[Mon Nov 10 18:50:46.830844 2025] [:error] [pid 14751:tid 14778] [client 165.227.170.149:58254] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRHDhgh14wwHxi74rrWYiAAAABU"]
[Mon Nov 10 19:29:00.274677 2025] [:error] [pid 37029:tid 37045] [client 165.227.170.149:51995] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRHMfGvEip1TAWJ5NqdutQAAAAo"]
[Mon Nov 10 20:07:14.821570 2025] [:error] [pid 62829:tid 62856] [client 165.227.170.149:61867] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRHVcvVqf4g8NgTiNHZt7QAAARg"]
[Mon Nov 10 20:45:38.275023 2025] [:error] [pid 34820:tid 34825] [client 165.227.170.149:55485] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRHecmK3qvhYIA1ghWDCVwAAAQM"]
[Mon Nov 10 21:23:54.079348 2025] [:error] [pid 31029:tid 31052] [client 165.227.170.149:49458] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRHnagaWYU_3FzBvTGj4hwAAAAM"]
[Mon Nov 10 22:02:13.855510 2025] [:error] [pid 31030:tid 31085] [client 165.227.170.149:59435] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRHwZTdQpWeECLLAfnZnmwAAAEk"]
[Mon Nov 10 22:40:20.575627 2025] [:error] [pid 31029:tid 31057] [client 165.227.170.149:52961] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRH5VAaWYU_3FzBvTGgOlAAAAAg"]
[Mon Nov 10 23:18:53.174982 2025] [:error] [pid 31031:tid 31120] [client 165.227.170.149:62980] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRICXXI8L5KZTd8nCaaqsgAAAJE"]
[Mon Nov 10 23:46:18.098238 2025] [autoindex:error] [pid 31030:tid 31076] [client 196.251.85.129:58795] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 10 23:57:18.288727 2025] [:error] [pid 34820:tid 34838] [client 165.227.170.149:56643] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRILXmK3qvhYIA1ghWAQ5wAAARA"]
[Tue Nov 11 00:35:37.175280 2025] [:error] [pid 31985:tid 32008] [client 165.227.170.149:50223] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRIUWZeXIbTtCYJNJFB3TQAAAQA"]
[Tue Nov 11 00:56:51.336461 2025] [:error] [pid 41839:tid 41937] [client 91.92.242.56:64694] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/wp-content/debug.log"] [unique_id "aRIZUzGxg5uCD9Nfh5W4WAAAAJc"]
[Tue Nov 11 01:13:45.775895 2025] [:error] [pid 24225:tid 24257] [client 165.227.170.149:60205] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRIdSZ2rrdiHvhXEioVw-QAAAlg"]
[Tue Nov 11 01:20:52.988550 2025] [:error] [pid 14120:tid 14127] [client 91.92.242.56:64317] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRIe9CT8OKKuPaCGMt0foQAAAUU"]
[Tue Nov 11 01:27:35.899230 2025] [:error] [pid 24225:tid 24247] [client 91.92.242.56:57124] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRIgh52rrdiHvhXEioVz5AAAAk4"]
[Tue Nov 11 01:27:37.169354 2025] [:error] [pid 24554:tid 24559] [client 91.92.242.56:63470] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRIgiRbgcg5JFvN-BGVvUAAAAsE"]
[Tue Nov 11 01:27:38.233379 2025] [:error] [pid 41839:tid 41926] [client 91.92.242.56:49417] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRIgijGxg5uCD9Nfh5XCkgAAAIw"]
[Tue Nov 11 01:27:39.306844 2025] [:error] [pid 24225:tid 24240] [client 91.92.242.56:51740] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIgi52rrdiHvhXEioVz5gAAAkc"]
[Tue Nov 11 01:27:41.372390 2025] [:error] [pid 41839:tid 41932] [client 91.92.242.56:54237] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRIgjTGxg5uCD9Nfh5XCmQAAAJI"]
[Tue Nov 11 01:27:42.440387 2025] [:error] [pid 41978:tid 42010] [client 91.92.242.56:58894] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIgjpTXUiwDnS4PcJ9IKQAAANA"]
[Tue Nov 11 01:27:43.506293 2025] [:error] [pid 24554:tid 24565] [client 91.92.242.56:60982] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIgjxbgcg5JFvN-BGVvWQAAAsc"]
[Tue Nov 11 01:27:44.590468 2025] [:error] [pid 24554:tid 24563] [client 91.92.242.56:63556] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRIgkBbgcg5JFvN-BGVvXAAAAsU"]
[Tue Nov 11 01:27:46.860190 2025] [:error] [pid 24103:tid 24116] [client 91.92.242.56:49865] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRIgkrmrGVWhZHx4njJA6wAAAgo"]
[Tue Nov 11 01:52:15.157978 2025] [:error] [pid 24225:tid 24239] [client 165.227.170.149:53957] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRImT52rrdiHvhXEioV8wAAAAkY"]
[Tue Nov 11 02:30:33.599194 2025] [:error] [pid 41825:tid 41908] [client 165.227.170.149:64033] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRIvSYr5hkwmQG_pQgAiYwAAAFU"]
[Tue Nov 11 03:09:08.774638 2025] [:error] [pid 24554:tid 24567] [client 165.227.170.149:57502] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRI4VBbgcg5JFvN-BGWHUwAAAsk"]
[Tue Nov 11 03:46:33.612777 2025] [:error] [pid 63955:tid 63961] [client 165.227.170.149:51348] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRJBGYL_Ma0cIjDhjt0hegAAAME"]
[Tue Nov 11 04:24:59.074673 2025] [:error] [pid 43436:tid 43467] [client 165.227.170.149:60812] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRJKG9uzjoymDUxEiDgPWgAAAEA"]
[Tue Nov 11 05:03:47.074867 2025] [:error] [pid 43523:tid 43543] [client 165.227.170.149:54616] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRJTM0pV__NXz9WhMIat0gAAANE"]
[Tue Nov 11 05:42:12.774909 2025] [:error] [pid 33932:tid 33979] [client 165.227.170.149:64788] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRJcNJdn2hP2rg5PoHI9KAAAAUw"]
[Tue Nov 11 06:20:38.775075 2025] [:error] [pid 34002:tid 34012] [client 165.227.170.149:58130] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRJlNtNx46Ag0u620oq61QAAAAY"]
[Tue Nov 11 06:58:55.458456 2025] [:error] [pid 57437:tid 57460] [client 165.227.170.149:51408] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRJuL-xevBIdHxHQtFqMcgAAAFM"]
[Tue Nov 11 07:36:48.478679 2025] [:error] [pid 33932:tid 33976] [client 165.227.170.149:60820] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRJ3EJdn2hP2rg5PoHJunAAAAUk"]
[Tue Nov 11 08:11:21.268946 2025] [:error] [pid 33888:tid 33912] [client 91.92.242.56:65361] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/wp-content/debug.log"] [unique_id "aRJ_KYhA0uVBNwBRvPoiJgAAAJU"]
[Tue Nov 11 08:15:10.475074 2025] [:error] [pid 33888:tid 33894] [client 165.227.170.149:54329] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRKADohA0uVBNwBRvPojhQAAAIM"]
[Tue Nov 11 08:34:12.520476 2025] [:error] [pid 33932:tid 33976] [client 91.92.242.56:65232] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRKEhJdn2hP2rg5PoHKHbgAAAUk"]
[Tue Nov 11 08:42:04.523423 2025] [:error] [pid 19436:tid 19450] [client 91.92.242.56:56686] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRKGXIDAvO-suY2r0aRujAAAAck"]
[Tue Nov 11 08:42:05.598767 2025] [:error] [pid 33932:tid 33980] [client 91.92.242.56:54850] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRKGXZdn2hP2rg5PoHKJtAAAAU0"]
[Tue Nov 11 08:42:06.674472 2025] [:error] [pid 20101:tid 20120] [client 91.92.242.56:59490] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRKGXvSZnd_J7V4i60JBeQAAAtE"]
[Tue Nov 11 08:42:07.750764 2025] [:error] [pid 33888:tid 33891] [client 91.92.242.56:56758] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRKGX4hA0uVBNwBRvPosFAAAAIA"]
[Tue Nov 11 08:42:08.827411 2025] [:error] [pid 34002:tid 34010] [client 91.92.242.56:64944] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRKGYNNx46Ag0u620or7igAAAAQ"]
[Tue Nov 11 08:42:09.918048 2025] [:error] [pid 19756:tid 19776] [client 91.92.242.56:65055] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRKGYekAxCY2xqQFnfoEBAAAAlI"]
[Tue Nov 11 08:42:10.993543 2025] [:error] [pid 19909:tid 19924] [client 91.92.242.56:61887] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRKGYpj4ijhm0fzOSagZMgAAAos"]
[Tue Nov 11 08:42:12.079658 2025] [:error] [pid 34002:tid 34029] [client 91.92.242.56:60431] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRKGZNNx46Ag0u620or7jwAAABc"]
[Tue Nov 11 08:42:13.156974 2025] [:error] [pid 33932:tid 33980] [client 91.92.242.56:59677] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRKGZZdn2hP2rg5PoHKJvAAAAU0"]
[Tue Nov 11 08:53:31.158477 2025] [:error] [pid 43302:tid 43365] [client 165.227.170.149:64613] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRKJC2EQ_QxM45F1aJHa0AAAAIQ"]
[Tue Nov 11 09:32:05.079073 2025] [:error] [pid 53356:tid 53407] [client 165.227.170.149:57962] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRKSFekdmt0kzjVcUN8z8wAAAFY"]
[Tue Nov 11 10:10:30.198241 2025] [:error] [pid 59670:tid 59681] [client 165.227.170.149:51822] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRKbFqk2Cnts0y-hpfpw0wAAAIg"]
[Tue Nov 11 10:48:53.478678 2025] [:error] [pid 59670:tid 59694] [client 165.227.170.149:61687] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRKkFak2Cnts0y-hpfqHVgAAAJU"]
[Tue Nov 11 11:26:57.174447 2025] [:error] [pid 59670:tid 59691] [client 165.227.170.149:55322] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRKtAak2Cnts0y-hpfqbNgAAAJI"]
[Tue Nov 11 12:05:22.327251 2025] [:error] [pid 53355:tid 53374] [client 165.227.170.149:65413] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRK2AoB5X5A3rMc4_nD4XwAAABA"]
[Tue Nov 11 12:07:57.382104 2025] [:error] [pid 53414:tid 53429] [client 213.209.143.137:51212] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2nQs6pHd_Z5oc1ecy-wAAAQ0"]
[Tue Nov 11 12:07:57.907197 2025] [:error] [pid 59670:tid 59686] [client 213.209.143.137:53105] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2nak2Cnts0y-hpfqywQAAAI0"]
[Tue Nov 11 12:08:17.987794 2025] [:error] [pid 59670:tid 59690] [client 213.209.143.137:55117] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/baiduseo/readme.txt"] [unique_id "aRK2sak2Cnts0y-hpfqzAwAAAJE"]
[Tue Nov 11 12:08:18.553179 2025] [:error] [pid 53356:tid 53399] [client 213.209.143.137:53181] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/baiduseo/readme.txt"] [unique_id "aRK2sukdmt0kzjVcUN9mlwAAAE4"]
[Tue Nov 11 12:08:19.072669 2025] [:error] [pid 53414:tid 53417] [client 213.209.143.137:54641] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/baiduseo/readme.txt"] [unique_id "aRK2sws6pHd_Z5oc1eczPwAAAQE"]
[Tue Nov 11 12:08:22.725879 2025] [:error] [pid 59670:tid 59679] [client 213.209.143.137:56385] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aRK2tqk2Cnts0y-hpfqzFAAAAIY"]
[Tue Nov 11 12:08:23.249042 2025] [:error] [pid 53356:tid 53402] [client 213.209.143.137:50343] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aRK2t-kdmt0kzjVcUN9mpAAAAFE"]
[Tue Nov 11 12:08:23.768640 2025] [:error] [pid 53449:tid 53469] [client 213.209.143.137:51675] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aRK2t9pz08j5NoUSzp_sdQAAAU8"]
[Tue Nov 11 12:08:24.291584 2025] [:error] [pid 53449:tid 53459] [client 213.209.143.137:53198] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/adforest/style.css"] [unique_id "aRK2uNpz08j5NoUSzp_seAAAAUU"]
[Tue Nov 11 12:43:53.073547 2025] [:error] [pid 53449:tid 53465] [client 165.227.170.149:58929] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRK_Cdpz08j5NoUSzp_59wAAAUs"]
[Tue Nov 11 13:22:13.194454 2025] [:error] [pid 59670:tid 59697] [client 165.227.170.149:52585] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRLIBak2Cnts0y-hpfrYzwAAAJg"]
[Tue Nov 11 14:00:30.533460 2025] [:error] [pid 53449:tid 53468] [client 165.227.170.149:62727] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRLQ_tpz08j5NoUSzp8ZDQAAAU4"]
[Tue Nov 11 14:38:39.775105 2025] [:error] [pid 53356:tid 53406] [client 165.227.170.149:56216] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRLZ7-kdmt0kzjVcUN-bcAAAAFU"]
[Tue Nov 11 15:16:49.732267 2025] [:error] [pid 53355:tid 53372] [client 165.227.170.149:49877] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRLi4YB5X5A3rMc4_nA6uAAAAA4"]
[Tue Nov 11 15:17:10.542714 2025] [autoindex:error] [pid 53449:tid 53474] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:10.641301 2025] [autoindex:error] [pid 53449:tid 53469] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/shortcode/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:10.736180 2025] [autoindex:error] [pid 53449:tid 53471] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:10.830826 2025] [autoindex:error] [pid 53449:tid 53455] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/languages/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:10.928019 2025] [autoindex:error] [pid 53449:tid 53466] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/list-reusable-blocks/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:11.026051 2025] [autoindex:error] [pid 53449:tid 53472] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/src/Auth/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:11.121758 2025] [autoindex:error] [pid 53449:tid 53476] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:11.224862 2025] [autoindex:error] [pid 53449:tid 53460] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:11.321032 2025] [autoindex:error] [pid 53449:tid 53461] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/site-logo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:13.456189 2025] [autoindex:error] [pid 53449:tid 53464] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:15.325904 2025] [autoindex:error] [pid 53449:tid 53454] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/plugins/elementor/assets/images/app/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:15.423738 2025] [autoindex:error] [pid 53449:tid 53474] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/loginout/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:15.517631 2025] [autoindex:error] [pid 53449:tid 53469] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:15.612898 2025] [autoindex:error] [pid 53449:tid 53471] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:16.959694 2025] [autoindex:error] [pid 53449:tid 53472] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.071663 2025] [autoindex:error] [pid 53449:tid 53467] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.170921 2025] [autoindex:error] [pid 53449:tid 53477] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.280063 2025] [autoindex:error] [pid 53449:tid 53454] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.374706 2025] [autoindex:error] [pid 53449:tid 53474] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.494167 2025] [autoindex:error] [pid 53449:tid 53469] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.595394 2025] [autoindex:error] [pid 53449:tid 53459] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.691174 2025] [autoindex:error] [pid 53449:tid 53455] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.790718 2025] [autoindex:error] [pid 53449:tid 53472] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:22.984689 2025] [autoindex:error] [pid 53449:tid 53466] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/latest-comments/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:24.351836 2025] [autoindex:error] [pid 53449:tid 53475] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:25.723601 2025] [autoindex:error] [pid 53449:tid 53477] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:25.820324 2025] [autoindex:error] [pid 53449:tid 53454] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:25.918016 2025] [autoindex:error] [pid 53449:tid 53474] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/src/Core32/Poly1305/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:26.012211 2025] [autoindex:error] [pid 53449:tid 53469] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/post-author/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:26.114073 2025] [autoindex:error] [pid 53449:tid 53459] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:26.212501 2025] [autoindex:error] [pid 53449:tid 53455] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:26.308893 2025] [autoindex:error] [pid 53449:tid 53472] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/customize-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:27.631696 2025] [autoindex:error] [pid 53449:tid 53464] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:27.728928 2025] [autoindex:error] [pid 53449:tid 53478] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:29.038164 2025] [autoindex:error] [pid 53449:tid 53454] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:31.699785 2025] [autoindex:error] [pid 53449:tid 53473] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:33.059751 2025] [autoindex:error] [pid 53449:tid 53463] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:33.155564 2025] [autoindex:error] [pid 53449:tid 53468] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:33.250957 2025] [autoindex:error] [pid 53449:tid 53467] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:33.346796 2025] [autoindex:error] [pid 53449:tid 53471] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/namespaced/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:34.791355 2025] [autoindex:error] [pid 53449:tid 53472] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:34.889734 2025] [autoindex:error] [pid 53449:tid 53474] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:36.506612 2025] [autoindex:error] [pid 53449:tid 53460] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:37.971391 2025] [autoindex:error] [pid 53449:tid 53456] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:38.069788 2025] [autoindex:error] [pid 53449:tid 53478] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:39.364154 2025] [autoindex:error] [pid 53449:tid 53466] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:39.560730 2025] [autoindex:error] [pid 53449:tid 53467] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:39.654717 2025] [autoindex:error] [pid 53449:tid 53465] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:39.850983 2025] [autoindex:error] [pid 53449:tid 53457] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/more/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:42.576437 2025] [autoindex:error] [pid 53449:tid 53461] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:43.940570 2025] [autoindex:error] [pid 53449:tid 53466] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:44.035090 2025] [autoindex:error] [pid 53449:tid 53467] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/swfupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:44.130153 2025] [autoindex:error] [pid 53449:tid 53465] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:45.445943 2025] [autoindex:error] [pid 53449:tid 53455] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:46.737078 2025] [autoindex:error] [pid 53449:tid 53476] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:46.832895 2025] [autoindex:error] [pid 53449:tid 53477] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:49.645158 2025] [autoindex:error] [pid 53449:tid 53461] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:52.126862 2025] [autoindex:error] [pid 53449:tid 53456] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:52.221906 2025] [autoindex:error] [pid 53449:tid 53473] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:54.712340 2025] [autoindex:error] [pid 53449:tid 53467] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:57.174649 2025] [autoindex:error] [pid 53449:tid 53476] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:57.268936 2025] [autoindex:error] [pid 53449:tid 53475] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:58.585807 2025] [autoindex:error] [pid 53449:tid 53470] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:58.680972 2025] [autoindex:error] [pid 53449:tid 53461] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:17:59.980001 2025] [autoindex:error] [pid 53449:tid 53460] [client 194.5.82.94:24449] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:02.879319 2025] [autoindex:error] [pid 53356:tid 53397] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:02.974975 2025] [autoindex:error] [pid 53356:tid 53400] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:05.543949 2025] [autoindex:error] [pid 53356:tid 53387] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:11.927155 2025] [autoindex:error] [pid 53356:tid 53399] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/embed/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:13.473816 2025] [autoindex:error] [pid 53356:tid 53386] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:13.568907 2025] [autoindex:error] [pid 53356:tid 53407] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/languages/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:13.662569 2025] [autoindex:error] [pid 53356:tid 53393] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:16.873151 2025] [autoindex:error] [pid 53356:tid 53385] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:16.968198 2025] [autoindex:error] [pid 53356:tid 53408] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:18.330224 2025] [autoindex:error] [pid 53356:tid 53396] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:18.423891 2025] [autoindex:error] [pid 53356:tid 53388] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:18:23.526504 2025] [autoindex:error] [pid 53356:tid 53404] [client 194.5.82.95:26595] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 15:53:49.967842 2025] [:error] [pid 53414:tid 53440] [client 165.227.170.149:60038] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRLrjQs6pHd_Z5oc1eeDhAAAARg"]
[Tue Nov 11 16:32:18.047616 2025] [:error] [pid 36673:tid 36691] [client 165.227.170.149:53530] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRL0kivASiSDHs9bkffXEAAAAJA"]
[Tue Nov 11 17:10:36.318844 2025] [:error] [pid 36580:tid 36647] [client 165.227.170.149:63606] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRL9jJaaFQZGE3H9yOGoDAAAAEk"]
[Tue Nov 11 17:48:58.534897 2025] [:error] [pid 36673:tid 36686] [client 165.227.170.149:57488] [client 165.227.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.170.149, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aRMGiivASiSDHs9bkffqYgAAAIs"]
[Tue Nov 11 21:06:43.606646 2025] [:error] [pid 36673:tid 36683] [client 45.8.132.219:50344] [client 45.8.132.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.8.132.219, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRM04yvASiSDHs9bkfcjXAAAAIg"], referer: binance.com
[Tue Nov 11 21:06:51.115699 2025] [:error] [pid 36673:tid 36687] [client 45.8.132.219:53911] [client 45.8.132.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.8.132.219, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRM06yvASiSDHs9bkfcjZwAAAIw"]
[Tue Nov 11 21:06:53.444916 2025] [:error] [pid 36578:tid 36588] [client 45.8.132.219:58017] [client 45.8.132.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.8.132.219, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRM07UMi03XeylcOo5XlWQAAAMU"]
[Tue Nov 11 21:06:55.755672 2025] [:error] [pid 36578:tid 36596] [client 45.8.132.219:57360] [client 45.8.132.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.8.132.219, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRM070Mi03XeylcOo5XlYgAAAM0"]
[Tue Nov 11 21:06:58.047643 2025] [:error] [pid 43205:tid 43232] [client 45.8.132.219:57371] [client 45.8.132.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.8.132.219, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRM08r48SbhIkX6TjwOqNQAAARg"]
[Tue Nov 11 22:11:08.214754 2025] [:error] [pid 47860:tid 47898] [client 213.209.143.137:62380] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRND_KPe6bkmJWx80CzSrwAAAEc"]
[Tue Nov 11 22:11:08.736625 2025] [:error] [pid 47860:tid 47913] [client 213.209.143.137:63624] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRND_KPe6bkmJWx80CzSsgAAAFY"]
[Tue Nov 11 22:11:09.259004 2025] [:error] [pid 47859:tid 47873] [client 213.209.143.137:65519] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRND_aRzLR7egYHK_4d6kAAAAAk"]
[Tue Nov 11 22:11:09.809756 2025] [:error] [pid 47964:tid 47976] [client 213.209.143.137:51432] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aRND_V6CQC3ebUS5pkQDswAAAYk"]
[Wed Nov 12 00:39:05.216857 2025] [:error] [pid 54701:tid 54987] [client 194.5.82.35:28113] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aRNmqRf-2zu56UfbUVKuSQAAAUI"]
[Wed Nov 12 00:39:16.316647 2025] [:error] [pid 54701:tid 54998] [client 194.5.82.17:59363] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aRNmtBf-2zu56UfbUVKuXwAAAU0"]
[Wed Nov 12 00:40:00.297597 2025] [:error] [pid 55206:tid 55210] [client 194.5.82.38:37343] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aRNm4O_aSLXgYkIZYTILkQAAAII"]
[Wed Nov 12 00:40:24.647988 2025] [:error] [pid 54700:tid 54938] [client 194.5.82.40:32415] [client 194.5.82.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aRNm-GB5AaOtkwsSKTr-6AAAAEI"]
[Wed Nov 12 00:40:32.640826 2025] [:error] [pid 55206:tid 55219] [client 194.5.82.166:47421] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aRNnAO_aSLXgYkIZYTIL0QAAAIs"]
[Wed Nov 12 00:41:24.195186 2025] [:error] [pid 55206:tid 55228] [client 194.5.82.27:37519] [client 194.5.82.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.5.82.27, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRNnNO_aSLXgYkIZYTIMSwAAAJQ"]
[Wed Nov 12 00:41:39.834708 2025] [:error] [pid 55206:tid 55227] [client 194.5.82.27:37519] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/chosen.php"] [unique_id "aRNnQ-_aSLXgYkIZYTIMdgAAAJM"]
[Wed Nov 12 00:41:51.692266 2025] [:error] [pid 10618:tid 10632] [client 194.5.82.44:56543] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aRNnT9wQBPCH2K2NYdioTgAAAAo"]
[Wed Nov 12 00:42:31.985328 2025] [:error] [pid 54701:tid 55007] [client 194.5.82.7:40571] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aRNndxf-2zu56UfbUVKvpQAAAVU"]
[Wed Nov 12 00:42:40.030601 2025] [:error] [pid 10618:tid 10622] [client 194.5.82.20:40723] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-atom.php"] [unique_id "aRNngNwQBPCH2K2NYdioxwAAAAA"]
[Wed Nov 12 00:42:51.694777 2025] [:error] [pid 54702:tid 55026] [client 194.5.82.50:57893] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aRNni4Cgou0IW-jKFfmNDgAAAYw"]
[Wed Nov 12 00:42:58.896704 2025] [:error] [pid 54702:tid 55017] [client 194.5.82.23:51699] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aRNnkoCgou0IW-jKFfmNGgAAAYM"]
[Wed Nov 12 00:43:15.939051 2025] [:error] [pid 54702:tid 55023] [client 194.5.82.44:58217] [client 194.5.82.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aRNno4Cgou0IW-jKFfmNLgAAAYk"]
[Wed Nov 12 00:43:51.472876 2025] [:error] [pid 55206:tid 55232] [client 194.5.82.53:51875] [client 194.5.82.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aRNnx-_aSLXgYkIZYTINJAAAAJg"]
[Wed Nov 12 00:44:21.962466 2025] [:error] [pid 10618:tid 10636] [client 194.5.82.15:55837] [client 194.5.82.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aRNn5dwQBPCH2K2NYdipfwAAAA4"]
[Wed Nov 12 00:44:22.381767 2025] [:error] [pid 55206:tid 55212] [client 194.5.82.28:59795] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aRNn5u_aSLXgYkIZYTINSQAAAIQ"]
[Wed Nov 12 00:44:28.639659 2025] [:error] [pid 54702:tid 55017] [client 194.5.82.52:42113] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aRNn7ICgou0IW-jKFfmNegAAAYM"]
[Wed Nov 12 00:44:34.896760 2025] [:error] [pid 54701:tid 55005] [client 194.5.82.23:44621] [client 194.5.82.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aRNn8hf-2zu56UfbUVKwZAAAAVM"]
[Wed Nov 12 00:44:39.365478 2025] [:error] [pid 10618:tid 10628] [client 194.5.82.18:52181] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aRNn99wQBPCH2K2NYdip0wAAAAY"]
[Wed Nov 12 00:44:39.652744 2025] [proxy_fcgi:error] [pid 54701:tid 55006] [client 194.5.82.36:26555] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 00:44:41.385965 2025] [:error] [pid 54701:tid 55000] [client 194.5.82.36:26555] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aRNn-Rf-2zu56UfbUVKwcQAAAU8"]
[Wed Nov 12 00:44:46.074408 2025] [:error] [pid 55206:tid 55211] [client 194.5.82.36:29813] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aRNn_u_aSLXgYkIZYTINpwAAAIM"]
[Wed Nov 12 00:45:14.723660 2025] [:error] [pid 54701:tid 54994] [client 194.5.82.38:52267] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aRNoGhf-2zu56UfbUVKwswAAAUk"]
[Wed Nov 12 00:45:30.220464 2025] [:error] [pid 54700:tid 54936] [client 194.5.82.39:51807] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/niil.php"] [unique_id "aRNoKmB5AaOtkwsSKToAUQAAAEA"]
[Wed Nov 12 00:45:39.554449 2025] [proxy_fcgi:error] [pid 54701:tid 54992] [client 194.5.82.42:36447] AH01071: Got error 'PHP message: WordPress database error The total number of locks exceeds the lock table size for query UPDATE `wp_options` SET `option_value` = 'a:215:{s:19:\\"voucher_template/?$\\";s:36:\\"index.php?post_type=voucher_template\\";s:49:\\"voucher_template/feed/(feed|rdf|rss|rss2|atom)/?$\\";s:53:\\"index.php?post_type=voucher_template&feed=$matches[1]\\";s:44:\\"voucher_template/(feed|rdf|rss|rss2|atom)/?$\\";s:53:\\"index.php?post_type=voucher_template&feed=$matches[1]\\";s:36:\\"voucher_template/page/([0-9]{1,})/?$\\";s:54:\\"index.php?post_type=voucher_template&paged=$matches[1]\\";s:11:\\"^wp-json/?$\\";s:22:\\"index.php?rest_route=/\\";s:14:\\"^wp-json/(.*)?\\";s:33:\\"index.php?rest_route=/$matches[1]\\";s:21:\\"^index.php/wp-json/?$\\";s:22:\\"index.php?rest_route=/\\";s:24:\\"^index.php/wp-json/(.*)?\\";s:33:\\"index.php?rest_route=/$matches[1]\\";s:22:\\"cosmetic-procedures/?$\\";s:29:\\"index.php?post_type=procedure\\";s:52:\\"cosmetic-procedures/feed/(feed|rdf|rss|rss2|atom)/?$\\";s:46:\\"index.php?post_type=procedure&feed=$m...'
[Wed Nov 12 00:45:41.079648 2025] [proxy_fcgi:error] [pid 54701:tid 54990] [client 194.5.82.42:36447] AH01071: Got error 'PHP message: WordPress database error The total number of locks exceeds the lock table size for query UPDATE `wp_options` SET `option_value` = 'a:215:{s:19:\\"voucher_template/?$\\";s:36:\\"index.php?post_type=voucher_template\\";s:49:\\"voucher_template/feed/(feed|rdf|rss|rss2|atom)/?$\\";s:53:\\"index.php?post_type=voucher_template&feed=$matches[1]\\";s:44:\\"voucher_template/(feed|rdf|rss|rss2|atom)/?$\\";s:53:\\"index.php?post_type=voucher_template&feed=$matches[1]\\";s:36:\\"voucher_template/page/([0-9]{1,})/?$\\";s:54:\\"index.php?post_type=voucher_template&paged=$matches[1]\\";s:11:\\"^wp-json/?$\\";s:22:\\"index.php?rest_route=/\\";s:14:\\"^wp-json/(.*)?\\";s:33:\\"index.php?rest_route=/$matches[1]\\";s:21:\\"^index.php/wp-json/?$\\";s:22:\\"index.php?rest_route=/\\";s:24:\\"^index.php/wp-json/(.*)?\\";s:33:\\"index.php?rest_route=/$matches[1]\\";s:22:\\"cosmetic-procedures/?$\\";s:29:\\"index.php?post_type=procedure\\";s:52:\\"cosmetic-procedures/feed/(feed|rdf|rss|rss2|atom)/?$\\";s:46:\\"index.php?post_type=procedure&feed=$m...'
[Wed Nov 12 00:45:51.819887 2025] [:error] [pid 54701:tid 54994] [client 194.5.82.42:36447] [client 194.5.82.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aRNoPxf-2zu56UfbUVKxDAAAAUk"]
[Wed Nov 12 00:45:55.890974 2025] [:error] [pid 55206:tid 55225] [client 194.5.82.39:34673] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aRNoQ-_aSLXgYkIZYTIOIgAAAJE"]
[Wed Nov 12 00:46:22.711920 2025] [:error] [pid 10618:tid 10638] [client 194.5.82.26:64071] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aRNoXtwQBPCH2K2NYdiqtQAAABA"]
[Wed Nov 12 00:46:32.535579 2025] [:error] [pid 54700:tid 54943] [client 194.5.82.17:52739] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/ff2.php"] [unique_id "aRNoaGB5AaOtkwsSKToAugAAAEY"]
[Wed Nov 12 00:46:43.735945 2025] [:error] [pid 54701:tid 55004] [client 194.5.82.4:58819] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aRNocxf-2zu56UfbUVKxSwAAAVI"]
[Wed Nov 12 00:46:50.732514 2025] [:error] [pid 10618:tid 10643] [client 194.5.82.43:32615] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aRNoetwQBPCH2K2NYdiq9gAAABU"]
[Wed Nov 12 00:46:56.940769 2025] [:error] [pid 54700:tid 54953] [client 194.5.82.37:61073] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aRNogGB5AaOtkwsSKToA1gAAAFA"]
[Wed Nov 12 00:47:03.699450 2025] [:error] [pid 10618:tid 10635] [client 194.5.82.27:35059] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aRNoh9wQBPCH2K2NYdirOwAAAA0"]
[Wed Nov 12 00:47:05.294038 2025] [:error] [pid 54701:tid 54994] [client 194.5.82.39:53287] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aRNoiRf-2zu56UfbUVKxfgAAAUk"]
[Wed Nov 12 00:47:12.163282 2025] [proxy_fcgi:error] [pid 54701:tid 55007] [client 194.5.82.17:41833] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 00:47:12.276588 2025] [:error] [pid 54701:tid 54995] [client 194.5.82.17:41833] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aRNokBf-2zu56UfbUVKxmgAAAUo"]
[Wed Nov 12 00:47:17.324438 2025] [:error] [pid 10618:tid 10623] [client 194.5.82.36:33181] [client 194.5.82.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/ff2.php"] [unique_id "aRNoldwQBPCH2K2NYdirUQAAAAE"]
[Wed Nov 12 00:47:31.712021 2025] [:error] [pid 54701:tid 54988] [client 194.5.82.7:44799] [client 194.5.82.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aRNooxf-2zu56UfbUVKxvgAAAUM"]
[Wed Nov 12 00:47:33.816122 2025] [:error] [pid 54700:tid 54953] [client 194.5.82.20:33549] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aRNopWB5AaOtkwsSKToBFAAAAFA"]
[Wed Nov 12 00:47:47.366518 2025] [proxy_fcgi:error] [pid 10618:tid 10637] [client 194.5.82.9:49205] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 00:48:13.155520 2025] [:error] [pid 10618:tid 10630] [client 194.5.82.9:49205] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/class-walker-category.php"] [unique_id "aRNozdwQBPCH2K2NYdir2gAAAAg"]
[Wed Nov 12 00:48:14.974593 2025] [:error] [pid 10618:tid 10635] [client 194.5.82.45:29589] [client 194.5.82.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aRNoztwQBPCH2K2NYdir4AAAAA0"]
[Wed Nov 12 00:48:29.306885 2025] [proxy_fcgi:error] [pid 54701:tid 55005] [client 194.5.82.32:31063] AH01071: Got error 'Primary script unknown'
[Wed Nov 12 00:48:36.476548 2025] [:error] [pid 54701:tid 54991] [client 194.5.82.32:31063] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aRNo5Bf-2zu56UfbUVKyEAAAAUY"]
[Wed Nov 12 00:48:36.781076 2025] [:error] [pid 54702:tid 55022] [client 194.5.82.165:53883] [client 194.5.82.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/class-wp-block-pattern-categories-registry.php"] [unique_id "aRNo5ICgou0IW-jKFfmPMQAAAYg"]
[Wed Nov 12 00:48:48.599336 2025] [autoindex:error] [pid 55206:tid 55217] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:48.931110 2025] [autoindex:error] [pid 55206:tid 55228] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/shortcode/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:49.161120 2025] [autoindex:error] [pid 55206:tid 55230] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:49.540164 2025] [autoindex:error] [pid 55206:tid 55225] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/languages/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:49.787549 2025] [autoindex:error] [pid 55206:tid 55221] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/list-reusable-blocks/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:50.128324 2025] [autoindex:error] [pid 55206:tid 55228] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/src/Auth/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:50.255796 2025] [autoindex:error] [pid 55206:tid 55209] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:50.425471 2025] [autoindex:error] [pid 55206:tid 55230] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:50.833185 2025] [autoindex:error] [pid 55206:tid 55208] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/site-logo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:53.336997 2025] [autoindex:error] [pid 55206:tid 55209] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:56.127683 2025] [autoindex:error] [pid 55206:tid 55229] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/plugins/elementor/assets/images/app/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:56.283287 2025] [autoindex:error] [pid 55206:tid 55208] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/loginout/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:56.425923 2025] [autoindex:error] [pid 55206:tid 55218] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:56.603368 2025] [autoindex:error] [pid 55206:tid 55225] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:48:58.412554 2025] [autoindex:error] [pid 55206:tid 55226] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:05.476105 2025] [autoindex:error] [pid 55206:tid 55215] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:05.634989 2025] [autoindex:error] [pid 55206:tid 55210] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:05.936612 2025] [autoindex:error] [pid 55206:tid 55223] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:06.072978 2025] [autoindex:error] [pid 55206:tid 55226] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:06.295834 2025] [autoindex:error] [pid 55206:tid 55212] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:06.502682 2025] [autoindex:error] [pid 55206:tid 55217] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:06.698157 2025] [autoindex:error] [pid 55206:tid 55224] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:06.995625 2025] [autoindex:error] [pid 55206:tid 55230] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:07.556183 2025] [autoindex:error] [pid 55206:tid 55214] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/latest-comments/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:09.978260 2025] [autoindex:error] [pid 55206:tid 55208] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:13.240988 2025] [autoindex:error] [pid 55206:tid 55209] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:13.358979 2025] [autoindex:error] [pid 55206:tid 55214] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:13.495782 2025] [autoindex:error] [pid 55206:tid 55225] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/src/Core32/Poly1305/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:13.623396 2025] [autoindex:error] [pid 55206:tid 55232] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/post-author/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:13.897999 2025] [autoindex:error] [pid 55206:tid 55223] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:14.092324 2025] [autoindex:error] [pid 55206:tid 55226] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:14.218403 2025] [autoindex:error] [pid 55206:tid 55222] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/customize-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:16.150918 2025] [autoindex:error] [pid 55206:tid 55211] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:17.005171 2025] [autoindex:error] [pid 55206:tid 55229] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:18.777732 2025] [autoindex:error] [pid 55206:tid 55228] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:22.508556 2025] [autoindex:error] [pid 55206:tid 55228] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:24.019365 2025] [autoindex:error] [pid 55206:tid 55230] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:24.155777 2025] [autoindex:error] [pid 55206:tid 55209] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:24.306730 2025] [autoindex:error] [pid 55206:tid 55220] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:24.482696 2025] [autoindex:error] [pid 55206:tid 55212] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/namespaced/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:26.282154 2025] [autoindex:error] [pid 55206:tid 55231] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:26.425769 2025] [autoindex:error] [pid 55206:tid 55218] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:26.658500 2025] [autoindex:error] [pid 55206:tid 55227] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:28.488172 2025] [autoindex:error] [pid 55206:tid 55217] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:28.596792 2025] [autoindex:error] [pid 55206:tid 55228] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:30.135966 2025] [autoindex:error] [pid 55206:tid 55231] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:30.535255 2025] [autoindex:error] [pid 55206:tid 55232] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:30.647242 2025] [autoindex:error] [pid 55206:tid 55214] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:31.027413 2025] [autoindex:error] [pid 55206:tid 55224] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/more/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:35.014022 2025] [autoindex:error] [pid 55206:tid 55226] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:37.131787 2025] [autoindex:error] [pid 55206:tid 55231] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:37.297019 2025] [autoindex:error] [pid 55206:tid 55219] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/swfupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:37.756837 2025] [autoindex:error] [pid 55206:tid 55232] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:40.529563 2025] [autoindex:error] [pid 55206:tid 55209] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:42.406731 2025] [autoindex:error] [pid 55206:tid 55230] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:42.530059 2025] [autoindex:error] [pid 55206:tid 55213] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:44.378025 2025] [autoindex:error] [pid 55206:tid 55226] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:48.279622 2025] [autoindex:error] [pid 55206:tid 55227] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:48.404459 2025] [autoindex:error] [pid 55206:tid 55214] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:51.354831 2025] [autoindex:error] [pid 55206:tid 55215] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:54.558742 2025] [autoindex:error] [pid 55206:tid 55209] [client 194.5.82.29:46055] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:54.859261 2025] [autoindex:error] [pid 10618:tid 10644] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:58.339277 2025] [autoindex:error] [pid 10618:tid 10632] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:49:58.519897 2025] [autoindex:error] [pid 10618:tid 10637] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:02.949485 2025] [autoindex:error] [pid 10618:tid 10633] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:09.449599 2025] [autoindex:error] [pid 10618:tid 10627] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:09.588561 2025] [autoindex:error] [pid 10618:tid 10635] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:13.796417 2025] [autoindex:error] [pid 10618:tid 10627] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:24.353565 2025] [autoindex:error] [pid 10618:tid 10627] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/embed/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:26.490230 2025] [autoindex:error] [pid 10618:tid 10636] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:26.870408 2025] [autoindex:error] [pid 10618:tid 10626] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/languages/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:27.273385 2025] [autoindex:error] [pid 10618:tid 10627] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:31.202278 2025] [autoindex:error] [pid 10618:tid 10627] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:31.366580 2025] [autoindex:error] [pid 10618:tid 10642] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:33.460870 2025] [autoindex:error] [pid 10618:tid 10630] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:33.627298 2025] [autoindex:error] [pid 10618:tid 10631] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 00:50:42.346950 2025] [autoindex:error] [pid 10618:tid 10637] [client 194.5.82.51:33857] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 12 04:20:20.457736 2025] [:error] [pid 57312:tid 57334] [client 213.209.143.137:51207] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROahI0cuHgB17JK5qWd-QAAANE"]
[Wed Nov 12 04:20:20.974109 2025] [:error] [pid 57224:tid 57306] [client 213.209.143.137:54442] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROahBs7oZ7imwCSdAnnBQAAAJY"]
[Wed Nov 12 04:20:21.477967 2025] [:error] [pid 57312:tid 57324] [client 213.209.143.137:56888] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROahY0cuHgB17JK5qWd-wAAAMc"]
[Wed Nov 12 12:36:53.297213 2025] [:error] [pid 60405:tid 60415] [client 45.148.10.249:19604] [client 45.148.10.249] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/config/environment.json"] [unique_id "aRQO5XMGv_mlVi6mf5qFUgAAAAc"]
[Wed Nov 12 13:41:42.023795 2025] [:error] [pid 12744:tid 12750] [client 178.128.207.138:60138] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/@vite/env"] [unique_id "aRQeFp1cp_ouUvkFj0XdEQAAAQI"]
[Wed Nov 12 13:41:42.862729 2025] [:error] [pid 60180:tid 60190] [client 178.128.207.138:60148] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aRQeFlhgd7ccS8EZg1rnOwAAAUg"]
[Wed Nov 12 13:41:43.726510 2025] [:error] [pid 60180:tid 60189] [client 178.128.207.138:60156] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRQeF1hgd7ccS8EZg1rnPQAAAUc"]
[Wed Nov 12 13:41:44.479677 2025] [:error] [pid 60180:tid 60188] [client 178.128.207.138:60160] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aRQeGFhgd7ccS8EZg1rnQAAAAUY"]
[Wed Nov 12 13:41:45.233455 2025] [:error] [pid 12744:tid 12763] [client 178.128.207.138:43526] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aRQeGZ1cp_ouUvkFj0XdFwAAAQ8"]
[Wed Nov 12 13:41:46.062384 2025] [:error] [pid 60095:tid 60118] [client 178.128.207.138:43530] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aRQeGnlw2elroagFF1rmugAAAFM"]
[Wed Nov 12 13:41:46.808700 2025] [:error] [pid 60096:tid 60136] [client 178.128.207.138:43536] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aRQeGjmzkhCvvk8DXOxQdAAAAIo"]
[Wed Nov 12 13:41:47.863890 2025] [:error] [pid 60180:tid 60183] [client 178.128.207.138:43550] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aRQeG1hgd7ccS8EZg1rnSAAAAUE"]
[Wed Nov 12 13:41:49.210612 2025] [:error] [pid 60405:tid 60429] [client 178.128.207.138:43560] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRQeHXMGv_mlVi6mf5qfvQAAABU"]
[Wed Nov 12 13:41:50.557279 2025] [:error] [pid 60095:tid 60120] [client 178.128.207.138:43570] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aRQeHnlw2elroagFF1rmvQAAAFU"]
[Wed Nov 12 13:41:51.547893 2025] [:error] [pid 60097:tid 60172] [client 178.128.207.138:43582] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aRQeH8dT5oio_TbWpi8mFAAAANM"]
[Wed Nov 12 13:41:55.293893 2025] [:error] [pid 60180:tid 60199] [client 178.128.207.138:55582] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aRQeI1hgd7ccS8EZg1rnUwAAAVE"]
[Wed Nov 12 13:41:56.685864 2025] [:error] [pid 12744:tid 12750] [client 178.128.207.138:55584] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aRQeJJ1cp_ouUvkFj0XdNAAAAQI"]
[Wed Nov 12 13:41:57.866347 2025] [:error] [pid 60096:tid 60138] [client 178.128.207.138:55586] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aRQeJTmzkhCvvk8DXOxQdwAAAIw"]
[Wed Nov 12 13:41:59.328594 2025] [:error] [pid 12744:tid 12755] [client 178.128.207.138:55588] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRQeJ51cp_ouUvkFj0XdPQAAAQc"]
[Wed Nov 12 13:42:00.285625 2025] [:error] [pid 12744:tid 12764] [client 178.128.207.138:55596] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aRQeKJ1cp_ouUvkFj0XdQAAAARA"]
[Wed Nov 12 13:42:01.609378 2025] [:error] [pid 60097:tid 60171] [client 178.128.207.138:55608] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aRQeKcdT5oio_TbWpi8mKQAAANI"]
[Wed Nov 12 13:42:02.745665 2025] [:error] [pid 12744:tid 12769] [client 178.128.207.138:55618] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aRQeKp1cp_ouUvkFj0XdRwAAARU"]
[Wed Nov 12 13:42:04.038980 2025] [:error] [pid 12744:tid 12749] [client 178.128.207.138:55634] [client 178.128.207.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRQeLJ1cp_ouUvkFj0XdSwAAAQE"]
[Wed Nov 12 21:34:16.430900 2025] [:error] [pid 60096:tid 60127] [client 159.65.144.72:45744] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/actuator/env"] [unique_id "aRSM2DmzkhCvvk8DXOzCkgAAAIE"]
[Wed Nov 12 21:34:16.840378 2025] [:error] [pid 60096:tid 60145] [client 159.65.144.72:45752] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRSM2DmzkhCvvk8DXOzCkwAAAJA"]
[Wed Nov 12 21:34:17.263658 2025] [:error] [pid 60180:tid 60199] [client 159.65.144.72:45760] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server"] [unique_id "aRSM2Vhgd7ccS8EZg1pmLAAAAVE"]
[Wed Nov 12 21:34:17.702160 2025] [:error] [pid 23737:tid 23750] [client 159.65.144.72:45772] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aRSM2RQUsVVfOZWgW_XZRwAAAYE"]
[Wed Nov 12 21:34:18.139369 2025] [:error] [pid 60405:tid 60424] [client 159.65.144.72:45782] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about"] [unique_id "aRSM2nMGv_mlVi6mf5ohzwAAABA"]
[Wed Nov 12 21:34:18.549431 2025] [:error] [pid 23737:tid 23761] [client 159.65.144.72:45798] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug/default/view"] [unique_id "aRSM2hQUsVVfOZWgW_XZUQAAAYw"]
[Wed Nov 12 21:34:18.944713 2025] [:error] [pid 60096:tid 60126] [client 159.65.144.72:45810] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/_catalog"] [unique_id "aRSM2jmzkhCvvk8DXOzClwAAAIA"]
[Wed Nov 12 21:34:19.341328 2025] [:error] [pid 60096:tid 60138] [client 159.65.144.72:45812] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRSM2zmzkhCvvk8DXOzCmAAAAIw"]
[Wed Nov 12 21:34:19.778939 2025] [:error] [pid 23737:tid 23749] [client 159.65.144.72:45824] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-status"] [unique_id "aRSM2xQUsVVfOZWgW_XZYAAAAYA"]
[Wed Nov 12 21:34:20.176003 2025] [:error] [pid 60095:tid 60106] [client 159.65.144.72:45838] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login.action"] [unique_id "aRSM3Hlw2elroagFF1pQIwAAAEc"]
[Wed Nov 12 21:34:20.626586 2025] [:error] [pid 60095:tid 60110] [client 159.65.144.72:45852] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_all_dbs"] [unique_id "aRSM3Hlw2elroagFF1pQKAAAAEs"]
[Wed Nov 12 21:34:21.090620 2025] [:error] [pid 60097:tid 60167] [client 159.65.144.72:45866] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.DS_Store"] [unique_id "aRSM3cdT5oio_TbWpi-dJgAAAM4"]
[Wed Nov 12 21:34:21.500467 2025] [:error] [pid 23737:tid 23762] [client 159.65.144.72:45880] [client 159.65.144.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aRSM3RQUsVVfOZWgW_XZegAAAY0"]
[Wed Nov 12 21:34:21.922580 2025] [:error] [pid 60405:tid 60432] [client 159.65.144.72:45894] [client 159.65.144.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aRSM3XMGv_mlVi6mf5oh3QAAABg"]
[Wed Nov 12 21:34:22.374426 2025] [:error] [pid 60405:tid 60428] [client 159.65.144.72:45898] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRSM3nMGv_mlVi6mf5oh5QAAABQ"]
[Wed Nov 12 21:34:22.799675 2025] [:error] [pid 23737:tid 23755] [client 159.65.144.72:45902] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.json"] [unique_id "aRSM3hQUsVVfOZWgW_XZlQAAAYY"]
[Wed Nov 12 21:34:23.276992 2025] [:error] [pid 23737:tid 23756] [client 159.65.144.72:45918] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/telescope/requests"] [unique_id "aRSM3xQUsVVfOZWgW_XZmAAAAYc"]
[Wed Nov 12 21:34:23.687139 2025] [:error] [pid 23737:tid 23761] [client 159.65.144.72:45930] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aRSM3xQUsVVfOZWgW_XZmwAAAYw"]
[Wed Nov 12 21:34:24.084358 2025] [:error] [pid 12744:tid 12756] [client 159.65.144.72:45936] [client 159.65.144.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRSM4J1cp_ouUvkFj0WEwgAAAQg"]
[Wed Nov 12 21:37:44.852180 2025] [:error] [pid 60180:tid 60197] [client 178.18.247.115:56716] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNqFhgd7ccS8EZg1pnEAAAAU8"], referer: binance.com
[Wed Nov 12 21:37:51.904909 2025] [:error] [pid 23737:tid 23762] [client 178.18.247.115:63608] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNrxQUsVVfOZWgW_XayAAAAY0"]
[Wed Nov 12 21:37:53.987011 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:57267] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNsRQUsVVfOZWgW_XazAAAAY8"]
[Wed Nov 12 21:37:56.084015 2025] [:error] [pid 60096:tid 60153] [client 178.18.247.115:51528] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNtDmzkhCvvk8DXOzDRwAAAJQ"]
[Wed Nov 12 21:37:58.162222 2025] [:error] [pid 60095:tid 60105] [client 178.18.247.115:60280] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNtnlw2elroagFF1pQ5gAAAEY"]
[Wed Nov 12 21:38:00.248212 2025] [:error] [pid 12744:tid 12768] [client 178.18.247.115:60280] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNuJ1cp_ouUvkFj0WFnAAAARQ"]
[Wed Nov 12 21:38:02.454402 2025] [:error] [pid 12744:tid 12770] [client 178.18.247.115:65434] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNup1cp_ouUvkFj0WFngAAARY"]
[Wed Nov 12 21:38:04.689847 2025] [:error] [pid 60405:tid 60414] [client 178.18.247.115:57503] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNvHMGv_mlVi6mf5oixAAAAAY"]
[Wed Nov 12 21:38:06.821310 2025] [:error] [pid 60405:tid 60424] [client 178.18.247.115:54925] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNvnMGv_mlVi6mf5oiygAAABA"]
[Wed Nov 12 21:38:08.908745 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:59419] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNwHMGv_mlVi6mf5oi0gAAABc"]
[Wed Nov 12 21:38:10.920861 2025] [:error] [pid 60405:tid 60413] [client 178.18.247.115:49371] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNwnMGv_mlVi6mf5oi1QAAAAU"]
[Wed Nov 12 21:38:12.973784 2025] [:error] [pid 60096:tid 60158] [client 178.18.247.115:52240] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNxDmzkhCvvk8DXOzDUwAAAJg"]
[Wed Nov 12 21:38:15.008086 2025] [:error] [pid 60405:tid 60427] [client 178.18.247.115:56254] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNx3MGv_mlVi6mf5oi2AAAABM"]
[Wed Nov 12 21:38:17.029869 2025] [:error] [pid 60180:tid 60206] [client 178.18.247.115:56266] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNyVhgd7ccS8EZg1pnJAAAAVg"]
[Wed Nov 12 21:38:19.079265 2025] [:error] [pid 60095:tid 60116] [client 178.18.247.115:65219] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNy3lw2elroagFF1pQ8gAAAFE"]
[Wed Nov 12 21:38:21.123587 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:65221] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNzVhgd7ccS8EZg1pnLAAAAUc"]
[Wed Nov 12 21:38:23.192350 2025] [:error] [pid 12744:tid 12772] [client 178.18.247.115:54939] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSNz51cp_ouUvkFj0WFrAAAARg"]
[Wed Nov 12 21:38:25.206268 2025] [:error] [pid 60097:tid 60175] [client 178.18.247.115:49850] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN0cdT5oio_TbWpi-eBwAAANY"]
[Wed Nov 12 21:38:27.285154 2025] [:error] [pid 60405:tid 60419] [client 178.18.247.115:56639] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN03MGv_mlVi6mf5oi4wAAAAs"]
[Wed Nov 12 21:38:29.318603 2025] [:error] [pid 60405:tid 60429] [client 178.18.247.115:56573] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN1XMGv_mlVi6mf5oi5QAAABU"]
[Wed Nov 12 21:38:31.359978 2025] [:error] [pid 60097:tid 60166] [client 178.18.247.115:51280] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN18dT5oio_TbWpi-eDgAAAM0"]
[Wed Nov 12 21:38:33.359398 2025] [:error] [pid 60096:tid 60131] [client 178.18.247.115:53937] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN2TmzkhCvvk8DXOzDYwAAAIU"]
[Wed Nov 12 21:38:35.445649 2025] [:error] [pid 60097:tid 60161] [client 178.18.247.115:61564] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN28dT5oio_TbWpi-eEQAAAMg"]
[Wed Nov 12 21:38:37.528840 2025] [:error] [pid 23737:tid 23763] [client 178.18.247.115:64548] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN3RQUsVVfOZWgW_Xa8gAAAY4"]
[Wed Nov 12 21:38:39.591640 2025] [:error] [pid 60405:tid 60412] [client 178.18.247.115:51387] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN33MGv_mlVi6mf5oi7QAAAAQ"]
[Wed Nov 12 21:38:39.591778 2025] [:error] [pid 60405:tid 60412] [client 178.18.247.115:51387] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN33MGv_mlVi6mf5oi7QAAAAQ"]
[Wed Nov 12 21:38:40.645274 2025] [:error] [pid 23737:tid 23769] [client 178.18.247.115:63881] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN4BQUsVVfOZWgW_Xa_wAAAZQ"]
[Wed Nov 12 21:38:42.729640 2025] [:error] [pid 60405:tid 60414] [client 178.18.247.115:55607] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN4nMGv_mlVi6mf5oi-AAAAAY"]
[Wed Nov 12 21:38:44.872693 2025] [:error] [pid 60096:tid 60138] [client 178.18.247.115:61784] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN5DmzkhCvvk8DXOzDfAAAAIw"]
[Wed Nov 12 21:38:46.938272 2025] [:error] [pid 12744:tid 12756] [client 178.18.247.115:63008] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN5p1cp_ouUvkFj0WFvQAAAQg"]
[Wed Nov 12 21:38:49.066333 2025] [:error] [pid 12744:tid 12752] [client 178.18.247.115:62240] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN6Z1cp_ouUvkFj0WFwAAAAQQ"]
[Wed Nov 12 21:38:51.115349 2025] [:error] [pid 60097:tid 60152] [client 178.18.247.115:52158] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN68dT5oio_TbWpi-eKgAAAMU"]
[Wed Nov 12 21:38:53.146513 2025] [:error] [pid 60095:tid 60102] [client 178.18.247.115:59759] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN7Xlw2elroagFF1pRDgAAAEM"]
[Wed Nov 12 21:38:55.246875 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:60863] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN71hgd7ccS8EZg1pnRAAAAUE"]
[Wed Nov 12 21:38:57.331176 2025] [:error] [pid 60097:tid 60160] [client 178.18.247.115:59713] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN8cdT5oio_TbWpi-eMgAAAMc"]
[Wed Nov 12 21:38:59.390503 2025] [:error] [pid 23737:tid 23771] [client 178.18.247.115:59718] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN8xQUsVVfOZWgW_XbKQAAAZY"]
[Wed Nov 12 21:39:01.507840 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:63460] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN9Xlw2elroagFF1pRFwAAAEg"]
[Wed Nov 12 21:39:01.507968 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:63460] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN9Xlw2elroagFF1pRFwAAAEg"]
[Wed Nov 12 21:39:02.493358 2025] [:error] [pid 12744:tid 12750] [client 178.18.247.115:53985] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN9p1cp_ouUvkFj0WF1AAAAQI"]
[Wed Nov 12 21:39:02.493482 2025] [:error] [pid 12744:tid 12750] [client 178.18.247.115:53985] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN9p1cp_ouUvkFj0WF1AAAAQI"]
[Wed Nov 12 21:39:03.561957 2025] [:error] [pid 23737:tid 23770] [client 178.18.247.115:65471] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN9xQUsVVfOZWgW_XbNAAAAZU"]
[Wed Nov 12 21:39:03.562149 2025] [:error] [pid 23737:tid 23770] [client 178.18.247.115:65471] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN9xQUsVVfOZWgW_XbNAAAAZU"]
[Wed Nov 12 21:39:04.657486 2025] [:error] [pid 60097:tid 60150] [client 178.18.247.115:61112] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN-MdT5oio_TbWpi-eOgAAAMQ"]
[Wed Nov 12 21:39:06.740428 2025] [:error] [pid 60405:tid 60415] [client 178.18.247.115:59572] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN-nMGv_mlVi6mf5ojGAAAAAc"]
[Wed Nov 12 21:39:08.825848 2025] [:error] [pid 23737:tid 23752] [client 178.18.247.115:54148] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN_BQUsVVfOZWgW_XbOAAAAYM"]
[Wed Nov 12 21:39:10.876696 2025] [:error] [pid 60096:tid 60156] [client 178.18.247.115:61395] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSN_jmzkhCvvk8DXOzDiAAAAJY"]
[Wed Nov 12 21:39:12.876460 2025] [:error] [pid 12744:tid 12750] [client 178.18.247.115:57876] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOAJ1cp_ouUvkFj0WF3AAAAQI"]
[Wed Nov 12 21:39:14.949830 2025] [:error] [pid 60180:tid 60192] [client 178.18.247.115:63722] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOAlhgd7ccS8EZg1pnUgAAAUo"]
[Wed Nov 12 21:39:14.949998 2025] [:error] [pid 60180:tid 60192] [client 178.18.247.115:63722] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOAlhgd7ccS8EZg1pnUgAAAUo"]
[Wed Nov 12 21:39:16.019575 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:64314] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOBBQUsVVfOZWgW_XbPwAAAYc"]
[Wed Nov 12 21:39:16.019771 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:64314] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOBBQUsVVfOZWgW_XbPwAAAYc"]
[Wed Nov 12 21:39:17.047244 2025] [:error] [pid 60097:tid 60147] [client 178.18.247.115:54873] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOBcdT5oio_TbWpi-eQQAAAMI"]
[Wed Nov 12 21:39:19.107688 2025] [:error] [pid 60095:tid 60111] [client 178.18.247.115:59556] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOB3lw2elroagFF1pRIgAAAEw"]
[Wed Nov 12 21:39:19.107815 2025] [:error] [pid 60095:tid 60111] [client 178.18.247.115:59556] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOB3lw2elroagFF1pRIgAAAEw"]
[Wed Nov 12 21:39:20.169514 2025] [:error] [pid 60097:tid 60150] [client 178.18.247.115:54872] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOCMdT5oio_TbWpi-eRwAAAMQ"]
[Wed Nov 12 21:39:20.169685 2025] [:error] [pid 60097:tid 60150] [client 178.18.247.115:54872] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOCMdT5oio_TbWpi-eRwAAAMQ"]
[Wed Nov 12 21:39:21.200310 2025] [:error] [pid 23737:tid 23765] [client 178.18.247.115:58136] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOCRQUsVVfOZWgW_XbRQAAAZA"]
[Wed Nov 12 21:39:21.200433 2025] [:error] [pid 23737:tid 23765] [client 178.18.247.115:58136] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOCRQUsVVfOZWgW_XbRQAAAZA"]
[Wed Nov 12 21:39:22.236345 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:64854] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOChQUsVVfOZWgW_XbSQAAAY8"]
[Wed Nov 12 21:39:24.265764 2025] [:error] [pid 12744:tid 12770] [client 178.18.247.115:61832] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSODJ1cp_ouUvkFj0WF5AAAARY"]
[Wed Nov 12 21:39:24.265928 2025] [:error] [pid 12744:tid 12770] [client 178.18.247.115:61832] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSODJ1cp_ouUvkFj0WF5AAAARY"]
[Wed Nov 12 21:39:25.303631 2025] [:error] [pid 60180:tid 60193] [client 178.18.247.115:63850] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSODVhgd7ccS8EZg1pnVgAAAUs"]
[Wed Nov 12 21:39:27.366225 2025] [:error] [pid 23737:tid 23763] [client 178.18.247.115:63860] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSODxQUsVVfOZWgW_XbUAAAAY4"]
[Wed Nov 12 21:39:29.500572 2025] [:error] [pid 60097:tid 60166] [client 178.18.247.115:57449] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOEcdT5oio_TbWpi-eTwAAAM0"]
[Wed Nov 12 21:39:29.500759 2025] [:error] [pid 60097:tid 60166] [client 178.18.247.115:57449] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOEcdT5oio_TbWpi-eTwAAAM0"]
[Wed Nov 12 21:39:30.498405 2025] [:error] [pid 60096:tid 60155] [client 178.18.247.115:53456] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOEjmzkhCvvk8DXOzDlwAAAJU"]
[Wed Nov 12 21:39:32.621209 2025] [:error] [pid 60095:tid 60102] [client 178.18.247.115:52980] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOFHlw2elroagFF1pRLgAAAEM"]
[Wed Nov 12 21:39:34.651469 2025] [:error] [pid 60096:tid 60148] [client 178.18.247.115:60032] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOFjmzkhCvvk8DXOzDngAAAJI"]
[Wed Nov 12 21:39:34.651592 2025] [:error] [pid 60096:tid 60148] [client 178.18.247.115:60032] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOFjmzkhCvvk8DXOzDngAAAJI"]
[Wed Nov 12 21:39:35.681457 2025] [:error] [pid 23737:tid 23752] [client 178.18.247.115:59288] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOFxQUsVVfOZWgW_XbWwAAAYM"]
[Wed Nov 12 21:39:35.681588 2025] [:error] [pid 23737:tid 23752] [client 178.18.247.115:59288] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOFxQUsVVfOZWgW_XbWwAAAYM"]
[Wed Nov 12 21:39:36.678837 2025] [:error] [pid 23737:tid 23757] [client 178.18.247.115:56212] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGBQUsVVfOZWgW_XbXwAAAYg"]
[Wed Nov 12 21:39:36.678971 2025] [:error] [pid 23737:tid 23757] [client 178.18.247.115:56212] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGBQUsVVfOZWgW_XbXwAAAYg"]
[Wed Nov 12 21:39:37.719217 2025] [:error] [pid 12744:tid 12757] [client 178.18.247.115:50903] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGZ1cp_ouUvkFj0WF8AAAAQk"]
[Wed Nov 12 21:39:37.719327 2025] [:error] [pid 12744:tid 12757] [client 178.18.247.115:50903] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGZ1cp_ouUvkFj0WF8AAAAQk"]
[Wed Nov 12 21:39:38.737304 2025] [:error] [pid 23737:tid 23749] [client 178.18.247.115:64900] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGhQUsVVfOZWgW_XbdQAAAYA"]
[Wed Nov 12 21:39:38.737417 2025] [:error] [pid 23737:tid 23749] [client 178.18.247.115:64900] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGhQUsVVfOZWgW_XbdQAAAYA"]
[Wed Nov 12 21:39:39.780088 2025] [:error] [pid 23737:tid 23763] [client 178.18.247.115:59224] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGxQUsVVfOZWgW_XbdwAAAY4"]
[Wed Nov 12 21:39:39.780307 2025] [:error] [pid 23737:tid 23763] [client 178.18.247.115:59224] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOGxQUsVVfOZWgW_XbdwAAAY4"]
[Wed Nov 12 21:39:40.773209 2025] [:error] [pid 23737:tid 23755] [client 178.18.247.115:56583] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOHBQUsVVfOZWgW_XbfAAAAYY"]
[Wed Nov 12 21:39:40.773363 2025] [:error] [pid 23737:tid 23755] [client 178.18.247.115:56583] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOHBQUsVVfOZWgW_XbfAAAAYY"]
[Wed Nov 12 21:39:41.812788 2025] [:error] [pid 60095:tid 60115] [client 178.18.247.115:62639] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOHXlw2elroagFF1pRPQAAAFA"]
[Wed Nov 12 21:39:43.882266 2025] [:error] [pid 60097:tid 60167] [client 178.18.247.115:50962] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOH8dT5oio_TbWpi-ebQAAAM4"]
[Wed Nov 12 21:39:43.882390 2025] [:error] [pid 60097:tid 60167] [client 178.18.247.115:50962] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOH8dT5oio_TbWpi-ebQAAAM4"]
[Wed Nov 12 21:39:44.865941 2025] [:error] [pid 60097:tid 60161] [client 178.18.247.115:62477] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOIMdT5oio_TbWpi-ecAAAAMg"]
[Wed Nov 12 21:39:46.917735 2025] [:error] [pid 23737:tid 23753] [client 178.18.247.115:52357] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOIhQUsVVfOZWgW_XbhgAAAYQ"]
[Wed Nov 12 21:39:46.917868 2025] [:error] [pid 23737:tid 23753] [client 178.18.247.115:52357] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOIhQUsVVfOZWgW_XbhgAAAYQ"]
[Wed Nov 12 21:39:47.922359 2025] [:error] [pid 60096:tid 60137] [client 178.18.247.115:65107] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOIzmzkhCvvk8DXOzDqQAAAIs"]
[Wed Nov 12 21:39:47.922544 2025] [:error] [pid 60096:tid 60137] [client 178.18.247.115:65107] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOIzmzkhCvvk8DXOzDqQAAAIs"]
[Wed Nov 12 21:39:48.983297 2025] [:error] [pid 60096:tid 60132] [client 178.18.247.115:55246] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOJDmzkhCvvk8DXOzDrgAAAIY"]
[Wed Nov 12 21:39:48.983442 2025] [:error] [pid 60096:tid 60132] [client 178.18.247.115:55246] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOJDmzkhCvvk8DXOzDrgAAAIY"]
[Wed Nov 12 21:39:49.989185 2025] [:error] [pid 12744:tid 12769] [client 178.18.247.115:61033] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOJZ1cp_ouUvkFj0WGCgAAARU"]
[Wed Nov 12 21:39:49.989312 2025] [:error] [pid 12744:tid 12769] [client 178.18.247.115:61033] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOJZ1cp_ouUvkFj0WGCgAAARU"]
[Wed Nov 12 21:39:51.136722 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:60197] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOJxQUsVVfOZWgW_XbjgAAAY8"]
[Wed Nov 12 21:39:51.136858 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:60197] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOJxQUsVVfOZWgW_XbjgAAAY8"]
[Wed Nov 12 21:39:52.189003 2025] [:error] [pid 23737:tid 23762] [client 178.18.247.115:64985] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOKBQUsVVfOZWgW_XbjwAAAY0"]
[Wed Nov 12 21:39:52.189188 2025] [:error] [pid 23737:tid 23762] [client 178.18.247.115:64985] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOKBQUsVVfOZWgW_XbjwAAAY0"]
[Wed Nov 12 21:39:53.248120 2025] [:error] [pid 60405:tid 60422] [client 178.18.247.115:58924] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOKXMGv_mlVi6mf5ojOgAAAA4"]
[Wed Nov 12 21:39:53.248259 2025] [:error] [pid 60405:tid 60422] [client 178.18.247.115:58924] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOKXMGv_mlVi6mf5ojOgAAAA4"]
[Wed Nov 12 21:39:54.325639 2025] [:error] [pid 12744:tid 12760] [client 178.18.247.115:61372] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOKp1cp_ouUvkFj0WGEAAAAQw"]
[Wed Nov 12 21:39:54.325782 2025] [:error] [pid 12744:tid 12760] [client 178.18.247.115:61372] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOKp1cp_ouUvkFj0WGEAAAAQw"]
[Wed Nov 12 21:39:55.349364 2025] [:error] [pid 60180:tid 60202] [client 178.18.247.115:52500] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOK1hgd7ccS8EZg1pnZAAAAVQ"]
[Wed Nov 12 21:39:55.349497 2025] [:error] [pid 60180:tid 60202] [client 178.18.247.115:52500] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOK1hgd7ccS8EZg1pnZAAAAVQ"]
[Wed Nov 12 21:39:56.350250 2025] [:error] [pid 60096:tid 60135] [client 178.18.247.115:56198] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOLDmzkhCvvk8DXOzDsAAAAIk"]
[Wed Nov 12 21:39:56.350372 2025] [:error] [pid 60096:tid 60135] [client 178.18.247.115:56198] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOLDmzkhCvvk8DXOzDsAAAAIk"]
[Wed Nov 12 21:39:57.366457 2025] [:error] [pid 60180:tid 60187] [client 178.18.247.115:63291] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOLVhgd7ccS8EZg1pnZgAAAUU"]
[Wed Nov 12 21:39:57.366610 2025] [:error] [pid 60180:tid 60187] [client 178.18.247.115:63291] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOLVhgd7ccS8EZg1pnZgAAAUU"]
[Wed Nov 12 21:39:58.401632 2025] [:error] [pid 60180:tid 60198] [client 178.18.247.115:56554] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOLlhgd7ccS8EZg1pnaQAAAVA"]
[Wed Nov 12 21:40:00.452283 2025] [:error] [pid 12744:tid 12766] [client 178.18.247.115:55503] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOMJ1cp_ouUvkFj0WGGgAAARI"]
[Wed Nov 12 21:40:00.452681 2025] [:error] [pid 12744:tid 12766] [client 178.18.247.115:55503] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOMJ1cp_ouUvkFj0WGGgAAARI"]
[Wed Nov 12 21:40:01.483669 2025] [:error] [pid 60405:tid 60428] [client 178.18.247.115:49620] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOMXMGv_mlVi6mf5ojQQAAABQ"]
[Wed Nov 12 21:40:03.982270 2025] [:error] [pid 60095:tid 60102] [client 178.18.247.115:55499] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOM3lw2elroagFF1pRTwAAAEM"]
[Wed Nov 12 21:40:03.982427 2025] [:error] [pid 60095:tid 60102] [client 178.18.247.115:55499] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOM3lw2elroagFF1pRTwAAAEM"]
[Wed Nov 12 21:40:05.063630 2025] [:error] [pid 60405:tid 60417] [client 178.18.247.115:51161] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSONXMGv_mlVi6mf5ojRwAAAAk"]
[Wed Nov 12 21:40:05.063795 2025] [:error] [pid 60405:tid 60417] [client 178.18.247.115:51161] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSONXMGv_mlVi6mf5ojRwAAAAk"]
[Wed Nov 12 21:40:06.129306 2025] [:error] [pid 60405:tid 60416] [client 178.18.247.115:60954] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSONnMGv_mlVi6mf5ojSwAAAAg"]
[Wed Nov 12 21:40:06.129421 2025] [:error] [pid 60405:tid 60416] [client 178.18.247.115:60954] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSONnMGv_mlVi6mf5ojSwAAAAg"]
[Wed Nov 12 21:40:07.223292 2025] [:error] [pid 12744:tid 12772] [client 178.18.247.115:58826] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSON51cp_ouUvkFj0WGIQAAARg"]
[Wed Nov 12 21:40:07.223412 2025] [:error] [pid 12744:tid 12772] [client 178.18.247.115:58826] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSON51cp_ouUvkFj0WGIQAAARg"]
[Wed Nov 12 21:40:08.325907 2025] [:error] [pid 60096:tid 60156] [client 178.18.247.115:59690] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOODmzkhCvvk8DXOzDswAAAJY"]
[Wed Nov 12 21:40:08.326092 2025] [:error] [pid 60096:tid 60156] [client 178.18.247.115:59690] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOODmzkhCvvk8DXOzDswAAAJY"]
[Wed Nov 12 21:40:09.438434 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:64019] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOOXMGv_mlVi6mf5ojTgAAABc"]
[Wed Nov 12 21:40:09.438585 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:64019] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOOXMGv_mlVi6mf5ojTgAAABc"]
[Wed Nov 12 21:40:10.470431 2025] [:error] [pid 12744:tid 12756] [client 178.18.247.115:58547] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOOp1cp_ouUvkFj0WGKAAAAQg"]
[Wed Nov 12 21:40:10.470632 2025] [:error] [pid 12744:tid 12756] [client 178.18.247.115:58547] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOOp1cp_ouUvkFj0WGKAAAAQg"]
[Wed Nov 12 21:40:11.616700 2025] [:error] [pid 60097:tid 60162] [client 178.18.247.115:49713] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOO8dT5oio_TbWpi-eewAAAMk"]
[Wed Nov 12 21:40:11.616821 2025] [:error] [pid 60097:tid 60162] [client 178.18.247.115:49713] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOO8dT5oio_TbWpi-eewAAAMk"]
[Wed Nov 12 21:40:12.622000 2025] [:error] [pid 12744:tid 12749] [client 178.18.247.115:50249] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOPJ1cp_ouUvkFj0WGLAAAAQE"]
[Wed Nov 12 21:40:12.622162 2025] [:error] [pid 12744:tid 12749] [client 178.18.247.115:50249] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOPJ1cp_ouUvkFj0WGLAAAAQE"]
[Wed Nov 12 21:40:13.649229 2025] [:error] [pid 23737:tid 23759] [client 178.18.247.115:63776] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOPRQUsVVfOZWgW_XbowAAAYo"]
[Wed Nov 12 21:40:13.649354 2025] [:error] [pid 23737:tid 23759] [client 178.18.247.115:63776] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOPRQUsVVfOZWgW_XbowAAAYo"]
[Wed Nov 12 21:40:14.698176 2025] [:error] [pid 60096:tid 60151] [client 178.18.247.115:56190] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOPjmzkhCvvk8DXOzDtQAAAJM"]
[Wed Nov 12 21:40:16.685958 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:51129] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOQFhgd7ccS8EZg1pndAAAAUE"]
[Wed Nov 12 21:40:16.686132 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:51129] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOQFhgd7ccS8EZg1pndAAAAUE"]
[Wed Nov 12 21:40:17.753602 2025] [:error] [pid 60405:tid 60423] [client 178.18.247.115:54009] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOQXMGv_mlVi6mf5ojWAAAAA8"]
[Wed Nov 12 21:40:17.753740 2025] [:error] [pid 60405:tid 60423] [client 178.18.247.115:54009] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOQXMGv_mlVi6mf5ojWAAAAA8"]
[Wed Nov 12 21:40:19.044911 2025] [:error] [pid 60405:tid 60432] [client 178.18.247.115:65060] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOQ3MGv_mlVi6mf5ojWgAAABg"]
[Wed Nov 12 21:40:19.045092 2025] [:error] [pid 60405:tid 60432] [client 178.18.247.115:65060] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOQ3MGv_mlVi6mf5ojWgAAABg"]
[Wed Nov 12 21:40:20.118494 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:62263] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSORFhgd7ccS8EZg1pneQAAAUc"]
[Wed Nov 12 21:40:20.118628 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:62263] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSORFhgd7ccS8EZg1pneQAAAUc"]
[Wed Nov 12 21:40:21.162281 2025] [:error] [pid 60180:tid 60192] [client 178.18.247.115:58904] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSORVhgd7ccS8EZg1pnegAAAUo"]
[Wed Nov 12 21:40:21.162454 2025] [:error] [pid 60180:tid 60192] [client 178.18.247.115:58904] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSORVhgd7ccS8EZg1pnegAAAUo"]
[Wed Nov 12 21:40:22.237550 2025] [:error] [pid 60180:tid 60185] [client 178.18.247.115:60806] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSORlhgd7ccS8EZg1pnfAAAAUM"]
[Wed Nov 12 21:40:22.237679 2025] [:error] [pid 60180:tid 60185] [client 178.18.247.115:60806] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSORlhgd7ccS8EZg1pnfAAAAUM"]
[Wed Nov 12 21:40:23.319752 2025] [:error] [pid 12744:tid 12754] [client 178.18.247.115:55947] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOR51cp_ouUvkFj0WGPAAAAQY"]
[Wed Nov 12 21:40:23.319891 2025] [:error] [pid 12744:tid 12754] [client 178.18.247.115:55947] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 6"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOR51cp_ouUvkFj0WGPAAAAQY"]
[Wed Nov 12 21:40:24.381718 2025] [:error] [pid 60096:tid 60136] [client 178.18.247.115:62134] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOSDmzkhCvvk8DXOzDvgAAAIo"]
[Wed Nov 12 21:40:24.381885 2025] [:error] [pid 60096:tid 60136] [client 178.18.247.115:62134] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOSDmzkhCvvk8DXOzDvgAAAIo"]
[Wed Nov 12 21:40:25.432062 2025] [:error] [pid 60405:tid 60422] [client 178.18.247.115:56088] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOSXMGv_mlVi6mf5ojXAAAAA4"]
[Wed Nov 12 21:40:25.432265 2025] [:error] [pid 60405:tid 60422] [client 178.18.247.115:56088] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOSXMGv_mlVi6mf5ojXAAAAA4"]
[Wed Nov 12 21:40:26.625434 2025] [:error] [pid 60097:tid 60175] [client 178.18.247.115:52716] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOSsdT5oio_TbWpi-ehQAAANY"]
[Wed Nov 12 21:40:26.625534 2025] [:error] [pid 60097:tid 60175] [client 178.18.247.115:52716] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOSsdT5oio_TbWpi-ehQAAANY"]
[Wed Nov 12 21:40:27.748166 2025] [:error] [pid 12744:tid 12748] [client 178.18.247.115:58309] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOS51cp_ouUvkFj0WGQgAAAQA"]
[Wed Nov 12 21:40:27.748305 2025] [:error] [pid 12744:tid 12748] [client 178.18.247.115:58309] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOS51cp_ouUvkFj0WGQgAAAQA"]
[Wed Nov 12 21:40:28.786918 2025] [:error] [pid 60096:tid 60151] [client 178.18.247.115:52180] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOTDmzkhCvvk8DXOzDwQAAAJM"]
[Wed Nov 12 21:40:28.787106 2025] [:error] [pid 60096:tid 60151] [client 178.18.247.115:52180] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOTDmzkhCvvk8DXOzDwQAAAJM"]
[Wed Nov 12 21:40:29.857397 2025] [:error] [pid 60405:tid 60430] [client 178.18.247.115:60051] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOTXMGv_mlVi6mf5ojYgAAABY"]
[Wed Nov 12 21:40:29.857511 2025] [:error] [pid 60405:tid 60430] [client 178.18.247.115:60051] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 7"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOTXMGv_mlVi6mf5ojYgAAABY"]
[Wed Nov 12 21:40:30.862879 2025] [:error] [pid 60405:tid 60412] [client 178.18.247.115:64664] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOTnMGv_mlVi6mf5ojZQAAAAQ"]
[Wed Nov 12 21:40:30.863076 2025] [:error] [pid 60405:tid 60412] [client 178.18.247.115:64664] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOTnMGv_mlVi6mf5ojZQAAAAQ"]
[Wed Nov 12 21:40:31.913948 2025] [:error] [pid 60097:tid 60147] [client 178.18.247.115:64667] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOT8dT5oio_TbWpi-ejQAAAMI"]
[Wed Nov 12 21:40:31.914119 2025] [:error] [pid 60097:tid 60147] [client 178.18.247.115:64667] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOT8dT5oio_TbWpi-ejQAAAMI"]
[Wed Nov 12 21:40:32.964437 2025] [:error] [pid 60180:tid 60185] [client 178.18.247.115:51713] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOUFhgd7ccS8EZg1pniAAAAUM"]
[Wed Nov 12 21:40:32.964533 2025] [:error] [pid 60180:tid 60185] [client 178.18.247.115:51713] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOUFhgd7ccS8EZg1pniAAAAUM"]
[Wed Nov 12 21:40:34.027288 2025] [:error] [pid 23737:tid 23757] [client 178.18.247.115:52326] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOUhQUsVVfOZWgW_XbugAAAYg"]
[Wed Nov 12 21:40:34.027411 2025] [:error] [pid 23737:tid 23757] [client 178.18.247.115:52326] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOUhQUsVVfOZWgW_XbugAAAYg"]
[Wed Nov 12 21:40:35.071904 2025] [:error] [pid 23737:tid 23760] [client 178.18.247.115:62014] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOUxQUsVVfOZWgW_XbuwAAAYs"]
[Wed Nov 12 21:40:35.072030 2025] [:error] [pid 23737:tid 23760] [client 178.18.247.115:62014] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOUxQUsVVfOZWgW_XbuwAAAYs"]
[Wed Nov 12 21:40:36.137950 2025] [:error] [pid 60405:tid 60418] [client 178.18.247.115:51114] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVHMGv_mlVi6mf5ojawAAAAo"]
[Wed Nov 12 21:40:36.138198 2025] [:error] [pid 60405:tid 60418] [client 178.18.247.115:51114] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVHMGv_mlVi6mf5ojawAAAAo"]
[Wed Nov 12 21:40:37.210884 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:51891] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVXMGv_mlVi6mf5ojbQAAABc"]
[Wed Nov 12 21:40:37.211035 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:51891] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVXMGv_mlVi6mf5ojbQAAABc"]
[Wed Nov 12 21:40:38.238217 2025] [:error] [pid 23737:tid 23768] [client 178.18.247.115:65175] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVhQUsVVfOZWgW_XbwQAAAZM"]
[Wed Nov 12 21:40:38.238431 2025] [:error] [pid 23737:tid 23768] [client 178.18.247.115:65175] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 9"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVhQUsVVfOZWgW_XbwQAAAZM"]
[Wed Nov 12 21:40:39.270481 2025] [:error] [pid 23737:tid 23755] [client 178.18.247.115:61380] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVxQUsVVfOZWgW_XbwgAAAYY"]
[Wed Nov 12 21:40:39.270626 2025] [:error] [pid 23737:tid 23755] [client 178.18.247.115:61380] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOVxQUsVVfOZWgW_XbwgAAAYY"]
[Wed Nov 12 21:40:40.341400 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:64610] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOWFhgd7ccS8EZg1pnjgAAAUE"]
[Wed Nov 12 21:40:40.341532 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:64610] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOWFhgd7ccS8EZg1pnjgAAAUE"]
[Wed Nov 12 21:40:41.343273 2025] [:error] [pid 23737:tid 23749] [client 178.18.247.115:50828] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOWRQUsVVfOZWgW_XbxwAAAYA"]
[Wed Nov 12 21:40:41.343430 2025] [:error] [pid 23737:tid 23749] [client 178.18.247.115:50828] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOWRQUsVVfOZWgW_XbxwAAAYA"]
[Wed Nov 12 21:40:42.418644 2025] [:error] [pid 60095:tid 60115] [client 178.18.247.115:61802] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOWnlw2elroagFF1pRZwAAAFA"]
[Wed Nov 12 21:40:42.418761 2025] [:error] [pid 60095:tid 60115] [client 178.18.247.115:61802] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOWnlw2elroagFF1pRZwAAAFA"]
[Wed Nov 12 21:40:43.453728 2025] [:error] [pid 12744:tid 12761] [client 178.18.247.115:61624] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOW51cp_ouUvkFj0WGUgAAAQ0"]
[Wed Nov 12 21:40:43.453880 2025] [:error] [pid 12744:tid 12761] [client 178.18.247.115:61624] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOW51cp_ouUvkFj0WGUgAAAQ0"]
[Wed Nov 12 21:40:44.485436 2025] [:error] [pid 12744:tid 12760] [client 178.18.247.115:57742] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOXJ1cp_ouUvkFj0WGVQAAAQw"]
[Wed Nov 12 21:40:44.485545 2025] [:error] [pid 12744:tid 12760] [client 178.18.247.115:57742] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOXJ1cp_ouUvkFj0WGVQAAAQw"]
[Wed Nov 12 21:40:45.516851 2025] [:error] [pid 12744:tid 12764] [client 178.18.247.115:49621] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOXZ1cp_ouUvkFj0WGVwAAARA"]
[Wed Nov 12 21:40:45.517009 2025] [:error] [pid 12744:tid 12764] [client 178.18.247.115:49621] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOXZ1cp_ouUvkFj0WGVwAAARA"]
[Wed Nov 12 21:40:46.560282 2025] [:error] [pid 12744:tid 12752] [client 178.18.247.115:63164] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOXp1cp_ouUvkFj0WGWgAAAQQ"]
[Wed Nov 12 21:40:46.560422 2025] [:error] [pid 12744:tid 12752] [client 178.18.247.115:63164] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOXp1cp_ouUvkFj0WGWgAAAQQ"]
[Wed Nov 12 21:40:47.558924 2025] [:error] [pid 60095:tid 60109] [client 178.18.247.115:62393] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOX3lw2elroagFF1pRaQAAAEo"]
[Wed Nov 12 21:40:47.559144 2025] [:error] [pid 60095:tid 60109] [client 178.18.247.115:62393] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOX3lw2elroagFF1pRaQAAAEo"]
[Wed Nov 12 21:40:48.586818 2025] [:error] [pid 60405:tid 60420] [client 178.18.247.115:51916] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYHMGv_mlVi6mf5ojdQAAAAw"]
[Wed Nov 12 21:40:48.586951 2025] [:error] [pid 60405:tid 60420] [client 178.18.247.115:51916] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYHMGv_mlVi6mf5ojdQAAAAw"]
[Wed Nov 12 21:40:49.675536 2025] [:error] [pid 60405:tid 60428] [client 178.18.247.115:55075] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYXMGv_mlVi6mf5ojfAAAABQ"]
[Wed Nov 12 21:40:49.675696 2025] [:error] [pid 60405:tid 60428] [client 178.18.247.115:55075] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYXMGv_mlVi6mf5ojfAAAABQ"]
[Wed Nov 12 21:40:50.699339 2025] [:error] [pid 12744:tid 12762] [client 178.18.247.115:53243] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYp1cp_ouUvkFj0WGXwAAAQ4"]
[Wed Nov 12 21:40:50.699490 2025] [:error] [pid 12744:tid 12762] [client 178.18.247.115:53243] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYp1cp_ouUvkFj0WGXwAAAQ4"]
[Wed Nov 12 21:40:51.741079 2025] [:error] [pid 60096:tid 60145] [client 178.18.247.115:64958] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYzmzkhCvvk8DXOzD2QAAAJA"]
[Wed Nov 12 21:40:51.741248 2025] [:error] [pid 60096:tid 60145] [client 178.18.247.115:64958] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOYzmzkhCvvk8DXOzD2QAAAJA"]
[Wed Nov 12 21:40:52.743592 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:53010] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZFhgd7ccS8EZg1pnmAAAAU4"]
[Wed Nov 12 21:40:52.743733 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:53010] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZFhgd7ccS8EZg1pnmAAAAU4"]
[Wed Nov 12 21:40:53.782936 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:54683] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZcdT5oio_TbWpi-enwAAAMY"]
[Wed Nov 12 21:40:53.783201 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:54683] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZcdT5oio_TbWpi-enwAAAMY"]
[Wed Nov 12 21:40:54.777180 2025] [:error] [pid 12744:tid 12764] [client 178.18.247.115:60655] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZp1cp_ouUvkFj0WGYwAAARA"]
[Wed Nov 12 21:40:54.777342 2025] [:error] [pid 12744:tid 12764] [client 178.18.247.115:60655] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZp1cp_ouUvkFj0WGYwAAARA"]
[Wed Nov 12 21:40:55.835297 2025] [:error] [pid 60405:tid 60411] [client 178.18.247.115:50527] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZ3MGv_mlVi6mf5ojgQAAAAM"]
[Wed Nov 12 21:40:55.835416 2025] [:error] [pid 60405:tid 60411] [client 178.18.247.115:50527] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOZ3MGv_mlVi6mf5ojgQAAAAM"]
[Wed Nov 12 21:40:56.899302 2025] [:error] [pid 60097:tid 60162] [client 178.18.247.115:52541] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOaMdT5oio_TbWpi-eoAAAAMk"]
[Wed Nov 12 21:40:56.899424 2025] [:error] [pid 60097:tid 60162] [client 178.18.247.115:52541] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOaMdT5oio_TbWpi-eoAAAAMk"]
[Wed Nov 12 21:40:57.957650 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:63442] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOaVhgd7ccS8EZg1pnpgAAAUE"]
[Wed Nov 12 21:40:57.957777 2025] [:error] [pid 60180:tid 60183] [client 178.18.247.115:63442] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOaVhgd7ccS8EZg1pnpgAAAUE"]
[Wed Nov 12 21:40:58.985349 2025] [:error] [pid 60096:tid 60155] [client 178.18.247.115:54391] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOajmzkhCvvk8DXOzD4wAAAJU"]
[Wed Nov 12 21:40:58.985461 2025] [:error] [pid 60096:tid 60155] [client 178.18.247.115:54391] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOajmzkhCvvk8DXOzD4wAAAJU"]
[Wed Nov 12 21:41:00.288430 2025] [:error] [pid 60405:tid 60427] [client 178.18.247.115:58428] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSObHMGv_mlVi6mf5ojigAAABM"]
[Wed Nov 12 21:41:00.288594 2025] [:error] [pid 60405:tid 60427] [client 178.18.247.115:58428] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSObHMGv_mlVi6mf5ojigAAABM"]
[Wed Nov 12 21:41:01.332471 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:54465] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSObTmzkhCvvk8DXOzD5wAAAIg"]
[Wed Nov 12 21:41:01.332640 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:54465] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSObTmzkhCvvk8DXOzD5wAAAIg"]
[Wed Nov 12 21:41:02.342613 2025] [:error] [pid 60405:tid 60426] [client 178.18.247.115:61376] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSObnMGv_mlVi6mf5ojkAAAABI"]
[Wed Nov 12 21:41:02.342754 2025] [:error] [pid 60405:tid 60426] [client 178.18.247.115:61376] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 10"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSObnMGv_mlVi6mf5ojkAAAABI"]
[Wed Nov 12 21:41:03.377582 2025] [:error] [pid 60405:tid 60432] [client 178.18.247.115:64031] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOb3MGv_mlVi6mf5ojkgAAABg"]
[Wed Nov 12 21:41:03.377698 2025] [:error] [pid 60405:tid 60432] [client 178.18.247.115:64031] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOb3MGv_mlVi6mf5ojkgAAABg"]
[Wed Nov 12 21:41:04.427452 2025] [:error] [pid 60405:tid 60418] [client 178.18.247.115:63350] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcHMGv_mlVi6mf5ojlAAAAAo"]
[Wed Nov 12 21:41:04.427588 2025] [:error] [pid 60405:tid 60418] [client 178.18.247.115:63350] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcHMGv_mlVi6mf5ojlAAAAAo"]
[Wed Nov 12 21:41:05.495197 2025] [:error] [pid 23737:tid 23771] [client 178.18.247.115:63135] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcRQUsVVfOZWgW_Xb4wAAAZY"]
[Wed Nov 12 21:41:05.495376 2025] [:error] [pid 23737:tid 23771] [client 178.18.247.115:63135] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcRQUsVVfOZWgW_Xb4wAAAZY"]
[Wed Nov 12 21:41:06.489884 2025] [:error] [pid 12744:tid 12763] [client 178.18.247.115:50949] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcp1cp_ouUvkFj0WGagAAAQ8"]
[Wed Nov 12 21:41:06.490064 2025] [:error] [pid 12744:tid 12763] [client 178.18.247.115:50949] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcp1cp_ouUvkFj0WGagAAAQ8"]
[Wed Nov 12 21:41:07.500939 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:51949] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcxQUsVVfOZWgW_Xb5wAAAYc"]
[Wed Nov 12 21:41:07.501110 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:51949] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOcxQUsVVfOZWgW_Xb5wAAAYc"]
[Wed Nov 12 21:41:08.570366 2025] [:error] [pid 60097:tid 60173] [client 178.18.247.115:51946] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOdMdT5oio_TbWpi-erQAAANQ"]
[Wed Nov 12 21:41:08.570472 2025] [:error] [pid 60097:tid 60173] [client 178.18.247.115:51946] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOdMdT5oio_TbWpi-erQAAANQ"]
[Wed Nov 12 21:41:09.639943 2025] [:error] [pid 60405:tid 60408] [client 178.18.247.115:49519] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOdXMGv_mlVi6mf5ojmAAAAAA"]
[Wed Nov 12 21:41:09.640170 2025] [:error] [pid 60405:tid 60408] [client 178.18.247.115:49519] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOdXMGv_mlVi6mf5ojmAAAAAA"]
[Wed Nov 12 21:41:10.640145 2025] [:error] [pid 60097:tid 60170] [client 178.18.247.115:59713] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOdsdT5oio_TbWpi-eswAAANE"]
[Wed Nov 12 21:41:10.640307 2025] [:error] [pid 60097:tid 60170] [client 178.18.247.115:59713] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOdsdT5oio_TbWpi-eswAAANE"]
[Wed Nov 12 21:41:11.677680 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:60618] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOd1hgd7ccS8EZg1pntgAAAUc"]
[Wed Nov 12 21:41:11.677897 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:60618] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOd1hgd7ccS8EZg1pntgAAAUc"]
[Wed Nov 12 21:41:12.675931 2025] [:error] [pid 23737:tid 23765] [client 178.18.247.115:58108] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOeBQUsVVfOZWgW_Xb7gAAAZA"]
[Wed Nov 12 21:41:12.676112 2025] [:error] [pid 23737:tid 23765] [client 178.18.247.115:58108] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOeBQUsVVfOZWgW_Xb7gAAAZA"]
[Wed Nov 12 21:41:13.695460 2025] [:error] [pid 60180:tid 60184] [client 178.18.247.115:54583] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOeVhgd7ccS8EZg1pnuwAAAUI"]
[Wed Nov 12 21:41:13.695579 2025] [:error] [pid 60180:tid 60184] [client 178.18.247.115:54583] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOeVhgd7ccS8EZg1pnuwAAAUI"]
[Wed Nov 12 21:41:14.728087 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:50946] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOehQUsVVfOZWgW_Xb8wAAAYc"]
[Wed Nov 12 21:41:14.728215 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:50946] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOehQUsVVfOZWgW_Xb8wAAAYc"]
[Wed Nov 12 21:41:15.765714 2025] [:error] [pid 60095:tid 60119] [client 178.18.247.115:65008] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOe3lw2elroagFF1pRhwAAAFQ"]
[Wed Nov 12 21:41:15.765845 2025] [:error] [pid 60095:tid 60119] [client 178.18.247.115:65008] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOe3lw2elroagFF1pRhwAAAFQ"]
[Wed Nov 12 21:41:16.819271 2025] [:error] [pid 23737:tid 23770] [client 178.18.247.115:54206] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfBQUsVVfOZWgW_Xb-AAAAZU"]
[Wed Nov 12 21:41:16.819401 2025] [:error] [pid 23737:tid 23770] [client 178.18.247.115:54206] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfBQUsVVfOZWgW_Xb-AAAAZU"]
[Wed Nov 12 21:41:17.838689 2025] [:error] [pid 60097:tid 60165] [client 178.18.247.115:57654] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfcdT5oio_TbWpi-evQAAAMw"]
[Wed Nov 12 21:41:17.838794 2025] [:error] [pid 60097:tid 60165] [client 178.18.247.115:57654] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfcdT5oio_TbWpi-evQAAAMw"]
[Wed Nov 12 21:41:18.849198 2025] [:error] [pid 12744:tid 12766] [client 178.18.247.115:51949] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfp1cp_ouUvkFj0WGeAAAARI"]
[Wed Nov 12 21:41:18.849353 2025] [:error] [pid 12744:tid 12766] [client 178.18.247.115:51949] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfp1cp_ouUvkFj0WGeAAAARI"]
[Wed Nov 12 21:41:19.918729 2025] [:error] [pid 23737:tid 23753] [client 178.18.247.115:52048] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfxQUsVVfOZWgW_Xb-wAAAYQ"]
[Wed Nov 12 21:41:19.918896 2025] [:error] [pid 23737:tid 23753] [client 178.18.247.115:52048] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOfxQUsVVfOZWgW_Xb-wAAAYQ"]
[Wed Nov 12 21:41:21.027332 2025] [:error] [pid 23737:tid 23762] [client 178.18.247.115:60413] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOgRQUsVVfOZWgW_XcBgAAAY0"]
[Wed Nov 12 21:41:21.027509 2025] [:error] [pid 23737:tid 23762] [client 178.18.247.115:60413] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOgRQUsVVfOZWgW_XcBgAAAY0"]
[Wed Nov 12 21:41:22.122770 2025] [:error] [pid 60097:tid 60163] [client 178.18.247.115:65035] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOgsdT5oio_TbWpi-ezQAAAMo"]
[Wed Nov 12 21:41:22.122957 2025] [:error] [pid 60097:tid 60163] [client 178.18.247.115:65035] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOgsdT5oio_TbWpi-ezQAAAMo"]
[Wed Nov 12 21:41:23.190464 2025] [:error] [pid 60405:tid 60416] [client 178.18.247.115:50639] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOg3MGv_mlVi6mf5ojtQAAAAg"]
[Wed Nov 12 21:41:23.190619 2025] [:error] [pid 60405:tid 60416] [client 178.18.247.115:50639] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOg3MGv_mlVi6mf5ojtQAAAAg"]
[Wed Nov 12 21:41:24.232115 2025] [:error] [pid 60097:tid 60166] [client 178.18.247.115:49266] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOhMdT5oio_TbWpi-e1wAAAM0"]
[Wed Nov 12 21:41:24.232224 2025] [:error] [pid 60097:tid 60166] [client 178.18.247.115:49266] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOhMdT5oio_TbWpi-e1wAAAM0"]
[Wed Nov 12 21:41:25.267557 2025] [:error] [pid 12744:tid 12761] [client 178.18.247.115:61011] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOhZ1cp_ouUvkFj0WGfQAAAQ0"]
[Wed Nov 12 21:41:25.267742 2025] [:error] [pid 12744:tid 12761] [client 178.18.247.115:61011] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOhZ1cp_ouUvkFj0WGfQAAAQ0"]
[Wed Nov 12 21:41:26.313947 2025] [:error] [pid 23737:tid 23766] [client 178.18.247.115:62150] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOhhQUsVVfOZWgW_XcHgAAAZE"]
[Wed Nov 12 21:41:26.314169 2025] [:error] [pid 23737:tid 23766] [client 178.18.247.115:62150] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOhhQUsVVfOZWgW_XcHgAAAZE"]
[Wed Nov 12 21:41:27.364267 2025] [:error] [pid 60097:tid 60164] [client 178.18.247.115:61539] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOh8dT5oio_TbWpi-e2QAAAMs"]
[Wed Nov 12 21:41:27.364395 2025] [:error] [pid 60097:tid 60164] [client 178.18.247.115:61539] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 8"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOh8dT5oio_TbWpi-e2QAAAMs"]
[Wed Nov 12 21:41:28.379699 2025] [:error] [pid 60405:tid 60427] [client 178.18.247.115:49673] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOiHMGv_mlVi6mf5ojvwAAABM"]
[Wed Nov 12 21:41:28.379859 2025] [:error] [pid 60405:tid 60427] [client 178.18.247.115:49673] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOiHMGv_mlVi6mf5ojvwAAABM"]
[Wed Nov 12 21:41:29.363421 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:53096] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOiXMGv_mlVi6mf5ojwwAAABc"]
[Wed Nov 12 21:41:29.363587 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:53096] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOiXMGv_mlVi6mf5ojwwAAABc"]
[Wed Nov 12 21:41:30.394053 2025] [:error] [pid 60180:tid 60198] [client 178.18.247.115:54306] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOilhgd7ccS8EZg1pn0AAAAVA"]
[Wed Nov 12 21:41:30.394205 2025] [:error] [pid 60180:tid 60198] [client 178.18.247.115:54306] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOilhgd7ccS8EZg1pn0AAAAVA"]
[Wed Nov 12 21:41:31.445274 2025] [:error] [pid 12744:tid 12750] [client 178.18.247.115:58962] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOi51cp_ouUvkFj0WGggAAAQI"]
[Wed Nov 12 21:41:31.445392 2025] [:error] [pid 12744:tid 12750] [client 178.18.247.115:58962] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOi51cp_ouUvkFj0WGggAAAQI"]
[Wed Nov 12 21:41:32.696612 2025] [:error] [pid 12744:tid 12755] [client 178.18.247.115:54073] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjJ1cp_ouUvkFj0WGhQAAAQc"]
[Wed Nov 12 21:41:32.696752 2025] [:error] [pid 12744:tid 12755] [client 178.18.247.115:54073] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjJ1cp_ouUvkFj0WGhQAAAQc"]
[Wed Nov 12 21:41:33.741259 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:56512] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjRQUsVVfOZWgW_XcLAAAAYc"]
[Wed Nov 12 21:41:33.741371 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:56512] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjRQUsVVfOZWgW_XcLAAAAYc"]
[Wed Nov 12 21:41:34.806443 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:62138] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjhQUsVVfOZWgW_XcMQAAAY8"]
[Wed Nov 12 21:41:34.806615 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:62138] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjhQUsVVfOZWgW_XcMQAAAY8"]
[Wed Nov 12 21:41:35.923733 2025] [:error] [pid 23737:tid 23771] [client 178.18.247.115:51397] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjxQUsVVfOZWgW_XcNAAAAZY"]
[Wed Nov 12 21:41:35.923884 2025] [:error] [pid 23737:tid 23771] [client 178.18.247.115:51397] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOjxQUsVVfOZWgW_XcNAAAAZY"]
[Wed Nov 12 21:41:37.044261 2025] [:error] [pid 60180:tid 60205] [client 178.18.247.115:65066] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOkVhgd7ccS8EZg1pn0gAAAVc"]
[Wed Nov 12 21:41:37.044369 2025] [:error] [pid 60180:tid 60205] [client 178.18.247.115:65066] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOkVhgd7ccS8EZg1pn0gAAAVc"]
[Wed Nov 12 21:41:38.029470 2025] [:error] [pid 60095:tid 60116] [client 178.18.247.115:63877] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOknlw2elroagFF1pRkwAAAFE"]
[Wed Nov 12 21:41:38.029597 2025] [:error] [pid 60095:tid 60116] [client 178.18.247.115:63877] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOknlw2elroagFF1pRkwAAAFE"]
[Wed Nov 12 21:41:39.056294 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:53282] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOk1hgd7ccS8EZg1pn1AAAAU4"]
[Wed Nov 12 21:41:39.056421 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:53282] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 11"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOk1hgd7ccS8EZg1pn1AAAAU4"]
[Wed Nov 12 21:41:40.099359 2025] [:error] [pid 60095:tid 60101] [client 178.18.247.115:56417] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOlHlw2elroagFF1pRlAAAAEI"]
[Wed Nov 12 21:41:40.099505 2025] [:error] [pid 60095:tid 60101] [client 178.18.247.115:56417] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOlHlw2elroagFF1pRlAAAAEI"]
[Wed Nov 12 21:41:41.099472 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:57613] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOlXlw2elroagFF1pRlQAAAEg"]
[Wed Nov 12 21:41:41.099583 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:57613] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 22"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOlXlw2elroagFF1pRlQAAAEg"]
[Wed Nov 12 21:41:42.092247 2025] [:error] [pid 60095:tid 60104] [client 178.18.247.115:61226] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOlnlw2elroagFF1pRlwAAAEU"]
[Wed Nov 12 21:41:42.092341 2025] [:error] [pid 60095:tid 60104] [client 178.18.247.115:61226] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOlnlw2elroagFF1pRlwAAAEU"]
[Wed Nov 12 21:41:43.114702 2025] [:error] [pid 12744:tid 12765] [client 178.18.247.115:61610] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOl51cp_ouUvkFj0WG0AAAARE"]
[Wed Nov 12 21:41:43.114874 2025] [:error] [pid 12744:tid 12765] [client 178.18.247.115:61610] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOl51cp_ouUvkFj0WG0AAAARE"]
[Wed Nov 12 21:41:44.187351 2025] [:error] [pid 60095:tid 60109] [client 178.18.247.115:63257] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOmHlw2elroagFF1pRngAAAEo"]
[Wed Nov 12 21:41:44.187483 2025] [:error] [pid 60095:tid 60109] [client 178.18.247.115:63257] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOmHlw2elroagFF1pRngAAAEo"]
[Wed Nov 12 21:41:45.202574 2025] [:error] [pid 60096:tid 60148] [client 178.18.247.115:65334] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOmTmzkhCvvk8DXOzEIAAAAJI"]
[Wed Nov 12 21:41:45.202716 2025] [:error] [pid 60096:tid 60148] [client 178.18.247.115:65334] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOmTmzkhCvvk8DXOzEIAAAAJI"]
[Wed Nov 12 21:41:46.233317 2025] [:error] [pid 12744:tid 12753] [client 178.18.247.115:61239] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOmp1cp_ouUvkFj0WG0wAAAQU"]
[Wed Nov 12 21:41:46.233436 2025] [:error] [pid 12744:tid 12753] [client 178.18.247.115:61239] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOmp1cp_ouUvkFj0WG0wAAAQU"]
[Wed Nov 12 21:41:47.216876 2025] [:error] [pid 60405:tid 60413] [client 178.18.247.115:60078] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOm3MGv_mlVi6mf5oj0AAAAAU"]
[Wed Nov 12 21:41:47.217005 2025] [:error] [pid 60405:tid 60413] [client 178.18.247.115:60078] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOm3MGv_mlVi6mf5oj0AAAAAU"]
[Wed Nov 12 21:41:48.242632 2025] [:error] [pid 60180:tid 60190] [client 178.18.247.115:59205] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOnFhgd7ccS8EZg1pn5AAAAUg"]
[Wed Nov 12 21:41:48.242764 2025] [:error] [pid 60180:tid 60190] [client 178.18.247.115:59205] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOnFhgd7ccS8EZg1pn5AAAAUg"]
[Wed Nov 12 21:41:49.415641 2025] [:error] [pid 60096:tid 60130] [client 178.18.247.115:58495] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOnTmzkhCvvk8DXOzEJAAAAIQ"]
[Wed Nov 12 21:41:49.415754 2025] [:error] [pid 60096:tid 60130] [client 178.18.247.115:58495] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 23"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOnTmzkhCvvk8DXOzEJAAAAIQ"]
[Wed Nov 12 21:41:50.460924 2025] [:error] [pid 60180:tid 60195] [client 178.18.247.115:50603] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOnlhgd7ccS8EZg1pn5wAAAU0"]
[Wed Nov 12 21:41:50.461105 2025] [:error] [pid 60180:tid 60195] [client 178.18.247.115:50603] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOnlhgd7ccS8EZg1pn5wAAAU0"]
[Wed Nov 12 21:41:51.507277 2025] [:error] [pid 60405:tid 60415] [client 178.18.247.115:65165] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOn3MGv_mlVi6mf5oj1QAAAAc"]
[Wed Nov 12 21:41:51.507414 2025] [:error] [pid 60405:tid 60415] [client 178.18.247.115:65165] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 13"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOn3MGv_mlVi6mf5oj1QAAAAc"]
[Wed Nov 12 21:41:52.547796 2025] [:error] [pid 23737:tid 23754] [client 178.18.247.115:52658] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOoBQUsVVfOZWgW_XcQwAAAYU"]
[Wed Nov 12 21:41:52.548100 2025] [:error] [pid 23737:tid 23754] [client 178.18.247.115:52658] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOoBQUsVVfOZWgW_XcQwAAAYU"]
[Wed Nov 12 21:41:53.541027 2025] [:error] [pid 60095:tid 60108] [client 178.18.247.115:53677] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOoXlw2elroagFF1pRpwAAAEk"]
[Wed Nov 12 21:41:53.541252 2025] [:error] [pid 60095:tid 60108] [client 178.18.247.115:53677] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 22"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOoXlw2elroagFF1pRpwAAAEk"]
[Wed Nov 12 21:41:54.580616 2025] [:error] [pid 12744:tid 12757] [client 178.18.247.115:52123] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOop1cp_ouUvkFj0WG3wAAAQk"]
[Wed Nov 12 21:41:54.580806 2025] [:error] [pid 12744:tid 12757] [client 178.18.247.115:52123] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 15"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOop1cp_ouUvkFj0WG3wAAAQk"]
[Wed Nov 12 21:41:55.579924 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:62107] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOo8dT5oio_TbWpi-e6AAAAMY"]
[Wed Nov 12 21:41:55.580099 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:62107] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOo8dT5oio_TbWpi-e6AAAAMY"]
[Wed Nov 12 21:41:56.584240 2025] [:error] [pid 60097:tid 60169] [client 178.18.247.115:51289] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOpMdT5oio_TbWpi-e6gAAANA"]
[Wed Nov 12 21:41:56.584371 2025] [:error] [pid 60097:tid 60169] [client 178.18.247.115:51289] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOpMdT5oio_TbWpi-e6gAAANA"]
[Wed Nov 12 21:41:57.612256 2025] [:error] [pid 60097:tid 60144] [client 178.18.247.115:61703] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOpcdT5oio_TbWpi-e7QAAAME"]
[Wed Nov 12 21:41:57.612373 2025] [:error] [pid 60097:tid 60144] [client 178.18.247.115:61703] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOpcdT5oio_TbWpi-e7QAAAME"]
[Wed Nov 12 21:41:58.672239 2025] [:error] [pid 60097:tid 60150] [client 178.18.247.115:49565] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOpsdT5oio_TbWpi-e8AAAAMQ"]
[Wed Nov 12 21:41:58.672346 2025] [:error] [pid 60097:tid 60150] [client 178.18.247.115:49565] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOpsdT5oio_TbWpi-e8AAAAMQ"]
[Wed Nov 12 21:41:59.710433 2025] [:error] [pid 60405:tid 60411] [client 178.18.247.115:51544] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOp3MGv_mlVi6mf5oj2QAAAAM"]
[Wed Nov 12 21:41:59.710559 2025] [:error] [pid 60405:tid 60411] [client 178.18.247.115:51544] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 12"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOp3MGv_mlVi6mf5oj2QAAAAM"]
[Wed Nov 12 21:42:00.909107 2025] [:error] [pid 60097:tid 60170] [client 178.18.247.115:59678] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOqMdT5oio_TbWpi-e9AAAANE"]
[Wed Nov 12 21:42:00.909233 2025] [:error] [pid 60097:tid 60170] [client 178.18.247.115:59678] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOqMdT5oio_TbWpi-e9AAAANE"]
[Wed Nov 12 21:42:01.953924 2025] [:error] [pid 60180:tid 60205] [client 178.18.247.115:49299] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOqVhgd7ccS8EZg1pn9gAAAVc"]
[Wed Nov 12 21:42:01.954117 2025] [:error] [pid 60180:tid 60205] [client 178.18.247.115:49299] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOqVhgd7ccS8EZg1pn9gAAAVc"]
[Wed Nov 12 21:42:03.011396 2025] [:error] [pid 60405:tid 60422] [client 178.18.247.115:62231] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOq3MGv_mlVi6mf5oj3gAAAA4"]
[Wed Nov 12 21:42:03.011555 2025] [:error] [pid 60405:tid 60422] [client 178.18.247.115:62231] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOq3MGv_mlVi6mf5oj3gAAAA4"]
[Wed Nov 12 21:42:04.062976 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:62234] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOrFhgd7ccS8EZg1pn-AAAAU4"]
[Wed Nov 12 21:42:04.063212 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:62234] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOrFhgd7ccS8EZg1pn-AAAAU4"]
[Wed Nov 12 21:42:05.119872 2025] [:error] [pid 60096:tid 60140] [client 178.18.247.115:57448] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOrTmzkhCvvk8DXOzELgAAAI0"]
[Wed Nov 12 21:42:05.120047 2025] [:error] [pid 60096:tid 60140] [client 178.18.247.115:57448] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 24"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOrTmzkhCvvk8DXOzELgAAAI0"]
[Wed Nov 12 21:42:06.134902 2025] [:error] [pid 60405:tid 60427] [client 178.18.247.115:52182] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOrnMGv_mlVi6mf5oj4QAAABM"]
[Wed Nov 12 21:42:06.135033 2025] [:error] [pid 60405:tid 60427] [client 178.18.247.115:52182] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 26"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOrnMGv_mlVi6mf5oj4QAAABM"]
[Wed Nov 12 21:42:07.205564 2025] [:error] [pid 60180:tid 60195] [client 178.18.247.115:55112] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOr1hgd7ccS8EZg1pn_gAAAU0"]
[Wed Nov 12 21:42:07.205691 2025] [:error] [pid 60180:tid 60195] [client 178.18.247.115:55112] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 24"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOr1hgd7ccS8EZg1pn_gAAAU0"]
[Wed Nov 12 21:42:08.254409 2025] [:error] [pid 60096:tid 60156] [client 178.18.247.115:55589] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOsDmzkhCvvk8DXOzEMAAAAJY"]
[Wed Nov 12 21:42:08.254554 2025] [:error] [pid 60096:tid 60156] [client 178.18.247.115:55589] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOsDmzkhCvvk8DXOzEMAAAAJY"]
[Wed Nov 12 21:42:09.329637 2025] [:error] [pid 23737:tid 23763] [client 178.18.247.115:58401] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOsRQUsVVfOZWgW_XcWQAAAY4"]
[Wed Nov 12 21:42:09.329786 2025] [:error] [pid 23737:tid 23763] [client 178.18.247.115:58401] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOsRQUsVVfOZWgW_XcWQAAAY4"]
[Wed Nov 12 21:42:10.461058 2025] [:error] [pid 12744:tid 12762] [client 178.18.247.115:62673] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOsp1cp_ouUvkFj0WG6AAAAQ4"]
[Wed Nov 12 21:42:10.461290 2025] [:error] [pid 12744:tid 12762] [client 178.18.247.115:62673] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 22"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOsp1cp_ouUvkFj0WG6AAAAQ4"]
[Wed Nov 12 21:42:11.491239 2025] [:error] [pid 60405:tid 60417] [client 178.18.247.115:61844] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOs3MGv_mlVi6mf5oj6wAAAAk"]
[Wed Nov 12 21:42:11.491364 2025] [:error] [pid 60405:tid 60417] [client 178.18.247.115:61844] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOs3MGv_mlVi6mf5oj6wAAAAk"]
[Wed Nov 12 21:42:12.536210 2025] [:error] [pid 60096:tid 60158] [client 178.18.247.115:56068] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOtDmzkhCvvk8DXOzEOAAAAJg"]
[Wed Nov 12 21:42:12.536327 2025] [:error] [pid 60096:tid 60158] [client 178.18.247.115:56068] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 25"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOtDmzkhCvvk8DXOzEOAAAAJg"]
[Wed Nov 12 21:42:13.525368 2025] [:error] [pid 60180:tid 60199] [client 178.18.247.115:59674] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOtVhgd7ccS8EZg1poBgAAAVE"]
[Wed Nov 12 21:42:13.525485 2025] [:error] [pid 60180:tid 60199] [client 178.18.247.115:59674] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOtVhgd7ccS8EZg1poBgAAAVE"]
[Wed Nov 12 21:42:14.553973 2025] [:error] [pid 60096:tid 60140] [client 178.18.247.115:50393] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOtjmzkhCvvk8DXOzEPQAAAI0"]
[Wed Nov 12 21:42:14.554233 2025] [:error] [pid 60096:tid 60140] [client 178.18.247.115:50393] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 14"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOtjmzkhCvvk8DXOzEPQAAAI0"]
[Wed Nov 12 21:42:15.579206 2025] [:error] [pid 60405:tid 60410] [client 178.18.247.115:58538] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOt3MGv_mlVi6mf5oj7gAAAAI"]
[Wed Nov 12 21:42:15.579330 2025] [:error] [pid 60405:tid 60410] [client 178.18.247.115:58538] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOt3MGv_mlVi6mf5oj7gAAAAI"]
[Wed Nov 12 21:42:16.578075 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:62267] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOuFhgd7ccS8EZg1poDQAAAUc"]
[Wed Nov 12 21:42:16.578209 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:62267] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 27"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOuFhgd7ccS8EZg1poDQAAAUc"]
[Wed Nov 12 21:42:17.552142 2025] [:error] [pid 60095:tid 60116] [client 178.18.247.115:54719] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOuXlw2elroagFF1pRtgAAAFE"]
[Wed Nov 12 21:42:17.552234 2025] [:error] [pid 60095:tid 60116] [client 178.18.247.115:54719] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOuXlw2elroagFF1pRtgAAAFE"]
[Wed Nov 12 21:42:18.553192 2025] [:error] [pid 60096:tid 60157] [client 178.18.247.115:56812] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOujmzkhCvvk8DXOzERAAAAJc"]
[Wed Nov 12 21:42:18.553323 2025] [:error] [pid 60096:tid 60157] [client 178.18.247.115:56812] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 26"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOujmzkhCvvk8DXOzERAAAAJc"]
[Wed Nov 12 21:42:19.610449 2025] [:error] [pid 23737:tid 23765] [client 178.18.247.115:52753] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOuxQUsVVfOZWgW_XcYAAAAZA"]
[Wed Nov 12 21:42:19.610567 2025] [:error] [pid 23737:tid 23765] [client 178.18.247.115:52753] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 27"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOuxQUsVVfOZWgW_XcYAAAAZA"]
[Wed Nov 12 21:42:20.588941 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:64468] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOvBQUsVVfOZWgW_XcZAAAAYc"]
[Wed Nov 12 21:42:20.589153 2025] [:error] [pid 23737:tid 23756] [client 178.18.247.115:64468] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 28"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOvBQUsVVfOZWgW_XcZAAAAYc"]
[Wed Nov 12 21:42:21.647291 2025] [:error] [pid 60097:tid 60142] [client 178.18.247.115:55860] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOvcdT5oio_TbWpi-e_gAAAMA"]
[Wed Nov 12 21:42:21.647405 2025] [:error] [pid 60097:tid 60142] [client 178.18.247.115:55860] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOvcdT5oio_TbWpi-e_gAAAMA"]
[Wed Nov 12 21:42:22.687815 2025] [:error] [pid 60096:tid 60141] [client 178.18.247.115:49591] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOvjmzkhCvvk8DXOzETQAAAI4"]
[Wed Nov 12 21:42:22.687982 2025] [:error] [pid 60096:tid 60141] [client 178.18.247.115:49591] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOvjmzkhCvvk8DXOzETQAAAI4"]
[Wed Nov 12 21:42:23.781116 2025] [:error] [pid 60097:tid 60171] [client 178.18.247.115:50004] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOv8dT5oio_TbWpi-fAQAAANI"]
[Wed Nov 12 21:42:23.781240 2025] [:error] [pid 60097:tid 60171] [client 178.18.247.115:50004] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOv8dT5oio_TbWpi-fAQAAANI"]
[Wed Nov 12 21:42:24.813142 2025] [:error] [pid 60097:tid 60164] [client 178.18.247.115:58378] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOwMdT5oio_TbWpi-fBAAAAMs"]
[Wed Nov 12 21:42:24.813272 2025] [:error] [pid 60097:tid 60164] [client 178.18.247.115:58378] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 24"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOwMdT5oio_TbWpi-fBAAAAMs"]
[Wed Nov 12 21:42:25.843511 2025] [:error] [pid 60095:tid 60109] [client 178.18.247.115:58378] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOwXlw2elroagFF1pRvgAAAEo"]
[Wed Nov 12 21:42:25.843662 2025] [:error] [pid 60095:tid 60109] [client 178.18.247.115:58378] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 27"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOwXlw2elroagFF1pRvgAAAEo"]
[Wed Nov 12 21:42:26.873693 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:49409] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOwlhgd7ccS8EZg1poEwAAAU4"]
[Wed Nov 12 21:42:26.873872 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:49409] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 29"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOwlhgd7ccS8EZg1poEwAAAU4"]
[Wed Nov 12 21:42:27.865323 2025] [:error] [pid 60180:tid 60186] [client 178.18.247.115:53178] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOw1hgd7ccS8EZg1poFgAAAUQ"]
[Wed Nov 12 21:42:27.865440 2025] [:error] [pid 60180:tid 60186] [client 178.18.247.115:53178] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOw1hgd7ccS8EZg1poFgAAAUQ"]
[Wed Nov 12 21:42:28.902407 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:57097] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxFhgd7ccS8EZg1poGQAAAUc"]
[Wed Nov 12 21:42:28.902586 2025] [:error] [pid 60180:tid 60189] [client 178.18.247.115:57097] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxFhgd7ccS8EZg1poGQAAAUc"]
[Wed Nov 12 21:42:29.938634 2025] [:error] [pid 60405:tid 60413] [client 178.18.247.115:53806] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxXMGv_mlVi6mf5oj_gAAAAU"]
[Wed Nov 12 21:42:29.938774 2025] [:error] [pid 60405:tid 60413] [client 178.18.247.115:53806] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 22"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxXMGv_mlVi6mf5oj_gAAAAU"]
[Wed Nov 12 21:42:30.983320 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:56886] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxnMGv_mlVi6mf5okAAAAABc"]
[Wed Nov 12 21:42:30.983437 2025] [:error] [pid 60405:tid 60431] [client 178.18.247.115:56886] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 29"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxnMGv_mlVi6mf5okAAAAABc"]
[Wed Nov 12 21:42:31.982487 2025] [:error] [pid 60096:tid 60157] [client 178.18.247.115:56815] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxzmzkhCvvk8DXOzEVwAAAJc"]
[Wed Nov 12 21:42:31.982633 2025] [:error] [pid 60096:tid 60157] [client 178.18.247.115:56815] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOxzmzkhCvvk8DXOzEVwAAAJc"]
[Wed Nov 12 21:42:33.013325 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:58318] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOyTmzkhCvvk8DXOzEWgAAAIg"]
[Wed Nov 12 21:42:33.013430 2025] [:error] [pid 60096:tid 60134] [client 178.18.247.115:58318] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 27"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOyTmzkhCvvk8DXOzEWgAAAIg"]
[Wed Nov 12 21:42:34.046521 2025] [:error] [pid 60180:tid 60186] [client 178.18.247.115:51207] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOylhgd7ccS8EZg1poHwAAAUQ"]
[Wed Nov 12 21:42:34.046637 2025] [:error] [pid 60180:tid 60186] [client 178.18.247.115:51207] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOylhgd7ccS8EZg1poHwAAAUQ"]
[Wed Nov 12 21:42:35.082482 2025] [:error] [pid 60180:tid 60182] [client 178.18.247.115:52345] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOy1hgd7ccS8EZg1poIQAAAUA"]
[Wed Nov 12 21:42:35.082674 2025] [:error] [pid 60180:tid 60182] [client 178.18.247.115:52345] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOy1hgd7ccS8EZg1poIQAAAUA"]
[Wed Nov 12 21:42:36.109751 2025] [:error] [pid 12744:tid 12771] [client 178.18.247.115:64084] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOzJ1cp_ouUvkFj0WG8wAAARc"]
[Wed Nov 12 21:42:36.109751 2025] [:error] [pid 12744:tid 12771] [client 178.18.247.115:64084] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 16"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOzJ1cp_ouUvkFj0WG8wAAARc"]
[Wed Nov 12 21:42:37.134815 2025] [:error] [pid 60096:tid 60132] [client 178.18.247.115:52992] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOzTmzkhCvvk8DXOzEXQAAAIY"]
[Wed Nov 12 21:42:37.135019 2025] [:error] [pid 60096:tid 60132] [client 178.18.247.115:52992] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 17"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOzTmzkhCvvk8DXOzEXQAAAIY"]
[Wed Nov 12 21:42:38.163338 2025] [:error] [pid 60180:tid 60204] [client 178.18.247.115:52656] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOzlhgd7ccS8EZg1poKQAAAVY"]
[Wed Nov 12 21:42:38.163474 2025] [:error] [pid 60180:tid 60204] [client 178.18.247.115:52656] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 24"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOzlhgd7ccS8EZg1poKQAAAVY"]
[Wed Nov 12 21:42:39.166362 2025] [:error] [pid 60180:tid 60201] [client 178.18.247.115:63977] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOz1hgd7ccS8EZg1poKwAAAVM"]
[Wed Nov 12 21:42:39.166504 2025] [:error] [pid 60180:tid 60201] [client 178.18.247.115:63977] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSOz1hgd7ccS8EZg1poKwAAAVM"]
[Wed Nov 12 21:42:40.265206 2025] [:error] [pid 12744:tid 12769] [client 178.18.247.115:51583] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO0J1cp_ouUvkFj0WG-gAAARU"]
[Wed Nov 12 21:42:40.265335 2025] [:error] [pid 12744:tid 12769] [client 178.18.247.115:51583] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 23"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO0J1cp_ouUvkFj0WG-gAAARU"]
[Wed Nov 12 21:42:41.242685 2025] [:error] [pid 60096:tid 60131] [client 178.18.247.115:60021] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO0TmzkhCvvk8DXOzEYwAAAIU"]
[Wed Nov 12 21:42:41.242833 2025] [:error] [pid 60096:tid 60131] [client 178.18.247.115:60021] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 29"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO0TmzkhCvvk8DXOzEYwAAAIU"]
[Wed Nov 12 21:42:42.227014 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:60270] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO0hQUsVVfOZWgW_XccAAAAY8"]
[Wed Nov 12 21:42:42.227166 2025] [:error] [pid 23737:tid 23764] [client 178.18.247.115:60270] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 18"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO0hQUsVVfOZWgW_XccAAAAY8"]
[Wed Nov 12 21:42:43.249284 2025] [:error] [pid 60180:tid 60184] [client 178.18.247.115:62849] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO01hgd7ccS8EZg1poMAAAAUI"]
[Wed Nov 12 21:42:43.249412 2025] [:error] [pid 60180:tid 60184] [client 178.18.247.115:62849] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO01hgd7ccS8EZg1poMAAAAUI"]
[Wed Nov 12 21:42:44.289899 2025] [:error] [pid 60097:tid 60167] [client 178.18.247.115:58337] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO1MdT5oio_TbWpi-fEwAAAM4"]
[Wed Nov 12 21:42:44.290080 2025] [:error] [pid 60097:tid 60167] [client 178.18.247.115:58337] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO1MdT5oio_TbWpi-fEwAAAM4"]
[Wed Nov 12 21:42:45.291283 2025] [:error] [pid 12744:tid 12749] [client 178.18.247.115:50847] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO1Z1cp_ouUvkFj0WHAwAAAQE"]
[Wed Nov 12 21:42:45.291396 2025] [:error] [pid 12744:tid 12749] [client 178.18.247.115:50847] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 20"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO1Z1cp_ouUvkFj0WHAwAAAQE"]
[Wed Nov 12 21:42:46.322700 2025] [:error] [pid 60097:tid 60152] [client 178.18.247.115:54530] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO1sdT5oio_TbWpi-fGAAAAMU"]
[Wed Nov 12 21:42:46.322849 2025] [:error] [pid 60097:tid 60152] [client 178.18.247.115:54530] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 25"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO1sdT5oio_TbWpi-fGAAAAMU"]
[Wed Nov 12 21:42:47.296277 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:61644] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO18dT5oio_TbWpi-fGQAAAMY"]
[Wed Nov 12 21:42:47.296434 2025] [:error] [pid 60097:tid 60154] [client 178.18.247.115:61644] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 21"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO18dT5oio_TbWpi-fGQAAAMY"]
[Wed Nov 12 21:42:48.357056 2025] [:error] [pid 60180:tid 60199] [client 178.18.247.115:63634] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2Fhgd7ccS8EZg1poNQAAAVE"]
[Wed Nov 12 21:42:48.357186 2025] [:error] [pid 60180:tid 60199] [client 178.18.247.115:63634] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 22"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2Fhgd7ccS8EZg1poNQAAAVE"]
[Wed Nov 12 21:42:49.413960 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:65184] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2Vhgd7ccS8EZg1poNgAAAU4"]
[Wed Nov 12 21:42:49.414117 2025] [:error] [pid 60180:tid 60196] [client 178.18.247.115:65184] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 19"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2Vhgd7ccS8EZg1poNgAAAU4"]
[Wed Nov 12 21:42:50.404851 2025] [:error] [pid 23737:tid 23771] [client 178.18.247.115:62700] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2hQUsVVfOZWgW_XcfAAAAZY"]
[Wed Nov 12 21:42:50.404953 2025] [:error] [pid 23737:tid 23771] [client 178.18.247.115:62700] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 34"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2hQUsVVfOZWgW_XcfAAAAZY"]
[Wed Nov 12 21:42:51.439620 2025] [:error] [pid 23737:tid 23753] [client 178.18.247.115:65230] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2xQUsVVfOZWgW_XcfQAAAYQ"]
[Wed Nov 12 21:42:51.439810 2025] [:error] [pid 23737:tid 23753] [client 178.18.247.115:65230] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 26"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO2xQUsVVfOZWgW_XcfQAAAYQ"]
[Wed Nov 12 21:42:52.533303 2025] [:error] [pid 60180:tid 60200] [client 178.18.247.115:57886] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO3Fhgd7ccS8EZg1poOwAAAVI"]
[Wed Nov 12 21:42:52.533462 2025] [:error] [pid 60180:tid 60200] [client 178.18.247.115:57886] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 33"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO3Fhgd7ccS8EZg1poOwAAAVI"]
[Wed Nov 12 21:42:53.557346 2025] [:error] [pid 60180:tid 60185] [client 178.18.247.115:50201] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO3Vhgd7ccS8EZg1poQgAAAUM"]
[Wed Nov 12 21:42:53.557504 2025] [:error] [pid 60180:tid 60185] [client 178.18.247.115:50201] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 22"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO3Vhgd7ccS8EZg1poQgAAAUM"]
[Wed Nov 12 21:42:54.585732 2025] [:error] [pid 23737:tid 23767] [client 178.18.247.115:64863] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO3hQUsVVfOZWgW_XcgwAAAZI"]
[Wed Nov 12 21:42:54.585884 2025] [:error] [pid 23737:tid 23767] [client 178.18.247.115:64863] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 34"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO3hQUsVVfOZWgW_XcgwAAAZI"]
[Wed Nov 12 21:42:55.828629 2025] [:error] [pid 12744:tid 12767] [client 178.18.247.115:61658] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO351cp_ouUvkFj0WHCAAAARM"]
[Wed Nov 12 21:42:55.828758 2025] [:error] [pid 12744:tid 12767] [client 178.18.247.115:61658] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 26"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO351cp_ouUvkFj0WHCAAAARM"]
[Wed Nov 12 21:42:56.938862 2025] [:error] [pid 12744:tid 12753] [client 178.18.247.115:57522] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO4J1cp_ouUvkFj0WHCwAAAQU"]
[Wed Nov 12 21:42:56.938998 2025] [:error] [pid 12744:tid 12753] [client 178.18.247.115:57522] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 23"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO4J1cp_ouUvkFj0WHCwAAAQU"]
[Wed Nov 12 21:42:57.993091 2025] [:error] [pid 23737:tid 23773] [client 178.18.247.115:60144] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO4RQUsVVfOZWgW_XcjwAAAZg"]
[Wed Nov 12 21:42:57.993248 2025] [:error] [pid 23737:tid 23773] [client 178.18.247.115:60144] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 23"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO4RQUsVVfOZWgW_XcjwAAAZg"]
[Wed Nov 12 21:42:59.027445 2025] [:error] [pid 60096:tid 60157] [client 178.18.247.115:59828] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO4zmzkhCvvk8DXOzEagAAAJc"]
[Wed Nov 12 21:42:59.027543 2025] [:error] [pid 60096:tid 60157] [client 178.18.247.115:59828] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 29"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO4zmzkhCvvk8DXOzEagAAAJc"]
[Wed Nov 12 21:43:00.024361 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:61825] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO5Hlw2elroagFF1pR1wAAAEg"]
[Wed Nov 12 21:43:00.024545 2025] [:error] [pid 60095:tid 60107] [client 178.18.247.115:61825] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 25"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO5Hlw2elroagFF1pR1wAAAEg"]
[Wed Nov 12 21:43:01.070291 2025] [:error] [pid 12744:tid 12756] [client 178.18.247.115:49723] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO5Z1cp_ouUvkFj0WHEQAAAQg"]
[Wed Nov 12 21:43:01.070416 2025] [:error] [pid 12744:tid 12756] [client 178.18.247.115:49723] [client 178.18.247.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 178.18.247.115, counter = 23"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aRSO5Z1cp_ouUvkFj0WHEQAAAQg"]
[Thu Nov 13 04:12:02.123367 2025] [:error] [pid 7146:tid 7170] [client 45.153.34.41:49442] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aRTqElyWGVnwG_8vjcYSEQAAANQ"]
[Thu Nov 13 05:07:08.276896 2025] [:error] [pid 51491:tid 51497] [client 45.153.34.41:39558] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aRT2_NQaME15TQuGVKQBFgAAAME"]
[Thu Nov 13 07:21:34.895485 2025] [:error] [pid 22224:tid 22304] [client 85.203.36.169:55405] [client 85.203.36.169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aRUWfruEVuTj3a_UBfAfTgAAAJg"]
[Thu Nov 13 10:31:07.208354 2025] [:error] [pid 62303:tid 62319] [client 43.153.135.208:44790] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRVC67-hlFTtVrZw8jA31wAAAIw"]
[Thu Nov 13 10:42:14.797458 2025] [:error] [pid 62215:tid 62227] [client 49.51.38.193:37014] [client 49.51.38.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRVFhkvClof1c6XaOBURDAAAAMg"]
[Thu Nov 13 17:30:54.254745 2025] [:error] [pid 6086:tid 6110] [client 182.42.110.255:54121] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRWlTn9_6CRZzjZnAe0t2QAAARU"]
[Thu Nov 13 17:55:43.291671 2025] [:error] [pid 62303:tid 62316] [client 150.241.107.255:56145] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRWrH7-hlFTtVrZw8jDoEgAAAIk"]
[Thu Nov 13 17:55:43.839042 2025] [:error] [pid 6086:tid 6093] [client 150.241.107.255:56396] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRWrH39_6CRZzjZnAe0zQQAAAQQ"]
[Thu Nov 13 17:55:44.387264 2025] [:error] [pid 62216:tid 62250] [client 150.241.107.255:56646] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrIOpyFB9M2aVQhwM0mgAAAAM"]
[Thu Nov 13 21:56:03.452897 2025] [:error] [pid 5086:tid 5091] [client 54.233.4.165:33196] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aRXjcx_dsYLFCHw574iqQQAAAQI"], referer: https://www.google.com/
[Thu Nov 13 21:56:04.135450 2025] [:error] [pid 5086:tid 5107] [client 54.233.4.165:33308] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aRXjdB_dsYLFCHw574iqRwAAARI"], referer: https://www.google.com/
[Thu Nov 13 21:56:04.767746 2025] [:error] [pid 4993:tid 5031] [client 54.233.4.165:33394] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev"] [unique_id "aRXjdMl_cC0Js5xNCU1GNQAAAAU"], referer: https://www.google.com/
[Thu Nov 13 21:56:05.497131 2025] [:error] [pid 4994:tid 5061] [client 54.233.4.165:33496] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.prod"] [unique_id "aRXjdQVaYoYtjfBbabUODQAAAIg"], referer: https://www.google.com/
[Thu Nov 13 21:56:06.128660 2025] [:error] [pid 4993:tid 5032] [client 54.233.4.165:33594] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "aRXjdsl_cC0Js5xNCU1GPgAAAAY"], referer: https://www.google.com/
[Thu Nov 13 21:56:06.757337 2025] [:error] [pid 4992:tid 5001] [client 54.233.4.165:33706] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "aRXjdimsutP7nusdj-CDvwAAAMU"], referer: https://www.google.com/
[Thu Nov 13 21:56:07.464385 2025] [:error] [pid 5086:tid 5089] [client 54.233.4.165:33798] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aRXjdx_dsYLFCHw574iqUAAAAQA"], referer: https://www.google.com/
[Thu Nov 13 21:56:08.096847 2025] [:error] [pid 4992:tid 5019] [client 54.233.4.165:33928] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "aRXjeCmsutP7nusdj-CDwQAAANc"], referer: https://www.google.com/
[Thu Nov 13 21:56:08.791442 2025] [:error] [pid 4993:tid 5045] [client 54.233.4.165:34056] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aRXjeMl_cC0Js5xNCU1GQAAAABM"], referer: https://www.google.com/
[Thu Nov 13 21:56:09.450850 2025] [:error] [pid 4994:tid 5070] [client 54.233.4.165:34192] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.example"] [unique_id "aRXjeQVaYoYtjfBbabUOEwAAAJE"], referer: https://www.google.com/
[Thu Nov 13 21:56:10.086445 2025] [:error] [pid 4994:tid 5066] [client 54.233.4.165:34310] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.sample"] [unique_id "aRXjegVaYoYtjfBbabUOFgAAAI0"], referer: https://www.google.com/
[Thu Nov 13 21:56:10.836165 2025] [:error] [pid 4994:tid 5068] [client 54.233.4.165:34422] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "aRXjegVaYoYtjfBbabUOGQAAAI8"], referer: https://www.google.com/
[Thu Nov 13 21:56:11.526131 2025] [:error] [pid 4992:tid 5004] [client 54.233.4.165:34554] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "aRXjeymsutP7nusdj-CDxAAAAMg"], referer: https://www.google.com/
[Thu Nov 13 21:56:12.201869 2025] [:error] [pid 5086:tid 5098] [client 54.233.4.165:34640] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.save"] [unique_id "aRXjfB_dsYLFCHw574iqXwAAAQk"], referer: https://www.google.com/
[Thu Nov 13 21:56:12.876954 2025] [:error] [pid 4993:tid 5030] [client 54.233.4.165:34790] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.orig"] [unique_id "aRXjfMl_cC0Js5xNCU1GRAAAAAQ"], referer: https://www.google.com/
[Thu Nov 13 21:56:13.568294 2025] [:error] [pid 4993:tid 5049] [client 54.233.4.165:34916] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.swp"] [unique_id "aRXjfcl_cC0Js5xNCU1GSQAAABc"], referer: https://www.google.com/
[Thu Nov 13 21:56:14.224062 2025] [:error] [pid 4993:tid 5040] [client 54.233.4.165:34990] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env~"] [unique_id "aRXjfsl_cC0Js5xNCU1GTAAAAA4"], referer: https://www.google.com/
[Thu Nov 13 21:56:14.875283 2025] [:error] [pid 4993:tid 5050] [client 54.233.4.165:35130] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.tmp"] [unique_id "aRXjfsl_cC0Js5xNCU1GTgAAABg"], referer: https://www.google.com/
[Thu Nov 13 21:56:15.600919 2025] [:error] [pid 4992:tid 5020] [client 54.233.4.165:35230] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dist"] [unique_id "aRXjfymsutP7nusdj-CDxQAAANg"], referer: https://www.google.com/
[Thu Nov 13 21:56:16.365882 2025] [:error] [pid 4994:tid 5073] [client 54.233.4.165:35312] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env"] [unique_id "aRXjgAVaYoYtjfBbabUOIwAAAJQ"], referer: https://www.google.com/
[Thu Nov 13 21:56:17.000360 2025] [:error] [pid 5086:tid 5108] [client 54.233.4.165:35442] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env.save"] [unique_id "aRXjgB_dsYLFCHw574iqZAAAARM"], referer: https://www.google.com/
[Thu Nov 13 21:56:17.720504 2025] [:error] [pid 5086:tid 5106] [client 54.233.4.165:35556] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env.bak"] [unique_id "aRXjgR_dsYLFCHw574iqZgAAARE"], referer: https://www.google.com/
[Thu Nov 13 21:56:18.494224 2025] [:error] [pid 5086:tid 5091] [client 54.233.4.165:35652] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env.old"] [unique_id "aRXjgh_dsYLFCHw574iqaAAAAQI"], referer: https://www.google.com/
[Thu Nov 13 21:56:19.129353 2025] [:error] [pid 4992:tid 5001] [client 54.233.4.165:35770] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "aRXjgymsutP7nusdj-CD0AAAAMU"], referer: https://www.google.com/
[Thu Nov 13 21:56:19.778231 2025] [:error] [pid 4994:tid 5069] [client 54.233.4.165:35898] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env.save"] [unique_id "aRXjgwVaYoYtjfBbabUORgAAAJA"], referer: https://www.google.com/
[Thu Nov 13 21:56:20.489013 2025] [:error] [pid 4993:tid 5028] [client 54.233.4.165:35976] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env.bak"] [unique_id "aRXjhMl_cC0Js5xNCU1GZgAAAAI"], referer: https://www.google.com/
[Thu Nov 13 21:56:21.142116 2025] [:error] [pid 4994:tid 5053] [client 54.233.4.165:36078] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env.old"] [unique_id "aRXjhQVaYoYtjfBbabUOTAAAAIA"], referer: https://www.google.com/
[Thu Nov 13 21:56:21.792966 2025] [:error] [pid 4994:tid 5054] [client 54.233.4.165:36198] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "aRXjhQVaYoYtjfBbabUOUAAAAIE"], referer: https://www.google.com/
[Thu Nov 13 21:56:22.507944 2025] [:error] [pid 4993:tid 5033] [client 54.233.4.165:36310] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env.save"] [unique_id "aRXjhsl_cC0Js5xNCU1GbwAAAAc"], referer: https://www.google.com/
[Thu Nov 13 21:56:23.266261 2025] [:error] [pid 4993:tid 5040] [client 54.233.4.165:36406] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env.bak"] [unique_id "aRXjh8l_cC0Js5xNCU1GcAAAAA4"], referer: https://www.google.com/
[Thu Nov 13 21:56:23.920802 2025] [:error] [pid 5086:tid 5101] [client 54.233.4.165:36534] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env.old"] [unique_id "aRXjhx_dsYLFCHw574iqbgAAAQw"], referer: https://www.google.com/
[Thu Nov 13 21:56:24.725242 2025] [:error] [pid 4992:tid 5003] [client 54.233.4.165:36670] [client 54.233.4.165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/config/.env"] [unique_id "aRXjiCmsutP7nusdj-CD2AAAAMc"], referer: https://www.google.com/
[Thu Nov 13 22:51:43.310281 2025] [:error] [pid 4992:tid 5017] [client 45.138.16.29:60582] [client 45.138.16.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/postnews.php"] [unique_id "aRXwfymsutP7nusdj-CV-QAAANU"]
[Thu Nov 13 22:51:43.848494 2025] [:error] [pid 4993:tid 5028] [client 45.138.16.29:60660] [client 45.138.16.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aRXwf8l_cC0Js5xNCU1X2gAAAAI"]
[Thu Nov 13 22:51:44.379451 2025] [:error] [pid 4993:tid 5046] [client 45.138.16.29:60762] [client 45.138.16.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aRXwgMl_cC0Js5xNCU1X6QAAABQ"]
[Thu Nov 13 23:16:04.329863 2025] [:error] [pid 28868:tid 28881] [client 3.250.110.19:37252] [client 3.250.110.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aRX2NIq9fgBJ6LAEEDzijgAAAUs"]
[Thu Nov 13 23:20:36.951851 2025] [:error] [pid 4992:tid 4997] [client 56.124.114.197:44760] [client 56.124.114.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aRX3RCmsutP7nusdj-CdpwAAAME"]
[Thu Nov 13 23:58:14.048735 2025] [:error] [pid 28868:tid 28888] [client 43.130.9.111:38044] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRYAFoq9fgBJ6LAEEDzt-wAAAVI"]
[Fri Nov 14 01:45:28.185959 2025] [:error] [pid 49246:tid 49271] [client 43.166.246.180:53456] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRYZON-hdG_ZJBT6alPj0wAAAFU"]
[Fri Nov 14 09:17:03.356712 2025] [autoindex:error] [pid 59105:tid 59131] [client 157.245.63.215:58271] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 14 09:17:03.563882 2025] [autoindex:error] [pid 47242:tid 47256] [client 157.245.63.215:59506] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/themes/twentytwentythree/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 14 09:30:28.914209 2025] [:error] [pid 47154:tid 47166] [client 43.135.172.89:48508] [client 43.135.172.89] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRaGNEijA13A3g3ATrK2sgAAAAc"]
[Fri Nov 14 12:32:45.381922 2025] [:error] [pid 16709:tid 16716] [client 182.44.10.67:46394] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRaw7aNdzfVNC4oipLW2FgAAAUU"]
[Fri Nov 14 13:23:50.393599 2025] [:error] [pid 16574:tid 16630] [client 2.57.122.173:38618] [client 2.57.122.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aRa85v6XQqe4NqaoE9LbZgAAAJc"]
[Fri Nov 14 17:09:23.547208 2025] [:error] [pid 16709:tid 16715] [client 43.167.232.38:45162] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRbxw6NdzfVNC4oipLVOFwAAAUQ"]
[Fri Nov 14 18:37:31.886114 2025] [autoindex:error] [pid 16709:tid 16715] [client 134.209.221.235:65403] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Nov 14 19:34:40.684371 2025] [:error] [pid 16671:tid 16677] [client 43.135.133.194:45176] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRcT0DsoHwEAmeIzZXBwHQAAAQA"]
[Fri Nov 14 20:03:34.094881 2025] [:error] [pid 16573:tid 16597] [client 43.130.139.136:34462] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRcaliPGexfUk9FDoEK5FwAAAFM"]
[Fri Nov 14 21:24:34.545008 2025] [:error] [pid 1170:tid 1185] [client 43.157.46.118:57518] [client 43.157.46.118] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRctkg5pkvzCDzzjItSM7gAAAA0"]
[Fri Nov 14 23:04:02.751557 2025] [:error] [pid 16573:tid 16582] [client 43.135.133.241:41794] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRdE4iPGexfUk9FDoELoPAAAAEQ"]
[Fri Nov 14 23:56:14.345946 2025] [:error] [pid 16574:tid 16622] [client 43.157.168.43:53204] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRdRHv6XQqe4NqaoE9KPfgAAAI8"]
[Sat Nov 15 05:28:57.873075 2025] [:error] [pid 27910:tid 27952] [client 35.192.84.27:43880] [client 35.192.84.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aRefGY6e1LusHMYkS7ZNlgAAAEs"]
[Sat Nov 15 07:33:04.838231 2025] [:error] [pid 27910:tid 27945] [client 52.167.165.248:7740] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filei.php"] [unique_id "aRe8MI6e1LusHMYkS7Z2DgAAAEQ"]
[Sat Nov 15 07:33:08.900493 2025] [:error] [pid 27911:tid 27972] [client 52.167.165.248:5380] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filei.php"] [unique_id "aRe8NMGzUdrhGBIfiKTlWQAAAIQ"]
[Sat Nov 15 07:33:11.138796 2025] [:error] [pid 27911:tid 27992] [client 52.167.165.248:5963] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filei.php"] [unique_id "aRe8N8GzUdrhGBIfiKTlXgAAAJg"]
[Sat Nov 15 07:33:14.516113 2025] [:error] [pid 37318:tid 37372] [client 52.167.165.248:5994] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filei.php"] [unique_id "aRe8OugM1rHoEAqoQDdb4QAAAQo"]
[Sat Nov 15 07:33:17.895004 2025] [:error] [pid 27911:tid 27970] [client 52.167.165.248:7679] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aRe8PcGzUdrhGBIfiKTlaQAAAII"]
[Sat Nov 15 07:33:25.763839 2025] [:error] [pid 27909:tid 27914] [client 52.167.165.248:8995] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aRe8RSTfZ6B57n8HepWtcAAAAAE"]
[Sat Nov 15 07:33:29.047610 2025] [:error] [pid 37318:tid 37381] [client 52.167.165.248:7672] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aRe8SegM1rHoEAqoQDdb-gAAARM"]
[Sat Nov 15 07:33:30.668890 2025] [:error] [pid 27997:tid 28001] [client 52.167.165.248:2329] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aRe8Stpja_6cDxKbxFlDUgAAAMI"]
[Sat Nov 15 07:33:34.689644 2025] [:error] [pid 27997:tid 28017] [client 52.167.165.248:6892] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aRe8Ttpja_6cDxKbxFlDWQAAANI"]
[Sat Nov 15 07:33:47.010523 2025] [:error] [pid 27909:tid 27922] [client 52.167.165.248:1265] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aRe8WyTfZ6B57n8HepWthgAAAAk"]
[Sat Nov 15 07:33:48.359451 2025] [:error] [pid 27911:tid 27975] [client 52.167.165.248:2319] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aRe8XMGzUdrhGBIfiKTljQAAAIc"]
[Sat Nov 15 07:34:27.688103 2025] [:error] [pid 27911:tid 27982] [client 52.167.165.248:2764] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aRe8g8GzUdrhGBIfiKTl0AAAAI4"]
[Sat Nov 15 07:34:29.672902 2025] [:error] [pid 27909:tid 27915] [client 52.167.165.248:2757] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aRe8hSTfZ6B57n8HepWttwAAAAI"]
[Sat Nov 15 07:34:32.274901 2025] [:error] [pid 27997:tid 28017] [client 52.167.165.248:2256] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aRe8iNpja_6cDxKbxFlDqAAAANI"]
[Sat Nov 15 07:34:33.183387 2025] [:error] [pid 27909:tid 27918] [client 52.167.165.248:1640] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aRe8iSTfZ6B57n8HepWtvQAAAAU"]
[Sat Nov 15 07:35:25.366970 2025] [:error] [pid 27911:tid 27982] [client 52.167.165.248:7018] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nij.php"] [unique_id "aRe8vcGzUdrhGBIfiKTmHAAAAI4"]
[Sat Nov 15 07:35:32.508163 2025] [:error] [pid 37318:tid 37390] [client 52.167.165.248:1749] [client 52.167.165.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aRe8xOgM1rHoEAqoQDdc3wAAARg"]
[Sat Nov 15 07:36:10.949699 2025] [:error] [pid 27911:tid 27985] [client 52.167.165.248:8043] [client 52.167.165.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aRe86sGzUdrhGBIfiKTmYwAAAJE"]
[Sat Nov 15 07:36:15.612796 2025] [:error] [pid 27909:tid 27925] [client 52.167.165.248:4968] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aRe87yTfZ6B57n8HepWuRAAAAAw"]
[Sat Nov 15 07:36:19.502592 2025] [:error] [pid 27997:tid 28007] [client 52.167.165.248:2103] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aRe889pja_6cDxKbxFlEIgAAAMg"]
[Sat Nov 15 07:36:20.948215 2025] [:error] [pid 27910:tid 27941] [client 52.167.165.248:4848] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aRe89I6e1LusHMYkS7Z3BAAAAEA"]
[Sat Nov 15 07:36:22.434077 2025] [:error] [pid 27910:tid 27961] [client 52.167.165.248:8350] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aRe89o6e1LusHMYkS7Z3CAAAAFQ"]
[Sat Nov 15 07:36:23.688991 2025] [:error] [pid 27997:tid 28002] [client 52.167.165.248:2113] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cf.php"] [unique_id "aRe899pja_6cDxKbxFlEKQAAAMM"]
[Sat Nov 15 07:36:28.431981 2025] [:error] [pid 27910:tid 27955] [client 52.167.165.248:3217] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cf.php"] [unique_id "aRe8_I6e1LusHMYkS7Z3FQAAAE4"]
[Sat Nov 15 07:36:30.044107 2025] [:error] [pid 27911:tid 27969] [client 52.167.165.248:1124] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cf.php"] [unique_id "aRe8_sGzUdrhGBIfiKTmewAAAIE"]
[Sat Nov 15 07:36:39.189638 2025] [:error] [pid 37318:tid 37381] [client 52.167.165.248:6331] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/get.php"] [unique_id "aRe9B-gM1rHoEAqoQDddYQAAARM"]
[Sat Nov 15 07:36:40.310830 2025] [:error] [pid 27909:tid 27929] [client 52.167.165.248:3081] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/get.php"] [unique_id "aRe9CCTfZ6B57n8HepWuYAAAABA"]
[Sat Nov 15 07:36:55.856714 2025] [:error] [pid 27909:tid 27934] [client 52.167.165.248:4431] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aRe9FyTfZ6B57n8HepWueAAAABU"]
[Sat Nov 15 07:36:57.277213 2025] [:error] [pid 37318:tid 37390] [client 52.167.165.248:3452] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aRe9GegM1rHoEAqoQDddhwAAARg"]
[Sat Nov 15 07:37:01.742379 2025] [:error] [pid 27909:tid 27923] [client 52.167.165.248:3017] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aRe9HSTfZ6B57n8HepWugwAAAAo"]
[Sat Nov 15 07:37:03.032217 2025] [:error] [pid 27909:tid 27920] [client 52.167.165.248:3076] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aRe9HyTfZ6B57n8HepWuiQAAAAc"]
[Sat Nov 15 07:37:11.663088 2025] [:error] [pid 27909:tid 27935] [client 52.167.165.248:5274] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/ws.php"] [unique_id "aRe9JyTfZ6B57n8HepWukwAAABY"]
[Sat Nov 15 07:37:29.908566 2025] [:error] [pid 37318:tid 37379] [client 52.167.165.248:7976] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xojryvch.php"] [unique_id "aRe9OegM1rHoEAqoQDdd2gAAARE"]
[Sat Nov 15 07:37:35.669785 2025] [:error] [pid 27911:tid 27968] [client 52.167.165.248:9198] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xojryvch.php"] [unique_id "aRe9P8GzUdrhGBIfiKTm0wAAAIA"]
[Sat Nov 15 07:37:37.696633 2025] [:error] [pid 37318:tid 37378] [client 52.167.165.248:3702] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xojryvch.php"] [unique_id "aRe9QegM1rHoEAqoQDdd5wAAARA"]
[Sat Nov 15 07:37:43.686127 2025] [:error] [pid 27911:tid 27990] [client 52.167.165.248:3337] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xojryvch.php"] [unique_id "aRe9R8GzUdrhGBIfiKTm4QAAAJY"]
[Sat Nov 15 07:37:46.138829 2025] [:error] [pid 27909:tid 27934] [client 52.167.165.248:7190] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reyna.php"] [unique_id "aRe9SiTfZ6B57n8HepWuwwAAABU"]
[Sat Nov 15 07:37:51.890354 2025] [:error] [pid 37318:tid 37389] [client 52.167.165.248:4663] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reyna.php"] [unique_id "aRe9T-gM1rHoEAqoQDdd8QAAARc"]
[Sat Nov 15 07:37:58.838031 2025] [:error] [pid 27997:tid 28015] [client 52.167.165.248:7625] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reyna.php"] [unique_id "aRe9Vtpja_6cDxKbxFlE2AAAANA"]
[Sat Nov 15 07:38:03.625869 2025] [:error] [pid 37318:tid 37379] [client 52.167.165.248:7841] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aRe9W-gM1rHoEAqoQDdeAQAAARE"]
[Sat Nov 15 07:38:06.644804 2025] [:error] [pid 27911:tid 27991] [client 52.167.165.248:6061] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aRe9XsGzUdrhGBIfiKTnEQAAAJc"]
[Sat Nov 15 07:38:09.615127 2025] [:error] [pid 27910:tid 27960] [client 52.167.165.248:8982] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aRe9YY6e1LusHMYkS7Z36QAAAFM"]
[Sat Nov 15 07:38:13.522354 2025] [:error] [pid 27910:tid 27955] [client 52.167.165.248:9385] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aRe9ZY6e1LusHMYkS7Z39gAAAE4"]
[Sat Nov 15 07:38:21.771567 2025] [:error] [pid 27997:tid 28023] [client 52.167.165.248:8226] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/unzip.php"] [unique_id "aRe9bdpja_6cDxKbxFlE_AAAANg"]
[Sat Nov 15 07:38:22.778254 2025] [:error] [pid 27997:tid 28017] [client 52.167.165.248:4606] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/unzip.php"] [unique_id "aRe9btpja_6cDxKbxFlE_gAAANI"]
[Sat Nov 15 07:38:24.321377 2025] [:error] [pid 27909:tid 27929] [client 52.167.165.248:4567] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/unzip.php"] [unique_id "aRe9cCTfZ6B57n8HepWu9gAAABA"]
[Sat Nov 15 07:38:55.111800 2025] [:error] [pid 27911:tid 27970] [client 52.167.165.248:8369] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aRe9j8GzUdrhGBIfiKTncAAAAII"]
[Sat Nov 15 07:38:57.921859 2025] [:error] [pid 27997:tid 28022] [client 52.167.165.248:8858] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aRe9kdpja_6cDxKbxFlFNwAAANc"]
[Sat Nov 15 07:38:59.711453 2025] [:error] [pid 27910:tid 27954] [client 52.167.165.248:1925] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aRe9k46e1LusHMYkS7Z4MQAAAE0"]
[Sat Nov 15 07:39:01.436367 2025] [:error] [pid 27911:tid 27979] [client 52.167.165.248:8537] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aRe9lcGzUdrhGBIfiKTnegAAAIs"]
[Sat Nov 15 07:39:05.682850 2025] [:error] [pid 27910:tid 27965] [client 52.167.165.248:3279] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aRe9mY6e1LusHMYkS7Z4NwAAAFg"]
[Sat Nov 15 07:39:09.030346 2025] [:error] [pid 27911:tid 27971] [client 52.167.165.248:7719] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aRe9ncGzUdrhGBIfiKTnjAAAAIM"]
[Sat Nov 15 07:39:12.466428 2025] [:error] [pid 37318:tid 37374] [client 52.167.165.248:6190] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aRe9oOgM1rHoEAqoQDdeuQAAAQw"]
[Sat Nov 15 07:39:16.832939 2025] [:error] [pid 27997:tid 28020] [client 52.167.165.248:3470] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aRe9pNpja_6cDxKbxFlFXwAAANU"]
[Sat Nov 15 07:39:21.452300 2025] [:error] [pid 37318:tid 37374] [client 52.167.165.248:9634] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aRe9qegM1rHoEAqoQDdezAAAAQw"]
[Sat Nov 15 07:39:24.385055 2025] [:error] [pid 27911:tid 27992] [client 52.167.165.248:6155] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aRe9rMGzUdrhGBIfiKTnqQAAAJg"]
[Sat Nov 15 07:39:26.108298 2025] [:error] [pid 27909:tid 27913] [client 52.167.165.248:2578] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aRe9riTfZ6B57n8HepWvUAAAAAA"]
[Sat Nov 15 07:39:29.283520 2025] [:error] [pid 27910:tid 27951] [client 52.167.165.248:9497] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aRe9sY6e1LusHMYkS7Z4YgAAAEo"]
[Sat Nov 15 07:39:35.884327 2025] [:error] [pid 37318:tid 37375] [client 52.167.165.248:9512] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aRe9t-gM1rHoEAqoQDde5AAAAQ0"]
[Sat Nov 15 07:39:36.917802 2025] [:error] [pid 27997:tid 28005] [client 52.167.165.248:7436] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aRe9uNpja_6cDxKbxFlFoQAAAMY"]
[Sat Nov 15 07:39:46.409521 2025] [:error] [pid 37318:tid 37375] [client 52.167.165.248:5599] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffile.php"] [unique_id "aRe9wugM1rHoEAqoQDde_AAAAQ0"]
[Sat Nov 15 07:40:00.808019 2025] [:error] [pid 37318:tid 37382] [client 52.167.165.248:3596] [client 52.167.165.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/buy.php"] [unique_id "aRe90OgM1rHoEAqoQDdfLQAAARQ"]
[Sat Nov 15 07:40:13.745210 2025] [:error] [pid 37318:tid 37362] [client 52.167.165.248:9591] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bqcheck.php"] [unique_id "aRe93egM1rHoEAqoQDdfWQAAAQA"]
[Sat Nov 15 07:40:15.176632 2025] [:error] [pid 27997:tid 28002] [client 52.167.165.248:9560] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bqcheck.php"] [unique_id "aRe939pja_6cDxKbxFlGGQAAAMM"]
[Sat Nov 15 07:40:17.366397 2025] [:error] [pid 37318:tid 37372] [client 52.167.165.248:5863] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bqcheck.php"] [unique_id "aRe94egM1rHoEAqoQDdfXgAAAQo"]
[Sat Nov 15 07:40:18.607880 2025] [:error] [pid 27997:tid 28023] [client 52.167.165.248:4797] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bqcheck.php"] [unique_id "aRe94tpja_6cDxKbxFlGHwAAANg"]
[Sat Nov 15 07:40:20.307285 2025] [:error] [pid 27911:tid 27981] [client 52.167.165.248:5858] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "aRe95MGzUdrhGBIfiKToXgAAAI0"]
[Sat Nov 15 07:40:21.494957 2025] [:error] [pid 27910:tid 27945] [client 52.167.165.248:5866] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "aRe95Y6e1LusHMYkS7Z4oAAAAEQ"]
[Sat Nov 15 07:40:22.278211 2025] [:error] [pid 37318:tid 37381] [client 52.167.165.248:5763] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "aRe95ugM1rHoEAqoQDdfZgAAARM"]
[Sat Nov 15 07:40:23.675667 2025] [:error] [pid 27911:tid 27968] [client 52.167.165.248:5820] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "aRe958GzUdrhGBIfiKToYwAAAIA"]
[Sat Nov 15 07:40:25.935247 2025] [:error] [pid 27997:tid 28018] [client 52.167.165.248:4398] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aRe96dpja_6cDxKbxFlGLwAAANM"]
[Sat Nov 15 07:40:26.941233 2025] [:error] [pid 27910:tid 27949] [client 52.167.165.248:4744] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aRe96o6e1LusHMYkS7Z4rAAAAEg"]
[Sat Nov 15 07:40:28.052730 2025] [:error] [pid 27911:tid 27974] [client 52.167.165.248:8103] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aRe97MGzUdrhGBIfiKToaQAAAIY"]
[Sat Nov 15 07:40:29.946094 2025] [:error] [pid 27997:tid 28001] [client 52.167.165.248:5775] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aRe97dpja_6cDxKbxFlGOgAAAMI"]
[Sat Nov 15 07:40:37.546837 2025] [:error] [pid 37318:tid 37379] [client 52.167.165.248:8068] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bv3.php"] [unique_id "aRe99egM1rHoEAqoQDdfgAAAARE"]
[Sat Nov 15 07:40:38.745927 2025] [:error] [pid 37318:tid 37373] [client 52.167.165.248:4366] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bv3.php"] [unique_id "aRe99ugM1rHoEAqoQDdfhAAAAQs"]
[Sat Nov 15 07:40:41.253384 2025] [:error] [pid 27910:tid 27951] [client 52.167.165.248:5950] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bv3.php"] [unique_id "aRe9-Y6e1LusHMYkS7Z4wQAAAEo"]
[Sat Nov 15 07:40:41.836156 2025] [:error] [pid 37318:tid 37362] [client 52.167.165.248:5926] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bv3.php"] [unique_id "aRe9-egM1rHoEAqoQDdfiAAAAQA"]
[Sat Nov 15 07:40:44.697132 2025] [:error] [pid 27997:tid 28023] [client 52.167.165.248:5846] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aRe9_Npja_6cDxKbxFlGjwAAANg"]
[Sat Nov 15 07:41:01.477028 2025] [:error] [pid 37318:tid 37370] [client 52.167.165.248:4389] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/racs3.php"] [unique_id "aRe-DegM1rHoEAqoQDdfsAAAAQg"]
[Sat Nov 15 07:41:03.257709 2025] [:error] [pid 27911:tid 27986] [client 52.167.165.248:4357] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/racs3.php"] [unique_id "aRe-D8GzUdrhGBIfiKTotgAAAJI"]
[Sat Nov 15 07:41:36.671542 2025] [:error] [pid 37318:tid 37390] [client 52.167.165.248:4745] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aRe-MOgM1rHoEAqoQDdgGgAAARg"]
[Sat Nov 15 07:41:39.577433 2025] [:error] [pid 27911:tid 27985] [client 52.167.165.248:1044] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aRe-M8GzUdrhGBIfiKTo-QAAAJE"]
[Sat Nov 15 07:41:41.410427 2025] [:error] [pid 27997:tid 28005] [client 52.167.165.248:1235] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aRe-Ndpja_6cDxKbxFlHFgAAAMY"]
[Sat Nov 15 07:41:42.356852 2025] [:error] [pid 27911:tid 27991] [client 52.167.165.248:9352] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aRe-NsGzUdrhGBIfiKTpAAAAAJc"]
[Sat Nov 15 07:41:44.373168 2025] [:error] [pid 37318:tid 37362] [client 52.167.165.248:7648] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggs.php"] [unique_id "aRe-OOgM1rHoEAqoQDdgOwAAAQA"]
[Sat Nov 15 07:41:46.414800 2025] [:error] [pid 27909:tid 27929] [client 52.167.165.248:7358] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggs.php"] [unique_id "aRe-OiTfZ6B57n8HepWwVQAAABA"]
[Sat Nov 15 07:41:48.066408 2025] [:error] [pid 37318:tid 37383] [client 52.167.165.248:5497] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggs.php"] [unique_id "aRe-POgM1rHoEAqoQDdgSQAAARU"]
[Sat Nov 15 07:41:48.967903 2025] [:error] [pid 27909:tid 27934] [client 52.167.165.248:7023] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggs.php"] [unique_id "aRe-PCTfZ6B57n8HepWwXAAAABU"]
[Sat Nov 15 07:41:53.169950 2025] [:error] [pid 37318:tid 37376] [client 52.167.165.248:2683] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsr2.php"] [unique_id "aRe-QegM1rHoEAqoQDdgUgAAAQ4"]
[Sat Nov 15 07:41:54.185499 2025] [:error] [pid 37318:tid 37372] [client 52.167.165.248:3114] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsr2.php"] [unique_id "aRe-QugM1rHoEAqoQDdgWAAAAQo"]
[Sat Nov 15 07:41:57.058827 2025] [:error] [pid 27997:tid 28009] [client 52.167.165.248:7028] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsr2.php"] [unique_id "aRe-Rdpja_6cDxKbxFlHUgAAAMo"]
[Sat Nov 15 07:41:59.724889 2025] [:error] [pid 27997:tid 28011] [client 52.167.165.248:1742] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsr2.php"] [unique_id "aRe-R9pja_6cDxKbxFlHXAAAAMw"]
[Sat Nov 15 07:42:03.691241 2025] [:error] [pid 37318:tid 37379] [client 52.167.165.248:2676] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aRe-S-gM1rHoEAqoQDdgeQAAARE"]
[Sat Nov 15 07:42:10.363363 2025] [:error] [pid 27910:tid 27963] [client 52.167.165.248:7393] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aRe-Uo6e1LusHMYkS7Z5RQAAAFY"]
[Sat Nov 15 07:42:13.061309 2025] [:error] [pid 27911:tid 27984] [client 52.167.165.248:8830] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aRe-VcGzUdrhGBIfiKTpNgAAAJA"]
[Sat Nov 15 07:42:15.996544 2025] [:error] [pid 27911:tid 27987] [client 52.167.165.248:5507] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wsr2.php"] [unique_id "aRe-V8GzUdrhGBIfiKTpRAAAAJM"]
[Sat Nov 15 07:42:17.005243 2025] [:error] [pid 27997:tid 28016] [client 52.167.165.248:7655] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wsr2.php"] [unique_id "aRe-Wdpja_6cDxKbxFlHfgAAANE"]
[Sat Nov 15 07:42:21.011262 2025] [:error] [pid 27911:tid 27969] [client 52.167.165.248:2367] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wsr2.php"] [unique_id "aRe-XcGzUdrhGBIfiKTpWAAAAIE"]
[Sat Nov 15 07:42:25.109818 2025] [:error] [pid 27997:tid 28006] [client 52.167.165.248:2707] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wsr2.php"] [unique_id "aRe-Ydpja_6cDxKbxFlHkwAAAMc"]
[Sat Nov 15 07:42:28.025843 2025] [:error] [pid 37318:tid 37388] [client 52.167.165.248:2031] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aRe-ZOgM1rHoEAqoQDdgvgAAARY"]
[Sat Nov 15 07:42:29.245336 2025] [:error] [pid 27911:tid 27974] [client 52.167.165.248:7020] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aRe-ZcGzUdrhGBIfiKTpagAAAIY"]
[Sat Nov 15 07:42:40.958830 2025] [:error] [pid 27997:tid 28008] [client 52.167.165.248:5979] [client 52.167.165.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aRe-cNpja_6cDxKbxFlHuwAAAMk"]
[Sat Nov 15 07:42:57.020762 2025] [:error] [pid 27910:tid 27950] [client 52.167.165.248:2433] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "aRe-gY6e1LusHMYkS7Z5oAAAAEk"]
[Sat Nov 15 07:42:59.698622 2025] [:error] [pid 27910:tid 27942] [client 52.167.165.248:4117] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "aRe-g46e1LusHMYkS7Z5pAAAAEE"]
[Sat Nov 15 07:43:03.960021 2025] [:error] [pid 27909:tid 27934] [client 52.167.165.248:6119] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "aRe-hyTfZ6B57n8HepWw3gAAABU"]
[Sat Nov 15 07:43:05.270709 2025] [:error] [pid 27997:tid 28001] [client 52.167.165.248:7907] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "aRe-idpja_6cDxKbxFlH9gAAAMI"]
[Sat Nov 15 07:43:17.277200 2025] [:error] [pid 27909:tid 27930] [client 52.167.165.248:7880] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "aRe-lSTfZ6B57n8HepWw8AAAABE"]
[Sat Nov 15 07:43:19.807251 2025] [:error] [pid 27909:tid 27923] [client 52.167.165.248:4718] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "aRe-lyTfZ6B57n8HepWw9gAAAAo"]
[Sat Nov 15 07:43:20.745749 2025] [:error] [pid 27910:tid 27956] [client 52.167.165.248:2070] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "aRe-mI6e1LusHMYkS7Z5zAAAAE8"]
[Sat Nov 15 07:43:27.092185 2025] [:error] [pid 27997:tid 28002] [client 52.167.165.248:8789] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sder52u.php"] [unique_id "aRe-n9pja_6cDxKbxFlIMgAAAMM"]
[Sat Nov 15 07:43:37.733497 2025] [:error] [pid 27911:tid 27979] [client 52.167.165.248:2747] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asserter.php"] [unique_id "aRe-qcGzUdrhGBIfiKTp8gAAAIs"]
[Sat Nov 15 07:43:41.066462 2025] [:error] [pid 27911:tid 27979] [client 52.167.165.248:2942] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asserter.php"] [unique_id "aRe-rcGzUdrhGBIfiKTp-QAAAIs"]
[Sat Nov 15 07:43:43.109877 2025] [:error] [pid 27997:tid 28016] [client 52.167.165.248:7707] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asserter.php"] [unique_id "aRe-r9pja_6cDxKbxFlIawAAANE"]
[Sat Nov 15 07:43:44.572973 2025] [:error] [pid 27911:tid 27990] [client 52.167.165.248:4490] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asserter.php"] [unique_id "aRe-sMGzUdrhGBIfiKTp_gAAAJY"]
[Sat Nov 15 07:43:46.736923 2025] [:error] [pid 27997:tid 28017] [client 52.167.165.248:2762] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aRe-stpja_6cDxKbxFlIdgAAANI"]
[Sat Nov 15 07:43:50.629003 2025] [:error] [pid 27911:tid 27986] [client 52.167.165.248:2763] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aRe-tsGzUdrhGBIfiKTqAwAAAJI"]
[Sat Nov 15 07:43:53.424352 2025] [:error] [pid 27910:tid 27944] [client 52.167.165.248:9634] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aRe-uY6e1LusHMYkS7Z6EwAAAEM"]
[Sat Nov 15 07:44:17.512058 2025] [:error] [pid 27997:tid 28003] [client 52.167.165.248:2807] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ef.php"] [unique_id "aRe-0dpja_6cDxKbxFlItgAAAMQ"]
[Sat Nov 15 07:44:20.895959 2025] [:error] [pid 27909:tid 27934] [client 52.167.165.248:7475] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ef.php"] [unique_id "aRe-1CTfZ6B57n8HepWxXgAAABU"]
[Sat Nov 15 07:44:23.899129 2025] [:error] [pid 37318:tid 37374] [client 52.167.165.248:7148] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ef.php"] [unique_id "aRe-1-gM1rHoEAqoQDdh2QAAAQw"]
[Sat Nov 15 07:44:26.003246 2025] [:error] [pid 27909:tid 27932] [client 52.167.165.248:5943] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ef.php"] [unique_id "aRe-2iTfZ6B57n8HepWxagAAABM"]
[Sat Nov 15 07:44:26.949995 2025] [:error] [pid 27910:tid 27950] [client 52.167.165.248:5376] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aRe-2o6e1LusHMYkS7Z6OAAAAEk"]
[Sat Nov 15 07:44:28.786446 2025] [:error] [pid 27910:tid 27944] [client 52.167.165.248:4470] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aRe-3I6e1LusHMYkS7Z6PgAAAEM"]
[Sat Nov 15 07:44:31.883092 2025] [:error] [pid 27997:tid 28016] [client 52.167.165.248:9076] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aRe-39pja_6cDxKbxFlI0wAAANE"]
[Sat Nov 15 07:44:36.372222 2025] [:error] [pid 27997:tid 27999] [client 52.167.165.248:3254] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aRe-5Npja_6cDxKbxFlI3wAAAMA"]
[Sat Nov 15 07:44:37.853217 2025] [:error] [pid 27997:tid 28020] [client 52.167.165.248:4416] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/667.php"] [unique_id "aRe-5dpja_6cDxKbxFlI5AAAANU"]
[Sat Nov 15 07:44:42.606687 2025] [:error] [pid 37318:tid 37364] [client 52.167.165.248:5436] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/667.php"] [unique_id "aRe-6ugM1rHoEAqoQDdiDQAAAQI"]
[Sat Nov 15 07:44:43.632821 2025] [:error] [pid 27910:tid 27960] [client 52.167.165.248:5395] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/667.php"] [unique_id "aRe-646e1LusHMYkS7Z6UAAAAFM"]
[Sat Nov 15 07:44:52.592510 2025] [:error] [pid 27997:tid 28013] [client 52.167.165.248:8159] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aRe-9Npja_6cDxKbxFlJBAAAAM4"]
[Sat Nov 15 07:44:59.342490 2025] [:error] [pid 27911:tid 27970] [client 52.167.165.248:3605] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aRe--8GzUdrhGBIfiKTqcgAAAII"]
[Sat Nov 15 07:45:09.222350 2025] [:error] [pid 27910:tid 27962] [client 52.167.165.248:3736] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-su.php"] [unique_id "aRe_BY6e1LusHMYkS7Z6fAAAAFU"]
[Sat Nov 15 07:45:11.278844 2025] [:error] [pid 27909:tid 27931] [client 52.167.165.248:8307] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-su.php"] [unique_id "aRe_ByTfZ6B57n8HepWxsQAAABI"]
[Sat Nov 15 07:45:43.447729 2025] [:error] [pid 27910:tid 27954] [client 52.167.165.248:7944] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb5.php"] [unique_id "aRe_J46e1LusHMYkS7Z6xQAAAE0"]
[Sat Nov 15 07:45:56.625271 2025] [:error] [pid 27910:tid 27945] [client 52.167.165.248:6260] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb5.php"] [unique_id "aRe_NI6e1LusHMYkS7Z60AAAAEQ"]
[Sat Nov 15 07:46:04.317945 2025] [:error] [pid 27909:tid 27927] [client 52.167.165.248:8454] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aRe_PCTfZ6B57n8HepWx6QAAAA4"]
[Sat Nov 15 07:46:05.542673 2025] [:error] [pid 27910:tid 27964] [client 52.167.165.248:8114] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aRe_PY6e1LusHMYkS7Z64AAAAFc"]
[Sat Nov 15 07:46:09.630220 2025] [:error] [pid 27911:tid 27968] [client 52.167.165.248:5037] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aRe_QcGzUdrhGBIfiKTqugAAAIA"]
[Sat Nov 15 07:46:11.341302 2025] [:error] [pid 27911:tid 27976] [client 52.167.165.248:4282] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aRe_Q8GzUdrhGBIfiKTqvAAAAIg"]
[Sat Nov 15 07:46:12.615724 2025] [:error] [pid 37318:tid 37372] [client 52.167.165.248:6567] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aRe_ROgM1rHoEAqoQDdi7AAAAQo"]
[Sat Nov 15 07:46:13.725936 2025] [:error] [pid 37318:tid 37374] [client 52.167.165.248:6238] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aRe_RegM1rHoEAqoQDdi8QAAAQw"]
[Sat Nov 15 07:46:17.715378 2025] [:error] [pid 27911:tid 27975] [client 52.167.165.248:1765] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aRe_ScGzUdrhGBIfiKTqxwAAAIc"]
[Sat Nov 15 07:46:25.345019 2025] [:error] [pid 27911:tid 27979] [client 52.167.165.248:8006] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aRe_UcGzUdrhGBIfiKTq0wAAAIs"]
[Sat Nov 15 07:46:28.313968 2025] [:error] [pid 27910:tid 27954] [client 52.167.165.248:4293] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yzkvrell.php"] [unique_id "aRe_VI6e1LusHMYkS7Z6_QAAAE0"]
[Sat Nov 15 07:46:32.182135 2025] [:error] [pid 27910:tid 27950] [client 52.167.165.248:5213] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yzkvrell.php"] [unique_id "aRe_WI6e1LusHMYkS7Z7BQAAAEk"]
[Sat Nov 15 07:47:03.876906 2025] [:error] [pid 27909:tid 27915] [client 52.167.165.248:4160] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aRe_dyTfZ6B57n8HepWyQAAAAAI"]
[Sat Nov 15 07:47:05.014086 2025] [:error] [pid 37318:tid 37379] [client 52.167.165.248:2473] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aRe_eegM1rHoEAqoQDdjfwAAARE"]
[Sat Nov 15 07:47:06.041848 2025] [:error] [pid 27997:tid 28017] [client 52.167.165.248:1073] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aRe_etpja_6cDxKbxFlJywAAANI"]
[Sat Nov 15 07:47:07.144150 2025] [:error] [pid 27997:tid 28006] [client 52.167.165.248:8239] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aRe_e9pja_6cDxKbxFlJzgAAAMc"]
[Sat Nov 15 07:47:10.824925 2025] [:error] [pid 37318:tid 37362] [client 52.167.165.248:8440] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aRe_fugM1rHoEAqoQDdjiwAAAQA"]
[Sat Nov 15 07:47:12.126164 2025] [:error] [pid 27910:tid 27953] [client 52.167.165.248:3689] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aRe_gI6e1LusHMYkS7Z7VwAAAEw"]
[Sat Nov 15 07:47:13.123734 2025] [:error] [pid 27909:tid 27935] [client 52.167.165.248:3656] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aRe_gSTfZ6B57n8HepWySwAAABY"]
[Sat Nov 15 07:47:20.440930 2025] [:error] [pid 27997:tid 28018] [client 52.167.165.248:1025] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aRe_iNpja_6cDxKbxFlJ4QAAANM"]
[Sat Nov 15 07:47:22.607623 2025] [:error] [pid 27997:tid 28006] [client 52.167.165.248:8367] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aRe_itpja_6cDxKbxFlJ5AAAAMc"]
[Sat Nov 15 07:47:24.683083 2025] [:error] [pid 27910:tid 27953] [client 52.167.165.248:4665] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aRe_jI6e1LusHMYkS7Z7YAAAAEw"]
[Sat Nov 15 07:48:20.266252 2025] [:error] [pid 27997:tid 28001] [client 52.167.165.248:2106] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsr2.php"] [unique_id "aRe_xNpja_6cDxKbxFlKcgAAAMI"]
[Sat Nov 15 07:48:47.105141 2025] [:error] [pid 37318:tid 37363] [client 52.167.165.248:9524] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shlo.php"] [unique_id "aRe_3-gM1rHoEAqoQDdkUwAAAQE"]
[Sat Nov 15 07:48:48.998595 2025] [:error] [pid 27997:tid 28014] [client 52.167.165.248:5946] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shlo.php"] [unique_id "aRe_4Npja_6cDxKbxFlKpQAAAM8"]
[Sat Nov 15 07:48:56.585390 2025] [:error] [pid 27911:tid 27973] [client 52.167.165.248:3202] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shlo.php"] [unique_id "aRe_6MGzUdrhGBIfiKTr7wAAAIU"]
[Sat Nov 15 07:49:02.730344 2025] [:error] [pid 27910:tid 27953] [client 52.167.165.248:3209] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aRe_7o6e1LusHMYkS7Z7-AAAAEw"]
[Sat Nov 15 07:49:03.769509 2025] [:error] [pid 37318:tid 37363] [client 52.167.165.248:3977] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aRe_7-gM1rHoEAqoQDdkegAAAQE"]
[Sat Nov 15 07:49:04.891001 2025] [:error] [pid 27909:tid 27928] [client 52.167.165.248:1827] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aRe_8CTfZ6B57n8HepWy6AAAAA8"]
[Sat Nov 15 07:49:11.687146 2025] [:error] [pid 27910:tid 27963] [client 52.167.165.248:5628] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aRe_946e1LusHMYkS7Z8BgAAAFY"]
[Sat Nov 15 07:49:16.028438 2025] [:error] [pid 27911:tid 27992] [client 52.167.165.248:5571] [client 52.167.165.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kill-9-1.php"] [unique_id "aRe__MGzUdrhGBIfiKTsFAAAAJg"]
[Sat Nov 15 08:38:06.398505 2025] [:error] [pid 27909:tid 27921] [client 43.153.35.128:36990] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRfLbiTfZ6B57n8HepXApwAAAAg"]
[Sat Nov 15 09:03:38.143817 2025] [:error] [pid 27910:tid 27951] [client 170.106.165.186:55112] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRfRao6e1LusHMYkS7aRXwAAAEo"]
[Sat Nov 15 12:09:33.671940 2025] [:error] [pid 27911:tid 27968] [client 138.197.23.42:58176] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRf8_cGzUdrhGBIfiKQmZAAAAIA"]
[Sat Nov 15 12:09:34.090595 2025] [:error] [pid 27997:tid 28006] [client 138.197.23.42:58349] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRf8_tpja_6cDxKbxFmOkwAAAMc"]
[Sat Nov 15 12:09:34.510084 2025] [:error] [pid 19961:tid 20008] [client 138.197.23.42:58517] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRf8_jar7Si-84EApVQ2iQAAAc8"]
[Sat Nov 15 12:09:34.947524 2025] [:error] [pid 22765:tid 22772] [client 138.197.23.42:58723] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRf8_qbrQzjuZmPIWDafdwAAAoQ"]
[Sat Nov 15 13:57:10.797793 2025] [:error] [pid 27997:tid 28009] [client 121.229.185.160:54262] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRgWNtpja_6cDxKbxFmkdAAAAMo"]
[Sat Nov 15 17:26:33.631979 2025] [autoindex:error] [pid 19959:tid 19983] [client 20.2.83.141:53619] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Nov 15 17:40:30.065241 2025] [:error] [pid 19961:tid 20007] [client 43.130.228.73:50290] [client 43.130.228.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRhKjjar7Si-84EApVRtvwAAAc4"]
[Sat Nov 15 20:16:06.697142 2025] [:error] [pid 20346:tid 20350] [client 45.138.16.215:53858] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/postnews.php"] [unique_id "aRhvBp7hsydZdIoVTltKsgAAAwE"]
[Sat Nov 15 20:16:07.236996 2025] [:error] [pid 20313:tid 20330] [client 45.138.16.215:53959] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aRhvBxI9DXIgPadBLUadHAAAAs4"]
[Sat Nov 15 20:16:07.773662 2025] [:error] [pid 20313:tid 20319] [client 45.138.16.215:54055] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aRhvBxI9DXIgPadBLUadHgAAAsM"]
[Sat Nov 15 20:36:23.886410 2025] [:error] [pid 19961:tid 20012] [client 111.172.249.49:59690] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRhzxzar7Si-84EApVSHDgAAAdM"]
[Sun Nov 16 00:12:34.553957 2025] [:error] [pid 22613:tid 22632] [client 49.51.132.100:51930] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRimcioyR3cDsIRGPRntkgAAAhE"]
[Sun Nov 16 02:02:53.519985 2025] [:error] [pid 19961:tid 20004] [client 43.157.180.116:57272] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRjATTar7Si-84EApVSpyQAAAcs"]
[Sun Nov 16 02:07:12.371769 2025] [:error] [pid 20346:tid 20373] [client 159.65.139.112:45386] [client 159.65.139.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aRjBUJ7hsydZdIoVTluLfAAAAxg"]
[Sun Nov 16 02:07:23.794563 2025] [:error] [pid 27911:tid 27971] [client 159.65.139.112:43734] [client 159.65.139.112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aRjBW8GzUdrhGBIfiKSdXwAAAIM"]
[Sun Nov 16 03:21:48.854499 2025] [:error] [pid 27972:tid 27986] [client 123.187.240.242:42602] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRjSzG8yq0TdrNn1vm1obAAAAMw"]
[Sun Nov 16 05:06:22.311299 2025] [:error] [pid 52471:tid 52555] [client 43.135.133.241:33518] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRjrTtmWsFzjR5CEgDWbTQAAAJc"]
[Sun Nov 16 08:16:12.042564 2025] [:error] [pid 20556:tid 20563] [client 150.109.230.210:38294] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRkXzEkbyEckbWtBcCLLoQAAAQU"]
[Sun Nov 16 09:45:58.791775 2025] [:error] [pid 52563:tid 52572] [client 101.91.148.219:43081] [client 101.91.148.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRks1s-l3ey-hVJ5Aus2RgAAAMY"]
[Sun Nov 16 10:02:10.692940 2025] [:error] [pid 52469:tid 52500] [client 43.159.141.150:51828] [client 43.159.141.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRkwok6HaXpHeEZ98Z1CKQAAABc"]
[Sun Nov 16 15:43:57.800779 2025] [:error] [pid 34164:tid 34173] [client 43.159.141.150:52772] [client 43.159.141.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRmAve93ccBCLD8-Q4YqOwAAAYU"]
[Sun Nov 16 16:21:37.048634 2025] [:error] [pid 34164:tid 34192] [client 101.91.148.219:56917] [client 101.91.148.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRmJke93ccBCLD8-Q4Yy-AAAAZg"]
[Sun Nov 16 17:50:19.907377 2025] [autoindex:error] [pid 34165:tid 34211] [client 155.94.163.116:64932] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Nov 16 18:38:16.035751 2025] [:error] [pid 52471:tid 52554] [client 43.130.116.87:51052] [client 43.130.116.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRmpmNmWsFzjR5CEgDVXDAAAAJY"]
[Sun Nov 16 20:31:35.212534 2025] [:error] [pid 34301:tid 34321] [client 15.229.18.138:51244] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aRnEJ7GPoZwUGuFNREvjEAAAApE"]
[Sun Nov 16 20:31:54.068626 2025] [:error] [pid 34301:tid 34317] [client 15.229.18.138:49830] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aRnEOrGPoZwUGuFNREvjIwAAAo0"]
[Sun Nov 16 20:31:54.160845 2025] [:error] [pid 34301:tid 34327] [client 15.229.18.138:49854] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "aRnEOrGPoZwUGuFNREvjJAAAApc"]
[Sun Nov 16 20:31:54.377501 2025] [:error] [pid 34227:tid 34251] [client 15.229.18.138:49818] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.prod"] [unique_id "aRnEOn108zGLYs9eMuhOAgAAAhY"]
[Sun Nov 16 20:31:54.902760 2025] [:error] [pid 34301:tid 34313] [client 15.229.18.138:49840] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev"] [unique_id "aRnEOrGPoZwUGuFNREvjJwAAAok"]
[Sun Nov 16 20:32:01.374740 2025] [:error] [pid 52563:tid 52590] [client 15.229.18.138:49860] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "aRnEQc-l3ey-hVJ5AuvEEgAAANg"]
[Sun Nov 16 20:32:01.704377 2025] [:error] [pid 34271:tid 34277] [client 15.229.18.138:49872] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env~"] [unique_id "aRnEQUNmlZhoZZV1BUDS2gAAAkQ"]
[Sun Nov 16 20:32:01.739095 2025] [:error] [pid 34301:tid 34323] [client 15.229.18.138:49896] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "aRnEQbGPoZwUGuFNREvjLwAAApM"]
[Sun Nov 16 20:32:01.816563 2025] [:error] [pid 34133:tid 34137] [client 15.229.18.138:49876] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aRnEQfSAB3iwXVRY0gGmMwAAAUI"]
[Sun Nov 16 20:32:01.819175 2025] [:error] [pid 34301:tid 34310] [client 15.229.18.138:49886] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aRnEQbGPoZwUGuFNREvjMAAAAoY"]
[Sun Nov 16 20:32:04.223463 2025] [:error] [pid 20556:tid 20569] [client 15.229.18.138:49226] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.orig"] [unique_id "aRnEREkbyEckbWtBcCKpSgAAAQs"]
[Sun Nov 16 20:32:04.450811 2025] [:error] [pid 34227:tid 34252] [client 15.229.18.138:49218] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.tmp"] [unique_id "aRnERH108zGLYs9eMuhOCQAAAhc"]
[Sun Nov 16 20:32:04.602507 2025] [:error] [pid 34301:tid 34315] [client 15.229.18.138:49228] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "aRnERLGPoZwUGuFNREvjMgAAAos"]
[Sun Nov 16 20:32:04.646380 2025] [:error] [pid 34227:tid 34234] [client 15.229.18.138:49256] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.sample"] [unique_id "aRnERH108zGLYs9eMuhOCgAAAgU"]
[Sun Nov 16 20:32:04.673600 2025] [:error] [pid 52471:tid 52537] [client 15.229.18.138:49242] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "aRnERNmWsFzjR5CEgDVyGwAAAIU"]
[Sun Nov 16 20:32:04.861684 2025] [:error] [pid 34271:tid 34297] [client 15.229.18.138:49234] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.save"] [unique_id "aRnERENmlZhoZZV1BUDS6gAAAlg"]
[Sun Nov 16 20:32:04.882749 2025] [:error] [pid 34165:tid 34202] [client 15.229.18.138:49278] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dist"] [unique_id "aRnERHhG2YTKEjXchwk-ZQAAAcc"]
[Sun Nov 16 20:32:04.883257 2025] [:error] [pid 52471:tid 52553] [client 15.229.18.138:49262] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.swp"] [unique_id "aRnERNmWsFzjR5CEgDVyHAAAAJU"]
[Sun Nov 16 20:32:10.221593 2025] [:error] [pid 52469:tid 52489] [client 15.229.18.138:49300] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env.old"] [unique_id "aRnESk6HaXpHeEZ98Z0C6gAAAAw"]
[Sun Nov 16 20:32:10.228915 2025] [:error] [pid 52469:tid 52492] [client 15.229.18.138:49310] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env.save"] [unique_id "aRnESk6HaXpHeEZ98Z0C7AAAAA8"]
[Sun Nov 16 20:32:10.249638 2025] [:error] [pid 52469:tid 52483] [client 15.229.18.138:49292] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env.bak"] [unique_id "aRnESk6HaXpHeEZ98Z0C7QAAAAY"]
[Sun Nov 16 20:32:10.297875 2025] [:error] [pid 52469:tid 52501] [client 15.229.18.138:49282] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "aRnESk6HaXpHeEZ98Z0C7gAAABg"]
[Sun Nov 16 20:32:10.307625 2025] [:error] [pid 52469:tid 52485] [client 15.229.18.138:49288] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env"] [unique_id "aRnESk6HaXpHeEZ98Z0C7wAAAAg"]
[Sun Nov 16 20:32:10.332286 2025] [:error] [pid 34301:tid 34318] [client 15.229.18.138:49304] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env.save"] [unique_id "aRnESrGPoZwUGuFNREvjNQAAAo4"]
[Sun Nov 16 20:32:10.615459 2025] [:error] [pid 34227:tid 34236] [client 15.229.18.138:49372] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "aRnESn108zGLYs9eMuhODwAAAgc"]
[Sun Nov 16 20:32:10.662291 2025] [:error] [pid 52469:tid 52479] [client 15.229.18.138:49342] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env.bak"] [unique_id "aRnESk6HaXpHeEZ98Z0C8gAAAAI"]
[Sun Nov 16 20:32:10.675742 2025] [:error] [pid 52469:tid 52498] [client 15.229.18.138:49378] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env.save"] [unique_id "aRnESk6HaXpHeEZ98Z0C8wAAABU"]
[Sun Nov 16 20:32:10.678429 2025] [:error] [pid 34133:tid 34143] [client 15.229.18.138:49326] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env.old"] [unique_id "aRnESvSAB3iwXVRY0gGmPgAAAUg"]
[Sun Nov 16 20:32:10.686475 2025] [:error] [pid 20556:tid 20575] [client 15.229.18.138:49352] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env.old"] [unique_id "aRnESkkbyEckbWtBcCKpUQAAARE"]
[Sun Nov 16 20:32:10.699675 2025] [:error] [pid 52469:tid 52486] [client 15.229.18.138:49358] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env.bak"] [unique_id "aRnESk6HaXpHeEZ98Z0C9AAAAAk"]
[Sun Nov 16 20:32:10.736409 2025] [:error] [pid 52469:tid 52500] [client 15.229.18.138:49350] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/config/.env"] [unique_id "aRnESk6HaXpHeEZ98Z0C9QAAABc"]
[Sun Nov 16 20:32:11.019736 2025] [:error] [pid 52471:tid 52545] [client 15.229.18.138:49362] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/config/.env.save"] [unique_id "aRnES9mWsFzjR5CEgDVyIQAAAI0"]
[Sun Nov 16 20:32:13.498922 2025] [:error] [pid 52563:tid 52581] [client 15.229.18.138:48256] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/src/.env.bak"] [unique_id "aRnETc-l3ey-hVJ5AuvEHAAAAM8"]
[Sun Nov 16 20:32:13.499369 2025] [:error] [pid 52469:tid 52485] [client 15.229.18.138:48242] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/config/.env.bak"] [unique_id "aRnETU6HaXpHeEZ98Z0C-QAAAAg"]
[Sun Nov 16 20:32:13.502825 2025] [:error] [pid 20556:tid 20565] [client 15.229.18.138:48248] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/src/.env"] [unique_id "aRnETUkbyEckbWtBcCKpUwAAAQc"]
[Sun Nov 16 20:32:13.503660 2025] [:error] [pid 20556:tid 20564] [client 15.229.18.138:48282] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/config/.env.old"] [unique_id "aRnETUkbyEckbWtBcCKpVAAAAQY"]
[Sun Nov 16 20:32:13.511270 2025] [:error] [pid 34301:tid 34305] [client 15.229.18.138:48296] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/src/.env.old"] [unique_id "aRnETbGPoZwUGuFNREvjOwAAAoE"]
[Sun Nov 16 20:32:13.514287 2025] [:error] [pid 52469:tid 52488] [client 15.229.18.138:48270] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/src/.env.save"] [unique_id "aRnETU6HaXpHeEZ98Z0C-gAAAAs"]
[Sun Nov 16 20:32:13.526157 2025] [:error] [pid 20556:tid 20567] [client 15.229.18.138:48312] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.env"] [unique_id "aRnETUkbyEckbWtBcCKpVQAAAQk"]
[Sun Nov 16 20:32:13.558469 2025] [:error] [pid 20556:tid 20566] [client 15.229.18.138:48328] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.env.save"] [unique_id "aRnETUkbyEckbWtBcCKpVgAAAQg"]
[Sun Nov 16 20:32:13.605447 2025] [:error] [pid 34164:tid 34182] [client 15.229.18.138:48332] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.env.old"] [unique_id "aRnETe93ccBCLD8-Q4ZvRgAAAY4"]
[Sun Nov 16 20:32:13.643708 2025] [:error] [pid 34301:tid 34315] [client 15.229.18.138:48348] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/assets/.env"] [unique_id "aRnETbGPoZwUGuFNREvjPAAAAos"]
[Sun Nov 16 20:32:13.685294 2025] [:error] [pid 34164:tid 34192] [client 15.229.18.138:48362] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/assets/.env.old"] [unique_id "aRnETe93ccBCLD8-Q4ZvRwAAAZg"]
[Sun Nov 16 20:32:13.686318 2025] [:error] [pid 52563:tid 52577] [client 15.229.18.138:48374] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/assets/.env.bak"] [unique_id "aRnETc-l3ey-hVJ5AuvEHQAAAMs"]
[Sun Nov 16 20:32:13.696253 2025] [:error] [pid 52563:tid 52583] [client 15.229.18.138:48330] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.env.bak"] [unique_id "aRnETc-l3ey-hVJ5AuvEHgAAANE"]
[Sun Nov 16 20:32:13.970233 2025] [:error] [pid 20556:tid 20580] [client 15.229.18.138:48384] [client 15.229.18.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/assets/.env.save"] [unique_id "aRnETUkbyEckbWtBcCKpVwAAARY"]
[Mon Nov 17 12:10:47.202884 2025] [:error] [pid 15150:tid 15164] [client 182.42.105.85:44363] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRqgR32DEo_rcsFuxj1DCQAAAYw"]
[Mon Nov 17 20:01:43.633898 2025] [:error] [pid 32753:tid 32773] [client 103.186.31.45:53923] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aRsOp06YNqI5vkht922C3gAAA9E"]
[Mon Nov 17 20:01:43.879246 2025] [:error] [pid 20913:tid 20919] [client 103.186.31.45:54048] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/style.php"] [unique_id "aRsOp-kafGNeN3nY1bda-gAAA0Q"]
[Mon Nov 17 20:01:44.130234 2025] [:error] [pid 32753:tid 32760] [client 103.186.31.45:54203] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/themes/style.php"] [unique_id "aRsOqE6YNqI5vkht922C5AAAA8Q"]
[Mon Nov 17 20:01:44.401291 2025] [:error] [pid 40548:tid 40561] [client 103.186.31.45:54329] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/style.php"] [unique_id "aRsOqAM_PykfYnxh-j9sMAAAAQs"]
[Mon Nov 17 20:01:44.673504 2025] [:error] [pid 30801:tid 30817] [client 103.186.31.45:54553] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style.php"] [unique_id "aRsOqDbGAU49DhMTBD7vxgAAAk4"]
[Mon Nov 17 20:01:44.954165 2025] [:error] [pid 30801:tid 30812] [client 103.186.31.45:54659] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aRsOqDbGAU49DhMTBD7vxwAAAkk"]
[Mon Nov 17 20:01:45.219830 2025] [:error] [pid 32753:tid 32765] [client 103.186.31.45:54779] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aRsOqU6YNqI5vkht922C7gAAA8k"]
[Mon Nov 17 20:01:45.481273 2025] [:error] [pid 32753:tid 32776] [client 103.186.31.45:54847] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aRsOqU6YNqI5vkht922C9QAAA9Q"]
[Mon Nov 17 20:01:45.739309 2025] [:error] [pid 15888:tid 15909] [client 103.186.31.45:55002] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aRsOqQjAdDTBm4W3qW03xQAAAdI"]
[Mon Nov 17 20:01:45.995293 2025] [:error] [pid 31419:tid 31430] [client 103.186.31.45:55148] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aRsOqQHQ5Sbp7elmDZiYhAAAAok"]
[Mon Nov 17 20:01:46.259294 2025] [:error] [pid 30801:tid 30826] [client 103.186.31.45:55236] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aRsOqjbGAU49DhMTBD7vzwAAAlc"]
[Mon Nov 17 20:01:46.521200 2025] [:error] [pid 20913:tid 20923] [client 103.186.31.45:55295] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/blurbs.php"] [unique_id "aRsOqukafGNeN3nY1bdbCQAAA0g"]
[Mon Nov 17 20:01:46.791031 2025] [:error] [pid 31419:tid 31433] [client 103.186.31.45:55386] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aRsOqgHQ5Sbp7elmDZiYjgAAAow"]
[Mon Nov 17 20:01:47.046213 2025] [:error] [pid 30801:tid 30809] [client 103.186.31.45:55451] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aRsOqzbGAU49DhMTBD7v1QAAAkY"]
[Mon Nov 17 20:01:47.307698 2025] [:error] [pid 39537:tid 39550] [client 103.186.31.45:55540] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/shelp.php"] [unique_id "aRsOq4ZRrh1pcrdcLB-9RQAAAMo"]
[Mon Nov 17 20:01:47.573038 2025] [:error] [pid 30801:tid 30822] [client 103.186.31.45:55609] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aRsOqzbGAU49DhMTBD7v2gAAAlM"]
[Mon Nov 17 20:01:47.827301 2025] [:error] [pid 39537:tid 39561] [client 103.186.31.45:55678] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aRsOq4ZRrh1pcrdcLB-9SAAAANU"]
[Mon Nov 17 20:01:48.070452 2025] [:error] [pid 32753:tid 32764] [client 103.186.31.45:55805] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRsOrE6YNqI5vkht922DBgAAA8g"]
[Mon Nov 17 20:01:48.332953 2025] [:error] [pid 40548:tid 40553] [client 103.186.31.45:55889] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aRsOrAM_PykfYnxh-j9sNgAAAQM"]
[Mon Nov 17 20:01:48.596159 2025] [:error] [pid 39537:tid 39562] [client 103.186.31.45:55946] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aRsOrIZRrh1pcrdcLB-9TQAAANY"]
[Mon Nov 17 20:01:48.843417 2025] [:error] [pid 20913:tid 20938] [client 103.186.31.45:56005] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/zwso.php"] [unique_id "aRsOrOkafGNeN3nY1bdbDwAAA1c"]
[Mon Nov 17 20:01:49.111564 2025] [:error] [pid 39451:tid 39520] [client 103.186.31.45:56047] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aRsOrefgkqXTS0SO3fAikQAAAIw"]
[Mon Nov 17 20:01:49.385288 2025] [:error] [pid 31419:tid 31436] [client 103.186.31.45:56107] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aRsOrQHQ5Sbp7elmDZiYqQAAAo8"]
[Mon Nov 17 20:01:49.646329 2025] [:error] [pid 30801:tid 30812] [client 103.186.31.45:56162] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/shlo.php"] [unique_id "aRsOrTbGAU49DhMTBD7v7AAAAkk"]
[Mon Nov 17 20:01:49.906085 2025] [:error] [pid 31419:tid 31433] [client 103.186.31.45:56211] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "aRsOrQHQ5Sbp7elmDZiYsQAAAow"]
[Mon Nov 17 20:01:51.485905 2025] [:error] [pid 39537:tid 39563] [client 103.186.31.45:56858] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aRsOr4ZRrh1pcrdcLB-9bQAAANc"]
[Mon Nov 17 20:01:51.741391 2025] [:error] [pid 31419:tid 31436] [client 103.186.31.45:56934] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "aRsOrwHQ5Sbp7elmDZiYygAAAo8"]
[Mon Nov 17 20:01:52.004975 2025] [:error] [pid 32753:tid 32778] [client 103.186.31.45:57004] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/lufix1.php"] [unique_id "aRsOsE6YNqI5vkht922DLQAAA9Y"]
[Mon Nov 17 20:01:52.260120 2025] [:error] [pid 39449:tid 39455] [client 103.186.31.45:57068] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/witmm.php"] [unique_id "aRsOsKUCymTA3MDfzLNb2AAAAAE"]
[Mon Nov 17 20:01:52.515004 2025] [:error] [pid 32753:tid 32768] [client 103.186.31.45:57131] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/css/index.php"] [unique_id "aRsOsE6YNqI5vkht922DMgAAA8w"]
[Mon Nov 17 20:01:52.763122 2025] [:error] [pid 39449:tid 39475] [client 103.186.31.45:57183] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aRsOsKUCymTA3MDfzLNb7AAAABU"]
[Mon Nov 17 20:01:53.021853 2025] [:error] [pid 39449:tid 39474] [client 103.186.31.45:57246] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aRsOsaUCymTA3MDfzLNb-AAAABQ"]
[Mon Nov 17 20:01:53.290024 2025] [:error] [pid 40548:tid 40556] [client 103.186.31.45:57314] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aRsOsQM_PykfYnxh-j9sTAAAAQY"]
[Mon Nov 17 20:01:53.561502 2025] [:error] [pid 32753:tid 32778] [client 103.186.31.45:57374] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aRsOsU6YNqI5vkht922DRwAAA9Y"]
[Mon Nov 17 20:01:53.826942 2025] [:error] [pid 31419:tid 31433] [client 103.186.31.45:57430] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aRsOsQHQ5Sbp7elmDZiY0QAAAow"]
[Mon Nov 17 20:01:54.087785 2025] [:error] [pid 39537:tid 39552] [client 103.186.31.45:57479] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-editor.php"] [unique_id "aRsOsoZRrh1pcrdcLB-9fgAAAMw"]
[Mon Nov 17 23:04:34.621940 2025] [:error] [pid 32753:tid 32776] [client 43.153.123.3:34622] [client 43.153.123.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRs5gk6YNqI5vkht922xUAAAA9Q"]
[Tue Nov 18 01:55:24.516460 2025] [:error] [pid 39189:tid 39213] [client 162.243.15.109:47042] [client 162.243.15.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aRthjJJJLi753QwyqGzqMQAAAJQ"]
[Tue Nov 18 02:04:59.873484 2025] [:error] [pid 40561:tid 40600] [client 43.166.250.187:40916] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRtjy5dU597fIdQPRD_OqAAAAMQ"]
[Tue Nov 18 07:38:36.752545 2025] [:error] [pid 61392:tid 61446] [client 101.91.148.219:56802] [client 101.91.148.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRux_HSmvb496zZxueLnEQAAAFE"]
[Tue Nov 18 14:10:39.121277 2025] [:error] [pid 1387:tid 1400] [client 221.229.106.25:50192] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aRwN30zBvalKyx3hMvX7sAAAAAc"]
[Tue Nov 18 18:09:49.825726 2025] [:error] [pid 44472:tid 44546] [client 49.51.72.76:36806] [client 49.51.72.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRxF7YKhGwkiLjv8BQzpwgAAAU8"]
[Tue Nov 18 20:59:36.867460 2025] [autoindex:error] [pid 1387:tid 1413] [client 84.247.191.22:58531] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 19 03:10:28.225491 2025] [autoindex:error] [pid 3052:tid 3149] [client 172.93.148.180:58412] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 19 03:10:28.504407 2025] [autoindex:error] [pid 3052:tid 3144] [client 172.93.148.180:58412] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 19 03:10:28.785967 2025] [autoindex:error] [pid 3052:tid 3142] [client 172.93.148.180:58412] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 19 03:10:29.073992 2025] [autoindex:error] [pid 3052:tid 3146] [client 172.93.148.180:58412] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 19 04:53:40.963370 2025] [:error] [pid 6919:tid 6942] [client 43.135.148.92:53762] [client 43.135.148.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aRzc1EYFdN1s_9xJVUlV9wAAARQ"]
[Wed Nov 19 13:03:16.358683 2025] [proxy_fcgi:error] [pid 6554:tid 6574] [client 66.249.64.10:44489] AH01071: Got error 'PHP message: WordPress database error The total number of locks exceeds the lock table size for query UPDATE `wp_options` SET `option_value` = 'a:215:{s:19:\\"voucher_template/?$\\";s:36:\\"index.php?post_type=voucher_template\\";s:49:\\"voucher_template/feed/(feed|rdf|rss|rss2|atom)/?$\\";s:53:\\"index.php?post_type=voucher_template&feed=$matches[1]\\";s:44:\\"voucher_template/(feed|rdf|rss|rss2|atom)/?$\\";s:53:\\"index.php?post_type=voucher_template&feed=$matches[1]\\";s:36:\\"voucher_template/page/([0-9]{1,})/?$\\";s:54:\\"index.php?post_type=voucher_template&paged=$matches[1]\\";s:11:\\"^wp-json/?$\\";s:22:\\"index.php?rest_route=/\\";s:14:\\"^wp-json/(.*)?\\";s:33:\\"index.php?rest_route=/$matches[1]\\";s:21:\\"^index.php/wp-json/?$\\";s:22:\\"index.php?rest_route=/\\";s:24:\\"^index.php/wp-json/(.*)?\\";s:33:\\"index.php?rest_route=/$matches[1]\\";s:22:\\"cosmetic-procedures/?$\\";s:29:\\"index.php?post_type=procedure\\";s:52:\\"cosmetic-procedures/feed/(feed|rdf|rss|rss2|atom)/?$\\";s:46:\\"index.php?post_type=procedure&feed=$m...'
[Wed Nov 19 13:28:07.458753 2025] [:error] [pid 6919:tid 6925] [client 43.157.38.131:55848] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aR1VZ0YFdN1s_9xJVUkwfwAAAQM"]
[Wed Nov 19 20:35:57.057326 2025] [:error] [pid 6554:tid 6584] [client 104.196.176.201:57848] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/system/js/core.js"] [unique_id "aR25rd8rvPWLafJFqmX7VQAAABg"]
[Wed Nov 19 20:46:33.423902 2025] [:error] [pid 6556:tid 6628] [client 170.106.187.106:48662] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aR28KZuL7hhgrmdM1mspHwAAAIo"]
[Thu Nov 20 01:48:04.141889 2025] [:error] [pid 50236:tid 50365] [client 170.106.161.78:38724] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aR4C1GT-l-atWVKihhsluAAAAIM"]
[Thu Nov 20 02:23:35.741306 2025] [:error] [pid 50475:tid 50528] [client 91.92.242.56:56563] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LJ1zRy2BTBjqrUmk3agAAAQY"]
[Thu Nov 20 02:23:36.304907 2025] [:error] [pid 50223:tid 50359] [client 91.92.242.56:56962] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LKD4iSUKl66cdvvbjpgAAAFg"]
[Thu Nov 20 02:23:36.869028 2025] [:error] [pid 8293:tid 8295] [client 91.92.242.56:57267] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LKCGLhDa8A92KWiIKiwAAAkA"]
[Thu Nov 20 17:23:22.668953 2025] [:error] [pid 34405:tid 34412] [client 106.227.49.113:43264] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aR7eCjFpvu8oRK7ATfsIzAAAAQU"]
[Thu Nov 20 18:43:38.279759 2025] [:error] [pid 55342:tid 55376] [client 66.249.64.9:56228] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/Login%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%9E%E0%B8%B5%E0%B8%88%E0%B8%B5.html"] [unique_id "aR7w2rg6x32Tvk7fIG_a8AAAAEQ"]
[Thu Nov 20 18:43:41.486810 2025] [:error] [pid 55340:tid 55362] [client 66.249.64.9:52846] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/betting/Slot%20%E0%B8%A3%E0%B8%A7%E0%B8%A2%E0%B8%A3%E0%B8%A7%E0%B8%A2%20888%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.html"] [unique_id "aR7w3fOxD-NeMydTybCcxAAAABE"]
[Thu Nov 20 18:44:14.402852 2025] [:error] [pid 55342:tid 55391] [client 66.249.64.9:53385] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sitemap/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.html"] [unique_id "aR7w_rg6x32Tvk7fIG_bBQAAAFM"]
[Thu Nov 20 18:44:22.395152 2025] [:error] [pid 40445:tid 40484] [client 66.249.64.9:47884] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casino/Slot%20%E0%B8%9A%E0%B8%AD%E0%B8%A5%E0%B8%A2%E0%B8%B8%E0%B9%82%E0%B8%A3%E0%B8%9B%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89.html"] [unique_id "aR7xBlH-MuFcoWRjXpZVzgAAAkk"]
[Thu Nov 20 18:44:31.966306 2025] [:error] [pid 55343:tid 55401] [client 66.249.64.9:56441] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/games/Slot%20%E0%B8%95%E0%B8%B2%E0%B8%A3%E0%B8%B2%E0%B8%87%E0%B8%84%E0%B8%B0%E0%B9%81%E0%B8%99%E0%B8%99%E0%B8%81%E0%B8%B1%E0%B8%A5%E0%B9%82%E0%B8%8A%E0%B9%88%20%E0%B9%80%E0%B8%8B%E0%B9%80%E0%B8%A3%E0%B8%B5%E0%B8%A2%E0%B8%9A%E0%B8%B5.html"] [unique_id "aR7xD1WlO3EnyVMV7w6xagAAAII"]
[Thu Nov 20 19:26:38.595023 2025] [autoindex:error] [pid 40537:tid 40559] [client 185.153.151.165:48908] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 19:26:39.210341 2025] [autoindex:error] [pid 40537:tid 40563] [client 185.153.151.165:48908] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 19:26:40.013032 2025] [autoindex:error] [pid 40537:tid 40546] [client 185.153.151.165:48908] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Nov 20 20:03:22.017192 2025] [:error] [pid 34405:tid 34423] [client 43.173.1.57:38640] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aR8DijFpvu8oRK7ATfspvwAAARA"]
[Thu Nov 20 20:40:33.010426 2025] [:error] [pid 55343:tid 55399] [client 43.135.133.241:50512] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aR8MQVWlO3EnyVMV7w7F1wAAAIA"]
[Fri Nov 21 00:07:41.555643 2025] [:error] [pid 40508:tid 40514] [client 125.94.144.102:33105] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aR88zaxXNVCMW_ksxPsJ-wAAAoQ"]
[Fri Nov 21 01:21:58.541172 2025] [:error] [pid 13506:tid 13687] [client 66.249.64.9:60069] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/deposit/PG%20Slot%20Team%20Contact%20Details.html"] [unique_id "aR9ONqTbGYpGB-467xZMWAAAABE"]
[Fri Nov 21 01:22:07.336021 2025] [:error] [pid 13506:tid 13692] [client 66.249.64.9:53089] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/games/Daftar%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B8%8B%E0%B8%B7%E0%B9%89%E0%B8%AD%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%AA%E0%B8%9B%E0%B8%B4%E0%B8%99%20pg.html"] [unique_id "aR9OP6TbGYpGB-467xZMYwAAABY"]
[Fri Nov 21 01:22:38.689729 2025] [:error] [pid 13805:tid 13808] [client 66.249.64.9:61240] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20XO%20%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B9%84%E0%B8%AB%E0%B8%99%E0%B9%81%E0%B8%88%E0%B8%81%E0%B9%82%E0%B8%9A%E0%B8%99%E0%B8%B1%E0%B8%AA%20%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2.html"] [unique_id "aR9OXlurU5-GZdwKvr7BRQAAAUA"]
[Fri Nov 21 01:22:44.102353 2025] [:error] [pid 13506:tid 13679] [client 66.249.64.9:50717] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sitemap/Login%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.html"] [unique_id "aR9OZKTbGYpGB-467xZMxQAAAAk"]
[Fri Nov 21 01:22:46.912169 2025] [:error] [pid 13506:tid 13683] [client 66.249.64.9:44395] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nohu/Slot%20%E0%B9%81%E0%B8%97%E0%B8%87%E0%B8%9A%E0%B8%AD%E0%B8%A5.html"] [unique_id "aR9OZqTbGYpGB-467xZMzgAAAA0"]
[Fri Nov 21 02:05:10.523130 2025] [:error] [pid 13536:tid 13729] [client 43.153.48.240:59654] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aR9YVqwnCU8z6PX3-ZnEFAAAAII"]
[Fri Nov 21 04:43:31.718334 2025] [:error] [pid 13325:tid 13337] [client 93.123.109.7:49246] [client 93.123.109.7] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aR99cyBUXj9tD75On3CSmwAAAAc"]
[Fri Nov 21 06:28:24.956619 2025] [:error] [pid 13412:tid 13422] [client 182.42.104.32:56141] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aR-WCH3-knz3ZB6HogHNFgAAAMU"]
[Fri Nov 21 08:03:43.889826 2025] [:error] [pid 17882:tid 17888] [client 43.130.14.245:56620] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aR-sX4wFFssEn348h94xEQAAAUQ"]
[Fri Nov 21 09:01:58.013072 2025] [:error] [pid 46276:tid 46288] [client 43.130.14.245:59332] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aR-6BnbpxuSAfajqqKOy0QAAAgU"]
[Fri Nov 21 12:39:35.930361 2025] [:error] [pid 51434:tid 51445] [client 101.91.148.219:47701] [client 101.91.148.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aR_tB_U96liplEDkw_RE9wAAAQk"]
[Fri Nov 21 14:47:34.695913 2025] [:error] [pid 25554:tid 25581] [client 213.21.239.4:39774] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSALBh-NtB-9AzFZrk4UJwAAARc"]
[Fri Nov 21 15:12:05.262520 2025] [:error] [pid 25430:tid 25484] [client 213.21.239.4:37924] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSAQxapnWJcWt_4foXkhPQAAAFg"]
[Fri Nov 21 15:46:37.817495 2025] [:error] [pid 25429:tid 25433] [client 213.21.239.4:40612] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.svn/wc.db"] [unique_id "aSAY3T4rZbRSr7vu-NOVMAAAAAA"]
[Fri Nov 21 16:11:08.061874 2025] [:error] [pid 25429:tid 25456] [client 213.21.239.4:38406] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.svn/wc.db"] [unique_id "aSAenD4rZbRSr7vu-NOxGAAAABc"]
[Fri Nov 21 19:11:13.270612 2025] [:error] [pid 25521:tid 25538] [client 111.172.249.49:59068] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSBI0fhXnBMilDddn3Um3QAAAM8"]
[Sat Nov 22 00:31:37.880713 2025] [:error] [pid 9180:tid 9206] [client 43.166.136.153:38066] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSCT6brk9msixUFV2i93fgAAAFg"]
[Sat Nov 22 01:51:22.121234 2025] [:error] [pid 9180:tid 9199] [client 182.42.111.156:50833] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSCmmrrk9msixUFV2i-hwAAAAFE"]
[Sat Nov 22 02:04:36.854290 2025] [:error] [pid 50057:tid 50068] [client 129.226.93.214:32972] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSCptFb9j9fTBoI0sRVZ3gAAAQk"]
[Sat Nov 22 03:34:42.420072 2025] [:error] [pid 8970:tid 9025] [client 66.249.64.9:34787] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gambling/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg888.html"] [unique_id "aSC-0puSBcofSIY3VZB9hAAAAE0"]
[Sat Nov 22 03:34:50.741016 2025] [:error] [pid 8971:tid 9044] [client 66.249.64.9:55636] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xoso/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pp%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%E0%B8%9A%E0%B8%B1%E0%B8%8D%E0%B8%8A%E0%B8%B5.html"] [unique_id "aSC-2tEhzhWJU17sRhwE0gAAAIU"]
[Sat Nov 22 03:34:58.566027 2025] [:error] [pid 9082:tid 9087] [client 66.249.64.9:61529] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/betting/Daftar%20%E0%B8%95%E0%B8%B2%E0%B8%A3%E0%B8%B2%E0%B8%87%E0%B8%84%E0%B8%B0%E0%B9%81%E0%B8%99%E0%B8%99%E0%B8%9A%E0%B8%A3%E0%B8%B2%E0%B8%8B%E0%B8%B4%E0%B8%A5%E0%B8%8B%E0%B8%B5%E0%B8%A3%E0%B8%B5%E0%B9%88%E0%B8%9A%E0%B8%B5.html"] [unique_id "aSC-4kKZzrBOWbHp287GcAAAAMI"]
[Sat Nov 22 03:35:01.561685 2025] [:error] [pid 8969:tid 8985] [client 66.249.64.9:52615] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nohu/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%E0%B8%95%E0%B9%88%E0%B8%B3.html"] [unique_id "aSC-5XZEkpElZmH2DXwpigAAAAI"]
[Sat Nov 22 03:35:14.542170 2025] [:error] [pid 8969:tid 9002] [client 66.249.64.9:56670] [client 66.249.64.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dabong/pg%20slot%20win%20mvpwin555.link.html"] [unique_id "aSC-8nZEkpElZmH2DXwpowAAABM"]
[Sat Nov 22 04:26:27.015147 2025] [:error] [pid 53477:tid 53484] [client 194.5.82.140:63737] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSDK837Lu30Ku9O40aKt_gAAAAM"]
[Sat Nov 22 04:26:31.095719 2025] [:error] [pid 53566:tid 53575] [client 194.5.82.141:51921] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSDK98bSHDBkRbwMbd4A6QAAAMc"]
[Sat Nov 22 04:26:39.431027 2025] [:error] [pid 53479:tid 53559] [client 194.5.82.124:61643] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aSDK_26cicFF3Aas-oRJFQAAAJc"]
[Sat Nov 22 04:26:43.798400 2025] [:error] [pid 25856:tid 25875] [client 194.5.82.156:27167] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSDLAxsTP0wy94zKUvFwmQAAARE"]
[Sat Nov 22 04:26:51.866695 2025] [:error] [pid 53479:tid 53542] [client 194.5.82.155:47371] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSDLC26cicFF3Aas-oRJLwAAAIY"]
[Sat Nov 22 04:26:53.545767 2025] [:error] [pid 25856:tid 25877] [client 194.5.82.139:63377] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSDLDRsTP0wy94zKUvFwqQAAARM"]
[Sat Nov 22 04:26:53.731505 2025] [:error] [pid 25856:tid 25865] [client 194.5.82.108:25891] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSDLDRsTP0wy94zKUvFwqgAAAQc"]
[Sat Nov 22 04:26:53.918318 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.143:45015] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSDLDQhUYdXBbQswAdTgkQAAAE0"]
[Sat Nov 22 04:26:54.113241 2025] [:error] [pid 25856:tid 25863] [client 194.5.82.113:45031] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSDLDhsTP0wy94zKUvFwrAAAAQU"]
[Sat Nov 22 04:26:54.315957 2025] [:error] [pid 25856:tid 25868] [client 194.5.82.142:34419] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSDLDhsTP0wy94zKUvFwrQAAAQo"]
[Sat Nov 22 04:26:55.611938 2025] [:error] [pid 25856:tid 25875] [client 194.5.82.142:34205] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSDLDxsTP0wy94zKUvFwsQAAARE"]
[Sat Nov 22 04:26:57.419439 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.157:48805] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aSDLEW6cicFF3Aas-oRJOgAAAJg"]
[Sat Nov 22 04:27:00.517160 2025] [:error] [pid 53566:tid 53572] [client 194.5.82.118:22535] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSDLFMbSHDBkRbwMbd4BUwAAAMQ"]
[Sat Nov 22 04:27:01.827448 2025] [:error] [pid 53477:tid 53492] [client 194.5.82.109:24215] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSDLFX7Lu30Ku9O40aKuQwAAAAs"]
[Sat Nov 22 04:27:03.559375 2025] [:error] [pid 53479:tid 53558] [client 194.5.82.117:44149] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSDLF26cicFF3Aas-oRJQQAAAJY"]
[Sat Nov 22 04:27:11.696026 2025] [:error] [pid 53478:tid 53511] [client 194.5.82.169:39287] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSDLHwhUYdXBbQswAdTgywAAAEI"]
[Sat Nov 22 04:27:13.314672 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.122:34321] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSDLIRsTP0wy94zKUvFw5wAAAQI"]
[Sat Nov 22 04:27:16.264389 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.134:55933] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSDLJBsTP0wy94zKUvFw9AAAAQA"]
[Sat Nov 22 04:27:17.883775 2025] [:error] [pid 53479:tid 53544] [client 194.5.82.135:46899] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSDLJW6cicFF3Aas-oRJagAAAIg"]
[Sat Nov 22 04:27:23.554843 2025] [:error] [pid 53477:tid 53504] [client 194.5.82.162:55893] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSDLK37Lu30Ku9O40aKuggAAABc"]
[Sat Nov 22 04:27:25.186346 2025] [:error] [pid 53477:tid 53503] [client 194.5.82.143:63441] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSDLLX7Lu30Ku9O40aKuhgAAABY"]
[Sat Nov 22 04:27:26.850757 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.131:29503] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSDLLm6cicFF3Aas-oRJfAAAAJI"]
[Sat Nov 22 04:27:27.036159 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.143:54679] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSDLLwhUYdXBbQswAdTg7AAAAEk"]
[Sat Nov 22 04:27:27.227411 2025] [:error] [pid 25856:tid 25863] [client 194.5.82.145:59751] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSDLLxsTP0wy94zKUvFxAgAAAQU"]
[Sat Nov 22 04:27:31.385763 2025] [:error] [pid 53477:tid 53494] [client 194.5.82.163:22883] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSDLM37Lu30Ku9O40aKulAAAAA0"]
[Sat Nov 22 04:27:31.575769 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.109:36693] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSDLMwhUYdXBbQswAdTg-AAAAFc"]
[Sat Nov 22 04:27:31.824683 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.164:26977] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSDLMwhUYdXBbQswAdTg-gAAAEk"]
[Sat Nov 22 04:27:45.181882 2025] [:error] [pid 53566:tid 53573] [client 194.5.82.143:30085] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aSDLQcbSHDBkRbwMbd4BxQAAAMU"]
[Sat Nov 22 04:27:49.018379 2025] [:error] [pid 53478:tid 53524] [client 194.5.82.157:55709] [client 194.5.82.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.157, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSDLRQhUYdXBbQswAdThHwAAAE8"]
[Sat Nov 22 04:28:04.008691 2025] [:error] [pid 53478:tid 53515] [client 194.5.82.157:55709] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSDLVAhUYdXBbQswAdThSwAAAEY"]
[Sat Nov 22 04:28:06.906212 2025] [:error] [pid 25856:tid 25866] [client 194.5.82.159:25395] [client 194.5.82.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.159, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSDLVhsTP0wy94zKUvFxWwAAAQg"]
[Sat Nov 22 04:28:09.405874 2025] [:error] [pid 25856:tid 25864] [client 194.5.82.159:25395] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aSDLWRsTP0wy94zKUvFxYgAAAQY"]
[Sat Nov 22 04:28:19.581858 2025] [:error] [pid 53477:tid 53505] [client 194.5.82.114:37019] [client 194.5.82.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSDLY37Lu30Ku9O40aKu7AAAABg"]
[Sat Nov 22 04:28:29.802199 2025] [:error] [pid 53479:tid 53552] [client 194.5.82.119:24333] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSDLbW6cicFF3Aas-oRJ_AAAAJA"]
[Sat Nov 22 04:28:32.821361 2025] [:error] [pid 53478:tid 53519] [client 194.5.82.105:64697] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSDLcAhUYdXBbQswAdThfQAAAEo"]
[Sat Nov 22 04:28:36.944647 2025] [:error] [pid 53566:tid 53580] [client 194.5.82.154:54623] [client 194.5.82.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.154, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSDLdMbSHDBkRbwMbd4CUQAAAMw"]
[Sat Nov 22 04:28:38.324255 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.154:54623] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSDLdsbSHDBkRbwMbd4CVwAAAMY"]
[Sat Nov 22 04:28:59.897899 2025] [:error] [pid 53479:tid 53550] [client 194.5.82.154:43031] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSDLi26cicFF3Aas-oRKLwAAAI4"]
[Sat Nov 22 04:29:04.683008 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.121:59891] [client 194.5.82.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.121, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSDLkBsTP0wy94zKUvFx6wAAAQA"]
[Sat Nov 22 04:29:09.955964 2025] [:error] [pid 25856:tid 25877] [client 194.5.82.121:59891] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSDLlRsTP0wy94zKUvFx-gAAARM"]
[Sat Nov 22 04:29:11.725104 2025] [:error] [pid 25856:tid 25859] [client 194.5.82.134:59261] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aSDLlxsTP0wy94zKUvFyAAAAAQE"]
[Sat Nov 22 04:29:14.398415 2025] [:error] [pid 53566:tid 53585] [client 194.5.82.122:34693] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSDLmsbSHDBkRbwMbd4CjAAAANE"]
[Sat Nov 22 04:29:18.403258 2025] [:error] [pid 53477:tid 53490] [client 194.5.82.108:36069] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSDLnn7Lu30Ku9O40aKvSwAAAAk"]
[Sat Nov 22 04:29:18.590652 2025] [:error] [pid 53479:tid 53543] [client 194.5.82.116:40231] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSDLnm6cicFF3Aas-oRKPgAAAIc"]
[Sat Nov 22 04:29:25.045922 2025] [:error] [pid 25856:tid 25881] [client 194.5.82.146:27185] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSDLpRsTP0wy94zKUvFyGwAAARc"]
[Sat Nov 22 04:29:26.633171 2025] [:error] [pid 25856:tid 25864] [client 194.5.82.163:63313] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSDLphsTP0wy94zKUvFyJAAAAQY"]
[Sat Nov 22 04:29:30.870124 2025] [:error] [pid 53478:tid 53514] [client 194.5.82.124:39881] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aSDLqghUYdXBbQswAdTh2gAAAEU"]
[Sat Nov 22 04:29:35.061264 2025] [:error] [pid 25856:tid 25875] [client 194.5.82.132:42581] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSDLrxsTP0wy94zKUvFyMwAAARE"]
[Sat Nov 22 04:29:37.955673 2025] [:error] [pid 53477:tid 53502] [client 194.5.82.153:62979] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "aSDLsX7Lu30Ku9O40aKvXQAAABU"]
[Sat Nov 22 04:29:44.198295 2025] [:error] [pid 25856:tid 25868] [client 194.5.82.144:41267] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSDLuBsTP0wy94zKUvFySAAAAQo"]
[Sat Nov 22 04:29:53.363975 2025] [:error] [pid 53477:tid 53504] [client 194.5.82.164:64403] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSDLwX7Lu30Ku9O40aKvgAAAABc"]
[Sat Nov 22 04:29:53.578282 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.107:31001] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSDLwRsTP0wy94zKUvFydgAAAQA"]
[Sat Nov 22 04:29:53.780341 2025] [:error] [pid 25856:tid 25880] [client 194.5.82.139:56255] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSDLwRsTP0wy94zKUvFyeAAAARY"]
[Sat Nov 22 04:29:53.993692 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.118:53343] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSDLwQhUYdXBbQswAdTiGQAAAE0"]
[Sat Nov 22 04:29:55.586793 2025] [:error] [pid 25856:tid 25867] [client 194.5.82.154:40587] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSDLwxsTP0wy94zKUvFyjAAAAQk"]
[Sat Nov 22 04:29:55.769147 2025] [:error] [pid 25856:tid 25878] [client 194.5.82.152:57213] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSDLwxsTP0wy94zKUvFyjwAAARQ"]
[Sat Nov 22 04:29:58.638946 2025] [:error] [pid 53478:tid 53530] [client 194.5.82.134:22059] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSDLxghUYdXBbQswAdTiNgAAAFU"]
[Sat Nov 22 04:29:58.834949 2025] [:error] [pid 53479:tid 53548] [client 194.5.82.135:21565] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSDLxm6cicFF3Aas-oRKrwAAAIw"]
[Sat Nov 22 04:29:59.016747 2025] [:error] [pid 53566:tid 53576] [client 194.5.82.138:38171] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSDLx8bSHDBkRbwMbd4DEwAAAMg"]
[Sat Nov 22 04:29:59.197188 2025] [:error] [pid 53478:tid 53523] [client 194.5.82.138:45661] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSDLxwhUYdXBbQswAdTiOgAAAE4"]
[Sat Nov 22 04:30:00.915215 2025] [:error] [pid 53477:tid 53494] [client 194.5.82.161:27583] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSDLyH7Lu30Ku9O40aKvjAAAAA0"]
[Sat Nov 22 04:30:04.336443 2025] [:error] [pid 25856:tid 25878] [client 194.5.82.143:42459] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSDLzBsTP0wy94zKUvFyqgAAARQ"]
[Sat Nov 22 04:30:09.698850 2025] [:error] [pid 53479:tid 53557] [client 194.5.82.169:53995] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSDL0W6cicFF3Aas-oRKwAAAAJU"]
[Sat Nov 22 04:30:19.036703 2025] [:error] [pid 25856:tid 25866] [client 194.5.82.118:61119] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSDL2xsTP0wy94zKUvFy6AAAAQg"]
[Sat Nov 22 04:30:23.211058 2025] [:error] [pid 53477:tid 53500] [client 194.5.82.113:62789] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSDL337Lu30Ku9O40aKvzgAAABM"]
[Sat Nov 22 04:30:23.390844 2025] [:error] [pid 53479:tid 53548] [client 194.5.82.134:23633] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSDL326cicFF3Aas-oRK2AAAAIw"]
[Sat Nov 22 04:30:28.572819 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.144:40169] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSDL5AhUYdXBbQswAdTiwwAAAEk"]
[Sat Nov 22 04:30:32.583631 2025] [proxy_fcgi:error] [pid 53477:tid 53486] [client 194.5.82.130:34609] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:30:32.691274 2025] [proxy_fcgi:error] [pid 53477:tid 53489] [client 194.5.82.130:34609] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:30:32.785423 2025] [proxy_fcgi:error] [pid 53477:tid 53487] [client 194.5.82.130:34609] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:30:36.509504 2025] [:error] [pid 53477:tid 53502] [client 194.5.82.130:34609] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSDL7H7Lu30Ku9O40aKv9wAAABU"]
[Sat Nov 22 04:30:36.726289 2025] [:error] [pid 53478:tid 53526] [client 194.5.82.116:25563] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSDL7AhUYdXBbQswAdTi4gAAAFE"]
[Sat Nov 22 04:30:36.907579 2025] [:error] [pid 53478:tid 53515] [client 194.5.82.139:23479] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSDL7AhUYdXBbQswAdTi4wAAAEY"]
[Sat Nov 22 04:30:37.148925 2025] [:error] [pid 53478:tid 53525] [client 194.5.82.119:34123] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSDL7QhUYdXBbQswAdTi5AAAAFA"]
[Sat Nov 22 04:30:37.338727 2025] [:error] [pid 53477:tid 53503] [client 194.5.82.153:60123] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSDL7X7Lu30Ku9O40aKv-QAAABY"]
[Sat Nov 22 04:30:37.551313 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.155:43339] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSDL7W6cicFF3Aas-oRK-gAAAJg"]
[Sat Nov 22 04:30:38.964415 2025] [:error] [pid 53477:tid 53497] [client 194.5.82.122:45927] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSDL7n7Lu30Ku9O40aKwAQAAABA"]
[Sat Nov 22 04:30:39.157947 2025] [:error] [pid 53477:tid 53491] [client 194.5.82.106:59013] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSDL737Lu30Ku9O40aKwAwAAAAo"]
[Sat Nov 22 04:30:39.354255 2025] [:error] [pid 53477:tid 53482] [client 194.5.82.128:25031] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSDL737Lu30Ku9O40aKwBAAAAAE"]
[Sat Nov 22 04:30:39.618361 2025] [:error] [pid 25856:tid 25873] [client 194.5.82.139:64693] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSDL7xsTP0wy94zKUvFzMgAAAQ8"]
[Sat Nov 22 04:30:42.417253 2025] [:error] [pid 25856:tid 25873] [client 194.5.82.121:26593] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSDL8hsTP0wy94zKUvFzQQAAAQ8"]
[Sat Nov 22 04:30:43.666374 2025] [:error] [pid 25856:tid 25870] [client 194.5.82.141:41043] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSDL8xsTP0wy94zKUvFzSgAAAQw"]
[Sat Nov 22 04:30:46.632183 2025] [:error] [pid 25856:tid 25859] [client 194.5.82.162:53641] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSDL9hsTP0wy94zKUvFzWwAAAQE"]
[Sat Nov 22 04:30:49.461803 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.117:40551] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSDL-W6cicFF3Aas-oRLFwAAAJI"]
[Sat Nov 22 04:30:54.987367 2025] [:error] [pid 53477:tid 53485] [client 194.5.82.123:22723] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSDL_n7Lu30Ku9O40aKwTAAAAAQ"]
[Sat Nov 22 04:31:00.828278 2025] [:error] [pid 25856:tid 25868] [client 194.5.82.136:46927] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSDMBBsTP0wy94zKUvFzrAAAAQo"]
[Sat Nov 22 04:31:03.896099 2025] [:error] [pid 25856:tid 25865] [client 194.5.82.106:65003] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSDMBxsTP0wy94zKUvFzuAAAAQc"]
[Sat Nov 22 04:31:23.854435 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.136:56015] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSDMGwhUYdXBbQswAdTjjAAAAFc"]
[Sat Nov 22 04:31:24.048422 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.145:56815] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSDMHMbSHDBkRbwMbd4EdQAAAMs"]
[Sat Nov 22 04:31:24.236048 2025] [:error] [pid 53566:tid 53576] [client 194.5.82.159:57791] [client 194.5.82.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.159, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aSDMHMbSHDBkRbwMbd4EeAAAAMg"]
[Sat Nov 22 04:31:26.974015 2025] [:error] [pid 53566:tid 53589] [client 194.5.82.159:57791] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSDMHsbSHDBkRbwMbd4EhwAAANU"]
[Sat Nov 22 04:31:30.097681 2025] [:error] [pid 53479:tid 53544] [client 194.5.82.131:41499] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSDMIm6cicFF3Aas-oRLhQAAAIg"]
[Sat Nov 22 04:31:30.281736 2025] [:error] [pid 53478:tid 53516] [client 194.5.82.138:36947] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSDMIghUYdXBbQswAdTjtwAAAEc"]
[Sat Nov 22 04:31:35.914002 2025] [:error] [pid 53479:tid 53548] [client 194.5.82.117:62415] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSDMJ26cicFF3Aas-oRLmgAAAIw"]
[Sat Nov 22 04:31:36.098726 2025] [:error] [pid 53566:tid 53577] [client 194.5.82.141:44163] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aSDMKMbSHDBkRbwMbd4ErwAAAMk"]
[Sat Nov 22 04:31:43.323819 2025] [:error] [pid 53478:tid 53519] [client 194.5.82.121:28167] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSDMLwhUYdXBbQswAdTkFgAAAEo"]
[Sat Nov 22 04:31:46.023750 2025] [proxy_fcgi:error] [pid 25856:tid 25881] [client 194.5.82.155:43663] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:31:47.468032 2025] [:error] [pid 25856:tid 25868] [client 194.5.82.155:43663] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aSDMMxsTP0wy94zKUvF0vwAAAQo"]
[Sat Nov 22 04:31:47.656464 2025] [:error] [pid 53478:tid 53529] [client 194.5.82.156:42415] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSDMMwhUYdXBbQswAdTkKAAAAFQ"]
[Sat Nov 22 04:31:50.570611 2025] [:error] [pid 53477:tid 53488] [client 194.5.82.108:43543] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSDMNn7Lu30Ku9O40aKxjQAAAAc"]
[Sat Nov 22 04:31:50.754954 2025] [:error] [pid 25856:tid 25862] [client 194.5.82.111:23989] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSDMNhsTP0wy94zKUvF0zwAAAQQ"]
[Sat Nov 22 04:31:59.957844 2025] [:error] [pid 53566:tid 53586] [client 194.5.82.145:53249] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSDMP8bSHDBkRbwMbd4FJgAAANI"]
[Sat Nov 22 04:32:00.175309 2025] [:error] [pid 25856:tid 25873] [client 194.5.82.159:64283] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSDMQBsTP0wy94zKUvF03QAAAQ8"]
[Sat Nov 22 04:32:05.676641 2025] [:error] [pid 53478:tid 53519] [client 194.5.82.125:25615] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aSDMRQhUYdXBbQswAdTkfAAAAEo"]
[Sat Nov 22 04:32:05.860029 2025] [:error] [pid 53566:tid 53572] [client 194.5.82.141:61599] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSDMRcbSHDBkRbwMbd4FNwAAAMQ"]
[Sat Nov 22 04:32:06.043849 2025] [:error] [pid 25856:tid 25864] [client 194.5.82.128:29025] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSDMRhsTP0wy94zKUvF09QAAAQY"]
[Sat Nov 22 04:32:12.975974 2025] [:error] [pid 53566:tid 53581] [client 194.5.82.160:49705] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSDMTMbSHDBkRbwMbd4FcgAAAM0"]
[Sat Nov 22 04:32:14.619301 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.157:51677] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSDMTm6cicFF3Aas-oRMgAAAAJI"]
[Sat Nov 22 04:32:22.357481 2025] [:error] [pid 53477:tid 53496] [client 194.5.82.170:56179] [client 194.5.82.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.170, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "aSDMVn7Lu30Ku9O40aKx0gAAAA8"]
[Sat Nov 22 04:32:30.261594 2025] [:error] [pid 53477:tid 53495] [client 194.5.82.170:56179] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSDMXn7Lu30Ku9O40aKx5AAAAA4"]
[Sat Nov 22 04:32:30.448989 2025] [:error] [pid 53566:tid 53580] [client 194.5.82.143:41841] [client 194.5.82.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.143, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSDMXsbSHDBkRbwMbd4GAQAAAMw"]
[Sat Nov 22 04:32:44.297513 2025] [proxy_fcgi:error] [pid 53566:tid 53584] [client 194.5.82.143:41841] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:33:02.449147 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.143:41841] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSDMfsbSHDBkRbwMbd4GggAAAMY"]
[Sat Nov 22 04:33:06.544921 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.145:39977] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSDMghsTP0wy94zKUvF1xwAAAQI"]
[Sat Nov 22 04:33:09.441203 2025] [:error] [pid 53477:tid 53481] [client 194.5.82.131:39825] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSDMhX7Lu30Ku9O40aKyOAAAAAA"]
[Sat Nov 22 04:33:21.159755 2025] [:error] [pid 53479:tid 53540] [client 194.5.82.139:31789] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSDMkW6cicFF3Aas-oRNBgAAAIQ"]
[Sat Nov 22 04:33:23.987673 2025] [:error] [pid 53477:tid 53484] [client 194.5.82.106:20761] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSDMk37Lu30Ku9O40aKyTQAAAAM"]
[Sat Nov 22 04:33:25.699014 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.120:40857] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSDMlQhUYdXBbQswAdTlKQAAAE0"]
[Sat Nov 22 04:33:32.190336 2025] [proxy_fcgi:error] [pid 53478:tid 53512] [client 194.5.82.160:55481] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:33:32.295123 2025] [proxy_fcgi:error] [pid 53478:tid 53519] [client 194.5.82.160:55481] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:33:32.396903 2025] [:error] [pid 53478:tid 53531] [client 194.5.82.160:55481] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSDMnAhUYdXBbQswAdTlOAAAAFY"]
[Sat Nov 22 04:33:32.582735 2025] [:error] [pid 53478:tid 53529] [client 194.5.82.160:47053] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSDMnAhUYdXBbQswAdTlOgAAAFQ"]
[Sat Nov 22 04:33:42.693092 2025] [:error] [pid 25856:tid 25859] [client 194.5.82.139:47629] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSDMphsTP0wy94zKUvF2KgAAAQE"]
[Sat Nov 22 04:33:44.279707 2025] [:error] [pid 53479:tid 53551] [client 194.5.82.156:56869] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aSDMqG6cicFF3Aas-oRNLQAAAI8"]
[Sat Nov 22 04:33:48.623147 2025] [:error] [pid 53479:tid 53539] [client 194.5.82.106:59127] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSDMrG6cicFF3Aas-oRNQgAAAIM"]
[Sat Nov 22 04:33:58.144170 2025] [:error] [pid 53566:tid 53585] [client 194.5.82.118:48761] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSDMtsbSHDBkRbwMbd4HrQAAANE"]
[Sat Nov 22 04:33:58.338370 2025] [proxy_fcgi:error] [pid 53566:tid 53575] [client 194.5.82.157:32599] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:34:01.163387 2025] [:error] [pid 53566:tid 53584] [client 194.5.82.157:32599] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSDMucbSHDBkRbwMbd4HswAAANA"]
[Sat Nov 22 04:34:07.681578 2025] [proxy_fcgi:error] [pid 53566:tid 53583] [client 194.5.82.141:44413] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:34:09.063620 2025] [:error] [pid 53566:tid 53569] [client 194.5.82.141:44413] [client 194.5.82.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.141, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSDMwcbSHDBkRbwMbd4HyAAAAME"]
[Sat Nov 22 04:34:15.406516 2025] [:error] [pid 53566:tid 53568] [client 194.5.82.141:44413] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSDMx8bSHDBkRbwMbd4HzgAAAMA"]
[Sat Nov 22 04:34:17.067881 2025] [:error] [pid 53477:tid 53498] [client 194.5.82.154:54849] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSDMyX7Lu30Ku9O40aKynQAAABE"]
[Sat Nov 22 04:34:21.384029 2025] [:error] [pid 53566:tid 53573] [client 194.5.82.131:54901] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSDMzcbSHDBkRbwMbd4H1QAAAMU"]
[Sat Nov 22 04:34:27.677003 2025] [:error] [pid 53566:tid 53587] [client 194.5.82.146:31307] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSDM08bSHDBkRbwMbd4H3gAAANM"]
[Sat Nov 22 04:34:29.413201 2025] [:error] [pid 25856:tid 25882] [client 194.5.82.143:55045] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSDM1RsTP0wy94zKUvF2xAAAARg"]
[Sat Nov 22 04:34:33.612930 2025] [:error] [pid 53477:tid 53499] [client 194.5.82.106:64889] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSDM2X7Lu30Ku9O40aKyqwAAABI"]
[Sat Nov 22 04:34:36.489623 2025] [proxy_fcgi:error] [pid 53479:tid 53545] [client 194.5.82.159:56075] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:34:36.581119 2025] [:error] [pid 53479:tid 53538] [client 194.5.82.159:56075] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSDM3G6cicFF3Aas-oRNdgAAAII"]
[Sat Nov 22 04:34:36.772508 2025] [proxy_fcgi:error] [pid 25856:tid 25876] [client 194.5.82.106:23785] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/rejuvanet/public_html/wp-content/themes/twentytwentyfour/functions.php:147\nStack trace:\n#0 {main}\n  thrown in /home/rejuvanet/public_html/wp-content/themes/twentytwentyfour/functions.php on line 147'
[Sat Nov 22 04:34:36.962867 2025] [:error] [pid 53478:tid 53528] [client 194.5.82.144:51507] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "aSDM3AhUYdXBbQswAdTliQAAAFM"]
[Sat Nov 22 04:34:37.146069 2025] [:error] [pid 53566:tid 53590] [client 194.5.82.146:36623] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSDM3cbSHDBkRbwMbd4H5gAAANY"]
[Sat Nov 22 04:34:37.328383 2025] [:error] [pid 53477:tid 53501] [client 194.5.82.137:63535] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSDM3X7Lu30Ku9O40aKyrwAAABQ"]
[Sat Nov 22 04:34:37.510667 2025] [:error] [pid 53478:tid 53511] [client 194.5.82.106:40551] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSDM3QhUYdXBbQswAdTligAAAEI"]
[Sat Nov 22 04:34:37.691158 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.139:32399] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSDM3RsTP0wy94zKUvF26AAAAQI"]
[Sat Nov 22 04:34:37.877843 2025] [:error] [pid 53566:tid 53578] [client 194.5.82.161:28781] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSDM3cbSHDBkRbwMbd4H5wAAAMo"]
[Sat Nov 22 04:34:40.934392 2025] [:error] [pid 53566:tid 53592] [client 194.5.82.162:55997] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSDM4MbSHDBkRbwMbd4H9AAAANg"]
[Sat Nov 22 04:34:41.114658 2025] [:error] [pid 53479:tid 53544] [client 194.5.82.145:43701] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSDM4W6cicFF3Aas-oRNfwAAAIg"]
[Sat Nov 22 04:34:41.300009 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.164:44763] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSDM4cbSHDBkRbwMbd4H9gAAAMs"]
[Sat Nov 22 04:34:42.555273 2025] [:error] [pid 53566:tid 53578] [client 194.5.82.116:64237] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSDM4sbSHDBkRbwMbd4H-AAAAMo"]
[Sat Nov 22 04:34:45.409460 2025] [:error] [pid 25856:tid 25869] [client 194.5.82.139:31685] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSDM5RsTP0wy94zKUvF3CwAAAQs"]
[Sat Nov 22 04:34:45.618978 2025] [proxy_fcgi:error] [pid 53477:tid 53505] [client 194.5.82.169:50991] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:34:49.635951 2025] [:error] [pid 53477:tid 53500] [client 194.5.82.169:50991] [client 194.5.82.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.169, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSDM6X7Lu30Ku9O40aKy1gAAABM"]
[Sat Nov 22 04:34:58.203868 2025] [:error] [pid 53477:tid 53481] [client 194.5.82.169:50991] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSDM8n7Lu30Ku9O40aKzBwAAAAA"]
[Sat Nov 22 04:34:59.856829 2025] [:error] [pid 53566:tid 53586] [client 194.5.82.139:58057] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSDM88bSHDBkRbwMbd4IPgAAANI"]
[Sat Nov 22 04:35:22.852624 2025] [:error] [pid 25856:tid 25866] [client 194.5.82.128:24571] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSDNChsTP0wy94zKUvF3fAAAAQg"]
[Sat Nov 22 04:35:23.039307 2025] [:error] [pid 53477:tid 53490] [client 194.5.82.128:63025] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSDNC37Lu30Ku9O40aKzRQAAAAk"]
[Sat Nov 22 04:35:23.221864 2025] [:error] [pid 25856:tid 25870] [client 194.5.82.108:62975] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSDNCxsTP0wy94zKUvF3gAAAAQw"]
[Sat Nov 22 04:35:31.062375 2025] [:error] [pid 53566:tid 53583] [client 194.5.82.170:32917] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSDNE8bSHDBkRbwMbd4IrAAAAM8"]
[Sat Nov 22 04:35:31.242539 2025] [:error] [pid 53477:tid 53491] [client 194.5.82.119:23907] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSDNE37Lu30Ku9O40aKzVgAAAAo"]
[Sat Nov 22 04:35:31.447220 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.125:40967] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSDNExsTP0wy94zKUvF3sgAAAQA"]
[Sat Nov 22 04:35:38.242712 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.140:54395] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSDNGm6cicFF3Aas-oRN7wAAAJQ"]
[Sat Nov 22 04:35:39.862668 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.132:64407] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSDNGxsTP0wy94zKUvF3zAAAAQA"]
[Sat Nov 22 04:35:42.760809 2025] [:error] [pid 25856:tid 25872] [client 194.5.82.122:49689] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSDNHhsTP0wy94zKUvF31AAAAQ4"]
[Sat Nov 22 04:35:56.977876 2025] [:error] [pid 53477:tid 53485] [client 194.5.82.123:32997] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSDNLH7Lu30Ku9O40aKzogAAAAQ"]
[Sat Nov 22 04:35:59.852752 2025] [:error] [pid 25856:tid 25871] [client 194.5.82.111:25621] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aSDNLxsTP0wy94zKUvF37AAAAQ0"]
[Sat Nov 22 04:36:09.794957 2025] [:error] [pid 53479:tid 53552] [client 194.5.82.159:56171] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSDNOW6cicFF3Aas-oROGAAAAJA"]
[Sat Nov 22 04:36:12.744341 2025] [:error] [pid 25856:tid 25882] [client 194.5.82.117:57623] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSDNPBsTP0wy94zKUvF4EQAAARg"]
[Sat Nov 22 04:36:18.715672 2025] [:error] [pid 53478:tid 53509] [client 194.5.82.169:43037] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSDNQghUYdXBbQswAdTmogAAAEA"]
[Sat Nov 22 04:36:25.228490 2025] [:error] [pid 25856:tid 25880] [client 194.5.82.159:55793] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSDNSRsTP0wy94zKUvF4KwAAARY"]
[Sat Nov 22 04:36:28.864233 2025] [:error] [pid 25856:tid 25863] [client 194.5.82.107:42245] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSDNTBsTP0wy94zKUvF4NwAAAQU"]
[Sat Nov 22 04:36:29.059758 2025] [:error] [pid 53479:tid 53549] [client 194.5.82.156:60859] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSDNTW6cicFF3Aas-oRORgAAAI0"]
[Sat Nov 22 04:36:37.230387 2025] [:error] [pid 53478:tid 53526] [client 194.5.82.118:28431] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSDNVQhUYdXBbQswAdTmxgAAAFE"]
[Sat Nov 22 04:36:43.964198 2025] [:error] [pid 25856:tid 25863] [client 194.5.82.161:64165] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSDNWxsTP0wy94zKUvF4dwAAAQU"]
[Sat Nov 22 04:36:49.670826 2025] [:error] [pid 53477:tid 53493] [client 194.5.82.143:47705] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSDNYX7Lu30Ku9O40aK0DAAAAAw"]
[Sat Nov 22 04:36:49.869268 2025] [:error] [pid 53479:tid 53543] [client 194.5.82.125:46373] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSDNYW6cicFF3Aas-oROgAAAAIc"]
[Sat Nov 22 04:36:53.339434 2025] [:error] [pid 53566:tid 53586] [client 194.5.82.128:44061] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSDNZcbSHDBkRbwMbd4JewAAANI"]
[Sat Nov 22 04:36:57.354079 2025] [:error] [pid 53566:tid 53591] [client 194.5.82.157:55457] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSDNacbSHDBkRbwMbd4JgwAAANc"]
[Sat Nov 22 04:36:57.558588 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.145:45175] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSDNaRsTP0wy94zKUvF4lwAAAQA"]
[Sat Nov 22 04:37:06.950110 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.163:37711] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSDNcghUYdXBbQswAdTm8gAAAFc"]
[Sat Nov 22 04:37:09.990327 2025] [:error] [pid 25856:tid 25862] [client 194.5.82.107:33791] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSDNdRsTP0wy94zKUvF4qQAAAQQ"]
[Sat Nov 22 04:37:10.174295 2025] [:error] [pid 25856:tid 25882] [client 194.5.82.119:23931] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSDNdhsTP0wy94zKUvF4qwAAARg"]
[Sat Nov 22 04:37:13.004074 2025] [:error] [pid 25856:tid 25874] [client 194.5.82.140:65369] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSDNeRsTP0wy94zKUvF4sQAAARA"]
[Sat Nov 22 04:37:14.664855 2025] [:error] [pid 53566:tid 53588] [client 194.5.82.138:24113] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSDNesbSHDBkRbwMbd4JqwAAANQ"]
[Sat Nov 22 04:37:21.113291 2025] [:error] [pid 25856:tid 25874] [client 194.5.82.114:22043] [client 194.5.82.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSDNgRsTP0wy94zKUvF4_gAAARA"]
[Sat Nov 22 04:37:24.507015 2025] [:error] [pid 53477:tid 53500] [client 194.5.82.118:30169] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSDNhH7Lu30Ku9O40aK0OQAAABM"]
[Sat Nov 22 04:37:27.438565 2025] [:error] [pid 53566:tid 53578] [client 194.5.82.146:43753] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSDNh8bSHDBkRbwMbd4JuQAAAMo"]
[Sat Nov 22 04:37:29.077418 2025] [:error] [pid 53477:tid 53483] [client 194.5.82.135:52925] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "aSDNiX7Lu30Ku9O40aK0PwAAAAI"]
[Sat Nov 22 04:37:30.812253 2025] [:error] [pid 53479:tid 53541] [client 194.5.82.144:63369] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSDNim6cicFF3Aas-oRPFgAAAIU"]
[Sat Nov 22 04:37:30.993362 2025] [:error] [pid 53479:tid 53544] [client 194.5.82.139:28263] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aSDNim6cicFF3Aas-oRPFwAAAIg"]
[Sat Nov 22 04:37:31.184729 2025] [:error] [pid 53478:tid 53526] [client 194.5.82.144:51589] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSDNiwhUYdXBbQswAdTnBAAAAFE"]
[Sat Nov 22 04:37:38.937674 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.128:48465] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSDNkm6cicFF3Aas-oRPIAAAAJI"]
[Sat Nov 22 04:37:42.948128 2025] [:error] [pid 25856:tid 25882] [client 194.5.82.119:41061] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSDNlhsTP0wy94zKUvF5SwAAARg"]
[Sat Nov 22 04:37:46.756683 2025] [:error] [pid 53566:tid 53581] [client 194.5.82.164:61005] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSDNmsbSHDBkRbwMbd4JyQAAAM0"]
[Sat Nov 22 04:37:50.810919 2025] [:error] [pid 53566:tid 53577] [client 194.5.82.127:53551] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSDNnsbSHDBkRbwMbd4JzwAAAMk"]
[Sat Nov 22 04:37:58.588525 2025] [:error] [pid 53478:tid 53513] [client 194.5.82.146:32685] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSDNpghUYdXBbQswAdTnKgAAAEQ"]
[Sat Nov 22 04:38:00.288628 2025] [:error] [pid 53566:tid 53583] [client 194.5.82.125:53785] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSDNqMbSHDBkRbwMbd4J3AAAAM8"]
[Sat Nov 22 04:38:02.069652 2025] [:error] [pid 53479:tid 53540] [client 194.5.82.169:46607] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSDNqm6cicFF3Aas-oRPKgAAAIQ"]
[Sat Nov 22 04:38:04.961178 2025] [:error] [pid 25856:tid 25863] [client 194.5.82.117:53569] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSDNrBsTP0wy94zKUvF5vgAAAQU"]
[Sat Nov 22 04:38:15.439304 2025] [:error] [pid 53566:tid 53577] [client 194.5.82.144:50663] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSDNt8bSHDBkRbwMbd4J9gAAAMk"]
[Sat Nov 22 04:38:15.622818 2025] [:error] [pid 25856:tid 25859] [client 194.5.82.140:26807] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSDNtxsTP0wy94zKUvF50AAAAQE"]
[Sat Nov 22 04:38:19.688518 2025] [:error] [pid 53566:tid 53569] [client 194.5.82.118:47415] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSDNu8bSHDBkRbwMbd4J_AAAAME"]
[Sat Nov 22 04:38:19.868352 2025] [:error] [pid 53479:tid 53542] [client 194.5.82.164:64537] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSDNu26cicFF3Aas-oRPPgAAAIY"]
[Sat Nov 22 04:38:22.839126 2025] [:error] [pid 25856:tid 25868] [client 194.5.82.136:38787] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSDNvhsTP0wy94zKUvF53wAAAQo"]
[Sat Nov 22 04:38:23.018194 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.107:40935] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSDNv8bSHDBkRbwMbd4KAAAAAMY"]
[Sat Nov 22 04:38:23.199080 2025] [:error] [pid 53566:tid 53577] [client 194.5.82.147:52825] [client 194.5.82.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.147, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSDNv8bSHDBkRbwMbd4KAwAAAMk"]
[Sat Nov 22 04:38:23.201664 2025] [proxy_fcgi:error] [pid 53566:tid 53577] [client 194.5.82.147:52825] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:38:23.307287 2025] [:error] [pid 53566:tid 53587] [client 194.5.82.147:52825] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSDNv8bSHDBkRbwMbd4KBAAAANM"]
[Sat Nov 22 04:38:27.168771 2025] [:error] [pid 53477:tid 53503] [client 194.5.82.136:39053] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSDNw37Lu30Ku9O40aK0fwAAABY"]
[Sat Nov 22 04:38:27.351397 2025] [:error] [pid 53477:tid 53492] [client 194.5.82.137:20931] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aSDNw37Lu30Ku9O40aK0gAAAAAs"]
[Sat Nov 22 04:38:36.019079 2025] [:error] [pid 53479:tid 53546] [client 194.5.82.123:53609] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSDNzG6cicFF3Aas-oRPWwAAAIo"]
[Sat Nov 22 04:38:36.233183 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.116:43865] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSDNzMbSHDBkRbwMbd4KFwAAAMs"]
[Sat Nov 22 04:38:38.530309 2025] [:error] [pid 25856:tid 25872] [client 194.5.82.113:32875] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSDNzhsTP0wy94zKUvF58QAAAQ4"]
[Sat Nov 22 04:38:38.710192 2025] [:error] [pid 53477:tid 53482] [client 194.5.82.169:62291] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSDNzn7Lu30Ku9O40aK0kgAAAAE"]
[Sat Nov 22 04:38:38.896402 2025] [proxy_fcgi:error] [pid 53478:tid 53521] [client 194.5.82.106:63629] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:38:38.987175 2025] [:error] [pid 53478:tid 53513] [client 194.5.82.106:63629] [client 194.5.82.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.106, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSDNzghUYdXBbQswAdTnQgAAAEQ"]
[Sat Nov 22 04:38:41.797503 2025] [:error] [pid 53478:tid 53525] [client 194.5.82.106:63629] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSDN0QhUYdXBbQswAdTnRgAAAFA"]
[Sat Nov 22 04:38:46.461907 2025] [:error] [pid 53566:tid 53570] [client 194.5.82.145:24595] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSDN1sbSHDBkRbwMbd4KJAAAAMI"]
[Sat Nov 22 04:38:48.085126 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.153:36383] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSDN2AhUYdXBbQswAdTnTQAAAE0"]
[Sat Nov 22 04:38:48.263800 2025] [:error] [pid 53566:tid 53571] [client 194.5.82.120:48357] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSDN2MbSHDBkRbwMbd4KKQAAAMM"]
[Sat Nov 22 04:38:52.438796 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.111:22991] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSDN3G6cicFF3Aas-oRPhAAAAJQ"]
[Sat Nov 22 04:38:55.289954 2025] [:error] [pid 53479:tid 53552] [client 194.5.82.116:36553] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSDN326cicFF3Aas-oRPjAAAAJA"]
[Sat Nov 22 04:39:00.790745 2025] [:error] [pid 25856:tid 25876] [client 194.5.82.127:51635] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSDN5BsTP0wy94zKUvF6DAAAARI"]
[Sat Nov 22 04:39:00.973155 2025] [:error] [pid 53566:tid 53585] [client 194.5.82.108:32983] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSDN5MbSHDBkRbwMbd4KOwAAANE"]
[Sat Nov 22 04:39:02.640160 2025] [:error] [pid 53478:tid 53533] [client 194.5.82.137:55593] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/count.php"] [unique_id "aSDN5ghUYdXBbQswAdTnYAAAAFg"]
[Sat Nov 22 04:39:10.819648 2025] [:error] [pid 53566:tid 53592] [client 194.5.82.117:33589] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSDN7sbSHDBkRbwMbd4KUQAAANg"]
[Sat Nov 22 04:39:13.725240 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.113:56251] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rejuva.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rejuva.au"] [uri "/images/stories/themes.php"] [unique_id "aSDN8RsTP0wy94zKUvF6JwAAAQI"]
[Sat Nov 22 04:39:13.818729 2025] [:error] [pid 25856:tid 25879] [client 194.5.82.113:56251] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSDN8RsTP0wy94zKUvF6KAAAARU"]
[Sat Nov 22 04:39:17.596284 2025] [:error] [pid 25856:tid 25868] [client 194.5.82.132:35501] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSDN9RsTP0wy94zKUvF6MAAAAQo"]
[Sat Nov 22 04:39:17.779085 2025] [:error] [pid 53566:tid 53582] [client 194.5.82.113:62779] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSDN9cbSHDBkRbwMbd4KaAAAAM4"]
[Sat Nov 22 04:39:25.531482 2025] [:error] [pid 53479:tid 53541] [client 194.5.82.122:22215] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSDN_W6cicFF3Aas-oRP0QAAAIU"]
[Sat Nov 22 04:39:28.475627 2025] [:error] [pid 53478:tid 53517] [client 194.5.82.125:28381] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSDOAAhUYdXBbQswAdTnlgAAAEg"]
[Sat Nov 22 04:39:30.122287 2025] [:error] [pid 53566:tid 53568] [client 194.5.82.161:37275] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSDOAsbSHDBkRbwMbd4KhwAAAMA"]
[Sat Nov 22 04:39:36.675450 2025] [:error] [pid 25856:tid 25880] [client 194.5.82.124:23667] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSDOCBsTP0wy94zKUvF6VAAAARY"]
[Sat Nov 22 04:39:38.268095 2025] [:error] [pid 53478:tid 53512] [client 194.5.82.121:40267] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/colour.php"] [unique_id "aSDOCghUYdXBbQswAdTnpwAAAEM"]
[Sat Nov 22 04:39:39.975201 2025] [:error] [pid 53478:tid 53533] [client 194.5.82.160:24413] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSDOCwhUYdXBbQswAdTnqwAAAFg"]
[Sat Nov 22 04:39:40.156296 2025] [:error] [pid 53477:tid 53489] [client 194.5.82.163:20375] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSDODH7Lu30Ku9O40aK08QAAAAg"]
[Sat Nov 22 04:39:43.011847 2025] [:error] [pid 53479:tid 53540] [client 194.5.82.139:28717] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSDOD26cicFF3Aas-oRP6QAAAIQ"]
[Sat Nov 22 04:39:48.267861 2025] [:error] [pid 53566:tid 53588] [client 194.5.82.144:32189] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSDOFMbSHDBkRbwMbd4KtQAAANQ"]
[Sat Nov 22 04:39:48.449668 2025] [:error] [pid 53479:tid 53545] [client 194.5.82.153:21443] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSDOFG6cicFF3Aas-oRP-QAAAIk"]
[Sat Nov 22 04:39:54.889313 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.142:28935] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSDOGm6cicFF3Aas-oRQDAAAAJQ"]
[Sat Nov 22 04:39:59.231391 2025] [:error] [pid 53479:tid 53552] [client 194.5.82.111:64249] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSDOH26cicFF3Aas-oRQEwAAAJA"]
[Sat Nov 22 04:40:03.620544 2025] [:error] [pid 53478:tid 53520] [client 194.5.82.135:56037] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSDOIwhUYdXBbQswAdTn7gAAAEs"]
[Sat Nov 22 04:40:03.837769 2025] [:error] [pid 53566:tid 53568] [client 194.5.82.111:38119] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSDOI8bSHDBkRbwMbd4KzwAAAMA"]
[Sat Nov 22 04:40:05.494921 2025] [:error] [pid 53477:tid 53487] [client 194.5.82.144:42521] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSDOJX7Lu30Ku9O40aK1IQAAAAY"]
[Sat Nov 22 04:40:08.433715 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.130:43727] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSDOKG6cicFF3Aas-oRQMgAAAJQ"]
[Sat Nov 22 04:40:11.308859 2025] [:error] [pid 53479:tid 53537] [client 194.5.82.108:47447] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSDOK26cicFF3Aas-oRQPgAAAIE"]
[Sat Nov 22 04:40:11.517760 2025] [:error] [pid 53477:tid 53501] [client 194.5.82.123:50689] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSDOK37Lu30Ku9O40aK1PwAAABQ"]
[Sat Nov 22 04:40:13.187115 2025] [:error] [pid 25856:tid 25871] [client 194.5.82.140:26135] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSDOLRsTP0wy94zKUvF6rAAAAQ0"]
[Sat Nov 22 04:40:13.371720 2025] [:error] [pid 53477:tid 53487] [client 194.5.82.119:52669] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSDOLX7Lu30Ku9O40aK1RAAAAAY"]
[Sat Nov 22 04:40:16.361431 2025] [:error] [pid 53566:tid 53573] [client 194.5.82.117:57567] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSDOMMbSHDBkRbwMbd4K6QAAAMU"]
[Sat Nov 22 04:40:17.594313 2025] [:error] [pid 53479:tid 53538] [client 194.5.82.136:34745] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSDOMW6cicFF3Aas-oRQRgAAAII"]
[Sat Nov 22 04:40:17.799827 2025] [:error] [pid 53477:tid 53495] [client 194.5.82.170:58897] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSDOMX7Lu30Ku9O40aK1TgAAAA4"]
[Sat Nov 22 04:40:17.989656 2025] [:error] [pid 53479:tid 53546] [client 194.5.82.170:53167] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSDOMW6cicFF3Aas-oRQRwAAAIo"]
[Sat Nov 22 04:40:22.127305 2025] [:error] [pid 53478:tid 53529] [client 194.5.82.108:47867] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSDONghUYdXBbQswAdToBAAAAFQ"]
[Sat Nov 22 04:40:24.972890 2025] [:error] [pid 53479:tid 53550] [client 194.5.82.147:35961] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSDOOG6cicFF3Aas-oRQTwAAAI4"]
[Sat Nov 22 04:40:26.659298 2025] [:error] [pid 53477:tid 53485] [client 194.5.82.155:52443] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSDOOn7Lu30Ku9O40aK1YwAAAAQ"]
[Sat Nov 22 04:40:26.873290 2025] [proxy_fcgi:error] [pid 25856:tid 25862] [client 194.5.82.124:45795] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/rejuvanet/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/rejuvanet/public_html/wp-admin/includes/admin.php on line 16'
[Sat Nov 22 04:40:27.087467 2025] [:error] [pid 25856:tid 25879] [client 194.5.82.164:51301] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSDOOxsTP0wy94zKUvF6wQAAARU"]
[Sat Nov 22 04:40:33.664892 2025] [:error] [pid 53566:tid 53572] [client 45.55.158.254:42046] [client 45.55.158.254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSDOQcbSHDBkRbwMbd4LDwAAAMQ"]
[Sat Nov 22 04:40:36.666751 2025] [:error] [pid 25856:tid 25861] [client 194.5.82.136:40577] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSDORBsTP0wy94zKUvF60wAAAQM"]
[Sat Nov 22 04:40:36.867607 2025] [:error] [pid 53566:tid 53588] [client 194.5.82.137:24611] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSDORMbSHDBkRbwMbd4LFQAAANQ"]
[Sat Nov 22 04:40:39.707052 2025] [:error] [pid 53477:tid 53503] [client 194.5.82.169:20399] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSDOR37Lu30Ku9O40aK1gAAAABY"]
[Sat Nov 22 04:40:44.896245 2025] [:error] [pid 53478:tid 53521] [client 194.5.82.124:56357] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSDOTAhUYdXBbQswAdToNQAAAEw"]
[Sat Nov 22 04:40:47.731882 2025] [:error] [pid 53566:tid 53585] [client 194.5.82.154:65201] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSDOT8bSHDBkRbwMbd4LMgAAANE"]
[Sat Nov 22 04:40:49.719438 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.111:34479] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSDOURsTP0wy94zKUvF68AAAAQA"]
[Sat Nov 22 04:40:51.393682 2025] [:error] [pid 53478:tid 53523] [client 194.5.82.144:29483] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSDOUwhUYdXBbQswAdToRgAAAE4"]
[Sat Nov 22 04:40:53.034870 2025] [:error] [pid 53477:tid 53488] [client 194.5.82.124:24525] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSDOVX7Lu30Ku9O40aK1lQAAAAc"]
[Sat Nov 22 04:40:58.518743 2025] [:error] [pid 53479:tid 53542] [client 194.5.82.132:41611] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSDOWm6cicFF3Aas-oRQmQAAAIY"]
[Sat Nov 22 04:41:02.821744 2025] [:error] [pid 25856:tid 25877] [client 194.5.82.131:24095] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSDOXhsTP0wy94zKUvF7OQAAARM"]
[Sat Nov 22 04:41:03.009697 2025] [proxy_fcgi:error] [pid 25856:tid 25875] [client 194.5.82.141:46657] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:41:03.099863 2025] [:error] [pid 25856:tid 25866] [client 194.5.82.141:46657] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSDOXxsTP0wy94zKUvF7PgAAAQg"]
[Sat Nov 22 04:41:03.285886 2025] [:error] [pid 25856:tid 25871] [client 194.5.82.130:40279] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSDOXxsTP0wy94zKUvF7QAAAAQ0"]
[Sat Nov 22 04:41:06.596647 2025] [:error] [pid 53566:tid 53569] [client 194.5.82.123:33583] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSDOYsbSHDBkRbwMbd4LTgAAAME"]
[Sat Nov 22 04:41:06.783822 2025] [:error] [pid 53566:tid 53588] [client 194.5.82.107:27439] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSDOYsbSHDBkRbwMbd4LUQAAANQ"]
[Sat Nov 22 04:41:14.661237 2025] [:error] [pid 53477:tid 53494] [client 194.5.82.134:65451] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSDOan7Lu30Ku9O40aK1rQAAAA0"]
[Sat Nov 22 04:41:14.856104 2025] [:error] [pid 53566:tid 53570] [client 194.5.82.152:50079] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSDOasbSHDBkRbwMbd4LZgAAAMI"]
[Sat Nov 22 04:41:16.433184 2025] [:error] [pid 53478:tid 53528] [client 194.5.82.106:23549] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/log.php"] [unique_id "aSDObAhUYdXBbQswAdTofAAAAFM"]
[Sat Nov 22 04:41:16.615981 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.111:45261] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSDObBsTP0wy94zKUvF7VQAAAQI"]
[Sat Nov 22 04:41:16.800015 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.107:23247] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSDObG6cicFF3Aas-oRQwwAAAJI"]
[Sat Nov 22 04:41:16.983000 2025] [:error] [pid 53566:tid 53584] [client 194.5.82.170:31929] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/aw.php"] [unique_id "aSDObMbSHDBkRbwMbd4LbgAAANA"]
[Sat Nov 22 04:41:22.374494 2025] [:error] [pid 25856:tid 25877] [client 194.5.82.128:30663] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSDOchsTP0wy94zKUvF7ZgAAARM"]
[Sat Nov 22 04:41:22.555726 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.138:22231] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/install.php"] [unique_id "aSDOcsbSHDBkRbwMbd4LcQAAAMs"]
[Sat Nov 22 04:41:25.298810 2025] [:error] [pid 25856:tid 25859] [client 194.5.82.131:30001] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSDOdRsTP0wy94zKUvF7awAAAQE"]
[Sat Nov 22 04:41:25.527586 2025] [:error] [pid 25856:tid 25873] [client 194.5.82.113:51299] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSDOdRsTP0wy94zKUvF7bgAAAQ8"]
[Sat Nov 22 04:41:28.411249 2025] [:error] [pid 53477:tid 53491] [client 194.5.82.123:30389] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/template-less.php"] [unique_id "aSDOeH7Lu30Ku9O40aK1vQAAAAo"]
[Sat Nov 22 04:41:28.625507 2025] [:error] [pid 53479:tid 53548] [client 194.5.82.137:52031] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSDOeG6cicFF3Aas-oRQ2AAAAIw"]
[Sat Nov 22 04:41:37.526594 2025] [:error] [pid 53477:tid 53494] [client 194.5.82.163:51091] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aSDOgX7Lu30Ku9O40aK12gAAAA0"]
[Sat Nov 22 04:41:37.723305 2025] [:error] [pid 53479:tid 53542] [client 194.5.82.156:60429] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSDOgW6cicFF3Aas-oRQ6AAAAIY"]
[Sat Nov 22 04:41:40.548723 2025] [:error] [pid 25856:tid 25870] [client 194.5.82.137:43019] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aSDOhBsTP0wy94zKUvF7iQAAAQw"]
[Sat Nov 22 04:41:42.204034 2025] [:error] [pid 53478:tid 53513] [client 194.5.82.150:24879] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSDOhghUYdXBbQswAdToqQAAAEQ"]
[Sat Nov 22 04:41:44.160565 2025] [:error] [pid 53479:tid 53549] [client 194.5.82.105:57765] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/load.php"] [unique_id "aSDOiG6cicFF3Aas-oRRCAAAAI0"]
[Sat Nov 22 04:41:44.343744 2025] [:error] [pid 53478:tid 53529] [client 194.5.82.120:62657] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSDOiAhUYdXBbQswAdTorAAAAFQ"]
[Sat Nov 22 04:41:44.556443 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.137:31333] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSDOiMbSHDBkRbwMbd4LkAAAAMY"]
[Sat Nov 22 04:41:48.753816 2025] [:error] [pid 53479:tid 53559] [client 194.5.82.108:23459] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSDOjG6cicFF3Aas-oRREgAAAJc"]
[Sat Nov 22 04:41:50.340353 2025] [:error] [pid 53566:tid 53569] [client 194.5.82.144:62913] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSDOjsbSHDBkRbwMbd4LmgAAAME"]
[Sat Nov 22 04:41:54.520658 2025] [:error] [pid 53566:tid 53572] [client 194.5.82.169:39043] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSDOksbSHDBkRbwMbd4LoAAAAMQ"]
[Sat Nov 22 04:41:54.706974 2025] [:error] [pid 25856:tid 25867] [client 194.5.82.150:45877] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSDOkhsTP0wy94zKUvF7sQAAAQk"]
[Sat Nov 22 04:41:56.460630 2025] [:error] [pid 53479:tid 53557] [client 194.5.82.152:37457] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSDOlG6cicFF3Aas-oRRKgAAAJU"]
[Sat Nov 22 04:42:08.744764 2025] [:error] [pid 53477:tid 53482] [client 194.5.82.134:27439] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aSDOoH7Lu30Ku9O40aK2GQAAAAE"]
[Sat Nov 22 04:42:10.010866 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.109:23857] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSDOohsTP0wy94zKUvF7zgAAAQI"]
[Sat Nov 22 04:42:13.198079 2025] [:error] [pid 53478:tid 53515] [client 194.5.82.134:33575] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aSDOpQhUYdXBbQswAdTozgAAAEY"]
[Sat Nov 22 04:42:13.383521 2025] [:error] [pid 53477:tid 53505] [client 194.5.82.118:36385] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aSDOpX7Lu30Ku9O40aK2IAAAABg"]
[Sat Nov 22 04:42:13.648415 2025] [:error] [pid 53477:tid 53496] [client 194.5.82.161:34551] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aSDOpX7Lu30Ku9O40aK2IQAAAA8"]
[Sat Nov 22 04:42:15.387377 2025] [autoindex:error] [pid 53566:tid 53568] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:15.526210 2025] [autoindex:error] [pid 53566:tid 53570] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:15.620660 2025] [autoindex:error] [pid 53566:tid 53573] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:15.729456 2025] [autoindex:error] [pid 53566:tid 53583] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:17.071661 2025] [autoindex:error] [pid 53566:tid 53572] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:17.177529 2025] [autoindex:error] [pid 53566:tid 53580] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:17.279679 2025] [autoindex:error] [pid 53566:tid 53576] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:17.377421 2025] [autoindex:error] [pid 53566:tid 53582] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:17.477920 2025] [autoindex:error] [pid 53566:tid 53590] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:17.577390 2025] [autoindex:error] [pid 53566:tid 53587] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:17.775930 2025] [autoindex:error] [pid 53566:tid 53578] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:19.035932 2025] [autoindex:error] [pid 53566:tid 53569] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:19.132086 2025] [autoindex:error] [pid 53566:tid 53571] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:21.899144 2025] [autoindex:error] [pid 53566:tid 53582] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:22.000146 2025] [autoindex:error] [pid 53566:tid 53590] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:22.097826 2025] [autoindex:error] [pid 53566:tid 53587] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:22.204489 2025] [autoindex:error] [pid 53566:tid 53592] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:23.649961 2025] [autoindex:error] [pid 53566:tid 53588] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:23.932582 2025] [autoindex:error] [pid 53566:tid 53585] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:25.367384 2025] [autoindex:error] [pid 53566:tid 53571] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:27.949622 2025] [autoindex:error] [pid 53566:tid 53583] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:28.059111 2025] [autoindex:error] [pid 53566:tid 53577] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:28.157309 2025] [autoindex:error] [pid 53566:tid 53581] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:36.538853 2025] [autoindex:error] [pid 53566:tid 53581] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:37.893077 2025] [autoindex:error] [pid 53566:tid 53580] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:38.017951 2025] [autoindex:error] [pid 53566:tid 53582] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:38.349470 2025] [autoindex:error] [pid 53566:tid 53589] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:38.472686 2025] [autoindex:error] [pid 53566:tid 53586] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:38.571116 2025] [autoindex:error] [pid 53566:tid 53591] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:44.010405 2025] [autoindex:error] [pid 53566:tid 53570] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:42:44.114133 2025] [autoindex:error] [pid 53566:tid 53576] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:16.429430 2025] [autoindex:error] [pid 53566:tid 53580] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:16.529891 2025] [autoindex:error] [pid 53566:tid 53590] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:16.630198 2025] [autoindex:error] [pid 53566:tid 53587] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:16.747925 2025] [autoindex:error] [pid 53566:tid 53575] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:16.861923 2025] [autoindex:error] [pid 53566:tid 53571] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/languages/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:16.968652 2025] [autoindex:error] [pid 53566:tid 53572] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:17.068843 2025] [autoindex:error] [pid 53566:tid 53578] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:17.185323 2025] [autoindex:error] [pid 53566:tid 53588] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:18.477736 2025] [autoindex:error] [pid 53566:tid 53574] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:19.794760 2025] [autoindex:error] [pid 53566:tid 53586] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:19.914137 2025] [autoindex:error] [pid 53566:tid 53570] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:20.024278 2025] [autoindex:error] [pid 53566:tid 53573] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:21.359918 2025] [autoindex:error] [pid 53566:tid 53590] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:21.465060 2025] [autoindex:error] [pid 53566:tid 53587] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:21.562000 2025] [autoindex:error] [pid 53566:tid 53575] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:21.685374 2025] [autoindex:error] [pid 53566:tid 53571] [client 194.5.82.140:36695] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:43:51.067219 2025] [autoindex:error] [pid 53477:tid 53490] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:06.050834 2025] [autoindex:error] [pid 53477:tid 53500] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:11.058206 2025] [autoindex:error] [pid 53477:tid 53502] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:11.151362 2025] [autoindex:error] [pid 53477:tid 53495] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.149844 2025] [autoindex:error] [pid 53477:tid 53501] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.270610 2025] [autoindex:error] [pid 53477:tid 53482] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.366715 2025] [autoindex:error] [pid 53477:tid 53502] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.465107 2025] [autoindex:error] [pid 53477:tid 53495] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.570331 2025] [autoindex:error] [pid 53477:tid 53496] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.672123 2025] [autoindex:error] [pid 53477:tid 53487] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.765962 2025] [autoindex:error] [pid 53477:tid 53489] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.862577 2025] [autoindex:error] [pid 53477:tid 53494] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:16.956140 2025] [autoindex:error] [pid 53477:tid 53491] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:39.361900 2025] [autoindex:error] [pid 53477:tid 53505] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 04:44:41.870050 2025] [autoindex:error] [pid 53477:tid 53484] [client 194.5.82.140:37355] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/maintenance/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:56:26.293180 2025] [autoindex:error] [pid 53477:tid 53502] [client 212.116.231.26:54590] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:56:26.723455 2025] [autoindex:error] [pid 53477:tid 53502] [client 212.116.231.26:54590] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:56:27.142046 2025] [:error] [pid 53477:tid 53488] [client 212.116.231.26:54590] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aSDuG37Lu30Ku9O40aIF5gAAAAc"]
[Sat Nov 22 06:56:27.979810 2025] [:error] [pid 53479:tid 53557] [client 212.116.231.26:54730] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aSDuG26cicFF3Aas-oSgzAAAAJU"]
[Sat Nov 22 06:56:28.813010 2025] [:error] [pid 53478:tid 53531] [client 212.116.231.26:54808] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aSDuHAhUYdXBbQswAdQ_KgAAAFY"]
[Sat Nov 22 06:56:29.650954 2025] [:error] [pid 25856:tid 25860] [client 212.116.231.26:58252] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aSDuHRsTP0wy94zKUvHmVQAAAQI"]
[Sat Nov 22 06:56:30.476641 2025] [:error] [pid 25856:tid 25861] [client 212.116.231.26:58326] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aSDuHhsTP0wy94zKUvHmXAAAAQM"]
[Sat Nov 22 06:59:38.974520 2025] [:error] [pid 53566:tid 53571] [client 43.130.34.74:39012] [client 43.130.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSDu2sbSHDBkRbwMbd5pJgAAAMM"]
[Sat Nov 22 08:12:27.461949 2025] [:error] [pid 53566:tid 53579] [client 43.173.1.57:39178] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSD_68bSHDBkRbwMbd5_YgAAAMs"]
[Sat Nov 22 10:33:41.521101 2025] [autoindex:error] [pid 25856:tid 25878] [client 139.59.37.180:61558] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Nov 22 11:46:25.316248 2025] [:error] [pid 53479:tid 53536] [client 43.128.67.187:52990] [client 43.128.67.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSEyEW6cicFF3Aas-oT0_QAAAIA"]
[Sat Nov 22 12:13:48.382219 2025] [:error] [pid 53566:tid 53578] [client 31.171.130.70:29173] [client 31.171.130.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSE4fMbSHDBkRbwMbd7NswAAAMo"]
[Sat Nov 22 12:13:52.076048 2025] [:error] [pid 53477:tid 53481] [client 31.171.130.88:22861] [client 31.171.130.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSE4gH7Lu30Ku9O40aJczAAAAAA"]
[Sat Nov 22 12:14:09.906145 2025] [:error] [pid 25856:tid 25861] [client 31.171.130.69:21323] [client 31.171.130.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSE4kRsTP0wy94zKUvFR8QAAAQM"]
[Sat Nov 22 12:14:15.461251 2025] [:error] [pid 25856:tid 25881] [client 31.171.130.60:52121] [client 31.171.130.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSE4lxsTP0wy94zKUvFR9gAAARc"]
[Sat Nov 22 12:14:16.482021 2025] [:error] [pid 53478:tid 53516] [client 31.171.130.71:22927] [client 31.171.130.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSE4mAhUYdXBbQswAdSZawAAAEc"]
[Sat Nov 22 12:14:18.452939 2025] [:error] [pid 9547:tid 9556] [client 31.171.130.77:54397] [client 31.171.130.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSE4mtClOR5qk7DoMeE2RAAAAUM"]
[Sat Nov 22 12:14:26.652266 2025] [:error] [pid 53479:tid 53553] [client 31.171.130.86:60051] [client 31.171.130.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSE4om6cicFF3Aas-oT8vQAAAJE"]
[Sat Nov 22 12:14:30.554562 2025] [:error] [pid 53566:tid 53569] [client 31.171.130.104:65265] [client 31.171.130.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSE4psbSHDBkRbwMbd7NxAAAAME"]
[Sat Nov 22 12:14:44.304160 2025] [:error] [pid 53477:tid 53494] [client 31.171.130.62:36829] [client 31.171.130.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSE4tH7Lu30Ku9O40aJc8wAAAA0"]
[Sat Nov 22 12:14:47.274947 2025] [:error] [pid 53566:tid 53591] [client 31.171.130.91:37561] [client 31.171.130.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSE4t8bSHDBkRbwMbd7NyAAAANc"]
[Sat Nov 22 12:16:38.370878 2025] [:error] [pid 53477:tid 53500] [client 31.171.130.92:48195] [client 31.171.130.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.92, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aSE5Jn7Lu30Ku9O40aJdqwAAABM"]
[Sat Nov 22 12:16:48.614480 2025] [:error] [pid 53477:tid 53486] [client 31.171.130.92:48195] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aSE5MH7Lu30Ku9O40aJdtAAAAAU"]
[Sat Nov 22 12:17:40.884746 2025] [:error] [pid 53478:tid 53532] [client 31.171.130.63:49549] [client 31.171.130.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aSE5ZAhUYdXBbQswAdSaPAAAAFc"]
[Sat Nov 22 12:19:11.083951 2025] [:error] [pid 9547:tid 9561] [client 31.171.130.95:56177] [client 31.171.130.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/lx.php"] [unique_id "aSE5v9ClOR5qk7DoMeE3gAAAAUg"]
[Sat Nov 22 12:21:41.782928 2025] [:error] [pid 25856:tid 25882] [client 31.171.130.74:39161] [client 31.171.130.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aSE6VRsTP0wy94zKUvFUAQAAARg"]
[Sat Nov 22 12:22:44.284928 2025] [:error] [pid 25856:tid 25859] [client 31.171.130.68:48495] [client 31.171.130.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSE6lBsTP0wy94zKUvFUOwAAAQE"]
[Sat Nov 22 12:22:45.250432 2025] [:error] [pid 53566:tid 53587] [client 31.171.130.88:46947] [client 31.171.130.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.171.130.88, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aSE6lcbSHDBkRbwMbd7PQgAAANM"]
[Sat Nov 22 12:22:52.370845 2025] [:error] [pid 53566:tid 53582] [client 31.171.130.88:46947] [client 31.171.130.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSE6nMbSHDBkRbwMbd7PWQAAAM4"]
[Sat Nov 22 12:23:20.821453 2025] [:error] [pid 53566:tid 53575] [client 31.171.130.92:41803] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSE6uMbSHDBkRbwMbd7PaAAAAMc"]
[Sat Nov 22 12:23:57.299730 2025] [:error] [pid 53479:tid 53546] [client 31.171.130.97:23721] [client 31.171.130.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSE63W6cicFF3Aas-oQAOwAAAIo"]
[Sat Nov 22 12:23:59.366340 2025] [:error] [pid 25856:tid 25869] [client 31.171.130.84:63059] [client 31.171.130.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSE63xsTP0wy94zKUvFUbwAAAQs"]
[Sat Nov 22 12:24:00.332188 2025] [:error] [pid 53566:tid 53575] [client 31.171.130.90:55149] [client 31.171.130.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSE64MbSHDBkRbwMbd7PjQAAAMc"]
[Sat Nov 22 12:24:01.351797 2025] [:error] [pid 53478:tid 53516] [client 31.171.130.59:33077] [client 31.171.130.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSE64QhUYdXBbQswAdSbmAAAAEc"]
[Sat Nov 22 12:24:13.098386 2025] [:error] [pid 53477:tid 53502] [client 31.171.130.94:29071] [client 31.171.130.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.94, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aSE67X7Lu30Ku9O40aJfcwAAABU"]
[Sat Nov 22 12:24:44.473765 2025] [:error] [pid 53477:tid 53501] [client 31.171.130.94:29071] [client 31.171.130.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSE7DH7Lu30Ku9O40aJfkwAAABQ"]
[Sat Nov 22 12:24:54.314055 2025] [:error] [pid 53479:tid 53537] [client 31.171.130.101:48617] [client 31.171.130.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.101, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSE7Fm6cicFF3Aas-oQAhgAAAIE"]
[Sat Nov 22 12:25:21.571519 2025] [:error] [pid 53566:tid 53589] [client 31.171.130.103:46437] [client 31.171.130.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aSE7McbSHDBkRbwMbd7PxwAAANU"]
[Sat Nov 22 12:25:22.570785 2025] [:error] [pid 53478:tid 53515] [client 31.171.130.54:37829] [client 31.171.130.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aSE7MghUYdXBbQswAdSbwAAAAEY"]
[Sat Nov 22 12:25:36.505915 2025] [proxy_fcgi:error] [pid 9547:tid 9565] [client 31.171.130.94:45477] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:25:51.430894 2025] [proxy_fcgi:error] [pid 9547:tid 9562] [client 31.171.130.94:45477] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:26:26.805298 2025] [:error] [pid 9547:tid 9574] [client 31.171.130.94:45477] [client 31.171.130.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSE7ctClOR5qk7DoMeE5IgAAAVU"]
[Sat Nov 22 12:26:36.075741 2025] [:error] [pid 53478:tid 53525] [client 31.171.130.61:35535] [client 31.171.130.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bak.php"] [unique_id "aSE7fAhUYdXBbQswAdScAAAAAFA"]
[Sat Nov 22 12:26:39.405683 2025] [:error] [pid 53566:tid 53568] [client 31.171.130.72:63589] [client 31.171.130.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSE7f8bSHDBkRbwMbd7QGQAAAMA"]
[Sat Nov 22 12:26:51.221818 2025] [:error] [pid 53477:tid 53497] [client 31.171.130.74:63089] [client 31.171.130.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aSE7i37Lu30Ku9O40aJgCQAAABA"]
[Sat Nov 22 12:26:52.207626 2025] [:error] [pid 9547:tid 9573] [client 31.171.130.92:40389] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSE7jNClOR5qk7DoMeE5WAAAAVQ"]
[Sat Nov 22 12:26:53.205638 2025] [:error] [pid 53566:tid 53582] [client 31.171.130.92:34251] [client 31.171.130.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.92, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aSE7jcbSHDBkRbwMbd7QKQAAAM4"]
[Sat Nov 22 12:27:00.994656 2025] [:error] [pid 53566:tid 53590] [client 31.171.130.92:34251] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/themes.php"] [unique_id "aSE7lMbSHDBkRbwMbd7QMQAAANY"]
[Sat Nov 22 12:27:22.066769 2025] [autoindex:error] [pid 53478:tid 53521] [client 31.171.130.91:54789] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:27:23.986484 2025] [:error] [pid 53478:tid 53528] [client 31.171.130.91:54789] [client 31.171.130.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aSE7qwhUYdXBbQswAdScOQAAAFM"]
[Sat Nov 22 12:27:29.335261 2025] [:error] [pid 53479:tid 53549] [client 31.171.130.103:39677] [client 31.171.130.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aSE7sW6cicFF3Aas-oQBvQAAAI0"]
[Sat Nov 22 12:27:38.429523 2025] [:error] [pid 9547:tid 9577] [client 31.171.130.80:29587] [client 31.171.130.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSE7utClOR5qk7DoMeE5ogAAAVg"]
[Sat Nov 22 12:27:49.094837 2025] [:error] [pid 53566:tid 53591] [client 31.171.130.72:26787] [client 31.171.130.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.72, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aSE7xcbSHDBkRbwMbd7QUQAAANc"]
[Sat Nov 22 12:27:56.593010 2025] [:error] [pid 53566:tid 53580] [client 31.171.130.72:26787] [client 31.171.130.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aSE7zMbSHDBkRbwMbd7QVQAAAMw"]
[Sat Nov 22 12:27:57.557129 2025] [:error] [pid 53478:tid 53523] [client 31.171.130.62:43463] [client 31.171.130.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSE7zQhUYdXBbQswAdScWQAAAE4"]
[Sat Nov 22 12:28:27.093257 2025] [:error] [pid 53478:tid 53522] [client 31.171.130.75:40223] [client 31.171.130.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSE76whUYdXBbQswAdScgwAAAE0"]
[Sat Nov 22 12:28:31.704286 2025] [:error] [pid 9547:tid 9565] [client 31.171.130.83:31867] [client 31.171.130.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSE779ClOR5qk7DoMeE57wAAAUw"]
[Sat Nov 22 12:28:32.684688 2025] [:error] [pid 53479:tid 53553] [client 31.171.130.101:30491] [client 31.171.130.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aSE78G6cicFF3Aas-oQCRQAAAJE"]
[Sat Nov 22 12:28:33.658245 2025] [:error] [pid 53477:tid 53489] [client 31.171.130.54:48943] [client 31.171.130.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aSE78X7Lu30Ku9O40aJgZQAAAAg"]
[Sat Nov 22 12:28:34.653851 2025] [:error] [pid 53479:tid 53560] [client 31.171.130.82:52323] [client 31.171.130.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSE78m6cicFF3Aas-oQCSgAAAJg"]
[Sat Nov 22 12:28:39.529667 2025] [autoindex:error] [pid 53479:tid 53553] [client 31.171.130.101:65045] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:28:44.471558 2025] [:error] [pid 53479:tid 53555] [client 31.171.130.101:65045] [client 31.171.130.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aSE7_G6cicFF3Aas-oQCWAAAAJM"]
[Sat Nov 22 12:28:54.121992 2025] [:error] [pid 53479:tid 53545] [client 31.171.130.87:42051] [client 31.171.130.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSE8Bm6cicFF3Aas-oQCZAAAAIk"]
[Sat Nov 22 12:29:00.025092 2025] [:error] [pid 53479:tid 53540] [client 31.171.130.61:34173] [client 31.171.130.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSE8DG6cicFF3Aas-oQCagAAAIQ"]
[Sat Nov 22 12:29:05.400720 2025] [:error] [pid 53566:tid 53580] [client 31.171.130.60:59157] [client 31.171.130.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aSE8EcbSHDBkRbwMbd7QnAAAAMw"]
[Sat Nov 22 12:29:14.168891 2025] [:error] [pid 53478:tid 53533] [client 31.171.130.99:37901] [client 31.171.130.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSE8GghUYdXBbQswAdScogAAAFg"]
[Sat Nov 22 12:29:16.320905 2025] [:error] [pid 25856:tid 25879] [client 31.171.130.105:33527] [client 31.171.130.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aSE8HBsTP0wy94zKUvFV1gAAARU"]
[Sat Nov 22 12:29:18.737423 2025] [:error] [pid 9547:tid 9577] [client 31.171.130.60:39399] [client 31.171.130.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSE8HtClOR5qk7DoMeE6IgAAAVg"]
[Sat Nov 22 12:29:25.432598 2025] [:error] [pid 9547:tid 9574] [client 31.171.130.75:55541] [client 31.171.130.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.75, incrementing brute counter"] [hostname "rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aSE8JdClOR5qk7DoMeE6KgAAAVU"]
[Sat Nov 22 12:29:29.873281 2025] [:error] [pid 9547:tid 9569] [client 31.171.130.75:55541] [client 31.171.130.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aSE8KdClOR5qk7DoMeE6MQAAAVA"]
[Sat Nov 22 12:29:32.881853 2025] [:error] [pid 25856:tid 25881] [client 31.171.130.91:39783] [client 31.171.130.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSE8LBsTP0wy94zKUvFV5QAAARc"]
[Sat Nov 22 12:29:52.100758 2025] [:error] [pid 25856:tid 25872] [client 31.171.130.78:34607] [client 31.171.130.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.78, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aSE8QBsTP0wy94zKUvFWFwAAAQ4"]
[Sat Nov 22 12:29:56.319652 2025] [:error] [pid 25856:tid 25865] [client 31.171.130.78:34607] [client 31.171.130.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSE8RBsTP0wy94zKUvFWGAAAAQc"]
[Sat Nov 22 12:29:57.339107 2025] [:error] [pid 53479:tid 53539] [client 31.171.130.96:55207] [client 31.171.130.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aSE8RW6cicFF3Aas-oQDJgAAAIM"]
[Sat Nov 22 12:29:58.255538 2025] [:error] [pid 53478:tid 53525] [client 31.171.130.86:33581] [client 31.171.130.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aSE8RghUYdXBbQswAdScygAAAFA"]
[Sat Nov 22 12:30:09.615694 2025] [:error] [pid 53478:tid 53515] [client 31.171.130.55:45517] [client 31.171.130.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aSE8UQhUYdXBbQswAdSc2AAAAEY"]
[Sat Nov 22 12:30:32.884846 2025] [:error] [pid 53478:tid 53518] [client 31.171.130.70:58711] [client 31.171.130.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSE8aAhUYdXBbQswAdSc7QAAAEk"]
[Sat Nov 22 12:30:42.080347 2025] [:error] [pid 53566:tid 53572] [client 31.171.130.104:41363] [client 31.171.130.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSE8csbSHDBkRbwMbd7RCAAAAMQ"]
[Sat Nov 22 12:30:54.929677 2025] [:error] [pid 53566:tid 53584] [client 31.171.130.60:59313] [client 31.171.130.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSE8fsbSHDBkRbwMbd7REQAAANA"]
[Sat Nov 22 12:30:58.706072 2025] [:error] [pid 53479:tid 53545] [client 31.171.130.60:51461] [client 31.171.130.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSE8gm6cicFF3Aas-oQDZAAAAIk"]
[Sat Nov 22 12:31:01.131906 2025] [:error] [pid 53479:tid 53540] [client 31.171.130.92:50445] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSE8hW6cicFF3Aas-oQDawAAAIQ"]
[Sat Nov 22 12:31:09.298725 2025] [:error] [pid 9547:tid 9569] [client 31.171.130.96:46903] [client 31.171.130.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSE8jdClOR5qk7DoMeE6ggAAAVA"]
[Sat Nov 22 12:31:12.999486 2025] [:error] [pid 53566:tid 53568] [client 31.171.130.75:23809] [client 31.171.130.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSE8kMbSHDBkRbwMbd7RIAAAAMA"]
[Sat Nov 22 12:31:20.036750 2025] [:error] [pid 53566:tid 53578] [client 31.171.130.103:22349] [client 31.171.130.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSE8mMbSHDBkRbwMbd7RLAAAAMo"]
[Sat Nov 22 12:31:28.903259 2025] [:error] [pid 9547:tid 9553] [client 31.171.130.92:41877] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSE8oNClOR5qk7DoMeE6jwAAAUA"]
[Sat Nov 22 12:31:37.883952 2025] [:error] [pid 9547:tid 9563] [client 31.171.130.79:31537] [client 31.171.130.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSE8qdClOR5qk7DoMeE6mgAAAUo"]
[Sat Nov 22 12:31:43.484516 2025] [:error] [pid 53479:tid 53557] [client 31.171.130.105:32455] [client 31.171.130.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSE8r26cicFF3Aas-oQDrAAAAJU"]
[Sat Nov 22 12:31:52.902910 2025] [proxy_fcgi:error] [pid 53479:tid 53555] [client 31.171.130.103:27681] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:31:58.427002 2025] [:error] [pid 53479:tid 53558] [client 31.171.130.103:27681] [client 31.171.130.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aSE8vm6cicFF3Aas-oQDwwAAAJY"]
[Sat Nov 22 12:32:36.284109 2025] [:error] [pid 53479:tid 53536] [client 31.171.130.99:58427] [client 31.171.130.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aSE85G6cicFF3Aas-oQD7QAAAIA"]
[Sat Nov 22 12:32:37.257476 2025] [:error] [pid 53566:tid 53581] [client 31.171.130.86:51633] [client 31.171.130.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSE85cbSHDBkRbwMbd7RTwAAAM0"]
[Sat Nov 22 12:32:44.413413 2025] [:error] [pid 53479:tid 53541] [client 31.171.130.78:44803] [client 31.171.130.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aSE87G6cicFF3Aas-oQD-gAAAIU"]
[Sat Nov 22 12:32:45.421197 2025] [:error] [pid 9547:tid 9556] [client 31.171.130.57:51399] [client 31.171.130.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSE87dClOR5qk7DoMeE6yQAAAUM"]
[Sat Nov 22 12:32:47.788688 2025] [:error] [pid 53477:tid 53486] [client 31.171.130.59:33267] [client 31.171.130.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aSE8737Lu30Ku9O40aJhGwAAAAU"]
[Sat Nov 22 12:33:04.812208 2025] [:error] [pid 53566:tid 53573] [client 31.171.130.70:36265] [client 31.171.130.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSE9AMbSHDBkRbwMbd7RYwAAAMU"]
[Sat Nov 22 12:33:14.713061 2025] [:error] [pid 53479:tid 53554] [client 31.171.130.54:27411] [client 31.171.130.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.54, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSE9Cm6cicFF3Aas-oQEJQAAAJI"]
[Sat Nov 22 12:33:20.559788 2025] [:error] [pid 53479:tid 53548] [client 31.171.130.54:27411] [client 31.171.130.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSE9EG6cicFF3Aas-oQELAAAAIw"]
[Sat Nov 22 12:33:21.570596 2025] [:error] [pid 53478:tid 53512] [client 31.171.130.84:47765] [client 31.171.130.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSE9EQhUYdXBbQswAdSdMgAAAEM"]
[Sat Nov 22 12:33:30.947763 2025] [:error] [pid 53479:tid 53555] [client 31.171.130.87:50163] [client 31.171.130.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aSE9Gm6cicFF3Aas-oQENwAAAJM"]
[Sat Nov 22 12:33:36.881831 2025] [:error] [pid 9547:tid 9564] [client 31.171.130.95:55755] [client 31.171.130.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSE9INClOR5qk7DoMeE6-gAAAUs"]
[Sat Nov 22 12:33:44.448231 2025] [proxy_fcgi:error] [pid 53477:tid 53482] [client 31.171.130.72:62533] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:33:56.886694 2025] [proxy_fcgi:error] [pid 53477:tid 53504] [client 31.171.130.72:62533] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:34:00.130431 2025] [:error] [pid 53477:tid 53490] [client 31.171.130.72:62533] [client 31.171.130.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSE9OH7Lu30Ku9O40aJhSwAAAAk"]
[Sat Nov 22 12:34:10.067431 2025] [:error] [pid 53566:tid 53570] [client 31.171.130.66:27667] [client 31.171.130.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aSE9QsbSHDBkRbwMbd7RgwAAAMI"]
[Sat Nov 22 12:34:21.798100 2025] [:error] [pid 53477:tid 53490] [client 31.171.130.103:29541] [client 31.171.130.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.103, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSE9TX7Lu30Ku9O40aJhWwAAAAk"]
[Sat Nov 22 12:34:21.802353 2025] [proxy_fcgi:error] [pid 53477:tid 53490] [client 31.171.130.103:29541] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:34:33.193842 2025] [:error] [pid 53477:tid 53496] [client 31.171.130.103:29541] [client 31.171.130.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mah.php"] [unique_id "aSE9WX7Lu30Ku9O40aJhaQAAAA8"]
[Sat Nov 22 12:34:34.916807 2025] [:error] [pid 53479:tid 53556] [client 31.171.130.59:43229] [client 31.171.130.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.59, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aSE9Wm6cicFF3Aas-oQEbAAAAJQ"]
[Sat Nov 22 12:34:43.714893 2025] [:error] [pid 53478:tid 53527] [client 31.171.130.74:21417] [client 31.171.130.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aSE9YwhUYdXBbQswAdSdWAAAAFI"]
[Sat Nov 22 12:34:59.929688 2025] [proxy_fcgi:error] [pid 9547:tid 9561] [client 31.171.130.94:24197] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:35:06.978912 2025] [:error] [pid 9547:tid 9560] [client 31.171.130.94:24197] [client 31.171.130.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSE9etClOR5qk7DoMeE7SwAAAUc"]
[Sat Nov 22 12:35:13.005750 2025] [:error] [pid 53479:tid 53548] [client 31.171.130.104:25225] [client 31.171.130.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSE9gW6cicFF3Aas-oQEjQAAAIw"]
[Sat Nov 22 12:35:17.498723 2025] [:error] [pid 53477:tid 53481] [client 31.171.130.101:34289] [client 31.171.130.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.101, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aSE9hX7Lu30Ku9O40aJhfgAAAAA"]
[Sat Nov 22 12:35:37.120683 2025] [:error] [pid 53477:tid 53499] [client 31.171.130.101:34289] [client 31.171.130.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aSE9mX7Lu30Ku9O40aJhlQAAABI"]
[Sat Nov 22 12:35:41.726000 2025] [:error] [pid 53566:tid 53589] [client 31.171.130.62:28375] [client 31.171.130.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/packed.php"] [unique_id "aSE9ncbSHDBkRbwMbd7RugAAANU"]
[Sat Nov 22 12:36:07.866452 2025] [:error] [pid 25856:tid 25871] [client 31.171.130.81:41081] [client 31.171.130.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aSE9txsTP0wy94zKUvFXLgAAAQ0"]
[Sat Nov 22 12:36:13.796393 2025] [:error] [pid 53479:tid 53537] [client 31.171.130.53:24603] [client 31.171.130.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSE9vW6cicFF3Aas-oQE_wAAAIE"]
[Sat Nov 22 12:36:16.502662 2025] [:error] [pid 53478:tid 53532] [client 31.171.130.71:54485] [client 31.171.130.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aSE9wAhUYdXBbQswAdSdjQAAAFc"]
[Sat Nov 22 12:36:29.534721 2025] [:error] [pid 9547:tid 9572] [client 31.171.130.68:31195] [client 31.171.130.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.68, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aSE9zdClOR5qk7DoMeE7iAAAAVM"]
[Sat Nov 22 12:36:31.407432 2025] [:error] [pid 9547:tid 9564] [client 31.171.130.68:31195] [client 31.171.130.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSE9z9ClOR5qk7DoMeE7iQAAAUs"]
[Sat Nov 22 12:36:46.086786 2025] [:error] [pid 53477:tid 53489] [client 31.171.130.73:49183] [client 31.171.130.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSE93n7Lu30Ku9O40aJhxgAAAAg"]
[Sat Nov 22 12:36:47.124940 2025] [:error] [pid 53477:tid 53504] [client 31.171.130.75:39389] [client 31.171.130.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aSE9337Lu30Ku9O40aJhxwAAABc"]
[Sat Nov 22 12:36:58.629648 2025] [proxy_fcgi:error] [pid 53478:tid 53521] [client 31.171.130.77:25187] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:37:04.778696 2025] [proxy_fcgi:error] [pid 53478:tid 53509] [client 31.171.130.77:25187] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:37:05.266146 2025] [:error] [pid 53478:tid 53525] [client 31.171.130.77:25187] [client 31.171.130.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aSE98QhUYdXBbQswAdSdswAAAFA"]
[Sat Nov 22 12:37:12.156586 2025] [:error] [pid 53566:tid 53590] [client 31.171.130.100:43247] [client 31.171.130.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/votes.php"] [unique_id "aSE9-MbSHDBkRbwMbd7R5gAAANY"]
[Sat Nov 22 12:37:33.638849 2025] [proxy_fcgi:error] [pid 53479:tid 53553] [client 31.171.130.93:31843] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:37:37.085697 2025] [:error] [pid 53479:tid 53548] [client 31.171.130.93:31843] [client 31.171.130.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "aSE-EW6cicFF3Aas-oQFVAAAAIw"]
[Sat Nov 22 12:37:45.679185 2025] [:error] [pid 53479:tid 53540] [client 31.171.130.56:61071] [client 31.171.130.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aSE-GW6cicFF3Aas-oQFZAAAAIQ"]
[Sat Nov 22 12:38:14.093367 2025] [proxy_fcgi:error] [pid 53477:tid 53487] [client 31.171.130.76:55353] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:38:15.315474 2025] [:error] [pid 53477:tid 53488] [client 31.171.130.76:55353] [client 31.171.130.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aSE-N37Lu30Ku9O40aJiAAAAAAc"]
[Sat Nov 22 12:38:16.314162 2025] [proxy_fcgi:error] [pid 9547:tid 9567] [client 31.171.130.89:43065] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:38:23.242522 2025] [proxy_fcgi:error] [pid 9547:tid 9555] [client 31.171.130.89:43065] AH01071: Got error 'PHP message: PHP Warning:  Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/rejuvanet/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/rejuvanet/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/rejuvanet/public_html/wp-settings.php on line 34PHP message: PHP Fatal error:  require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/rejuvanet/public_html/wp-settings.php on line 34'
[Sat Nov 22 12:38:24.248414 2025] [:error] [pid 53477:tid 53482] [client 31.171.130.74:29105] [client 31.171.130.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSE-QH7Lu30Ku9O40aJiEwAAAAE"]
[Sat Nov 22 12:38:45.820489 2025] [:error] [pid 53477:tid 53483] [client 31.171.130.92:39897] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/item.php"] [unique_id "aSE-VX7Lu30Ku9O40aJiMQAAAAI"]
[Sat Nov 22 12:39:00.196477 2025] [:error] [pid 53478:tid 53509] [client 31.171.130.105:38135] [client 31.171.130.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.105, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aSE-ZAhUYdXBbQswAdSeFQAAAEA"]
[Sat Nov 22 12:39:06.062979 2025] [:error] [pid 53478:tid 53528] [client 31.171.130.105:38135] [client 31.171.130.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.105, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSE-aghUYdXBbQswAdSeFgAAAFM"]
[Sat Nov 22 12:39:08.619264 2025] [:error] [pid 53478:tid 53516] [client 31.171.130.105:38135] [client 31.171.130.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mani.php"] [unique_id "aSE-bAhUYdXBbQswAdSeGQAAAEc"]
[Sat Nov 22 12:39:28.453569 2025] [:error] [pid 53479:tid 53554] [client 31.171.130.72:30727] [client 31.171.130.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aSE-gG6cicFF3Aas-oQF8QAAAJI"]
[Sat Nov 22 12:39:34.315517 2025] [:error] [pid 53479:tid 53539] [client 31.171.130.89:40261] [client 31.171.130.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSE-hm6cicFF3Aas-oQF_QAAAIM"]
[Sat Nov 22 12:39:44.490914 2025] [proxy_fcgi:error] [pid 9547:tid 9572] [client 31.171.130.74:62397] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:39:48.793514 2025] [proxy_fcgi:error] [pid 9547:tid 9573] [client 31.171.130.74:62397] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:39:51.302252 2025] [:error] [pid 9547:tid 9565] [client 31.171.130.74:62397] [client 31.171.130.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSE-l9ClOR5qk7DoMeE8fAAAAUw"]
[Sat Nov 22 12:39:52.322667 2025] [:error] [pid 25856:tid 25870] [client 31.171.130.60:39795] [client 31.171.130.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aSE-mBsTP0wy94zKUvFYEQAAAQw"]
[Sat Nov 22 12:40:01.126081 2025] [:error] [pid 53566:tid 53592] [client 31.171.130.78:45875] [client 31.171.130.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.78, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/wp-login.php"] [unique_id "aSE-ocbSHDBkRbwMbd7SkgAAANg"]
[Sat Nov 22 12:40:13.921134 2025] [:error] [pid 53566:tid 53591] [client 31.171.130.78:45875] [client 31.171.130.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aSE-rcbSHDBkRbwMbd7SnAAAANc"]
[Sat Nov 22 12:40:16.397224 2025] [:error] [pid 53566:tid 53582] [client 31.171.130.95:58257] [client 31.171.130.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aSE-sMbSHDBkRbwMbd7SoAAAAM4"]
[Sat Nov 22 12:40:17.367367 2025] [:error] [pid 53479:tid 53559] [client 31.171.130.92:63011] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSE-sW6cicFF3Aas-oQGfQAAAJc"]
[Sat Nov 22 12:40:22.421298 2025] [:error] [pid 25856:tid 25865] [client 31.171.130.79:58763] [client 31.171.130.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSE-thsTP0wy94zKUvFYIQAAAQc"]
[Sat Nov 22 12:40:37.834205 2025] [proxy_fcgi:error] [pid 53477:tid 53486] [client 31.171.130.76:55299] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:40:40.669227 2025] [:error] [pid 53477:tid 53504] [client 31.171.130.76:55299] [client 31.171.130.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aSE-yH7Lu30Ku9O40aJiawAAABc"]
[Sat Nov 22 12:40:44.894084 2025] [proxy_fcgi:error] [pid 53478:tid 53525] [client 31.171.130.54:40155] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:41:15.881387 2025] [:error] [pid 53478:tid 53519] [client 31.171.130.54:40155] [client 31.171.130.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/radio.php"] [unique_id "aSE-6whUYdXBbQswAdSefgAAAEo"]
[Sat Nov 22 12:41:41.690075 2025] [:error] [pid 53479:tid 53538] [client 31.171.130.57:55049] [client 31.171.130.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aSE_BW6cicFF3Aas-oQG4gAAAII"]
[Sat Nov 22 12:41:54.172306 2025] [:error] [pid 53477:tid 53494] [client 31.171.130.77:49155] [client 31.171.130.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSE_En7Lu30Ku9O40aJilQAAAA0"]
[Sat Nov 22 12:41:59.081400 2025] [:error] [pid 53479:tid 53541] [client 31.171.130.92:64707] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aSE_F26cicFF3Aas-oQG7gAAAIU"]
[Sat Nov 22 12:42:18.875950 2025] [:error] [pid 53566:tid 53582] [client 31.171.130.92:24151] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aSE_KsbSHDBkRbwMbd7S5wAAAM4"]
[Sat Nov 22 12:42:20.924675 2025] [:error] [pid 9547:tid 9567] [client 31.171.130.78:48725] [client 31.171.130.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSE_LNClOR5qk7DoMeE8_AAAAU4"]
[Sat Nov 22 12:42:28.636228 2025] [:error] [pid 53477:tid 53504] [client 31.171.130.73:50389] [client 31.171.130.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aSE_NH7Lu30Ku9O40aJipAAAABc"]
[Sat Nov 22 12:43:39.633122 2025] [proxy_fcgi:error] [pid 53479:tid 53538] [client 31.171.130.95:47713] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:43:44.227216 2025] [:error] [pid 53479:tid 53553] [client 31.171.130.95:47713] [client 31.171.130.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSE_gG6cicFF3Aas-oQHsgAAAJE"]
[Sat Nov 22 12:44:09.633211 2025] [:error] [pid 53477:tid 53503] [client 31.171.130.103:23651] [client 31.171.130.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "aSE_mX7Lu30Ku9O40aJi7AAAABY"]
[Sat Nov 22 12:44:43.814655 2025] [:error] [pid 25856:tid 25877] [client 31.171.130.58:31817] [client 31.171.130.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aSE_uxsTP0wy94zKUvFZQAAAARM"]
[Sat Nov 22 12:44:44.934471 2025] [:error] [pid 53478:tid 53521] [client 31.171.130.88:21665] [client 31.171.130.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aSE_vAhUYdXBbQswAdSfIwAAAEw"]
[Sat Nov 22 12:44:50.704814 2025] [:error] [pid 53566:tid 53588] [client 31.171.130.87:61675] [client 31.171.130.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aSE_wsbSHDBkRbwMbd7ThgAAANQ"]
[Sat Nov 22 12:44:54.725404 2025] [:error] [pid 53477:tid 53484] [client 31.171.130.65:24637] [client 31.171.130.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/repeater.php"] [unique_id "aSE_xn7Lu30Ku9O40aJjCAAAAAM"]
[Sat Nov 22 12:45:34.428351 2025] [:error] [pid 53566:tid 53579] [client 31.171.130.55:22763] [client 31.171.130.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aSE_7sbSHDBkRbwMbd7TwQAAAMs"]
[Sat Nov 22 12:45:35.415175 2025] [:error] [pid 53479:tid 53549] [client 31.171.130.63:53841] [client 31.171.130.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aSE_726cicFF3Aas-oQIQAAAAI0"]
[Sat Nov 22 12:45:39.212493 2025] [:error] [pid 25856:tid 25874] [client 31.171.130.79:31331] [client 31.171.130.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/options.php"] [unique_id "aSE_8xsTP0wy94zKUvFZlQAAARA"]
[Sat Nov 22 12:45:47.071671 2025] [:error] [pid 53478:tid 53515] [client 31.171.130.59:61589] [client 31.171.130.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aSE_-whUYdXBbQswAdSfcQAAAEY"]
[Sat Nov 22 12:45:49.409032 2025] [:error] [pid 53479:tid 53549] [client 31.171.130.82:60793] [client 31.171.130.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aSE__W6cicFF3Aas-oQISAAAAI0"]
[Sat Nov 22 12:45:55.871383 2025] [:error] [pid 25856:tid 25861] [client 31.171.130.77:24579] [client 31.171.130.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.77, incrementing brute counter"] [hostname "rejuva.au"] [uri "/images/wp-login.php"] [unique_id "aSFAAxsTP0wy94zKUvFZrQAAAQM"]
[Sat Nov 22 12:46:04.820311 2025] [:error] [pid 25856:tid 25874] [client 31.171.130.77:24579] [client 31.171.130.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aSFADBsTP0wy94zKUvFZtgAAARA"]
[Sat Nov 22 12:46:15.573684 2025] [:error] [pid 53477:tid 53493] [client 31.171.130.60:29777] [client 31.171.130.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aSFAF37Lu30Ku9O40aJjRQAAAAw"]
[Sat Nov 22 12:46:18.642724 2025] [:error] [pid 25856:tid 25867] [client 31.171.130.79:24121] [client 31.171.130.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aSFAGhsTP0wy94zKUvFZywAAAQk"]
[Sat Nov 22 12:46:20.920146 2025] [proxy_fcgi:error] [pid 53566:tid 53570] [client 31.171.130.81:53953] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 12:46:21.422762 2025] [:error] [pid 53566:tid 53574] [client 31.171.130.81:53953] [client 31.171.130.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.81, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aSFAHcbSHDBkRbwMbd7T6gAAAMY"]
[Sat Nov 22 12:46:27.185748 2025] [:error] [pid 53566:tid 53589] [client 31.171.130.81:53953] [client 31.171.130.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aSFAI8bSHDBkRbwMbd7T-gAAANU"]
[Sat Nov 22 12:46:37.781005 2025] [:error] [pid 53479:tid 53555] [client 31.171.130.92:31517] [client 31.171.130.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aSFALW6cicFF3Aas-oQIiAAAAJM"]
[Sat Nov 22 12:48:25.922110 2025] [:error] [pid 9547:tid 9575] [client 31.171.130.61:45757] [client 31.171.130.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.61, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSFAmdClOR5qk7DoMeE_UgAAAVY"]
[Sat Nov 22 12:48:36.292971 2025] [:error] [pid 9547:tid 9568] [client 31.171.130.61:45757] [client 31.171.130.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.61, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.tmb/wp-login.php"] [unique_id "aSFApNClOR5qk7DoMeE_YQAAAU8"]
[Sat Nov 22 12:48:43.903072 2025] [:error] [pid 9547:tid 9569] [client 31.171.130.61:45757] [client 31.171.130.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aSFAq9ClOR5qk7DoMeE_bgAAAVA"]
[Sat Nov 22 12:48:44.960409 2025] [:error] [pid 53477:tid 53494] [client 31.171.130.93:48527] [client 31.171.130.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aSFArH7Lu30Ku9O40aJj0QAAAA0"]
[Sat Nov 22 12:48:48.814610 2025] [:error] [pid 25856:tid 25866] [client 31.171.130.95:40193] [client 31.171.130.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aSFAsBsTP0wy94zKUvFaWAAAAQg"]
[Sat Nov 22 12:49:16.080633 2025] [:error] [pid 53566:tid 53570] [client 31.171.130.73:20317] [client 31.171.130.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.73, incrementing brute counter"] [hostname "rejuva.au"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aSFAzMbSHDBkRbwMbd7UgwAAAMI"]
[Sat Nov 22 12:49:18.017379 2025] [:error] [pid 53566:tid 53582] [client 31.171.130.73:20317] [client 31.171.130.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSFAzsbSHDBkRbwMbd7UiQAAAM4"]
[Sat Nov 22 12:49:23.721390 2025] [:error] [pid 53478:tid 53514] [client 31.171.130.94:42897] [client 31.171.130.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.94, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSFA0whUYdXBbQswAdSgfQAAAEU"]
[Sat Nov 22 12:49:58.490131 2025] [:error] [pid 53478:tid 53510] [client 31.171.130.94:42897] [client 31.171.130.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aSFA9ghUYdXBbQswAdSgmwAAAEE"]
[Sat Nov 22 12:50:21.576651 2025] [:error] [pid 53478:tid 53530] [client 31.171.130.72:24401] [client 31.171.130.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSFBDQhUYdXBbQswAdSgrwAAAFU"]
[Sat Nov 22 12:50:52.584608 2025] [:error] [pid 9547:tid 9563] [client 31.171.130.68:34751] [client 31.171.130.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.68, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSFBLNClOR5qk7DoMeFAEgAAAUo"]
[Sat Nov 22 12:51:21.288021 2025] [autoindex:error] [pid 9547:tid 9554] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:22.319630 2025] [autoindex:error] [pid 9547:tid 9555] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:22.804392 2025] [autoindex:error] [pid 9547:tid 9561] [client 31.171.130.68:34751] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:32.517709 2025] [autoindex:error] [pid 9547:tid 9561] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:35.688958 2025] [autoindex:error] [pid 9547:tid 9570] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:36.135899 2025] [autoindex:error] [pid 9547:tid 9553] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:36.606379 2025] [autoindex:error] [pid 9547:tid 9562] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:37.138425 2025] [autoindex:error] [pid 9547:tid 9574] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:37.610767 2025] [autoindex:error] [pid 9547:tid 9567] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:38.622662 2025] [autoindex:error] [pid 9547:tid 9569] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:39.124197 2025] [autoindex:error] [pid 9547:tid 9568] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:39.618073 2025] [autoindex:error] [pid 9547:tid 9559] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:40.109918 2025] [autoindex:error] [pid 9547:tid 9563] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:48.771992 2025] [autoindex:error] [pid 9547:tid 9562] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2021/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:51:49.707506 2025] [autoindex:error] [pid 9547:tid 9574] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:02.949723 2025] [autoindex:error] [pid 9547:tid 9569] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:03.447471 2025] [autoindex:error] [pid 9547:tid 9557] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:03.948017 2025] [autoindex:error] [pid 9547:tid 9567] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:04.456682 2025] [autoindex:error] [pid 9547:tid 9556] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:04.920893 2025] [autoindex:error] [pid 9547:tid 9575] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:05.403950 2025] [autoindex:error] [pid 9547:tid 9566] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:05.914017 2025] [autoindex:error] [pid 9547:tid 9572] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:06.402442 2025] [autoindex:error] [pid 9547:tid 9562] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/languages/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:06.939003 2025] [autoindex:error] [pid 9547:tid 9560] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2022/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:07.427914 2025] [autoindex:error] [pid 9547:tid 9576] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:08.436068 2025] [autoindex:error] [pid 9547:tid 9561] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:12.420597 2025] [autoindex:error] [pid 9547:tid 9565] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:16.093617 2025] [autoindex:error] [pid 9547:tid 9563] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:16.600459 2025] [autoindex:error] [pid 9547:tid 9571] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:17.086617 2025] [autoindex:error] [pid 9547:tid 9574] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:20.974612 2025] [autoindex:error] [pid 9547:tid 9557] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:21.474133 2025] [autoindex:error] [pid 9547:tid 9555] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:21.989886 2025] [autoindex:error] [pid 9547:tid 9567] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:22.492416 2025] [autoindex:error] [pid 9547:tid 9559] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:53:22.979849 2025] [autoindex:error] [pid 9547:tid 9577] [client 31.171.130.68:34751] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:54:32.275451 2025] [autoindex:error] [pid 53477:tid 53501] [client 31.171.130.71:47503] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:07.203408 2025] [autoindex:error] [pid 53566:tid 53575] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:17.147602 2025] [autoindex:error] [pid 53566:tid 53587] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:17.644412 2025] [autoindex:error] [pid 53566:tid 53573] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:25.180963 2025] [autoindex:error] [pid 53566:tid 53574] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:25.671039 2025] [autoindex:error] [pid 53566:tid 53580] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:26.143784 2025] [autoindex:error] [pid 53566:tid 53579] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:26.624107 2025] [autoindex:error] [pid 53566:tid 53582] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:27.137815 2025] [autoindex:error] [pid 53566:tid 53592] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:27.698508 2025] [autoindex:error] [pid 53566:tid 53583] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:28.219012 2025] [autoindex:error] [pid 53566:tid 53581] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:28.745749 2025] [autoindex:error] [pid 53566:tid 53587] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:29.283226 2025] [autoindex:error] [pid 53566:tid 53573] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:29.803094 2025] [autoindex:error] [pid 53566:tid 53584] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:55:51.813728 2025] [autoindex:error] [pid 53566:tid 53584] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:56:22.121884 2025] [autoindex:error] [pid 53566:tid 53570] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:56:22.614108 2025] [autoindex:error] [pid 53566:tid 53571] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:56:29.108753 2025] [autoindex:error] [pid 53566:tid 53580] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/maintenance/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:09.222595 2025] [autoindex:error] [pid 53566:tid 53585] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:16.127120 2025] [autoindex:error] [pid 53566:tid 53592] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:26.476923 2025] [autoindex:error] [pid 53566:tid 53576] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:29.928293 2025] [autoindex:error] [pid 53566:tid 53572] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:35.894854 2025] [autoindex:error] [pid 53566:tid 53583] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:38.715652 2025] [autoindex:error] [pid 53566:tid 53585] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:39.198130 2025] [autoindex:error] [pid 53566:tid 53570] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:43.274328 2025] [autoindex:error] [pid 53566:tid 53582] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:46.483804 2025] [autoindex:error] [pid 53566:tid 53577] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:50.387147 2025] [autoindex:error] [pid 53566:tid 53583] [client 31.171.130.94:63079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:57:53.735508 2025] [proxy_fcgi:error] [pid 53566:tid 53591] [client 31.171.130.94:63079] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/rejuvanet/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/rejuvanet/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Sat Nov 22 12:58:00.358419 2025] [autoindex:error] [pid 9547:tid 9562] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:58:05.738862 2025] [autoindex:error] [pid 9547:tid 9556] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/plugins/elementor/modules/floating-buttons/classes/render/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:58:13.977481 2025] [autoindex:error] [pid 9547:tid 9565] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:58:14.513425 2025] [autoindex:error] [pid 9547:tid 9555] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/plugins/elementor/assets/js/packages/editor-app-bar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:58:26.883732 2025] [autoindex:error] [pid 9547:tid 9574] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:58:29.926174 2025] [autoindex:error] [pid 9547:tid 9556] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:58:30.398987 2025] [autoindex:error] [pid 9547:tid 9573] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 12:59:54.603605 2025] [autoindex:error] [pid 9547:tid 9554] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 13:00:01.487891 2025] [autoindex:error] [pid 9547:tid 9557] [client 31.171.130.83:35029] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 13:00:53.598907 2025] [autoindex:error] [pid 53566:tid 53587] [client 31.171.130.93:62079] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 14:23:16.180706 2025] [:error] [pid 9547:tid 9558] [client 221.229.106.25:35664] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSFW1NClOR5qk7DoMeFe2wAAAUU"]
[Sat Nov 22 16:27:11.015360 2025] [:error] [pid 25856:tid 25863] [client 206.189.95.232:49704] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/api-docs"] [unique_id "aSFz3xsTP0wy94zKUvGR-gAAAQU"]
[Sat Nov 22 16:27:11.392438 2025] [:error] [pid 53479:tid 53543] [client 206.189.95.232:49714] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/@vite/env"] [unique_id "aSFz326cicFF3Aas-oRgIwAAAIc"]
[Sat Nov 22 16:27:11.655380 2025] [:error] [pid 53477:tid 53497] [client 206.189.95.232:34874] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aSFz337Lu30Ku9O40aKUUAAAABA"]
[Sat Nov 22 16:27:11.919321 2025] [:error] [pid 53477:tid 53501] [client 206.189.95.232:34882] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSFz337Lu30Ku9O40aKUUgAAABQ"]
[Sat Nov 22 16:27:12.182458 2025] [:error] [pid 53479:tid 53538] [client 206.189.95.232:34888] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aSFz4G6cicFF3Aas-oRgKQAAAII"]
[Sat Nov 22 16:27:12.446464 2025] [:error] [pid 53479:tid 53536] [client 206.189.95.232:34890] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aSFz4G6cicFF3Aas-oRgKwAAAIA"]
[Sat Nov 22 16:27:12.710517 2025] [:error] [pid 53477:tid 53489] [client 206.189.95.232:34902] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aSFz4H7Lu30Ku9O40aKUVAAAAAg"]
[Sat Nov 22 16:27:12.975828 2025] [:error] [pid 53479:tid 53550] [client 206.189.95.232:34904] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aSFz4G6cicFF3Aas-oRgLgAAAI4"]
[Sat Nov 22 16:27:13.238975 2025] [:error] [pid 53479:tid 53542] [client 206.189.95.232:34916] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aSFz4W6cicFF3Aas-oRgMQAAAIY"]
[Sat Nov 22 16:27:13.501907 2025] [:error] [pid 53479:tid 53560] [client 206.189.95.232:34924] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSFz4W6cicFF3Aas-oRgMgAAAJg"]
[Sat Nov 22 16:27:13.773900 2025] [:error] [pid 53479:tid 53549] [client 206.189.95.232:34930] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aSFz4W6cicFF3Aas-oRgMwAAAI0"]
[Sat Nov 22 16:27:14.036212 2025] [:error] [pid 53479:tid 53552] [client 206.189.95.232:34932] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aSFz4m6cicFF3Aas-oRgOAAAAJA"]
[Sat Nov 22 16:27:14.299413 2025] [:error] [pid 25856:tid 25881] [client 206.189.95.232:34942] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_all_dbs"] [unique_id "aSFz4hsTP0wy94zKUvGR_wAAARc"]
[Sat Nov 22 16:27:14.563117 2025] [:error] [pid 25856:tid 25858] [client 206.189.95.232:34954] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aSFz4hsTP0wy94zKUvGSAAAAAQA"]
[Sat Nov 22 16:27:14.825999 2025] [:error] [pid 25856:tid 25861] [client 206.189.95.232:34964] [client 206.189.95.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aSFz4hsTP0wy94zKUvGSAgAAAQM"]
[Sat Nov 22 16:27:15.087432 2025] [:error] [pid 25856:tid 25875] [client 206.189.95.232:34976] [client 206.189.95.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSFz4xsTP0wy94zKUvGSAwAAARE"]
[Sat Nov 22 16:27:15.350772 2025] [:error] [pid 53478:tid 53512] [client 206.189.95.232:34980] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSFz4whUYdXBbQswAdTTRwAAAEM"]
[Sat Nov 22 16:27:15.612904 2025] [:error] [pid 53566:tid 53584] [client 206.189.95.232:34996] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aSFz48bSHDBkRbwMbd4HpgAAANA"]
[Sat Nov 22 16:27:15.877848 2025] [:error] [pid 25856:tid 25882] [client 206.189.95.232:35002] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aSFz4xsTP0wy94zKUvGSBgAAARg"]
[Sat Nov 22 16:27:16.140923 2025] [:error] [pid 53478:tid 53514] [client 206.189.95.232:35016] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aSFz5AhUYdXBbQswAdTTSQAAAEU"]
[Sat Nov 22 16:27:16.404009 2025] [:error] [pid 25856:tid 25880] [client 206.189.95.232:35032] [client 206.189.95.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSFz5BsTP0wy94zKUvGSBwAAARY"]
[Sat Nov 22 20:54:30.535751 2025] [:error] [pid 53478:tid 53530] [client 58.49.233.126:38558] [client 58.49.233.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSGyhghUYdXBbQswAdQgOQAAAFU"]
[Sat Nov 22 23:03:55.117501 2025] [:error] [pid 53566:tid 53590] [client 159.203.89.146:46086] [client 159.203.89.146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSHQ28bSHDBkRbwMbd53ewAAANY"]
[Sun Nov 23 01:42:03.292384 2025] [:error] [pid 39718:tid 39753] [client 159.203.89.146:49840] [client 159.203.89.146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSH16wQ3B_uDoeItNmNtawAAAEQ"]
[Sun Nov 23 03:29:35.027780 2025] [:error] [pid 39719:tid 39793] [client 222.79.104.23:46651] [client 222.79.104.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSIPHxmP4k0tY5Yex-X1TQAAARE"]
[Sun Nov 23 05:47:14.130103 2025] [:error] [pid 38739:tid 38784] [client 216.126.225.91:37794] [client 216.126.225.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSIvYgdvEgJm2n2cDmoFOwAAAE8"]
[Sun Nov 23 08:09:33.781504 2025] [:error] [pid 38824:tid 38836] [client 43.166.246.180:60780] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSJQvU8WZjXLvbHTHPf9TwAAAMk"]
[Sun Nov 23 09:41:13.181730 2025] [:error] [pid 38739:tid 38777] [client 113.141.91.58:58591] [client 113.141.91.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSJmOQdvEgJm2n2cDmp5QQAAAEg"]
[Sun Nov 23 10:03:03.276871 2025] [:error] [pid 38738:tid 38757] [client 43.130.60.195:40522] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSJrVwytc6TL9XavPmMz4gAAAA8"]
[Sun Nov 23 11:07:56.636598 2025] [:error] [pid 38824:tid 38828] [client 172.71.247.35:9450] [client 172.71.247.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSJ6jE8WZjXLvbHTHPcyeQAAAME"]
[Sun Nov 23 16:08:25.354022 2025] [:error] [pid 38824:tid 38843] [client 180.102.134.69:33292] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSLA-U8WZjXLvbHTHPeAFgAAANA"]
[Sun Nov 23 16:47:14.769072 2025] [autoindex:error] [pid 38824:tid 38844] [client 140.99.1.13:40519] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:14.903358 2025] [autoindex:error] [pid 38824:tid 38830] [client 140.99.1.13:40519] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:15.073489 2025] [autoindex:error] [pid 38824:tid 38833] [client 140.99.1.13:40519] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:15.167817 2025] [autoindex:error] [pid 38824:tid 38846] [client 140.99.1.13:40519] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 17:28:35.951177 2025] [:error] [pid 14602:tid 14629] [client 176.65.132.18:33198] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSLTwx-I77jdD81pU-nHhwAAAUg"]
[Sun Nov 23 22:48:11.096971 2025] [:error] [pid 17534:tid 17550] [client 180.102.134.69:55935] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSMeq3PX9nXBrhgM8syk8gAAAc4"]
[Mon Nov 24 01:24:11.999673 2025] [:error] [pid 1452:tid 1479] [client 170.106.187.106:33692] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSNDOxKZkEEyVNVXr_nFQwAAAFY"]
[Mon Nov 24 01:45:54.937186 2025] [:error] [pid 1454:tid 1513] [client 176.65.132.18:48556] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSNIUreh4NH3skJ5n4R7FAAAAME"]
[Mon Nov 24 05:07:57.597333 2025] [:error] [pid 12911:tid 12960] [client 121.229.185.160:57464] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSN3rUDMbk9464jnIl7gWAAAAFI"]
[Mon Nov 24 05:33:35.050094 2025] [:error] [pid 12911:tid 12961] [client 172.70.250.192:10746] [client 172.70.250.192] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSN9r0DMbk9464jnIl7oAAAAAFM"]
[Mon Nov 24 08:21:51.603702 2025] [:error] [pid 49900:tid 49922] [client 103.65.237.124:54057] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "aSOlHzCyPLrvg06aorlmlQAAABQ"]
[Mon Nov 24 08:21:51.843686 2025] [:error] [pid 48600:tid 48636] [client 103.65.237.124:63524] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aSOlH_tOzSUAQvWVjBcK-AAAAcY"]
[Mon Nov 24 10:18:31.492093 2025] [:error] [pid 48601:tid 48664] [client 181.215.65.65:56609] [client 181.215.65.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSPAd4MM4MaVTk74-AZgjQAAAgc"]
[Mon Nov 24 10:18:37.272982 2025] [:error] [pid 16593:tid 16607] [client 85.237.194.72:43575] [client 85.237.194.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSPAfRVGznHBJI2LKpQANgAAAow"]
[Mon Nov 24 10:18:59.973954 2025] [:error] [pid 16441:tid 16459] [client 85.237.194.56:57145] [client 85.237.194.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSPAk4q_bc5MOa9HflmfhgAAAI8"]
[Mon Nov 24 10:19:16.175194 2025] [:error] [pid 16441:tid 16459] [client 85.237.194.105:63005] [client 85.237.194.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSPApIq_bc5MOa9HflmfogAAAI8"]
[Mon Nov 24 10:19:17.560836 2025] [:error] [pid 16593:tid 16610] [client 85.237.194.86:20315] [client 85.237.194.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSPApRVGznHBJI2LKpQAbAAAAo8"]
[Mon Nov 24 10:19:18.969617 2025] [:error] [pid 16593:tid 16612] [client 181.215.65.74:24203] [client 181.215.65.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSPAphVGznHBJI2LKpQAbwAAApE"]
[Mon Nov 24 10:19:24.275003 2025] [:error] [pid 16593:tid 16610] [client 104.234.32.4:34391] [client 104.234.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSPArBVGznHBJI2LKpQAeQAAAo8"]
[Mon Nov 24 10:19:29.677071 2025] [:error] [pid 49900:tid 49916] [client 104.234.32.2:47825] [client 104.234.32.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSPAsTCyPLrvg06aormwJQAAAA4"]
[Mon Nov 24 10:19:48.615242 2025] [:error] [pid 16593:tid 16605] [client 85.237.194.134:45539] [client 85.237.194.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSPAxBVGznHBJI2LKpQAoAAAAoo"]
[Mon Nov 24 10:19:52.859749 2025] [:error] [pid 9630:tid 9633] [client 85.237.194.145:24035] [client 85.237.194.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSPAyCrSgUgPGkizt2p_aAAAAEE"]
[Mon Nov 24 10:22:55.567790 2025] [:error] [pid 16441:tid 16448] [client 181.215.65.77:41601] [client 181.215.65.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 181.215.65.77, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aSPBf4q_bc5MOa9HflmhvwAAAIQ"]
[Mon Nov 24 10:23:18.357663 2025] [:error] [pid 48601:tid 48675] [client 181.215.65.65:45643] [client 181.215.65.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aSPBloMM4MaVTk74-AZiEgAAAhI"]
[Mon Nov 24 10:23:47.084126 2025] [autoindex:error] [pid 16441:tid 16458] [client 85.237.194.60:31559] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:23:47.713321 2025] [autoindex:error] [pid 16441:tid 16461] [client 85.237.194.60:31559] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/pki-validation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:23:48.395213 2025] [autoindex:error] [pid 16441:tid 16465] [client 85.237.194.60:31559] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:08.696515 2025] [autoindex:error] [pid 9630:tid 9656] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:12.399001 2025] [autoindex:error] [pid 9630:tid 9641] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:13.171189 2025] [autoindex:error] [pid 9630:tid 9654] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:13.867650 2025] [autoindex:error] [pid 9630:tid 9652] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:14.578942 2025] [autoindex:error] [pid 9630:tid 9649] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:16.175130 2025] [autoindex:error] [pid 9630:tid 9647] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:17.595612 2025] [autoindex:error] [pid 9630:tid 9643] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:18.283824 2025] [autoindex:error] [pid 9630:tid 9638] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:18.898900 2025] [autoindex:error] [pid 9630:tid 9642] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:24:19.590100 2025] [autoindex:error] [pid 9630:tid 9632] [client 181.215.65.74:41261] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 10:55:07.632774 2025] [:error] [pid 16549:tid 16573] [client 43.163.206.70:52530] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSPJC6eWW19A99PUw_cB8wAAAVQ"]
[Mon Nov 24 13:49:01.100104 2025] [autoindex:error] [pid 9630:tid 9651] [client 4.211.111.86:40931] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 13:49:04.247184 2025] [proxy_fcgi:error] [pid 9630:tid 9638] [client 4.211.111.86:40931] AH01071: Got error 'Primary script unknown'
[Mon Nov 24 13:49:07.693662 2025] [:error] [pid 9630:tid 9655] [client 4.211.111.86:40931] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/cs.php"] [unique_id "aSPx0yrSgUgPGkizt2q5_AAAAFc"]
[Mon Nov 24 13:49:11.621541 2025] [:error] [pid 16441:tid 16444] [client 4.211.111.86:40920] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aSPx14q_bc5MOa9HflnrewAAAIA"]
[Mon Nov 24 13:49:12.097946 2025] [:error] [pid 49900:tid 49902] [client 4.211.111.86:40833] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aSPx2DCyPLrvg06aornf5QAAAAA"]
[Mon Nov 24 13:49:12.581681 2025] [:error] [pid 49900:tid 49919] [client 4.211.111.86:40914] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aSPx2DCyPLrvg06aornf5gAAABE"]
[Mon Nov 24 13:49:13.064218 2025] [:error] [pid 16441:tid 16447] [client 4.211.111.86:40917] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aSPx2Yq_bc5MOa9HflnrfQAAAIM"]
[Mon Nov 24 13:49:13.536704 2025] [:error] [pid 49900:tid 49905] [client 4.211.111.86:40951] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aSPx2TCyPLrvg06aornf6QAAAAM"]
[Mon Nov 24 13:49:14.013023 2025] [:error] [pid 49900:tid 49909] [client 4.211.111.86:40849] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aSPx2jCyPLrvg06aornf6wAAAAc"]
[Mon Nov 24 13:49:14.486266 2025] [:error] [pid 48688:tid 48708] [client 4.211.111.86:40943] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aSPx2hm2q1FkzLam7A14ZQAAAlA"]
[Mon Nov 24 13:49:14.969162 2025] [:error] [pid 16549:tid 16577] [client 4.211.111.86:40897] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aSPx2qeWW19A99PUw_cbAQAAAVg"]
[Mon Nov 24 13:49:15.443962 2025] [:error] [pid 48601:tid 48660] [client 4.211.111.86:40935] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aSPx24MM4MaVTk74-AaKeQAAAgM"]
[Mon Nov 24 13:49:15.921055 2025] [:error] [pid 16441:tid 16453] [client 4.211.111.86:40898] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aSPx24q_bc5MOa9HflnrgAAAAIk"]
[Mon Nov 24 13:49:16.413663 2025] [:error] [pid 16441:tid 16455] [client 4.211.111.86:40845] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aSPx3Iq_bc5MOa9HflnrgQAAAIs"]
[Mon Nov 24 13:49:16.895303 2025] [:error] [pid 48601:tid 48661] [client 4.211.111.86:40907] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aSPx3IMM4MaVTk74-AaKegAAAgQ"]
[Mon Nov 24 13:49:17.370124 2025] [:error] [pid 49900:tid 49925] [client 4.211.111.86:40842] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aSPx3TCyPLrvg06aornf7AAAABc"]
[Mon Nov 24 13:49:17.873715 2025] [:error] [pid 9630:tid 9644] [client 4.211.111.86:40945] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aSPx3SrSgUgPGkizt2q6EwAAAEw"]
[Mon Nov 24 13:49:18.346967 2025] [:error] [pid 16441:tid 16446] [client 4.211.111.86:40952] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aSPx3oq_bc5MOa9HflnrhAAAAII"]
[Mon Nov 24 13:49:18.819855 2025] [:error] [pid 48599:tid 48613] [client 4.211.111.86:40958] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aSPx3pzvu6PDJiRKE3IBMwAAAYo"]
[Mon Nov 24 13:49:19.294565 2025] [:error] [pid 48599:tid 48616] [client 4.211.111.86:40939] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aSPx35zvu6PDJiRKE3IBNQAAAY0"]
[Mon Nov 24 13:49:19.780691 2025] [:error] [pid 16549:tid 16571] [client 4.211.111.86:40850] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aSPx36eWW19A99PUw_cbAgAAAVI"]
[Mon Nov 24 13:49:20.261702 2025] [:error] [pid 16516:tid 16541] [client 4.211.111.86:40944] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aSPx4PqZbniwaNwL8XnHuQAAARY"]
[Mon Nov 24 13:49:20.735185 2025] [:error] [pid 9630:tid 9646] [client 4.211.111.86:40959] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aSPx4CrSgUgPGkizt2q6GQAAAE4"]
[Mon Nov 24 13:49:21.209200 2025] [:error] [pid 9630:tid 9632] [client 4.211.111.86:40924] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cok.php"] [unique_id "aSPx4SrSgUgPGkizt2q6GwAAAEA"]
[Mon Nov 24 13:49:21.684628 2025] [:error] [pid 16516:tid 16530] [client 4.211.111.86:40836] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cok.php"] [unique_id "aSPx4fqZbniwaNwL8XnHugAAAQs"]
[Mon Nov 24 13:49:22.157087 2025] [:error] [pid 9630:tid 9633] [client 4.211.111.86:40948] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cok.php"] [unique_id "aSPx4irSgUgPGkizt2q6HgAAAEE"]
[Mon Nov 24 13:49:22.629292 2025] [:error] [pid 16441:tid 16453] [client 4.211.111.86:40839] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cok.php"] [unique_id "aSPx4oq_bc5MOa9HflnrjwAAAIk"]
[Mon Nov 24 13:49:23.121895 2025] [:error] [pid 48600:tid 48654] [client 4.211.111.86:40902] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hob.php"] [unique_id "aSPx4_tOzSUAQvWVjBddMwAAAdg"]
[Mon Nov 24 13:49:23.599049 2025] [:error] [pid 48600:tid 48649] [client 4.211.111.86:40928] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hob.php"] [unique_id "aSPx4_tOzSUAQvWVjBddNQAAAdM"]
[Mon Nov 24 13:49:24.083510 2025] [:error] [pid 16441:tid 16455] [client 4.211.111.86:40933] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hob.php"] [unique_id "aSPx5Iq_bc5MOa9HflnrkgAAAIs"]
[Mon Nov 24 13:49:24.557332 2025] [:error] [pid 9630:tid 9639] [client 4.211.111.86:40881] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hob.php"] [unique_id "aSPx5CrSgUgPGkizt2q6JAAAAEc"]
[Mon Nov 24 13:49:25.032721 2025] [:error] [pid 48599:tid 48605] [client 4.211.111.86:40847] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aSPx5Zzvu6PDJiRKE3IBRQAAAYI"]
[Mon Nov 24 13:49:25.507214 2025] [:error] [pid 16516:tid 16520] [client 4.211.111.86:40854] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aSPx5fqZbniwaNwL8XnHuwAAAQE"]
[Mon Nov 24 13:49:25.982355 2025] [:error] [pid 48688:tid 48709] [client 4.211.111.86:40911] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aSPx5Rm2q1FkzLam7A14aAAAAlE"]
[Mon Nov 24 13:49:26.475539 2025] [:error] [pid 9630:tid 9635] [client 4.211.111.86:40947] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aSPx5irSgUgPGkizt2q6KwAAAEM"]
[Mon Nov 24 13:49:26.951477 2025] [:error] [pid 16441:tid 16454] [client 4.211.111.86:40780] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aSPx5oq_bc5MOa9HflnrlQAAAIo"]
[Mon Nov 24 13:49:27.444119 2025] [:error] [pid 16441:tid 16460] [client 4.211.111.86:40950] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aSPx54q_bc5MOa9HflnrlwAAAJA"]
[Mon Nov 24 13:49:27.928091 2025] [:error] [pid 48601:tid 48658] [client 4.211.111.86:40851] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aSPx54MM4MaVTk74-AaKggAAAgE"]
[Mon Nov 24 13:49:28.409858 2025] [:error] [pid 48599:tid 48617] [client 4.211.111.86:40834] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aSPx6Jzvu6PDJiRKE3IBRwAAAY4"]
[Mon Nov 24 13:49:28.889142 2025] [:error] [pid 9630:tid 9632] [client 4.211.111.86:40949] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aSPx6CrSgUgPGkizt2q6MAAAAEA"]
[Mon Nov 24 13:49:29.362172 2025] [:error] [pid 16441:tid 16465] [client 4.211.111.86:40848] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aSPx6Yq_bc5MOa9HflnrmwAAAJU"]
[Mon Nov 24 13:49:29.836746 2025] [:error] [pid 48601:tid 48675] [client 4.211.111.86:40955] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aSPx6YMM4MaVTk74-AaKhAAAAhI"]
[Mon Nov 24 13:49:30.311481 2025] [:error] [pid 48601:tid 48669] [client 4.211.111.86:40837] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aSPx6oMM4MaVTk74-AaKhQAAAgw"]
[Mon Nov 24 13:49:30.799805 2025] [:error] [pid 48599:tid 48606] [client 4.211.111.86:40871] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aSPx6pzvu6PDJiRKE3IBSQAAAYM"]
[Mon Nov 24 13:49:31.273239 2025] [:error] [pid 48600:tid 48650] [client 4.211.111.86:40832] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aSPx6_tOzSUAQvWVjBddNgAAAdQ"]
[Mon Nov 24 13:49:31.751751 2025] [:error] [pid 48599:tid 48620] [client 4.211.111.86:40956] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aSPx65zvu6PDJiRKE3IBSwAAAZE"]
[Mon Nov 24 13:49:32.248636 2025] [:error] [pid 16549:tid 16560] [client 4.211.111.86:40874] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aSPx7KeWW19A99PUw_cbBQAAAUg"]
[Mon Nov 24 13:49:32.725767 2025] [:error] [pid 9630:tid 9637] [client 4.211.111.86:40868] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lx.php"] [unique_id "aSPx7CrSgUgPGkizt2q6OAAAAEU"]
[Mon Nov 24 13:49:33.202663 2025] [:error] [pid 48601:tid 48680] [client 4.211.111.86:40941] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lx.php"] [unique_id "aSPx7YMM4MaVTk74-AaKhgAAAhc"]
[Mon Nov 24 13:49:33.694309 2025] [:error] [pid 16549:tid 16576] [client 4.211.111.86:40954] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lx.php"] [unique_id "aSPx7aeWW19A99PUw_cbBwAAAVc"]
[Mon Nov 24 13:49:34.175171 2025] [:error] [pid 49900:tid 49919] [client 4.211.111.86:40937] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lx.php"] [unique_id "aSPx7jCyPLrvg06aornf9gAAABE"]
[Mon Nov 24 13:49:34.647749 2025] [:error] [pid 48599:tid 48621] [client 4.211.111.86:40927] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1w.php"] [unique_id "aSPx7pzvu6PDJiRKE3IBTAAAAZI"]
[Mon Nov 24 13:49:35.120771 2025] [:error] [pid 16593:tid 16598] [client 4.211.111.86:40838] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1w.php"] [unique_id "aSPx7xVGznHBJI2LKpQdxgAAAoM"]
[Mon Nov 24 13:49:35.614136 2025] [:error] [pid 48600:tid 48640] [client 4.211.111.86:40940] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1w.php"] [unique_id "aSPx7_tOzSUAQvWVjBddQQAAAco"]
[Mon Nov 24 13:49:36.090508 2025] [:error] [pid 48688:tid 48696] [client 4.211.111.86:40923] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1w.php"] [unique_id "aSPx8Bm2q1FkzLam7A14bAAAAkQ"]
[Mon Nov 24 13:49:36.577827 2025] [:error] [pid 48601:tid 48662] [client 4.211.111.86:40863] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cafe.php"] [unique_id "aSPx8IMM4MaVTk74-AaKhwAAAgU"]
[Mon Nov 24 13:49:37.057818 2025] [:error] [pid 16593:tid 16609] [client 4.211.111.86:40795] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cafe.php"] [unique_id "aSPx8RVGznHBJI2LKpQdyAAAAo4"]
[Mon Nov 24 13:49:37.531397 2025] [:error] [pid 48599:tid 48615] [client 4.211.111.86:40840] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cafe.php"] [unique_id "aSPx8Zzvu6PDJiRKE3IBTQAAAYw"]
[Mon Nov 24 13:49:38.004430 2025] [:error] [pid 48600:tid 48646] [client 4.211.111.86:40853] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cafe.php"] [unique_id "aSPx8vtOzSUAQvWVjBddQwAAAdA"]
[Mon Nov 24 13:49:38.476838 2025] [:error] [pid 49900:tid 49924] [client 4.211.111.86:40777] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww2.php"] [unique_id "aSPx8jCyPLrvg06aornf-QAAABY"]
[Mon Nov 24 13:49:38.948810 2025] [:error] [pid 9630:tid 9653] [client 4.211.111.86:40930] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww2.php"] [unique_id "aSPx8irSgUgPGkizt2q6RgAAAFU"]
[Mon Nov 24 13:49:39.425564 2025] [:error] [pid 16516:tid 16533] [client 4.211.111.86:40843] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww2.php"] [unique_id "aSPx8_qZbniwaNwL8XnHvgAAAQ4"]
[Mon Nov 24 13:49:39.906635 2025] [:error] [pid 49900:tid 49925] [client 4.211.111.86:40929] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww2.php"] [unique_id "aSPx8zCyPLrvg06aornf-gAAABc"]
[Mon Nov 24 13:49:40.379528 2025] [:error] [pid 16441:tid 16450] [client 4.211.111.86:40796] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSPx9Iq_bc5MOa9HflnrpgAAAIY"]
[Mon Nov 24 13:49:40.863595 2025] [:error] [pid 9630:tid 9637] [client 4.211.111.86:40883] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSPx9CrSgUgPGkizt2q6YAAAAEU"]
[Mon Nov 24 13:49:41.348246 2025] [:error] [pid 16441:tid 16446] [client 4.211.111.86:40887] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSPx9Yq_bc5MOa9HflnrqgAAAII"]
[Mon Nov 24 13:49:41.819471 2025] [:error] [pid 16516:tid 16539] [client 4.211.111.86:40858] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSPx9fqZbniwaNwL8XnHyAAAARQ"]
[Mon Nov 24 13:49:42.298707 2025] [:error] [pid 49900:tid 49916] [client 4.211.111.86:40852] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww4.php"] [unique_id "aSPx9jCyPLrvg06aornf-wAAAA4"]
[Mon Nov 24 13:49:42.786422 2025] [:error] [pid 9630:tid 9632] [client 4.211.111.86:40808] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww4.php"] [unique_id "aSPx9irSgUgPGkizt2q6bAAAAEA"]
[Mon Nov 24 13:49:43.271797 2025] [:error] [pid 16549:tid 16565] [client 4.211.111.86:40846] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww4.php"] [unique_id "aSPx96eWW19A99PUw_cbFgAAAU0"]
[Mon Nov 24 13:49:43.765649 2025] [:error] [pid 16516:tid 16542] [client 4.211.111.86:40801] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww4.php"] [unique_id "aSPx9_qZbniwaNwL8XnHygAAARc"]
[Mon Nov 24 13:49:44.242108 2025] [:error] [pid 48688:tid 48706] [client 4.211.111.86:40870] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aSPx-Bm2q1FkzLam7A14eAAAAk4"]
[Mon Nov 24 13:49:44.727406 2025] [:error] [pid 16516:tid 16531] [client 4.211.111.86:40919] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aSPx-PqZbniwaNwL8XnHzAAAAQw"]
[Mon Nov 24 13:49:45.199781 2025] [:error] [pid 9630:tid 9654] [client 4.211.111.86:40942] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aSPx-SrSgUgPGkizt2q6cgAAAFY"]
[Mon Nov 24 13:49:45.673644 2025] [:error] [pid 16516:tid 16533] [client 4.211.111.86:40886] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aSPx-fqZbniwaNwL8XnHzwAAAQ4"]
[Mon Nov 24 13:49:46.160006 2025] [:error] [pid 16441:tid 16445] [client 4.211.111.86:40884] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aSPx-oq_bc5MOa9HflnrrAAAAIE"]
[Mon Nov 24 13:49:46.636366 2025] [:error] [pid 16441:tid 16464] [client 4.211.111.86:40792] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aSPx-oq_bc5MOa9HflnrrgAAAJQ"]
[Mon Nov 24 13:49:47.113351 2025] [:error] [pid 16549:tid 16572] [client 4.211.111.86:40915] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aSPx-6eWW19A99PUw_cbGAAAAVM"]
[Mon Nov 24 13:49:47.651421 2025] [:error] [pid 48688:tid 48712] [client 4.211.111.86:40856] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aSPx-xm2q1FkzLam7A14egAAAlQ"]
[Mon Nov 24 13:49:48.147380 2025] [:error] [pid 9630:tid 9643] [client 4.211.111.86:40900] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aSPx_CrSgUgPGkizt2q6dgAAAEs"]
[Mon Nov 24 13:49:48.631740 2025] [:error] [pid 9630:tid 9648] [client 4.211.111.86:40912] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aSPx_CrSgUgPGkizt2q6egAAAFA"]
[Mon Nov 24 13:49:49.107898 2025] [:error] [pid 9630:tid 9632] [client 4.211.111.86:40809] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aSPx_SrSgUgPGkizt2q6fAAAAEA"]
[Mon Nov 24 13:49:49.584470 2025] [:error] [pid 9630:tid 9650] [client 4.211.111.86:40844] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aSPx_SrSgUgPGkizt2q6fgAAAFI"]
[Mon Nov 24 13:49:50.060058 2025] [:error] [pid 16549:tid 16561] [client 4.211.111.86:40775] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aSPx_qeWW19A99PUw_cbHwAAAUk"]
[Mon Nov 24 13:49:50.537944 2025] [:error] [pid 9630:tid 9653] [client 4.211.111.86:40865] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aSPx_irSgUgPGkizt2q6fwAAAFU"]
[Mon Nov 24 13:49:51.021790 2025] [:error] [pid 48688:tid 48695] [client 4.211.111.86:40769] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aSPx_xm2q1FkzLam7A14hwAAAkM"]
[Mon Nov 24 13:49:51.497150 2025] [:error] [pid 16593:tid 16617] [client 4.211.111.86:40885] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aSPx_xVGznHBJI2LKpQd5wAAApY"]
[Mon Nov 24 13:49:51.983602 2025] [:error] [pid 48688:tid 48703] [client 4.211.111.86:40877] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aSPx_xm2q1FkzLam7A14iQAAAks"]
[Mon Nov 24 13:49:52.517502 2025] [:error] [pid 9630:tid 9640] [client 4.211.111.86:40908] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aSPyACrSgUgPGkizt2q6gAAAAEg"]
[Mon Nov 24 13:49:53.008295 2025] [:error] [pid 16516:tid 16543] [client 4.211.111.86:40957] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aSPyAfqZbniwaNwL8XnH0gAAARg"]
[Mon Nov 24 13:49:53.488865 2025] [:error] [pid 48688:tid 48697] [client 4.211.111.86:40879] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aSPyARm2q1FkzLam7A14iwAAAkU"]
[Mon Nov 24 13:49:53.968434 2025] [:error] [pid 48601:tid 48667] [client 4.211.111.86:40841] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aSPyAYMM4MaVTk74-AaKlQAAAgo"]
[Mon Nov 24 13:49:54.453642 2025] [:error] [pid 9630:tid 9655] [client 4.211.111.86:40796] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aSPyAirSgUgPGkizt2q6hAAAAFc"]
[Mon Nov 24 13:49:54.954661 2025] [:error] [pid 16593:tid 16600] [client 4.211.111.86:40861] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aSPyAhVGznHBJI2LKpQd6QAAAoU"]
[Mon Nov 24 13:49:55.430686 2025] [:error] [pid 16593:tid 16605] [client 4.211.111.86:40922] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aSPyAxVGznHBJI2LKpQd6gAAAoo"]
[Mon Nov 24 13:49:55.907279 2025] [:error] [pid 9630:tid 9635] [client 4.211.111.86:40869] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSPyAyrSgUgPGkizt2q6hgAAAEM"]
[Mon Nov 24 13:49:56.379714 2025] [:error] [pid 16441:tid 16449] [client 4.211.111.86:40835] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSPyBIq_bc5MOa9HflnrtgAAAIU"]
[Mon Nov 24 13:49:56.855136 2025] [:error] [pid 16441:tid 16445] [client 4.211.111.86:40824] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSPyBIq_bc5MOa9HflnruAAAAIE"]
[Mon Nov 24 13:49:57.327060 2025] [:error] [pid 49900:tid 49906] [client 4.211.111.86:40771] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aSPyBTCyPLrvg06aornf_wAAAAQ"]
[Mon Nov 24 13:49:57.802661 2025] [:error] [pid 16593:tid 16607] [client 4.211.111.86:40889] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSPyBRVGznHBJI2LKpQd7wAAAow"]
[Mon Nov 24 13:49:58.277857 2025] [:error] [pid 48688:tid 48701] [client 4.211.111.86:40817] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSPyBhm2q1FkzLam7A14jwAAAkk"]
[Mon Nov 24 13:49:58.751510 2025] [:error] [pid 48688:tid 48694] [client 4.211.111.86:40867] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSPyBhm2q1FkzLam7A14kAAAAkI"]
[Mon Nov 24 13:49:59.247657 2025] [:error] [pid 48599:tid 48613] [client 4.211.111.86:40876] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aSPyB5zvu6PDJiRKE3IBbwAAAYo"]
[Mon Nov 24 13:49:59.720883 2025] [:error] [pid 49900:tid 49914] [client 4.211.111.86:40953] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aSPyBzCyPLrvg06aorngAgAAAAw"]
[Mon Nov 24 13:50:00.206702 2025] [:error] [pid 48688:tid 48713] [client 4.211.111.86:40828] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aSPyCBm2q1FkzLam7A14kQAAAlU"]
[Mon Nov 24 13:50:00.678472 2025] [:error] [pid 48688:tid 48708] [client 4.211.111.86:40891] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aSPyCBm2q1FkzLam7A14lAAAAlA"]
[Mon Nov 24 13:50:01.151318 2025] [:error] [pid 48688:tid 48693] [client 4.211.111.86:40711] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aSPyCRm2q1FkzLam7A14lQAAAkE"]
[Mon Nov 24 13:50:01.630529 2025] [:error] [pid 48599:tid 48627] [client 4.211.111.86:40900] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aSPyCZzvu6PDJiRKE3IBcgAAAZg"]
[Mon Nov 24 13:50:02.113440 2025] [:error] [pid 49900:tid 49908] [client 4.211.111.86:40789] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aSPyCjCyPLrvg06aorngBAAAAAY"]
[Mon Nov 24 13:50:02.587951 2025] [:error] [pid 48599:tid 48624] [client 4.211.111.86:40770] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aSPyCpzvu6PDJiRKE3IBcwAAAZU"]
[Mon Nov 24 13:50:03.062510 2025] [:error] [pid 16441:tid 16449] [client 4.211.111.86:40904] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aSPyC4q_bc5MOa9HflnrygAAAIU"]
[Mon Nov 24 13:50:03.538447 2025] [:error] [pid 49900:tid 49903] [client 4.211.111.86:40812] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aSPyCzCyPLrvg06aorngDQAAAAE"]
[Mon Nov 24 13:50:04.018110 2025] [:error] [pid 48688:tid 48695] [client 4.211.111.86:40899] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aSPyDBm2q1FkzLam7A14lgAAAkM"]
[Mon Nov 24 13:50:04.490362 2025] [:error] [pid 16516:tid 16520] [client 4.211.111.86:40901] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aSPyDPqZbniwaNwL8XnH2QAAAQE"]
[Mon Nov 24 13:50:04.963478 2025] [:error] [pid 9630:tid 9651] [client 4.211.111.86:40773] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aSPyDCrSgUgPGkizt2q6iwAAAFM"]
[Mon Nov 24 13:50:05.437830 2025] [:error] [pid 16549:tid 16567] [client 4.211.111.86:40875] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aSPyDaeWW19A99PUw_cbQQAAAU8"]
[Mon Nov 24 13:50:05.910769 2025] [:error] [pid 48599:tid 48611] [client 4.211.111.86:40821] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aSPyDZzvu6PDJiRKE3IBdQAAAYg"]
[Mon Nov 24 13:50:06.388934 2025] [:error] [pid 9630:tid 9650] [client 4.211.111.86:40946] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aSPyDirSgUgPGkizt2q6jAAAAFI"]
[Mon Nov 24 13:50:06.862335 2025] [:error] [pid 16441:tid 16467] [client 4.211.111.86:40811] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aSPyDoq_bc5MOa9Hflnr0gAAAJc"]
[Mon Nov 24 13:50:07.347645 2025] [:error] [pid 48601:tid 48677] [client 4.211.111.86:40866] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyD4MM4MaVTk74-AaKowAAAhQ"]
[Mon Nov 24 13:50:07.820740 2025] [:error] [pid 16441:tid 16457] [client 4.211.111.86:40910] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyD4q_bc5MOa9Hflnr1QAAAI0"]
[Mon Nov 24 13:50:08.298769 2025] [:error] [pid 48688:tid 48696] [client 4.211.111.86:40733] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyEBm2q1FkzLam7A14ogAAAkQ"]
[Mon Nov 24 13:50:08.772446 2025] [:error] [pid 49900:tid 49911] [client 4.211.111.86:40909] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyEDCyPLrvg06aorngJQAAAAk"]
[Mon Nov 24 13:50:09.249695 2025] [:error] [pid 16516:tid 16541] [client 4.211.111.86:40707] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow3.php"] [unique_id "aSPyEfqZbniwaNwL8XnH5AAAARY"]
[Mon Nov 24 13:50:09.735299 2025] [:error] [pid 16593:tid 16615] [client 4.211.111.86:40715] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow3.php"] [unique_id "aSPyERVGznHBJI2LKpQd-gAAApQ"]
[Mon Nov 24 13:50:15.948778 2025] [:error] [pid 16441:tid 16454] [client 4.211.111.86:40893] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSPyF4q_bc5MOa9Hflnr4wAAAIo"]
[Mon Nov 24 13:50:28.527422 2025] [:error] [pid 48601:tid 48663] [client 4.211.111.86:40873] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/function.php"] [unique_id "aSPyJIMM4MaVTk74-AaKtAAAAgY"]
[Mon Nov 24 13:50:29.012364 2025] [:error] [pid 48600:tid 48639] [client 4.211.111.86:40779] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/function.php"] [unique_id "aSPyJftOzSUAQvWVjBddbwAAAck"]
[Mon Nov 24 13:50:29.556786 2025] [:error] [pid 48688:tid 48694] [client 4.211.111.86:40906] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/function.php"] [unique_id "aSPyJRm2q1FkzLam7A14rQAAAkI"]
[Mon Nov 24 13:50:30.086101 2025] [:error] [pid 48599:tid 48610] [client 4.211.111.86:40786] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/function.php"] [unique_id "aSPyJpzvu6PDJiRKE3IBfAAAAYc"]
[Mon Nov 24 13:50:30.601996 2025] [:error] [pid 49900:tid 49909] [client 4.211.111.86:40776] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyJjCyPLrvg06aorngLQAAAAc"]
[Mon Nov 24 13:50:31.192198 2025] [:error] [pid 16516:tid 16529] [client 4.211.111.86:40785] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyJ_qZbniwaNwL8XnH7QAAAQo"]
[Mon Nov 24 13:50:31.704041 2025] [:error] [pid 49900:tid 49922] [client 4.211.111.86:40916] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyJzCyPLrvg06aorngMAAAABQ"]
[Mon Nov 24 13:50:32.286001 2025] [:error] [pid 48601:tid 48680] [client 4.211.111.86:40794] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyKIMM4MaVTk74-AaKtwAAAhc"]
[Mon Nov 24 13:50:32.854727 2025] [:error] [pid 48601:tid 48665] [client 4.211.111.86:40814] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyKIMM4MaVTk74-AaKuAAAAgg"]
[Mon Nov 24 13:50:33.366305 2025] [:error] [pid 16516:tid 16522] [client 4.211.111.86:40895] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyKfqZbniwaNwL8XnH7gAAAQM"]
[Mon Nov 24 13:50:34.039742 2025] [:error] [pid 48688:tid 48708] [client 4.211.111.86:40921] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyKhm2q1FkzLam7A14rgAAAlA"]
[Mon Nov 24 13:50:34.625637 2025] [:error] [pid 16441:tid 16448] [client 4.211.111.86:40892] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSPyKoq_bc5MOa9Hflnr-gAAAIQ"]
[Mon Nov 24 13:50:35.169006 2025] [:error] [pid 16516:tid 16540] [client 4.211.111.86:40813] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aSPyK_qZbniwaNwL8XnH7wAAARU"]
[Mon Nov 24 13:50:35.682821 2025] [:error] [pid 49900:tid 49925] [client 4.211.111.86:40778] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aSPyKzCyPLrvg06aorngNQAAABc"]
[Mon Nov 24 13:50:36.178106 2025] [:error] [pid 9630:tid 9656] [client 4.211.111.86:40709] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aSPyLCrSgUgPGkizt2q6mwAAAFg"]
[Mon Nov 24 13:50:36.658608 2025] [:error] [pid 16441:tid 16467] [client 4.211.111.86:40816] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aSPyLIq_bc5MOa9Hflnr_AAAAJc"]
[Mon Nov 24 13:50:37.142124 2025] [:error] [pid 16593:tid 16604] [client 4.211.111.86:40807] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aSPyLRVGznHBJI2LKpQd_wAAAok"]
[Mon Nov 24 13:50:37.651693 2025] [:error] [pid 16593:tid 16611] [client 4.211.111.86:40793] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aSPyLRVGznHBJI2LKpQeAgAAApA"]
[Mon Nov 24 13:50:38.128643 2025] [:error] [pid 48688:tid 48715] [client 4.211.111.86:40872] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aSPyLhm2q1FkzLam7A14rwAAAlc"]
[Mon Nov 24 13:50:38.601525 2025] [:error] [pid 48599:tid 48612] [client 4.211.111.86:40744] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aSPyLpzvu6PDJiRKE3IBgAAAAYk"]
[Mon Nov 24 13:50:39.085902 2025] [:error] [pid 49900:tid 49903] [client 4.211.111.86:40932] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSPyLzCyPLrvg06aorngNwAAAAE"]
[Mon Nov 24 13:50:39.597769 2025] [:error] [pid 16549:tid 16568] [client 4.211.111.86:40810] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSPyL6eWW19A99PUw_cbhQAAAVA"]
[Mon Nov 24 13:50:40.125996 2025] [:error] [pid 48599:tid 48627] [client 4.211.111.86:40830] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSPyMJzvu6PDJiRKE3IBgQAAAZg"]
[Mon Nov 24 13:50:40.636249 2025] [:error] [pid 49900:tid 49904] [client 4.211.111.86:40855] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSPyMDCyPLrvg06aorngOAAAAAI"]
[Mon Nov 24 13:50:41.126777 2025] [:error] [pid 48599:tid 48621] [client 4.211.111.86:40722] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aSPyMZzvu6PDJiRKE3IBhAAAAZI"]
[Mon Nov 24 13:50:41.604748 2025] [:error] [pid 48599:tid 48604] [client 4.211.111.86:40802] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aSPyMZzvu6PDJiRKE3IBhwAAAYE"]
[Mon Nov 24 13:50:42.128040 2025] [:error] [pid 49900:tid 49912] [client 4.211.111.86:40742] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aSPyMjCyPLrvg06aorngOQAAAAo"]
[Mon Nov 24 13:50:42.618804 2025] [:error] [pid 16549:tid 16571] [client 4.211.111.86:40764] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aSPyMqeWW19A99PUw_cbjgAAAVI"]
[Mon Nov 24 13:50:43.141173 2025] [:error] [pid 16441:tid 16457] [client 4.211.111.86:40799] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSPyM4q_bc5MOa9HflnsBQAAAI0"]
[Mon Nov 24 13:50:43.675799 2025] [:error] [pid 16516:tid 16527] [client 4.211.111.86:40803] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSPyM_qZbniwaNwL8XnH8gAAAQg"]
[Mon Nov 24 13:50:44.177767 2025] [:error] [pid 9630:tid 9649] [client 4.211.111.86:40791] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSPyNCrSgUgPGkizt2q6qwAAAFE"]
[Mon Nov 24 13:50:44.669166 2025] [:error] [pid 48601:tid 48671] [client 4.211.111.86:40860] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aSPyNIMM4MaVTk74-AaKvAAAAg4"]
[Mon Nov 24 13:50:45.209228 2025] [:error] [pid 49900:tid 49906] [client 4.211.111.86:40896] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aSPyNTCyPLrvg06aorngOgAAAAQ"]
[Mon Nov 24 13:50:45.732016 2025] [:error] [pid 48600:tid 48641] [client 4.211.111.86:40913] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aSPyNftOzSUAQvWVjBddeQAAAcs"]
[Mon Nov 24 13:50:46.231950 2025] [:error] [pid 48601:tid 48668] [client 4.211.111.86:40753] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aSPyNoMM4MaVTk74-AaKvQAAAgs"]
[Mon Nov 24 13:50:46.729792 2025] [:error] [pid 48688:tid 48699] [client 4.211.111.86:40752] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aSPyNhm2q1FkzLam7A14wgAAAkc"]
[Mon Nov 24 13:50:47.202593 2025] [:error] [pid 16516:tid 16538] [client 4.211.111.86:40862] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aSPyN_qZbniwaNwL8XnH9AAAARM"]
[Mon Nov 24 13:50:47.716751 2025] [:error] [pid 48601:tid 48672] [client 4.211.111.86:40735] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aSPyN4MM4MaVTk74-AaKvwAAAg8"]
[Mon Nov 24 13:50:48.195751 2025] [:error] [pid 48601:tid 48659] [client 4.211.111.86:40926] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aSPyOIMM4MaVTk74-AaKwAAAAgI"]
[Mon Nov 24 13:50:48.689491 2025] [:error] [pid 16441:tid 16450] [client 4.211.111.86:40751] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aSPyOIq_bc5MOa9HflnsEgAAAIY"]
[Mon Nov 24 13:50:49.181085 2025] [:error] [pid 48599:tid 48616] [client 4.211.111.86:40734] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyOZzvu6PDJiRKE3IBjgAAAY0"]
[Mon Nov 24 13:50:49.653734 2025] [:error] [pid 49900:tid 49919] [client 4.211.111.86:40882] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyOTCyPLrvg06aorngQQAAABE"]
[Mon Nov 24 13:50:50.140876 2025] [:error] [pid 48601:tid 48681] [client 4.211.111.86:40582] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyOoMM4MaVTk74-AaKwQAAAhg"]
[Mon Nov 24 13:50:50.619765 2025] [:error] [pid 48600:tid 48643] [client 4.211.111.86:40797] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aSPyOvtOzSUAQvWVjBddhgAAAc0"]
[Mon Nov 24 13:50:51.099506 2025] [:error] [pid 48601:tid 48676] [client 4.211.111.86:40790] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aSPyO4MM4MaVTk74-AaKwgAAAhM"]
[Mon Nov 24 13:50:51.571839 2025] [:error] [pid 16516:tid 16540] [client 4.211.111.86:40894] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aSPyO_qZbniwaNwL8XnIAQAAARU"]
[Mon Nov 24 13:50:52.047011 2025] [:error] [pid 9630:tid 9636] [client 4.211.111.86:40762] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aSPyPCrSgUgPGkizt2q6uwAAAEQ"]
[Mon Nov 24 13:50:52.540929 2025] [:error] [pid 48688:tid 48703] [client 4.211.111.86:40714] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aSPyPBm2q1FkzLam7A14zgAAAks"]
[Mon Nov 24 13:50:53.024678 2025] [:error] [pid 48601:tid 48677] [client 4.211.111.86:40819] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aSPyPYMM4MaVTk74-AaKwwAAAhQ"]
[Mon Nov 24 13:50:53.527256 2025] [:error] [pid 48601:tid 48657] [client 4.211.111.86:40878] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aSPyPYMM4MaVTk74-AaKxAAAAgA"]
[Mon Nov 24 13:50:54.000421 2025] [:error] [pid 48688:tid 48710] [client 4.211.111.86:40781] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aSPyPRm2q1FkzLam7A140wAAAlI"]
[Mon Nov 24 13:50:54.499208 2025] [:error] [pid 48688:tid 48708] [client 4.211.111.86:40706] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aSPyPhm2q1FkzLam7A141QAAAlA"]
[Mon Nov 24 13:50:54.986500 2025] [:error] [pid 48688:tid 48693] [client 4.211.111.86:40934] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aSPyPhm2q1FkzLam7A142AAAAkE"]
[Mon Nov 24 13:50:55.493682 2025] [:error] [pid 16593:tid 16614] [client 4.211.111.86:40888] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aSPyPxVGznHBJI2LKpQeFAAAApM"]
[Mon Nov 24 13:50:55.968170 2025] [:error] [pid 16516:tid 16535] [client 4.211.111.86:40730] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aSPyP_qZbniwaNwL8XnIBAAAARA"]
[Mon Nov 24 13:50:56.468644 2025] [:error] [pid 48599:tid 48612] [client 4.211.111.86:40804] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aSPyQJzvu6PDJiRKE3IBlAAAAYk"]
[Mon Nov 24 13:50:56.951610 2025] [:error] [pid 48601:tid 48664] [client 4.211.111.86:40667] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aSPyQIMM4MaVTk74-AaKxQAAAgc"]
[Mon Nov 24 13:50:57.446048 2025] [:error] [pid 49900:tid 49925] [client 4.211.111.86:40736] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aSPyQTCyPLrvg06aorngRwAAABc"]
[Mon Nov 24 13:50:57.921437 2025] [:error] [pid 9630:tid 9632] [client 4.211.111.86:40825] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aSPyQSrSgUgPGkizt2q6vwAAAEA"]
[Mon Nov 24 13:50:58.411664 2025] [:error] [pid 16593:tid 16610] [client 4.211.111.86:40662] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aSPyQhVGznHBJI2LKpQeFgAAAo8"]
[Mon Nov 24 13:50:58.894512 2025] [:error] [pid 48599:tid 48615] [client 4.211.111.86:40880] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aSPyQpzvu6PDJiRKE3IBlgAAAYw"]
[Mon Nov 24 13:50:59.372513 2025] [:error] [pid 9630:tid 9642] [client 4.211.111.86:40905] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aSPyQyrSgUgPGkizt2q6wAAAAEo"]
[Mon Nov 24 13:50:59.863630 2025] [:error] [pid 16516:tid 16519] [client 4.211.111.86:40806] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aSPyQ_qZbniwaNwL8XnIBQAAAQA"]
[Mon Nov 24 13:51:00.337159 2025] [:error] [pid 16549:tid 16575] [client 4.211.111.86:40654] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aSPyRKeWW19A99PUw_cbnQAAAVY"]
[Mon Nov 24 13:51:00.860318 2025] [:error] [pid 16441:tid 16460] [client 4.211.111.86:40823] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSPyRIq_bc5MOa9HflnsLwAAAJA"]
[Mon Nov 24 13:51:01.354914 2025] [:error] [pid 16441:tid 16457] [client 4.211.111.86:40739] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSPyRYq_bc5MOa9HflnsMAAAAI0"]
[Mon Nov 24 13:51:01.839377 2025] [:error] [pid 48688:tid 48694] [client 4.211.111.86:40767] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSPyRRm2q1FkzLam7A145gAAAkI"]
[Mon Nov 24 13:51:02.336113 2025] [:error] [pid 16441:tid 16451] [client 4.211.111.86:40710] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSPyRoq_bc5MOa9HflnsMgAAAIc"]
[Mon Nov 24 13:51:02.838251 2025] [:error] [pid 48600:tid 48638] [client 4.211.111.86:40815] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSPyRvtOzSUAQvWVjBddtgAAAcg"]
[Mon Nov 24 13:51:03.337707 2025] [:error] [pid 48599:tid 48614] [client 4.211.111.86:40647] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSPyR5zvu6PDJiRKE3IBmAAAAYs"]
[Mon Nov 24 13:51:03.839436 2025] [:error] [pid 16593:tid 16612] [client 4.211.111.86:40820] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSPyRxVGznHBJI2LKpQeFwAAApE"]
[Mon Nov 24 13:51:04.322623 2025] [:error] [pid 9630:tid 9639] [client 4.211.111.86:40646] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSPySCrSgUgPGkizt2q6yQAAAEc"]
[Mon Nov 24 13:51:04.842069 2025] [:error] [pid 16441:tid 16464] [client 4.211.111.86:40859] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSPySIq_bc5MOa9HflnsNQAAAJQ"]
[Mon Nov 24 13:51:05.349839 2025] [:error] [pid 48601:tid 48675] [client 4.211.111.86:40783] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSPySYMM4MaVTk74-AaKyAAAAhI"]
[Mon Nov 24 13:51:05.884643 2025] [:error] [pid 49900:tid 49920] [client 4.211.111.86:40648] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSPySTCyPLrvg06aorngTAAAABI"]
[Mon Nov 24 13:51:06.368047 2025] [:error] [pid 16516:tid 16542] [client 4.211.111.86:40741] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSPySvqZbniwaNwL8XnIBwAAARc"]
[Mon Nov 24 13:51:06.840743 2025] [:error] [pid 9630:tid 9655] [client 4.211.111.86:40720] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSPySirSgUgPGkizt2q6ygAAAFc"]
[Mon Nov 24 13:51:07.316778 2025] [:error] [pid 48600:tid 48633] [client 4.211.111.86:40774] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSPyS_tOzSUAQvWVjBddyQAAAcM"]
[Mon Nov 24 13:51:07.811089 2025] [:error] [pid 9630:tid 9641] [client 4.211.111.86:40717] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSPySyrSgUgPGkizt2q6ywAAAEk"]
[Mon Nov 24 13:51:08.304257 2025] [:error] [pid 16516:tid 16520] [client 4.211.111.86:40746] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aSPyTPqZbniwaNwL8XnICAAAAQE"]
[Mon Nov 24 13:51:08.803478 2025] [:error] [pid 16516:tid 16531] [client 4.211.111.86:40649] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aSPyTPqZbniwaNwL8XnICQAAAQw"]
[Mon Nov 24 13:51:09.288954 2025] [:error] [pid 16516:tid 16530] [client 4.211.111.86:40713] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aSPyTfqZbniwaNwL8XnICgAAAQs"]
[Mon Nov 24 13:51:09.780817 2025] [:error] [pid 16593:tid 16599] [client 4.211.111.86:40643] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aSPyTRVGznHBJI2LKpQeGgAAAoQ"]
[Mon Nov 24 13:51:10.270659 2025] [:error] [pid 16593:tid 16615] [client 4.211.111.86:40745] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aSPyThVGznHBJI2LKpQeGwAAApQ"]
[Mon Nov 24 13:51:10.826156 2025] [:error] [pid 48601:tid 48674] [client 4.211.111.86:40676] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aSPyToMM4MaVTk74-AaKzAAAAhE"]
[Mon Nov 24 13:51:11.396599 2025] [:error] [pid 9630:tid 9638] [client 4.211.111.86:40784] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aSPyTyrSgUgPGkizt2q6zgAAAEY"]
[Mon Nov 24 13:51:11.917616 2025] [:error] [pid 48688:tid 48692] [client 4.211.111.86:40826] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aSPyTxm2q1FkzLam7A14_AAAAkA"]
[Mon Nov 24 13:51:12.413090 2025] [:error] [pid 49900:tid 49910] [client 4.211.111.86:40727] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aSPyUDCyPLrvg06aorngTQAAAAg"]
[Mon Nov 24 13:51:12.938846 2025] [:error] [pid 16593:tid 16617] [client 4.211.111.86:40721] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aSPyUBVGznHBJI2LKpQeHAAAApY"]
[Mon Nov 24 13:51:13.433773 2025] [:error] [pid 48688:tid 48716] [client 4.211.111.86:40936] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aSPyURm2q1FkzLam7A14_wAAAlg"]
[Mon Nov 24 13:51:13.920856 2025] [:error] [pid 16549:tid 16559] [client 4.211.111.86:40890] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aSPyUaeWW19A99PUw_cbpwAAAUc"]
[Mon Nov 24 13:51:14.406250 2025] [:error] [pid 16441:tid 16461] [client 4.211.111.86:40577] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aSPyUoq_bc5MOa9HflnsPgAAAJE"]
[Mon Nov 24 13:51:14.886619 2025] [:error] [pid 16441:tid 16449] [client 4.211.111.86:40938] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSPyUoq_bc5MOa9HflnsQAAAAIU"]
[Mon Nov 24 13:51:15.361286 2025] [:error] [pid 9630:tid 9648] [client 4.211.111.86:40656] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSPyUyrSgUgPGkizt2q60AAAAFA"]
[Mon Nov 24 13:51:15.850734 2025] [:error] [pid 48600:tid 48653] [client 4.211.111.86:40788] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSPyU_tOzSUAQvWVjBdd6AAAAdc"]
[Mon Nov 24 13:51:16.330617 2025] [:error] [pid 48599:tid 48622] [client 4.211.111.86:40718] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSPyVJzvu6PDJiRKE3IBnQAAAZM"]
[Mon Nov 24 13:51:16.804616 2025] [:error] [pid 16593:tid 16613] [client 4.211.111.86:40754] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aSPyVBVGznHBJI2LKpQeHQAAApI"]
[Mon Nov 24 13:51:17.279000 2025] [:error] [pid 48688:tid 48697] [client 4.211.111.86:40798] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aSPyVRm2q1FkzLam7A15CgAAAkU"]
[Mon Nov 24 13:51:17.773160 2025] [:error] [pid 16441:tid 16450] [client 4.211.111.86:40759] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aSPyVYq_bc5MOa9HflnsSAAAAIY"]
[Mon Nov 24 13:51:18.251247 2025] [:error] [pid 9630:tid 9650] [client 4.211.111.86:40723] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aSPyVirSgUgPGkizt2q61wAAAFI"]
[Mon Nov 24 13:51:18.742395 2025] [:error] [pid 9630:tid 9655] [client 4.211.111.86:40593] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aSPyVirSgUgPGkizt2q62QAAAFc"]
[Mon Nov 24 13:51:19.245028 2025] [:error] [pid 48688:tid 48716] [client 4.211.111.86:40763] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aSPyVxm2q1FkzLam7A15EwAAAlg"]
[Mon Nov 24 13:51:19.734488 2025] [:error] [pid 49900:tid 49918] [client 4.211.111.86:40712] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aSPyVzCyPLrvg06aorngWgAAABA"]
[Mon Nov 24 13:51:20.262138 2025] [:error] [pid 49900:tid 49906] [client 4.211.111.86:40805] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aSPyWDCyPLrvg06aorngXwAAAAQ"]
[Mon Nov 24 13:51:20.734273 2025] [:error] [pid 16516:tid 16522] [client 4.211.111.86:40719] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSPyWPqZbniwaNwL8XnIDQAAAQM"]
[Mon Nov 24 13:51:21.206245 2025] [:error] [pid 16549:tid 16574] [client 4.211.111.86:40726] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSPyWaeWW19A99PUw_cbrQAAAVU"]
[Mon Nov 24 13:51:21.684622 2025] [:error] [pid 9630:tid 9638] [client 4.211.111.86:40800] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSPyWSrSgUgPGkizt2q63AAAAEY"]
[Mon Nov 24 13:51:22.178170 2025] [:error] [pid 16516:tid 16540] [client 4.211.111.86:40831] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aSPyWvqZbniwaNwL8XnIDgAAARU"]
[Mon Nov 24 13:51:22.669434 2025] [:error] [pid 49900:tid 49913] [client 4.211.111.86:40668] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aSPyWjCyPLrvg06aorngbAAAAAs"]
[Mon Nov 24 13:51:23.174338 2025] [:error] [pid 16441:tid 16462] [client 4.211.111.86:40579] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aSPyW4q_bc5MOa9HflnsTwAAAJI"]
[Mon Nov 24 13:51:23.649353 2025] [:error] [pid 48600:tid 48645] [client 4.211.111.86:40818] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aSPyW_tOzSUAQvWVjBdd9wAAAc8"]
[Mon Nov 24 13:51:24.123330 2025] [:error] [pid 16593:tid 16615] [client 4.211.111.86:40673] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aSPyXBVGznHBJI2LKpQeMgAAApQ"]
[Mon Nov 24 13:51:24.600709 2025] [:error] [pid 16593:tid 16617] [client 4.211.111.86:40664] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSPyXBVGznHBJI2LKpQeMwAAApY"]
[Mon Nov 24 13:51:25.098192 2025] [:error] [pid 48601:tid 48665] [client 4.211.111.86:40782] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSPyXYMM4MaVTk74-AaK2AAAAgg"]
[Mon Nov 24 13:51:25.586360 2025] [:error] [pid 48688:tid 48704] [client 4.211.111.86:40690] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSPyXRm2q1FkzLam7A15NgAAAkw"]
[Mon Nov 24 13:51:26.113475 2025] [:error] [pid 9630:tid 9647] [client 4.211.111.86:40674] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aSPyXirSgUgPGkizt2q64QAAAE8"]
[Mon Nov 24 13:51:26.593931 2025] [:error] [pid 16516:tid 16537] [client 4.211.111.86:40892] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/article.php"] [unique_id "aSPyXvqZbniwaNwL8XnIEAAAARI"]
[Mon Nov 24 13:51:40.600415 2025] [autoindex:error] [pid 9630:tid 9653] [client 4.211.111.86:40661] AH01276: Cannot serve directory /home/rejuvanet/public_html/.well-known/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 13:51:51.711591 2025] [:error] [pid 9630:tid 9633] [client 4.211.111.86:40661] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSPydyrSgUgPGkizt2q7FwAAAEE"]
[Mon Nov 24 13:51:55.650588 2025] [:error] [pid 16441:tid 16447] [client 4.211.111.86:40868] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aSPye4q_bc5MOa9HflnsegAAAIM"]
[Mon Nov 24 13:51:58.076752 2025] [:error] [pid 48601:tid 48669] [client 4.211.111.86:40708] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aSPyfoMM4MaVTk74-AaLAQAAAgw"]
[Mon Nov 24 13:51:58.564215 2025] [:error] [pid 9630:tid 9632] [client 4.211.111.86:40680] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aSPyfirSgUgPGkizt2q7IAAAAEA"]
[Mon Nov 24 13:51:59.062157 2025] [:error] [pid 16441:tid 16449] [client 4.211.111.86:40704] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aSPyf4q_bc5MOa9HflnsfQAAAIU"]
[Mon Nov 24 13:51:59.559383 2025] [:error] [pid 16441:tid 16452] [client 4.211.111.86:40864] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aSPyf4q_bc5MOa9HflnsfgAAAIg"]
[Mon Nov 24 13:52:00.058186 2025] [:error] [pid 9630:tid 9649] [client 4.211.111.86:40687] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSPygCrSgUgPGkizt2q7IQAAAFE"]
[Mon Nov 24 13:52:00.545399 2025] [:error] [pid 16593:tid 16600] [client 4.211.111.86:40738] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSPygBVGznHBJI2LKpQePwAAAoU"]
[Mon Nov 24 13:52:01.055255 2025] [:error] [pid 16516:tid 16536] [client 4.211.111.86:40882] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSPygfqZbniwaNwL8XnINwAAARE"]
[Mon Nov 24 13:52:01.529315 2025] [:error] [pid 9630:tid 9641] [client 4.211.111.86:40766] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aSPygSrSgUgPGkizt2q7IwAAAEk"]
[Mon Nov 24 13:52:02.038161 2025] [:error] [pid 48599:tid 48609] [client 4.211.111.86:40749] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSPygpzvu6PDJiRKE3IBpgAAAYY"]
[Mon Nov 24 13:52:02.515787 2025] [:error] [pid 16593:tid 16595] [client 4.211.111.86:40918] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aSPyghVGznHBJI2LKpQeQAAAAoA"]
[Mon Nov 24 13:52:02.989385 2025] [:error] [pid 48601:tid 48679] [client 4.211.111.86:40693] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aSPygoMM4MaVTk74-AaLAwAAAhY"]
[Mon Nov 24 13:52:03.472236 2025] [:error] [pid 9630:tid 9637] [client 4.211.111.86:40679] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aSPygyrSgUgPGkizt2q7JgAAAEU"]
[Mon Nov 24 13:52:03.966620 2025] [:error] [pid 16516:tid 16525] [client 4.211.111.86:40760] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSPyg_qZbniwaNwL8XnIPgAAAQY"]
[Mon Nov 24 13:52:04.464038 2025] [:error] [pid 9630:tid 9647] [client 4.211.111.86:40671] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSPyhCrSgUgPGkizt2q7KQAAAE8"]
[Mon Nov 24 13:52:04.957278 2025] [:error] [pid 9630:tid 9635] [client 4.211.111.86:40669] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSPyhCrSgUgPGkizt2q7KgAAAEM"]
[Mon Nov 24 13:52:05.431930 2025] [:error] [pid 16549:tid 16561] [client 4.211.111.86:40829] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aSPyhaeWW19A99PUw_cbugAAAUk"]
[Mon Nov 24 13:52:05.907678 2025] [:error] [pid 48688:tid 48696] [client 4.211.111.86:40689] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSPyhRm2q1FkzLam7A15egAAAkQ"]
[Mon Nov 24 13:52:06.382478 2025] [:error] [pid 48688:tid 48716] [client 4.211.111.86:40737] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aSPyhhm2q1FkzLam7A15ewAAAlg"]
[Mon Nov 24 13:52:06.858244 2025] [:error] [pid 48600:tid 48645] [client 4.211.111.86:40748] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aSPyhvtOzSUAQvWVjBdeCwAAAc8"]
[Mon Nov 24 13:52:07.353493 2025] [:error] [pid 49900:tid 49906] [client 4.211.111.86:40642] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aSPyhzCyPLrvg06aorngxQAAAAQ"]
[Mon Nov 24 13:52:07.843635 2025] [:error] [pid 16549:tid 16554] [client 4.211.111.86:40682] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqq.php"] [unique_id "aSPyh6eWW19A99PUw_cbuwAAAUI"]
[Mon Nov 24 13:52:08.325927 2025] [:error] [pid 16549:tid 16564] [client 4.211.111.86:40658] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqq.php"] [unique_id "aSPyiKeWW19A99PUw_cbvQAAAUw"]
[Mon Nov 24 13:52:08.799746 2025] [:error] [pid 48599:tid 48607] [client 4.211.111.86:40758] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqq.php"] [unique_id "aSPyiJzvu6PDJiRKE3IBqAAAAYQ"]
[Mon Nov 24 13:52:09.312902 2025] [:error] [pid 49900:tid 49912] [client 4.211.111.86:40595] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqq.php"] [unique_id "aSPyiTCyPLrvg06aorngxgAAAAo"]
[Mon Nov 24 13:52:09.787782 2025] [:error] [pid 49900:tid 49917] [client 4.211.111.86:40732] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aSPyiTCyPLrvg06aorngxwAAAA8"]
[Mon Nov 24 13:52:10.298779 2025] [:error] [pid 49900:tid 49914] [client 4.211.111.86:40670] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aSPyijCyPLrvg06aorngyQAAAAw"]
[Mon Nov 24 13:52:10.786161 2025] [:error] [pid 49900:tid 49908] [client 4.211.111.86:40651] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aSPyijCyPLrvg06aorngywAAAAY"]
[Mon Nov 24 13:52:11.278885 2025] [:error] [pid 49900:tid 49913] [client 4.211.111.86:40699] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aSPyizCyPLrvg06aorngzQAAAAs"]
[Mon Nov 24 13:52:11.751699 2025] [:error] [pid 48599:tid 48605] [client 4.211.111.86:40725] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSPyi5zvu6PDJiRKE3IBqQAAAYI"]
[Mon Nov 24 13:52:12.271644 2025] [:error] [pid 48601:tid 48658] [client 4.211.111.86:40772] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aSPyjIMM4MaVTk74-AaLBwAAAgE"]
[Mon Nov 24 13:52:12.745920 2025] [:error] [pid 49900:tid 49922] [client 4.211.111.86:40768] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aSPyjDCyPLrvg06aorngzgAAABQ"]
[Mon Nov 24 13:52:13.222203 2025] [:error] [pid 49900:tid 49902] [client 4.211.111.86:40755] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aSPyjTCyPLrvg06aorng0QAAAAA"]
[Mon Nov 24 13:52:13.696931 2025] [:error] [pid 16441:tid 16465] [client 4.211.111.86:40657] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSPyjYq_bc5MOa9HflnsjgAAAJU"]
[Mon Nov 24 13:52:14.183999 2025] [:error] [pid 9630:tid 9634] [client 4.211.111.86:40731] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSPyjirSgUgPGkizt2q7MwAAAEI"]
[Mon Nov 24 13:52:14.656792 2025] [:error] [pid 48599:tid 48613] [client 4.211.111.86:40665] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSPyjpzvu6PDJiRKE3IBqwAAAYo"]
[Mon Nov 24 13:52:15.135346 2025] [:error] [pid 48599:tid 48612] [client 4.211.111.86:40756] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSPyj5zvu6PDJiRKE3IBrAAAAYk"]
[Mon Nov 24 13:52:15.643239 2025] [:error] [pid 49900:tid 49918] [client 4.211.111.86:40599] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aSPyjzCyPLrvg06aorng0gAAABA"]
[Mon Nov 24 13:52:16.190691 2025] [:error] [pid 48688:tid 48715] [client 4.211.111.86:40827] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aSPykBm2q1FkzLam7A15fwAAAlc"]
[Mon Nov 24 13:52:16.712733 2025] [:error] [pid 48601:tid 48659] [client 4.211.111.86:40653] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aSPykIMM4MaVTk74-AaLCQAAAgI"]
[Mon Nov 24 13:52:17.231234 2025] [:error] [pid 48688:tid 48708] [client 4.211.111.86:40613] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aSPykRm2q1FkzLam7A15gAAAAlA"]
[Mon Nov 24 13:52:17.760018 2025] [:error] [pid 16593:tid 16596] [client 4.211.111.86:40696] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aSPykRVGznHBJI2LKpQeRwAAAoE"]
[Mon Nov 24 13:52:18.275338 2025] [:error] [pid 9630:tid 9638] [client 4.211.111.86:40536] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aSPykirSgUgPGkizt2q7NwAAAEY"]
[Mon Nov 24 13:52:18.748782 2025] [:error] [pid 9630:tid 9635] [client 4.211.111.86:40787] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aSPykirSgUgPGkizt2q7OQAAAEM"]
[Mon Nov 24 13:52:19.233944 2025] [:error] [pid 48599:tid 48624] [client 4.211.111.86:40702] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aSPyk5zvu6PDJiRKE3IBrgAAAZU"]
[Mon Nov 24 13:52:19.737287 2025] [:error] [pid 49900:tid 49904] [client 4.211.111.86:40526] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSPykzCyPLrvg06aorng1QAAAAI"]
[Mon Nov 24 13:52:20.224291 2025] [:error] [pid 9630:tid 9646] [client 4.211.111.86:40597] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSPylCrSgUgPGkizt2q7OwAAAE4"]
[Mon Nov 24 13:52:20.724911 2025] [:error] [pid 49900:tid 49906] [client 4.211.111.86:40925] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSPylDCyPLrvg06aorng1wAAAAQ"]
[Mon Nov 24 13:52:21.210066 2025] [:error] [pid 16549:tid 16573] [client 4.211.111.86:40610] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSPylaeWW19A99PUw_cbwgAAAVQ"]
[Mon Nov 24 13:52:21.723034 2025] [:error] [pid 9630:tid 9643] [client 4.211.111.86:40716] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSPylSrSgUgPGkizt2q7PAAAAEs"]
[Mon Nov 24 13:52:22.211629 2025] [:error] [pid 48688:tid 48693] [client 4.211.111.86:40747] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSPylhm2q1FkzLam7A15gQAAAkE"]
[Mon Nov 24 13:52:22.710016 2025] [:error] [pid 48688:tid 48699] [client 4.211.111.86:40684] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSPylhm2q1FkzLam7A15ggAAAkc"]
[Mon Nov 24 13:52:23.217389 2025] [:error] [pid 16441:tid 16448] [client 4.211.111.86:40750] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aSPyl4q_bc5MOa9HflnskwAAAIQ"]
[Mon Nov 24 13:52:23.706445 2025] [:error] [pid 16441:tid 16446] [client 4.211.111.86:40589] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSPyl4q_bc5MOa9HflnslAAAAII"]
[Mon Nov 24 13:52:24.192532 2025] [:error] [pid 48600:tid 48644] [client 4.211.111.86:40603] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSPymPtOzSUAQvWVjBdeFAAAAc4"]
[Mon Nov 24 13:52:24.679672 2025] [:error] [pid 48600:tid 48636] [client 4.211.111.86:40691] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSPymPtOzSUAQvWVjBdeFQAAAcY"]
[Mon Nov 24 13:52:25.174900 2025] [:error] [pid 49900:tid 49905] [client 4.211.111.86:40615] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aSPymTCyPLrvg06aorng2gAAAAM"]
[Mon Nov 24 13:52:25.656500 2025] [:error] [pid 48600:tid 48631] [client 4.211.111.86:40757] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSPymftOzSUAQvWVjBdeGAAAAcE"]
[Mon Nov 24 13:52:26.130365 2025] [:error] [pid 49900:tid 49922] [client 4.211.111.86:40705] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aSPymjCyPLrvg06aorng3AAAABQ"]
[Mon Nov 24 13:52:26.621334 2025] [:error] [pid 48599:tid 48615] [client 4.211.111.86:40644] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aSPympzvu6PDJiRKE3IBsQAAAYw"]
[Mon Nov 24 13:52:27.095817 2025] [:error] [pid 9630:tid 9642] [client 4.211.111.86:40621] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aSPymyrSgUgPGkizt2q7PgAAAEo"]
[Mon Nov 24 13:52:27.568912 2025] [:error] [pid 16593:tid 16600] [client 4.211.111.86:40602] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSPymxVGznHBJI2LKpQeSwAAAoU"]
[Mon Nov 24 13:52:28.052910 2025] [:error] [pid 16549:tid 16574] [client 4.211.111.86:40618] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSPynKeWW19A99PUw_cbwwAAAVU"]
[Mon Nov 24 13:52:28.525262 2025] [:error] [pid 48599:tid 48627] [client 4.211.111.86:40694] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSPynJzvu6PDJiRKE3IBswAAAZg"]
[Mon Nov 24 13:52:28.996875 2025] [:error] [pid 48601:tid 48662] [client 4.211.111.86:40605] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSPynIMM4MaVTk74-AaLEwAAAgU"]
[Mon Nov 24 13:52:29.471300 2025] [:error] [pid 9630:tid 9650] [client 4.211.111.86:40592] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aSPynSrSgUgPGkizt2q7QAAAAFI"]
[Mon Nov 24 13:52:29.946681 2025] [:error] [pid 48688:tid 48704] [client 4.211.111.86:40743] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aSPynRm2q1FkzLam7A15hAAAAkw"]
[Mon Nov 24 13:52:30.423412 2025] [:error] [pid 48601:tid 48660] [client 4.211.111.86:40606] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aSPynoMM4MaVTk74-AaLFAAAAgM"]
[Mon Nov 24 13:52:30.896267 2025] [:error] [pid 16441:tid 16467] [client 4.211.111.86:40765] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aSPynoq_bc5MOa9HflnsmQAAAJc"]
[Mon Nov 24 13:52:31.380004 2025] [:error] [pid 16441:tid 16453] [client 4.211.111.86:40650] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aSPyn4q_bc5MOa9HflnsnAAAAIk"]
[Mon Nov 24 13:52:31.861646 2025] [:error] [pid 48688:tid 48706] [client 4.211.111.86:40640] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aSPynxm2q1FkzLam7A15hwAAAk4"]
[Mon Nov 24 13:52:32.356076 2025] [:error] [pid 16549:tid 16565] [client 4.211.111.86:40641] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aSPyoKeWW19A99PUw_cbxAAAAU0"]
[Mon Nov 24 13:52:32.841262 2025] [:error] [pid 48599:tid 48609] [client 4.211.111.86:40729] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aSPyoJzvu6PDJiRKE3IBtgAAAYY"]
[Mon Nov 24 13:52:33.316857 2025] [:error] [pid 48688:tid 48696] [client 4.211.111.86:40625] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSPyoRm2q1FkzLam7A15iwAAAkQ"]
[Mon Nov 24 13:52:33.797438 2025] [:error] [pid 16549:tid 16571] [client 4.211.111.86:40677] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSPyoaeWW19A99PUw_cbxgAAAVI"]
[Mon Nov 24 13:52:34.273751 2025] [:error] [pid 48600:tid 48647] [client 4.211.111.86:40678] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSPyovtOzSUAQvWVjBdeGQAAAdE"]
[Mon Nov 24 13:52:34.749383 2025] [:error] [pid 16441:tid 16451] [client 4.211.111.86:40686] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSPyooq_bc5MOa9HflnsowAAAIc"]
[Mon Nov 24 13:52:35.229904 2025] [:error] [pid 16516:tid 16529] [client 4.211.111.86:40822] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSPyo_qZbniwaNwL8XnIYwAAAQo"]
[Mon Nov 24 13:52:35.714845 2025] [:error] [pid 48600:tid 48643] [client 4.211.111.86:40645] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSPyo_tOzSUAQvWVjBdeGgAAAc0"]
[Mon Nov 24 13:52:36.191051 2025] [:error] [pid 16549:tid 16566] [client 4.211.111.86:40631] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSPypKeWW19A99PUw_cbxwAAAU4"]
[Mon Nov 24 13:52:36.672451 2025] [:error] [pid 48688:tid 48694] [client 4.211.111.86:40681] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aSPypBm2q1FkzLam7A15jwAAAkI"]
[Mon Nov 24 13:52:37.157128 2025] [:error] [pid 16549:tid 16552] [client 4.211.111.86:40652] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aSPypaeWW19A99PUw_cbyQAAAUA"]
[Mon Nov 24 13:52:37.637173 2025] [:error] [pid 49900:tid 49904] [client 4.211.111.86:40578] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aSPypTCyPLrvg06aorng4AAAAAI"]
[Mon Nov 24 13:52:38.126337 2025] [:error] [pid 9630:tid 9638] [client 4.211.111.86:40700] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aSPypirSgUgPGkizt2q7RgAAAEY"]
[Mon Nov 24 13:52:38.633936 2025] [:error] [pid 48600:tid 48640] [client 4.211.111.86:40857] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aSPypvtOzSUAQvWVjBdeHAAAAco"]
[Mon Nov 24 13:52:39.111763 2025] [:error] [pid 48688:tid 48711] [client 4.211.111.86:40556] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aSPypxm2q1FkzLam7A15kQAAAlM"]
[Mon Nov 24 13:52:39.585427 2025] [:error] [pid 48600:tid 48630] [client 4.211.111.86:40522] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aSPyp_tOzSUAQvWVjBdeHQAAAcA"]
[Mon Nov 24 13:52:40.062793 2025] [:error] [pid 48599:tid 48605] [client 4.211.111.86:40590] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aSPyqJzvu6PDJiRKE3IBuQAAAYI"]
[Mon Nov 24 13:52:40.535299 2025] [:error] [pid 48599:tid 48625] [client 4.211.111.86:40624] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aSPyqJzvu6PDJiRKE3IBugAAAZY"]
[Mon Nov 24 13:52:41.010480 2025] [:error] [pid 9630:tid 9654] [client 4.211.111.86:40520] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aSPyqSrSgUgPGkizt2q7SwAAAFY"]
[Mon Nov 24 13:52:41.483650 2025] [:error] [pid 48688:tid 48706] [client 4.211.111.86:40660] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aSPyqRm2q1FkzLam7A15lAAAAk4"]
[Mon Nov 24 13:52:41.955222 2025] [:error] [pid 48688:tid 48697] [client 4.211.111.86:40917] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aSPyqRm2q1FkzLam7A15lQAAAkU"]
[Mon Nov 24 13:52:42.430229 2025] [:error] [pid 9630:tid 9639] [client 4.211.111.86:40540] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aSPyqirSgUgPGkizt2q7TAAAAEc"]
[Mon Nov 24 13:52:42.909601 2025] [:error] [pid 16441:tid 16466] [client 4.211.111.86:40688] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSPyqoq_bc5MOa9HflnsqgAAAJY"]
[Mon Nov 24 13:52:43.382559 2025] [:error] [pid 9630:tid 9647] [client 4.211.111.86:40512] [client 4.211.111.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSPyqyrSgUgPGkizt2q7TwAAAE8"]
[Mon Nov 24 13:52:43.863612 2025] [:error] [pid 48688:tid 48695] [client 4.211.111.86:40675] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aSPyqxm2q1FkzLam7A15nAAAAkM"]
[Mon Nov 24 13:52:44.359181 2025] [:error] [pid 49900:tid 49924] [client 4.211.111.86:40632] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aSPyrDCyPLrvg06aorng7QAAABY"]
[Mon Nov 24 13:52:44.838287 2025] [:error] [pid 48599:tid 48618] [client 4.211.111.86:40628] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aSPyrJzvu6PDJiRKE3IBwQAAAY8"]
[Mon Nov 24 13:52:45.336301 2025] [:error] [pid 48599:tid 48623] [client 4.211.111.86:40845] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aSPyrZzvu6PDJiRKE3IBwgAAAZQ"]
[Mon Nov 24 13:52:45.814395 2025] [:error] [pid 9630:tid 9642] [client 4.211.111.86:40761] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bge.php"] [unique_id "aSPyrSrSgUgPGkizt2q7WAAAAEo"]
[Mon Nov 24 13:52:46.357004 2025] [:error] [pid 16516:tid 16543] [client 4.211.111.86:40568] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bge.php"] [unique_id "aSPyrvqZbniwaNwL8XnIZgAAARg"]
[Mon Nov 24 13:52:46.829604 2025] [:error] [pid 48599:tid 48603] [client 4.211.111.86:40740] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bge.php"] [unique_id "aSPyrpzvu6PDJiRKE3IBwwAAAYA"]
[Mon Nov 24 13:52:47.302233 2025] [:error] [pid 9630:tid 9633] [client 4.211.111.86:40614] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bge.php"] [unique_id "aSPyryrSgUgPGkizt2q7XQAAAEE"]
[Mon Nov 24 13:52:47.773831 2025] [:error] [pid 48600:tid 48641] [client 4.211.111.86:40685] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ifm.php"] [unique_id "aSPyr_tOzSUAQvWVjBdeHwAAAcs"]
[Mon Nov 24 13:52:48.257636 2025] [:error] [pid 16593:tid 16615] [client 4.211.111.86:40588] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ifm.php"] [unique_id "aSPysBVGznHBJI2LKpQeWQAAApQ"]
[Mon Nov 24 13:52:48.745190 2025] [:error] [pid 48600:tid 48654] [client 4.211.111.86:40659] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ifm.php"] [unique_id "aSPysPtOzSUAQvWVjBdeIQAAAdg"]
[Mon Nov 24 13:52:49.225366 2025] [:error] [pid 16441:tid 16449] [client 4.211.111.86:40567] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ifm.php"] [unique_id "aSPysYq_bc5MOa9HflnssgAAAIU"]
[Mon Nov 24 13:52:49.733045 2025] [:error] [pid 16549:tid 16566] [client 4.211.111.86:40627] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww5.php"] [unique_id "aSPysaeWW19A99PUw_cb0gAAAU4"]
[Mon Nov 24 13:52:50.223866 2025] [:error] [pid 48599:tid 48624] [client 4.211.111.86:40690] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww5.php"] [unique_id "aSPyspzvu6PDJiRKE3IByQAAAZU"]
[Mon Nov 24 13:52:50.696232 2025] [:error] [pid 9630:tid 9632] [client 4.211.111.86:40464] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww5.php"] [unique_id "aSPysirSgUgPGkizt2q7cgAAAEA"]
[Mon Nov 24 13:52:51.186131 2025] [:error] [pid 48600:tid 48648] [client 4.211.111.86:40701] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww5.php"] [unique_id "aSPys_tOzSUAQvWVjBdeIgAAAdI"]
[Mon Nov 24 13:52:51.659393 2025] [:error] [pid 48601:tid 48681] [client 4.211.111.86:40666] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thxt.php"] [unique_id "aSPys4MM4MaVTk74-AaLIgAAAhg"]
[Mon Nov 24 13:52:52.136425 2025] [:error] [pid 48599:tid 48620] [client 4.211.111.86:40522] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thxt.php"] [unique_id "aSPytJzvu6PDJiRKE3IB0gAAAZE"]
[Mon Nov 24 13:52:52.610898 2025] [:error] [pid 48688:tid 48697] [client 4.211.111.86:40607] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thxt.php"] [unique_id "aSPytBm2q1FkzLam7A15rAAAAkU"]
[Mon Nov 24 13:52:53.091930 2025] [:error] [pid 49900:tid 49914] [client 4.211.111.86:40604] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thxt.php"] [unique_id "aSPytTCyPLrvg06aornhFgAAAAw"]
[Mon Nov 24 13:52:53.562874 2025] [:error] [pid 16516:tid 16536] [client 4.211.111.86:40728] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kairolin.php"] [unique_id "aSPytfqZbniwaNwL8XnIbgAAARE"]
[Mon Nov 24 13:52:54.033997 2025] [:error] [pid 16549:tid 16563] [client 4.211.111.86:40523] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kairolin.php"] [unique_id "aSPytqeWW19A99PUw_cb1wAAAUs"]
[Mon Nov 24 13:52:54.506379 2025] [:error] [pid 16549:tid 16568] [client 4.211.111.86:40626] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kairolin.php"] [unique_id "aSPytqeWW19A99PUw_cb2AAAAVA"]
[Mon Nov 24 13:52:54.981309 2025] [:error] [pid 16441:tid 16464] [client 4.211.111.86:40636] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kairolin.php"] [unique_id "aSPytoq_bc5MOa9HflnsuAAAAJQ"]
[Mon Nov 24 13:52:55.459478 2025] [:error] [pid 49900:tid 49909] [client 4.211.111.86:40640] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/siln.php"] [unique_id "aSPytzCyPLrvg06aornhGwAAAAc"]
[Mon Nov 24 13:52:55.930598 2025] [:error] [pid 48599:tid 48608] [client 4.211.111.86:40609] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/siln.php"] [unique_id "aSPyt5zvu6PDJiRKE3IB0wAAAYU"]
[Mon Nov 24 13:53:13.397299 2025] [:error] [pid 49900:tid 49922] [client 4.211.111.86:40550] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/03.php"] [unique_id "aSPyyTCyPLrvg06aornhMAAAABQ"]
[Mon Nov 24 13:53:13.869755 2025] [:error] [pid 48688:tid 48707] [client 4.211.111.86:40587] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/03.php"] [unique_id "aSPyyRm2q1FkzLam7A15swAAAk8"]
[Mon Nov 24 13:53:14.345058 2025] [:error] [pid 49900:tid 49914] [client 4.211.111.86:40608] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/03.php"] [unique_id "aSPyyjCyPLrvg06aornhMgAAAAw"]
[Mon Nov 24 13:53:14.979817 2025] [:error] [pid 16549:tid 16559] [client 4.211.111.86:40586] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/03.php"] [unique_id "aSPyyqeWW19A99PUw_cb5AAAAUc"]
[Mon Nov 24 13:53:15.463997 2025] [:error] [pid 16549:tid 16562] [client 4.211.111.86:40539] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aSPyy6eWW19A99PUw_cb5gAAAUo"]
[Mon Nov 24 13:53:15.950192 2025] [:error] [pid 16516:tid 16538] [client 4.211.111.86:40607] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aSPyy_qZbniwaNwL8XnIdAAAARM"]
[Mon Nov 24 13:53:16.425767 2025] [:error] [pid 16516:tid 16523] [client 4.211.111.86:40788] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aSPyzPqZbniwaNwL8XnIdQAAAQQ"]
[Mon Nov 24 13:53:16.898372 2025] [:error] [pid 48688:tid 48699] [client 4.211.111.86:40561] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aSPyzBm2q1FkzLam7A15tQAAAkc"]
[Mon Nov 24 13:53:17.374381 2025] [:error] [pid 49900:tid 49904] [client 4.211.111.86:40623] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aSPyzTCyPLrvg06aornhNwAAAAI"]
[Mon Nov 24 13:53:17.847024 2025] [:error] [pid 49900:tid 49921] [client 4.211.111.86:40638] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aSPyzTCyPLrvg06aornhOQAAABM"]
[Mon Nov 24 13:53:18.321325 2025] [:error] [pid 49900:tid 49925] [client 4.211.111.86:40549] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aSPyzjCyPLrvg06aornhOgAAABc"]
[Mon Nov 24 13:53:18.794182 2025] [:error] [pid 48688:tid 48711] [client 4.211.111.86:40519] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aSPyzhm2q1FkzLam7A15tgAAAlM"]
[Mon Nov 24 13:53:19.280933 2025] [:error] [pid 16441:tid 16447] [client 4.211.111.86:40620] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aSPyz4q_bc5MOa9HflnsywAAAIM"]
[Mon Nov 24 13:53:19.756119 2025] [:error] [pid 49900:tid 49917] [client 4.211.111.86:40616] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aSPyzzCyPLrvg06aornhPQAAAA8"]
[Mon Nov 24 13:53:20.247637 2025] [:error] [pid 48688:tid 48709] [client 4.211.111.86:40576] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aSPy0Bm2q1FkzLam7A15twAAAlE"]
[Mon Nov 24 13:53:20.717998 2025] [:error] [pid 16441:tid 16444] [client 4.211.111.86:40518] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aSPy0Iq_bc5MOa9HflnszAAAAIA"]
[Mon Nov 24 13:53:21.191899 2025] [:error] [pid 16441:tid 16450] [client 4.211.111.86:40559] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless3.php"] [unique_id "aSPy0Yq_bc5MOa9HflnszQAAAIY"]
[Mon Nov 24 13:53:21.667903 2025] [:error] [pid 16441:tid 16453] [client 4.211.111.86:40697] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless3.php"] [unique_id "aSPy0Yq_bc5MOa9HflnszgAAAIk"]
[Mon Nov 24 13:53:22.142111 2025] [:error] [pid 9630:tid 9653] [client 4.211.111.86:40581] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless3.php"] [unique_id "aSPy0irSgUgPGkizt2q7iAAAAFU"]
[Mon Nov 24 13:53:22.621413 2025] [:error] [pid 48688:tid 48700] [client 4.211.111.86:40611] [client 4.211.111.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless3.php"] [unique_id "aSPy0hm2q1FkzLam7A15uQAAAkg"]
[Mon Nov 24 17:59:10.286493 2025] [:error] [pid 49900:tid 49920] [client 182.44.2.148:42295] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSQsbjCyPLrvg06aorkVcQAAABI"]
[Tue Nov 25 00:44:44.422789 2025] [:error] [pid 16549:tid 16562] [client 221.229.106.25:34016] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSSLfKeWW19A99PUw_eBiAAAAUo"]
[Tue Nov 25 03:41:38.943778 2025] [:error] [pid 61433:tid 61508] [client 20.119.245.174:4285] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSS08k1nb5r2eDXSMnSz6wAAAIs"]
[Tue Nov 25 03:41:42.156759 2025] [:error] [pid 61528:tid 61545] [client 20.119.245.174:3802] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSS09pmXyiOE_lMDJTNGPgAAAM8"]
[Tue Nov 25 03:41:44.394148 2025] [:error] [pid 61528:tid 61547] [client 20.119.245.174:4213] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSS0-JmXyiOE_lMDJTNGQgAAANE"]
[Tue Nov 25 03:41:45.932797 2025] [:error] [pid 61432:tid 61487] [client 20.119.245.174:2242] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aSS0-WjoHc8OYPguMSCt0QAAAFE"]
[Tue Nov 25 03:41:49.790512 2025] [:error] [pid 61432:tid 61474] [client 20.119.245.174:4967] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aSS0_WjoHc8OYPguMSCt3gAAAEQ"]
[Tue Nov 25 03:41:51.728886 2025] [:error] [pid 61431:tid 61435] [client 20.119.245.174:1475] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aSS0_9ISJUjxNuXBMNDAdQAAAAA"]
[Tue Nov 25 03:41:52.715278 2025] [:error] [pid 61433:tid 61505] [client 20.119.245.174:3830] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aSS1AE1nb5r2eDXSMnSz9QAAAIg"]
[Tue Nov 25 03:41:55.425169 2025] [:error] [pid 61432:tid 61489] [client 20.119.245.174:4064] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aSS1A2joHc8OYPguMSCt6gAAAFM"]
[Tue Nov 25 03:41:57.628266 2025] [:error] [pid 61433:tid 61521] [client 20.119.245.174:5593] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "aSS1BU1nb5r2eDXSMnSz_QAAAJg"]
[Tue Nov 25 03:41:58.883237 2025] [:error] [pid 61431:tid 61444] [client 20.119.245.174:3796] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "aSS1BtISJUjxNuXBMNDAfAAAAAk"]
[Tue Nov 25 03:42:00.450216 2025] [:error] [pid 61433:tid 61505] [client 20.119.245.174:1525] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "aSS1CE1nb5r2eDXSMnS0AwAAAIg"]
[Tue Nov 25 03:42:02.545662 2025] [:error] [pid 61528:tid 61543] [client 20.119.245.174:2294] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "aSS1CpmXyiOE_lMDJTNGVwAAAM0"]
[Tue Nov 25 03:42:04.113612 2025] [:error] [pid 61433:tid 61500] [client 20.119.245.174:4034] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/snus.php"] [unique_id "aSS1DE1nb5r2eDXSMnS0DQAAAIM"]
[Tue Nov 25 03:42:10.552800 2025] [:error] [pid 61433:tid 61501] [client 20.119.245.174:1511] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/snus.php"] [unique_id "aSS1Ek1nb5r2eDXSMnS0FgAAAIQ"]
[Tue Nov 25 03:42:11.847008 2025] [:error] [pid 61431:tid 61453] [client 20.119.245.174:2254] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/snus.php"] [unique_id "aSS1E9ISJUjxNuXBMNDAiQAAABI"]
[Tue Nov 25 03:42:13.775774 2025] [:error] [pid 61432:tid 61472] [client 20.119.245.174:1316] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/snus.php"] [unique_id "aSS1FWjoHc8OYPguMSCt-wAAAEI"]
[Tue Nov 25 03:42:14.917489 2025] [:error] [pid 61432:tid 61486] [client 20.119.245.174:3819] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/011i.php"] [unique_id "aSS1FmjoHc8OYPguMSCt_gAAAFA"]
[Tue Nov 25 03:42:16.749818 2025] [:error] [pid 61432:tid 61492] [client 20.119.245.174:5602] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/011i.php"] [unique_id "aSS1GGjoHc8OYPguMSCuAAAAAFY"]
[Tue Nov 25 03:42:18.831845 2025] [:error] [pid 61528:tid 61533] [client 20.119.245.174:1478] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/011i.php"] [unique_id "aSS1GpmXyiOE_lMDJTNGagAAAMM"]
[Tue Nov 25 03:42:23.471808 2025] [:error] [pid 61432:tid 61477] [client 20.119.245.174:5569] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/011i.php"] [unique_id "aSS1H2joHc8OYPguMSCuBAAAAEc"]
[Tue Nov 25 03:42:26.167856 2025] [:error] [pid 61431:tid 61459] [client 20.119.245.174:1319] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/disaos.php"] [unique_id "aSS1ItISJUjxNuXBMNDAlgAAABg"]
[Tue Nov 25 03:43:03.263917 2025] [:error] [pid 61528:tid 61531] [client 20.119.245.174:1496] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gm.php"] [unique_id "aSS1R5mXyiOE_lMDJTNGugAAAME"]
[Tue Nov 25 03:43:06.071165 2025] [:error] [pid 61433:tid 61517] [client 20.119.245.174:1499] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gm.php"] [unique_id "aSS1Sk1nb5r2eDXSMnS0igAAAJQ"]
[Tue Nov 25 03:43:07.017711 2025] [:error] [pid 61528:tid 61548] [client 20.119.245.174:1308] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gm.php"] [unique_id "aSS1S5mXyiOE_lMDJTNGvQAAANI"]
[Tue Nov 25 03:43:08.619819 2025] [:error] [pid 61431:tid 61447] [client 20.119.245.174:3803] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gm.php"] [unique_id "aSS1TNISJUjxNuXBMNDBJgAAAAw"]
[Tue Nov 25 03:43:11.248870 2025] [:error] [pid 61528:tid 61551] [client 20.119.245.174:4938] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/naxc.php"] [unique_id "aSS1T5mXyiOE_lMDJTNGwgAAANU"]
[Tue Nov 25 03:43:12.903058 2025] [:error] [pid 61433:tid 61498] [client 20.119.245.174:2261] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/naxc.php"] [unique_id "aSS1UE1nb5r2eDXSMnS0lQAAAIE"]
[Tue Nov 25 03:43:15.102461 2025] [:error] [pid 61431:tid 61437] [client 20.119.245.174:4066] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/naxc.php"] [unique_id "aSS1U9ISJUjxNuXBMNDBKwAAAAI"]
[Tue Nov 25 03:43:15.874496 2025] [:error] [pid 61432:tid 61484] [client 20.119.245.174:5577] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/naxc.php"] [unique_id "aSS1U2joHc8OYPguMSCuaAAAAE4"]
[Tue Nov 25 03:43:20.815390 2025] [:error] [pid 61528:tid 61551] [client 20.119.245.174:2283] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aSS1WJmXyiOE_lMDJTNGxwAAANU"]
[Tue Nov 25 03:43:22.957892 2025] [:error] [pid 61432:tid 61493] [client 20.119.245.174:4356] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aSS1WmjoHc8OYPguMSCudwAAAFc"]
[Tue Nov 25 03:43:24.662017 2025] [:error] [pid 61433:tid 61502] [client 20.119.245.174:3787] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aSS1XE1nb5r2eDXSMnS0ogAAAIU"]
[Tue Nov 25 03:43:38.252920 2025] [:error] [pid 61528:tid 61546] [client 20.119.245.174:4399] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "aSS1apmXyiOE_lMDJTNG3gAAANA"]
[Tue Nov 25 03:43:40.822547 2025] [:error] [pid 61528:tid 61537] [client 20.119.245.174:4046] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "aSS1bJmXyiOE_lMDJTNG6QAAAMc"]
[Tue Nov 25 03:43:42.143750 2025] [:error] [pid 61433:tid 61504] [client 20.119.245.174:4362] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "aSS1bk1nb5r2eDXSMnS0rAAAAIc"]
[Tue Nov 25 03:43:43.992845 2025] [:error] [pid 61528:tid 61551] [client 20.119.245.174:3817] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "aSS1b5mXyiOE_lMDJTNG8AAAANU"]
[Tue Nov 25 03:43:50.995882 2025] [:error] [pid 61433:tid 61501] [client 20.119.245.174:3783] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rsjlrria.php"] [unique_id "aSS1dk1nb5r2eDXSMnS0vQAAAIQ"]
[Tue Nov 25 03:43:53.003330 2025] [:error] [pid 61432:tid 61489] [client 20.119.245.174:5616] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rsjlrria.php"] [unique_id "aSS1eWjoHc8OYPguMSCuoAAAAFM"]
[Tue Nov 25 03:43:56.227037 2025] [:error] [pid 61528:tid 61547] [client 20.119.245.174:5578] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rsjlrria.php"] [unique_id "aSS1fJmXyiOE_lMDJTNHDgAAANE"]
[Tue Nov 25 03:44:01.889320 2025] [:error] [pid 61432:tid 61479] [client 20.119.245.174:4078] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSS1gWjoHc8OYPguMSCusgAAAEk"]
[Tue Nov 25 03:44:19.603198 2025] [:error] [pid 61431:tid 61435] [client 20.119.245.174:2263] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/product.php"] [unique_id "aSS1k9ISJUjxNuXBMNDBdQAAAAA"]
[Tue Nov 25 03:44:22.173970 2025] [:error] [pid 61433:tid 61514] [client 20.119.245.174:4049] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/product.php"] [unique_id "aSS1lk1nb5r2eDXSMnS01wAAAJE"]
[Tue Nov 25 03:44:23.270983 2025] [:error] [pid 61433:tid 61516] [client 20.119.245.174:5572] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/product.php"] [unique_id "aSS1l01nb5r2eDXSMnS02AAAAJM"]
[Tue Nov 25 03:44:26.148470 2025] [:error] [pid 61528:tid 61541] [client 20.119.245.174:1334] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/product.php"] [unique_id "aSS1mpmXyiOE_lMDJTNHLwAAAMs"]
[Tue Nov 25 03:44:27.895396 2025] [:error] [pid 61528:tid 61535] [client 20.119.245.174:4952] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e56.php"] [unique_id "aSS1m5mXyiOE_lMDJTNHNQAAAMU"]
[Tue Nov 25 03:44:29.067457 2025] [:error] [pid 61431:tid 61440] [client 20.119.245.174:2280] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e56.php"] [unique_id "aSS1ndISJUjxNuXBMNDBsAAAAAU"]
[Tue Nov 25 03:44:30.492470 2025] [:error] [pid 61431:tid 61449] [client 20.119.245.174:1289] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e56.php"] [unique_id "aSS1ntISJUjxNuXBMNDBtgAAAA4"]
[Tue Nov 25 03:44:33.182270 2025] [:error] [pid 61431:tid 61451] [client 20.119.245.174:5618] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e56.php"] [unique_id "aSS1odISJUjxNuXBMNDBuQAAABA"]
[Tue Nov 25 03:44:44.653752 2025] [:error] [pid 61528:tid 61530] [client 20.119.245.174:5617] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-x.php"] [unique_id "aSS1rJmXyiOE_lMDJTNHXwAAAMA"]
[Tue Nov 25 03:44:46.860872 2025] [:error] [pid 61433:tid 61513] [client 20.119.245.174:4357] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-x.php"] [unique_id "aSS1rk1nb5r2eDXSMnS1AgAAAJA"]
[Tue Nov 25 03:45:08.039172 2025] [:error] [pid 61432:tid 61486] [client 20.119.245.174:1280] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aSS1xGjoHc8OYPguMSCvAQAAAFA"]
[Tue Nov 25 03:45:13.040748 2025] [:error] [pid 61528:tid 61533] [client 20.119.245.174:2287] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aSS1yZmXyiOE_lMDJTNHhAAAAMM"]
[Tue Nov 25 03:45:43.374087 2025] [:error] [pid 34790:tid 34813] [client 20.119.245.174:2286] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-22.php"] [unique_id "aSS1576t_aow_iQiQYAjRwAAAMo"]
[Tue Nov 25 03:45:45.057993 2025] [:error] [pid 34694:tid 34722] [client 20.119.245.174:1301] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-22.php"] [unique_id "aSS16VBW7J9m3gnaVKSg_gAAAA4"]
[Tue Nov 25 03:45:46.293172 2025] [:error] [pid 34695:tid 34760] [client 20.119.245.174:1313] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-22.php"] [unique_id "aSS16iwTx_MzUP3xQvkb4QAAAFg"]
[Tue Nov 25 03:45:48.022179 2025] [:error] [pid 34696:tid 34772] [client 20.119.245.174:1897] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-22.php"] [unique_id "aSS17HZD4E4cFtkL0rW_9AAAAIk"]
[Tue Nov 25 03:45:49.945121 2025] [:error] [pid 34790:tid 34822] [client 20.119.245.174:4060] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aSS17b6t_aow_iQiQYAjTQAAANM"]
[Tue Nov 25 03:46:11.464125 2025] [:error] [pid 34696:tid 34775] [client 20.119.245.174:4040] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aSS2A3ZD4E4cFtkL0rXABwAAAIw"]
[Tue Nov 25 03:46:12.797117 2025] [:error] [pid 34790:tid 34826] [client 20.119.245.174:5631] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aSS2BL6t_aow_iQiQYAjcAAAANc"]
[Tue Nov 25 03:46:21.139081 2025] [:error] [pid 34694:tid 34720] [client 20.119.245.174:4036] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aSS2DVBW7J9m3gnaVKShGAAAAAw"]
[Tue Nov 25 03:46:23.243962 2025] [:error] [pid 34790:tid 34826] [client 20.119.245.174:1310] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aSS2D76t_aow_iQiQYAjoAAAANc"]
[Tue Nov 25 03:46:24.160438 2025] [:error] [pid 34694:tid 34714] [client 20.119.245.174:4384] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aSS2EFBW7J9m3gnaVKShGQAAAAY"]
[Tue Nov 25 03:46:25.515069 2025] [:error] [pid 34694:tid 34726] [client 20.119.245.174:4041] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aSS2EVBW7J9m3gnaVKShHQAAABI"]
[Tue Nov 25 03:46:29.753574 2025] [:error] [pid 34790:tid 34812] [client 20.119.245.174:5576] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aSS2Fb6t_aow_iQiQYAjpwAAAMk"]
[Tue Nov 25 03:46:31.167147 2025] [:error] [pid 34694:tid 34715] [client 20.119.245.174:3788] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aSS2F1BW7J9m3gnaVKShHwAAAAc"]
[Tue Nov 25 03:46:32.842370 2025] [:error] [pid 34790:tid 34817] [client 20.119.245.174:5569] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aSS2GL6t_aow_iQiQYAjrQAAAM4"]
[Tue Nov 25 03:46:36.218743 2025] [:error] [pid 34790:tid 34810] [client 20.119.245.174:5574] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aSS2HL6t_aow_iQiQYAjrwAAAMc"]
[Tue Nov 25 03:46:38.295131 2025] [:error] [pid 34790:tid 34824] [client 20.119.245.174:5622] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aSS2Hr6t_aow_iQiQYAjtAAAANU"]
[Tue Nov 25 03:47:04.763077 2025] [:error] [pid 34696:tid 34773] [client 20.119.245.174:1863] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aSS2OHZD4E4cFtkL0rXAUQAAAIo"]
[Tue Nov 25 03:47:05.954297 2025] [:error] [pid 34694:tid 34722] [client 20.119.245.174:1903] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aSS2OVBW7J9m3gnaVKShLwAAAA4"]
[Tue Nov 25 03:47:10.169863 2025] [:error] [pid 34695:tid 34743] [client 20.119.245.174:1739] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aSS2PiwTx_MzUP3xQvkcCgAAAEc"]
[Tue Nov 25 03:47:16.846099 2025] [:error] [pid 34694:tid 34725] [client 20.119.245.174:4167] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aSS2RFBW7J9m3gnaVKShRgAAABE"]
[Tue Nov 25 03:47:32.065648 2025] [:error] [pid 34695:tid 34757] [client 20.119.245.174:4240] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aSS2VCwTx_MzUP3xQvkcEgAAAFU"]
[Tue Nov 25 03:47:47.873766 2025] [:error] [pid 34790:tid 34827] [client 20.119.245.174:4636] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aSS2Y76t_aow_iQiQYAj6QAAANg"]
[Tue Nov 25 03:47:49.218990 2025] [:error] [pid 34695:tid 34754] [client 20.119.245.174:4615] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSS2ZSwTx_MzUP3xQvkcJwAAAFI"]
[Tue Nov 25 03:47:50.371821 2025] [:error] [pid 34695:tid 34756] [client 20.119.245.174:2642] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aSS2ZiwTx_MzUP3xQvkcKAAAAFQ"]
[Tue Nov 25 03:47:55.800391 2025] [:error] [pid 34695:tid 34752] [client 20.119.245.174:5296] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aSS2aywTx_MzUP3xQvkcKgAAAFA"]
[Tue Nov 25 03:47:57.258408 2025] [:error] [pid 34694:tid 34727] [client 20.119.245.174:2939] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aSS2bVBW7J9m3gnaVKShYQAAABM"]
[Tue Nov 25 03:48:07.970138 2025] [:error] [pid 34790:tid 34827] [client 20.119.245.174:4581] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSS2d76t_aow_iQiQYAkIQAAANg"]
[Tue Nov 25 03:48:29.490862 2025] [:error] [pid 34790:tid 34824] [client 20.119.245.174:4856] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSS2jb6t_aow_iQiQYAkRAAAANU"]
[Tue Nov 25 03:48:33.629213 2025] [autoindex:error] [pid 34790:tid 34819] [client 20.119.245.174:5199] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 25 03:48:40.206824 2025] [:error] [pid 34790:tid 34805] [client 20.119.245.174:5199] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSS2mL6t_aow_iQiQYAkcAAAAMI"]
[Tue Nov 25 03:48:42.912215 2025] [:error] [pid 34790:tid 34810] [client 20.119.245.174:3521] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/403.php"] [unique_id "aSS2mr6t_aow_iQiQYAkdgAAAMc"]
[Tue Nov 25 03:48:45.665810 2025] [:error] [pid 34694:tid 34728] [client 20.119.245.174:2836] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/403.php"] [unique_id "aSS2nVBW7J9m3gnaVKShewAAABQ"]
[Tue Nov 25 03:48:47.781414 2025] [:error] [pid 34695:tid 34736] [client 20.119.245.174:4993] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/403.php"] [unique_id "aSS2nywTx_MzUP3xQvkccgAAAEA"]
[Tue Nov 25 03:48:49.301700 2025] [:error] [pid 34695:tid 34747] [client 20.119.245.174:3531] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSS2oSwTx_MzUP3xQvkcdgAAAEs"]
[Tue Nov 25 03:48:51.055912 2025] [:error] [pid 34694:tid 34721] [client 20.119.245.174:3265] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSS2o1BW7J9m3gnaVKShfwAAAA0"]
[Tue Nov 25 03:48:53.084645 2025] [:error] [pid 34790:tid 34827] [client 20.119.245.174:3575] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSS2pb6t_aow_iQiQYAknQAAANg"]
[Tue Nov 25 03:48:54.654412 2025] [:error] [pid 34695:tid 34756] [client 20.119.245.174:4995] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aSS2piwTx_MzUP3xQvkckgAAAFQ"]
[Tue Nov 25 03:48:58.278877 2025] [:error] [pid 34695:tid 34747] [client 20.119.245.174:2714] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSS2qiwTx_MzUP3xQvkclQAAAEs"]
[Tue Nov 25 03:48:59.120563 2025] [:error] [pid 34696:tid 34780] [client 20.119.245.174:2717] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSS2q3ZD4E4cFtkL0rXAzAAAAJE"]
[Tue Nov 25 03:49:01.897606 2025] [:error] [pid 34790:tid 34814] [client 20.119.245.174:3546] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSS2rb6t_aow_iQiQYAkqgAAAMs"]
[Tue Nov 25 03:49:04.002160 2025] [:error] [pid 34790:tid 34810] [client 20.119.245.174:3301] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aSS2sL6t_aow_iQiQYAkrAAAAMc"]
[Tue Nov 25 03:49:05.951960 2025] [:error] [pid 34695:tid 34756] [client 20.119.245.174:2817] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/marijuana.php"] [unique_id "aSS2sSwTx_MzUP3xQvkcoQAAAFQ"]
[Tue Nov 25 03:49:22.917019 2025] [:error] [pid 34696:tid 34779] [client 20.119.245.174:1966] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aSS2wnZD4E4cFtkL0rXA_AAAAJA"]
[Tue Nov 25 03:50:00.084138 2025] [:error] [pid 34790:tid 34815] [client 20.119.245.174:3057] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSS26L6t_aow_iQiQYAk_gAAAMw"]
[Tue Nov 25 03:50:02.236001 2025] [:error] [pid 62683:tid 62813] [client 20.119.245.174:3090] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aSS26gP9Uk3TDol8osyClgAAARE"]
[Tue Nov 25 03:50:05.680071 2025] [:error] [pid 34695:tid 34747] [client 20.119.245.174:5356] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aSS27SwTx_MzUP3xQvkc5gAAAEs"]
[Tue Nov 25 03:50:13.861816 2025] [:error] [pid 34696:tid 34783] [client 20.119.245.174:5372] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aSS29XZD4E4cFtkL0rXBWgAAAJQ"]
[Tue Nov 25 03:50:15.705131 2025] [:error] [pid 34695:tid 34757] [client 20.119.245.174:3846] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aSS29ywTx_MzUP3xQvkc9AAAAFU"]
[Tue Nov 25 03:50:21.055208 2025] [:error] [pid 34790:tid 34810] [client 20.119.245.174:3996] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aSS2_b6t_aow_iQiQYAlFQAAAMc"]
[Tue Nov 25 03:50:23.549849 2025] [:error] [pid 34695:tid 34739] [client 20.119.245.174:1262] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aSS2_ywTx_MzUP3xQvkc9wAAAEM"]
[Tue Nov 25 03:50:31.024196 2025] [:error] [pid 34695:tid 34757] [client 20.119.245.174:3072] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aSS3BywTx_MzUP3xQvkc_gAAAFU"]
[Tue Nov 25 03:50:32.340739 2025] [:error] [pid 34696:tid 34768] [client 20.119.245.174:3106] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aSS3CHZD4E4cFtkL0rXBegAAAIU"]
[Tue Nov 25 03:50:38.695749 2025] [:error] [pid 34694:tid 34722] [client 20.119.245.174:2802] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aSS3DlBW7J9m3gnaVKSh5AAAAA4"]
[Tue Nov 25 03:50:40.356950 2025] [:error] [pid 62683:tid 62810] [client 20.119.245.174:6112] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSS3EAP9Uk3TDol8osyC-AAAAQ4"]
[Tue Nov 25 03:50:44.268328 2025] [:error] [pid 34790:tid 34819] [client 20.119.245.174:3127] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aSS3FL6t_aow_iQiQYAlHgAAANA"]
[Tue Nov 25 03:51:02.461858 2025] [:error] [pid 62683:tid 62809] [client 20.119.245.174:2118] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSS3JgP9Uk3TDol8osyDDAAAAQ0"]
[Tue Nov 25 03:51:04.407405 2025] [:error] [pid 34790:tid 34819] [client 20.119.245.174:5809] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSS3KL6t_aow_iQiQYAlJwAAANA"]
[Tue Nov 25 03:51:05.220771 2025] [:error] [pid 34694:tid 34716] [client 20.119.245.174:5541] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSS3KVBW7J9m3gnaVKSh8AAAAAg"]
[Tue Nov 25 03:51:10.759982 2025] [:error] [pid 34695:tid 34748] [client 20.119.245.174:1943] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/pwnd/as.php"] [unique_id "aSS3LiwTx_MzUP3xQvkdJgAAAEw"]
[Tue Nov 25 03:51:33.166146 2025] [:error] [pid 34790:tid 34818] [client 20.119.245.174:2081] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSS3Rb6t_aow_iQiQYAlRgAAAM8"]
[Tue Nov 25 03:51:36.221305 2025] [:error] [pid 62683:tid 62807] [client 20.119.245.174:2173] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSS3SAP9Uk3TDol8osyDbQAAAQs"]
[Tue Nov 25 03:51:39.434432 2025] [autoindex:error] [pid 34694:tid 34725] [client 20.119.245.174:1579] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 25 03:51:44.411237 2025] [proxy_fcgi:error] [pid 34694:tid 34713] [client 20.119.245.174:1579] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 06:57:13.135130 2025] [:error] [pid 14078:tid 14138] [client 180.110.203.108:44243] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSTiydVXYbb0ii_rVoJhCQAAAIE"]
[Tue Nov 25 07:35:28.228387 2025] [:error] [pid 14078:tid 14161] [client 38.154.97.94:39979] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/sitemap.xml"] [unique_id "aSTrwNVXYbb0ii_rVoJpdwAAAJg"]
[Tue Nov 25 07:35:28.284691 2025] [:error] [pid 14168:tid 14175] [client 38.154.97.94:46781] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSTrwPR-ZDU0QEgAIIuX2AAAAMQ"]
[Tue Nov 25 07:35:28.296012 2025] [:error] [pid 14077:tid 14111] [client 38.154.97.94:42769] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/robots.txt"] [unique_id "aSTrwBG9n7UHEkwDTyhvFgAAAEE"]
[Tue Nov 25 07:35:29.694225 2025] [:error] [pid 14077:tid 14119] [client 38.154.97.94:47533] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/sitemap.xml"] [unique_id "aSTrwRG9n7UHEkwDTyhvGAAAAEk"]
[Tue Nov 25 07:35:29.809349 2025] [:error] [pid 14077:tid 14123] [client 38.154.97.94:46940] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/robots.txt"] [unique_id "aSTrwRG9n7UHEkwDTyhvGQAAAE0"]
[Tue Nov 25 10:03:29.716819 2025] [:error] [pid 1103:tid 1128] [client 129.226.213.145:42818] [client 129.226.213.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSUOcY0LETdqOlq63sRV5AAAAVM"]
[Tue Nov 25 13:17:02.462224 2025] [:error] [pid 14076:tid 14082] [client 123.187.240.242:35792] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSU7znsB4Gz6Qw-pvBukPAAAAAE"]
[Tue Nov 25 16:05:25.930300 2025] [:error] [pid 28609:tid 28637] [client 165.232.35.220:64783] [client 165.232.35.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.232.35.220, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aSVjRSGGdT-nZJVs3x2WeQAAAZM"]
[Tue Nov 25 16:05:28.972935 2025] [:error] [pid 28842:tid 29025] [client 165.232.35.220:59719] [client 165.232.35.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.232.35.220, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aSVjSNNmoaPf6T4-6C1MDwAAA1c"]
[Tue Nov 25 18:39:47.217187 2025] [:error] [pid 28609:tid 28637] [client 54.173.250.15:48778] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSWHcyGGdT-nZJVs3x22EAAAAZM"]
[Tue Nov 25 18:53:02.850840 2025] [:error] [pid 14077:tid 14119] [client 138.199.60.187:42574] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKjhG9n7UHEkwDTyh9zwAAAEk"]
[Tue Nov 25 18:53:03.123813 2025] [:error] [pid 28836:tid 28964] [client 138.199.60.187:42670] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKj5wNRsoxcLQGkTe3LwAAAsk"]
[Tue Nov 25 18:53:03.408527 2025] [:error] [pid 14078:tid 14149] [client 138.199.60.187:42794] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKj9VXYbb0ii_rVoI3pgAAAIw"]
[Tue Nov 25 18:53:03.688922 2025] [:error] [pid 28740:tid 28813] [client 138.199.60.187:42932] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKj1ppQCoYxWW6V0VySgAAAlY"]
[Tue Nov 25 18:53:04.020450 2025] [:error] [pid 14077:tid 14134] [client 138.199.60.187:43056] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKkBG9n7UHEkwDTyh93gAAAFg"]
[Tue Nov 25 23:09:42.118249 2025] [autoindex:error] [pid 43981:tid 43994] [client 139.59.30.253:56107] AH01276: Cannot serve directory /home/rejuvanet/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 00:51:54.767925 2025] [:error] [pid 14078:tid 14151] [client 35.247.120.123:59574] [client 35.247.120.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSXeqtVXYbb0ii_rVoLbpgAAAI4"]
[Wed Nov 26 00:51:55.201904 2025] [:error] [pid 28739:tid 28780] [client 35.247.120.123:57015] [client 35.247.120.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSXeqxxGpKmlkG4FexTz6gAAAhI"]
[Wed Nov 26 00:51:55.574715 2025] [:error] [pid 28739:tid 28767] [client 35.247.120.123:65108] [client 35.247.120.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aSXeqxxGpKmlkG4FexTz7gAAAgU"]
[Wed Nov 26 03:44:55.141326 2025] [:error] [pid 3012:tid 3085] [client 54.173.250.15:59740] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSYHN0fo8Sm1Un9NK6gS-gAAAJA"]
[Wed Nov 26 11:58:25.144461 2025] [:error] [pid 45836:tid 45861] [client 213.21.239.4:42164] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.git/config"] [unique_id "aSZ64ZfrnOGqL-seZAwofAAAAM8"]
[Wed Nov 26 11:58:25.149114 2025] [:error] [pid 10383:tid 10403] [client 213.21.239.4:42230] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/database/.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-ujwAAAdE"]
[Wed Nov 26 11:58:25.149164 2025] [:error] [pid 10383:tid 10402] [client 213.21.239.4:42262] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva/.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-ukAAAAdA"]
[Wed Nov 26 11:58:25.149490 2025] [:error] [pid 34830:tid 34835] [client 213.21.239.4:42260] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backup/.git/config"] [unique_id "aSZ64UukvkWgWN6jCR2UYQAAAAM"]
[Wed Nov 26 11:58:25.154769 2025] [:error] [pid 10383:tid 10387] [client 213.21.239.4:42228] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva../.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-ukQAAAcE"]
[Wed Nov 26 11:58:25.157464 2025] [:error] [pid 34830:tid 34839] [client 213.21.239.4:42292] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/content../.git/config"] [unique_id "aSZ64UukvkWgWN6jCR2UYwAAAAc"]
[Wed Nov 26 11:58:25.158370 2025] [:error] [pid 34830:tid 34846] [client 213.21.239.4:42328] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/application/.git/config"] [unique_id "aSZ64UukvkWgWN6jCR2UZAAAAA4"]
[Wed Nov 26 11:58:25.158500 2025] [:error] [pid 10383:tid 10388] [client 213.21.239.4:42270] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva/static../.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-ukgAAAcI"]
[Wed Nov 26 11:58:25.163003 2025] [:error] [pid 34830:tid 34836] [client 213.21.239.4:42266] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva/;/.git/config"] [unique_id "aSZ64UukvkWgWN6jCR2UZQAAAAQ"]
[Wed Nov 26 11:58:25.163869 2025] [:error] [pid 10383:tid 10405] [client 213.21.239.4:42232] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-ulAAAAdM"]
[Wed Nov 26 11:58:25.164027 2025] [:error] [pid 10383:tid 10400] [client 213.21.239.4:42202] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/dev/.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-ukwAAAc4"]
[Wed Nov 26 11:58:25.164857 2025] [:error] [pid 34744:tid 34811] [client 213.21.239.4:42288] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.git/config"] [unique_id "aSZ64UtgOvVbhyALkTTlmQAAAYg"]
[Wed Nov 26 11:58:25.166110 2025] [:error] [pid 34744:tid 34818] [client 213.21.239.4:42216] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva/.git/config;"] [unique_id "aSZ64UtgOvVbhyALkTTlmgAAAY8"]
[Wed Nov 26 11:58:25.171900 2025] [:error] [pid 10383:tid 10409] [client 213.21.239.4:42286] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva/.git/config;.."] [unique_id "aSZ64a0RJ-zjhOVjD8-ulgAAAdc"]
[Wed Nov 26 11:58:25.173578 2025] [:error] [pid 34830:tid 34854] [client 213.21.239.4:42318] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva/.git/%0Aconfig"] [unique_id "aSZ64UukvkWgWN6jCR2UaAAAABY"]
[Wed Nov 26 11:58:25.173915 2025] [:error] [pid 10383:tid 10391] [client 213.21.239.4:42184] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/developer/.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-ulwAAAcU"]
[Wed Nov 26 11:58:25.174457 2025] [:error] [pid 10383:tid 10390] [client 213.21.239.4:42336] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/css../.git/config"] [unique_id "aSZ64a0RJ-zjhOVjD8-umAAAAcQ"]
[Wed Nov 26 11:58:25.174735 2025] [:error] [pid 34742:tid 34754] [client 213.21.239.4:42342] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/common/.git/config"] [unique_id "aSZ64ZSuLNwpQF_jzAcuNwAAAEY"]
[Wed Nov 26 11:58:25.175731 2025] [:error] [pid 34830:tid 34853] [client 213.21.239.4:42188] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva/..;/.git/config"] [unique_id "aSZ64UukvkWgWN6jCR2UagAAABU"]
[Wed Nov 26 11:58:25.176995 2025] [:error] [pid 34744:tid 34806] [client 213.21.239.4:42346] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/assets../.git/config"] [unique_id "aSZ64UtgOvVbhyALkTTlmwAAAYM"]
[Wed Nov 26 11:58:27.627494 2025] [:error] [pid 34744:tid 34816] [client 213.21.239.4:42636] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/static../.git/config"] [unique_id "aSZ640tgOvVbhyALkTTlnwAAAY0"]
[Wed Nov 26 11:58:27.629482 2025] [:error] [pid 35540:tid 35549] [client 213.21.239.4:42638] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/%0Aconfig"] [unique_id "aSZ648GrIq2A6SZSnkJcaQAAAIM"]
[Wed Nov 26 11:58:27.630828 2025] [:error] [pid 35540:tid 35556] [client 213.21.239.4:42700] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/;/.git/config"] [unique_id "aSZ648GrIq2A6SZSnkJcagAAAIo"]
[Wed Nov 26 11:58:27.632102 2025] [:error] [pid 34742:tid 34755] [client 213.21.239.4:42586] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/..;/.git/config"] [unique_id "aSZ645SuLNwpQF_jzAcuPAAAAEc"]
[Wed Nov 26 11:58:27.634387 2025] [:error] [pid 35540:tid 35564] [client 213.21.239.4:42610] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/config;.."] [unique_id "aSZ648GrIq2A6SZSnkJcawAAAJI"]
[Wed Nov 26 11:58:27.635018 2025] [:error] [pid 35540:tid 35550] [client 213.21.239.4:42580] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au../.git/config"] [unique_id "aSZ648GrIq2A6SZSnkJcbAAAAIQ"]
[Wed Nov 26 11:58:27.635170 2025] [:error] [pid 35540:tid 35554] [client 213.21.239.4:42724] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/%0Aconfig"] [unique_id "aSZ648GrIq2A6SZSnkJcbQAAAIg"]
[Wed Nov 26 11:58:27.640298 2025] [:error] [pid 35540:tid 35565] [client 213.21.239.4:42596] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/config"] [unique_id "aSZ648GrIq2A6SZSnkJcbgAAAJM"]
[Wed Nov 26 11:58:27.643317 2025] [:error] [pid 35540:tid 35567] [client 213.21.239.4:42624] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/;/.git/config"] [unique_id "aSZ648GrIq2A6SZSnkJcbwAAAJU"]
[Wed Nov 26 11:58:27.643774 2025] [:error] [pid 35540:tid 35561] [client 213.21.239.4:42668] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config;.."] [unique_id "aSZ648GrIq2A6SZSnkJccAAAAI8"]
[Wed Nov 26 11:58:27.644211 2025] [:error] [pid 34742:tid 34760] [client 213.21.239.4:42730] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/images../.git/config"] [unique_id "aSZ645SuLNwpQF_jzAcuPQAAAEw"]
[Wed Nov 26 11:58:27.646850 2025] [:error] [pid 34742:tid 34759] [client 213.21.239.4:42690] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/img../.git/config"] [unique_id "aSZ645SuLNwpQF_jzAcuPgAAAEs"]
[Wed Nov 26 11:58:27.651991 2025] [:error] [pid 34742:tid 34770] [client 213.21.239.4:42714] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/git/.git/config"] [unique_id "aSZ645SuLNwpQF_jzAcuPwAAAFY"]
[Wed Nov 26 11:58:27.653428 2025] [:error] [pid 35540:tid 35546] [client 213.21.239.4:42642] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/..;/.git/config"] [unique_id "aSZ648GrIq2A6SZSnkJccwAAAIA"]
[Wed Nov 26 11:58:27.653744 2025] [:error] [pid 34742:tid 34768] [client 213.21.239.4:42602] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/config;"] [unique_id "aSZ645SuLNwpQF_jzAcuQAAAAFQ"]
[Wed Nov 26 11:58:27.658238 2025] [:error] [pid 35540:tid 35570] [client 213.21.239.4:42654] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config;"] [unique_id "aSZ648GrIq2A6SZSnkJcdAAAAJg"]
[Wed Nov 26 11:58:27.659175 2025] [:error] [pid 34742:tid 34756] [client 213.21.239.4:42650] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSZ645SuLNwpQF_jzAcuQQAAAEg"]
[Wed Nov 26 11:58:29.629264 2025] [:error] [pid 35540:tid 35557] [client 213.21.239.4:42904] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/js../.git/config"] [unique_id "aSZ65cGrIq2A6SZSnkJcfwAAAIs"]
[Wed Nov 26 11:58:30.605818 2025] [:error] [pid 35540:tid 35547] [client 213.21.239.4:42928] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/%0Aconfig"] [unique_id "aSZ65sGrIq2A6SZSnkJcgQAAAIE"]
[Wed Nov 26 11:58:30.610945 2025] [:error] [pid 45836:tid 45849] [client 213.21.239.4:42974] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/m/.git/config"] [unique_id "aSZ65pfrnOGqL-seZAwohgAAAMM"]
[Wed Nov 26 11:58:30.615248 2025] [:error] [pid 34742:tid 34755] [client 213.21.239.4:42968] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/new/.git/config"] [unique_id "aSZ65pSuLNwpQF_jzAcuRQAAAEc"]
[Wed Nov 26 11:58:30.618200 2025] [:error] [pid 34742:tid 34759] [client 213.21.239.4:42992] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/config"] [unique_id "aSZ65pSuLNwpQF_jzAcuRgAAAEs"]
[Wed Nov 26 11:58:30.620795 2025] [:error] [pid 45836:tid 45869] [client 213.21.239.4:42938] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/static../.git/config"] [unique_id "aSZ65pfrnOGqL-seZAwoiAAAANc"]
[Wed Nov 26 11:58:30.621177 2025] [:error] [pid 45836:tid 45862] [client 213.21.239.4:42994] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/prod/.git/config"] [unique_id "aSZ65pfrnOGqL-seZAwoiQAAANA"]
[Wed Nov 26 11:58:30.621783 2025] [:error] [pid 34742:tid 34760] [client 213.21.239.4:43014] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/qa/.git/config"] [unique_id "aSZ65pSuLNwpQF_jzAcuRwAAAEw"]
[Wed Nov 26 11:58:30.622109 2025] [:error] [pid 45836:tid 45867] [client 213.21.239.4:43004] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/config;"] [unique_id "aSZ65pfrnOGqL-seZAwoigAAANU"]
[Wed Nov 26 11:58:30.623475 2025] [:error] [pid 34742:tid 34756] [client 213.21.239.4:43076] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/..;/.git/config"] [unique_id "aSZ65pSuLNwpQF_jzAcuSAAAAEg"]
[Wed Nov 26 11:58:30.625965 2025] [:error] [pid 34743:tid 34797] [client 213.21.239.4:42910] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/live/.git/config"] [unique_id "aSZ65gvyX7Q5oU7_mByJQwAAAVU"]
[Wed Nov 26 11:58:30.626414 2025] [:error] [pid 34742:tid 34770] [client 213.21.239.4:42948] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/message-api/.git/config"] [unique_id "aSZ65pSuLNwpQF_jzAcuSQAAAFY"]
[Wed Nov 26 11:58:30.626506 2025] [:error] [pid 34742:tid 34768] [client 213.21.239.4:43008] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/.git/config;.."] [unique_id "aSZ65pSuLNwpQF_jzAcuSgAAAFQ"]
[Wed Nov 26 11:58:30.630317 2025] [:error] [pid 34742:tid 34753] [client 213.21.239.4:43016] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au/;/.git/config"] [unique_id "aSZ65pSuLNwpQF_jzAcuSwAAAEU"]
[Wed Nov 26 11:58:30.636855 2025] [:error] [pid 34743:tid 34786] [client 213.21.239.4:43062] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/rejuva.au../.git/config"] [unique_id "aSZ65gvyX7Q5oU7_mByJRQAAAUo"]
[Wed Nov 26 11:58:30.637948 2025] [:error] [pid 45836:tid 45851] [client 213.21.239.4:42918] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/lib../.git/config"] [unique_id "aSZ65pfrnOGqL-seZAwoiwAAAMU"]
[Wed Nov 26 11:58:30.645369 2025] [:error] [pid 45836:tid 45853] [client 213.21.239.4:43026] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.git/config"] [unique_id "aSZ65pfrnOGqL-seZAwojAAAAMc"]
[Wed Nov 26 11:58:30.649943 2025] [core:error] [pid 34743:tid 34794] [client 213.21.239.4:43092] AH10244: invalid URI path (/../config)
[Wed Nov 26 11:58:32.625604 2025] [:error] [pid 35540:tid 35554] [client 213.21.239.4:48604] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/%0Aconfig"] [unique_id "aSZ66MGrIq2A6SZSnkJchwAAAIg"]
[Wed Nov 26 11:58:32.645806 2025] [:error] [pid 34742:tid 34759] [client 213.21.239.4:48632] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/../.git/config"] [unique_id "aSZ66JSuLNwpQF_jzAcuTQAAAEs"]
[Wed Nov 26 11:58:32.663441 2025] [:error] [pid 35540:tid 35546] [client 213.21.239.4:48652] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/..;/.git/config"] [unique_id "aSZ66MGrIq2A6SZSnkJciQAAAIA"]
[Wed Nov 26 11:58:33.605882 2025] [:error] [pid 34743:tid 34792] [client 213.21.239.4:48668] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/uat/.git/config"] [unique_id "aSZ66QvyX7Q5oU7_mByJUAAAAVA"]
[Wed Nov 26 11:58:33.606629 2025] [:error] [pid 34742:tid 34770] [client 213.21.239.4:48752] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config;.."] [unique_id "aSZ66ZSuLNwpQF_jzAcuTgAAAFY"]
[Wed Nov 26 11:58:33.608278 2025] [:error] [pid 34743:tid 34780] [client 213.21.239.4:48772] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/;/.git/config"] [unique_id "aSZ66QvyX7Q5oU7_mByJUQAAAUQ"]
[Wed Nov 26 11:58:33.613641 2025] [:error] [pid 45901:tid 45927] [client 213.21.239.4:48702] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/.git/config"] [unique_id "aSZ66SunQ1SpfPRNrtyQsgAAARg"]
[Wed Nov 26 11:58:33.614509 2025] [:error] [pid 34744:tid 34814] [client 213.21.239.4:48684] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/web/.git/config"] [unique_id "aSZ66UtgOvVbhyALkTTlpgAAAYs"]
[Wed Nov 26 11:58:33.614932 2025] [:error] [pid 34743:tid 34776] [client 213.21.239.4:48774] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/static../.git/config"] [unique_id "aSZ66QvyX7Q5oU7_mByJUgAAAUA"]
[Wed Nov 26 11:58:33.616542 2025] [:error] [pid 34743:tid 34787] [client 213.21.239.4:48710] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/plugins/.git/config"] [unique_id "aSZ66QvyX7Q5oU7_mByJUwAAAUs"]
[Wed Nov 26 11:58:33.618654 2025] [:error] [pid 34742:tid 34753] [client 213.21.239.4:48732] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config;"] [unique_id "aSZ66ZSuLNwpQF_jzAcuTwAAAEU"]
[Wed Nov 26 11:58:33.666713 2025] [:error] [pid 45901:tid 45911] [client 213.21.239.4:48792] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSZ66SunQ1SpfPRNrtyQswAAAQg"]
[Wed Nov 26 11:58:33.666988 2025] [:error] [pid 34742:tid 34763] [client 213.21.239.4:48786] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/staging/.git/config"] [unique_id "aSZ66ZSuLNwpQF_jzAcuUQAAAE8"]
[Wed Nov 26 11:58:33.669705 2025] [:error] [pid 34744:tid 34826] [client 213.21.239.4:48788] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/static../.git/config"] [unique_id "aSZ66UtgOvVbhyALkTTlqQAAAZc"]
[Wed Nov 26 11:58:33.702212 2025] [:error] [pid 34742:tid 34766] [client 213.21.239.4:48716] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-content/themes/.git/config"] [unique_id "aSZ66ZSuLNwpQF_jzAcuUgAAAFI"]
[Wed Nov 26 14:08:19.882420 2025] [:error] [pid 45836:tid 45859] [client 139.59.30.253:51788] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aSaZU5frnOGqL-seZAxESAAAAM0"], referer: binance.com
[Wed Nov 26 15:11:29.361115 2025] [:error] [pid 34744:tid 34824] [client 182.44.8.254:35459] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSaoIUtgOvVbhyALkTQe7gAAAZU"]
[Wed Nov 26 17:04:46.390843 2025] [:error] [pid 45769:tid 45779] [client 167.99.182.39:44056] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aSbCrldG5Eht9c3yy4MCywAAAcc"]
[Wed Nov 26 17:04:47.039808 2025] [:error] [pid 46443:tid 46448] [client 167.99.182.39:44072] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSbCr8LmDsnHrj-QFB-1HAAAAEM"]
[Wed Nov 26 17:04:47.688483 2025] [:error] [pid 6471:tid 6488] [client 167.99.182.39:44082] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aSbCr-h3Z9TZLlRuTiNmTAAAAI4"]
[Wed Nov 26 17:04:48.337415 2025] [:error] [pid 6471:tid 6482] [client 167.99.182.39:44090] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aSbCsOh3Z9TZLlRuTiNmTgAAAIg"]
[Wed Nov 26 17:04:48.986306 2025] [:error] [pid 45685:tid 45752] [client 167.99.182.39:44100] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aSbCsFj3f_NRdgU0DQ65WAAAAQo"]
[Wed Nov 26 17:04:49.636914 2025] [:error] [pid 45684:tid 45725] [client 167.99.182.39:44116] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aSbCsfg5LMxwI4-PD1cU7gAAAAo"]
[Wed Nov 26 17:04:50.298643 2025] [:error] [pid 45685:tid 45753] [client 167.99.182.39:44126] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aSbCslj3f_NRdgU0DQ65WQAAAQs"]
[Wed Nov 26 17:04:50.947186 2025] [:error] [pid 45769:tid 45773] [client 167.99.182.39:44142] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSbCsldG5Eht9c3yy4MCzwAAAcE"]
[Wed Nov 26 17:04:51.595932 2025] [:error] [pid 45684:tid 45733] [client 167.99.182.39:44150] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aSbCs_g5LMxwI4-PD1cU8AAAABI"]
[Wed Nov 26 17:04:52.244227 2025] [:error] [pid 45684:tid 45738] [client 167.99.182.39:44162] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aSbCtPg5LMxwI4-PD1cU8gAAABc"]
[Wed Nov 26 17:04:52.892941 2025] [:error] [pid 45769:tid 45793] [client 167.99.182.39:44164] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_all_dbs"] [unique_id "aSbCtFdG5Eht9c3yy4MC0AAAAdU"]
[Wed Nov 26 17:04:53.542476 2025] [:error] [pid 45769:tid 45774] [client 167.99.182.39:44178] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aSbCtVdG5Eht9c3yy4MC0wAAAcI"]
[Wed Nov 26 17:04:54.190767 2025] [:error] [pid 45684:tid 45734] [client 167.99.182.39:44194] [client 167.99.182.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aSbCtvg5LMxwI4-PD1cU9AAAABM"]
[Wed Nov 26 17:04:54.839359 2025] [:error] [pid 45684:tid 45716] [client 167.99.182.39:44200] [client 167.99.182.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aSbCtvg5LMxwI4-PD1cU9wAAAAE"]
[Wed Nov 26 17:04:55.487284 2025] [:error] [pid 45684:tid 45722] [client 167.99.182.39:44212] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSbCt_g5LMxwI4-PD1cU-gAAAAc"]
[Wed Nov 26 17:04:56.134520 2025] [:error] [pid 45685:tid 45755] [client 167.99.182.39:44222] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aSbCuFj3f_NRdgU0DQ65XAAAAQ0"]
[Wed Nov 26 17:04:56.782442 2025] [:error] [pid 45769:tid 45776] [client 167.99.182.39:46254] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aSbCuFdG5Eht9c3yy4MC1wAAAcQ"]
[Wed Nov 26 17:04:57.430349 2025] [:error] [pid 45769:tid 45787] [client 167.99.182.39:46268] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aSbCuVdG5Eht9c3yy4MC2QAAAc8"]
[Wed Nov 26 17:04:58.077043 2025] [:error] [pid 45769:tid 45790] [client 167.99.182.39:46272] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSbCuldG5Eht9c3yy4MC3gAAAdI"]
[Wed Nov 26 23:59:54.863409 2025] [:error] [pid 46443:tid 46448] [client 216.126.239.203:55458] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aScj-sLmDsnHrj-QFB819gAAAEM"]
[Thu Nov 27 00:56:00.043025 2025] [:error] [pid 24814:tid 25083] [client 103.77.107.57:58971] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "aScxIAPn1NMGCdo6RsihMQAAAUg"]
[Thu Nov 27 00:56:00.303385 2025] [:error] [pid 25180:tid 25202] [client 103.77.107.57:57593] [client 103.77.107.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aScxIL-owhtiwMHXYlzQhQAAAZQ"]
[Thu Nov 27 01:25:03.539156 2025] [:error] [pid 54723:tid 54741] [client 43.155.27.244:49838] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aSc37w2CEg7QoyDosdL6sAAAAAs"]
[Thu Nov 27 04:18:13.697424 2025] [:error] [pid 6201:tid 6209] [client 58.49.233.126:48625] [client 58.49.233.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aSdghTkSJeRkIQGTjzwZ0wAAAAQ"]
[Thu Nov 27 05:10:47.395426 2025] [:error] [pid 6202:tid 6234] [client 34.50.166.104:56640] [client 34.50.166.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aSds19Ja7NTP0XPyZ6lrPgAAAEE"]
[Fri Dec 12 06:53:42.048858 2025] [:error] [pid 27950:tid 27966] [client 170.106.147.63:55328] [client 170.106.147.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aTtLdoVLRvkrdsSc1F3VYwAAAU4"]
[Fri Dec 12 11:32:11.764228 2025] [:error] [pid 26519:tid 26537] [client 117.33.163.216:33466] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aTuMu88TRgSGOeWqEheTHAAAAA4"]
[Fri Dec 12 17:59:00.036006 2025] [:error] [pid 55760:tid 55769] [client 182.42.105.144:39092] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aTvnZFObDQlftFDyGazgZgAAAYc"]
[Fri Dec 12 20:31:01.261511 2025] [:error] [pid 26521:tid 26593] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Fri Dec 12 20:31:01.356427 2025] [:error] [pid 26521:tid 26599] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/vbbn.php
[Fri Dec 12 20:31:01.447995 2025] [:error] [pid 26521:tid 26591] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Fri Dec 12 20:31:01.540307 2025] [:error] [pid 26521:tid 26590] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/fz.php
[Fri Dec 12 20:31:01.633272 2025] [:error] [pid 26521:tid 26602] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/wl.php
[Fri Dec 12 20:31:01.725731 2025] [:error] [pid 26521:tid 26589] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/sang.php
[Fri Dec 12 20:31:01.820838 2025] [:error] [pid 26521:tid 26600] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/0o0.php
[Fri Dec 12 20:31:03.431679 2025] [:error] [pid 26521:tid 26600] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/zxl.php
[Fri Dec 12 20:31:03.522672 2025] [:error] [pid 26521:tid 26585] [client 4.194.202.71:16128] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Dec 12 20:31:03.700803 2025] [:error] [pid 26521:tid 26587] [client 4.194.202.71:16128] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class19.php"] [unique_id "aTwLB5dhcAPU617AKTB1pAAAAIg"]
[Fri Dec 12 20:31:03.875467 2025] [:error] [pid 26520:tid 26573] [client 4.194.202.71:16249] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class19.php"] [unique_id "aTwLB0G_frlY5vNXu_D19wAAAFU"]
[Fri Dec 12 20:31:04.049946 2025] [:error] [pid 26607:tid 26619] [client 4.194.202.71:16151] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class19.php"] [unique_id "aTwLCMb_b0tOEWTL2KmWkwAAAMo"]
[Fri Dec 12 20:31:04.228326 2025] [:error] [pid 55760:tid 55762] [client 4.194.202.71:16237] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class19.php"] [unique_id "aTwLCFObDQlftFDyGawJbgAAAYA"]
[Fri Dec 12 20:31:04.428435 2025] [:error] [pid 26521:tid 26593] [client 4.194.202.71:16251] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aTwLCJdhcAPU617AKTB1pQAAAI4"]
[Fri Dec 12 20:31:04.620983 2025] [:error] [pid 55760:tid 55775] [client 4.194.202.71:16254] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aTwLCFObDQlftFDyGawJbwAAAY0"]
[Fri Dec 12 20:31:04.800695 2025] [:error] [pid 55760:tid 55778] [client 4.194.202.71:16216] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aTwLCFObDQlftFDyGawJcAAAAZA"]
[Fri Dec 12 20:31:04.982697 2025] [:error] [pid 26519:tid 26535] [client 4.194.202.71:16241] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aTwLCM8TRgSGOeWqEhfusgAAAAw"]
[Fri Dec 12 20:31:05.157823 2025] [:error] [pid 55760:tid 55767] [client 4.194.202.71:16255] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLCVObDQlftFDyGawJcgAAAYU"]
[Fri Dec 12 20:31:05.351706 2025] [:error] [pid 26521:tid 26590] [client 4.194.202.71:16239] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLCZdhcAPU617AKTB1pwAAAIs"]
[Fri Dec 12 20:31:05.566708 2025] [:error] [pid 26521:tid 26579] [client 4.194.202.71:16150] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLCZdhcAPU617AKTB1qQAAAIA"]
[Fri Dec 12 20:31:05.742397 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:16247] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLCZdhcAPU617AKTB1qgAAAIc"]
[Fri Dec 12 20:31:05.966366 2025] [:error] [pid 55760:tid 55780] [client 4.194.202.71:16217] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/randkeyword.php"] [unique_id "aTwLCVObDQlftFDyGawJcwAAAZI"]
[Fri Dec 12 20:31:06.145617 2025] [:error] [pid 26521:tid 26596] [client 4.194.202.71:16140] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/randkeyword.php"] [unique_id "aTwLCpdhcAPU617AKTB1rwAAAJE"]
[Fri Dec 12 20:31:06.325062 2025] [:error] [pid 26519:tid 26537] [client 4.194.202.71:16142] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/randkeyword.php"] [unique_id "aTwLCs8TRgSGOeWqEhfutAAAAA4"]
[Fri Dec 12 20:31:06.515642 2025] [:error] [pid 26521:tid 26588] [client 4.194.202.71:16193] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/randkeyword.php"] [unique_id "aTwLCpdhcAPU617AKTB1sgAAAIk"]
[Fri Dec 12 20:31:06.690306 2025] [:error] [pid 26521:tid 26593] [client 4.194.202.71:16221] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fwe.php"] [unique_id "aTwLCpdhcAPU617AKTB1tAAAAI4"]
[Fri Dec 12 20:31:06.864360 2025] [:error] [pid 26519:tid 26523] [client 4.194.202.71:16155] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fwe.php"] [unique_id "aTwLCs8TRgSGOeWqEhfutQAAAAA"]
[Fri Dec 12 20:31:07.060156 2025] [:error] [pid 55760:tid 55784] [client 4.194.202.71:16197] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fwe.php"] [unique_id "aTwLC1ObDQlftFDyGawJdAAAAZY"]
[Fri Dec 12 20:31:07.238147 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:16203] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fwe.php"] [unique_id "aTwLC5dhcAPU617AKTB1twAAAJA"]
[Fri Dec 12 20:31:07.415575 2025] [:error] [pid 55760:tid 55764] [client 4.194.202.71:16236] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aTwLC1ObDQlftFDyGawJdgAAAYI"]
[Fri Dec 12 20:31:07.591715 2025] [:error] [pid 26521:tid 26590] [client 4.194.202.71:16248] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aTwLC5dhcAPU617AKTB1uQAAAIs"]
[Fri Dec 12 20:31:07.776925 2025] [:error] [pid 26520:tid 26571] [client 4.194.202.71:16149] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aTwLC0G_frlY5vNXu_D1-QAAAFM"]
[Fri Dec 12 20:31:07.957457 2025] [:error] [pid 26519:tid 26538] [client 4.194.202.71:16243] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aTwLC88TRgSGOeWqEhfuugAAAA8"]
[Fri Dec 12 20:31:08.141519 2025] [:error] [pid 55760:tid 55776] [client 4.194.202.71:16143] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aTwLDFObDQlftFDyGawJdwAAAY4"]
[Fri Dec 12 20:31:08.318927 2025] [:error] [pid 55760:tid 55763] [client 4.194.202.71:16194] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aTwLDFObDQlftFDyGawJeAAAAYE"]
[Fri Dec 12 20:31:08.513119 2025] [:error] [pid 26519:tid 26524] [client 4.194.202.71:16154] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aTwLDM8TRgSGOeWqEhfuvAAAAAE"]
[Fri Dec 12 20:31:08.714704 2025] [:error] [pid 26607:tid 26626] [client 4.194.202.71:16204] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aTwLDMb_b0tOEWTL2KmWlgAAANE"]
[Fri Dec 12 20:31:08.891349 2025] [:error] [pid 55760:tid 55782] [client 4.194.202.71:16161] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aTwLDFObDQlftFDyGawJeQAAAZQ"]
[Fri Dec 12 20:31:09.074423 2025] [:error] [pid 55760:tid 55783] [client 4.194.202.71:16141] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aTwLDVObDQlftFDyGawJewAAAZU"]
[Fri Dec 12 20:31:09.250538 2025] [:error] [pid 55760:tid 55777] [client 4.194.202.71:9162] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aTwLDVObDQlftFDyGawJfAAAAY8"]
[Fri Dec 12 20:31:09.442493 2025] [:error] [pid 26607:tid 26611] [client 4.194.202.71:16228] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aTwLDcb_b0tOEWTL2KmWlwAAAMI"]
[Fri Dec 12 20:31:09.649328 2025] [:error] [pid 26520:tid 26556] [client 4.194.202.71:16171] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aTwLDUG_frlY5vNXu_D1-gAAAEQ"]
[Fri Dec 12 20:31:09.831159 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:16170] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aTwLDZdhcAPU617AKTB1xAAAAIU"]
[Fri Dec 12 20:31:10.006730 2025] [:error] [pid 26521:tid 26593] [client 4.194.202.71:16145] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aTwLDpdhcAPU617AKTB1xQAAAI4"]
[Fri Dec 12 20:31:10.184037 2025] [:error] [pid 26520:tid 26554] [client 4.194.202.71:16218] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aTwLDkG_frlY5vNXu_D1-wAAAEI"]
[Fri Dec 12 20:31:10.358291 2025] [:error] [pid 55760:tid 55786] [client 4.194.202.71:16234] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aTwLDlObDQlftFDyGawJgQAAAZg"]
[Fri Dec 12 20:31:10.543903 2025] [:error] [pid 26521:tid 26580] [client 4.194.202.71:16159] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aTwLDpdhcAPU617AKTB1xwAAAIE"]
[Fri Dec 12 20:31:10.725047 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:9158] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aTwLDpdhcAPU617AKTB1ygAAAIc"]
[Fri Dec 12 20:31:10.898842 2025] [:error] [pid 55760:tid 55781] [client 4.194.202.71:16152] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aTwLDlObDQlftFDyGawJggAAAZM"]
[Fri Dec 12 20:31:11.078687 2025] [:error] [pid 26521:tid 26599] [client 4.194.202.71:16220] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aTwLD5dhcAPU617AKTB10QAAAJQ"]
[Fri Dec 12 20:31:11.253803 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:9155] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aTwLD5dhcAPU617AKTB11AAAAJA"]
[Fri Dec 12 20:31:11.431932 2025] [:error] [pid 26519:tid 26537] [client 4.194.202.71:16209] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aTwLD88TRgSGOeWqEhfuwwAAAA4"]
[Fri Dec 12 20:31:11.607145 2025] [:error] [pid 26521:tid 26598] [client 4.194.202.71:16240] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aTwLD5dhcAPU617AKTB11wAAAJM"]
[Fri Dec 12 20:31:11.797340 2025] [:error] [pid 27950:tid 27976] [client 4.194.202.71:16202] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aTwLD4VLRvkrdsSc1F2YBwAAAVg"]
[Fri Dec 12 20:31:11.975630 2025] [:error] [pid 27950:tid 27972] [client 4.194.202.71:16235] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aTwLD4VLRvkrdsSc1F2YCQAAAVQ"]
[Fri Dec 12 20:31:12.152224 2025] [:error] [pid 26607:tid 26621] [client 4.194.202.71:16160] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aTwLEMb_b0tOEWTL2KmWnQAAAMw"]
[Fri Dec 12 20:31:12.326744 2025] [:error] [pid 55760:tid 55766] [client 4.194.202.71:16207] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aTwLEFObDQlftFDyGawJgwAAAYQ"]
[Fri Dec 12 20:31:12.501760 2025] [:error] [pid 26607:tid 26609] [client 4.194.202.71:9194] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aTwLEMb_b0tOEWTL2KmWoAAAAMA"]
[Fri Dec 12 20:31:12.699119 2025] [:error] [pid 26607:tid 26632] [client 4.194.202.71:16225] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aTwLEMb_b0tOEWTL2KmWogAAANc"]
[Fri Dec 12 20:31:12.883788 2025] [:error] [pid 27950:tid 27962] [client 4.194.202.71:16158] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aTwLEIVLRvkrdsSc1F2YCwAAAUo"]
[Fri Dec 12 20:31:13.063719 2025] [:error] [pid 26519:tid 26523] [client 4.194.202.71:9181] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aTwLEc8TRgSGOeWqEhfuxAAAAAA"]
[Fri Dec 12 20:31:13.243320 2025] [:error] [pid 26607:tid 26616] [client 4.194.202.71:16231] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aTwLEcb_b0tOEWTL2KmWpQAAAMc"]
[Fri Dec 12 20:31:13.417844 2025] [:error] [pid 26607:tid 26625] [client 4.194.202.71:16131] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aTwLEcb_b0tOEWTL2KmWpwAAANA"]
[Fri Dec 12 20:31:13.597992 2025] [:error] [pid 60649:tid 60673] [client 4.194.202.71:16242] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aTwLEVOcUGKU3sgfHP_zcAAAARU"]
[Fri Dec 12 20:31:13.778732 2025] [:error] [pid 55760:tid 55778] [client 4.194.202.71:9192] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aTwLEVObDQlftFDyGawJhQAAAZA"]
[Fri Dec 12 20:31:13.954251 2025] [:error] [pid 27950:tid 27960] [client 4.194.202.71:16210] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aTwLEYVLRvkrdsSc1F2YDgAAAUg"]
[Fri Dec 12 20:31:14.148996 2025] [:error] [pid 55760:tid 55767] [client 4.194.202.71:16232] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aTwLElObDQlftFDyGawJhwAAAYU"]
[Fri Dec 12 20:31:14.323414 2025] [:error] [pid 27950:tid 27954] [client 4.194.202.71:16189] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aTwLEoVLRvkrdsSc1F2YDwAAAUI"]
[Fri Dec 12 20:31:14.497959 2025] [:error] [pid 26520:tid 26569] [client 4.194.202.71:9157] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aTwLEkG_frlY5vNXu_D2AwAAAFE"]
[Fri Dec 12 20:31:14.681923 2025] [:error] [pid 26520:tid 26570] [client 4.194.202.71:16200] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aTwLEkG_frlY5vNXu_D2BAAAAFI"]
[Fri Dec 12 20:31:14.856288 2025] [:error] [pid 60649:tid 60661] [client 4.194.202.71:16178] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aTwLElOcUGKU3sgfHP_zcQAAAQk"]
[Fri Dec 12 20:31:15.030842 2025] [:error] [pid 26607:tid 26627] [client 4.194.202.71:16174] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aTwLE8b_b0tOEWTL2KmWqgAAANI"]
[Fri Dec 12 20:31:15.206199 2025] [:error] [pid 26519:tid 26540] [client 4.194.202.71:16253] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aTwLE88TRgSGOeWqEhfuxQAAABE"]
[Fri Dec 12 20:31:15.380684 2025] [:error] [pid 27950:tid 27963] [client 4.194.202.71:16224] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aTwLE4VLRvkrdsSc1F2YEQAAAUs"]
[Fri Dec 12 20:31:15.572455 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:16134] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aTwLE5dhcAPU617AKTB12AAAAJA"]
[Fri Dec 12 20:31:15.750079 2025] [:error] [pid 27950:tid 27967] [client 4.194.202.71:16139] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aTwLE4VLRvkrdsSc1F2YEgAAAU8"]
[Fri Dec 12 20:31:15.930899 2025] [:error] [pid 26521:tid 26587] [client 4.194.202.71:9184] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aTwLE5dhcAPU617AKTB12wAAAIg"]
[Fri Dec 12 20:31:16.106107 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:16212] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aTwLFMb_b0tOEWTL2KmWrQAAAM4"]
[Fri Dec 12 20:31:16.283431 2025] [:error] [pid 26607:tid 26632] [client 4.194.202.71:9099] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aTwLFMb_b0tOEWTL2KmWrgAAANc"]
[Fri Dec 12 20:31:16.458220 2025] [:error] [pid 55760:tid 55768] [client 4.194.202.71:9167] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aTwLFFObDQlftFDyGawJiwAAAYY"]
[Fri Dec 12 20:31:16.632370 2025] [:error] [pid 55760:tid 55764] [client 4.194.202.71:16187] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aTwLFFObDQlftFDyGawJjAAAAYI"]
[Fri Dec 12 20:31:16.807610 2025] [:error] [pid 26521:tid 26600] [client 4.194.202.71:16175] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLFJdhcAPU617AKTB13gAAAJU"]
[Fri Dec 12 20:31:16.983801 2025] [:error] [pid 26607:tid 26619] [client 4.194.202.71:16195] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLFMb_b0tOEWTL2KmWsAAAAMo"]
[Fri Dec 12 20:31:17.159129 2025] [:error] [pid 55760:tid 55763] [client 4.194.202.71:16165] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLFVObDQlftFDyGawJjgAAAYE"]
[Fri Dec 12 20:31:17.334319 2025] [:error] [pid 26520:tid 26576] [client 4.194.202.71:16144] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLFUG_frlY5vNXu_D2CAAAAFg"]
[Fri Dec 12 20:31:17.511119 2025] [:error] [pid 27950:tid 27973] [client 4.194.202.71:16173] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aTwLFYVLRvkrdsSc1F2YFAAAAVU"]
[Fri Dec 12 20:31:17.685338 2025] [:error] [pid 27950:tid 27975] [client 4.194.202.71:16148] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aTwLFYVLRvkrdsSc1F2YFgAAAVc"]
[Fri Dec 12 20:31:17.886643 2025] [:error] [pid 55760:tid 55773] [client 4.194.202.71:16246] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aTwLFVObDQlftFDyGawJkAAAAYs"]
[Fri Dec 12 20:31:18.065080 2025] [:error] [pid 55760:tid 55774] [client 4.194.202.71:16226] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aTwLFlObDQlftFDyGawJkwAAAYw"]
[Fri Dec 12 20:31:18.251852 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:16156] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTwLFpdhcAPU617AKTB13wAAAIU"]
[Fri Dec 12 20:31:18.449342 2025] [:error] [pid 55760:tid 55786] [client 4.194.202.71:16133] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTwLFlObDQlftFDyGawJlAAAAZg"]
[Fri Dec 12 20:31:18.625066 2025] [:error] [pid 26607:tid 26628] [client 4.194.202.71:16176] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTwLFsb_b0tOEWTL2KmWsQAAANM"]
[Fri Dec 12 20:31:18.811061 2025] [:error] [pid 27950:tid 27955] [client 4.194.202.71:16186] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aTwLFoVLRvkrdsSc1F2YGQAAAUM"]
[Fri Dec 12 20:31:18.992921 2025] [:error] [pid 26521:tid 26594] [client 4.194.202.71:16137] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTwLFpdhcAPU617AKTB14QAAAI8"]
[Fri Dec 12 20:31:19.169839 2025] [:error] [pid 26521:tid 26602] [client 4.194.202.71:16219] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTwLF5dhcAPU617AKTB14gAAAJc"]
[Fri Dec 12 20:31:19.343206 2025] [:error] [pid 26521:tid 26599] [client 4.194.202.71:16179] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTwLF5dhcAPU617AKTB15AAAAJQ"]
[Fri Dec 12 20:31:19.550938 2025] [:error] [pid 26519:tid 26545] [client 4.194.202.71:9191] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aTwLF88TRgSGOeWqEhfuxgAAABY"]
[Fri Dec 12 20:31:19.726881 2025] [:error] [pid 26607:tid 26614] [client 4.194.202.71:9170] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aTwLF8b_b0tOEWTL2KmWswAAAMU"]
[Fri Dec 12 20:31:19.901682 2025] [:error] [pid 26519:tid 26525] [client 4.194.202.71:9164] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aTwLF88TRgSGOeWqEhfuxwAAAAI"]
[Fri Dec 12 20:31:20.083661 2025] [:error] [pid 60649:tid 60669] [client 4.194.202.71:9156] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aTwLGFOcUGKU3sgfHP_zfQAAARE"]
[Fri Dec 12 20:31:20.258250 2025] [:error] [pid 60649:tid 60664] [client 4.194.202.71:16168] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aTwLGFOcUGKU3sgfHP_zgAAAAQw"]
[Fri Dec 12 20:31:20.434075 2025] [:error] [pid 26607:tid 26625] [client 4.194.202.71:9185] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aTwLGMb_b0tOEWTL2KmWtAAAANA"]
[Fri Dec 12 20:31:20.615394 2025] [:error] [pid 26520:tid 26565] [client 4.194.202.71:9183] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aTwLGEG_frlY5vNXu_D2CwAAAE0"]
[Fri Dec 12 20:31:20.789329 2025] [:error] [pid 26607:tid 26631] [client 4.194.202.71:16244] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aTwLGMb_b0tOEWTL2KmWtgAAANY"]
[Fri Dec 12 20:31:20.974634 2025] [:error] [pid 26607:tid 26618] [client 4.194.202.71:16136] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aTwLGMb_b0tOEWTL2KmWtwAAAMk"]
[Fri Dec 12 20:31:21.149270 2025] [:error] [pid 26519:tid 26541] [client 4.194.202.71:9163] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aTwLGc8TRgSGOeWqEhfuygAAABI"]
[Fri Dec 12 20:31:21.332283 2025] [:error] [pid 27950:tid 27960] [client 4.194.202.71:16196] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aTwLGYVLRvkrdsSc1F2YHgAAAUg"]
[Fri Dec 12 20:31:21.508780 2025] [:error] [pid 26519:tid 26531] [client 4.194.202.71:9175] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aTwLGc8TRgSGOeWqEhfuzgAAAAg"]
[Fri Dec 12 20:31:21.684914 2025] [:error] [pid 27950:tid 27968] [client 4.194.202.71:9182] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aTwLGYVLRvkrdsSc1F2YHwAAAVA"]
[Fri Dec 12 20:31:21.884662 2025] [:error] [pid 26607:tid 26620] [client 4.194.202.71:16129] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLGcb_b0tOEWTL2KmWuAAAAMs"]
[Fri Dec 12 20:31:22.059577 2025] [:error] [pid 26519:tid 26528] [client 4.194.202.71:16239] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLGs8TRgSGOeWqEhfuzwAAAAU"]
[Fri Dec 12 20:31:22.234571 2025] [:error] [pid 26519:tid 26527] [client 4.194.202.71:16138] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLGs8TRgSGOeWqEhfu0AAAAAQ"]
[Fri Dec 12 20:31:22.414320 2025] [:error] [pid 26519:tid 26526] [client 4.194.202.71:16206] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLGs8TRgSGOeWqEhfu0gAAAAM"]
[Fri Dec 12 20:31:22.601094 2025] [:error] [pid 27950:tid 27961] [client 4.194.202.71:16162] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aTwLGoVLRvkrdsSc1F2YIQAAAUk"]
[Fri Dec 12 20:31:22.774999 2025] [:error] [pid 27950:tid 27963] [client 4.194.202.71:9186] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aTwLGoVLRvkrdsSc1F2YIgAAAUs"]
[Fri Dec 12 20:31:22.952291 2025] [:error] [pid 26519:tid 26534] [client 4.194.202.71:16163] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aTwLGs8TRgSGOeWqEhfu1QAAAAs"]
[Fri Dec 12 20:31:23.138501 2025] [:error] [pid 26519:tid 26539] [client 4.194.202.71:16188] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aTwLG88TRgSGOeWqEhfu2AAAABA"]
[Fri Dec 12 20:31:23.312474 2025] [:error] [pid 55760:tid 55767] [client 4.194.202.71:16153] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aTwLG1ObDQlftFDyGawJlwAAAYU"]
[Fri Dec 12 20:31:23.487941 2025] [:error] [pid 55760:tid 55779] [client 4.194.202.71:9212] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aTwLG1ObDQlftFDyGawJmAAAAZE"]
[Fri Dec 12 20:31:23.672046 2025] [:error] [pid 26521:tid 26587] [client 4.194.202.71:9177] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aTwLG5dhcAPU617AKTB16wAAAIg"]
[Fri Dec 12 20:31:23.847891 2025] [:error] [pid 26521:tid 26590] [client 4.194.202.71:16147] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aTwLG5dhcAPU617AKTB17gAAAIs"]
[Fri Dec 12 20:31:24.024185 2025] [:error] [pid 26521:tid 26581] [client 4.194.202.71:9154] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aTwLHJdhcAPU617AKTB17wAAAII"]
[Fri Dec 12 20:31:24.198018 2025] [:error] [pid 55760:tid 55764] [client 4.194.202.71:9201] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aTwLHFObDQlftFDyGawJmQAAAYI"]
[Fri Dec 12 20:31:24.379207 2025] [:error] [pid 26521:tid 26582] [client 4.194.202.71:16166] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aTwLHJdhcAPU617AKTB18QAAAIM"]
[Fri Dec 12 20:31:24.556843 2025] [:error] [pid 60649:tid 60658] [client 4.194.202.71:9174] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aTwLHFOcUGKU3sgfHP_zggAAAQY"]
[Fri Dec 12 20:31:24.737418 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:16227] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLHJdhcAPU617AKTB18gAAAIU"]
[Fri Dec 12 20:31:24.911501 2025] [:error] [pid 60649:tid 60655] [client 4.194.202.71:16250] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLHFOcUGKU3sgfHP_zhAAAAQM"]
[Fri Dec 12 20:31:25.086657 2025] [:error] [pid 55760:tid 55763] [client 4.194.202.71:16167] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLHVObDQlftFDyGawJmwAAAYE"]
[Fri Dec 12 20:31:25.262181 2025] [:error] [pid 60649:tid 60659] [client 4.194.202.71:16190] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLHVOcUGKU3sgfHP_zhQAAAQc"]
[Fri Dec 12 20:31:25.436014 2025] [:error] [pid 27950:tid 27975] [client 4.194.202.71:9106] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aTwLHYVLRvkrdsSc1F2YJgAAAVc"]
[Fri Dec 12 20:31:25.618624 2025] [:error] [pid 55760:tid 55783] [client 4.194.202.71:16157] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aTwLHVObDQlftFDyGawJnQAAAZU"]
[Fri Dec 12 20:31:25.797202 2025] [:error] [pid 55760:tid 55774] [client 4.194.202.71:9153] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aTwLHVObDQlftFDyGawJnwAAAYw"]
[Fri Dec 12 20:31:25.983406 2025] [:error] [pid 26607:tid 26609] [client 4.194.202.71:16223] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aTwLHcb_b0tOEWTL2KmWvQAAAMA"]
[Fri Dec 12 20:31:26.159110 2025] [:error] [pid 27950:tid 27956] [client 4.194.202.71:16192] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aTwLHoVLRvkrdsSc1F2YKgAAAUQ"]
[Fri Dec 12 20:31:26.334607 2025] [:error] [pid 55760:tid 55785] [client 4.194.202.71:9115] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aTwLHlObDQlftFDyGawJoQAAAZc"]
[Fri Dec 12 20:31:26.508954 2025] [:error] [pid 55760:tid 55775] [client 4.194.202.71:9107] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aTwLHlObDQlftFDyGawJowAAAY0"]
[Fri Dec 12 20:31:26.688477 2025] [:error] [pid 26521:tid 26579] [client 4.194.202.71:16229] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aTwLHpdhcAPU617AKTB19wAAAIA"]
[Fri Dec 12 20:31:26.862260 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:16146] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLHsb_b0tOEWTL2KmWvgAAAM4"]
[Fri Dec 12 20:31:27.037025 2025] [:error] [pid 26521:tid 26603] [client 4.194.202.71:9159] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLH5dhcAPU617AKTB1-gAAAJg"]
[Fri Dec 12 20:31:27.224321 2025] [:error] [pid 55760:tid 55769] [client 4.194.202.71:9109] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLH1ObDQlftFDyGawJqAAAAYc"]
[Fri Dec 12 20:31:27.398931 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:16145] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aTwLH5dhcAPU617AKTB1_QAAAIc"]
[Fri Dec 12 20:31:27.586063 2025] [:error] [pid 55760:tid 55780] [client 4.194.202.71:16164] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aTwLH1ObDQlftFDyGawJqgAAAZI"]
[Fri Dec 12 20:31:27.760280 2025] [:error] [pid 27950:tid 27962] [client 4.194.202.71:16181] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aTwLH4VLRvkrdsSc1F2YLQAAAUo"]
[Fri Dec 12 20:31:27.934378 2025] [:error] [pid 26607:tid 26610] [client 4.194.202.71:9118] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aTwLH8b_b0tOEWTL2KmWwAAAAME"]
[Fri Dec 12 20:31:28.109506 2025] [:error] [pid 55760:tid 55776] [client 4.194.202.71:16169] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aTwLIFObDQlftFDyGawJrQAAAY4"]
[Fri Dec 12 20:31:28.290973 2025] [:error] [pid 27950:tid 27964] [client 4.194.202.71:9096] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aTwLIIVLRvkrdsSc1F2YMAAAAUw"]
[Fri Dec 12 20:31:28.480534 2025] [:error] [pid 55760:tid 55763] [client 4.194.202.71:9165] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aTwLIFObDQlftFDyGawJrwAAAYE"]
[Fri Dec 12 20:31:28.660478 2025] [:error] [pid 26607:tid 26619] [client 4.194.202.71:9203] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aTwLIMb_b0tOEWTL2KmWwwAAAMo"]
[Fri Dec 12 20:31:28.843797 2025] [:error] [pid 55760:tid 55783] [client 4.194.202.71:9198] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aTwLIFObDQlftFDyGawJsAAAAZU"]
[Fri Dec 12 20:31:29.044630 2025] [:error] [pid 60649:tid 60661] [client 4.194.202.71:9180] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLIVOcUGKU3sgfHP_zigAAAQk"]
[Fri Dec 12 20:31:29.219883 2025] [:error] [pid 26607:tid 26628] [client 4.194.202.71:9161] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLIcb_b0tOEWTL2KmWxQAAANM"]
[Fri Dec 12 20:31:29.394629 2025] [:error] [pid 26521:tid 26590] [client 4.194.202.71:16214] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLIZdhcAPU617AKTB2AAAAAIs"]
[Fri Dec 12 20:31:29.582083 2025] [:error] [pid 60649:tid 60656] [client 4.194.202.71:16183] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aTwLIVOcUGKU3sgfHP_ziwAAAQQ"]
[Fri Dec 12 20:31:29.756730 2025] [:error] [pid 55760:tid 55786] [client 4.194.202.71:16208] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aTwLIVObDQlftFDyGawJsgAAAZg"]
[Fri Dec 12 20:31:29.934873 2025] [:error] [pid 26521:tid 26582] [client 4.194.202.71:16177] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aTwLIZdhcAPU617AKTB2AwAAAIM"]
[Fri Dec 12 20:31:30.110080 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:9173] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aTwLIpdhcAPU617AKTB2BQAAAIU"]
[Fri Dec 12 20:31:30.295082 2025] [:error] [pid 26519:tid 26541] [client 4.194.202.71:16252] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aTwLIs8TRgSGOeWqEhfu3gAAABI"]
[Fri Dec 12 20:31:30.474358 2025] [:error] [pid 26519:tid 26543] [client 4.194.202.71:9188] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aTwLIs8TRgSGOeWqEhfu4AAAABQ"]
[Fri Dec 12 20:31:30.652459 2025] [:error] [pid 55760:tid 55781] [client 4.194.202.71:16132] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aTwLIlObDQlftFDyGawJtAAAAZM"]
[Fri Dec 12 20:31:30.838191 2025] [:error] [pid 55760:tid 55775] [client 4.194.202.71:9168] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aTwLIlObDQlftFDyGawJtQAAAY0"]
[Fri Dec 12 20:31:31.016774 2025] [:error] [pid 55760:tid 55772] [client 4.194.202.71:16215] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aTwLI1ObDQlftFDyGawJtgAAAYo"]
[Fri Dec 12 20:31:31.217611 2025] [:error] [pid 26519:tid 26528] [client 4.194.202.71:9179] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aTwLI88TRgSGOeWqEhfu5AAAAAU"]
[Fri Dec 12 20:31:31.396470 2025] [:error] [pid 26520:tid 26572] [client 4.194.202.71:9128] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aTwLI0G_frlY5vNXu_D2EgAAAFQ"]
[Fri Dec 12 20:31:31.571326 2025] [:error] [pid 55760:tid 55778] [client 4.194.202.71:16205] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aTwLI1ObDQlftFDyGawJuQAAAZA"]
[Fri Dec 12 20:31:31.772785 2025] [:error] [pid 55760:tid 55771] [client 4.194.202.71:16213] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aTwLI1ObDQlftFDyGawJvAAAAYk"]
[Fri Dec 12 20:31:31.948237 2025] [:error] [pid 26519:tid 26527] [client 4.194.202.71:9171] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aTwLI88TRgSGOeWqEhfu5QAAAAQ"]
[Fri Dec 12 20:31:32.131009 2025] [:error] [pid 26521:tid 26592] [client 4.194.202.71:16245] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aTwLJJdhcAPU617AKTB2CAAAAI0"]
[Fri Dec 12 20:31:32.309358 2025] [:error] [pid 26520:tid 26569] [client 4.194.202.71:16201] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aTwLJEG_frlY5vNXu_D2EwAAAFE"]
[Fri Dec 12 20:31:32.484371 2025] [:error] [pid 26607:tid 26625] [client 4.194.202.71:16135] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aTwLJMb_b0tOEWTL2KmWxgAAANA"]
[Fri Dec 12 20:31:32.682105 2025] [:error] [pid 26607:tid 26631] [client 4.194.202.71:9034] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aTwLJMb_b0tOEWTL2KmWxwAAANY"]
[Fri Dec 12 20:31:32.871192 2025] [:error] [pid 27950:tid 27959] [client 4.194.202.71:9122] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aTwLJIVLRvkrdsSc1F2YNwAAAUc"]
[Fri Dec 12 20:31:33.056296 2025] [:error] [pid 26607:tid 26620] [client 4.194.202.71:9134] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aTwLJcb_b0tOEWTL2KmWygAAAMs"]
[Fri Dec 12 20:31:33.243367 2025] [:error] [pid 27950:tid 27973] [client 4.194.202.71:16233] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aTwLJYVLRvkrdsSc1F2YOgAAAVU"]
[Fri Dec 12 20:31:33.432316 2025] [:error] [pid 26519:tid 26526] [client 4.194.202.71:9189] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aTwLJc8TRgSGOeWqEhfu5wAAAAM"]
[Fri Dec 12 20:31:33.621271 2025] [:error] [pid 26519:tid 26532] [client 4.194.202.71:16198] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aTwLJc8TRgSGOeWqEhfu6AAAAAk"]
[Fri Dec 12 20:31:33.826387 2025] [:error] [pid 26520:tid 26561] [client 4.194.202.71:16130] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aTwLJUG_frlY5vNXu_D2GQAAAEk"]
[Fri Dec 12 20:31:34.000899 2025] [:error] [pid 26520:tid 26567] [client 4.194.202.71:9169] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aTwLJUG_frlY5vNXu_D2GwAAAE8"]
[Fri Dec 12 20:31:34.179881 2025] [:error] [pid 26519:tid 26534] [client 4.194.202.71:9200] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aTwLJs8TRgSGOeWqEhfu6gAAAAs"]
[Fri Dec 12 20:31:34.391286 2025] [:error] [pid 26519:tid 26529] [client 4.194.202.71:9211] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aTwLJs8TRgSGOeWqEhfu6wAAAAY"]
[Fri Dec 12 20:31:34.573832 2025] [:error] [pid 55760:tid 55768] [client 4.194.202.71:9172] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aTwLJlObDQlftFDyGawJvwAAAYY"]
[Fri Dec 12 20:31:34.758294 2025] [:error] [pid 26519:tid 26544] [client 4.194.202.71:9120] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aTwLJs8TRgSGOeWqEhfu7AAAABU"]
[Fri Dec 12 20:31:34.956658 2025] [:error] [pid 27950:tid 27958] [client 4.194.202.71:9092] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTwLJoVLRvkrdsSc1F2YPAAAAUY"]
[Fri Dec 12 20:31:35.132777 2025] [:error] [pid 26520:tid 26554] [client 4.194.202.71:9114] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTwLJ0G_frlY5vNXu_D2HwAAAEI"]
[Fri Dec 12 20:31:35.325939 2025] [:error] [pid 27950:tid 27970] [client 4.194.202.71:9206] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTwLJ4VLRvkrdsSc1F2YPgAAAVI"]
[Fri Dec 12 20:31:35.501562 2025] [:error] [pid 26520:tid 26564] [client 4.194.202.71:16172] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aTwLJ0G_frlY5vNXu_D2IAAAAEw"]
[Fri Dec 12 20:31:35.679651 2025] [:error] [pid 26520:tid 26560] [client 4.194.202.71:9138] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTwLJ0G_frlY5vNXu_D2IQAAAEg"]
[Fri Dec 12 20:31:35.858654 2025] [:error] [pid 55760:tid 55764] [client 4.194.202.71:9166] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTwLJ1ObDQlftFDyGawJwQAAAYI"]
[Fri Dec 12 20:31:36.040984 2025] [:error] [pid 55760:tid 55782] [client 4.194.202.71:9136] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTwLKFObDQlftFDyGawJwgAAAZQ"]
[Fri Dec 12 20:31:36.224825 2025] [:error] [pid 26520:tid 26556] [client 4.194.202.71:9103] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aTwLKEG_frlY5vNXu_D2JAAAAEQ"]
[Fri Dec 12 20:31:36.402363 2025] [:error] [pid 26520:tid 26575] [client 4.194.202.71:9196] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTwLKEG_frlY5vNXu_D2JQAAAFc"]
[Fri Dec 12 20:31:36.586676 2025] [:error] [pid 26520:tid 26574] [client 4.194.202.71:9142] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTwLKEG_frlY5vNXu_D2JwAAAFY"]
[Fri Dec 12 20:31:36.772107 2025] [:error] [pid 26521:tid 26603] [client 4.194.202.71:9101] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTwLKJdhcAPU617AKTB2CwAAAJg"]
[Fri Dec 12 20:31:36.953041 2025] [:error] [pid 26519:tid 26541] [client 4.194.202.71:9187] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aTwLKM8TRgSGOeWqEhfu9AAAABI"]
[Fri Dec 12 20:31:37.137921 2025] [:error] [pid 55760:tid 55777] [client 4.194.202.71:9208] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aTwLKVObDQlftFDyGawJxAAAAY8"]
[Fri Dec 12 20:31:37.358060 2025] [:error] [pid 60649:tid 60652] [client 4.194.202.71:9209] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aTwLKVOcUGKU3sgfHP_zlAAAAQA"]
[Fri Dec 12 20:31:37.565040 2025] [:error] [pid 60649:tid 60668] [client 4.194.202.71:9193] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aTwLKVOcUGKU3sgfHP_zlwAAARA"]
[Fri Dec 12 20:31:37.749512 2025] [:error] [pid 26520:tid 26557] [client 4.194.202.71:9100] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aTwLKUG_frlY5vNXu_D2KwAAAEU"]
[Fri Dec 12 20:31:37.938449 2025] [:error] [pid 26520:tid 26570] [client 4.194.202.71:9111] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aTwLKUG_frlY5vNXu_D2LgAAAFI"]
[Fri Dec 12 20:31:38.116792 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:9039] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aTwLKpdhcAPU617AKTB2DAAAAJA"]
[Fri Dec 12 20:31:38.329036 2025] [:error] [pid 26521:tid 26589] [client 4.194.202.71:16230] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aTwLKpdhcAPU617AKTB2DgAAAIo"]
[Fri Dec 12 20:31:38.509118 2025] [:error] [pid 60649:tid 60672] [client 4.194.202.71:16182] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aTwLKlOcUGKU3sgfHP_zmAAAARQ"]
[Fri Dec 12 20:31:38.696537 2025] [:error] [pid 60649:tid 60655] [client 4.194.202.71:9123] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTwLKlOcUGKU3sgfHP_zmwAAAQM"]
[Fri Dec 12 20:31:38.878526 2025] [:error] [pid 60649:tid 60667] [client 4.194.202.71:9125] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTwLKlOcUGKU3sgfHP_znQAAAQ8"]
[Fri Dec 12 20:31:39.070316 2025] [:error] [pid 60649:tid 60654] [client 4.194.202.71:9152] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTwLK1OcUGKU3sgfHP_zngAAAQI"]
[Fri Dec 12 20:31:39.246412 2025] [:error] [pid 26519:tid 26527] [client 4.194.202.71:9204] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aTwLK88TRgSGOeWqEhfu-gAAAAQ"]
[Fri Dec 12 20:31:39.439196 2025] [:error] [pid 60649:tid 60661] [client 4.194.202.71:16141] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLK1OcUGKU3sgfHP_zoQAAAQk"]
[Fri Dec 12 20:31:39.617738 2025] [:error] [pid 60649:tid 60656] [client 4.194.202.71:9132] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLK1OcUGKU3sgfHP_zogAAAQQ"]
[Fri Dec 12 20:31:39.801394 2025] [:error] [pid 60649:tid 60663] [client 4.194.202.71:9160] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLK1OcUGKU3sgfHP_zowAAAQs"]
[Fri Dec 12 20:31:39.988267 2025] [:error] [pid 26520:tid 26565] [client 4.194.202.71:16222] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aTwLK0G_frlY5vNXu_D2NgAAAE0"]
[Fri Dec 12 20:31:40.165025 2025] [:error] [pid 60649:tid 60660] [client 4.194.202.71:9202] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aTwLLFOcUGKU3sgfHP_zpgAAAQg"]
[Fri Dec 12 20:31:40.342950 2025] [:error] [pid 26521:tid 26588] [client 4.194.202.71:16238] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aTwLLJdhcAPU617AKTB2EgAAAIk"]
[Fri Dec 12 20:31:40.524102 2025] [:error] [pid 55760:tid 55785] [client 4.194.202.71:9146] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aTwLLFObDQlftFDyGawJxgAAAZc"]
[Fri Dec 12 20:31:40.706034 2025] [:error] [pid 60649:tid 60652] [client 4.194.202.71:9029] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aTwLLFOcUGKU3sgfHP_zqQAAAQA"]
[Fri Dec 12 20:31:40.881410 2025] [:error] [pid 26521:tid 26600] [client 4.194.202.71:9076] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTwLLJdhcAPU617AKTB2FgAAAJU"]
[Fri Dec 12 20:31:41.065175 2025] [:error] [pid 55760:tid 55767] [client 4.194.202.71:9112] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTwLLVObDQlftFDyGawJygAAAYU"]
[Fri Dec 12 20:31:41.255271 2025] [:error] [pid 55760:tid 55762] [client 4.194.202.71:9093] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTwLLVObDQlftFDyGawJzAAAAYA"]
[Fri Dec 12 20:31:41.437438 2025] [:error] [pid 55760:tid 55778] [client 4.194.202.71:9207] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aTwLLVObDQlftFDyGawJzQAAAZA"]
[Fri Dec 12 20:31:41.614346 2025] [:error] [pid 27950:tid 27971] [client 4.194.202.71:9141] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aTwLLYVLRvkrdsSc1F2YSQAAAVM"]
[Fri Dec 12 20:31:41.790796 2025] [:error] [pid 27950:tid 27967] [client 4.194.202.71:9095] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aTwLLYVLRvkrdsSc1F2YTQAAAU8"]
[Fri Dec 12 20:31:41.969908 2025] [:error] [pid 26607:tid 26631] [client 4.194.202.71:9081] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aTwLLcb_b0tOEWTL2KmW2gAAANY"]
[Fri Dec 12 20:31:42.157229 2025] [:error] [pid 26607:tid 26611] [client 4.194.202.71:9129] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aTwLLsb_b0tOEWTL2KmW2wAAAMI"]
[Fri Dec 12 20:31:42.335430 2025] [:error] [pid 55760:tid 55768] [client 4.194.202.71:9090] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTwLLlObDQlftFDyGawJ0gAAAYY"]
[Fri Dec 12 20:31:42.533708 2025] [:error] [pid 27950:tid 27956] [client 4.194.202.71:16231] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTwLLoVLRvkrdsSc1F2YTwAAAUQ"]
[Fri Dec 12 20:31:42.723204 2025] [:error] [pid 27950:tid 27952] [client 4.194.202.71:9215] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTwLLoVLRvkrdsSc1F2YUwAAAUA"]
[Fri Dec 12 20:31:42.899420 2025] [:error] [pid 26521:tid 26579] [client 4.194.202.71:9127] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aTwLLpdhcAPU617AKTB2HAAAAIA"]
[Fri Dec 12 20:31:43.097473 2025] [:error] [pid 55760:tid 55773] [client 4.194.202.71:9091] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aTwLL1ObDQlftFDyGawJ1wAAAYs"]
[Fri Dec 12 20:31:43.274292 2025] [:error] [pid 26520:tid 26568] [client 4.194.202.71:9149] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aTwLL0G_frlY5vNXu_D2PwAAAFA"]
[Fri Dec 12 20:31:43.455529 2025] [:error] [pid 26519:tid 26540] [client 4.194.202.71:9110] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aTwLL88TRgSGOeWqEhfvBAAAABE"]
[Fri Dec 12 20:31:43.633423 2025] [:error] [pid 26519:tid 26545] [client 4.194.202.71:9028] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aTwLL88TRgSGOeWqEhfvBQAAABY"]
[Fri Dec 12 20:31:43.808096 2025] [:error] [pid 55760:tid 55774] [client 4.194.202.71:9205] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aTwLL1ObDQlftFDyGawJ2QAAAYw"]
[Fri Dec 12 20:31:43.985171 2025] [:error] [pid 26520:tid 26574] [client 4.194.202.71:9044] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aTwLL0G_frlY5vNXu_D2QAAAAFY"]
[Fri Dec 12 20:31:44.162128 2025] [:error] [pid 26521:tid 26603] [client 4.194.202.71:9059] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aTwLMJdhcAPU617AKTB2HwAAAJg"]
[Fri Dec 12 20:31:44.350776 2025] [:error] [pid 26520:tid 26572] [client 4.194.202.71:9097] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aTwLMEG_frlY5vNXu_D2QQAAAFQ"]
[Fri Dec 12 20:31:44.529133 2025] [:error] [pid 26519:tid 26530] [client 4.194.202.71:16199] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aTwLMM8TRgSGOeWqEhfvBgAAAAc"]
[Fri Dec 12 20:31:44.708208 2025] [:error] [pid 26521:tid 26580] [client 4.194.202.71:9080] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aTwLMJdhcAPU617AKTB2IgAAAIE"]
[Fri Dec 12 20:31:44.889407 2025] [:error] [pid 26520:tid 26563] [client 4.194.202.71:9035] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aTwLMEG_frlY5vNXu_D2QgAAAEs"]
[Fri Dec 12 20:31:45.075900 2025] [:error] [pid 26519:tid 26541] [client 4.194.202.71:9178] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aTwLMc8TRgSGOeWqEhfvBwAAABI"]
[Fri Dec 12 20:31:45.251979 2025] [:error] [pid 26607:tid 26609] [client 4.194.202.71:9047] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aTwLMcb_b0tOEWTL2KmW4AAAAMA"]
[Fri Dec 12 20:31:45.463869 2025] [:error] [pid 26519:tid 26542] [client 4.194.202.71:9197] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aTwLMc8TRgSGOeWqEhfvCAAAABM"]
[Fri Dec 12 20:31:45.638700 2025] [:error] [pid 26519:tid 26527] [client 4.194.202.71:9094] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aTwLMc8TRgSGOeWqEhfvCgAAAAQ"]
[Fri Dec 12 20:31:45.828651 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:9176] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aTwLMZdhcAPU617AKTB2JAAAAIc"]
[Fri Dec 12 20:31:46.005006 2025] [:error] [pid 26520:tid 26576] [client 4.194.202.71:9057] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTwLMkG_frlY5vNXu_D2RgAAAFg"]
[Fri Dec 12 20:31:46.180188 2025] [:error] [pid 60649:tid 60676] [client 4.194.202.71:9199] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTwLMlOcUGKU3sgfHP_zqwAAARg"]
[Fri Dec 12 20:31:46.354843 2025] [:error] [pid 26520:tid 26561] [client 4.194.202.71:9043] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTwLMkG_frlY5vNXu_D2RwAAAEk"]
[Fri Dec 12 20:31:46.530132 2025] [:error] [pid 26607:tid 26610] [client 4.194.202.71:16246] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aTwLMsb_b0tOEWTL2KmW4wAAAME"]
[Fri Dec 12 20:31:46.707845 2025] [:error] [pid 26521:tid 26588] [client 4.194.202.71:9150] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aTwLMpdhcAPU617AKTB2KAAAAIk"]
[Fri Dec 12 20:31:46.897345 2025] [:error] [pid 26521:tid 26581] [client 4.194.202.71:9045] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aTwLMpdhcAPU617AKTB2KQAAAII"]
[Fri Dec 12 20:31:47.083589 2025] [:error] [pid 26607:tid 26633] [client 4.194.202.71:9033] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aTwLM8b_b0tOEWTL2KmW5AAAANg"]
[Fri Dec 12 20:31:47.260143 2025] [:error] [pid 60649:tid 60658] [client 4.194.202.71:9089] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aTwLM1OcUGKU3sgfHP_zrQAAAQY"]
[Fri Dec 12 20:31:47.443104 2025] [:error] [pid 60649:tid 60675] [client 4.194.202.71:9040] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aTwLM1OcUGKU3sgfHP_zrgAAARc"]
[Fri Dec 12 20:31:47.621642 2025] [:error] [pid 60649:tid 60655] [client 4.194.202.71:16185] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aTwLM1OcUGKU3sgfHP_zrwAAAQM"]
[Fri Dec 12 20:31:47.805584 2025] [:error] [pid 26521:tid 26600] [client 4.194.202.71:9147] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aTwLM5dhcAPU617AKTB2KwAAAJU"]
[Fri Dec 12 20:31:47.983351 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:9190] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aTwLM5dhcAPU617AKTB2LQAAAIU"]
[Fri Dec 12 20:31:48.158299 2025] [:error] [pid 26520:tid 26553] [client 4.194.202.71:9131] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aTwLNEG_frlY5vNXu_D2SgAAAEE"]
[Fri Dec 12 20:31:48.336940 2025] [:error] [pid 26519:tid 26546] [client 4.194.202.71:9037] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/index.php"] [unique_id "aTwLNM8TRgSGOeWqEhfvEQAAABc"]
[Fri Dec 12 20:31:48.529721 2025] [:error] [pid 60649:tid 60659] [client 4.194.202.71:9124] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/index.php"] [unique_id "aTwLNFOcUGKU3sgfHP_zsAAAAQc"]
[Fri Dec 12 20:31:48.709252 2025] [:error] [pid 26607:tid 26616] [client 4.194.202.71:9213] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/index.php"] [unique_id "aTwLNMb_b0tOEWTL2KmW6gAAAMc"]
[Fri Dec 12 20:31:48.892739 2025] [:error] [pid 26607:tid 26631] [client 4.194.202.71:9085] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/index.php"] [unique_id "aTwLNMb_b0tOEWTL2KmW7AAAANY"]
[Fri Dec 12 20:31:49.086039 2025] [:error] [pid 26519:tid 26540] [client 4.194.202.71:9210] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aTwLNc8TRgSGOeWqEhfvFQAAABE"]
[Fri Dec 12 20:31:49.262159 2025] [:error] [pid 60649:tid 60653] [client 4.194.202.71:16244] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aTwLNVOcUGKU3sgfHP_zsgAAAQE"]
[Fri Dec 12 20:31:49.437998 2025] [:error] [pid 60649:tid 60673] [client 4.194.202.71:9098] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aTwLNVOcUGKU3sgfHP_zswAAARU"]
[Fri Dec 12 20:31:49.643627 2025] [:error] [pid 26520:tid 26554] [client 4.194.202.71:9102] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aTwLNUG_frlY5vNXu_D2TQAAAEI"]
[Fri Dec 12 20:31:49.818895 2025] [:error] [pid 26521:tid 26579] [client 4.194.202.71:9042] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aTwLNZdhcAPU617AKTB2MwAAAIA"]
[Fri Dec 12 20:31:50.002884 2025] [:error] [pid 26521:tid 26597] [client 4.194.202.71:9063] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aTwLNpdhcAPU617AKTB2NQAAAJI"]
[Fri Dec 12 20:31:50.178098 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:9116] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aTwLNpdhcAPU617AKTB2NwAAAJA"]
[Fri Dec 12 20:31:50.354709 2025] [:error] [pid 55760:tid 55771] [client 4.194.202.71:9140] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aTwLNlObDQlftFDyGawJ4wAAAYk"]
[Fri Dec 12 20:31:50.530940 2025] [:error] [pid 60649:tid 60663] [client 4.194.202.71:9062] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTwLNlOcUGKU3sgfHP_ztgAAAQs"]
[Fri Dec 12 20:31:50.728453 2025] [:error] [pid 26520:tid 26555] [client 4.194.202.71:9137] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTwLNkG_frlY5vNXu_D2UAAAAEM"]
[Fri Dec 12 20:31:50.915318 2025] [:error] [pid 26520:tid 26558] [client 4.194.202.71:16162] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTwLNkG_frlY5vNXu_D2UQAAAEY"]
[Fri Dec 12 20:31:51.090005 2025] [:error] [pid 55760:tid 55770] [client 4.194.202.71:9214] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aTwLN1ObDQlftFDyGawJ5AAAAYg"]
[Fri Dec 12 20:31:51.266570 2025] [:error] [pid 26607:tid 26620] [client 4.194.202.71:9121] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aTwLN8b_b0tOEWTL2KmW8QAAAMs"]
[Fri Dec 12 20:31:51.442052 2025] [:error] [pid 26521:tid 26601] [client 4.194.202.71:9087] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aTwLN5dhcAPU617AKTB2PQAAAJY"]
[Fri Dec 12 20:31:51.621618 2025] [:error] [pid 27950:tid 27959] [client 4.194.202.71:9026] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aTwLN4VLRvkrdsSc1F2YWgAAAUc"]
[Fri Dec 12 20:31:51.796314 2025] [:error] [pid 27950:tid 27957] [client 4.194.202.71:8990] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aTwLN4VLRvkrdsSc1F2YWwAAAUU"]
[Fri Dec 12 20:31:51.971729 2025] [:error] [pid 27950:tid 27973] [client 4.194.202.71:9031] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTwLN4VLRvkrdsSc1F2YXAAAAVU"]
[Fri Dec 12 20:31:52.156724 2025] [:error] [pid 26607:tid 26609] [client 4.194.202.71:8986] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTwLOMb_b0tOEWTL2KmW8wAAAMA"]
[Fri Dec 12 20:31:52.333075 2025] [:error] [pid 26520:tid 26575] [client 4.194.202.71:9144] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTwLOEG_frlY5vNXu_D2UwAAAFc"]
[Fri Dec 12 20:31:52.510008 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:9143] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aTwLOMb_b0tOEWTL2KmW9AAAAM4"]
[Fri Dec 12 20:31:52.720963 2025] [:error] [pid 27950:tid 27971] [client 4.194.202.71:9003] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aTwLOIVLRvkrdsSc1F2YXQAAAVM"]
[Fri Dec 12 20:31:52.896282 2025] [:error] [pid 26520:tid 26568] [client 4.194.202.71:9041] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aTwLOEG_frlY5vNXu_D2VAAAAFA"]
[Fri Dec 12 20:31:53.077144 2025] [:error] [pid 26607:tid 26613] [client 4.194.202.71:9083] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aTwLOcb_b0tOEWTL2KmW-AAAAMQ"]
[Fri Dec 12 20:31:53.281233 2025] [:error] [pid 27950:tid 27966] [client 4.194.202.71:9108] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aTwLOYVLRvkrdsSc1F2YXgAAAU4"]
[Fri Dec 12 20:31:53.456789 2025] [:error] [pid 26520:tid 26574] [client 4.194.202.71:9030] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aTwLOUG_frlY5vNXu_D2VQAAAFY"]
[Fri Dec 12 20:31:53.642421 2025] [:error] [pid 26520:tid 26572] [client 4.194.202.71:9023] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aTwLOUG_frlY5vNXu_D2VgAAAFQ"]
[Fri Dec 12 20:31:53.817568 2025] [:error] [pid 26607:tid 26625] [client 4.194.202.71:9068] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aTwLOcb_b0tOEWTL2KmXAwAAANA"]
[Fri Dec 12 20:31:53.991386 2025] [:error] [pid 26607:tid 26630] [client 4.194.202.71:8964] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aTwLOcb_b0tOEWTL2KmXBAAAANU"]
[Fri Dec 12 20:31:54.174990 2025] [:error] [pid 26607:tid 26612] [client 4.194.202.71:9055] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aTwLOsb_b0tOEWTL2KmXBgAAAMM"]
[Fri Dec 12 20:31:54.352518 2025] [:error] [pid 26520:tid 26563] [client 4.194.202.71:9075] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aTwLOkG_frlY5vNXu_D2VwAAAEs"]
[Fri Dec 12 20:31:54.526937 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:9038] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aTwLOsb_b0tOEWTL2KmXCAAAAM4"]
[Fri Dec 12 20:31:54.706095 2025] [:error] [pid 26607:tid 26615] [client 4.194.202.71:8962] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aTwLOsb_b0tOEWTL2KmXDQAAAMY"]
[Fri Dec 12 20:31:54.884305 2025] [:error] [pid 26521:tid 26597] [client 4.194.202.71:16211] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aTwLOpdhcAPU617AKTB2RAAAAJI"]
[Fri Dec 12 20:31:55.058776 2025] [:error] [pid 55760:tid 55764] [client 4.194.202.71:9061] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwLO1ObDQlftFDyGawJ5gAAAYI"]
[Fri Dec 12 20:31:55.245394 2025] [:error] [pid 26607:tid 26624] [client 4.194.202.71:9078] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwLO8b_b0tOEWTL2KmXFAAAAM8"]
[Fri Dec 12 20:31:55.419633 2025] [:error] [pid 60649:tid 60659] [client 4.194.202.71:9135] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwLO1OcUGKU3sgfHP_zyAAAAQc"]
[Fri Dec 12 20:31:55.597037 2025] [:error] [pid 26519:tid 26547] [client 4.194.202.71:9126] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwLO88TRgSGOeWqEhfvHAAAABg"]
[Fri Dec 12 20:31:55.804083 2025] [:error] [pid 27950:tid 27967] [client 4.194.202.71:16180] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTwLO4VLRvkrdsSc1F2YXwAAAU8"]
[Fri Dec 12 20:31:55.988372 2025] [:error] [pid 55760:tid 55765] [client 4.194.202.71:9104] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTwLO1ObDQlftFDyGawJ6AAAAYM"]
[Fri Dec 12 20:31:56.165935 2025] [:error] [pid 26519:tid 26544] [client 4.194.202.71:9058] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTwLPM8TRgSGOeWqEhfvHQAAABU"]
[Fri Dec 12 20:31:56.363993 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:9067] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aTwLPJdhcAPU617AKTB2SAAAAIc"]
[Fri Dec 12 20:31:56.538611 2025] [:error] [pid 60649:tid 60663] [client 4.194.202.71:9006] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aTwLPFOcUGKU3sgfHP_zzQAAAQs"]
[Fri Dec 12 20:31:56.718094 2025] [:error] [pid 60649:tid 60654] [client 4.194.202.71:16191] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aTwLPFOcUGKU3sgfHP_zzgAAAQI"]
[Fri Dec 12 20:31:56.936098 2025] [:error] [pid 27950:tid 27970] [client 4.194.202.71:9014] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aTwLPIVLRvkrdsSc1F2YYAAAAVI"]
[Fri Dec 12 20:31:57.119660 2025] [:error] [pid 55760:tid 55763] [client 4.194.202.71:9024] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aTwLPVObDQlftFDyGawJ6QAAAYE"]
[Fri Dec 12 20:31:57.302037 2025] [:error] [pid 27950:tid 27969] [client 4.194.202.71:9073] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwLPYVLRvkrdsSc1F2YYQAAAVE"]
[Fri Dec 12 20:31:57.482763 2025] [:error] [pid 26519:tid 26546] [client 4.194.202.71:9088] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwLPc8TRgSGOeWqEhfvHgAAABc"]
[Fri Dec 12 20:31:57.684241 2025] [:error] [pid 27950:tid 27962] [client 4.194.202.71:9082] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwLPYVLRvkrdsSc1F2YYgAAAUo"]
[Fri Dec 12 20:31:57.862097 2025] [:error] [pid 27950:tid 27972] [client 4.194.202.71:9119] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aTwLPYVLRvkrdsSc1F2YYwAAAVQ"]
[Fri Dec 12 20:31:58.049328 2025] [:error] [pid 26521:tid 26589] [client 4.194.202.71:9013] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTwLPpdhcAPU617AKTB2SQAAAIo"]
[Fri Dec 12 20:31:58.228356 2025] [:error] [pid 55760:tid 55779] [client 4.194.202.71:16184] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTwLPlObDQlftFDyGawJ6gAAAZE"]
[Fri Dec 12 20:31:58.408034 2025] [:error] [pid 60649:tid 60660] [client 4.194.202.71:16139] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTwLPlOcUGKU3sgfHP_z0AAAAQg"]
[Fri Dec 12 20:31:58.583980 2025] [:error] [pid 26607:tid 26621] [client 4.194.202.71:9113] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aTwLPsb_b0tOEWTL2KmXHQAAAMw"]
[Fri Dec 12 20:31:58.808954 2025] [:error] [pid 27950:tid 27952] [client 4.194.202.71:9074] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aTwLPoVLRvkrdsSc1F2YZQAAAUA"]
[Fri Dec 12 20:31:58.995016 2025] [:error] [pid 27950:tid 27975] [client 4.194.202.71:9195] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aTwLPoVLRvkrdsSc1F2YZgAAAVc"]
[Fri Dec 12 20:31:59.179024 2025] [:error] [pid 26521:tid 26588] [client 4.194.202.71:8987] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aTwLP5dhcAPU617AKTB2TQAAAIk"]
[Fri Dec 12 20:31:59.363844 2025] [:error] [pid 26521:tid 26581] [client 4.194.202.71:9005] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aTwLP5dhcAPU617AKTB2TgAAAII"]
[Fri Dec 12 20:31:59.550857 2025] [:error] [pid 26520:tid 26566] [client 4.194.202.71:9148] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aTwLP0G_frlY5vNXu_D2WQAAAE4"]
[Fri Dec 12 20:31:59.737174 2025] [:error] [pid 55760:tid 55775] [client 4.194.202.71:9070] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aTwLP1ObDQlftFDyGawJ7AAAAY0"]
[Fri Dec 12 20:31:59.921773 2025] [:error] [pid 26519:tid 26536] [client 4.194.202.71:9105] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aTwLP88TRgSGOeWqEhfvHwAAAA0"]
[Fri Dec 12 20:32:00.146042 2025] [:error] [pid 26521:tid 26596] [client 4.194.202.71:8709] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aTwLQJdhcAPU617AKTB2TwAAAJE"]
[Fri Dec 12 20:32:00.358101 2025] [:error] [pid 26520:tid 26561] [client 4.194.202.71:9064] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aTwLQEG_frlY5vNXu_D2WgAAAEk"]
[Fri Dec 12 20:32:00.557403 2025] [:error] [pid 26521:tid 26598] [client 4.194.202.71:8915] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aTwLQJdhcAPU617AKTB2UAAAAJM"]
[Fri Dec 12 20:32:00.732413 2025] [:error] [pid 26607:tid 26627] [client 4.194.202.71:8760] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aTwLQMb_b0tOEWTL2KmXIgAAANI"]
[Fri Dec 12 20:32:00.948355 2025] [:error] [pid 60649:tid 60657] [client 4.194.202.71:9069] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aTwLQFOcUGKU3sgfHP_z0QAAAQU"]
[Fri Dec 12 20:32:01.133986 2025] [:error] [pid 26607:tid 26624] [client 4.194.202.71:8991] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aTwLQcb_b0tOEWTL2KmXJAAAAM8"]
[Fri Dec 12 20:32:01.318861 2025] [:error] [pid 26520:tid 26559] [client 4.194.202.71:9050] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aTwLQUG_frlY5vNXu_D2WwAAAEc"]
[Fri Dec 12 20:32:01.493948 2025] [:error] [pid 27950:tid 27960] [client 4.194.202.71:9018] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aTwLQYVLRvkrdsSc1F2YaAAAAUg"]
[Fri Dec 12 20:32:01.679924 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:9054] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aTwLQZdhcAPU617AKTB2UwAAAIU"]
[Fri Dec 12 20:32:01.898196 2025] [:error] [pid 26521:tid 26603] [client 4.194.202.71:8714] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aTwLQZdhcAPU617AKTB2VQAAAJg"]
[Fri Dec 12 20:32:02.097414 2025] [:error] [pid 60649:tid 60669] [client 4.194.202.71:8965] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aTwLQlOcUGKU3sgfHP_z1AAAARE"]
[Fri Dec 12 20:32:02.283811 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:9077] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aTwLQpdhcAPU617AKTB2WQAAAIc"]
[Fri Dec 12 20:32:02.482919 2025] [:error] [pid 60649:tid 60664] [client 4.194.202.71:9065] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aTwLQlOcUGKU3sgfHP_z1wAAAQw"]
[Fri Dec 12 20:32:02.664803 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:8995] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aTwLQpdhcAPU617AKTB2WwAAAJA"]
[Fri Dec 12 20:32:02.843632 2025] [:error] [pid 26607:tid 26611] [client 4.194.202.71:9139] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aTwLQsb_b0tOEWTL2KmXKAAAAMI"]
[Fri Dec 12 20:32:03.301271 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:9151] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Dec 12 20:32:03.396678 2025] [:error] [pid 26607:tid 26621] [client 4.194.202.71:9151] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Fri Dec 12 20:32:03.483692 2025] [:error] [pid 26607:tid 26625] [client 4.194.202.71:9151] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aTwLQ8b_b0tOEWTL2KmXLgAAANA"]
[Fri Dec 12 20:32:03.669854 2025] [:error] [pid 27950:tid 27963] [client 4.194.202.71:8972] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aTwLQ4VLRvkrdsSc1F2YagAAAUs"]
[Fri Dec 12 20:32:03.860099 2025] [:error] [pid 26607:tid 26616] [client 4.194.202.71:8971] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Dec 12 20:32:03.952902 2025] [:error] [pid 26607:tid 26617] [client 4.194.202.71:8971] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Dec 12 20:32:04.043607 2025] [:error] [pid 26607:tid 26633] [client 4.194.202.71:8971] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Fri Dec 12 20:32:04.133964 2025] [:error] [pid 26607:tid 26618] [client 4.194.202.71:8971] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Fri Dec 12 20:32:04.226237 2025] [:error] [pid 26607:tid 26619] [client 4.194.202.71:8971] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Fri Dec 12 20:32:04.317900 2025] [:error] [pid 26607:tid 26615] [client 4.194.202.71:8971] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Fri Dec 12 20:32:04.404323 2025] [:error] [pid 26607:tid 26632] [client 4.194.202.71:8971] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aTwLRMb_b0tOEWTL2KmXNgAAANc"]
[Fri Dec 12 20:32:04.591839 2025] [:error] [pid 26607:tid 26631] [client 4.194.202.71:9020] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aTwLRMb_b0tOEWTL2KmXNwAAANY"]
[Fri Dec 12 20:32:04.766617 2025] [:error] [pid 55760:tid 55771] [client 4.194.202.71:9071] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aTwLRFObDQlftFDyGawJ8QAAAYk"]
[Fri Dec 12 20:32:04.980987 2025] [:error] [pid 60649:tid 60655] [client 4.194.202.71:8738] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aTwLRFOcUGKU3sgfHP_z2gAAAQM"]
[Fri Dec 12 20:32:05.172591 2025] [:error] [pid 60649:tid 60659] [client 4.194.202.71:8960] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aTwLRVOcUGKU3sgfHP_z2wAAAQc"]
[Fri Dec 12 20:32:05.355796 2025] [:error] [pid 60649:tid 60653] [client 4.194.202.71:8731] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aTwLRVOcUGKU3sgfHP_z3QAAAQE"]
[Fri Dec 12 20:32:05.556235 2025] [:error] [pid 27950:tid 27965] [client 4.194.202.71:9056] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aTwLRYVLRvkrdsSc1F2YbQAAAU0"]
[Fri Dec 12 20:32:05.752872 2025] [:error] [pid 26521:tid 26598] [client 4.194.202.71:9133] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aTwLRZdhcAPU617AKTB2ZAAAAJM"]
[Fri Dec 12 20:32:05.937894 2025] [:error] [pid 55760:tid 55781] [client 4.194.202.71:8969] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aTwLRVObDQlftFDyGawJ9AAAAZM"]
[Fri Dec 12 20:32:06.111960 2025] [:error] [pid 26521:tid 26593] [client 4.194.202.71:16218] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aTwLRpdhcAPU617AKTB2ZQAAAI4"]
[Fri Dec 12 20:32:06.289624 2025] [:error] [pid 27950:tid 27973] [client 4.194.202.71:9055] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aTwLRoVLRvkrdsSc1F2YbwAAAVU"]
[Fri Dec 12 20:32:06.498932 2025] [:error] [pid 26607:tid 26613] [client 4.194.202.71:9025] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aTwLRsb_b0tOEWTL2KmXOgAAAMQ"]
[Fri Dec 12 20:32:06.691617 2025] [:error] [pid 26607:tid 26626] [client 4.194.202.71:8704] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aTwLRsb_b0tOEWTL2KmXOwAAANE"]
[Fri Dec 12 20:32:06.867075 2025] [:error] [pid 60649:tid 60656] [client 4.194.202.71:9027] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aTwLRlOcUGKU3sgfHP_z3wAAAQQ"]
[Fri Dec 12 20:32:07.052638 2025] [:error] [pid 26520:tid 26565] [client 4.194.202.71:8911] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aTwLR0G_frlY5vNXu_D2XwAAAE0"]
[Fri Dec 12 20:32:07.228975 2025] [:error] [pid 26521:tid 26602] [client 4.194.202.71:8759] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aTwLR5dhcAPU617AKTB2ZgAAAJc"]
[Fri Dec 12 20:32:07.404725 2025] [:error] [pid 26519:tid 26526] [client 4.194.202.71:16214] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aTwLR88TRgSGOeWqEhfvJwAAAAM"]
[Fri Dec 12 20:32:07.581602 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:9060] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aTwLR8b_b0tOEWTL2KmXPQAAAM4"]
[Fri Dec 12 20:32:07.757568 2025] [:error] [pid 26520:tid 26571] [client 4.194.202.71:9019] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aTwLR0G_frlY5vNXu_D2YAAAAFM"]
[Fri Dec 12 20:32:07.935461 2025] [:error] [pid 26521:tid 26590] [client 4.194.202.71:9046] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aTwLR5dhcAPU617AKTB2ZwAAAIs"]
[Fri Dec 12 20:32:08.138302 2025] [:error] [pid 26521:tid 26579] [client 4.194.202.71:8966] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aTwLSJdhcAPU617AKTB2aAAAAIA"]
[Fri Dec 12 20:32:08.315830 2025] [:error] [pid 26521:tid 26587] [client 4.194.202.71:9084] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aTwLSJdhcAPU617AKTB2aQAAAIg"]
[Fri Dec 12 20:32:08.490463 2025] [:error] [pid 27950:tid 27966] [client 4.194.202.71:9049] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aTwLSIVLRvkrdsSc1F2YdAAAAU4"]
[Fri Dec 12 20:32:08.678851 2025] [:error] [pid 26520:tid 26554] [client 4.194.202.71:9021] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aTwLSEG_frlY5vNXu_D2YQAAAEI"]
[Fri Dec 12 20:32:08.871996 2025] [:error] [pid 26520:tid 26564] [client 4.194.202.71:9086] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aTwLSEG_frlY5vNXu_D2YgAAAEw"]
[Fri Dec 12 20:32:09.060568 2025] [:error] [pid 26521:tid 26603] [client 4.194.202.71:8967] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aTwLSZdhcAPU617AKTB2awAAAJg"]
[Fri Dec 12 20:32:09.238475 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:9016] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aTwLSZdhcAPU617AKTB2bwAAAIc"]
[Fri Dec 12 20:32:09.421736 2025] [:error] [pid 55760:tid 55776] [client 4.194.202.71:8921] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aTwLSVObDQlftFDyGawJ-QAAAY4"]
[Fri Dec 12 20:32:09.629356 2025] [:error] [pid 26520:tid 26558] [client 4.194.202.71:9088] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aTwLSUG_frlY5vNXu_D2ZAAAAEY"]
[Fri Dec 12 20:32:09.818031 2025] [:error] [pid 26520:tid 26556] [client 4.194.202.71:8970] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aTwLSUG_frlY5vNXu_D2ZgAAAEQ"]
[Fri Dec 12 20:32:10.005441 2025] [:error] [pid 26520:tid 26575] [client 4.194.202.71:8730] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aTwLSkG_frlY5vNXu_D2ZwAAAFc"]
[Fri Dec 12 20:32:10.186389 2025] [:error] [pid 55760:tid 55773] [client 4.194.202.71:8722] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aTwLSlObDQlftFDyGawJ-wAAAYs"]
[Fri Dec 12 20:32:10.370260 2025] [:error] [pid 55760:tid 55780] [client 4.194.202.71:8975] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTwLSlObDQlftFDyGawJ_AAAAZI"]
[Fri Dec 12 20:32:10.549123 2025] [:error] [pid 55760:tid 55783] [client 4.194.202.71:8897] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTwLSlObDQlftFDyGawJ_QAAAZU"]
[Fri Dec 12 20:32:10.745193 2025] [:error] [pid 26521:tid 26588] [client 4.194.202.71:9072] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTwLSpdhcAPU617AKTB2cwAAAIk"]
[Fri Dec 12 20:32:10.924327 2025] [:error] [pid 26521:tid 26581] [client 4.194.202.71:8982] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aTwLSpdhcAPU617AKTB2dAAAAII"]
[Fri Dec 12 20:32:11.121115 2025] [:error] [pid 55760:tid 55775] [client 4.194.202.71:8904] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aTwLS1ObDQlftFDyGawJ_gAAAY0"]
[Fri Dec 12 20:32:11.305873 2025] [:error] [pid 26607:tid 26615] [client 4.194.202.71:8747] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aTwLS8b_b0tOEWTL2KmXQAAAAMY"]
[Fri Dec 12 20:32:11.488168 2025] [:error] [pid 26519:tid 26527] [client 4.194.202.71:8973] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aTwLS88TRgSGOeWqEhfvKQAAAAQ"]
[Fri Dec 12 20:32:11.674759 2025] [:error] [pid 27950:tid 27969] [client 4.194.202.71:9005] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aTwLS4VLRvkrdsSc1F2YdwAAAVE"]
[Fri Dec 12 20:32:11.865005 2025] [:error] [pid 26521:tid 26582] [client 4.194.202.71:9001] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aTwLS5dhcAPU617AKTB2dQAAAIM"]
[Fri Dec 12 20:32:12.052907 2025] [:error] [pid 55760:tid 55772] [client 4.194.202.71:9079] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aTwLTFObDQlftFDyGawKAAAAAYo"]
[Fri Dec 12 20:32:12.268533 2025] [:error] [pid 55760:tid 55785] [client 4.194.202.71:8750] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aTwLTFObDQlftFDyGawKAQAAAZc"]
[Fri Dec 12 20:32:12.444124 2025] [:error] [pid 26607:tid 26624] [client 4.194.202.71:9017] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aTwLTMb_b0tOEWTL2KmXQgAAAM8"]
[Fri Dec 12 20:32:12.658783 2025] [:error] [pid 26519:tid 26532] [client 4.194.202.71:8978] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aTwLTM8TRgSGOeWqEhfvKgAAAAk"]
[Fri Dec 12 20:32:12.832285 2025] [:error] [pid 55760:tid 55786] [client 4.194.202.71:8733] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aTwLTFObDQlftFDyGawKAwAAAZg"]
[Fri Dec 12 20:32:13.027071 2025] [:error] [pid 60649:tid 60670] [client 4.194.202.71:9032] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aTwLTVOcUGKU3sgfHP_z4wAAARI"]
[Fri Dec 12 20:32:13.218457 2025] [:error] [pid 26521:tid 26593] [client 4.194.202.71:9002] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aTwLTZdhcAPU617AKTB2eQAAAI4"]
[Fri Dec 12 20:32:13.394629 2025] [:error] [pid 27950:tid 27952] [client 4.194.202.71:8996] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aTwLTYVLRvkrdsSc1F2YeAAAAUA"]
[Fri Dec 12 20:32:13.572965 2025] [:error] [pid 26519:tid 26537] [client 4.194.202.71:8705] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aTwLTc8TRgSGOeWqEhfvKwAAAA4"]
[Fri Dec 12 20:32:13.764893 2025] [:error] [pid 26519:tid 26543] [client 4.194.202.71:8989] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aTwLTc8TRgSGOeWqEhfvLAAAABQ"]
[Fri Dec 12 20:32:13.972413 2025] [:error] [pid 26607:tid 26613] [client 4.194.202.71:8963] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aTwLTcb_b0tOEWTL2KmXRQAAAMQ"]
[Fri Dec 12 20:32:14.170782 2025] [:error] [pid 55760:tid 55771] [client 4.194.202.71:9138] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aTwLTlObDQlftFDyGawKBQAAAYk"]
[Fri Dec 12 20:32:14.357510 2025] [:error] [pid 26520:tid 26576] [client 4.194.202.71:8981] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aTwLTkG_frlY5vNXu_D2bAAAAFg"]
[Fri Dec 12 20:32:14.545362 2025] [:error] [pid 26520:tid 26561] [client 4.194.202.71:8994] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aTwLTkG_frlY5vNXu_D2bQAAAEk"]
[Fri Dec 12 20:32:14.727216 2025] [:error] [pid 60649:tid 60657] [client 4.194.202.71:8719] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aTwLTlOcUGKU3sgfHP_z5AAAAQU"]
[Fri Dec 12 20:32:14.949934 2025] [:error] [pid 26521:tid 26602] [client 4.194.202.71:8715] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aTwLTpdhcAPU617AKTB2egAAAJc"]
[Fri Dec 12 20:32:15.133859 2025] [:error] [pid 60649:tid 60665] [client 4.194.202.71:9117] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aTwLT1OcUGKU3sgfHP_z5QAAAQ0"]
[Fri Dec 12 20:32:15.349488 2025] [:error] [pid 26607:tid 26626] [client 4.194.202.71:8914] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aTwLT8b_b0tOEWTL2KmXRgAAANE"]
[Fri Dec 12 20:32:15.535005 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:8974] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aTwLT5dhcAPU617AKTB2fwAAAIU"]
[Fri Dec 12 20:32:15.732106 2025] [:error] [pid 26607:tid 26630] [client 4.194.202.71:8999] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aTwLT8b_b0tOEWTL2KmXSAAAANU"]
[Fri Dec 12 20:32:15.929566 2025] [:error] [pid 26520:tid 26569] [client 4.194.202.71:8712] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aTwLT0G_frlY5vNXu_D2cAAAAFE"]
[Fri Dec 12 20:32:16.107476 2025] [:error] [pid 55760:tid 55764] [client 4.194.202.71:9036] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aTwLUFObDQlftFDyGawKCQAAAYI"]
[Fri Dec 12 20:32:16.293243 2025] [:error] [pid 26520:tid 26562] [client 4.194.202.71:9008] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aTwLUEG_frlY5vNXu_D2cQAAAEo"]
[Fri Dec 12 20:32:16.494621 2025] [:error] [pid 26520:tid 26553] [client 4.194.202.71:8988] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLUEG_frlY5vNXu_D2cgAAAEE"]
[Fri Dec 12 20:32:16.675622 2025] [:error] [pid 26521:tid 26597] [client 4.194.202.71:8985] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLUJdhcAPU617AKTB2gAAAAJI"]
[Fri Dec 12 20:32:16.854524 2025] [:error] [pid 26521:tid 26594] [client 4.194.202.71:8721] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLUJdhcAPU617AKTB2hAAAAI8"]
[Fri Dec 12 20:32:17.051720 2025] [:error] [pid 26521:tid 26586] [client 4.194.202.71:8980] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aTwLUZdhcAPU617AKTB2hQAAAIc"]
[Fri Dec 12 20:32:17.229441 2025] [:error] [pid 26521:tid 26589] [client 4.194.202.71:8736] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aTwLUZdhcAPU617AKTB2hgAAAIo"]
[Fri Dec 12 20:32:17.427000 2025] [:error] [pid 55760:tid 55784] [client 4.194.202.71:8723] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aTwLUVObDQlftFDyGawKDAAAAZY"]
[Fri Dec 12 20:32:17.604755 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:8741] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aTwLUZdhcAPU617AKTB2hwAAAJA"]
[Fri Dec 12 20:32:17.798742 2025] [:error] [pid 27950:tid 27976] [client 4.194.202.71:8720] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aTwLUYVLRvkrdsSc1F2YewAAAVg"]
[Fri Dec 12 20:32:17.979211 2025] [:error] [pid 27950:tid 27960] [client 4.194.202.71:8711] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aTwLUYVLRvkrdsSc1F2YfAAAAUg"]
[Fri Dec 12 20:32:18.188442 2025] [:error] [pid 55760:tid 55776] [client 4.194.202.71:8739] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aTwLUlObDQlftFDyGawKDQAAAY4"]
[Fri Dec 12 20:32:18.373245 2025] [:error] [pid 27950:tid 27954] [client 4.194.202.71:9052] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aTwLUoVLRvkrdsSc1F2YfQAAAUI"]
[Fri Dec 12 20:32:18.558777 2025] [:error] [pid 27950:tid 27955] [client 4.194.202.71:8742] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aTwLUoVLRvkrdsSc1F2YfwAAAUM"]
[Fri Dec 12 20:32:18.748385 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:8920] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aTwLUsb_b0tOEWTL2KmXSgAAAM4"]
[Fri Dec 12 20:32:18.931208 2025] [:error] [pid 26607:tid 26621] [client 4.194.202.71:9180] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aTwLUsb_b0tOEWTL2KmXSwAAAMw"]
[Fri Dec 12 20:32:19.110779 2025] [:error] [pid 55760:tid 55773] [client 4.194.202.71:8752] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aTwLU1ObDQlftFDyGawKDgAAAYs"]
[Fri Dec 12 20:32:19.289774 2025] [:error] [pid 26607:tid 26625] [client 4.194.202.71:8968] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aTwLU8b_b0tOEWTL2KmXTAAAANA"]
[Fri Dec 12 20:32:19.474497 2025] [:error] [pid 26521:tid 26601] [client 4.194.202.71:8923] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aTwLU5dhcAPU617AKTB2iAAAAJY"]
[Fri Dec 12 20:32:19.648624 2025] [:error] [pid 26519:tid 26531] [client 4.194.202.71:8765] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aTwLU88TRgSGOeWqEhfvLwAAAAg"]
[Fri Dec 12 20:32:19.824605 2025] [:error] [pid 26519:tid 26536] [client 4.194.202.71:9048] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aTwLU88TRgSGOeWqEhfvMAAAAA0"]
[Fri Dec 12 20:32:20.003883 2025] [:error] [pid 26521:tid 26591] [client 4.194.202.71:8837] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aTwLVJdhcAPU617AKTB2iQAAAIw"]
[Fri Dec 12 20:32:20.183445 2025] [:error] [pid 60649:tid 60671] [client 4.194.202.71:8917] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aTwLVFOcUGKU3sgfHP_z6AAAARM"]
[Fri Dec 12 20:32:20.357720 2025] [:error] [pid 60649:tid 60656] [client 4.194.202.71:9145] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aTwLVFOcUGKU3sgfHP_z6QAAAQQ"]
[Fri Dec 12 20:32:20.531486 2025] [:error] [pid 27950:tid 27957] [client 4.194.202.71:8961] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aTwLVIVLRvkrdsSc1F2YgQAAAUU"]
[Fri Dec 12 20:32:20.705330 2025] [:error] [pid 26519:tid 26540] [client 4.194.202.71:8902] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aTwLVM8TRgSGOeWqEhfvMwAAABE"]
[Fri Dec 12 20:32:20.896680 2025] [:error] [pid 26520:tid 26554] [client 4.194.202.71:8725] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aTwLVEG_frlY5vNXu_D2dwAAAEI"]
[Fri Dec 12 20:32:21.079224 2025] [:error] [pid 26521:tid 26585] [client 4.194.202.71:8713] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aTwLVZdhcAPU617AKTB2igAAAIY"]
[Fri Dec 12 20:32:21.259576 2025] [:error] [pid 60649:tid 60675] [client 4.194.202.71:9007] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aTwLVVOcUGKU3sgfHP_z6gAAARc"]
[Fri Dec 12 20:32:21.438808 2025] [:error] [pid 26521:tid 26580] [client 4.194.202.71:9022] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aTwLVZdhcAPU617AKTB2jwAAAIE"]
[Fri Dec 12 20:32:21.617588 2025] [:error] [pid 26521:tid 26596] [client 4.194.202.71:8767] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aTwLVZdhcAPU617AKTB2kAAAAJE"]
[Fri Dec 12 20:32:21.800044 2025] [:error] [pid 60649:tid 60668] [client 4.194.202.71:8729] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aTwLVVOcUGKU3sgfHP_z6wAAARA"]
[Fri Dec 12 20:32:21.991933 2025] [:error] [pid 26521:tid 26598] [client 4.194.202.71:8918] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aTwLVZdhcAPU617AKTB2kQAAAJM"]
[Fri Dec 12 20:32:22.175135 2025] [:error] [pid 26519:tid 26530] [client 4.194.202.71:8953] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aTwLVs8TRgSGOeWqEhfvNQAAAAc"]
[Fri Dec 12 20:32:22.353814 2025] [:error] [pid 26607:tid 26622] [client 4.194.202.71:8761] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aTwLVsb_b0tOEWTL2KmXTwAAAM0"]
[Fri Dec 12 20:32:22.530810 2025] [:error] [pid 26519:tid 26524] [client 4.194.202.71:8732] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aTwLVs8TRgSGOeWqEhfvNgAAAAE"]
[Fri Dec 12 20:32:22.706684 2025] [:error] [pid 26607:tid 26628] [client 4.194.202.71:9130] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aTwLVsb_b0tOEWTL2KmXUAAAANM"]
[Fri Dec 12 20:32:22.903712 2025] [:error] [pid 26607:tid 26617] [client 4.194.202.71:9053] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aTwLVsb_b0tOEWTL2KmXUQAAAMg"]
[Fri Dec 12 20:32:23.078554 2025] [:error] [pid 26519:tid 26528] [client 4.194.202.71:8929] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aTwLV88TRgSGOeWqEhfvOAAAAAU"]
[Fri Dec 12 20:32:23.252816 2025] [:error] [pid 26607:tid 26618] [client 4.194.202.71:8907] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aTwLV8b_b0tOEWTL2KmXUgAAAMk"]
[Fri Dec 12 20:32:23.482121 2025] [:error] [pid 27950:tid 27974] [client 4.194.202.71:9010] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aTwLV4VLRvkrdsSc1F2YgwAAAVY"]
[Fri Dec 12 20:32:23.675156 2025] [:error] [pid 55760:tid 55772] [client 4.194.202.71:9000] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aTwLV1ObDQlftFDyGawKEgAAAYo"]
[Fri Dec 12 20:32:23.850719 2025] [:error] [pid 26607:tid 26619] [client 4.194.202.71:8708] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aTwLV8b_b0tOEWTL2KmXUwAAAMo"]
[Fri Dec 12 20:32:24.039567 2025] [:error] [pid 55760:tid 55785] [client 4.194.202.71:8861] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aTwLWFObDQlftFDyGawKEwAAAZc"]
[Fri Dec 12 20:32:24.220885 2025] [:error] [pid 26520:tid 26575] [client 4.194.202.71:8937] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aTwLWEG_frlY5vNXu_D2egAAAFc"]
[Fri Dec 12 20:32:24.416086 2025] [:error] [pid 26519:tid 26523] [client 4.194.202.71:8710] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aTwLWM8TRgSGOeWqEhfvOwAAAAA"]
[Fri Dec 12 20:32:24.608422 2025] [:error] [pid 26520:tid 26555] [client 4.194.202.71:8900] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aTwLWEG_frlY5vNXu_D2ewAAAEM"]
[Fri Dec 12 20:32:24.785170 2025] [:error] [pid 26521:tid 26584] [client 4.194.202.71:8916] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aTwLWJdhcAPU617AKTB2lQAAAIU"]
[Fri Dec 12 20:32:24.981037 2025] [:error] [pid 26521:tid 26597] [client 4.194.202.71:9011] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aTwLWJdhcAPU617AKTB2lgAAAJI"]
[Fri Dec 12 20:32:25.160012 2025] [:error] [pid 27950:tid 27958] [client 4.194.202.71:8922] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aTwLWYVLRvkrdsSc1F2YhAAAAUY"]
[Fri Dec 12 20:32:25.336622 2025] [:error] [pid 27950:tid 27971] [client 4.194.202.71:9004] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aTwLWYVLRvkrdsSc1F2YhQAAAVM"]
[Fri Dec 12 20:32:25.543507 2025] [:error] [pid 27950:tid 27966] [client 4.194.202.71:8735] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aTwLWYVLRvkrdsSc1F2YhgAAAU4"]
[Fri Dec 12 20:32:25.719345 2025] [:error] [pid 27950:tid 27969] [client 4.194.202.71:8952] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aTwLWYVLRvkrdsSc1F2YhwAAAVE"]
[Fri Dec 12 20:32:25.896772 2025] [:error] [pid 26520:tid 26572] [client 4.194.202.71:8948] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aTwLWUG_frlY5vNXu_D2fQAAAFQ"]
[Fri Dec 12 20:32:26.105853 2025] [:error] [pid 26521:tid 26603] [client 4.194.202.71:8992] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aTwLWpdhcAPU617AKTB2mAAAAJg"]
[Fri Dec 12 20:32:26.281075 2025] [:error] [pid 26519:tid 26529] [client 4.194.202.71:8718] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aTwLWs8TRgSGOeWqEhfvPAAAAAY"]
[Fri Dec 12 20:32:26.462076 2025] [:error] [pid 26519:tid 26547] [client 4.194.202.71:8834] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aTwLWs8TRgSGOeWqEhfvPQAAABg"]
[Fri Dec 12 20:32:26.654873 2025] [:error] [pid 26607:tid 26614] [client 4.194.202.71:8717] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aTwLWsb_b0tOEWTL2KmXVwAAAMU"]
[Fri Dec 12 20:32:26.828584 2025] [:error] [pid 26607:tid 26611] [client 4.194.202.71:8737] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTwLWsb_b0tOEWTL2KmXWAAAAMI"]
[Fri Dec 12 20:32:27.001979 2025] [:error] [pid 26607:tid 26613] [client 4.194.202.71:8927] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTwLW8b_b0tOEWTL2KmXWgAAAMQ"]
[Fri Dec 12 20:32:27.175925 2025] [:error] [pid 26607:tid 26626] [client 4.194.202.71:9066] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTwLW8b_b0tOEWTL2KmXXAAAANE"]
[Fri Dec 12 20:32:27.353378 2025] [:error] [pid 55760:tid 55769] [client 4.194.202.71:8910] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTwLW1ObDQlftFDyGawKFQAAAYc"]
[Fri Dec 12 20:32:27.527341 2025] [:error] [pid 55760:tid 55771] [client 4.194.202.71:8977] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aTwLW1ObDQlftFDyGawKFgAAAYk"]
[Fri Dec 12 20:32:27.706926 2025] [:error] [pid 55760:tid 55781] [client 4.194.202.71:8908] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aTwLW1ObDQlftFDyGawKGAAAAZM"]
[Fri Dec 12 20:32:27.880794 2025] [:error] [pid 55760:tid 55766] [client 4.194.202.71:9015] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aTwLW1ObDQlftFDyGawKGQAAAYQ"]
[Fri Dec 12 20:32:28.068853 2025] [:error] [pid 26607:tid 26630] [client 4.194.202.71:8706] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aTwLXMb_b0tOEWTL2KmXXgAAANU"]
[Fri Dec 12 20:32:28.243271 2025] [:error] [pid 26521:tid 26595] [client 4.194.202.71:8880] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admiin.php"] [unique_id "aTwLXJdhcAPU617AKTB2nQAAAJA"]
[Fri Dec 12 20:32:28.422811 2025] [:error] [pid 55760:tid 55770] [client 4.194.202.71:8930] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admiin.php"] [unique_id "aTwLXFObDQlftFDyGawKHAAAAYg"]
[Fri Dec 12 20:32:28.621336 2025] [:error] [pid 26521:tid 26591] [client 4.194.202.71:8881] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admiin.php"] [unique_id "aTwLXJdhcAPU617AKTB2nwAAAIw"]
[Fri Dec 12 20:32:28.795277 2025] [:error] [pid 27950:tid 27975] [client 4.194.202.71:8770] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admiin.php"] [unique_id "aTwLXIVLRvkrdsSc1F2YjgAAAVc"]
[Fri Dec 12 20:32:28.969043 2025] [:error] [pid 26521:tid 26585] [client 4.194.202.71:16236] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xse25.php"] [unique_id "aTwLXJdhcAPU617AKTB2oAAAAIY"]
[Fri Dec 12 20:32:29.151882 2025] [:error] [pid 55760:tid 55782] [client 4.194.202.71:8901] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xse25.php"] [unique_id "aTwLXVObDQlftFDyGawKHQAAAZQ"]
[Fri Dec 12 20:32:29.327070 2025] [:error] [pid 60649:tid 60670] [client 4.194.202.71:8984] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xse25.php"] [unique_id "aTwLXVOcUGKU3sgfHP_z7QAAARI"]
[Fri Dec 12 20:32:29.518356 2025] [:error] [pid 26519:tid 26525] [client 4.194.202.71:8757] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xse25.php"] [unique_id "aTwLXc8TRgSGOeWqEhfvPwAAAAI"]
[Fri Dec 12 20:32:29.692920 2025] [:error] [pid 60649:tid 60660] [client 4.194.202.71:8751] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/customize/sx.php"] [unique_id "aTwLXVOcUGKU3sgfHP_z7wAAAQg"]
[Fri Dec 12 20:32:29.875968 2025] [:error] [pid 60649:tid 60665] [client 4.194.202.71:8743] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aTwLXVOcUGKU3sgfHP_z8AAAAQ0"]
[Fri Dec 12 20:32:30.050990 2025] [:error] [pid 26607:tid 26628] [client 4.194.202.71:8724] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aTwLXsb_b0tOEWTL2KmXYwAAANM"]
[Fri Dec 12 20:32:30.227124 2025] [:error] [pid 55760:tid 55773] [client 4.194.202.71:8950] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aTwLXlObDQlftFDyGawKIAAAAYs"]
[Fri Dec 12 20:32:30.411751 2025] [:error] [pid 55760:tid 55765] [client 4.194.202.71:9009] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aTwLXlObDQlftFDyGawKIQAAAYM"]
[Fri Dec 12 20:32:30.594591 2025] [:error] [pid 55760:tid 55783] [client 4.194.202.71:8941] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTwLXlObDQlftFDyGawKIgAAAZU"]
[Fri Dec 12 20:32:30.779444 2025] [:error] [pid 55760:tid 55772] [client 4.194.202.71:8745] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTwLXlObDQlftFDyGawKIwAAAYo"]
[Fri Dec 12 20:32:30.954102 2025] [:error] [pid 60649:tid 60666] [client 4.194.202.71:8919] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTwLXlOcUGKU3sgfHP_z8QAAAQ4"]
[Fri Dec 12 20:32:31.152025 2025] [:error] [pid 55760:tid 55762] [client 4.194.202.71:8854] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aTwLX1ObDQlftFDyGawKJgAAAYA"]
[Fri Dec 12 20:32:31.338303 2025] [:error] [pid 60649:tid 60664] [client 4.194.202.71:8740] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aTwLX1OcUGKU3sgfHP_z8wAAAQw"]
[Fri Dec 12 20:32:31.513791 2025] [:error] [pid 55760:tid 55769] [client 4.194.202.71:8753] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-signin.php"] [unique_id "aTwLX1ObDQlftFDyGawKKQAAAYc"]
[Fri Dec 12 20:32:31.726057 2025] [:error] [pid 55760:tid 55774] [client 4.194.202.71:8846] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-signin.php"] [unique_id "aTwLX1ObDQlftFDyGawKKgAAAYw"]
[Fri Dec 12 20:32:31.900483 2025] [:error] [pid 27950:tid 27965] [client 4.194.202.71:8905] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-signin.php"] [unique_id "aTwLX4VLRvkrdsSc1F2YkQAAAU0"]
[Fri Dec 12 20:32:32.074939 2025] [:error] [pid 60649:tid 60671] [client 4.194.202.71:8912] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aTwLYFOcUGKU3sgfHP_z9gAAARM"]
[Fri Dec 12 20:32:32.275453 2025] [:error] [pid 27950:tid 27973] [client 4.194.202.71:8954] [client 4.194.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rejuva.au"] [uri "/fm.php"] [unique_id "aTwLYIVLRvkrdsSc1F2YkwAAAVU"]
[Fri Dec 12 20:32:32.474688 2025] [:error] [pid 26607:tid 26615] [client 4.194.202.71:8935] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shoyo.php"] [unique_id "aTwLYMb_b0tOEWTL2KmXZgAAAMY"]
[Fri Dec 12 20:32:32.649657 2025] [:error] [pid 60649:tid 60675] [client 4.194.202.71:8758] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shoyo.php"] [unique_id "aTwLYFOcUGKU3sgfHP_z9wAAARc"]
[Fri Dec 12 20:32:32.831722 2025] [:error] [pid 60649:tid 60653] [client 4.194.202.71:8844] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shoyo.php"] [unique_id "aTwLYFOcUGKU3sgfHP_z-AAAAQE"]
[Fri Dec 12 20:32:33.036602 2025] [:error] [pid 60649:tid 60661] [client 4.194.202.71:8762] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shoyo.php"] [unique_id "aTwLYVOcUGKU3sgfHP_z-QAAAQk"]
[Fri Dec 12 20:32:33.212851 2025] [:error] [pid 60649:tid 60673] [client 4.194.202.71:8889] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aTwLYVOcUGKU3sgfHP_z-wAAARU"]
[Fri Dec 12 20:32:33.396196 2025] [:error] [pid 60649:tid 60674] [client 4.194.202.71:8734] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aTwLYVOcUGKU3sgfHP_z_AAAARY"]
[Fri Dec 12 20:32:33.574708 2025] [:error] [pid 60649:tid 60670] [client 4.194.202.71:8763] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aTwLYVOcUGKU3sgfHP_z_QAAARI"]
[Fri Dec 12 20:32:33.773187 2025] [:error] [pid 55760:tid 55766] [client 4.194.202.71:8943] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aTwLYVObDQlftFDyGawKKwAAAYQ"]
[Fri Dec 12 20:32:33.947696 2025] [:error] [pid 27950:tid 27958] [client 4.194.202.71:8867] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aTwLYYVLRvkrdsSc1F2YlQAAAUY"]
[Fri Dec 12 20:32:34.127128 2025] [:error] [pid 60649:tid 60663] [client 4.194.202.71:8998] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aTwLYlOcUGKU3sgfHP_z_gAAAQs"]
[Fri Dec 12 20:32:34.302144 2025] [:error] [pid 60649:tid 60660] [client 4.194.202.71:8945] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aTwLYlOcUGKU3sgfHP_z_wAAAQg"]
[Fri Dec 12 20:32:34.477105 2025] [:error] [pid 27950:tid 27971] [client 4.194.202.71:8979] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aTwLYoVLRvkrdsSc1F2YlgAAAVM"]
[Fri Dec 12 20:32:34.663519 2025] [:error] [pid 26521:tid 26593] [client 4.194.202.71:8976] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yyy.php"] [unique_id "aTwLYpdhcAPU617AKTB2pAAAAI4"]
[Fri Dec 12 20:32:34.852043 2025] [:error] [pid 27950:tid 27966] [client 4.194.202.71:8983] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yyy.php"] [unique_id "aTwLYoVLRvkrdsSc1F2YlwAAAU4"]
[Fri Dec 12 20:32:35.026052 2025] [:error] [pid 55760:tid 55782] [client 4.194.202.71:8744] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yyy.php"] [unique_id "aTwLY1ObDQlftFDyGawKLQAAAZQ"]
[Fri Dec 12 20:32:35.215747 2025] [:error] [pid 27950:tid 27969] [client 4.194.202.71:8958] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yyy.php"] [unique_id "aTwLY4VLRvkrdsSc1F2YmAAAAVE"]
[Fri Dec 12 20:32:35.396403 2025] [:error] [pid 60649:tid 60665] [client 4.194.202.71:8936] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wakak.php"] [unique_id "aTwLY1OcUGKU3sgfHP_0AgAAAQ0"]
[Fri Dec 12 20:32:35.576472 2025] [:error] [pid 26521:tid 26602] [client 4.194.202.71:8776] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wakak.php"] [unique_id "aTwLY5dhcAPU617AKTB2pgAAAJc"]
[Fri Dec 12 20:32:35.756669 2025] [:error] [pid 60649:tid 60662] [client 4.194.202.71:8852] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wakak.php"] [unique_id "aTwLY1OcUGKU3sgfHP_0AwAAAQo"]
[Fri Dec 12 20:32:35.933169 2025] [:error] [pid 26521:tid 26579] [client 4.194.202.71:8951] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wakak.php"] [unique_id "aTwLY5dhcAPU617AKTB2qAAAAIA"]
[Fri Dec 12 20:32:36.108294 2025] [:error] [pid 55760:tid 55776] [client 4.194.202.71:8835] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gzone.php"] [unique_id "aTwLZFObDQlftFDyGawKMAAAAY4"]
[Fri Dec 12 20:32:36.297263 2025] [:error] [pid 60649:tid 60664] [client 4.194.202.71:8876] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gzone.php"] [unique_id "aTwLZFOcUGKU3sgfHP_0BgAAAQw"]
[Fri Dec 12 20:32:36.479794 2025] [:error] [pid 26521:tid 26599] [client 4.194.202.71:8903] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gzone.php"] [unique_id "aTwLZJdhcAPU617AKTB2qgAAAJQ"]
[Fri Dec 12 20:32:36.676857 2025] [:error] [pid 26521:tid 26601] [client 4.194.202.71:8887] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gzone.php"] [unique_id "aTwLZJdhcAPU617AKTB2qwAAAJY"]
[Fri Dec 12 20:32:36.853692 2025] [:error] [pid 27950:tid 27961] [client 4.194.202.71:9012] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nansa.php"] [unique_id "aTwLZIVLRvkrdsSc1F2YmwAAAUk"]
[Fri Dec 12 20:32:37.027941 2025] [:error] [pid 60649:tid 60669] [client 4.194.202.71:8866] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nansa.php"] [unique_id "aTwLZVOcUGKU3sgfHP_0CgAAARE"]
[Fri Dec 12 20:32:37.204860 2025] [:error] [pid 26607:tid 26612] [client 4.194.202.71:8862] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nansa.php"] [unique_id "aTwLZcb_b0tOEWTL2KmXaQAAAMM"]
[Fri Dec 12 20:32:37.381844 2025] [:error] [pid 55760:tid 55782] [client 4.194.202.71:8842] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nansa.php"] [unique_id "aTwLZVObDQlftFDyGawKQAAAAZQ"]
[Fri Dec 12 20:32:37.564011 2025] [:error] [pid 26521:tid 26583] [client 4.194.202.71:8764] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/quoys.php"] [unique_id "aTwLZZdhcAPU617AKTB2uAAAAIQ"]
[Fri Dec 12 20:32:37.739994 2025] [:error] [pid 26521:tid 26594] [client 4.194.202.71:8858] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/quoys.php"] [unique_id "aTwLZZdhcAPU617AKTB2ugAAAI8"]
[Fri Dec 12 20:32:37.920491 2025] [:error] [pid 60649:tid 60661] [client 4.194.202.71:8786] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/quoys.php"] [unique_id "aTwLZVOcUGKU3sgfHP_0EAAAAQk"]
[Fri Dec 12 20:32:38.100376 2025] [:error] [pid 60649:tid 60673] [client 4.194.202.71:8899] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/quoys.php"] [unique_id "aTwLZlOcUGKU3sgfHP_0EgAAARU"]
[Fri Dec 12 20:32:38.284448 2025] [:error] [pid 26520:tid 26569] [client 4.194.202.71:8756] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waw.php"] [unique_id "aTwLZkG_frlY5vNXu_D2gAAAAFE"]
[Fri Dec 12 20:32:38.459669 2025] [:error] [pid 26521:tid 26592] [client 4.194.202.71:8728] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waw.php"] [unique_id "aTwLZpdhcAPU617AKTB2uwAAAI0"]
[Fri Dec 12 20:32:38.637408 2025] [:error] [pid 60649:tid 60660] [client 4.194.202.71:8898] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waw.php"] [unique_id "aTwLZlOcUGKU3sgfHP_0FAAAAQg"]
[Fri Dec 12 20:32:38.811737 2025] [:error] [pid 27950:tid 27964] [client 4.194.202.71:8766] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waw.php"] [unique_id "aTwLZoVLRvkrdsSc1F2YnAAAAUw"]
[Fri Dec 12 20:32:38.996213 2025] [:error] [pid 27950:tid 27975] [client 4.194.202.71:8727] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wbw.php"] [unique_id "aTwLZoVLRvkrdsSc1F2YnQAAAVc"]
[Fri Dec 12 20:32:39.175467 2025] [:error] [pid 26521:tid 26582] [client 4.194.202.71:8832] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wbw.php"] [unique_id "aTwLZ5dhcAPU617AKTB2wgAAAIM"]
[Fri Dec 12 20:32:39.376716 2025] [:error] [pid 26521:tid 26580] [client 4.194.202.71:8803] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wbw.php"] [unique_id "aTwLZ5dhcAPU617AKTB2xAAAAIE"]
[Fri Dec 12 20:32:39.554114 2025] [:error] [pid 27950:tid 27970] [client 4.194.202.71:8956] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wbw.php"] [unique_id "aTwLZ4VLRvkrdsSc1F2YngAAAVI"]
[Fri Dec 12 20:32:39.742008 2025] [:error] [pid 26521:tid 26581] [client 4.194.202.71:9054] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wfw.php"] [unique_id "aTwLZ5dhcAPU617AKTB2xQAAAII"]
[Fri Dec 12 20:32:39.941472 2025] [:error] [pid 55760:tid 55775] [client 4.194.202.71:8859] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wfw.php"] [unique_id "aTwLZ1ObDQlftFDyGawKVQAAAY0"]
[Fri Dec 12 20:32:40.115765 2025] [:error] [pid 26521:tid 26600] [client 4.194.202.71:9051] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wfw.php"] [unique_id "aTwLaJdhcAPU617AKTB2xgAAAJU"]
[Fri Dec 12 20:32:40.294373 2025] [:error] [pid 27950:tid 27954] [client 4.194.202.71:8839] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wfw.php"] [unique_id "aTwLaIVLRvkrdsSc1F2YoAAAAUI"]
[Fri Dec 12 20:32:40.472076 2025] [:error] [pid 55760:tid 55762] [client 4.194.202.71:8947] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/031.php"] [unique_id "aTwLaFObDQlftFDyGawKWAAAAYA"]
[Fri Dec 12 20:32:40.653819 2025] [:error] [pid 55760:tid 55784] [client 4.194.202.71:8836] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/031.php"] [unique_id "aTwLaFObDQlftFDyGawKWQAAAZY"]
[Fri Dec 12 20:32:40.837629 2025] [:error] [pid 26521:tid 26583] [client 4.194.202.71:8932] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/031.php"] [unique_id "aTwLaJdhcAPU617AKTB2ywAAAIQ"]
[Fri Dec 12 20:32:41.018765 2025] [:error] [pid 26521:tid 26599] [client 4.194.202.71:8746] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/031.php"] [unique_id "aTwLaZdhcAPU617AKTB2zAAAAJQ"]
[Fri Dec 12 20:32:41.195267 2025] [:error] [pid 27950:tid 27965] [client 4.194.202.71:8939] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/system_log.php"] [unique_id "aTwLaYVLRvkrdsSc1F2YoQAAAU0"]
[Fri Dec 12 20:32:41.376406 2025] [:error] [pid 60649:tid 60655] [client 4.194.202.71:8748] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/system_log.php"] [unique_id "aTwLaVOcUGKU3sgfHP_0GQAAAQM"]
[Fri Dec 12 20:32:41.561812 2025] [:error] [pid 27950:tid 27963] [client 4.194.202.71:8934] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/system_log.php"] [unique_id "aTwLaYVLRvkrdsSc1F2YogAAAUs"]
[Fri Dec 12 20:32:41.742381 2025] [:error] [pid 26607:tid 26623] [client 4.194.202.71:8726] [client 4.194.202.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/system_log.php"] [unique_id "aTwLacb_b0tOEWTL2KmXbAAAAM4"]
[Fri Dec 12 21:08:29.619026 2025] [:error] [pid 60649:tid 60664] [client 129.226.93.214:59290] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aTwTzVOcUGKU3sgfHP_7YwAAAQw"]
[Sat Dec 13 00:54:36.496500 2025] [:error] [pid 26520:tid 26565] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 13 00:54:36.831451 2025] [:error] [pid 26520:tid 26559] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 13 00:54:37.184350 2025] [:error] [pid 26520:tid 26552] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Dec 13 00:54:37.533933 2025] [:error] [pid 26520:tid 26576] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Dec 13 00:54:37.869059 2025] [:error] [pid 26520:tid 26566] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 13 00:54:38.203716 2025] [:error] [pid 26520:tid 26568] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 13 00:54:38.532396 2025] [:error] [pid 26520:tid 26555] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 13 00:54:38.856648 2025] [:error] [pid 26520:tid 26569] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 13 00:54:39.513987 2025] [:error] [pid 26520:tid 26561] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 13 00:54:40.187965 2025] [:error] [pid 26520:tid 26552] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Dec 13 00:54:40.512028 2025] [:error] [pid 26520:tid 26566] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Dec 13 00:54:40.839263 2025] [:error] [pid 26520:tid 26556] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 13 00:54:41.178694 2025] [:error] [pid 26520:tid 26555] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Dec 13 00:54:41.516716 2025] [:error] [pid 26520:tid 26574] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Dec 13 00:54:43.155147 2025] [:error] [pid 26520:tid 26574] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Dec 13 00:54:43.505481 2025] [:error] [pid 26520:tid 26554] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Dec 13 00:54:43.851052 2025] [:error] [pid 26520:tid 26559] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Dec 13 00:54:44.193073 2025] [:error] [pid 26520:tid 26552] [client 188.212.135.169:24783] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Dec 13 00:54:48.987153 2025] [:error] [pid 26520:tid 26562] [client 188.212.135.169:24783] [client 188.212.135.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aTxI2EG_frlY5vNXu_AovgAAAEo"]
[Sat Dec 13 00:54:50.727832 2025] [:error] [pid 26520:tid 26569] [client 188.212.135.160:58489] [client 188.212.135.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aTxI2kG_frlY5vNXu_AoxQAAAFE"]
[Sat Dec 13 00:54:53.467466 2025] [:error] [pid 55760:tid 55776] [client 188.212.135.184:57605] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 13 00:54:54.486744 2025] [:error] [pid 55760:tid 55768] [client 188.212.135.184:57605] [client 188.212.135.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aTxI3lObDQlftFDyGaxS2gAAAYY"]
[Sat Dec 13 00:54:55.793974 2025] [:error] [pid 26519:tid 26527] [client 188.212.135.168:61791] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 13 00:54:56.114231 2025] [:error] [pid 26519:tid 26537] [client 188.212.135.168:61791] [client 188.212.135.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aTxI4M8TRgSGOeWqEhceAQAAAA4"]
[Sat Dec 13 00:54:57.088490 2025] [:error] [pid 60649:tid 60652] [client 188.212.135.168:32087] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Dec 13 00:54:58.846603 2025] [:error] [pid 60649:tid 60654] [client 188.212.135.168:32087] [client 188.212.135.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aTxI4lOcUGKU3sgfHP8sXwAAAQI"]
[Sat Dec 13 00:55:01.003597 2025] [:error] [pid 26519:tid 26545] [client 188.212.135.154:63421] [client 188.212.135.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aTxI5c8TRgSGOeWqEhceBQAAABY"]
[Sat Dec 13 00:55:01.665493 2025] [:error] [pid 26607:tid 26627] [client 188.212.135.154:46297] [client 188.212.135.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aTxI5cb_b0tOEWTL2KnPHQAAANI"]
[Sat Dec 13 00:55:02.283586 2025] [:error] [pid 26521:tid 26584] [client 188.212.135.186:63031] [client 188.212.135.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aTxI5pdhcAPU617AKTDTCgAAAIU"]
[Sat Dec 13 00:55:02.929819 2025] [:error] [pid 27950:tid 27963] [client 188.212.135.189:21225] [client 188.212.135.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aTxI5oVLRvkrdsSc1F3XJgAAAUs"]
[Sat Dec 13 00:55:03.595046 2025] [:error] [pid 55760:tid 55776] [client 188.212.135.158:31737] [client 188.212.135.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aTxI51ObDQlftFDyGaxS5wAAAY4"]
[Sat Dec 13 00:55:04.645565 2025] [:error] [pid 26520:tid 26569] [client 188.212.135.205:40991] [client 188.212.135.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aTxI6EG_frlY5vNXu_AoywAAAFE"]
[Sat Dec 13 00:55:05.294638 2025] [:error] [pid 26519:tid 26534] [client 188.212.135.162:63121] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Dec 13 00:55:05.938129 2025] [:error] [pid 26519:tid 26541] [client 188.212.135.162:63121] [client 188.212.135.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aTxI6c8TRgSGOeWqEhceEQAAABI"]
[Sat Dec 13 00:55:07.252691 2025] [:error] [pid 55760:tid 55768] [client 188.212.135.199:23889] [client 188.212.135.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aTxI61ObDQlftFDyGaxS6wAAAYY"]
[Sat Dec 13 00:55:08.263986 2025] [:error] [pid 26520:tid 26555] [client 188.212.135.182:41627] [client 188.212.135.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aTxI7EG_frlY5vNXu_Ao0AAAAEM"]
[Sat Dec 13 00:55:08.927701 2025] [:error] [pid 27950:tid 27953] [client 188.212.135.200:31479] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Dec 13 00:55:09.250060 2025] [:error] [pid 27950:tid 27971] [client 188.212.135.200:31479] [client 188.212.135.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aTxI7YVLRvkrdsSc1F3XKwAAAVM"]
[Sat Dec 13 00:55:09.918222 2025] [:error] [pid 55760:tid 55773] [client 188.212.135.184:58153] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Dec 13 00:55:10.908025 2025] [:error] [pid 55760:tid 55763] [client 188.212.135.184:58153] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Dec 13 00:55:11.884784 2025] [:error] [pid 55760:tid 55762] [client 188.212.135.184:58153] [client 188.212.135.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aTxI71ObDQlftFDyGaxS9AAAAYA"]
[Sat Dec 13 00:55:12.565094 2025] [:error] [pid 27950:tid 27974] [client 188.212.135.186:41617] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sat Dec 13 00:55:13.704868 2025] [:error] [pid 27950:tid 27974] [client 188.212.135.186:41617] [client 188.212.135.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aTxI8YVLRvkrdsSc1F3XLQAAAVY"]
[Sat Dec 13 00:55:15.377707 2025] [:error] [pid 55760:tid 55768] [client 188.212.135.192:49907] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Dec 13 00:55:16.037153 2025] [:error] [pid 55760:tid 55782] [client 188.212.135.192:49907] [client 188.212.135.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aTxI9FObDQlftFDyGaxS-AAAAZQ"]
[Sat Dec 13 02:49:57.752134 2025] [:error] [pid 60649:tid 60662] [client 34.125.16.214:59090] [client 34.125.16.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aTxj1VOcUGKU3sgfHP8_WAAAAQo"]
[Sat Dec 13 03:36:33.458514 2025] [:error] [pid 26521:tid 26603] [client 38.97.60.82:50950] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "aTxuwZdhcAPU617AKTDz0QAAAJg"], referer: binance.com
[Sat Dec 13 03:36:34.640089 2025] [:error] [pid 27950:tid 27965] [client 38.97.60.82:59760] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aTxuwoVLRvkrdsSc1F3tQQAAAU0"], referer: binance.com
[Sat Dec 13 04:11:49.115974 2025] [:error] [pid 64355:tid 64448] [client 38.97.60.82:62326] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "aTx3Bfzy6OXYeYq3qodoKwAAAJU"], referer: binance.com
[Sat Dec 13 04:11:50.170841 2025] [:error] [pid 64354:tid 64406] [client 38.97.60.82:60170] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aTx3BmmYRhyd1x4hQJUAeQAAAEY"], referer: binance.com
[Sat Dec 13 09:06:14.620361 2025] [:error] [pid 39287:tid 39295] [client 43.164.197.209:39938] [client 43.164.197.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aTy8BjBwBW1JRRoCYqZDOwAAAQY"]
[Sat Dec 13 10:05:05.386679 2025] [:error] [pid 43747:tid 43774] [client 43.166.136.24:45300] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aTzJ0ZYw3twBd_JQEHjYJQAAABc"]
[Sat Dec 13 13:26:09.341133 2025] [:error] [pid 8243:tid 8279] [client 43.166.7.113:37344] [client 43.166.7.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aTz48SIrGC80ajIR9nJRKAAAAoM"]
[Sat Dec 13 18:19:51.587290 2025] [:error] [pid 55071:tid 55087] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/6kUgr4yGzxN.php
[Sat Dec 13 18:19:51.677933 2025] [:error] [pid 55071:tid 55088] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/tesTyuj.php
[Sat Dec 13 18:19:51.770915 2025] [:error] [pid 55071:tid 55089] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Sat Dec 13 18:19:51.861327 2025] [:error] [pid 55071:tid 55093] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Dec 13 18:19:51.953227 2025] [:error] [pid 55071:tid 55073] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/ww3.php
[Sat Dec 13 18:19:52.044744 2025] [:error] [pid 55071:tid 55079] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Sat Dec 13 18:19:52.225740 2025] [:error] [pid 55071:tid 55095] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-64wscx6shd.php
[Sat Dec 13 18:19:52.316427 2025] [:error] [pid 55071:tid 55077] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Sat Dec 13 18:19:52.409223 2025] [:error] [pid 55071:tid 55090] [client 4.194.187.1:30042] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sid.php
[Sat Dec 13 18:19:52.496765 2025] [:error] [pid 55071:tid 55082] [client 4.194.187.1:30042] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aT09yMHSpNduhEZ_mjfF9QAAAYk"]
[Sat Dec 13 18:19:52.671105 2025] [:error] [pid 43748:tid 43795] [client 4.194.187.1:30054] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aT09yKrTT0VzE3gYjcChEQAAAFA"]
[Sat Dec 13 18:19:52.850077 2025] [:error] [pid 43836:tid 43839] [client 4.194.187.1:30030] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aT09yGAEOBirsxb11nbx4wAAAME"]
[Sat Dec 13 18:19:53.035838 2025] [:error] [pid 21342:tid 21349] [client 4.194.187.1:30052] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aT09yfBL0VVSMIEvqstaNwAAAwM"]
[Sat Dec 13 18:19:53.209694 2025] [:error] [pid 22505:tid 22510] [client 4.194.187.1:30077] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aT09yTvNI-35hW16TnUPoAAAA4M"]
[Sat Dec 13 18:19:53.397106 2025] [:error] [pid 8242:tid 8259] [client 4.194.187.1:29965] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aT09ySNKA7vSGNUfnOEu0QAAAks"]
[Sat Dec 13 18:19:53.573359 2025] [:error] [pid 23013:tid 23020] [client 4.194.187.1:30035] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aT09yas9bDNWPQXUW1aNUgAAA8U"]
[Sat Dec 13 18:19:53.747110 2025] [:error] [pid 21342:tid 21369] [client 4.194.187.1:30043] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aT09yfBL0VVSMIEvqstaOAAAAxc"]
[Sat Dec 13 18:19:53.922866 2025] [:error] [pid 21342:tid 21355] [client 4.194.187.1:29970] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aT09yfBL0VVSMIEvqstaOQAAAwk"]
[Sat Dec 13 18:19:54.119799 2025] [:error] [pid 21342:tid 21365] [client 4.194.187.1:29969] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aT09yvBL0VVSMIEvqstaOgAAAxM"]
[Sat Dec 13 18:19:54.302630 2025] [:error] [pid 21342:tid 21357] [client 4.194.187.1:30053] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aT09yvBL0VVSMIEvqstaOwAAAws"]
[Sat Dec 13 18:19:54.477403 2025] [:error] [pid 39287:tid 39301] [client 4.194.187.1:15300] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aT09yjBwBW1JRRoCYqZ94QAAAQw"]
[Sat Dec 13 18:19:54.668264 2025] [:error] [pid 20799:tid 20805] [client 4.194.187.1:30064] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT09yqPz3eVRUTzZpOJuJQAAAsQ"]
[Sat Dec 13 18:19:54.874477 2025] [:error] [pid 20799:tid 20808] [client 4.194.187.1:29958] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT09yqPz3eVRUTzZpOJuJgAAAsc"]
[Sat Dec 13 18:19:55.051401 2025] [:error] [pid 20799:tid 20824] [client 4.194.187.1:30056] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT09y6Pz3eVRUTzZpOJuJwAAAtc"]
[Sat Dec 13 18:19:55.318354 2025] [:error] [pid 23013:tid 23022] [client 4.194.187.1:30019] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT09y6s9bDNWPQXUW1aNUwAAA8c"]
[Sat Dec 13 18:19:55.501313 2025] [:error] [pid 23013:tid 23018] [client 4.194.187.1:30045] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aT09y6s9bDNWPQXUW1aNVAAAA8M"]
[Sat Dec 13 18:19:55.682139 2025] [:error] [pid 21342:tid 21356] [client 4.194.187.1:30079] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aT09y_BL0VVSMIEvqstaPAAAAwo"]
[Sat Dec 13 18:19:55.868009 2025] [:error] [pid 21342:tid 21362] [client 4.194.187.1:29983] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aT09y_BL0VVSMIEvqstaPQAAAxA"]
[Sat Dec 13 18:19:56.042626 2025] [:error] [pid 21342:tid 21364] [client 4.194.187.1:29952] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aT09zPBL0VVSMIEvqstaPgAAAxI"]
[Sat Dec 13 18:19:56.252980 2025] [:error] [pid 21342:tid 21358] [client 4.194.187.1:30037] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aT09zPBL0VVSMIEvqstaPwAAAww"]
[Sat Dec 13 18:19:56.429869 2025] [:error] [pid 21342:tid 21352] [client 4.194.187.1:30039] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aT09zPBL0VVSMIEvqstaQAAAAwY"]
[Sat Dec 13 18:19:56.605974 2025] [:error] [pid 21342:tid 21354] [client 4.194.187.1:30071] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aT09zPBL0VVSMIEvqstaQQAAAwg"]
[Sat Dec 13 18:19:56.780643 2025] [:error] [pid 43747:tid 43751] [client 4.194.187.1:29973] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aT09zJYw3twBd_JQEHgfzwAAAAA"]
[Sat Dec 13 18:19:56.956920 2025] [:error] [pid 43747:tid 43765] [client 4.194.187.1:30055] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-home.php"] [unique_id "aT09zJYw3twBd_JQEHgf0AAAAA4"]
[Sat Dec 13 18:19:57.206251 2025] [:error] [pid 43747:tid 43762] [client 4.194.187.1:30041] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-home.php"] [unique_id "aT09zZYw3twBd_JQEHgf0QAAAAs"]
[Sat Dec 13 18:19:57.381151 2025] [:error] [pid 55071:tid 55084] [client 4.194.187.1:29972] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-home.php"] [unique_id "aT09zcHSpNduhEZ_mjfF-AAAAYs"]
[Sat Dec 13 18:19:57.567544 2025] [:error] [pid 21342:tid 21366] [client 4.194.187.1:30067] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-home.php"] [unique_id "aT09zfBL0VVSMIEvqstaRAAAAxQ"]
[Sat Dec 13 18:19:57.744102 2025] [:error] [pid 21342:tid 21350] [client 4.194.187.1:29956] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aT09zfBL0VVSMIEvqstaRQAAAwQ"]
[Sat Dec 13 18:19:57.927801 2025] [:error] [pid 23013:tid 23036] [client 4.194.187.1:30076] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aT09zas9bDNWPQXUW1aNVQAAA9U"]
[Sat Dec 13 18:19:58.147894 2025] [:error] [pid 21342:tid 21353] [client 4.194.187.1:29981] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aT09zvBL0VVSMIEvqstaRgAAAwc"]
[Sat Dec 13 18:19:58.324406 2025] [:error] [pid 23013:tid 23032] [client 4.194.187.1:29955] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aT09zqs9bDNWPQXUW1aNVwAAA9E"]
[Sat Dec 13 18:19:58.498646 2025] [:error] [pid 21342:tid 21359] [client 4.194.187.1:29961] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aT09zvBL0VVSMIEvqstaRwAAAw0"]
[Sat Dec 13 18:19:58.677228 2025] [:error] [pid 21342:tid 21351] [client 4.194.187.1:29962] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aT09zvBL0VVSMIEvqstaSAAAAwU"]
[Sat Dec 13 18:19:58.880626 2025] [:error] [pid 43836:tid 43857] [client 4.194.187.1:29981] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aT09zmAEOBirsxb11nbx5AAAANM"]
[Sat Dec 13 18:19:59.060876 2025] [:error] [pid 21342:tid 21361] [client 4.194.187.1:15305] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aT09z_BL0VVSMIEvqstaSQAAAw8"]
[Sat Dec 13 18:19:59.297348 2025] [:error] [pid 55071:tid 55088] [client 4.194.187.1:30038] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aT09z8HSpNduhEZ_mjfF_AAAAY8"]
[Sat Dec 13 18:19:59.471643 2025] [:error] [pid 8242:tid 8254] [client 4.194.187.1:15309] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aT09zyNKA7vSGNUfnOEu0gAAAkY"]
[Sat Dec 13 18:19:59.646492 2025] [:error] [pid 43748:tid 43784] [client 4.194.187.1:29964] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aT09z6rTT0VzE3gYjcChEgAAAEU"]
[Sat Dec 13 18:19:59.822726 2025] [:error] [pid 22505:tid 22512] [client 4.194.187.1:30025] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aT09zzvNI-35hW16TnUPpAAAA4U"]
[Sat Dec 13 18:20:00.001287 2025] [:error] [pid 8242:tid 8250] [client 4.194.187.1:29984] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aT09zyNKA7vSGNUfnOEu0wAAAkI"]
[Sat Dec 13 18:20:00.178686 2025] [:error] [pid 8242:tid 8248] [client 4.194.187.1:29961] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aT090CNKA7vSGNUfnOEu1AAAAkA"]
[Sat Dec 13 18:20:00.362379 2025] [:error] [pid 43748:tid 43791] [client 4.194.187.1:30070] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aT090KrTT0VzE3gYjcChFAAAAEw"]
[Sat Dec 13 18:20:00.538386 2025] [:error] [pid 21342:tid 21347] [client 4.194.187.1:29974] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aT090PBL0VVSMIEvqstaSgAAAwE"]
[Sat Dec 13 18:20:00.736642 2025] [:error] [pid 21342:tid 21349] [client 4.194.187.1:30074] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aT090PBL0VVSMIEvqstaSwAAAwM"]
[Sat Dec 13 18:20:00.915144 2025] [:error] [pid 21342:tid 21360] [client 4.194.187.1:30057] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aT090PBL0VVSMIEvqstaTAAAAw4"]
[Sat Dec 13 18:20:01.102335 2025] [:error] [pid 21342:tid 21355] [client 4.194.187.1:30078] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aT090fBL0VVSMIEvqstaTgAAAwk"]
[Sat Dec 13 18:20:01.283751 2025] [:error] [pid 39287:tid 39291] [client 4.194.187.1:30020] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aT090TBwBW1JRRoCYqZ94gAAAQI"]
[Sat Dec 13 18:20:01.461474 2025] [:error] [pid 22505:tid 22507] [client 4.194.187.1:15314] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aT090TvNI-35hW16TnUPpgAAA4A"]
[Sat Dec 13 18:20:01.660760 2025] [:error] [pid 21342:tid 21365] [client 4.194.187.1:30034] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aT090fBL0VVSMIEvqstaTwAAAxM"]
[Sat Dec 13 18:20:01.838667 2025] [:error] [pid 21342:tid 21357] [client 4.194.187.1:15320] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aT090fBL0VVSMIEvqstaUAAAAws"]
[Sat Dec 13 18:20:02.020079 2025] [:error] [pid 43747:tid 43752] [client 4.194.187.1:15321] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aT090pYw3twBd_JQEHgf0gAAAAE"]
[Sat Dec 13 18:20:02.218122 2025] [:error] [pid 43747:tid 43755] [client 4.194.187.1:29986] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aT090pYw3twBd_JQEHgf0wAAAAQ"]
[Sat Dec 13 18:20:02.400229 2025] [:error] [pid 43747:tid 43764] [client 4.194.187.1:29959] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aT090pYw3twBd_JQEHgf1AAAAA0"]
[Sat Dec 13 18:20:02.580716 2025] [:error] [pid 21342:tid 21370] [client 4.194.187.1:29978] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aT090vBL0VVSMIEvqstaUQAAAxg"]
[Sat Dec 13 18:20:02.757672 2025] [:error] [pid 43747:tid 43761] [client 4.194.187.1:30062] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aT090pYw3twBd_JQEHgf1QAAAAo"]
[Sat Dec 13 18:20:02.931948 2025] [:error] [pid 21342:tid 21356] [client 4.194.187.1:29953] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aT090vBL0VVSMIEvqstaUgAAAwo"]
[Sat Dec 13 18:20:03.112700 2025] [:error] [pid 43747:tid 43769] [client 4.194.187.1:29968] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aT0905Yw3twBd_JQEHgf1wAAABI"]
[Sat Dec 13 18:20:03.287325 2025] [:error] [pid 43747:tid 43770] [client 4.194.187.1:29976] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aT0905Yw3twBd_JQEHgf2AAAABM"]
[Sat Dec 13 18:20:03.476267 2025] [:error] [pid 43747:tid 43768] [client 4.194.187.1:15336] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aT0905Yw3twBd_JQEHgf2QAAABE"]
[Sat Dec 13 18:20:03.657140 2025] [:error] [pid 21342:tid 21362] [client 4.194.187.1:30033] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aT090_BL0VVSMIEvqstaVAAAAxA"]
[Sat Dec 13 18:20:03.845153 2025] [:error] [pid 22505:tid 22523] [client 4.194.187.1:30046] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aT090zvNI-35hW16TnUPpwAAA5A"]
[Sat Dec 13 18:20:04.047094 2025] [:error] [pid 8242:tid 8266] [client 4.194.187.1:30017] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aT091CNKA7vSGNUfnOEu1QAAAlI"]
[Sat Dec 13 18:20:04.226611 2025] [:error] [pid 39287:tid 39312] [client 4.194.187.1:30001] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aT091DBwBW1JRRoCYqZ95AAAARc"]
[Sat Dec 13 18:20:04.401892 2025] [:error] [pid 55071:tid 55089] [client 4.194.187.1:29979] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aT091MHSpNduhEZ_mjfF_QAAAZA"]
[Sat Dec 13 18:20:04.576564 2025] [:error] [pid 21342:tid 21358] [client 4.194.187.1:30013] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aT091PBL0VVSMIEvqstaVgAAAww"]
[Sat Dec 13 18:20:04.750990 2025] [:error] [pid 8242:tid 8261] [client 4.194.187.1:15301] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aT091CNKA7vSGNUfnOEu1gAAAk0"]
[Sat Dec 13 18:20:04.926822 2025] [:error] [pid 20799:tid 20823] [client 4.194.187.1:29963] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aT091KPz3eVRUTzZpOJuKQAAAtY"]
[Sat Dec 13 18:20:05.101028 2025] [:error] [pid 43748:tid 43800] [client 4.194.187.1:29971] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Contrller.php"] [unique_id "aT091arTT0VzE3gYjcChFQAAAFU"]
[Sat Dec 13 18:20:05.287048 2025] [:error] [pid 55071:tid 55093] [client 4.194.187.1:30059] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Contrller.php"] [unique_id "aT091cHSpNduhEZ_mjfF_gAAAZQ"]
[Sat Dec 13 18:20:05.461635 2025] [:error] [pid 39287:tid 39307] [client 4.194.187.1:30049] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Contrller.php"] [unique_id "aT091TBwBW1JRRoCYqZ95QAAARI"]
[Sat Dec 13 18:20:05.636650 2025] [:error] [pid 21342:tid 21352] [client 4.194.187.1:30063] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Contrller.php"] [unique_id "aT091fBL0VVSMIEvqstaVwAAAwY"]
[Sat Dec 13 18:20:05.826166 2025] [:error] [pid 21342:tid 21354] [client 4.194.187.1:15315] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aT091fBL0VVSMIEvqstaWAAAAwg"]
[Sat Dec 13 18:20:06.003613 2025] [:error] [pid 8242:tid 8265] [client 4.194.187.1:15316] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aT091iNKA7vSGNUfnOEu1wAAAlE"]
[Sat Dec 13 18:20:06.183083 2025] [:error] [pid 43748:tid 43779] [client 4.194.187.1:30009] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aT091qrTT0VzE3gYjcChFgAAAEA"]
[Sat Dec 13 18:20:06.363436 2025] [:error] [pid 39287:tid 39313] [client 4.194.187.1:29987] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aT091jBwBW1JRRoCYqZ95gAAARg"]
[Sat Dec 13 18:20:06.537414 2025] [:error] [pid 39287:tid 39293] [client 4.194.187.1:15328] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aT091jBwBW1JRRoCYqZ95wAAAQQ"]
[Sat Dec 13 18:20:06.721032 2025] [:error] [pid 22505:tid 22520] [client 4.194.187.1:30012] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aT091jvNI-35hW16TnUPqAAAA40"]
[Sat Dec 13 18:20:06.895498 2025] [:error] [pid 39287:tid 39311] [client 4.194.187.1:15291] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aT091jBwBW1JRRoCYqZ96QAAARY"]
[Sat Dec 13 18:20:07.070796 2025] [:error] [pid 8242:tid 8269] [client 4.194.187.1:29995] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aT091yNKA7vSGNUfnOEu2QAAAlU"]
[Sat Dec 13 18:20:07.300448 2025] [:error] [pid 8242:tid 8256] [client 4.194.187.1:15337] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aT091yNKA7vSGNUfnOEu2gAAAkg"]
[Sat Dec 13 18:20:07.503618 2025] [:error] [pid 20799:tid 20822] [client 4.194.187.1:30051] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aT0916Pz3eVRUTzZpOJuKgAAAtU"]
[Sat Dec 13 18:20:07.712252 2025] [:error] [pid 55071:tid 55074] [client 4.194.187.1:30022] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aT0918HSpNduhEZ_mjfGAAAAAYE"]
[Sat Dec 13 18:20:07.913790 2025] [:error] [pid 8242:tid 8260] [client 4.194.187.1:29993] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aT091yNKA7vSGNUfnOEu3AAAAkw"]
[Sat Dec 13 18:20:08.087775 2025] [:error] [pid 22505:tid 22515] [client 4.194.187.1:29982] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aT092DvNI-35hW16TnUPqgAAA4g"]
[Sat Dec 13 18:20:08.262008 2025] [:error] [pid 21342:tid 21366] [client 4.194.187.1:15339] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aT092PBL0VVSMIEvqstaWgAAAxQ"]
[Sat Dec 13 18:20:08.450868 2025] [:error] [pid 21342:tid 21350] [client 4.194.187.1:30018] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aT092PBL0VVSMIEvqstaWwAAAwQ"]
[Sat Dec 13 18:20:08.641747 2025] [:error] [pid 20799:tid 20825] [client 4.194.187.1:30002] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aT092KPz3eVRUTzZpOJuRQAAAtg"]
[Sat Dec 13 18:20:08.818789 2025] [:error] [pid 20799:tid 20812] [client 4.194.187.1:30010] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT092KPz3eVRUTzZpOJuUAAAAss"]
[Sat Dec 13 18:20:08.995139 2025] [:error] [pid 55071:tid 55077] [client 4.194.187.1:30058] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT092MHSpNduhEZ_mjfGAgAAAYQ"]
[Sat Dec 13 18:20:09.168366 2025] [:error] [pid 55071:tid 55090] [client 4.194.187.1:29999] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT092cHSpNduhEZ_mjfGAwAAAZE"]
[Sat Dec 13 18:20:09.350058 2025] [:error] [pid 21342:tid 21353] [client 4.194.187.1:15359] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT092fBL0VVSMIEvqstaXAAAAwc"]
[Sat Dec 13 18:20:09.533590 2025] [:error] [pid 43747:tid 43757] [client 4.194.187.1:15327] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aT092ZYw3twBd_JQEHgf2gAAAAY"]
[Sat Dec 13 18:20:09.708252 2025] [:error] [pid 21342:tid 21359] [client 4.194.187.1:30036] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aT092fBL0VVSMIEvqstaXQAAAw0"]
[Sat Dec 13 18:20:09.895700 2025] [:error] [pid 43747:tid 43775] [client 4.194.187.1:30065] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aT092ZYw3twBd_JQEHgf2wAAABg"]
[Sat Dec 13 18:20:10.075402 2025] [:error] [pid 21342:tid 21351] [client 4.194.187.1:30028] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aT092vBL0VVSMIEvqstaXgAAAwU"]
[Sat Dec 13 18:20:10.249958 2025] [:error] [pid 55071:tid 55081] [client 4.194.187.1:30004] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/krypton.php"] [unique_id "aT092sHSpNduhEZ_mjfGBQAAAYg"]
[Sat Dec 13 18:20:10.424117 2025] [:error] [pid 55071:tid 55097] [client 4.194.187.1:15351] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/krypton.php"] [unique_id "aT092sHSpNduhEZ_mjfGBgAAAZg"]
[Sat Dec 13 18:20:10.604485 2025] [:error] [pid 43747:tid 43766] [client 4.194.187.1:15307] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/krypton.php"] [unique_id "aT092pYw3twBd_JQEHgf3AAAAA8"]
[Sat Dec 13 18:20:10.785621 2025] [:error] [pid 43748:tid 43786] [client 4.194.187.1:29967] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/krypton.php"] [unique_id "aT092qrTT0VzE3gYjcChFwAAAEc"]
[Sat Dec 13 18:20:10.960243 2025] [:error] [pid 55071:tid 55085] [client 4.194.187.1:29994] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_57c3d4.php"] [unique_id "aT092sHSpNduhEZ_mjfGBwAAAYw"]
[Sat Dec 13 18:20:11.135040 2025] [:error] [pid 22505:tid 22530] [client 4.194.187.1:30003] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_57c3d4.php"] [unique_id "aT092zvNI-35hW16TnUPqwAAA5c"]
[Sat Dec 13 18:20:11.311815 2025] [:error] [pid 55071:tid 55080] [client 4.194.187.1:15303] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_57c3d4.php"] [unique_id "aT0928HSpNduhEZ_mjfGCQAAAYc"]
[Sat Dec 13 18:20:11.487938 2025] [:error] [pid 21342:tid 21361] [client 4.194.187.1:29966] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_57c3d4.php"] [unique_id "aT092_BL0VVSMIEvqstaXwAAAw8"]
[Sat Dec 13 18:20:11.668940 2025] [:error] [pid 21342:tid 21347] [client 4.194.187.1:30069] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aT092_BL0VVSMIEvqstaYAAAAwE"]
[Sat Dec 13 18:20:11.847984 2025] [:error] [pid 20799:tid 20812] [client 4.194.187.1:30011] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aT0926Pz3eVRUTzZpOJuaQAAAss"]
[Sat Dec 13 18:20:12.025470 2025] [:error] [pid 43836:tid 43853] [client 4.194.187.1:30007] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aT093GAEOBirsxb11nbx5wAAAM8"]
[Sat Dec 13 18:20:12.202925 2025] [:error] [pid 55071:tid 55086] [client 4.194.187.1:30024] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aT093MHSpNduhEZ_mjfGCwAAAY0"]
[Sat Dec 13 18:20:12.383697 2025] [:error] [pid 55071:tid 55088] [client 4.194.187.1:15308] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT093MHSpNduhEZ_mjfGDAAAAY8"]
[Sat Dec 13 18:20:12.559939 2025] [:error] [pid 43747:tid 43767] [client 4.194.187.1:30073] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT093JYw3twBd_JQEHgf3wAAABA"]
[Sat Dec 13 18:20:12.759145 2025] [:error] [pid 55071:tid 55094] [client 4.194.187.1:30008] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT093MHSpNduhEZ_mjfGDQAAAZU"]
[Sat Dec 13 18:20:12.963495 2025] [:error] [pid 55071:tid 55087] [client 4.194.187.1:29991] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT093MHSpNduhEZ_mjfGDgAAAY4"]
[Sat Dec 13 18:20:13.158781 2025] [:error] [pid 21342:tid 21360] [client 4.194.187.1:15191] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aT093fBL0VVSMIEvqstaYgAAAw4"]
[Sat Dec 13 18:20:13.333720 2025] [:error] [pid 43836:tid 43844] [client 4.194.187.1:30024] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aT093WAEOBirsxb11nbx6AAAAMY"]
[Sat Dec 13 18:20:13.507958 2025] [:error] [pid 43836:tid 43843] [client 4.194.187.1:29987] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aT093WAEOBirsxb11nbx6gAAAMU"]
[Sat Dec 13 18:20:13.685440 2025] [:error] [pid 55071:tid 55096] [client 4.194.187.1:29954] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aT093cHSpNduhEZ_mjfGDwAAAZc"]
[Sat Dec 13 18:20:13.880964 2025] [:error] [pid 55071:tid 55093] [client 4.194.187.1:15275] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aT093cHSpNduhEZ_mjfGEAAAAZQ"]
[Sat Dec 13 18:20:14.071474 2025] [:error] [pid 43836:tid 43846] [client 4.194.187.1:29989] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aT093mAEOBirsxb11nbx6wAAAMg"]
[Sat Dec 13 18:20:14.246412 2025] [:error] [pid 55071:tid 55073] [client 4.194.187.1:30050] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aT093sHSpNduhEZ_mjfGEQAAAYA"]
[Sat Dec 13 18:20:14.423916 2025] [:error] [pid 43836:tid 43859] [client 4.194.187.1:29988] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aT093mAEOBirsxb11nbx7AAAANU"]
[Sat Dec 13 18:20:14.645610 2025] [:error] [pid 21342:tid 21369] [client 4.194.187.1:30021] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aT093vBL0VVSMIEvqstaYwAAAxc"]
[Sat Dec 13 18:20:14.821892 2025] [:error] [pid 21342:tid 21365] [client 4.194.187.1:15297] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aT093vBL0VVSMIEvqstaZQAAAxM"]
[Sat Dec 13 18:20:15.037169 2025] [:error] [pid 21342:tid 21357] [client 4.194.187.1:15317] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aT093_BL0VVSMIEvqstaZgAAAws"]
[Sat Dec 13 18:20:15.235296 2025] [:error] [pid 43836:tid 43840] [client 4.194.187.1:15252] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aT0932AEOBirsxb11nbx7wAAAMI"]
[Sat Dec 13 18:20:15.441801 2025] [:error] [pid 55071:tid 55079] [client 4.194.187.1:15299] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aT0938HSpNduhEZ_mjfGEgAAAYY"]
[Sat Dec 13 18:20:15.623837 2025] [:error] [pid 55071:tid 55074] [client 4.194.187.1:15306] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aT0938HSpNduhEZ_mjfGEwAAAYE"]
[Sat Dec 13 18:20:15.801114 2025] [:error] [pid 20799:tid 20815] [client 4.194.187.1:15267] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aT0936Pz3eVRUTzZpOJuawAAAs4"]
[Sat Dec 13 18:20:15.983747 2025] [:error] [pid 43747:tid 43758] [client 4.194.187.1:15258] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aT0935Yw3twBd_JQEHgf4AAAAAc"]
[Sat Dec 13 18:20:16.167061 2025] [:error] [pid 55071:tid 55095] [client 4.194.187.1:29980] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aT094MHSpNduhEZ_mjfGFAAAAZY"]
[Sat Dec 13 18:20:16.343204 2025] [:error] [pid 55071:tid 55077] [client 4.194.187.1:15330] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aT094MHSpNduhEZ_mjfGFQAAAYQ"]
[Sat Dec 13 18:20:16.516676 2025] [:error] [pid 55071:tid 55090] [client 4.194.187.1:15345] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aT094MHSpNduhEZ_mjfGFgAAAZE"]
[Sat Dec 13 18:20:16.693174 2025] [:error] [pid 23013:tid 23038] [client 4.194.187.1:30031] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aT094Ks9bDNWPQXUW1aNWAAAA9c"]
[Sat Dec 13 18:20:16.867951 2025] [:error] [pid 23013:tid 23034] [client 4.194.187.1:15302] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aT094Ks9bDNWPQXUW1aNWQAAA9M"]
[Sat Dec 13 18:20:17.043740 2025] [:error] [pid 43748:tid 43792] [client 4.194.187.1:15296] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aT094arTT0VzE3gYjcChGgAAAE0"]
[Sat Dec 13 18:20:17.223960 2025] [:error] [pid 43836:tid 43845] [client 4.194.187.1:15292] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aT094WAEOBirsxb11nbx8AAAAMc"]
[Sat Dec 13 18:20:17.400963 2025] [:error] [pid 55071:tid 55081] [client 4.194.187.1:29960] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aT094cHSpNduhEZ_mjfGGAAAAYg"]
[Sat Dec 13 18:20:17.601491 2025] [:error] [pid 8242:tid 8262] [client 4.194.187.1:15277] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aT094SNKA7vSGNUfnOEu3gAAAk4"]
[Sat Dec 13 18:20:17.783047 2025] [:error] [pid 43747:tid 43753] [client 4.194.187.1:15352] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aT094ZYw3twBd_JQEHgf4QAAAAI"]
[Sat Dec 13 18:20:17.981483 2025] [:error] [pid 20799:tid 20805] [client 4.194.187.1:30029] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aT094aPz3eVRUTzZpOJubAAAAsQ"]
[Sat Dec 13 18:20:18.161760 2025] [:error] [pid 20799:tid 20808] [client 4.194.187.1:29977] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aT094qPz3eVRUTzZpOJubQAAAsc"]
[Sat Dec 13 18:20:18.348246 2025] [:error] [pid 20799:tid 20824] [client 4.194.187.1:15304] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT094qPz3eVRUTzZpOJubwAAAtc"]
[Sat Dec 13 18:20:18.530267 2025] [:error] [pid 55071:tid 55075] [client 4.194.187.1:15357] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT094sHSpNduhEZ_mjfGHAAAAYI"]
[Sat Dec 13 18:20:18.707254 2025] [:error] [pid 55071:tid 55085] [client 4.194.187.1:30072] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT094sHSpNduhEZ_mjfGHQAAAYw"]
[Sat Dec 13 18:20:18.882182 2025] [:error] [pid 21342:tid 21356] [client 4.194.187.1:15343] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT094vBL0VVSMIEvqstaZwAAAwo"]
[Sat Dec 13 18:20:19.070288 2025] [:error] [pid 21342:tid 21362] [client 4.194.187.1:15293] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT094_BL0VVSMIEvqstaaAAAAxA"]
[Sat Dec 13 18:20:19.244376 2025] [:error] [pid 21342:tid 21364] [client 4.194.187.1:30014] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT094_BL0VVSMIEvqstaagAAAxI"]
[Sat Dec 13 18:20:19.423269 2025] [:error] [pid 21342:tid 21358] [client 4.194.187.1:15249] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT094_BL0VVSMIEvqstaawAAAww"]
[Sat Dec 13 18:20:19.660194 2025] [:error] [pid 21342:tid 21352] [client 4.194.187.1:15246] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT094_BL0VVSMIEvqstabAAAAwY"]
[Sat Dec 13 18:20:19.849139 2025] [:error] [pid 20799:tid 20821] [client 4.194.187.1:15332] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jdlqi.php"] [unique_id "aT0946Pz3eVRUTzZpOJucAAAAtQ"]
[Sat Dec 13 18:20:20.024541 2025] [:error] [pid 21342:tid 21354] [client 4.194.187.1:15273] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jdlqi.php"] [unique_id "aT095PBL0VVSMIEvqstabQAAAwg"]
[Sat Dec 13 18:20:20.214773 2025] [:error] [pid 21342:tid 21346] [client 4.194.187.1:15295] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jdlqi.php"] [unique_id "aT095PBL0VVSMIEvqstabgAAAwA"]
[Sat Dec 13 18:20:20.400264 2025] [:error] [pid 21342:tid 21368] [client 4.194.187.1:15334] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jdlqi.php"] [unique_id "aT095PBL0VVSMIEvqstacAAAAxY"]
[Sat Dec 13 18:20:20.578287 2025] [:error] [pid 39287:tid 39295] [client 4.194.187.1:15356] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aT095DBwBW1JRRoCYqZ96gAAAQY"]
[Sat Dec 13 18:20:20.759382 2025] [:error] [pid 21342:tid 21366] [client 4.194.187.1:15335] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aT095PBL0VVSMIEvqstacQAAAxQ"]
[Sat Dec 13 18:20:20.957885 2025] [:error] [pid 55071:tid 55088] [client 4.194.187.1:30040] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aT095MHSpNduhEZ_mjfGHgAAAY8"]
[Sat Dec 13 18:20:21.131991 2025] [:error] [pid 55071:tid 55094] [client 4.194.187.1:15318] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aT095cHSpNduhEZ_mjfGHwAAAZU"]
[Sat Dec 13 18:20:21.313689 2025] [:error] [pid 43747:tid 43774] [client 4.194.187.1:15311] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aT095ZYw3twBd_JQEHgf4gAAABc"]
[Sat Dec 13 18:20:21.508644 2025] [:error] [pid 21342:tid 21350] [client 4.194.187.1:30026] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aT095fBL0VVSMIEvqstacgAAAwQ"]
[Sat Dec 13 18:20:21.710141 2025] [:error] [pid 21342:tid 21353] [client 4.194.187.1:30027] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aT095fBL0VVSMIEvqstacwAAAwc"]
[Sat Dec 13 18:20:21.940409 2025] [:error] [pid 21342:tid 21359] [client 4.194.187.1:15334] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aT095fBL0VVSMIEvqstadAAAAw0"]
[Sat Dec 13 18:20:22.154902 2025] [:error] [pid 8242:tid 8252] [client 4.194.187.1:29957] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aT095iNKA7vSGNUfnOEu5AAAAkQ"]
[Sat Dec 13 18:20:22.350007 2025] [:error] [pid 21342:tid 21347] [client 4.194.187.1:15322] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aT095vBL0VVSMIEvqstadQAAAwE"]
[Sat Dec 13 18:20:22.534207 2025] [:error] [pid 21342:tid 21360] [client 4.194.187.1:15262] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aT095vBL0VVSMIEvqstadgAAAw4"]
[Sat Dec 13 18:20:22.726485 2025] [:error] [pid 55071:tid 55096] [client 4.194.187.1:29998] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aT095sHSpNduhEZ_mjfGIQAAAZc"]
[Sat Dec 13 18:20:22.903963 2025] [:error] [pid 21342:tid 21349] [client 4.194.187.1:15233] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aT095vBL0VVSMIEvqstadwAAAwM"]
[Sat Dec 13 18:20:23.079278 2025] [:error] [pid 21342:tid 21363] [client 4.194.187.1:30016] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aT095_BL0VVSMIEvqstaeAAAAxE"]
[Sat Dec 13 18:20:23.270487 2025] [:error] [pid 39287:tid 39298] [client 4.194.187.1:15354] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aT095zBwBW1JRRoCYqZ96wAAAQk"]
[Sat Dec 13 18:20:23.446023 2025] [:error] [pid 39287:tid 39300] [client 4.194.187.1:15347] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aT095zBwBW1JRRoCYqZ97QAAAQs"]
[Sat Dec 13 18:20:23.621977 2025] [:error] [pid 43747:tid 43751] [client 4.194.187.1:15344] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xopvne.php"] [unique_id "aT0955Yw3twBd_JQEHgf4wAAAAA"]
[Sat Dec 13 18:20:23.799605 2025] [:error] [pid 21342:tid 21369] [client 4.194.187.1:15353] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xopvne.php"] [unique_id "aT095_BL0VVSMIEvqstaeQAAAxc"]
[Sat Dec 13 18:20:23.973717 2025] [:error] [pid 21342:tid 21355] [client 4.194.187.1:15323] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xopvne.php"] [unique_id "aT095_BL0VVSMIEvqstaegAAAwk"]
[Sat Dec 13 18:20:24.154976 2025] [:error] [pid 21342:tid 21365] [client 4.194.187.1:29975] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xopvne.php"] [unique_id "aT096PBL0VVSMIEvqstaewAAAxM"]
[Sat Dec 13 18:20:24.338188 2025] [:error] [pid 23013:tid 23028] [client 4.194.187.1:15172] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aT096Ks9bDNWPQXUW1aNXAAAA80"]
[Sat Dec 13 18:20:24.513259 2025] [:error] [pid 43747:tid 43760] [client 4.194.187.1:15319] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aT096JYw3twBd_JQEHgf5QAAAAk"]
[Sat Dec 13 18:20:24.704730 2025] [:error] [pid 43747:tid 43771] [client 4.194.187.1:15310] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aT096JYw3twBd_JQEHgf5gAAABQ"]
[Sat Dec 13 18:20:24.882396 2025] [:error] [pid 43836:tid 43857] [client 4.194.187.1:15325] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aT096GAEOBirsxb11nbx8wAAANM"]
[Sat Dec 13 18:20:25.071399 2025] [:error] [pid 21342:tid 21357] [client 4.194.187.1:15346] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aT096fBL0VVSMIEvqstafAAAAws"]
[Sat Dec 13 18:20:25.253655 2025] [:error] [pid 39287:tid 39309] [client 4.194.187.1:15333] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aT096TBwBW1JRRoCYqZ97gAAARQ"]
[Sat Dec 13 18:20:25.429819 2025] [:error] [pid 39287:tid 39294] [client 4.194.187.1:15284] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aT096TBwBW1JRRoCYqZ97wAAAQU"]
[Sat Dec 13 18:20:25.623490 2025] [:error] [pid 43747:tid 43752] [client 4.194.187.1:15266] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aT096ZYw3twBd_JQEHgf5wAAAAE"]
[Sat Dec 13 18:20:25.824244 2025] [:error] [pid 21342:tid 21356] [client 4.194.187.1:15265] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aT096fBL0VVSMIEvqstafQAAAwo"]
[Sat Dec 13 18:20:25.997905 2025] [:error] [pid 39287:tid 39306] [client 4.194.187.1:15279] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aT096TBwBW1JRRoCYqZ98AAAARE"]
[Sat Dec 13 18:20:26.174351 2025] [:error] [pid 21342:tid 21362] [client 4.194.187.1:15259] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aT096vBL0VVSMIEvqstafgAAAxA"]
[Sat Dec 13 18:20:26.353864 2025] [:error] [pid 55071:tid 55077] [client 4.194.187.1:15341] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aT096sHSpNduhEZ_mjfGJgAAAYQ"]
[Sat Dec 13 18:20:26.546238 2025] [:error] [pid 21342:tid 21358] [client 4.194.187.1:15212] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aT096vBL0VVSMIEvqstafwAAAww"]
[Sat Dec 13 18:20:26.745098 2025] [:error] [pid 55071:tid 55081] [client 4.194.187.1:15268] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aT096sHSpNduhEZ_mjfGJwAAAYg"]
[Sat Dec 13 18:20:26.919493 2025] [:error] [pid 55071:tid 55082] [client 4.194.187.1:15331] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aT096sHSpNduhEZ_mjfGKQAAAYk"]
[Sat Dec 13 18:20:27.113178 2025] [:error] [pid 23013:tid 23021] [client 4.194.187.1:15250] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aT0966s9bDNWPQXUW1aNXgAAA8Y"]
[Sat Dec 13 18:20:27.293607 2025] [:error] [pid 20799:tid 20804] [client 4.194.187.1:30015] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aT0966Pz3eVRUTzZpOJucgAAAsM"]
[Sat Dec 13 18:20:27.467179 2025] [:error] [pid 39287:tid 39297] [client 4.194.187.1:15260] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aT096zBwBW1JRRoCYqZ98QAAAQg"]
[Sat Dec 13 18:20:27.644477 2025] [:error] [pid 39287:tid 39310] [client 4.194.187.1:15196] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aT096zBwBW1JRRoCYqZ98gAAARU"]
[Sat Dec 13 18:20:27.818807 2025] [:error] [pid 39287:tid 39302] [client 4.194.187.1:30047] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aT096zBwBW1JRRoCYqZ98wAAAQ0"]
[Sat Dec 13 18:20:28.007903 2025] [:error] [pid 21342:tid 21352] [client 4.194.187.1:15355] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aT097PBL0VVSMIEvqstagQAAAwY"]
[Sat Dec 13 18:20:28.218904 2025] [:error] [pid 39287:tid 39290] [client 4.194.187.1:15313] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aT097DBwBW1JRRoCYqZ99AAAAQE"]
[Sat Dec 13 18:20:28.396506 2025] [:error] [pid 21342:tid 21354] [client 4.194.187.1:30075] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aT097PBL0VVSMIEvqstaggAAAwg"]
[Sat Dec 13 18:20:28.575038 2025] [:error] [pid 55071:tid 55092] [client 4.194.187.1:15272] [client 4.194.187.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aT097MHSpNduhEZ_mjfGKgAAAZM"]
[Sat Dec 13 19:58:28.321946 2025] [:error] [pid 55071:tid 55077] [client 43.152.72.247:57606] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aT1U5MHSpNduhEZ_mjfR9AAAAYQ"]
[Sun Dec 14 01:46:20.535834 2025] [:error] [pid 14689:tid 14702] [client 101.42.46.71:59404] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aT2mbEEcifvaa9I7SnmDPQAAAUk"]
[Sun Dec 14 07:03:58.191774 2025] [:error] [pid 41600:tid 41608] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 14 07:03:58.535393 2025] [:error] [pid 41600:tid 41613] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 14 07:03:58.864838 2025] [:error] [pid 41600:tid 41611] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 14 07:03:59.209475 2025] [:error] [pid 41600:tid 41621] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 14 07:03:59.565591 2025] [:error] [pid 41600:tid 41605] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 14 07:03:59.934663 2025] [:error] [pid 41600:tid 41617] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 14 07:04:00.288947 2025] [:error] [pid 41600:tid 41615] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 14 07:04:00.652601 2025] [:error] [pid 41600:tid 41610] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 14 07:04:01.473222 2025] [:error] [pid 41600:tid 41624] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 14 07:04:02.188572 2025] [:error] [pid 41600:tid 41611] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 14 07:04:02.572450 2025] [:error] [pid 41600:tid 41605] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 14 07:04:02.901933 2025] [:error] [pid 41600:tid 41609] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 14 07:04:03.245091 2025] [:error] [pid 41600:tid 41617] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 14 07:04:03.628419 2025] [:error] [pid 41600:tid 41612] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 14 07:04:03.978954 2025] [:error] [pid 41600:tid 41616] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 14 07:04:04.304641 2025] [:error] [pid 41600:tid 41625] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 14 07:04:04.638843 2025] [:error] [pid 41600:tid 41614] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 14 07:04:05.019307 2025] [:error] [pid 41600:tid 41613] [client 45.154.138.48:35957] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 14 07:04:09.959600 2025] [:error] [pid 41600:tid 41606] [client 45.154.138.48:35957] [client 45.154.138.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aT3w6dFLTBZjcwNd_VsGuAAAAQM"]
[Sun Dec 14 07:04:11.722203 2025] [:error] [pid 39523:tid 39534] [client 45.154.138.16:40145] [client 45.154.138.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aT3w6zQTQH1raAj2lkg6nAAAAAY"]
[Sun Dec 14 07:04:14.547065 2025] [:error] [pid 39614:tid 39617] [client 45.154.138.12:27687] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 14 07:04:15.680642 2025] [:error] [pid 39614:tid 39618] [client 45.154.138.12:27687] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aT3w7_xybG8-9MflbDegfgAAAMI"]
[Sun Dec 14 07:04:17.129488 2025] [:error] [pid 39523:tid 39545] [client 45.154.138.35:34011] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Dec 14 07:04:17.456739 2025] [:error] [pid 39523:tid 39538] [client 45.154.138.35:34011] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aT3w8TQTQH1raAj2lkg6rwAAAAo"]
[Sun Dec 14 07:04:19.867023 2025] [:error] [pid 41600:tid 41608] [client 45.154.138.21:52225] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Dec 14 07:04:21.572844 2025] [:error] [pid 41600:tid 41610] [client 45.154.138.21:52225] [client 45.154.138.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aT3w9dFLTBZjcwNd_VsGygAAAQc"]
[Sun Dec 14 07:04:23.630635 2025] [:error] [pid 39523:tid 39536] [client 45.154.138.42:53055] [client 45.154.138.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aT3w9zQTQH1raAj2lkg6tQAAAAg"]
[Sun Dec 14 07:04:24.294355 2025] [:error] [pid 39523:tid 39541] [client 45.154.138.25:21873] [client 45.154.138.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aT3w-DQTQH1raAj2lkg6tgAAAA0"]
[Sun Dec 14 07:04:24.966833 2025] [:error] [pid 39523:tid 39543] [client 45.154.138.7:60029] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aT3w-DQTQH1raAj2lkg6twAAAA8"]
[Sun Dec 14 07:04:25.662369 2025] [:error] [pid 39614:tid 39629] [client 45.154.138.101:51069] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aT3w-fxybG8-9MflbDegjAAAAM0"]
[Sun Dec 14 07:04:27.370722 2025] [:error] [pid 39614:tid 39625] [client 45.154.138.47:37313] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aT3w-_xybG8-9MflbDegjwAAAMk"]
[Sun Dec 14 07:04:28.447151 2025] [:error] [pid 39614:tid 39638] [client 45.154.138.21:34577] [client 45.154.138.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aT3w_PxybG8-9MflbDegkQAAANY"]
[Sun Dec 14 07:04:29.110261 2025] [:error] [pid 41600:tid 41626] [client 45.154.138.29:54073] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Dec 14 07:04:29.782926 2025] [:error] [pid 41600:tid 41620] [client 45.154.138.29:54073] [client 45.154.138.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aT3w_dFLTBZjcwNd_VsG0AAAARE"]
[Sun Dec 14 07:04:32.262281 2025] [:error] [pid 41600:tid 41607] [client 45.154.138.7:38211] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aT3xANFLTBZjcwNd_VsG2QAAAQQ"]
[Sun Dec 14 07:04:34.312419 2025] [:error] [pid 39523:tid 39541] [client 45.154.138.46:47775] [client 45.154.138.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aT3xAjQTQH1raAj2lkg6xQAAAA0"]
[Sun Dec 14 07:04:35.986789 2025] [:error] [pid 41600:tid 41622] [client 45.154.138.40:39519] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Dec 14 07:04:36.336899 2025] [:error] [pid 41600:tid 41626] [client 45.154.138.40:39519] [client 45.154.138.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aT3xBNFLTBZjcwNd_VsG3QAAARc"]
[Sun Dec 14 07:04:37.038295 2025] [:error] [pid 39523:tid 39535] [client 45.154.138.101:51221] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Dec 14 07:04:38.088920 2025] [:error] [pid 39523:tid 39545] [client 45.154.138.101:51221] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Dec 14 07:04:39.163295 2025] [:error] [pid 39523:tid 39547] [client 45.154.138.101:51221] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aT3xBzQTQH1raAj2lkg60AAAABM"]
[Sun Dec 14 07:04:39.878062 2025] [:error] [pid 39614:tid 39618] [client 45.154.138.41:45987] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Dec 14 07:04:40.252417 2025] [:error] [pid 39614:tid 39619] [client 45.154.138.41:45987] [client 45.154.138.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aT3xCPxybG8-9MflbDegoAAAAMM"]
[Sun Dec 14 07:04:41.960816 2025] [:error] [pid 39525:tid 39604] [client 45.154.138.38:63553] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Dec 14 07:04:42.695681 2025] [:error] [pid 39525:tid 39601] [client 45.154.138.38:63553] [client 45.154.138.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aT3xCk1fX_pB_BrvE_6PqwAAAJI"]
[Sun Dec 14 07:04:43.738422 2025] [:error] [pid 39525:tid 39602] [client 45.154.138.10:47891] [client 45.154.138.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aT3xC01fX_pB_BrvE_6PrQAAAJM"]
[Sun Dec 14 07:04:46.226043 2025] [:error] [pid 41600:tid 41616] [client 45.154.138.5:31069] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Dec 14 07:04:46.567073 2025] [:error] [pid 41600:tid 41606] [client 45.154.138.5:31069] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Dec 14 07:04:47.328227 2025] [:error] [pid 41600:tid 41626] [client 45.154.138.5:31069] [client 45.154.138.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aT3xD9FLTBZjcwNd_VsG7AAAARc"]
[Sun Dec 14 07:04:48.412837 2025] [:error] [pid 39525:tid 39599] [client 45.154.138.1:48249] [client 45.154.138.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aT3xEE1fX_pB_BrvE_6PswAAAJA"]
[Sun Dec 14 07:04:49.482739 2025] [:error] [pid 41600:tid 41611] [client 45.154.138.12:33619] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aT3xEdFLTBZjcwNd_VsG9QAAAQg"]
[Sun Dec 14 07:04:51.201229 2025] [:error] [pid 41600:tid 41621] [client 45.154.138.29:23325] [client 45.154.138.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aT3xE9FLTBZjcwNd_VsG9gAAARI"]
[Sun Dec 14 07:04:51.867596 2025] [:error] [pid 39525:tid 39587] [client 45.154.138.45:37633] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aT3xE01fX_pB_BrvE_6PtgAAAIQ"]
[Sun Dec 14 07:04:53.249807 2025] [:error] [pid 39524:tid 39574] [client 45.154.138.1:25357] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Dec 14 07:04:53.631082 2025] [:error] [pid 39524:tid 39572] [client 45.154.138.1:25357] [client 45.154.138.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aT3xFWrVGpbDzFtDE9Mg_AAAAFA"]
[Sun Dec 14 07:53:01.679343 2025] [:error] [pid 39614:tid 39624] [client 110.166.71.39:45371] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aT38XfxybG8-9MflbDeq8QAAAMg"]
[Sun Dec 14 17:18:32.537207 2025] [:error] [pid 39524:tid 39579] [client 95.154.200.40:46762] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aT6A6GrVGpbDzFtDE9OL0AAAAFc"]
[Sun Dec 14 17:18:33.777518 2025] [:error] [pid 40595:tid 40609] [client 95.154.200.40:46770] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aT6A6fjrht6y4RN-xKTLoAAAAYo"]
[Sun Dec 14 17:18:34.978913 2025] [:error] [pid 40596:tid 40643] [client 95.154.200.40:58096] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/tools.js"] [unique_id "aT6A6mvZZo4N2X7WoLw8iQAAAdE"]
[Sun Dec 14 17:18:36.154429 2025] [:error] [pid 39614:tid 39621] [client 95.154.200.40:58100] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/translate_inline.js"] [unique_id "aT6A7PxybG8-9MflbDcYjAAAAMU"]
[Sun Dec 14 17:18:37.412984 2025] [:error] [pid 40595:tid 40613] [client 95.154.200.40:58110] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skin/adminhtml/default/default/boxes.css"] [unique_id "aT6A7fjrht6y4RN-xKTLswAAAY4"]
[Sun Dec 14 17:18:38.669012 2025] [:error] [pid 39523:tid 39550] [client 95.154.200.40:58114] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/prototype/validation.js"] [unique_id "aT6A7jQTQH1raAj2lkigfQAAABY"]
[Sun Dec 14 17:18:39.848119 2025] [:error] [pid 41600:tid 41611] [client 95.154.200.40:58124] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RELEASE_NOTES.txt"] [unique_id "aT6A79FLTBZjcwNd_VufUAAAAQg"]
[Sun Dec 14 20:35:09.879255 2025] [:error] [pid 39614:tid 39621] [client 123.187.240.242:57206] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aT6u_fxybG8-9MflbDdzdwAAAMU"]
[Sun Dec 14 21:00:25.668096 2025] [:error] [pid 40596:tid 40641] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Sun Dec 14 21:00:25.793251 2025] [:error] [pid 40596:tid 40644] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Dec 14 21:00:25.932716 2025] [:error] [pid 40596:tid 40647] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 14 21:00:26.068931 2025] [:error] [pid 40596:tid 40635] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Dec 14 21:00:26.194270 2025] [:error] [pid 40596:tid 40632] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Sun Dec 14 21:00:26.321193 2025] [:error] [pid 40596:tid 40636] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Dec 14 21:00:26.474190 2025] [:error] [pid 40596:tid 40645] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 14 21:00:26.619609 2025] [:error] [pid 40596:tid 40650] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Sun Dec 14 21:00:26.747003 2025] [:error] [pid 40596:tid 40639] [client 4.190.216.178:17477] File does not exist: /usr/local/apache/htdocs/suspended-page/cord.php
[Sun Dec 14 21:00:26.870932 2025] [:error] [pid 40596:tid 40638] [client 4.190.216.178:17477] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aT606mvZZo4N2X7WoLyfugAAAcw"]
[Sun Dec 14 21:00:27.219455 2025] [:error] [pid 13799:tid 13825] [client 4.190.216.178:17518] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aT6063jPEin01ElFTNZKOQAAAhc"]
[Sun Dec 14 21:00:27.552815 2025] [:error] [pid 41600:tid 41623] [client 4.190.216.178:17490] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aT6069FLTBZjcwNd_VslhQAAARQ"]
[Sun Dec 14 21:00:27.836853 2025] [:error] [pid 13799:tid 13807] [client 4.190.216.178:17520] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aT6063jPEin01ElFTNZKQAAAAgU"]
[Sun Dec 14 21:00:28.135468 2025] [:error] [pid 39614:tid 39633] [client 4.190.216.178:17514] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT607PxybG8-9MflbDd9OAAAANE"]
[Sun Dec 14 21:00:28.729592 2025] [:error] [pid 39525:tid 39599] [client 4.190.216.178:17432] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT607E1fX_pB_BrvE_5WbQAAAJA"]
[Sun Dec 14 21:00:29.355011 2025] [:error] [pid 39524:tid 39563] [client 4.190.216.178:17417] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT607WrVGpbDzFtDE9P5RAAAAEc"]
[Sun Dec 14 21:00:29.832858 2025] [:error] [pid 41600:tid 41606] [client 4.190.216.178:17478] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT607dFLTBZjcwNd_VsljwAAAQM"]
[Sun Dec 14 21:00:30.163893 2025] [:error] [pid 40595:tid 40603] [client 4.190.216.178:17419] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aT607vjrht6y4RN-xKQryQAAAYQ"]
[Sun Dec 14 21:00:30.476715 2025] [:error] [pid 40596:tid 40642] [client 4.190.216.178:17521] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aT607mvZZo4N2X7WoLyfvQAAAdA"]
[Sun Dec 14 21:00:30.769223 2025] [:error] [pid 40596:tid 40627] [client 4.190.216.178:17409] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aT607mvZZo4N2X7WoLyfvgAAAcE"]
[Sun Dec 14 21:00:31.083123 2025] [:error] [pid 39525:tid 39588] [client 4.190.216.178:17498] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aT60701fX_pB_BrvE_5WcwAAAIU"]
[Sun Dec 14 21:00:31.382085 2025] [:error] [pid 39524:tid 39568] [client 4.190.216.178:17437] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aT6072rVGpbDzFtDE9P5TAAAAEw"]
[Sun Dec 14 21:00:31.968172 2025] [:error] [pid 41600:tid 41608] [client 4.190.216.178:17483] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aT6079FLTBZjcwNd_VsllwAAAQU"]
[Sun Dec 14 21:00:32.272008 2025] [:error] [pid 39524:tid 39557] [client 4.190.216.178:17439] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aT608GrVGpbDzFtDE9P5TgAAAEE"]
[Sun Dec 14 21:00:32.582929 2025] [:error] [pid 39524:tid 39576] [client 4.190.216.178:17497] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aT608GrVGpbDzFtDE9P5TwAAAFQ"]
[Sun Dec 14 21:00:33.017882 2025] [:error] [pid 40596:tid 40644] [client 4.190.216.178:17425] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aT608WvZZo4N2X7WoLyfwAAAAdI"]
[Sun Dec 14 21:00:33.468825 2025] [:error] [pid 39524:tid 39578] [client 4.190.216.178:17502] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aT608WrVGpbDzFtDE9P5UAAAAFY"]
[Sun Dec 14 21:00:34.071438 2025] [:error] [pid 41600:tid 41624] [client 4.190.216.178:17496] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aT608tFLTBZjcwNd_VslnQAAARU"]
[Sun Dec 14 21:00:34.364595 2025] [:error] [pid 40595:tid 40617] [client 4.190.216.178:17474] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aT608vjrht6y4RN-xKQr1gAAAZI"]
[Sun Dec 14 21:00:34.672841 2025] [:error] [pid 39523:tid 39528] [client 4.190.216.178:17412] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aT608jQTQH1raAj2lkjvlgAAAAA"]
[Sun Dec 14 21:00:35.027487 2025] [:error] [pid 13799:tid 13816] [client 4.190.216.178:11230] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aT6083jPEin01ElFTNZKcwAAAg4"]
[Sun Dec 14 21:00:35.314205 2025] [:error] [pid 40596:tid 40645] [client 4.190.216.178:17523] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aT6082vZZo4N2X7WoLyfxAAAAdM"]
[Sun Dec 14 21:00:35.684430 2025] [:error] [pid 40595:tid 40611] [client 4.190.216.178:17434] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aT608_jrht6y4RN-xKQr2gAAAYw"]
[Sun Dec 14 21:00:36.252234 2025] [:error] [pid 39524:tid 39577] [client 4.190.216.178:17486] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aT609GrVGpbDzFtDE9P5WQAAAFU"]
[Sun Dec 14 21:00:36.665220 2025] [:error] [pid 39525:tid 39607] [client 4.190.216.178:17484] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aT609E1fX_pB_BrvE_5WegAAAJg"]
[Sun Dec 14 21:00:36.963012 2025] [:error] [pid 13799:tid 13815] [client 4.190.216.178:17494] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aT609HjPEin01ElFTNZKfgAAAg0"]
[Sun Dec 14 21:00:37.299145 2025] [:error] [pid 40595:tid 40622] [client 4.190.216.178:11256] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aT609fjrht6y4RN-xKQr3wAAAZc"]
[Sun Dec 14 21:00:37.577734 2025] [:error] [pid 40561:tid 40584] [client 4.190.216.178:17513] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aT609YY6r869zoqRQkThggAAAVM"]
[Sun Dec 14 21:00:37.923286 2025] [:error] [pid 40595:tid 40612] [client 4.190.216.178:11210] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aT609fjrht6y4RN-xKQr4wAAAY0"]
[Sun Dec 14 21:00:38.424384 2025] [:error] [pid 40596:tid 40626] [client 4.190.216.178:17530] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aT609mvZZo4N2X7WoLyfxgAAAcA"]
[Sun Dec 14 21:00:39.171943 2025] [:error] [pid 41600:tid 41614] [client 4.190.216.178:17515] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aT6099FLTBZjcwNd_VslpQAAAQs"]
[Sun Dec 14 21:00:39.749730 2025] [:error] [pid 40595:tid 40614] [client 4.190.216.178:17508] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aT609_jrht6y4RN-xKQr5wAAAY8"]
[Sun Dec 14 21:00:40.013490 2025] [:error] [pid 40596:tid 40627] [client 4.190.216.178:17512] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aT60-GvZZo4N2X7WoLyfzAAAAcE"]
[Sun Dec 14 21:00:40.338359 2025] [:error] [pid 41600:tid 41625] [client 4.190.216.178:17454] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aT60-NFLTBZjcwNd_VslpwAAARY"]
[Sun Dec 14 21:00:40.802116 2025] [:error] [pid 39614:tid 39632] [client 4.190.216.178:17433] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aT60-PxybG8-9MflbDd9RAAAANA"]
[Sun Dec 14 21:00:41.132494 2025] [:error] [pid 39524:tid 39565] [client 4.190.216.178:17428] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aT60-WrVGpbDzFtDE9P5YQAAAEk"]
[Sun Dec 14 21:00:41.510310 2025] [:error] [pid 40561:tid 40580] [client 4.190.216.178:17519] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aT60-YY6r869zoqRQkThjwAAAU8"]
[Sun Dec 14 21:00:41.820786 2025] [:error] [pid 39525:tid 39585] [client 4.190.216.178:17485] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aT60-U1fX_pB_BrvE_5WgwAAAII"]
[Sun Dec 14 21:00:42.319001 2025] [:error] [pid 41600:tid 41608] [client 4.190.216.178:17452] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aT60-tFLTBZjcwNd_VslqQAAAQU"]
[Sun Dec 14 21:00:42.655878 2025] [:error] [pid 39524:tid 39577] [client 4.190.216.178:17480] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aT60-mrVGpbDzFtDE9P5ZgAAAFU"]
[Sun Dec 14 21:00:42.930779 2025] [:error] [pid 40595:tid 40603] [client 4.190.216.178:17431] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aT60-vjrht6y4RN-xKQr6wAAAYQ"]
[Sun Dec 14 21:00:43.321447 2025] [:error] [pid 39524:tid 39560] [client 4.190.216.178:17495] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aT60-2rVGpbDzFtDE9P5ZwAAAEQ"]
[Sun Dec 14 21:00:43.623104 2025] [:error] [pid 40596:tid 40642] [client 4.190.216.178:11233] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aT60-2vZZo4N2X7WoLyf3QAAAdA"]
[Sun Dec 14 21:00:43.918602 2025] [:error] [pid 41600:tid 41611] [client 4.190.216.178:17455] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aT60-9FLTBZjcwNd_VslqwAAAQg"]
[Sun Dec 14 21:00:44.311157 2025] [:error] [pid 39614:tid 39639] [client 4.190.216.178:17470] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aT60_PxybG8-9MflbDd9SwAAANc"]
[Sun Dec 14 21:00:44.732851 2025] [:error] [pid 39524:tid 39566] [client 4.190.216.178:17444] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aT60_GrVGpbDzFtDE9P5agAAAEo"]
[Sun Dec 14 21:00:45.098322 2025] [:error] [pid 39525:tid 39601] [client 4.190.216.178:17430] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aT60_U1fX_pB_BrvE_5WhQAAAJI"]
[Sun Dec 14 21:00:45.417209 2025] [:error] [pid 39524:tid 39579] [client 4.190.216.178:11247] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aT60_WrVGpbDzFtDE9P5bAAAAFc"]
[Sun Dec 14 21:00:45.742880 2025] [:error] [pid 13799:tid 13815] [client 4.190.216.178:17465] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aT60_XjPEin01ElFTNZKogAAAg0"]
[Sun Dec 14 21:00:46.165449 2025] [:error] [pid 13799:tid 13805] [client 4.190.216.178:17507] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aT60_njPEin01ElFTNZKowAAAgM"]
[Sun Dec 14 21:00:46.442220 2025] [:error] [pid 39614:tid 39635] [client 4.190.216.178:17449] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aT60_vxybG8-9MflbDd9UQAAANM"]
[Sun Dec 14 21:00:46.940998 2025] [:error] [pid 39524:tid 39574] [client 4.190.216.178:17429] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT60_mrVGpbDzFtDE9P5bgAAAFI"]
[Sun Dec 14 21:00:47.346244 2025] [:error] [pid 40595:tid 40613] [client 4.190.216.178:17422] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT60__jrht6y4RN-xKQr8QAAAY4"]
[Sun Dec 14 21:00:47.765074 2025] [:error] [pid 40595:tid 40605] [client 4.190.216.178:17447] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT60__jrht6y4RN-xKQr8wAAAYY"]
[Sun Dec 14 21:00:48.145636 2025] [:error] [pid 40595:tid 40614] [client 4.190.216.178:17528] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT61APjrht6y4RN-xKQr9AAAAY8"]
[Sun Dec 14 21:00:48.542878 2025] [:error] [pid 41600:tid 41623] [client 4.190.216.178:17427] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aT61ANFLTBZjcwNd_VslsQAAARQ"]
[Sun Dec 14 21:00:48.826565 2025] [:error] [pid 40595:tid 40618] [client 4.190.216.178:17450] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aT61APjrht6y4RN-xKQr9wAAAZM"]
[Sun Dec 14 21:00:49.110741 2025] [:error] [pid 40596:tid 40648] [client 4.190.216.178:17531] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aT61AWvZZo4N2X7WoLyf5wAAAdY"]
[Sun Dec 14 21:00:49.362312 2025] [:error] [pid 39525:tid 39606] [client 4.190.216.178:11204] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aT61AU1fX_pB_BrvE_5WiwAAAJc"]
[Sun Dec 14 21:00:49.662394 2025] [:error] [pid 13799:tid 13822] [client 4.190.216.178:17443] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT61AXjPEin01ElFTNZKpgAAAhQ"]
[Sun Dec 14 21:00:50.034180 2025] [:error] [pid 39524:tid 39578] [client 4.190.216.178:17448] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT61AmrVGpbDzFtDE9P5cgAAAFY"]
[Sun Dec 14 21:00:50.422927 2025] [:error] [pid 40561:tid 40577] [client 4.190.216.178:17525] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT61AoY6r869zoqRQkThmQAAAUw"]
[Sun Dec 14 21:00:50.753849 2025] [:error] [pid 40596:tid 40633] [client 4.190.216.178:11222] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aT61AmvZZo4N2X7WoLyf6QAAAcc"]
[Sun Dec 14 21:00:51.050566 2025] [:error] [pid 41600:tid 41614] [client 4.190.216.178:17424] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aT61A9FLTBZjcwNd_VsltAAAAQs"]
[Sun Dec 14 21:00:51.395690 2025] [:error] [pid 41600:tid 41620] [client 4.190.216.178:11213] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aT61A9FLTBZjcwNd_VsltQAAARE"]
[Sun Dec 14 21:00:51.693503 2025] [:error] [pid 40561:tid 40578] [client 4.190.216.178:11220] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aT61A4Y6r869zoqRQkThmwAAAU0"]
[Sun Dec 14 21:00:52.004103 2025] [:error] [pid 39524:tid 39558] [client 4.190.216.178:17505] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aT61BGrVGpbDzFtDE9P5dQAAAEI"]
[Sun Dec 14 21:00:52.426335 2025] [:error] [pid 40561:tid 40575] [client 4.190.216.178:17420] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aT61BIY6r869zoqRQkThngAAAUo"]
[Sun Dec 14 21:00:52.885569 2025] [:error] [pid 41600:tid 41615] [client 4.190.216.178:17511] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aT61BNFLTBZjcwNd_VsltwAAAQw"]
[Sun Dec 14 21:00:53.336777 2025] [:error] [pid 40561:tid 40566] [client 4.190.216.178:17506] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aT61BYY6r869zoqRQkThoAAAAUE"]
[Sun Dec 14 21:00:53.642496 2025] [:error] [pid 40596:tid 40627] [client 4.190.216.178:11212] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aT61BWvZZo4N2X7WoLyf6wAAAcE"]
[Sun Dec 14 21:00:53.971273 2025] [:error] [pid 41600:tid 41626] [client 4.190.216.178:17426] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aT61BdFLTBZjcwNd_VsluAAAARc"]
[Sun Dec 14 21:00:54.483075 2025] [:error] [pid 40596:tid 40646] [client 4.190.216.178:17416] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aT61BmvZZo4N2X7WoLyf7QAAAdQ"]
[Sun Dec 14 21:00:54.830914 2025] [:error] [pid 39525:tid 39607] [client 4.190.216.178:17535] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aT61Bk1fX_pB_BrvE_5WjwAAAJg"]
[Sun Dec 14 21:00:55.290264 2025] [:error] [pid 40561:tid 40572] [client 4.190.216.178:17423] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aT61B4Y6r869zoqRQkThoQAAAUc"]
[Sun Dec 14 21:00:55.725482 2025] [:error] [pid 40596:tid 40635] [client 4.190.216.178:17436] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aT61B2vZZo4N2X7WoLyf7wAAAck"]
[Sun Dec 14 21:00:56.200088 2025] [:error] [pid 41600:tid 41611] [client 4.190.216.178:17456] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aT61CNFLTBZjcwNd_VslugAAAQg"]
[Sun Dec 14 21:00:56.767326 2025] [:error] [pid 40561:tid 40581] [client 4.190.216.178:17501] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aT61CIY6r869zoqRQkThowAAAVA"]
[Sun Dec 14 21:00:57.297730 2025] [:error] [pid 39523:tid 39538] [client 4.190.216.178:17509] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aT61CTQTQH1raAj2lkjvrgAAAAo"]
[Sun Dec 14 21:00:57.555053 2025] [:error] [pid 41600:tid 41627] [client 4.190.216.178:17441] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aT61CdFLTBZjcwNd_VsluwAAARg"]
[Sun Dec 14 21:00:57.877520 2025] [:error] [pid 39614:tid 39618] [client 4.190.216.178:17516] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aT61CfxybG8-9MflbDd9ZAAAAMI"]
[Sun Dec 14 21:00:58.365038 2025] [:error] [pid 13799:tid 13819] [client 4.190.216.178:11201] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aT61CnjPEin01ElFTNZKswAAAhE"]
[Sun Dec 14 21:00:58.727558 2025] [:error] [pid 39525:tid 39603] [client 4.190.216.178:11240] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aT61Ck1fX_pB_BrvE_5WkQAAAJQ"]
[Sun Dec 14 21:00:59.175391 2025] [:error] [pid 40595:tid 40609] [client 4.190.216.178:17481] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61C_jrht6y4RN-xKQsAwAAAYo"]
[Sun Dec 14 21:00:59.614881 2025] [:error] [pid 40561:tid 40585] [client 4.190.216.178:17475] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61C4Y6r869zoqRQkThpgAAAVQ"]
[Sun Dec 14 21:00:59.990331 2025] [:error] [pid 41600:tid 41613] [client 4.190.216.178:17467] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61C9FLTBZjcwNd_VslwAAAAQo"]
[Sun Dec 14 21:01:00.434044 2025] [:error] [pid 40595:tid 40604] [client 4.190.216.178:17476] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61DPjrht6y4RN-xKQsBQAAAYU"]
[Sun Dec 14 21:01:00.706281 2025] [:error] [pid 39524:tid 39578] [client 4.190.216.178:11226] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aT61DGrVGpbDzFtDE9P5fQAAAFY"]
[Sun Dec 14 21:01:01.024067 2025] [:error] [pid 39614:tid 39621] [client 4.190.216.178:11251] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aT61DfxybG8-9MflbDd9aQAAAMU"]
[Sun Dec 14 21:01:01.330351 2025] [:error] [pid 39614:tid 39633] [client 4.190.216.178:17466] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aT61DfxybG8-9MflbDd9awAAANE"]
[Sun Dec 14 21:01:01.634160 2025] [:error] [pid 39524:tid 39559] [client 4.190.216.178:17469] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aT61DWrVGpbDzFtDE9P5fwAAAEM"]
[Sun Dec 14 21:01:02.020692 2025] [:error] [pid 39525:tid 39593] [client 4.190.216.178:17493] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aT61Dk1fX_pB_BrvE_5WlQAAAIo"]
[Sun Dec 14 21:01:02.375495 2025] [:error] [pid 40561:tid 40566] [client 4.190.216.178:11215] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aT61DoY6r869zoqRQkThqAAAAUE"]
[Sun Dec 14 21:01:02.882625 2025] [:error] [pid 39524:tid 39558] [client 4.190.216.178:11160] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aT61DmrVGpbDzFtDE9P5gAAAAEI"]
[Sun Dec 14 21:01:03.318838 2025] [:error] [pid 39524:tid 39563] [client 4.190.216.178:17410] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aT61D2rVGpbDzFtDE9P5gQAAAEc"]
[Sun Dec 14 21:01:03.601976 2025] [:error] [pid 40561:tid 40567] [client 4.190.216.178:17408] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aT61D4Y6r869zoqRQkThqgAAAUI"]
[Sun Dec 14 21:01:03.959025 2025] [:error] [pid 39525:tid 39590] [client 4.190.216.178:11137] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aT61D01fX_pB_BrvE_5WmQAAAIc"]
[Sun Dec 14 21:01:04.249991 2025] [:error] [pid 40561:tid 40568] [client 4.190.216.178:17479] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aT61EIY6r869zoqRQkThrAAAAUM"]
[Sun Dec 14 21:01:04.651975 2025] [:error] [pid 40561:tid 40573] [client 4.190.216.178:17442] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aT61EIY6r869zoqRQkThrQAAAUg"]
[Sun Dec 14 21:01:05.083370 2025] [:error] [pid 13799:tid 13804] [client 4.190.216.178:11214] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61EXjPEin01ElFTNZKtwAAAgI"]
[Sun Dec 14 21:01:05.482918 2025] [:error] [pid 40595:tid 40618] [client 4.190.216.178:17446] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61Efjrht6y4RN-xKQsCwAAAZM"]
[Sun Dec 14 21:01:05.795076 2025] [:error] [pid 39523:tid 39546] [client 4.190.216.178:11203] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61ETQTQH1raAj2lkjvtQAAABI"]
[Sun Dec 14 21:01:06.310043 2025] [:error] [pid 40561:tid 40570] [client 4.190.216.178:11211] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61EoY6r869zoqRQkThsgAAAUU"]
[Sun Dec 14 21:01:06.701156 2025] [:error] [pid 13799:tid 13808] [client 4.190.216.178:17491] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aT61EnjPEin01ElFTNZKvQAAAgY"]
[Sun Dec 14 21:01:07.007110 2025] [:error] [pid 41600:tid 41608] [client 4.190.216.178:17522] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aT61E9FLTBZjcwNd_VslwgAAAQU"]
[Sun Dec 14 21:01:07.287895 2025] [:error] [pid 40596:tid 40639] [client 4.190.216.178:17517] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aT61E2vZZo4N2X7WoLyf8gAAAc0"]
[Sun Dec 14 21:01:07.574619 2025] [:error] [pid 13799:tid 13813] [client 4.190.216.178:11170] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aT61E3jPEin01ElFTNZKwAAAAgs"]
[Sun Dec 14 21:01:07.987045 2025] [:error] [pid 39614:tid 39632] [client 4.190.216.178:17526] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aT61E_xybG8-9MflbDd9cQAAANA"]
[Sun Dec 14 21:01:08.398975 2025] [:error] [pid 40561:tid 40585] [client 4.190.216.178:11140] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aT61FIY6r869zoqRQkThtAAAAVQ"]
[Sun Dec 14 21:01:08.900928 2025] [:error] [pid 40561:tid 40575] [client 4.190.216.178:17460] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aT61FIY6r869zoqRQkThtgAAAUo"]
[Sun Dec 14 21:01:09.434378 2025] [:error] [pid 40596:tid 40634] [client 4.190.216.178:11148] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aT61FWvZZo4N2X7WoLyf9QAAAcg"]
[Sun Dec 14 21:01:10.065813 2025] [:error] [pid 39523:tid 39534] [client 4.190.216.178:17463] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aT61FjQTQH1raAj2lkjvuQAAAAY"]
[Sun Dec 14 21:01:10.452485 2025] [:error] [pid 39523:tid 39538] [client 4.190.216.178:17468] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aT61FjQTQH1raAj2lkjvuwAAAAo"]
[Sun Dec 14 21:01:10.800887 2025] [:error] [pid 39523:tid 39543] [client 4.190.216.178:17461] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aT61FjQTQH1raAj2lkjvvgAAAA8"]
[Sun Dec 14 21:01:11.094256 2025] [:error] [pid 39524:tid 39559] [client 4.190.216.178:11205] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aT61F2rVGpbDzFtDE9P5jQAAAEM"]
[Sun Dec 14 21:01:11.514398 2025] [:error] [pid 39524:tid 39563] [client 4.190.216.178:17421] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT61F2rVGpbDzFtDE9P5jgAAAEc"]
[Sun Dec 14 21:01:11.887165 2025] [:error] [pid 41600:tid 41611] [client 4.190.216.178:17510] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT61F9FLTBZjcwNd_VslxwAAAQg"]
[Sun Dec 14 21:01:12.201766 2025] [:error] [pid 39614:tid 39619] [client 4.190.216.178:17529] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT61GPxybG8-9MflbDd9dwAAAMM"]
[Sun Dec 14 21:01:12.751562 2025] [:error] [pid 39524:tid 39575] [client 4.190.216.178:11236] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT61GGrVGpbDzFtDE9P5lgAAAFM"]
[Sun Dec 14 21:01:13.416340 2025] [:error] [pid 40595:tid 40619] [client 4.190.216.178:11243] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aT61Gfjrht6y4RN-xKQsHwAAAZQ"]
[Sun Dec 14 21:01:14.145205 2025] [:error] [pid 39524:tid 39565] [client 4.190.216.178:17531] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aT61GmrVGpbDzFtDE9P5ngAAAEk"]
[Sun Dec 14 21:01:14.566173 2025] [:error] [pid 13799:tid 13803] [client 4.190.216.178:17487] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aT61GnjPEin01ElFTNZK0wAAAgE"]
[Sun Dec 14 21:01:14.870376 2025] [:error] [pid 39523:tid 39544] [client 4.190.216.178:17500] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aT61GjQTQH1raAj2lkjv7AAAABA"]
[Sun Dec 14 21:01:15.402324 2025] [:error] [pid 39524:tid 39561] [client 4.190.216.178:17464] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aT61G2rVGpbDzFtDE9P5ogAAAEU"]
[Sun Dec 14 21:01:15.798334 2025] [:error] [pid 41600:tid 41617] [client 4.190.216.178:11223] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aT61G9FLTBZjcwNd_VslywAAAQ4"]
[Sun Dec 14 21:01:16.188362 2025] [:error] [pid 39524:tid 39574] [client 4.190.216.178:17415] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aT61HGrVGpbDzFtDE9P5pgAAAFI"]
[Sun Dec 14 21:01:16.807836 2025] [:error] [pid 13799:tid 13804] [client 4.190.216.178:11188] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aT61HHjPEin01ElFTNZK3AAAAgI"]
[Sun Dec 14 21:01:17.647041 2025] [:error] [pid 39614:tid 39634] [client 4.190.216.178:17472] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aT61HfxybG8-9MflbDd9jgAAANI"]
[Sun Dec 14 21:01:18.520743 2025] [:error] [pid 39525:tid 39606] [client 4.190.216.178:17413] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aT61Hk1fX_pB_BrvE_5WtQAAAJc"]
[Sun Dec 14 21:01:18.931772 2025] [:error] [pid 40561:tid 40578] [client 4.190.216.178:11175] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aT61HoY6r869zoqRQkTh7wAAAU0"]
[Sun Dec 14 21:01:19.296293 2025] [:error] [pid 39523:tid 39545] [client 4.190.216.178:11138] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aT61HzQTQH1raAj2lkjwDQAAABE"]
[Sun Dec 14 21:01:19.816498 2025] [:error] [pid 39523:tid 39543] [client 4.190.216.178:11234] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT61HzQTQH1raAj2lkjwEQAAAA8"]
[Sun Dec 14 21:01:20.164056 2025] [:error] [pid 41600:tid 41626] [client 4.190.216.178:11164] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT61INFLTBZjcwNd_Vsl0QAAARc"]
[Sun Dec 14 21:01:20.919651 2025] [:error] [pid 13799:tid 13818] [client 4.190.216.178:11262] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT61IHjPEin01ElFTNZK6wAAAhA"]
[Sun Dec 14 21:01:21.287772 2025] [:error] [pid 40595:tid 40609] [client 4.190.216.178:11259] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aT61Ifjrht6y4RN-xKQsagAAAYo"]
[Sun Dec 14 21:01:21.646139 2025] [:error] [pid 40596:tid 40650] [client 4.190.216.178:11216] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aT61IWvZZo4N2X7WoLyf_wAAAdg"]
[Sun Dec 14 21:01:21.971244 2025] [:error] [pid 39523:tid 39550] [client 4.190.216.178:17489] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aT61ITQTQH1raAj2lkjwHQAAABY"]
[Sun Dec 14 21:01:22.419960 2025] [:error] [pid 13799:tid 13820] [client 4.190.216.178:11254] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aT61InjPEin01ElFTNZK8AAAAhI"]
[Sun Dec 14 21:01:22.785169 2025] [:error] [pid 40561:tid 40573] [client 4.190.216.178:17534] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aT61IoY6r869zoqRQkTh-QAAAUg"]
[Sun Dec 14 21:01:23.070789 2025] [:error] [pid 40595:tid 40623] [client 4.190.216.178:11249] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61I_jrht6y4RN-xKQsdAAAAZg"]
[Sun Dec 14 21:01:23.478143 2025] [:error] [pid 13799:tid 13812] [client 4.190.216.178:11235] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61I3jPEin01ElFTNZK9AAAAgo"]
[Sun Dec 14 21:01:23.864974 2025] [:error] [pid 39525:tid 39598] [client 4.190.216.178:11077] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61I01fX_pB_BrvE_5WvAAAAI8"]
[Sun Dec 14 21:01:24.228198 2025] [:error] [pid 39614:tid 39639] [client 4.190.216.178:11174] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61JPxybG8-9MflbDd9rAAAANc"]
[Sun Dec 14 21:01:24.881902 2025] [:error] [pid 39614:tid 39636] [client 4.190.216.178:11180] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aT61JPxybG8-9MflbDd9rQAAANQ"]
[Sun Dec 14 21:01:25.148857 2025] [:error] [pid 41600:tid 41616] [client 4.190.216.178:17451] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aT61JdFLTBZjcwNd_Vsl1gAAAQ0"]
[Sun Dec 14 21:01:25.468806 2025] [:error] [pid 40596:tid 40630] [client 4.190.216.178:17532] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aT61JWvZZo4N2X7WoLygAAAAAcQ"]
[Sun Dec 14 21:01:25.788316 2025] [:error] [pid 13799:tid 13805] [client 4.190.216.178:11238] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aT61JXjPEin01ElFTNZK-AAAAgM"]
[Sun Dec 14 21:01:26.047634 2025] [:error] [pid 40596:tid 40626] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Dec 14 21:01:26.460565 2025] [:error] [pid 40596:tid 40633] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Dec 14 21:01:26.596913 2025] [:error] [pid 40596:tid 40627] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Sun Dec 14 21:01:26.984376 2025] [:error] [pid 40596:tid 40646] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/rss.php
[Sun Dec 14 21:01:27.133204 2025] [:error] [pid 40596:tid 40629] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/pekok.php
[Sun Dec 14 21:01:27.269453 2025] [:error] [pid 40596:tid 40647] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Dec 14 21:01:27.398035 2025] [:error] [pid 40596:tid 40648] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aa.php
[Sun Dec 14 21:01:27.688070 2025] [:error] [pid 40596:tid 40641] [client 4.190.216.178:17527] File does not exist: /usr/local/apache/htdocs/suspended-page/cart.php
[Sun Dec 14 21:01:28.215990 2025] [:error] [pid 40596:tid 40643] [client 4.190.216.178:17527] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aT61KGvZZo4N2X7WoLygDQAAAdE"]
[Sun Dec 14 21:01:28.933397 2025] [:error] [pid 39614:tid 39631] [client 4.190.216.178:17418] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aT61KPxybG8-9MflbDd9sAAAAM8"]
[Sun Dec 14 21:01:29.257230 2025] [:error] [pid 13799:tid 13813] [client 4.190.216.178:17414] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aT61KXjPEin01ElFTNZK-gAAAgs"]
[Sun Dec 14 21:01:29.546213 2025] [:error] [pid 40595:tid 40601] [client 4.190.216.178:11237] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aT61Kfjrht6y4RN-xKQsgQAAAYI"]
[Sun Dec 14 21:01:29.917809 2025] [:error] [pid 41600:tid 41622] [client 4.190.216.178:17492] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aT61KdFLTBZjcwNd_Vsl2QAAARM"]
[Sun Dec 14 21:01:30.241118 2025] [:error] [pid 40596:tid 40644] [client 4.190.216.178:11091] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aT61KmvZZo4N2X7WoLygDgAAAdI"]
[Sun Dec 14 21:01:30.634165 2025] [:error] [pid 41600:tid 41618] [client 4.190.216.178:11115] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aT61KtFLTBZjcwNd_Vsl2gAAAQ8"]
[Sun Dec 14 21:01:31.090143 2025] [:error] [pid 39523:tid 39530] [client 4.190.216.178:11224] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aT61KzQTQH1raAj2lkjwKQAAAAI"]
[Sun Dec 14 21:01:31.464175 2025] [:error] [pid 41600:tid 41619] [client 4.190.216.178:11208] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61K9FLTBZjcwNd_Vsl3AAAARA"]
[Sun Dec 14 21:01:31.821668 2025] [:error] [pid 40596:tid 40636] [client 4.190.216.178:17438] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61K2vZZo4N2X7WoLygEAAAAco"]
[Sun Dec 14 21:01:32.286250 2025] [:error] [pid 39525:tid 39600] [client 4.190.216.178:11169] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61LE1fX_pB_BrvE_5W1gAAAJE"]
[Sun Dec 14 21:01:32.637839 2025] [:error] [pid 40595:tid 40607] [client 4.190.216.178:11179] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aT61LPjrht6y4RN-xKQslwAAAYg"]
[Sun Dec 14 21:01:32.952493 2025] [:error] [pid 40596:tid 40645] [client 4.190.216.178:17462] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT61LGvZZo4N2X7WoLygEQAAAdM"]
[Sun Dec 14 21:01:33.228787 2025] [:error] [pid 39524:tid 39566] [client 4.190.216.178:11239] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT61LWrVGpbDzFtDE9P5zQAAAEo"]
[Sun Dec 14 21:01:33.557626 2025] [:error] [pid 39614:tid 39626] [client 4.190.216.178:11231] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT61LfxybG8-9MflbDd9sgAAAMo"]
[Sun Dec 14 21:01:33.863473 2025] [:error] [pid 40596:tid 40630] [client 4.190.216.178:11150] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aT61LWvZZo4N2X7WoLygFAAAAcQ"]
[Sun Dec 14 21:01:34.273022 2025] [:error] [pid 39523:tid 39533] [client 4.190.216.178:11229] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atom.php"] [unique_id "aT61LjQTQH1raAj2lkjwLQAAAAU"]
[Sun Dec 14 21:01:34.641532 2025] [:error] [pid 13799:tid 13819] [client 4.190.216.178:11011] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atom.php"] [unique_id "aT61LnjPEin01ElFTNZLEgAAAhE"]
[Sun Dec 14 21:01:34.908403 2025] [:error] [pid 39524:tid 39578] [client 4.190.216.178:11250] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atom.php"] [unique_id "aT61LmrVGpbDzFtDE9P5zgAAAFY"]
[Sun Dec 14 21:01:35.379765 2025] [:error] [pid 41600:tid 41609] [client 4.190.216.178:11075] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atom.php"] [unique_id "aT61L9FLTBZjcwNd_Vsl4AAAAQY"]
[Sun Dec 14 21:01:35.771414 2025] [:error] [pid 41600:tid 41615] [client 4.190.216.178:11145] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/case.php"] [unique_id "aT61L9FLTBZjcwNd_Vsl4gAAAQw"]
[Sun Dec 14 21:01:36.091106 2025] [:error] [pid 39525:tid 39587] [client 4.190.216.178:11147] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/case.php"] [unique_id "aT61ME1fX_pB_BrvE_5W2gAAAIQ"]
[Sun Dec 14 21:01:36.376764 2025] [:error] [pid 13799:tid 13816] [client 4.190.216.178:17435] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/case.php"] [unique_id "aT61MHjPEin01ElFTNZLFQAAAg4"]
[Sun Dec 14 21:01:36.630546 2025] [:error] [pid 39614:tid 39637] [client 4.190.216.178:11084] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/case.php"] [unique_id "aT61MPxybG8-9MflbDd9tQAAANU"]
[Sun Dec 14 21:01:36.900407 2025] [:error] [pid 40596:tid 40642] [client 4.190.216.178:11095] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aT61MGvZZo4N2X7WoLygFgAAAdA"]
[Sun Dec 14 21:01:37.188687 2025] [:error] [pid 13799:tid 13809] [client 4.190.216.178:11206] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aT61MXjPEin01ElFTNZLFwAAAgc"]
[Sun Dec 14 21:01:37.633664 2025] [:error] [pid 40561:tid 40583] [client 4.190.216.178:11171] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aT61MYY6r869zoqRQkTiBQAAAVI"]
[Sun Dec 14 21:01:37.970424 2025] [:error] [pid 39523:tid 39552] [client 4.190.216.178:11079] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aT61MTQTQH1raAj2lkjwLwAAABg"]
[Sun Dec 14 21:01:38.348948 2025] [:error] [pid 39525:tid 39593] [client 4.190.216.178:11156] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ios.php"] [unique_id "aT61Mk1fX_pB_BrvE_5W3AAAAIo"]
[Sun Dec 14 21:01:38.628463 2025] [:error] [pid 41600:tid 41616] [client 4.190.216.178:11241] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ios.php"] [unique_id "aT61MtFLTBZjcwNd_Vsl5AAAAQ0"]
[Sun Dec 14 21:01:38.881344 2025] [:error] [pid 39524:tid 39562] [client 4.190.216.178:11167] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ios.php"] [unique_id "aT61MmrVGpbDzFtDE9P51QAAAEY"]
[Sun Dec 14 21:01:39.142739 2025] [:error] [pid 39614:tid 39619] [client 4.190.216.178:11225] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ios.php"] [unique_id "aT61M_xybG8-9MflbDd9tgAAAMM"]
[Sun Dec 14 21:01:39.413876 2025] [:error] [pid 39614:tid 39624] [client 4.190.216.178:11198] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT61M_xybG8-9MflbDd9twAAAMg"]
[Sun Dec 14 21:01:39.789656 2025] [:error] [pid 39524:tid 39569] [client 4.190.216.178:17504] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT61M2rVGpbDzFtDE9P51wAAAE0"]
[Sun Dec 14 21:01:42.482631 2025] [:error] [pid 41600:tid 41613] [client 4.190.216.178:11195] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT61NtFLTBZjcwNd_Vsl5gAAAQo"]
[Sun Dec 14 21:01:42.819941 2025] [:error] [pid 39525:tid 39589] [client 4.190.216.178:11244] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aT61Nk1fX_pB_BrvE_5W4wAAAIY"]
[Sun Dec 14 21:01:43.116810 2025] [:error] [pid 39614:tid 39617] [client 4.190.216.178:11105] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aT61N_xybG8-9MflbDd9vAAAAME"]
[Sun Dec 14 21:01:43.404135 2025] [:error] [pid 41600:tid 41622] [client 4.190.216.178:11166] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aT61N9FLTBZjcwNd_Vsl5wAAARM"]
[Sun Dec 14 21:01:43.712923 2025] [:error] [pid 13799:tid 13803] [client 4.190.216.178:11219] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aT61N3jPEin01ElFTNZLGQAAAgE"]
[Sun Dec 14 21:01:44.127058 2025] [:error] [pid 40561:tid 40584] [client 4.190.216.178:11248] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aT61OIY6r869zoqRQkTiGQAAAVM"]
[Sun Dec 14 21:01:44.592525 2025] [:error] [pid 40596:tid 40626] [client 4.190.216.178:11218] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aT61OGvZZo4N2X7WoLygKgAAAcA"]
[Sun Dec 14 21:01:44.899671 2025] [:error] [pid 39525:tid 39587] [client 4.190.216.178:11073] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aT61OE1fX_pB_BrvE_5W7AAAAIQ"]
[Sun Dec 14 21:01:45.195326 2025] [:error] [pid 40596:tid 40627] [client 4.190.216.178:11252] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aT61OWvZZo4N2X7WoLygLQAAAcE"]
[Sun Dec 14 21:01:45.510178 2025] [:error] [pid 13799:tid 13808] [client 4.190.216.178:17440] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aT61OXjPEin01ElFTNZLGgAAAgY"]
[Sun Dec 14 21:01:45.809092 2025] [:error] [pid 40561:tid 40566] [client 4.190.216.178:11202] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT61OYY6r869zoqRQkTiHQAAAUE"]
[Sun Dec 14 21:01:46.172119 2025] [:error] [pid 41600:tid 41610] [client 4.190.216.178:11186] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT61OtFLTBZjcwNd_Vsl6QAAAQc"]
[Sun Dec 14 21:01:46.509347 2025] [:error] [pid 41600:tid 41626] [client 4.190.216.178:11130] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT61OtFLTBZjcwNd_Vsl6gAAARc"]
[Sun Dec 14 21:01:46.851039 2025] [:error] [pid 41600:tid 41625] [client 4.190.216.178:17488] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT61OtFLTBZjcwNd_Vsl7AAAARY"]
[Sun Dec 14 21:01:47.229719 2025] [:error] [pid 39525:tid 39586] [client 4.190.216.178:11163] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aT61O01fX_pB_BrvE_5W8AAAAIM"]
[Sun Dec 14 21:01:47.610320 2025] [:error] [pid 39524:tid 39570] [client 4.190.216.178:11023] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aT61O2rVGpbDzFtDE9P55wAAAE4"]
[Sun Dec 14 21:01:48.082431 2025] [:error] [pid 39614:tid 39626] [client 4.190.216.178:11168] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aT61PPxybG8-9MflbDd9wQAAAMo"]
[Sun Dec 14 21:01:48.399890 2025] [:error] [pid 39525:tid 39594] [client 4.190.216.178:11209] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aT61PE1fX_pB_BrvE_5W8wAAAIs"]
[Sun Dec 14 21:01:48.706686 2025] [:error] [pid 39614:tid 39632] [client 4.190.216.178:17457] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "aT61PPxybG8-9MflbDd9xAAAANA"]
[Sun Dec 14 21:01:49.094876 2025] [:error] [pid 13799:tid 13811] [client 4.190.216.178:11261] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "aT61PXjPEin01ElFTNZLHgAAAgk"]
[Sun Dec 14 21:01:49.469379 2025] [:error] [pid 40561:tid 40587] [client 4.190.216.178:11181] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "aT61PYY6r869zoqRQkTiIwAAAVY"]
[Sun Dec 14 21:01:49.788781 2025] [:error] [pid 13799:tid 13816] [client 4.190.216.178:11207] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "aT61PXjPEin01ElFTNZLHwAAAg4"]
[Sun Dec 14 21:01:50.078679 2025] [:error] [pid 39525:tid 39604] [client 4.190.216.178:11257] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aT61Pk1fX_pB_BrvE_5W9QAAAJU"]
[Sun Dec 14 21:01:50.396912 2025] [:error] [pid 41600:tid 41606] [client 4.190.216.178:11153] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aT61PtFLTBZjcwNd_Vsl7wAAAQM"]
[Sun Dec 14 21:01:50.677158 2025] [:error] [pid 39524:tid 39558] [client 4.190.216.178:11051] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aT61PmrVGpbDzFtDE9P58AAAAEI"]
[Sun Dec 14 21:01:50.964468 2025] [:error] [pid 39523:tid 39548] [client 4.190.216.178:11221] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aT61PjQTQH1raAj2lkjwSAAAABQ"]
[Sun Dec 14 21:01:51.369953 2025] [:error] [pid 41600:tid 41623] [client 4.190.216.178:11226] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aT61P9FLTBZjcwNd_Vsl8AAAARQ"]
[Sun Dec 14 21:01:51.639054 2025] [:error] [pid 39614:tid 39623] [client 4.190.216.178:17412] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aT61P_xybG8-9MflbDd9yAAAAMc"]
[Sun Dec 14 21:01:51.928084 2025] [:error] [pid 39524:tid 39563] [client 4.190.216.178:11238] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aT61P2rVGpbDzFtDE9P58QAAAEc"]
[Sun Dec 14 21:01:52.293670 2025] [:error] [pid 39523:tid 39533] [client 4.190.216.178:11217] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aT61QDQTQH1raAj2lkjwSgAAAAU"]
[Sun Dec 14 21:01:52.651336 2025] [:error] [pid 39524:tid 39564] [client 4.190.216.178:11260] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT61QGrVGpbDzFtDE9P58gAAAEg"]
[Sun Dec 14 21:01:52.911031 2025] [:error] [pid 13799:tid 13802] [client 4.190.216.178:11258] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT61QHjPEin01ElFTNZLJQAAAgA"]
[Sun Dec 14 21:01:53.264893 2025] [:error] [pid 13799:tid 13822] [client 4.190.216.178:11149] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT61QXjPEin01ElFTNZLJwAAAhQ"]
[Sun Dec 14 21:01:53.531721 2025] [:error] [pid 40561:tid 40568] [client 4.190.216.178:11098] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT61QYY6r869zoqRQkTiKQAAAUM"]
[Sun Dec 14 21:01:53.876711 2025] [:error] [pid 40561:tid 40581] [client 4.190.216.178:11194] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61QYY6r869zoqRQkTiKgAAAVA"]
[Sun Dec 14 21:01:54.152855 2025] [:error] [pid 40595:tid 40603] [client 4.190.216.178:11146] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61Qvjrht6y4RN-xKQsxgAAAYQ"]
[Sun Dec 14 21:01:54.472790 2025] [:error] [pid 39614:tid 39627] [client 4.190.216.178:11185] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61QvxybG8-9MflbDd9ygAAAMs"]
[Sun Dec 14 21:01:54.975762 2025] [:error] [pid 39523:tid 39547] [client 4.190.216.178:11232] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aT61QjQTQH1raAj2lkjwTQAAABM"]
[Sun Dec 14 21:01:55.292748 2025] [:error] [pid 39524:tid 39568] [client 4.190.216.178:11242] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aT61Q2rVGpbDzFtDE9P59AAAAEw"]
[Sun Dec 14 21:01:55.574668 2025] [:error] [pid 39524:tid 39572] [client 4.190.216.178:11155] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aT61Q2rVGpbDzFtDE9P59QAAAFA"]
[Sun Dec 14 21:01:55.862715 2025] [:error] [pid 13799:tid 13814] [client 4.190.216.178:11090] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aT61Q3jPEin01ElFTNZLKgAAAgw"]
[Sun Dec 14 21:01:56.134280 2025] [:error] [pid 40595:tid 40619] [client 4.190.216.178:11227] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aT61RPjrht6y4RN-xKQszAAAAZQ"]
[Sun Dec 14 21:01:56.488909 2025] [:error] [pid 40595:tid 40600] [client 4.190.216.178:11076] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61RPjrht6y4RN-xKQszgAAAYE"]
[Sun Dec 14 21:01:56.814816 2025] [:error] [pid 13799:tid 13821] [client 4.190.216.178:17411] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61RHjPEin01ElFTNZLLAAAAhM"]
[Sun Dec 14 21:01:57.086441 2025] [:error] [pid 13799:tid 13825] [client 4.190.216.178:11136] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61RXjPEin01ElFTNZLLQAAAhc"]
[Sun Dec 14 21:01:57.468949 2025] [:error] [pid 39524:tid 39565] [client 4.190.216.178:11187] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aT61RWrVGpbDzFtDE9P5-gAAAEk"]
[Sun Dec 14 21:01:57.814677 2025] [:error] [pid 40561:tid 40576] [client 4.190.216.178:11082] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aT61RYY6r869zoqRQkTiLAAAAUs"]
[Sun Dec 14 21:01:58.059381 2025] [:error] [pid 13799:tid 13807] [client 4.190.216.178:17524] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aT61RnjPEin01ElFTNZLLwAAAgU"]
[Sun Dec 14 21:01:58.370076 2025] [:error] [pid 40596:tid 40631] [client 4.190.216.178:11200] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aT61RmvZZo4N2X7WoLygMgAAAcU"]
[Sun Dec 14 21:01:58.630606 2025] [:error] [pid 39525:tid 39593] [client 4.190.216.178:11151] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aT61Rk1fX_pB_BrvE_5W_wAAAIo"]
[Sun Dec 14 21:01:58.902232 2025] [:error] [pid 13799:tid 13809] [client 4.190.216.178:11246] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aT61RnjPEin01ElFTNZLMQAAAgc"]
[Sun Dec 14 21:01:59.177484 2025] [:error] [pid 41600:tid 41613] [client 4.190.216.178:11165] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aT61R9FLTBZjcwNd_Vsl9gAAAQo"]
[Sun Dec 14 21:01:59.420157 2025] [:error] [pid 41600:tid 41619] [client 4.190.216.178:11141] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aT61R9FLTBZjcwNd_Vsl9wAAARA"]
[Sun Dec 14 21:01:59.689296 2025] [:error] [pid 39614:tid 39633] [client 4.190.216.178:17459] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aT61R_xybG8-9MflbDd9zAAAANE"]
[Sun Dec 14 21:01:59.968340 2025] [:error] [pid 39614:tid 39638] [client 4.190.216.178:11019] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aT61R_xybG8-9MflbDd9zQAAANY"]
[Sun Dec 14 21:02:00.282034 2025] [:error] [pid 39523:tid 39540] [client 4.190.216.178:11112] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aT61SDQTQH1raAj2lkjwTgAAAAw"]
[Sun Dec 14 21:02:00.567358 2025] [:error] [pid 39524:tid 39571] [client 4.190.216.178:11189] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aT61SGrVGpbDzFtDE9P5_QAAAE8"]
[Sun Dec 14 21:02:00.836883 2025] [:error] [pid 13799:tid 13803] [client 4.190.216.178:11134] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aT61SHjPEin01ElFTNZLMwAAAgE"]
[Sun Dec 14 21:02:01.117971 2025] [:error] [pid 39523:tid 39528] [client 4.190.216.178:11113] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aT61STQTQH1raAj2lkjwTwAAAAA"]
[Sun Dec 14 21:02:01.475249 2025] [:error] [pid 39525:tid 39603] [client 4.190.216.178:11078] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aT61SU1fX_pB_BrvE_5XBQAAAJQ"]
[Sun Dec 14 21:02:01.755284 2025] [:error] [pid 40595:tid 40613] [client 4.190.216.178:17499] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aT61Sfjrht6y4RN-xKQs0gAAAY4"]
[Sun Dec 14 21:02:02.141034 2025] [:error] [pid 39523:tid 39531] [client 4.190.216.178:11118] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aT61SjQTQH1raAj2lkjwUQAAAAM"]
[Sun Dec 14 21:02:02.386689 2025] [:error] [pid 40595:tid 40623] [client 4.190.216.178:11199] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aT61Svjrht6y4RN-xKQs1AAAAZg"]
[Sun Dec 14 21:02:02.692372 2025] [:error] [pid 39523:tid 39542] [client 4.190.216.178:17422] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aT61SjQTQH1raAj2lkjwUgAAAA4"]
[Sun Dec 14 21:02:02.955049 2025] [:error] [pid 39614:tid 39618] [client 4.190.216.178:11143] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aT61SvxybG8-9MflbDd90AAAAMI"]
[Sun Dec 14 21:02:03.201736 2025] [:error] [pid 40596:tid 40646] [client 4.190.216.178:17458] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aT61S2vZZo4N2X7WoLygOAAAAdQ"]
[Sun Dec 14 21:02:03.504222 2025] [:error] [pid 39614:tid 39640] [client 4.190.216.178:11102] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT61S_xybG8-9MflbDd90gAAANg"]
[Sun Dec 14 21:02:03.816083 2025] [:error] [pid 39614:tid 39637] [client 4.190.216.178:11096] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT61S_xybG8-9MflbDd91AAAANU"]
[Sun Dec 14 21:02:04.081222 2025] [:error] [pid 40561:tid 40567] [client 4.190.216.178:11081] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT61TIY6r869zoqRQkTiMwAAAUI"]
[Sun Dec 14 21:02:04.478450 2025] [:error] [pid 39524:tid 39569] [client 4.190.216.178:11157] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT61TGrVGpbDzFtDE9P6AgAAAE0"]
[Sun Dec 14 21:02:04.819128 2025] [:error] [pid 39524:tid 39566] [client 4.190.216.178:11116] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aT61TGrVGpbDzFtDE9P6AwAAAEo"]
[Sun Dec 14 21:02:05.161876 2025] [:error] [pid 39524:tid 39556] [client 4.190.216.178:17453] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aT61TWrVGpbDzFtDE9P6BAAAAEA"]
[Sun Dec 14 21:02:05.482629 2025] [:error] [pid 39524:tid 39568] [client 4.190.216.178:11173] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aT61TWrVGpbDzFtDE9P6BgAAAEw"]
[Sun Dec 14 21:02:05.778884 2025] [:error] [pid 39524:tid 39567] [client 4.190.216.178:11172] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aT61TWrVGpbDzFtDE9P6CAAAAEs"]
[Sun Dec 14 21:02:06.147698 2025] [:error] [pid 39523:tid 39541] [client 4.190.216.178:11142] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aT61TjQTQH1raAj2lkjwVwAAAA0"]
[Sun Dec 14 21:02:06.424111 2025] [:error] [pid 40595:tid 40615] [client 4.190.216.178:11263] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aT61Tvjrht6y4RN-xKQs2AAAAZA"]
[Sun Dec 14 21:02:06.940637 2025] [:error] [pid 40561:tid 40581] [client 4.190.216.178:11122] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aT61ToY6r869zoqRQkTiOQAAAVA"]
[Sun Dec 14 21:02:07.260858 2025] [:error] [pid 40561:tid 40571] [client 4.190.216.178:11190] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aT61T4Y6r869zoqRQkTiOgAAAUY"]
[Sun Dec 14 21:02:07.607258 2025] [:error] [pid 39614:tid 39616] [client 4.190.216.178:11039] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aT61T_xybG8-9MflbDd91gAAAMA"]
[Sun Dec 14 21:02:07.889229 2025] [:error] [pid 39523:tid 39535] [client 4.190.216.178:11176] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aT61TzQTQH1raAj2lkjwWQAAAAc"]
[Sun Dec 14 21:02:08.155137 2025] [:error] [pid 39614:tid 39628] [client 4.190.216.178:11041] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aT61UPxybG8-9MflbDd92AAAAMw"]
[Sun Dec 14 21:02:08.507460 2025] [:error] [pid 41600:tid 41616] [client 4.190.216.178:11129] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aT61UNFLTBZjcwNd_Vsl_wAAAQ0"]
[Sun Dec 14 21:02:08.839870 2025] [:error] [pid 40561:tid 40569] [client 4.190.216.178:11123] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aT61UIY6r869zoqRQkTiQQAAAUQ"]
[Sun Dec 14 21:02:09.116933 2025] [:error] [pid 41600:tid 41618] [client 4.190.216.178:11178] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aT61UdFLTBZjcwNd_VsmAgAAAQ8"]
[Sun Dec 14 21:02:09.673151 2025] [:error] [pid 41600:tid 41625] [client 4.190.216.178:11120] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aT61UdFLTBZjcwNd_VsmCwAAARY"]
[Sun Dec 14 21:02:10.099873 2025] [:error] [pid 39525:tid 39584] [client 4.190.216.178:11191] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aT61Uk1fX_pB_BrvE_5XHwAAAIE"]
[Sun Dec 14 21:02:10.403854 2025] [:error] [pid 40595:tid 40617] [client 4.190.216.178:11085] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aT61Uvjrht6y4RN-xKQs7AAAAZI"]
[Sun Dec 14 21:02:10.696909 2025] [:error] [pid 41600:tid 41621] [client 4.190.216.178:11117] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aT61UtFLTBZjcwNd_VsmFgAAARI"]
[Sun Dec 14 21:02:10.978366 2025] [:error] [pid 39614:tid 39627] [client 4.190.216.178:11094] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aT61UvxybG8-9MflbDd92gAAAMs"]
[Sun Dec 14 21:02:11.299212 2025] [:error] [pid 13799:tid 13802] [client 4.190.216.178:11048] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aT61U3jPEin01ElFTNZLVAAAAgA"]
[Sun Dec 14 21:02:11.626906 2025] [:error] [pid 41600:tid 41613] [client 4.190.216.178:17471] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aT61U9FLTBZjcwNd_VsmFwAAAQo"]
[Sun Dec 14 21:02:11.881452 2025] [:error] [pid 39524:tid 39575] [client 4.190.216.178:11100] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aT61U2rVGpbDzFtDE9P6GQAAAFM"]
[Sun Dec 14 21:02:12.266060 2025] [:error] [pid 39524:tid 39565] [client 4.190.216.178:11197] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aT61VGrVGpbDzFtDE9P6GwAAAEk"]
[Sun Dec 14 21:02:12.539100 2025] [:error] [pid 39524:tid 39560] [client 4.190.216.178:11114] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aT61VGrVGpbDzFtDE9P6HwAAAEQ"]
[Sun Dec 14 21:02:12.932712 2025] [:error] [pid 39614:tid 39617] [client 4.190.216.178:11074] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aT61VPxybG8-9MflbDd93AAAAME"]
[Sun Dec 14 21:02:13.284265 2025] [:error] [pid 40595:tid 40610] [client 4.190.216.178:11135] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aT61Vfjrht6y4RN-xKQs8QAAAYs"]
[Sun Dec 14 21:02:13.630945 2025] [:error] [pid 40596:tid 40648] [client 4.190.216.178:11093] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aT61VWvZZo4N2X7WoLygSgAAAdY"]
[Sun Dec 14 21:02:14.064265 2025] [:error] [pid 39524:tid 39557] [client 4.190.216.178:11144] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aT61VmrVGpbDzFtDE9P6IwAAAEE"]
[Sun Dec 14 21:02:14.451706 2025] [:error] [pid 39523:tid 39537] [client 4.190.216.178:11255] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aT61VjQTQH1raAj2lkjwXgAAAAk"]
[Sun Dec 14 21:02:14.812611 2025] [:error] [pid 39525:tid 39584] [client 4.190.216.178:11131] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aT61Vk1fX_pB_BrvE_5XMQAAAIE"]
[Sun Dec 14 21:02:15.120642 2025] [:error] [pid 39525:tid 39590] [client 4.190.216.178:11177] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aT61V01fX_pB_BrvE_5XMgAAAIc"]
[Sun Dec 14 21:02:15.386115 2025] [:error] [pid 40596:tid 40635] [client 4.190.216.178:11010] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aT61V2vZZo4N2X7WoLygTAAAAck"]
[Sun Dec 14 21:02:15.651780 2025] [:error] [pid 40596:tid 40631] [client 4.190.216.178:11245] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aT61V2vZZo4N2X7WoLygTQAAAcU"]
[Sun Dec 14 21:02:16.098411 2025] [:error] [pid 13799:tid 13820] [client 4.190.216.178:11097] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aT61WHjPEin01ElFTNZLYwAAAhI"]
[Sun Dec 14 21:02:16.475198 2025] [:error] [pid 39525:tid 39606] [client 4.190.216.178:17482] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aT61WE1fX_pB_BrvE_5XNwAAAJc"]
[Sun Dec 14 21:02:16.740880 2025] [:error] [pid 39523:tid 39531] [client 4.190.216.178:11139] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aT61WDQTQH1raAj2lkjwYQAAAAM"]
[Sun Dec 14 21:02:17.057299 2025] [:error] [pid 40596:tid 40634] [client 4.190.216.178:11092] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aT61WWvZZo4N2X7WoLygTwAAAcg"]
[Sun Dec 14 21:02:17.336708 2025] [:error] [pid 39525:tid 39599] [client 4.190.216.178:17473] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aT61WU1fX_pB_BrvE_5XOgAAAJA"]
[Sun Dec 14 21:02:17.598233 2025] [:error] [pid 40595:tid 40601] [client 4.190.216.178:11182] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aT61Wfjrht6y4RN-xKQs9gAAAYI"]
[Sun Dec 14 21:02:17.892716 2025] [:error] [pid 41600:tid 41614] [client 4.190.216.178:11016] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aT61WdFLTBZjcwNd_VsmIgAAAQs"]
[Sun Dec 14 21:02:18.179654 2025] [:error] [pid 40561:tid 40589] [client 4.190.216.178:11184] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aT61WoY6r869zoqRQkTibAAAAVg"]
[Sun Dec 14 21:02:18.464009 2025] [:error] [pid 40561:tid 40570] [client 4.190.216.178:11193] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aT61WoY6r869zoqRQkTibgAAAUU"]
[Sun Dec 14 21:02:18.826019 2025] [:error] [pid 40596:tid 40640] [client 4.190.216.178:11158] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aT61WmvZZo4N2X7WoLygUQAAAc4"]
[Sun Dec 14 21:02:19.105933 2025] [:error] [pid 39525:tid 39605] [client 4.190.216.178:11021] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aT61W01fX_pB_BrvE_5XPgAAAJY"]
[Sun Dec 14 21:02:19.399934 2025] [:error] [pid 39524:tid 39565] [client 4.190.216.178:11013] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aT61W2rVGpbDzFtDE9P6KQAAAEk"]
[Sun Dec 14 21:02:19.684683 2025] [:error] [pid 13799:tid 13812] [client 4.190.216.178:10979] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aT61W3jPEin01ElFTNZLaQAAAgo"]
[Sun Dec 14 21:02:19.944471 2025] [:error] [pid 39524:tid 39561] [client 4.190.216.178:11033] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aT61W2rVGpbDzFtDE9P6LAAAAEU"]
[Sun Dec 14 21:02:20.268969 2025] [:error] [pid 13799:tid 13806] [client 4.190.216.178:11015] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aT61XHjPEin01ElFTNZLawAAAgQ"]
[Sun Dec 14 21:02:20.663126 2025] [:error] [pid 41600:tid 41610] [client 4.190.216.178:11126] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aT61XNFLTBZjcwNd_VsmKQAAAQc"]
[Sun Dec 14 21:02:20.933752 2025] [:error] [pid 39524:tid 39569] [client 4.190.216.178:11125] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aT61XGrVGpbDzFtDE9P6LgAAAE0"]
[Sun Dec 14 21:02:21.387965 2025] [:error] [pid 40596:tid 40626] [client 4.190.216.178:11083] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aT61XWvZZo4N2X7WoLygUgAAAcA"]
[Sun Dec 14 21:02:21.706031 2025] [:error] [pid 39523:tid 39537] [client 4.190.216.178:11022] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aT61XTQTQH1raAj2lkjwcQAAAAk"]
[Sun Dec 14 21:02:21.964631 2025] [:error] [pid 13799:tid 13822] [client 4.190.216.178:11106] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aT61XXjPEin01ElFTNZLcgAAAhQ"]
[Sun Dec 14 21:02:22.278213 2025] [:error] [pid 40596:tid 40637] [client 4.190.216.178:11099] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aT61XmvZZo4N2X7WoLygUwAAAcs"]
[Sun Dec 14 21:02:22.658070 2025] [:error] [pid 40561:tid 40587] [client 4.190.216.178:11087] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aT61XoY6r869zoqRQkTiggAAAVY"]
[Sun Dec 14 21:02:23.018782 2025] [:error] [pid 40561:tid 40567] [client 4.190.216.178:11086] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aT61X4Y6r869zoqRQkTilQAAAUI"]
[Sun Dec 14 21:02:23.344645 2025] [:error] [pid 39524:tid 39556] [client 4.190.216.178:17445] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aT61X2rVGpbDzFtDE9P6MAAAAEA"]
[Sun Dec 14 21:02:23.678006 2025] [:error] [pid 13799:tid 13818] [client 4.190.216.178:11014] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aT61X3jPEin01ElFTNZLkAAAAhA"]
[Sun Dec 14 21:02:23.968729 2025] [:error] [pid 39525:tid 39607] [client 4.190.216.178:11026] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aT61X01fX_pB_BrvE_5XPwAAAJg"]
[Sun Dec 14 21:02:24.409083 2025] [:error] [pid 40561:tid 40582] [client 4.190.216.178:11111] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aT61YIY6r869zoqRQkTipwAAAVE"]
[Sun Dec 14 21:02:24.684714 2025] [:error] [pid 39524:tid 39564] [client 4.190.216.178:11035] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aT61YGrVGpbDzFtDE9P6NQAAAEg"]
[Sun Dec 14 21:02:25.116667 2025] [:error] [pid 41600:tid 41618] [client 4.190.216.178:11031] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aT61YdFLTBZjcwNd_VsmXQAAAQ8"]
[Sun Dec 14 21:02:25.419904 2025] [:error] [pid 39524:tid 39570] [client 4.190.216.178:11020] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aT61YWrVGpbDzFtDE9P6NgAAAE4"]
[Sun Dec 14 21:02:25.804029 2025] [:error] [pid 39523:tid 39550] [client 4.190.216.178:11101] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aT61YTQTQH1raAj2lkjwkwAAABY"]
[Sun Dec 14 21:02:26.195827 2025] [:error] [pid 40596:tid 40632] [client 4.190.216.178:11025] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aT61YmvZZo4N2X7WoLygWgAAAcY"]
[Sun Dec 14 21:02:26.549324 2025] [:error] [pid 13799:tid 13816] [client 4.190.216.178:10955] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aT61YnjPEin01ElFTNZLmgAAAg4"]
[Sun Dec 14 21:02:26.865973 2025] [:error] [pid 39525:tid 39599] [client 4.190.216.178:11032] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aT61Yk1fX_pB_BrvE_5XRQAAAJA"]
[Sun Dec 14 21:02:27.276946 2025] [:error] [pid 40561:tid 40574] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/file1.php
[Sun Dec 14 21:02:27.405457 2025] [:error] [pid 40561:tid 40578] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Dec 14 21:02:27.531755 2025] [:error] [pid 40561:tid 40569] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php
[Sun Dec 14 21:02:27.674660 2025] [:error] [pid 40561:tid 40589] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/321.php
[Sun Dec 14 21:02:27.798334 2025] [:error] [pid 40561:tid 40583] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 14 21:02:27.934364 2025] [:error] [pid 40561:tid 40566] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 14 21:02:28.058207 2025] [:error] [pid 40561:tid 40576] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Sun Dec 14 21:02:28.206447 2025] [:error] [pid 40561:tid 40573] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Dec 14 21:02:28.333086 2025] [:error] [pid 40561:tid 40582] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Sun Dec 14 21:02:28.457036 2025] [:error] [pid 40561:tid 40586] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Sun Dec 14 21:02:28.593897 2025] [:error] [pid 40561:tid 40567] [client 4.190.216.178:11162] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sun Dec 14 21:02:28.719927 2025] [:error] [pid 40561:tid 40565] [client 4.190.216.178:11162] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aT61ZIY6r869zoqRQkTiuwAAAUA"]
[Sun Dec 14 21:02:29.053628 2025] [:error] [pid 40595:tid 40617] [client 4.190.216.178:11109] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aT61Zfjrht6y4RN-xKQtBwAAAZI"]
[Sun Dec 14 21:02:29.371537 2025] [:error] [pid 40595:tid 40621] [client 4.190.216.178:11043] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aT61Zfjrht6y4RN-xKQtCAAAAZY"]
[Sun Dec 14 21:02:29.701334 2025] [:error] [pid 13799:tid 13819] [client 4.190.216.178:11196] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aT61ZXjPEin01ElFTNZLnAAAAhE"]
[Sun Dec 14 21:02:30.091576 2025] [:error] [pid 40595:tid 40615] [client 4.190.216.178:11018] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aT61Zvjrht6y4RN-xKQtCgAAAZA"]
[Sun Dec 14 21:02:30.385745 2025] [:error] [pid 39524:tid 39580] [client 4.190.216.178:11152] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aT61ZmrVGpbDzFtDE9P6PQAAAFg"]
[Sun Dec 14 21:02:30.843624 2025] [:error] [pid 40596:tid 40636] [client 4.190.216.178:11061] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aT61ZmvZZo4N2X7WoLygYAAAAco"]
[Sun Dec 14 21:02:31.186501 2025] [:error] [pid 39523:tid 39543] [client 4.190.216.178:11228] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aT61ZzQTQH1raAj2lkjwmQAAAA8"]
[Sun Dec 14 21:02:31.559652 2025] [:error] [pid 41600:tid 41605] [client 4.190.216.178:11192] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aT61Z9FLTBZjcwNd_VsmYgAAAQI"]
[Sun Dec 14 21:02:31.853001 2025] [:error] [pid 39523:tid 39539] [client 4.190.216.178:11104] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aT61ZzQTQH1raAj2lkjwmwAAAAs"]
[Sun Dec 14 21:02:32.114663 2025] [:error] [pid 40595:tid 40614] [client 4.190.216.178:11062] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aT61aPjrht6y4RN-xKQtDQAAAY8"]
[Sun Dec 14 21:02:32.527007 2025] [:error] [pid 40595:tid 40608] [client 4.190.216.178:11008] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aT61aPjrht6y4RN-xKQtEAAAAYk"]
[Sun Dec 14 21:02:32.872660 2025] [:error] [pid 39523:tid 39541] [client 4.190.216.178:11024] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aT61aDQTQH1raAj2lkjwngAAAA0"]
[Sun Dec 14 21:02:33.246280 2025] [:error] [pid 40595:tid 40611] [client 4.190.216.178:11057] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aT61afjrht6y4RN-xKQtFAAAAYw"]
[Sun Dec 14 21:02:33.530045 2025] [:error] [pid 13799:tid 13811] [client 4.190.216.178:10962] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aT61aXjPEin01ElFTNZLowAAAgk"]
[Sun Dec 14 21:02:33.846310 2025] [:error] [pid 13799:tid 13808] [client 4.190.216.178:11055] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aT61aXjPEin01ElFTNZLpQAAAgY"]
[Sun Dec 14 21:02:34.480682 2025] [:error] [pid 39525:tid 39587] [client 4.190.216.178:11049] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aT61ak1fX_pB_BrvE_5XTwAAAIQ"]
[Sun Dec 14 21:02:34.751384 2025] [:error] [pid 39523:tid 39534] [client 4.190.216.178:11080] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aT61ajQTQH1raAj2lkjwpQAAAAY"]
[Sun Dec 14 21:02:35.123614 2025] [:error] [pid 41600:tid 41604] [client 4.190.216.178:10890] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aT61a9FLTBZjcwNd_VsmaQAAAQE"]
[Sun Dec 14 21:02:35.551400 2025] [:error] [pid 39524:tid 39577] [client 4.190.216.178:10944] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aT61a2rVGpbDzFtDE9P6RwAAAFU"]
[Sun Dec 14 21:02:35.873875 2025] [:error] [pid 40561:tid 40578] [client 4.190.216.178:10946] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aT61a4Y6r869zoqRQkTivwAAAU0"]
[Sun Dec 14 21:02:36.177755 2025] [:error] [pid 13799:tid 13820] [client 4.190.216.178:11029] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aT61bHjPEin01ElFTNZLrAAAAhI"]
[Sun Dec 14 21:02:36.528251 2025] [:error] [pid 39524:tid 39565] [client 4.190.216.178:11088] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aT61bGrVGpbDzFtDE9P6TgAAAEk"]
[Sun Dec 14 21:02:36.818751 2025] [:error] [pid 39523:tid 39543] [client 4.190.216.178:11027] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aT61bDQTQH1raAj2lkjwqAAAAA8"]
[Sun Dec 14 21:02:37.090398 2025] [:error] [pid 13799:tid 13802] [client 4.190.216.178:10951] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT61bXjPEin01ElFTNZLrwAAAgA"]
[Sun Dec 14 21:02:37.420093 2025] [:error] [pid 39614:tid 39623] [client 4.190.216.178:11070] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT61bfxybG8-9MflbDd98gAAAMc"]
[Sun Dec 14 21:02:37.774023 2025] [:error] [pid 40561:tid 40583] [client 4.190.216.178:10982] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT61bYY6r869zoqRQkTiwgAAAVI"]
[Sun Dec 14 21:02:38.047908 2025] [:error] [pid 39614:tid 39637] [client 4.190.216.178:11034] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aT61bvxybG8-9MflbDd99AAAANU"]
[Sun Dec 14 21:02:38.329527 2025] [:error] [pid 39523:tid 39530] [client 4.190.216.178:11042] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aT61bjQTQH1raAj2lkjwrAAAAAI"]
[Sun Dec 14 21:02:38.605804 2025] [:error] [pid 39524:tid 39561] [client 4.190.216.178:10961] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aT61bmrVGpbDzFtDE9P6UQAAAEU"]
[Sun Dec 14 21:02:38.883834 2025] [:error] [pid 39525:tid 39588] [client 4.190.216.178:10990] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aT61bk1fX_pB_BrvE_5XVAAAAIU"]
[Sun Dec 14 21:02:39.175522 2025] [:error] [pid 39614:tid 39620] [client 4.190.216.178:11154] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aT61b_xybG8-9MflbDd9-gAAAMQ"]
[Sun Dec 14 21:02:39.458392 2025] [:error] [pid 40561:tid 40576] [client 4.190.216.178:11159] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aT61b4Y6r869zoqRQkTiwwAAAUs"]
[Sun Dec 14 21:02:39.714890 2025] [:error] [pid 39523:tid 39547] [client 4.190.216.178:10888] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aT61bzQTQH1raAj2lkjwsQAAABM"]
[Sun Dec 14 21:02:40.091999 2025] [:error] [pid 39614:tid 39617] [client 4.190.216.178:11183] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aT61cPxybG8-9MflbDd9_gAAAME"]
[Sun Dec 14 21:02:40.389652 2025] [:error] [pid 39614:tid 39631] [client 4.190.216.178:11056] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aT61cPxybG8-9MflbDd9_wAAAM8"]
[Sun Dec 14 21:02:40.646407 2025] [:error] [pid 40596:tid 40631] [client 4.190.216.178:11107] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aT61cGvZZo4N2X7WoLygagAAAcU"]
[Sun Dec 14 21:02:40.974041 2025] [:error] [pid 39525:tid 39586] [client 4.190.216.178:10966] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aT61cE1fX_pB_BrvE_5XWAAAAIM"]
[Sun Dec 14 21:02:41.307916 2025] [:error] [pid 40596:tid 40626] [client 4.190.216.178:11065] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aT61cWvZZo4N2X7WoLygbwAAAcA"]
[Sun Dec 14 21:02:41.847908 2025] [:error] [pid 39525:tid 39591] [client 4.190.216.178:10919] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aT61cU1fX_pB_BrvE_5XWQAAAIg"]
[Sun Dec 14 21:02:42.575601 2025] [:error] [pid 39524:tid 39573] [client 4.190.216.178:11030] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aT61cmrVGpbDzFtDE9P6VQAAAFE"]
[Sun Dec 14 21:02:43.074898 2025] [:error] [pid 40561:tid 40570] [client 4.190.216.178:11119] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aT61c4Y6r869zoqRQkTixQAAAUU"]
[Sun Dec 14 21:02:43.813758 2025] [:error] [pid 13799:tid 13814] [client 4.190.216.178:11009] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aT61c3jPEin01ElFTNZLtgAAAgw"]
[Sun Dec 14 21:02:44.142686 2025] [:error] [pid 40596:tid 40627] [client 4.190.216.178:10977] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aT61dGvZZo4N2X7WoLygfgAAAcE"]
[Sun Dec 14 21:02:44.609251 2025] [:error] [pid 40596:tid 40633] [client 4.190.216.178:11054] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aT61dGvZZo4N2X7WoLyggQAAAcc"]
[Sun Dec 14 21:02:45.186159 2025] [:error] [pid 13799:tid 13805] [client 4.190.216.178:10976] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aT61dXjPEin01ElFTNZLtwAAAgM"]
[Sun Dec 14 21:02:45.852990 2025] [:error] [pid 39525:tid 39590] [client 4.190.216.178:11040] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aT61dU1fX_pB_BrvE_5XXwAAAIc"]
[Sun Dec 14 21:02:46.272257 2025] [:error] [pid 13799:tid 13820] [client 4.190.216.178:11072] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aT61dnjPEin01ElFTNZLuQAAAhI"]
[Sun Dec 14 21:02:46.620682 2025] [:error] [pid 41600:tid 41617] [client 4.190.216.178:17533] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT61dtFLTBZjcwNd_VsmcwAAAQ4"]
[Sun Dec 14 21:02:47.142738 2025] [:error] [pid 40561:tid 40582] [client 4.190.216.178:10960] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT61d4Y6r869zoqRQkTixgAAAVE"]
[Sun Dec 14 21:02:47.499677 2025] [:error] [pid 39523:tid 39536] [client 4.190.216.178:11036] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT61dzQTQH1raAj2lkjwxwAAAAg"]
[Sun Dec 14 21:02:47.833969 2025] [:error] [pid 39523:tid 39545] [client 4.190.216.178:11052] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aT61dzQTQH1raAj2lkjwyAAAABE"]
[Sun Dec 14 21:02:48.209575 2025] [:error] [pid 40561:tid 40565] [client 4.190.216.178:11253] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aT61eIY6r869zoqRQkTiyAAAAUA"]
[Sun Dec 14 21:02:48.731096 2025] [:error] [pid 39524:tid 39572] [client 4.190.216.178:11050] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aT61eGrVGpbDzFtDE9P6awAAAFA"]
[Sun Dec 14 21:02:49.176922 2025] [:error] [pid 39524:tid 39568] [client 4.190.216.178:11161] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aT61eWrVGpbDzFtDE9P6bgAAAEw"]
[Sun Dec 14 21:02:49.473075 2025] [:error] [pid 39614:tid 39632] [client 4.190.216.178:10970] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aT61efxybG8-9MflbDd-CgAAANA"]
[Sun Dec 14 21:02:49.843497 2025] [:error] [pid 39614:tid 39619] [client 4.190.216.178:10953] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aT61efxybG8-9MflbDd-CwAAAMM"]
[Sun Dec 14 21:02:50.147872 2025] [:error] [pid 40595:tid 40615] [client 4.190.216.178:11108] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aT61evjrht6y4RN-xKQtKgAAAZA"]
[Sun Dec 14 21:02:50.424325 2025] [:error] [pid 13799:tid 13826] [client 4.190.216.178:11110] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aT61enjPEin01ElFTNZLvQAAAhg"]
[Sun Dec 14 21:02:50.736439 2025] [:error] [pid 39614:tid 39637] [client 4.190.216.178:10981] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aT61evxybG8-9MflbDd-DgAAANU"]
[Sun Dec 14 21:02:51.059352 2025] [:error] [pid 39524:tid 39580] [client 4.190.216.178:10999] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aT61e2rVGpbDzFtDE9P6dQAAAFg"]
[Sun Dec 14 21:02:51.637742 2025] [:error] [pid 39524:tid 39557] [client 4.190.216.178:11059] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aT61e2rVGpbDzFtDE9P6eAAAAEE"]
[Sun Dec 14 21:02:51.920659 2025] [:error] [pid 39525:tid 39591] [client 4.190.216.178:10958] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aT61e01fX_pB_BrvE_5XZgAAAIg"]
[Sun Dec 14 21:02:52.300494 2025] [:error] [pid 13799:tid 13811] [client 4.190.216.178:11127] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aT61fHjPEin01ElFTNZLwQAAAgk"]
[Sun Dec 14 21:02:52.804045 2025] [:error] [pid 39523:tid 39535] [client 4.190.216.178:11012] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aT61fDQTQH1raAj2lkjw0AAAAAc"]
[Sun Dec 14 21:02:53.240411 2025] [:error] [pid 39524:tid 39577] [client 4.190.216.178:11017] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aT61fWrVGpbDzFtDE9P6eQAAAFU"]
[Sun Dec 14 21:02:53.731673 2025] [:error] [pid 40561:tid 40571] [client 4.190.216.178:10978] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aT61fYY6r869zoqRQkTizQAAAUY"]
[Sun Dec 14 21:02:54.094097 2025] [:error] [pid 13799:tid 13825] [client 4.190.216.178:10895] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aT61fnjPEin01ElFTNZLxAAAAhc"]
[Sun Dec 14 21:02:54.413834 2025] [:error] [pid 41600:tid 41615] [client 4.190.216.178:11060] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aT61ftFLTBZjcwNd_VsmewAAAQw"]
[Sun Dec 14 21:02:54.946161 2025] [:error] [pid 41600:tid 41613] [client 4.190.216.178:10894] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aT61ftFLTBZjcwNd_VsmfgAAAQo"]
[Sun Dec 14 21:02:55.322882 2025] [:error] [pid 13799:tid 13804] [client 4.190.216.178:10956] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aT61f3jPEin01ElFTNZLxgAAAgI"]
[Sun Dec 14 21:02:55.683450 2025] [:error] [pid 40595:tid 40604] [client 4.190.216.178:10969] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aT61f_jrht6y4RN-xKQtLwAAAYU"]
[Sun Dec 14 21:02:56.034401 2025] [:error] [pid 39614:tid 39624] [client 4.190.216.178:10985] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aT61gPxybG8-9MflbDd-FAAAAMg"]
[Sun Dec 14 21:02:56.438848 2025] [:error] [pid 40596:tid 40646] [client 4.190.216.178:10968] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aT61gGvZZo4N2X7WoLyglQAAAdQ"]
[Sun Dec 14 21:02:56.726647 2025] [:error] [pid 41600:tid 41626] [client 4.190.216.178:10912] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aT61gNFLTBZjcwNd_VsmhgAAARc"]
[Sun Dec 14 21:02:57.111727 2025] [:error] [pid 13799:tid 13819] [client 4.190.216.178:17503] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aT61gXjPEin01ElFTNZLyAAAAhE"]
[Sun Dec 14 21:02:57.574625 2025] [:error] [pid 41600:tid 41610] [client 4.190.216.178:10965] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aT61gdFLTBZjcwNd_VsmhwAAAQc"]
[Sun Dec 14 21:02:57.858623 2025] [:error] [pid 39614:tid 39621] [client 4.190.216.178:10949] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aT61gfxybG8-9MflbDd-FgAAAMU"]
[Sun Dec 14 21:02:58.259411 2025] [:error] [pid 41600:tid 41608] [client 4.190.216.178:10995] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aT61gtFLTBZjcwNd_VsmigAAAQU"]
[Sun Dec 14 21:02:58.634804 2025] [:error] [pid 39524:tid 39571] [client 4.190.216.178:10948] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aT61gmrVGpbDzFtDE9P6fgAAAE8"]
[Sun Dec 14 21:02:58.982831 2025] [:error] [pid 13799:tid 13802] [client 4.190.216.178:10974] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aT61gnjPEin01ElFTNZLzAAAAgA"]
[Sun Dec 14 21:02:59.318759 2025] [:error] [pid 13799:tid 13826] [client 4.190.216.178:11044] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aT61g3jPEin01ElFTNZLzgAAAhg"]
[Sun Dec 14 21:02:59.635096 2025] [:error] [pid 39524:tid 39562] [client 4.190.216.178:10963] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aT61g2rVGpbDzFtDE9P6gAAAAEY"]
[Sun Dec 14 21:02:59.907093 2025] [:error] [pid 41600:tid 41623] [client 4.190.216.178:11007] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aT61g9FLTBZjcwNd_VsmjAAAARQ"]
[Sun Dec 14 21:03:00.283589 2025] [:error] [pid 13799:tid 13824] [client 4.190.216.178:11089] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT61hHjPEin01ElFTNZLzwAAAhY"]
[Sun Dec 14 21:03:00.555256 2025] [:error] [pid 41600:tid 41620] [client 4.190.216.178:10937] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT61hNFLTBZjcwNd_VsmkAAAARE"]
[Sun Dec 14 21:03:00.841637 2025] [:error] [pid 39524:tid 39579] [client 4.190.216.178:10986] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT61hGrVGpbDzFtDE9P6gwAAAFc"]
[Sun Dec 14 21:03:01.149132 2025] [:error] [pid 40596:tid 40633] [client 4.190.216.178:10947] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT61hWvZZo4N2X7WoLygmgAAAcc"]
[Sun Dec 14 21:03:01.459815 2025] [:error] [pid 39524:tid 39567] [client 4.190.216.178:10916] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aT61hWrVGpbDzFtDE9P6hQAAAEs"]
[Sun Dec 14 21:03:01.802140 2025] [:error] [pid 41600:tid 41619] [client 4.190.216.178:10880] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aT61hdFLTBZjcwNd_VsmkgAAARA"]
[Sun Dec 14 21:03:02.248815 2025] [:error] [pid 13799:tid 13808] [client 4.190.216.178:10996] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aT61hnjPEin01ElFTNZL0wAAAgY"]
[Sun Dec 14 21:03:02.583391 2025] [:error] [pid 39524:tid 39573] [client 4.190.216.178:10936] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aT61hmrVGpbDzFtDE9P6iAAAAFE"]
[Sun Dec 14 21:03:02.911612 2025] [:error] [pid 40596:tid 40638] [client 4.190.216.178:10964] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aT61hmvZZo4N2X7WoLygngAAAcw"]
[Sun Dec 14 21:03:03.214824 2025] [:error] [pid 13799:tid 13825] [client 4.190.216.178:10984] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aT61h3jPEin01ElFTNZL1gAAAhc"]
[Sun Dec 14 21:03:03.470639 2025] [:error] [pid 41600:tid 41626] [client 4.190.216.178:10884] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aT61h9FLTBZjcwNd_VsmlAAAARc"]
[Sun Dec 14 21:03:03.753043 2025] [:error] [pid 39524:tid 39560] [client 4.190.216.178:10980] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aT61h2rVGpbDzFtDE9P6igAAAEQ"]
[Sun Dec 14 21:03:04.052968 2025] [:error] [pid 39525:tid 39592] [client 4.190.216.178:10950] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aT61iE1fX_pB_BrvE_5XcwAAAIk"]
[Sun Dec 14 21:03:04.336563 2025] [:error] [pid 39523:tid 39535] [client 4.190.216.178:10887] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aT61iDQTQH1raAj2lkjw2wAAAAc"]
[Sun Dec 14 21:03:04.675040 2025] [:error] [pid 40595:tid 40599] [client 4.190.216.178:10886] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aT61iPjrht6y4RN-xKQtNQAAAYA"]
[Sun Dec 14 21:03:04.935309 2025] [:error] [pid 39523:tid 39529] [client 4.190.216.178:11064] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aT61iDQTQH1raAj2lkjw3gAAAAE"]
[Sun Dec 14 21:03:05.242935 2025] [:error] [pid 39523:tid 39538] [client 4.190.216.178:10906] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aT61iTQTQH1raAj2lkjw3wAAAAo"]
[Sun Dec 14 21:03:05.598711 2025] [:error] [pid 39523:tid 39531] [client 4.190.216.178:11037] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aT61iTQTQH1raAj2lkjw4QAAAAM"]
[Sun Dec 14 21:03:06.104085 2025] [:error] [pid 41600:tid 41608] [client 4.190.216.178:11046] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aT61itFLTBZjcwNd_VsmmAAAAQU"]
[Sun Dec 14 21:03:06.600335 2025] [:error] [pid 13799:tid 13814] [client 4.190.216.178:11103] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aT61injPEin01ElFTNZL1wAAAgw"]
[Sun Dec 14 21:03:06.933470 2025] [:error] [pid 40595:tid 40608] [client 4.190.216.178:11071] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aT61ivjrht6y4RN-xKQtOAAAAYk"]
[Sun Dec 14 21:03:07.285078 2025] [:error] [pid 39524:tid 39576] [client 4.190.216.178:10911] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aT61i2rVGpbDzFtDE9P6iwAAAFQ"]
[Sun Dec 14 21:03:07.784667 2025] [:error] [pid 40595:tid 40609] [client 4.190.216.178:10900] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aT61i_jrht6y4RN-xKQtOgAAAYo"]
[Sun Dec 14 21:03:08.264169 2025] [:error] [pid 39525:tid 39605] [client 4.190.216.178:10971] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aT61jE1fX_pB_BrvE_5XeQAAAJY"]
[Sun Dec 14 21:03:08.603366 2025] [:error] [pid 39614:tid 39640] [client 4.190.216.178:10883] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aT61jPxybG8-9MflbDd-HwAAANg"]
[Sun Dec 14 21:03:08.879734 2025] [:error] [pid 13799:tid 13803] [client 4.190.216.178:10957] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aT61jHjPEin01ElFTNZL3AAAAgE"]
[Sun Dec 14 21:03:09.264292 2025] [:error] [pid 39524:tid 39564] [client 4.190.216.178:10909] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aT61jWrVGpbDzFtDE9P6jAAAAEg"]
[Sun Dec 14 21:03:09.532044 2025] [:error] [pid 39614:tid 39633] [client 4.190.216.178:10837] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aT61jfxybG8-9MflbDd-IgAAANE"]
[Sun Dec 14 21:03:09.851851 2025] [:error] [pid 39524:tid 39565] [client 4.190.216.178:11004] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aT61jWrVGpbDzFtDE9P6jgAAAEk"]
[Sun Dec 14 21:03:10.219036 2025] [:error] [pid 41600:tid 41618] [client 4.190.216.178:11002] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aT61jtFLTBZjcwNd_VsmnAAAAQ8"]
[Sun Dec 14 21:03:10.543806 2025] [:error] [pid 39614:tid 39626] [client 4.190.216.178:11066] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aT61jvxybG8-9MflbDd-JgAAAMo"]
[Sun Dec 14 21:03:10.824152 2025] [:error] [pid 39524:tid 39572] [client 4.190.216.178:10959] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aT61jmrVGpbDzFtDE9P6kAAAAFA"]
[Sun Dec 14 21:03:11.162928 2025] [:error] [pid 13799:tid 13812] [client 4.190.216.178:10928] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aT61j3jPEin01ElFTNZL4AAAAgo"]
[Sun Dec 14 21:03:11.448606 2025] [:error] [pid 39614:tid 39627] [client 4.190.216.178:10975] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aT61j_xybG8-9MflbDd-KAAAAMs"]
[Sun Dec 14 21:03:11.812049 2025] [:error] [pid 39614:tid 39619] [client 4.190.216.178:10952] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aT61j_xybG8-9MflbDd-KQAAAMM"]
[Sun Dec 14 21:03:12.220996 2025] [:error] [pid 39614:tid 39625] [client 4.190.216.178:11045] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aT61kPxybG8-9MflbDd-KwAAAMk"]
[Sun Dec 14 21:03:12.533935 2025] [:error] [pid 39525:tid 39587] [client 4.190.216.178:11005] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aT61kE1fX_pB_BrvE_5XfAAAAIQ"]
[Sun Dec 14 21:03:12.857951 2025] [:error] [pid 39525:tid 39584] [client 4.190.216.178:11121] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aT61kE1fX_pB_BrvE_5XfwAAAIE"]
[Sun Dec 14 21:03:13.183969 2025] [:error] [pid 40561:tid 40579] [client 4.190.216.178:11001] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aT61kYY6r869zoqRQkTi1QAAAU4"]
[Sun Dec 14 21:03:13.508375 2025] [:error] [pid 39524:tid 39562] [client 4.190.216.178:10994] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aT61kWrVGpbDzFtDE9P6kgAAAEY"]
[Sun Dec 14 21:03:13.761009 2025] [:error] [pid 39523:tid 39540] [client 4.190.216.178:10973] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aT61kTQTQH1raAj2lkjw5QAAAAw"]
[Sun Dec 14 21:03:14.016228 2025] [:error] [pid 40561:tid 40584] [client 4.190.216.178:10882] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aT61koY6r869zoqRQkTi1wAAAVM"]
[Sun Dec 14 21:03:14.361998 2025] [:error] [pid 40595:tid 40599] [client 4.190.216.178:10892] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aT61kvjrht6y4RN-xKQtQAAAAYA"]
[Sun Dec 14 21:03:14.823498 2025] [:error] [pid 13799:tid 13816] [client 4.190.216.178:11154] [client 4.190.216.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aT61knjPEin01ElFTNZL5QAAAg4"]
[Sun Dec 14 23:06:45.718413 2025] [:error] [pid 39523:tid 39537] [client 43.156.232.190:37540] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aT7ShTQTQH1raAj2lkgLzgAAAAk"]
[Mon Dec 15 02:47:42.937297 2025] [:error] [pid 8341:tid 8404] [client 36.41.75.167:46624] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aT8GThOat6dLvzj8EhTsuAAAAIY"]
[Mon Dec 15 03:51:59.205891 2025] [:error] [pid 56009:tid 56012] [client 4.217.254.218:62357] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Mon Dec 15 03:51:59.369243 2025] [:error] [pid 56009:tid 56022] [client 4.217.254.218:62357] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Mon Dec 15 03:51:59.548336 2025] [:error] [pid 56009:tid 56024] [client 4.217.254.218:62357] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Mon Dec 15 03:51:59.712184 2025] [:error] [pid 56009:tid 56015] [client 4.217.254.218:62357] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Mon Dec 15 03:51:59.878833 2025] [:error] [pid 56009:tid 56029] [client 4.217.254.218:62357] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Mon Dec 15 03:52:00.318385 2025] [:error] [pid 56009:tid 56027] [client 4.217.254.218:62357] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Mon Dec 15 03:52:00.470859 2025] [:error] [pid 56009:tid 56014] [client 4.217.254.218:62357] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Mon Dec 15 03:52:02.054296 2025] [:error] [pid 56009:tid 56014] [client 4.217.254.218:62357] [client 4.217.254.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aT8VYjzFib9wWPXNl9dD3wAAAMM"]
[Mon Dec 15 03:52:02.702023 2025] [:error] [pid 55905:tid 55998] [client 4.217.254.218:52219] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Mon Dec 15 03:52:02.852380 2025] [:error] [pid 55905:tid 55994] [client 4.217.254.218:52219] File does not exist: /usr/local/apache/htdocs/suspended-page/dejavu.php
[Mon Dec 15 03:52:03.030196 2025] [:error] [pid 55905:tid 55982] [client 4.217.254.218:52219] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Mon Dec 15 03:52:03.210925 2025] [:error] [pid 55905:tid 55989] [client 4.217.254.218:52219] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aT8VY8L5e7ZKWVJJdlYG4QAAAIw"]
[Mon Dec 15 03:52:04.542313 2025] [:error] [pid 56009:tid 56012] [client 4.217.254.218:49973] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aT8VZDzFib9wWPXNl9dD5AAAAME"]
[Mon Dec 15 03:52:05.763298 2025] [:error] [pid 55903:tid 55918] [client 4.217.254.218:4910] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aT8VZfdvpWbb83qz50rDdQAAAAY"]
[Mon Dec 15 03:52:07.429266 2025] [:error] [pid 55905:tid 55991] [client 4.217.254.218:49981] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aT8VZ8L5e7ZKWVJJdlYG5wAAAI4"]
[Mon Dec 15 03:52:10.699247 2025] [:error] [pid 55903:tid 55919] [client 4.217.254.218:52191] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aT8VavdvpWbb83qz50rDfAAAAAc"]
[Mon Dec 15 03:52:13.422339 2025] [:error] [pid 55904:tid 55963] [client 4.217.254.218:59520] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aT8VbTjnzi_KlarhcWEipAAAAE0"]
[Mon Dec 15 03:52:14.855612 2025] [:error] [pid 55904:tid 55966] [client 4.217.254.218:49979] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aT8Vbjjnzi_KlarhcWEipgAAAFA"]
[Mon Dec 15 03:52:17.476715 2025] [:error] [pid 56009:tid 56027] [client 4.217.254.218:59545] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aT8VcTzFib9wWPXNl9dD9AAAAM8"]
[Mon Dec 15 03:52:19.032071 2025] [:error] [pid 55905:tid 55977] [client 4.217.254.218:59566] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aT8Vc8L5e7ZKWVJJdlYG7QAAAIA"]
[Mon Dec 15 03:52:21.797535 2025] [:error] [pid 55905:tid 55995] [client 4.217.254.218:4907] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aT8VdcL5e7ZKWVJJdlYG9QAAAJI"]
[Mon Dec 15 03:52:24.140639 2025] [:error] [pid 55905:tid 55989] [client 4.217.254.218:58717] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aT8VeML5e7ZKWVJJdlYG9wAAAIw"]
[Mon Dec 15 03:52:27.953525 2025] [:error] [pid 56009:tid 56024] [client 4.217.254.218:49937] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aT8VezzFib9wWPXNl9dECgAAAMw"]
[Mon Dec 15 03:52:30.497525 2025] [:error] [pid 55904:tid 55972] [client 4.217.254.218:59529] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.trash7309/index.php"] [unique_id "aT8Vfjjnzi_KlarhcWEiugAAAFY"]
[Mon Dec 15 03:52:32.017271 2025] [:error] [pid 56009:tid 56018] [client 4.217.254.218:62990] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.trash7309/index.php"] [unique_id "aT8VgDzFib9wWPXNl9dEEAAAAMY"]
[Mon Dec 15 03:52:33.899956 2025] [:error] [pid 56009:tid 56031] [client 4.217.254.218:54243] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.trash7309/index.php"] [unique_id "aT8VgTzFib9wWPXNl9dEEQAAANM"]
[Mon Dec 15 03:52:35.570710 2025] [:error] [pid 55903:tid 55919] [client 4.217.254.218:49952] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.trash7309/index.php"] [unique_id "aT8Vg_dvpWbb83qz50rDsgAAAAc"]
[Mon Dec 15 03:52:37.636167 2025] [:error] [pid 55904:tid 55963] [client 4.217.254.218:58712] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aT8VhTjnzi_KlarhcWEivgAAAE0"]
[Mon Dec 15 03:52:39.155338 2025] [:error] [pid 55904:tid 55969] [client 4.217.254.218:58719] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aT8Vhzjnzi_KlarhcWEiwQAAAFM"]
[Mon Dec 15 03:52:41.532468 2025] [:error] [pid 56009:tid 56032] [client 4.217.254.218:58736] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aT8ViTzFib9wWPXNl9dEGQAAANQ"]
[Mon Dec 15 03:52:44.220308 2025] [:error] [pid 56009:tid 56036] [client 4.217.254.218:54268] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aT8VjDzFib9wWPXNl9dEHAAAANg"]
[Mon Dec 15 03:52:46.632646 2025] [:error] [pid 55905:tid 55978] [client 4.217.254.218:62399] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/faq.php"] [unique_id "aT8VjsL5e7ZKWVJJdlYHAgAAAIE"]
[Mon Dec 15 03:52:48.109356 2025] [:error] [pid 55905:tid 55977] [client 4.217.254.218:58692] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/faq.php"] [unique_id "aT8VkML5e7ZKWVJJdlYHBAAAAIA"]
[Mon Dec 15 03:52:51.675884 2025] [:error] [pid 56009:tid 56011] [client 4.217.254.218:4883] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/faq.php"] [unique_id "aT8VkzzFib9wWPXNl9dEHwAAAMA"]
[Mon Dec 15 03:52:52.462747 2025] [:error] [pid 55904:tid 55961] [client 4.217.254.218:62374] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/faq.php"] [unique_id "aT8VlDjnzi_KlarhcWEixgAAAEs"]
[Mon Dec 15 03:52:54.549674 2025] [:error] [pid 55904:tid 55950] [client 4.217.254.218:59562] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT8Vljjnzi_KlarhcWEiygAAAEA"]
[Mon Dec 15 03:52:55.860620 2025] [:error] [pid 55905:tid 56000] [client 4.217.254.218:58741] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT8Vl8L5e7ZKWVJJdlYHCQAAAJc"]
[Mon Dec 15 03:52:57.494382 2025] [:error] [pid 55905:tid 55994] [client 4.217.254.218:52187] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT8VmcL5e7ZKWVJJdlYHDAAAAJE"]
[Mon Dec 15 03:53:00.781815 2025] [:error] [pid 56009:tid 56036] [client 4.217.254.218:55593] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aT8VnDzFib9wWPXNl9dEKQAAANg"]
[Mon Dec 15 03:53:03.538308 2025] [:error] [pid 55904:tid 55950] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/file17.php
[Mon Dec 15 03:53:03.694014 2025] [:error] [pid 55904:tid 55959] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Mon Dec 15 03:53:03.856884 2025] [:error] [pid 55904:tid 55967] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/file8.php
[Mon Dec 15 03:53:04.012258 2025] [:error] [pid 55904:tid 55974] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Mon Dec 15 03:53:04.163406 2025] [:error] [pid 55904:tid 55963] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Mon Dec 15 03:53:04.382055 2025] [:error] [pid 55904:tid 55965] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Dec 15 03:53:04.990209 2025] [:error] [pid 55904:tid 55952] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Mon Dec 15 03:53:05.405509 2025] [:error] [pid 55904:tid 55962] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/abe.php
[Mon Dec 15 03:53:05.571120 2025] [:error] [pid 55904:tid 55960] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Mon Dec 15 03:53:05.728626 2025] [:error] [pid 55904:tid 55969] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php
[Mon Dec 15 03:53:05.881261 2025] [:error] [pid 55904:tid 55973] [client 4.217.254.218:55367] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Mon Dec 15 03:53:06.047223 2025] [:error] [pid 55904:tid 55972] [client 4.217.254.218:55367] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hoot.php"] [unique_id "aT8Vojjnzi_KlarhcWEi4gAAAFY"]
[Mon Dec 15 03:53:07.703873 2025] [:error] [pid 56009:tid 56028] [client 4.217.254.218:63102] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hoot.php"] [unique_id "aT8VozzFib9wWPXNl9dELgAAANA"]
[Mon Dec 15 03:53:08.856692 2025] [:error] [pid 55905:tid 55982] [client 4.217.254.218:59481] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hoot.php"] [unique_id "aT8VpML5e7ZKWVJJdlYHGQAAAIU"]
[Mon Dec 15 03:53:09.595609 2025] [:error] [pid 55905:tid 55993] [client 4.217.254.218:55352] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hoot.php"] [unique_id "aT8VpcL5e7ZKWVJJdlYHGwAAAJA"]
[Mon Dec 15 03:53:11.523954 2025] [:error] [pid 55904:tid 55959] [client 4.217.254.218:64545] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aT8Vpzjnzi_KlarhcWEi5AAAAEk"]
[Mon Dec 15 03:53:13.804327 2025] [:error] [pid 56009:tid 56029] [client 4.217.254.218:4244] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aT8VqTzFib9wWPXNl9dEOAAAANE"]
[Mon Dec 15 03:53:15.261677 2025] [:error] [pid 55905:tid 55996] [client 4.217.254.218:50566] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aT8Vq8L5e7ZKWVJJdlYHHgAAAJM"]
[Mon Dec 15 03:53:17.470903 2025] [:error] [pid 55905:tid 55983] [client 4.217.254.218:4442] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aT8VrcL5e7ZKWVJJdlYHIAAAAIY"]
[Mon Dec 15 03:53:19.328481 2025] [:error] [pid 56009:tid 56021] [client 4.217.254.218:58805] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aT8VrzzFib9wWPXNl9dESQAAAMk"]
[Mon Dec 15 03:53:20.474463 2025] [:error] [pid 56009:tid 56032] [client 4.217.254.218:58785] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aT8VsDzFib9wWPXNl9dEUAAAANQ"]
[Mon Dec 15 03:53:21.329430 2025] [:error] [pid 55904:tid 55959] [client 4.217.254.218:4438] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aT8VsTjnzi_KlarhcWEjCgAAAEk"]
[Mon Dec 15 03:53:23.004042 2025] [:error] [pid 55904:tid 55952] [client 4.217.254.218:59139] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aT8Vszjnzi_KlarhcWEjCwAAAEI"]
[Mon Dec 15 03:53:24.171008 2025] [:error] [pid 55903:tid 55914] [client 4.217.254.218:4813] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT8VtPdvpWbb83qz50rD7wAAAAI"]
[Mon Dec 15 03:53:26.966807 2025] [:error] [pid 56009:tid 56036] [client 4.217.254.218:4422] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT8VtjzFib9wWPXNl9dEVgAAANg"]
[Mon Dec 15 03:53:29.573415 2025] [:error] [pid 55904:tid 55961] [client 4.217.254.218:64344] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT8VuTjnzi_KlarhcWEjEgAAAEs"]
[Mon Dec 15 03:53:30.648729 2025] [:error] [pid 55905:tid 55987] [client 4.217.254.218:4617] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aT8VusL5e7ZKWVJJdlYHLQAAAIo"]
[Mon Dec 15 03:53:31.550478 2025] [:error] [pid 56009:tid 56028] [client 4.217.254.218:4802] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/golden.php"] [unique_id "aT8VuzzFib9wWPXNl9dEXAAAANA"]
[Mon Dec 15 03:53:33.185447 2025] [:error] [pid 55903:tid 55931] [client 4.217.254.218:56070] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/golden.php"] [unique_id "aT8VvfdvpWbb83qz50rD9wAAABM"]
[Mon Dec 15 03:53:36.043040 2025] [:error] [pid 56009:tid 56014] [client 4.217.254.218:4445] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/golden.php"] [unique_id "aT8VwDzFib9wWPXNl9dEXgAAAMM"]
[Mon Dec 15 03:53:37.557193 2025] [:error] [pid 55903:tid 55914] [client 4.217.254.218:56075] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/golden.php"] [unique_id "aT8VwfdvpWbb83qz50rD-gAAAAI"]
[Mon Dec 15 03:53:42.518240 2025] [:error] [pid 55905:tid 55994] [client 4.217.254.218:4437] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT8VxsL5e7ZKWVJJdlYHMQAAAJE"]
[Mon Dec 15 03:53:43.111769 2025] [:error] [pid 55905:tid 55982] [client 4.217.254.218:4661] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT8Vx8L5e7ZKWVJJdlYHMwAAAIU"]
[Mon Dec 15 03:53:44.902928 2025] [:error] [pid 55903:tid 55927] [client 4.217.254.218:4447] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT8VyPdvpWbb83qz50rD_gAAAA8"]
[Mon Dec 15 03:53:45.996320 2025] [:error] [pid 55903:tid 55933] [client 4.217.254.218:64334] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aT8VyfdvpWbb83qz50rD_wAAABU"]
[Mon Dec 15 03:53:47.094821 2025] [:error] [pid 55903:tid 55920] [client 4.217.254.218:4856] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aT8Vy_dvpWbb83qz50rEAQAAAAg"]
[Mon Dec 15 03:53:47.875274 2025] [:error] [pid 56009:tid 56011] [client 4.217.254.218:64363] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aT8VyzzFib9wWPXNl9dEZwAAAMA"]
[Mon Dec 15 03:53:49.512827 2025] [:error] [pid 55903:tid 55931] [client 4.217.254.218:49772] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aT8VzfdvpWbb83qz50rEBAAAABM"]
[Mon Dec 15 03:53:52.846025 2025] [:error] [pid 56009:tid 56021] [client 4.217.254.218:4831] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aT8V0DzFib9wWPXNl9dEbAAAAMk"]
[Mon Dec 15 03:53:56.074339 2025] [:error] [pid 55905:tid 55999] [client 4.217.254.218:56104] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geju.php"] [unique_id "aT8V1ML5e7ZKWVJJdlYHPAAAAJY"]
[Mon Dec 15 03:53:57.538077 2025] [:error] [pid 55905:tid 55980] [client 4.217.254.218:49791] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geju.php"] [unique_id "aT8V1cL5e7ZKWVJJdlYHRwAAAIM"]
[Mon Dec 15 03:53:58.595197 2025] [:error] [pid 55904:tid 55972] [client 4.217.254.218:56111] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geju.php"] [unique_id "aT8V1jjnzi_KlarhcWEjXAAAAFY"]
[Mon Dec 15 03:54:02.381869 2025] [:error] [pid 55903:tid 55912] [client 4.217.254.218:49763] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geju.php"] [unique_id "aT8V2vdvpWbb83qz50rEMQAAAAA"]
[Mon Dec 15 03:54:04.614353 2025] [:error] [pid 56009:tid 56016] [client 4.217.254.218:4416] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index1.php"] [unique_id "aT8V3DzFib9wWPXNl9dE-wAAAMU"]
[Mon Dec 15 03:54:06.593892 2025] [:error] [pid 55904:tid 55950] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Mon Dec 15 03:54:06.754216 2025] [:error] [pid 55904:tid 55966] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Dec 15 03:54:07.365672 2025] [:error] [pid 55904:tid 55965] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Mon Dec 15 03:54:07.531596 2025] [:error] [pid 55904:tid 55951] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/news.php
[Mon Dec 15 03:54:08.025079 2025] [:error] [pid 55904:tid 55967] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Mon Dec 15 03:54:08.205276 2025] [:error] [pid 55904:tid 55972] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Mon Dec 15 03:54:08.360035 2025] [:error] [pid 55904:tid 55963] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mn.php
[Mon Dec 15 03:54:08.529122 2025] [:error] [pid 55904:tid 55958] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Mon Dec 15 03:54:08.884534 2025] [:error] [pid 55904:tid 55956] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Mon Dec 15 03:54:09.038686 2025] [:error] [pid 55904:tid 55967] [client 4.217.254.218:4661] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Mon Dec 15 03:54:09.351796 2025] [:error] [pid 55904:tid 55957] [client 4.217.254.218:4661] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aT8V4Tjnzi_KlarhcWEjnwAAAEc"]
[Mon Dec 15 03:54:42.785137 2025] [:error] [pid 35019:tid 35024] [client 4.217.254.218:4213] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT8WAq2LAdKSfjdLIKJc8AAAAAE"]
[Mon Dec 15 03:54:52.692155 2025] [:error] [pid 35019:tid 35038] [client 4.217.254.218:51002] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT8WDK2LAdKSfjdLIKJc9wAAAA8"]
[Mon Dec 15 03:54:53.462859 2025] [:error] [pid 35021:tid 35093] [client 4.217.254.218:62664] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT8WDS9sSwxVqtYnS1tlFAAAAJA"]
[Mon Dec 15 03:54:54.480314 2025] [:error] [pid 35021:tid 35095] [client 4.217.254.218:57003] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aT8WDi9sSwxVqtYnS1tlFgAAAJI"]
[Mon Dec 15 03:54:55.846798 2025] [:error] [pid 35021:tid 35099] [client 4.217.254.218:51528] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aT8WDy9sSwxVqtYnS1tlGAAAAJY"]
[Mon Dec 15 03:54:56.696233 2025] [:error] [pid 35019:tid 35045] [client 4.217.254.218:56973] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aT8WEK2LAdKSfjdLIKJc_AAAABY"]
[Mon Dec 15 03:54:58.916196 2025] [:error] [pid 35021:tid 35082] [client 4.217.254.218:51539] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aT8WEi9sSwxVqtYnS1tlHAAAAIU"]
[Mon Dec 15 03:54:59.902684 2025] [:error] [pid 35021:tid 35085] [client 4.217.254.218:4337] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aT8WEy9sSwxVqtYnS1tlHwAAAIg"]
[Mon Dec 15 03:55:01.802170 2025] [:error] [pid 35104:tid 35123] [client 4.217.254.218:5090] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aT8WFaWpPfWnBdEuPp4SZgAAANA"]
[Mon Dec 15 03:55:19.162749 2025] [:error] [pid 35021:tid 35084] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Mon Dec 15 03:55:20.049428 2025] [:error] [pid 35021:tid 35082] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Dec 15 03:55:20.202964 2025] [:error] [pid 35021:tid 35086] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Mon Dec 15 03:55:20.369102 2025] [:error] [pid 35021:tid 35092] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Dec 15 03:55:20.536777 2025] [:error] [pid 35021:tid 35090] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Mon Dec 15 03:55:20.690612 2025] [:error] [pid 35021:tid 35100] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Mon Dec 15 03:55:20.842188 2025] [:error] [pid 35021:tid 35096] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Mon Dec 15 03:55:21.511413 2025] [:error] [pid 35021:tid 35080] [client 4.217.254.218:52249] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Dec 15 03:55:21.658976 2025] [:error] [pid 35021:tid 35093] [client 4.217.254.218:52249] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT8WKS9sSwxVqtYnS1tlkgAAAJA"]
[Mon Dec 15 03:55:24.244512 2025] [:error] [pid 35020:tid 35056] [client 4.217.254.218:64522] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT8WLCBMuWbtFfQIRIbDcwAAAEY"]
[Mon Dec 15 03:55:24.856891 2025] [:error] [pid 35019:tid 35040] [client 4.217.254.218:58477] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT8WLK2LAdKSfjdLIKJdQgAAABE"]
[Mon Dec 15 03:55:25.829158 2025] [:error] [pid 35020:tid 35060] [client 4.217.254.218:50634] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aT8WLSBMuWbtFfQIRIbDdgAAAEo"]
[Mon Dec 15 03:55:27.908138 2025] [:error] [pid 35021:tid 35090] [client 4.217.254.218:4510] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT8WLy9sSwxVqtYnS1tllQAAAI0"]
[Mon Dec 15 03:55:28.859896 2025] [:error] [pid 35020:tid 35065] [client 4.217.254.218:61960] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT8WMCBMuWbtFfQIRIbDegAAAE8"]
[Mon Dec 15 03:55:30.904887 2025] [:error] [pid 35021:tid 35096] [client 4.217.254.218:52231] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT8WMi9sSwxVqtYnS1tllwAAAJM"]
[Mon Dec 15 03:55:32.280004 2025] [:error] [pid 35104:tid 35129] [client 4.217.254.218:49908] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aT8WNKWpPfWnBdEuPp4ScgAAANY"]
[Mon Dec 15 03:55:33.332203 2025] [:error] [pid 35020:tid 35069] [client 4.217.254.218:58001] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock6.php"] [unique_id "aT8WNSBMuWbtFfQIRIbDfAAAAFM"]
[Mon Dec 15 03:55:33.898784 2025] [:error] [pid 35104:tid 35108] [client 4.217.254.218:60080] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock6.php"] [unique_id "aT8WNaWpPfWnBdEuPp4SdQAAAME"]
[Mon Dec 15 03:55:40.674219 2025] [:error] [pid 35019:tid 35030] [client 4.217.254.218:57999] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock6.php"] [unique_id "aT8WPK2LAdKSfjdLIKJdeAAAAAc"]
[Mon Dec 15 03:55:42.644753 2025] [:error] [pid 35021:tid 35095] [client 4.217.254.218:61507] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock6.php"] [unique_id "aT8WPi9sSwxVqtYnS1tlmgAAAJI"]
[Mon Dec 15 03:55:44.334204 2025] [:error] [pid 35019:tid 35042] [client 4.217.254.218:55323] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aT8WQK2LAdKSfjdLIKJdewAAABM"]
[Mon Dec 15 03:55:45.602772 2025] [:error] [pid 35104:tid 35113] [client 4.217.254.218:5019] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aT8WQaWpPfWnBdEuPp4SggAAAMY"]
[Mon Dec 15 03:55:47.312691 2025] [:error] [pid 35104:tid 35112] [client 4.217.254.218:4712] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aT8WQ6WpPfWnBdEuPp4ShAAAAMU"]
[Mon Dec 15 03:55:49.568005 2025] [:error] [pid 35104:tid 35121] [client 4.217.254.218:4699] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aT8WRaWpPfWnBdEuPp4ShgAAAM4"]
[Mon Dec 15 03:55:52.618959 2025] [:error] [pid 35104:tid 35117] [client 4.217.254.218:50186] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/post.php"] [unique_id "aT8WSKWpPfWnBdEuPp4SigAAAMo"]
[Mon Dec 15 03:55:53.520281 2025] [:error] [pid 35104:tid 35107] [client 4.217.254.218:5029] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/post.php"] [unique_id "aT8WSaWpPfWnBdEuPp4SiwAAAMA"]
[Mon Dec 15 03:55:56.378999 2025] [:error] [pid 35021:tid 35081] [client 4.217.254.218:61082] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/post.php"] [unique_id "aT8WTC9sSwxVqtYnS1tlngAAAIQ"]
[Mon Dec 15 03:55:57.637850 2025] [:error] [pid 35104:tid 35126] [client 4.217.254.218:61073] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/post.php"] [unique_id "aT8WTaWpPfWnBdEuPp4SkwAAANM"]
[Mon Dec 15 03:56:01.097897 2025] [:error] [pid 35019:tid 35024] [client 4.217.254.218:59505] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aT8WUa2LAdKSfjdLIKJdfAAAAAE"]
[Mon Dec 15 03:56:02.122896 2025] [:error] [pid 35021:tid 35101] [client 4.217.254.218:4729] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aT8WUi9sSwxVqtYnS1tlnwAAAJg"]
[Mon Dec 15 03:56:03.168295 2025] [:error] [pid 35104:tid 35110] [client 4.217.254.218:52140] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aT8WU6WpPfWnBdEuPp4SmwAAAMM"]
[Mon Dec 15 03:56:04.545381 2025] [:error] [pid 35104:tid 35116] [client 4.217.254.218:53861] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aT8WVKWpPfWnBdEuPp4SngAAAMk"]
[Mon Dec 15 03:56:05.344742 2025] [:error] [pid 35019:tid 35025] [client 4.217.254.218:53859] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/file.php"] [unique_id "aT8WVa2LAdKSfjdLIKJdfgAAAAI"]
[Mon Dec 15 03:56:06.773430 2025] [:error] [pid 35104:tid 35107] [client 4.217.254.218:58867] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/file.php"] [unique_id "aT8WVqWpPfWnBdEuPp4SpQAAAMA"]
[Mon Dec 15 03:56:10.168947 2025] [:error] [pid 35104:tid 35122] [client 4.217.254.218:58828] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/file.php"] [unique_id "aT8WWqWpPfWnBdEuPp4SqgAAAM8"]
[Mon Dec 15 03:56:14.691942 2025] [:error] [pid 35019:tid 35023] [client 4.217.254.218:59500] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/file.php"] [unique_id "aT8WXq2LAdKSfjdLIKJdgwAAAAA"]
[Mon Dec 15 03:56:19.463194 2025] [:error] [pid 35019:tid 35041] [client 4.217.254.218:53831] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aT8WY62LAdKSfjdLIKJdiQAAABI"]
[Mon Dec 15 03:56:22.935439 2025] [:error] [pid 35021:tid 35099] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Dec 15 03:56:23.085588 2025] [:error] [pid 35021:tid 35087] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Dec 15 03:56:23.235770 2025] [:error] [pid 35021:tid 35081] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Mon Dec 15 03:56:23.389668 2025] [:error] [pid 35021:tid 35085] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Mon Dec 15 03:56:23.539536 2025] [:error] [pid 35021:tid 35082] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Mon Dec 15 03:56:23.893068 2025] [:error] [pid 35021:tid 35084] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Mon Dec 15 03:56:24.044281 2025] [:error] [pid 35021:tid 35092] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Mon Dec 15 03:56:24.462923 2025] [:error] [pid 35021:tid 35100] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Mon Dec 15 03:56:24.614767 2025] [:error] [pid 35021:tid 35096] [client 4.217.254.218:59843] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Mon Dec 15 03:56:24.783388 2025] [:error] [pid 35021:tid 35097] [client 4.217.254.218:59843] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/astab.php"] [unique_id "aT8WaC9sSwxVqtYnS1tltwAAAJQ"]
[Mon Dec 15 03:56:27.391046 2025] [:error] [pid 35019:tid 35040] [client 4.217.254.218:58063] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/astab.php"] [unique_id "aT8Wa62LAdKSfjdLIKJd9gAAABE"]
[Mon Dec 15 03:56:27.801780 2025] [:error] [pid 35104:tid 35128] [client 4.217.254.218:54656] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/astab.php"] [unique_id "aT8Wa6WpPfWnBdEuPp4S3wAAANU"]
[Mon Dec 15 03:56:29.813962 2025] [:error] [pid 35021:tid 35095] [client 4.217.254.218:63099] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/astab.php"] [unique_id "aT8WbS9sSwxVqtYnS1tluwAAAJI"]
[Mon Dec 15 03:56:31.000734 2025] [:error] [pid 35021:tid 35078] [client 4.217.254.218:59846] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless2.php"] [unique_id "aT8Wbi9sSwxVqtYnS1tlvQAAAIE"]
[Mon Dec 15 03:56:32.525686 2025] [:error] [pid 35104:tid 35115] [client 4.217.254.218:63083] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless2.php"] [unique_id "aT8WcKWpPfWnBdEuPp4S4wAAAMg"]
[Mon Dec 15 03:56:33.622064 2025] [:error] [pid 35104:tid 35116] [client 4.217.254.218:59861] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless2.php"] [unique_id "aT8WcaWpPfWnBdEuPp4S5QAAAMk"]
[Mon Dec 15 03:56:38.142007 2025] [:error] [pid 35020:tid 35054] [client 4.217.254.218:61170] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless2.php"] [unique_id "aT8WdiBMuWbtFfQIRIbD4gAAAEQ"]
[Mon Dec 15 03:56:49.678097 2025] [:error] [pid 35021:tid 35082] [client 4.217.254.218:55578] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless3.php"] [unique_id "aT8WgS9sSwxVqtYnS1tl0AAAAIU"]
[Mon Dec 15 03:56:50.464810 2025] [:error] [pid 35019:tid 35037] [client 4.217.254.218:59850] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless3.php"] [unique_id "aT8Wgq2LAdKSfjdLIKJeBAAAAA4"]
[Mon Dec 15 03:56:51.186906 2025] [:error] [pid 35104:tid 35125] [client 4.217.254.218:61171] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless3.php"] [unique_id "aT8Wg6WpPfWnBdEuPp4S-QAAANI"]
[Mon Dec 15 03:56:55.320732 2025] [:error] [pid 35019:tid 35031] [client 4.217.254.218:46912] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aT8Wh62LAdKSfjdLIKJeBwAAAAg"]
[Mon Dec 15 03:56:56.699179 2025] [:error] [pid 35104:tid 35120] [client 4.217.254.218:58084] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aT8WiKWpPfWnBdEuPp4TAQAAAM0"]
[Mon Dec 15 03:57:00.529833 2025] [:error] [pid 35104:tid 35130] [client 4.217.254.218:54217] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aT8WjKWpPfWnBdEuPp4TCgAAANc"]
[Mon Dec 15 03:57:02.577405 2025] [:error] [pid 35104:tid 35114] [client 4.217.254.218:53637] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aT8WjqWpPfWnBdEuPp4TEwAAAMc"]
[Mon Dec 15 03:57:03.988358 2025] [:error] [pid 35021:tid 35088] [client 4.217.254.218:59547] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aT8Wjy9sSwxVqtYnS1tl6AAAAIs"]
[Mon Dec 15 03:57:05.530632 2025] [:error] [pid 35021:tid 35098] [client 4.217.254.218:4740] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aT8WkS9sSwxVqtYnS1tl7gAAAJU"]
[Mon Dec 15 03:57:08.974074 2025] [:error] [pid 35021:tid 35077] [client 4.217.254.218:61456] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aT8WlC9sSwxVqtYnS1tl8gAAAIA"]
[Mon Dec 15 03:57:09.801963 2025] [:error] [pid 35021:tid 35100] [client 4.217.254.218:58718] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aT8WlS9sSwxVqtYnS1tl9QAAAJc"]
[Mon Dec 15 03:57:10.832308 2025] [:error] [pid 35021:tid 35081] [client 4.217.254.218:59779] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aT8Wli9sSwxVqtYnS1tl-QAAAIQ"]
[Mon Dec 15 03:57:11.720485 2025] [:error] [pid 35104:tid 35129] [client 4.217.254.218:59832] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aT8Wl6WpPfWnBdEuPp4TIQAAANY"]
[Mon Dec 15 03:57:12.639738 2025] [:error] [pid 35021:tid 35094] [client 4.217.254.218:4156] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aT8WmC9sSwxVqtYnS1tl_gAAAJE"]
[Mon Dec 15 03:57:13.624330 2025] [:error] [pid 35104:tid 35111] [client 4.217.254.218:59823] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aT8WmaWpPfWnBdEuPp4TIgAAAMQ"]
[Mon Dec 15 03:57:20.332439 2025] [:error] [pid 35019:tid 35039] [client 4.217.254.218:4868] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless7.php"] [unique_id "aT8WoK2LAdKSfjdLIKJeFgAAABA"]
[Mon Dec 15 03:57:21.275111 2025] [:error] [pid 35021:tid 35092] [client 4.217.254.218:59797] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless7.php"] [unique_id "aT8WoS9sSwxVqtYnS1tmGAAAAI8"]
[Mon Dec 15 03:57:22.100477 2025] [:error] [pid 35021:tid 35078] [client 4.217.254.218:61494] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless7.php"] [unique_id "aT8Woi9sSwxVqtYnS1tmGgAAAIE"]
[Mon Dec 15 03:57:22.848693 2025] [:error] [pid 35020:tid 35067] [client 4.217.254.218:50102] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless7.php"] [unique_id "aT8WoiBMuWbtFfQIRIbEBgAAAFE"]
[Mon Dec 15 03:57:24.698017 2025] [:error] [pid 35021:tid 35082] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/bless8.php
[Mon Dec 15 03:57:24.862169 2025] [:error] [pid 35021:tid 35077] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/bless9.php
[Mon Dec 15 03:57:25.015047 2025] [:error] [pid 35021:tid 35090] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/bless1.php
[Mon Dec 15 03:57:25.184330 2025] [:error] [pid 35021:tid 35099] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file11.php
[Mon Dec 15 03:57:25.334665 2025] [:error] [pid 35021:tid 35086] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file12.php
[Mon Dec 15 03:57:25.486659 2025] [:error] [pid 35021:tid 35101] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file13.php
[Mon Dec 15 03:57:25.657952 2025] [:error] [pid 35021:tid 35089] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file14.php
[Mon Dec 15 03:57:25.894891 2025] [:error] [pid 35021:tid 35088] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file15.php
[Mon Dec 15 03:57:26.046867 2025] [:error] [pid 35021:tid 35081] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file16.php
[Mon Dec 15 03:57:26.218522 2025] [:error] [pid 35021:tid 35091] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Mon Dec 15 03:57:26.570493 2025] [:error] [pid 35021:tid 35083] [client 4.217.254.218:4749] File does not exist: /usr/local/apache/htdocs/suspended-page/file19.php
[Mon Dec 15 03:57:26.718999 2025] [:error] [pid 35021:tid 35097] [client 4.217.254.218:4749] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aT8Wpi9sSwxVqtYnS1tmNgAAAJQ"]
[Mon Dec 15 03:57:30.288024 2025] [:error] [pid 35020:tid 35074] [client 4.217.254.218:58692] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aT8WqiBMuWbtFfQIRIbECgAAAFg"]
[Mon Dec 15 03:57:31.280342 2025] [:error] [pid 35104:tid 35108] [client 4.217.254.218:60115] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aT8Wq6WpPfWnBdEuPp4TKAAAAME"]
[Mon Dec 15 03:57:33.220173 2025] [:error] [pid 35104:tid 35126] [client 4.217.254.218:65178] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aT8WraWpPfWnBdEuPp4TKQAAANM"]
[Mon Dec 15 03:57:34.348180 2025] [:error] [pid 35104:tid 35127] [client 4.217.254.218:49975] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aT8WrqWpPfWnBdEuPp4TKgAAANQ"]
[Mon Dec 15 03:57:36.434492 2025] [:error] [pid 35104:tid 35128] [client 4.217.254.218:64313] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aT8WsKWpPfWnBdEuPp4TLwAAANU"]
[Mon Dec 15 03:57:38.102415 2025] [:error] [pid 35104:tid 35121] [client 4.217.254.218:61162] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aT8WsqWpPfWnBdEuPp4TMgAAAM4"]
[Mon Dec 15 03:57:39.322436 2025] [:error] [pid 35020:tid 35059] [client 4.217.254.218:4718] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aT8WsyBMuWbtFfQIRIbEDgAAAEk"]
[Mon Dec 15 03:57:44.212509 2025] [:error] [pid 35019:tid 35031] [client 4.217.254.218:53214] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file23.php"] [unique_id "aT8WuK2LAdKSfjdLIKJeHgAAAAg"]
[Mon Dec 15 03:57:47.225141 2025] [:error] [pid 35020:tid 35052] [client 4.217.254.218:50284] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file23.php"] [unique_id "aT8WuyBMuWbtFfQIRIbEFQAAAEI"]
[Mon Dec 15 03:57:49.161190 2025] [:error] [pid 35020:tid 35070] [client 4.217.254.218:4202] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file23.php"] [unique_id "aT8WvSBMuWbtFfQIRIbEFgAAAFQ"]
[Mon Dec 15 03:57:50.308688 2025] [:error] [pid 35021:tid 35099] [client 4.217.254.218:49317] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file23.php"] [unique_id "aT8Wvi9sSwxVqtYnS1tmXgAAAJY"]
[Mon Dec 15 03:57:53.033017 2025] [:error] [pid 35020:tid 35072] [client 4.217.254.218:4508] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file24.php"] [unique_id "aT8WwSBMuWbtFfQIRIbEGAAAAFY"]
[Mon Dec 15 03:57:54.216415 2025] [:error] [pid 35020:tid 35051] [client 4.217.254.218:65136] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file24.php"] [unique_id "aT8WwiBMuWbtFfQIRIbEGQAAAEE"]
[Mon Dec 15 03:57:54.914232 2025] [:error] [pid 35020:tid 35074] [client 4.217.254.218:65110] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file24.php"] [unique_id "aT8WwiBMuWbtFfQIRIbEGwAAAFg"]
[Mon Dec 15 03:57:58.015828 2025] [:error] [pid 35104:tid 35111] [client 4.217.254.218:65151] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file24.php"] [unique_id "aT8WxqWpPfWnBdEuPp4TRAAAAMQ"]
[Mon Dec 15 03:57:59.672069 2025] [:error] [pid 35104:tid 35121] [client 4.217.254.218:62431] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file25.php"] [unique_id "aT8Wx6WpPfWnBdEuPp4TRgAAAM4"]
[Mon Dec 15 03:58:01.104346 2025] [:error] [pid 35019:tid 35036] [client 4.217.254.218:4542] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file25.php"] [unique_id "aT8Wya2LAdKSfjdLIKJeLAAAAA0"]
[Mon Dec 15 03:58:03.064740 2025] [:error] [pid 35021:tid 35095] [client 4.217.254.218:57012] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file25.php"] [unique_id "aT8Wyy9sSwxVqtYnS1tmaQAAAJI"]
[Mon Dec 15 03:58:03.866792 2025] [:error] [pid 35021:tid 35086] [client 4.217.254.218:4382] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file25.php"] [unique_id "aT8Wyy9sSwxVqtYnS1tmagAAAIk"]
[Mon Dec 15 03:58:05.297782 2025] [:error] [pid 35021:tid 35096] [client 4.217.254.218:62427] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file26.php"] [unique_id "aT8WzS9sSwxVqtYnS1tmbQAAAJM"]
[Mon Dec 15 03:58:05.960864 2025] [:error] [pid 35019:tid 35047] [client 4.217.254.218:4364] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file26.php"] [unique_id "aT8Wza2LAdKSfjdLIKJeMgAAABg"]
[Mon Dec 15 03:58:06.443258 2025] [:error] [pid 35019:tid 35042] [client 4.217.254.218:4497] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file26.php"] [unique_id "aT8Wzq2LAdKSfjdLIKJeNAAAABM"]
[Mon Dec 15 03:58:08.006141 2025] [:error] [pid 35021:tid 35098] [client 4.217.254.218:65111] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file26.php"] [unique_id "aT8W0C9sSwxVqtYnS1tmbwAAAJU"]
[Mon Dec 15 03:58:08.781487 2025] [:error] [pid 35021:tid 35083] [client 4.217.254.218:56990] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file27.php"] [unique_id "aT8W0C9sSwxVqtYnS1tmcQAAAIY"]
[Mon Dec 15 03:58:09.968187 2025] [:error] [pid 35019:tid 35034] [client 4.217.254.218:56989] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file27.php"] [unique_id "aT8W0a2LAdKSfjdLIKJeOAAAAAs"]
[Mon Dec 15 03:58:12.733348 2025] [:error] [pid 35019:tid 35040] [client 4.217.254.218:4969] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file27.php"] [unique_id "aT8W1K2LAdKSfjdLIKJePAAAABE"]
[Mon Dec 15 03:58:13.929526 2025] [:error] [pid 35020:tid 35061] [client 4.217.254.218:4499] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file27.php"] [unique_id "aT8W1SBMuWbtFfQIRIbEIAAAAEs"]
[Mon Dec 15 03:58:15.058826 2025] [:error] [pid 35104:tid 35108] [client 4.217.254.218:4982] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file28.php"] [unique_id "aT8W16WpPfWnBdEuPp4TSQAAAME"]
[Mon Dec 15 03:58:16.778258 2025] [:error] [pid 35104:tid 35117] [client 4.217.254.218:62405] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file28.php"] [unique_id "aT8W2KWpPfWnBdEuPp4TSgAAAMo"]
[Mon Dec 15 03:58:17.958709 2025] [:error] [pid 35020:tid 35050] [client 4.217.254.218:63598] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file28.php"] [unique_id "aT8W2SBMuWbtFfQIRIbEJwAAAEA"]
[Mon Dec 15 03:58:19.936734 2025] [:error] [pid 35021:tid 35095] [client 4.217.254.218:4404] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file28.php"] [unique_id "aT8W2y9sSwxVqtYnS1tmdwAAAJI"]
[Mon Dec 15 03:58:21.176895 2025] [:error] [pid 35020:tid 35074] [client 4.217.254.218:62441] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file29.php"] [unique_id "aT8W3SBMuWbtFfQIRIbEQwAAAFg"]
[Mon Dec 15 03:58:22.147795 2025] [:error] [pid 35021:tid 35099] [client 4.217.254.218:62402] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file29.php"] [unique_id "aT8W3i9sSwxVqtYnS1tmegAAAJY"]
[Mon Dec 15 03:58:23.457012 2025] [:error] [pid 35104:tid 35115] [client 4.217.254.218:57010] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file29.php"] [unique_id "aT8W36WpPfWnBdEuPp4TawAAAMg"]
[Mon Dec 15 03:58:23.989424 2025] [:error] [pid 35104:tid 35113] [client 4.217.254.218:63587] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file29.php"] [unique_id "aT8W36WpPfWnBdEuPp4TbQAAAMY"]
[Mon Dec 15 03:58:24.500905 2025] [:error] [pid 35021:tid 35096] [client 4.217.254.218:65112] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "aT8W4C9sSwxVqtYnS1tmewAAAJM"]
[Mon Dec 15 03:58:25.484865 2025] [:error] [pid 35021:tid 35100] [client 4.217.254.218:49316] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "aT8W4S9sSwxVqtYnS1tmfAAAAJc"]
[Mon Dec 15 03:58:26.635790 2025] [:error] [pid 35104:tid 35121] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/file30.php
[Mon Dec 15 03:58:26.802119 2025] [:error] [pid 35104:tid 35122] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Mon Dec 15 03:58:27.045895 2025] [:error] [pid 35104:tid 35124] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Mon Dec 15 03:58:27.302311 2025] [:error] [pid 35104:tid 35120] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpcx.php
[Mon Dec 15 03:58:27.454281 2025] [:error] [pid 35104:tid 35108] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/ot.php
[Mon Dec 15 03:58:27.619804 2025] [:error] [pid 35104:tid 35128] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Dec 15 03:58:27.772054 2025] [:error] [pid 35104:tid 35117] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Mon Dec 15 03:58:27.925129 2025] [:error] [pid 35104:tid 35130] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Mon Dec 15 03:58:28.103601 2025] [:error] [pid 35104:tid 35127] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Dec 15 03:58:28.408262 2025] [:error] [pid 35104:tid 35131] [client 4.217.254.218:63584] File does not exist: /usr/local/apache/htdocs/suspended-page/mek.php
[Mon Dec 15 03:58:28.555620 2025] [:error] [pid 35104:tid 35123] [client 4.217.254.218:63584] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aT8W5KWpPfWnBdEuPp4TeQAAANA"]
[Mon Dec 15 03:58:30.361751 2025] [:error] [pid 35019:tid 35023] [client 4.217.254.218:49292] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aT8W5q2LAdKSfjdLIKJeTgAAAAA"]
[Mon Dec 15 03:58:31.815813 2025] [:error] [pid 35020:tid 35050] [client 4.217.254.218:4489] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aT8W5yBMuWbtFfQIRIbETAAAAEA"]
[Mon Dec 15 03:58:33.784995 2025] [:error] [pid 35104:tid 35115] [client 4.217.254.218:4535] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aT8W6aWpPfWnBdEuPp4TfQAAAMg"]
[Mon Dec 15 03:58:35.814495 2025] [:error] [pid 35019:tid 35043] [client 4.217.254.218:4397] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aT8W662LAdKSfjdLIKJeWQAAABQ"]
[Mon Dec 15 03:58:37.176028 2025] [:error] [pid 35104:tid 35122] [client 4.217.254.218:65103] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aT8W7aWpPfWnBdEuPp4ThAAAAM8"]
[Mon Dec 15 03:58:38.151122 2025] [:error] [pid 35104:tid 35120] [client 4.217.254.218:4947] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aT8W7qWpPfWnBdEuPp4ThQAAAM0"]
[Mon Dec 15 03:58:41.942246 2025] [:error] [pid 35020:tid 35073] [client 4.217.254.218:62463] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aT8W8SBMuWbtFfQIRIbETwAAAFc"]
[Mon Dec 15 03:58:42.628795 2025] [:error] [pid 35020:tid 35062] [client 4.217.254.218:49297] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aT8W8iBMuWbtFfQIRIbEUAAAAEw"]
[Mon Dec 15 03:58:46.422929 2025] [:error] [pid 35019:tid 35039] [client 4.217.254.218:49335] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aT8W9q2LAdKSfjdLIKJeYQAAABA"]
[Mon Dec 15 03:58:48.118478 2025] [:error] [pid 35020:tid 35070] [client 4.217.254.218:57019] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aT8W-CBMuWbtFfQIRIbEVAAAAFQ"]
[Mon Dec 15 03:58:49.201816 2025] [:error] [pid 35021:tid 35077] [client 4.217.254.218:4490] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aT8W-S9sSwxVqtYnS1tmkwAAAIA"]
[Mon Dec 15 03:58:50.911778 2025] [:error] [pid 35104:tid 35122] [client 4.217.254.218:49305] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aT8W-qWpPfWnBdEuPp4TjAAAAM8"]
[Mon Dec 15 03:58:52.007868 2025] [:error] [pid 35020:tid 35060] [client 4.217.254.218:4966] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aT8W_CBMuWbtFfQIRIbEVQAAAEo"]
[Mon Dec 15 03:58:53.358209 2025] [:error] [pid 35104:tid 35128] [client 4.217.254.218:65133] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aT8W_aWpPfWnBdEuPp4TkQAAANU"]
[Mon Dec 15 03:58:54.598309 2025] [:error] [pid 35104:tid 35131] [client 4.217.254.218:63575] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aT8W_qWpPfWnBdEuPp4TlAAAANg"]
[Mon Dec 15 03:58:55.170968 2025] [:error] [pid 35020:tid 35057] [client 4.217.254.218:63567] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleetx.php"] [unique_id "aT8W_yBMuWbtFfQIRIbEVwAAAEc"]
[Mon Dec 15 03:58:55.809529 2025] [:error] [pid 35021:tid 35090] [client 4.217.254.218:62412] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleetx.php"] [unique_id "aT8W_y9sSwxVqtYnS1tmlAAAAI0"]
[Mon Dec 15 03:58:57.228144 2025] [:error] [pid 35021:tid 35086] [client 4.217.254.218:4979] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleetx.php"] [unique_id "aT8XAS9sSwxVqtYnS1tmlgAAAIk"]
[Mon Dec 15 03:58:58.196205 2025] [:error] [pid 35021:tid 35096] [client 4.217.254.218:56961] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleetx.php"] [unique_id "aT8XAi9sSwxVqtYnS1tmmAAAAJM"]
[Mon Dec 15 03:58:59.718641 2025] [:error] [pid 35104:tid 35122] [client 4.217.254.218:49290] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aT8XA6WpPfWnBdEuPp4TmgAAAM8"]
[Mon Dec 15 03:59:01.845681 2025] [:error] [pid 35020:tid 35056] [client 4.217.254.218:4517] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aT8XBSBMuWbtFfQIRIbEWwAAAEY"]
[Mon Dec 15 03:59:02.667982 2025] [:error] [pid 35021:tid 35080] [client 4.217.254.218:51529] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aT8XBi9sSwxVqtYnS1tmnAAAAIM"]
[Mon Dec 15 03:59:03.788518 2025] [:error] [pid 35020:tid 35062] [client 4.217.254.218:62400] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aT8XByBMuWbtFfQIRIbEXQAAAEw"]
[Mon Dec 15 03:59:05.107476 2025] [:error] [pid 35104:tid 35116] [client 4.217.254.218:65125] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aT8XCaWpPfWnBdEuPp4TngAAAMk"]
[Mon Dec 15 03:59:06.163281 2025] [:error] [pid 35104:tid 35131] [client 4.217.254.218:56977] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aT8XCqWpPfWnBdEuPp4ToQAAANg"]
[Mon Dec 15 03:59:07.115320 2025] [:error] [pid 35104:tid 35120] [client 4.217.254.218:62458] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aT8XC6WpPfWnBdEuPp4TogAAAM0"]
[Mon Dec 15 03:59:09.734827 2025] [:error] [pid 35104:tid 35108] [client 4.217.254.218:63591] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aT8XDaWpPfWnBdEuPp4TpAAAAME"]
[Mon Dec 15 03:59:11.854317 2025] [:error] [pid 35019:tid 35031] [client 4.217.254.218:50990] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aT8XD62LAdKSfjdLIKJeaQAAAAg"]
[Mon Dec 15 03:59:13.831761 2025] [:error] [pid 35021:tid 35083] [client 4.217.254.218:4514] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aT8XES9sSwxVqtYnS1tmpwAAAIY"]
[Mon Dec 15 03:59:15.403051 2025] [:error] [pid 35020:tid 35060] [client 4.217.254.218:4521] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aT8XEyBMuWbtFfQIRIbEYgAAAEo"]
[Mon Dec 15 03:59:18.363686 2025] [:error] [pid 35020:tid 35066] [client 4.217.254.218:50992] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aT8XFiBMuWbtFfQIRIbEZAAAAFA"]
[Mon Dec 15 03:59:20.476229 2025] [:error] [pid 35021:tid 35096] [client 4.217.254.218:58381] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xax.php"] [unique_id "aT8XGC9sSwxVqtYnS1tmswAAAJM"]
[Mon Dec 15 03:59:21.709586 2025] [:error] [pid 35019:tid 35026] [client 4.217.254.218:4493] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xax.php"] [unique_id "aT8XGa2LAdKSfjdLIKJebAAAAAM"]
[Mon Dec 15 03:59:22.922342 2025] [:error] [pid 35020:tid 35072] [client 4.217.254.218:60327] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xax.php"] [unique_id "aT8XGiBMuWbtFfQIRIbEZgAAAFY"]
[Mon Dec 15 03:59:25.144746 2025] [:error] [pid 35021:tid 35095] [client 4.217.254.218:49713] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xax.php"] [unique_id "aT8XHS9sSwxVqtYnS1tmtwAAAJI"]
[Mon Dec 15 03:59:26.377182 2025] [:error] [pid 35020:tid 35054] [client 4.217.254.218:50257] [client 4.217.254.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aT8XHiBMuWbtFfQIRIbEZwAAAEQ"]
[Mon Dec 15 03:59:29.971682 2025] [:error] [pid 35020:tid 35074] [client 4.217.254.218:62606] File does not exist: /usr/local/apache/htdocs/suspended-page/dlex.php
[Mon Dec 15 07:46:28.615878 2025] [:error] [pid 35020:tid 35066] [client 165.22.244.138:59615] [client 165.22.244.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aT9MVCBMuWbtFfQIRIYtCQAAAFA"]
[Mon Dec 15 15:03:46.786660 2025] [:error] [pid 39828:tid 39867] [client 182.40.104.255:46514] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aT-y0u0Kj9XWFkRmVbQSkAAAAMk"]
[Mon Dec 15 21:21:10.940175 2025] [:error] [pid 31374:tid 31441] [client 106.54.62.156:33556] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUALRpzSh8b7uk6RWiF4XQAAAEk"]
[Tue Dec 16 02:08:44.849270 2025] [:error] [pid 34411:tid 34490] [client 43.156.232.190:33176] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUBOrB05Egz6aV0buEzN4AAAABY"]
[Tue Dec 16 03:29:23.836113 2025] [:error] [pid 34495:tid 34511] [client 43.138.68.113:37012] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUBhk2ZCUf_mSR4srxuxDQAAAU4"]
[Tue Dec 16 04:09:08.802952 2025] [:error] [pid 58731:tid 58746] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Dec 16 04:09:09.202563 2025] [:error] [pid 58731:tid 58744] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Dec 16 04:09:09.629733 2025] [:error] [pid 58731:tid 58753] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Dec 16 04:09:10.164389 2025] [:error] [pid 58731:tid 58745] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Dec 16 04:09:10.587304 2025] [:error] [pid 58731:tid 58741] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Dec 16 04:09:11.023894 2025] [:error] [pid 58731:tid 58746] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Dec 16 04:09:11.444287 2025] [:error] [pid 58731:tid 58741] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Dec 16 04:09:11.868631 2025] [:error] [pid 58731:tid 58736] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Dec 16 04:09:12.711675 2025] [:error] [pid 58731:tid 58749] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Dec 16 04:09:13.970303 2025] [:error] [pid 58731:tid 58738] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Dec 16 04:09:14.395026 2025] [:error] [pid 58731:tid 58741] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Dec 16 04:09:14.782777 2025] [:error] [pid 58731:tid 58746] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Dec 16 04:09:15.187730 2025] [:error] [pid 58731:tid 58742] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Dec 16 04:09:15.638868 2025] [:error] [pid 58731:tid 58734] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Dec 16 04:09:16.113856 2025] [:error] [pid 58731:tid 58750] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Dec 16 04:09:16.496914 2025] [:error] [pid 58731:tid 58745] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Dec 16 04:09:16.902282 2025] [:error] [pid 58731:tid 58733] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Dec 16 04:09:17.332087 2025] [:error] [pid 58731:tid 58752] [client 45.154.138.7:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Dec 16 04:09:23.210008 2025] [:error] [pid 58731:tid 58748] [client 45.154.138.7:35657] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUBq8_fMdtvgyth4ND6WeAAAAU8"]
[Tue Dec 16 04:09:25.689761 2025] [:error] [pid 58731:tid 58746] [client 45.154.138.3:57857] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUBq9ffMdtvgyth4ND6WmAAAAU0"]
[Tue Dec 16 04:09:28.807457 2025] [:error] [pid 34008:tid 34022] [client 45.154.138.49:30197] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Dec 16 04:09:29.996912 2025] [:error] [pid 34008:tid 34030] [client 45.154.138.49:30197] [client 45.154.138.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aUBq-RMSzjEG4A-bhxxcqwAAANQ"]
[Tue Dec 16 04:09:32.699058 2025] [:error] [pid 58449:tid 58471] [client 45.154.138.12:36901] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Dec 16 04:09:33.083915 2025] [:error] [pid 58449:tid 58457] [client 45.154.138.12:36901] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUBq_Ry4x-l6LcLg3Ee0aAAAAQU"]
[Tue Dec 16 04:09:34.290168 2025] [:error] [pid 58449:tid 58461] [client 45.154.138.2:42547] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Dec 16 04:09:36.374973 2025] [:error] [pid 58449:tid 58477] [client 45.154.138.2:42547] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUBrABy4x-l6LcLg3Ee0nAAAARg"]
[Tue Dec 16 04:55:47.885150 2025] [:error] [pid 18322:tid 18333] [client 150.109.230.210:53414] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUB105sCeWBjrw28Xtz6FAAAAAc"]
[Tue Dec 16 08:43:01.725517 2025] [:error] [pid 51991:tid 52010] [client 43.135.142.37:58912] [client 43.135.142.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUCrFa7zKCVJSuwV1xaa7wAAARE"]
[Tue Dec 16 09:09:07.868525 2025] [:error] [pid 18324:tid 18400] [client 43.166.237.57:54436] [client 43.166.237.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUCxM6G4um2mD1VpJHLjowAAAJQ"]
[Tue Dec 16 09:34:53.898692 2025] [:error] [pid 18324:tid 18398] [client 106.54.62.156:57508] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUC3PaG4um2mD1VpJHLtxAAAAJI"]
[Tue Dec 16 10:04:37.023725 2025] [:error] [pid 18323:tid 18370] [client 43.130.78.203:52312] [client 43.130.78.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUC-NTJB6UFxIutsA8abwAAAAFE"]
[Tue Dec 16 11:45:07.002678 2025] [:error] [pid 12330:tid 12341] [client 170.106.161.78:57328] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUDVwl6iIQEVCIh8V1nxiwAAAYc"]
[Tue Dec 16 13:46:44.408286 2025] [:error] [pid 12330:tid 12356] [client 207.154.212.47:51024] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/api-docs"] [unique_id "aUDyRF6iIQEVCIh8V1ka_QAAAZY"]
[Tue Dec 16 13:46:45.416568 2025] [:error] [pid 51991:tid 52001] [client 207.154.212.47:51026] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3/api-docs"] [unique_id "aUDyRa7zKCVJSuwV1xYYpgAAAQg"]
[Tue Dec 16 13:46:46.421894 2025] [:error] [pid 18408:tid 18431] [client 207.154.212.47:51030] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aUDyRji2Gr8pDzjrVBCl1QAAANU"]
[Tue Dec 16 13:46:47.417705 2025] [:error] [pid 18324:tid 18383] [client 207.154.212.47:51032] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api/swagger.json"] [unique_id "aUDyR6G4um2mD1VpJHI6WQAAAIM"]
[Tue Dec 16 13:46:48.409167 2025] [:error] [pid 18322:tid 18329] [client 207.154.212.47:51034] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/@vite/env"] [unique_id "aUDySJsCeWBjrw28XtyxNQAAAAM"]
[Tue Dec 16 13:46:49.422045 2025] [:error] [pid 18324:tid 18399] [client 207.154.212.47:51040] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aUDySaG4um2mD1VpJHI6XgAAAJM"]
[Tue Dec 16 13:46:50.418644 2025] [:error] [pid 12330:tid 12354] [client 207.154.212.47:51048] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aUDySl6iIQEVCIh8V1kbCAAAAZQ"]
[Tue Dec 16 13:46:51.410763 2025] [:error] [pid 18322:tid 18350] [client 207.154.212.47:35060] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aUDyS5sCeWBjrw28XtyxOgAAABg"]
[Tue Dec 16 13:46:53.409393 2025] [:error] [pid 51991:tid 51998] [client 207.154.212.47:35070] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aUDyTa7zKCVJSuwV1xYYvwAAAQU"]
[Tue Dec 16 13:46:54.411837 2025] [:error] [pid 53940:tid 53957] [client 207.154.212.47:35074] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aUDyTl91PNbcXLVkpR6ZjwAAAc4"]
[Tue Dec 16 13:46:55.433243 2025] [:error] [pid 18323:tid 18374] [client 207.154.212.47:35088] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aUDyTzJB6UFxIutsA8bZQQAAAFU"]
[Tue Dec 16 13:46:56.424009 2025] [:error] [pid 18323:tid 18357] [client 207.154.212.47:35100] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUDyUDJB6UFxIutsA8bZQwAAAEQ"]
[Tue Dec 16 13:46:57.420091 2025] [:error] [pid 18324:tid 18400] [client 207.154.212.47:35116] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aUDyUaG4um2mD1VpJHI6ZwAAAJQ"]
[Tue Dec 16 13:46:58.420961 2025] [:error] [pid 18324:tid 18397] [client 207.154.212.47:35132] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aUDyUqG4um2mD1VpJHI6aAAAAJE"]
[Tue Dec 16 13:46:59.423838 2025] [:error] [pid 18324:tid 18394] [client 207.154.212.47:35138] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_all_dbs"] [unique_id "aUDyU6G4um2mD1VpJHI6bQAAAI4"]
[Tue Dec 16 13:47:00.412823 2025] [:error] [pid 12330:tid 12344] [client 207.154.212.47:35144] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aUDyVF6iIQEVCIh8V1kbDwAAAYo"]
[Tue Dec 16 13:47:01.414492 2025] [:error] [pid 18408:tid 18428] [client 207.154.212.47:37886] [client 207.154.212.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aUDyVTi2Gr8pDzjrVBCl7gAAANI"]
[Tue Dec 16 13:47:03.422473 2025] [:error] [pid 18408:tid 18433] [client 207.154.212.47:37894] [client 207.154.212.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aUDyVzi2Gr8pDzjrVBCl8AAAANc"]
[Tue Dec 16 13:47:04.424967 2025] [:error] [pid 35998:tid 36015] [client 207.154.212.47:37898] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUDyWBKnhGuuhGxBSLNkwwAAAU4"]
[Tue Dec 16 13:47:05.426254 2025] [:error] [pid 18322:tid 18335] [client 207.154.212.47:37906] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aUDyWZsCeWBjrw28XtyxRAAAAAk"]
[Tue Dec 16 13:47:06.416939 2025] [:error] [pid 18323:tid 18361] [client 207.154.212.47:37912] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aUDyWjJB6UFxIutsA8bZUAAAAEg"]
[Tue Dec 16 13:47:07.416157 2025] [:error] [pid 18408:tid 18419] [client 207.154.212.47:37928] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aUDyWzi2Gr8pDzjrVBCl-QAAAMk"]
[Tue Dec 16 13:47:08.425639 2025] [:error] [pid 18408:tid 18429] [client 207.154.212.47:37936] [client 207.154.212.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUDyXDi2Gr8pDzjrVBCmAAAAANM"]
[Tue Dec 16 14:09:09.534987 2025] [:error] [pid 18324:tid 18397] [client 164.90.208.56:45800] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/api-docs"] [unique_id "aUD3haG4um2mD1VpJHJAZQAAAJE"]
[Tue Dec 16 14:09:10.544467 2025] [:error] [pid 35998:tid 36014] [client 164.90.208.56:45804] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3/api-docs"] [unique_id "aUD3hhKnhGuuhGxBSLNpiwAAAU0"]
[Tue Dec 16 14:09:11.532011 2025] [:error] [pid 51991:tid 52009] [client 164.90.208.56:49112] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aUD3h67zKCVJSuwV1xYijAAAARA"]
[Tue Dec 16 14:09:12.532643 2025] [:error] [pid 18408:tid 18422] [client 164.90.208.56:49124] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/swagger.json"] [unique_id "aUD3iDi2Gr8pDzjrVBCtpgAAAMw"]
[Tue Dec 16 14:09:13.541973 2025] [:error] [pid 18408:tid 18431] [client 164.90.208.56:49132] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/@vite/env"] [unique_id "aUD3iTi2Gr8pDzjrVBCtqQAAANU"]
[Tue Dec 16 14:09:14.533256 2025] [:error] [pid 18323:tid 18371] [client 164.90.208.56:49140] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/actuator/env"] [unique_id "aUD3ijJB6UFxIutsA8bfGQAAAFI"]
[Tue Dec 16 14:09:15.544723 2025] [:error] [pid 18323:tid 18363] [client 164.90.208.56:49154] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server"] [unique_id "aUD3izJB6UFxIutsA8bfHAAAAEo"]
[Tue Dec 16 14:09:16.555857 2025] [:error] [pid 51991:tid 52009] [client 164.90.208.56:49170] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aUD3jK7zKCVJSuwV1xYikgAAARA"]
[Tue Dec 16 14:09:18.539625 2025] [:error] [pid 18322:tid 18338] [client 164.90.208.56:49180] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about"] [unique_id "aUD3jpsCeWBjrw28Xty4fAAAAAw"]
[Tue Dec 16 14:09:19.542202 2025] [:error] [pid 18323:tid 18359] [client 164.90.208.56:49196] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug/default/view"] [unique_id "aUD3jzJB6UFxIutsA8bfIwAAAEY"]
[Tue Dec 16 14:09:20.555248 2025] [:error] [pid 12330:tid 12353] [client 164.90.208.56:49212] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/_catalog"] [unique_id "aUD3kF6iIQEVCIh8V1khxQAAAZM"]
[Tue Dec 16 14:09:21.548034 2025] [:error] [pid 18324:tid 18393] [client 164.90.208.56:36208] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUD3kaG4um2mD1VpJHJAcgAAAI0"]
[Tue Dec 16 14:09:22.550206 2025] [:error] [pid 51991:tid 52015] [client 164.90.208.56:36212] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-status"] [unique_id "aUD3kq7zKCVJSuwV1xYilQAAARY"]
[Tue Dec 16 14:09:23.554178 2025] [:error] [pid 18408:tid 18420] [client 164.90.208.56:36214] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login.action"] [unique_id "aUD3kzi2Gr8pDzjrVBCtuAAAAMo"]
[Tue Dec 16 14:09:24.553641 2025] [:error] [pid 53940:tid 53959] [client 164.90.208.56:36218] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_all_dbs"] [unique_id "aUD3lF91PNbcXLVkpR6fPwAAAdA"]
[Tue Dec 16 14:09:25.545079 2025] [:error] [pid 18323:tid 18360] [client 164.90.208.56:36230] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.DS_Store"] [unique_id "aUD3lTJB6UFxIutsA8bfSQAAAEc"]
[Tue Dec 16 14:09:26.551190 2025] [:error] [pid 35998:tid 36011] [client 164.90.208.56:36238] [client 164.90.208.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aUD3lhKnhGuuhGxBSLNpnwAAAUo"]
[Tue Dec 16 14:09:28.553850 2025] [:error] [pid 18322:tid 18336] [client 164.90.208.56:36250] [client 164.90.208.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aUD3mJsCeWBjrw28Xty4lwAAAAo"]
[Tue Dec 16 14:09:29.552363 2025] [:error] [pid 35998:tid 36013] [client 164.90.208.56:36260] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUD3mRKnhGuuhGxBSLNpoQAAAUw"]
[Tue Dec 16 14:09:30.585264 2025] [:error] [pid 12330:tid 12336] [client 164.90.208.56:36270] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.json"] [unique_id "aUD3ml6iIQEVCIh8V1kh2wAAAYI"]
[Tue Dec 16 14:09:31.568791 2025] [:error] [pid 18324:tid 18381] [client 164.90.208.56:48298] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/telescope/requests"] [unique_id "aUD3m6G4um2mD1VpJHJAdwAAAIE"]
[Tue Dec 16 14:09:32.554161 2025] [:error] [pid 18322:tid 18336] [client 164.90.208.56:48312] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUD3nJsCeWBjrw28Xty4qQAAAAo"]
[Tue Dec 16 14:09:33.541657 2025] [:error] [pid 18324:tid 18392] [client 164.90.208.56:48318] [client 164.90.208.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUD3naG4um2mD1VpJHJAegAAAIw"]
[Tue Dec 16 15:16:18.058055 2025] [:error] [pid 18408:tid 18420] [client 43.157.181.189:52306] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUEHQji2Gr8pDzjrVBDJLgAAAMo"]
[Tue Dec 16 15:41:45.081180 2025] [:error] [pid 12330:tid 12358] [client 175.6.217.4:54358] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUENOV6iIQEVCIh8V1lBHwAAAZg"]
[Tue Dec 16 21:34:58.072945 2025] [:error] [pid 18408:tid 18424] [client 43.135.133.241:52806] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUFgAji2Gr8pDzjrVBA6uwAAAM4"]
[Tue Dec 16 22:16:40.230791 2025] [:error] [pid 12330:tid 12342] [client 36.41.75.167:42863] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUFpyF6iIQEVCIh8V1mpagAAAYg"]
[Tue Dec 16 23:08:07.190423 2025] [:error] [pid 18408:tid 18432] [client 43.130.100.35:36582] [client 43.130.100.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUF11zi2Gr8pDzjrVBBhWgAAANY"]
[Wed Dec 17 00:14:18.182308 2025] [:error] [pid 64835:tid 64853] [client 43.166.250.187:43508] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUGFWu0_iNx32Sz58MK58AAAAA4"]
[Wed Dec 17 10:21:09.317887 2025] [:error] [pid 45532:tid 45612] [client 180.110.203.108:52156] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUITlQeWB-JXOyTKNs1cpAAAAJY"]
[Wed Dec 17 17:36:02.676723 2025] [:error] [pid 45531:tid 45566] [client 172.192.79.140:50495] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Dec 17 17:36:03.068862 2025] [:error] [pid 45531:tid 45587] [client 172.192.79.140:50495] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Dec 17 17:36:03.202768 2025] [:error] [pid 45531:tid 45580] [client 172.192.79.140:50495] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Wed Dec 17 17:36:03.453430 2025] [:error] [pid 45531:tid 45579] [client 172.192.79.140:50495] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Wed Dec 17 17:36:03.573374 2025] [:error] [pid 45531:tid 45564] [client 172.192.79.140:50495] File does not exist: /usr/local/apache/htdocs/suspended-page/ah22.php
[Wed Dec 17 17:36:03.794960 2025] [:error] [pid 45531:tid 45581] [client 172.192.79.140:50495] File does not exist: /usr/local/apache/htdocs/suspended-page/styll.php
[Wed Dec 17 17:36:03.911923 2025] [:error] [pid 45531:tid 45584] [client 172.192.79.140:50495] [client 172.192.79.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "aUJ5g4juE-Fd-sBWjvVWJwAAAFU"]
[Wed Dec 17 17:36:05.504574 2025] [:error] [pid 45530:tid 45558] [client 172.192.79.140:50490] File does not exist: /usr/local/apache/htdocs/suspended-page/wfile.php
[Wed Dec 17 17:36:05.617268 2025] [:error] [pid 45530:tid 45557] [client 172.192.79.140:50490] [client 172.192.79.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/zxl.php"] [unique_id "aUJ5hW4IsXcKlf7LWf_uXQAAABY"]
[Wed Dec 17 17:36:07.663738 2025] [:error] [pid 45621:tid 45629] [client 172.192.79.140:50376] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Dec 17 17:36:07.780865 2025] [:error] [pid 45621:tid 45648] [client 172.192.79.140:50376] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUJ5h-VNGQfJ1rR90pQyzQAAANY"]
[Wed Dec 17 17:36:11.588844 2025] [:error] [pid 45530:tid 45552] [client 172.192.79.140:50488] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUJ5i24IsXcKlf7LWf_uZQAAABE"]
[Wed Dec 17 17:36:12.892237 2025] [:error] [pid 11733:tid 11747] [client 172.192.79.140:50368] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUJ5jDzmtBRXExJb1PHzXQAAAQw"]
[Wed Dec 17 17:36:13.647608 2025] [:error] [pid 11733:tid 11736] [client 172.192.79.140:50378] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUJ5jTzmtBRXExJb1PHzXgAAAQE"]
[Wed Dec 17 17:36:15.536686 2025] [:error] [pid 45621:tid 45637] [client 172.192.79.140:50430] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "aUJ5j-VNGQfJ1rR90pQy0wAAAMs"]
[Wed Dec 17 17:36:19.068467 2025] [:error] [pid 45621:tid 45630] [client 172.192.79.140:50450] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "aUJ5k-VNGQfJ1rR90pQy1wAAAMQ"]
[Wed Dec 17 17:36:20.372387 2025] [:error] [pid 45532:tid 45602] [client 172.192.79.140:50440] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "aUJ5lAeWB-JXOyTKNs0SrQAAAIw"]
[Wed Dec 17 17:36:21.583447 2025] [:error] [pid 45532:tid 45614] [client 172.192.79.140:50384] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "aUJ5lQeWB-JXOyTKNs0SsgAAAJg"]
[Wed Dec 17 17:36:24.896607 2025] [:error] [pid 45621:tid 45629] [client 172.192.79.140:50468] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfcl.php"] [unique_id "aUJ5mOVNGQfJ1rR90pQy5AAAAMM"]
[Wed Dec 17 17:36:25.648017 2025] [:error] [pid 11733:tid 11753] [client 172.192.79.140:50387] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfcl.php"] [unique_id "aUJ5mTzmtBRXExJb1PHzbgAAARI"]
[Wed Dec 17 17:36:27.842628 2025] [:error] [pid 45621:tid 45649] [client 172.192.79.140:50455] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfcl.php"] [unique_id "aUJ5m-VNGQfJ1rR90pQy7AAAANc"]
[Wed Dec 17 17:36:30.607459 2025] [:error] [pid 45531:tid 45563] [client 172.192.79.140:50372] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfcl.php"] [unique_id "aUJ5nojuE-Fd-sBWjvVWewAAAEA"]
[Wed Dec 17 17:36:31.372134 2025] [:error] [pid 11733:tid 11751] [client 172.192.79.140:50382] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npcs7k.php"] [unique_id "aUJ5nzzmtBRXExJb1PHzdgAAARA"]
[Wed Dec 17 17:36:32.899179 2025] [:error] [pid 11733:tid 11737] [client 172.192.79.140:50469] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npcs7k.php"] [unique_id "aUJ5oDzmtBRXExJb1PHzegAAAQI"]
[Wed Dec 17 17:36:35.988080 2025] [:error] [pid 45621:tid 45646] [client 172.192.79.140:50404] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npcs7k.php"] [unique_id "aUJ5o-VNGQfJ1rR90pQzFQAAANQ"]
[Wed Dec 17 17:36:39.456676 2025] [:error] [pid 11733:tid 11750] [client 172.192.79.140:50479] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npcs7k.php"] [unique_id "aUJ5pzzmtBRXExJb1PHzjgAAAQ8"]
[Wed Dec 17 17:36:41.701454 2025] [:error] [pid 45532:tid 45597] [client 172.192.79.140:50377] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUJ5qQeWB-JXOyTKNs0TDQAAAIc"]
[Wed Dec 17 17:36:44.694468 2025] [:error] [pid 45621:tid 45643] [client 172.192.79.140:50380] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUJ5rOVNGQfJ1rR90pQzIAAAANE"]
[Wed Dec 17 17:36:46.422241 2025] [:error] [pid 45530:tid 45557] [client 172.192.79.140:50454] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUJ5rm4IsXcKlf7LWf_u2AAAABY"]
[Wed Dec 17 17:36:47.891582 2025] [:error] [pid 11733:tid 11755] [client 172.192.79.140:50439] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUJ5rzzmtBRXExJb1PHzqwAAARQ"]
[Wed Dec 17 17:36:48.735531 2025] [:error] [pid 11733:tid 11757] [client 172.192.79.140:50473] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cro.php"] [unique_id "aUJ5sDzmtBRXExJb1PHzrQAAARY"]
[Wed Dec 17 17:36:51.543600 2025] [:error] [pid 45621:tid 45645] [client 172.192.79.140:50316] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cro.php"] [unique_id "aUJ5s-VNGQfJ1rR90pQzJwAAANM"]
[Wed Dec 17 17:36:52.909156 2025] [:error] [pid 45531:tid 45573] [client 172.192.79.140:50461] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cro.php"] [unique_id "aUJ5tIjuE-Fd-sBWjvVWjAAAAEo"]
[Wed Dec 17 17:36:56.789869 2025] [:error] [pid 45621:tid 45629] [client 172.192.79.140:50443] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cro.php"] [unique_id "aUJ5uOVNGQfJ1rR90pQzMgAAAMM"]
[Wed Dec 17 17:36:59.518356 2025] [:error] [pid 45531:tid 45583] [client 172.192.79.140:50435] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/egu.php"] [unique_id "aUJ5u4juE-Fd-sBWjvVWlAAAAFQ"]
[Wed Dec 17 17:37:01.567957 2025] [:error] [pid 11733:tid 11747] [client 172.192.79.140:50449] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/egu.php"] [unique_id "aUJ5vTzmtBRXExJb1PHz3wAAAQw"]
[Wed Dec 17 17:37:04.335929 2025] [:error] [pid 45531:tid 45575] [client 172.192.79.140:50329] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/egu.php"] [unique_id "aUJ5wIjuE-Fd-sBWjvVWlgAAAEw"]
[Wed Dec 17 17:37:09.229688 2025] [:error] [pid 45532:tid 45604] [client 172.192.79.140:50466] File does not exist: /usr/local/apache/htdocs/suspended-page/egu.php
[Wed Dec 17 17:37:09.358962 2025] [:error] [pid 45532:tid 45594] [client 172.192.79.140:50466] File does not exist: /usr/local/apache/htdocs/suspended-page/doo.php
[Wed Dec 17 17:37:09.478516 2025] [:error] [pid 45532:tid 45610] [client 172.192.79.140:50466] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Wed Dec 17 17:37:09.606132 2025] [:error] [pid 45532:tid 45614] [client 172.192.79.140:50466] File does not exist: /usr/local/apache/htdocs/suspended-page/wakak.php
[Wed Dec 17 17:37:09.735413 2025] [:error] [pid 45532:tid 45592] [client 172.192.79.140:50466] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Dec 17 17:37:09.849310 2025] [:error] [pid 45532:tid 45603] [client 172.192.79.140:50466] [client 172.192.79.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUJ5xQeWB-JXOyTKNs0TJAAAAI0"]
[Wed Dec 17 17:37:10.758747 2025] [:error] [pid 45532:tid 45595] [client 172.192.79.140:50434] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Wed Dec 17 17:37:10.947203 2025] [:error] [pid 45532:tid 45612] [client 172.192.79.140:50434] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Dec 17 17:37:11.065031 2025] [:error] [pid 45532:tid 45600] [client 172.192.79.140:50434] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Wed Dec 17 17:37:11.314463 2025] [:error] [pid 45532:tid 45598] [client 172.192.79.140:50434] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Wed Dec 17 17:37:11.431832 2025] [:error] [pid 45532:tid 45593] [client 172.192.79.140:50434] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Dec 17 17:37:11.726697 2025] [:error] [pid 45532:tid 45601] [client 172.192.79.140:50434] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUJ5xweWB-JXOyTKNs0TRQAAAIs"]
[Wed Dec 17 17:37:12.403938 2025] [:error] [pid 45532:tid 45614] [client 172.192.79.140:50432] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUJ5yAeWB-JXOyTKNs0TRwAAAJg"]
[Wed Dec 17 17:37:13.401703 2025] [:error] [pid 45621:tid 45642] [client 172.192.79.140:50416] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUJ5yeVNGQfJ1rR90pQzXAAAANA"]
[Wed Dec 17 17:37:15.798427 2025] [:error] [pid 45532:tid 45608] [client 172.192.79.140:50442] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUJ5yweWB-JXOyTKNs0TTQAAAJI"]
[Wed Dec 17 17:37:17.018958 2025] [:error] [pid 45530:tid 45538] [client 172.192.79.140:50493] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aves.php"] [unique_id "aUJ5zW4IsXcKlf7LWf_vCwAAAAM"]
[Wed Dec 17 17:37:18.442053 2025] [:error] [pid 45532:tid 45613] [client 172.192.79.140:50444] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aves.php"] [unique_id "aUJ5zgeWB-JXOyTKNs0TTwAAAJc"]
[Wed Dec 17 17:37:19.732663 2025] [:error] [pid 45532:tid 45603] [client 172.192.79.140:50474] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aves.php"] [unique_id "aUJ5zweWB-JXOyTKNs0TUQAAAI0"]
[Wed Dec 17 17:37:20.945295 2025] [:error] [pid 45621:tid 45649] [client 172.192.79.140:50476] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aves.php"] [unique_id "aUJ50OVNGQfJ1rR90pQzjgAAANc"]
[Wed Dec 17 17:37:22.105707 2025] [:error] [pid 45621:tid 45635] [client 172.192.79.140:50477] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/chosen.php"] [unique_id "aUJ50uVNGQfJ1rR90pQzngAAAMk"]
[Wed Dec 17 17:37:23.576640 2025] [:error] [pid 11733:tid 11740] [client 172.192.79.140:50457] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/chosen.php"] [unique_id "aUJ50zzmtBRXExJb1PH0BAAAAQU"]
[Wed Dec 17 17:37:25.400579 2025] [:error] [pid 45531:tid 45565] [client 172.192.79.140:50400] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/chosen.php"] [unique_id "aUJ51YjuE-Fd-sBWjvVWzQAAAEI"]
[Wed Dec 17 17:37:27.317358 2025] [:error] [pid 45621:tid 45630] [client 172.192.79.140:50374] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/chosen.php"] [unique_id "aUJ51-VNGQfJ1rR90pQzxQAAAMQ"]
[Wed Dec 17 17:37:30.320293 2025] [:error] [pid 11733:tid 11749] [client 172.192.79.140:50441] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aUJ52jzmtBRXExJb1PH0GAAAAQ4"]
[Wed Dec 17 17:37:35.067230 2025] [:error] [pid 45531:tid 45576] [client 172.192.79.140:50464] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aUJ534juE-Fd-sBWjvVW5AAAAE0"]
[Wed Dec 17 17:37:36.132737 2025] [:error] [pid 45531:tid 45571] [client 172.192.79.140:50452] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aUJ54IjuE-Fd-sBWjvVW5gAAAEg"]
[Wed Dec 17 17:37:40.254833 2025] [:error] [pid 45532:tid 45600] [client 172.192.79.140:50458] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aUJ55AeWB-JXOyTKNs0TcAAAAIo"]
[Wed Dec 17 17:37:52.411977 2025] [:error] [pid 45530:tid 45543] [client 172.192.79.140:50370] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manage.php"] [unique_id "aUJ58G4IsXcKlf7LWf_vhwAAAAg"]
[Wed Dec 17 17:37:53.531066 2025] [:error] [pid 11733:tid 11745] [client 172.192.79.140:50485] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manage.php"] [unique_id "aUJ58TzmtBRXExJb1PH0MgAAAQo"]
[Wed Dec 17 17:37:57.244996 2025] [:error] [pid 11733:tid 11753] [client 172.192.79.140:50305] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aUJ59TzmtBRXExJb1PH0dgAAARI"]
[Wed Dec 17 17:37:59.303500 2025] [:error] [pid 11733:tid 11746] [client 172.192.79.140:50481] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aUJ59zzmtBRXExJb1PH0fQAAAQs"]
[Wed Dec 17 17:38:01.133516 2025] [:error] [pid 45621:tid 45650] [client 172.192.79.140:50494] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aUJ5-eVNGQfJ1rR90pQz5wAAANg"]
[Wed Dec 17 17:38:02.925956 2025] [:error] [pid 45530:tid 45558] [client 172.192.79.140:50413] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aUJ5-m4IsXcKlf7LWf_vkgAAABc"]
[Wed Dec 17 17:38:04.244984 2025] [:error] [pid 45531:tid 45564] [client 172.192.79.140:50399] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aUJ5_IjuE-Fd-sBWjvVW9wAAAEE"]
[Wed Dec 17 17:38:05.195439 2025] [:error] [pid 45621:tid 45640] [client 172.192.79.140:50467] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aUJ5_eVNGQfJ1rR90pQz6AAAAM4"]
[Wed Dec 17 17:38:06.741328 2025] [:error] [pid 45621:tid 45629] [client 172.192.79.140:50460] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aUJ5_uVNGQfJ1rR90pQz6gAAAMM"]
[Wed Dec 17 17:38:12.915257 2025] [:error] [pid 45531:tid 45572] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Dec 17 17:38:13.031920 2025] [:error] [pid 45531:tid 45580] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Wed Dec 17 17:38:13.160563 2025] [:error] [pid 45531:tid 45581] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Dec 17 17:38:13.416999 2025] [:error] [pid 45531:tid 45574] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Wed Dec 17 17:38:13.533207 2025] [:error] [pid 45531:tid 45568] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Dec 17 17:38:13.666524 2025] [:error] [pid 45531:tid 45585] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Wed Dec 17 17:38:13.905097 2025] [:error] [pid 45531:tid 45586] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Wed Dec 17 17:38:14.484759 2025] [:error] [pid 45531:tid 45575] [client 172.192.79.140:50405] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Wed Dec 17 17:38:14.598670 2025] [:error] [pid 45531:tid 45566] [client 172.192.79.140:50405] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aUJ6BojuE-Fd-sBWjvVXCgAAAEM"]
[Wed Dec 17 17:38:15.614749 2025] [:error] [pid 45530:tid 45539] [client 172.192.79.140:50427] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aUJ6B24IsXcKlf7LWf_voAAAAAQ"]
[Wed Dec 17 17:38:17.428625 2025] [:error] [pid 45530:tid 45555] [client 172.192.79.140:50463] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aUJ6CW4IsXcKlf7LWf_vowAAABQ"]
[Wed Dec 17 17:38:17.779688 2025] [:error] [pid 45621:tid 45634] [client 172.192.79.140:50475] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aUJ6CeVNGQfJ1rR90pQz-wAAAMg"]
[Wed Dec 17 17:38:19.021489 2025] [:error] [pid 45530:tid 45558] [client 172.192.79.140:50482] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUJ6C24IsXcKlf7LWf_vpAAAABc"]
[Wed Dec 17 17:38:19.997479 2025] [:error] [pid 45530:tid 45544] [client 172.192.79.140:50346] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUJ6C24IsXcKlf7LWf_vqAAAAAk"]
[Wed Dec 17 17:38:23.895931 2025] [:error] [pid 45531:tid 45578] [client 172.192.79.140:50438] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUJ6D4juE-Fd-sBWjvVXDgAAAE8"]
[Wed Dec 17 17:38:25.041015 2025] [:error] [pid 45532:tid 45611] [client 172.192.79.140:50388] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUJ6EQeWB-JXOyTKNs0T8wAAAJU"]
[Wed Dec 17 17:38:26.775591 2025] [:error] [pid 45531:tid 45580] [client 172.192.79.140:50394] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aUJ6EojuE-Fd-sBWjvVXFAAAAFE"]
[Wed Dec 17 17:38:29.103000 2025] [:error] [pid 11733:tid 11758] [client 172.192.79.140:50433] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aUJ6FTzmtBRXExJb1PH0kwAAARc"]
[Wed Dec 17 17:38:37.768811 2025] [:error] [pid 45532:tid 45590] [client 172.192.79.140:50385] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aUJ6HQeWB-JXOyTKNs0UBQAAAIA"]
[Wed Dec 17 17:38:41.520481 2025] [:error] [pid 45531:tid 45577] [client 172.192.79.140:50383] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUJ6IYjuE-Fd-sBWjvVXMAAAAE4"]
[Wed Dec 17 17:38:45.152676 2025] [:error] [pid 45531:tid 45575] [client 172.192.79.140:50447] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUJ6JYjuE-Fd-sBWjvVXOgAAAEw"]
[Wed Dec 17 17:38:46.433263 2025] [:error] [pid 45621:tid 45639] [client 172.192.79.140:50386] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUJ6JuVNGQfJ1rR90pQ0FAAAAM0"]
[Wed Dec 17 17:38:48.417202 2025] [:error] [pid 45621:tid 45626] [client 172.192.79.140:50241] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUJ6KOVNGQfJ1rR90pQ0HAAAAMA"]
[Wed Dec 17 17:38:49.372698 2025] [:error] [pid 45531:tid 45563] [client 172.192.79.140:50392] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUJ6KYjuE-Fd-sBWjvVXSAAAAEA"]
[Wed Dec 17 17:38:51.394855 2025] [:error] [pid 45621:tid 45646] [client 172.192.79.140:50419] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUJ6K-VNGQfJ1rR90pQ0IwAAANQ"]
[Wed Dec 17 17:38:54.023397 2025] [:error] [pid 45532:tid 45611] [client 172.192.79.140:50307] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUJ6LgeWB-JXOyTKNs0UGAAAAJU"]
[Wed Dec 17 17:38:54.669919 2025] [:error] [pid 45530:tid 45556] [client 172.192.79.140:50389] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUJ6Lm4IsXcKlf7LWf_wCwAAABU"]
[Wed Dec 17 17:38:55.892351 2025] [:error] [pid 45532:tid 45599] [client 172.192.79.140:50462] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aUJ6LweWB-JXOyTKNs0URQAAAIk"]
[Wed Dec 17 17:39:04.228434 2025] [:error] [pid 45621:tid 45638] [client 172.192.79.140:50347] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aUJ6OOVNGQfJ1rR90pQ0bQAAAMw"]
[Wed Dec 17 17:39:06.327793 2025] [:error] [pid 11733:tid 11755] [client 172.192.79.140:50492] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aUJ6OjzmtBRXExJb1PH0xgAAARQ"]
[Wed Dec 17 17:39:07.523718 2025] [:error] [pid 45530:tid 45549] [client 172.192.79.140:50431] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aUJ6O24IsXcKlf7LWf_wUwAAAA4"]
[Wed Dec 17 17:39:09.922564 2025] [:error] [pid 11733:tid 11744] [client 172.192.79.140:50398] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aUJ6PTzmtBRXExJb1PH0zQAAAQk"]
[Wed Dec 17 17:39:13.273181 2025] [:error] [pid 45530:tid 45540] [client 172.192.79.140:50332] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aUJ6QW4IsXcKlf7LWf_wYQAAAAU"]
[Wed Dec 17 17:39:15.627859 2025] [:error] [pid 45621:tid 45650] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Wed Dec 17 17:39:15.744985 2025] [:error] [pid 45621:tid 45640] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/zeal.php
[Wed Dec 17 17:39:16.157599 2025] [:error] [pid 45621:tid 45642] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Wed Dec 17 17:39:16.288578 2025] [:error] [pid 45621:tid 45628] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/133.php
[Wed Dec 17 17:39:16.404712 2025] [:error] [pid 45621:tid 45631] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Dec 17 17:39:16.714897 2025] [:error] [pid 45621:tid 45638] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Wed Dec 17 17:39:16.841884 2025] [:error] [pid 45621:tid 45626] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/htaccess.php
[Wed Dec 17 17:39:16.987817 2025] [:error] [pid 45621:tid 45637] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Dec 17 17:39:17.369715 2025] [:error] [pid 45621:tid 45646] [client 172.192.79.140:50381] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Dec 17 17:39:17.509004 2025] [:error] [pid 45621:tid 45635] [client 172.192.79.140:50381] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aUJ6ReVNGQfJ1rR90pQ0kwAAAMk"]
[Wed Dec 17 17:39:18.630678 2025] [:error] [pid 45530:tid 45547] [client 172.192.79.140:50489] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aUJ6Rm4IsXcKlf7LWf_waAAAAAw"]
[Wed Dec 17 17:39:20.564751 2025] [:error] [pid 45530:tid 45559] [client 172.192.79.140:50333] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aUJ6SG4IsXcKlf7LWf_wbwAAABg"]
[Wed Dec 17 17:39:21.896576 2025] [:error] [pid 45531:tid 45583] [client 172.192.79.140:50393] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aUJ6SYjuE-Fd-sBWjvVXewAAAFQ"]
[Wed Dec 17 17:39:23.720604 2025] [:error] [pid 45531:tid 45586] [client 172.192.79.140:50350] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUJ6S4juE-Fd-sBWjvVXfAAAAFc"]
[Wed Dec 17 17:39:24.866800 2025] [:error] [pid 45531:tid 45584] [client 172.192.79.140:50484] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUJ6TIjuE-Fd-sBWjvVXgAAAAFU"]
[Wed Dec 17 17:39:26.941796 2025] [:error] [pid 45531:tid 45580] [client 172.192.79.140:50375] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUJ6TojuE-Fd-sBWjvVXhwAAAFE"]
[Wed Dec 17 17:39:29.040188 2025] [:error] [pid 11733:tid 11754] [client 172.192.79.140:50403] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUJ6UTzmtBRXExJb1PH01gAAARM"]
[Wed Dec 17 17:39:31.236144 2025] [:error] [pid 45530:tid 45552] [client 172.192.79.140:50472] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aUJ6U24IsXcKlf7LWf_wfwAAABE"]
[Wed Dec 17 17:39:32.647662 2025] [:error] [pid 45532:tid 45595] [client 172.192.79.140:50358] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aUJ6VAeWB-JXOyTKNs0UlQAAAIU"]
[Wed Dec 17 17:39:33.608857 2025] [:error] [pid 45621:tid 45639] [client 172.192.79.140:50422] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aUJ6VeVNGQfJ1rR90pQ0nQAAAM0"]
[Wed Dec 17 17:39:35.397908 2025] [:error] [pid 11733:tid 11751] [client 172.192.79.140:50465] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aUJ6VzzmtBRXExJb1PH04gAAARA"]
[Wed Dec 17 17:39:37.505281 2025] [:error] [pid 45621:tid 45632] [client 172.192.79.140:50411] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/json.php"] [unique_id "aUJ6WeVNGQfJ1rR90pQ0owAAAMY"]
[Wed Dec 17 17:39:39.879281 2025] [:error] [pid 45531:tid 45570] [client 172.192.79.140:50278] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/json.php"] [unique_id "aUJ6W4juE-Fd-sBWjvVXkwAAAEc"]
[Wed Dec 17 17:39:41.070296 2025] [:error] [pid 45621:tid 45647] [client 172.192.79.140:50425] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/json.php"] [unique_id "aUJ6XeVNGQfJ1rR90pQ0sQAAANU"]
[Wed Dec 17 17:39:42.050822 2025] [:error] [pid 45532:tid 45597] [client 172.192.79.140:50322] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/json.php"] [unique_id "aUJ6XgeWB-JXOyTKNs0UmQAAAIc"]
[Wed Dec 17 17:39:44.226817 2025] [:error] [pid 45530:tid 45546] [client 172.192.79.140:50408] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUJ6YG4IsXcKlf7LWf_wiAAAAAs"]
[Wed Dec 17 17:39:46.443903 2025] [:error] [pid 45530:tid 45554] [client 172.192.79.140:50397] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUJ6Ym4IsXcKlf7LWf_wjAAAABM"]
[Wed Dec 17 17:39:47.338971 2025] [:error] [pid 45530:tid 45545] [client 172.192.79.140:50421] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUJ6Y24IsXcKlf7LWf_wjgAAAAo"]
[Wed Dec 17 17:39:49.702770 2025] [:error] [pid 45531:tid 45582] [client 172.192.79.140:50423] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUJ6ZYjuE-Fd-sBWjvVXmgAAAFM"]
[Wed Dec 17 17:39:51.580942 2025] [:error] [pid 45621:tid 45646] [client 172.192.79.140:50401] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUJ6Z-VNGQfJ1rR90pQ0ygAAANQ"]
[Wed Dec 17 17:39:53.255256 2025] [:error] [pid 45621:tid 45637] [client 172.192.79.140:50402] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUJ6aeVNGQfJ1rR90pQ0zAAAAMs"]
[Wed Dec 17 17:39:55.281190 2025] [:error] [pid 45531:tid 45586] [client 172.192.79.140:50428] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUJ6a4juE-Fd-sBWjvVXowAAAFc"]
[Wed Dec 17 17:39:57.045321 2025] [:error] [pid 11733:tid 11736] [client 172.192.79.140:50429] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUJ6bTzmtBRXExJb1PH1BAAAAQE"]
[Wed Dec 17 17:39:58.916982 2025] [:error] [pid 11733:tid 11741] [client 172.192.79.140:50340] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUJ6bjzmtBRXExJb1PH1BgAAAQY"]
[Wed Dec 17 17:39:59.218633 2025] [:error] [pid 11733:tid 11750] [client 172.192.79.140:50317] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUJ6bzzmtBRXExJb1PH1BwAAAQ8"]
[Wed Dec 17 17:40:01.674203 2025] [:error] [pid 45621:tid 45649] [client 172.192.79.140:50446] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUJ6ceVNGQfJ1rR90pQ01QAAANc"]
[Wed Dec 17 17:40:04.123701 2025] [:error] [pid 11733:tid 11749] [client 172.192.79.140:50352] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUJ6dDzmtBRXExJb1PH1DgAAAQ4"]
[Wed Dec 17 17:40:04.707902 2025] [:error] [pid 45621:tid 45631] [client 172.192.79.140:50318] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/loads.PhP"] [unique_id "aUJ6dOVNGQfJ1rR90pQ03QAAAMU"]
[Wed Dec 17 17:40:08.500434 2025] [:error] [pid 11733:tid 11752] [client 172.192.79.140:50487] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/loads.PhP"] [unique_id "aUJ6eDzmtBRXExJb1PH1FAAAARE"]
[Wed Dec 17 17:40:09.700112 2025] [:error] [pid 11733:tid 11745] [client 172.192.79.140:50324] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/loads.PhP"] [unique_id "aUJ6eTzmtBRXExJb1PH1GQAAAQo"]
[Wed Dec 17 17:40:10.707450 2025] [:error] [pid 45530:tid 45559] [client 172.192.79.140:50415] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/loads.PhP"] [unique_id "aUJ6em4IsXcKlf7LWf_wpAAAABg"]
[Wed Dec 17 17:40:12.304669 2025] [:error] [pid 45530:tid 45557] [client 172.192.79.140:50471] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/"] [unique_id "aUJ6fG4IsXcKlf7LWf_wrAAAABY"]
[Wed Dec 17 17:40:13.711135 2025] [:error] [pid 45532:tid 45596] [client 172.192.79.140:50240] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/"] [unique_id "aUJ6fQeWB-JXOyTKNs0UuwAAAIY"]
[Wed Dec 17 17:40:14.984081 2025] [:error] [pid 45532:tid 45600] [client 172.192.79.140:50459] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/"] [unique_id "aUJ6fgeWB-JXOyTKNs0UxQAAAIo"]
[Wed Dec 17 17:40:16.415635 2025] [:error] [pid 45621:tid 45640] [client 172.192.79.140:50320] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/"] [unique_id "aUJ6gOVNGQfJ1rR90pQ05wAAAM4"]
[Wed Dec 17 17:40:20.917708 2025] [:error] [pid 45532:tid 45594] [client 172.192.79.140:50357] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Wed Dec 17 17:40:21.038039 2025] [:error] [pid 45532:tid 45610] [client 172.192.79.140:50357] File does not exist: /usr/local/apache/htdocs/suspended-page/file1.php
[Wed Dec 17 17:40:21.156615 2025] [:error] [pid 45532:tid 45598] [client 172.192.79.140:50357] File does not exist: /usr/local/apache/htdocs/suspended-page/2r.php
[Wed Dec 17 17:40:21.290598 2025] [:error] [pid 45532:tid 45600] [client 172.192.79.140:50357] [client 172.192.79.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.192.79.140, incrementing brute counter"] [hostname "rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUJ6hQeWB-JXOyTKNs0U1AAAAIo"]
[Wed Dec 17 17:40:22.267238 2025] [:error] [pid 45532:tid 45602] [client 172.192.79.140:50357] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Dec 17 17:40:22.388825 2025] [:error] [pid 45532:tid 45613] [client 172.192.79.140:50357] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Dec 17 17:40:22.611186 2025] [:error] [pid 45532:tid 45612] [client 172.192.79.140:50357] [client 172.192.79.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUJ6hgeWB-JXOyTKNs0U2AAAAJY"]
[Wed Dec 17 17:40:23.243411 2025] [:error] [pid 45531:tid 45586] [client 172.192.79.140:50327] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Wed Dec 17 17:40:23.449007 2025] [:error] [pid 45531:tid 45581] [client 172.192.79.140:50327] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Wed Dec 17 17:40:23.565192 2025] [:error] [pid 45531:tid 45580] [client 172.192.79.140:50327] [client 172.192.79.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.192.79.140, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aUJ6h4juE-Fd-sBWjvVXxwAAAFE"]
[Wed Dec 17 17:40:23.568745 2025] [:error] [pid 45531:tid 45580] [client 172.192.79.140:50327] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Dec 17 17:40:23.685810 2025] [:error] [pid 45531:tid 45565] [client 172.192.79.140:50327] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Wed Dec 17 17:40:23.808624 2025] [:error] [pid 45531:tid 45570] [client 172.192.79.140:50327] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aUJ6h4juE-Fd-sBWjvVXygAAAEc"]
[Wed Dec 17 17:40:28.566293 2025] [:error] [pid 45621:tid 45640] [client 172.192.79.140:50371] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aUJ6jOVNGQfJ1rR90pQ0-AAAAM4"]
[Wed Dec 17 17:40:35.017694 2025] [:error] [pid 45531:tid 45576] [client 172.192.79.140:50341] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aUJ6k4juE-Fd-sBWjvVX1gAAAE0"]
[Wed Dec 17 17:40:40.381653 2025] [:error] [pid 45532:tid 45596] [client 172.192.79.140:50248] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUJ6mAeWB-JXOyTKNs0U6AAAAIY"]
[Wed Dec 17 17:40:43.470777 2025] [:error] [pid 11733:tid 11746] [client 172.192.79.140:50445] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUJ6mzzmtBRXExJb1PH1NwAAAQs"]
[Wed Dec 17 17:40:56.560351 2025] [:error] [pid 45530:tid 45545] [client 172.192.79.140:50376] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aUJ6qG4IsXcKlf7LWf_w3QAAAAo"]
[Wed Dec 17 17:40:57.851397 2025] [:error] [pid 45532:tid 45612] [client 172.192.79.140:50491] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aUJ6qQeWB-JXOyTKNs0U_gAAAJY"]
[Wed Dec 17 17:41:00.963089 2025] [:error] [pid 11733:tid 11751] [client 172.192.79.140:50337] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aUJ6rDzmtBRXExJb1PH1UAAAARA"]
[Wed Dec 17 17:41:03.162259 2025] [:error] [pid 45531:tid 45582] [client 172.192.79.140:50382] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aUJ6r4juE-Fd-sBWjvVX7QAAAFM"]
[Wed Dec 17 17:41:03.993407 2025] [:error] [pid 45531:tid 45572] [client 172.192.79.140:50439] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUJ6r4juE-Fd-sBWjvVX7wAAAEk"]
[Wed Dec 17 17:41:05.511369 2025] [:error] [pid 45530:tid 45539] [client 172.192.79.140:50378] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUJ6sW4IsXcKlf7LWf_w5AAAAAQ"]
[Wed Dec 17 17:41:06.511956 2025] [:error] [pid 45531:tid 45565] [client 172.192.79.140:50373] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUJ6sojuE-Fd-sBWjvVX8QAAAEI"]
[Wed Dec 17 17:41:07.554628 2025] [:error] [pid 45532:tid 45594] [client 172.192.79.140:50461] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUJ6sweWB-JXOyTKNs0VBwAAAIQ"]
[Wed Dec 17 17:41:29.660007 2025] [:error] [pid 45532:tid 45601] [client 172.192.79.140:50310] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qlex1.php"] [unique_id "aUJ6yQeWB-JXOyTKNs0VPAAAAIs"]
[Wed Dec 17 17:41:31.787378 2025] [:error] [pid 45621:tid 45636] [client 172.192.79.140:50432] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qlex1.php"] [unique_id "aUJ6y-VNGQfJ1rR90pQ1igAAAMo"]
[Wed Dec 17 17:41:33.252914 2025] [:error] [pid 45621:tid 45648] [client 172.192.79.140:50406] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qlex1.php"] [unique_id "aUJ6zeVNGQfJ1rR90pQ1jwAAANY"]
[Wed Dec 17 17:41:35.306209 2025] [:error] [pid 45531:tid 45580] [client 172.192.79.140:50311] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qlex1.php"] [unique_id "aUJ6z4juE-Fd-sBWjvVYCwAAAFE"]
[Wed Dec 17 17:41:37.831665 2025] [:error] [pid 45530:tid 45559] [client 172.192.79.140:50440] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aUJ60W4IsXcKlf7LWf_xBwAAABg"]
[Wed Dec 17 17:41:41.901251 2025] [:error] [pid 11733:tid 11739] [client 172.192.79.140:50387] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aUJ61TzmtBRXExJb1PH18gAAAQQ"]
[Wed Dec 17 17:41:45.919646 2025] [:error] [pid 45621:tid 45633] [client 172.192.79.140:50476] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aUJ62eVNGQfJ1rR90pQ1rgAAAMc"]
[Wed Dec 17 17:41:52.599936 2025] [:error] [pid 45531:tid 45566] [client 172.192.79.140:50453] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUJ64IjuE-Fd-sBWjvVYIAAAAEM"]
[Wed Dec 17 17:41:55.867796 2025] [:error] [pid 45532:tid 45610] [client 172.192.79.140:50339] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUJ64weWB-JXOyTKNs0VUAAAAJQ"]
[Wed Dec 17 17:42:03.560129 2025] [:error] [pid 45532:tid 45611] [client 172.192.79.140:50343] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUJ66weWB-JXOyTKNs0VVgAAAJU"]
[Wed Dec 17 17:42:15.258074 2025] [:error] [pid 45530:tid 45550] [client 172.192.79.140:50274] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aUJ6924IsXcKlf7LWf_xQQAAAA8"]
[Wed Dec 17 17:42:18.326695 2025] [:error] [pid 45531:tid 45574] [client 172.192.79.140:50449] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aUJ6-ojuE-Fd-sBWjvVYRQAAAEs"]
[Wed Dec 17 17:42:42.615208 2025] [:error] [pid 11733:tid 11750] [client 172.192.79.140:50404] [client 172.192.79.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mah.php"] [unique_id "aUJ7EjzmtBRXExJb1PH2PgAAAQ8"]
[Wed Dec 17 17:42:55.108333 2025] [:error] [pid 45531:tid 45571] [client 172.192.79.140:50486] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aUJ7H4juE-Fd-sBWjvVYfgAAAEg"]
[Wed Dec 17 17:42:56.539093 2025] [:error] [pid 11733:tid 11741] [client 172.192.79.140:50442] [client 172.192.79.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aUJ7IDzmtBRXExJb1PH2aAAAAQY"]
[Wed Dec 17 22:43:34.138791 2025] [:error] [pid 16666:tid 16685] [client 175.6.217.4:42411] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aULBllAThvYvBwbndYIUhgAAAZA"]
[Thu Dec 18 04:41:34.687091 2025] [:error] [pid 21100:tid 21112] [client 223.244.35.77:39557] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUMVfimdf0GusoIGpFXVpAAAAMk"]
[Thu Dec 18 06:47:18.973877 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Dec 18 06:47:19.372482 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Dec 18 06:47:19.717564 2025] [:error] [pid 23645:tid 23648] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Dec 18 06:47:20.078933 2025] [:error] [pid 23645:tid 23671] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Dec 18 06:47:20.496977 2025] [:error] [pid 23645:tid 23651] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Dec 18 06:47:20.887887 2025] [:error] [pid 23645:tid 23655] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Dec 18 06:47:21.231148 2025] [:error] [pid 23645:tid 23649] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Dec 18 06:47:21.604962 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Dec 18 06:47:22.383916 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Dec 18 06:47:23.125366 2025] [:error] [pid 23645:tid 23668] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Dec 18 06:47:23.572449 2025] [:error] [pid 23645:tid 23666] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Dec 18 06:47:23.916945 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Dec 18 06:47:24.312146 2025] [:error] [pid 23645:tid 23656] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Dec 18 06:47:24.689603 2025] [:error] [pid 23645:tid 23667] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Dec 18 06:47:25.073712 2025] [:error] [pid 23645:tid 23664] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Dec 18 06:47:25.469149 2025] [:error] [pid 23645:tid 23660] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Dec 18 06:47:25.825462 2025] [:error] [pid 23645:tid 23655] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Dec 18 06:47:26.275628 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.206:31937] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Dec 18 06:47:31.673968 2025] [:error] [pid 23645:tid 23648] [client 193.19.109.206:31937] [client 193.19.109.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUMzAzf_Rx0Y0ao_QJh8agAAAIE"]
[Thu Dec 18 06:47:33.580594 2025] [:error] [pid 24433:tid 24450] [client 193.19.109.193:27393] [client 193.19.109.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUMzBZ4pN9ycmipm8TgUQgAAAQ4"]
[Thu Dec 18 06:47:36.094479 2025] [:error] [pid 24433:tid 24447] [client 193.19.109.174:62073] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Dec 18 06:47:37.358680 2025] [:error] [pid 24433:tid 24447] [client 193.19.109.174:62073] [client 193.19.109.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aUMzCZ4pN9ycmipm8TgUegAAAQs"]
[Thu Dec 18 06:47:38.956791 2025] [:error] [pid 23558:tid 23631] [client 193.19.109.173:51705] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Dec 18 06:47:39.313762 2025] [:error] [pid 23558:tid 23617] [client 193.19.109.173:51705] [client 193.19.109.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUMzC-Ham9NbgPQa9uYszwAAAMI"]
[Thu Dec 18 06:47:40.508734 2025] [:error] [pid 23558:tid 23627] [client 193.19.109.192:54517] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Dec 18 06:47:42.475768 2025] [:error] [pid 23558:tid 23619] [client 193.19.109.192:54517] [client 193.19.109.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUMzDuHam9NbgPQa9uYtFgAAAMQ"]
[Thu Dec 18 06:47:43.778836 2025] [:error] [pid 24542:tid 24556] [client 193.37.33.230:34445] [client 193.37.33.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUMzD0tQz4H2oS3NrDYHvQAAAUw"]
[Thu Dec 18 06:47:44.512067 2025] [:error] [pid 24542:tid 24566] [client 193.19.109.198:48057] [client 193.19.109.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUMzEEtQz4H2oS3NrDYHyQAAAVY"]
[Thu Dec 18 06:47:45.255006 2025] [:error] [pid 23558:tid 23637] [client 193.19.109.173:30053] [client 193.19.109.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUMzEeHam9NbgPQa9uYtNwAAANY"]
[Thu Dec 18 06:47:46.149004 2025] [:error] [pid 24433:tid 24451] [client 193.19.109.209:30779] [client 193.19.109.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUMzEp4pN9ycmipm8TgVLAAAAQ8"]
[Thu Dec 18 06:47:46.894764 2025] [:error] [pid 24542:tid 24547] [client 193.19.109.175:36215] [client 193.19.109.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUMzEktQz4H2oS3NrDYH6AAAAUM"]
[Thu Dec 18 06:47:48.021166 2025] [:error] [pid 23557:tid 23605] [client 193.19.109.181:60083] [client 193.19.109.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUMzFBYcs6rFVxbdP_kqmwAAAFE"]
[Thu Dec 18 06:47:48.787709 2025] [:error] [pid 23556:tid 23573] [client 193.19.109.162:20233] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Dec 18 06:47:49.520445 2025] [:error] [pid 23556:tid 23582] [client 193.19.109.162:20233] [client 193.19.109.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aUMzFRnmLlk3u5yt9kH9VwAAABY"]
[Thu Dec 18 06:47:51.017493 2025] [:error] [pid 23558:tid 23637] [client 193.19.109.172:51309] [client 193.19.109.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUMzF-Ham9NbgPQa9uYtlAAAANY"]
[Thu Dec 18 06:47:52.173589 2025] [:error] [pid 24542:tid 24552] [client 193.19.109.206:22169] [client 193.19.109.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUMzGEtQz4H2oS3NrDYIMgAAAUg"]
[Thu Dec 18 06:47:52.906471 2025] [:error] [pid 23556:tid 23563] [client 193.19.109.193:40371] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Dec 18 06:47:53.271988 2025] [:error] [pid 23556:tid 23562] [client 193.19.109.193:40371] [client 193.19.109.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUMzGRnmLlk3u5yt9kH9mgAAAAI"]
[Thu Dec 18 06:47:54.006097 2025] [:error] [pid 24542:tid 24565] [client 193.37.33.230:57391] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Dec 18 06:47:55.193924 2025] [:error] [pid 24542:tid 24553] [client 193.37.33.230:57391] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Dec 18 06:47:56.335834 2025] [:error] [pid 24542:tid 24559] [client 193.37.33.230:57391] [client 193.37.33.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUMzHEtQz4H2oS3NrDYIigAAAU8"]
[Thu Dec 18 06:47:57.133388 2025] [:error] [pid 24433:tid 24457] [client 193.19.109.198:41863] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Dec 18 06:47:57.499418 2025] [:error] [pid 24433:tid 24458] [client 193.19.109.198:41863] [client 193.19.109.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUMzHZ4pN9ycmipm8TgV6wAAARY"]
[Thu Dec 18 06:47:58.285176 2025] [:error] [pid 23558:tid 23633] [client 193.19.109.186:62987] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Dec 18 06:47:59.115945 2025] [:error] [pid 23558:tid 23632] [client 193.19.109.186:62987] [client 193.19.109.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUMzH-Ham9NbgPQa9uYuLAAAANE"]
[Thu Dec 18 06:48:00.304014 2025] [:error] [pid 23556:tid 23583] [client 193.19.109.192:46667] [client 193.19.109.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUMzIBnmLlk3u5yt9kH-IAAAABc"]
[Thu Dec 18 06:48:01.476427 2025] [:error] [pid 23557:tid 23591] [client 193.19.109.210:63867] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Dec 18 06:48:01.887203 2025] [:error] [pid 23557:tid 23588] [client 193.19.109.210:63867] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Dec 18 06:48:02.619038 2025] [:error] [pid 23557:tid 23604] [client 193.19.109.210:63867] [client 193.19.109.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUMzIhYcs6rFVxbdP_krgAAAAFA"]
[Thu Dec 18 06:48:03.973436 2025] [:error] [pid 23645:tid 23663] [client 193.19.109.168:48559] [client 193.19.109.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUMzIzf_Rx0Y0ao_QJh_WwAAAJA"]
[Thu Dec 18 06:48:05.077701 2025] [:error] [pid 23557:tid 23602] [client 193.19.109.176:22537] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUMzJRYcs6rFVxbdP_krlwAAAE4"]
[Thu Dec 18 06:48:05.776197 2025] [:error] [pid 23558:tid 23635] [client 193.19.109.186:57629] [client 193.19.109.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUMzJeHam9NbgPQa9uYukwAAANQ"]
[Thu Dec 18 06:48:06.553074 2025] [:error] [pid 23556:tid 23565] [client 193.19.109.177:50487] [client 193.19.109.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUMzJhnmLlk3u5yt9kH-dwAAAAU"]
[Thu Dec 18 06:48:08.101485 2025] [:error] [pid 23645:tid 23663] [client 193.19.109.202:47075] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Dec 18 06:48:08.485214 2025] [:error] [pid 23645:tid 23665] [client 193.19.109.202:47075] [client 193.19.109.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aUMzKDf_Rx0Y0ao_QJh_tQAAAJI"]
[Thu Dec 18 06:48:09.250100 2025] [:error] [pid 24542:tid 24545] [client 193.19.109.184:21981] [client 193.19.109.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aUMzKUtQz4H2oS3NrDYJUgAAAUE"]
[Thu Dec 18 06:48:10.068004 2025] [:error] [pid 23557:tid 23602] [client 193.19.109.173:64795] [client 193.19.109.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUMzKhYcs6rFVxbdP_kr9QAAAE4"]
[Thu Dec 18 06:48:11.693355 2025] [:error] [pid 23556:tid 23570] [client 193.19.109.199:61693] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Dec 18 06:48:12.474567 2025] [:error] [pid 23556:tid 23571] [client 193.19.109.199:61693] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Dec 18 06:48:14.007670 2025] [:error] [pid 23556:tid 23583] [client 193.19.109.199:61693] [client 193.19.109.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aUMzLhnmLlk3u5yt9kH_GwAAABc"]
[Thu Dec 18 06:48:15.978911 2025] [:error] [pid 23556:tid 23581] [client 193.19.109.197:50339] [client 193.19.109.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.197, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUMzLxnmLlk3u5yt9kH_QQAAABU"]
[Thu Dec 18 06:48:16.396871 2025] [:error] [pid 23556:tid 23571] [client 193.19.109.197:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Dec 18 06:48:18.382371 2025] [:error] [pid 23556:tid 23562] [client 193.19.109.197:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Dec 18 06:48:18.808564 2025] [:error] [pid 23556:tid 23583] [client 193.19.109.197:50339] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Dec 18 06:48:20.815878 2025] [:error] [pid 23556:tid 23569] [client 193.19.109.197:50339] [client 193.19.109.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUMzNBnmLlk3u5yt9kH_jgAAAAk"]
[Thu Dec 18 06:48:28.503427 2025] [:error] [pid 23645:tid 23647] [client 193.19.109.188:39943] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Dec 18 06:48:28.881705 2025] [:error] [pid 23645:tid 23650] [client 193.19.109.188:39943] [client 193.19.109.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.188, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUMzPDf_Rx0Y0ao_QJiBOwAAAIM"]
[Thu Dec 18 06:48:29.676633 2025] [:error] [pid 23645:tid 23663] [client 193.19.109.188:39943] [client 193.19.109.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aUMzPTf_Rx0Y0ao_QJiBSgAAAJA"]
[Thu Dec 18 06:48:32.008206 2025] [:error] [pid 23645:tid 23650] [client 193.19.109.189:52631] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Dec 18 06:48:32.862841 2025] [:error] [pid 23645:tid 23653] [client 193.19.109.189:52631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Dec 18 06:48:33.595684 2025] [:error] [pid 23645:tid 23654] [client 193.19.109.189:52631] [client 193.19.109.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUMzQTf_Rx0Y0ao_QJiBqQAAAIc"]
[Thu Dec 18 06:48:34.528572 2025] [:error] [pid 23645:tid 23654] [client 193.19.109.180:60373] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Dec 18 06:48:35.780382 2025] [:error] [pid 23645:tid 23666] [client 193.19.109.180:60373] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Dec 18 06:48:36.619923 2025] [:error] [pid 23645:tid 23662] [client 193.19.109.180:60373] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Dec 18 06:48:37.421686 2025] [:error] [pid 23645:tid 23651] [client 193.19.109.180:60373] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Dec 18 06:48:37.811253 2025] [:error] [pid 23645:tid 23665] [client 193.19.109.180:60373] [client 193.19.109.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUMzRTf_Rx0Y0ao_QJiCFwAAAJI"]
[Thu Dec 18 06:48:38.644116 2025] [:error] [pid 24433:tid 24443] [client 193.19.109.204:22491] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Dec 18 06:48:39.028424 2025] [:error] [pid 24433:tid 24443] [client 193.19.109.204:22491] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Dec 18 06:48:39.397138 2025] [:error] [pid 24433:tid 24457] [client 193.19.109.204:22491] [client 193.19.109.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUMzR54pN9ycmipm8TgYwgAAARU"]
[Thu Dec 18 06:48:40.713745 2025] [:error] [pid 24542:tid 24567] [client 193.19.109.203:58231] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Dec 18 09:08:16.206779 2025] [:error] [pid 24542:tid 24554] [client 43.133.253.253:51482] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUNUAEtQz4H2oS3NrDZHKAAAAUo"]
[Thu Dec 18 10:06:51.119046 2025] [:error] [pid 23556:tid 23568] [client 43.159.149.56:57404] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUNhuxnmLlk3u5yt9kE_5wAAAAg"]
[Thu Dec 18 10:57:35.600501 2025] [:error] [pid 24542:tid 24556] [client 43.159.135.203:36262] [client 43.159.135.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUNtn0tQz4H2oS3NrDZfeAAAAUw"]
[Thu Dec 18 15:41:07.047655 2025] [:error] [pid 23645:tid 23649] [client 128.199.182.55:38302] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/api-docs"] [unique_id "aUOwEzf_Rx0Y0ao_QJgYaQAAAII"]
[Thu Dec 18 15:41:07.991738 2025] [:error] [pid 24542:tid 24568] [client 128.199.182.55:38314] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3/api-docs"] [unique_id "aUOwE0tQz4H2oS3NrDaldwAAAVg"]
[Thu Dec 18 15:41:09.086662 2025] [:error] [pid 23558:tid 23635] [client 128.199.182.55:38326] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aUOwFeHam9NbgPQa9ua6LQAAANQ"]
[Thu Dec 18 15:41:09.984693 2025] [:error] [pid 24433:tid 24438] [client 128.199.182.55:35960] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api/swagger.json"] [unique_id "aUOwFZ4pN9ycmipm8TibyAAAAQI"]
[Thu Dec 18 15:41:11.068382 2025] [:error] [pid 12383:tid 12399] [client 128.199.182.55:35974] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/@vite/env"] [unique_id "aUOwF_dgllo9h1cyxGaKbgAAAs0"]
[Thu Dec 18 15:41:11.988401 2025] [:error] [pid 24958:tid 24976] [client 128.199.182.55:35988] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aUOwF8kDOrUkd0wNm2GS_gAAAY8"]
[Thu Dec 18 15:41:13.003598 2025] [:error] [pid 24433:tid 24460] [client 128.199.182.55:36000] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aUOwGZ4pN9ycmipm8TibzAAAARg"]
[Thu Dec 18 15:41:13.995870 2025] [:error] [pid 23558:tid 23639] [client 128.199.182.55:36008] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aUOwGeHam9NbgPQa9ua6PAAAANg"]
[Thu Dec 18 15:41:15.987423 2025] [:error] [pid 23645:tid 23656] [client 128.199.182.55:36012] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aUOwGzf_Rx0Y0ao_QJgYcgAAAIk"]
[Thu Dec 18 15:41:16.995694 2025] [:error] [pid 24433:tid 24454] [client 128.199.182.55:36014] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aUOwHJ4pN9ycmipm8Tib0QAAARI"]
[Thu Dec 18 15:41:18.036217 2025] [:error] [pid 12035:tid 12058] [client 128.199.182.55:36022] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aUOwHrcVHrNSHjCo-0pdsQAAAg8"]
[Thu Dec 18 15:41:19.032383 2025] [:error] [pid 23558:tid 23637] [client 128.199.182.55:36038] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUOwH-Ham9NbgPQa9ua6QAAAANY"]
[Thu Dec 18 15:41:20.134048 2025] [:error] [pid 24542:tid 24553] [client 128.199.182.55:50768] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aUOwIEtQz4H2oS3NrDalfwAAAUk"]
[Thu Dec 18 15:41:21.029878 2025] [:error] [pid 24958:tid 24962] [client 128.199.182.55:50776] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aUOwIckDOrUkd0wNm2GS_wAAAYE"]
[Thu Dec 18 15:41:22.041971 2025] [:error] [pid 12035:tid 12063] [client 128.199.182.55:50792] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_all_dbs"] [unique_id "aUOwIrcVHrNSHjCo-0pdtAAAAhQ"]
[Thu Dec 18 15:41:23.035583 2025] [:error] [pid 23556:tid 23580] [client 128.199.182.55:50806] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aUOwIxnmLlk3u5yt9kGhXwAAABQ"]
[Thu Dec 18 15:41:24.043878 2025] [:error] [pid 23558:tid 23620] [client 128.199.182.55:50822] [client 128.199.182.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aUOwJOHam9NbgPQa9ua6TAAAAMU"]
[Thu Dec 18 15:41:26.112504 2025] [:error] [pid 12239:tid 12247] [client 128.199.182.55:50832] [client 128.199.182.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aUOwJtNnXxfGIuWO6anAHwAAAoM"]
[Thu Dec 18 15:41:27.048495 2025] [:error] [pid 12383:tid 12392] [client 128.199.182.55:50842] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUOwJ_dgllo9h1cyxGaKeAAAAsY"]
[Thu Dec 18 15:41:28.042267 2025] [:error] [pid 23645:tid 23660] [client 128.199.182.55:50858] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aUOwKDf_Rx0Y0ao_QJgYdwAAAI0"]
[Thu Dec 18 15:41:29.042926 2025] [:error] [pid 23645:tid 23663] [client 128.199.182.55:50868] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aUOwKTf_Rx0Y0ao_QJgYeAAAAJA"]
[Thu Dec 18 15:41:30.043895 2025] [:error] [pid 12035:tid 12062] [client 128.199.182.55:57354] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aUOwKrcVHrNSHjCo-0pdvgAAAhM"]
[Thu Dec 18 15:41:31.091909 2025] [:error] [pid 23645:tid 23653] [client 128.199.182.55:57368] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUOwKzf_Rx0Y0ao_QJgYegAAAIY"]
[Thu Dec 18 16:45:45.078275 2025] [:error] [pid 12239:tid 12256] [client 36.41.75.167:46988] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUO_OdNnXxfGIuWO6anO_QAAAow"]
[Thu Dec 18 19:17:10.231600 2025] [:error] [pid 12239:tid 12245] [client 43.157.46.118:51020] [client 43.157.46.118] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUPittNnXxfGIuWO6an15QAAAoE"]
[Fri Dec 19 01:46:10.238906 2025] [:error] [pid 45739:tid 45804] [client 170.64.150.152:44644] [client 170.64.150.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aUQ94uIfOvWlLwqW0X3v2gAAAQk"]
[Fri Dec 19 01:46:11.110683 2025] [:error] [pid 45825:tid 45834] [client 170.64.150.152:44648] [client 170.64.150.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aUQ949ES1ifyzuzFwz8mkgAAAEc"]
[Fri Dec 19 05:27:53.424762 2025] [:error] [pid 62008:tid 62020] [client 36.41.75.167:42862] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aURx2ZJCOG7NAlbm_ORdcgAAAMk"]
[Fri Dec 19 09:10:04.911646 2025] [:error] [pid 41858:tid 41881] [client 43.166.247.155:34434] [client 43.166.247.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUSl7J0PV23R6CcTulWi-wAAAFU"]
[Fri Dec 19 10:05:05.570876 2025] [:error] [pid 41889:tid 41904] [client 43.157.98.187:41702] [client 43.157.98.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUSy0YD4vChTJK38lbYPpQAAAQU"]
[Fri Dec 19 12:28:46.876294 2025] [:error] [pid 20675:tid 20707] [client 43.159.149.56:55054] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUTUfrMyJ3XqeDRsbQm1CwAAARM"]
[Fri Dec 19 17:50:54.731745 2025] [:error] [pid 20675:tid 20706] [client 223.15.245.170:43429] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUUf_rMyJ3XqeDRsbQlJWQAAARI"]
[Fri Dec 19 21:15:14.091816 2025] [:error] [pid 16026:tid 16031] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Fri Dec 19 21:15:14.222006 2025] [:error] [pid 16026:tid 16045] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Fri Dec 19 21:15:15.811755 2025] [:error] [pid 16026:tid 16045] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Dec 19 21:15:15.929562 2025] [:error] [pid 16026:tid 16043] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Dec 19 21:15:16.047617 2025] [:error] [pid 16026:tid 16035] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Fri Dec 19 21:15:16.617084 2025] [:error] [pid 16026:tid 16034] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Dec 19 21:15:16.742216 2025] [:error] [pid 16026:tid 16041] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Dec 19 21:15:16.860998 2025] [:error] [pid 16026:tid 16032] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Fri Dec 19 21:15:16.995824 2025] [:error] [pid 16026:tid 16037] [client 4.189.163.214:30075] File does not exist: /usr/local/apache/htdocs/suspended-page/cord.php
[Fri Dec 19 21:15:17.135297 2025] [:error] [pid 16026:tid 16049] [client 4.189.163.214:30075] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aUVP5ULVfhf4Jb3enmM_OAAAAVQ"]
[Fri Dec 19 21:15:18.305006 2025] [:error] [pid 20582:tid 20651] [client 4.189.163.214:30287] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aUVP5spAnrkQKZ4b5gY-ggAAAMk"]
[Fri Dec 19 21:15:18.812461 2025] [:error] [pid 18438:tid 18449] [client 4.189.163.214:30051] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aUVP5pRArClWV1iij_Sb4QAAAYg"]
[Fri Dec 19 21:15:19.856290 2025] [:error] [pid 20675:tid 20691] [client 4.189.163.214:37903] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aUVP57MyJ3XqeDRsbQmk8gAAAQM"]
[Fri Dec 19 21:15:20.755134 2025] [:error] [pid 16026:tid 16051] [client 4.189.163.214:32157] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aUVP6ELVfhf4Jb3enmM_OQAAAVY"]
[Fri Dec 19 21:15:21.916643 2025] [:error] [pid 16026:tid 16042] [client 4.189.163.214:27390] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aUVP6ULVfhf4Jb3enmM_OwAAAU0"]
[Fri Dec 19 21:15:23.761615 2025] [:error] [pid 16026:tid 16038] [client 4.189.163.214:4198] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aUVP60LVfhf4Jb3enmM_PAAAAUk"]
[Fri Dec 19 21:15:25.835584 2025] [:error] [pid 18438:tid 18445] [client 4.189.163.214:51299] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aUVP7ZRArClWV1iij_Sb6wAAAYQ"]
[Fri Dec 19 21:15:27.472376 2025] [:error] [pid 20581:tid 20615] [client 4.189.163.214:28516] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUVP7_xEv7WXNhnFD1mMkAAAAIA"]
[Fri Dec 19 21:15:28.867563 2025] [:error] [pid 20580:tid 20587] [client 4.189.163.214:30172] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUVP8Emd1op_YdAdgR2nQgAAAEE"]
[Fri Dec 19 21:15:30.590682 2025] [:error] [pid 20675:tid 20697] [client 4.189.163.214:30364] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUVP8rMyJ3XqeDRsbQmk-AAAAQk"]
[Fri Dec 19 21:15:31.449658 2025] [:error] [pid 41451:tid 41456] [client 4.189.163.214:30337] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUVP8wYXFn-DbZghZBHjKwAAAAI"]
[Fri Dec 19 21:15:32.229369 2025] [:error] [pid 41451:tid 41470] [client 4.189.163.214:30368] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aUVP9AYXFn-DbZghZBHjLQAAABA"]
[Fri Dec 19 21:15:33.094470 2025] [:error] [pid 20675:tid 20700] [client 4.189.163.214:4408] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aUVP9bMyJ3XqeDRsbQmk-wAAAQw"]
[Fri Dec 19 21:15:35.019639 2025] [:error] [pid 16026:tid 16037] [client 4.189.163.214:4753] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aUVP90LVfhf4Jb3enmM_SQAAAUg"]
[Fri Dec 19 21:15:37.808925 2025] [:error] [pid 16026:tid 16029] [client 4.189.163.214:25724] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aUVP-ULVfhf4Jb3enmM_TwAAAUA"]
[Fri Dec 19 21:15:39.346583 2025] [:error] [pid 20580:tid 20591] [client 4.189.163.214:29964] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aUVP-0md1op_YdAdgR2nSAAAAEU"]
[Fri Dec 19 21:15:40.186310 2025] [:error] [pid 16026:tid 16044] [client 4.189.163.214:27857] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aUVP_ELVfhf4Jb3enmM_UAAAAU8"]
[Fri Dec 19 21:15:41.632080 2025] [:error] [pid 20580:tid 20602] [client 4.189.163.214:29990] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aUVP_Umd1op_YdAdgR2nTAAAAFA"]
[Fri Dec 19 21:15:42.741774 2025] [:error] [pid 20580:tid 20589] [client 4.189.163.214:34106] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aUVP_kmd1op_YdAdgR2nTwAAAEM"]
[Fri Dec 19 21:15:45.163631 2025] [:error] [pid 20581:tid 20615] [client 4.189.163.214:34077] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aUVQAfxEv7WXNhnFD1mMnAAAAIA"]
[Fri Dec 19 21:15:46.114353 2025] [:error] [pid 20675:tid 20701] [client 4.189.163.214:34809] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aUVQArMyJ3XqeDRsbQmlAgAAAQ0"]
[Fri Dec 19 21:15:48.246519 2025] [:error] [pid 20675:tid 20689] [client 4.189.163.214:29989] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aUVQBLMyJ3XqeDRsbQmlAwAAAQE"]
[Fri Dec 19 21:15:49.836452 2025] [:error] [pid 20580:tid 20592] [client 4.189.163.214:4847] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aUVQBUmd1op_YdAdgR2nVgAAAEY"]
[Fri Dec 19 21:15:50.596204 2025] [:error] [pid 18438:tid 18459] [client 4.189.163.214:31101] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aUVQBpRArClWV1iij_Sb_wAAAZI"]
[Fri Dec 19 21:15:51.136676 2025] [:error] [pid 18438:tid 18445] [client 4.189.163.214:37080] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aUVQB5RArClWV1iij_ScAwAAAYQ"]
[Fri Dec 19 21:15:51.797615 2025] [:error] [pid 16026:tid 16043] [client 4.189.163.214:32097] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aUVQB0LVfhf4Jb3enmM_XgAAAU4"]
[Fri Dec 19 21:15:53.963427 2025] [:error] [pid 16026:tid 16041] [client 4.189.163.214:4447] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aUVQCULVfhf4Jb3enmM_YgAAAUw"]
[Fri Dec 19 21:15:54.733941 2025] [:error] [pid 20582:tid 20645] [client 4.189.163.214:37083] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aUVQCspAnrkQKZ4b5gY-oQAAAMM"]
[Fri Dec 19 21:15:55.645195 2025] [:error] [pid 16026:tid 16042] [client 4.189.163.214:37057] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aUVQC0LVfhf4Jb3enmM_ZQAAAU0"]
[Fri Dec 19 21:15:56.149383 2025] [:error] [pid 20675:tid 20699] [client 4.189.163.214:31046] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aUVQDLMyJ3XqeDRsbQmlDgAAAQs"]
[Fri Dec 19 21:15:56.872414 2025] [:error] [pid 20581:tid 20616] [client 4.189.163.214:29674] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aUVQDPxEv7WXNhnFD1mMpwAAAIE"]
[Fri Dec 19 21:15:57.490933 2025] [:error] [pid 20675:tid 20694] [client 4.189.163.214:36470] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aUVQDbMyJ3XqeDRsbQmlEQAAAQY"]
[Fri Dec 19 21:15:58.438759 2025] [:error] [pid 20675:tid 20701] [client 4.189.163.214:32766] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aUVQDrMyJ3XqeDRsbQmlEwAAAQ0"]
[Fri Dec 19 21:15:59.074585 2025] [:error] [pid 16026:tid 16044] [client 4.189.163.214:50849] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aUVQD0LVfhf4Jb3enmM_aQAAAU8"]
[Fri Dec 19 21:16:00.601080 2025] [:error] [pid 20580:tid 20602] [client 4.189.163.214:4471] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aUVQEEmd1op_YdAdgR2nWwAAAFA"]
[Fri Dec 19 21:16:02.111437 2025] [:error] [pid 20675:tid 20701] [client 4.189.163.214:36443] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aUVQErMyJ3XqeDRsbQmlHgAAAQ0"]
[Fri Dec 19 21:16:03.655399 2025] [:error] [pid 20580:tid 20596] [client 4.189.163.214:29654] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aUVQE0md1op_YdAdgR2nYwAAAEo"]
[Fri Dec 19 21:16:05.538880 2025] [:error] [pid 20582:tid 20662] [client 4.189.163.214:26000] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aUVQFcpAnrkQKZ4b5gY-tQAAANQ"]
[Fri Dec 19 21:16:06.569019 2025] [:error] [pid 18438:tid 18448] [client 4.189.163.214:26018] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aUVQFpRArClWV1iij_ScJQAAAYc"]
[Fri Dec 19 21:16:07.420194 2025] [:error] [pid 18438:tid 18455] [client 4.189.163.214:31841] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aUVQF5RArClWV1iij_ScKQAAAY4"]
[Fri Dec 19 21:16:08.678940 2025] [:error] [pid 20582:tid 20655] [client 4.189.163.214:50850] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aUVQGMpAnrkQKZ4b5gY-uwAAAM0"]
[Fri Dec 19 21:16:10.044380 2025] [:error] [pid 20582:tid 20652] [client 4.189.163.214:31834] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aUVQGspAnrkQKZ4b5gY-vQAAAMo"]
[Fri Dec 19 21:16:10.651757 2025] [:error] [pid 16026:tid 16049] [client 4.189.163.214:4469] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aUVQGkLVfhf4Jb3enmM_pQAAAVQ"]
[Fri Dec 19 21:16:12.304498 2025] [:error] [pid 16026:tid 16031] [client 4.189.163.214:29036] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hugo.php"] [unique_id "aUVQHELVfhf4Jb3enmM_sQAAAUI"]
[Fri Dec 19 21:16:13.549314 2025] [:error] [pid 18438:tid 18455] [client 4.189.163.214:29027] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hugo.php"] [unique_id "aUVQHZRArClWV1iij_ScNwAAAY4"]
[Fri Dec 19 21:16:14.735340 2025] [:error] [pid 16026:tid 16046] [client 4.189.163.214:30209] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hugo.php"] [unique_id "aUVQHkLVfhf4Jb3enmM_vgAAAVE"]
[Fri Dec 19 21:16:16.293607 2025] [:error] [pid 20581:tid 20639] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/hugo.php
[Fri Dec 19 21:16:16.474620 2025] [:error] [pid 20581:tid 20627] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/ava.php
[Fri Dec 19 21:16:16.612741 2025] [:error] [pid 20581:tid 20618] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/lzyrj.php
[Fri Dec 19 21:16:16.744461 2025] [:error] [pid 20581:tid 20623] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/laudq.php
[Fri Dec 19 21:16:16.880289 2025] [:error] [pid 20581:tid 20616] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/anjay.php
[Fri Dec 19 21:16:17.007806 2025] [:error] [pid 20581:tid 20621] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/let.php
[Fri Dec 19 21:16:17.137391 2025] [:error] [pid 20581:tid 20631] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Fri Dec 19 21:16:17.411767 2025] [:error] [pid 20581:tid 20620] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Dec 19 21:16:17.539895 2025] [:error] [pid 20581:tid 20638] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Fri Dec 19 21:16:17.670660 2025] [:error] [pid 20581:tid 20629] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Fri Dec 19 21:16:17.801854 2025] [:error] [pid 20581:tid 20628] [client 4.189.163.214:29460] File does not exist: /usr/local/apache/htdocs/suspended-page/abe.php
[Fri Dec 19 21:16:18.114755 2025] [:error] [pid 20581:tid 20636] [client 4.189.163.214:29460] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aUVQIvxEv7WXNhnFD1mMxAAAAJU"]
[Fri Dec 19 21:16:19.011351 2025] [:error] [pid 18438:tid 18463] [client 4.189.163.214:35310] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aUVQI5RArClWV1iij_ScRwAAAZY"]
[Fri Dec 19 21:16:19.677913 2025] [:error] [pid 16026:tid 16038] [client 4.189.163.214:32349] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aUVQI0LVfhf4Jb3enmM_2AAAAUk"]
[Fri Dec 19 21:16:21.753170 2025] [:error] [pid 41451:tid 41468] [client 4.189.163.214:38129] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aUVQJQYXFn-DbZghZBHjdgAAAA4"]
[Fri Dec 19 21:16:22.186386 2025] [:error] [pid 18438:tid 18464] [client 4.189.163.214:26868] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aUVQJpRArClWV1iij_ScVgAAAZc"]
[Fri Dec 19 21:16:23.670670 2025] [:error] [pid 18438:tid 18441] [client 4.189.163.214:31108] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aUVQJ5RArClWV1iij_ScWwAAAYA"]
[Fri Dec 19 21:16:24.598219 2025] [:error] [pid 20581:tid 20619] [client 4.189.163.214:29467] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aUVQKPxEv7WXNhnFD1mMygAAAIQ"]
[Fri Dec 19 21:16:25.695138 2025] [:error] [pid 16026:tid 16032] [client 4.189.163.214:31282] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aUVQKULVfhf4Jb3enmM_7wAAAUM"]
[Fri Dec 19 21:16:27.141336 2025] [:error] [pid 41451:tid 41468] [client 4.189.163.214:32375] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUVQKwYXFn-DbZghZBHjhQAAAA4"]
[Fri Dec 19 21:16:28.018050 2025] [:error] [pid 16026:tid 16030] [client 4.189.163.214:31134] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUVQLELVfhf4Jb3enmM_9QAAAUE"]
[Fri Dec 19 21:16:28.755191 2025] [:error] [pid 18438:tid 18462] [client 4.189.163.214:31269] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUVQLJRArClWV1iij_ScZwAAAZU"]
[Fri Dec 19 21:16:29.646091 2025] [:error] [pid 20581:tid 20615] [client 4.189.163.214:38086] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUVQLfxEv7WXNhnFD1mM1gAAAIA"]
[Fri Dec 19 21:16:30.328178 2025] [:error] [pid 41451:tid 41478] [client 4.189.163.214:32324] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aUVQLgYXFn-DbZghZBHjkQAAABg"]
[Fri Dec 19 21:16:31.068355 2025] [:error] [pid 20580:tid 20605] [client 4.189.163.214:31815] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aUVQL0md1op_YdAdgR2nhwAAAFM"]
[Fri Dec 19 21:16:32.070117 2025] [:error] [pid 20581:tid 20630] [client 4.189.163.214:32369] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aUVQMPxEv7WXNhnFD1mM2AAAAI8"]
[Fri Dec 19 21:16:33.083353 2025] [:error] [pid 20580:tid 20596] [client 4.189.163.214:38097] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aUVQMUmd1op_YdAdgR2njwAAAEo"]
[Fri Dec 19 21:16:34.036347 2025] [:error] [pid 20582:tid 20663] [client 4.189.163.214:32338] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQMspAnrkQKZ4b5gY-4AAAANU"]
[Fri Dec 19 21:16:35.301341 2025] [:error] [pid 41451:tid 41476] [client 4.189.163.214:29048] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQMwYXFn-DbZghZBHjngAAABY"]
[Fri Dec 19 21:16:36.508175 2025] [:error] [pid 18438:tid 18453] [client 4.189.163.214:38113] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQNJRArClWV1iij_ScegAAAYw"]
[Fri Dec 19 21:16:37.407740 2025] [:error] [pid 20582:tid 20649] [client 4.189.163.214:29196] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQNcpAnrkQKZ4b5gY-5gAAAMc"]
[Fri Dec 19 21:16:37.945942 2025] [:error] [pid 20675:tid 20710] [client 4.189.163.214:29468] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUVQNbMyJ3XqeDRsbQmlcQAAARY"]
[Fri Dec 19 21:16:38.596936 2025] [:error] [pid 16026:tid 16049] [client 4.189.163.214:26862] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUVQNkLVfhf4Jb3enmNAEAAAAVQ"]
[Fri Dec 19 21:16:39.452023 2025] [:error] [pid 18438:tid 18448] [client 4.189.163.214:31133] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUVQN5RArClWV1iij_ScgQAAAYc"]
[Fri Dec 19 21:16:41.350341 2025] [:error] [pid 20580:tid 20598] [client 4.189.163.214:29234] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUVQOUmd1op_YdAdgR2nngAAAEw"]
[Fri Dec 19 21:16:42.740538 2025] [:error] [pid 20675:tid 20697] [client 4.189.163.214:29019] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUVQOrMyJ3XqeDRsbQmlgQAAAQk"]
[Fri Dec 19 21:16:45.011526 2025] [:error] [pid 20580:tid 20592] [client 4.189.163.214:31816] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUVQPUmd1op_YdAdgR2nqAAAAEY"]
[Fri Dec 19 21:16:46.400445 2025] [:error] [pid 20675:tid 20704] [client 4.189.163.214:33832] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUVQPrMyJ3XqeDRsbQmllAAAARA"]
[Fri Dec 19 21:16:46.783529 2025] [:error] [pid 16026:tid 16031] [client 4.189.163.214:31125] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUVQPkLVfhf4Jb3enmNALQAAAUI"]
[Fri Dec 19 21:16:47.191681 2025] [:error] [pid 41451:tid 41469] [client 4.189.163.214:33798] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aUVQPwYXFn-DbZghZBHjuAAAAA8"]
[Fri Dec 19 21:16:47.978867 2025] [:error] [pid 20582:tid 20657] [client 4.189.163.214:38091] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aUVQP8pAnrkQKZ4b5gY_DQAAAM8"]
[Fri Dec 19 21:16:48.710980 2025] [:error] [pid 41451:tid 41456] [client 4.189.163.214:29034] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aUVQQAYXFn-DbZghZBHjuwAAAAI"]
[Fri Dec 19 21:16:50.057800 2025] [:error] [pid 41451:tid 41476] [client 4.189.163.214:29485] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aUVQQgYXFn-DbZghZBHjwAAAABY"]
[Fri Dec 19 21:16:52.348073 2025] [:error] [pid 20581:tid 20622] [client 4.189.163.214:26043] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQRPxEv7WXNhnFD1mNAAAAAIc"]
[Fri Dec 19 21:16:53.177176 2025] [:error] [pid 41451:tid 41465] [client 4.189.163.214:26841] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQRQYXFn-DbZghZBHjxgAAAAs"]
[Fri Dec 19 21:16:53.733192 2025] [:error] [pid 41451:tid 41455] [client 4.189.163.214:29005] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQRQYXFn-DbZghZBHjxwAAAAE"]
[Fri Dec 19 21:16:55.201798 2025] [:error] [pid 20582:tid 20649] [client 4.189.163.214:35667] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQR8pAnrkQKZ4b5gY_GAAAAMc"]
[Fri Dec 19 21:16:55.997913 2025] [:error] [pid 20580:tid 20594] [client 4.189.163.214:32359] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUVQR0md1op_YdAdgR2nvQAAAEg"]
[Fri Dec 19 21:16:57.035832 2025] [:error] [pid 18438:tid 18463] [client 4.189.163.214:29195] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUVQSZRArClWV1iij_ScpQAAAZY"]
[Fri Dec 19 21:16:58.519577 2025] [:error] [pid 20582:tid 20652] [client 4.189.163.214:29455] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUVQSspAnrkQKZ4b5gY_GwAAAMo"]
[Fri Dec 19 21:16:59.728302 2025] [:error] [pid 20675:tid 20712] [client 4.189.163.214:26837] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUVQS7MyJ3XqeDRsbQmlpQAAARg"]
[Fri Dec 19 21:17:00.295718 2025] [:error] [pid 41451:tid 41477] [client 4.189.163.214:30120] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aUVQTAYXFn-DbZghZBHj0wAAABc"]
[Fri Dec 19 21:17:01.655602 2025] [:error] [pid 18438:tid 18461] [client 4.189.163.214:35679] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aUVQTZRArClWV1iij_ScsAAAAZQ"]
[Fri Dec 19 21:17:03.019857 2025] [:error] [pid 16026:tid 16037] [client 4.189.163.214:35686] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aUVQT0LVfhf4Jb3enmNASQAAAUg"]
[Fri Dec 19 21:17:04.248889 2025] [:error] [pid 20581:tid 20630] [client 4.189.163.214:29245] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aUVQUPxEv7WXNhnFD1mNGQAAAI8"]
[Fri Dec 19 21:17:05.238818 2025] [:error] [pid 20580:tid 20604] [client 4.189.163.214:29448] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aUVQUUmd1op_YdAdgR2nxQAAAFI"]
[Fri Dec 19 21:17:06.471058 2025] [:error] [pid 18438:tid 18464] [client 4.189.163.214:26828] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aUVQUpRArClWV1iij_ScuAAAAZc"]
[Fri Dec 19 21:17:08.536948 2025] [:error] [pid 20675:tid 20705] [client 4.189.163.214:35666] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aUVQVLMyJ3XqeDRsbQmlrAAAARE"]
[Fri Dec 19 21:17:09.912492 2025] [:error] [pid 18438:tid 18443] [client 4.189.163.214:29495] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aUVQVZRArClWV1iij_ScvAAAAYI"]
[Fri Dec 19 21:17:11.331840 2025] [:error] [pid 41451:tid 41456] [client 4.189.163.214:26459] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUVQVwYXFn-DbZghZBHj3gAAAAI"]
[Fri Dec 19 21:17:13.141681 2025] [:error] [pid 20582:tid 20659] [client 4.189.163.214:38139] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUVQWcpAnrkQKZ4b5gY_KgAAANE"]
[Fri Dec 19 21:17:14.023042 2025] [:error] [pid 16026:tid 16033] [client 4.189.163.214:26493] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUVQWkLVfhf4Jb3enmNATwAAAUQ"]
[Fri Dec 19 21:17:14.758254 2025] [:error] [pid 20581:tid 20622] [client 4.189.163.214:31237] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUVQWvxEv7WXNhnFD1mNHwAAAIc"]
[Fri Dec 19 21:17:15.449538 2025] [:error] [pid 16026:tid 16042] [client 4.189.163.214:38770] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aUVQW0LVfhf4Jb3enmNAUgAAAU0"]
[Fri Dec 19 21:17:16.716352 2025] [:error] [pid 20582:tid 20662] [client 4.189.163.214:29004] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aUVQXMpAnrkQKZ4b5gY_LwAAANQ"]
[Fri Dec 19 21:17:18.135269 2025] [:error] [pid 20675:tid 20706] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Dec 19 21:17:18.291838 2025] [:error] [pid 20675:tid 20708] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Dec 19 21:17:18.437484 2025] [:error] [pid 20675:tid 20689] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/uana.php
[Fri Dec 19 21:17:18.594031 2025] [:error] [pid 20675:tid 20702] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Dec 19 21:17:18.761258 2025] [:error] [pid 20675:tid 20691] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Fri Dec 19 21:17:18.922510 2025] [:error] [pid 20675:tid 20698] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php
[Fri Dec 19 21:17:19.341167 2025] [:error] [pid 20675:tid 20695] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Dec 19 21:17:19.485080 2025] [:error] [pid 20675:tid 20688] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Dec 19 21:17:19.802254 2025] [:error] [pid 20675:tid 20693] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Dec 19 21:17:19.953955 2025] [:error] [pid 20675:tid 20692] [client 4.189.163.214:35659] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Fri Dec 19 21:17:20.105299 2025] [:error] [pid 20675:tid 20699] [client 4.189.163.214:35659] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aUVQYLMyJ3XqeDRsbQmlvAAAAQs"]
[Fri Dec 19 21:17:21.002524 2025] [:error] [pid 20582:tid 20648] [client 4.189.163.214:50914] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aUVQYcpAnrkQKZ4b5gY_OAAAAMY"]
[Fri Dec 19 21:17:22.012621 2025] [:error] [pid 20675:tid 20704] [client 4.189.163.214:38759] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aUVQYrMyJ3XqeDRsbQmlvgAAARA"]
[Fri Dec 19 21:17:22.926620 2025] [:error] [pid 20675:tid 20709] [client 4.189.163.214:38102] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aUVQYrMyJ3XqeDRsbQmlvwAAARU"]
[Fri Dec 19 21:17:24.053708 2025] [:error] [pid 16026:tid 16053] [client 4.189.163.214:30118] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aUVQZELVfhf4Jb3enmNAWgAAAVg"]
[Fri Dec 19 21:17:25.701465 2025] [:error] [pid 20582:tid 20662] [client 4.189.163.214:26445] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aUVQZcpAnrkQKZ4b5gY_PAAAANQ"]
[Fri Dec 19 21:17:27.175711 2025] [:error] [pid 20675:tid 20690] [client 4.189.163.214:35701] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aUVQZ7MyJ3XqeDRsbQmlwwAAAQI"]
[Fri Dec 19 21:17:28.146410 2025] [:error] [pid 41451:tid 41455] [client 4.189.163.214:35291] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aUVQaAYXFn-DbZghZBHj7wAAAAE"]
[Fri Dec 19 21:17:30.119383 2025] [:error] [pid 20582:tid 20665] [client 4.189.163.214:31248] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUVQaspAnrkQKZ4b5gY_QQAAANc"]
[Fri Dec 19 21:17:32.308045 2025] [:error] [pid 18438:tid 18463] [client 4.189.163.214:31251] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUVQbJRArClWV1iij_Sc1AAAAZY"]
[Fri Dec 19 21:17:33.015285 2025] [:error] [pid 16026:tid 16035] [client 4.189.163.214:31256] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUVQbULVfhf4Jb3enmNAXQAAAUY"]
[Fri Dec 19 21:17:34.442290 2025] [:error] [pid 18438:tid 18458] [client 4.189.163.214:35269] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aUVQbpRArClWV1iij_Sc1gAAAZE"]
[Fri Dec 19 21:17:35.720778 2025] [:error] [pid 20582:tid 20650] [client 4.189.163.214:35684] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aUVQb8pAnrkQKZ4b5gY_RgAAAMg"]
[Fri Dec 19 21:17:37.035429 2025] [:error] [pid 16026:tid 16051] [client 4.189.163.214:30090] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aUVQcULVfhf4Jb3enmNAbQAAAVY"]
[Fri Dec 19 21:17:38.137896 2025] [:error] [pid 20582:tid 20649] [client 4.189.163.214:36162] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aUVQcspAnrkQKZ4b5gY_SgAAAMc"]
[Fri Dec 19 21:17:40.565738 2025] [:error] [pid 18438:tid 18450] [client 4.189.163.214:30121] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aUVQdJRArClWV1iij_Sc4wAAAYk"]
[Fri Dec 19 21:17:41.575160 2025] [:error] [pid 20675:tid 20690] [client 4.189.163.214:38782] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUVQdbMyJ3XqeDRsbQml0wAAAQI"]
[Fri Dec 19 21:17:42.893534 2025] [:error] [pid 20675:tid 20711] [client 4.189.163.214:37363] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUVQdrMyJ3XqeDRsbQml1QAAARc"]
[Fri Dec 19 21:17:45.543411 2025] [:error] [pid 20675:tid 20688] [client 4.189.163.214:29061] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUVQebMyJ3XqeDRsbQml2QAAAQA"]
[Fri Dec 19 21:17:47.516079 2025] [:error] [pid 20675:tid 20710] [client 4.189.163.214:33783] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUVQe7MyJ3XqeDRsbQml3wAAARY"]
[Fri Dec 19 21:17:49.822765 2025] [:error] [pid 20675:tid 20705] [client 4.189.163.214:29064] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aUVQfbMyJ3XqeDRsbQml4QAAARE"]
[Fri Dec 19 21:17:51.100924 2025] [:error] [pid 20582:tid 20645] [client 4.189.163.214:4899] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aUVQf8pAnrkQKZ4b5gY_ZAAAAMM"]
[Fri Dec 19 21:17:52.472620 2025] [:error] [pid 20580:tid 20587] [client 4.189.163.214:33784] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aUVQgEmd1op_YdAdgR2n5QAAAEE"]
[Fri Dec 19 21:17:53.407564 2025] [:error] [pid 41451:tid 41468] [client 4.189.163.214:36214] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aUVQgQYXFn-DbZghZBHj_wAAAA4"]
[Fri Dec 19 21:17:54.549699 2025] [:error] [pid 20581:tid 20625] [client 4.189.163.214:37373] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aUVQgvxEv7WXNhnFD1mNRwAAAIo"]
[Fri Dec 19 21:17:56.953916 2025] [:error] [pid 20582:tid 20642] [client 4.189.163.214:36174] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aUVQhMpAnrkQKZ4b5gY_awAAAMA"]
[Fri Dec 19 21:17:58.904297 2025] [:error] [pid 20582:tid 20662] [client 4.189.163.214:30133] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aUVQhspAnrkQKZ4b5gY_cAAAANQ"]
[Fri Dec 19 21:17:59.559278 2025] [:error] [pid 16026:tid 16032] [client 4.189.163.214:50943] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aUVQh0LVfhf4Jb3enmNAvgAAAUM"]
[Fri Dec 19 21:18:00.990501 2025] [:error] [pid 41451:tid 41465] [client 4.189.163.214:37341] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aUVQiAYXFn-DbZghZBHkDgAAAAs"]
[Fri Dec 19 21:18:03.364226 2025] [:error] [pid 16026:tid 16041] [client 4.189.163.214:37339] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aUVQi0LVfhf4Jb3enmNAxQAAAUw"]
[Fri Dec 19 21:18:04.820968 2025] [:error] [pid 20581:tid 20627] [client 4.189.163.214:36739] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aUVQjPxEv7WXNhnFD1mNWgAAAIw"]
[Fri Dec 19 21:18:06.543358 2025] [:error] [pid 20582:tid 20644] [client 4.189.163.214:29058] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aUVQjspAnrkQKZ4b5gY_eAAAAMI"]
[Fri Dec 19 21:18:08.279936 2025] [:error] [pid 41451:tid 41471] [client 4.189.163.214:37316] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aUVQkAYXFn-DbZghZBHkEwAAABE"]
[Fri Dec 19 21:18:09.224219 2025] [:error] [pid 41451:tid 41476] [client 4.189.163.214:29546] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aUVQkQYXFn-DbZghZBHkFgAAABY"]
[Fri Dec 19 21:18:10.111763 2025] [:error] [pid 18438:tid 18455] [client 4.189.163.214:26269] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aUVQkpRArClWV1iij_SdGQAAAY4"]
[Fri Dec 19 21:18:11.255593 2025] [:error] [pid 16026:tid 16052] [client 4.189.163.214:4916] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aUVQk0LVfhf4Jb3enmNA0QAAAVc"]
[Fri Dec 19 21:18:12.208507 2025] [:error] [pid 20580:tid 20608] [client 4.189.163.214:29092] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aUVQlEmd1op_YdAdgR2oBwAAAFY"]
[Fri Dec 19 21:18:12.871283 2025] [:error] [pid 20581:tid 20616] [client 4.189.163.214:37319] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aUVQlPxEv7WXNhnFD1mNYQAAAIE"]
[Fri Dec 19 21:18:14.353395 2025] [:error] [pid 16026:tid 16040] [client 4.189.163.214:26272] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aUVQlkLVfhf4Jb3enmNA0wAAAUs"]
[Fri Dec 19 21:18:15.254643 2025] [:error] [pid 20580:tid 20605] [client 4.189.163.214:32798] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aUVQl0md1op_YdAdgR2oCgAAAFM"]
[Fri Dec 19 21:18:16.452363 2025] [:error] [pid 20580:tid 20602] [client 4.189.163.214:37323] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUVQmEmd1op_YdAdgR2oDwAAAFA"]
[Fri Dec 19 21:18:17.576013 2025] [:error] [pid 18438:tid 18444] [client 4.189.163.214:37364] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUVQmZRArClWV1iij_SdJgAAAYM"]
[Fri Dec 19 21:18:18.487635 2025] [:error] [pid 20582:tid 20651] [client 4.189.163.214:33781] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUVQmspAnrkQKZ4b5gY_gwAAAMk"]
[Fri Dec 19 21:18:20.052615 2025] [:error] [pid 16026:tid 16050] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Dec 19 21:18:20.787342 2025] [:error] [pid 16026:tid 16045] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/atom.php
[Fri Dec 19 21:18:20.952308 2025] [:error] [pid 16026:tid 16035] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/case.php
[Fri Dec 19 21:18:21.117801 2025] [:error] [pid 16026:tid 16053] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/docs.php
[Fri Dec 19 21:18:21.247022 2025] [:error] [pid 16026:tid 16036] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/ios.php
[Fri Dec 19 21:18:21.366954 2025] [:error] [pid 16026:tid 16030] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Fri Dec 19 21:18:21.490665 2025] [:error] [pid 16026:tid 16033] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Fri Dec 19 21:18:21.616446 2025] [:error] [pid 16026:tid 16052] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Dec 19 21:18:21.753478 2025] [:error] [pid 16026:tid 16048] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Dec 19 21:18:21.880934 2025] [:error] [pid 16026:tid 16038] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Dec 19 21:18:22.010075 2025] [:error] [pid 16026:tid 16032] [client 4.189.163.214:32768] File does not exist: /usr/local/apache/htdocs/suspended-page/goat1.php
[Fri Dec 19 21:18:22.151196 2025] [:error] [pid 16026:tid 16046] [client 4.189.163.214:32768] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aUVQnkLVfhf4Jb3enmNA6gAAAVE"]
[Fri Dec 19 21:18:23.447426 2025] [:error] [pid 18438:tid 18456] [client 4.189.163.214:37610] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aUVQn5RArClWV1iij_SdLAAAAY8"]
[Fri Dec 19 21:18:25.096468 2025] [:error] [pid 18438:tid 18462] [client 4.189.163.214:28850] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aUVQoZRArClWV1iij_SdLQAAAZU"]
[Fri Dec 19 21:18:26.229628 2025] [:error] [pid 16026:tid 16035] [client 4.189.163.214:29561] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aUVQokLVfhf4Jb3enmNA7wAAAUY"]
[Fri Dec 19 21:18:26.866929 2025] [:error] [pid 18438:tid 18448] [client 4.189.163.214:28816] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aUVQopRArClWV1iij_SdLwAAAYc"]
[Fri Dec 19 21:18:27.709037 2025] [:error] [pid 41451:tid 41465] [client 4.189.163.214:26294] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aUVQowYXFn-DbZghZBHkKQAAAAs"]
[Fri Dec 19 21:18:28.406060 2025] [:error] [pid 41451:tid 41477] [client 4.189.163.214:37614] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aUVQpAYXFn-DbZghZBHkKwAAABc"]
[Fri Dec 19 21:18:29.594923 2025] [:error] [pid 18438:tid 18463] [client 4.189.163.214:29560] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aUVQpZRArClWV1iij_SdMwAAAZY"]
[Fri Dec 19 21:18:31.282420 2025] [:error] [pid 18438:tid 18444] [client 4.189.163.214:33760] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUVQp5RArClWV1iij_SdNgAAAYM"]
[Fri Dec 19 21:18:32.129084 2025] [:error] [pid 20581:tid 20616] [client 4.189.163.214:37327] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUVQqPxEv7WXNhnFD1mNbgAAAIE"]
[Fri Dec 19 21:18:33.594533 2025] [:error] [pid 20582:tid 20656] [client 4.189.163.214:36741] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUVQqcpAnrkQKZ4b5gY_kAAAAM4"]
[Fri Dec 19 21:18:35.228612 2025] [:error] [pid 16026:tid 16029] [client 4.189.163.214:29833] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUVQq0LVfhf4Jb3enmNA-AAAAUA"]
[Fri Dec 19 21:18:36.356003 2025] [:error] [pid 20675:tid 20706] [client 4.189.163.214:28843] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQrLMyJ3XqeDRsbQmmBgAAARI"]
[Fri Dec 19 21:18:37.964667 2025] [:error] [pid 16026:tid 16045] [client 4.189.163.214:33001] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQrULVfhf4Jb3enmNA-gAAAVA"]
[Fri Dec 19 21:18:39.158679 2025] [:error] [pid 16026:tid 16053] [client 4.189.163.214:29538] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQr0LVfhf4Jb3enmNA_QAAAVg"]
[Fri Dec 19 21:18:41.022247 2025] [:error] [pid 20580:tid 20601] [client 4.189.163.214:5051] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUVQsUmd1op_YdAdgR2oJgAAAE8"]
[Fri Dec 19 21:18:42.154817 2025] [:error] [pid 20675:tid 20693] [client 4.189.163.214:29871] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aUVQsrMyJ3XqeDRsbQmmBwAAAQU"]
[Fri Dec 19 21:18:43.262621 2025] [:error] [pid 20582:tid 20666] [client 4.189.163.214:26243] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aUVQs8pAnrkQKZ4b5gY_lgAAANg"]
[Fri Dec 19 21:18:45.102428 2025] [:error] [pid 18438:tid 18450] [client 4.189.163.214:29172] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aUVQtZRArClWV1iij_SdQwAAAYk"]
[Fri Dec 19 21:18:46.210517 2025] [:error] [pid 20675:tid 20692] [client 4.189.163.214:29432] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aUVQtrMyJ3XqeDRsbQmmCgAAAQQ"]
[Fri Dec 19 21:18:47.043952 2025] [:error] [pid 18438:tid 18460] [client 4.189.163.214:29862] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQt5RArClWV1iij_SdRwAAAZM"]
[Fri Dec 19 21:18:53.497652 2025] [:error] [pid 18438:tid 18457] [client 4.189.163.214:28810] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQvZRArClWV1iij_SdVgAAAZA"]
[Fri Dec 19 21:18:54.147708 2025] [:error] [pid 20580:tid 20589] [client 4.189.163.214:29888] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQvkmd1op_YdAdgR2oMAAAAEM"]
[Fri Dec 19 21:18:54.578063 2025] [:error] [pid 41451:tid 41466] [client 4.189.163.214:27576] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aUVQvgYXFn-DbZghZBHkNAAAAAw"]
[Fri Dec 19 21:18:56.978971 2025] [:error] [pid 20581:tid 20618] [client 4.189.163.214:37830] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aUVQwPxEv7WXNhnFD1mNgwAAAIM"]
[Fri Dec 19 21:18:57.923989 2025] [:error] [pid 18438:tid 18455] [client 4.189.163.214:30686] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aUVQwZRArClWV1iij_SdWQAAAY4"]
[Fri Dec 19 21:19:00.630026 2025] [:error] [pid 16026:tid 16041] [client 4.189.163.214:30741] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aUVQxELVfhf4Jb3enmNBDQAAAUw"]
[Fri Dec 19 21:19:02.424460 2025] [:error] [pid 18438:tid 18444] [client 4.189.163.214:27573] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aUVQxpRArClWV1iij_SdYgAAAYM"]
[Fri Dec 19 21:19:03.111859 2025] [:error] [pid 41451:tid 41475] [client 4.189.163.214:27522] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aUVQxwYXFn-DbZghZBHkOwAAABU"]
[Fri Dec 19 21:19:03.680576 2025] [:error] [pid 20580:tid 20608] [client 4.189.163.214:31671] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aUVQx0md1op_YdAdgR2oOQAAAFY"]
[Fri Dec 19 21:19:04.664133 2025] [:error] [pid 20582:tid 20665] [client 4.189.163.214:35679] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aUVQyMpAnrkQKZ4b5gY_pAAAANc"]
[Fri Dec 19 21:19:05.517124 2025] [:error] [pid 18438:tid 18462] [client 4.189.163.214:34304] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aUVQyZRArClWV1iij_SdaAAAAZU"]
[Fri Dec 19 21:19:06.456135 2025] [:error] [pid 41451:tid 41470] [client 4.189.163.214:51246] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aUVQygYXFn-DbZghZBHkPwAAABA"]
[Fri Dec 19 21:19:06.942459 2025] [:error] [pid 18438:tid 18451] [client 4.189.163.214:33044] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aUVQypRArClWV1iij_SdcAAAAYo"]
[Fri Dec 19 21:19:07.679716 2025] [:error] [pid 18438:tid 18464] [client 4.189.163.214:30687] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aUVQy5RArClWV1iij_SdcgAAAZc"]
[Fri Dec 19 21:19:09.245914 2025] [:error] [pid 18438:tid 18447] [client 4.189.163.214:33315] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aUVQzZRArClWV1iij_SddgAAAYY"]
[Fri Dec 19 21:19:11.091336 2025] [:error] [pid 20582:tid 20657] [client 4.189.163.214:33287] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aUVQz8pAnrkQKZ4b5gY_qgAAAM8"]
[Fri Dec 19 21:19:12.776645 2025] [:error] [pid 20675:tid 20695] [client 4.189.163.214:35639] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aUVQ0LMyJ3XqeDRsbQmmHwAAAQc"]
[Fri Dec 19 21:19:13.808869 2025] [:error] [pid 41451:tid 41472] [client 4.189.163.214:29704] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aUVQ0QYXFn-DbZghZBHkRgAAABI"]
[Fri Dec 19 21:19:15.808010 2025] [:error] [pid 20581:tid 20621] [client 4.189.163.214:33337] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aUVQ0_xEv7WXNhnFD1mNkAAAAIY"]
[Fri Dec 19 21:19:16.779127 2025] [:error] [pid 41451:tid 41475] [client 4.189.163.214:34335] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aUVQ1AYXFn-DbZghZBHkSgAAABU"]
[Fri Dec 19 21:19:19.350763 2025] [:error] [pid 20582:tid 20643] [client 4.189.163.214:4932] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aUVQ18pAnrkQKZ4b5gY_uAAAAME"]
[Fri Dec 19 21:19:21.196376 2025] [:error] [pid 20580:tid 20607] [client 4.189.163.214:30075] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aUVQ2Umd1op_YdAdgR2oQwAAAFU"]
[Fri Dec 19 21:19:21.816086 2025] [:error] [pid 20582:tid 20644] [client 4.189.163.214:31815] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aUVQ2cpAnrkQKZ4b5gY_vgAAAMI"]
[Fri Dec 19 21:19:23.355987 2025] [:error] [pid 20582:tid 20664] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Dec 19 21:19:24.060733 2025] [:error] [pid 20582:tid 20664] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Dec 19 21:19:24.257977 2025] [:error] [pid 20582:tid 20666] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Dec 19 21:19:24.415180 2025] [:error] [pid 20582:tid 20662] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Dec 19 21:19:24.563449 2025] [:error] [pid 20582:tid 20646] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Dec 19 21:19:24.707310 2025] [:error] [pid 20582:tid 20645] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Fri Dec 19 21:19:24.862187 2025] [:error] [pid 20582:tid 20647] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Fri Dec 19 21:19:25.014443 2025] [:error] [pid 20582:tid 20656] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/conflg.php
[Fri Dec 19 21:19:25.178777 2025] [:error] [pid 20582:tid 20651] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Dec 19 21:19:25.321207 2025] [:error] [pid 20582:tid 20650] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/asas.php
[Fri Dec 19 21:19:25.933862 2025] [:error] [pid 20582:tid 20663] [client 4.189.163.214:33027] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Dec 19 21:19:26.098528 2025] [:error] [pid 20582:tid 20652] [client 4.189.163.214:33027] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aUVQ3spAnrkQKZ4b5gY_zQAAAMo"]
[Fri Dec 19 21:19:27.028026 2025] [:error] [pid 20582:tid 20664] [client 4.189.163.214:29601] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aUVQ38pAnrkQKZ4b5gY_zwAAANY"]
[Fri Dec 19 21:19:28.540009 2025] [:error] [pid 20581:tid 20624] [client 4.189.163.214:34966] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aUVQ4PxEv7WXNhnFD1mNoAAAAIk"]
[Fri Dec 19 21:19:29.605832 2025] [:error] [pid 20582:tid 20657] [client 4.189.163.214:37667] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aUVQ4cpAnrkQKZ4b5gY_1QAAAM8"]
[Fri Dec 19 21:19:31.727023 2025] [:error] [pid 20582:tid 20644] [client 4.189.163.214:4106] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUVQ48pAnrkQKZ4b5gY_2gAAAMI"]
[Fri Dec 19 21:19:32.581457 2025] [:error] [pid 41451:tid 41469] [client 4.189.163.214:37847] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUVQ5AYXFn-DbZghZBHkWAAAAA8"]
[Fri Dec 19 21:19:33.511889 2025] [:error] [pid 20580:tid 20593] [client 4.189.163.214:51224] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUVQ5Umd1op_YdAdgR2oXgAAAEc"]
[Fri Dec 19 21:19:34.390565 2025] [:error] [pid 20581:tid 20637] [client 4.189.163.214:51213] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUVQ5vxEv7WXNhnFD1mNrAAAAJY"]
[Fri Dec 19 21:19:35.378538 2025] [:error] [pid 20581:tid 20639] [client 4.189.163.214:27580] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUVQ5_xEv7WXNhnFD1mNswAAAJg"]
[Fri Dec 19 21:19:37.236176 2025] [:error] [pid 20580:tid 20598] [client 4.189.163.214:37416] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUVQ6Umd1op_YdAdgR2oYwAAAEw"]
[Fri Dec 19 21:19:39.371004 2025] [:error] [pid 20675:tid 20693] [client 4.189.163.214:26111] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUVQ67MyJ3XqeDRsbQmmOAAAAQU"]
[Fri Dec 19 21:19:40.764100 2025] [:error] [pid 20675:tid 20709] [client 4.189.163.214:30674] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUVQ7LMyJ3XqeDRsbQmmPgAAARU"]
[Fri Dec 19 21:19:41.545047 2025] [:error] [pid 18438:tid 18461] [client 4.189.163.214:34994] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aUVQ7ZRArClWV1iij_SdpQAAAZQ"]
[Fri Dec 19 21:19:42.603487 2025] [:error] [pid 20582:tid 20650] [client 4.189.163.214:34981] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aUVQ7spAnrkQKZ4b5gY_5gAAAMg"]
[Fri Dec 19 21:19:43.812724 2025] [:error] [pid 41451:tid 41469] [client 4.189.163.214:27530] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aUVQ7wYXFn-DbZghZBHkZwAAAA8"]
[Fri Dec 19 21:19:44.810175 2025] [:error] [pid 41451:tid 41455] [client 4.189.163.214:4099] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aUVQ8AYXFn-DbZghZBHkagAAAAE"]
[Fri Dec 19 21:19:45.819693 2025] [:error] [pid 20582:tid 20666] [client 4.189.163.214:37869] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUVQ8cpAnrkQKZ4b5gY_6QAAANg"]
[Fri Dec 19 21:19:46.697224 2025] [:error] [pid 18438:tid 18452] [client 4.189.163.214:51221] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUVQ8pRArClWV1iij_SdrAAAAYs"]
[Fri Dec 19 21:19:48.500476 2025] [:error] [pid 20580:tid 20593] [client 4.189.163.214:34963] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUVQ9Emd1op_YdAdgR2oZQAAAEc"]
[Fri Dec 19 21:19:49.104054 2025] [:error] [pid 18438:tid 18460] [client 4.189.163.214:34977] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUVQ9ZRArClWV1iij_SdrwAAAZM"]
[Fri Dec 19 21:19:49.802890 2025] [:error] [pid 41451:tid 41457] [client 4.189.163.214:27551] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aUVQ9QYXFn-DbZghZBHkcAAAAAM"]
[Fri Dec 19 21:19:51.239405 2025] [:error] [pid 20581:tid 20619] [client 4.189.163.214:4282] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aUVQ9_xEv7WXNhnFD1mNxAAAAIQ"]
[Fri Dec 19 21:19:52.547168 2025] [:error] [pid 18438:tid 18442] [client 4.189.163.214:26779] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aUVQ-JRArClWV1iij_SdtgAAAYE"]
[Fri Dec 19 21:19:54.134591 2025] [:error] [pid 20675:tid 20702] [client 4.189.163.214:37866] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aUVQ-rMyJ3XqeDRsbQmmSQAAAQ4"]
[Fri Dec 19 21:19:55.044465 2025] [:error] [pid 20580:tid 20610] [client 4.189.163.214:28525] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aUVQ-0md1op_YdAdgR2ocwAAAFg"]
[Fri Dec 19 21:19:56.109824 2025] [:error] [pid 20582:tid 20649] [client 4.189.163.214:35000] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aUVQ_MpAnrkQKZ4b5gY__QAAAMc"]
[Fri Dec 19 21:19:56.896017 2025] [:error] [pid 20582:tid 20654] [client 4.189.163.214:27012] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aUVQ_MpAnrkQKZ4b5gY__gAAAMw"]
[Fri Dec 19 21:19:57.977766 2025] [:error] [pid 16026:tid 16042] [client 4.189.163.214:37842] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aUVQ_ULVfhf4Jb3enmNBYAAAAU0"]
[Fri Dec 19 21:20:01.294032 2025] [:error] [pid 20582:tid 20651] [client 4.189.163.214:30323] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aUVRAcpAnrkQKZ4b5gZAAgAAAMk"]
[Fri Dec 19 21:20:04.843144 2025] [:error] [pid 20675:tid 20709] [client 4.189.163.214:27068] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aUVRBLMyJ3XqeDRsbQmmWwAAARU"]
[Fri Dec 19 21:20:05.322887 2025] [:error] [pid 20582:tid 20648] [client 4.189.163.214:27023] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aUVRBcpAnrkQKZ4b5gZABwAAAMY"]
[Fri Dec 19 21:20:06.283687 2025] [:error] [pid 20580:tid 20610] [client 4.189.163.214:30295] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aUVRBkmd1op_YdAdgR2ofQAAAFg"]
[Fri Dec 19 21:20:07.115122 2025] [:error] [pid 41451:tid 41464] [client 4.189.163.214:36411] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aUVRBwYXFn-DbZghZBHkfwAAAAo"]
[Fri Dec 19 21:20:07.921884 2025] [:error] [pid 20675:tid 20711] [client 4.189.163.214:34111] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aUVRB7MyJ3XqeDRsbQmmYAAAARc"]
[Fri Dec 19 21:20:09.928150 2025] [:error] [pid 20580:tid 20596] [client 4.189.163.214:4663] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aUVRCUmd1op_YdAdgR2ogAAAAEo"]
[Fri Dec 19 21:20:11.286200 2025] [:error] [pid 20581:tid 20634] [client 4.189.163.214:36400] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aUVRC_xEv7WXNhnFD1mN2wAAAJM"]
[Fri Dec 19 21:20:13.308294 2025] [:error] [pid 16026:tid 16036] [client 4.189.163.214:36398] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aUVRDULVfhf4Jb3enmNBdQAAAUc"]
[Fri Dec 19 21:20:13.919274 2025] [:error] [pid 20580:tid 20608] [client 4.189.163.214:28531] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aUVRDUmd1op_YdAdgR2ohgAAAFY"]
[Fri Dec 19 21:20:14.467508 2025] [:error] [pid 20582:tid 20643] [client 4.189.163.214:28495] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aUVRDspAnrkQKZ4b5gZADgAAAME"]
[Fri Dec 19 21:20:15.659006 2025] [:error] [pid 20675:tid 20707] [client 4.189.163.214:35949] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aUVRD7MyJ3XqeDRsbQmmbAAAARM"]
[Fri Dec 19 21:20:16.834237 2025] [:error] [pid 20582:tid 20648] [client 4.189.163.214:34104] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUVREMpAnrkQKZ4b5gZAFAAAAMY"]
[Fri Dec 19 21:20:17.624250 2025] [:error] [pid 41451:tid 41466] [client 4.189.163.214:4644] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUVREQYXFn-DbZghZBHkigAAAAw"]
[Fri Dec 19 21:20:18.641890 2025] [:error] [pid 20675:tid 20690] [client 4.189.163.214:29707] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUVRErMyJ3XqeDRsbQmmbwAAAQI"]
[Fri Dec 19 21:20:20.192133 2025] [:error] [pid 20582:tid 20663] [client 4.189.163.214:4385] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUVRFMpAnrkQKZ4b5gZAGgAAANU"]
[Fri Dec 19 21:20:21.647207 2025] [:error] [pid 18438:tid 18448] [client 4.189.163.214:30183] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUVRFZRArClWV1iij_Sd3wAAAYc"]
[Fri Dec 19 21:20:22.924292 2025] [:error] [pid 20580:tid 20594] [client 4.189.163.214:36374] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUVRFkmd1op_YdAdgR2oigAAAEg"]
[Fri Dec 19 21:20:23.864257 2025] [:error] [pid 20582:tid 20646] [client 4.189.163.214:27784] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUVRF8pAnrkQKZ4b5gZAHwAAAMQ"]
[Fri Dec 19 21:20:24.980747 2025] [:error] [pid 41451:tid 41475] [client 4.189.163.214:29356] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUVRGAYXFn-DbZghZBHklAAAABU"]
[Fri Dec 19 21:20:27.108412 2025] [:error] [pid 41451:tid 41456] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/al.php
[Fri Dec 19 21:20:27.235093 2025] [:error] [pid 41451:tid 41461] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Dec 19 21:20:27.391695 2025] [:error] [pid 41451:tid 41470] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Fri Dec 19 21:20:27.521304 2025] [:error] [pid 41451:tid 41477] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Fri Dec 19 21:20:27.656665 2025] [:error] [pid 41451:tid 41458] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Fri Dec 19 21:20:27.809766 2025] [:error] [pid 41451:tid 41460] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Dec 19 21:20:27.936676 2025] [:error] [pid 41451:tid 41464] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Fri Dec 19 21:20:28.093284 2025] [:error] [pid 41451:tid 41473] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Fri Dec 19 21:20:28.217916 2025] [:error] [pid 41451:tid 41463] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/xo.php
[Fri Dec 19 21:20:28.737029 2025] [:error] [pid 41451:tid 41472] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/dlu.php
[Fri Dec 19 21:20:28.862776 2025] [:error] [pid 41451:tid 41454] [client 4.189.163.214:37164] File does not exist: /usr/local/apache/htdocs/suspended-page/rk2.php
[Fri Dec 19 21:20:28.986955 2025] [:error] [pid 41451:tid 41462] [client 4.189.163.214:37164] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aUVRHAYXFn-DbZghZBHkowAAAAg"]
[Fri Dec 19 21:20:29.673449 2025] [:error] [pid 20582:tid 20643] [client 4.189.163.214:30172] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aUVRHcpAnrkQKZ4b5gZAKwAAAME"]
[Fri Dec 19 21:20:30.642137 2025] [:error] [pid 18438:tid 18446] [client 4.189.163.214:35927] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aUVRHpRArClWV1iij_Sd8QAAAYU"]
[Fri Dec 19 21:20:32.080742 2025] [:error] [pid 20675:tid 20688] [client 4.189.163.214:29346] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aUVRILMyJ3XqeDRsbQmmgQAAAQA"]
[Fri Dec 19 21:20:32.947836 2025] [:error] [pid 18438:tid 18457] [client 4.189.163.214:37180] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aUVRIJRArClWV1iij_Sd9gAAAZA"]
[Fri Dec 19 21:20:34.074612 2025] [:error] [pid 20580:tid 20590] [client 4.189.163.214:25678] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aUVRIkmd1op_YdAdgR2olAAAAEQ"]
[Fri Dec 19 21:20:35.408556 2025] [:error] [pid 16026:tid 16036] [client 4.189.163.214:37128] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aUVRI0LVfhf4Jb3enmNBkgAAAUc"]
[Fri Dec 19 21:20:36.056514 2025] [:error] [pid 18438:tid 18447] [client 4.189.163.214:29324] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aUVRJJRArClWV1iij_Sd_gAAAYY"]
[Fri Dec 19 21:20:38.052979 2025] [:error] [pid 18438:tid 18461] [client 4.189.163.214:4825] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aUVRJpRArClWV1iij_SeAQAAAZQ"]
[Fri Dec 19 21:20:39.891842 2025] [:error] [pid 20581:tid 20615] [client 4.189.163.214:4592] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aUVRJ_xEv7WXNhnFD1mN-AAAAIA"]
[Fri Dec 19 21:20:42.446651 2025] [:error] [pid 20580:tid 20608] [client 4.189.163.214:25683] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aUVRKkmd1op_YdAdgR2olwAAAFY"]
[Fri Dec 19 21:20:44.335147 2025] [:error] [pid 20582:tid 20658] [client 4.189.163.214:4849] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aUVRLMpAnrkQKZ4b5gZAOwAAANA"]
[Fri Dec 19 21:20:46.009303 2025] [:error] [pid 41451:tid 41476] [client 4.189.163.214:4584] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aUVRLgYXFn-DbZghZBHkrgAAABY"]
[Fri Dec 19 21:20:47.928411 2025] [:error] [pid 20580:tid 20605] [client 4.189.163.214:4562] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aUVRL0md1op_YdAdgR2onAAAAFM"]
[Fri Dec 19 21:20:49.497520 2025] [:error] [pid 16026:tid 16030] [client 4.189.163.214:51319] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aUVRMULVfhf4Jb3enmNBpwAAAUE"]
[Fri Dec 19 21:20:50.778147 2025] [:error] [pid 41451:tid 41475] [client 4.189.163.214:37919] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aUVRMgYXFn-DbZghZBHksAAAABU"]
[Fri Dec 19 21:20:52.555514 2025] [:error] [pid 20675:tid 20707] [client 4.189.163.214:35203] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aUVRNLMyJ3XqeDRsbQmmqQAAARM"]
[Fri Dec 19 21:20:53.207384 2025] [:error] [pid 16026:tid 16035] [client 4.189.163.214:4549] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aUVRNULVfhf4Jb3enmNBrgAAAUY"]
[Fri Dec 19 21:20:57.760641 2025] [:error] [pid 20582:tid 20642] [client 4.189.163.214:51295] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aUVROcpAnrkQKZ4b5gZAXgAAAMA"]
[Fri Dec 19 21:20:59.545035 2025] [:error] [pid 18438:tid 18441] [client 4.189.163.214:27860] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aUVRO5RArClWV1iij_SeEwAAAYA"]
[Fri Dec 19 21:21:01.116460 2025] [:error] [pid 18438:tid 18460] [client 4.189.163.214:32706] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aUVRPZRArClWV1iij_SeGwAAAZM"]
[Fri Dec 19 21:21:02.148005 2025] [:error] [pid 16026:tid 16048] [client 4.189.163.214:32156] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aUVRPkLVfhf4Jb3enmNBtQAAAVM"]
[Fri Dec 19 21:21:03.953656 2025] [:error] [pid 18438:tid 18453] [client 4.189.163.214:29637] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aUVRP5RArClWV1iij_SeKQAAAYw"]
[Fri Dec 19 21:21:05.984968 2025] [:error] [pid 20675:tid 20699] [client 4.189.163.214:27850] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aUVRQbMyJ3XqeDRsbQmmugAAAQs"]
[Fri Dec 19 21:21:06.847387 2025] [:error] [pid 20675:tid 20708] [client 4.189.163.214:4781] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aUVRQrMyJ3XqeDRsbQmmwAAAARQ"]
[Fri Dec 19 21:21:07.668086 2025] [:error] [pid 18438:tid 18444] [client 4.189.163.214:5070] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aUVRQ5RArClWV1iij_SeMQAAAYM"]
[Fri Dec 19 21:21:08.333716 2025] [:error] [pid 16026:tid 16040] [client 4.189.163.214:30023] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aUVRRELVfhf4Jb3enmNBvQAAAUs"]
[Fri Dec 19 21:21:08.926402 2025] [:error] [pid 18438:tid 18458] [client 4.189.163.214:4746] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aUVRRJRArClWV1iij_SeNgAAAZE"]
[Fri Dec 19 21:21:10.094792 2025] [:error] [pid 41451:tid 41467] [client 4.189.163.214:27328] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aUVRRgYXFn-DbZghZBHkvwAAAA0"]
[Fri Dec 19 21:21:11.238096 2025] [:error] [pid 41451:tid 41473] [client 4.189.163.214:27339] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aUVRRwYXFn-DbZghZBHkyQAAABM"]
[Fri Dec 19 21:21:12.127586 2025] [:error] [pid 18438:tid 18459] [client 4.189.163.214:29654] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aUVRSJRArClWV1iij_SeXgAAAZI"]
[Fri Dec 19 21:21:13.667621 2025] [:error] [pid 20582:tid 20660] [client 4.189.163.214:36455] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aUVRScpAnrkQKZ4b5gZAiQAAANI"]
[Fri Dec 19 21:21:15.070299 2025] [:error] [pid 20675:tid 20702] [client 4.189.163.214:32105] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aUVRS7MyJ3XqeDRsbQmmygAAAQ4"]
[Fri Dec 19 21:21:15.780528 2025] [:error] [pid 41451:tid 41454] [client 4.189.163.214:27360] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aUVRSwYXFn-DbZghZBHk1AAAAAA"]
[Fri Dec 19 21:21:17.129888 2025] [:error] [pid 16026:tid 16043] [client 4.189.163.214:32174] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aUVRTULVfhf4Jb3enmNB0wAAAU4"]
[Fri Dec 19 21:21:18.167310 2025] [:error] [pid 20675:tid 20689] [client 4.189.163.214:4477] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aUVRTrMyJ3XqeDRsbQmmzgAAAQE"]
[Fri Dec 19 21:21:18.947085 2025] [:error] [pid 20580:tid 20610] [client 4.189.163.214:35892] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aUVRTkmd1op_YdAdgR2osQAAAFg"]
[Fri Dec 19 21:21:20.326359 2025] [:error] [pid 16026:tid 16038] [client 4.189.163.214:35888] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aUVRUELVfhf4Jb3enmNB2gAAAUk"]
[Fri Dec 19 21:21:22.238749 2025] [:error] [pid 20582:tid 20655] [client 4.189.163.214:27373] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aUVRUspAnrkQKZ4b5gZAkgAAAM0"]
[Fri Dec 19 21:21:23.701369 2025] [:error] [pid 20581:tid 20627] [client 4.189.163.214:30349] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aUVRU_xEv7WXNhnFD1mOJAAAAIw"]
[Fri Dec 19 21:21:25.057002 2025] [:error] [pid 20675:tid 20699] [client 4.189.163.214:38188] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aUVRVbMyJ3XqeDRsbQmm1wAAAQs"]
[Fri Dec 19 21:21:26.547053 2025] [:error] [pid 20580:tid 20606] [client 4.189.163.214:35868] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aUVRVkmd1op_YdAdgR2oswAAAFQ"]
[Fri Dec 19 21:21:27.251718 2025] [:error] [pid 18438:tid 18458] [client 4.189.163.214:27329] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aUVRV5RArClWV1iij_SedwAAAZE"]
[Fri Dec 19 21:21:28.165682 2025] [:error] [pid 20582:tid 20662] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/des.php
[Fri Dec 19 21:21:28.286620 2025] [:error] [pid 20582:tid 20660] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/ant.php
[Fri Dec 19 21:21:28.408189 2025] [:error] [pid 20582:tid 20649] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Fri Dec 19 21:21:28.753979 2025] [:error] [pid 20582:tid 20658] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Dec 19 21:21:28.880073 2025] [:error] [pid 20582:tid 20648] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Fri Dec 19 21:21:29.011735 2025] [:error] [pid 20582:tid 20663] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Dec 19 21:21:29.349481 2025] [:error] [pid 20582:tid 20666] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/wpc.php
[Fri Dec 19 21:21:29.497870 2025] [:error] [pid 20582:tid 20662] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Fri Dec 19 21:21:29.649498 2025] [:error] [pid 20582:tid 20653] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/mlex.php
[Fri Dec 19 21:21:29.771449 2025] [:error] [pid 20582:tid 20663] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Fri Dec 19 21:21:29.915606 2025] [:error] [pid 20582:tid 20656] [client 4.189.163.214:33819] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Dec 19 21:21:30.057105 2025] [:error] [pid 20582:tid 20650] [client 4.189.163.214:33819] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aUVRWspAnrkQKZ4b5gZAyAAAAMg"]
[Fri Dec 19 21:21:31.277134 2025] [:error] [pid 20580:tid 20603] [client 4.189.163.214:37084] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aUVRW0md1op_YdAdgR2ougAAAFE"]
[Fri Dec 19 21:21:32.720647 2025] [:error] [pid 18438:tid 18445] [client 4.189.163.214:34795] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aUVRXJRArClWV1iij_SefwAAAYQ"]
[Fri Dec 19 21:21:34.063786 2025] [:error] [pid 20675:tid 20712] [client 4.189.163.214:36806] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mpvloi.php"] [unique_id "aUVRXrMyJ3XqeDRsbQmm4gAAARg"]
[Fri Dec 19 21:21:36.700562 2025] [:error] [pid 20675:tid 20691] [client 4.189.163.214:30406] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aUVRYLMyJ3XqeDRsbQmm6AAAAQM"]
[Fri Dec 19 21:21:38.188445 2025] [:error] [pid 20582:tid 20665] [client 4.189.163.214:50827] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aUVRYspAnrkQKZ4b5gZA0QAAANc"]
[Fri Dec 19 21:21:39.675136 2025] [:error] [pid 20582:tid 20657] [client 4.189.163.214:29806] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aUVRY8pAnrkQKZ4b5gZA0wAAAM8"]
[Fri Dec 19 21:21:41.356099 2025] [:error] [pid 20581:tid 20638] [client 4.189.163.214:38127] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1.php"] [unique_id "aUVRZfxEv7WXNhnFD1mOSwAAAJc"]
[Fri Dec 19 21:21:43.545027 2025] [:error] [pid 41451:tid 41465] [client 4.189.163.214:30412] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aUVRZwYXFn-DbZghZBHlAwAAAAs"]
[Fri Dec 19 21:21:45.988331 2025] [:error] [pid 20582:tid 20652] [client 4.189.163.214:28048] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aUVRacpAnrkQKZ4b5gZA2gAAAMo"]
[Fri Dec 19 21:21:48.570695 2025] [:error] [pid 16026:tid 16038] [client 4.189.163.214:28050] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aUVRbELVfhf4Jb3enmNCBgAAAUk"]
[Fri Dec 19 21:21:49.510590 2025] [:error] [pid 20581:tid 20623] [client 4.189.163.214:28056] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aUVRbfxEv7WXNhnFD1mOVQAAAIg"]
[Fri Dec 19 21:21:52.554648 2025] [:error] [pid 20581:tid 20631] [client 4.189.163.214:32354] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aUVRcPxEv7WXNhnFD1mOVgAAAJA"]
[Fri Dec 19 21:21:55.496244 2025] [:error] [pid 18438:tid 18444] [client 4.189.163.214:30426] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aUVRc5RArClWV1iij_SeqAAAAYM"]
[Fri Dec 19 21:21:57.811996 2025] [:error] [pid 20581:tid 20636] [client 4.189.163.214:30271] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aUVRdfxEv7WXNhnFD1mOWgAAAJU"]
[Fri Dec 19 21:22:00.300080 2025] [:error] [pid 20582:tid 20650] [client 4.189.163.214:29004] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "aUVReMpAnrkQKZ4b5gZA6QAAAMg"]
[Fri Dec 19 21:22:02.308065 2025] [:error] [pid 20582:tid 20651] [client 4.189.163.214:31161] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aUVRespAnrkQKZ4b5gZA7gAAAMk"]
[Fri Dec 19 21:22:03.808681 2025] [:error] [pid 18438:tid 18458] [client 4.189.163.214:26849] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aUVRe5RArClWV1iij_SeswAAAZE"]
[Fri Dec 19 21:22:05.447002 2025] [:error] [pid 16026:tid 16032] [client 4.189.163.214:29045] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aUVRfULVfhf4Jb3enmNCGwAAAUM"]
[Fri Dec 19 21:22:06.418260 2025] [:error] [pid 18438:tid 18464] [client 4.189.163.214:36854] [client 4.189.163.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/angelV2.php"] [unique_id "aUVRfpRArClWV1iij_SeuAAAAZc"]
[Sat Dec 20 00:28:58.412478 2025] [:error] [pid 35711:tid 35737] [client 36.41.75.167:49181] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUV9SixTWUmlILwAM_efMwAAABg"]
[Sat Dec 20 06:30:50.227766 2025] [:error] [pid 39577:tid 39589] [client 117.62.235.53:33058] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUXSGrviRnt1rJiSOfyC-AAAAMo"]
[Sat Dec 20 07:36:27.131095 2025] [:error] [pid 39493:tid 39573] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 20 07:36:27.432070 2025] [:error] [pid 39493:tid 39549] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 20 07:36:27.724064 2025] [:error] [pid 39493:tid 39558] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Dec 20 07:36:28.022247 2025] [:error] [pid 39493:tid 39556] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Dec 20 07:36:28.364191 2025] [:error] [pid 39493:tid 39550] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 20 07:36:28.712187 2025] [:error] [pid 39493:tid 39564] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 07:36:29.000959 2025] [:error] [pid 39493:tid 39555] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 07:36:29.288170 2025] [:error] [pid 39493:tid 39566] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 20 07:36:29.880167 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 20 07:36:30.488997 2025] [:error] [pid 39493:tid 39555] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Dec 20 07:36:30.894312 2025] [:error] [pid 39493:tid 39568] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Dec 20 07:36:31.221993 2025] [:error] [pid 39493:tid 39566] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 20 07:36:31.503207 2025] [:error] [pid 39493:tid 39569] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Dec 20 07:36:31.797376 2025] [:error] [pid 39493:tid 39550] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Dec 20 07:36:32.100019 2025] [:error] [pid 39493:tid 39552] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Dec 20 07:36:32.393299 2025] [:error] [pid 39493:tid 39571] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Dec 20 07:36:32.690433 2025] [:error] [pid 39493:tid 39558] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Dec 20 07:36:32.981821 2025] [:error] [pid 39493:tid 39566] [client 45.86.202.53:53025] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Dec 20 07:36:37.472854 2025] [:error] [pid 39493:tid 39560] [client 45.86.202.53:53025] [client 45.86.202.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUXhhWhjL2VG_FmIHqAdIwAAAIs"]
[Sat Dec 20 07:36:41.210593 2025] [:error] [pid 14286:tid 14296] [client 45.86.202.68:39603] [client 45.86.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUXhiZ7rbXIrw6rGSda8gQAAAUY"]
[Sat Dec 20 07:36:44.030659 2025] [:error] [pid 39577:tid 39599] [client 45.86.202.70:35657] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 20 07:36:44.995255 2025] [:error] [pid 39577:tid 39580] [client 45.86.202.70:35657] [client 45.86.202.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aUXhjLviRnt1rJiSOfyW5gAAAME"]
[Sat Dec 20 07:36:46.263135 2025] [:error] [pid 39493:tid 39552] [client 45.86.202.54:42235] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 20 07:36:46.555865 2025] [:error] [pid 39493:tid 39551] [client 45.86.202.54:42235] [client 45.86.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUXhjmhjL2VG_FmIHqAdfwAAAII"]
[Sat Dec 20 07:36:47.423563 2025] [:error] [pid 39493:tid 39549] [client 45.86.202.76:53693] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Dec 20 07:36:48.962560 2025] [:error] [pid 39493:tid 39565] [client 45.86.202.76:53693] [client 45.86.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUXhkGhjL2VG_FmIHqAdpAAAAJA"]
[Sat Dec 20 07:36:49.854149 2025] [:error] [pid 14247:tid 14273] [client 45.86.202.74:29041] [client 45.86.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUXhkSDv9TtKKdJQn9lgCQAAARg"]
[Sat Dec 20 07:36:50.427608 2025] [:error] [pid 14286:tid 14290] [client 45.86.202.58:47529] [client 45.86.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUXhkp7rbXIrw6rGSda82gAAAUA"]
[Sat Dec 20 07:37:50.888911 2025] [:error] [pid 14286:tid 14299] [client 45.86.202.77:41385] [client 45.86.202.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/"] [unique_id "aUXhzp7rbXIrw6rGSda_5wAAAUk"]
[Sat Dec 20 10:07:59.623821 2025] [:error] [pid 39492:tid 39536] [client 124.156.225.181:56038] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUYE_4s_ZYP1UQNM9hbpJAAAAE4"]
[Sat Dec 20 10:50:16.060431 2025] [:error] [pid 39491:tid 39510] [client 170.106.72.178:40276] [client 170.106.72.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUYO6Ftw2ggYvDxu2EAZZwAAAA8"]
[Sat Dec 20 12:35:43.105179 2025] [:error] [pid 39493:tid 39567] [client 182.42.110.255:46309] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUYnn2hjL2VG_FmIHqCGHAAAAJI"]
[Sat Dec 20 14:53:43.831034 2025] [:error] [pid 39492:tid 39527] [client 43.135.145.77:43716] [client 43.135.145.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUZH94s_ZYP1UQNM9hYWdgAAAEU"]
[Sat Dec 20 15:58:00.334717 2025] [:error] [pid 39492:tid 39523] [client 157.245.36.108:33550] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/api-docs"] [unique_id "aUZXCIs_ZYP1UQNM9hYf2QAAAEE"]
[Sat Dec 20 15:58:01.330229 2025] [:error] [pid 14286:tid 14299] [client 157.245.36.108:50666] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3/api-docs"] [unique_id "aUZXCZ7rbXIrw6rGSdY3mQAAAUk"]
[Sat Dec 20 15:58:02.372837 2025] [:error] [pid 14286:tid 14297] [client 157.245.36.108:50678] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aUZXCp7rbXIrw6rGSdY3mgAAAUc"]
[Sat Dec 20 15:58:03.382218 2025] [:error] [pid 39577:tid 39587] [client 157.245.36.108:50682] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api/swagger.json"] [unique_id "aUZXC7viRnt1rJiSOfwelwAAAMg"]
[Sat Dec 20 15:58:04.363217 2025] [:error] [pid 14286:tid 14292] [client 157.245.36.108:50690] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/@vite/env"] [unique_id "aUZXDJ7rbXIrw6rGSdY3nQAAAUI"]
[Sat Dec 20 15:58:05.376964 2025] [:error] [pid 39577:tid 39589] [client 157.245.36.108:50706] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aUZXDbviRnt1rJiSOfwemAAAAMo"]
[Sat Dec 20 15:58:06.355129 2025] [:error] [pid 39577:tid 39594] [client 157.245.36.108:50722] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aUZXDrviRnt1rJiSOfwemgAAAM8"]
[Sat Dec 20 15:58:07.377143 2025] [:error] [pid 39491:tid 39514] [client 157.245.36.108:50734] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aUZXD1tw2ggYvDxu2EBEqwAAABM"]
[Sat Dec 20 15:58:09.369969 2025] [:error] [pid 39492:tid 39538] [client 157.245.36.108:50740] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aUZXEYs_ZYP1UQNM9hYf3QAAAFA"]
[Sat Dec 20 15:58:10.347511 2025] [:error] [pid 39493:tid 39552] [client 157.245.36.108:50752] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aUZXEmhjL2VG_FmIHqCzYQAAAIM"]
[Sat Dec 20 15:58:11.344185 2025] [:error] [pid 18807:tid 18820] [client 157.245.36.108:58692] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aUZXE2RP9n5OCTllYeXDAwAAAYs"]
[Sat Dec 20 15:58:12.373243 2025] [:error] [pid 18807:tid 18826] [client 157.245.36.108:58708] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUZXFGRP9n5OCTllYeXDBAAAAZE"]
[Sat Dec 20 15:58:13.331321 2025] [:error] [pid 39491:tid 39497] [client 157.245.36.108:58718] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aUZXFVtw2ggYvDxu2EBEsAAAAAI"]
[Sat Dec 20 15:58:14.351517 2025] [:error] [pid 39493:tid 39561] [client 157.245.36.108:58734] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aUZXFmhjL2VG_FmIHqCzYwAAAIw"]
[Sat Dec 20 15:58:15.360238 2025] [:error] [pid 39491:tid 39511] [client 157.245.36.108:58736] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_all_dbs"] [unique_id "aUZXF1tw2ggYvDxu2EBEsgAAABA"]
[Sat Dec 20 15:58:16.405129 2025] [:error] [pid 39491:tid 39501] [client 157.245.36.108:58752] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aUZXGFtw2ggYvDxu2EBEswAAAAY"]
[Sat Dec 20 15:58:17.387088 2025] [:error] [pid 39493:tid 39573] [client 157.245.36.108:58756] [client 157.245.36.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aUZXGWhjL2VG_FmIHqCzZgAAAJg"]
[Sat Dec 20 15:58:19.381118 2025] [:error] [pid 18807:tid 18817] [client 157.245.36.108:58768] [client 157.245.36.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aUZXG2RP9n5OCTllYeXDCwAAAYg"]
[Sat Dec 20 15:58:20.305095 2025] [:error] [pid 39492:tid 39533] [client 157.245.36.108:58770] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUZXHIs_ZYP1UQNM9hYf4QAAAEs"]
[Sat Dec 20 15:58:21.276302 2025] [:error] [pid 39493:tid 39551] [client 157.245.36.108:53248] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aUZXHWhjL2VG_FmIHqCzagAAAII"]
[Sat Dec 20 15:58:22.286909 2025] [:error] [pid 14286:tid 14292] [client 157.245.36.108:53260] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aUZXHp7rbXIrw6rGSdY3qQAAAUI"]
[Sat Dec 20 15:58:23.282961 2025] [:error] [pid 39493:tid 39562] [client 157.245.36.108:53272] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aUZXH2hjL2VG_FmIHqCzbQAAAI0"]
[Sat Dec 20 15:58:24.279193 2025] [:error] [pid 14286:tid 14314] [client 157.245.36.108:53280] [client 157.245.36.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUZXIJ7rbXIrw6rGSdY3qwAAAVg"]
[Sat Dec 20 16:42:01.313084 2025] [:error] [pid 14247:tid 14271] [client 165.227.173.41:40132] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/api-docs"] [unique_id "aUZhWSDv9TtKKdJQn9niGgAAARY"]
[Sat Dec 20 16:42:02.243937 2025] [:error] [pid 39577:tid 39594] [client 165.227.173.41:40140] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3/api-docs"] [unique_id "aUZhWrviRnt1rJiSOfwmsQAAAM8"]
[Sat Dec 20 16:42:03.296740 2025] [:error] [pid 14286:tid 14310] [client 165.227.173.41:40150] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aUZhW57rbXIrw6rGSdY-OwAAAVQ"]
[Sat Dec 20 16:42:04.385950 2025] [:error] [pid 14286:tid 14300] [client 165.227.173.41:40156] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/swagger.json"] [unique_id "aUZhXJ7rbXIrw6rGSdY-PAAAAUo"]
[Sat Dec 20 16:42:05.265604 2025] [:error] [pid 14286:tid 14301] [client 165.227.173.41:40170] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/@vite/env"] [unique_id "aUZhXZ7rbXIrw6rGSdY-PgAAAUs"]
[Sat Dec 20 16:42:06.250394 2025] [:error] [pid 14247:tid 14263] [client 165.227.173.41:40172] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/actuator/env"] [unique_id "aUZhXiDv9TtKKdJQn9niHQAAAQ4"]
[Sat Dec 20 16:42:07.427471 2025] [:error] [pid 14286:tid 14295] [client 165.227.173.41:40176] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server"] [unique_id "aUZhX57rbXIrw6rGSdY-QAAAAUU"]
[Sat Dec 20 16:42:08.338233 2025] [:error] [pid 14286:tid 14303] [client 165.227.173.41:54490] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aUZhYJ7rbXIrw6rGSdY-QQAAAU0"]
[Sat Dec 20 16:42:10.319000 2025] [:error] [pid 39577:tid 39591] [client 165.227.173.41:54502] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about"] [unique_id "aUZhYrviRnt1rJiSOfwmuAAAAMw"]
[Sat Dec 20 16:42:11.301804 2025] [:error] [pid 14286:tid 14294] [client 165.227.173.41:54514] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug/default/view"] [unique_id "aUZhY57rbXIrw6rGSdY-RwAAAUQ"]
[Sat Dec 20 16:42:12.381957 2025] [:error] [pid 39577:tid 39584] [client 165.227.173.41:54520] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/_catalog"] [unique_id "aUZhZLviRnt1rJiSOfwmuwAAAMU"]
[Sat Dec 20 16:42:13.318951 2025] [:error] [pid 39492:tid 39528] [client 165.227.173.41:54522] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUZhZYs_ZYP1UQNM9hYm5AAAAEY"]
[Sat Dec 20 16:42:14.380230 2025] [:error] [pid 39577:tid 39581] [client 165.227.173.41:54538] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-status"] [unique_id "aUZhZrviRnt1rJiSOfwmvgAAAMI"]
[Sat Dec 20 16:42:15.602490 2025] [:error] [pid 39492:tid 39539] [client 165.227.173.41:54542] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login.action"] [unique_id "aUZhZ4s_ZYP1UQNM9hYm5wAAAFE"]
[Sat Dec 20 16:42:16.775706 2025] [:error] [pid 39492:tid 39538] [client 165.227.173.41:54546] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_all_dbs"] [unique_id "aUZhaIs_ZYP1UQNM9hYm6QAAAFA"]
[Sat Dec 20 16:42:17.756647 2025] [:error] [pid 39577:tid 39588] [client 165.227.173.41:54558] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.DS_Store"] [unique_id "aUZhabviRnt1rJiSOfwmvwAAAMk"]
[Sat Dec 20 16:42:18.833605 2025] [:error] [pid 14286:tid 14313] [client 165.227.173.41:43132] [client 165.227.173.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aUZhap7rbXIrw6rGSdY-TAAAAVc"]
[Sat Dec 20 16:42:20.838296 2025] [:error] [pid 39493:tid 39565] [client 165.227.173.41:43134] [client 165.227.173.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aUZhbGhjL2VG_FmIHqC86AAAAJA"]
[Sat Dec 20 16:42:21.849040 2025] [:error] [pid 39577:tid 39595] [client 165.227.173.41:43142] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUZhbbviRnt1rJiSOfwmyQAAANA"]
[Sat Dec 20 16:42:22.784811 2025] [:error] [pid 14247:tid 14249] [client 165.227.173.41:43148] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.json"] [unique_id "aUZhbiDv9TtKKdJQn9niJAAAAQA"]
[Sat Dec 20 16:42:23.811079 2025] [:error] [pid 39493:tid 39561] [client 165.227.173.41:43158] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/telescope/requests"] [unique_id "aUZhb2hjL2VG_FmIHqC86gAAAIw"]
[Sat Dec 20 16:42:24.762139 2025] [:error] [pid 39492:tid 39546] [client 165.227.173.41:43174] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUZhcIs_ZYP1UQNM9hYm7gAAAFg"]
[Sat Dec 20 16:42:25.792958 2025] [:error] [pid 39492:tid 39535] [client 165.227.173.41:43180] [client 165.227.173.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUZhcYs_ZYP1UQNM9hYm7wAAAE0"]
[Sat Dec 20 19:12:21.783122 2025] [:error] [pid 33793:tid 33805] [client 162.62.132.25:58004] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUaElVSicyB0BFmbRMy6OAAAAso"]
[Sat Dec 20 21:41:05.299700 2025] [:error] [pid 62124:tid 62140] [client 85.203.34.36:43541] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Dec 20 21:41:05.887995 2025] [:error] [pid 62124:tid 62139] [client 85.203.34.36:43541] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Dec 20 21:41:06.174855 2025] [:error] [pid 62124:tid 62138] [client 85.203.34.36:43541] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUancls94zPA9ULQOjl6FgAAAAw"]
[Sat Dec 20 21:41:07.761384 2025] [:error] [pid 33570:tid 33587] [client 85.203.34.1:22817] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Dec 20 21:41:08.038944 2025] [:error] [pid 33570:tid 33584] [client 85.203.34.1:22817] [client 85.203.34.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aUandITNveA-c6YcSrIKOAAAAcg"]
[Sat Dec 20 21:41:08.880061 2025] [:error] [pid 33793:tid 33802] [client 85.203.34.39:33151] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sat Dec 20 21:41:09.481711 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.39:33151] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 20 21:41:09.795263 2025] [:error] [pid 33793:tid 33803] [client 85.203.34.39:33151] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:41:10.091018 2025] [:error] [pid 33793:tid 33807] [client 85.203.34.39:33151] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sat Dec 20 21:41:10.683643 2025] [:error] [pid 33793:tid 33800] [client 85.203.34.39:33151] [client 85.203.34.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aUandlSicyB0BFmbRMzPcAAAAsU"]
[Sat Dec 20 21:41:11.256836 2025] [:error] [pid 14286:tid 14311] [client 85.203.34.4:23555] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Dec 20 21:41:11.545089 2025] [:error] [pid 14286:tid 14295] [client 85.203.34.4:23555] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Dec 20 21:41:11.830372 2025] [:error] [pid 14286:tid 14303] [client 85.203.34.4:23555] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aUand57rbXIrw6rGSdZ8PAAAAU0"]
[Sat Dec 20 21:41:12.433539 2025] [:error] [pid 62124:tid 62149] [client 85.203.34.34:44859] [client 85.203.34.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aUaneFs94zPA9ULQOjl6IwAAABc"]
[Sat Dec 20 21:41:13.048294 2025] [:error] [pid 33749:tid 33771] [client 185.92.25.138:64283] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aUanedoInXJnb96wei9WaQAAApQ"]
[Sat Dec 20 21:41:14.915640 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.6:38317] [client 85.203.34.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aUanerviRnt1rJiSOfxfmAAAANI"]
[Sat Dec 20 21:41:15.803294 2025] [:error] [pid 33687:tid 33707] [client 85.203.34.11:65385] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aUanezYMR4qK1N4g7vjKqwAAAlE"]
[Sat Dec 20 21:41:17.034257 2025] [:error] [pid 39577:tid 39601] [client 85.203.34.18:57013] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Dec 20 21:41:17.993893 2025] [:error] [pid 39577:tid 39582] [client 85.203.34.18:57013] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sat Dec 20 21:41:18.295493 2025] [:error] [pid 39577:tid 39592] [client 85.203.34.18:57013] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aUanfrviRnt1rJiSOfxfpQAAAM0"]
[Sat Dec 20 21:41:18.902596 2025] [:error] [pid 14286:tid 14298] [client 85.203.34.33:64803] [client 85.203.34.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aUanfp7rbXIrw6rGSdZ8VQAAAUg"]
[Sat Dec 20 21:41:19.847352 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sat Dec 20 21:41:20.377373 2025] [:error] [pid 33570:tid 33598] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Sat Dec 20 21:41:20.675783 2025] [:error] [pid 33570:tid 33578] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sat Dec 20 21:41:20.969714 2025] [:error] [pid 33570:tid 33586] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Dec 20 21:41:21.265221 2025] [:error] [pid 33570:tid 33588] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Sat Dec 20 21:41:21.563689 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Dec 20 21:41:21.863935 2025] [:error] [pid 33570:tid 33580] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Sat Dec 20 21:41:22.161824 2025] [:error] [pid 33570:tid 33599] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat Dec 20 21:41:22.504113 2025] [:error] [pid 33570:tid 33592] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Sat Dec 20 21:41:22.823563 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sat Dec 20 21:41:23.122935 2025] [:error] [pid 33570:tid 33585] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Sat Dec 20 21:41:23.409953 2025] [:error] [pid 33570:tid 33579] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Dec 20 21:41:23.716382 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sat Dec 20 21:41:24.024299 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Sat Dec 20 21:41:24.338966 2025] [:error] [pid 33570:tid 33586] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Sat Dec 20 21:41:24.654303 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Dec 20 21:41:24.965512 2025] [:error] [pid 33570:tid 33600] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sat Dec 20 21:41:25.255057 2025] [:error] [pid 33570:tid 33599] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Dec 20 21:41:25.578759 2025] [:error] [pid 33570:tid 33592] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Sat Dec 20 21:41:25.895102 2025] [:error] [pid 33570:tid 33577] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Dec 20 21:41:26.220449 2025] [:error] [pid 33570:tid 33585] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sat Dec 20 21:41:26.544989 2025] [:error] [pid 33570:tid 33595] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Dec 20 21:41:26.856446 2025] [:error] [pid 33570:tid 33596] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sat Dec 20 21:41:27.180942 2025] [:error] [pid 33570:tid 33578] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Dec 20 21:41:27.702016 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sat Dec 20 21:41:28.042153 2025] [:error] [pid 33570:tid 33594] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sat Dec 20 21:41:28.342893 2025] [:error] [pid 33570:tid 33587] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sat Dec 20 21:41:28.661941 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Sat Dec 20 21:41:28.956611 2025] [:error] [pid 33570:tid 33580] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Sat Dec 20 21:41:29.259413 2025] [:error] [pid 33570:tid 33576] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sat Dec 20 21:41:29.562715 2025] [:error] [pid 33570:tid 33599] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Sat Dec 20 21:41:29.873402 2025] [:error] [pid 33570:tid 33589] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Sat Dec 20 21:41:30.173748 2025] [:error] [pid 33570:tid 33583] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Dec 20 21:41:30.458295 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.6:28689] [client 85.203.34.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.6, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aUanioTNveA-c6YcSrIKiQAAAc8"]
[Sat Dec 20 21:41:30.461374 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Dec 20 21:41:31.306281 2025] [:error] [pid 33570:tid 33579] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sat Dec 20 21:41:31.606889 2025] [:error] [pid 33570:tid 33598] [client 85.203.34.6:28689] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sat Dec 20 21:41:31.911284 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.6:28689] [client 85.203.34.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aUani4TNveA-c6YcSrIKkQAAAcY"]
[Sat Dec 20 21:41:32.523867 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Sat Dec 20 21:41:32.832414 2025] [:error] [pid 33749:tid 33769] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sat Dec 20 21:41:34.703892 2025] [:error] [pid 33749:tid 33758] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Sat Dec 20 21:41:35.017260 2025] [:error] [pid 33749:tid 33771] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Sat Dec 20 21:41:35.323638 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Sat Dec 20 21:41:35.641957 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Sat Dec 20 21:41:36.198329 2025] [:error] [pid 33749:tid 33753] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Sat Dec 20 21:41:36.498717 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Sat Dec 20 21:41:36.793876 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.15:44951] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Sat Dec 20 21:41:37.415220 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.15:44951] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aUankdoInXJnb96wei9XWwAAAow"]
[Sat Dec 20 21:41:38.004698 2025] [:error] [pid 33793:tid 33819] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Sat Dec 20 21:41:38.312362 2025] [:error] [pid 33793:tid 33816] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Sat Dec 20 21:41:39.765231 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sat Dec 20 21:41:40.071204 2025] [:error] [pid 33793:tid 33799] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Sat Dec 20 21:41:40.377336 2025] [:error] [pid 33793:tid 33805] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Sat Dec 20 21:41:40.899988 2025] [:error] [pid 33793:tid 33818] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Sat Dec 20 21:41:41.186300 2025] [:error] [pid 33793:tid 33815] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Sat Dec 20 21:41:42.065171 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Sat Dec 20 21:41:42.363667 2025] [:error] [pid 33793:tid 33797] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Sat Dec 20 21:41:42.926642 2025] [:error] [pid 33793:tid 33819] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Sat Dec 20 21:41:43.209303 2025] [:error] [pid 33793:tid 33813] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Sat Dec 20 21:41:43.499315 2025] [:error] [pid 33793:tid 33802] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Sat Dec 20 21:41:43.779851 2025] [:error] [pid 33793:tid 33796] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Sat Dec 20 21:41:44.100176 2025] [:error] [pid 33793:tid 33817] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Sat Dec 20 21:41:44.868197 2025] [:error] [pid 33793:tid 33808] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Sat Dec 20 21:41:45.159831 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Sat Dec 20 21:41:45.767752 2025] [:error] [pid 33793:tid 33795] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Sat Dec 20 21:41:46.068695 2025] [:error] [pid 33793:tid 33818] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Sat Dec 20 21:41:46.357627 2025] [:error] [pid 33793:tid 33812] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Sat Dec 20 21:41:46.644765 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Dec 20 21:41:46.935914 2025] [:error] [pid 33793:tid 33800] [client 85.203.34.47:48089] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Sat Dec 20 21:41:47.449683 2025] [:error] [pid 33793:tid 33797] [client 85.203.34.47:48089] [client 85.203.34.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/lx.php"] [unique_id "aUanm1SicyB0BFmbRMzP9QAAAsI"]
[Sat Dec 20 21:41:48.994769 2025] [:error] [pid 33844:tid 33859] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Sat Dec 20 21:41:49.325936 2025] [:error] [pid 33844:tid 33853] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Sat Dec 20 21:41:49.636637 2025] [:error] [pid 33844:tid 33867] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Sat Dec 20 21:41:49.966446 2025] [:error] [pid 33844:tid 33855] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Sat Dec 20 21:41:50.269076 2025] [:error] [pid 33844:tid 33851] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Sat Dec 20 21:41:50.818854 2025] [:error] [pid 33844:tid 33857] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sat Dec 20 21:41:51.138428 2025] [:error] [pid 33844:tid 33852] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Sat Dec 20 21:41:51.440254 2025] [:error] [pid 33844:tid 33865] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Sat Dec 20 21:41:51.752115 2025] [:error] [pid 33844:tid 33846] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Sat Dec 20 21:41:52.295271 2025] [:error] [pid 33844:tid 33853] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Sat Dec 20 21:41:52.604300 2025] [:error] [pid 33844:tid 33863] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Dec 20 21:41:53.149187 2025] [:error] [pid 33844:tid 33866] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Sat Dec 20 21:41:53.462026 2025] [:error] [pid 33844:tid 33864] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Sat Dec 20 21:41:53.997439 2025] [:error] [pid 33844:tid 33847] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Sat Dec 20 21:41:54.324162 2025] [:error] [pid 33844:tid 33870] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Sat Dec 20 21:41:54.620853 2025] [:error] [pid 33844:tid 33854] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Sat Dec 20 21:41:54.935150 2025] [:error] [pid 33844:tid 33865] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Sat Dec 20 21:41:55.255345 2025] [:error] [pid 33844:tid 33846] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Sat Dec 20 21:41:55.572892 2025] [:error] [pid 33844:tid 33861] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Sat Dec 20 21:41:55.885486 2025] [:error] [pid 33844:tid 33867] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Sat Dec 20 21:41:56.436942 2025] [:error] [pid 33844:tid 33860] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Sat Dec 20 21:41:57.015037 2025] [:error] [pid 33844:tid 33854] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Dec 20 21:41:57.323729 2025] [:error] [pid 33844:tid 33868] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Sat Dec 20 21:41:57.866927 2025] [:error] [pid 33844:tid 33869] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Sat Dec 20 21:41:58.191302 2025] [:error] [pid 33844:tid 33850] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Sat Dec 20 21:41:58.489030 2025] [:error] [pid 33844:tid 33866] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Dec 20 21:41:58.815021 2025] [:error] [pid 33844:tid 33864] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Sat Dec 20 21:41:59.138606 2025] [:error] [pid 33844:tid 33847] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sat Dec 20 21:41:59.439466 2025] [:error] [pid 33844:tid 33854] [client 85.203.34.29:49897] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Sat Dec 20 21:42:06.625478 2025] [:error] [pid 33844:tid 33846] [client 85.203.34.29:49897] [client 85.203.34.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aUanriaNtwGsyqqVmQHzYgAAAwA"]
[Sat Dec 20 21:42:07.779821 2025] [:error] [pid 33570:tid 33596] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Sat Dec 20 21:42:10.476393 2025] [:error] [pid 33570:tid 33578] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Sat Dec 20 21:42:10.762490 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Sat Dec 20 21:42:11.074239 2025] [:error] [pid 33570:tid 33599] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Sat Dec 20 21:42:12.016222 2025] [:error] [pid 33570:tid 33594] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Sat Dec 20 21:42:13.776362 2025] [:error] [pid 33570:tid 33576] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Sat Dec 20 21:42:14.092221 2025] [:error] [pid 33570:tid 33598] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sat Dec 20 21:42:14.423221 2025] [:error] [pid 33570:tid 33579] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sat Dec 20 21:42:14.714300 2025] [:error] [pid 33570:tid 33590] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sat Dec 20 21:42:15.008634 2025] [:error] [pid 33570:tid 33578] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sat Dec 20 21:42:15.334254 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.6:39825] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Sat Dec 20 21:42:15.939441 2025] [:error] [pid 33570:tid 33598] [client 85.203.34.6:39825] [client 85.203.34.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUant4TNveA-c6YcSrIL6wAAAdY"]
[Sat Dec 20 21:42:16.544746 2025] [:error] [pid 33749:tid 33762] [client 85.203.34.16:43363] [client 85.203.34.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.34.16, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aUanuNoInXJnb96wei9ZCAAAAos"]
[Sat Dec 20 21:42:16.546739 2025] [:error] [pid 33749:tid 33762] [client 85.203.34.16:43363] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Dec 20 21:42:16.861606 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.16:43363] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sat Dec 20 21:42:17.706350 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.16:43363] [client 85.203.34.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUanudoInXJnb96wei9ZGQAAApE"]
[Sat Dec 20 21:42:18.834643 2025] [:error] [pid 62124:tid 62137] [client 85.203.34.44:28143] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Sat Dec 20 21:42:20.600670 2025] [:error] [pid 62124:tid 62134] [client 85.203.34.44:28143] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 20 21:42:21.455500 2025] [:error] [pid 62124:tid 62130] [client 85.203.34.44:28143] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sat Dec 20 21:42:21.781637 2025] [:error] [pid 62124:tid 62135] [client 85.203.34.44:28143] [client 85.203.34.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUanvVs94zPA9ULQOjl8EwAAAAk"]
[Sat Dec 20 21:42:22.383201 2025] [:error] [pid 39577:tid 39588] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Sat Dec 20 21:42:22.682170 2025] [:error] [pid 39577:tid 39583] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Sat Dec 20 21:42:22.975781 2025] [:error] [pid 39577:tid 39591] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Sat Dec 20 21:42:24.196697 2025] [:error] [pid 39577:tid 39580] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Sat Dec 20 21:42:24.731714 2025] [:error] [pid 39577:tid 39593] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 20 21:42:25.032562 2025] [:error] [pid 39577:tid 39591] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Dec 20 21:42:25.357729 2025] [:error] [pid 39577:tid 39595] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Sat Dec 20 21:42:26.603115 2025] [:error] [pid 39577:tid 39585] [client 85.203.34.11:39257] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sat Dec 20 21:42:27.460866 2025] [:error] [pid 39577:tid 39596] [client 85.203.34.11:39257] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aUanw7viRnt1rJiSOfxiUAAAANE"]
[Sat Dec 20 21:42:28.038306 2025] [:error] [pid 39493:tid 39571] [client 85.203.34.15:64847] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUanxGhjL2VG_FmIHqD6DQAAAJY"]
[Sat Dec 20 21:42:28.933679 2025] [:error] [pid 39577:tid 39581] [client 85.203.34.22:56293] [client 85.203.34.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aUanxLviRnt1rJiSOfxiaAAAAMI"]
[Sat Dec 20 21:42:29.858379 2025] [:error] [pid 14286:tid 14299] [client 85.203.34.36:61485] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aUanxZ7rbXIrw6rGSdZ_IQAAAUk"]
[Sat Dec 20 21:42:30.760394 2025] [:error] [pid 33844:tid 33864] [client 85.203.34.11:43109] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Sat Dec 20 21:42:31.084407 2025] [:error] [pid 33844:tid 33870] [client 85.203.34.11:43109] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Sat Dec 20 21:42:31.691417 2025] [:error] [pid 33844:tid 33862] [client 85.203.34.11:43109] [client 85.203.34.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.11, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aUanxyaNtwGsyqqVmQH0xAAAAxA"]
[Sat Dec 20 21:42:33.680099 2025] [:error] [pid 33844:tid 33868] [client 85.203.34.11:43109] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sat Dec 20 21:42:34.254265 2025] [:error] [pid 33844:tid 33857] [client 85.203.34.11:43109] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Dec 20 21:42:36.290824 2025] [:error] [pid 33844:tid 33853] [client 85.203.34.11:43109] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aUanzCaNtwGsyqqVmQH0_AAAAwc"]
[Sat Dec 20 21:42:36.891198 2025] [:error] [pid 39493:tid 39570] [client 85.203.34.49:55831] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Dec 20 21:42:37.813616 2025] [:error] [pid 39493:tid 39554] [client 85.203.34.49:55831] [client 85.203.34.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.49, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aUanzWhjL2VG_FmIHqD6XwAAAIU"]
[Sat Dec 20 21:42:38.113727 2025] [:error] [pid 39493:tid 39550] [client 85.203.34.49:55831] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Sat Dec 20 21:42:38.725347 2025] [:error] [pid 39493:tid 39567] [client 85.203.34.49:55831] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Sat Dec 20 21:42:39.027057 2025] [:error] [pid 39493:tid 39556] [client 85.203.34.49:55831] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Sat Dec 20 21:42:39.569306 2025] [:error] [pid 39493:tid 39561] [client 85.203.34.49:55831] [client 85.203.34.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aUanz2hjL2VG_FmIHqD6bwAAAIw"]
[Sat Dec 20 21:42:40.484825 2025] [:error] [pid 39577:tid 39600] [client 85.203.34.11:40777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Dec 20 21:42:40.779217 2025] [:error] [pid 39577:tid 39590] [client 85.203.34.11:40777] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sat Dec 20 21:42:41.076001 2025] [:error] [pid 39577:tid 39585] [client 85.203.34.11:40777] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aUan0bviRnt1rJiSOfxi2QAAAMY"]
[Sat Dec 20 21:42:41.662459 2025] [:error] [pid 33687:tid 33704] [client 85.203.34.2:20837] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aUan0TYMR4qK1N4g7vjMuAAAAk4"]
[Sat Dec 20 21:42:42.247223 2025] [:error] [pid 33793:tid 33809] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Sat Dec 20 21:42:42.556918 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sat Dec 20 21:42:42.866586 2025] [:error] [pid 33793:tid 33816] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sat Dec 20 21:42:43.387762 2025] [:error] [pid 33793:tid 33817] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Dec 20 21:42:43.968663 2025] [:error] [pid 33793:tid 33796] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Sat Dec 20 21:42:45.637239 2025] [:error] [pid 33793:tid 33814] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/zmFM.php
[Sat Dec 20 21:42:49.880606 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Sat Dec 20 21:42:50.182893 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Dec 20 21:42:50.480014 2025] [:error] [pid 33793:tid 33802] [client 85.203.34.24:53841] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Sat Dec 20 21:42:51.115655 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.24:53841] [client 85.203.34.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUan21SicyB0BFmbRMzRtAAAAss"]
[Sat Dec 20 21:42:52.910521 2025] [:error] [pid 33570:tid 33581] [client 85.203.34.17:35083] [client 85.203.34.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bak.php"] [unique_id "aUan3ITNveA-c6YcSrINGAAAAcU"]
[Sat Dec 20 21:42:53.532370 2025] [:error] [pid 33749:tid 33765] [client 85.203.34.27:52821] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sat Dec 20 21:42:53.819494 2025] [:error] [pid 33749:tid 33769] [client 85.203.34.27:52821] [client 85.203.34.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUan3doInXJnb96wei9a2wAAApI"]
[Sat Dec 20 21:42:55.272417 2025] [:error] [pid 39493:tid 39556] [client 85.203.34.36:47411] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Sat Dec 20 21:42:55.879097 2025] [:error] [pid 39493:tid 39565] [client 85.203.34.36:47411] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Dec 20 21:42:56.162308 2025] [:error] [pid 39493:tid 39573] [client 85.203.34.36:47411] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aUan4GhjL2VG_FmIHqD65gAAAJg"]
[Sat Dec 20 21:42:56.745740 2025] [:error] [pid 39493:tid 39553] [client 85.203.34.35:32965] [client 85.203.34.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUan4GhjL2VG_FmIHqD67AAAAIQ"]
[Sat Dec 20 21:42:57.338185 2025] [:error] [pid 33687:tid 33711] [client 85.203.34.26:55349] [client 85.203.34.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.26, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aUan4TYMR4qK1N4g7vjNEgAAAlU"]
[Sat Dec 20 21:42:57.648913 2025] [:error] [pid 33687:tid 33708] [client 85.203.34.26:55349] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sat Dec 20 21:42:58.259478 2025] [:error] [pid 33687:tid 33713] [client 85.203.34.26:55349] [client 85.203.34.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/themes.php"] [unique_id "aUan4jYMR4qK1N4g7vjNGQAAAlc"]
[Sat Dec 20 21:42:59.876565 2025] [:error] [pid 33793:tid 33806] [client 85.203.34.18:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:43:00.705220 2025] [:error] [pid 33793:tid 33815] [client 85.203.34.18:44321] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Sat Dec 20 21:43:02.398980 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.18:44321] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aUan5lSicyB0BFmbRMzSIAAAAsk"]
[Sat Dec 20 21:43:03.014171 2025] [:error] [pid 14286:tid 14306] [client 85.203.34.38:57457] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sat Dec 20 21:43:03.600758 2025] [:error] [pid 14286:tid 14301] [client 85.203.34.38:57457] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aUan557rbXIrw6rGSdaA1gAAAUs"]
[Sat Dec 20 21:43:04.461247 2025] [:error] [pid 33749:tid 33760] [client 85.203.34.17:59483] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Sat Dec 20 21:43:04.869276 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.17:59483] [client 85.203.34.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aUan6NoInXJnb96wei9bagAAAoE"]
[Sat Dec 20 21:43:06.154022 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.13:43085] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Sat Dec 20 21:43:06.476268 2025] [:error] [pid 33749:tid 33762] [client 85.203.34.13:43085] [client 85.203.34.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.13, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aUan6toInXJnb96wei9bkAAAAos"]
[Sat Dec 20 21:43:07.382382 2025] [:error] [pid 33749:tid 33769] [client 85.203.34.13:43085] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aUan69oInXJnb96wei9boAAAApI"]
[Sat Dec 20 21:43:07.980031 2025] [:error] [pid 33844:tid 33860] [client 85.203.34.8:33085] [client 85.203.34.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUan6yaNtwGsyqqVmQH2kAAAAw4"]
[Sat Dec 20 21:43:09.568159 2025] [:error] [pid 33687:tid 33714] [client 85.203.34.42:47701] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sat Dec 20 21:43:10.514838 2025] [:error] [pid 33687:tid 33707] [client 85.203.34.42:47701] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Sat Dec 20 21:43:11.140205 2025] [:error] [pid 33687:tid 33703] [client 85.203.34.42:47701] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Dec 20 21:43:11.691731 2025] [:error] [pid 33687:tid 33709] [client 85.203.34.42:47701] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Sat Dec 20 21:43:12.280567 2025] [:error] [pid 33687:tid 33697] [client 85.203.34.42:47701] [client 85.203.34.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aUan8DYMR4qK1N4g7vjNbgAAAkc"]
[Sat Dec 20 21:43:13.497191 2025] [:error] [pid 33570:tid 33588] [client 85.203.34.25:20583] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUan8YTNveA-c6YcSrINpgAAAcw"]
[Sat Dec 20 21:43:14.113603 2025] [:error] [pid 33793:tid 33811] [client 85.203.34.10:23199] [client 85.203.34.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aUan8lSicyB0BFmbRMzSfAAAAtA"]
[Sat Dec 20 21:43:14.707608 2025] [:error] [pid 33793:tid 33803] [client 85.203.34.39:49829] [client 85.203.34.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aUan8lSicyB0BFmbRMzShAAAAsg"]
[Sat Dec 20 21:43:15.276342 2025] [:error] [pid 14247:tid 14267] [client 85.203.34.44:43923] [client 85.203.34.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aUan8yDv9TtKKdJQn9kULwAAARI"]
[Sat Dec 20 21:43:19.406182 2025] [:error] [pid 14286:tid 14300] [client 85.203.34.21:45079] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Sat Dec 20 21:43:19.681290 2025] [:error] [pid 14286:tid 14311] [client 85.203.34.21:45079] [client 85.203.34.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aUan957rbXIrw6rGSdaBpwAAAVU"]
[Sat Dec 20 21:43:20.835169 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.2:34871] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Dec 20 21:43:21.140812 2025] [:error] [pid 39493:tid 39550] [client 85.203.34.2:34871] File does not exist: /usr/local/apache/htdocs/suspended-page/rcc.php
[Sat Dec 20 21:43:21.440893 2025] [:error] [pid 39493:tid 39565] [client 85.203.34.2:34871] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUan-WhjL2VG_FmIHqD8JwAAAJA"]
[Sat Dec 20 21:43:22.029519 2025] [:error] [pid 14286:tid 14314] [client 85.203.34.18:22297] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sat Dec 20 21:43:22.312918 2025] [:error] [pid 14286:tid 14312] [client 85.203.34.18:22297] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Sat Dec 20 21:43:22.840333 2025] [:error] [pid 14286:tid 14297] [client 85.203.34.18:22297] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUan-p7rbXIrw6rGSdaB0gAAAUc"]
[Sat Dec 20 21:43:24.438000 2025] [:error] [pid 33570:tid 33585] [client 85.203.34.12:27063] File does not exist: /usr/local/apache/htdocs/suspended-page/history.php
[Sat Dec 20 21:43:24.721132 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.12:27063] [client 85.203.34.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aUan_ITNveA-c6YcSrIOMwAAAc8"]
[Sat Dec 20 21:43:26.518699 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.37:43075] [client 85.203.34.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aUan_toInXJnb96wei9ciQAAAoo"]
[Sat Dec 20 21:43:27.097518 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.4:49199] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aUan_2hjL2VG_FmIHqD8ZgAAAJQ"]
[Sat Dec 20 21:43:28.236719 2025] [:error] [pid 39493:tid 39562] [client 85.203.34.50:49667] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aUaoAGhjL2VG_FmIHqD8cwAAAI0"]
[Sat Dec 20 21:43:28.825627 2025] [:error] [pid 39577:tid 39594] [client 85.203.34.36:37655] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 21:43:29.412569 2025] [:error] [pid 39577:tid 39596] [client 85.203.34.36:37655] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Dec 20 21:43:29.930983 2025] [:error] [pid 39577:tid 39599] [client 85.203.34.36:37655] [client 85.203.34.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.36, incrementing brute counter"] [hostname "rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUaoAbviRnt1rJiSOfxlRgAAANQ"]
[Sat Dec 20 21:43:30.519420 2025] [:error] [pid 39577:tid 39598] [client 85.203.34.36:37655] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aUaoArviRnt1rJiSOfxlUgAAANM"]
[Sat Dec 20 21:43:31.152535 2025] [:error] [pid 39493:tid 39552] [client 85.203.34.1:63349] [client 85.203.34.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aUaoA2hjL2VG_FmIHqD8mgAAAIM"]
[Sat Dec 20 21:43:31.772970 2025] [:error] [pid 39493:tid 39555] [client 85.203.34.39:43081] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sat Dec 20 21:43:32.082068 2025] [:error] [pid 39493:tid 39553] [client 85.203.34.39:43081] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sat Dec 20 21:43:32.391139 2025] [:error] [pid 39493:tid 39566] [client 85.203.34.39:43081] [client 85.203.34.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/classwithtostring.php"] [unique_id "aUaoBGhjL2VG_FmIHqD8rwAAAJE"]
[Sat Dec 20 21:43:33.886495 2025] [:error] [pid 62124:tid 62139] [client 85.203.34.2:30267] File does not exist: /usr/local/apache/htdocs/suspended-page/login.php
[Sat Dec 20 21:43:34.785988 2025] [:error] [pid 62124:tid 62149] [client 85.203.34.2:30267] [client 85.203.34.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aUaoBls94zPA9ULQOjl_CwAAABc"]
[Sat Dec 20 21:43:35.083699 2025] [:error] [pid 62124:tid 62146] [client 85.203.34.2:30267] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aUaoB1s94zPA9ULQOjl_EAAAABQ"]
[Sat Dec 20 21:43:35.646821 2025] [:error] [pid 14247:tid 14257] [client 185.92.25.138:26759] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aUaoByDv9TtKKdJQn9kU3gAAAQg"]
[Sat Dec 20 21:43:36.264127 2025] [:error] [pid 33570:tid 33587] [client 85.203.34.18:61963] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aUaoCITNveA-c6YcSrIOpwAAAcs"]
[Sat Dec 20 21:43:38.105322 2025] [:error] [pid 33749:tid 33756] [client 85.203.34.13:54413] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Sat Dec 20 21:43:38.412049 2025] [:error] [pid 33749:tid 33765] [client 85.203.34.13:54413] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aUaoCtoInXJnb96wei9c-wAAAo4"]
[Sat Dec 20 21:43:39.269852 2025] [:error] [pid 33749:tid 33774] [client 85.203.34.25:41827] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Sat Dec 20 21:43:41.028934 2025] [:error] [pid 33749:tid 33770] [client 85.203.34.25:41827] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Dec 20 21:43:41.961427 2025] [:error] [pid 33749:tid 33760] [client 85.203.34.25:41827] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Sat Dec 20 21:43:42.479888 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.25:41827] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUaoDtoInXJnb96wei9dKwAAAoY"]
[Sat Dec 20 21:43:43.379874 2025] [:error] [pid 33749:tid 33771] [client 85.203.34.3:52235] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Sat Dec 20 21:43:44.000461 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.3:52235] [client 85.203.34.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUaoD9oInXJnb96wei9dQQAAApA"]
[Sat Dec 20 21:43:44.920396 2025] [:error] [pid 14286:tid 14304] [client 85.203.34.6:38463] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Dec 20 21:43:46.095978 2025] [:error] [pid 14286:tid 14310] [client 85.203.34.6:38463] [client 85.203.34.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aUaoEp7rbXIrw6rGSdaDUwAAAVQ"]
[Sat Dec 20 21:43:46.993707 2025] [:error] [pid 33687:tid 33696] [client 85.203.34.43:45341] [client 85.203.34.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aUaoEjYMR4qK1N4g7vjOzQAAAkY"]
[Sat Dec 20 21:43:47.861619 2025] [:error] [pid 14286:tid 14295] [client 85.203.34.4:41335] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUaoE57rbXIrw6rGSdaDegAAAUU"]
[Sat Dec 20 21:43:48.807196 2025] [:error] [pid 33570:tid 33581] [client 85.203.34.20:39879] [client 85.203.34.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aUaoFITNveA-c6YcSrIPFAAAAcU"]
[Sat Dec 20 21:43:49.693013 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.6:27015] [client 85.203.34.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aUaoFVs94zPA9ULQOjl_jwAAABY"]
[Sat Dec 20 21:43:50.955099 2025] [:error] [pid 33844:tid 33860] [client 85.203.34.33:27959] [client 85.203.34.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aUaoFiaNtwGsyqqVmQH4MgAAAw4"]
[Sat Dec 20 21:43:51.851936 2025] [:error] [pid 39577:tid 39583] [client 85.203.34.23:52827] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Dec 20 21:43:52.475738 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.23:52827] [client 85.203.34.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aUaoGLviRnt1rJiSOfxmYwAAAMo"]
[Sat Dec 20 21:43:53.366850 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.23:51235] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Sat Dec 20 21:43:53.666345 2025] [:error] [pid 33793:tid 33796] [client 85.203.34.23:51235] File does not exist: /usr/local/apache/htdocs/suspended-page/conf_upload.php
[Sat Dec 20 21:43:53.964733 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.23:51235] [client 85.203.34.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aUaoGVSicyB0BFmbRMzTywAAAsY"]
[Sat Dec 20 21:43:55.122706 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.3:50183] [client 85.203.34.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aUaoG9oInXJnb96wei9eAgAAAoY"]
[Sat Dec 20 21:43:55.743614 2025] [:error] [pid 14286:tid 14311] [client 85.203.34.29:25631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sat Dec 20 21:43:56.354098 2025] [:error] [pid 14286:tid 14297] [client 85.203.34.29:25631] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sat Dec 20 21:43:56.939871 2025] [:error] [pid 14286:tid 14308] [client 85.203.34.29:25631] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Dec 20 21:43:57.234207 2025] [:error] [pid 14286:tid 14309] [client 85.203.34.29:25631] [client 85.203.34.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aUaoHZ7rbXIrw6rGSdaEAQAAAVM"]
[Sat Dec 20 21:43:58.099599 2025] [:error] [pid 33749:tid 33769] [client 85.203.34.14:61107] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat Dec 20 21:43:59.001016 2025] [:error] [pid 33749:tid 33770] [client 85.203.34.14:61107] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sat Dec 20 21:43:59.320442 2025] [:error] [pid 33749:tid 33771] [client 85.203.34.14:61107] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sat Dec 20 21:44:00.474639 2025] [:error] [pid 33749:tid 33759] [client 85.203.34.14:61107] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sat Dec 20 21:44:00.898041 2025] [:error] [pid 33749:tid 33760] [client 85.203.34.14:61107] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Sat Dec 20 21:44:02.376565 2025] [:error] [pid 33749:tid 33751] [client 85.203.34.14:61107] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Sat Dec 20 21:44:02.665405 2025] [:error] [pid 33749:tid 33753] [client 85.203.34.14:61107] [client 85.203.34.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aUaoItoInXJnb96wei9eaAAAAoI"]
[Sat Dec 20 21:44:03.233199 2025] [:error] [pid 39577:tid 39600] [client 85.203.34.46:57497] [client 85.203.34.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aUaoI7viRnt1rJiSOfxm2gAAANU"]
[Sat Dec 20 21:44:03.870183 2025] [:error] [pid 33749:tid 33751] [client 85.203.34.50:61609] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Dec 20 21:44:04.179290 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.50:61609] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Dec 20 21:44:04.497630 2025] [:error] [pid 33749:tid 33758] [client 85.203.34.50:61609] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Dec 20 21:44:05.022723 2025] [:error] [pid 33749:tid 33751] [client 85.203.34.50:61609] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aUaoJdoInXJnb96wei9ekgAAAoA"]
[Sat Dec 20 21:44:05.647979 2025] [:error] [pid 39493:tid 39565] [client 85.203.34.50:31003] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUaoJWhjL2VG_FmIHqD-FAAAAJA"]
[Sat Dec 20 21:44:09.266666 2025] [:error] [pid 33749:tid 33759] [client 85.203.34.2:42563] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Dec 20 21:44:09.802182 2025] [:error] [pid 33749:tid 33775] [client 85.203.34.2:42563] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aUaoKdoInXJnb96wei9e9gAAApg"]
[Sat Dec 20 21:44:10.430462 2025] [:error] [pid 14286:tid 14300] [client 85.203.34.38:43567] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Sat Dec 20 21:44:10.748860 2025] [:error] [pid 14286:tid 14304] [client 85.203.34.38:43567] File does not exist: /usr/local/apache/htdocs/suspended-page/sck.php
[Sat Dec 20 21:44:11.063423 2025] [:error] [pid 14286:tid 14305] [client 85.203.34.38:43567] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Sat Dec 20 21:44:11.704467 2025] [:error] [pid 14286:tid 14308] [client 85.203.34.38:43567] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Sat Dec 20 21:44:12.235954 2025] [:error] [pid 14286:tid 14311] [client 85.203.34.38:43567] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 21:44:12.547604 2025] [:error] [pid 14286:tid 14293] [client 85.203.34.38:43567] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aUaoLJ7rbXIrw6rGSdaFEAAAAUM"]
[Sat Dec 20 21:44:13.529032 2025] [:error] [pid 14247:tid 14262] [client 85.203.34.14:34587] [client 85.203.34.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.14, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUaoLSDv9TtKKdJQn9kV3wAAAQ0"]
[Sat Dec 20 21:44:13.834135 2025] [:error] [pid 14247:tid 14265] [client 85.203.34.14:34587] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sat Dec 20 21:44:14.144032 2025] [:error] [pid 14247:tid 14261] [client 85.203.34.14:34587] [client 85.203.34.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUaoLiDv9TtKKdJQn9kV5QAAAQw"]
[Sat Dec 20 21:44:14.747264 2025] [:error] [pid 14247:tid 14272] [client 85.203.34.8:41277] [client 85.203.34.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aUaoLiDv9TtKKdJQn9kV6AAAARc"]
[Sat Dec 20 21:44:15.679780 2025] [:error] [pid 33749:tid 33756] [client 85.203.34.17:50287] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:44:16.004869 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.17:50287] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Sat Dec 20 21:44:16.304986 2025] [:error] [pid 33749:tid 33770] [client 85.203.34.17:50287] [client 85.203.34.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aUaoMNoInXJnb96wei9fTQAAApM"]
[Sat Dec 20 21:44:16.892812 2025] [:error] [pid 39493:tid 39571] [client 85.203.34.44:22127] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Sat Dec 20 21:44:17.194947 2025] [:error] [pid 39493:tid 39555] [client 85.203.34.44:22127] [client 85.203.34.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aUaoMWhjL2VG_FmIHqD-YgAAAIY"]
[Sat Dec 20 21:44:18.093629 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.23:54611] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Dec 20 21:44:18.381397 2025] [:error] [pid 39577:tid 39583] [client 85.203.34.23:54611] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sat Dec 20 21:44:18.684979 2025] [:error] [pid 39577:tid 39598] [client 85.203.34.23:54611] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/cloud.php
[Sat Dec 20 21:44:20.429744 2025] [:error] [pid 39577:tid 39602] [client 85.203.34.23:54611] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Sat Dec 20 21:44:20.980578 2025] [:error] [pid 39577:tid 39592] [client 85.203.34.23:54611] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/class_api.php
[Sat Dec 20 21:44:21.662968 2025] [:error] [pid 39577:tid 39602] [client 85.203.34.23:54611] [client 85.203.34.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aUaoNbviRnt1rJiSOfxnxgAAANc"]
[Sat Dec 20 21:44:22.282367 2025] [:error] [pid 39577:tid 39590] [client 85.203.34.40:30797] File does not exist: /usr/local/apache/htdocs/suspended-page/base.php
[Sat Dec 20 21:44:22.938882 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.40:30797] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Sat Dec 20 21:44:23.251819 2025] [:error] [pid 39577:tid 39582] [client 85.203.34.40:30797] [client 85.203.34.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aUaoN7viRnt1rJiSOfxn5QAAAMM"]
[Sat Dec 20 21:44:24.207670 2025] [:error] [pid 39577:tid 39582] [client 85.203.34.35:62051] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sat Dec 20 21:44:24.518495 2025] [:error] [pid 39577:tid 39581] [client 85.203.34.35:62051] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Dec 20 21:44:24.822630 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.35:62051] [client 85.203.34.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.35, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUaoOLviRnt1rJiSOfxoBgAAAMo"]
[Sat Dec 20 21:44:24.826397 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.35:62051] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sat Dec 20 21:44:26.284976 2025] [:error] [pid 39577:tid 39579] [client 85.203.34.35:62051] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Sat Dec 20 21:44:26.596262 2025] [:error] [pid 39577:tid 39586] [client 85.203.34.35:62051] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Dec 20 21:44:27.436035 2025] [:error] [pid 39577:tid 39588] [client 85.203.34.35:62051] [client 85.203.34.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mah.php"] [unique_id "aUaoO7viRnt1rJiSOfxoOgAAAMk"]
[Sat Dec 20 21:44:28.022368 2025] [:error] [pid 14286:tid 14314] [client 85.203.34.4:43801] [client 85.203.34.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.4, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aUaoPJ7rbXIrw6rGSdaFiAAAAVg"]
[Sat Dec 20 21:44:28.330917 2025] [:error] [pid 14286:tid 14297] [client 85.203.34.4:43801] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aUaoPJ7rbXIrw6rGSdaFjQAAAUc"]
[Sat Dec 20 21:44:31.533911 2025] [:error] [pid 33687:tid 33707] [client 85.203.34.10:35763] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sat Dec 20 21:44:32.705230 2025] [:error] [pid 33687:tid 33700] [client 85.203.34.10:35763] [client 85.203.34.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aUaoQDYMR4qK1N4g7vjRTwAAAko"]
[Sat Dec 20 21:44:33.284564 2025] [:error] [pid 33844:tid 33862] [client 85.203.34.14:62973] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Dec 20 21:44:33.891381 2025] [:error] [pid 33844:tid 33859] [client 85.203.34.14:62973] [client 85.203.34.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aUaoQSaNtwGsyqqVmQH5xQAAAw0"]
[Sat Dec 20 21:44:34.822229 2025] [:error] [pid 33793:tid 33818] [client 85.203.34.29:21187] [client 85.203.34.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.29, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aUaoQlSicyB0BFmbRMzVPAAAAtc"]
[Sat Dec 20 21:44:35.752496 2025] [:error] [pid 33793:tid 33813] [client 85.203.34.29:21187] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sat Dec 20 21:44:36.040672 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.29:21187] File does not exist: /usr/local/apache/htdocs/suspended-page/bulk.php
[Sat Dec 20 21:44:36.350228 2025] [:error] [pid 33793:tid 33797] [client 85.203.34.29:21187] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Sat Dec 20 21:44:36.992871 2025] [:error] [pid 33793:tid 33814] [client 85.203.34.29:21187] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logout.php
[Sat Dec 20 21:44:37.313044 2025] [:error] [pid 33793:tid 33804] [client 85.203.34.29:21187] [client 85.203.34.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aUaoRVSicyB0BFmbRMzVYAAAAsk"]
[Sat Dec 20 21:44:38.475690 2025] [:error] [pid 33749:tid 33760] [client 85.203.34.36:28377] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/packed.php"] [unique_id "aUaoRtoInXJnb96wei9g3wAAAok"]
[Sat Dec 20 21:44:39.073861 2025] [:error] [pid 14247:tid 14264] [client 85.203.34.45:30743] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Dec 20 21:44:39.405730 2025] [:error] [pid 14247:tid 14250] [client 85.203.34.45:30743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sat Dec 20 21:44:40.308142 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.45:30743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sat Dec 20 21:44:40.617723 2025] [:error] [pid 14247:tid 14258] [client 85.203.34.45:30743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-simple.php
[Sat Dec 20 21:44:41.556236 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.45:30743] [client 85.203.34.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aUaoSSDv9TtKKdJQn9kXCwAAAQg"]
[Sat Dec 20 21:44:42.461247 2025] [:error] [pid 39493:tid 39572] [client 85.203.34.9:27353] [client 85.203.34.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aUaoSmhjL2VG_FmIHqD_JAAAAJc"]
[Sat Dec 20 21:44:43.346249 2025] [:error] [pid 33793:tid 33803] [client 185.92.25.139:41921] [client 185.92.25.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aUaoS1SicyB0BFmbRMzVfwAAAsg"]
[Sat Dec 20 21:44:44.224072 2025] [:error] [pid 39493:tid 39550] [client 85.203.34.50:63007] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sat Dec 20 21:44:45.753326 2025] [:error] [pid 39493:tid 39568] [client 85.203.34.50:63007] [client 85.203.34.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.50, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aUaoTWhjL2VG_FmIHqD_VwAAAJM"]
[Sat Dec 20 21:44:46.331055 2025] [:error] [pid 39493:tid 39569] [client 85.203.34.50:63007] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUaoTmhjL2VG_FmIHqD_XwAAAJQ"]
[Sat Dec 20 21:44:48.088918 2025] [:error] [pid 39493:tid 39563] [client 85.203.34.38:56581] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Sat Dec 20 21:44:48.399377 2025] [:error] [pid 39493:tid 39555] [client 85.203.34.38:56581] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sat Dec 20 21:44:49.021610 2025] [:error] [pid 39493:tid 39552] [client 85.203.34.38:56581] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUaoUWhjL2VG_FmIHqD_hAAAAIM"]
[Sat Dec 20 21:44:49.607921 2025] [:error] [pid 14247:tid 14266] [client 85.203.34.29:27475] [client 85.203.34.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aUaoUSDv9TtKKdJQn9kXagAAARE"]
[Sat Dec 20 21:44:50.249236 2025] [:error] [pid 62124:tid 62136] [client 85.203.34.49:49379] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Sat Dec 20 21:44:51.445665 2025] [:error] [pid 62124:tid 62134] [client 85.203.34.49:49379] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/moon.php
[Sat Dec 20 21:44:52.400173 2025] [:error] [pid 62124:tid 62133] [client 85.203.34.49:49379] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/dropdown.php
[Sat Dec 20 21:44:52.734117 2025] [:error] [pid 62124:tid 62137] [client 85.203.34.49:49379] [client 85.203.34.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aUaoVFs94zPA9ULQOjmCUwAAAAs"]
[Sat Dec 20 21:44:53.390340 2025] [:error] [pid 14286:tid 14313] [client 85.203.34.38:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 20 21:44:53.945882 2025] [:error] [pid 14286:tid 14299] [client 85.203.34.38:21095] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Sat Dec 20 21:44:54.567956 2025] [:error] [pid 14286:tid 14296] [client 85.203.34.38:21095] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/votes.php"] [unique_id "aUaoVp7rbXIrw6rGSdaGlQAAAUY"]
[Sat Dec 20 21:44:56.906762 2025] [:error] [pid 33570:tid 33584] [client 85.203.34.34:25497] File does not exist: /usr/local/apache/htdocs/suspended-page/sk.php
[Sat Dec 20 21:44:57.532344 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.34:25497] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/blurbs.php
[Sat Dec 20 21:44:58.119966 2025] [:error] [pid 33570:tid 33577] [client 85.203.34.34:25497] [client 85.203.34.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "aUaoWoTNveA-c6YcSrIRBwAAAcE"]
[Sat Dec 20 21:44:59.961843 2025] [:error] [pid 33844:tid 33867] [client 85.203.34.26:52775] [client 85.203.34.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aUaoWyaNtwGsyqqVmQH6_gAAAxU"]
[Sat Dec 20 21:45:01.795983 2025] [:error] [pid 39493:tid 39551] [client 85.203.34.39:20111] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Sat Dec 20 21:45:02.729793 2025] [:error] [pid 39493:tid 39573] [client 85.203.34.39:20111] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sat Dec 20 21:45:03.142793 2025] [:error] [pid 39493:tid 39560] [client 85.203.34.39:20111] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sat Dec 20 21:45:03.459352 2025] [:error] [pid 39493:tid 39562] [client 85.203.34.39:20111] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sat Dec 20 21:45:03.792212 2025] [:error] [pid 39493:tid 39557] [client 85.203.34.39:20111] [client 85.203.34.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aUaoX2hjL2VG_FmIHqAABwAAAIg"]
[Sat Dec 20 21:45:04.396516 2025] [:error] [pid 33844:tid 33864] [client 85.203.34.30:50457] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/doc.php
[Sat Dec 20 21:45:04.704248 2025] [:error] [pid 33844:tid 33870] [client 85.203.34.30:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/fm1.php
[Sat Dec 20 21:45:05.630182 2025] [:error] [pid 33844:tid 33850] [client 85.203.34.30:50457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Sat Dec 20 21:45:05.929563 2025] [:error] [pid 33844:tid 33862] [client 85.203.34.30:50457] [client 85.203.34.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aUaoYSaNtwGsyqqVmQH7OwAAAxA"]
[Sat Dec 20 21:45:06.519512 2025] [:error] [pid 14286:tid 14296] [client 85.203.34.48:29743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Sat Dec 20 21:45:06.851611 2025] [:error] [pid 14286:tid 14308] [client 85.203.34.48:29743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sat Dec 20 21:45:07.496619 2025] [:error] [pid 14286:tid 14308] [client 85.203.34.48:29743] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Sat Dec 20 21:45:08.129473 2025] [:error] [pid 14286:tid 14290] [client 85.203.34.48:29743] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi01.php
[Sat Dec 20 21:45:09.068712 2025] [:error] [pid 14286:tid 14305] [client 85.203.34.48:29743] [client 85.203.34.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/item.php"] [unique_id "aUaoZZ7rbXIrw6rGSdaHgQAAAU8"]
[Sat Dec 20 21:45:11.638390 2025] [:error] [pid 62124:tid 62138] [client 85.203.34.21:40181] [client 85.203.34.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.21, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aUaoZ1s94zPA9ULQOjmDFQAAAAw"]
[Sat Dec 20 21:45:11.973991 2025] [:error] [pid 62124:tid 62137] [client 85.203.34.21:40181] [client 85.203.34.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.21, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aUaoZ1s94zPA9ULQOjmDGgAAAAs"]
[Sat Dec 20 21:45:12.272775 2025] [:error] [pid 62124:tid 62147] [client 85.203.34.21:40181] [client 85.203.34.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mani.php"] [unique_id "aUaoaFs94zPA9ULQOjmDHwAAABU"]
[Sat Dec 20 21:45:13.973410 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.33:48533] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Dec 20 21:45:16.649373 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.33:48533] [client 85.203.34.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aUaobNoInXJnb96wei9jWgAAAoM"]
[Sat Dec 20 21:45:17.532335 2025] [:error] [pid 33687:tid 33694] [client 85.203.34.5:49159] File does not exist: /usr/local/apache/htdocs/suspended-page/images.php
[Sat Dec 20 21:45:17.834999 2025] [:error] [pid 33687:tid 33698] [client 85.203.34.5:49159] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aespa.php
[Sat Dec 20 21:45:18.168400 2025] [:error] [pid 33687:tid 33696] [client 85.203.34.5:49159] [client 85.203.34.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUaobjYMR4qK1N4g7vjTZAAAAkY"]
[Sat Dec 20 21:45:18.769932 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.18:23585] [client 85.203.34.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/install.php"] [unique_id "aUaobtoInXJnb96wei9jdwAAAow"]
[Sat Dec 20 21:45:21.179893 2025] [:error] [pid 14286:tid 14307] [client 85.203.34.42:21625] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mariju.php
[Sat Dec 20 21:45:22.171022 2025] [:error] [pid 14286:tid 14304] [client 85.203.34.42:21625] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/themes.php
[Sat Dec 20 21:45:22.816928 2025] [:error] [pid 14286:tid 14297] [client 85.203.34.42:21625] [client 85.203.34.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aUaocp7rbXIrw6rGSdaISQAAAUc"]
[Sat Dec 20 21:45:23.436850 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.8:40549] [client 85.203.34.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aUaoc9oInXJnb96wei9j7wAAApE"]
[Sat Dec 20 21:45:24.366106 2025] [:error] [pid 33793:tid 33797] [client 85.203.34.46:33811] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sat Dec 20 21:45:25.381018 2025] [:error] [pid 33793:tid 33802] [client 85.203.34.46:33811] [client 85.203.34.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.46, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/wp-login.php"] [unique_id "aUaodVSicyB0BFmbRMzW5AAAAsc"]
[Sat Dec 20 21:45:26.749916 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.46:33811] [client 85.203.34.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aUaodlSicyB0BFmbRMzW8gAAAsY"]
[Sat Dec 20 21:45:27.398816 2025] [:error] [pid 39493:tid 39572] [client 85.203.34.46:26623] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Dec 20 21:45:27.721859 2025] [:error] [pid 39493:tid 39567] [client 85.203.34.46:26623] [client 85.203.34.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aUaod2hjL2VG_FmIHqABIgAAAJI"]
[Sat Dec 20 21:45:28.589364 2025] [:error] [pid 14286:tid 14312] [client 85.203.34.16:27491] [client 85.203.34.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aUaoeJ7rbXIrw6rGSdaImQAAAVY"]
[Sat Dec 20 21:45:29.507995 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.38:22753] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUaoedoInXJnb96wei9kjwAAAoQ"]
[Sat Dec 20 21:45:31.822449 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.19:30867] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/parx.php
[Sat Dec 20 21:45:32.685413 2025] [:error] [pid 33749:tid 33756] [client 85.203.34.19:30867] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aUaofNoInXJnb96wei9kyQAAAoU"]
[Sat Dec 20 21:45:33.557293 2025] [:error] [pid 39493:tid 39573] [client 85.203.34.27:36571] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sat Dec 20 21:45:33.882838 2025] [:error] [pid 39493:tid 39555] [client 85.203.34.27:36571] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sat Dec 20 21:45:35.160496 2025] [:error] [pid 39493:tid 39550] [client 85.203.34.27:36571] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sat Dec 20 21:45:35.481613 2025] [:error] [pid 39493:tid 39560] [client 85.203.34.27:36571] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Sat Dec 20 21:45:35.773943 2025] [:error] [pid 39493:tid 39567] [client 85.203.34.27:36571] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Sat Dec 20 21:45:36.058908 2025] [:error] [pid 39493:tid 39556] [client 85.203.34.27:36571] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sat Dec 20 21:45:36.635228 2025] [:error] [pid 39493:tid 39563] [client 85.203.34.27:36571] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Dec 20 21:45:37.743153 2025] [:error] [pid 39493:tid 39549] [client 85.203.34.27:36571] [client 85.203.34.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/radio.php"] [unique_id "aUaogWhjL2VG_FmIHqABggAAAIA"]
[Sat Dec 20 21:45:38.641437 2025] [:error] [pid 39577:tid 39588] [client 85.203.34.38:29121] File does not exist: /usr/local/apache/htdocs/suspended-page/payout.php
[Sat Dec 20 21:45:38.954760 2025] [:error] [pid 39577:tid 39581] [client 85.203.34.38:29121] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Dec 20 21:45:39.297689 2025] [:error] [pid 39577:tid 39580] [client 85.203.34.38:29121] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Dec 20 21:45:39.596567 2025] [:error] [pid 39577:tid 39596] [client 85.203.34.38:29121] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Sat Dec 20 21:45:40.222155 2025] [:error] [pid 39577:tid 39600] [client 85.203.34.38:29121] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Sat Dec 20 21:45:40.531425 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.38:29121] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Sat Dec 20 21:45:41.141823 2025] [:error] [pid 39577:tid 39583] [client 85.203.34.38:29121] [client 85.203.34.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aUaohbviRnt1rJiSOfxrkQAAAMQ"]
[Sat Dec 20 21:45:42.045943 2025] [:error] [pid 33687:tid 33701] [client 85.203.34.10:38405] [client 85.203.34.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/Cache/Cache.php"] [unique_id "aUaohjYMR4qK1N4g7vjU1AAAAks"]
[Sat Dec 20 21:45:43.881236 2025] [:error] [pid 33687:tid 33708] [client 85.203.34.17:55097] [client 85.203.34.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aUaohzYMR4qK1N4g7vjVBAAAAlI"]
[Sat Dec 20 21:45:44.756138 2025] [:error] [pid 33687:tid 33701] [client 85.203.34.5:56535] [client 85.203.34.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aUaoiDYMR4qK1N4g7vjVHgAAAks"]
[Sat Dec 20 21:45:46.506746 2025] [:error] [pid 39577:tid 39601] [client 85.203.34.48:20689] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sat Dec 20 21:45:46.798295 2025] [:error] [pid 39577:tid 39583] [client 85.203.34.48:20689] File does not exist: /usr/local/apache/htdocs/suspended-page/fox.php
[Sat Dec 20 21:45:47.345492 2025] [:error] [pid 39577:tid 39589] [client 85.203.34.48:20689] File does not exist: /usr/local/apache/htdocs/suspended-page/google.php
[Sat Dec 20 21:45:47.938102 2025] [:error] [pid 39577:tid 39588] [client 85.203.34.48:20689] File does not exist: /usr/local/apache/htdocs/suspended-page/ovatools.php
[Sat Dec 20 21:45:48.484579 2025] [:error] [pid 39577:tid 39580] [client 85.203.34.48:20689] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwso.php
[Sat Dec 20 21:45:48.783852 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.48:20689] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Sat Dec 20 21:45:49.076681 2025] [:error] [pid 39577:tid 39585] [client 85.203.34.48:20689] [client 85.203.34.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aUaojbviRnt1rJiSOfxsDQAAAMY"]
[Sat Dec 20 21:45:49.696887 2025] [:error] [pid 39493:tid 39570] [client 85.203.34.5:26603] [client 85.203.34.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aUaojWhjL2VG_FmIHqACLwAAAJU"]
[Sat Dec 20 21:45:51.170058 2025] [:error] [pid 39577:tid 39590] [client 85.203.34.26:59393] [client 85.203.34.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aUaoj7viRnt1rJiSOfxsLgAAAMs"]
[Sat Dec 20 21:45:52.144292 2025] [:error] [pid 14247:tid 14266] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sat Dec 20 21:45:52.697885 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Sat Dec 20 21:45:53.039517 2025] [:error] [pid 14247:tid 14250] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/style2.php
[Sat Dec 20 21:45:53.375300 2025] [:error] [pid 14247:tid 14267] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scripts.php
[Sat Dec 20 21:45:54.388187 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Dec 20 21:45:54.720886 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Sat Dec 20 21:45:55.043836 2025] [:error] [pid 14247:tid 14250] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/comfunctions.php
[Sat Dec 20 21:45:55.577223 2025] [:error] [pid 14247:tid 14258] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sat Dec 20 21:45:56.119162 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Sat Dec 20 21:45:56.459056 2025] [:error] [pid 14247:tid 14256] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sat Dec 20 21:45:56.786046 2025] [:error] [pid 14247:tid 14251] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/hinfofuns.php
[Sat Dec 20 21:45:57.134052 2025] [:error] [pid 14247:tid 14252] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/qfunctions.php
[Sat Dec 20 21:45:57.468660 2025] [:error] [pid 14247:tid 14249] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/qinfofuns.php
[Sat Dec 20 21:45:57.994572 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Sat Dec 20 21:45:58.327018 2025] [:error] [pid 14247:tid 14265] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Sat Dec 20 21:45:58.640331 2025] [:error] [pid 14247:tid 14268] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php
[Sat Dec 20 21:45:58.945966 2025] [:error] [pid 14247:tid 14254] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Sat Dec 20 21:45:59.227564 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sat Dec 20 21:45:59.536036 2025] [:error] [pid 14247:tid 14251] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/my-sites.php
[Sat Dec 20 21:45:59.831522 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Sat Dec 20 21:46:00.364832 2025] [:error] [pid 14247:tid 14267] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/nav-menus.php
[Sat Dec 20 21:46:00.662592 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sat Dec 20 21:46:01.016344 2025] [:error] [pid 14247:tid 14263] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Sat Dec 20 21:46:01.338859 2025] [:error] [pid 14247:tid 14259] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/revision.php
[Sat Dec 20 21:46:01.667766 2025] [:error] [pid 14247:tid 14272] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Sat Dec 20 21:46:01.963357 2025] [:error] [pid 14247:tid 14268] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Sat Dec 20 21:46:02.273466 2025] [:error] [pid 14247:tid 14260] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sat Dec 20 21:46:02.574232 2025] [:error] [pid 14247:tid 14271] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sat Dec 20 21:46:02.878087 2025] [:error] [pid 14247:tid 14261] [client 85.203.34.11:32881] File does not exist: /usr/local/apache/htdocs/suspended-page/moded.php
[Sat Dec 20 21:46:03.174695 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.11:32881] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aUaomyDv9TtKKdJQn9kaoQAAARU"]
[Sat Dec 20 21:46:04.776634 2025] [:error] [pid 39493:tid 39572] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/upgrade.php
[Sat Dec 20 21:46:05.094277 2025] [:error] [pid 39493:tid 39559] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/gh.php
[Sat Dec 20 21:46:05.653261 2025] [:error] [pid 39493:tid 39563] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/version.php
[Sat Dec 20 21:46:05.976613 2025] [:error] [pid 39493:tid 39554] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/head.php
[Sat Dec 20 21:46:06.291752 2025] [:error] [pid 39493:tid 39550] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Sat Dec 20 21:46:06.593157 2025] [:error] [pid 39493:tid 39556] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/theme-insqbzk.php
[Sat Dec 20 21:46:06.878429 2025] [:error] [pid 39493:tid 39559] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Sat Dec 20 21:46:07.199196 2025] [:error] [pid 39493:tid 39557] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Sat Dec 20 21:46:07.814836 2025] [:error] [pid 39493:tid 39556] [client 85.203.34.19:53637] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Sat Dec 20 21:46:08.118488 2025] [:error] [pid 39493:tid 39570] [client 85.203.34.19:53637] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "aUaooGhjL2VG_FmIHqADBwAAAJU"]
[Sat Dec 20 21:46:09.657577 2025] [:error] [pid 33570:tid 33595] [client 85.203.34.38:42285] [client 85.203.34.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php"] [unique_id "aUaooYTNveA-c6YcSrIUYAAAAdM"]
[Sat Dec 20 21:46:10.241113 2025] [:error] [pid 33687:tid 33706] [client 85.203.34.50:41381] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Sat Dec 20 21:46:13.631146 2025] [:error] [pid 33687:tid 33702] [client 85.203.34.50:41381] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aUaopTYMR4qK1N4g7vjWggAAAkw"]
[Sat Dec 20 21:46:14.216055 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.10:48515] [client 85.203.34.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aUaoprviRnt1rJiSOfxtqQAAANI"]
[Sat Dec 20 21:46:15.332117 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.22:49729] [client 85.203.34.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/dropdown.php"] [unique_id "aUaop1s94zPA9ULQOjmGYQAAABY"]
[Sat Dec 20 21:46:16.217047 2025] [:error] [pid 39493:tid 39570] [client 85.203.34.27:27423] [client 85.203.34.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aUaoqGhjL2VG_FmIHqADTAAAAJU"]
[Sat Dec 20 21:46:17.135946 2025] [:error] [pid 33687:tid 33706] [client 85.203.34.13:20413] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/repeater.php"] [unique_id "aUaoqTYMR4qK1N4g7vjWsAAAAlA"]
[Sat Dec 20 21:46:18.687481 2025] [:error] [pid 33687:tid 33702] [client 85.203.34.6:46651] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php
[Sat Dec 20 21:46:18.985234 2025] [:error] [pid 33687:tid 33698] [client 85.203.34.6:46651] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php
[Sat Dec 20 21:46:19.700196 2025] [:error] [pid 33687:tid 33691] [client 85.203.34.6:46651] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php
[Sat Dec 20 21:46:22.285567 2025] [:error] [pid 33687:tid 33699] [client 85.203.34.6:46651] [client 85.203.34.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aUaorjYMR4qK1N4g7vjW_gAAAkk"]
[Sat Dec 20 21:46:23.168059 2025] [:error] [pid 62124:tid 62134] [client 85.203.34.11:60721] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aUaor1s94zPA9ULQOjmGyAAAAAg"]
[Sat Dec 20 21:46:24.099863 2025] [:error] [pid 62124:tid 62136] [client 85.203.34.46:25933] [client 85.203.34.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/options.php"] [unique_id "aUaosFs94zPA9ULQOjmG0wAAAAo"]
[Sat Dec 20 21:46:24.698035 2025] [:error] [pid 33793:tid 33819] [client 85.203.34.2:29177] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Dec 20 21:46:25.356949 2025] [:error] [pid 33793:tid 33803] [client 85.203.34.2:29177] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aUaosVSicyB0BFmbRMzZ9AAAAsg"]
[Sat Dec 20 21:46:26.005440 2025] [:error] [pid 33793:tid 33801] [client 85.203.34.9:47379] [client 85.203.34.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aUaoslSicyB0BFmbRMzZ_gAAAsY"]
[Sat Dec 20 21:46:27.191462 2025] [:error] [pid 62124:tid 62142] [client 85.203.34.5:63077] [client 85.203.34.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.5, incrementing brute counter"] [hostname "rejuva.au"] [uri "/images/wp-login.php"] [unique_id "aUaos1s94zPA9ULQOjmG6QAAABA"]
[Sat Dec 20 21:46:27.543804 2025] [:error] [pid 62124:tid 62148] [client 85.203.34.5:63077] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sat Dec 20 21:46:28.468889 2025] [:error] [pid 62124:tid 62140] [client 85.203.34.5:63077] [client 85.203.34.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aUaotFs94zPA9ULQOjmG9gAAAA4"]
[Sat Dec 20 21:46:29.059066 2025] [:error] [pid 39577:tid 39587] [client 85.203.34.15:29257] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads-config.php
[Sat Dec 20 21:46:30.322117 2025] [:error] [pid 39577:tid 39591] [client 85.203.34.15:29257] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aUaotrviRnt1rJiSOfxuvwAAAMw"]
[Sat Dec 20 21:46:30.891255 2025] [:error] [pid 62124:tid 62147] [client 85.203.34.20:24347] [client 85.203.34.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aUaotls94zPA9ULQOjmHHAAAABU"]
[Sat Dec 20 21:46:31.500002 2025] [:error] [pid 33844:tid 33852] [client 85.203.34.6:57247] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/autoload_classmap.php
[Sat Dec 20 21:46:31.883286 2025] [:error] [pid 33844:tid 33854] [client 85.203.34.6:57247] [client 85.203.34.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.6, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aUaotyaNtwGsyqqVmQH_HwAAAwg"]
[Sat Dec 20 21:46:32.415731 2025] [:error] [pid 33844:tid 33847] [client 85.203.34.6:57247] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Sat Dec 20 21:46:32.739106 2025] [:error] [pid 33844:tid 33869] [client 85.203.34.6:57247] [client 85.203.34.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aUaouCaNtwGsyqqVmQH_MgAAAxc"]
[Sat Dec 20 21:46:33.335787 2025] [:error] [pid 33570:tid 33578] [client 85.203.34.40:51147] File does not exist: /usr/local/apache/htdocs/suspended-page/indeex.php
[Sat Dec 20 21:46:33.864449 2025] [:error] [pid 33570:tid 33576] [client 85.203.34.40:51147] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sat Dec 20 21:46:34.202479 2025] [:error] [pid 33570:tid 33579] [client 85.203.34.40:51147] [client 85.203.34.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentythree/patterns/index.php"] [unique_id "aUaouoTNveA-c6YcSrIVywAAAcM"]
[Sat Dec 20 21:46:35.451398 2025] [:error] [pid 39493:tid 39555] [client 185.92.25.138:31821] [client 185.92.25.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aUaou2hjL2VG_FmIHqAEDwAAAIY"]
[Sat Dec 20 21:46:36.037629 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Sat Dec 20 21:46:36.747716 2025] [:error] [pid 33749:tid 33764] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/credits.php
[Sat Dec 20 21:46:37.049942 2025] [:error] [pid 33749:tid 33772] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-comments.php
[Sat Dec 20 21:46:37.343950 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Sat Dec 20 21:46:37.652779 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Sat Dec 20 21:46:37.953211 2025] [:error] [pid 33749:tid 33770] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Sat Dec 20 21:46:38.375378 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/load-scripts.php
[Sat Dec 20 21:46:38.664895 2025] [:error] [pid 33749:tid 33751] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/load-styles.php
[Sat Dec 20 21:46:38.962017 2025] [:error] [pid 33749:tid 33772] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/options-discussion.php
[Sat Dec 20 21:46:39.274496 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/options-general.php
[Sat Dec 20 21:46:39.630425 2025] [:error] [pid 33749:tid 33769] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/options-permalink.php
[Sat Dec 20 21:46:39.985143 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/options-privacy.php
[Sat Dec 20 21:46:40.294246 2025] [:error] [pid 33749:tid 33769] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sat Dec 20 21:46:40.599273 2025] [:error] [pid 33749:tid 33758] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sat Dec 20 21:46:40.903835 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/post-new.php
[Sat Dec 20 21:46:41.209095 2025] [:error] [pid 33749:tid 33772] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Sat Dec 20 21:46:41.493202 2025] [:error] [pid 33749:tid 33758] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Sat Dec 20 21:46:41.779820 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/site-health.php
[Sat Dec 20 21:46:42.093691 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Sat Dec 20 21:46:42.408993 2025] [:error] [pid 33749:tid 33775] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sat Dec 20 21:46:42.709627 2025] [:error] [pid 33749:tid 33774] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/user-edit.php
[Sat Dec 20 21:46:43.035666 2025] [:error] [pid 33749:tid 33764] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/user-new.php
[Sat Dec 20 21:46:43.348637 2025] [:error] [pid 33749:tid 33758] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Sat Dec 20 21:46:43.650117 2025] [:error] [pid 33749:tid 33764] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/bar.php
[Sat Dec 20 21:46:43.970538 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Sat Dec 20 21:46:44.278808 2025] [:error] [pid 33749:tid 33751] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sat Dec 20 21:46:44.574096 2025] [:error] [pid 33749:tid 33772] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sat Dec 20 21:46:44.864875 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sat Dec 20 21:46:45.182984 2025] [:error] [pid 33749:tid 33773] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/km.php
[Sat Dec 20 21:46:45.529864 2025] [:error] [pid 33749:tid 33771] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/LA.php
[Sat Dec 20 21:46:45.855342 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Dec 20 21:46:46.141924 2025] [:error] [pid 33749:tid 33757] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ldd.php
[Sat Dec 20 21:46:46.444517 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/sgd.php
[Sat Dec 20 21:46:46.752050 2025] [:error] [pid 33749:tid 33764] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/wzy.php
[Sat Dec 20 21:46:47.804387 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Dec 20 21:46:48.659606 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sat Dec 20 21:46:50.013942 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Dec 20 21:46:50.331706 2025] [:error] [pid 33749:tid 33775] [client 85.203.34.18:23007] [client 85.203.34.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.18, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aUaoytoInXJnb96wei9pwQAAApg"]
[Sat Dec 20 21:46:50.648995 2025] [:error] [pid 33749:tid 33773] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Sat Dec 20 21:46:51.613010 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.18:23007] [client 85.203.34.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.18, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.tmb/wp-login.php"] [unique_id "aUaoy9oInXJnb96wei9p2wAAAoM"]
[Sat Dec 20 21:46:52.280814 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.18:23007] File does not exist: /usr/local/apache/htdocs/suspended-page/FroggBaba.php
[Sat Dec 20 21:46:52.603826 2025] [:error] [pid 33749:tid 33773] [client 85.203.34.18:23007] [client 85.203.34.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aUaozNoInXJnb96wei9p7wAAApY"]
[Sat Dec 20 21:46:53.511834 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.25:28655] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aUaozYTNveA-c6YcSrIW4wAAAcY"]
[Sat Dec 20 21:46:54.428961 2025] [:error] [pid 14247:tid 14270] [client 85.203.34.5:64887] [client 85.203.34.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aUaoziDv9TtKKdJQn9kc9AAAARU"]
[Sat Dec 20 21:46:54.988995 2025] [:error] [pid 39493:tid 39564] [client 85.203.34.49:24433] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Sat Dec 20 21:46:56.289012 2025] [:error] [pid 39493:tid 39552] [client 85.203.34.49:24433] [client 85.203.34.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/wp-cron.php"] [unique_id "aUao0GhjL2VG_FmIHqAEpQAAAIM"]
[Sat Dec 20 21:46:57.176729 2025] [:error] [pid 33793:tid 33803] [client 85.203.34.46:31897] [client 85.203.34.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/tunnelforms/lib.php"] [unique_id "aUao0VSicyB0BFmbRMzbBAAAAsg"]
[Sat Dec 20 21:46:58.113085 2025] [:error] [pid 14247:tid 14262] [client 85.203.34.32:60971] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Sat Dec 20 21:46:58.425209 2025] [:error] [pid 14247:tid 14258] [client 85.203.34.32:60971] File does not exist: /usr/local/apache/htdocs/suspended-page/GA13.php
[Sat Dec 20 21:46:59.612106 2025] [:error] [pid 14247:tid 14257] [client 85.203.34.32:60971] [client 85.203.34.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.32, incrementing brute counter"] [hostname "rejuva.au"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aUao0yDv9TtKKdJQn9kdNAAAAQg"]
[Sat Dec 20 21:46:59.928526 2025] [:error] [pid 14247:tid 14267] [client 85.203.34.32:60971] [client 85.203.34.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUao0yDv9TtKKdJQn9kdPAAAARI"]
[Sat Dec 20 21:47:01.099009 2025] [:error] [pid 14247:tid 14262] [client 85.203.34.2:48187] File does not exist: /usr/local/apache/htdocs/suspended-page/crop.php
[Sat Dec 20 21:47:01.392475 2025] [:error] [pid 14247:tid 14253] [client 85.203.34.2:48187] [client 85.203.34.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUao1SDv9TtKKdJQn9kdYAAAAQQ"]
[Sat Dec 20 21:47:01.782328 2025] [:error] [pid 14247:tid 14251] [client 85.203.34.2:48187] [client 85.203.34.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/Mhbgf.php/xx.php"] [unique_id "aUao1SDv9TtKKdJQn9kdZAAAAQI"]
[Sat Dec 20 21:47:02.712192 2025] [:error] [pid 33749:tid 33773] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/gali.php
[Sat Dec 20 21:47:03.616001 2025] [:error] [pid 33749:tid 33773] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sat Dec 20 21:47:03.955471 2025] [:error] [pid 33749:tid 33752] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/dirs.php
[Sat Dec 20 21:47:04.756325 2025] [:error] [pid 33749:tid 33759] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/abouts.php
[Sat Dec 20 21:47:05.083670 2025] [:error] [pid 33749:tid 33755] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/malls.php
[Sat Dec 20 21:47:05.600038 2025] [:error] [pid 33749:tid 33763] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/liefs.php
[Sat Dec 20 21:47:05.907160 2025] [:error] [pid 33749:tid 33762] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/uc.php
[Sat Dec 20 21:47:06.258428 2025] [:error] [pid 33749:tid 33756] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/locks.php
[Sat Dec 20 21:47:06.568462 2025] [:error] [pid 33749:tid 33760] [client 85.203.34.25:22911] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-dsdd.php
[Sat Dec 20 21:47:07.790919 2025] [:error] [pid 33749:tid 33774] [client 85.203.34.25:22911] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aUao29oInXJnb96wei9qpgAAApc"]
[Sat Dec 20 21:47:08.422742 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.37:30749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sat Dec 20 21:47:08.843497 2025] [:error] [pid 33793:tid 33807] [client 85.203.34.37:30749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Sat Dec 20 21:47:09.148882 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.37:30749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sat Dec 20 21:47:09.443126 2025] [:error] [pid 33793:tid 33800] [client 85.203.34.37:30749] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Sat Dec 20 21:47:09.768350 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.37:30749] File does not exist: /usr/local/apache/htdocs/suspended-page/stindex.php
[Sat Dec 20 21:47:10.103460 2025] [:error] [pid 33793:tid 33800] [client 85.203.34.37:30749] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sat Dec 20 21:47:10.404995 2025] [:error] [pid 33793:tid 33810] [client 85.203.34.37:30749] [client 85.203.34.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/test.php"] [unique_id "aUao3lSicyB0BFmbRMzb2wAAAs8"]
[Sat Dec 20 21:47:11.356719 2025] [:error] [pid 33749:tid 33761] [client 85.203.34.13:46701] File does not exist: /usr/local/apache/htdocs/suspended-page/exit.php
[Sat Dec 20 21:47:11.656409 2025] [:error] [pid 33749:tid 33774] [client 85.203.34.13:46701] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Dec 20 21:47:11.947942 2025] [:error] [pid 33749:tid 33754] [client 85.203.34.13:46701] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Sat Dec 20 21:47:12.284324 2025] [:error] [pid 33749:tid 33768] [client 85.203.34.13:46701] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Sat Dec 20 21:47:12.575761 2025] [:error] [pid 33749:tid 33772] [client 85.203.34.13:46701] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aUao4NoInXJnb96wei9q8gAAApU"]
[Sat Dec 20 21:47:13.173863 2025] [:error] [pid 33793:tid 33798] [client 85.203.34.37:20339] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Dec 20 21:47:14.107613 2025] [:error] [pid 33793:tid 33811] [client 85.203.34.37:20339] [client 85.203.34.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellv3.php"] [unique_id "aUao4lSicyB0BFmbRMzcFAAAAtA"]
[Sat Dec 20 21:47:14.671212 2025] [:error] [pid 14247:tid 14249] [client 85.203.34.23:38213] [client 85.203.34.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellv3.php"] [unique_id "aUao4iDv9TtKKdJQn9kdzwAAAQA"]
[Sat Dec 20 21:47:15.269021 2025] [:error] [pid 33570:tid 33597] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/shellv3.php
[Sat Dec 20 21:47:15.625308 2025] [:error] [pid 33570:tid 33599] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/sh.php
[Sat Dec 20 21:47:16.604928 2025] [:error] [pid 33570:tid 33591] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sat Dec 20 21:47:16.905521 2025] [:error] [pid 33570:tid 33578] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Sat Dec 20 21:47:17.228670 2025] [:error] [pid 33570:tid 33593] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/delete3.php
[Sat Dec 20 21:47:17.849810 2025] [:error] [pid 33570:tid 33580] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/mm.php
[Sat Dec 20 21:47:27.114111 2025] [:error] [pid 33570:tid 33599] [client 85.203.34.20:25677] [client 85.203.34.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.20, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aUao74TNveA-c6YcSrIYMgAAAdc"]
[Sat Dec 20 21:47:27.413469 2025] [:error] [pid 33570:tid 33594] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Sat Dec 20 21:47:28.029445 2025] [:error] [pid 33570:tid 33580] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/mailer.php
[Sat Dec 20 21:47:28.307696 2025] [:error] [pid 33570:tid 33585] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/www.php
[Sat Dec 20 21:47:28.930645 2025] [:error] [pid 33570:tid 33584] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat Dec 20 21:47:29.850123 2025] [:error] [pid 33570:tid 33582] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sat Dec 20 21:47:30.168238 2025] [:error] [pid 33570:tid 33593] [client 85.203.34.20:25677] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sat Dec 20 21:47:31.912882 2025] [autoindex:error] [pid 33570:tid 33588] [client 85.203.34.20:25677] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 21:47:47.908495 2025] [:error] [pid 33570:tid 33590] [client 85.203.34.20:25677] [client 85.203.34.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/"] [unique_id "aUapA4TNveA-c6YcSrIZGAAAAc4"]
[Sat Dec 20 21:47:48.576940 2025] [:error] [pid 33687:tid 33712] [client 85.203.34.35:59139] [client 85.203.34.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/"] [unique_id "aUapBDYMR4qK1N4g7vjaewAAAlY"]
[Sat Dec 20 21:47:59.649203 2025] [:error] [pid 33793:tid 33803] [client 85.203.34.17:47259] [client 85.203.34.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/administrator/"] [unique_id "aUapD1SicyB0BFmbRMzd_wAAAsg"]
[Sat Dec 20 21:48:06.499713 2025] [:error] [pid 33793:tid 33799] [client 85.203.34.48:34803] [client 85.203.34.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "aUapFlSicyB0BFmbRMzeTwAAAsQ"]
[Sat Dec 20 21:48:09.269116 2025] [:error] [pid 14286:tid 14311] [client 185.92.25.138:24081] [client 185.92.25.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aUapGZ7rbXIrw6rGSdaQXQAAAVU"]
[Sat Dec 20 21:48:59.312154 2025] [:error] [pid 33844:tid 33862] [client 85.203.34.5:40585] [client 85.203.34.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/travelscape/"] [unique_id "aUapSyaNtwGsyqqVmQEEWgAAAxA"]
[Sat Dec 20 22:01:09.292967 2025] [:error] [pid 62124:tid 62150] [client 43.135.138.128:40126] [client 43.135.138.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUasJVs94zPA9ULQOjmhYAAAABg"]
[Sat Dec 20 23:04:32.781360 2025] [:error] [pid 62124:tid 62147] [client 43.153.119.119:38776] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUa7AFs94zPA9ULQOjmyGwAAABU"]
[Sun Dec 21 02:33:36.623634 2025] [:error] [pid 43680:tid 43700] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 21 02:33:37.172282 2025] [:error] [pid 43680:tid 43686] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Dec 21 02:33:37.496599 2025] [:error] [pid 43680:tid 43702] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Dec 21 02:33:37.819522 2025] [:error] [pid 43680:tid 43708] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 21 02:33:38.393568 2025] [:error] [pid 43680:tid 43691] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 21 02:33:38.704480 2025] [:error] [pid 43680:tid 43695] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 21 02:33:39.017985 2025] [:error] [pid 43680:tid 43694] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 21 02:33:39.309052 2025] [:error] [pid 43680:tid 43708] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 21 02:33:39.933162 2025] [:error] [pid 43680:tid 43686] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Dec 21 02:33:40.551747 2025] [:error] [pid 43680:tid 43708] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Dec 21 02:33:40.938967 2025] [:error] [pid 43680:tid 43692] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Dec 21 02:33:41.531499 2025] [:error] [pid 43680:tid 43701] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 21 02:33:41.847057 2025] [:error] [pid 43680:tid 43695] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Dec 21 02:33:42.380186 2025] [:error] [pid 43680:tid 43694] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Dec 21 02:33:42.961008 2025] [:error] [pid 43680:tid 43691] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Dec 21 02:33:43.603139 2025] [:error] [pid 43680:tid 43689] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Dec 21 02:33:43.992281 2025] [:error] [pid 43680:tid 43698] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Dec 21 02:33:44.348819 2025] [:error] [pid 43680:tid 43694] [client 31.171.130.109:26985] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 21 02:33:50.547853 2025] [:error] [pid 43680:tid 43684] [client 31.171.130.109:26985] [client 31.171.130.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUbsDkDkAAJVjNqC6UWz3gAAAUA"]
[Sun Dec 21 02:33:52.439645 2025] [:error] [pid 22338:tid 22390] [client 31.171.130.165:35291] [client 31.171.130.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUbsEHGYQSUt-opKpSI6ZwAAAEY"]
[Sun Dec 21 02:33:54.556743 2025] [:error] [pid 43680:tid 43691] [client 31.171.130.157:64721] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 21 02:33:55.532729 2025] [:error] [pid 43680:tid 43707] [client 31.171.130.157:64721] [client 31.171.130.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aUbsE0DkAAJVjNqC6UW0BgAAAVc"]
[Sun Dec 21 02:33:56.742303 2025] [:error] [pid 8642:tid 8713] [client 31.171.130.129:44263] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Dec 21 02:33:57.025450 2025] [:error] [pid 8642:tid 8714] [client 31.171.130.129:44263] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUbsFSJkiik8k41igp0rqAAAAQk"]
[Sun Dec 21 02:33:57.954399 2025] [:error] [pid 8641:tid 8696] [client 31.171.130.112:35317] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Dec 21 02:33:59.483286 2025] [:error] [pid 8641:tid 8684] [client 31.171.130.112:35317] [client 31.171.130.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUbsF3E703usYSvQGLR6xgAAAMY"]
[Sun Dec 21 02:34:00.394653 2025] [:error] [pid 8642:tid 8718] [client 31.171.130.135:35193] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUbsGCJkiik8k41igp0ruAAAAQ0"]
[Sun Dec 21 02:34:01.298655 2025] [:error] [pid 8751:tid 8753] [client 31.171.130.133:46083] [client 31.171.130.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUbsGWvrnuGjNP7vtDRTYgAAAAA"]
[Sun Dec 21 02:34:02.963991 2025] [:error] [pid 43680:tid 43703] [client 31.171.130.111:63793] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUbsGkDkAAJVjNqC6UW0LAAAAVM"]
[Sun Dec 21 02:34:04.625710 2025] [:error] [pid 22338:tid 22393] [client 31.171.130.162:32079] [client 31.171.130.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUbsHHGYQSUt-opKpSI66AAAAEk"]
[Sun Dec 21 02:34:05.230848 2025] [:error] [pid 8751:tid 8753] [client 31.171.130.150:27899] [client 31.171.130.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUbsHWvrnuGjNP7vtDRTfgAAAAA"]
[Sun Dec 21 02:34:06.144701 2025] [:error] [pid 8751:tid 8758] [client 31.171.130.143:53821] [client 31.171.130.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUbsHmvrnuGjNP7vtDRThwAAAAU"]
[Sun Dec 21 02:34:06.756874 2025] [:error] [pid 43680:tid 43702] [client 31.171.130.147:35477] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Dec 21 02:34:07.390653 2025] [:error] [pid 43680:tid 43706] [client 31.171.130.147:35477] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aUbsH0DkAAJVjNqC6UW0WwAAAVY"]
[Sun Dec 21 02:34:08.875718 2025] [:error] [pid 8641:tid 8696] [client 31.171.130.136:32033] [client 31.171.130.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUbsIHE703usYSvQGLR7NwAAANE"]
[Sun Dec 21 02:34:09.751160 2025] [:error] [pid 22338:tid 22399] [client 31.171.130.111:46947] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUbsIXGYQSUt-opKpSI7EwAAAE4"]
[Sun Dec 21 02:34:10.398958 2025] [:error] [pid 43680:tid 43688] [client 31.171.130.111:40955] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Dec 21 02:34:10.704528 2025] [:error] [pid 43680:tid 43702] [client 31.171.130.111:40955] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUbsIkDkAAJVjNqC6UW0cgAAAVI"]
[Sun Dec 21 02:34:11.342929 2025] [:error] [pid 8642:tid 8729] [client 31.171.130.141:65029] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Dec 21 02:34:12.823015 2025] [:error] [pid 8642:tid 8699] [client 31.171.130.141:65029] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Dec 21 02:34:14.095577 2025] [:error] [pid 8642:tid 8719] [client 31.171.130.141:65029] [client 31.171.130.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUbsJiJkiik8k41igp0sXwAAAQ4"]
[Sun Dec 21 02:34:14.708357 2025] [:error] [pid 8640:tid 8651] [client 31.171.130.130:22183] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Dec 21 02:34:14.998801 2025] [:error] [pid 8640:tid 8667] [client 31.171.130.130:22183] [client 31.171.130.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUbsJvVclzlEWWhvYtmENwAAAJE"]
[Sun Dec 21 02:34:15.597858 2025] [:error] [pid 22338:tid 22399] [client 31.171.130.150:26247] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Dec 21 02:34:16.204624 2025] [:error] [pid 22338:tid 22384] [client 31.171.130.150:26247] [client 31.171.130.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUbsKHGYQSUt-opKpSI7YAAAAEA"]
[Sun Dec 21 02:34:17.464671 2025] [:error] [pid 8640:tid 8656] [client 31.171.130.133:59207] [client 31.171.130.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUbsKfVclzlEWWhvYtmESwAAAIY"]
[Sun Dec 21 02:34:18.410482 2025] [:error] [pid 8751:tid 8761] [client 31.171.130.157:65113] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Dec 21 02:34:18.718225 2025] [:error] [pid 8751:tid 8764] [client 31.171.130.157:65113] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Dec 21 02:34:19.330569 2025] [:error] [pid 8751:tid 8777] [client 31.171.130.157:65113] [client 31.171.130.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUbsK2vrnuGjNP7vtDRT_QAAABg"]
[Sun Dec 21 02:34:20.521507 2025] [:error] [pid 22338:tid 22397] [client 31.171.130.137:42143] [client 31.171.130.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUbsLHGYQSUt-opKpSI7nQAAAEw"]
[Sun Dec 21 02:34:21.431531 2025] [:error] [pid 8642:tid 8713] [client 31.171.130.107:36411] [client 31.171.130.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUbsLSJkiik8k41igp0spwAAAQg"]
[Sun Dec 21 02:34:22.064601 2025] [:error] [pid 8642:tid 8724] [client 31.171.130.163:32351] [client 31.171.130.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUbsLiJkiik8k41igp0ssAAAARM"]
[Sun Dec 21 07:22:27.910978 2025] [:error] [pid 20676:tid 20737] [client 117.62.235.53:60436] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUcvs6pSa967F4pOO5za4gAAAIQ"]
[Sun Dec 21 15:44:05.614068 2025] [:error] [pid 16016:tid 16034] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/wacce.php
[Sun Dec 21 15:44:05.781142 2025] [:error] [pid 16016:tid 16032] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/quote.php
[Sun Dec 21 15:44:05.949417 2025] [:error] [pid 16016:tid 16035] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/little.php
[Sun Dec 21 15:44:06.112077 2025] [:error] [pid 16016:tid 16023] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/xtride.php
[Sun Dec 21 15:44:06.267977 2025] [:error] [pid 16016:tid 16019] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/ws29.php
[Sun Dec 21 15:44:06.437491 2025] [:error] [pid 16016:tid 16038] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/oo.php
[Sun Dec 21 15:44:06.594900 2025] [:error] [pid 16016:tid 16039] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/s11.php
[Sun Dec 21 15:44:06.756424 2025] [:error] [pid 16016:tid 16024] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/dkub.php
[Sun Dec 21 15:44:06.917409 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Dec 21 15:44:07.092780 2025] [:error] [pid 16016:tid 16020] [client 4.189.104.41:16606] File does not exist: /usr/local/apache/htdocs/suspended-page/x100.php
[Sun Dec 21 15:44:07.235780 2025] [:error] [pid 16016:tid 16027] [client 4.189.104.41:16606] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aUelR8HQ_KQh3iINaCNJAQAAAUk"]
[Sun Dec 21 15:44:07.625636 2025] [:error] [pid 20676:tid 20733] [client 4.189.104.41:38704] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aUelR6pSa967F4pOO5xT9QAAAIA"]
[Sun Dec 21 15:44:08.014571 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:44317] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aUelSKklhK29C3vVvLVeIAAAAZY"]
[Sun Dec 21 15:44:08.403788 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.41:4238] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aUelSAM0m463UZmqdiCTtgAAAQY"]
[Sun Dec 21 15:44:08.777025 2025] [:error] [pid 20760:tid 20773] [client 4.189.104.41:22007] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aUelSOXEVvRTAtWo3gk6jwAAAMo"]
[Sun Dec 21 15:44:09.183805 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.41:62663] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aUelSaklhK29C3vVvLVeIwAAAZg"]
[Sun Dec 21 15:44:09.560217 2025] [:error] [pid 60191:tid 60214] [client 4.189.104.41:62698] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aUelSaklhK29C3vVvLVeJAAAAZU"]
[Sun Dec 21 15:44:09.996404 2025] [:error] [pid 60191:tid 60211] [client 4.189.104.41:44288] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aUelSaklhK29C3vVvLVeJQAAAZI"]
[Sun Dec 21 15:44:10.392035 2025] [:error] [pid 20674:tid 20690] [client 4.189.104.41:17092] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aUelSthSbhHOCK6TAw-fvAAAAAw"]
[Sun Dec 21 15:44:10.813189 2025] [:error] [pid 20760:tid 20781] [client 4.189.104.41:4232] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aUelSuXEVvRTAtWo3gk6kwAAANI"]
[Sun Dec 21 15:44:11.259029 2025] [:error] [pid 20760:tid 20776] [client 4.189.104.41:17050] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aUelS-XEVvRTAtWo3gk6mAAAAM0"]
[Sun Dec 21 15:44:11.641092 2025] [:error] [pid 20760:tid 20787] [client 4.189.104.41:4256] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aUelS-XEVvRTAtWo3gk6mwAAANg"]
[Sun Dec 21 15:44:11.993577 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.41:61934] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aUelS6pSa967F4pOO5xUAQAAAIg"]
[Sun Dec 21 15:44:12.319302 2025] [:error] [pid 60191:tid 60206] [client 4.189.104.41:25161] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aUelTKklhK29C3vVvLVeOgAAAY0"]
[Sun Dec 21 15:44:12.671960 2025] [:error] [pid 20676:tid 20748] [client 4.189.104.41:34611] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aUelTKpSa967F4pOO5xUFAAAAI8"]
[Sun Dec 21 15:44:12.988905 2025] [:error] [pid 20674:tid 20688] [client 4.189.104.41:34609] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aUelTNhSbhHOCK6TAw-fvwAAAAo"]
[Sun Dec 21 15:44:13.444731 2025] [:error] [pid 60191:tid 60202] [client 4.189.104.41:4284] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aUelTaklhK29C3vVvLVeQAAAAYk"]
[Sun Dec 21 15:44:13.769543 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.41:44398] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aUelTaklhK29C3vVvLVeQwAAAYM"]
[Sun Dec 21 15:44:14.189356 2025] [:error] [pid 20675:tid 20728] [client 4.189.104.41:61947] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aUelTryUvZnd3bHSR3aIngAAAFY"]
[Sun Dec 21 15:44:14.736462 2025] [:error] [pid 20674:tid 20687] [client 4.189.104.41:17056] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aUelTthSbhHOCK6TAw-fwgAAAAk"]
[Sun Dec 21 15:44:15.097080 2025] [:error] [pid 60191:tid 60210] [client 4.189.104.41:21977] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/File.php"] [unique_id "aUelT6klhK29C3vVvLVeSgAAAZE"]
[Sun Dec 21 15:44:15.446267 2025] [:error] [pid 20760:tid 20778] [client 4.189.104.41:17108] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/File.php"] [unique_id "aUelT-XEVvRTAtWo3gk6nwAAAM8"]
[Sun Dec 21 15:44:15.767042 2025] [:error] [pid 20674:tid 20702] [client 4.189.104.41:44370] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/File.php"] [unique_id "aUelT9hSbhHOCK6TAw-fxwAAABg"]
[Sun Dec 21 15:44:16.221575 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.41:61898] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/File.php"] [unique_id "aUelUAM0m463UZmqdiCTwwAAAQY"]
[Sun Dec 21 15:44:16.573012 2025] [:error] [pid 16016:tid 16039] [client 4.189.104.41:22006] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/all.php"] [unique_id "aUelUMHQ_KQh3iINaCNJBQAAAVU"]
[Sun Dec 21 15:44:16.921872 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.41:17118] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/all.php"] [unique_id "aUelUKpSa967F4pOO5xUHgAAAJM"]
[Sun Dec 21 15:44:17.309260 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.41:24664] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/all.php"] [unique_id "aUelUaklhK29C3vVvLVeTwAAAZA"]
[Sun Dec 21 15:44:17.623703 2025] [:error] [pid 20675:tid 20714] [client 4.189.104.41:55278] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/all.php"] [unique_id "aUelUbyUvZnd3bHSR3aIoAAAAEg"]
[Sun Dec 21 15:44:18.000916 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.41:34619] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aUelUapSa967F4pOO5xUHwAAAI4"]
[Sun Dec 21 15:44:18.494307 2025] [:error] [pid 20676:tid 20734] [client 4.189.104.41:17141] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aUelUqpSa967F4pOO5xUIQAAAIE"]
[Sun Dec 21 15:44:18.931392 2025] [:error] [pid 20675:tid 20711] [client 4.189.104.41:34608] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aUelUryUvZnd3bHSR3aIqQAAAEU"]
[Sun Dec 21 15:44:19.339175 2025] [:error] [pid 16016:tid 16026] [client 4.189.104.41:21993] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aUelU8HQ_KQh3iINaCNJCgAAAUg"]
[Sun Dec 21 15:44:19.839527 2025] [:error] [pid 20760:tid 20782] [client 4.189.104.41:34603] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aUelU-XEVvRTAtWo3gk6pAAAANM"]
[Sun Dec 21 15:44:20.393480 2025] [:error] [pid 20760:tid 20765] [client 4.189.104.41:28322] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aUelVOXEVvRTAtWo3gk6pQAAAMI"]
[Sun Dec 21 15:44:20.815774 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.41:61922] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aUelVKklhK29C3vVvLVeUgAAAYw"]
[Sun Dec 21 15:44:21.317029 2025] [:error] [pid 12191:tid 12204] [client 4.189.104.41:25195] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aUelVQM0m463UZmqdiCT0AAAAQs"]
[Sun Dec 21 15:44:21.743427 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.41:17124] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aUelVaklhK29C3vVvLVeUwAAAZg"]
[Sun Dec 21 15:44:22.054470 2025] [:error] [pid 20760:tid 20778] [client 4.189.104.41:28323] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aUelVuXEVvRTAtWo3gk6pwAAAM8"]
[Sun Dec 21 15:44:22.425737 2025] [:error] [pid 12191:tid 12211] [client 4.189.104.41:34582] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aUelVgM0m463UZmqdiCT0gAAARI"]
[Sun Dec 21 15:44:22.768631 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.41:44385] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aUelVsHQ_KQh3iINaCNJDAAAAUA"]
[Sun Dec 21 15:44:23.189348 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.41:20769] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api2.php"] [unique_id "aUelV8HQ_KQh3iINaCNJDQAAAVc"]
[Sun Dec 21 15:44:23.526892 2025] [:error] [pid 20760:tid 20768] [client 4.189.104.41:25173] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api2.php"] [unique_id "aUelV-XEVvRTAtWo3gk6rQAAAMU"]
[Sun Dec 21 15:44:23.859256 2025] [:error] [pid 20674:tid 20679] [client 4.189.104.41:44400] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api2.php"] [unique_id "aUelV9hSbhHOCK6TAw-f1QAAAAE"]
[Sun Dec 21 15:44:24.231241 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.41:55280] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api2.php"] [unique_id "aUelWAM0m463UZmqdiCT1AAAARg"]
[Sun Dec 21 15:44:24.691617 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.41:25210] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xz89.php"] [unique_id "aUelWNhSbhHOCK6TAw-f2gAAAAs"]
[Sun Dec 21 15:44:25.104267 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.41:17126] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xz89.php"] [unique_id "aUelWeXEVvRTAtWo3gk6rwAAAMk"]
[Sun Dec 21 15:44:25.467676 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.41:4759] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xz89.php"] [unique_id "aUelWapSa967F4pOO5xUNAAAAJI"]
[Sun Dec 21 15:44:25.816179 2025] [:error] [pid 20676:tid 20750] [client 4.189.104.41:61926] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xz89.php"] [unique_id "aUelWapSa967F4pOO5xUNgAAAJE"]
[Sun Dec 21 15:44:26.220483 2025] [:error] [pid 20676:tid 20742] [client 4.189.104.41:34606] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thai.php"] [unique_id "aUelWqpSa967F4pOO5xUNwAAAIk"]
[Sun Dec 21 15:44:26.528652 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.41:4797] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thai.php"] [unique_id "aUelWqklhK29C3vVvLVeWAAAAYg"]
[Sun Dec 21 15:44:26.928044 2025] [:error] [pid 20760:tid 20782] [client 4.189.104.41:62656] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thai.php"] [unique_id "aUelWuXEVvRTAtWo3gk6tQAAANM"]
[Sun Dec 21 15:44:27.236264 2025] [:error] [pid 20760:tid 20777] [client 4.189.104.41:21986] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thai.php"] [unique_id "aUelW-XEVvRTAtWo3gk6twAAAM4"]
[Sun Dec 21 15:44:27.602165 2025] [:error] [pid 16016:tid 16038] [client 4.189.104.41:51472] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aUelW8HQ_KQh3iINaCNJEQAAAVQ"]
[Sun Dec 21 15:44:27.988950 2025] [:error] [pid 20760:tid 20768] [client 4.189.104.41:25177] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aUelW-XEVvRTAtWo3gk6ugAAAMU"]
[Sun Dec 21 15:44:28.434205 2025] [:error] [pid 16016:tid 16024] [client 4.189.104.41:4753] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aUelXMHQ_KQh3iINaCNJEgAAAUY"]
[Sun Dec 21 15:44:28.888284 2025] [:error] [pid 20675:tid 20707] [client 4.189.104.41:61935] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aUelXLyUvZnd3bHSR3aItQAAAEE"]
[Sun Dec 21 15:44:29.208616 2025] [:error] [pid 16016:tid 16030] [client 4.189.104.41:21995] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wft.php"] [unique_id "aUelXcHQ_KQh3iINaCNJFQAAAUw"]
[Sun Dec 21 15:44:29.534710 2025] [:error] [pid 16016:tid 16040] [client 4.189.104.41:51495] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wft.php"] [unique_id "aUelXcHQ_KQh3iINaCNJFwAAAVY"]
[Sun Dec 21 15:44:29.924198 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.41:27236] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wft.php"] [unique_id "aUelXbyUvZnd3bHSR3aItgAAAEA"]
[Sun Dec 21 15:44:30.243583 2025] [:error] [pid 20675:tid 20710] [client 4.189.104.41:28295] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wft.php"] [unique_id "aUelXryUvZnd3bHSR3aIuAAAAEQ"]
[Sun Dec 21 15:44:30.573101 2025] [:error] [pid 20760:tid 20763] [client 4.189.104.41:21972] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws28.php"] [unique_id "aUelXuXEVvRTAtWo3gk6vgAAAMA"]
[Sun Dec 21 15:44:30.954281 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.41:24645] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws28.php"] [unique_id "aUelXqklhK29C3vVvLVeXwAAAZc"]
[Sun Dec 21 15:44:31.333638 2025] [:error] [pid 20760:tid 20782] [client 4.189.104.41:18469] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws28.php"] [unique_id "aUelX-XEVvRTAtWo3gk6wAAAANM"]
[Sun Dec 21 15:44:31.770126 2025] [:error] [pid 20760:tid 20764] [client 4.189.104.41:39113] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws28.php"] [unique_id "aUelX-XEVvRTAtWo3gk6wQAAAME"]
[Sun Dec 21 15:44:32.142626 2025] [:error] [pid 20674:tid 20681] [client 4.189.104.41:18438] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsvvs.php"] [unique_id "aUelYNhSbhHOCK6TAw-f3gAAAAM"]
[Sun Dec 21 15:44:32.462920 2025] [:error] [pid 20760:tid 20765] [client 4.189.104.41:23537] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsvvs.php"] [unique_id "aUelYOXEVvRTAtWo3gk6xAAAAMI"]
[Sun Dec 21 15:44:32.826403 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.41:51492] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsvvs.php"] [unique_id "aUelYMHQ_KQh3iINaCNJGwAAAVc"]
[Sun Dec 21 15:44:33.147031 2025] [:error] [pid 20760:tid 20776] [client 4.189.104.41:23499] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsvvs.php"] [unique_id "aUelYeXEVvRTAtWo3gk6xQAAAM0"]
[Sun Dec 21 15:44:33.487040 2025] [:error] [pid 20675:tid 20728] [client 4.189.104.41:53391] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aUelYbyUvZnd3bHSR3aIvgAAAFY"]
[Sun Dec 21 15:44:33.800390 2025] [:error] [pid 16016:tid 16036] [client 4.189.104.41:17511] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aUelYcHQ_KQh3iINaCNJHwAAAVI"]
[Sun Dec 21 15:44:34.166146 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.41:28312] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aUelYqpSa967F4pOO5xUPAAAAJI"]
[Sun Dec 21 15:44:34.497761 2025] [:error] [pid 16016:tid 16024] [client 4.189.104.41:23548] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aUelYsHQ_KQh3iINaCNJIQAAAUY"]
[Sun Dec 21 15:44:34.817979 2025] [:error] [pid 20676:tid 20750] [client 4.189.104.41:25861] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aUelYqpSa967F4pOO5xUPQAAAJE"]
[Sun Dec 21 15:44:35.145290 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.41:18482] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aUelY8HQ_KQh3iINaCNJIgAAAUc"]
[Sun Dec 21 15:44:35.499924 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.41:4317] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aUelYwM0m463UZmqdiCT2QAAARU"]
[Sun Dec 21 15:44:35.839107 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.41:19050] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aUelYwM0m463UZmqdiCT2wAAAQI"]
[Sun Dec 21 15:44:36.177926 2025] [:error] [pid 12191:tid 12208] [client 4.189.104.41:51474] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aUelZAM0m463UZmqdiCT3AAAAQ8"]
[Sun Dec 21 15:44:36.523047 2025] [:error] [pid 20676:tid 20754] [client 4.189.104.41:25870] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aUelZKpSa967F4pOO5xUQAAAAJU"]
[Sun Dec 21 15:44:36.885590 2025] [:error] [pid 60191:tid 60204] [client 4.189.104.41:25905] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aUelZKklhK29C3vVvLVeYgAAAYs"]
[Sun Dec 21 15:44:37.188011 2025] [:error] [pid 20674:tid 20687] [client 4.189.104.41:39109] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aUelZdhSbhHOCK6TAw-f4gAAAAk"]
[Sun Dec 21 15:44:37.543826 2025] [:error] [pid 20674:tid 20690] [client 4.189.104.41:39134] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aUelZdhSbhHOCK6TAw-f4wAAAAw"]
[Sun Dec 21 15:44:37.855057 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.41:4290] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aUelZapSa967F4pOO5xUQQAAAI4"]
[Sun Dec 21 15:44:38.171605 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.41:53432] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aUelZqklhK29C3vVvLVeZQAAAZQ"]
[Sun Dec 21 15:44:38.554646 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.41:4533] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aUelZqpSa967F4pOO5xURAAAAIc"]
[Sun Dec 21 15:44:38.905053 2025] [:error] [pid 20675:tid 20729] [client 4.189.104.41:17513] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aUelZryUvZnd3bHSR3aIwgAAAFc"]
[Sun Dec 21 15:44:39.224022 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.41:19030] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aUelZ9hSbhHOCK6TAw-f5wAAABQ"]
[Sun Dec 21 15:44:39.569355 2025] [:error] [pid 12191:tid 12216] [client 4.189.104.41:51501] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aUelZwM0m463UZmqdiCT4AAAARc"]
[Sun Dec 21 15:44:39.898510 2025] [:error] [pid 16016:tid 16035] [client 4.189.104.41:23538] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aUelZ8HQ_KQh3iINaCNJKAAAAVE"]
[Sun Dec 21 15:44:40.197017 2025] [:error] [pid 20760:tid 20773] [client 4.189.104.41:4539] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUelaOXEVvRTAtWo3gk6zAAAAMo"]
[Sun Dec 21 15:44:40.509384 2025] [:error] [pid 20760:tid 20783] [client 4.189.104.41:5017] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUelaOXEVvRTAtWo3gk6zgAAANQ"]
[Sun Dec 21 15:44:40.881362 2025] [:error] [pid 20760:tid 20768] [client 4.189.104.41:19024] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUelaOXEVvRTAtWo3gk6zwAAAMU"]
[Sun Dec 21 15:44:41.210329 2025] [:error] [pid 60191:tid 60212] [client 4.189.104.41:17507] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aUelaaklhK29C3vVvLVeZgAAAZM"]
[Sun Dec 21 15:44:41.525002 2025] [:error] [pid 20760:tid 20787] [client 4.189.104.41:17489] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aUelaeXEVvRTAtWo3gk61AAAANg"]
[Sun Dec 21 15:44:41.837597 2025] [:error] [pid 20674:tid 20682] [client 4.189.104.41:4960] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aUeladhSbhHOCK6TAw-f6QAAAAQ"]
[Sun Dec 21 15:44:42.182287 2025] [:error] [pid 20674:tid 20678] [client 4.189.104.41:53405] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aUelathSbhHOCK6TAw-f7gAAAAA"]
[Sun Dec 21 15:44:42.521421 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.41:62744] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aUelathSbhHOCK6TAw-f8QAAAAc"]
[Sun Dec 21 15:44:42.873730 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:4335] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUelaqklhK29C3vVvLVecgAAAZY"]
[Sun Dec 21 15:44:43.275455 2025] [:error] [pid 20674:tid 20690] [client 4.189.104.41:4344] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUela9hSbhHOCK6TAw-f8wAAAAw"]
[Sun Dec 21 15:44:43.663028 2025] [:error] [pid 20674:tid 20694] [client 4.189.104.41:4529] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUela9hSbhHOCK6TAw-f9QAAABA"]
[Sun Dec 21 15:44:44.006327 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.41:4307] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUelbNhSbhHOCK6TAw-f9gAAABQ"]
[Sun Dec 21 15:44:44.330839 2025] [:error] [pid 20674:tid 20683] [client 4.189.104.41:4975] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aUelbNhSbhHOCK6TAw-f-QAAAAU"]
[Sun Dec 21 15:44:44.700095 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.41:25867] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aUelbNhSbhHOCK6TAw-f-gAAABI"]
[Sun Dec 21 15:44:45.015997 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.41:25875] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aUelbdhSbhHOCK6TAw-f_QAAABE"]
[Sun Dec 21 15:44:45.414481 2025] [:error] [pid 60191:tid 60212] [client 4.189.104.41:23944] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aUelbaklhK29C3vVvLVedgAAAZM"]
[Sun Dec 21 15:44:45.744145 2025] [:error] [pid 20675:tid 20711] [client 4.189.104.41:22563] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aUelbbyUvZnd3bHSR3aIxAAAAEU"]
[Sun Dec 21 15:44:46.093398 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.41:23989] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aUelbqklhK29C3vVvLVeeQAAAYc"]
[Sun Dec 21 15:44:46.430398 2025] [:error] [pid 20674:tid 20687] [client 4.189.104.41:5047] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aUelbthSbhHOCK6TAw-gAQAAAAk"]
[Sun Dec 21 15:44:46.832175 2025] [:error] [pid 20676:tid 20739] [client 4.189.104.41:32677] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aUelbqpSa967F4pOO5xUSAAAAIY"]
[Sun Dec 21 15:44:47.242717 2025] [:error] [pid 20760:tid 20779] [client 4.189.104.41:22567] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUelb-XEVvRTAtWo3gk64gAAANA"]
[Sun Dec 21 15:44:47.600291 2025] [:error] [pid 20760:tid 20777] [client 4.189.104.41:62765] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUelb-XEVvRTAtWo3gk64wAAAM4"]
[Sun Dec 21 15:44:47.881810 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.41:5018] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUelb8HQ_KQh3iINaCNJLQAAAUA"]
[Sun Dec 21 15:44:48.181209 2025] [:error] [pid 20674:tid 20701] [client 4.189.104.41:20084] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUelcNhSbhHOCK6TAw-gBQAAABc"]
[Sun Dec 21 15:44:48.531989 2025] [:error] [pid 20674:tid 20679] [client 4.189.104.41:22582] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "aUelcNhSbhHOCK6TAw-gBwAAAAE"]
[Sun Dec 21 15:44:48.866640 2025] [:error] [pid 20674:tid 20682] [client 4.189.104.41:19200] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "aUelcNhSbhHOCK6TAw-gCgAAAAQ"]
[Sun Dec 21 15:44:49.303800 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.41:28909] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "aUelcQM0m463UZmqdiCT5AAAARQ"]
[Sun Dec 21 15:44:49.719796 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.41:32680] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "aUelcQM0m463UZmqdiCT5QAAARU"]
[Sun Dec 21 15:44:50.116354 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.41:5044] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aUelcgM0m463UZmqdiCT5gAAAQI"]
[Sun Dec 21 15:44:50.414330 2025] [:error] [pid 12191:tid 12208] [client 4.189.104.41:5004] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aUelcgM0m463UZmqdiCT6AAAAQ8"]
[Sun Dec 21 15:44:50.822122 2025] [:error] [pid 12191:tid 12215] [client 4.189.104.41:5025] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aUelcgM0m463UZmqdiCT6gAAARY"]
[Sun Dec 21 15:44:51.156766 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.41:4995] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aUelc8HQ_KQh3iINaCNJLwAAAU8"]
[Sun Dec 21 15:44:51.592754 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.41:23938] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aUelcwM0m463UZmqdiCT7gAAARM"]
[Sun Dec 21 15:44:52.006350 2025] [:error] [pid 12191:tid 12204] [client 4.189.104.41:23961] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aUeldAM0m463UZmqdiCT8QAAAQs"]
[Sun Dec 21 15:44:52.351688 2025] [:error] [pid 20674:tid 20697] [client 4.189.104.41:19210] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aUeldNhSbhHOCK6TAw-gDwAAABM"]
[Sun Dec 21 15:44:52.707513 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.41:19260] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aUeldAM0m463UZmqdiCT9wAAARU"]
[Sun Dec 21 15:44:53.038476 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.41:32657] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUeldeXEVvRTAtWo3gk65wAAAMg"]
[Sun Dec 21 15:44:53.508818 2025] [:error] [pid 12191:tid 12208] [client 4.189.104.41:23991] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUeldQM0m463UZmqdiCT-AAAAQ8"]
[Sun Dec 21 15:44:53.904976 2025] [:error] [pid 20760:tid 20770] [client 4.189.104.41:32631] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUeldeXEVvRTAtWo3gk66AAAAMc"]
[Sun Dec 21 15:44:54.345715 2025] [:error] [pid 12191:tid 12215] [client 4.189.104.41:32664] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUeldgM0m463UZmqdiCT-gAAARY"]
[Sun Dec 21 15:44:54.737703 2025] [:error] [pid 12191:tid 12205] [client 4.189.104.41:23971] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUeldgM0m463UZmqdiCT_AAAAQw"]
[Sun Dec 21 15:44:55.104218 2025] [:error] [pid 20676:tid 20737] [client 4.189.104.41:32634] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUeld6pSa967F4pOO5xUTAAAAIQ"]
[Sun Dec 21 15:44:55.514259 2025] [:error] [pid 60191:tid 60211] [client 4.189.104.41:62783] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUeld6klhK29C3vVvLVefQAAAZI"]
[Sun Dec 21 15:44:55.915873 2025] [:error] [pid 20760:tid 20765] [client 4.189.104.41:28891] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUeld-XEVvRTAtWo3gk67AAAAMI"]
[Sun Dec 21 15:44:56.299513 2025] [:error] [pid 20760:tid 20787] [client 4.189.104.41:32640] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUeleOXEVvRTAtWo3gk67gAAANg"]
[Sun Dec 21 15:44:56.658091 2025] [:error] [pid 20674:tid 20681] [client 4.189.104.41:22535] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUeleNhSbhHOCK6TAw-gFQAAAAM"]
[Sun Dec 21 15:44:57.037308 2025] [:error] [pid 20760:tid 20780] [client 4.189.104.41:23998] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUeleeXEVvRTAtWo3gk67wAAANE"]
[Sun Dec 21 15:44:57.357022 2025] [:error] [pid 20760:tid 20777] [client 4.189.104.41:28898] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUeleeXEVvRTAtWo3gk68QAAAM4"]
[Sun Dec 21 15:44:57.758052 2025] [:error] [pid 20674:tid 20691] [client 4.189.104.41:4945] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUeledhSbhHOCK6TAw-gFwAAAA0"]
[Sun Dec 21 15:44:58.301778 2025] [:error] [pid 20676:tid 20749] [client 4.189.104.41:23996] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUeleqpSa967F4pOO5xUVAAAAJA"]
[Sun Dec 21 15:44:58.694675 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.41:62743] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUeleuXEVvRTAtWo3gk69AAAAMk"]
[Sun Dec 21 15:44:59.212088 2025] [:error] [pid 20760:tid 20769] [client 4.189.104.41:51480] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUele-XEVvRTAtWo3gk69gAAAMY"]
[Sun Dec 21 15:44:59.639784 2025] [:error] [pid 16016:tid 16032] [client 4.189.104.41:62739] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUele8HQ_KQh3iINaCNJNAAAAU4"]
[Sun Dec 21 15:45:00.098976 2025] [:error] [pid 20676:tid 20743] [client 4.189.104.41:19201] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUelfKpSa967F4pOO5xUWgAAAIo"]
[Sun Dec 21 15:45:00.724802 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.41:4982] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUelfAM0m463UZmqdiCUAAAAAQM"]
[Sun Dec 21 15:45:01.137145 2025] [:error] [pid 20676:tid 20755] [client 4.189.104.41:57445] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUelfapSa967F4pOO5xUXQAAAJY"]
[Sun Dec 21 15:45:01.557698 2025] [:error] [pid 20676:tid 20737] [client 4.189.104.41:25893] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUelfapSa967F4pOO5xUXwAAAIQ"]
[Sun Dec 21 15:45:02.130652 2025] [:error] [pid 16016:tid 16042] [client 4.189.104.41:17141] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUelfsHQ_KQh3iINaCNJOQAAAVg"]
[Sun Dec 21 15:45:02.564006 2025] [:error] [pid 20675:tid 20716] [client 4.189.104.41:22532] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUelfryUvZnd3bHSR3aI1gAAAEo"]
[Sun Dec 21 15:45:02.969868 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.41:23992] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUelfsHQ_KQh3iINaCNJPAAAAUA"]
[Sun Dec 21 15:45:03.291098 2025] [:error] [pid 20675:tid 20707] [client 4.189.104.41:5020] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUelf7yUvZnd3bHSR3aI2AAAAEE"]
[Sun Dec 21 15:45:03.752104 2025] [:error] [pid 20675:tid 20710] [client 4.189.104.41:4564] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUelf7yUvZnd3bHSR3aI2gAAAEQ"]
[Sun Dec 21 15:45:04.194917 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.41:19208] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUelgNhSbhHOCK6TAw-gHgAAABE"]
[Sun Dec 21 15:45:04.801930 2025] [:error] [pid 20674:tid 20692] [client 4.189.104.41:4572] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUelgNhSbhHOCK6TAw-gIQAAAA4"]
[Sun Dec 21 15:45:05.238129 2025] [:error] [pid 20675:tid 20713] [client 4.189.104.41:22046] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUelgbyUvZnd3bHSR3aI3QAAAEc"]
[Sun Dec 21 15:45:05.790290 2025] [:error] [pid 60191:tid 60197] [client 4.189.104.41:20053] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUelgaklhK29C3vVvLVejAAAAYQ"]
[Sun Dec 21 15:45:06.333703 2025] [:error] [pid 60191:tid 60206] [client 4.189.104.41:38034] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUelgqklhK29C3vVvLVekQAAAY0"]
[Sun Dec 21 15:45:06.859612 2025] [:error] [pid 12191:tid 12198] [client 4.189.104.41:4613] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUelggM0m463UZmqdiCUAwAAAQU"]
[Sun Dec 21 15:45:07.324523 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Sun Dec 21 15:45:07.494024 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/atx.php
[Sun Dec 21 15:45:07.649009 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Sun Dec 21 15:45:07.823376 2025] [:error] [pid 60191:tid 60202] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sun Dec 21 15:45:07.974348 2025] [:error] [pid 60191:tid 60194] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Dec 21 15:45:08.459036 2025] [:error] [pid 60191:tid 60193] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Dec 21 15:45:08.646019 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Dec 21 15:45:08.805913 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Dec 21 15:45:08.973675 2025] [:error] [pid 60191:tid 60208] [client 4.189.104.41:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Dec 21 15:45:09.131090 2025] [:error] [pid 60191:tid 60197] [client 4.189.104.41:57471] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUelhaklhK29C3vVvLVeoAAAAYQ"]
[Sun Dec 21 15:45:09.576922 2025] [:error] [pid 16016:tid 16022] [client 4.189.104.41:4665] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUelhcHQ_KQh3iINaCNJPwAAAUQ"]
[Sun Dec 21 15:45:10.204301 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.41:4829] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUelhqpSa967F4pOO5xUaAAAAJM"]
[Sun Dec 21 15:45:10.703751 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.41:27642] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUelhgM0m463UZmqdiCUCAAAARU"]
[Sun Dec 21 15:45:11.244865 2025] [:error] [pid 16016:tid 16031] [client 4.189.104.41:32628] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUelh8HQ_KQh3iINaCNJRAAAAU0"]
[Sun Dec 21 15:45:11.609765 2025] [:error] [pid 20760:tid 20764] [client 4.189.104.41:4618] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUelh-XEVvRTAtWo3gk7CwAAAME"]
[Sun Dec 21 15:45:12.103593 2025] [:error] [pid 60191:tid 60194] [client 4.189.104.41:32612] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUeliKklhK29C3vVvLVepwAAAYE"]
[Sun Dec 21 15:45:12.604727 2025] [:error] [pid 16016:tid 16033] [client 4.189.104.41:32601] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUeliMHQ_KQh3iINaCNJRwAAAU8"]
[Sun Dec 21 15:45:13.237766 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.41:57424] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUeliapSa967F4pOO5xUbgAAAIU"]
[Sun Dec 21 15:45:13.775734 2025] [:error] [pid 16016:tid 16028] [client 4.189.104.41:4647] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUelicHQ_KQh3iINaCNJSgAAAUo"]
[Sun Dec 21 15:45:14.270472 2025] [:error] [pid 16016:tid 16019] [client 4.189.104.41:4488] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUelisHQ_KQh3iINaCNJSwAAAUE"]
[Sun Dec 21 15:45:14.684104 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.41:38039] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUeligM0m463UZmqdiCUEgAAAQ4"]
[Sun Dec 21 15:45:15.093128 2025] [:error] [pid 12191:tid 12209] [client 4.189.104.41:27638] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUeliwM0m463UZmqdiCUFQAAARA"]
[Sun Dec 21 15:45:15.474875 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.41:16564] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUeliwM0m463UZmqdiCUFgAAARU"]
[Sun Dec 21 15:45:15.926660 2025] [:error] [pid 20675:tid 20710] [client 4.189.104.41:16519] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUeli7yUvZnd3bHSR3aI7wAAAEQ"]
[Sun Dec 21 15:45:16.315844 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.41:23215] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUeljAM0m463UZmqdiCUGwAAAQ0"]
[Sun Dec 21 15:45:16.677426 2025] [:error] [pid 20675:tid 20709] [client 4.189.104.41:23190] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUeljLyUvZnd3bHSR3aI8gAAAEM"]
[Sun Dec 21 15:45:17.024435 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.41:21084] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUeljQM0m463UZmqdiCUHgAAAQM"]
[Sun Dec 21 15:45:17.418904 2025] [:error] [pid 20674:tid 20678] [client 4.189.104.41:21112] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUeljdhSbhHOCK6TAw-gQgAAAAA"]
[Sun Dec 21 15:45:17.771802 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.41:4843] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUeljQM0m463UZmqdiCUHwAAAQI"]
[Sun Dec 21 15:45:18.107704 2025] [:error] [pid 12191:tid 12203] [client 4.189.104.41:20038] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUeljgM0m463UZmqdiCUIQAAAQo"]
[Sun Dec 21 15:45:18.556708 2025] [:error] [pid 20675:tid 20713] [client 4.189.104.41:4670] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUeljryUvZnd3bHSR3aI9wAAAEc"]
[Sun Dec 21 15:45:18.879608 2025] [:error] [pid 16016:tid 16029] [client 4.189.104.41:57416] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUeljsHQ_KQh3iINaCNJVgAAAUs"]
[Sun Dec 21 15:45:19.270194 2025] [:error] [pid 60191:tid 60207] [client 4.189.104.41:25239] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUelj6klhK29C3vVvLVeuAAAAY4"]
[Sun Dec 21 15:45:19.806274 2025] [:error] [pid 12191:tid 12216] [client 4.189.104.41:4619] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUeljwM0m463UZmqdiCUIwAAARc"]
[Sun Dec 21 15:45:20.214619 2025] [:error] [pid 60191:tid 60193] [client 4.189.104.41:21073] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUelkKklhK29C3vVvLVeuQAAAYA"]
[Sun Dec 21 15:45:20.520272 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.41:20092] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUelkKklhK29C3vVvLVeuwAAAYM"]
[Sun Dec 21 15:45:20.919933 2025] [:error] [pid 20675:tid 20718] [client 4.189.104.41:4849] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUelkLyUvZnd3bHSR3aI_QAAAEw"]
[Sun Dec 21 15:45:21.323877 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.41:27610] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUelkQM0m463UZmqdiCUJwAAAQM"]
[Sun Dec 21 15:45:21.800643 2025] [:error] [pid 20760:tid 20769] [client 4.189.104.41:38615] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUelkeXEVvRTAtWo3gk7GAAAAMY"]
[Sun Dec 21 15:45:22.315494 2025] [:error] [pid 12191:tid 12205] [client 4.189.104.41:21110] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUelkgM0m463UZmqdiCUKQAAAQw"]
[Sun Dec 21 15:45:22.706076 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.41:56852] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUelkryUvZnd3bHSR3aJAgAAAEA"]
[Sun Dec 21 15:45:23.079605 2025] [:error] [pid 16016:tid 16040] [client 4.189.104.41:38625] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUelk8HQ_KQh3iINaCNJYAAAAVY"]
[Sun Dec 21 15:45:23.408298 2025] [:error] [pid 20760:tid 20773] [client 4.189.104.41:39229] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUelk-XEVvRTAtWo3gk7GwAAAMo"]
[Sun Dec 21 15:45:23.798183 2025] [:error] [pid 16016:tid 16026] [client 4.189.104.41:56889] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUelk8HQ_KQh3iINaCNJYQAAAUg"]
[Sun Dec 21 15:45:24.319173 2025] [:error] [pid 20675:tid 20718] [client 4.189.104.41:61994] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUellLyUvZnd3bHSR3aJCgAAAEw"]
[Sun Dec 21 15:45:24.729113 2025] [:error] [pid 16016:tid 16029] [client 4.189.104.41:23229] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUellMHQ_KQh3iINaCNJZAAAAUs"]
[Sun Dec 21 15:45:25.152204 2025] [:error] [pid 20675:tid 20709] [client 4.189.104.41:25224] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUellbyUvZnd3bHSR3aJDQAAAEM"]
[Sun Dec 21 15:45:25.521451 2025] [:error] [pid 20674:tid 20682] [client 4.189.104.41:25254] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUelldhSbhHOCK6TAw-gUQAAAAQ"]
[Sun Dec 21 15:45:25.970448 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.41:20554] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUellbyUvZnd3bHSR3aJDwAAAEA"]
[Sun Dec 21 15:45:26.438630 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.41:18302] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUellqpSa967F4pOO5xUdgAAAIU"]
[Sun Dec 21 15:45:26.886264 2025] [:error] [pid 60191:tid 60210] [client 4.189.104.41:18242] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUellqklhK29C3vVvLVevwAAAZE"]
[Sun Dec 21 15:45:27.235897 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.41:56870] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUell6klhK29C3vVvLVewQAAAYc"]
[Sun Dec 21 15:45:27.641605 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.41:56866] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUellwM0m463UZmqdiCUMQAAAQM"]
[Sun Dec 21 15:45:28.005617 2025] [:error] [pid 20760:tid 20776] [client 4.189.104.41:61922] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUelmOXEVvRTAtWo3gk7HgAAAM0"]
[Sun Dec 21 15:45:28.949633 2025] [:error] [pid 20760:tid 20778] [client 4.189.104.41:31284] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUelmOXEVvRTAtWo3gk7HwAAAM8"]
[Sun Dec 21 15:45:29.386560 2025] [:error] [pid 60191:tid 60202] [client 4.189.104.41:39185] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUelmaklhK29C3vVvLVexQAAAYk"]
[Sun Dec 21 15:45:29.764069 2025] [:error] [pid 20676:tid 20756] [client 4.189.104.41:31292] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUelmapSa967F4pOO5xUeQAAAJc"]
[Sun Dec 21 15:45:30.118249 2025] [:error] [pid 16016:tid 16023] [client 4.189.104.41:39201] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUelmsHQ_KQh3iINaCNJawAAAUU"]
[Sun Dec 21 15:45:30.648107 2025] [:error] [pid 60191:tid 60193] [client 4.189.104.41:18258] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUelmqklhK29C3vVvLVeyQAAAYA"]
[Sun Dec 21 15:45:31.145190 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.41:56841] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUelm6klhK29C3vVvLVeygAAAYM"]
[Sun Dec 21 15:45:31.639431 2025] [:error] [pid 20676:tid 20746] [client 4.189.104.41:61976] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUelm6pSa967F4pOO5xUfwAAAI0"]
[Sun Dec 21 15:45:32.077370 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.41:20834] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUelnKpSa967F4pOO5xUiAAAAIU"]
[Sun Dec 21 15:45:32.750320 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.41:20562] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUelnAM0m463UZmqdiCUNwAAARM"]
[Sun Dec 21 15:45:33.288348 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.41:34559] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUelncHQ_KQh3iINaCNJbQAAAUA"]
[Sun Dec 21 15:45:33.681928 2025] [:error] [pid 20675:tid 20726] [client 4.189.104.41:56880] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUelnbyUvZnd3bHSR3aJFwAAAFQ"]
[Sun Dec 21 15:45:34.253144 2025] [:error] [pid 16016:tid 16019] [client 4.189.104.41:25261] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUelnsHQ_KQh3iINaCNJbwAAAUE"]
[Sun Dec 21 15:45:34.735706 2025] [:error] [pid 20760:tid 20765] [client 4.189.104.41:20577] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aUelnuXEVvRTAtWo3gk7KQAAAMI"]
[Sun Dec 21 15:45:35.235729 2025] [:error] [pid 20674:tid 20686] [client 4.189.104.41:38599] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aUeln9hSbhHOCK6TAw-gcwAAAAg"]
[Sun Dec 21 15:45:35.668424 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.41:18277] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aUeln8HQ_KQh3iINaCNJcQAAAVc"]
[Sun Dec 21 15:45:36.119846 2025] [:error] [pid 16016:tid 16028] [client 4.189.104.41:25253] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aUeloMHQ_KQh3iINaCNJcgAAAUo"]
[Sun Dec 21 15:45:36.812425 2025] [:error] [pid 20760:tid 20781] [client 4.189.104.41:38626] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aUeloOXEVvRTAtWo3gk7KgAAANI"]
[Sun Dec 21 15:45:37.366925 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.41:20584] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aUeloQM0m463UZmqdiCUPQAAAQk"]
[Sun Dec 21 15:45:37.819895 2025] [:error] [pid 20760:tid 20779] [client 4.189.104.41:39208] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aUeloeXEVvRTAtWo3gk7LgAAANA"]
[Sun Dec 21 15:45:38.400832 2025] [:error] [pid 20760:tid 20764] [client 4.189.104.41:20544] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aUelouXEVvRTAtWo3gk7MAAAAME"]
[Sun Dec 21 15:45:38.824308 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.41:20560] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUelouXEVvRTAtWo3gk7MwAAAMk"]
[Sun Dec 21 15:45:39.258082 2025] [:error] [pid 60191:tid 60210] [client 4.189.104.41:16863] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUelo6klhK29C3vVvLVe3AAAAZE"]
[Sun Dec 21 15:45:39.669221 2025] [:error] [pid 20760:tid 20773] [client 4.189.104.41:31257] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUelo-XEVvRTAtWo3gk7NAAAAMo"]
[Sun Dec 21 15:45:40.098694 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.41:19824] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUelpKklhK29C3vVvLVe3gAAAZQ"]
[Sun Dec 21 15:45:40.514786 2025] [:error] [pid 60191:tid 60202] [client 4.189.104.41:53362] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUelpKklhK29C3vVvLVe3wAAAYk"]
[Sun Dec 21 15:45:40.937320 2025] [:error] [pid 20675:tid 20707] [client 4.189.104.41:17973] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUelpLyUvZnd3bHSR3aJHAAAAEE"]
[Sun Dec 21 15:45:41.414433 2025] [:error] [pid 20675:tid 20730] [client 4.189.104.41:16843] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUelpbyUvZnd3bHSR3aJHgAAAFg"]
[Sun Dec 21 15:45:41.888921 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.41:31251] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUelpcHQ_KQh3iINaCNJgwAAAVM"]
[Sun Dec 21 15:45:42.356389 2025] [:error] [pid 20760:tid 20763] [client 4.189.104.41:53337] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUelpuXEVvRTAtWo3gk7OAAAAMA"]
[Sun Dec 21 15:45:42.811959 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.41:19776] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUelpthSbhHOCK6TAw-gfQAAAAc"]
[Sun Dec 21 15:45:43.250962 2025] [:error] [pid 20760:tid 20776] [client 4.189.104.41:17934] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUelp-XEVvRTAtWo3gk7OQAAAM0"]
[Sun Dec 21 15:45:43.792644 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.41:31224] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUelp9hSbhHOCK6TAw-ggAAAABE"]
[Sun Dec 21 15:45:44.191841 2025] [:error] [pid 60191:tid 60197] [client 4.189.104.41:20569] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUelqKklhK29C3vVvLVe5QAAAYQ"]
[Sun Dec 21 15:45:44.839932 2025] [:error] [pid 20676:tid 20736] [client 4.189.104.41:31253] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUelqKpSa967F4pOO5xUmgAAAIM"]
[Sun Dec 21 15:45:45.231874 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.41:53332] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUelqQM0m463UZmqdiCUSgAAAQ0"]
[Sun Dec 21 15:45:45.731698 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.41:19821] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUelqQM0m463UZmqdiCUTAAAAQY"]
[Sun Dec 21 15:45:46.063226 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.41:31275] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUelqthSbhHOCK6TAw-ghAAAAAs"]
[Sun Dec 21 15:45:46.510052 2025] [:error] [pid 20674:tid 20697] [client 4.189.104.41:51411] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUelqthSbhHOCK6TAw-ghwAAABM"]
[Sun Dec 21 15:45:46.933912 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.41:19459] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUelqqklhK29C3vVvLVe7AAAAZg"]
[Sun Dec 21 15:45:47.446143 2025] [:error] [pid 20760:tid 20782] [client 4.189.104.41:53318] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aUelq-XEVvRTAtWo3gk7OgAAANM"]
[Sun Dec 21 15:45:47.936655 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.41:52809] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUelqwM0m463UZmqdiCUTgAAARM"]
[Sun Dec 21 15:45:48.536883 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.41:17726] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUelrOXEVvRTAtWo3gk7OwAAAMk"]
[Sun Dec 21 15:45:48.958414 2025] [:error] [pid 12191:tid 12203] [client 4.189.104.41:31170] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUelrAM0m463UZmqdiCUUAAAAQo"]
[Sun Dec 21 15:45:49.370912 2025] [:error] [pid 12191:tid 12216] [client 4.189.104.41:17930] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aUelrQM0m463UZmqdiCUUQAAARc"]
[Sun Dec 21 15:45:50.110977 2025] [:error] [pid 60191:tid 60200] [client 4.189.104.41:17706] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUelrqklhK29C3vVvLVe7wAAAYc"]
[Sun Dec 21 15:45:50.614281 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.41:51401] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUelrqklhK29C3vVvLVe8gAAAYw"]
[Sun Dec 21 15:45:51.047610 2025] [:error] [pid 60191:tid 60197] [client 4.189.104.41:17664] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUelr6klhK29C3vVvLVe8wAAAYQ"]
[Sun Dec 21 15:45:51.558722 2025] [:error] [pid 60191:tid 60211] [client 4.189.104.41:42992] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUelr6klhK29C3vVvLVe9wAAAZI"]
[Sun Dec 21 15:45:52.295788 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.41:17938] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUelsOXEVvRTAtWo3gk7PwAAAMg"]
[Sun Dec 21 15:45:52.687452 2025] [:error] [pid 20760:tid 20763] [client 4.189.104.41:18985] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUelsOXEVvRTAtWo3gk7QAAAAMA"]
[Sun Dec 21 15:45:53.287036 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.41:18978] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUelsapSa967F4pOO5xUogAAAIg"]
[Sun Dec 21 15:45:53.851370 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.41:4529] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUelsQM0m463UZmqdiCUWAAAAQM"]
[Sun Dec 21 15:45:54.220876 2025] [:error] [pid 12191:tid 12197] [client 4.189.104.41:17955] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUelsgM0m463UZmqdiCUWQAAAQQ"]
[Sun Dec 21 15:45:54.628257 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.41:51445] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUelssHQ_KQh3iINaCNJjgAAAUc"]
[Sun Dec 21 15:45:55.031473 2025] [:error] [pid 16016:tid 16020] [client 4.189.104.41:30421] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUels8HQ_KQh3iINaCNJkAAAAUI"]
[Sun Dec 21 15:45:55.453326 2025] [:error] [pid 20676:tid 20753] [client 4.189.104.41:51435] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUels6pSa967F4pOO5xUpAAAAJQ"]
[Sun Dec 21 15:45:56.016114 2025] [:error] [pid 20676:tid 20736] [client 4.189.104.41:16830] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUeltKpSa967F4pOO5xUpQAAAIM"]
[Sun Dec 21 15:45:56.390077 2025] [:error] [pid 20676:tid 20735] [client 4.189.104.41:19483] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUeltKpSa967F4pOO5xUqAAAAII"]
[Sun Dec 21 15:45:56.928749 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.41:30441] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUeltMHQ_KQh3iINaCNJkwAAAVM"]
[Sun Dec 21 15:45:57.578601 2025] [:error] [pid 12191:tid 12212] [client 4.189.104.41:51427] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUeltQM0m463UZmqdiCUYgAAARM"]
[Sun Dec 21 15:45:58.047724 2025] [:error] [pid 16016:tid 16024] [client 4.189.104.41:51402] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUeltsHQ_KQh3iINaCNJlwAAAUY"]
[Sun Dec 21 15:45:58.803219 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.41:19002] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUeltqpSa967F4pOO5xUqgAAAI4"]
[Sun Dec 21 15:45:59.160066 2025] [:error] [pid 16016:tid 16027] [client 4.189.104.41:17718] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUelt8HQ_KQh3iINaCNJmAAAAUk"]
[Sun Dec 21 15:45:59.681891 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.41:51443] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUelt6pSa967F4pOO5xUrAAAAIw"]
[Sun Dec 21 15:46:00.212098 2025] [:error] [pid 20675:tid 20727] [client 4.189.104.41:27311] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUeluLyUvZnd3bHSR3aJKwAAAFU"]
[Sun Dec 21 15:46:00.660230 2025] [:error] [pid 20675:tid 20716] [client 4.189.104.41:4477] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUeluLyUvZnd3bHSR3aJLgAAAEo"]
[Sun Dec 21 15:46:01.075538 2025] [:error] [pid 20675:tid 20720] [client 4.189.104.41:21550] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUelubyUvZnd3bHSR3aJMAAAAE4"]
[Sun Dec 21 15:46:01.858208 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.41:17672] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUeludhSbhHOCK6TAw-gmgAAAAY"]
[Sun Dec 21 15:46:02.374500 2025] [:error] [pid 60191:tid 60195] [client 4.189.104.41:27324] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUeluqklhK29C3vVvLVfBAAAAYI"]
[Sun Dec 21 15:46:02.748496 2025] [:error] [pid 60191:tid 60193] [client 4.189.104.41:27283] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUeluqklhK29C3vVvLVfBgAAAYA"]
[Sun Dec 21 15:46:03.080438 2025] [:error] [pid 20674:tid 20683] [client 4.189.104.41:4419] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUelu9hSbhHOCK6TAw-gnQAAAAU"]
[Sun Dec 21 15:46:03.569459 2025] [:error] [pid 12191:tid 12200] [client 4.189.104.41:17714] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUeluwM0m463UZmqdiCUZgAAAQc"]
[Sun Dec 21 15:46:03.930699 2025] [:error] [pid 12191:tid 12209] [client 4.189.104.41:16801] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUeluwM0m463UZmqdiCUaQAAARA"]
[Sun Dec 21 15:46:04.696610 2025] [:error] [pid 20674:tid 20691] [client 4.189.104.41:17709] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUelvNhSbhHOCK6TAw-gngAAAA0"]
[Sun Dec 21 15:46:05.138160 2025] [:error] [pid 20674:tid 20686] [client 4.189.104.41:21546] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUelvdhSbhHOCK6TAw-goAAAAAg"]
[Sun Dec 21 15:46:05.586728 2025] [:error] [pid 20760:tid 20774] [client 4.189.104.41:30454] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUelveXEVvRTAtWo3gk7RgAAAMs"]
[Sun Dec 21 15:46:06.075815 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.41:21508] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUelvthSbhHOCK6TAw-gpQAAABQ"]
[Sun Dec 21 15:46:06.453444 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.41:4904] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUelvuXEVvRTAtWo3gk7SQAAAMg"]
[Sun Dec 21 15:46:06.807429 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.41:19754] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUelvsHQ_KQh3iINaCNJmQAAAUc"]
[Sun Dec 21 15:46:07.380398 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.41:4903] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUelv9hSbhHOCK6TAw-gpgAAABI"]
[Sun Dec 21 15:46:07.880665 2025] [:error] [pid 60191:tid 60198] [client 4.189.104.41:17719] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUelv6klhK29C3vVvLVfJQAAAYU"]
[Sun Dec 21 15:46:08.480637 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.41:51416] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aUelwAM0m463UZmqdiCUcAAAAQ4"]
[Sun Dec 21 15:46:09.212418 2025] [:error] [pid 20676:tid 20749] [client 4.189.104.41:21516] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aUelwapSa967F4pOO5xUsgAAAJA"]
[Sun Dec 21 15:46:09.922187 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.41:4927] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aUelwapSa967F4pOO5xUtgAAAJI"]
[Sun Dec 21 15:46:10.256746 2025] [:error] [pid 60191:tid 60210] [client 4.189.104.41:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Sun Dec 21 15:46:11.715230 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.41:21548] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Dec 21 15:46:12.069505 2025] [:error] [pid 60191:tid 60206] [client 4.189.104.41:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Sun Dec 21 15:46:12.248455 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:21548] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUelxKklhK29C3vVvLVfswAAAZY"]
[Sun Dec 21 15:46:12.587301 2025] [:error] [pid 12191:tid 12203] [client 4.189.104.41:18968] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUelxAM0m463UZmqdiCUdgAAAQo"]
[Sun Dec 21 15:46:13.071052 2025] [:error] [pid 20760:tid 20787] [client 4.189.104.41:18980] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUelxeXEVvRTAtWo3gk7TAAAANg"]
[Sun Dec 21 15:46:13.573071 2025] [:error] [pid 16016:tid 16024] [client 4.189.104.41:18975] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUelxcHQ_KQh3iINaCNJoAAAAUY"]
[Sun Dec 21 15:46:14.120880 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.41:17706] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUelxsHQ_KQh3iINaCNJogAAAUM"]
[Sun Dec 21 15:46:14.548216 2025] [:error] [pid 12191:tid 12210] [client 4.189.104.41:19758] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUelxgM0m463UZmqdiCUegAAARE"]
[Sun Dec 21 15:46:15.062081 2025] [:error] [pid 20676:tid 20750] [client 4.189.104.41:27325] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUelx6pSa967F4pOO5xUuwAAAJE"]
[Sun Dec 21 15:46:15.417129 2025] [:error] [pid 20676:tid 20757] [client 4.189.104.41:4438] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUelx6pSa967F4pOO5xUvQAAAJg"]
[Sun Dec 21 15:46:15.905243 2025] [:error] [pid 12191:tid 12194] [client 4.189.104.41:19751] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUelxwM0m463UZmqdiCUewAAAQE"]
[Sun Dec 21 15:46:16.352880 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.41:4441] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUelyKpSa967F4pOO5xUvwAAAIc"]
[Sun Dec 21 15:46:16.685260 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.41:27294] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUelyNhSbhHOCK6TAw-grAAAABQ"]
[Sun Dec 21 15:46:17.185535 2025] [:error] [pid 20674:tid 20681] [client 4.189.104.41:27290] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUelydhSbhHOCK6TAw-grgAAAAM"]
[Sun Dec 21 15:46:17.547892 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.41:4198] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUelyQM0m463UZmqdiCUfwAAARQ"]
[Sun Dec 21 15:46:17.919777 2025] [:error] [pid 16016:tid 16026] [client 4.189.104.41:27281] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs5.php"] [unique_id "aUelycHQ_KQh3iINaCNJpwAAAUg"]
[Sun Dec 21 15:46:18.268777 2025] [:error] [pid 20674:tid 20688] [client 4.189.104.41:4887] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs5.php"] [unique_id "aUelythSbhHOCK6TAw-gswAAAAo"]
[Sun Dec 21 15:46:18.623343 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.41:4457] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs5.php"] [unique_id "aUelyqklhK29C3vVvLVfwAAAAZQ"]
[Sun Dec 21 15:46:18.935201 2025] [:error] [pid 20676:tid 20742] [client 4.189.104.41:21032] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUelyqpSa967F4pOO5xUwAAAAIk"]
[Sun Dec 21 15:46:19.267075 2025] [:error] [pid 16016:tid 16039] [client 4.189.104.41:21052] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUely8HQ_KQh3iINaCNJqgAAAVU"]
[Sun Dec 21 15:46:19.787023 2025] [:error] [pid 20674:tid 20686] [client 4.189.104.41:27320] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUely9hSbhHOCK6TAw-gtgAAAAg"]
[Sun Dec 21 15:46:20.201589 2025] [:error] [pid 60191:tid 60202] [client 4.189.104.41:33944] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUelzKklhK29C3vVvLVfwgAAAYk"]
[Sun Dec 21 15:46:20.535478 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.41:26851] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUelzMHQ_KQh3iINaCNJqwAAAUA"]
[Sun Dec 21 15:46:20.967411 2025] [:error] [pid 20675:tid 20711] [client 4.189.104.41:4160] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUelzLyUvZnd3bHSR3aJawAAAEU"]
[Sun Dec 21 15:46:21.320929 2025] [:error] [pid 16016:tid 16030] [client 4.189.104.41:19543] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUelzcHQ_KQh3iINaCNJrAAAAUw"]
[Sun Dec 21 15:46:21.693761 2025] [:error] [pid 20760:tid 20766] [client 4.189.104.41:26867] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUelzeXEVvRTAtWo3gk7VQAAAMM"]
[Sun Dec 21 15:46:22.037335 2025] [:error] [pid 20676:tid 20746] [client 4.189.104.41:26841] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUelzqpSa967F4pOO5xUxgAAAI0"]
[Sun Dec 21 15:46:22.451727 2025] [:error] [pid 20674:tid 20702] [client 4.189.104.41:19582] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUelzthSbhHOCK6TAw-guAAAABg"]
[Sun Dec 21 15:46:22.789320 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.41:54632] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUelzthSbhHOCK6TAw-guQAAAAs"]
[Sun Dec 21 15:46:23.266008 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.41:4172] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUelz9hSbhHOCK6TAw-gugAAABI"]
[Sun Dec 21 15:46:23.637303 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:4443] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUelz6klhK29C3vVvLVfxAAAAZY"]
[Sun Dec 21 15:46:23.970447 2025] [:error] [pid 20675:tid 20714] [client 4.189.104.41:21554] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUelz7yUvZnd3bHSR3aJcQAAAEg"]
[Sun Dec 21 15:46:24.327227 2025] [:error] [pid 20675:tid 20715] [client 4.189.104.41:57424] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUel0LyUvZnd3bHSR3aJcgAAAEk"]
[Sun Dec 21 15:46:24.724889 2025] [:error] [pid 12191:tid 12204] [client 4.189.104.41:54615] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUel0AM0m463UZmqdiCUiQAAAQs"]
[Sun Dec 21 15:46:25.084062 2025] [:error] [pid 12191:tid 12194] [client 4.189.104.41:26877] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUel0QM0m463UZmqdiCUigAAAQE"]
[Sun Dec 21 15:46:25.423138 2025] [:error] [pid 12191:tid 12210] [client 4.189.104.41:26329] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUel0QM0m463UZmqdiCUiwAAARE"]
[Sun Dec 21 15:46:25.747438 2025] [:error] [pid 20676:tid 20739] [client 4.189.104.41:21030] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUel0apSa967F4pOO5xUygAAAIY"]
[Sun Dec 21 15:46:26.159502 2025] [:error] [pid 20760:tid 20784] [client 4.189.104.41:21509] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUel0uXEVvRTAtWo3gk7WwAAANU"]
[Sun Dec 21 15:46:26.580223 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.41:19770] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUel0thSbhHOCK6TAw-gvQAAABE"]
[Sun Dec 21 15:46:27.031810 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.41:4220] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUel0-XEVvRTAtWo3gk7XgAAAMk"]
[Sun Dec 21 15:46:27.501890 2025] [:error] [pid 20760:tid 20767] [client 4.189.104.41:26330] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUel0-XEVvRTAtWo3gk7XwAAAMQ"]
[Sun Dec 21 15:46:27.917770 2025] [:error] [pid 60191:tid 60194] [client 4.189.104.41:18230] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUel06klhK29C3vVvLVfxgAAAYE"]
[Sun Dec 21 15:46:28.225774 2025] [:error] [pid 20675:tid 20726] [client 4.189.104.41:50605] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUel1LyUvZnd3bHSR3aJdgAAAFQ"]
[Sun Dec 21 15:46:28.670690 2025] [:error] [pid 60191:tid 60195] [client 4.189.104.41:26354] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUel1KklhK29C3vVvLVfxwAAAYI"]
[Sun Dec 21 15:46:29.138937 2025] [:error] [pid 20676:tid 20751] [client 4.189.104.41:26843] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUel1apSa967F4pOO5xUzQAAAJI"]
[Sun Dec 21 15:46:29.497751 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.41:33980] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUel1dhSbhHOCK6TAw-gwwAAABI"]
[Sun Dec 21 15:46:29.923750 2025] [:error] [pid 20675:tid 20730] [client 4.189.104.41:21046] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUel1byUvZnd3bHSR3aJeQAAAFg"]
[Sun Dec 21 15:46:30.308448 2025] [:error] [pid 20676:tid 20737] [client 4.189.104.41:26315] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUel1qpSa967F4pOO5xUzwAAAIQ"]
[Sun Dec 21 15:46:30.744828 2025] [:error] [pid 20760:tid 20781] [client 4.189.104.41:33943] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUel1uXEVvRTAtWo3gk7YwAAANI"]
[Sun Dec 21 15:46:31.405547 2025] [:error] [pid 20675:tid 20725] [client 4.189.104.41:50603] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUel17yUvZnd3bHSR3aJegAAAFM"]
[Sun Dec 21 15:46:31.966007 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.41:23548] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUel19hSbhHOCK6TAw-gxwAAAAY"]
[Sun Dec 21 15:46:32.312435 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.41:26349] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUel2NhSbhHOCK6TAw-gyQAAABE"]
[Sun Dec 21 15:46:32.673105 2025] [:error] [pid 20674:tid 20685] [client 4.189.104.41:54630] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUel2NhSbhHOCK6TAw-gywAAAAc"]
[Sun Dec 21 15:46:33.073351 2025] [:error] [pid 16016:tid 16037] [client 4.189.104.41:18179] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUel2cHQ_KQh3iINaCNJvAAAAVM"]
[Sun Dec 21 15:46:33.497681 2025] [:error] [pid 20675:tid 20728] [client 4.189.104.41:4180] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUel2byUvZnd3bHSR3aJewAAAFY"]
[Sun Dec 21 15:46:33.836454 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.41:33982] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUel2QM0m463UZmqdiCUjwAAAQI"]
[Sun Dec 21 15:46:34.259388 2025] [:error] [pid 16016:tid 16026] [client 4.189.104.41:19537] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUel2sHQ_KQh3iINaCNJvwAAAUg"]
[Sun Dec 21 15:46:34.734616 2025] [:error] [pid 12191:tid 12209] [client 4.189.104.41:19719] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUel2gM0m463UZmqdiCUkAAAARA"]
[Sun Dec 21 15:46:35.135451 2025] [:error] [pid 60191:tid 60210] [client 4.189.104.41:54649] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aUel26klhK29C3vVvLVf0AAAAZE"]
[Sun Dec 21 15:46:35.486329 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.41:19548] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aUel26klhK29C3vVvLVf0QAAAZA"]
[Sun Dec 21 15:46:35.893068 2025] [:error] [pid 20674:tid 20701] [client 4.189.104.41:27317] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aUel29hSbhHOCK6TAw-gzgAAABc"]
[Sun Dec 21 15:46:36.273558 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.41:21517] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aUel3KklhK29C3vVvLVf0wAAAYM"]
[Sun Dec 21 15:46:36.869057 2025] [:error] [pid 20674:tid 20693] [client 4.189.104.41:27306] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aUel3NhSbhHOCK6TAw-gzwAAAA8"]
[Sun Dec 21 15:46:37.271424 2025] [:error] [pid 60191:tid 60195] [client 4.189.104.41:19563] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aUel3aklhK29C3vVvLVf2AAAAYI"]
[Sun Dec 21 15:46:37.828989 2025] [:error] [pid 16016:tid 16020] [client 4.189.104.41:4173] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aUel3cHQ_KQh3iINaCNJwwAAAUI"]
[Sun Dec 21 15:46:38.541596 2025] [:error] [pid 12191:tid 12203] [client 4.189.104.41:4166] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aUel3gM0m463UZmqdiCUlAAAAQo"]
[Sun Dec 21 15:46:38.888958 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.41:4897] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUel3qklhK29C3vVvLVf2gAAAZc"]
[Sun Dec 21 15:46:39.296352 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.41:19552] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUel36pSa967F4pOO5xU0wAAAIc"]
[Sun Dec 21 15:46:39.637528 2025] [:error] [pid 20676:tid 20742] [client 4.189.104.41:54624] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUel36pSa967F4pOO5xU1AAAAIk"]
[Sun Dec 21 15:46:40.083923 2025] [:error] [pid 20760:tid 20772] [client 4.189.104.41:30461] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aUel4OXEVvRTAtWo3gk7agAAAMk"]
[Sun Dec 21 15:46:40.534107 2025] [:error] [pid 20760:tid 20767] [client 4.189.104.41:18989] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aUel4OXEVvRTAtWo3gk7bQAAAMQ"]
[Sun Dec 21 15:46:40.933781 2025] [:error] [pid 12191:tid 12202] [client 4.189.104.41:4922] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aUel4AM0m463UZmqdiCUlwAAAQk"]
[Sun Dec 21 15:46:41.252423 2025] [:error] [pid 20675:tid 20721] [client 4.189.104.41:18958] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aUel4byUvZnd3bHSR3aJggAAAE8"]
[Sun Dec 21 15:46:41.609812 2025] [:error] [pid 16016:tid 16023] [client 4.189.104.41:30402] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aUel4cHQ_KQh3iINaCNJxwAAAUU"]
[Sun Dec 21 15:46:41.960521 2025] [:error] [pid 12191:tid 12206] [client 4.189.104.41:21539] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aUel4QM0m463UZmqdiCUmAAAAQ0"]
[Sun Dec 21 15:46:42.301795 2025] [:error] [pid 12191:tid 12201] [client 4.189.104.41:4420] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aUel4gM0m463UZmqdiCUmgAAAQg"]
[Sun Dec 21 15:46:42.603681 2025] [:error] [pid 12191:tid 12195] [client 4.189.104.41:18954] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aUel4gM0m463UZmqdiCUmwAAAQI"]
[Sun Dec 21 15:46:43.011741 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.41:4466] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aUel49hSbhHOCK6TAw-g1gAAABE"]
[Sun Dec 21 15:46:43.540080 2025] [:error] [pid 20676:tid 20741] [client 4.189.104.41:30434] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aUel46pSa967F4pOO5xU1gAAAIg"]
[Sun Dec 21 15:46:44.074897 2025] [:error] [pid 20674:tid 20698] [client 4.189.104.41:18964] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aUel5NhSbhHOCK6TAw-g2wAAABQ"]
[Sun Dec 21 15:46:44.496899 2025] [:error] [pid 20675:tid 20722] [client 4.189.104.41:18996] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aUel5LyUvZnd3bHSR3aJhQAAAFA"]
[Sun Dec 21 15:46:44.818816 2025] [:error] [pid 20675:tid 20713] [client 4.189.104.41:18993] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aUel5LyUvZnd3bHSR3aJhgAAAEc"]
[Sun Dec 21 15:46:45.301970 2025] [:error] [pid 20674:tid 20692] [client 4.189.104.41:4439] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUel5dhSbhHOCK6TAw-g4QAAAA4"]
[Sun Dec 21 15:46:45.970088 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.41:27270] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUel5apSa967F4pOO5xU2QAAAJM"]
[Sun Dec 21 15:46:46.370118 2025] [:error] [pid 20760:tid 20769] [client 4.189.104.41:30429] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUel5uXEVvRTAtWo3gk7cQAAAMY"]
[Sun Dec 21 15:46:46.739833 2025] [:error] [pid 12191:tid 12208] [client 4.189.104.41:51393] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUel5gM0m463UZmqdiCUngAAAQ8"]
[Sun Dec 21 15:46:47.233482 2025] [:error] [pid 16016:tid 16041] [client 4.189.104.41:17952] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUel58HQ_KQh3iINaCNJzwAAAVc"]
[Sun Dec 21 15:46:47.617990 2025] [:error] [pid 12191:tid 12211] [client 4.189.104.41:51406] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUel5wM0m463UZmqdiCUoAAAARI"]
[Sun Dec 21 15:46:47.974788 2025] [:error] [pid 20674:tid 20701] [client 4.189.104.41:51422] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUel59hSbhHOCK6TAw-g5QAAABc"]
[Sun Dec 21 15:46:48.306204 2025] [:error] [pid 20674:tid 20689] [client 4.189.104.41:23879] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUel6NhSbhHOCK6TAw-g5gAAAAs"]
[Sun Dec 21 15:46:48.673070 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.41:23916] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUel6MHQ_KQh3iINaCNJ0wAAAUM"]
[Sun Dec 21 15:46:48.982307 2025] [:error] [pid 20676:tid 20757] [client 4.189.104.41:31185] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUel6KpSa967F4pOO5xU3QAAAJg"]
[Sun Dec 21 15:46:49.474933 2025] [:error] [pid 20675:tid 20726] [client 4.189.104.41:18948] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUel6byUvZnd3bHSR3aJjAAAAFQ"]
[Sun Dec 21 15:46:49.864600 2025] [:error] [pid 16016:tid 16025] [client 4.189.104.41:53336] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUel6cHQ_KQh3iINaCNJ1QAAAUc"]
[Sun Dec 21 15:46:50.194913 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.41:51426] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUel6gM0m463UZmqdiCUowAAAQ4"]
[Sun Dec 21 15:46:50.554301 2025] [:error] [pid 20674:tid 20691] [client 4.189.104.41:23885] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUel6thSbhHOCK6TAw-g6wAAAA0"]
[Sun Dec 21 15:46:50.931006 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:33336] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUel6qklhK29C3vVvLVf4QAAAZY"]
[Sun Dec 21 15:46:51.416421 2025] [:error] [pid 12191:tid 12217] [client 4.189.104.41:16814] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUel6wM0m463UZmqdiCUpQAAARg"]
[Sun Dec 21 15:46:51.844996 2025] [:error] [pid 20676:tid 20748] [client 4.189.104.41:51434] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUel66pSa967F4pOO5xU4QAAAI8"]
[Sun Dec 21 15:46:52.320919 2025] [:error] [pid 60191:tid 60208] [client 4.189.104.41:53344] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUel7KklhK29C3vVvLVf4wAAAY8"]
[Sun Dec 21 15:46:52.819639 2025] [:error] [pid 20675:tid 20709] [client 4.189.104.41:19813] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUel7LyUvZnd3bHSR3aJjwAAAEM"]
[Sun Dec 21 15:46:53.373136 2025] [:error] [pid 60191:tid 60211] [client 4.189.104.41:33287] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUel7aklhK29C3vVvLVf5AAAAZI"]
[Sun Dec 21 15:46:53.747400 2025] [:error] [pid 20760:tid 20774] [client 4.189.104.41:16862] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUel7eXEVvRTAtWo3gk7eQAAAMs"]
[Sun Dec 21 15:46:54.181564 2025] [:error] [pid 20676:tid 20733] [client 4.189.104.41:31286] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUel7qpSa967F4pOO5xU4gAAAIA"]
[Sun Dec 21 15:46:54.608382 2025] [:error] [pid 20675:tid 20719] [client 4.189.104.41:38645] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUel7ryUvZnd3bHSR3aJkQAAAE0"]
[Sun Dec 21 15:46:54.926880 2025] [:error] [pid 20676:tid 20737] [client 4.189.104.41:34538] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUel7qpSa967F4pOO5xU5AAAAIQ"]
[Sun Dec 21 15:46:55.476833 2025] [:error] [pid 20676:tid 20745] [client 4.189.104.41:18297] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUel76pSa967F4pOO5xU5wAAAIw"]
[Sun Dec 21 15:46:56.004224 2025] [:error] [pid 20674:tid 20696] [client 4.189.104.41:16540] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUel8NhSbhHOCK6TAw-g7wAAABI"]
[Sun Dec 21 15:46:56.396725 2025] [:error] [pid 12191:tid 12196] [client 4.189.104.41:57433] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUel8AM0m463UZmqdiCUqQAAAQM"]
[Sun Dec 21 15:46:56.806962 2025] [:error] [pid 20760:tid 20776] [client 4.189.104.41:4588] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUel8OXEVvRTAtWo3gk7fwAAAM0"]
[Sun Dec 21 15:46:57.324413 2025] [:error] [pid 16016:tid 16042] [client 4.189.104.41:20033] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUel8cHQ_KQh3iINaCNJ1wAAAVg"]
[Sun Dec 21 15:46:57.735177 2025] [:error] [pid 20674:tid 20679] [client 4.189.104.41:57458] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUel8dhSbhHOCK6TAw-g8QAAAAE"]
[Sun Dec 21 15:46:58.101852 2025] [:error] [pid 16016:tid 16027] [client 4.189.104.41:53409] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUel8sHQ_KQh3iINaCNJ2gAAAUk"]
[Sun Dec 21 15:46:58.749090 2025] [:error] [pid 20674:tid 20690] [client 4.189.104.41:17529] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUel8thSbhHOCK6TAw-hDwAAAAw"]
[Sun Dec 21 15:46:59.172106 2025] [:error] [pid 20674:tid 20697] [client 4.189.104.41:23947] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUel89hSbhHOCK6TAw-hJgAAABM"]
[Sun Dec 21 15:46:59.555169 2025] [:error] [pid 20674:tid 20684] [client 4.189.104.41:23488] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUel89hSbhHOCK6TAw-hOwAAAAY"]
[Sun Dec 21 15:46:59.960042 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.41:19062] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUel86pSa967F4pOO5xU6wAAAIU"]
[Sun Dec 21 15:47:00.282931 2025] [:error] [pid 12191:tid 12205] [client 4.189.104.41:19041] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUel9AM0m463UZmqdiCUrQAAAQw"]
[Sun Dec 21 15:47:00.733363 2025] [:error] [pid 20676:tid 20749] [client 4.189.104.41:19022] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUel9KpSa967F4pOO5xU7AAAAJA"]
[Sun Dec 21 15:47:01.206876 2025] [:error] [pid 20675:tid 20726] [client 4.189.104.41:21964] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUel9byUvZnd3bHSR3aJlAAAAFQ"]
[Sun Dec 21 15:47:01.580844 2025] [:error] [pid 20675:tid 20723] [client 4.189.104.41:25170] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUel9byUvZnd3bHSR3aJlQAAAFE"]
[Sun Dec 21 15:47:01.899407 2025] [:error] [pid 20675:tid 20720] [client 4.189.104.41:55250] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUel9byUvZnd3bHSR3aJlgAAAE4"]
[Sun Dec 21 15:47:02.353319 2025] [:error] [pid 12191:tid 12214] [client 4.189.104.41:25185] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUel9gM0m463UZmqdiCUsAAAARU"]
[Sun Dec 21 15:47:02.847603 2025] [:error] [pid 20675:tid 20711] [client 4.189.104.41:44342] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUel9ryUvZnd3bHSR3aJmAAAAEU"]
[Sun Dec 21 15:47:03.308532 2025] [:error] [pid 20676:tid 20733] [client 4.189.104.41:32042] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUel96pSa967F4pOO5xU7wAAAIA"]
[Sun Dec 21 15:47:03.707440 2025] [:error] [pid 16016:tid 16018] [client 4.189.104.41:38690] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUel98HQ_KQh3iINaCNJ3wAAAUA"]
[Sun Dec 21 15:47:04.078467 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.41:23113] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUel-AM0m463UZmqdiCUsgAAARQ"]
[Sun Dec 21 15:47:04.796529 2025] [:error] [pid 20675:tid 20706] [client 4.189.104.41:22511] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUel-LyUvZnd3bHSR3aJmgAAAEA"]
[Sun Dec 21 15:47:05.350929 2025] [:error] [pid 20675:tid 20719] [client 4.189.104.41:27210] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUel-byUvZnd3bHSR3aJnQAAAE0"]
[Sun Dec 21 15:47:05.826371 2025] [:error] [pid 20675:tid 20717] [client 4.189.104.41:24737] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUel-byUvZnd3bHSR3aJnwAAAEs"]
[Sun Dec 21 15:47:06.229288 2025] [:error] [pid 20675:tid 20718] [client 4.189.104.41:37994] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUel-ryUvZnd3bHSR3aJoQAAAEw"]
[Sun Dec 21 15:47:06.924500 2025] [:error] [pid 60191:tid 60196] [client 4.189.104.41:16580] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUel-qklhK29C3vVvLVgDwAAAYM"]
[Sun Dec 21 15:47:07.327737 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.41:45991] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUel-6klhK29C3vVvLVgGwAAAZA"]
[Sun Dec 21 15:47:07.839145 2025] [:error] [pid 60191:tid 60194] [client 4.189.104.41:22488] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUel-6klhK29C3vVvLVgIAAAAYE"]
[Sun Dec 21 15:47:08.267819 2025] [:error] [pid 16016:tid 16019] [client 4.189.104.41:38010] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUel_MHQ_KQh3iINaCNJ4QAAAUE"]
[Sun Dec 21 15:47:08.659797 2025] [:error] [pid 12191:tid 12198] [client 4.189.104.41:24704] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUel_AM0m463UZmqdiCUtwAAAQU"]
[Sun Dec 21 15:47:09.015905 2025] [:error] [pid 60191:tid 60193] [client 4.189.104.41:18715] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUel_aklhK29C3vVvLVgIwAAAYA"]
[Sun Dec 21 15:47:09.379277 2025] [:error] [pid 20674:tid 20679] [client 4.189.104.41:22491] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUel_dhSbhHOCK6TAw-hdwAAAAE"]
[Sun Dec 21 15:47:09.804148 2025] [:error] [pid 20760:tid 20767] [client 4.189.104.41:31990] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUel_eXEVvRTAtWo3gk7lwAAAMQ"]
[Sun Dec 21 15:47:10.187929 2025] [:error] [pid 20675:tid 20712] [client 4.189.104.41:37985] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUel_ryUvZnd3bHSR3aJpAAAAEY"]
[Sun Dec 21 15:47:10.503622 2025] [:error] [pid 20676:tid 20735] [client 4.189.104.41:23161] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUel_qpSa967F4pOO5xU8wAAAII"]
[Sun Dec 21 15:47:10.891976 2025] [:error] [pid 20760:tid 20780] [client 4.189.104.41:31963] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUel_uXEVvRTAtWo3gk7mQAAANE"]
[Sun Dec 21 15:47:11.216211 2025] [:error] [pid 60191:tid 60214] [client 4.189.104.41:31973] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aUel_6klhK29C3vVvLVgJAAAAZU"]
[Sun Dec 21 15:47:11.662544 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.41:32004] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aUel_6pSa967F4pOO5xU9AAAAIU"]
[Sun Dec 21 15:47:12.112666 2025] [:error] [pid 20676:tid 20754] [client 4.189.104.41:18040] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Sun Dec 21 15:47:12.491149 2025] [:error] [pid 20676:tid 20754] [client 4.189.104.41:18040] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sun Dec 21 15:47:12.731153 2025] [:error] [pid 20676:tid 20739] [client 4.189.104.41:18040] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Dec 21 15:47:12.899590 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.41:18040] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Dec 21 15:47:13.081475 2025] [:error] [pid 20676:tid 20749] [client 4.189.104.41:18040] [client 4.189.104.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.104.41, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUemAapSa967F4pOO5xU-QAAAJA"]
[Sun Dec 21 15:47:13.085418 2025] [:error] [pid 20676:tid 20749] [client 4.189.104.41:18040] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Dec 21 15:47:13.245186 2025] [:error] [pid 20676:tid 20743] [client 4.189.104.41:18040] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Dec 21 15:47:13.423509 2025] [:error] [pid 20676:tid 20748] [client 4.189.104.41:18040] File does not exist: /usr/local/apache/htdocs/suspended-page/xse25.php
[Sun Dec 21 15:47:13.747509 2025] [:error] [pid 20676:tid 20740] [client 4.189.104.41:18040] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aUemAapSa967F4pOO5xU_QAAAIc"]
[Sun Dec 21 15:47:14.161395 2025] [:error] [pid 12191:tid 12200] [client 4.189.104.41:24718] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Sun Dec 21 15:47:14.364474 2025] [:error] [pid 12191:tid 12208] [client 4.189.104.41:24718] File does not exist: /usr/local/apache/htdocs/suspended-page/shoyo.php
[Sun Dec 21 15:47:14.525104 2025] [:error] [pid 12191:tid 12211] [client 4.189.104.41:24718] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Dec 21 15:47:14.686239 2025] [:error] [pid 12191:tid 12204] [client 4.189.104.41:24718] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aUemAgM0m463UZmqdiCUwgAAAQs"]
[Sun Dec 21 15:47:15.090128 2025] [:error] [pid 12191:tid 12198] [client 4.189.104.41:54685] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aUemAwM0m463UZmqdiCUwwAAAQU"]
[Sun Dec 21 15:47:15.507779 2025] [:error] [pid 16016:tid 16020] [client 4.189.104.41:4691] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aUemA8HQ_KQh3iINaCNJ6gAAAUI"]
[Sun Dec 21 15:47:15.913163 2025] [:error] [pid 20675:tid 20714] [client 4.189.104.41:23166] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aUemA7yUvZnd3bHSR3aJqQAAAEg"]
[Sun Dec 21 15:47:16.320859 2025] [:error] [pid 20674:tid 20688] [client 4.189.104.41:27673] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aUemBNhSbhHOCK6TAw-hggAAAAo"]
[Sun Dec 21 15:47:16.824624 2025] [:error] [pid 16016:tid 16038] [client 4.189.104.41:42888] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aUemBMHQ_KQh3iINaCNJ7AAAAVQ"]
[Sun Dec 21 15:47:17.295771 2025] [:error] [pid 16016:tid 16042] [client 4.189.104.41:40053] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aUemBcHQ_KQh3iINaCNJ7QAAAVg"]
[Sun Dec 21 15:47:17.689983 2025] [:error] [pid 20676:tid 20734] [client 4.189.104.41:17991] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aUemBapSa967F4pOO5xVAgAAAIE"]
[Sun Dec 21 15:47:18.073634 2025] [:error] [pid 20676:tid 20746] [client 4.189.104.41:27675] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aUemBqpSa967F4pOO5xVAwAAAI0"]
[Sun Dec 21 15:47:18.511819 2025] [:error] [pid 16016:tid 16027] [client 4.189.104.41:42911] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aUemBsHQ_KQh3iINaCNJ8AAAAUk"]
[Sun Dec 21 15:47:18.863163 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.41:42889] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aUemBsHQ_KQh3iINaCNJ8QAAAUM"]
[Sun Dec 21 15:47:19.178858 2025] [:error] [pid 12191:tid 12207] [client 4.189.104.41:33882] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aUemBwM0m463UZmqdiCUxAAAAQ4"]
[Sun Dec 21 15:47:19.494920 2025] [:error] [pid 20674:tid 20695] [client 4.189.104.41:33896] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aUemB9hSbhHOCK6TAw-hhgAAABE"]
[Sun Dec 21 15:47:19.808416 2025] [:error] [pid 20674:tid 20693] [client 4.189.104.41:56236] [client 4.189.104.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/index.php"] [unique_id "aUemB9hSbhHOCK6TAw-hhwAAAA8"]
[Sun Dec 21 15:47:20.192803 2025] [:error] [pid 12191:tid 12199] [client 4.189.104.41:27707] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aUemCAM0m463UZmqdiCUxgAAAQY"]
[Sun Dec 21 15:47:20.561166 2025] [:error] [pid 60191:tid 60213] [client 4.189.104.41:27670] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aUemCKklhK29C3vVvLVgLAAAAZQ"]
[Sun Dec 21 15:47:20.905029 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:40117] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aUemCKklhK29C3vVvLVgLQAAAZY"]
[Sun Dec 21 15:47:21.289847 2025] [:error] [pid 20676:tid 20738] [client 4.189.104.41:56192] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aUemCapSa967F4pOO5xVBgAAAIU"]
[Sun Dec 21 15:47:21.636848 2025] [:error] [pid 60191:tid 60206] [client 4.189.104.41:40046] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aUemCaklhK29C3vVvLVgMQAAAY0"]
[Sun Dec 21 15:47:22.058916 2025] [:error] [pid 20674:tid 20702] [client 4.189.104.41:4683] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aUemCthSbhHOCK6TAw-hjQAAABg"]
[Sun Dec 21 15:47:22.580611 2025] [:error] [pid 20675:tid 20723] [client 4.189.104.41:17450] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aUemCryUvZnd3bHSR3aJrAAAAFE"]
[Sun Dec 21 15:47:22.971037 2025] [:error] [pid 20676:tid 20747] [client 4.189.104.41:26431] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aUemCqpSa967F4pOO5xVCAAAAI4"]
[Sun Dec 21 15:47:23.458295 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.41:56251] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah24.php"] [unique_id "aUemC6klhK29C3vVvLVgNQAAAYg"]
[Sun Dec 21 15:47:23.816612 2025] [:error] [pid 20760:tid 20769] [client 4.189.104.41:40029] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah24.php"] [unique_id "aUemC-XEVvRTAtWo3gk7owAAAMY"]
[Sun Dec 21 15:47:24.186267 2025] [:error] [pid 20674:tid 20691] [client 4.189.104.41:19978] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah24.php"] [unique_id "aUemDNhSbhHOCK6TAw-hjwAAAA0"]
[Sun Dec 21 15:47:24.503455 2025] [:error] [pid 12191:tid 12198] [client 4.189.104.41:54656] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah24.php"] [unique_id "aUemDAM0m463UZmqdiCUzAAAAQU"]
[Sun Dec 21 15:47:24.868345 2025] [:error] [pid 16016:tid 16034] [client 4.189.104.41:33244] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aUemDMHQ_KQh3iINaCNJ-AAAAVA"]
[Sun Dec 21 15:47:25.195047 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:26379] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aUemDaklhK29C3vVvLVgNgAAAZY"]
[Sun Dec 21 15:47:25.567215 2025] [:error] [pid 60191:tid 60209] [client 4.189.104.41:54687] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aUemDaklhK29C3vVvLVgOAAAAZA"]
[Sun Dec 21 15:47:25.881492 2025] [:error] [pid 60191:tid 60216] [client 4.189.104.41:17461] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aUemDaklhK29C3vVvLVgOQAAAZc"]
[Sun Dec 21 15:47:26.227884 2025] [:error] [pid 20674:tid 20692] [client 4.189.104.41:33251] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aUemDthSbhHOCK6TAw-hkQAAAA4"]
[Sun Dec 21 15:47:26.526412 2025] [:error] [pid 20674:tid 20699] [client 4.189.104.41:18504] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aUemDthSbhHOCK6TAw-hlAAAABU"]
[Sun Dec 21 15:47:26.823672 2025] [:error] [pid 20675:tid 20730] [client 4.189.104.41:17454] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aUemDryUvZnd3bHSR3aJrgAAAFg"]
[Sun Dec 21 15:47:27.156619 2025] [:error] [pid 60191:tid 60214] [client 4.189.104.41:21277] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aUemD6klhK29C3vVvLVgOwAAAZU"]
[Sun Dec 21 15:47:27.553145 2025] [:error] [pid 20674:tid 20690] [client 4.189.104.41:40121] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aUemD9hSbhHOCK6TAw-hmAAAAAw"]
[Sun Dec 21 15:47:27.948023 2025] [:error] [pid 20760:tid 20786] [client 4.189.104.41:18548] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aUemD-XEVvRTAtWo3gk7pwAAANc"]
[Sun Dec 21 15:47:28.237557 2025] [:error] [pid 16016:tid 16021] [client 4.189.104.41:21282] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aUemEMHQ_KQh3iINaCNJ-wAAAUM"]
[Sun Dec 21 15:47:28.577224 2025] [:error] [pid 16016:tid 16040] [client 4.189.104.41:55308] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aUemEMHQ_KQh3iINaCNJ_AAAAVY"]
[Sun Dec 21 15:47:28.926065 2025] [:error] [pid 60191:tid 60201] [client 4.189.104.41:20522] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aUemEKklhK29C3vVvLVgQAAAAYg"]
[Sun Dec 21 15:47:29.312023 2025] [:error] [pid 60191:tid 60205] [client 4.189.104.41:46002] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aUemEaklhK29C3vVvLVgQQAAAYw"]
[Sun Dec 21 15:47:29.651749 2025] [:error] [pid 60191:tid 60217] [client 4.189.104.41:26420] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aUemEaklhK29C3vVvLVgQgAAAZg"]
[Sun Dec 21 15:47:30.058154 2025] [:error] [pid 16016:tid 16028] [client 4.189.104.41:20023] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aUemEsHQ_KQh3iINaCNJ_gAAAUo"]
[Sun Dec 21 15:47:30.398748 2025] [:error] [pid 20760:tid 20771] [client 4.189.104.41:21331] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aUemEuXEVvRTAtWo3gk7qwAAAMg"]
[Sun Dec 21 15:47:30.908098 2025] [:error] [pid 12191:tid 12213] [client 4.189.104.41:21299] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aUemEgM0m463UZmqdiCU0gAAARQ"]
[Sun Dec 21 15:47:31.290408 2025] [:error] [pid 60191:tid 60204] [client 4.189.104.41:33231] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aUemE6klhK29C3vVvLVgRgAAAYs"]
[Sun Dec 21 15:47:31.705203 2025] [:error] [pid 60191:tid 60215] [client 4.189.104.41:20010] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aUemE6klhK29C3vVvLVgRwAAAZY"]
[Sun Dec 21 15:47:32.102961 2025] [:error] [pid 16016:tid 16038] [client 4.189.104.41:33236] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aUemFMHQ_KQh3iINaCNKAAAAAVQ"]
[Sun Dec 21 15:47:32.594977 2025] [:error] [pid 20676:tid 20744] [client 4.189.104.41:26426] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aUemFKpSa967F4pOO5xVDQAAAIs"]
[Sun Dec 21 15:47:32.962059 2025] [:error] [pid 20676:tid 20752] [client 4.189.104.41:50508] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aUemFKpSa967F4pOO5xVDgAAAJM"]
[Sun Dec 21 15:47:33.392273 2025] [:error] [pid 20674:tid 20702] [client 4.189.104.41:53876] [client 4.189.104.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aUemFdhSbhHOCK6TAw-hnQAAABg"]
[Sun Dec 21 18:43:23.067289 2025] [:error] [pid 59070:tid 59150] [client 43.132.214.228:45930] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUfPS33dhXne9KX1kgLnbwAAAJY"]
[Sun Dec 21 22:43:47.691039 2025] [:error] [pid 30183:tid 30207] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sun Dec 21 22:43:47.843744 2025] [:error] [pid 30183:tid 30209] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Dec 21 22:43:48.176785 2025] [:error] [pid 30183:tid 30190] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sun Dec 21 22:43:48.316339 2025] [:error] [pid 30183:tid 30193] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Dec 21 22:43:48.454616 2025] [:error] [pid 30183:tid 30196] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Dec 21 22:43:48.592395 2025] [:error] [pid 30183:tid 30202] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sun Dec 21 22:43:48.730312 2025] [:error] [pid 30183:tid 30191] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sun Dec 21 22:43:49.163537 2025] [:error] [pid 30183:tid 30194] [client 4.230.41.166:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Dec 21 22:43:49.324588 2025] [:error] [pid 30183:tid 30189] [client 4.230.41.166:4086] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUgHpeCmP2zCzk_WZcUxswAAAQQ"]
[Sun Dec 21 22:43:49.767267 2025] [:error] [pid 65237:tid 65262] [client 4.230.41.166:4071] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUgHpVVJYjxIpnUJfgJixAAAAZc"]
[Sun Dec 21 22:43:50.192104 2025] [:error] [pid 65237:tid 65250] [client 4.230.41.166:4070] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUgHplVJYjxIpnUJfgJixgAAAYs"]
[Sun Dec 21 22:43:50.577649 2025] [:error] [pid 30183:tid 30204] [client 4.230.41.166:4088] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aUgHpuCmP2zCzk_WZcUxtQAAARM"]
[Sun Dec 21 22:43:51.082492 2025] [:error] [pid 59158:tid 59177] [client 4.230.41.166:3987] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUgHp47NvyNF8ab5VgVpnQAAANE"]
[Sun Dec 21 22:43:51.422613 2025] [:error] [pid 42755:tid 42758] [client 4.230.41.166:3979] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUgHp-W0XvxgXMTJJbv6BwAAAUE"]
[Sun Dec 21 22:43:51.977037 2025] [:error] [pid 65237:tid 65239] [client 4.230.41.166:3982] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUgHp1VJYjxIpnUJfgJiyQAAAYA"]
[Sun Dec 21 22:43:52.330274 2025] [:error] [pid 59158:tid 59175] [client 4.230.41.166:3988] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aUgHqI7NvyNF8ab5VgVpngAAAM8"]
[Sun Dec 21 22:43:52.753492 2025] [:error] [pid 30183:tid 30188] [client 4.230.41.166:3974] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aUgHqOCmP2zCzk_WZcUxuwAAAQM"]
[Sun Dec 21 22:43:53.135180 2025] [:error] [pid 59068:tid 59103] [client 4.230.41.166:4053] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aUgHqRmLyLqWUlrjwyeyEgAAAEI"]
[Sun Dec 21 22:43:53.584453 2025] [:error] [pid 59068:tid 59125] [client 4.230.41.166:3968] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aUgHqRmLyLqWUlrjwyeyFAAAAFg"]
[Sun Dec 21 22:43:53.936145 2025] [:error] [pid 59067:tid 59083] [client 4.230.41.166:4066] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aUgHqctpsOP1NfIK_qKHBwAAAAk"]
[Sun Dec 21 22:43:54.587161 2025] [:error] [pid 59068:tid 59102] [client 4.230.41.166:3999] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUgHqhmLyLqWUlrjwyeyIQAAAEE"]
[Sun Dec 21 22:43:54.984168 2025] [:error] [pid 59068:tid 59109] [client 4.230.41.166:3986] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUgHqhmLyLqWUlrjwyeyIwAAAEg"]
[Sun Dec 21 22:43:55.287053 2025] [:error] [pid 30183:tid 30196] [client 4.230.41.166:3978] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUgHq-CmP2zCzk_WZcUxvwAAAQs"]
[Sun Dec 21 22:43:55.778431 2025] [:error] [pid 30183:tid 30205] [client 4.230.41.166:3980] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aUgHq-CmP2zCzk_WZcUxwgAAARQ"]
[Sun Dec 21 22:43:56.174299 2025] [:error] [pid 59067:tid 59090] [client 4.230.41.166:4050] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aUgHrMtpsOP1NfIK_qKHCgAAABA"]
[Sun Dec 21 22:43:56.601187 2025] [:error] [pid 59158:tid 59184] [client 4.230.41.166:4030] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aUgHrI7NvyNF8ab5VgVpogAAANg"]
[Sun Dec 21 22:43:57.029222 2025] [:error] [pid 65237:tid 65249] [client 4.230.41.166:4087] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aUgHrVVJYjxIpnUJfgJiywAAAYo"]
[Sun Dec 21 22:43:57.534218 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:3972] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aUgHrRmLyLqWUlrjwyeyJQAAAEM"]
[Sun Dec 21 22:43:58.255988 2025] [:error] [pid 65237:tid 65251] [client 4.230.41.166:4064] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aUgHrlVJYjxIpnUJfgJizQAAAYw"]
[Sun Dec 21 22:43:58.607466 2025] [:error] [pid 30183:tid 30196] [client 4.230.41.166:4046] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aUgHruCmP2zCzk_WZcUxxgAAAQs"]
[Sun Dec 21 22:43:59.005924 2025] [:error] [pid 42755:tid 42766] [client 4.230.41.166:4057] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aUgHr-W0XvxgXMTJJbv6DwAAAUk"]
[Sun Dec 21 22:43:59.386493 2025] [:error] [pid 42755:tid 42758] [client 4.230.41.166:4059] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aUgHr-W0XvxgXMTJJbv6EAAAAUE"]
[Sun Dec 21 22:43:59.733960 2025] [:error] [pid 59070:tid 59130] [client 4.230.41.166:4025] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUgHr33dhXne9KX1kgJypQAAAII"]
[Sun Dec 21 22:44:00.182344 2025] [:error] [pid 59067:tid 59080] [client 4.230.41.166:4056] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUgHsMtpsOP1NfIK_qKHEQAAAAY"]
[Sun Dec 21 22:44:00.594645 2025] [:error] [pid 59158:tid 59177] [client 4.230.41.166:3973] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUgHsI7NvyNF8ab5VgVpqgAAANE"]
[Sun Dec 21 22:44:01.148301 2025] [:error] [pid 59070:tid 59148] [client 4.230.41.166:4060] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aUgHsX3dhXne9KX1kgJypgAAAJQ"]
[Sun Dec 21 22:44:01.542427 2025] [:error] [pid 42755:tid 42761] [client 4.230.41.166:4002] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUgHseW0XvxgXMTJJbv6EwAAAUQ"]
[Sun Dec 21 22:44:01.980245 2025] [:error] [pid 59068:tid 59103] [client 4.230.41.166:3909] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUgHsRmLyLqWUlrjwyeyLAAAAEI"]
[Sun Dec 21 22:44:02.369239 2025] [:error] [pid 65237:tid 65260] [client 4.230.41.166:4015] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUgHslVJYjxIpnUJfgJi0gAAAZU"]
[Sun Dec 21 22:44:02.782305 2025] [:error] [pid 42755:tid 42764] [client 4.230.41.166:4007] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUgHsuW0XvxgXMTJJbv6FgAAAUc"]
[Sun Dec 21 22:44:03.204870 2025] [:error] [pid 59070:tid 59129] [client 4.230.41.166:4067] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUgHs33dhXne9KX1kgJyqgAAAIE"]
[Sun Dec 21 22:44:03.576073 2025] [:error] [pid 59070:tid 59141] [client 4.230.41.166:3991] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUgHs33dhXne9KX1kgJyrAAAAI0"]
[Sun Dec 21 22:44:03.930067 2025] [:error] [pid 59067:tid 59090] [client 4.230.41.166:4075] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUgHs8tpsOP1NfIK_qKHFQAAABA"]
[Sun Dec 21 22:44:04.355719 2025] [:error] [pid 42755:tid 42759] [client 4.230.41.166:3937] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aUgHtOW0XvxgXMTJJbv6GAAAAUI"]
[Sun Dec 21 22:44:04.784371 2025] [:error] [pid 42755:tid 42779] [client 4.230.41.166:3976] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUgHtOW0XvxgXMTJJbv6GgAAAVY"]
[Sun Dec 21 22:44:05.148185 2025] [:error] [pid 59068:tid 59124] [client 4.230.41.166:4094] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUgHtRmLyLqWUlrjwyeyLgAAAFc"]
[Sun Dec 21 22:44:05.615614 2025] [:error] [pid 59067:tid 59078] [client 4.230.41.166:3966] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUgHtctpsOP1NfIK_qKHFgAAAAQ"]
[Sun Dec 21 22:44:06.008018 2025] [:error] [pid 42755:tid 42777] [client 4.230.41.166:4083] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aUgHtuW0XvxgXMTJJbv6HAAAAVQ"]
[Sun Dec 21 22:44:06.352798 2025] [:error] [pid 59070:tid 59148] [client 4.230.41.166:4033] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUgHtn3dhXne9KX1kgJytAAAAJQ"]
[Sun Dec 21 22:44:06.799449 2025] [:error] [pid 42755:tid 42763] [client 4.230.41.166:3985] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUgHtuW0XvxgXMTJJbv6HQAAAUY"]
[Sun Dec 21 22:44:07.172488 2025] [:error] [pid 59070:tid 59135] [client 4.230.41.166:4049] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUgHt33dhXne9KX1kgJytgAAAIc"]
[Sun Dec 21 22:44:07.592373 2025] [:error] [pid 59068:tid 59102] [client 4.230.41.166:4051] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aUgHtxmLyLqWUlrjwyeyNgAAAEE"]
[Sun Dec 21 22:44:07.903277 2025] [:error] [pid 59158:tid 59172] [client 4.230.41.166:3924] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aUgHt47NvyNF8ab5VgVpsgAAAMw"]
[Sun Dec 21 22:44:08.215076 2025] [:error] [pid 59158:tid 59181] [client 4.230.41.166:4034] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aUgHuI7NvyNF8ab5VgVpswAAANU"]
[Sun Dec 21 22:44:08.599996 2025] [:error] [pid 59068:tid 59123] [client 4.230.41.166:4036] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aUgHuBmLyLqWUlrjwyeyNwAAAFY"]
[Sun Dec 21 22:44:08.956683 2025] [:error] [pid 30183:tid 30192] [client 4.230.41.166:4027] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aUgHuOCmP2zCzk_WZcUxygAAAQc"]
[Sun Dec 21 22:44:09.585671 2025] [:error] [pid 59158:tid 59184] [client 4.230.41.166:3933] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aUgHuY7NvyNF8ab5VgVptgAAANg"]
[Sun Dec 21 22:44:09.970831 2025] [:error] [pid 65237:tid 65258] [client 4.230.41.166:4091] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aUgHuVVJYjxIpnUJfgJi3wAAAZM"]
[Sun Dec 21 22:44:10.423527 2025] [:error] [pid 59158:tid 59183] [client 4.230.41.166:3929] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aUgHuo7NvyNF8ab5VgVpuAAAANc"]
[Sun Dec 21 22:44:10.759183 2025] [:error] [pid 59158:tid 59162] [client 4.230.41.166:4038] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aUgHuo7NvyNF8ab5VgVpuwAAAMI"]
[Sun Dec 21 22:44:11.242822 2025] [:error] [pid 59158:tid 59160] [client 4.230.41.166:4079] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aUgHu47NvyNF8ab5VgVpvAAAAMA"]
[Sun Dec 21 22:44:11.599730 2025] [:error] [pid 42755:tid 42757] [client 4.230.41.166:4093] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aUgHu-W0XvxgXMTJJbv6IAAAAUA"]
[Sun Dec 21 22:44:11.976202 2025] [:error] [pid 59068:tid 59114] [client 4.230.41.166:3911] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aUgHuxmLyLqWUlrjwyeyPAAAAE0"]
[Sun Dec 21 22:44:12.409626 2025] [:error] [pid 59158:tid 59176] [client 4.230.41.166:4039] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aUgHvI7NvyNF8ab5VgVpwgAAANA"]
[Sun Dec 21 22:44:12.759732 2025] [:error] [pid 65237:tid 65249] [client 4.230.41.166:4043] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgHvFVJYjxIpnUJfgJi5QAAAYo"]
[Sun Dec 21 22:44:13.306102 2025] [:error] [pid 65237:tid 65242] [client 4.230.41.166:4006] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgHvVVJYjxIpnUJfgJi5gAAAYM"]
[Sun Dec 21 22:44:13.795186 2025] [:error] [pid 59068:tid 59120] [client 4.230.41.166:4074] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgHvRmLyLqWUlrjwyeyPQAAAFM"]
[Sun Dec 21 22:44:14.321371 2025] [:error] [pid 42755:tid 42759] [client 4.230.41.166:4040] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgHvuW0XvxgXMTJJbv6IgAAAUI"]
[Sun Dec 21 22:44:14.746142 2025] [:error] [pid 59070:tid 59152] [client 4.230.41.166:4092] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUgHvn3dhXne9KX1kgJywgAAAJg"]
[Sun Dec 21 22:44:15.128756 2025] [:error] [pid 30183:tid 30204] [client 4.230.41.166:4042] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUgHv-CmP2zCzk_WZcUx0wAAARM"]
[Sun Dec 21 22:44:15.574775 2025] [:error] [pid 42755:tid 42770] [client 4.230.41.166:4061] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUgHv-W0XvxgXMTJJbv6JAAAAU0"]
[Sun Dec 21 22:44:16.004799 2025] [:error] [pid 59067:tid 59077] [client 4.230.41.166:4085] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aUgHwMtpsOP1NfIK_qKHGgAAAAM"]
[Sun Dec 21 22:44:16.450499 2025] [:error] [pid 59158:tid 59163] [client 4.230.41.166:4023] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aUgHwI7NvyNF8ab5VgVpywAAAMM"]
[Sun Dec 21 22:44:16.825631 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:4048] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aUgHwBmLyLqWUlrjwyeyQwAAAEM"]
[Sun Dec 21 22:44:17.204708 2025] [:error] [pid 42755:tid 42778] [client 4.230.41.166:4000] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aUgHweW0XvxgXMTJJbv6JwAAAVU"]
[Sun Dec 21 22:44:17.596658 2025] [:error] [pid 59158:tid 59179] [client 4.230.41.166:4089] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aUgHwY7NvyNF8ab5VgVpzQAAANM"]
[Sun Dec 21 22:44:17.984977 2025] [:error] [pid 59067:tid 59081] [client 4.230.41.166:3906] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUgHwctpsOP1NfIK_qKHHAAAAAc"]
[Sun Dec 21 22:44:18.329624 2025] [:error] [pid 30183:tid 30195] [client 4.230.41.166:3977] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUgHwuCmP2zCzk_WZcUx2gAAAQo"]
[Sun Dec 21 22:44:18.953893 2025] [:error] [pid 59070:tid 59145] [client 4.230.41.166:4041] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUgHwn3dhXne9KX1kgJyxgAAAJE"]
[Sun Dec 21 22:44:19.628620 2025] [:error] [pid 42755:tid 42763] [client 4.230.41.166:4044] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aUgHw-W0XvxgXMTJJbv6KAAAAUY"]
[Sun Dec 21 22:44:19.967004 2025] [:error] [pid 65237:tid 65241] [client 4.230.41.166:4081] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUgHw1VJYjxIpnUJfgJi7QAAAYI"]
[Sun Dec 21 22:44:20.281710 2025] [:error] [pid 59070:tid 59129] [client 4.230.41.166:4058] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUgHxH3dhXne9KX1kgJyyQAAAIE"]
[Sun Dec 21 22:44:20.589699 2025] [:error] [pid 59158:tid 59174] [client 4.230.41.166:4084] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUgHxI7NvyNF8ab5VgVp0wAAAM4"]
[Sun Dec 21 22:44:21.107363 2025] [:error] [pid 59158:tid 59178] [client 4.230.41.166:3932] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUgHxY7NvyNF8ab5VgVp1wAAANI"]
[Sun Dec 21 22:44:21.405136 2025] [:error] [pid 59068:tid 59103] [client 4.230.41.166:4037] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aUgHxRmLyLqWUlrjwyeyRgAAAEI"]
[Sun Dec 21 22:44:21.773217 2025] [:error] [pid 59158:tid 59176] [client 4.230.41.166:3908] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aUgHxY7NvyNF8ab5VgVp2gAAANA"]
[Sun Dec 21 22:44:22.215145 2025] [:error] [pid 59067:tid 59079] [client 4.230.41.166:3930] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aUgHxstpsOP1NfIK_qKHIAAAAAU"]
[Sun Dec 21 22:44:22.507039 2025] [:error] [pid 59070:tid 59152] [client 4.230.41.166:4018] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aUgHxn3dhXne9KX1kgJyzQAAAJg"]
[Sun Dec 21 22:44:22.876691 2025] [:error] [pid 59070:tid 59140] [client 4.230.41.166:4045] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aUgHxn3dhXne9KX1kgJy0AAAAIw"]
[Sun Dec 21 22:44:23.223978 2025] [:error] [pid 59158:tid 59166] [client 4.230.41.166:3989] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aUgHx47NvyNF8ab5VgVp3QAAAMY"]
[Sun Dec 21 22:44:23.726774 2025] [:error] [pid 42755:tid 42781] [client 4.230.41.166:3913] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aUgHx-W0XvxgXMTJJbv6LQAAAVg"]
[Sun Dec 21 22:44:24.210951 2025] [:error] [pid 30183:tid 30197] [client 4.230.41.166:4010] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aUgHyOCmP2zCzk_WZcUx4AAAAQw"]
[Sun Dec 21 22:44:24.918819 2025] [:error] [pid 59067:tid 59093] [client 4.230.41.166:4012] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aUgHyMtpsOP1NfIK_qKHIwAAABM"]
[Sun Dec 21 22:44:25.304775 2025] [:error] [pid 42755:tid 42778] [client 4.230.41.166:3995] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aUgHyeW0XvxgXMTJJbv6NQAAAVU"]
[Sun Dec 21 22:44:25.872394 2025] [:error] [pid 42755:tid 42760] [client 4.230.41.166:4014] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aUgHyeW0XvxgXMTJJbv6OQAAAUM"]
[Sun Dec 21 22:44:26.269915 2025] [:error] [pid 59158:tid 59182] [client 4.230.41.166:3859] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aUgHyo7NvyNF8ab5VgVp4QAAANY"]
[Sun Dec 21 22:44:26.796789 2025] [:error] [pid 59158:tid 59177] [client 4.230.41.166:4065] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUgHyo7NvyNF8ab5VgVp4wAAANE"]
[Sun Dec 21 22:44:27.223389 2025] [:error] [pid 59070:tid 59135] [client 4.230.41.166:3910] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUgHy33dhXne9KX1kgJy1AAAAIc"]
[Sun Dec 21 22:44:27.616534 2025] [:error] [pid 59067:tid 59085] [client 4.230.41.166:3969] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUgHy8tpsOP1NfIK_qKHKQAAAAs"]
[Sun Dec 21 22:44:27.925276 2025] [:error] [pid 30183:tid 30203] [client 4.230.41.166:3981] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aUgHy-CmP2zCzk_WZcUx4wAAARI"]
[Sun Dec 21 22:44:28.290011 2025] [:error] [pid 30183:tid 30196] [client 4.230.41.166:3904] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgHzOCmP2zCzk_WZcUx5QAAAQs"]
[Sun Dec 21 22:44:28.732496 2025] [:error] [pid 65237:tid 65251] [client 4.230.41.166:4019] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgHzFVJYjxIpnUJfgJi8AAAAYw"]
[Sun Dec 21 22:44:29.061226 2025] [:error] [pid 65237:tid 65253] [client 4.230.41.166:4052] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgHzVVJYjxIpnUJfgJi8QAAAY4"]
[Sun Dec 21 22:44:29.429715 2025] [:error] [pid 59070:tid 59143] [client 4.230.41.166:3885] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgHzX3dhXne9KX1kgJy1gAAAI8"]
[Sun Dec 21 22:44:29.794835 2025] [:error] [pid 42755:tid 42764] [client 4.230.41.166:3970] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUgHzeW0XvxgXMTJJbv6PwAAAUc"]
[Sun Dec 21 22:44:30.114914 2025] [:error] [pid 42755:tid 42771] [client 4.230.41.166:3993] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUgHzuW0XvxgXMTJJbv6QAAAAU4"]
[Sun Dec 21 22:44:30.531461 2025] [:error] [pid 59067:tid 59087] [client 4.230.41.166:4080] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUgHzstpsOP1NfIK_qKHLAAAAA0"]
[Sun Dec 21 22:44:30.838069 2025] [:error] [pid 42755:tid 42772] [client 4.230.41.166:3946] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUgHzuW0XvxgXMTJJbv6QQAAAU8"]
[Sun Dec 21 22:44:31.151209 2025] [:error] [pid 59067:tid 59094] [client 4.230.41.166:3941] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUgHz8tpsOP1NfIK_qKHLgAAABQ"]
[Sun Dec 21 22:44:31.545329 2025] [:error] [pid 42755:tid 42773] [client 4.230.41.166:4082] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUgHz-W0XvxgXMTJJbv6RAAAAVA"]
[Sun Dec 21 22:44:31.891836 2025] [:error] [pid 59068:tid 59115] [client 4.230.41.166:4054] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUgHzxmLyLqWUlrjwyeyTAAAAE4"]
[Sun Dec 21 22:44:32.221591 2025] [:error] [pid 42755:tid 42776] [client 4.230.41.166:4009] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aUgH0OW0XvxgXMTJJbv6SAAAAVM"]
[Sun Dec 21 22:44:32.579971 2025] [:error] [pid 30183:tid 30199] [client 4.230.41.166:3994] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUgH0OCmP2zCzk_WZcUx6gAAAQ4"]
[Sun Dec 21 22:44:32.924931 2025] [:error] [pid 59067:tid 59091] [client 4.230.41.166:3919] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUgH0MtpsOP1NfIK_qKHMAAAABE"]
[Sun Dec 21 22:44:33.254365 2025] [:error] [pid 59067:tid 59092] [client 4.230.41.166:3912] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUgH0ctpsOP1NfIK_qKHMgAAABI"]
[Sun Dec 21 22:44:33.540768 2025] [:error] [pid 59068:tid 59102] [client 4.230.41.166:4024] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aUgH0RmLyLqWUlrjwyeyTgAAAEE"]
[Sun Dec 21 22:44:33.869118 2025] [:error] [pid 59067:tid 59088] [client 4.230.41.166:4032] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH0ctpsOP1NfIK_qKHNQAAAA4"]
[Sun Dec 21 22:44:34.220343 2025] [:error] [pid 59067:tid 59089] [client 4.230.41.166:4031] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH0stpsOP1NfIK_qKHNwAAAA8"]
[Sun Dec 21 22:44:34.543380 2025] [:error] [pid 59158:tid 59183] [client 4.230.41.166:3923] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH0o7NvyNF8ab5VgVp7AAAANc"]
[Sun Dec 21 22:44:35.069111 2025] [:error] [pid 59070:tid 59143] [client 4.230.41.166:3951] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH033dhXne9KX1kgJy3gAAAI8"]
[Sun Dec 21 22:44:35.504425 2025] [:error] [pid 59158:tid 59172] [client 4.230.41.166:3998] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUgH047NvyNF8ab5VgVp7wAAAMw"]
[Sun Dec 21 22:44:35.849614 2025] [:error] [pid 59067:tid 59084] [client 4.230.41.166:3914] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUgH08tpsOP1NfIK_qKHOAAAAAo"]
[Sun Dec 21 22:44:36.156892 2025] [:error] [pid 59070:tid 59140] [client 4.230.41.166:4063] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUgH1H3dhXne9KX1kgJy4QAAAIw"]
[Sun Dec 21 22:44:36.494328 2025] [:error] [pid 59068:tid 59103] [client 4.230.41.166:3879] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUgH1BmLyLqWUlrjwyeyUAAAAEI"]
[Sun Dec 21 22:44:36.881305 2025] [:error] [pid 59067:tid 59079] [client 4.230.41.166:3916] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUgH1MtpsOP1NfIK_qKHOQAAAAU"]
[Sun Dec 21 22:44:37.254818 2025] [:error] [pid 59067:tid 59096] [client 4.230.41.166:3861] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUgH1ctpsOP1NfIK_qKHOwAAABY"]
[Sun Dec 21 22:44:37.670845 2025] [:error] [pid 59158:tid 59162] [client 4.230.41.166:4072] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUgH1Y7NvyNF8ab5VgVp9AAAAMI"]
[Sun Dec 21 22:44:37.979775 2025] [:error] [pid 59158:tid 59180] [client 4.230.41.166:3926] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aUgH1Y7NvyNF8ab5VgVp9gAAANQ"]
[Sun Dec 21 22:44:38.384271 2025] [:error] [pid 59067:tid 59091] [client 4.230.41.166:4095] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgH1stpsOP1NfIK_qKHPAAAABE"]
[Sun Dec 21 22:44:38.706370 2025] [:error] [pid 59070:tid 59148] [client 4.230.41.166:4073] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgH1n3dhXne9KX1kgJy5QAAAJQ"]
[Sun Dec 21 22:44:39.038379 2025] [:error] [pid 30183:tid 30186] [client 4.230.41.166:3842] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgH1-CmP2zCzk_WZcUx7gAAAQE"]
[Sun Dec 21 22:44:39.370327 2025] [:error] [pid 30183:tid 30195] [client 4.230.41.166:4047] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aUgH1-CmP2zCzk_WZcUx7wAAAQo"]
[Sun Dec 21 22:44:39.726320 2025] [:error] [pid 30183:tid 30192] [client 4.230.41.166:3975] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUgH1-CmP2zCzk_WZcUx8gAAAQc"]
[Sun Dec 21 22:44:40.036523 2025] [:error] [pid 30183:tid 30190] [client 4.230.41.166:3905] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUgH2OCmP2zCzk_WZcUx9gAAAQU"]
[Sun Dec 21 22:44:40.386704 2025] [:error] [pid 59067:tid 59074] [client 4.230.41.166:3852] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUgH2MtpsOP1NfIK_qKHQQAAAAA"]
[Sun Dec 21 22:44:40.696664 2025] [:error] [pid 42755:tid 42781] [client 4.230.41.166:3884] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aUgH2OW0XvxgXMTJJbv6SwAAAVg"]
[Sun Dec 21 22:44:41.058172 2025] [:error] [pid 42755:tid 42780] [client 4.230.41.166:4028] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUgH2eW0XvxgXMTJJbv6TgAAAVc"]
[Sun Dec 21 22:44:41.384861 2025] [:error] [pid 42755:tid 42771] [client 4.230.41.166:4035] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUgH2eW0XvxgXMTJJbv6UQAAAU4"]
[Sun Dec 21 22:44:41.809276 2025] [:error] [pid 59067:tid 59077] [client 4.230.41.166:3949] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUgH2ctpsOP1NfIK_qKHQwAAAAM"]
[Sun Dec 21 22:44:42.235125 2025] [:error] [pid 59070:tid 59143] [client 4.230.41.166:3847] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aUgH2n3dhXne9KX1kgJy6QAAAI8"]
[Sun Dec 21 22:44:42.568411 2025] [:error] [pid 59067:tid 59085] [client 4.230.41.166:4029] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUgH2stpsOP1NfIK_qKHRAAAAAs"]
[Sun Dec 21 22:44:43.015038 2025] [:error] [pid 42755:tid 42772] [client 4.230.41.166:4076] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUgH2-W0XvxgXMTJJbv6VAAAAU8"]
[Sun Dec 21 22:44:43.489237 2025] [:error] [pid 59070:tid 59147] [client 4.230.41.166:4001] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUgH233dhXne9KX1kgJy7QAAAJM"]
[Sun Dec 21 22:44:43.886523 2025] [:error] [pid 65237:tid 65253] [client 4.230.41.166:3917] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aUgH21VJYjxIpnUJfgJi-gAAAY4"]
[Sun Dec 21 22:44:44.264526 2025] [:error] [pid 59067:tid 59075] [client 4.230.41.166:4022] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUgH3MtpsOP1NfIK_qKHRwAAAAE"]
[Sun Dec 21 22:44:44.643893 2025] [:error] [pid 59067:tid 59080] [client 4.230.41.166:3931] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUgH3MtpsOP1NfIK_qKHSAAAAAY"]
[Sun Dec 21 22:44:44.992794 2025] [:error] [pid 59070:tid 59145] [client 4.230.41.166:4008] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUgH3H3dhXne9KX1kgJy7wAAAJE"]
[Sun Dec 21 22:44:45.387320 2025] [:error] [pid 65237:tid 65255] [client 4.230.41.166:3948] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUgH3VVJYjxIpnUJfgJi_AAAAZA"]
[Sun Dec 21 22:44:45.686013 2025] [:error] [pid 42755:tid 42779] [client 4.230.41.166:3990] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUgH3eW0XvxgXMTJJbv6WAAAAVY"]
[Sun Dec 21 22:44:46.028939 2025] [:error] [pid 30183:tid 30208] [client 4.230.41.166:3965] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUgH3uCmP2zCzk_WZcUx-QAAARc"]
[Sun Dec 21 22:44:46.369093 2025] [:error] [pid 59070:tid 59129] [client 4.230.41.166:4020] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUgH3n3dhXne9KX1kgJy8gAAAIE"]
[Sun Dec 21 22:44:46.668200 2025] [:error] [pid 42755:tid 42775] [client 4.230.41.166:3851] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aUgH3uW0XvxgXMTJJbv6WQAAAVI"]
[Sun Dec 21 22:44:47.015017 2025] [:error] [pid 59158:tid 59179] [client 4.230.41.166:3939] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUgH347NvyNF8ab5VgVp-AAAANM"]
[Sun Dec 21 22:44:47.349498 2025] [:error] [pid 59070:tid 59131] [client 4.230.41.166:4004] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUgH333dhXne9KX1kgJy9AAAAIM"]
[Sun Dec 21 22:44:47.693668 2025] [:error] [pid 59070:tid 59141] [client 4.230.41.166:3936] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUgH333dhXne9KX1kgJy9gAAAI0"]
[Sun Dec 21 22:44:48.080795 2025] [:error] [pid 59158:tid 59170] [client 4.230.41.166:4077] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aUgH4I7NvyNF8ab5VgVp-wAAAMo"]
[Sun Dec 21 22:44:48.392697 2025] [:error] [pid 59070:tid 59142] [client 4.230.41.166:3971] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUgH4H3dhXne9KX1kgJy9wAAAI4"]
[Sun Dec 21 22:44:48.716443 2025] [:error] [pid 59158:tid 59175] [client 4.230.41.166:3805] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUgH4I7NvyNF8ab5VgVp_QAAAM8"]
[Sun Dec 21 22:44:49.022747 2025] [:error] [pid 59067:tid 59090] [client 4.230.41.166:4026] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Dec 21 22:44:49.168507 2025] [:error] [pid 59067:tid 59093] [client 4.230.41.166:4026] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Dec 21 22:44:49.331604 2025] [:error] [pid 59067:tid 59088] [client 4.230.41.166:4026] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Dec 21 22:44:49.511626 2025] [:error] [pid 59067:tid 59089] [client 4.230.41.166:4026] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Dec 21 22:44:50.416807 2025] [:error] [pid 59067:tid 59098] [client 4.230.41.166:4026] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Dec 21 22:44:50.597110 2025] [:error] [pid 59067:tid 59075] [client 4.230.41.166:4026] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Dec 21 22:44:51.133384 2025] [:error] [pid 59067:tid 59079] [client 4.230.41.166:4026] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH48tpsOP1NfIK_qKHVQAAAAU"]
[Sun Dec 21 22:44:51.441716 2025] [:error] [pid 59158:tid 59183] [client 4.230.41.166:3925] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH447NvyNF8ab5VgVqBAAAANc"]
[Sun Dec 21 22:44:51.833151 2025] [:error] [pid 42755:tid 42778] [client 4.230.41.166:4005] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH4-W0XvxgXMTJJbv6XAAAAVU"]
[Sun Dec 21 22:44:52.242315 2025] [:error] [pid 42755:tid 42770] [client 4.230.41.166:3920] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aUgH5OW0XvxgXMTJJbv6XQAAAU0"]
[Sun Dec 21 22:44:52.803956 2025] [:error] [pid 59068:tid 59106] [client 4.230.41.166:3922] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aUgH5BmLyLqWUlrjwyeyWgAAAEU"]
[Sun Dec 21 22:44:53.184306 2025] [:error] [pid 59067:tid 59080] [client 4.230.41.166:3877] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aUgH5ctpsOP1NfIK_qKHVgAAAAY"]
[Sun Dec 21 22:44:53.512153 2025] [:error] [pid 42755:tid 42764] [client 4.230.41.166:3950] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aUgH5eW0XvxgXMTJJbv6YQAAAUc"]
[Sun Dec 21 22:44:53.908978 2025] [:error] [pid 59068:tid 59110] [client 4.230.41.166:3958] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aUgH5RmLyLqWUlrjwyeyXQAAAEk"]
[Sun Dec 21 22:44:54.278998 2025] [:error] [pid 65237:tid 65263] [client 4.230.41.166:3947] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUgH5lVJYjxIpnUJfgJjAQAAAZg"]
[Sun Dec 21 22:44:54.622262 2025] [:error] [pid 59068:tid 59121] [client 4.230.41.166:3945] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUgH5hmLyLqWUlrjwyeyXwAAAFQ"]
[Sun Dec 21 22:44:55.018587 2025] [:error] [pid 65237:tid 65259] [client 4.230.41.166:4090] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUgH51VJYjxIpnUJfgJjAgAAAZQ"]
[Sun Dec 21 22:44:55.442208 2025] [:error] [pid 30183:tid 30208] [client 4.230.41.166:3960] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aUgH5-CmP2zCzk_WZcUyCQAAARc"]
[Sun Dec 21 22:44:55.763689 2025] [:error] [pid 65237:tid 65248] [client 4.230.41.166:4016] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUgH51VJYjxIpnUJfgJjAwAAAYk"]
[Sun Dec 21 22:44:56.124692 2025] [:error] [pid 30183:tid 30192] [client 4.230.41.166:3927] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUgH6OCmP2zCzk_WZcUyDgAAAQc"]
[Sun Dec 21 22:44:56.416514 2025] [:error] [pid 59067:tid 59094] [client 4.230.41.166:3784] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUgH6MtpsOP1NfIK_qKHWQAAABQ"]
[Sun Dec 21 22:44:56.705188 2025] [:error] [pid 59158:tid 59162] [client 4.230.41.166:3782] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aUgH6I7NvyNF8ab5VgVqCAAAAMI"]
[Sun Dec 21 22:44:57.041364 2025] [:error] [pid 59158:tid 59174] [client 4.230.41.166:3840] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUgH6Y7NvyNF8ab5VgVqCQAAAM4"]
[Sun Dec 21 22:44:57.416338 2025] [:error] [pid 42755:tid 42765] [client 4.230.41.166:3984] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUgH6eW0XvxgXMTJJbv6ZQAAAUg"]
[Sun Dec 21 22:44:57.816657 2025] [:error] [pid 65237:tid 65242] [client 4.230.41.166:3864] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUgH6VVJYjxIpnUJfgJjBQAAAYM"]
[Sun Dec 21 22:44:58.095459 2025] [:error] [pid 65237:tid 65253] [client 4.230.41.166:3845] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUgH6lVJYjxIpnUJfgJjBwAAAY4"]
[Sun Dec 21 22:44:58.407831 2025] [:error] [pid 59070:tid 59137] [client 4.230.41.166:3942] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUgH6n3dhXne9KX1kgJzBQAAAIk"]
[Sun Dec 21 22:44:58.707128 2025] [:error] [pid 59158:tid 59169] [client 4.230.41.166:3940] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUgH6o7NvyNF8ab5VgVqCgAAAMk"]
[Sun Dec 21 22:44:59.030639 2025] [:error] [pid 59070:tid 59128] [client 4.230.41.166:4062] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUgH633dhXne9KX1kgJzCAAAAIA"]
[Sun Dec 21 22:44:59.328440 2025] [:error] [pid 59070:tid 59141] [client 4.230.41.166:4068] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aUgH633dhXne9KX1kgJzDAAAAI0"]
[Sun Dec 21 22:44:59.649048 2025] [:error] [pid 59158:tid 59164] [client 4.230.41.166:3952] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aUgH647NvyNF8ab5VgVqCwAAAMQ"]
[Sun Dec 21 22:44:59.971495 2025] [:error] [pid 59158:tid 59183] [client 4.230.41.166:3854] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aUgH647NvyNF8ab5VgVqDAAAANc"]
[Sun Dec 21 22:45:00.369862 2025] [:error] [pid 59067:tid 59088] [client 4.230.41.166:4013] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aUgH7MtpsOP1NfIK_qKHXwAAAA4"]
[Sun Dec 21 22:45:00.773851 2025] [:error] [pid 59070:tid 59132] [client 4.230.41.166:3997] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aUgH7H3dhXne9KX1kgJzEAAAAIQ"]
[Sun Dec 21 22:45:01.079963 2025] [:error] [pid 59070:tid 59138] [client 4.230.41.166:3896] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aUgH7X3dhXne9KX1kgJzEwAAAIo"]
[Sun Dec 21 22:45:01.440900 2025] [:error] [pid 59070:tid 59133] [client 4.230.41.166:3953] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aUgH7X3dhXne9KX1kgJzFQAAAIU"]
[Sun Dec 21 22:45:01.748936 2025] [:error] [pid 42755:tid 42766] [client 4.230.41.166:4011] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aUgH7eW0XvxgXMTJJbv6awAAAUk"]
[Sun Dec 21 22:45:02.033609 2025] [:error] [pid 59070:tid 59145] [client 4.230.41.166:3886] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aUgH7n3dhXne9KX1kgJzFgAAAJE"]
[Sun Dec 21 22:45:02.398721 2025] [:error] [pid 59158:tid 59177] [client 4.230.41.166:3866] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUgH7o7NvyNF8ab5VgVqEQAAANE"]
[Sun Dec 21 22:45:02.793027 2025] [:error] [pid 59070:tid 59134] [client 4.230.41.166:3899] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUgH7n3dhXne9KX1kgJzGQAAAIY"]
[Sun Dec 21 22:45:03.169674 2025] [:error] [pid 59070:tid 59131] [client 4.230.41.166:3883] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUgH733dhXne9KX1kgJzGwAAAIM"]
[Sun Dec 21 22:45:03.590768 2025] [:error] [pid 59158:tid 59175] [client 4.230.41.166:3961] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aUgH747NvyNF8ab5VgVqFgAAAM8"]
[Sun Dec 21 22:45:03.977690 2025] [:error] [pid 59158:tid 59178] [client 4.230.41.166:3844] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUgH747NvyNF8ab5VgVqFwAAANI"]
[Sun Dec 21 22:45:04.288683 2025] [:error] [pid 59070:tid 59149] [client 4.230.41.166:3967] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUgH8H3dhXne9KX1kgJzHgAAAJU"]
[Sun Dec 21 22:45:04.876370 2025] [:error] [pid 59070:tid 59133] [client 4.230.41.166:3807] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUgH8H3dhXne9KX1kgJzJAAAAIU"]
[Sun Dec 21 22:45:05.281619 2025] [:error] [pid 59158:tid 59164] [client 4.230.41.166:3959] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aUgH8Y7NvyNF8ab5VgVqGgAAAMQ"]
[Sun Dec 21 22:45:05.610272 2025] [:error] [pid 59070:tid 59131] [client 4.230.41.166:3801] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUgH8X3dhXne9KX1kgJzJQAAAIM"]
[Sun Dec 21 22:45:05.940189 2025] [:error] [pid 59158:tid 59182] [client 4.230.41.166:3935] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUgH8Y7NvyNF8ab5VgVqHAAAANY"]
[Sun Dec 21 22:45:06.311468 2025] [:error] [pid 59070:tid 59149] [client 4.230.41.166:4021] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUgH8n3dhXne9KX1kgJzKgAAAJU"]
[Sun Dec 21 22:45:06.609764 2025] [:error] [pid 59158:tid 59165] [client 4.230.41.166:3992] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUgH8o7NvyNF8ab5VgVqHQAAAMU"]
[Sun Dec 21 22:45:06.944302 2025] [:error] [pid 59158:tid 59177] [client 4.230.41.166:3862] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUgH8o7NvyNF8ab5VgVqHgAAANE"]
[Sun Dec 21 22:45:07.269269 2025] [:error] [pid 59158:tid 59160] [client 4.230.41.166:4084] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUgH847NvyNF8ab5VgVqIAAAAMA"]
[Sun Dec 21 22:45:07.608430 2025] [:error] [pid 42755:tid 42773] [client 4.230.41.166:3855] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUgH8-W0XvxgXMTJJbv6bAAAAVA"]
[Sun Dec 21 22:45:07.987750 2025] [:error] [pid 42755:tid 42767] [client 4.230.41.166:3786] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aUgH8-W0XvxgXMTJJbv6bQAAAUo"]
[Sun Dec 21 22:45:08.320766 2025] [:error] [pid 42755:tid 42780] [client 4.230.41.166:3872] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUgH9OW0XvxgXMTJJbv6bgAAAVc"]
[Sun Dec 21 22:45:08.652157 2025] [:error] [pid 59158:tid 59161] [client 4.230.41.166:3897] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUgH9I7NvyNF8ab5VgVqJQAAAME"]
[Sun Dec 21 22:45:08.964309 2025] [:error] [pid 59070:tid 59135] [client 4.230.41.166:3944] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUgH9H3dhXne9KX1kgJzLwAAAIc"]
[Sun Dec 21 22:45:09.303418 2025] [:error] [pid 59158:tid 59168] [client 4.230.41.166:3840] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUgH9Y7NvyNF8ab5VgVqKgAAAMg"]
[Sun Dec 21 22:45:09.641212 2025] [:error] [pid 59158:tid 59165] [client 4.230.41.166:3871] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUgH9Y7NvyNF8ab5VgVqLAAAAMU"]
[Sun Dec 21 22:45:09.994975 2025] [:error] [pid 59158:tid 59160] [client 4.230.41.166:3889] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aUgH9Y7NvyNF8ab5VgVqLwAAAMA"]
[Sun Dec 21 22:45:10.284761 2025] [:error] [pid 59158:tid 59167] [client 4.230.41.166:3788] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aUgH9o7NvyNF8ab5VgVqMQAAAMc"]
[Sun Dec 21 22:45:10.607480 2025] [:error] [pid 59158:tid 59170] [client 4.230.41.166:3816] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aUgH9o7NvyNF8ab5VgVqNAAAAMo"]
[Sun Dec 21 22:45:10.892140 2025] [:error] [pid 30183:tid 30194] [client 4.230.41.166:3791] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aUgH9uCmP2zCzk_WZcUyEQAAAQk"]
[Sun Dec 21 22:45:12.538402 2025] [:error] [pid 59068:tid 59114] [client 4.230.41.166:3983] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUgH-BmLyLqWUlrjwyeybAAAAE0"]
[Sun Dec 21 22:45:12.919073 2025] [:error] [pid 59068:tid 59124] [client 4.230.41.166:3918] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUgH-BmLyLqWUlrjwyeybwAAAFc"]
[Sun Dec 21 22:45:13.228532 2025] [:error] [pid 59158:tid 59166] [client 4.230.41.166:3938] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aUgH-Y7NvyNF8ab5VgVqPwAAAMY"]
[Sun Dec 21 22:45:13.529006 2025] [:error] [pid 59070:tid 59150] [client 4.230.41.166:3934] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aUgH-X3dhXne9KX1kgJzMgAAAJY"]
[Sun Dec 21 22:45:13.838731 2025] [:error] [pid 42755:tid 42771] [client 4.230.41.166:3795] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aUgH-eW0XvxgXMTJJbv6cgAAAU4"]
[Sun Dec 21 22:45:14.248156 2025] [:error] [pid 59070:tid 59146] [client 4.230.41.166:3943] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aUgH-n3dhXne9KX1kgJzMwAAAJI"]
[Sun Dec 21 22:45:14.638322 2025] [:error] [pid 59070:tid 59134] [client 4.230.41.166:3819] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aUgH-n3dhXne9KX1kgJzNgAAAIY"]
[Sun Dec 21 22:45:15.030064 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:3907] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUgH-xmLyLqWUlrjwyeycQAAAEM"]
[Sun Dec 21 22:45:15.407015 2025] [:error] [pid 59068:tid 59102] [client 4.230.41.166:3957] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUgH-xmLyLqWUlrjwyeycgAAAEE"]
[Sun Dec 21 22:45:15.745097 2025] [:error] [pid 59070:tid 59137] [client 4.230.41.166:3796] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUgH-33dhXne9KX1kgJzOAAAAIk"]
[Sun Dec 21 22:45:16.074821 2025] [:error] [pid 59070:tid 59136] [client 4.230.41.166:3870] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aUgH_H3dhXne9KX1kgJzOQAAAIg"]
[Sun Dec 21 22:45:16.394558 2025] [:error] [pid 59067:tid 59089] [client 4.230.41.166:3962] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aUgH_MtpsOP1NfIK_qKHZgAAAA8"]
[Sun Dec 21 22:45:16.684044 2025] [:error] [pid 42755:tid 42779] [client 4.230.41.166:3783] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aUgH_OW0XvxgXMTJJbv6eAAAAVY"]
[Sun Dec 21 22:45:16.965325 2025] [:error] [pid 59068:tid 59109] [client 4.230.41.166:3873] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aUgH_BmLyLqWUlrjwyeydwAAAEg"]
[Sun Dec 21 22:45:17.257155 2025] [:error] [pid 42755:tid 42758] [client 4.230.41.166:3822] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aUgH_eW0XvxgXMTJJbv6eQAAAUE"]
[Sun Dec 21 22:45:17.610518 2025] [:error] [pid 30183:tid 30188] [client 4.230.41.166:3956] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aUgH_eCmP2zCzk_WZcUyGgAAAQM"]
[Sun Dec 21 22:45:17.968635 2025] [:error] [pid 59070:tid 59151] [client 4.230.41.166:3887] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUgH_X3dhXne9KX1kgJzOgAAAJc"]
[Sun Dec 21 22:45:18.262079 2025] [:error] [pid 30183:tid 30196] [client 4.230.41.166:3901] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUgH_uCmP2zCzk_WZcUyHAAAAQs"]
[Sun Dec 21 22:45:18.539789 2025] [:error] [pid 30183:tid 30207] [client 4.230.41.166:3867] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUgH_uCmP2zCzk_WZcUyHQAAARY"]
[Sun Dec 21 22:45:18.903492 2025] [:error] [pid 59070:tid 59135] [client 4.230.41.166:3811] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUgH_n3dhXne9KX1kgJzOwAAAIc"]
[Sun Dec 21 22:45:19.195815 2025] [:error] [pid 59070:tid 59141] [client 4.230.41.166:3815] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aUgH_33dhXne9KX1kgJzPAAAAI0"]
[Sun Dec 21 22:45:19.510921 2025] [:error] [pid 65237:tid 65240] [client 4.230.41.166:3865] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aUgH_1VJYjxIpnUJfgJjEgAAAYE"]
[Sun Dec 21 22:45:19.823421 2025] [:error] [pid 59070:tid 59147] [client 4.230.41.166:3898] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aUgH_33dhXne9KX1kgJzPQAAAJM"]
[Sun Dec 21 22:45:20.116084 2025] [:error] [pid 59158:tid 59161] [client 4.230.41.166:3876] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aUgIAI7NvyNF8ab5VgVqSwAAAME"]
[Sun Dec 21 22:45:20.400382 2025] [:error] [pid 59068:tid 59113] [client 4.230.41.166:3860] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aUgIABmLyLqWUlrjwyeyfAAAAEw"]
[Sun Dec 21 22:45:20.716778 2025] [:error] [pid 42755:tid 42773] [client 4.230.41.166:3880] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aUgIAOW0XvxgXMTJJbv6ewAAAVA"]
[Sun Dec 21 22:45:21.026394 2025] [:error] [pid 42755:tid 42767] [client 4.230.41.166:3955] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aUgIAeW0XvxgXMTJJbv6fAAAAUo"]
[Sun Dec 21 22:45:21.364433 2025] [:error] [pid 59070:tid 59138] [client 4.230.41.166:3789] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aUgIAX3dhXne9KX1kgJzPwAAAIo"]
[Sun Dec 21 22:45:21.657084 2025] [:error] [pid 59070:tid 59140] [client 4.230.41.166:3928] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aUgIAX3dhXne9KX1kgJzQQAAAIw"]
[Sun Dec 21 22:45:21.978379 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:3814] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aUgIARmLyLqWUlrjwyeyfwAAAEM"]
[Sun Dec 21 22:45:22.402799 2025] [:error] [pid 42755:tid 42763] [client 4.230.41.166:3881] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aUgIAuW0XvxgXMTJJbv6fQAAAUY"]
[Sun Dec 21 22:45:22.798825 2025] [:error] [pid 59067:tid 59092] [client 4.230.41.166:3726] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aUgIAstpsOP1NfIK_qKHbwAAABI"]
[Sun Dec 21 22:45:23.101118 2025] [:error] [pid 59067:tid 59097] [client 4.230.41.166:3843] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aUgIA8tpsOP1NfIK_qKHcAAAABc"]
[Sun Dec 21 22:45:23.436905 2025] [:error] [pid 42755:tid 42771] [client 4.230.41.166:3892] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUgIA-W0XvxgXMTJJbv6fwAAAU4"]
[Sun Dec 21 22:45:23.742706 2025] [:error] [pid 42755:tid 42761] [client 4.230.41.166:3722] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUgIA-W0XvxgXMTJJbv6gQAAAUQ"]
[Sun Dec 21 22:45:24.093310 2025] [:error] [pid 42755:tid 42766] [client 4.230.41.166:3894] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUgIBOW0XvxgXMTJJbv6ggAAAUk"]
[Sun Dec 21 22:45:24.481006 2025] [:error] [pid 59067:tid 59085] [client 4.230.41.166:3882] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUgIBMtpsOP1NfIK_qKHdQAAAAs"]
[Sun Dec 21 22:45:24.812079 2025] [:error] [pid 59067:tid 59081] [client 4.230.41.166:3963] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUgIBMtpsOP1NfIK_qKHdwAAAAc"]
[Sun Dec 21 22:45:25.243591 2025] [:error] [pid 59158:tid 59184] [client 4.230.41.166:4017] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUgIBY7NvyNF8ab5VgVqTwAAANg"]
[Sun Dec 21 22:45:25.636116 2025] [:error] [pid 59158:tid 59168] [client 4.230.41.166:3797] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUgIBY7NvyNF8ab5VgVqUQAAAMg"]
[Sun Dec 21 22:45:26.040104 2025] [:error] [pid 59068:tid 59123] [client 4.230.41.166:3846] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aUgIBhmLyLqWUlrjwyeygQAAAFY"]
[Sun Dec 21 22:45:26.473772 2025] [:error] [pid 59158:tid 59162] [client 4.230.41.166:3716] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aUgIBo7NvyNF8ab5VgVqUwAAAMI"]
[Sun Dec 21 22:45:26.864652 2025] [:error] [pid 42755:tid 42759] [client 4.230.41.166:4055] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aUgIBuW0XvxgXMTJJbv6hgAAAUI"]
[Sun Dec 21 22:45:27.200850 2025] [:error] [pid 59158:tid 59169] [client 4.230.41.166:3848] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aUgIB47NvyNF8ab5VgVqVAAAAMk"]
[Sun Dec 21 22:45:27.557792 2025] [:error] [pid 59158:tid 59179] [client 4.230.41.166:3798] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aUgIB47NvyNF8ab5VgVqVwAAANM"]
[Sun Dec 21 22:45:27.938653 2025] [:error] [pid 65237:tid 65248] [client 4.230.41.166:3915] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUgIB1VJYjxIpnUJfgJjGQAAAYk"]
[Sun Dec 21 22:45:28.331723 2025] [:error] [pid 42755:tid 42781] [client 4.230.41.166:3830] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUgICOW0XvxgXMTJJbv6igAAAVg"]
[Sun Dec 21 22:45:28.643155 2025] [:error] [pid 42755:tid 42778] [client 4.230.41.166:4069] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUgICOW0XvxgXMTJJbv6jQAAAVU"]
[Sun Dec 21 22:45:28.947160 2025] [:error] [pid 42755:tid 42761] [client 4.230.41.166:3893] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aUgICOW0XvxgXMTJJbv6kAAAAUQ"]
[Sun Dec 21 22:45:29.434058 2025] [:error] [pid 65237:tid 65242] [client 4.230.41.166:3891] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUgICVVJYjxIpnUJfgJjGgAAAYM"]
[Sun Dec 21 22:45:29.841776 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:3833] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUgICRmLyLqWUlrjwyeyhQAAAEM"]
[Sun Dec 21 22:45:30.196849 2025] [:error] [pid 59068:tid 59103] [client 4.230.41.166:3713] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUgIChmLyLqWUlrjwyeyhgAAAEI"]
[Sun Dec 21 22:45:30.532197 2025] [:error] [pid 59068:tid 59102] [client 4.230.41.166:3817] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aUgIChmLyLqWUlrjwyeyhwAAAEE"]
[Sun Dec 21 22:45:30.860228 2025] [:error] [pid 30183:tid 30199] [client 4.230.41.166:3903] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUgICuCmP2zCzk_WZcUyJgAAAQ4"]
[Sun Dec 21 22:45:31.174930 2025] [:error] [pid 30183:tid 30204] [client 4.230.41.166:3809] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUgIC-CmP2zCzk_WZcUyJwAAARM"]
[Sun Dec 21 22:45:31.531656 2025] [:error] [pid 59070:tid 59140] [client 4.230.41.166:3731] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUgIC33dhXne9KX1kgJzSwAAAIw"]
[Sun Dec 21 22:45:31.870881 2025] [:error] [pid 59068:tid 59110] [client 4.230.41.166:3832] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUgICxmLyLqWUlrjwyeyiwAAAEk"]
[Sun Dec 21 22:45:32.197606 2025] [:error] [pid 65237:tid 65240] [client 4.230.41.166:3744] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aUgIDFVJYjxIpnUJfgJjHQAAAYE"]
[Sun Dec 21 22:45:32.493669 2025] [:error] [pid 59158:tid 59169] [client 4.230.41.166:3996] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aUgIDI7NvyNF8ab5VgVqYgAAAMk"]
[Sun Dec 21 22:45:32.896396 2025] [:error] [pid 42755:tid 42779] [client 4.230.41.166:3853] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aUgIDOW0XvxgXMTJJbv6kgAAAVY"]
[Sun Dec 21 22:45:33.215909 2025] [:error] [pid 59070:tid 59130] [client 4.230.41.166:3868] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aUgIDX3dhXne9KX1kgJzUAAAAII"]
[Sun Dec 21 22:45:33.522266 2025] [:error] [pid 59067:tid 59090] [client 4.230.41.166:3799] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUgIDctpsOP1NfIK_qKHhgAAABA"]
[Sun Dec 21 22:45:33.970022 2025] [:error] [pid 59158:tid 59161] [client 4.230.41.166:3800] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUgIDY7NvyNF8ab5VgVqZAAAAME"]
[Sun Dec 21 22:45:34.297105 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:3840] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUgIDhmLyLqWUlrjwyeyjwAAAEM"]
[Sun Dec 21 22:45:34.627851 2025] [:error] [pid 42755:tid 42765] [client 4.230.41.166:3921] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUgIDuW0XvxgXMTJJbv6lAAAAUg"]
[Sun Dec 21 22:45:34.995779 2025] [:error] [pid 59158:tid 59184] [client 4.230.41.166:3841] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUgIDo7NvyNF8ab5VgVqZgAAANg"]
[Sun Dec 21 22:45:35.361750 2025] [:error] [pid 42755:tid 42781] [client 4.230.41.166:3806] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUgID-W0XvxgXMTJJbv6lgAAAVg"]
[Sun Dec 21 22:45:35.775316 2025] [:error] [pid 42755:tid 42776] [client 4.230.41.166:3874] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUgID-W0XvxgXMTJJbv6lwAAAVM"]
[Sun Dec 21 22:45:36.195110 2025] [:error] [pid 42755:tid 42778] [client 4.230.41.166:3791] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aUgIEOW0XvxgXMTJJbv6mAAAAVU"]
[Sun Dec 21 22:45:36.515831 2025] [:error] [pid 65237:tid 65241] [client 4.230.41.166:3785] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUgIEFVJYjxIpnUJfgJjJQAAAYI"]
[Sun Dec 21 22:45:36.877719 2025] [:error] [pid 30183:tid 30203] [client 4.230.41.166:4003] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUgIEOCmP2zCzk_WZcUyLAAAARI"]
[Sun Dec 21 22:45:37.238680 2025] [:error] [pid 59068:tid 59106] [client 4.230.41.166:3802] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUgIERmLyLqWUlrjwyeykgAAAEU"]
[Sun Dec 21 22:45:37.568873 2025] [:error] [pid 59070:tid 59129] [client 4.230.41.166:3810] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aUgIEX3dhXne9KX1kgJzVQAAAIE"]
[Sun Dec 21 22:45:37.868753 2025] [:error] [pid 59067:tid 59086] [client 4.230.41.166:3863] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUgIEctpsOP1NfIK_qKHiwAAAAw"]
[Sun Dec 21 22:45:38.183161 2025] [:error] [pid 59158:tid 59163] [client 4.230.41.166:3964] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUgIEo7NvyNF8ab5VgVqZwAAAMM"]
[Sun Dec 21 22:45:38.472531 2025] [:error] [pid 65237:tid 65252] [client 4.230.41.166:3765] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUgIElVJYjxIpnUJfgJjJwAAAY0"]
[Sun Dec 21 22:45:38.817162 2025] [:error] [pid 30183:tid 30209] [client 4.230.41.166:3821] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUgIEuCmP2zCzk_WZcUyLgAAARg"]
[Sun Dec 21 22:45:39.109530 2025] [:error] [pid 30183:tid 30193] [client 4.230.41.166:4078] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUgIE-CmP2zCzk_WZcUyLwAAAQg"]
[Sun Dec 21 22:45:39.404943 2025] [:error] [pid 42755:tid 42767] [client 4.230.41.166:3826] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUgIE-W0XvxgXMTJJbv6nQAAAUo"]
[Sun Dec 21 22:45:39.710835 2025] [:error] [pid 59158:tid 59180] [client 4.230.41.166:3763] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUgIE47NvyNF8ab5VgVqaQAAANQ"]
[Sun Dec 21 22:45:40.093722 2025] [:error] [pid 59158:tid 59169] [client 4.230.41.166:3858] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUgIFI7NvyNF8ab5VgVqawAAAMk"]
[Sun Dec 21 22:45:40.443257 2025] [:error] [pid 42755:tid 42766] [client 4.230.41.166:3790] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aUgIFOW0XvxgXMTJJbv6nwAAAUk"]
[Sun Dec 21 22:45:40.744172 2025] [:error] [pid 59158:tid 59173] [client 4.230.41.166:3902] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aUgIFI7NvyNF8ab5VgVqbAAAAM0"]
[Sun Dec 21 22:45:41.034847 2025] [:error] [pid 59158:tid 59164] [client 4.230.41.166:3793] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aUgIFY7NvyNF8ab5VgVqbQAAAMQ"]
[Sun Dec 21 22:45:41.354922 2025] [:error] [pid 59067:tid 59085] [client 4.230.41.166:3813] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aUgIFctpsOP1NfIK_qKHjQAAAAs"]
[Sun Dec 21 22:45:41.701584 2025] [:error] [pid 59070:tid 59137] [client 4.230.41.166:3776] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUgIFX3dhXne9KX1kgJzWgAAAIk"]
[Sun Dec 21 22:45:42.015730 2025] [:error] [pid 59070:tid 59139] [client 4.230.41.166:3890] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUgIFn3dhXne9KX1kgJzWwAAAIs"]
[Sun Dec 21 22:45:42.315228 2025] [:error] [pid 59158:tid 59174] [client 4.230.41.166:3878] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUgIFo7NvyNF8ab5VgVqbwAAAM4"]
[Sun Dec 21 22:45:42.657262 2025] [:error] [pid 59158:tid 59177] [client 4.230.41.166:3954] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aUgIFo7NvyNF8ab5VgVqcQAAANE"]
[Sun Dec 21 22:45:43.069494 2025] [:error] [pid 59158:tid 59182] [client 4.230.41.166:3715] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUgIF47NvyNF8ab5VgVqcwAAANY"]
[Sun Dec 21 22:45:43.370756 2025] [:error] [pid 59067:tid 59098] [client 4.230.41.166:3778] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUgIF8tpsOP1NfIK_qKHjwAAABg"]
[Sun Dec 21 22:45:43.785661 2025] [:error] [pid 59158:tid 59172] [client 4.230.41.166:3764] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUgIF47NvyNF8ab5VgVqdgAAAMw"]
[Sun Dec 21 22:45:44.074073 2025] [:error] [pid 65237:tid 65241] [client 4.230.41.166:3824] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aUgIGFVJYjxIpnUJfgJjKwAAAYI"]
[Sun Dec 21 22:45:44.351582 2025] [:error] [pid 59067:tid 59077] [client 4.230.41.166:3823] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aUgIGMtpsOP1NfIK_qKHkAAAAAM"]
[Sun Dec 21 22:45:44.672111 2025] [:error] [pid 59067:tid 59092] [client 4.230.41.166:3725] [client 4.230.41.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aUgIGMtpsOP1NfIK_qKHkgAAABI"]
[Sun Dec 21 22:45:45.038373 2025] [:error] [pid 65237:tid 65246] [client 4.230.41.166:3653] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUgIGVVJYjxIpnUJfgJjLgAAAYc"]
[Sun Dec 21 22:45:45.337797 2025] [:error] [pid 59067:tid 59094] [client 4.230.41.166:3850] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUgIGctpsOP1NfIK_qKHlQAAABQ"]
[Sun Dec 21 22:45:45.774902 2025] [:error] [pid 59067:tid 59086] [client 4.230.41.166:3746] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUgIGctpsOP1NfIK_qKHmQAAAAw"]
[Sun Dec 21 22:45:46.072598 2025] [:error] [pid 59158:tid 59174] [client 4.230.41.166:3794] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUgIGo7NvyNF8ab5VgVqfQAAAM4"]
[Sun Dec 21 22:45:46.355974 2025] [:error] [pid 59158:tid 59170] [client 4.230.41.166:3827] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUgIGo7NvyNF8ab5VgVqggAAAMo"]
[Sun Dec 21 22:45:46.700203 2025] [:error] [pid 59158:tid 59178] [client 4.230.41.166:3875] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUgIGo7NvyNF8ab5VgVqhAAAANI"]
[Sun Dec 21 22:45:47.024342 2025] [:error] [pid 42755:tid 42770] [client 4.230.41.166:3724] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aUgIG-W0XvxgXMTJJbv6pQAAAU0"]
[Sun Dec 21 22:45:47.378128 2025] [:error] [pid 42755:tid 42766] [client 4.230.41.166:3739] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUgIG-W0XvxgXMTJJbv6pgAAAUk"]
[Sun Dec 21 22:45:47.676388 2025] [:error] [pid 42755:tid 42777] [client 4.230.41.166:3837] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUgIG-W0XvxgXMTJJbv6pwAAAVQ"]
[Sun Dec 21 22:45:48.092572 2025] [:error] [pid 59070:tid 59140] [client 4.230.41.166:3895] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUgIHH3dhXne9KX1kgJzXQAAAIw"]
[Sun Dec 21 22:45:48.449741 2025] [:error] [pid 30183:tid 30197] [client 4.230.41.166:3775] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aUgIHOCmP2zCzk_WZcUyNQAAAQw"]
[Sun Dec 21 22:45:48.837743 2025] [:error] [pid 65237:tid 65242] [client 4.230.41.166:3777] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aUgIHFVJYjxIpnUJfgJjMQAAAYM"]
[Sun Dec 21 22:45:49.169229 2025] [:error] [pid 30183:tid 30203] [client 4.230.41.166:3769] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aUgIHeCmP2zCzk_WZcUyNgAAARI"]
[Sun Dec 21 22:45:49.619628 2025] [:error] [pid 59158:tid 59174] [client 4.230.41.166:3755] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aUgIHY7NvyNF8ab5VgVqhwAAAM4"]
[Sun Dec 21 22:45:49.954346 2025] [:error] [pid 30183:tid 30193] [client 4.230.41.166:3857] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aUgIHeCmP2zCzk_WZcUyOAAAAQg"]
[Sun Dec 21 22:45:50.278678 2025] [:error] [pid 59067:tid 59094] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sun Dec 21 22:45:50.448747 2025] [:error] [pid 59067:tid 59086] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sun Dec 21 22:45:50.589791 2025] [:error] [pid 59067:tid 59091] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Sun Dec 21 22:45:50.733500 2025] [:error] [pid 59067:tid 59090] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Sun Dec 21 22:45:50.874493 2025] [:error] [pid 59067:tid 59088] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun Dec 21 22:45:51.024872 2025] [:error] [pid 59067:tid 59079] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Sun Dec 21 22:45:51.163783 2025] [:error] [pid 59067:tid 59076] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Sun Dec 21 22:45:51.305485 2025] [:error] [pid 59067:tid 59075] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Dec 21 22:45:51.471123 2025] [:error] [pid 59067:tid 59098] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Dec 21 22:45:51.659854 2025] [:error] [pid 59067:tid 59085] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Sun Dec 21 22:45:51.807808 2025] [:error] [pid 59067:tid 59084] [client 4.230.41.166:3759] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Sun Dec 21 22:45:51.963747 2025] [:error] [pid 59067:tid 59082] [client 4.230.41.166:3759] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aUgIH8tpsOP1NfIK_qKHrAAAAAg"]
[Sun Dec 21 22:45:52.332493 2025] [:error] [pid 59068:tid 59114] [client 4.230.41.166:3730] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aUgIIBmLyLqWUlrjwyeynAAAAE0"]
[Sun Dec 21 22:45:52.638787 2025] [:error] [pid 42755:tid 42773] [client 4.230.41.166:3812] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aUgIIOW0XvxgXMTJJbv6rwAAAVA"]
[Sun Dec 21 22:45:52.981180 2025] [:error] [pid 30183:tid 30205] [client 4.230.41.166:3834] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aUgIIOCmP2zCzk_WZcUyQAAAARQ"]
[Sun Dec 21 22:45:53.318173 2025] [:error] [pid 59068:tid 59122] [client 4.230.41.166:3820] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aUgIIRmLyLqWUlrjwyeynQAAAFU"]
[Sun Dec 21 22:45:53.672572 2025] [:error] [pid 59070:tid 59146] [client 4.230.41.166:3780] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aUgIIX3dhXne9KX1kgJzYwAAAJI"]
[Sun Dec 21 22:45:53.959347 2025] [:error] [pid 59068:tid 59113] [client 4.230.41.166:3869] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aUgIIRmLyLqWUlrjwyeypgAAAEw"]
[Sun Dec 21 22:45:54.284358 2025] [:error] [pid 59067:tid 59097] [client 4.230.41.166:3900] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aUgIIstpsOP1NfIK_qKH2gAAABc"]
[Sun Dec 21 22:45:54.586069 2025] [:error] [pid 42755:tid 42770] [client 4.230.41.166:3754] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aUgIIuW0XvxgXMTJJbv6sQAAAU0"]
[Sun Dec 21 22:45:54.965048 2025] [:error] [pid 59068:tid 59125] [client 4.230.41.166:3825] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aUgIIhmLyLqWUlrjwyeyugAAAFg"]
[Sun Dec 21 22:45:55.249788 2025] [:error] [pid 42755:tid 42767] [client 4.230.41.166:3720] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aUgII-W0XvxgXMTJJbv6sgAAAUo"]
[Sun Dec 21 22:45:55.590935 2025] [:error] [pid 59070:tid 59144] [client 4.230.41.166:3717] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aUgII33dhXne9KX1kgJzfwAAAJA"]
[Sun Dec 21 22:45:55.876763 2025] [:error] [pid 30183:tid 30185] [client 4.230.41.166:3836] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUgII-CmP2zCzk_WZcUyQwAAAQA"]
[Sun Dec 21 22:45:56.181189 2025] [:error] [pid 59158:tid 59170] [client 4.230.41.166:3792] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUgIJI7NvyNF8ab5VgVqlAAAAMo"]
[Sun Dec 21 22:45:56.490210 2025] [:error] [pid 42755:tid 42757] [client 4.230.41.166:3743] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUgIJOW0XvxgXMTJJbv6swAAAUA"]
[Sun Dec 21 22:45:56.796504 2025] [:error] [pid 59068:tid 59123] [client 4.230.41.166:3849] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aUgIJBmLyLqWUlrjwyeyvwAAAFY"]
[Sun Dec 21 22:45:57.106731 2025] [:error] [pid 65237:tid 65263] [client 4.230.41.166:3721] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUgIJVVJYjxIpnUJfgJjOQAAAZg"]
[Sun Dec 21 22:45:57.422519 2025] [:error] [pid 59067:tid 59097] [client 4.230.41.166:3758] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUgIJctpsOP1NfIK_qKIDwAAABc"]
[Sun Dec 21 22:45:57.739589 2025] [:error] [pid 59068:tid 59108] [client 4.230.41.166:3831] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUgIJRmLyLqWUlrjwyeywAAAAEc"]
[Sun Dec 21 22:45:58.031045 2025] [:error] [pid 59070:tid 59136] [client 4.230.41.166:3648] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aUgIJn3dhXne9KX1kgJzhAAAAIg"]
[Sun Dec 21 22:45:58.341435 2025] [:error] [pid 65237:tid 65254] [client 4.230.41.166:3741] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aUgIJlVJYjxIpnUJfgJjPAAAAY8"]
[Sun Dec 21 22:45:58.649850 2025] [:error] [pid 59070:tid 59131] [client 4.230.41.166:3747] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aUgIJn3dhXne9KX1kgJzhwAAAIM"]
[Sun Dec 21 22:45:58.925265 2025] [:error] [pid 59070:tid 59138] [client 4.230.41.166:3651] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aUgIJn3dhXne9KX1kgJziQAAAIo"]
[Sun Dec 21 22:45:59.230668 2025] [:error] [pid 59067:tid 59078] [client 4.230.41.166:3749] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aUgIJ8tpsOP1NfIK_qKIEAAAAAQ"]
[Sun Dec 21 22:45:59.564093 2025] [:error] [pid 59070:tid 59148] [client 4.230.41.166:3687] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUgIJ33dhXne9KX1kgJzkAAAAJQ"]
[Sun Dec 21 22:45:59.858257 2025] [:error] [pid 59070:tid 59136] [client 4.230.41.166:3723] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUgIJ33dhXne9KX1kgJzkwAAAIg"]
[Sun Dec 21 22:46:00.145259 2025] [:error] [pid 42755:tid 42763] [client 4.230.41.166:3718] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUgIKOW0XvxgXMTJJbv6twAAAUY"]
[Sun Dec 21 22:46:00.430386 2025] [:error] [pid 59070:tid 59142] [client 4.230.41.166:3773] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aUgIKH3dhXne9KX1kgJzmQAAAI4"]
[Sun Dec 21 22:46:00.742842 2025] [:error] [pid 59067:tid 59093] [client 4.230.41.166:3711] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUgIKMtpsOP1NfIK_qKIEgAAABM"]
[Sun Dec 21 22:46:01.069913 2025] [:error] [pid 59067:tid 59088] [client 4.230.41.166:3649] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUgIKctpsOP1NfIK_qKIEwAAAA4"]
[Sun Dec 21 22:46:01.350587 2025] [:error] [pid 42755:tid 42758] [client 4.230.41.166:3767] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUgIKeW0XvxgXMTJJbv6uwAAAUE"]
[Sun Dec 21 22:46:01.671103 2025] [:error] [pid 59068:tid 59102] [client 4.230.41.166:3770] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUgIKRmLyLqWUlrjwyeywwAAAEE"]
[Sun Dec 21 22:46:01.961808 2025] [:error] [pid 42755:tid 42775] [client 4.230.41.166:3682] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUgIKeW0XvxgXMTJJbv6vgAAAVI"]
[Sun Dec 21 22:46:02.249329 2025] [:error] [pid 59067:tid 59097] [client 4.230.41.166:3804] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUgIKstpsOP1NfIK_qKIGQAAABc"]
[Sun Dec 21 22:46:02.542752 2025] [:error] [pid 42755:tid 42774] [client 4.230.41.166:3733] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUgIKuW0XvxgXMTJJbv6wAAAAVE"]
[Sun Dec 21 22:46:02.843691 2025] [:error] [pid 59067:tid 59078] [client 4.230.41.166:3591] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aUgIKstpsOP1NfIK_qKIGwAAAAQ"]
[Sun Dec 21 22:46:03.161326 2025] [:error] [pid 30183:tid 30185] [client 4.230.41.166:3839] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUgIK-CmP2zCzk_WZcUyTQAAAQA"]
[Sun Dec 21 22:46:03.461821 2025] [:error] [pid 59070:tid 59148] [client 4.230.41.166:3838] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUgIK33dhXne9KX1kgJznQAAAJQ"]
[Sun Dec 21 22:46:03.817413 2025] [:error] [pid 30183:tid 30196] [client 4.230.41.166:3728] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUgIK-CmP2zCzk_WZcUyUgAAAQs"]
[Sun Dec 21 22:46:04.125148 2025] [:error] [pid 30183:tid 30207] [client 4.230.41.166:3584] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aUgILOCmP2zCzk_WZcUyVgAAARY"]
[Sun Dec 21 22:46:04.434638 2025] [:error] [pid 59070:tid 59133] [client 4.230.41.166:3745] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUgILH3dhXne9KX1kgJznwAAAIU"]
[Sun Dec 21 22:46:04.730836 2025] [:error] [pid 30183:tid 30190] [client 4.230.41.166:3818] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUgILOCmP2zCzk_WZcUyWgAAAQU"]
[Sun Dec 21 22:46:05.096085 2025] [:error] [pid 42755:tid 42777] [client 4.230.41.166:3803] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUgILeW0XvxgXMTJJbv6xAAAAVQ"]
[Sun Dec 21 22:46:05.385129 2025] [:error] [pid 42755:tid 42780] [client 4.230.41.166:3756] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUgILeW0XvxgXMTJJbv6xgAAAVc"]
[Sun Dec 21 22:46:05.689714 2025] [:error] [pid 30183:tid 30200] [client 4.230.41.166:3762] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUgILeCmP2zCzk_WZcUyXQAAAQ8"]
[Sun Dec 21 22:46:06.014057 2025] [:error] [pid 59068:tid 59106] [client 4.230.41.166:3740] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUgILhmLyLqWUlrjwyeyzAAAAEU"]
[Sun Dec 21 22:46:06.324029 2025] [:error] [pid 59067:tid 59087] [client 4.230.41.166:3734] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUgILstpsOP1NfIK_qKIHgAAAA0"]
[Sun Dec 21 22:46:06.621471 2025] [:error] [pid 42755:tid 42779] [client 4.230.41.166:3768] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aUgILuW0XvxgXMTJJbv6ygAAAVY"]
[Sun Dec 21 22:46:06.993573 2025] [:error] [pid 42755:tid 42773] [client 4.230.41.166:3703] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUgILuW0XvxgXMTJJbv6ywAAAVA"]
[Sun Dec 21 22:46:07.338430 2025] [:error] [pid 30183:tid 30197] [client 4.230.41.166:3757] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUgIL-CmP2zCzk_WZcUyXgAAAQw"]
[Sun Dec 21 22:46:07.642048 2025] [:error] [pid 30183:tid 30201] [client 4.230.41.166:3714] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUgIL-CmP2zCzk_WZcUyYAAAARA"]
[Sun Dec 21 22:46:08.085513 2025] [:error] [pid 59070:tid 59150] [client 4.230.41.166:3599] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aUgIMH3dhXne9KX1kgJzpQAAAJY"]
[Sun Dec 21 22:46:08.432610 2025] [:error] [pid 59070:tid 59142] [client 4.230.41.166:3856] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUgIMH3dhXne9KX1kgJzpwAAAI4"]
[Sun Dec 21 22:46:08.734465 2025] [:error] [pid 59070:tid 59144] [client 4.230.41.166:3772] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUgIMH3dhXne9KX1kgJzqQAAAJA"]
[Sun Dec 21 22:46:09.118654 2025] [:error] [pid 59070:tid 59145] [client 4.230.41.166:3668] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUgIMX3dhXne9KX1kgJzrAAAAJE"]
[Sun Dec 21 22:46:09.454048 2025] [:error] [pid 59067:tid 59098] [client 4.230.41.166:3738] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aUgIMctpsOP1NfIK_qKIJAAAABg"]
[Sun Dec 21 22:46:09.743400 2025] [:error] [pid 59068:tid 59109] [client 4.230.41.166:3652] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUgIMRmLyLqWUlrjwyey0wAAAEg"]
[Sun Dec 21 22:46:10.052387 2025] [:error] [pid 42755:tid 42765] [client 4.230.41.166:3735] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUgIMuW0XvxgXMTJJbv61AAAAUg"]
[Sun Dec 21 22:46:10.335679 2025] [:error] [pid 42755:tid 42776] [client 4.230.41.166:3737] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUgIMuW0XvxgXMTJJbv61gAAAVM"]
[Sun Dec 21 22:46:10.659133 2025] [:error] [pid 59070:tid 59133] [client 4.230.41.166:3679] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aUgIMn3dhXne9KX1kgJzrwAAAIU"]
[Sun Dec 21 22:46:10.960322 2025] [:error] [pid 65237:tid 65246] [client 4.230.41.166:3835] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aUgIMlVJYjxIpnUJfgJjQwAAAYc"]
[Sun Dec 21 22:46:11.262699 2025] [:error] [pid 59070:tid 59152] [client 4.230.41.166:3664] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aUgIM33dhXne9KX1kgJzsgAAAJg"]
[Sun Dec 21 22:46:11.553072 2025] [:error] [pid 59068:tid 59103] [client 4.230.41.166:3670] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aUgIMxmLyLqWUlrjwyey1gAAAEI"]
[Sun Dec 21 22:46:11.891150 2025] [:error] [pid 59068:tid 59118] [client 4.230.41.166:3771] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aUgIMxmLyLqWUlrjwyey2QAAAFE"]
[Sun Dec 21 22:46:12.216734 2025] [:error] [pid 59070:tid 59150] [client 4.230.41.166:3727] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgINH3dhXne9KX1kgJztwAAAJY"]
[Sun Dec 21 22:46:12.561656 2025] [:error] [pid 59067:tid 59096] [client 4.230.41.166:3696] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgINMtpsOP1NfIK_qKIKAAAABY"]
[Sun Dec 21 22:46:12.844332 2025] [:error] [pid 42755:tid 42758] [client 4.230.41.166:3595] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgINOW0XvxgXMTJJbv63gAAAUE"]
[Sun Dec 21 22:46:13.141356 2025] [:error] [pid 65237:tid 65242] [client 4.230.41.166:3753] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aUgINVVJYjxIpnUJfgJjRgAAAYM"]
[Sun Dec 21 22:46:13.419635 2025] [:error] [pid 65237:tid 65240] [client 4.230.41.166:3677] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUgINVVJYjxIpnUJfgJjSAAAAYE"]
[Sun Dec 21 22:46:13.691416 2025] [:error] [pid 59068:tid 59114] [client 4.230.41.166:3606] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUgINRmLyLqWUlrjwyey3wAAAE0"]
[Sun Dec 21 22:46:13.972092 2025] [:error] [pid 59068:tid 59124] [client 4.230.41.166:3693] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUgINRmLyLqWUlrjwyey4AAAAFc"]
[Sun Dec 21 22:46:14.293332 2025] [:error] [pid 42755:tid 42776] [client 4.230.41.166:3663] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aUgINuW0XvxgXMTJJbv64gAAAVM"]
[Sun Dec 21 22:46:14.586707 2025] [:error] [pid 42755:tid 42774] [client 4.230.41.166:3699] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUgINuW0XvxgXMTJJbv65AAAAVE"]
[Sun Dec 21 22:46:14.879994 2025] [:error] [pid 42755:tid 42778] [client 4.230.41.166:3656] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUgINuW0XvxgXMTJJbv65wAAAVU"]
[Sun Dec 21 22:46:15.202454 2025] [:error] [pid 59070:tid 59147] [client 4.230.41.166:3732] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUgIN33dhXne9KX1kgJzugAAAJM"]
[Sun Dec 21 22:46:15.512864 2025] [:error] [pid 59070:tid 59151] [client 4.230.41.166:3665] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aUgIN33dhXne9KX1kgJzuwAAAJc"]
[Sun Dec 21 22:46:15.806101 2025] [:error] [pid 59067:tid 59088] [client 4.230.41.166:3657] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aUgIN8tpsOP1NfIK_qKILQAAAA4"]
[Sun Dec 21 22:46:16.187205 2025] [:error] [pid 42755:tid 42768] [client 4.230.41.166:3774] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aUgIOOW0XvxgXMTJJbv67wAAAUs"]
[Sun Dec 21 22:46:16.504012 2025] [:error] [pid 65237:tid 65254] [client 4.230.41.166:3617] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aUgIOFVJYjxIpnUJfgJjTAAAAY8"]
[Sun Dec 21 22:46:16.814579 2025] [:error] [pid 59067:tid 59086] [client 4.230.41.166:3695] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aUgIOMtpsOP1NfIK_qKIMAAAAAw"]
[Sun Dec 21 22:46:17.117071 2025] [:error] [pid 59068:tid 59103] [client 4.230.41.166:3761] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUgIORmLyLqWUlrjwyey5QAAAEI"]
[Sun Dec 21 22:46:17.406189 2025] [:error] [pid 59068:tid 59121] [client 4.230.41.166:3587] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUgIORmLyLqWUlrjwyey5gAAAFQ"]
[Sun Dec 21 22:46:17.715599 2025] [:error] [pid 59158:tid 59175] [client 4.230.41.166:3662] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUgIOY7NvyNF8ab5VgVqtgAAAM8"]
[Sun Dec 21 22:46:18.067958 2025] [:error] [pid 42755:tid 42757] [client 4.230.41.166:3752] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUgIOuW0XvxgXMTJJbv69wAAAUA"]
[Sun Dec 21 22:46:18.396997 2025] [:error] [pid 59070:tid 59142] [client 4.230.41.166:3590] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUgIOn3dhXne9KX1kgJzwQAAAI4"]
[Sun Dec 21 22:46:18.690358 2025] [:error] [pid 65237:tid 65247] [client 4.230.41.166:3655] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUgIOlVJYjxIpnUJfgJjTgAAAYg"]
[Sun Dec 21 22:46:19.023167 2025] [:error] [pid 30183:tid 30208] [client 4.230.41.166:3676] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUgIO-CmP2zCzk_WZcUyagAAARc"]
[Sun Dec 21 22:46:19.330216 2025] [:error] [pid 59067:tid 59081] [client 4.230.41.166:3712] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aUgIO8tpsOP1NfIK_qKINAAAAAc"]
[Sun Dec 21 22:46:19.673734 2025] [:error] [pid 30183:tid 30207] [client 4.230.41.166:3750] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aUgIO-CmP2zCzk_WZcUybAAAARY"]
[Sun Dec 21 22:46:19.988739 2025] [:error] [pid 59070:tid 59141] [client 4.230.41.166:3766] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aUgIO33dhXne9KX1kgJzxAAAAI0"]
[Sun Dec 21 22:46:20.359043 2025] [:error] [pid 59070:tid 59134] [client 4.230.41.166:3671] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aUgIPH3dhXne9KX1kgJzxQAAAIY"]
[Sun Dec 21 22:46:20.655702 2025] [:error] [pid 59067:tid 59096] [client 4.230.41.166:3589] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aUgIPMtpsOP1NfIK_qKINQAAABY"]
[Sun Dec 21 22:46:20.988169 2025] [:error] [pid 59158:tid 59177] [client 4.230.41.166:3888] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aUgIPI7NvyNF8ab5VgVqvAAAANE"]
[Sun Dec 21 22:46:21.263888 2025] [:error] [pid 59068:tid 59123] [client 4.230.41.166:3674] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aUgIPRmLyLqWUlrjwyey7AAAAFY"]
[Sun Dec 21 22:46:21.651937 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:3689] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aUgIPRmLyLqWUlrjwyey7wAAAEM"]
[Sun Dec 21 22:46:21.942899 2025] [:error] [pid 30183:tid 30190] [client 4.230.41.166:3808] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aUgIPeCmP2zCzk_WZcUycgAAAQU"]
[Sun Dec 21 22:46:22.259662 2025] [:error] [pid 59068:tid 59106] [client 4.230.41.166:3678] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUgIPhmLyLqWUlrjwyey9AAAAEU"]
[Sun Dec 21 22:46:22.691209 2025] [:error] [pid 59068:tid 59122] [client 4.230.41.166:3616] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUgIPhmLyLqWUlrjwyey9QAAAFU"]
[Sun Dec 21 22:46:23.021809 2025] [:error] [pid 59068:tid 59102] [client 4.230.41.166:3708] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUgIPxmLyLqWUlrjwyey-QAAAEE"]
[Sun Dec 21 22:46:23.308870 2025] [:error] [pid 59158:tid 59179] [client 4.230.41.166:3680] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUgIP47NvyNF8ab5VgVqvgAAANM"]
[Sun Dec 21 22:46:23.740604 2025] [:error] [pid 65237:tid 65252] [client 4.230.41.166:3829] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUgIP1VJYjxIpnUJfgJjVwAAAY0"]
[Sun Dec 21 22:46:24.104581 2025] [:error] [pid 59158:tid 59173] [client 4.230.41.166:3669] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUgIQI7NvyNF8ab5VgVqwQAAAM0"]
[Sun Dec 21 22:46:24.501361 2025] [:error] [pid 59158:tid 59184] [client 4.230.41.166:3700] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUgIQI7NvyNF8ab5VgVqwwAAANg"]
[Sun Dec 21 22:46:24.890925 2025] [:error] [pid 59068:tid 59124] [client 4.230.41.166:3719] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aUgIQBmLyLqWUlrjwyey_AAAAFc"]
[Sun Dec 21 22:46:25.248511 2025] [:error] [pid 42755:tid 42771] [client 4.230.41.166:3686] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aUgIQeW0XvxgXMTJJbv7CAAAAU4"]
[Sun Dec 21 22:46:25.642442 2025] [:error] [pid 42755:tid 42768] [client 4.230.41.166:3667] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aUgIQeW0XvxgXMTJJbv7CQAAAUs"]
[Sun Dec 21 22:46:26.079010 2025] [:error] [pid 30183:tid 30197] [client 4.230.41.166:3603] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aUgIQuCmP2zCzk_WZcUydwAAAQw"]
[Sun Dec 21 22:46:26.540405 2025] [:error] [pid 59068:tid 59104] [client 4.230.41.166:3602] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aUgIQhmLyLqWUlrjwyey_wAAAEM"]
[Sun Dec 21 22:46:26.975230 2025] [:error] [pid 59158:tid 59171] [client 4.230.41.166:3620] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUgIQo7NvyNF8ab5VgVqyQAAAMs"]
[Sun Dec 21 22:46:27.337649 2025] [:error] [pid 59067:tid 59091] [client 4.230.41.166:3692] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUgIQ8tpsOP1NfIK_qKIPQAAABE"]
[Sun Dec 21 22:46:27.831291 2025] [:error] [pid 59067:tid 59097] [client 4.230.41.166:3729] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUgIQ8tpsOP1NfIK_qKIPwAAABc"]
[Sun Dec 21 22:46:28.227025 2025] [:error] [pid 59158:tid 59179] [client 4.230.41.166:3600] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aUgIRI7NvyNF8ab5VgVqzQAAANM"]
[Sun Dec 21 22:46:28.633146 2025] [:error] [pid 42755:tid 42773] [client 4.230.41.166:3650] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aUgIROW0XvxgXMTJJbv7DgAAAVA"]
[Sun Dec 21 22:46:29.007585 2025] [:error] [pid 59068:tid 59116] [client 4.230.41.166:3779] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aUgIRRmLyLqWUlrjwyezAQAAAE8"]
[Sun Dec 21 22:46:29.381692 2025] [:error] [pid 42755:tid 42776] [client 4.230.41.166:3688] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aUgIReW0XvxgXMTJJbv7EQAAAVM"]
[Sun Dec 21 22:46:29.774540 2025] [:error] [pid 59158:tid 59181] [client 4.230.41.166:3828] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aUgIRY7NvyNF8ab5VgVq0AAAANU"]
[Sun Dec 21 22:46:30.118098 2025] [:error] [pid 59067:tid 59074] [client 4.230.41.166:3628] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aUgIRstpsOP1NfIK_qKIRAAAAAA"]
[Sun Dec 21 22:46:30.511825 2025] [:error] [pid 59068:tid 59115] [client 4.230.41.166:3555] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aUgIRhmLyLqWUlrjwyezBgAAAE4"]
[Sun Dec 21 22:46:30.886499 2025] [:error] [pid 42755:tid 42774] [client 4.230.41.166:3706] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aUgIRuW0XvxgXMTJJbv7GAAAAVE"]
[Sun Dec 21 22:46:31.302003 2025] [:error] [pid 59067:tid 59080] [client 4.230.41.166:3610] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aUgIR8tpsOP1NfIK_qKIRQAAAAY"]
[Sun Dec 21 22:46:31.737294 2025] [:error] [pid 42755:tid 42760] [client 4.230.41.166:3635] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aUgIR-W0XvxgXMTJJbv7GgAAAUM"]
[Sun Dec 21 22:46:32.134524 2025] [:error] [pid 42755:tid 42766] [client 4.230.41.166:3528] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aUgISOW0XvxgXMTJJbv7HQAAAUk"]
[Sun Dec 21 22:46:32.492181 2025] [:error] [pid 42755:tid 42773] [client 4.230.41.166:3685] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aUgISOW0XvxgXMTJJbv7IAAAAVA"]
[Sun Dec 21 22:46:32.902290 2025] [:error] [pid 59068:tid 59113] [client 4.230.41.166:3609] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aUgISBmLyLqWUlrjwyezDAAAAEw"]
[Sun Dec 21 22:46:33.230703 2025] [:error] [pid 65237:tid 65248] [client 4.230.41.166:3666] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aUgISVVJYjxIpnUJfgJjXwAAAYk"]
[Sun Dec 21 22:46:33.629813 2025] [:error] [pid 59158:tid 59170] [client 4.230.41.166:3698] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aUgISY7NvyNF8ab5VgVq1wAAAMo"]
[Sun Dec 21 22:46:34.187159 2025] [:error] [pid 59067:tid 59075] [client 4.230.41.166:3787] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aUgISstpsOP1NfIK_qKISAAAAAE"]
[Sun Dec 21 22:46:34.581992 2025] [:error] [pid 59070:tid 59143] [client 4.230.41.166:3704] [client 4.230.41.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aUgISn3dhXne9KX1kgJzzwAAAI8"]
[Mon Dec 22 10:20:13.918188 2025] [:error] [pid 33535:tid 33544] [client 2.58.56.27:49863] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUiq3WOCI8D9Xtn-n7QcVQAAAcc"]
[Mon Dec 22 10:20:13.919479 2025] [:error] [pid 33535:tid 33544] [client 2.58.56.27:52005] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq3WOCI8D9Xtn-n7QcVgAAAcc"], referer: www.google.com
[Mon Dec 22 10:20:13.921235 2025] [:error] [pid 33564:tid 33583] [client 2.58.56.27:53801] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "aUiq3QSHeG6oLmMnKY4GWwAAAhA"], referer: www.google.com
[Mon Dec 22 10:20:13.923689 2025] [:error] [pid 58078:tid 58098] [client 2.58.56.27:62221] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq3ZWKg9Bf8njHlB6lzAAAAA8"], referer: www.google.com
[Mon Dec 22 10:20:14.221388 2025] [:error] [pid 33565:tid 33596] [client 2.58.56.27:63821] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUiq3tOWX69q8T0m_yKfHgAAAkI"]
[Mon Dec 22 10:20:14.507655 2025] [:error] [pid 58078:tid 58098] [client 2.58.56.27:65203] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq3pWKg9Bf8njHlB6l2wAAAA8"], referer: www.google.com
[Mon Dec 22 10:20:14.508955 2025] [:error] [pid 58078:tid 58104] [client 2.58.56.27:59954] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq3pWKg9Bf8njHlB6l3QAAABU"], referer: www.google.com
[Mon Dec 22 10:20:14.510360 2025] [:error] [pid 58078:tid 58084] [client 2.58.56.27:65209] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "aUiq3pWKg9Bf8njHlB6l3gAAAAE"], referer: www.google.com
[Mon Dec 22 10:20:14.853698 2025] [:error] [pid 33564:tid 33584] [client 2.58.56.27:54299] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUiq3gSHeG6oLmMnKY4GdAAAAhE"]
[Mon Dec 22 10:20:15.386098 2025] [:error] [pid 33564:tid 33589] [client 2.58.56.27:60363] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq3wSHeG6oLmMnKY4GgQAAAhY"], referer: www.google.com
[Mon Dec 22 10:20:15.387172 2025] [:error] [pid 33643:tid 33658] [client 2.58.56.27:54561] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq30oNwyN4xVhAvNOm7QAAAow"], referer: www.google.com
[Mon Dec 22 10:20:15.420875 2025] [:error] [pid 33565:tid 33602] [client 2.58.56.27:54559] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "aUiq39OWX69q8T0m_yKfQAAAAkg"], referer: www.google.com
[Mon Dec 22 10:20:15.647585 2025] [:error] [pid 33535:tid 33542] [client 2.58.56.27:56718] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUiq32OCI8D9Xtn-n7QcZgAAAcU"]
[Mon Dec 22 10:20:16.643817 2025] [:error] [pid 33472:tid 33518] [client 2.58.56.27:56648] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq4J5p2WQpPIK8HAlSFAAAAZE"], referer: www.google.com
[Mon Dec 22 10:20:16.666659 2025] [:error] [pid 33535:tid 33544] [client 2.58.56.27:51290] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq4GOCI8D9Xtn-n7QcggAAAcc"], referer: www.google.com
[Mon Dec 22 10:20:16.825779 2025] [:error] [pid 33471:tid 33493] [client 2.58.56.27:54730] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "aUiq4L5BeNE7regJ7izFzwAAAVM"], referer: www.google.com
[Mon Dec 22 10:20:16.939805 2025] [:error] [pid 33564:tid 33574] [client 2.58.56.27:63063] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUiq4ASHeG6oLmMnKY4GlAAAAgc"]
[Mon Dec 22 10:20:17.654951 2025] [:error] [pid 33472:tid 33516] [client 2.58.56.27:52784] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq4Z5p2WQpPIK8HAlSMAAAAY8"], referer: www.google.com
[Mon Dec 22 10:20:17.675802 2025] [:error] [pid 33643:tid 33660] [client 2.58.56.27:65144] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq4UoNwyN4xVhAvNOnPQAAAo4"], referer: www.google.com
[Mon Dec 22 10:20:17.905282 2025] [:error] [pid 58172:tid 58186] [client 2.58.56.27:52466] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "aUiq4eSVKDT5jWOcnSUlmAAAAMw"], referer: www.google.com
[Mon Dec 22 10:20:19.293609 2025] [:error] [pid 33535:tid 33547] [client 2.58.56.27:63166] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq42OCI8D9Xtn-n7QcvQAAAco"], referer: www.google.com
[Mon Dec 22 10:20:19.315684 2025] [:error] [pid 33471:tid 33487] [client 2.58.56.27:53716] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq475BeNE7regJ7izGGwAAAU0"], referer: www.google.com
[Mon Dec 22 10:20:20.657494 2025] [:error] [pid 58079:tid 58123] [client 2.58.56.27:54886] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq5HxLB7WYaNS5A7j4VgAAAEo"], referer: www.google.com
[Mon Dec 22 10:20:20.771667 2025] [:error] [pid 33643:tid 33648] [client 2.58.56.27:50559] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq5EoNwyN4xVhAvNOnmQAAAoI"], referer: www.google.com
[Mon Dec 22 10:20:22.032726 2025] [:error] [pid 56044:tid 56069] [client 2.58.56.27:59381] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq5u60uUaieriJqP3uDAAAAJU"], referer: www.google.com
[Mon Dec 22 10:20:22.046538 2025] [:error] [pid 58079:tid 58127] [client 2.58.56.27:57280] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq5nxLB7WYaNS5A7j4hwAAAE4"], referer: www.google.com
[Mon Dec 22 10:20:23.297506 2025] [:error] [pid 56044:tid 56070] [client 2.58.56.27:63167] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq5-60uUaieriJqP3uIAAAAJY"], referer: www.google.com
[Mon Dec 22 10:20:23.299975 2025] [:error] [pid 33564:tid 33569] [client 2.58.56.27:49215] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq5wSHeG6oLmMnKY4HUwAAAgI"], referer: www.google.com
[Mon Dec 22 10:20:24.556888 2025] [:error] [pid 33440:tid 33453] [client 2.58.56.27:59999] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUiq6JOsUWKqgxu6QTSWewAAAQs"], referer: www.google.com
[Mon Dec 22 10:20:24.565681 2025] [:error] [pid 33471:tid 33488] [client 2.58.56.27:50285] [client 2.58.56.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUiq6L5BeNE7regJ7izGoAAAAU4"], referer: www.google.com
[Mon Dec 22 16:12:08.693727 2025] [:error] [pid 33472:tid 33516] [client 167.99.182.39:35212] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/api-docs"] [unique_id "aUj9WJ5p2WQpPIK8HAnisgAAAY8"]
[Mon Dec 22 16:12:09.684281 2025] [:error] [pid 33472:tid 33521] [client 167.99.182.39:35224] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3/api-docs"] [unique_id "aUj9WZ5p2WQpPIK8HAniswAAAZQ"]
[Mon Dec 22 16:12:10.686273 2025] [:error] [pid 33472:tid 33503] [client 167.99.182.39:35226] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aUj9Wp5p2WQpPIK8HAniuAAAAYI"]
[Mon Dec 22 16:12:11.691119 2025] [:error] [pid 56080:tid 56131] [client 167.99.182.39:35232] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/swagger.json"] [unique_id "aUj9W5IHT3YJq9hjDc6ptwAAAwc"]
[Mon Dec 22 16:12:12.693032 2025] [:error] [pid 33564:tid 33581] [client 167.99.182.39:35234] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/@vite/env"] [unique_id "aUj9XASHeG6oLmMnKY5hwwAAAg4"]
[Mon Dec 22 16:12:13.683679 2025] [:error] [pid 58172:tid 58197] [client 167.99.182.39:35238] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/actuator/env"] [unique_id "aUj9XeSVKDT5jWOcnSWX0QAAANc"]
[Mon Dec 22 16:12:14.690926 2025] [:error] [pid 58172:tid 58181] [client 167.99.182.39:35244] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server"] [unique_id "aUj9XuSVKDT5jWOcnSWX2AAAAMc"]
[Mon Dec 22 16:12:15.687750 2025] [:error] [pid 33440:tid 33452] [client 167.99.182.39:35246] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aUj9X5OsUWKqgxu6QTTt7QAAAQo"]
[Mon Dec 22 16:12:17.686478 2025] [:error] [pid 33564:tid 33569] [client 167.99.182.39:38234] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about"] [unique_id "aUj9YQSHeG6oLmMnKY5hyQAAAgI"]
[Mon Dec 22 16:12:18.697309 2025] [:error] [pid 33440:tid 33454] [client 167.99.182.39:38238] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug/default/view"] [unique_id "aUj9YpOsUWKqgxu6QTTt8AAAAQw"]
[Mon Dec 22 16:12:19.696096 2025] [:error] [pid 33472:tid 33521] [client 167.99.182.39:38250] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/_catalog"] [unique_id "aUj9Y55p2WQpPIK8HAniuwAAAZQ"]
[Mon Dec 22 16:12:20.690363 2025] [:error] [pid 33564:tid 33584] [client 167.99.182.39:38252] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUj9ZASHeG6oLmMnKY5hzgAAAhE"]
[Mon Dec 22 16:12:21.695403 2025] [:error] [pid 33535:tid 33540] [client 167.99.182.39:38266] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-status"] [unique_id "aUj9ZWOCI8D9Xtn-n7R61gAAAcM"]
[Mon Dec 22 16:12:22.689668 2025] [:error] [pid 58078:tid 58104] [client 167.99.182.39:38278] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login.action"] [unique_id "aUj9ZpWKg9Bf8njHlB7oSAAAABU"]
[Mon Dec 22 16:12:23.695892 2025] [:error] [pid 33472:tid 33509] [client 167.99.182.39:38290] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_all_dbs"] [unique_id "aUj9Z55p2WQpPIK8HAnivQAAAYg"]
[Mon Dec 22 16:12:24.756857 2025] [:error] [pid 56080:tid 56140] [client 167.99.182.39:38304] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.DS_Store"] [unique_id "aUj9aJIHT3YJq9hjDc6pugAAAxA"]
[Mon Dec 22 16:12:25.817428 2025] [:error] [pid 58078:tid 58095] [client 167.99.182.39:38312] [client 167.99.182.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aUj9aZWKg9Bf8njHlB7oTQAAAAw"]
[Mon Dec 22 16:12:27.844175 2025] [:error] [pid 33471:tid 33475] [client 167.99.182.39:58186] [client 167.99.182.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aUj9a75BeNE7regJ7iwPkQAAAUE"]
[Mon Dec 22 16:12:28.715320 2025] [:error] [pid 33564:tid 33578] [client 167.99.182.39:58192] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUj9bASHeG6oLmMnKY5h2QAAAgs"]
[Mon Dec 22 16:12:29.733917 2025] [:error] [pid 33564:tid 33582] [client 167.99.182.39:58198] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.json"] [unique_id "aUj9bQSHeG6oLmMnKY5h3QAAAg8"]
[Mon Dec 22 16:12:30.722634 2025] [:error] [pid 33564:tid 33579] [client 167.99.182.39:58204] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/telescope/requests"] [unique_id "aUj9bgSHeG6oLmMnKY5h4gAAAgw"]
[Mon Dec 22 16:12:31.741866 2025] [:error] [pid 58078:tid 58085] [client 167.99.182.39:58216] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aUj9b5WKg9Bf8njHlB7oTwAAAAI"]
[Mon Dec 22 16:12:32.728984 2025] [:error] [pid 33564:tid 33576] [client 167.99.182.39:58228] [client 167.99.182.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUj9cASHeG6oLmMnKY5h5wAAAgk"]
[Mon Dec 22 20:34:44.932011 2025] [:error] [pid 33535:tid 33546] [client 43.138.68.113:54810] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUk65GOCI8D9Xtn-n7S_xQAAAck"]
[Mon Dec 22 22:31:18.417049 2025] [:error] [pid 58078:tid 58088] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Mon Dec 22 22:31:18.616456 2025] [:error] [pid 58078:tid 58093] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/an7.php
[Mon Dec 22 22:31:18.835835 2025] [:error] [pid 58078:tid 58087] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Mon Dec 22 22:31:19.348030 2025] [:error] [pid 58078:tid 58103] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/n.php
[Mon Dec 22 22:31:19.507561 2025] [:error] [pid 58078:tid 58092] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Mon Dec 22 22:31:19.666860 2025] [:error] [pid 58078:tid 58099] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/mds.php
[Mon Dec 22 22:31:19.831051 2025] [:error] [pid 58078:tid 58105] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Mon Dec 22 22:31:19.994949 2025] [:error] [pid 58078:tid 58096] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/admir.php
[Mon Dec 22 22:31:20.329302 2025] [:error] [pid 58078:tid 58091] [client 4.214.54.153:16325] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Mon Dec 22 22:31:20.487375 2025] [:error] [pid 58078:tid 58090] [client 4.214.54.153:16325] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aUlWOJWKg9Bf8njHlB5v7AAAAAc"]
[Mon Dec 22 22:31:21.052183 2025] [:error] [pid 33440:tid 33461] [client 4.214.54.153:43682] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aUlWOZOsUWKqgxu6QTRJOgAAARM"]
[Mon Dec 22 22:31:21.710050 2025] [:error] [pid 33440:tid 33463] [client 4.214.54.153:16337] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aUlWOZOsUWKqgxu6QTRJPQAAARU"]
[Mon Dec 22 22:31:22.106309 2025] [:error] [pid 58172:tid 58188] [client 4.214.54.153:43651] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/admin-post.php"] [unique_id "aUlWOuSVKDT5jWOcnSURBQAAAM4"]
[Mon Dec 22 22:31:22.822100 2025] [:error] [pid 58078:tid 58095] [client 4.214.54.153:16338] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aUlWOpWKg9Bf8njHlB5v7QAAAAw"]
[Mon Dec 22 22:31:24.238514 2025] [:error] [pid 58078:tid 58102] [client 4.214.54.153:43697] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aUlWPJWKg9Bf8njHlB5v7wAAABM"]
[Mon Dec 22 22:31:24.852071 2025] [:error] [pid 58078:tid 58089] [client 4.214.54.153:43707] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aUlWPJWKg9Bf8njHlB5v8QAAAAY"]
[Mon Dec 22 22:31:25.738814 2025] [:error] [pid 58078:tid 58087] [client 4.214.54.153:43683] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "aUlWPZWKg9Bf8njHlB5v9QAAAAQ"]
[Mon Dec 22 22:31:26.366842 2025] [:error] [pid 58078:tid 58092] [client 4.214.54.153:43667] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aUlWPpWKg9Bf8njHlB5v-gAAAAk"]
[Mon Dec 22 22:31:26.915655 2025] [:error] [pid 56044:tid 56062] [client 4.214.54.153:16333] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aUlWPu60uUaieriJqP1_6QAAAI4"]
[Mon Dec 22 22:31:28.549647 2025] [:error] [pid 33440:tid 33465] [client 4.214.54.153:43654] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aUlWQJOsUWKqgxu6QTRJQQAAARc"]
[Mon Dec 22 22:31:29.454727 2025] [:error] [pid 33564:tid 33589] [client 4.214.54.153:43673] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aUlWQQSHeG6oLmMnKY7e7QAAAhY"]
[Mon Dec 22 22:31:30.051543 2025] [:error] [pid 56155:tid 56240] [client 4.214.54.153:43705] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aUlWQmG8a3wQucsuN64HQwAAA5I"]
[Mon Dec 22 22:31:31.195142 2025] [:error] [pid 33472:tid 33524] [client 4.214.54.153:43658] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aUlWQ55p2WQpPIK8HAlKogAAAZc"]
[Mon Dec 22 22:31:32.114043 2025] [:error] [pid 56044:tid 56053] [client 4.214.54.153:43679] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aUlWRO60uUaieriJqP1_8QAAAIU"]
[Mon Dec 22 22:31:32.922117 2025] [:error] [pid 33535:tid 33540] [client 4.214.54.153:43700] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aUlWRGOCI8D9Xtn-n7TXIAAAAcM"]
[Mon Dec 22 22:31:34.028906 2025] [:error] [pid 56080:tid 56146] [client 4.214.54.153:16341] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aUlWRpIHT3YJq9hjDc78gwAAAxY"]
[Mon Dec 22 22:31:34.894481 2025] [:error] [pid 56080:tid 56138] [client 4.214.54.153:43687] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aUlWRpIHT3YJq9hjDc78hAAAAw4"]
[Mon Dec 22 22:31:35.611251 2025] [:error] [pid 58078:tid 58098] [client 4.214.54.153:43668] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aUlWR5WKg9Bf8njHlB5wDgAAAA8"]
[Mon Dec 22 22:31:37.151866 2025] [:error] [pid 33472:tid 33519] [client 4.214.54.153:16330] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aUlWSZ5p2WQpPIK8HAlKpQAAAZI"]
[Mon Dec 22 22:31:37.842424 2025] [:error] [pid 58078:tid 58087] [client 4.214.54.153:43693] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aUlWSZWKg9Bf8njHlB5wDwAAAAQ"]
[Mon Dec 22 22:31:39.022080 2025] [:error] [pid 56044:tid 56057] [client 4.214.54.153:16331] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aUlWS-60uUaieriJqP1_-AAAAIk"]
[Mon Dec 22 22:31:40.578798 2025] [:error] [pid 56155:tid 56235] [client 4.214.54.153:16362] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aUlWTGG8a3wQucsuN64HSgAAA40"]
[Mon Dec 22 22:31:42.034021 2025] [:error] [pid 33564:tid 33578] [client 4.214.54.153:43655] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aUlWTgSHeG6oLmMnKY7e9wAAAgs"]
[Mon Dec 22 22:31:42.865769 2025] [:error] [pid 33564:tid 33581] [client 4.214.54.153:43670] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aUlWTgSHeG6oLmMnKY7e-QAAAg4"]
[Mon Dec 22 22:31:43.387763 2025] [:error] [pid 33471:tid 33478] [client 4.214.54.153:43709] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aUlWT75BeNE7regJ7ixdtQAAAUQ"]
[Mon Dec 22 22:31:44.175514 2025] [:error] [pid 33471:tid 33494] [client 4.214.54.153:43694] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aUlWUL5BeNE7regJ7ixdtgAAAVQ"]
[Mon Dec 22 22:31:44.819372 2025] [:error] [pid 33472:tid 33522] [client 4.214.54.153:43708] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aUlWUJ5p2WQpPIK8HAlKrQAAAZU"]
[Mon Dec 22 22:31:46.216020 2025] [:error] [pid 33471:tid 33481] [client 4.214.54.153:43692] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aUlWUr5BeNE7regJ7ixduAAAAUc"]
[Mon Dec 22 22:31:47.470175 2025] [:error] [pid 58172:tid 58191] [client 4.214.54.153:16377] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aUlWU-SVKDT5jWOcnSURGgAAANE"]
[Mon Dec 22 22:31:48.699480 2025] [:error] [pid 58172:tid 58195] [client 4.214.54.153:43664] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aUlWVOSVKDT5jWOcnSURGwAAANU"]
[Mon Dec 22 22:31:49.525220 2025] [:error] [pid 56044:tid 56065] [client 4.214.54.153:16275] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aUlWVe60uUaieriJqP1__AAAAJE"]
[Mon Dec 22 22:31:50.389146 2025] [:error] [pid 56044:tid 56056] [client 4.214.54.153:16332] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aUlWVu60uUaieriJqP1__QAAAIg"]
[Mon Dec 22 22:31:51.322239 2025] [:error] [pid 33535:tid 33551] [client 4.214.54.153:16328] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aUlWV2OCI8D9Xtn-n7TXKwAAAc4"]
[Mon Dec 22 22:31:51.887465 2025] [:error] [pid 58172:tid 58188] [client 4.214.54.153:16347] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aUlWV-SVKDT5jWOcnSURIAAAAM4"]
[Mon Dec 22 22:31:53.136767 2025] [:error] [pid 58172:tid 58181] [client 4.214.54.153:16276] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aUlWWeSVKDT5jWOcnSURIwAAAMc"]
[Mon Dec 22 22:31:53.611136 2025] [:error] [pid 58078:tid 58107] [client 4.214.54.153:43663] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aUlWWZWKg9Bf8njHlB5wGAAAABg"]
[Mon Dec 22 22:31:54.585899 2025] [:error] [pid 33440:tid 33454] [client 4.214.54.153:16327] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aUlWWpOsUWKqgxu6QTRJRwAAAQw"]
[Mon Dec 22 22:31:55.663484 2025] [:error] [pid 56044:tid 56058] [client 4.214.54.153:43699] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aUlWW-60uUaieriJqP2AAwAAAIo"]
[Mon Dec 22 22:31:57.070375 2025] [:error] [pid 33564:tid 33576] [client 4.214.54.153:43671] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aUlWXQSHeG6oLmMnKY7e_gAAAgk"]
[Mon Dec 22 22:31:57.689397 2025] [:error] [pid 33535:tid 33538] [client 4.214.54.153:16274] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/NewFile.php"] [unique_id "aUlWXWOCI8D9Xtn-n7TXLwAAAcE"]
[Mon Dec 22 22:31:58.401313 2025] [:error] [pid 33535:tid 33547] [client 4.214.54.153:43689] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/NewFile.php"] [unique_id "aUlWXmOCI8D9Xtn-n7TXMwAAAco"]
[Mon Dec 22 22:31:58.872245 2025] [:error] [pid 33564:tid 33577] [client 4.214.54.153:43698] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/NewFile.php"] [unique_id "aUlWXgSHeG6oLmMnKY7fAgAAAgo"]
[Mon Dec 22 22:31:59.425613 2025] [:error] [pid 33472:tid 33506] [client 4.214.54.153:43703] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/NewFile.php"] [unique_id "aUlWX55p2WQpPIK8HAlKtAAAAYU"]
[Mon Dec 22 22:32:00.111591 2025] [:error] [pid 33535:tid 33558] [client 4.214.54.153:43659] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-x7.php"] [unique_id "aUlWYGOCI8D9Xtn-n7TXNQAAAdU"]
[Mon Dec 22 22:32:00.797760 2025] [:error] [pid 33535:tid 33559] [client 4.214.54.153:43665] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-x7.php"] [unique_id "aUlWYGOCI8D9Xtn-n7TXNgAAAdY"]
[Mon Dec 22 22:32:01.379897 2025] [:error] [pid 33440:tid 33445] [client 4.214.54.153:43710] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-x7.php"] [unique_id "aUlWYZOsUWKqgxu6QTRJTAAAAQM"]
[Mon Dec 22 22:32:02.618867 2025] [:error] [pid 33440:tid 33447] [client 4.214.54.153:16342] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-x7.php"] [unique_id "aUlWYpOsUWKqgxu6QTRJTQAAAQU"]
[Mon Dec 22 22:32:03.774955 2025] [:error] [pid 56080:tid 56124] [client 4.214.54.153:16343] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aUlWY5IHT3YJq9hjDc78lwAAAwA"]
[Mon Dec 22 22:32:04.581885 2025] [:error] [pid 33535:tid 33545] [client 4.214.54.153:16324] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aUlWZGOCI8D9Xtn-n7TXNwAAAcg"]
[Mon Dec 22 22:32:05.619784 2025] [:error] [pid 56155:tid 56228] [client 4.214.54.153:43653] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aUlWZWG8a3wQucsuN64HVQAAA4Y"]
[Mon Dec 22 22:32:06.982484 2025] [:error] [pid 33564:tid 33582] [client 4.214.54.153:43676] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aUlWZgSHeG6oLmMnKY7fCAAAAg8"]
[Mon Dec 22 22:32:07.603083 2025] [:error] [pid 33564:tid 33575] [client 4.214.54.153:16364] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aUlWZwSHeG6oLmMnKY7fDAAAAgg"]
[Mon Dec 22 22:32:08.106153 2025] [:error] [pid 33564:tid 33588] [client 4.214.54.153:43685] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aUlWaASHeG6oLmMnKY7fEQAAAhU"]
[Mon Dec 22 22:32:08.978298 2025] [:error] [pid 33535:tid 33543] [client 4.214.54.153:43696] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aUlWaGOCI8D9Xtn-n7TXOAAAAcY"]
[Mon Dec 22 22:32:10.283150 2025] [:error] [pid 33535:tid 33557] [client 4.214.54.153:16370] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aUlWamOCI8D9Xtn-n7TXOwAAAdQ"]
[Mon Dec 22 22:32:11.166042 2025] [:error] [pid 33472:tid 33524] [client 4.214.54.153:16326] [client 4.214.54.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aUlWa55p2WQpPIK8HAlKywAAAZc"]
[Mon Dec 22 22:32:11.705085 2025] [:error] [pid 33564:tid 33584] [client 4.214.54.153:16283] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/system.php"] [unique_id "aUlWawSHeG6oLmMnKY7fFAAAAhE"]
[Mon Dec 22 22:32:12.697988 2025] [:error] [pid 33471:tid 33495] [client 4.214.54.153:43701] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/system.php"] [unique_id "aUlWbL5BeNE7regJ7ixdvwAAAVU"]
[Mon Dec 22 22:32:13.777123 2025] [:error] [pid 33440:tid 33453] [client 4.214.54.153:16349] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/system.php"] [unique_id "aUlWbZOsUWKqgxu6QTRJUwAAAQs"]
[Mon Dec 22 22:32:14.530079 2025] [:error] [pid 33564:tid 33582] [client 4.214.54.153:43649] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aUlWbgSHeG6oLmMnKY7fGAAAAg8"]
[Mon Dec 22 22:32:15.291345 2025] [:error] [pid 33471:tid 33498] [client 4.214.54.153:43648] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aUlWb75BeNE7regJ7ixdxQAAAVg"]
[Mon Dec 22 22:32:15.951335 2025] [:error] [pid 33535:tid 33558] [client 4.214.54.153:43704] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aUlWb2OCI8D9Xtn-n7TXRAAAAdU"]
[Mon Dec 22 22:32:16.339783 2025] [:error] [pid 33564:tid 33588] [client 4.214.54.153:16352] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aUlWcASHeG6oLmMnKY7fHwAAAhU"]
[Mon Dec 22 22:32:17.318797 2025] [:error] [pid 33564:tid 33579] [client 4.214.54.153:43711] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/555.php"] [unique_id "aUlWcQSHeG6oLmMnKY7fIAAAAgw"]
[Mon Dec 22 22:32:17.884566 2025] [:error] [pid 33564:tid 33572] [client 4.214.54.153:16373] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/555.php"] [unique_id "aUlWcQSHeG6oLmMnKY7fIgAAAgU"]
[Mon Dec 22 22:32:18.718016 2025] [:error] [pid 33471:tid 33481] [client 4.214.54.153:16279] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/555.php"] [unique_id "aUlWcr5BeNE7regJ7ixdxwAAAUc"]
[Mon Dec 22 22:32:19.288372 2025] [:error] [pid 58078:tid 58095] [client 4.214.54.153:16272] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/555.php"] [unique_id "aUlWc5WKg9Bf8njHlB5wMwAAAAw"]
[Mon Dec 22 22:32:19.885946 2025] [:error] [pid 33564:tid 33569] [client 4.214.54.153:16361] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/AxAo.php"] [unique_id "aUlWcwSHeG6oLmMnKY7fJwAAAgI"]
[Mon Dec 22 22:32:20.414534 2025] [:error] [pid 58078:tid 58107] [client 4.214.54.153:43678] File does not exist: /usr/local/apache/htdocs/suspended-page/AxAo.php
[Mon Dec 22 22:32:20.695200 2025] [:error] [pid 58078:tid 58092] [client 4.214.54.153:43678] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Mon Dec 22 22:32:20.855164 2025] [:error] [pid 58078:tid 58104] [client 4.214.54.153:43678] File does not exist: /usr/local/apache/htdocs/suspended-page/nc.php
[Mon Dec 22 22:32:21.026004 2025] [:error] [pid 58078:tid 58084] [client 4.214.54.153:43678] File does not exist: /usr/local/apache/htdocs/suspended-page/file1.php
[Mon Dec 22 22:32:21.191908 2025] [:error] [pid 58078:tid 58097] [client 4.214.54.153:43678] File does not exist: /usr/local/apache/htdocs/suspended-page/file32.php
[Mon Dec 22 22:32:21.355049 2025] [:error] [pid 58078:tid 58083] [client 4.214.54.153:43678] File does not exist: /usr/local/apache/htdocs/suspended-page/hook.php
[Mon Dec 22 22:32:21.511777 2025] [:error] [pid 58078:tid 58094] [client 4.214.54.153:43678] [client 4.214.54.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aUlWdZWKg9Bf8njHlB5wOwAAAAs"]
[Mon Dec 22 22:32:22.050393 2025] [:error] [pid 56044:tid 56054] [client 4.214.54.153:43695] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Mon Dec 22 22:32:22.192024 2025] [:error] [pid 56044:tid 56049] [client 4.214.54.153:43695] File does not exist: /usr/local/apache/htdocs/suspended-page/sto.php
[Mon Dec 22 22:32:22.331566 2025] [:error] [pid 56044:tid 56055] [client 4.214.54.153:43695] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Mon Dec 22 22:32:22.573433 2025] [:error] [pid 56044:tid 56072] [client 4.214.54.153:43695] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Mon Dec 22 22:32:22.707275 2025] [:error] [pid 56044:tid 56061] [client 4.214.54.153:43695] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aUlWdu60uUaieriJqP2ADgAAAI0"]
[Mon Dec 22 22:32:23.740980 2025] [:error] [pid 33472:tid 33511] [client 4.214.54.153:16277] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aUlWd55p2WQpPIK8HAlK2AAAAYo"]
[Mon Dec 22 22:32:24.259018 2025] [:error] [pid 33472:tid 33506] [client 4.214.54.153:16355] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aUlWeJ5p2WQpPIK8HAlK2wAAAYU"]
[Mon Dec 22 22:32:25.074881 2025] [:error] [pid 33440:tid 33464] [client 4.214.54.153:43666] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aUlWeZOsUWKqgxu6QTRJZgAAARY"]
[Mon Dec 22 22:32:25.610358 2025] [:error] [pid 33564:tid 33581] [client 4.214.54.153:16358] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/up.php"] [unique_id "aUlWeQSHeG6oLmMnKY7fLAAAAg4"]
[Mon Dec 22 22:32:26.519190 2025] [:error] [pid 56044:tid 56060] [client 4.214.54.153:16376] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/up.php"] [unique_id "aUlWeu60uUaieriJqP2AEAAAAIw"]
[Mon Dec 22 22:32:26.924025 2025] [:error] [pid 58172:tid 58174] [client 4.214.54.153:16322] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/up.php"] [unique_id "aUlWeuSVKDT5jWOcnSURMgAAAMA"]
[Mon Dec 22 22:32:29.075940 2025] [:error] [pid 33471:tid 33496] [client 4.214.54.153:16323] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/up.php"] [unique_id "aUlWfb5BeNE7regJ7ixd0gAAAVY"]
[Mon Dec 22 22:32:29.849406 2025] [:error] [pid 33564:tid 33567] [client 4.214.54.153:16329] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aUlWfQSHeG6oLmMnKY7fNwAAAgA"]
[Mon Dec 22 22:32:30.423101 2025] [:error] [pid 33440:tid 33447] [client 4.214.54.153:16345] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aUlWfpOsUWKqgxu6QTRJagAAAQU"]
[Mon Dec 22 22:32:30.821464 2025] [:error] [pid 33440:tid 33448] [client 4.214.54.153:43677] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aUlWfpOsUWKqgxu6QTRJawAAAQY"]
[Mon Dec 22 22:32:31.648920 2025] [:error] [pid 58078:tid 58088] [client 4.214.54.153:16271] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aUlWf5WKg9Bf8njHlB5wQAAAAAU"]
[Mon Dec 22 22:32:33.109088 2025] [:error] [pid 33472:tid 33509] [client 4.214.54.153:16374] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aUlWgZ5p2WQpPIK8HAlK4gAAAYg"]
[Mon Dec 22 22:32:33.866718 2025] [:error] [pid 56044:tid 56065] [client 4.214.54.153:16320] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aUlWge60uUaieriJqP2AGgAAAJE"]
[Mon Dec 22 22:32:34.813315 2025] [:error] [pid 58172:tid 58182] [client 4.214.54.153:43675] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aUlWguSVKDT5jWOcnSUROgAAAMg"]
[Mon Dec 22 22:32:36.187859 2025] [:error] [pid 58078:tid 58106] [client 4.214.54.153:43690] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aUlWhJWKg9Bf8njHlB5wRwAAABc"]
[Mon Dec 22 22:32:36.857805 2025] [:error] [pid 58172:tid 58198] [client 4.214.54.153:16292] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wb.php"] [unique_id "aUlWhOSVKDT5jWOcnSURPwAAANg"]
[Mon Dec 22 22:32:37.773225 2025] [:error] [pid 33564:tid 33580] [client 4.214.54.153:16382] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wb.php"] [unique_id "aUlWhQSHeG6oLmMnKY7fSAAAAg0"]
[Mon Dec 22 22:32:38.366992 2025] [:error] [pid 56080:tid 56143] [client 4.214.54.153:16363] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wb.php"] [unique_id "aUlWhpIHT3YJq9hjDc78oQAAAxM"]
[Mon Dec 22 22:32:39.166989 2025] [:error] [pid 56080:tid 56130] [client 4.214.54.153:16346] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wb.php"] [unique_id "aUlWh5IHT3YJq9hjDc78ogAAAwY"]
[Mon Dec 22 22:32:39.640430 2025] [:error] [pid 33564:tid 33588] [client 4.214.54.153:43702] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aUlWhwSHeG6oLmMnKY7fUAAAAhU"]
[Mon Dec 22 22:32:40.472627 2025] [:error] [pid 56044:tid 56070] [client 4.214.54.153:16286] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aUlWiO60uUaieriJqP2AHgAAAJY"]
[Mon Dec 22 22:32:41.069431 2025] [:error] [pid 56155:tid 56225] [client 4.214.54.153:43684] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aUlWiWG8a3wQucsuN64HdQAAA4M"]
[Mon Dec 22 22:32:42.163484 2025] [:error] [pid 58078:tid 58105] [client 4.214.54.153:43650] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aUlWipWKg9Bf8njHlB5wSwAAABY"]
[Mon Dec 22 22:32:42.924493 2025] [:error] [pid 58172:tid 58198] [client 4.214.54.153:16366] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aUlWiuSVKDT5jWOcnSURSgAAANg"]
[Mon Dec 22 22:32:43.809190 2025] [:error] [pid 56080:tid 56134] [client 4.214.54.153:16371] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aUlWi5IHT3YJq9hjDc78pQAAAwo"]
[Mon Dec 22 22:32:44.758535 2025] [:error] [pid 58172:tid 58180] [client 4.214.54.153:16268] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aUlWjOSVKDT5jWOcnSURTQAAAMY"]
[Mon Dec 22 22:32:46.003344 2025] [:error] [pid 33440:tid 33457] [client 4.214.54.153:43686] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aUlWjpOsUWKqgxu6QTRJdAAAAQ8"]
[Mon Dec 22 22:32:47.857208 2025] [:error] [pid 56080:tid 56141] [client 4.214.54.153:16369] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aUlWj5IHT3YJq9hjDc78qAAAAxE"]
[Mon Dec 22 22:32:48.734848 2025] [:error] [pid 33535:tid 33549] [client 4.214.54.153:16350] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aUlWkGOCI8D9Xtn-n7TXSgAAAcw"]
[Mon Dec 22 22:32:49.500443 2025] [:error] [pid 33471:tid 33475] [client 4.214.54.153:16353] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aUlWkb5BeNE7regJ7ixd4gAAAUE"]
[Mon Dec 22 22:32:50.735856 2025] [:error] [pid 33535:tid 33538] [client 4.214.54.153:43660] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aUlWkmOCI8D9Xtn-n7TXTAAAAcE"]
[Mon Dec 22 22:32:51.594312 2025] [:error] [pid 33471:tid 33483] [client 4.214.54.153:16216] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aUlWk75BeNE7regJ7ixd5wAAAUk"]
[Mon Dec 22 22:32:52.335088 2025] [:error] [pid 56080:tid 56132] [client 4.214.54.153:16339] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aUlWlJIHT3YJq9hjDc78qwAAAwg"]
[Mon Dec 22 22:32:53.130175 2025] [:error] [pid 33471:tid 33474] [client 4.214.54.153:16218] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aUlWlb5BeNE7regJ7ixd7AAAAUA"]
[Mon Dec 22 22:32:53.748498 2025] [:error] [pid 33471:tid 33480] [client 4.214.54.153:16368] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aUlWlb5BeNE7regJ7ixd7wAAAUY"]
[Mon Dec 22 22:32:54.566629 2025] [:error] [pid 33472:tid 33516] [client 4.214.54.153:16334] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aUlWlp5p2WQpPIK8HAlLTwAAAY8"]
[Mon Dec 22 22:32:55.166253 2025] [:error] [pid 58172:tid 58186] [client 4.214.54.153:16289] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aUlWl-SVKDT5jWOcnSURVAAAAMw"]
[Mon Dec 22 22:32:56.030056 2025] [:error] [pid 33440:tid 33443] [client 4.214.54.153:16198] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aUlWmJOsUWKqgxu6QTRJhwAAAQE"]
[Mon Dec 22 22:32:56.594081 2025] [:error] [pid 58078:tid 58085] [client 4.214.54.153:16360] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aUlWmJWKg9Bf8njHlB5wYwAAAAI"]
[Mon Dec 22 22:32:57.149598 2025] [:error] [pid 33471:tid 33476] [client 4.214.54.153:16303] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/indo.php"] [unique_id "aUlWmb5BeNE7regJ7ixd9wAAAUI"]
[Mon Dec 22 22:32:57.886224 2025] [:error] [pid 56044:tid 56067] [client 4.214.54.153:16359] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/indo.php"] [unique_id "aUlWme60uUaieriJqP2AKAAAAJM"]
[Mon Dec 22 22:32:58.880544 2025] [:error] [pid 56044:tid 56062] [client 4.214.54.153:16301] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/indo.php"] [unique_id "aUlWmu60uUaieriJqP2AKQAAAI4"]
[Mon Dec 22 22:33:00.790404 2025] [:error] [pid 56155:tid 56232] [client 4.214.54.153:16273] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/indo.php"] [unique_id "aUlWnGG8a3wQucsuN64HvwAAA4o"]
[Mon Dec 22 22:33:01.926348 2025] [:error] [pid 33440:tid 33452] [client 4.214.54.153:16319] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/card.php"] [unique_id "aUlWnZOsUWKqgxu6QTRJjwAAAQo"]
[Mon Dec 22 22:33:03.222763 2025] [:error] [pid 58172:tid 58179] [client 4.214.54.153:43688] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/card.php"] [unique_id "aUlWn-SVKDT5jWOcnSURWwAAAMU"]
[Mon Dec 22 22:33:04.094601 2025] [:error] [pid 58078:tid 58084] [client 4.214.54.153:16357] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/card.php"] [unique_id "aUlWoJWKg9Bf8njHlB5wawAAAAE"]
[Mon Dec 22 22:33:05.669385 2025] [:error] [pid 33440:tid 33448] [client 4.214.54.153:16302] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/card.php"] [unique_id "aUlWoZOsUWKqgxu6QTRJkwAAAQY"]
[Mon Dec 22 22:33:06.844066 2025] [:error] [pid 56080:tid 56144] [client 4.214.54.153:43680] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aUlWopIHT3YJq9hjDc78ugAAAxQ"]
[Mon Dec 22 22:33:08.108323 2025] [:error] [pid 33440:tid 33442] [client 4.214.54.153:16299] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aUlWpJOsUWKqgxu6QTRJlwAAAQA"]
[Mon Dec 22 22:33:09.692664 2025] [:error] [pid 33564:tid 33589] [client 4.214.54.153:16354] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aUlWpQSHeG6oLmMnKY7fkQAAAhY"]
[Mon Dec 22 22:33:10.257814 2025] [:error] [pid 56080:tid 56127] [client 4.214.54.153:16264] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aUlWppIHT3YJq9hjDc78vgAAAwM"]
[Mon Dec 22 22:33:12.210992 2025] [:error] [pid 56044:tid 56056] [client 4.214.54.153:16312] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mnkalo.php"] [unique_id "aUlWqO60uUaieriJqP2AMwAAAIg"]
[Mon Dec 22 22:33:12.946673 2025] [:error] [pid 56044:tid 56053] [client 4.214.54.153:16335] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mnkalo.php"] [unique_id "aUlWqO60uUaieriJqP2ANQAAAIU"]
[Mon Dec 22 22:33:14.018218 2025] [:error] [pid 58172:tid 58175] [client 4.214.54.153:16383] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mnkalo.php"] [unique_id "aUlWquSVKDT5jWOcnSURXAAAAME"]
[Mon Dec 22 22:33:16.825140 2025] [:error] [pid 58078:tid 58093] [client 4.214.54.153:16196] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mnkalo.php"] [unique_id "aUlWrJWKg9Bf8njHlB5wfwAAAAo"]
[Mon Dec 22 22:33:17.625825 2025] [:error] [pid 33564:tid 33583] [client 4.214.54.153:16207] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aUlWrQSHeG6oLmMnKY7flAAAAhA"]
[Mon Dec 22 22:33:18.907707 2025] [:error] [pid 33564:tid 33578] [client 4.214.54.153:16285] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aUlWrgSHeG6oLmMnKY7flgAAAgs"]
[Mon Dec 22 22:33:19.440632 2025] [:error] [pid 33564:tid 33569] [client 4.214.54.153:43675] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aUlWrwSHeG6oLmMnKY7fmAAAAgI"]
[Mon Dec 22 22:33:19.835320 2025] [:error] [pid 56044:tid 56071] [client 4.214.54.153:16380] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aUlWr-60uUaieriJqP2AOQAAAJc"]
[Mon Dec 22 22:33:20.185591 2025] [:error] [pid 58172:tid 58190] [client 4.214.54.153:16375] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file3.php"] [unique_id "aUlWsOSVKDT5jWOcnSURYwAAANA"]
[Mon Dec 22 22:33:21.149477 2025] [:error] [pid 33535:tid 33561] [client 4.214.54.153:16365] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file3.php"] [unique_id "aUlWsWOCI8D9Xtn-n7TXYgAAAdg"]
[Mon Dec 22 22:33:21.837973 2025] [:error] [pid 58078:tid 58097] [client 4.214.54.153:16379] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file3.php"] [unique_id "aUlWsZWKg9Bf8njHlB5wgQAAAA4"]
[Mon Dec 22 22:33:23.131952 2025] [:error] [pid 33535:tid 33538] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Mon Dec 22 22:33:23.390092 2025] [:error] [pid 33535:tid 33542] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/031.php
[Mon Dec 22 22:33:23.530303 2025] [:error] [pid 33535:tid 33556] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/mws.php
[Mon Dec 22 22:33:23.705746 2025] [:error] [pid 33535:tid 33547] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/dlu.php
[Mon Dec 22 22:33:23.842155 2025] [:error] [pid 33535:tid 33539] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Mon Dec 22 22:33:23.978450 2025] [:error] [pid 33535:tid 33550] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Mon Dec 22 22:33:24.117903 2025] [:error] [pid 33535:tid 33553] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the1me.php
[Mon Dec 22 22:33:24.303859 2025] [:error] [pid 33535:tid 33558] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Mon Dec 22 22:33:24.439136 2025] [:error] [pid 33535:tid 33559] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Mon Dec 22 22:33:24.580126 2025] [:error] [pid 33535:tid 33554] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Dec 22 22:33:24.930982 2025] [:error] [pid 33535:tid 33541] [client 4.214.54.153:16291] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Mon Dec 22 22:33:25.372651 2025] [:error] [pid 33535:tid 33546] [client 4.214.54.153:16291] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aUlWtWOCI8D9Xtn-n7TXcwAAAck"]
[Mon Dec 22 22:33:26.083716 2025] [:error] [pid 33535:tid 33557] [client 4.214.54.153:16300] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aUlWtmOCI8D9Xtn-n7TXdAAAAdQ"]
[Mon Dec 22 22:33:27.145980 2025] [:error] [pid 33472:tid 33513] [client 4.214.54.153:16356] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aUlWt55p2WQpPIK8HAlLWgAAAYw"]
[Mon Dec 22 22:33:27.837353 2025] [:error] [pid 33472:tid 33520] [client 4.214.54.153:16242] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aUlWt55p2WQpPIK8HAlLXAAAAZM"]
[Mon Dec 22 22:33:28.525704 2025] [:error] [pid 56044:tid 56072] [client 4.214.54.153:16348] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aUlWuO60uUaieriJqP2APQAAAJg"]
[Mon Dec 22 22:33:29.639140 2025] [:error] [pid 33564:tid 33591] [client 4.214.54.153:16205] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aUlWuQSHeG6oLmMnKY7foAAAAhg"]
[Mon Dec 22 22:33:30.334897 2025] [:error] [pid 56080:tid 56126] [client 4.214.54.153:43691] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aUlWupIHT3YJq9hjDc78xAAAAwI"]
[Mon Dec 22 22:33:30.932003 2025] [:error] [pid 33564:tid 33578] [client 4.214.54.153:16318] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aUlWugSHeG6oLmMnKY7fowAAAgs"]
[Mon Dec 22 22:33:31.633939 2025] [:error] [pid 58172:tid 58179] [client 4.214.54.153:16378] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aUlWu-SVKDT5jWOcnSURZwAAAMU"]
[Mon Dec 22 22:33:32.262797 2025] [:error] [pid 33535:tid 33538] [client 4.214.54.153:16340] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aUlWvGOCI8D9Xtn-n7TXdgAAAcE"]
[Mon Dec 22 22:33:32.804418 2025] [:error] [pid 58172:tid 58182] [client 4.214.54.153:16256] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aUlWvOSVKDT5jWOcnSURawAAAMg"]
[Mon Dec 22 22:33:33.548412 2025] [:error] [pid 33535:tid 33550] [client 4.214.54.153:16244] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aUlWvWOCI8D9Xtn-n7TXegAAAc0"]
[Mon Dec 22 22:33:34.253930 2025] [:error] [pid 58172:tid 58197] [client 4.214.54.153:16269] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hk.php"] [unique_id "aUlWvuSVKDT5jWOcnSURbgAAANc"]
[Mon Dec 22 22:33:34.998111 2025] [:error] [pid 33535:tid 33543] [client 4.214.54.153:16224] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hk.php"] [unique_id "aUlWvmOCI8D9Xtn-n7TXfAAAAcY"]
[Mon Dec 22 22:33:35.610093 2025] [:error] [pid 33535:tid 33554] [client 4.214.54.153:16203] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hk.php"] [unique_id "aUlWv2OCI8D9Xtn-n7TXfgAAAdE"]
[Mon Dec 22 22:33:36.405074 2025] [:error] [pid 33535:tid 33551] [client 4.214.54.153:43652] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hk.php"] [unique_id "aUlWwGOCI8D9Xtn-n7TXgAAAAc4"]
[Mon Dec 22 22:33:37.106913 2025] [:error] [pid 58172:tid 58175] [client 4.214.54.153:43672] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yas.php"] [unique_id "aUlWweSVKDT5jWOcnSUReAAAAME"]
[Mon Dec 22 22:33:37.974497 2025] [:error] [pid 33440:tid 33449] [client 4.214.54.153:43656] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yas.php"] [unique_id "aUlWwZOsUWKqgxu6QTRJngAAAQc"]
[Mon Dec 22 22:33:39.208865 2025] [:error] [pid 33535:tid 33549] [client 4.214.54.153:16321] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yas.php"] [unique_id "aUlWw2OCI8D9Xtn-n7TXhgAAAcw"]
[Mon Dec 22 22:33:39.754114 2025] [:error] [pid 58172:tid 58197] [client 4.214.54.153:16217] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yas.php"] [unique_id "aUlWw-SVKDT5jWOcnSURegAAANc"]
[Mon Dec 22 22:33:41.152543 2025] [:error] [pid 56080:tid 56148] [client 4.214.54.153:16280] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aUlWxZIHT3YJq9hjDc78xQAAAxg"]
[Mon Dec 22 22:33:41.781490 2025] [:error] [pid 56080:tid 56144] [client 4.214.54.153:16296] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aUlWxZIHT3YJq9hjDc78xgAAAxQ"]
[Mon Dec 22 22:33:42.503864 2025] [:error] [pid 33564:tid 33581] [client 4.214.54.153:16259] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aUlWxgSHeG6oLmMnKY7fqAAAAg4"]
[Mon Dec 22 22:33:43.657525 2025] [:error] [pid 56080:tid 56125] [client 4.214.54.153:16215] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aUlWx5IHT3YJq9hjDc78yAAAAwE"]
[Mon Dec 22 22:33:45.116933 2025] [:error] [pid 56080:tid 56146] [client 4.214.54.153:43674] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gr.php"] [unique_id "aUlWyZIHT3YJq9hjDc78yQAAAxY"]
[Mon Dec 22 22:33:46.262747 2025] [:error] [pid 33535:tid 33554] [client 4.214.54.153:16263] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gr.php"] [unique_id "aUlWymOCI8D9Xtn-n7TXjgAAAdE"]
[Mon Dec 22 22:33:47.348819 2025] [:error] [pid 33564:tid 33588] [client 4.214.54.153:16282] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gr.php"] [unique_id "aUlWywSHeG6oLmMnKY7frgAAAhU"]
[Mon Dec 22 22:33:48.298558 2025] [:error] [pid 33564:tid 33578] [client 4.214.54.153:16204] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-gr.php"] [unique_id "aUlWzASHeG6oLmMnKY7fsAAAAgs"]
[Mon Dec 22 22:33:49.289756 2025] [:error] [pid 33472:tid 33522] [client 4.214.54.153:16201] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/owl.php"] [unique_id "aUlWzZ5p2WQpPIK8HAlLYwAAAZU"]
[Mon Dec 22 22:33:50.589431 2025] [:error] [pid 56080:tid 56141] [client 4.214.54.153:16311] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/owl.php"] [unique_id "aUlWzpIHT3YJq9hjDc78zQAAAxE"]
[Mon Dec 22 22:33:51.674656 2025] [:error] [pid 33535:tid 33549] [client 4.214.54.153:16220] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/owl.php"] [unique_id "aUlWz2OCI8D9Xtn-n7TXmwAAAcw"]
[Mon Dec 22 22:33:52.623413 2025] [:error] [pid 33471:tid 33483] [client 4.214.54.153:16267] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/owl.php"] [unique_id "aUlW0L5BeNE7regJ7ixeAAAAAUk"]
[Mon Dec 22 22:33:54.034129 2025] [:error] [pid 33440:tid 33443] [client 4.214.54.153:16293] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mo.php"] [unique_id "aUlW0pOsUWKqgxu6QTRJqwAAAQE"]
[Mon Dec 22 22:33:55.631638 2025] [:error] [pid 33564:tid 33575] [client 4.214.54.153:16261] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mo.php"] [unique_id "aUlW0wSHeG6oLmMnKY7fugAAAgg"]
[Mon Dec 22 22:33:56.230634 2025] [:error] [pid 58172:tid 58187] [client 4.214.54.153:16211] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mo.php"] [unique_id "aUlW1OSVKDT5jWOcnSURjAAAAM0"]
[Mon Dec 22 22:33:57.071959 2025] [:error] [pid 56044:tid 56049] [client 4.214.54.153:16344] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mo.php"] [unique_id "aUlW1e60uUaieriJqP2ARwAAAIE"]
[Mon Dec 22 22:33:57.988904 2025] [:error] [pid 33472:tid 33523] [client 4.214.54.153:16297] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aUlW1Z5p2WQpPIK8HAlLZwAAAZY"]
[Mon Dec 22 22:33:58.800344 2025] [:error] [pid 58172:tid 58174] [client 4.214.54.153:43706] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aUlW1uSVKDT5jWOcnSURjwAAAMA"]
[Mon Dec 22 22:33:59.797217 2025] [:error] [pid 56080:tid 56128] [client 4.214.54.153:43662] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aUlW15IHT3YJq9hjDc78zwAAAwQ"]
[Mon Dec 22 22:34:00.889827 2025] [:error] [pid 33472:tid 33507] [client 4.214.54.153:16290] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aUlW2J5p2WQpPIK8HAlLawAAAYY"]
[Mon Dec 22 22:34:01.589126 2025] [:error] [pid 33564:tid 33591] [client 4.214.54.153:16228] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ok.php"] [unique_id "aUlW2QSHeG6oLmMnKY7fwAAAAhg"]
[Mon Dec 22 22:34:02.167121 2025] [:error] [pid 33564:tid 33584] [client 4.214.54.153:16309] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ok.php"] [unique_id "aUlW2gSHeG6oLmMnKY7fxAAAAhE"]
[Mon Dec 22 22:34:02.714809 2025] [:error] [pid 33472:tid 33512] [client 4.214.54.153:16234] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ok.php"] [unique_id "aUlW2p5p2WQpPIK8HAlLcAAAAYs"]
[Mon Dec 22 22:34:04.100877 2025] [:error] [pid 56044:tid 56053] [client 4.214.54.153:16266] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ok.php"] [unique_id "aUlW3O60uUaieriJqP2ATAAAAIU"]
[Mon Dec 22 22:34:04.976718 2025] [:error] [pid 33440:tid 33463] [client 4.214.54.153:16208] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/444.php"] [unique_id "aUlW3JOsUWKqgxu6QTRJsAAAARU"]
[Mon Dec 22 22:34:05.680691 2025] [:error] [pid 56044:tid 56064] [client 4.214.54.153:16193] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/444.php"] [unique_id "aUlW3e60uUaieriJqP2ATQAAAJA"]
[Mon Dec 22 22:34:06.234758 2025] [:error] [pid 33564:tid 33580] [client 4.214.54.153:16245] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/444.php"] [unique_id "aUlW3gSHeG6oLmMnKY7fyAAAAg0"]
[Mon Dec 22 22:34:08.653690 2025] [:error] [pid 33564:tid 33590] [client 4.214.54.153:16142] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/444.php"] [unique_id "aUlW4ASHeG6oLmMnKY7fygAAAhc"]
[Mon Dec 22 22:34:10.072180 2025] [:error] [pid 33440:tid 33459] [client 4.214.54.153:16287] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-903.php"] [unique_id "aUlW4pOsUWKqgxu6QTRJtAAAARE"]
[Mon Dec 22 22:34:11.319962 2025] [:error] [pid 56155:tid 56229] [client 4.214.54.153:16260] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-903.php"] [unique_id "aUlW42G8a3wQucsuN64H2wAAA4c"]
[Mon Dec 22 22:34:12.266679 2025] [:error] [pid 56044:tid 56050] [client 4.214.54.153:16316] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-903.php"] [unique_id "aUlW5O60uUaieriJqP2AUQAAAII"]
[Mon Dec 22 22:34:12.945655 2025] [:error] [pid 33535:tid 33546] [client 4.214.54.153:16202] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-903.php"] [unique_id "aUlW5GOCI8D9Xtn-n7TXpwAAAck"]
[Mon Dec 22 22:34:14.147341 2025] [:error] [pid 56155:tid 56221] [client 4.214.54.153:16219] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aUlW5mG8a3wQucsuN64H4QAAA4A"]
[Mon Dec 22 22:34:15.108520 2025] [:error] [pid 33440:tid 33450] [client 4.214.54.153:16270] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aUlW55OsUWKqgxu6QTRJtwAAAQg"]
[Mon Dec 22 22:34:16.495376 2025] [:error] [pid 56044:tid 56072] [client 4.214.54.153:16306] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aUlW6O60uUaieriJqP2AVAAAAJg"]
[Mon Dec 22 22:34:17.658868 2025] [:error] [pid 56044:tid 56059] [client 4.214.54.153:16212] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aUlW6e60uUaieriJqP2AVQAAAIs"]
[Mon Dec 22 22:34:18.419202 2025] [:error] [pid 56044:tid 56066] [client 4.214.54.153:16281] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nij.php"] [unique_id "aUlW6u60uUaieriJqP2AWAAAAJI"]
[Mon Dec 22 22:34:19.373316 2025] [:error] [pid 56155:tid 56223] [client 4.214.54.153:16372] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nij.php"] [unique_id "aUlW62G8a3wQucsuN64H5gAAA4E"]
[Mon Dec 22 22:34:20.158094 2025] [:error] [pid 33564:tid 33590] [client 4.214.54.153:16247] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nij.php"] [unique_id "aUlW7ASHeG6oLmMnKY7f0QAAAhc"]
[Mon Dec 22 22:34:20.625142 2025] [:error] [pid 58172:tid 58180] [client 4.214.54.153:16335] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nij.php"] [unique_id "aUlW7OSVKDT5jWOcnSURpAAAAMY"]
[Mon Dec 22 22:34:22.183644 2025] [:error] [pid 56044:tid 56050] [client 4.214.54.153:16248] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aUlW7u60uUaieriJqP2AXAAAAII"]
[Mon Dec 22 22:34:23.428249 2025] [:error] [pid 33471:tid 33481] [client 4.214.54.153:16262] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aUlW775BeNE7regJ7ixeEQAAAUc"]
[Mon Dec 22 22:34:24.711935 2025] [:error] [pid 58172:tid 58185] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Mon Dec 22 22:34:24.834637 2025] [:error] [pid 58172:tid 58174] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Mon Dec 22 22:34:25.370416 2025] [:error] [pid 58172:tid 58191] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Mon Dec 22 22:34:25.987973 2025] [:error] [pid 58172:tid 58198] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Mon Dec 22 22:34:26.173939 2025] [:error] [pid 58172:tid 58184] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/lo.php
[Mon Dec 22 22:34:26.407197 2025] [:error] [pid 58172:tid 58195] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/wpls.php
[Mon Dec 22 22:34:26.558566 2025] [:error] [pid 58172:tid 58179] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/geck.php
[Mon Dec 22 22:34:26.723517 2025] [:error] [pid 58172:tid 58186] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/inde.php
[Mon Dec 22 22:34:26.875850 2025] [:error] [pid 58172:tid 58196] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/777.php
[Mon Dec 22 22:34:27.084966 2025] [:error] [pid 58172:tid 58194] [client 4.214.54.153:16336] File does not exist: /usr/local/apache/htdocs/suspended-page/luxe.php
[Mon Dec 22 22:34:27.247749 2025] [:error] [pid 58172:tid 58175] [client 4.214.54.153:16336] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aUlW8-SVKDT5jWOcnSURugAAAME"]
[Mon Dec 22 22:34:28.650962 2025] [:error] [pid 33564:tid 33570] [client 4.214.54.153:16305] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aUlW9ASHeG6oLmMnKY7f2gAAAgM"]
[Mon Dec 22 22:34:30.958137 2025] [:error] [pid 58172:tid 58189] [client 4.214.54.153:16158] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aUlW9uSVKDT5jWOcnSURvAAAAM8"]
[Mon Dec 22 22:34:32.118466 2025] [:error] [pid 58172:tid 58198] [client 4.214.54.153:16313] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aUlW-OSVKDT5jWOcnSURvgAAANg"]
[Mon Dec 22 22:34:33.590203 2025] [:error] [pid 56044:tid 56067] [client 4.214.54.153:16251] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxin.php"] [unique_id "aUlW-e60uUaieriJqP2AYQAAAJM"]
[Mon Dec 22 22:34:34.479262 2025] [:error] [pid 33472:tid 33522] [client 4.214.54.153:16381] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxin.php"] [unique_id "aUlW-p5p2WQpPIK8HAlLdwAAAZU"]
[Mon Dec 22 22:34:36.101890 2025] [:error] [pid 58172:tid 58185] [client 4.214.54.153:16307] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxin.php"] [unique_id "aUlW_OSVKDT5jWOcnSURxwAAAMs"]
[Mon Dec 22 22:34:37.484631 2025] [:error] [pid 33535:tid 33548] [client 4.214.54.153:16232] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxin.php"] [unique_id "aUlW_WOCI8D9Xtn-n7TXsgAAAcs"]
[Mon Dec 22 22:34:38.536454 2025] [:error] [pid 56080:tid 56129] [client 4.214.54.153:16246] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xtt.php"] [unique_id "aUlW_pIHT3YJq9hjDc784QAAAwU"]
[Mon Dec 22 22:34:39.369085 2025] [:error] [pid 33440:tid 33456] [client 4.214.54.153:43661] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xtt.php"] [unique_id "aUlW_5OsUWKqgxu6QTRJwwAAAQ4"]
[Mon Dec 22 22:34:40.470886 2025] [:error] [pid 56155:tid 56229] [client 4.214.54.153:16255] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xtt.php"] [unique_id "aUlXAGG8a3wQucsuN64H7gAAA4c"]
[Mon Dec 22 22:34:41.332296 2025] [:error] [pid 58078:tid 58083] [client 4.214.54.153:16317] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xtt.php"] [unique_id "aUlXAZWKg9Bf8njHlB5wygAAAAA"]
[Mon Dec 22 22:34:42.195851 2025] [:error] [pid 33564:tid 33576] [client 4.214.54.153:16294] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aUlXAgSHeG6oLmMnKY7f5wAAAgk"]
[Mon Dec 22 22:34:43.990416 2025] [:error] [pid 58078:tid 58095] [client 4.214.54.153:16192] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aUlXA5WKg9Bf8njHlB5wzAAAAAw"]
[Mon Dec 22 22:34:45.150888 2025] [:error] [pid 56155:tid 56226] [client 4.214.54.153:16132] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aUlXBWG8a3wQucsuN64H8QAAA4Q"]
[Mon Dec 22 22:34:45.789704 2025] [:error] [pid 33535:tid 33537] [client 4.214.54.153:16199] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aUlXBWOCI8D9Xtn-n7TXtQAAAcA"]
[Mon Dec 22 22:34:47.039285 2025] [:error] [pid 58078:tid 58087] [client 4.214.54.153:16295] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/noe.php"] [unique_id "aUlXB5WKg9Bf8njHlB5wzwAAAAQ"]
[Mon Dec 22 22:34:48.238269 2025] [:error] [pid 58078:tid 58096] [client 4.214.54.153:16209] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/noe.php"] [unique_id "aUlXCJWKg9Bf8njHlB5w1AAAAA0"]
[Mon Dec 22 22:34:49.581410 2025] [:error] [pid 58078:tid 58099] [client 4.214.54.153:16298] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/noe.php"] [unique_id "aUlXCZWKg9Bf8njHlB5w2QAAABA"]
[Mon Dec 22 22:34:50.510272 2025] [:error] [pid 58078:tid 58105] [client 4.214.54.153:16231] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/noe.php"] [unique_id "aUlXCpWKg9Bf8njHlB5w2gAAABY"]
[Mon Dec 22 22:34:52.681441 2025] [:error] [pid 33535:tid 33560] [client 4.214.54.153:43669] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aUlXDGOCI8D9Xtn-n7TXuQAAAdc"]
[Mon Dec 22 22:34:53.518172 2025] [:error] [pid 33472:tid 33518] [client 4.214.54.153:16315] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aUlXDZ5p2WQpPIK8HAlLggAAAZE"]
[Mon Dec 22 22:34:54.597635 2025] [:error] [pid 56044:tid 56065] [client 4.214.54.153:16278] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aUlXDu60uUaieriJqP2AaAAAAJE"]
[Mon Dec 22 22:34:55.098057 2025] [:error] [pid 56044:tid 56066] [client 4.214.54.153:16221] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class20.php"] [unique_id "aUlXD-60uUaieriJqP2AaQAAAJI"]
[Mon Dec 22 22:34:55.761467 2025] [:error] [pid 56080:tid 56143] [client 4.214.54.153:16071] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shellalfa.php"] [unique_id "aUlXD5IHT3YJq9hjDc786AAAAxM"]
[Mon Dec 22 22:34:56.588214 2025] [:error] [pid 33471:tid 33488] [client 4.214.54.153:16156] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shellalfa.php"] [unique_id "aUlXEL5BeNE7regJ7ixeIgAAAU4"]
[Mon Dec 22 22:34:57.370725 2025] [:error] [pid 33535:tid 33544] [client 4.214.54.153:16139] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shellalfa.php"] [unique_id "aUlXEWOCI8D9Xtn-n7TXugAAAcc"]
[Mon Dec 22 22:34:57.972153 2025] [:error] [pid 58172:tid 58191] [client 4.214.54.153:16222] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shellalfa.php"] [unique_id "aUlXEeSVKDT5jWOcnSUR5QAAANE"]
[Mon Dec 22 22:34:58.539071 2025] [:error] [pid 58172:tid 58183] [client 4.214.54.153:16090] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/te.php"] [unique_id "aUlXEuSVKDT5jWOcnSUR5wAAAMk"]
[Mon Dec 22 22:34:59.867325 2025] [:error] [pid 33472:tid 33503] [client 4.214.54.153:16240] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/te.php"] [unique_id "aUlXE55p2WQpPIK8HAlLhwAAAYI"]
[Mon Dec 22 22:35:00.676972 2025] [:error] [pid 58172:tid 58194] [client 4.214.54.153:16194] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/te.php"] [unique_id "aUlXFOSVKDT5jWOcnSUR6QAAANQ"]
[Mon Dec 22 22:35:02.870677 2025] [:error] [pid 33471:tid 33493] [client 4.214.54.153:16137] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/te.php"] [unique_id "aUlXFr5BeNE7regJ7ixeJQAAAVM"]
[Mon Dec 22 22:35:05.156051 2025] [:error] [pid 33440:tid 33447] [client 4.214.54.153:16152] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aUlXGZOsUWKqgxu6QTRJ1gAAAQU"]
[Mon Dec 22 22:35:06.124270 2025] [:error] [pid 33564:tid 33570] [client 4.214.54.153:16195] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aUlXGgSHeG6oLmMnKY7f9AAAAgM"]
[Mon Dec 22 22:35:08.211023 2025] [:error] [pid 58172:tid 58178] [client 4.214.54.153:16073] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aUlXHOSVKDT5jWOcnSUR7QAAAMQ"]
[Mon Dec 22 22:35:10.535478 2025] [:error] [pid 33440:tid 33464] [client 4.214.54.153:16257] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aUlXHpOsUWKqgxu6QTRJ2wAAARY"]
[Mon Dec 22 22:35:14.188707 2025] [:error] [pid 33440:tid 33445] [client 4.214.54.153:16230] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aUlXIpOsUWKqgxu6QTRJ3gAAAQM"]
[Mon Dec 22 22:35:15.862107 2025] [:error] [pid 33440:tid 33465] [client 4.214.54.153:16258] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aUlXI5OsUWKqgxu6QTRJ4QAAARc"]
[Mon Dec 22 22:35:18.391642 2025] [:error] [pid 33440:tid 33444] [client 4.214.54.153:16067] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aUlXJpOsUWKqgxu6QTRJ5gAAAQI"]
[Mon Dec 22 22:35:21.153882 2025] [:error] [pid 33440:tid 33454] [client 4.214.54.153:16253] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aUlXKZOsUWKqgxu6QTRJ6gAAAQw"]
[Mon Dec 22 22:35:21.640290 2025] [:error] [pid 58078:tid 58107] [client 4.214.54.153:16308] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cccc.php"] [unique_id "aUlXKZWKg9Bf8njHlB5xAgAAABg"]
[Mon Dec 22 22:35:24.777491 2025] [:error] [pid 58172:tid 58179] [client 4.214.54.153:16226] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cccc.php"] [unique_id "aUlXLOSVKDT5jWOcnSUR9QAAAMU"]
[Mon Dec 22 22:35:25.670433 2025] [:error] [pid 33471:tid 33492] [client 4.214.54.153:16186] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cccc.php"] [unique_id "aUlXLb5BeNE7regJ7ixeNAAAAVI"]
[Mon Dec 22 22:35:26.761666 2025] [:error] [pid 33471:tid 33480] [client 4.214.54.153:16190] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cccc.php"] [unique_id "aUlXLr5BeNE7regJ7ixeNgAAAUY"]
[Mon Dec 22 22:35:27.670561 2025] [:error] [pid 58078:tid 58097] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Mon Dec 22 22:35:27.801658 2025] [:error] [pid 58078:tid 58105] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Mon Dec 22 22:35:27.940332 2025] [:error] [pid 58078:tid 58092] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/v4.php
[Mon Dec 22 22:35:28.075622 2025] [:error] [pid 58078:tid 58094] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Mon Dec 22 22:35:28.212440 2025] [:error] [pid 58078:tid 58095] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Mon Dec 22 22:35:28.355799 2025] [:error] [pid 58078:tid 58087] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Mon Dec 22 22:35:28.491789 2025] [:error] [pid 58078:tid 58091] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/gelap.php
[Mon Dec 22 22:35:28.790937 2025] [:error] [pid 58078:tid 58093] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon Dec 22 22:35:28.925952 2025] [:error] [pid 58078:tid 58084] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Mon Dec 22 22:35:29.077969 2025] [:error] [pid 58078:tid 58086] [client 4.214.54.153:16249] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Dec 22 22:35:29.360508 2025] [:error] [pid 58078:tid 58090] [client 4.214.54.153:16249] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aUlXMZWKg9Bf8njHlB5xFwAAAAc"]
[Mon Dec 22 22:35:30.828124 2025] [:error] [pid 33472:tid 33520] [client 4.214.54.153:16235] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aUlXMp5p2WQpPIK8HAlLmAAAAZM"]
[Mon Dec 22 22:35:32.388005 2025] [:error] [pid 33535:tid 33549] [client 4.214.54.153:16178] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aUlXNGOCI8D9Xtn-n7TX1wAAAcw"]
[Mon Dec 22 22:35:32.889727 2025] [:error] [pid 56044:tid 56056] [client 4.214.54.153:16197] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aUlXNO60uUaieriJqP2AegAAAIg"]
[Mon Dec 22 22:35:34.117648 2025] [:error] [pid 58172:tid 58176] [client 4.214.54.153:16149] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v.php"] [unique_id "aUlXNuSVKDT5jWOcnSUR-wAAAMI"]
[Mon Dec 22 22:35:35.585169 2025] [:error] [pid 33472:tid 33523] [client 4.214.54.153:16213] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v.php"] [unique_id "aUlXN55p2WQpPIK8HAlLmQAAAZY"]
[Mon Dec 22 22:35:36.555608 2025] [:error] [pid 56155:tid 56232] [client 4.214.54.153:16214] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v.php"] [unique_id "aUlXOGG8a3wQucsuN64IAwAAA4o"]
[Mon Dec 22 22:35:37.452609 2025] [:error] [pid 58172:tid 58178] [client 4.214.54.153:16337] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v.php"] [unique_id "aUlXOeSVKDT5jWOcnSUR_QAAAMQ"]
[Mon Dec 22 22:35:38.693417 2025] [:error] [pid 33440:tid 33455] [client 4.214.54.153:16284] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aUlXOpOsUWKqgxu6QTRJ7wAAAQ0"]
[Mon Dec 22 22:35:42.559654 2025] [:error] [pid 33472:tid 33501] [client 4.214.54.153:43683] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aUlXPp5p2WQpPIK8HAlLngAAAYA"]
[Mon Dec 22 22:35:44.762453 2025] [:error] [pid 33535:tid 33540] [client 4.214.54.153:16233] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aUlXQGOCI8D9Xtn-n7TX4QAAAcM"]
[Mon Dec 22 22:35:46.078980 2025] [:error] [pid 33472:tid 33509] [client 4.214.54.153:16314] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aUlXQp5p2WQpPIK8HAlLogAAAYg"]
[Mon Dec 22 22:35:47.118234 2025] [:error] [pid 33535:tid 33543] [client 4.214.54.153:43700] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aUlXQ2OCI8D9Xtn-n7TX5AAAAcY"]
[Mon Dec 22 22:35:47.670930 2025] [:error] [pid 56080:tid 56135] [client 4.214.54.153:16333] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aUlXQ5IHT3YJq9hjDc79AgAAAws"]
[Mon Dec 22 22:35:48.508839 2025] [:error] [pid 33535:tid 33551] [client 4.214.54.153:43697] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aUlXRGOCI8D9Xtn-n7TX5wAAAc4"]
[Mon Dec 22 22:35:49.409074 2025] [:error] [pid 33564:tid 33584] [client 4.214.54.153:16088] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aUlXRQSHeG6oLmMnKY7gJwAAAhE"]
[Mon Dec 22 22:35:50.826707 2025] [:error] [pid 58078:tid 58097] [client 4.214.54.153:16250] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aUlXRpWKg9Bf8njHlB5xMAAAAA4"]
[Mon Dec 22 22:35:51.631934 2025] [:error] [pid 56044:tid 56054] [client 4.214.54.153:16330] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aUlXR-60uUaieriJqP2AiQAAAIY"]
[Mon Dec 22 22:35:53.511367 2025] [:error] [pid 33472:tid 33525] [client 4.214.54.153:16367] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aUlXSZ5p2WQpPIK8HAlLpQAAAZg"]
[Mon Dec 22 22:35:54.405611 2025] [:error] [pid 33440:tid 33465] [client 4.214.54.153:16288] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aUlXSpOsUWKqgxu6QTRJ-wAAARc"]
[Mon Dec 22 22:35:55.193341 2025] [:error] [pid 58172:tid 58184] [client 4.214.54.153:43709] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aUlXS-SVKDT5jWOcnSUSCAAAAMo"]
[Mon Dec 22 22:35:55.812765 2025] [:error] [pid 56044:tid 56055] [client 4.214.54.153:16146] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aUlXS-60uUaieriJqP2AjAAAAIc"]
[Mon Dec 22 22:35:56.869915 2025] [:error] [pid 33535:tid 33555] [client 4.214.54.153:16238] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aUlXTGOCI8D9Xtn-n7TX8AAAAdI"]
[Mon Dec 22 22:35:58.123982 2025] [:error] [pid 33535:tid 33553] [client 4.214.54.153:43658] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/g.php"] [unique_id "aUlXTmOCI8D9Xtn-n7TX9AAAAdA"]
[Mon Dec 22 22:35:59.313407 2025] [:error] [pid 56044:tid 56048] [client 4.214.54.153:16347] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/static/as.php"] [unique_id "aUlXT-60uUaieriJqP2AkwAAAIA"]
[Mon Dec 22 22:36:00.748203 2025] [:error] [pid 33535:tid 33548] [client 4.214.54.153:16167] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/static/as.php"] [unique_id "aUlXUGOCI8D9Xtn-n7TX9wAAAcs"]
[Mon Dec 22 22:36:02.751398 2025] [:error] [pid 33535:tid 33544] [client 4.214.54.153:43705] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/static/as.php"] [unique_id "aUlXUmOCI8D9Xtn-n7TX-QAAAcc"]
[Mon Dec 22 22:36:03.696088 2025] [:error] [pid 56080:tid 56127] [client 4.214.54.153:16078] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/static/as.php"] [unique_id "aUlXU5IHT3YJq9hjDc79CgAAAwM"]
[Mon Dec 22 22:36:04.613548 2025] [:error] [pid 33564:tid 33577] [client 4.214.54.153:43654] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aUlXVASHeG6oLmMnKY7gSgAAAgo"]
[Mon Dec 22 22:36:05.199982 2025] [:error] [pid 33472:tid 33517] [client 4.214.54.153:16131] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aUlXVZ5p2WQpPIK8HAlLqgAAAZA"]
[Mon Dec 22 22:36:06.108872 2025] [:error] [pid 58172:tid 58191] [client 4.214.54.153:16362] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aUlXVuSVKDT5jWOcnSUSEAAAANE"]
[Mon Dec 22 22:36:06.687749 2025] [:error] [pid 33471:tid 33477] [client 4.214.54.153:16185] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aUlXVr5BeNE7regJ7ixeUgAAAUM"]
[Mon Dec 22 22:36:08.273790 2025] [:error] [pid 58078:tid 58083] [client 4.214.54.153:16155] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aUlXWJWKg9Bf8njHlB5xSQAAAAA"]
[Mon Dec 22 22:36:09.197182 2025] [:error] [pid 33564:tid 33589] [client 4.214.54.153:16348] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aUlXWQSHeG6oLmMnKY7gUQAAAhY"]
[Mon Dec 22 22:36:10.815606 2025] [:error] [pid 33472:tid 33507] [client 4.214.54.153:16157] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aUlXWp5p2WQpPIK8HAlLtAAAAYY"]
[Mon Dec 22 22:36:12.511907 2025] [:error] [pid 58078:tid 58088] [client 4.214.54.153:16354] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aUlXXJWKg9Bf8njHlB5xTAAAAAU"]
[Mon Dec 22 22:36:13.352270 2025] [:error] [pid 58078:tid 58107] [client 4.214.54.153:16099] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUlXXZWKg9Bf8njHlB5xTgAAABg"]
[Mon Dec 22 22:36:14.112509 2025] [:error] [pid 33535:tid 33544] [client 4.214.54.153:16331] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUlXXmOCI8D9Xtn-n7TYAAAAAcc"]
[Mon Dec 22 22:36:14.830995 2025] [:error] [pid 56155:tid 56230] [client 4.214.54.153:43699] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUlXXmG8a3wQucsuN64IFQAAA4g"]
[Mon Dec 22 22:36:15.844828 2025] [:error] [pid 33535:tid 33555] [client 4.214.54.153:16066] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aUlXX2OCI8D9Xtn-n7TYAgAAAdI"]
[Mon Dec 22 22:36:17.056169 2025] [:error] [pid 33471:tid 33496] [client 4.214.54.153:16083] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/33.php"] [unique_id "aUlXYb5BeNE7regJ7ixeVAAAAVY"]
[Mon Dec 22 22:36:17.947787 2025] [:error] [pid 58078:tid 58104] [client 4.214.54.153:16165] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/33.php"] [unique_id "aUlXYZWKg9Bf8njHlB5xVgAAABU"]
[Mon Dec 22 22:36:18.916710 2025] [:error] [pid 33564:tid 33579] [client 4.214.54.153:16343] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/33.php"] [unique_id "aUlXYgSHeG6oLmMnKY7gWAAAAgw"]
[Mon Dec 22 22:36:20.063093 2025] [:error] [pid 56044:tid 56062] [client 4.214.54.153:16325] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/33.php"] [unique_id "aUlXZO60uUaieriJqP2AmwAAAI4"]
[Mon Dec 22 22:36:20.750749 2025] [:error] [pid 56044:tid 56064] [client 4.214.54.153:16174] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/o.php"] [unique_id "aUlXZO60uUaieriJqP2AnAAAAJA"]
[Mon Dec 22 22:36:21.862268 2025] [:error] [pid 58078:tid 58092] [client 4.214.54.153:16231] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/o.php"] [unique_id "aUlXZZWKg9Bf8njHlB5xXQAAAAk"]
[Mon Dec 22 22:36:22.620641 2025] [:error] [pid 56155:tid 56228] [client 4.214.54.153:43696] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/o.php"] [unique_id "aUlXZmG8a3wQucsuN64IGgAAA4Y"]
[Mon Dec 22 22:36:23.610369 2025] [:error] [pid 58172:tid 58197] [client 4.214.54.153:16326] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/o.php"] [unique_id "aUlXZ-SVKDT5jWOcnSUSHAAAANc"]
[Mon Dec 22 22:36:24.318890 2025] [:error] [pid 33472:tid 33503] [client 4.214.54.153:16141] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wcas.php"] [unique_id "aUlXaJ5p2WQpPIK8HAlLuQAAAYI"]
[Mon Dec 22 22:36:25.276178 2025] [:error] [pid 33535:tid 33557] [client 4.214.54.153:16070] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wcas.php"] [unique_id "aUlXaWOCI8D9Xtn-n7TYCQAAAdQ"]
[Mon Dec 22 22:36:26.064410 2025] [:error] [pid 58078:tid 58090] [client 4.214.54.153:16170] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wcas.php"] [unique_id "aUlXapWKg9Bf8njHlB5xZQAAAAc"]
[Mon Dec 22 22:36:27.932625 2025] [:error] [pid 58172:tid 58181] [client 4.214.54.153:16169] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wcas.php"] [unique_id "aUlXa-SVKDT5jWOcnSUSIQAAAMc"]
[Mon Dec 22 22:36:29.596010 2025] [:error] [pid 33471:tid 33489] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Mon Dec 22 22:36:29.749209 2025] [:error] [pid 33471:tid 33486] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Mon Dec 22 22:36:30.243139 2025] [:error] [pid 33471:tid 33492] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Mon Dec 22 22:36:30.390052 2025] [:error] [pid 33471:tid 33498] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/lol.php
[Mon Dec 22 22:36:30.556034 2025] [:error] [pid 33471:tid 33480] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/fileas.php
[Mon Dec 22 22:36:30.710293 2025] [:error] [pid 33471:tid 33484] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/n3.php
[Mon Dec 22 22:36:30.950008 2025] [:error] [pid 33471:tid 33485] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Dec 22 22:36:31.354922 2025] [:error] [pid 33471:tid 33477] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Mon Dec 22 22:36:31.712435 2025] [:error] [pid 33471:tid 33479] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv2.php
[Mon Dec 22 22:36:31.899711 2025] [:error] [pid 33471:tid 33487] [client 4.214.54.153:16136] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-is.php
[Mon Dec 22 22:36:32.067760 2025] [:error] [pid 33471:tid 33474] [client 4.214.54.153:16136] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ava.php"] [unique_id "aUlXcL5BeNE7regJ7ixeawAAAUA"]
[Mon Dec 22 22:36:34.306939 2025] [:error] [pid 33564:tid 33583] [client 4.214.54.153:16324] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ava.php"] [unique_id "aUlXcgSHeG6oLmMnKY7gZAAAAhA"]
[Mon Dec 22 22:36:37.375290 2025] [:error] [pid 56155:tid 56240] [client 4.214.54.153:16210] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ava.php"] [unique_id "aUlXdWG8a3wQucsuN64IJQAAA5I"]
[Mon Dec 22 22:36:38.020739 2025] [:error] [pid 33440:tid 33450] [client 4.214.54.153:16341] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ava.php"] [unique_id "aUlXdpOsUWKqgxu6QTRKLwAAAQg"]
[Mon Dec 22 22:36:39.635605 2025] [:error] [pid 33472:tid 33508] [client 4.214.54.153:43671] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aUlXd55p2WQpPIK8HAlLyQAAAYc"]
[Mon Dec 22 22:36:40.516325 2025] [:error] [pid 58078:tid 58091] [client 4.214.54.153:43659] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aUlXeJWKg9Bf8njHlB5xdgAAAAg"]
[Mon Dec 22 22:36:41.926262 2025] [:error] [pid 33472:tid 33506] [client 4.214.54.153:43667] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aUlXeZ5p2WQpPIK8HAlLywAAAYU"]
[Mon Dec 22 22:36:42.966369 2025] [:error] [pid 33440:tid 33454] [client 4.214.54.153:16200] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aUlXepOsUWKqgxu6QTRKNAAAAQw"]
[Mon Dec 22 22:36:44.497881 2025] [:error] [pid 33535:tid 33545] [client 4.214.54.153:43682] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell1.php"] [unique_id "aUlXfGOCI8D9Xtn-n7TYEwAAAcg"]
[Mon Dec 22 22:36:45.617642 2025] [:error] [pid 33471:tid 33477] [client 4.214.54.153:43663] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell1.php"] [unique_id "aUlXfb5BeNE7regJ7ixedgAAAUM"]
[Mon Dec 22 22:36:46.873039 2025] [:error] [pid 56155:tid 56233] [client 4.214.54.153:43685] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell1.php"] [unique_id "aUlXfmG8a3wQucsuN64ILAAAA4s"]
[Mon Dec 22 22:36:48.758167 2025] [:error] [pid 58078:tid 58105] [client 4.214.54.153:43655] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell1.php"] [unique_id "aUlXgJWKg9Bf8njHlB5xfQAAABY"]
[Mon Dec 22 22:36:51.258369 2025] [:error] [pid 33471:tid 33496] [client 4.214.54.153:16129] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gdn.php"] [unique_id "aUlXg75BeNE7regJ7ixeegAAAVY"]
[Mon Dec 22 22:36:51.931961 2025] [:error] [pid 33535:tid 33554] [client 4.214.54.153:43695] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gdn.php"] [unique_id "aUlXg2OCI8D9Xtn-n7TYHgAAAdE"]
[Mon Dec 22 22:36:52.913161 2025] [:error] [pid 33472:tid 33516] [client 4.214.54.153:16236] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gdn.php"] [unique_id "aUlXhJ5p2WQpPIK8HAlL2AAAAY8"]
[Mon Dec 22 22:36:53.576463 2025] [:error] [pid 33564:tid 33571] [client 4.214.54.153:16361] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gdn.php"] [unique_id "aUlXhQSHeG6oLmMnKY7gcAAAAgQ"]
[Mon Dec 22 22:36:54.359204 2025] [:error] [pid 33564:tid 33588] [client 4.214.54.153:16377] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aUlXhgSHeG6oLmMnKY7gdAAAAhU"]
[Mon Dec 22 22:36:57.128193 2025] [:error] [pid 58172:tid 58187] [client 4.214.54.153:16130] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aUlXieSVKDT5jWOcnSUSNgAAAM0"]
[Mon Dec 22 22:36:58.056651 2025] [:error] [pid 33564:tid 33571] [client 4.214.54.153:16150] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aUlXigSHeG6oLmMnKY7gfgAAAgQ"]
[Mon Dec 22 22:36:59.245189 2025] [:error] [pid 58078:tid 58092] [client 4.214.54.153:16138] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aUlXi5WKg9Bf8njHlB5xiQAAAAk"]
[Mon Dec 22 22:37:00.215864 2025] [:error] [pid 58172:tid 58189] [client 4.214.54.153:16327] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aUlXjOSVKDT5jWOcnSUSOwAAAM8"]
[Mon Dec 22 22:37:00.561561 2025] [:error] [pid 33440:tid 33442] [client 4.214.54.153:43687] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aUlXjJOsUWKqgxu6QTRKQAAAAQA"]
[Mon Dec 22 22:37:01.608096 2025] [:error] [pid 58078:tid 58085] [client 4.214.54.153:43664] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aUlXjZWKg9Bf8njHlB5xjgAAAAI"]
[Mon Dec 22 22:37:02.880526 2025] [:error] [pid 56080:tid 56135] [client 4.214.54.153:16339] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aUlXjpIHT3YJq9hjDc79KAAAAws"]
[Mon Dec 22 22:37:04.004694 2025] [:error] [pid 33472:tid 33519] [client 4.214.54.153:43648] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUlXkJ5p2WQpPIK8HAlL3QAAAZI"]
[Mon Dec 22 22:37:04.870404 2025] [:error] [pid 33472:tid 33505] [client 4.214.54.153:16276] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUlXkJ5p2WQpPIK8HAlL3gAAAYQ"]
[Mon Dec 22 22:37:05.240705 2025] [:error] [pid 33564:tid 33568] [client 4.214.54.153:43670] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUlXkQSHeG6oLmMnKY7ghwAAAgE"]
[Mon Dec 22 22:37:05.876364 2025] [:error] [pid 56044:tid 56055] [client 4.214.54.153:16323] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aUlXke60uUaieriJqP2AuwAAAIc"]
[Mon Dec 22 22:37:06.590321 2025] [:error] [pid 58078:tid 58084] [client 4.214.54.153:16274] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd67.php"] [unique_id "aUlXkpWKg9Bf8njHlB5xlAAAAAE"]
[Mon Dec 22 22:37:07.589318 2025] [:error] [pid 58078:tid 58106] [client 4.214.54.153:43660] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd67.php"] [unique_id "aUlXk5WKg9Bf8njHlB5xlwAAABc"]
[Mon Dec 22 22:37:08.555543 2025] [:error] [pid 56080:tid 56147] [client 4.214.54.153:16140] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd67.php"] [unique_id "aUlXlJIHT3YJq9hjDc79LQAAAxc"]
[Mon Dec 22 22:37:09.980094 2025] [:error] [pid 33472:tid 33517] [client 4.214.54.153:43703] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd67.php"] [unique_id "aUlXlZ5p2WQpPIK8HAlL5AAAAZA"]
[Mon Dec 22 22:37:11.314483 2025] [:error] [pid 58172:tid 58198] [client 4.214.54.153:16168] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aUlXl-SVKDT5jWOcnSUSQgAAANg"]
[Mon Dec 22 22:37:12.659289 2025] [:error] [pid 33472:tid 33519] [client 4.214.54.153:16218] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aUlXmJ5p2WQpPIK8HAlL5QAAAZI"]
[Mon Dec 22 22:37:14.151656 2025] [:error] [pid 56080:tid 56137] [client 4.214.54.153:43673] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aUlXmpIHT3YJq9hjDc79MgAAAw0"]
[Mon Dec 22 22:37:15.567722 2025] [:error] [pid 58078:tid 58106] [client 4.214.54.153:16225] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aUlXm5WKg9Bf8njHlB5xoAAAABc"]
[Mon Dec 22 22:37:16.869163 2025] [:error] [pid 58172:tid 58174] [client 4.214.54.153:43684] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aUlXnOSVKDT5jWOcnSUSTQAAAMA"]
[Mon Dec 22 22:37:17.709614 2025] [:error] [pid 58172:tid 58197] [client 4.214.54.153:16382] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aUlXneSVKDT5jWOcnSUSUQAAANc"]
[Mon Dec 22 22:37:18.249094 2025] [:error] [pid 33471:tid 33479] [client 4.214.54.153:16338] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aUlXnr5BeNE7regJ7ixegQAAAUU"]
[Mon Dec 22 22:37:19.342854 2025] [:error] [pid 58172:tid 58179] [client 4.214.54.153:16332] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aUlXn-SVKDT5jWOcnSUSUwAAAMU"]
[Mon Dec 22 22:37:22.320255 2025] [:error] [pid 56155:tid 56230] [client 4.214.54.153:43681] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/usep.php"] [unique_id "aUlXomG8a3wQucsuN64IPQAAA4g"]
[Mon Dec 22 22:37:25.262889 2025] [:error] [pid 33440:tid 33456] [client 4.214.54.153:16320] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/usep.php"] [unique_id "aUlXpZOsUWKqgxu6QTRKUgAAAQ4"]
[Mon Dec 22 22:37:26.146465 2025] [:error] [pid 33564:tid 33567] [client 4.214.54.153:43702] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/usep.php"] [unique_id "aUlXpgSHeG6oLmMnKY7gkwAAAgA"]
[Mon Dec 22 22:37:28.909745 2025] [:error] [pid 58172:tid 58198] [client 4.214.54.153:16285] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/usep.php"] [unique_id "aUlXqOSVKDT5jWOcnSUSWgAAANg"]
[Mon Dec 22 22:37:30.584143 2025] [:error] [pid 33471:tid 33477] [client 4.214.54.153:43653] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/auth.php"] [unique_id "aUlXqr5BeNE7regJ7ixeiQAAAUM"]
[Mon Dec 22 22:37:32.557792 2025] [:error] [pid 33564:tid 33583] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Mon Dec 22 22:37:32.843241 2025] [:error] [pid 33564:tid 33577] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/hello.php
[Mon Dec 22 22:37:32.977245 2025] [:error] [pid 33564:tid 33573] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/abt.php
[Mon Dec 22 22:37:33.191282 2025] [:error] [pid 33564:tid 33590] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/jmfi2.php
[Mon Dec 22 22:37:33.326357 2025] [:error] [pid 33564:tid 33567] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Mon Dec 22 22:37:33.464073 2025] [:error] [pid 33564:tid 33569] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Mon Dec 22 22:37:33.601191 2025] [:error] [pid 33564:tid 33581] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Mon Dec 22 22:37:34.025236 2025] [:error] [pid 33564:tid 33585] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/nope.php
[Mon Dec 22 22:37:34.157006 2025] [:error] [pid 33564:tid 33584] [client 4.214.54.153:43657] File does not exist: /usr/local/apache/htdocs/suspended-page/js.php
[Mon Dec 22 22:37:34.466873 2025] [:error] [pid 33564:tid 33570] [client 4.214.54.153:43657] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/media.php"] [unique_id "aUlXrgSHeG6oLmMnKY7gqgAAAgM"]
[Mon Dec 22 22:37:35.729741 2025] [:error] [pid 33564:tid 33571] [client 4.214.54.153:16169] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/media.php"] [unique_id "aUlXrwSHeG6oLmMnKY7grAAAAgQ"]
[Mon Dec 22 22:37:37.454451 2025] [:error] [pid 58172:tid 58181] [client 4.214.54.153:16144] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/media.php"] [unique_id "aUlXseSVKDT5jWOcnSUSaAAAAMc"]
[Mon Dec 22 22:37:38.271458 2025] [:error] [pid 58172:tid 58195] [client 4.214.54.153:16359] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/media.php"] [unique_id "aUlXsuSVKDT5jWOcnSUSbQAAANU"]
[Mon Dec 22 22:37:40.025538 2025] [:error] [pid 33472:tid 33523] [client 4.214.54.153:43711] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aUlXtJ5p2WQpPIK8HAlL9wAAAZY"]
[Mon Dec 22 22:37:41.615752 2025] [:error] [pid 33564:tid 33570] [client 4.214.54.153:43693] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aUlXtQSHeG6oLmMnKY7gsQAAAgM"]
[Mon Dec 22 22:37:42.747520 2025] [:error] [pid 33440:tid 33454] [client 4.214.54.153:43686] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aUlXtpOsUWKqgxu6QTRKYAAAAQw"]
[Mon Dec 22 22:37:43.319029 2025] [:error] [pid 56155:tid 56224] [client 4.214.54.153:43692] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aUlXt2G8a3wQucsuN64ISAAAA4I"]
[Mon Dec 22 22:37:44.305461 2025] [:error] [pid 56155:tid 56235] [client 4.214.54.153:16341] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/default.php"] [unique_id "aUlXuGG8a3wQucsuN64ITAAAA40"]
[Mon Dec 22 22:37:45.547253 2025] [:error] [pid 56080:tid 56141] [client 4.214.54.153:43710] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/default.php"] [unique_id "aUlXuZIHT3YJq9hjDc79QAAAAxE"]
[Mon Dec 22 22:37:46.287817 2025] [:error] [pid 56044:tid 56053] [client 4.214.54.153:43688] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/default.php"] [unique_id "aUlXuu60uUaieriJqP2AywAAAIU"]
[Mon Dec 22 22:37:46.815159 2025] [:error] [pid 58172:tid 58195] [client 4.214.54.153:16360] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/default.php"] [unique_id "aUlXuuSVKDT5jWOcnSUScwAAANU"]
[Mon Dec 22 22:37:47.738279 2025] [:error] [pid 33564:tid 33584] [client 4.214.54.153:16334] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUlXuwSHeG6oLmMnKY7gtwAAAhE"]
[Mon Dec 22 22:37:49.109528 2025] [:error] [pid 58078:tid 58083] [client 4.214.54.153:16321] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUlXvZWKg9Bf8njHlB5xtQAAAAA"]
[Mon Dec 22 22:37:52.054039 2025] [:error] [pid 56044:tid 56069] [client 4.214.54.153:16275] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUlXwO60uUaieriJqP2A0AAAAJU"]
[Mon Dec 22 22:37:52.962695 2025] [:error] [pid 56080:tid 56146] [client 4.214.54.153:16310] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUlXwJIHT3YJq9hjDc79TAAAAxY"]
[Mon Dec 22 22:37:54.277939 2025] [:error] [pid 33471:tid 33495] [client 4.214.54.153:16271] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-load.php"] [unique_id "aUlXwr5BeNE7regJ7ixemAAAAVU"]
[Mon Dec 22 22:37:54.941693 2025] [:error] [pid 56080:tid 56137] [client 4.214.54.153:16217] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-load.php"] [unique_id "aUlXwpIHT3YJq9hjDc79TwAAAw0"]
[Mon Dec 22 22:37:55.915780 2025] [:error] [pid 58078:tid 58083] [client 4.214.54.153:43690] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-load.php"] [unique_id "aUlXw5WKg9Bf8njHlB5xwgAAAAA"]
[Mon Dec 22 22:37:56.841473 2025] [:error] [pid 33535:tid 33545] [client 4.214.54.153:16345] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-load.php"] [unique_id "aUlXxGOCI8D9Xtn-n7TYOAAAAcg"]
[Mon Dec 22 22:37:57.840655 2025] [:error] [pid 33471:tid 33492] [client 4.214.54.153:43676] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sko.php"] [unique_id "aUlXxb5BeNE7regJ7ixemQAAAVI"]
[Mon Dec 22 22:37:58.856597 2025] [:error] [pid 33535:tid 33561] [client 4.214.54.153:43694] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sko.php"] [unique_id "aUlXxmOCI8D9Xtn-n7TYOQAAAdg"]
[Mon Dec 22 22:37:59.480191 2025] [:error] [pid 33471:tid 33498] [client 4.214.54.153:16374] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sko.php"] [unique_id "aUlXx75BeNE7regJ7ixemgAAAVg"]
[Mon Dec 22 22:38:00.329446 2025] [:error] [pid 58078:tid 58088] [client 4.214.54.153:16338] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sko.php"] [unique_id "aUlXyJWKg9Bf8njHlB5xygAAAAU"]
[Mon Dec 22 22:38:00.953156 2025] [:error] [pid 33471:tid 33481] [client 4.214.54.153:16239] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aUlXyL5BeNE7regJ7ixenQAAAUc"]
[Mon Dec 22 22:38:01.864990 2025] [:error] [pid 56080:tid 56131] [client 4.214.54.153:43708] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aUlXyZIHT3YJq9hjDc79WQAAAwc"]
[Mon Dec 22 22:38:02.435051 2025] [:error] [pid 33535:tid 33539] [client 4.214.54.153:43668] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aUlXymOCI8D9Xtn-n7TYPgAAAcI"]
[Mon Dec 22 22:38:03.162078 2025] [:error] [pid 58078:tid 58097] [client 4.214.54.153:43704] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aUlXy5WKg9Bf8njHlB5x0AAAAA4"]
[Mon Dec 22 22:38:03.964769 2025] [:error] [pid 33471:tid 33485] [client 4.214.54.153:16356] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aUlXy75BeNE7regJ7ixengAAAUs"]
[Mon Dec 22 22:38:04.744644 2025] [:error] [pid 56080:tid 56145] [client 4.214.54.153:16364] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aUlXzJIHT3YJq9hjDc79XgAAAxU"]
[Mon Dec 22 22:38:06.116478 2025] [:error] [pid 58172:tid 58195] [client 4.214.54.153:43652] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aUlXzuSVKDT5jWOcnSUSfAAAANU"]
[Mon Dec 22 22:38:06.808278 2025] [:error] [pid 33472:tid 33505] [client 4.214.54.153:16279] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rnEPv9.php"] [unique_id "aUlXzp5p2WQpPIK8HAlMAwAAAYQ"]
[Mon Dec 22 22:38:07.583148 2025] [:error] [pid 58172:tid 58174] [client 4.214.54.153:16366] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/png.php"] [unique_id "aUlXz-SVKDT5jWOcnSUSfQAAAMA"]
[Mon Dec 22 22:38:08.983821 2025] [:error] [pid 33472:tid 33525] [client 4.214.54.153:16148] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/png.php"] [unique_id "aUlX0J5p2WQpPIK8HAlMBwAAAZg"]
[Mon Dec 22 22:38:10.174676 2025] [:error] [pid 33535:tid 33552] [client 4.214.54.153:16291] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/png.php"] [unique_id "aUlX0mOCI8D9Xtn-n7TYRQAAAc8"]
[Mon Dec 22 22:38:11.130420 2025] [:error] [pid 58078:tid 58104] [client 4.214.54.153:16342] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/png.php"] [unique_id "aUlX05WKg9Bf8njHlB5x4wAAABU"]
[Mon Dec 22 22:38:11.846240 2025] [:error] [pid 56080:tid 56148] [client 4.214.54.153:16369] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aUlX05IHT3YJq9hjDc79YgAAAxg"]
[Mon Dec 22 22:38:13.474687 2025] [:error] [pid 33472:tid 33513] [client 4.214.54.153:43662] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aUlX1Z5p2WQpPIK8HAlMDAAAAYw"]
[Mon Dec 22 22:38:14.952008 2025] [:error] [pid 33472:tid 33523] [client 4.214.54.153:16311] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aUlX1p5p2WQpPIK8HAlMDgAAAZY"]
[Mon Dec 22 22:38:16.152478 2025] [:error] [pid 33564:tid 33573] [client 4.214.54.153:43654] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aUlX2ASHeG6oLmMnKY7gxgAAAgY"]
[Mon Dec 22 22:38:16.921772 2025] [:error] [pid 33535:tid 33556] [client 4.214.54.153:16350] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aUlX2GOCI8D9Xtn-n7TYTAAAAdM"]
[Mon Dec 22 22:38:18.218621 2025] [:error] [pid 56080:tid 56130] [client 4.214.54.153:16355] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aUlX2pIHT3YJq9hjDc79aQAAAwY"]
[Mon Dec 22 22:38:18.885127 2025] [:error] [pid 33535:tid 33548] [client 4.214.54.153:43711] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aUlX2mOCI8D9Xtn-n7TYTgAAAcs"]
[Mon Dec 22 22:38:20.282226 2025] [:error] [pid 58078:tid 58103] [client 4.214.54.153:16193] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aUlX3JWKg9Bf8njHlB5x7wAAABQ"]
[Mon Dec 22 22:38:21.006330 2025] [:error] [pid 33564:tid 33567] [client 4.214.54.153:16201] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aUlX3QSHeG6oLmMnKY7gyQAAAgA"]
[Mon Dec 22 22:38:21.488310 2025] [:error] [pid 33472:tid 33507] [client 4.214.54.153:43665] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aUlX3Z5p2WQpPIK8HAlMEwAAAYY"]
[Mon Dec 22 22:38:22.215515 2025] [:error] [pid 33471:tid 33488] [client 4.214.54.153:16187] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aUlX3r5BeNE7regJ7ixeqQAAAU4"]
[Mon Dec 22 22:38:22.973603 2025] [:error] [pid 33440:tid 33462] [client 4.214.54.153:16093] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about3.php"] [unique_id "aUlX3pOsUWKqgxu6QTRKfgAAARQ"]
[Mon Dec 22 22:38:23.971693 2025] [:error] [pid 33471:tid 33491] [client 4.214.54.153:43698] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aUlX375BeNE7regJ7ixeqgAAAVE"]
[Mon Dec 22 22:38:24.485732 2025] [:error] [pid 58172:tid 58177] [client 4.214.54.153:16375] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aUlX4OSVKDT5jWOcnSUSiQAAAMM"]
[Mon Dec 22 22:38:25.172476 2025] [:error] [pid 33471:tid 33475] [client 4.214.54.153:16371] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aUlX4b5BeNE7regJ7ixerQAAAUE"]
[Mon Dec 22 22:38:26.554386 2025] [:error] [pid 33471:tid 33479] [client 4.214.54.153:16263] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aUlX4r5BeNE7regJ7ixergAAAUU"]
[Mon Dec 22 22:38:27.103906 2025] [:error] [pid 33471:tid 33482] [client 4.214.54.153:16365] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r4f_1.php"] [unique_id "aUlX475BeNE7regJ7ixesAAAAUg"]
[Mon Dec 22 22:38:28.205229 2025] [:error] [pid 33471:tid 33476] [client 4.214.54.153:16328] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r4f_1.php"] [unique_id "aUlX5L5BeNE7regJ7ixetAAAAUI"]
[Mon Dec 22 22:38:28.706305 2025] [:error] [pid 58172:tid 58198] [client 4.214.54.153:16290] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r4f_1.php"] [unique_id "aUlX5OSVKDT5jWOcnSUSjwAAANg"]
[Mon Dec 22 22:38:30.082803 2025] [:error] [pid 33535:tid 33547] [client 4.214.54.153:16212] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r4f_1.php"] [unique_id "aUlX5mOCI8D9Xtn-n7TYUgAAAco"]
[Mon Dec 22 22:38:31.561699 2025] [:error] [pid 33535:tid 33560] [client 4.214.54.153:16196] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ftp.php"] [unique_id "aUlX52OCI8D9Xtn-n7TYWAAAAdc"]
[Mon Dec 22 22:38:33.138381 2025] [:error] [pid 33535:tid 33559] [client 4.214.54.153:43672] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ftp.php"] [unique_id "aUlX6WOCI8D9Xtn-n7TYYAAAAdY"]
[Mon Dec 22 22:38:34.785156 2025] [:error] [pid 56080:tid 56147] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/ftp.php
[Mon Dec 22 22:38:34.938887 2025] [:error] [pid 56080:tid 56139] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Mon Dec 22 22:38:35.083740 2025] [:error] [pid 56080:tid 56145] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Mon Dec 22 22:38:35.226852 2025] [:error] [pid 56080:tid 56140] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/himu.php
[Mon Dec 22 22:38:35.379205 2025] [:error] [pid 56080:tid 56128] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/wfile.php
[Mon Dec 22 22:38:35.517367 2025] [:error] [pid 56080:tid 56124] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Mon Dec 22 22:38:35.658264 2025] [:error] [pid 56080:tid 56146] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/miansha.php
[Mon Dec 22 22:38:35.867641 2025] [:error] [pid 56080:tid 56141] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/test2.php
[Mon Dec 22 22:38:36.190383 2025] [:error] [pid 56080:tid 56126] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Mon Dec 22 22:38:36.346753 2025] [:error] [pid 56080:tid 56136] [client 4.214.54.153:16370] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Mon Dec 22 22:38:36.499828 2025] [:error] [pid 56080:tid 56125] [client 4.214.54.153:16370] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asas.php"] [unique_id "aUlX7JIHT3YJq9hjDc79eAAAAwE"]
[Mon Dec 22 22:38:38.371606 2025] [:error] [pid 58172:tid 58189] [client 4.214.54.153:16319] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asas.php"] [unique_id "aUlX7uSVKDT5jWOcnSUSmgAAAM8"]
[Mon Dec 22 22:38:39.102620 2025] [:error] [pid 33440:tid 33451] [client 4.214.54.153:16344] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asas.php"] [unique_id "aUlX75OsUWKqgxu6QTRKhwAAAQk"]
[Mon Dec 22 22:38:39.894123 2025] [:error] [pid 33440:tid 33462] [client 4.214.54.153:16215] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asas.php"] [unique_id "aUlX75OsUWKqgxu6QTRKiAAAARQ"]
[Mon Dec 22 22:38:40.815517 2025] [:error] [pid 56044:tid 56060] [client 4.214.54.153:16203] [client 4.214.54.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aUlX8O60uUaieriJqP2A4AAAAIw"]
[Mon Dec 22 22:38:42.094873 2025] [:error] [pid 33535:tid 33542] [client 4.214.54.153:43701] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mans.php"] [unique_id "aUlX8mOCI8D9Xtn-n7TYawAAAcU"]
[Mon Dec 22 22:38:42.963827 2025] [:error] [pid 33535:tid 33537] [client 4.214.54.153:16269] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mans.php"] [unique_id "aUlX8mOCI8D9Xtn-n7TYbAAAAcA"]
[Mon Dec 22 22:38:44.086173 2025] [:error] [pid 33535:tid 33556] [client 4.214.54.153:16208] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mans.php"] [unique_id "aUlX9GOCI8D9Xtn-n7TYcAAAAdM"]
[Mon Dec 22 22:38:45.448255 2025] [:error] [pid 56080:tid 56131] [client 4.214.54.153:16267] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mans.php"] [unique_id "aUlX9ZIHT3YJq9hjDc79ewAAAwc"]
[Mon Dec 22 22:38:45.864919 2025] [:error] [pid 33472:tid 33517] [client 4.214.54.153:43656] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/build.php"] [unique_id "aUlX9Z5p2WQpPIK8HAlMLgAAAZA"]
[Mon Dec 22 22:38:47.862481 2025] [:error] [pid 33472:tid 33505] [client 4.214.54.153:16256] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/build.php"] [unique_id "aUlX955p2WQpPIK8HAlMMAAAAYQ"]
[Mon Dec 22 22:38:48.660633 2025] [:error] [pid 58172:tid 58176] [client 4.214.54.153:16259] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/build.php"] [unique_id "aUlX-OSVKDT5jWOcnSUSpQAAAMI"]
[Mon Dec 22 22:38:49.453790 2025] [:error] [pid 56155:tid 56238] [client 4.214.54.153:16322] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/build.php"] [unique_id "aUlX-WG8a3wQucsuN64IaQAAA5A"]
[Mon Dec 22 22:38:50.976683 2025] [:error] [pid 33472:tid 33504] [client 4.214.54.153:16198] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aUlX-p5p2WQpPIK8HAlMNAAAAYM"]
[Mon Dec 22 22:38:51.662128 2025] [:error] [pid 58172:tid 58193] [client 4.214.54.153:16363] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aUlX--SVKDT5jWOcnSUSqAAAANM"]
[Mon Dec 22 22:38:54.008473 2025] [:error] [pid 58078:tid 58105] [client 4.214.54.153:16128] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aUlX_pWKg9Bf8njHlB5yGAAAABY"]
[Mon Dec 22 22:38:54.702489 2025] [:error] [pid 58172:tid 58194] [client 4.214.54.153:43678] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aUlX_uSVKDT5jWOcnSUSqwAAANQ"]
[Mon Dec 22 22:38:55.218644 2025] [:error] [pid 58172:tid 58183] [client 4.214.54.153:16368] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aUlX_-SVKDT5jWOcnSUSrQAAAMk"]
[Mon Dec 22 22:38:55.935862 2025] [:error] [pid 58172:tid 58184] [client 4.214.54.153:16373] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aUlX_-SVKDT5jWOcnSUSsAAAAMo"]
[Mon Dec 22 22:38:56.612520 2025] [:error] [pid 56155:tid 56246] [client 4.214.54.153:43691] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aUlYAGG8a3wQucsuN64IbQAAA5g"]
[Mon Dec 22 22:38:57.547317 2025] [:error] [pid 33564:tid 33570] [client 4.214.54.153:16357] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aUlYAQSHeG6oLmMnKY7g8QAAAgM"]
[Mon Dec 22 22:38:58.614324 2025] [:error] [pid 33472:tid 33525] [client 4.214.54.153:16266] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aUlYAp5p2WQpPIK8HAlMPQAAAZg"]
[Mon Dec 22 22:38:59.283307 2025] [:error] [pid 33472:tid 33511] [client 4.214.54.153:16296] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aUlYA55p2WQpPIK8HAlMPwAAAYo"]
[Mon Dec 22 22:38:59.959700 2025] [:error] [pid 56080:tid 56141] [client 4.214.54.153:16381] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aUlYA5IHT3YJq9hjDc79gQAAAxE"]
[Mon Dec 22 22:39:00.392264 2025] [:error] [pid 56155:tid 56236] [client 4.214.54.153:16273] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aUlYBGG8a3wQucsuN64IbwAAA44"]
[Mon Dec 22 22:39:01.044854 2025] [:error] [pid 56044:tid 56063] [client 4.214.54.153:16065] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-wp.php"] [unique_id "aUlYBe60uUaieriJqP2A5QAAAI8"]
[Mon Dec 22 22:39:02.414224 2025] [:error] [pid 33535:tid 33544] [client 4.214.54.153:16199] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-wp.php"] [unique_id "aUlYBmOCI8D9Xtn-n7TYdwAAAcc"]
[Mon Dec 22 22:39:02.842627 2025] [:error] [pid 33564:tid 33580] [client 4.214.54.153:43649] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-wp.php"] [unique_id "aUlYBgSHeG6oLmMnKY7g8wAAAg0"]
[Mon Dec 22 22:39:04.036511 2025] [:error] [pid 58078:tid 58107] [client 4.214.54.153:16234] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-wp.php"] [unique_id "aUlYCJWKg9Bf8njHlB5yHgAAABg"]
[Mon Dec 22 22:39:06.666954 2025] [:error] [pid 56155:tid 56238] [client 4.214.54.153:16295] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aUlYCmG8a3wQucsuN64IdQAAA5A"]
[Mon Dec 22 22:39:08.042200 2025] [:error] [pid 33472:tid 33523] [client 4.214.54.153:16351] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aUlYDJ5p2WQpPIK8HAlMRAAAAZY"]
[Mon Dec 22 22:39:09.775485 2025] [:error] [pid 56080:tid 56144] [client 4.214.54.153:16224] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aUlYDZIHT3YJq9hjDc79iQAAAxQ"]
[Mon Dec 22 22:39:11.869902 2025] [:error] [pid 56044:tid 56055] [client 4.214.54.153:43689] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aUlYD-60uUaieriJqP2A6gAAAIc"]
[Mon Dec 22 22:39:12.597861 2025] [:error] [pid 58172:tid 58194] [client 4.214.54.153:16280] [client 4.214.54.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rejuva.au"] [uri "/filemanager.php"] [unique_id "aUlYEOSVKDT5jWOcnSUStwAAANQ"]
[Mon Dec 22 22:39:13.672716 2025] [:error] [pid 33472:tid 33516] [client 4.214.54.153:43661] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o2.php"] [unique_id "aUlYEZ5p2WQpPIK8HAlMSQAAAY8"]
[Mon Dec 22 22:39:14.603985 2025] [:error] [pid 58078:tid 58099] [client 4.214.54.153:16352] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o2.php"] [unique_id "aUlYEpWKg9Bf8njHlB5yLwAAABA"]
[Mon Dec 22 22:39:15.405688 2025] [:error] [pid 33564:tid 33587] [client 4.214.54.153:43679] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o2.php"] [unique_id "aUlYEwSHeG6oLmMnKY7g-AAAAhQ"]
[Mon Dec 22 22:39:15.917698 2025] [:error] [pid 56080:tid 56128] [client 4.214.54.153:16251] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aUlYE5IHT3YJq9hjDc79jAAAAwQ"]
[Mon Dec 22 22:39:16.861623 2025] [:error] [pid 58078:tid 58084] [client 4.214.54.153:16277] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aUlYFJWKg9Bf8njHlB5yMQAAAAE"]
[Mon Dec 22 22:39:17.839294 2025] [:error] [pid 58172:tid 58193] [client 4.214.54.153:43680] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aUlYFeSVKDT5jWOcnSUSvwAAANM"]
[Mon Dec 22 22:39:18.362194 2025] [:error] [pid 33535:tid 33554] [client 4.214.54.153:16147] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aUlYFmOCI8D9Xtn-n7TYfAAAAdE"]
[Mon Dec 22 22:39:19.177047 2025] [:error] [pid 33471:tid 33479] [client 4.214.54.153:16346] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aUlYF75BeNE7regJ7ixe1AAAAUU"]
[Mon Dec 22 22:39:19.939758 2025] [:error] [pid 33535:tid 33540] [client 4.214.54.153:16329] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aUlYF2OCI8D9Xtn-n7TYfwAAAcM"]
[Mon Dec 22 22:39:21.067776 2025] [:error] [pid 33564:tid 33577] [client 4.214.54.153:16379] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aUlYGQSHeG6oLmMnKY7g_QAAAgo"]
[Mon Dec 22 22:39:21.763963 2025] [:error] [pid 58078:tid 58091] [client 4.214.54.153:16309] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aUlYGZWKg9Bf8njHlB5yNQAAAAg"]
[Mon Dec 22 22:39:22.349912 2025] [:error] [pid 58078:tid 58099] [client 4.214.54.153:16315] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CLA.php"] [unique_id "aUlYGpWKg9Bf8njHlB5yOQAAABA"]
[Mon Dec 22 22:39:23.117594 2025] [:error] [pid 58078:tid 58083] [client 4.214.54.153:16017] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CLA.php"] [unique_id "aUlYG5WKg9Bf8njHlB5yOgAAAAA"]
[Mon Dec 22 22:39:24.271297 2025] [:error] [pid 33471:tid 33491] [client 4.214.54.153:16289] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CLA.php"] [unique_id "aUlYHL5BeNE7regJ7ixe1QAAAVE"]
[Mon Dec 22 22:39:25.083513 2025] [:error] [pid 56155:tid 56229] [client 4.214.54.153:43675] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CLA.php"] [unique_id "aUlYHWG8a3wQucsuN64IgAAAA4c"]
[Mon Dec 22 22:39:26.460188 2025] [:error] [pid 33440:tid 33465] [client 4.214.54.153:43650] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aUlYHpOsUWKqgxu6QTRKoAAAARc"]
[Mon Dec 22 22:39:27.370863 2025] [:error] [pid 33564:tid 33590] [client 4.214.54.153:43707] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aUlYHwSHeG6oLmMnKY7hBQAAAhc"]
[Mon Dec 22 22:39:29.124623 2025] [:error] [pid 33564:tid 33573] [client 4.214.54.153:43674] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aUlYIQSHeG6oLmMnKY7hBwAAAgY"]
[Mon Dec 22 22:39:29.814732 2025] [:error] [pid 33564:tid 33570] [client 4.214.54.153:16298] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aUlYIQSHeG6oLmMnKY7hCgAAAgM"]
[Mon Dec 22 22:39:30.392959 2025] [:error] [pid 58078:tid 58083] [client 4.214.54.153:16270] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ouh.php"] [unique_id "aUlYIpWKg9Bf8njHlB5yPwAAAAA"]
[Mon Dec 22 22:39:31.752675 2025] [:error] [pid 33472:tid 33516] [client 4.214.54.153:16317] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ouh.php"] [unique_id "aUlYI55p2WQpPIK8HAlMWQAAAY8"]
[Mon Dec 22 22:39:32.627016 2025] [:error] [pid 58078:tid 58103] [client 4.214.54.153:16091] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ouh.php"] [unique_id "aUlYJJWKg9Bf8njHlB5yQAAAABQ"]
[Mon Dec 22 22:39:33.089085 2025] [:error] [pid 56155:tid 56236] [client 4.214.54.153:16335] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ouh.php"] [unique_id "aUlYJWG8a3wQucsuN64IggAAA44"]
[Mon Dec 22 22:39:33.792815 2025] [:error] [pid 33535:tid 33552] [client 4.214.54.153:16349] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aUlYJWOCI8D9Xtn-n7TYiAAAAc8"]
[Mon Dec 22 22:39:34.355721 2025] [:error] [pid 33564:tid 33574] [client 4.214.54.153:16246] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aUlYJgSHeG6oLmMnKY7hEAAAAgc"]
[Mon Dec 22 22:39:34.954050 2025] [:error] [pid 33440:tid 33457] [client 4.214.54.153:16268] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aUlYJpOsUWKqgxu6QTRKpAAAAQ8"]
[Mon Dec 22 22:39:35.780782 2025] [:error] [pid 33471:tid 33476] [client 4.214.54.153:16272] [client 4.214.54.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aUlYJ75BeNE7regJ7ixe2gAAAUI"]
[Mon Dec 22 22:39:36.459526 2025] [:error] [pid 33564:tid 33570] [client 4.214.54.153:16303] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Mon Dec 22 22:39:36.610733 2025] [:error] [pid 33564:tid 33567] [client 4.214.54.153:16303] File does not exist: /usr/local/apache/htdocs/suspended-page/tgrs.php
[Mon Dec 22 22:39:36.785174 2025] [:error] [pid 33564:tid 33591] [client 4.214.54.153:16303] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Mon Dec 22 22:39:36.965622 2025] [:error] [pid 33564:tid 33579] [client 4.214.54.153:16303] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Mon Dec 22 22:39:37.511031 2025] [:error] [pid 33564:tid 33578] [client 4.214.54.153:16303] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Mon Dec 22 22:39:37.660800 2025] [:error] [pid 33564:tid 33589] [client 4.214.54.153:16303] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Mon Dec 22 22:39:38.068348 2025] [:error] [pid 33564:tid 33568] [client 4.214.54.153:16303] File does not exist: /usr/local/apache/htdocs/suspended-page/zxz.php
[Tue Dec 23 00:02:30.064838 2025] [:error] [pid 58078:tid 58106] [client 109.169.10.5:60824] [client 109.169.10.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aUlrlpWKg9Bf8njHlB6F1wAAABc"]
[Tue Dec 23 00:02:31.117128 2025] [:error] [pid 33440:tid 33450] [client 109.169.10.5:60826] [client 109.169.10.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aUlrl5OsUWKqgxu6QTRVuwAAAQg"]
[Tue Dec 23 00:02:32.163762 2025] [:error] [pid 58078:tid 58085] [client 109.169.10.5:60834] [client 109.169.10.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/tools.js"] [unique_id "aUlrmJWKg9Bf8njHlB6F2gAAAAI"]
[Tue Dec 23 00:02:33.196209 2025] [:error] [pid 33440:tid 33458] [client 109.169.10.5:60838] [client 109.169.10.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/translate_inline.js"] [unique_id "aUlrmZOsUWKqgxu6QTRVvQAAARA"]
[Tue Dec 23 00:02:34.230506 2025] [:error] [pid 56044:tid 56072] [client 109.169.10.5:60848] [client 109.169.10.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skin/adminhtml/default/default/boxes.css"] [unique_id "aUlrmu60uUaieriJqP2KLQAAAJg"]
[Tue Dec 23 00:02:35.266631 2025] [:error] [pid 56080:tid 56136] [client 109.169.10.5:41018] [client 109.169.10.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/prototype/validation.js"] [unique_id "aUlrm5IHT3YJq9hjDc4GjwAAAww"]
[Tue Dec 23 00:02:36.314853 2025] [:error] [pid 56080:tid 56145] [client 109.169.10.5:41032] [client 109.169.10.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RELEASE_NOTES.txt"] [unique_id "aUlrnJIHT3YJq9hjDc4GkAAAAxU"]
[Tue Dec 23 04:18:58.312158 2025] [:error] [pid 49150:tid 49157] [client 43.130.110.130:56600] [client 43.130.110.130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUmnskuL91O4jNPzb4FG7wAAAMU"]
[Tue Dec 23 15:09:45.856360 2025] [:error] [pid 25976:tid 25995] [client 36.41.75.167:59116] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUpAObF6LaWzQScE-xM3xAAAARE"]
[Wed Dec 24 03:47:05.691951 2025] [:error] [pid 16466:tid 16486] [client 192.144.148.122:47770] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUrxubu0JcuKJMjJn6xR3gAAABA"]
[Wed Dec 24 10:45:58.750334 2025] [:error] [pid 16550:tid 16571] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Dec 24 10:45:59.091388 2025] [:error] [pid 16550:tid 16560] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Dec 24 10:45:59.404767 2025] [:error] [pid 16550:tid 16573] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Dec 24 10:45:59.660020 2025] [:error] [pid 16550:tid 16567] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Dec 24 10:45:59.874615 2025] [:error] [pid 16550:tid 16568] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Dec 24 10:46:00.088425 2025] [:error] [pid 16550:tid 16558] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Dec 24 10:46:00.338354 2025] [:error] [pid 16550:tid 16566] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Dec 24 10:46:00.569839 2025] [:error] [pid 16550:tid 16570] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Dec 24 10:46:01.164395 2025] [:error] [pid 16550:tid 16572] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Dec 24 10:46:01.623847 2025] [:error] [pid 16550:tid 16558] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Dec 24 10:46:01.860504 2025] [:error] [pid 16550:tid 16566] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Dec 24 10:46:02.074190 2025] [:error] [pid 16550:tid 16565] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Dec 24 10:46:02.294415 2025] [:error] [pid 16550:tid 16568] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Dec 24 10:46:02.522680 2025] [:error] [pid 16550:tid 16555] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Dec 24 10:46:02.807355 2025] [:error] [pid 16550:tid 16554] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Dec 24 10:46:03.088041 2025] [:error] [pid 16550:tid 16568] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Dec 24 10:46:03.326271 2025] [:error] [pid 16550:tid 16557] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Dec 24 10:46:03.564857 2025] [:error] [pid 16550:tid 16570] [client 104.234.53.213:25881] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Dec 24 10:46:06.807859 2025] [:error] [pid 16550:tid 16564] [client 104.234.53.213:25881] [client 104.234.53.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUtT7qYYcdD-LuO7vrBVHgAAAMw"]
[Wed Dec 24 10:46:07.957628 2025] [:error] [pid 54139:tid 54154] [client 104.234.53.211:58395] [client 104.234.53.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUtT78rYCZenIDzgXuLxHQAAAQ0"]
[Wed Dec 24 10:46:09.204603 2025] [:error] [pid 16468:tid 16538] [client 63.135.161.68:26355] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Dec 24 10:46:09.955638 2025] [:error] [pid 16468:tid 16533] [client 63.135.161.68:26355] [client 63.135.161.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aUtT8YdyfuSTFLkCbP8VBgAAAIk"]
[Wed Dec 24 10:46:10.952303 2025] [:error] [pid 16468:tid 16527] [client 63.135.161.74:32109] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Dec 24 10:46:11.179568 2025] [:error] [pid 16468:tid 16537] [client 63.135.161.74:32109] [client 63.135.161.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aUtT84dyfuSTFLkCbP8VHwAAAI0"]
[Wed Dec 24 10:46:12.001760 2025] [:error] [pid 54139:tid 54144] [client 63.135.161.57:42777] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Dec 24 10:46:13.352729 2025] [:error] [pid 54139:tid 54157] [client 63.135.161.57:42777] [client 63.135.161.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUtT9crYCZenIDzgXuLxbgAAARA"]
[Wed Dec 24 10:46:14.083438 2025] [:error] [pid 16467:tid 16510] [client 63.135.161.74:46959] [client 63.135.161.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUtT9o0TJMcBxX5slgrRJQAAAE0"]
[Wed Dec 24 10:46:14.533784 2025] [:error] [pid 28405:tid 28423] [client 104.234.53.218:64313] [client 104.234.53.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUtT9sKkTWlhmfdXFqbbNgAAAU0"]
[Wed Dec 24 10:46:15.060911 2025] [:error] [pid 16468:tid 16533] [client 63.135.161.68:40903] [client 63.135.161.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUtT94dyfuSTFLkCbP8VSAAAAIk"]
[Wed Dec 24 10:46:15.498339 2025] [:error] [pid 54139:tid 54161] [client 63.135.161.74:26633] [client 63.135.161.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUtT98rYCZenIDzgXuLxjAAAARQ"]
[Wed Dec 24 10:46:15.967404 2025] [:error] [pid 16467:tid 16520] [client 104.234.53.213:34789] [client 104.234.53.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUtT940TJMcBxX5slgrRUQAAAFc"]
[Wed Dec 24 10:46:16.752245 2025] [:error] [pid 16466:tid 16482] [client 104.234.53.209:57467] [client 104.234.53.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUtT-Lu0JcuKJMjJn6y1qgAAAAw"]
[Wed Dec 24 10:46:17.266893 2025] [:error] [pid 54139:tid 54156] [client 104.234.53.208:49375] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Dec 24 10:46:17.753416 2025] [:error] [pid 54139:tid 54149] [client 104.234.53.208:49375] [client 104.234.53.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aUtT-crYCZenIDzgXuLxtwAAAQg"]
[Wed Dec 24 10:46:18.712585 2025] [:error] [pid 28405:tid 28426] [client 63.135.161.51:48085] [client 63.135.161.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUtT-sKkTWlhmfdXFqbbgQAAAVA"]
[Wed Dec 24 10:46:19.517838 2025] [:error] [pid 16550:tid 16575] [client 63.135.161.55:36297] [client 63.135.161.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUtT-6YYcdD-LuO7vrBVkAAAANc"]
[Wed Dec 24 10:46:19.974096 2025] [:error] [pid 28405:tid 28420] [client 63.135.161.64:52269] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Dec 24 10:46:20.209758 2025] [:error] [pid 28405:tid 28423] [client 63.135.161.64:52269] [client 63.135.161.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUtT_MKkTWlhmfdXFqbbjAAAAU0"]
[Wed Dec 24 10:46:20.710927 2025] [:error] [pid 16550:tid 16557] [client 63.135.161.76:26841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Dec 24 10:46:21.569126 2025] [:error] [pid 16550:tid 16571] [client 63.135.161.76:26841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Dec 24 10:46:22.325042 2025] [:error] [pid 16550:tid 16554] [client 63.135.161.76:26841] [client 63.135.161.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUtT_qYYcdD-LuO7vrBVsAAAAMI"]
[Wed Dec 24 10:46:22.825021 2025] [:error] [pid 28405:tid 28417] [client 104.234.53.208:20323] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Dec 24 10:46:23.034037 2025] [:error] [pid 28405:tid 28422] [client 104.234.53.208:20323] [client 104.234.53.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUtT_8KkTWlhmfdXFqbbtgAAAUw"]
[Wed Dec 24 10:46:23.465772 2025] [:error] [pid 54139:tid 54159] [client 63.135.161.73:34217] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Dec 24 10:46:23.914744 2025] [:error] [pid 54139:tid 54155] [client 63.135.161.73:34217] [client 63.135.161.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aUtT_8rYCZenIDzgXuLx6QAAAQ4"]
[Wed Dec 24 10:46:24.611430 2025] [:error] [pid 16468:tid 16529] [client 63.135.161.64:47835] [client 63.135.161.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aUtUAIdyfuSTFLkCbP8V2wAAAIU"]
[Wed Dec 24 10:46:25.355941 2025] [:error] [pid 54139:tid 54147] [client 104.234.53.219:39767] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Dec 24 10:46:25.631810 2025] [:error] [pid 54139:tid 54163] [client 104.234.53.219:39767] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Dec 24 10:46:26.076754 2025] [:error] [pid 54139:tid 54161] [client 104.234.53.219:39767] [client 104.234.53.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUtUAsrYCZenIDzgXuLx-AAAARQ"]
[Wed Dec 24 10:46:26.736234 2025] [:error] [pid 54139:tid 54159] [client 104.234.53.224:47303] [client 104.234.53.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUtUAsrYCZenIDzgXuLx-wAAARI"]
[Wed Dec 24 10:46:27.647620 2025] [:error] [pid 16467:tid 16504] [client 63.135.161.63:28617] [client 63.135.161.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUtUA40TJMcBxX5slgrSAgAAAEc"]
[Wed Dec 24 10:46:28.260025 2025] [:error] [pid 28405:tid 28434] [client 63.135.161.66:24053] [client 63.135.161.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUtUBMKkTWlhmfdXFqbb8gAAAVg"]
[Wed Dec 24 10:46:28.689793 2025] [:error] [pid 16468:tid 16532] [client 104.234.53.222:26091] [client 104.234.53.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUtUBIdyfuSTFLkCbP8WKQAAAIg"]
[Wed Dec 24 10:46:29.605966 2025] [:error] [pid 54139:tid 54162] [client 63.135.161.48:60393] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Dec 24 10:46:29.874166 2025] [:error] [pid 54139:tid 54157] [client 63.135.161.48:60393] [client 63.135.161.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aUtUBcrYCZenIDzgXuLyEQAAARA"]
[Wed Dec 24 10:46:30.384705 2025] [:error] [pid 54139:tid 54155] [client 63.135.161.72:20037] [client 63.135.161.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aUtUBsrYCZenIDzgXuLyFgAAAQ4"]
[Wed Dec 24 10:46:30.833311 2025] [:error] [pid 16468:tid 16535] [client 104.234.53.210:29039] [client 104.234.53.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUtUBodyfuSTFLkCbP8WXwAAAIs"]
[Wed Dec 24 10:46:32.055179 2025] [:error] [pid 16550:tid 16571] [client 63.135.161.61:22059] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Dec 24 10:46:32.642308 2025] [:error] [pid 16550:tid 16552] [client 63.135.161.61:22059] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Dec 24 10:46:33.777752 2025] [:error] [pid 16550:tid 16553] [client 63.135.161.61:22059] [client 63.135.161.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aUtUCaYYcdD-LuO7vrBWGQAAAME"]
[Wed Dec 24 10:46:35.002157 2025] [:error] [pid 16467:tid 16518] [client 104.234.53.208:25937] [client 104.234.53.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.208, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUtUC40TJMcBxX5slgrSZgAAAFU"]
[Wed Dec 24 10:46:35.283796 2025] [:error] [pid 16467:tid 16506] [client 104.234.53.208:25937] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Dec 24 10:46:36.516884 2025] [:error] [pid 16467:tid 16498] [client 104.234.53.208:25937] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Dec 24 10:46:36.764198 2025] [:error] [pid 16467:tid 16513] [client 104.234.53.208:25937] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Dec 24 10:46:38.008052 2025] [:error] [pid 16467:tid 16519] [client 104.234.53.208:25937] [client 104.234.53.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUtUDo0TJMcBxX5slgrSiwAAAFY"]
[Wed Dec 24 10:46:38.918682 2025] [:error] [pid 54139:tid 54144] [client 104.234.53.212:33475] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Dec 24 10:46:39.135104 2025] [:error] [pid 54139:tid 54150] [client 104.234.53.212:33475] [client 104.234.53.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.212, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUtUD8rYCZenIDzgXuLyWAAAAQk"]
[Wed Dec 24 10:46:39.688569 2025] [:error] [pid 54139:tid 54149] [client 104.234.53.212:33475] [client 104.234.53.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aUtUD8rYCZenIDzgXuLyZAAAAQg"]
[Wed Dec 24 10:46:41.240254 2025] [:error] [pid 54139:tid 54161] [client 63.135.161.75:26073] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Dec 24 10:46:41.709443 2025] [:error] [pid 54139:tid 54147] [client 63.135.161.75:26073] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Wed Dec 24 10:46:42.213089 2025] [:error] [pid 54139:tid 54142] [client 63.135.161.75:26073] [client 63.135.161.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUtUEsrYCZenIDzgXuLykQAAAQE"]
[Wed Dec 24 10:46:42.835189 2025] [:error] [pid 16550:tid 16571] [client 63.135.161.62:28049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Dec 24 10:46:43.567178 2025] [:error] [pid 16550:tid 16552] [client 63.135.161.62:28049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Dec 24 10:46:44.093245 2025] [:error] [pid 16550:tid 16564] [client 63.135.161.62:28049] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Dec 24 10:46:44.546967 2025] [:error] [pid 16550:tid 16576] [client 63.135.161.62:28049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Dec 24 10:46:44.787717 2025] [:error] [pid 16550:tid 16566] [client 63.135.161.62:28049] [client 63.135.161.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUtUFKYYcdD-LuO7vrBWswAAAM4"]
[Wed Dec 24 10:46:45.296293 2025] [:error] [pid 28405:tid 28414] [client 63.135.161.51:36309] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Dec 24 10:46:45.574658 2025] [:error] [pid 28405:tid 28431] [client 63.135.161.51:36309] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Dec 24 10:46:45.855558 2025] [:error] [pid 28405:tid 28414] [client 63.135.161.51:36309] [client 63.135.161.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUtUFcKkTWlhmfdXFqbc1wAAAUU"]
[Wed Dec 24 10:46:46.594902 2025] [:error] [pid 54139:tid 54159] [client 104.234.53.218:45865] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Dec 24 10:46:47.086821 2025] [:error] [pid 54139:tid 54142] [client 104.234.53.218:45865] [client 104.234.53.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.218, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aUtUF8rYCZenIDzgXuLyxgAAAQE"]
[Wed Dec 24 10:46:47.303128 2025] [:error] [pid 54139:tid 54163] [client 104.234.53.218:45865] [client 104.234.53.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUtUF8rYCZenIDzgXuLyywAAARY"]
[Wed Dec 24 10:46:53.892262 2025] [:error] [pid 54139:tid 54147] [client 63.135.161.64:30901] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Dec 24 10:46:55.442746 2025] [:error] [pid 54139:tid 54149] [client 63.135.161.64:30901] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Dec 24 10:46:55.677639 2025] [:error] [pid 54139:tid 54157] [client 63.135.161.64:30901] [client 63.135.161.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUtUH8rYCZenIDzgXuLzXQAAARA"]
[Wed Dec 24 10:46:56.150068 2025] [:error] [pid 54139:tid 54143] [client 63.135.161.56:49385] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Dec 24 10:46:56.936048 2025] [:error] [pid 54139:tid 54147] [client 63.135.161.56:49385] [client 63.135.161.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.56, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUtUIMrYCZenIDzgXuLzeAAAAQY"]
[Wed Dec 24 10:46:57.170474 2025] [:error] [pid 54139:tid 54151] [client 63.135.161.56:49385] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Dec 24 10:46:57.403705 2025] [:error] [pid 54139:tid 54163] [client 63.135.161.56:49385] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Dec 24 10:46:57.645644 2025] [:error] [pid 54139:tid 54157] [client 63.135.161.56:49385] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Dec 24 10:46:57.908341 2025] [:error] [pid 54139:tid 54163] [client 63.135.161.56:49385] [client 63.135.161.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aUtUIcrYCZenIDzgXuLzlAAAARY"]
[Wed Dec 24 10:46:58.468068 2025] [:error] [pid 16466:tid 16485] [client 104.234.53.218:30307] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Dec 24 10:46:58.687759 2025] [:error] [pid 16466:tid 16481] [client 104.234.53.218:30307] [client 104.234.53.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aUtUIru0JcuKJMjJn6y3xwAAAAs"]
[Wed Dec 24 10:46:59.364298 2025] [:error] [pid 16468:tid 16537] [client 63.135.161.58:45169] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Dec 24 10:46:59.600557 2025] [:error] [pid 16468:tid 16541] [client 63.135.161.58:45169] [client 63.135.161.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUtUI4dyfuSTFLkCbP8YUQAAAJE"]
[Wed Dec 24 10:47:00.537028 2025] [:error] [pid 16550:tid 16566] [client 104.234.53.207:35197] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Dec 24 10:47:00.754891 2025] [:error] [pid 16550:tid 16568] [client 104.234.53.207:35197] [client 104.234.53.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUtUJKYYcdD-LuO7vrBXqgAAANA"]
[Wed Dec 24 10:47:01.479282 2025] [:error] [pid 16466:tid 16478] [client 63.135.161.58:26341] [client 63.135.161.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUtUJbu0JcuKJMjJn6y34wAAAAg"]
[Wed Dec 24 10:47:02.023207 2025] [:error] [pid 16550:tid 16575] [client 63.135.161.71:59143] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Dec 24 10:47:02.284680 2025] [:error] [pid 16550:tid 16562] [client 63.135.161.71:59143] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Wed Dec 24 10:47:03.285605 2025] [:error] [pid 16550:tid 16562] [client 63.135.161.71:59143] [client 63.135.161.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUtUJ6YYcdD-LuO7vrBXwgAAAMo"]
[Wed Dec 24 10:47:04.067816 2025] [:error] [pid 16466:tid 16494] [client 104.234.53.216:47215] [client 104.234.53.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUtUKLu0JcuKJMjJn6y3_AAAABg"]
[Wed Dec 24 10:47:05.198048 2025] [:error] [pid 16550:tid 16573] [client 63.135.161.67:36023] [client 63.135.161.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aUtUKaYYcdD-LuO7vrBX2QAAANU"]
[Wed Dec 24 14:14:28.314024 2025] [:error] [pid 54139:tid 54159] [client 165.227.84.14:59038] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/api-docs"] [unique_id "aUuExMrYCZenIDzgXuJIagAAARI"]
[Wed Dec 24 14:14:29.318207 2025] [:error] [pid 16468:tid 16535] [client 165.227.84.14:59040] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3/api-docs"] [unique_id "aUuExYdyfuSTFLkCbP9XdAAAAIs"]
[Wed Dec 24 14:14:30.333911 2025] [:error] [pid 16467:tid 16520] [client 165.227.84.14:59044] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aUuExo0TJMcBxX5slgoS0AAAAFc"]
[Wed Dec 24 14:14:31.307375 2025] [:error] [pid 28777:tid 28801] [client 165.227.84.14:59050] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api/swagger.json"] [unique_id "aUuEx5BVBcZ34cSqz8r8ZwAAAZY"]
[Wed Dec 24 14:14:32.320263 2025] [:error] [pid 28777:tid 28786] [client 165.227.84.14:50138] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/@vite/env"] [unique_id "aUuEyJBVBcZ34cSqz8r8aAAAAYc"]
[Wed Dec 24 14:14:33.326053 2025] [:error] [pid 28405:tid 28425] [client 165.227.84.14:50150] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aUuEycKkTWlhmfdXFqYgjQAAAU8"]
[Wed Dec 24 14:14:34.329116 2025] [:error] [pid 29371:tid 29375] [client 165.227.84.14:50166] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aUuEyns-DlKLysSq5L9XqAAAAcI"]
[Wed Dec 24 14:14:35.349471 2025] [:error] [pid 29371:tid 29381] [client 165.227.84.14:50172] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aUuEy3s-DlKLysSq5L9XqgAAAcg"]
[Wed Dec 24 14:14:37.319633 2025] [:error] [pid 28405:tid 28430] [client 165.227.84.14:50180] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aUuEzcKkTWlhmfdXFqYgkAAAAVQ"]
[Wed Dec 24 14:14:38.315653 2025] [:error] [pid 16550:tid 16563] [client 165.227.84.14:50196] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aUuEzqYYcdD-LuO7vrC4CQAAAMs"]
[Wed Dec 24 14:14:39.322855 2025] [:error] [pid 16550:tid 16572] [client 165.227.84.14:50210] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aUuEz6YYcdD-LuO7vrC4CwAAANQ"]
[Wed Dec 24 14:14:40.322753 2025] [:error] [pid 28777:tid 28780] [client 165.227.84.14:50222] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUuE0JBVBcZ34cSqz8r8bAAAAYE"]
[Wed Dec 24 14:14:41.320487 2025] [:error] [pid 16550:tid 16557] [client 165.227.84.14:50232] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aUuE0aYYcdD-LuO7vrC4DQAAAMU"]
[Wed Dec 24 14:14:42.331318 2025] [:error] [pid 16550:tid 16556] [client 165.227.84.14:56572] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aUuE0qYYcdD-LuO7vrC4EAAAAMQ"]
[Wed Dec 24 14:14:43.331284 2025] [:error] [pid 16468:tid 16542] [client 165.227.84.14:56584] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_all_dbs"] [unique_id "aUuE04dyfuSTFLkCbP9XeAAAAJI"]
[Wed Dec 24 14:14:44.398327 2025] [:error] [pid 16550:tid 16566] [client 165.227.84.14:56590] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aUuE1KYYcdD-LuO7vrC4EgAAAM4"]
[Wed Dec 24 14:14:45.374245 2025] [:error] [pid 29371:tid 29384] [client 165.227.84.14:56604] [client 165.227.84.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aUuE1Xs-DlKLysSq5L9XsgAAAcs"]
[Wed Dec 24 14:14:47.417700 2025] [:error] [pid 28777:tid 28798] [client 165.227.84.14:56620] [client 165.227.84.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aUuE15BVBcZ34cSqz8r8cQAAAZM"]
[Wed Dec 24 14:14:48.339992 2025] [:error] [pid 28777:tid 28802] [client 165.227.84.14:56622] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUuE2JBVBcZ34cSqz8r8cgAAAZc"]
[Wed Dec 24 14:14:49.333263 2025] [:error] [pid 29371:tid 29379] [client 165.227.84.14:56624] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aUuE2Xs-DlKLysSq5L9XswAAAcY"]
[Wed Dec 24 14:14:50.355904 2025] [:error] [pid 16550:tid 16568] [client 165.227.84.14:56638] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aUuE2qYYcdD-LuO7vrC4HQAAANA"]
[Wed Dec 24 14:14:51.332806 2025] [:error] [pid 16468:tid 16547] [client 165.227.84.14:56640] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aUuE24dyfuSTFLkCbP9XegAAAJc"]
[Wed Dec 24 14:14:52.348955 2025] [:error] [pid 16468:tid 16544] [client 165.227.84.14:54874] [client 165.227.84.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUuE3IdyfuSTFLkCbP9XfQAAAJQ"]
[Wed Dec 24 14:16:31.887080 2025] [:error] [pid 29371:tid 29395] [client 162.62.132.25:57870] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUuFP3s-DlKLysSq5L9YBQAAAdY"]
[Wed Dec 24 17:02:04.378878 2025] [:error] [pid 28405:tid 28411] [client 49.51.243.95:38982] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUusDMKkTWlhmfdXFqZGEwAAAUI"]
[Wed Dec 24 17:25:18.689004 2025] [:error] [pid 54139:tid 54143] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Wed Dec 24 17:25:19.010328 2025] [:error] [pid 54139:tid 54160] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/d4.php
[Wed Dec 24 17:25:19.241838 2025] [:error] [pid 54139:tid 54142] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Wed Dec 24 17:25:19.407564 2025] [:error] [pid 54139:tid 54161] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/dlex.php
[Wed Dec 24 17:25:19.618773 2025] [:error] [pid 54139:tid 54146] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Dec 24 17:25:19.760777 2025] [:error] [pid 54139:tid 54148] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/pass.php
[Wed Dec 24 17:25:19.910798 2025] [:error] [pid 54139:tid 54153] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Wed Dec 24 17:25:20.065254 2025] [:error] [pid 54139:tid 54155] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Wed Dec 24 17:25:20.251791 2025] [:error] [pid 54139:tid 54145] [client 52.141.46.221:27646] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Wed Dec 24 17:25:20.877763 2025] [:error] [pid 54139:tid 54141] [client 52.141.46.221:27646] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aUuxgMrYCZenIDzgXuKCLgAAAQA"]
[Wed Dec 24 17:25:24.928479 2025] [:error] [pid 16467:tid 16504] [client 52.141.46.221:41935] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aUuxhI0TJMcBxX5slgo1FAAAAEc"]
[Wed Dec 24 17:25:29.580624 2025] [:error] [pid 54139:tid 54144] [client 52.141.46.221:58268] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aUuxicrYCZenIDzgXuKCMgAAAQM"]
[Wed Dec 24 17:25:31.059456 2025] [:error] [pid 29371:tid 29386] [client 52.141.46.221:35460] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aUuxi3s-DlKLysSq5L9_oAAAAc0"]
[Wed Dec 24 17:25:32.562719 2025] [:error] [pid 28405:tid 28417] [client 52.141.46.221:27183] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aUuxjMKkTWlhmfdXFqZPhAAAAUg"]
[Wed Dec 24 17:25:33.944056 2025] [:error] [pid 29371:tid 29384] [client 52.141.46.221:27186] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aUuxjXs-DlKLysSq5L9_owAAAcs"]
[Wed Dec 24 17:25:37.411847 2025] [:error] [pid 54139:tid 54147] [client 52.141.46.221:27192] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aUuxkcrYCZenIDzgXuKCNgAAAQY"]
[Wed Dec 24 17:25:41.442377 2025] [:error] [pid 28405:tid 28431] [client 52.141.46.221:27165] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aUuxlcKkTWlhmfdXFqZPjQAAAVU"]
[Wed Dec 24 17:25:45.977154 2025] [:error] [pid 16550:tid 16552] [client 52.141.46.221:42613] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aUuxmaYYcdD-LuO7vrDjuwAAAMA"]
[Wed Dec 24 17:25:50.078670 2025] [:error] [pid 28777:tid 28801] [client 52.141.46.221:33455] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aUuxnpBVBcZ34cSqz8ohOgAAAZY"]
[Wed Dec 24 17:25:56.553054 2025] [:error] [pid 54139:tid 54160] [client 52.141.46.221:55845] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aUuxpMrYCZenIDzgXuKCQQAAARM"]
[Wed Dec 24 17:25:58.400709 2025] [:error] [pid 28777:tid 28779] [client 52.141.46.221:39423] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUuxppBVBcZ34cSqz8ohPQAAAYA"]
[Wed Dec 24 17:25:59.182423 2025] [:error] [pid 16468:tid 16537] [client 52.141.46.221:27166] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUuxp4dyfuSTFLkCbP95yQAAAI0"]
[Wed Dec 24 17:26:00.155789 2025] [:error] [pid 16550:tid 16556] [client 52.141.46.221:42646] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUuxqKYYcdD-LuO7vrDjwQAAAMQ"]
[Wed Dec 24 17:26:03.615384 2025] [:error] [pid 28777:tid 28789] [client 52.141.46.221:39368] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aUuxq5BVBcZ34cSqz8ohPwAAAYo"]
[Wed Dec 24 17:26:05.635437 2025] [:error] [pid 16550:tid 16569] [client 52.141.46.221:27706] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aUuxraYYcdD-LuO7vrDjxgAAANE"]
[Wed Dec 24 17:26:07.633614 2025] [:error] [pid 16468:tid 16529] [client 52.141.46.221:30448] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aUuxr4dyfuSTFLkCbP95zgAAAIU"]
[Wed Dec 24 17:26:09.314203 2025] [:error] [pid 16466:tid 16473] [client 52.141.46.221:33348] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aUuxsbu0JcuKJMjJn6wadAAAAAM"]
[Wed Dec 24 17:26:13.282839 2025] [:error] [pid 29371:tid 29382] [client 52.141.46.221:42640] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aUuxtXs-DlKLysSq5L9_twAAAck"]
[Wed Dec 24 17:26:15.415941 2025] [:error] [pid 28777:tid 28790] [client 52.141.46.221:39383] [client 52.141.46.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aUuxt5BVBcZ34cSqz8ohRgAAAYs"]
[Wed Dec 24 17:26:20.660678 2025] [:error] [pid 29371:tid 29384] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Dec 24 17:26:20.827695 2025] [:error] [pid 29371:tid 29386] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/litanies.php
[Wed Dec 24 17:26:20.987042 2025] [:error] [pid 29371:tid 29396] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Wed Dec 24 17:26:21.161807 2025] [:error] [pid 29371:tid 29377] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Wed Dec 24 17:26:21.582398 2025] [:error] [pid 29371:tid 29393] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/kwm4.php
[Wed Dec 24 17:26:21.775569 2025] [:error] [pid 29371:tid 29378] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/just2.php
[Wed Dec 24 17:26:21.937267 2025] [:error] [pid 29371:tid 29394] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Wed Dec 24 17:26:22.102966 2025] [:error] [pid 29371:tid 29379] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/geger.php
[Wed Dec 24 17:26:22.345873 2025] [:error] [pid 29371:tid 29389] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/let.php
[Wed Dec 24 17:26:22.494330 2025] [:error] [pid 29371:tid 29380] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/np.php
[Wed Dec 24 17:26:22.636223 2025] [:error] [pid 29371:tid 29388] [client 52.141.46.221:42620] File does not exist: /usr/local/apache/htdocs/suspended-page/ask.php
[Wed Dec 24 17:26:22.777325 2025] [:error] [pid 29371:tid 29385] [client 52.141.46.221:42620] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aUuxvns-DlKLysSq5L9_yQAAAcw"]
[Wed Dec 24 17:26:24.569132 2025] [:error] [pid 16468:tid 16542] [client 52.141.46.221:6125] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aUuxwIdyfuSTFLkCbP953QAAAJI"]
[Wed Dec 24 17:26:32.003079 2025] [:error] [pid 16467:tid 16512] [client 52.141.46.221:5526] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aUuxyI0TJMcBxX5slgo1PAAAAE8"]
[Wed Dec 24 17:26:43.209505 2025] [:error] [pid 29371:tid 29373] [client 52.141.46.221:5824] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aUux03s-DlKLysSq5L9_0AAAAcA"]
[Wed Dec 24 17:26:44.601488 2025] [:error] [pid 16466:tid 16472] [client 52.141.46.221:57090] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aUux1Lu0JcuKJMjJn6walQAAAAI"]
[Wed Dec 24 17:26:47.711693 2025] [:error] [pid 28777:tid 28789] [client 52.141.46.221:56453] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aUux15BVBcZ34cSqz8ohYAAAAYo"]
[Wed Dec 24 17:26:49.528727 2025] [:error] [pid 16467:tid 16514] [client 52.141.46.221:57116] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aUux2Y0TJMcBxX5slgo1RAAAAFE"]
[Wed Dec 24 17:26:51.040455 2025] [:error] [pid 28405:tid 28434] [client 52.141.46.221:30483] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aUux28KkTWlhmfdXFqZP1QAAAVg"]
[Wed Dec 24 17:26:56.951868 2025] [:error] [pid 28405:tid 28433] [client 52.141.46.221:46212] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aUux4MKkTWlhmfdXFqZP5wAAAVc"]
[Wed Dec 24 17:27:01.883334 2025] [:error] [pid 28405:tid 28434] [client 52.141.46.221:30494] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aUux5cKkTWlhmfdXFqZP7gAAAVg"]
[Wed Dec 24 17:27:04.059074 2025] [:error] [pid 16466:tid 16494] [client 52.141.46.221:30465] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aUux6Lu0JcuKJMjJn6waoQAAABg"]
[Wed Dec 24 17:27:05.354609 2025] [:error] [pid 54139:tid 54152] [client 52.141.46.221:32160] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aUux6crYCZenIDzgXuKCYgAAAQs"]
[Wed Dec 24 17:27:10.238149 2025] [:error] [pid 28777:tid 28784] [client 52.141.46.221:53178] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aUux7pBVBcZ34cSqz8ohbgAAAYU"]
[Wed Dec 24 17:27:10.965470 2025] [:error] [pid 54139:tid 54151] [client 52.141.46.221:5308] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aUux7srYCZenIDzgXuKCZgAAAQo"]
[Wed Dec 24 17:27:22.772180 2025] [:error] [pid 16466:tid 16475] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/ex.php
[Wed Dec 24 17:27:22.947347 2025] [:error] [pid 16466:tid 16471] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/asd67.php
[Wed Dec 24 17:27:23.126404 2025] [:error] [pid 16466:tid 16476] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Dec 24 17:27:23.296867 2025] [:error] [pid 16466:tid 16470] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Dec 24 17:27:23.455404 2025] [:error] [pid 16466:tid 16477] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/shlo.php
[Wed Dec 24 17:27:23.622617 2025] [:error] [pid 16466:tid 16486] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/sec.php
[Wed Dec 24 17:27:23.804552 2025] [:error] [pid 16466:tid 16479] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Dec 24 17:27:23.970406 2025] [:error] [pid 16466:tid 16472] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Dec 24 17:27:24.134879 2025] [:error] [pid 16466:tid 16478] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Wed Dec 24 17:27:24.373165 2025] [:error] [pid 16466:tid 16474] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Wed Dec 24 17:27:24.716237 2025] [:error] [pid 16466:tid 16489] [client 52.141.46.221:44929] File does not exist: /usr/local/apache/htdocs/suspended-page/bluejackets.php
[Wed Dec 24 17:27:24.873433 2025] [:error] [pid 16466:tid 16491] [client 52.141.46.221:44929] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aUux_Lu0JcuKJMjJn6wauQAAABU"]
[Wed Dec 24 17:27:27.328534 2025] [:error] [pid 29371:tid 29379] [client 52.141.46.221:45589] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aUux_3s-DlKLysSq5L9_3AAAAcY"]
[Wed Dec 24 17:27:31.032911 2025] [:error] [pid 29371:tid 29391] [client 52.141.46.221:5367] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aUuyA3s-DlKLysSq5L9_3QAAAdI"]
[Wed Dec 24 17:27:33.513010 2025] [:error] [pid 16466:tid 16483] [client 52.141.46.221:43759] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aUuyBbu0JcuKJMjJn6wa3gAAAA0"]
[Wed Dec 24 17:27:37.765602 2025] [:error] [pid 28405:tid 28427] [client 52.141.46.221:5373] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx21_1.php"] [unique_id "aUuyCcKkTWlhmfdXFqZQGwAAAVE"]
[Wed Dec 24 17:27:40.096858 2025] [:error] [pid 54139:tid 54155] [client 52.141.46.221:5891] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx21_1.php"] [unique_id "aUuyDMrYCZenIDzgXuKCsgAAAQ4"]
[Wed Dec 24 17:27:42.537988 2025] [:error] [pid 16466:tid 16473] [client 52.141.46.221:31099] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx21_1.php"] [unique_id "aUuyDru0JcuKJMjJn6wa-wAAAAM"]
[Wed Dec 24 17:27:45.581900 2025] [:error] [pid 28405:tid 28428] [client 52.141.46.221:36970] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx21_1.php"] [unique_id "aUuyEcKkTWlhmfdXFqZQLQAAAVI"]
[Wed Dec 24 17:27:47.024925 2025] [:error] [pid 28405:tid 28412] [client 52.141.46.221:41312] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUuyE8KkTWlhmfdXFqZQOwAAAUM"]
[Wed Dec 24 17:27:47.946649 2025] [:error] [pid 29371:tid 29397] [client 52.141.46.221:31056] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUuyE3s-DlKLysSq5L9_5gAAAdg"]
[Wed Dec 24 17:27:51.310805 2025] [:error] [pid 16466:tid 16493] [client 52.141.46.221:5925] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUuyF7u0JcuKJMjJn6wbAAAAABc"]
[Wed Dec 24 17:27:56.736755 2025] [:error] [pid 28405:tid 28433] [client 52.141.46.221:5142] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aUuyHMKkTWlhmfdXFqZQSAAAAVc"]
[Wed Dec 24 17:27:58.460930 2025] [:error] [pid 54139:tid 54146] [client 52.141.46.221:41318] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aUuyHsrYCZenIDzgXuKCuwAAAQU"]
[Wed Dec 24 17:27:59.586509 2025] [:error] [pid 29371:tid 29382] [client 52.141.46.221:35438] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aUuyH3s-DlKLysSq5L9_7wAAAck"]
[Wed Dec 24 17:28:01.704315 2025] [:error] [pid 29371:tid 29375] [client 52.141.46.221:29858] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aUuyIXs-DlKLysSq5L9_8QAAAcI"]
[Wed Dec 24 17:28:02.828106 2025] [:error] [pid 16468:tid 16542] [client 52.141.46.221:41383] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aUuyIodyfuSTFLkCbP96iAAAAJI"]
[Wed Dec 24 17:28:04.837411 2025] [:error] [pid 28405:tid 28412] [client 52.141.46.221:5152] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUuyJMKkTWlhmfdXFqZQUQAAAUM"]
[Wed Dec 24 17:28:06.978776 2025] [:error] [pid 16466:tid 16477] [client 52.141.46.221:26160] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUuyJru0JcuKJMjJn6wbCQAAAAc"]
[Wed Dec 24 17:28:10.858442 2025] [:error] [pid 16468:tid 16532] [client 52.141.46.221:57745] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUuyKodyfuSTFLkCbP96igAAAIg"]
[Wed Dec 24 17:28:13.348296 2025] [:error] [pid 28405:tid 28430] [client 52.141.46.221:55765] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aUuyLcKkTWlhmfdXFqZQWwAAAVQ"]
[Wed Dec 24 17:28:14.078832 2025] [:error] [pid 28405:tid 28427] [client 52.141.46.221:6002] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aUuyLsKkTWlhmfdXFqZQYAAAAVE"]
[Wed Dec 24 17:28:23.498329 2025] [:error] [pid 28777:tid 28790] [client 52.141.46.221:26072] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aUuyN5BVBcZ34cSqz8ohvQAAAYs"]
[Wed Dec 24 17:28:25.148138 2025] [:error] [pid 54139:tid 54153] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/aw.php
[Wed Dec 24 17:28:25.291289 2025] [:error] [pid 54139:tid 54159] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/sfvul.php
[Wed Dec 24 17:28:25.449987 2025] [:error] [pid 54139:tid 54141] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/icdwb.php
[Wed Dec 24 17:28:25.681806 2025] [:error] [pid 54139:tid 54158] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/ticket.php
[Wed Dec 24 17:28:25.836559 2025] [:error] [pid 54139:tid 54165] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Dec 24 17:28:25.978353 2025] [:error] [pid 54139:tid 54151] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Dec 24 17:28:27.290822 2025] [:error] [pid 54139:tid 54151] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/amphicyon.php
[Wed Dec 24 17:28:27.442238 2025] [:error] [pid 54139:tid 54162] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Wed Dec 24 17:28:27.919013 2025] [:error] [pid 54139:tid 54154] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/lock1.php
[Wed Dec 24 17:28:28.061675 2025] [:error] [pid 54139:tid 54144] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Wed Dec 24 17:28:28.230611 2025] [:error] [pid 54139:tid 54152] [client 52.141.46.221:5973] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Wed Dec 24 17:28:28.369624 2025] [:error] [pid 54139:tid 54163] [client 52.141.46.221:5973] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aUuyPMrYCZenIDzgXuKC2AAAARY"]
[Wed Dec 24 17:28:32.021896 2025] [:error] [pid 16550:tid 16561] [client 52.141.46.221:26070] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aUuyQKYYcdD-LuO7vrDkFAAAAMk"]
[Wed Dec 24 17:28:33.041986 2025] [:error] [pid 29371:tid 29390] [client 52.141.46.221:55754] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aUuyQXs-DlKLysSq5L9__AAAAdE"]
[Wed Dec 24 17:28:41.487647 2025] [:error] [pid 28777:tid 28790] [client 52.141.46.221:57065] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aUuySZBVBcZ34cSqz8ohxgAAAYs"]
[Wed Dec 24 17:28:42.334115 2025] [:error] [pid 16550:tid 16559] [client 52.141.46.221:40079] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUuySqYYcdD-LuO7vrDkHwAAAMc"]
[Wed Dec 24 17:28:48.829808 2025] [:error] [pid 16467:tid 16512] [client 52.141.46.221:57051] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUuyUI0TJMcBxX5slgo1owAAAE8"]
[Wed Dec 24 17:28:51.285493 2025] [:error] [pid 16468:tid 16531] [client 52.141.46.221:28843] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUuyU4dyfuSTFLkCbP96ngAAAIc"]
[Wed Dec 24 17:28:52.712528 2025] [:error] [pid 29371:tid 29376] [client 52.141.46.221:57695] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aUuyVHs-DlKLysSq5L-AAwAAAcM"]
[Wed Dec 24 17:28:54.535196 2025] [:error] [pid 54139:tid 54142] [client 52.141.46.221:57042] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUuyVsrYCZenIDzgXuKC5gAAAQE"]
[Wed Dec 24 17:28:58.224323 2025] [:error] [pid 16468:tid 16534] [client 52.141.46.221:54362] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUuyWodyfuSTFLkCbP96oAAAAIo"]
[Wed Dec 24 17:29:01.740437 2025] [:error] [pid 16468:tid 16546] [client 52.141.46.221:25784] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUuyXYdyfuSTFLkCbP96oQAAAJY"]
[Wed Dec 24 17:29:05.197367 2025] [:error] [pid 28777:tid 28786] [client 52.141.46.221:32710] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aUuyYZBVBcZ34cSqz8oh0AAAAYc"]
[Wed Dec 24 17:29:06.790816 2025] [:error] [pid 28777:tid 28790] [client 52.141.46.221:43835] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aUuyYpBVBcZ34cSqz8oh0gAAAYs"]
[Wed Dec 24 17:29:11.628739 2025] [:error] [pid 16550:tid 16568] [client 52.141.46.221:43076] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aUuyZ6YYcdD-LuO7vrDkLAAAANA"]
[Wed Dec 24 17:29:17.367624 2025] [:error] [pid 16468:tid 16541] [client 52.141.46.221:31130] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aUuybYdyfuSTFLkCbP96sgAAAJE"]
[Wed Dec 24 17:29:18.960765 2025] [:error] [pid 28405:tid 28423] [client 52.141.46.221:46811] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aUuybsKkTWlhmfdXFqZQuAAAAU0"]
[Wed Dec 24 17:29:20.685186 2025] [:error] [pid 16550:tid 16557] [client 52.141.46.221:46796] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aUuycKYYcdD-LuO7vrDkMQAAAMU"]
[Wed Dec 24 17:29:21.542566 2025] [:error] [pid 16466:tid 16491] [client 52.141.46.221:29461] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aUuycbu0JcuKJMjJn6wbQAAAABU"]
[Wed Dec 24 17:29:24.434996 2025] [:error] [pid 16468:tid 16545] [client 52.141.46.221:44866] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aUuydIdyfuSTFLkCbP96tgAAAJU"]
[Wed Dec 24 17:29:24.869215 2025] [:error] [pid 16467:tid 16507] [client 52.141.46.221:45526] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aUuydI0TJMcBxX5slgo1sgAAAEo"]
[Wed Dec 24 17:29:26.239827 2025] [:error] [pid 28777:tid 28803] [client 52.141.46.221:45511] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aUuydpBVBcZ34cSqz8oh2QAAAZg"]
[Wed Dec 24 17:29:27.366054 2025] [:error] [pid 29371:tid 29378] [client 52.141.46.221:29472] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aUuyd3s-DlKLysSq5L-ALgAAAcU"]
[Wed Dec 24 17:29:30.589961 2025] [:error] [pid 16468:tid 16532] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Dec 24 17:29:30.756303 2025] [:error] [pid 16468:tid 16541] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Wed Dec 24 17:29:30.934782 2025] [:error] [pid 16468:tid 16541] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/xpw.php
[Wed Dec 24 17:29:31.142041 2025] [:error] [pid 16468:tid 16533] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Wed Dec 24 17:29:31.308508 2025] [:error] [pid 16468:tid 16531] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/akp.php
[Wed Dec 24 17:29:31.468310 2025] [:error] [pid 16468:tid 16530] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/cwsd.php
[Wed Dec 24 17:29:31.750144 2025] [:error] [pid 16468:tid 16538] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/tll.php
[Wed Dec 24 17:29:32.143000 2025] [:error] [pid 16468:tid 16527] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Wed Dec 24 17:29:32.298866 2025] [:error] [pid 16468:tid 16524] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/idea.php
[Wed Dec 24 17:29:32.458349 2025] [:error] [pid 16468:tid 16539] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/pepe.php
[Wed Dec 24 17:29:32.634962 2025] [:error] [pid 16468:tid 16531] [client 52.141.46.221:44231] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Wed Dec 24 17:29:32.815020 2025] [:error] [pid 16468:tid 16534] [client 52.141.46.221:44231] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yca.php"] [unique_id "aUuyfIdyfuSTFLkCbP97GwAAAIo"]
[Wed Dec 24 17:29:37.513986 2025] [:error] [pid 28777:tid 28794] [client 52.141.46.221:27078] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yca.php"] [unique_id "aUuygZBVBcZ34cSqz8oh3QAAAY8"]
[Wed Dec 24 17:29:38.875401 2025] [:error] [pid 16467:tid 16520] [client 52.141.46.221:34814] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yca.php"] [unique_id "aUuygo0TJMcBxX5slgo1vAAAAFc"]
[Wed Dec 24 17:29:41.993319 2025] [:error] [pid 28405:tid 28432] [client 52.141.46.221:58718] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yca.php"] [unique_id "aUuyhcKkTWlhmfdXFqZQzgAAAVY"]
[Wed Dec 24 17:29:42.802954 2025] [:error] [pid 16466:tid 16492] [client 52.141.46.221:43802] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUuyhru0JcuKJMjJn6wbUgAAABY"]
[Wed Dec 24 17:29:46.466769 2025] [:error] [pid 28405:tid 28415] [client 52.141.46.221:32746] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUuyisKkTWlhmfdXFqZQ1QAAAUY"]
[Wed Dec 24 17:29:47.175026 2025] [:error] [pid 29371:tid 29394] [client 52.141.46.221:40088] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUuyi3s-DlKLysSq5L-AQQAAAdU"]
[Wed Dec 24 17:29:50.051618 2025] [:error] [pid 16468:tid 16544] [client 52.141.46.221:28855] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUuyjodyfuSTFLkCbP97LwAAAJQ"]
[Wed Dec 24 17:29:52.640621 2025] [:error] [pid 16468:tid 16544] [client 52.141.46.221:28855] [client 52.141.46.221] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "34.87.42.98_ba9d5453ca2f799c46fb0ab777295be766174fb4"): Internal error (specific information not available) [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aUuyjodyfuSTFLkCbP97LwAAAJQ"]
[Wed Dec 24 17:29:53.011082 2025] [:error] [pid 16468:tid 16534] [client 52.141.46.221:5767] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aUuykYdyfuSTFLkCbP97MAAAAIo"]
[Wed Dec 24 17:29:55.608927 2025] [:error] [pid 54139:tid 54145] [client 52.141.46.221:44938] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aUuyk8rYCZenIDzgXuKDVwAAAQQ"]
[Wed Dec 24 17:30:01.143317 2025] [:error] [pid 54139:tid 54162] [client 52.141.46.221:5253] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aUuymcrYCZenIDzgXuKDWwAAARU"]
[Wed Dec 24 17:30:09.468396 2025] [:error] [pid 28405:tid 28424] [client 52.141.46.221:46868] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aUuyocKkTWlhmfdXFqZQ5gAAAU4"]
[Wed Dec 24 17:30:10.427940 2025] [:error] [pid 16466:tid 16473] [client 52.141.46.221:32150] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aUuyoru0JcuKJMjJn6wbnAAAAAM"]
[Wed Dec 24 17:30:14.658703 2025] [:error] [pid 28405:tid 28417] [client 52.141.46.221:37644] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aUuypsKkTWlhmfdXFqZQ6QAAAUg"]
[Wed Dec 24 17:30:15.868838 2025] [:error] [pid 28405:tid 28426] [client 52.141.46.221:35512] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aUuyp8KkTWlhmfdXFqZQ6wAAAVA"]
[Wed Dec 24 17:30:17.805643 2025] [:error] [pid 29371:tid 29390] [client 52.141.46.221:37682] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/j.php"] [unique_id "aUuyqXs-DlKLysSq5L-AowAAAdE"]
[Wed Dec 24 17:30:20.981832 2025] [:error] [pid 54139:tid 54163] [client 52.141.46.221:58754] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/j.php"] [unique_id "aUuyrMrYCZenIDzgXuKDaQAAARY"]
[Wed Dec 24 17:30:26.794842 2025] [:error] [pid 54139:tid 54143] [client 52.141.46.221:38141] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/j.php"] [unique_id "aUuyssrYCZenIDzgXuKDbQAAAQI"]
[Wed Dec 24 17:30:29.447091 2025] [:error] [pid 54139:tid 54164] [client 52.141.46.221:46869] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/j.php"] [unique_id "aUuytcrYCZenIDzgXuKDbwAAARc"]
[Wed Dec 24 17:30:32.620979 2025] [:error] [pid 16467:tid 16517] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Wed Dec 24 17:30:32.766156 2025] [:error] [pid 16467:tid 16508] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/ucp.php
[Wed Dec 24 17:30:32.955156 2025] [:error] [pid 16467:tid 16509] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/zse.php
[Wed Dec 24 17:30:33.268041 2025] [:error] [pid 16467:tid 16519] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Dec 24 17:30:33.409166 2025] [:error] [pid 16467:tid 16505] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Dec 24 17:30:33.558124 2025] [:error] [pid 16467:tid 16502] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Wed Dec 24 17:30:33.718600 2025] [:error] [pid 16467:tid 16510] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Dec 24 17:30:33.859867 2025] [:error] [pid 16467:tid 16504] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/orm.php
[Wed Dec 24 17:30:34.375450 2025] [:error] [pid 16467:tid 16516] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Wed Dec 24 17:30:34.544870 2025] [:error] [pid 16467:tid 16513] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Dec 24 17:30:34.747101 2025] [:error] [pid 16467:tid 16514] [client 52.141.46.221:58776] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Wed Dec 24 17:30:34.915711 2025] [:error] [pid 16467:tid 16521] [client 52.141.46.221:58776] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aUuyuo0TJMcBxX5slgo14QAAAFg"]
[Wed Dec 24 17:30:39.736283 2025] [:error] [pid 16466:tid 16493] [client 52.141.46.221:37691] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aUuyv7u0JcuKJMjJn6wb0gAAABc"]
[Wed Dec 24 17:30:42.465567 2025] [:error] [pid 54139:tid 54142] [client 52.141.46.221:58762] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aUuywsrYCZenIDzgXuKDcwAAAQE"]
[Wed Dec 24 17:30:43.157780 2025] [:error] [pid 16467:tid 16518] [client 52.141.46.221:32179] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aUuyw40TJMcBxX5slgo15gAAAFU"]
[Wed Dec 24 17:30:45.924212 2025] [:error] [pid 16468:tid 16542] [client 52.141.46.221:28122] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aUuyxYdyfuSTFLkCbP97XgAAAJI"]
[Wed Dec 24 17:30:46.675783 2025] [:error] [pid 16468:tid 16541] [client 52.141.46.221:58763] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aUuyxodyfuSTFLkCbP97XwAAAJE"]
[Wed Dec 24 17:30:47.810924 2025] [:error] [pid 16550:tid 16561] [client 52.141.46.221:28120] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aUuyx6YYcdD-LuO7vrDkYQAAAMk"]
[Wed Dec 24 17:30:49.653046 2025] [:error] [pid 28405:tid 28410] [client 52.141.46.221:41959] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aUuyycKkTWlhmfdXFqZRAgAAAUE"]
[Wed Dec 24 17:30:50.378236 2025] [:error] [pid 54139:tid 54145] [client 52.141.46.221:32159] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aUuyysrYCZenIDzgXuKDewAAAQQ"]
[Wed Dec 24 17:30:51.450644 2025] [:error] [pid 54139:tid 54141] [client 52.141.46.221:46852] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aUuyy8rYCZenIDzgXuKDfAAAAQA"]
[Wed Dec 24 17:30:53.302266 2025] [:error] [pid 29371:tid 29379] [client 52.141.46.221:38081] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aUuyzXs-DlKLysSq5L-AtQAAAcY"]
[Wed Dec 24 17:30:53.989167 2025] [:error] [pid 54139:tid 54161] [client 52.141.46.221:35483] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aUuyzcrYCZenIDzgXuKDfgAAARQ"]
[Wed Dec 24 17:30:55.233985 2025] [:error] [pid 28777:tid 28794] [client 52.141.46.221:28114] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aUuyz5BVBcZ34cSqz8oiBQAAAY8"]
[Wed Dec 24 17:30:56.398085 2025] [:error] [pid 28777:tid 28785] [client 52.141.46.221:32164] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aUuy0JBVBcZ34cSqz8oiBgAAAYY"]
[Wed Dec 24 17:30:57.940218 2025] [:error] [pid 16466:tid 16474] [client 52.141.46.221:5279] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aUuy0bu0JcuKJMjJn6wb4gAAAAQ"]
[Wed Dec 24 17:30:59.318706 2025] [:error] [pid 16466:tid 16473] [client 52.141.46.221:28119] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aUuy07u0JcuKJMjJn6wb5AAAAAM"]
[Wed Dec 24 17:31:02.407454 2025] [:error] [pid 16467:tid 16516] [client 52.141.46.221:5280] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUuy1o0TJMcBxX5slgo17QAAAFM"]
[Wed Dec 24 17:31:03.334061 2025] [:error] [pid 16468:tid 16531] [client 52.141.46.221:38143] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUuy14dyfuSTFLkCbP97YwAAAIc"]
[Wed Dec 24 17:31:07.025156 2025] [:error] [pid 29371:tid 29389] [client 52.141.46.221:38114] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUuy23s-DlKLysSq5L-AtwAAAdA"]
[Wed Dec 24 17:31:08.154770 2025] [:error] [pid 54139:tid 54159] [client 52.141.46.221:5406] [client 52.141.46.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aUuy3MrYCZenIDzgXuKDjwAAARI"]
[Thu Dec 25 02:10:44.583514 2025] [:error] [pid 16659:tid 16724] [client 195.178.110.223:42000] [client 195.178.110.223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aUwspC2KqR0Lr_kutLvLawAAAVA"]
[Thu Dec 25 09:06:43.033154 2025] [:error] [pid 31570:tid 31620] [client 43.135.145.77:54252] [client 43.135.145.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUyOI2Py2DpAzW_4a2jIeQAAAFQ"]
[Thu Dec 25 10:05:58.164802 2025] [:error] [pid 31571:tid 31648] [client 43.153.85.46:52520] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUycBu7e_lLK2X5wU8k8NwAAAJU"]
[Thu Dec 25 10:58:33.866267 2025] [:error] [pid 31570:tid 31602] [client 125.75.66.97:40233] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUyoWWPy2DpAzW_4a2jdXgAAAEI"]
[Thu Dec 25 12:14:36.915923 2025] [:error] [pid 31570:tid 31609] [client 43.157.170.126:36932] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aUy6LGPy2DpAzW_4a2jqpgAAAEk"]
[Thu Dec 25 15:55:11.749248 2025] [:error] [pid 2996:tid 3005] [client 43.133.66.51:60264] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aUzt36rrTp0EWNyhaIQHIgAAAQc"]
[Thu Dec 25 18:36:49.243301 2025] [:error] [pid 31655:tid 31664] [client 43.153.19.83:34616] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aU0TwZozPMk9HPtIJPOVDwAAAMc"]
[Thu Dec 25 21:41:13.859707 2025] [:error] [pid 22131:tid 22142] [client 174.138.85.139:57540] [client 174.138.85.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aU0--ZvVMtSTB4lX2fYr_gAAAEg"], referer: binance.com
[Thu Dec 25 22:02:43.332108 2025] [:error] [pid 27869:tid 27888] [client 43.155.26.193:57120] [client 43.155.26.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aU1EAxNK7_n86kBD7qfXEwAAAJE"]
[Thu Dec 25 22:09:08.202667 2025] [:error] [pid 22045:tid 22126] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Thu Dec 25 22:09:08.467979 2025] [:error] [pid 22045:tid 22112] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/d4.php
[Thu Dec 25 22:09:08.847691 2025] [:error] [pid 22045:tid 22117] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Thu Dec 25 22:09:09.104718 2025] [:error] [pid 22045:tid 22124] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/dlex.php
[Thu Dec 25 22:09:09.274506 2025] [:error] [pid 22045:tid 22107] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Dec 25 22:09:09.442710 2025] [:error] [pid 22045:tid 22105] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/pass.php
[Thu Dec 25 22:09:09.606750 2025] [:error] [pid 22045:tid 22114] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Thu Dec 25 22:09:10.019025 2025] [:error] [pid 22045:tid 22111] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Dec 25 22:09:10.183795 2025] [:error] [pid 22045:tid 22125] [client 4.194.116.41:20620] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Dec 25 22:09:10.668195 2025] [:error] [pid 22045:tid 22123] [client 4.194.116.41:20620] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU1FhqsGGmXjDnvlmHtt8wAAAVU"]
[Thu Dec 25 22:09:11.783189 2025] [:error] [pid 22043:tid 22053] [client 4.194.116.41:20733] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU1Fhz4YVtlb2Iz_QE5SQAAAAAU"]
[Thu Dec 25 22:09:14.106485 2025] [:error] [pid 22044:tid 22077] [client 4.194.116.41:20729] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU1FinPTC5rQKTB0FQ-eowAAAMI"]
[Thu Dec 25 22:09:15.915360 2025] [:error] [pid 22131:tid 22145] [client 4.194.116.41:20615] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU1Fi5vVMtSTB4lX2fY0sgAAAEs"]
[Thu Dec 25 22:09:21.578157 2025] [:error] [pid 27869:tid 27891] [client 4.194.116.41:20731] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aU1FkRNK7_n86kBD7qfaAQAAAJQ"]
[Thu Dec 25 22:09:25.987042 2025] [:error] [pid 22045:tid 22121] [client 4.194.116.41:20716] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aU1FlasGGmXjDnvlmHtt9QAAAVM"]
[Thu Dec 25 22:09:27.442329 2025] [:error] [pid 22045:tid 22106] [client 4.194.116.41:20690] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aU1Fl6sGGmXjDnvlmHtt9gAAAUQ"]
[Thu Dec 25 22:09:28.537651 2025] [:error] [pid 22045:tid 22113] [client 4.194.116.41:20710] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aU1FmKsGGmXjDnvlmHtt-wAAAUs"]
[Thu Dec 25 22:09:33.591869 2025] [:error] [pid 27869:tid 27873] [client 4.194.116.41:20610] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU1FnRNK7_n86kBD7qfaHAAAAII"]
[Thu Dec 25 22:09:35.701771 2025] [:error] [pid 22131:tid 22137] [client 4.194.116.41:20628] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU1Fn5vVMtSTB4lX2fY0yAAAAEQ"]
[Thu Dec 25 22:09:36.764235 2025] [:error] [pid 27869:tid 27871] [client 4.194.116.41:20707] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU1FoBNK7_n86kBD7qfaJAAAAIA"]
[Thu Dec 25 22:09:38.245993 2025] [:error] [pid 22044:tid 22094] [client 4.194.116.41:20719] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU1FonPTC5rQKTB0FQ-evwAAANM"]
[Thu Dec 25 22:09:39.067736 2025] [:error] [pid 27869:tid 27892] [client 4.194.116.41:20702] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aU1FoxNK7_n86kBD7qfaLQAAAJU"]
[Thu Dec 25 22:09:41.583355 2025] [:error] [pid 27869:tid 27876] [client 4.194.116.41:20723] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aU1FpRNK7_n86kBD7qfaNQAAAIU"]
[Thu Dec 25 22:09:42.482153 2025] [:error] [pid 22044:tid 22078] [client 4.194.116.41:20704] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aU1FpnPTC5rQKTB0FQ-eyQAAAMM"]
[Thu Dec 25 22:09:42.874361 2025] [:error] [pid 22043:tid 22066] [client 4.194.116.41:20725] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aU1Fpj4YVtlb2Iz_QE5SVgAAABI"]
[Thu Dec 25 22:09:44.633331 2025] [:error] [pid 22131:tid 22151] [client 4.194.116.41:20658] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aU1FqJvVMtSTB4lX2fY0zwAAAFA"]
[Thu Dec 25 22:09:47.336207 2025] [:error] [pid 22131:tid 22137] [client 4.194.116.41:20686] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aU1Fq5vVMtSTB4lX2fY01AAAAEQ"]
[Thu Dec 25 22:09:49.255292 2025] [:error] [pid 22044:tid 22094] [client 4.194.116.41:20612] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aU1FrXPTC5rQKTB0FQ-e0gAAANM"]
[Thu Dec 25 22:09:53.996272 2025] [:error] [pid 27869:tid 27879] [client 4.194.116.41:20679] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aU1FsRNK7_n86kBD7qfaTwAAAIg"]
[Thu Dec 25 22:09:56.035088 2025] [:error] [pid 22131:tid 22144] [client 4.194.116.41:20690] [client 4.194.116.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aU1FtJvVMtSTB4lX2fY03AAAAEo"]
[Thu Dec 25 22:09:59.023798 2025] [:error] [pid 22131:tid 22140] [client 4.194.116.41:20705] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU1Ft5vVMtSTB4lX2fY04gAAAEY"]
[Thu Dec 25 22:10:00.514980 2025] [:error] [pid 22131:tid 22133] [client 4.194.116.41:20698] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU1FuJvVMtSTB4lX2fY05AAAAEA"]
[Thu Dec 25 22:10:03.592542 2025] [:error] [pid 22044:tid 22088] [client 4.194.116.41:20617] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU1Fu3PTC5rQKTB0FQ-e9AAAAM0"]
[Thu Dec 25 22:10:05.114439 2025] [:error] [pid 22045:tid 22118] [client 4.194.116.41:20682] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU1FvasGGmXjDnvlmHtuIAAAAVA"]
[Thu Dec 25 22:10:06.010914 2025] [:error] [pid 22131:tid 22140] [client 4.194.116.41:20678] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litanies.php"] [unique_id "aU1FvpvVMtSTB4lX2fY07AAAAEY"]
[Thu Dec 25 22:10:06.956395 2025] [:error] [pid 22131:tid 22134] [client 4.194.116.41:20720] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litanies.php"] [unique_id "aU1FvpvVMtSTB4lX2fY07QAAAEE"]
[Thu Dec 25 22:10:09.363527 2025] [:error] [pid 22045:tid 22125] [client 4.194.116.41:20709] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litanies.php"] [unique_id "aU1FwasGGmXjDnvlmHtuKQAAAVc"]
[Thu Dec 25 22:10:10.630789 2025] [:error] [pid 22044:tid 22093] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/litanies.php
[Thu Dec 25 22:10:10.749193 2025] [:error] [pid 22044:tid 22082] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Thu Dec 25 22:10:10.874509 2025] [:error] [pid 22044:tid 22095] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Thu Dec 25 22:10:10.991712 2025] [:error] [pid 22044:tid 22087] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/kwm4.php
[Thu Dec 25 22:10:11.121664 2025] [:error] [pid 22044:tid 22096] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/just2.php
[Thu Dec 25 22:10:11.237867 2025] [:error] [pid 22044:tid 22079] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Thu Dec 25 22:10:11.402878 2025] [:error] [pid 22044:tid 22097] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/geger.php
[Thu Dec 25 22:10:11.593356 2025] [:error] [pid 22044:tid 22078] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/let.php
[Thu Dec 25 22:10:11.886065 2025] [:error] [pid 22044:tid 22086] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/np.php
[Thu Dec 25 22:10:11.999191 2025] [:error] [pid 22044:tid 22098] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/ask.php
[Thu Dec 25 22:10:12.107645 2025] [:error] [pid 22044:tid 22088] [client 4.194.116.41:20642] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Thu Dec 25 22:10:12.208412 2025] [:error] [pid 22044:tid 22091] [client 4.194.116.41:20642] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aU1FxHPTC5rQKTB0FQ-fDwAAANA"]
[Thu Dec 25 22:10:15.258056 2025] [:error] [pid 22043:tid 22070] [client 4.194.116.41:20687] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aU1Fxz4YVtlb2Iz_QE5SfAAAABY"]
[Thu Dec 25 22:10:18.381440 2025] [:error] [pid 22043:tid 22056] [client 4.194.116.41:20727] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aU1Fyj4YVtlb2Iz_QE5SfgAAAAg"]
[Thu Dec 25 22:10:19.418407 2025] [:error] [pid 22044:tid 22076] [client 4.194.116.41:20684] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aU1Fy3PTC5rQKTB0FQ-fGQAAAME"]
[Thu Dec 25 22:10:21.397141 2025] [:error] [pid 22045:tid 22108] [client 4.194.116.41:20623] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aU1FzasGGmXjDnvlmHtuOgAAAUY"]
[Thu Dec 25 22:10:23.094782 2025] [:error] [pid 27869:tid 27886] [client 4.194.116.41:20648] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aU1FzxNK7_n86kBD7qfacwAAAI8"]
[Thu Dec 25 22:10:24.359028 2025] [:error] [pid 22131:tid 22147] [client 4.194.116.41:20715] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aU1F0JvVMtSTB4lX2fY1CwAAAEw"]
[Thu Dec 25 22:10:28.220063 2025] [:error] [pid 22131:tid 22150] [client 4.194.116.41:20721] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aU1F1JvVMtSTB4lX2fY1EAAAAE8"]
[Thu Dec 25 22:10:30.105145 2025] [:error] [pid 22043:tid 22068] [client 4.194.116.41:20683] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aU1F1j4YVtlb2Iz_QE5ShAAAABQ"]
[Thu Dec 25 22:10:31.664780 2025] [:error] [pid 22043:tid 22061] [client 4.194.116.41:20566] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aU1F1z4YVtlb2Iz_QE5ShwAAAA0"]
[Thu Dec 25 22:10:32.651274 2025] [:error] [pid 22045:tid 22109] [client 4.194.116.41:20708] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aU1F2KsGGmXjDnvlmHtuRAAAAUc"]
[Thu Dec 25 22:10:35.994773 2025] [:error] [pid 22045:tid 22114] [client 4.194.116.41:20735] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aU1F26sGGmXjDnvlmHtuRwAAAUw"]
[Thu Dec 25 22:10:38.650828 2025] [:error] [pid 27869:tid 27879] [client 4.194.116.41:20613] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aU1F3hNK7_n86kBD7qfafAAAAIg"]
[Thu Dec 25 22:10:41.199269 2025] [:error] [pid 22043:tid 22051] [client 4.194.116.41:20724] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aU1F4T4YVtlb2Iz_QE5SkAAAAAM"]
[Thu Dec 25 22:10:43.241479 2025] [:error] [pid 27869:tid 27881] [client 4.194.116.41:20706] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aU1F4xNK7_n86kBD7qfafgAAAIo"]
[Thu Dec 25 22:10:45.752563 2025] [:error] [pid 22043:tid 22059] [client 4.194.116.41:20730] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aU1F5T4YVtlb2Iz_QE5SmAAAAAs"]
[Thu Dec 25 22:10:48.590093 2025] [:error] [pid 22043:tid 22057] [client 4.194.116.41:20611] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aU1F6D4YVtlb2Iz_QE5SnAAAAAk"]
[Thu Dec 25 22:10:54.872275 2025] [:error] [pid 22043:tid 22072] [client 4.194.116.41:20693] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aU1F7j4YVtlb2Iz_QE5SogAAABg"]
[Thu Dec 25 22:10:59.826055 2025] [:error] [pid 22043:tid 22055] [client 4.194.116.41:20726] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aU1F8z4YVtlb2Iz_QE5SpwAAAAc"]
[Thu Dec 25 22:11:07.449604 2025] [:error] [pid 22131:tid 22139] [client 4.194.116.41:20712] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aU1F-5vVMtSTB4lX2fY1NQAAAEU"]
[Thu Dec 25 22:11:22.622027 2025] [:error] [pid 22045:tid 22121] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Dec 25 22:11:22.944915 2025] [:error] [pid 22045:tid 22113] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/shlo.php
[Thu Dec 25 22:11:23.114660 2025] [:error] [pid 22045:tid 22102] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/sec.php
[Thu Dec 25 22:11:23.306423 2025] [:error] [pid 22045:tid 22116] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Dec 25 22:11:23.488658 2025] [:error] [pid 22045:tid 22104] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Dec 25 22:11:23.665886 2025] [:error] [pid 22045:tid 22124] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Thu Dec 25 22:11:23.840742 2025] [:error] [pid 22045:tid 22125] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Thu Dec 25 22:11:24.068607 2025] [:error] [pid 22045:tid 22117] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/bluejackets.php
[Thu Dec 25 22:11:24.236413 2025] [:error] [pid 22045:tid 22114] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Thu Dec 25 22:11:24.419594 2025] [:error] [pid 22045:tid 22105] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/sx21_1.php
[Thu Dec 25 22:11:24.609764 2025] [:error] [pid 22045:tid 22103] [client 4.194.116.41:20722] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Thu Dec 25 22:11:24.897449 2025] [:error] [pid 22045:tid 22109] [client 4.194.116.41:20722] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aU1GDKsGGmXjDnvlmHtudwAAAUc"]
[Thu Dec 25 22:11:26.403015 2025] [:error] [pid 22043:tid 22070] [client 4.194.116.41:20621] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aU1GDj4YVtlb2Iz_QE5StgAAABY"]
[Thu Dec 25 22:11:29.268969 2025] [:error] [pid 22044:tid 22090] [client 4.194.116.41:20654] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aU1GEXPTC5rQKTB0FQ-fbQAAAM8"]
[Thu Dec 25 22:11:31.031859 2025] [:error] [pid 22044:tid 22089] [client 4.194.116.41:20663] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aU1GE3PTC5rQKTB0FQ-fcgAAAM4"]
[Thu Dec 25 22:11:33.044996 2025] [:error] [pid 22045:tid 22104] [client 4.194.116.41:20697] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU1GFasGGmXjDnvlmHtugAAAAUI"]
[Thu Dec 25 22:11:34.404883 2025] [:error] [pid 27869:tid 27884] [client 4.194.116.41:20545] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU1GFhNK7_n86kBD7qfarQAAAI0"]
[Thu Dec 25 22:11:36.917867 2025] [:error] [pid 22045:tid 22124] [client 4.194.116.41:20717] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU1GGKsGGmXjDnvlmHtuggAAAVY"]
[Thu Dec 25 22:11:37.688977 2025] [:error] [pid 22044:tid 22084] [client 4.194.116.41:20659] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU1GGXPTC5rQKTB0FQ-fiwAAAMk"]
[Thu Dec 25 22:11:38.745177 2025] [:error] [pid 22045:tid 22106] [client 4.194.116.41:20665] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aU1GGqsGGmXjDnvlmHtujAAAAUQ"]
[Thu Dec 25 22:11:39.347606 2025] [:error] [pid 27869:tid 27887] [client 4.194.116.41:20685] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aU1GGxNK7_n86kBD7qfasQAAAJA"]
[Thu Dec 25 22:11:40.211423 2025] [:error] [pid 22044:tid 22081] [client 4.194.116.41:20672] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aU1GHHPTC5rQKTB0FQ-fkQAAAMY"]
[Thu Dec 25 22:11:41.825818 2025] [:error] [pid 22044:tid 22098] [client 4.194.116.41:20732] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aU1GHXPTC5rQKTB0FQ-flAAAANc"]
[Thu Dec 25 22:11:43.609254 2025] [:error] [pid 22044:tid 22087] [client 4.194.116.41:20641] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfvul.php"] [unique_id "aU1GH3PTC5rQKTB0FQ-flgAAAMw"]
[Thu Dec 25 22:11:47.313800 2025] [:error] [pid 22045:tid 22107] [client 4.194.116.41:20571] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfvul.php"] [unique_id "aU1GI6sGGmXjDnvlmHtumwAAAUU"]
[Thu Dec 25 22:11:47.911684 2025] [:error] [pid 22131:tid 22136] [client 4.194.116.41:20713] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfvul.php"] [unique_id "aU1GI5vVMtSTB4lX2fY1XQAAAEM"]
[Thu Dec 25 22:11:50.037811 2025] [:error] [pid 27869:tid 27893] [client 4.194.116.41:20651] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfvul.php"] [unique_id "aU1GJhNK7_n86kBD7qfazwAAAJY"]
[Thu Dec 25 22:11:52.316246 2025] [:error] [pid 27869:tid 27888] [client 4.194.116.41:20680] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aU1GKBNK7_n86kBD7qfa1AAAAJE"]
[Thu Dec 25 22:11:55.184861 2025] [:error] [pid 22044:tid 22095] [client 4.194.116.41:20714] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aU1GK3PTC5rQKTB0FQ-fpQAAANQ"]
[Thu Dec 25 22:11:56.066638 2025] [:error] [pid 22044:tid 22082] [client 4.194.116.41:20664] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aU1GLHPTC5rQKTB0FQ-fqAAAAMc"]
[Thu Dec 25 22:11:57.662096 2025] [:error] [pid 22044:tid 22078] [client 4.194.116.41:20562] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aU1GLXPTC5rQKTB0FQ-ftQAAAMM"]
[Thu Dec 25 22:12:01.066868 2025] [:error] [pid 27869:tid 27881] [client 4.194.116.41:20670] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "aU1GMRNK7_n86kBD7qfa4gAAAIo"]
[Thu Dec 25 22:12:01.765150 2025] [:error] [pid 27869:tid 27874] [client 4.194.116.41:20634] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "aU1GMRNK7_n86kBD7qfa5QAAAIM"]
[Thu Dec 25 22:12:11.742499 2025] [:error] [pid 22131:tid 22159] [client 4.194.116.41:20575] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "aU1GO5vVMtSTB4lX2fY1cwAAAFc"]
[Thu Dec 25 22:12:12.945816 2025] [:error] [pid 22043:tid 22066] [client 4.194.116.41:20692] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "aU1GPD4YVtlb2Iz_QE5S6gAAABI"]
[Thu Dec 25 22:12:14.091722 2025] [:error] [pid 22131:tid 22142] [client 4.194.116.41:20627] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aU1GPpvVMtSTB4lX2fY1egAAAEg"]
[Thu Dec 25 22:12:18.290376 2025] [:error] [pid 27869:tid 27890] [client 4.194.116.41:20565] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aU1GQhNK7_n86kBD7qfa_wAAAJM"]
[Thu Dec 25 22:12:19.196758 2025] [:error] [pid 22043:tid 22055] [client 4.194.116.41:20616] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aU1GQz4YVtlb2Iz_QE5S8gAAAAc"]
[Thu Dec 25 22:12:20.329424 2025] [:error] [pid 22043:tid 22063] [client 4.194.116.41:20700] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aU1GRD4YVtlb2Iz_QE5S9gAAAA8"]
[Thu Dec 25 22:12:21.816055 2025] [:error] [pid 22045:tid 22114] [client 4.194.116.41:20653] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aU1GRasGGmXjDnvlmHtu1QAAAUw"]
[Thu Dec 25 22:12:25.324283 2025] [:error] [pid 27869:tid 27893] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Dec 25 22:12:25.417529 2025] [:error] [pid 27869:tid 27876] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/amphicyon.php
[Thu Dec 25 22:12:25.520395 2025] [:error] [pid 27869:tid 27880] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Dec 25 22:12:25.634031 2025] [:error] [pid 27869:tid 27890] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/lock1.php
[Thu Dec 25 22:12:25.994121 2025] [:error] [pid 27869:tid 27878] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Dec 25 22:12:26.094805 2025] [:error] [pid 27869:tid 27871] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Thu Dec 25 22:12:26.416970 2025] [:error] [pid 27869:tid 27892] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Thu Dec 25 22:12:26.760369 2025] [:error] [pid 27869:tid 27891] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Thu Dec 25 22:12:26.850572 2025] [:error] [pid 27869:tid 27883] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/minik.php
[Thu Dec 25 22:12:26.943320 2025] [:error] [pid 27869:tid 27872] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Thu Dec 25 22:12:27.036809 2025] [:error] [pid 27869:tid 27895] [client 4.194.116.41:20618] File does not exist: /usr/local/apache/htdocs/suspended-page/nx.php
[Thu Dec 25 22:12:27.239038 2025] [:error] [pid 27869:tid 27887] [client 4.194.116.41:20618] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU1GSxNK7_n86kBD7qfbEwAAAJA"]
[Thu Dec 25 22:12:33.524007 2025] [:error] [pid 22044:tid 22087] [client 4.194.116.41:20728] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU1GUXPTC5rQKTB0FQ-f9AAAAMw"]
[Thu Dec 25 22:12:35.221267 2025] [:error] [pid 22043:tid 22066] [client 4.194.116.41:20626] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU1GUz4YVtlb2Iz_QE5TGgAAABI"]
[Thu Dec 25 22:12:37.858193 2025] [:error] [pid 22043:tid 22063] [client 4.194.116.41:20699] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU1GVT4YVtlb2Iz_QE5TKwAAAA8"]
[Thu Dec 25 22:12:38.808824 2025] [:error] [pid 22043:tid 22060] [client 4.194.116.41:20573] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aU1GVj4YVtlb2Iz_QE5TMgAAAAw"]
[Thu Dec 25 22:12:40.786836 2025] [:error] [pid 22045:tid 22110] [client 4.194.116.41:20689] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aU1GWKsGGmXjDnvlmHtu9AAAAUg"]
[Thu Dec 25 22:12:46.329592 2025] [:error] [pid 22045:tid 22102] [client 4.194.116.41:20577] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aU1GXqsGGmXjDnvlmHtvAgAAAUA"]
[Thu Dec 25 22:12:49.273156 2025] [:error] [pid 22043:tid 22050] [client 4.194.116.41:20549] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aU1GYT4YVtlb2Iz_QE5TPwAAAAI"]
[Thu Dec 25 22:12:52.875984 2025] [:error] [pid 27869:tid 27876] [client 4.194.116.41:20644] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aU1GZBNK7_n86kBD7qfbTAAAAIU"]
[Thu Dec 25 22:12:53.525956 2025] [:error] [pid 22043:tid 22065] [client 4.194.116.41:20675] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aU1GZT4YVtlb2Iz_QE5TRAAAABE"]
[Thu Dec 25 22:12:55.261906 2025] [:error] [pid 27869:tid 27880] [client 4.194.116.41:20624] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aU1GZxNK7_n86kBD7qfbTwAAAIk"]
[Thu Dec 25 22:12:55.914773 2025] [:error] [pid 22043:tid 22070] [client 4.194.116.41:20553] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aU1GZz4YVtlb2Iz_QE5TTQAAABY"]
[Thu Dec 25 22:12:57.341182 2025] [:error] [pid 22043:tid 22072] [client 4.194.116.41:20614] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aU1GaT4YVtlb2Iz_QE5TTwAAABg"]
[Thu Dec 25 22:12:58.786935 2025] [:error] [pid 27869:tid 27872] [client 4.194.116.41:20666] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aU1GahNK7_n86kBD7qfbUgAAAIE"]
[Thu Dec 25 22:12:59.837437 2025] [:error] [pid 22045:tid 22109] [client 4.194.116.41:20681] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aU1Ga6sGGmXjDnvlmHtvFQAAAUc"]
[Thu Dec 25 22:13:01.365467 2025] [:error] [pid 22044:tid 22080] [client 4.194.116.41:20688] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aU1GbXPTC5rQKTB0FQ-gJAAAAMU"]
[Thu Dec 25 22:13:03.766743 2025] [:error] [pid 27869:tid 27887] [client 4.194.116.41:20656] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aU1GbxNK7_n86kBD7qfbYwAAAJA"]
[Thu Dec 25 22:13:04.334425 2025] [:error] [pid 27869:tid 27885] [client 4.194.116.41:20699] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aU1GcBNK7_n86kBD7qfbZwAAAI4"]
[Thu Dec 25 22:13:07.993299 2025] [:error] [pid 22044:tid 22079] [client 4.194.116.41:20630] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aU1Gc3PTC5rQKTB0FQ-gNQAAAMQ"]
[Thu Dec 25 22:13:11.966018 2025] [:error] [pid 22044:tid 22087] [client 4.194.116.41:20694] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aU1Gd3PTC5rQKTB0FQ-gQQAAAMw"]
[Thu Dec 25 22:13:15.677783 2025] [:error] [pid 22044:tid 22089] [client 4.194.116.41:20546] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aU1Ge3PTC5rQKTB0FQ-gSAAAAM4"]
[Thu Dec 25 22:13:17.136666 2025] [:error] [pid 27869:tid 27876] [client 4.194.116.41:20557] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aU1GfRNK7_n86kBD7qfbigAAAIU"]
[Thu Dec 25 22:13:18.760050 2025] [:error] [pid 22044:tid 22079] [client 4.194.116.41:20661] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aU1GfnPTC5rQKTB0FQ-gUQAAAMQ"]
[Thu Dec 25 22:13:20.623374 2025] [:error] [pid 22044:tid 22098] [client 4.194.116.41:20635] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aU1GgHPTC5rQKTB0FQ-gVQAAANc"]
[Thu Dec 25 22:13:23.391079 2025] [:error] [pid 22131:tid 22159] [client 4.194.116.41:20509] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tll.php"] [unique_id "aU1Gg5vVMtSTB4lX2fY1zgAAAFc"]
[Thu Dec 25 22:13:28.085982 2025] [:error] [pid 22043:tid 22059] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/tll.php
[Thu Dec 25 22:13:28.299713 2025] [:error] [pid 22043:tid 22051] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Thu Dec 25 22:13:28.781346 2025] [:error] [pid 22043:tid 22062] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/idea.php
[Thu Dec 25 22:13:28.891194 2025] [:error] [pid 22043:tid 22067] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/pepe.php
[Thu Dec 25 22:13:28.984465 2025] [:error] [pid 22043:tid 22048] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Thu Dec 25 22:13:29.075821 2025] [:error] [pid 22043:tid 22064] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/yca.php
[Thu Dec 25 22:13:29.197766 2025] [:error] [pid 22043:tid 22063] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Dec 25 22:13:29.483451 2025] [:error] [pid 22043:tid 22060] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/ot.php
[Thu Dec 25 22:13:29.810681 2025] [:error] [pid 22043:tid 22071] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Thu Dec 25 22:13:29.900151 2025] [:error] [pid 22043:tid 22050] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/j.php
[Thu Dec 25 22:13:29.995452 2025] [:error] [pid 22043:tid 22053] [client 4.194.116.41:20552] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Thu Dec 25 22:13:30.083876 2025] [:error] [pid 22043:tid 22056] [client 4.194.116.41:20552] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aU1Gij4YVtlb2Iz_QE5ThAAAAAg"]
[Thu Dec 25 22:13:36.553616 2025] [:error] [pid 22044:tid 22075] [client 4.194.116.41:20551] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aU1GkHPTC5rQKTB0FQ-ghQAAAMA"]
[Thu Dec 25 22:13:37.632273 2025] [:error] [pid 22131:tid 22145] [client 4.194.116.41:20583] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aU1GkZvVMtSTB4lX2fY18QAAAEs"]
[Thu Dec 25 22:13:39.631609 2025] [:error] [pid 22044:tid 22078] [client 4.194.116.41:20673] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aU1Gk3PTC5rQKTB0FQ-gkAAAAMM"]
[Thu Dec 25 22:13:41.485883 2025] [:error] [pid 22044:tid 22081] [client 4.194.116.41:20556] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aU1GlXPTC5rQKTB0FQ-gmQAAAMY"]
[Thu Dec 25 22:13:46.342774 2025] [:error] [pid 22045:tid 22121] [client 4.194.116.41:20643] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aU1GmqsGGmXjDnvlmHtvSAAAAVM"]
[Thu Dec 25 22:13:49.631217 2025] [:error] [pid 22045:tid 22109] [client 4.194.116.41:20622] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aU1GnasGGmXjDnvlmHtvWgAAAUc"]
[Thu Dec 25 22:13:50.027151 2025] [:error] [pid 27869:tid 27890] [client 4.194.116.41:20652] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aU1GnhNK7_n86kBD7qfbtQAAAJM"]
[Thu Dec 25 22:13:52.059253 2025] [:error] [pid 22044:tid 22085] [client 4.194.116.41:20645] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU1GoHPTC5rQKTB0FQ-gsgAAAMo"]
[Thu Dec 25 22:13:53.373524 2025] [:error] [pid 27869:tid 27872] [client 4.194.116.41:20493] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU1GoRNK7_n86kBD7qfbvQAAAIE"]
[Thu Dec 25 22:13:55.734072 2025] [:error] [pid 27869:tid 27887] [client 4.194.116.41:20602] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU1GoxNK7_n86kBD7qfbwwAAAJA"]
[Thu Dec 25 22:13:59.186209 2025] [:error] [pid 22044:tid 22098] [client 4.194.116.41:20704] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU1Gp3PTC5rQKTB0FQ-gvwAAANc"]
[Thu Dec 25 22:14:02.034942 2025] [:error] [pid 22043:tid 22057] [client 4.194.116.41:20603] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU1Gqj4YVtlb2Iz_QE5TrQAAAAk"]
[Thu Dec 25 22:14:03.894310 2025] [:error] [pid 22044:tid 22081] [client 4.194.116.41:20625] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU1Gq3PTC5rQKTB0FQ-gxAAAAMY"]
[Thu Dec 25 22:14:05.257798 2025] [:error] [pid 22045:tid 22103] [client 4.194.116.41:20731] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU1GrasGGmXjDnvlmHtvawAAAUE"]
[Thu Dec 25 22:14:06.925603 2025] [:error] [pid 27869:tid 27884] [client 4.194.116.41:20702] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU1GrhNK7_n86kBD7qfb7gAAAI0"]
[Thu Dec 25 22:14:10.737798 2025] [:error] [pid 22045:tid 22124] [client 4.194.116.41:20631] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aU1GsqsGGmXjDnvlmHtvbAAAAVY"]
[Thu Dec 25 22:14:14.671430 2025] [:error] [pid 22044:tid 22090] [client 4.194.116.41:20629] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aU1GtnPTC5rQKTB0FQ-g2wAAAM8"]
[Thu Dec 25 22:14:16.070049 2025] [:error] [pid 22043:tid 22058] [client 4.194.116.41:20677] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aU1GuD4YVtlb2Iz_QE5TuwAAAAo"]
[Thu Dec 25 22:14:20.182286 2025] [:error] [pid 22045:tid 22120] [client 4.194.116.41:20619] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aU1GvKsGGmXjDnvlmHtvdAAAAVI"]
[Thu Dec 25 22:14:21.544584 2025] [:error] [pid 22045:tid 22111] [client 4.194.116.41:20668] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aU1GvasGGmXjDnvlmHtvfwAAAUk"]
[Thu Dec 25 22:14:22.466672 2025] [:error] [pid 22045:tid 22120] [client 4.194.116.41:20642] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aU1GvqsGGmXjDnvlmHtvhgAAAVI"]
[Thu Dec 25 22:14:23.778022 2025] [:error] [pid 22044:tid 22098] [client 4.194.116.41:20561] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aU1Gv3PTC5rQKTB0FQ-g5AAAANc"]
[Thu Dec 25 22:14:25.499649 2025] [:error] [pid 22131:tid 22145] [client 4.194.116.41:20709] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aU1GwZvVMtSTB4lX2fY2OwAAAEs"]
[Thu Dec 25 22:14:27.870629 2025] [:error] [pid 22044:tid 22096] [client 4.194.116.41:20720] [client 4.194.116.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aU1Gw3PTC5rQKTB0FQ-g8QAAANU"]
[Thu Dec 25 22:14:30.693784 2025] [:error] [pid 27869:tid 27871] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/orm.php
[Thu Dec 25 22:14:30.842302 2025] [:error] [pid 27869:tid 27883] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Thu Dec 25 22:14:30.995396 2025] [:error] [pid 27869:tid 27894] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Dec 25 22:14:31.171457 2025] [:error] [pid 27869:tid 27882] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Thu Dec 25 22:14:31.720648 2025] [:error] [pid 27869:tid 27892] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Dec 25 22:14:31.895415 2025] [:error] [pid 27869:tid 27877] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv.php
[Thu Dec 25 22:14:32.172679 2025] [:error] [pid 27869:tid 27886] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/ea3f.php
[Thu Dec 25 22:14:32.392932 2025] [:error] [pid 27869:tid 27871] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/price.php
[Thu Dec 25 22:14:32.561366 2025] [:error] [pid 27869:tid 27881] [client 4.194.116.41:20637] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Fri Dec 26 05:55:15.001213 2025] [:error] [pid 28270:tid 28343] [client 36.41.75.167:50435] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aU2ywl9Ac79_ckdPN5JHvwAAAI4"]
[Fri Dec 26 14:31:22.446774 2025] [:error] [pid 34865:tid 34891] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Dec 26 14:31:22.896472 2025] [:error] [pid 34865:tid 34868] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Dec 26 14:31:23.709769 2025] [:error] [pid 34865:tid 34883] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Dec 26 14:31:24.233144 2025] [:error] [pid 34865:tid 34871] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Dec 26 14:31:24.677318 2025] [:error] [pid 34865:tid 34877] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Dec 26 14:31:25.454254 2025] [:error] [pid 34865:tid 34869] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Dec 26 14:31:25.948051 2025] [:error] [pid 34865:tid 34889] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Dec 26 14:31:26.494426 2025] [:error] [pid 34865:tid 34886] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Dec 26 14:31:27.777429 2025] [:error] [pid 34865:tid 34876] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Dec 26 14:31:28.693709 2025] [:error] [pid 34865:tid 34891] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Dec 26 14:31:29.212061 2025] [:error] [pid 34865:tid 34875] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Dec 26 14:31:29.640807 2025] [:error] [pid 34865:tid 34871] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Dec 26 14:31:30.107257 2025] [:error] [pid 34865:tid 34877] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Dec 26 14:31:30.561231 2025] [:error] [pid 34865:tid 34872] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Dec 26 14:31:31.334447 2025] [:error] [pid 34865:tid 34876] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Dec 26 14:31:31.783030 2025] [:error] [pid 34865:tid 34889] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Dec 26 14:31:32.328795 2025] [:error] [pid 34865:tid 34886] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Dec 26 14:31:32.818944 2025] [:error] [pid 34865:tid 34874] [client 203.159.81.25:59903] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Dec 26 14:31:40.561658 2025] [:error] [pid 34865:tid 34869] [client 203.159.81.25:59903] [client 203.159.81.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aU4rzKi4zjVVKBdvuTR0ugAAAUI"]
[Fri Dec 26 14:31:43.961753 2025] [:error] [pid 28355:tid 28362] [client 203.159.81.12:36487] [client 203.159.81.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aU4rz7sFqKXf7ADZcTaumQAAAMU"]
[Fri Dec 26 14:31:47.292687 2025] [:error] [pid 15063:tid 15088] [client 203.159.81.34:22409] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Dec 26 14:31:48.734496 2025] [:error] [pid 15063:tid 15087] [client 203.159.81.34:22409] [client 203.159.81.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aU4r1ODsf_aL46Jy7z-RFwAAARY"]
[Fri Dec 26 14:31:50.620886 2025] [:error] [pid 34865:tid 34871] [client 203.159.81.28:54441] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Dec 26 14:31:51.075089 2025] [:error] [pid 34865:tid 34878] [client 203.159.81.28:54441] [client 203.159.81.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aU4r16i4zjVVKBdvuTR09QAAAUs"]
[Fri Dec 26 14:31:53.387875 2025] [:error] [pid 28270:tid 28343] [client 203.159.81.45:44715] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Dec 26 14:31:56.369612 2025] [:error] [pid 28270:tid 28332] [client 203.159.81.45:44715] [client 203.159.81.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aU4r3F9Ac79_ckdPN5Ls6wAAAIM"]
[Fri Dec 26 14:31:57.777473 2025] [:error] [pid 34865:tid 34882] [client 203.159.81.14:39287] [client 203.159.81.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aU4r3ai4zjVVKBdvuTR1GgAAAU8"]
[Fri Dec 26 14:36:18.874112 2025] [:error] [pid 28355:tid 28362] [client 170.106.35.137:48460] [client 170.106.35.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aU4s4rsFqKXf7ADZcTa3bgAAAMU"]
[Fri Dec 26 17:03:00.791853 2025] [:error] [pid 7160:tid 7166] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Dec 26 17:03:00.959465 2025] [:error] [pid 7160:tid 7187] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Fri Dec 26 17:03:01.131986 2025] [:error] [pid 7160:tid 7169] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Fri Dec 26 17:03:01.317385 2025] [:error] [pid 7160:tid 7176] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Fri Dec 26 17:03:02.749973 2025] [:error] [pid 7160:tid 7176] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/gdn.php
[Fri Dec 26 17:03:02.917979 2025] [:error] [pid 7160:tid 7179] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/tebar.php
[Fri Dec 26 17:03:03.090730 2025] [:error] [pid 7160:tid 7171] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/ty226.php
[Fri Dec 26 17:03:03.267796 2025] [:error] [pid 7160:tid 7181] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/songsa.php
[Fri Dec 26 17:03:03.411023 2025] [:error] [pid 7160:tid 7186] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/qing2.php
[Fri Dec 26 17:03:03.562456 2025] [:error] [pid 7160:tid 7180] [client 74.225.189.166:17821] File does not exist: /usr/local/apache/htdocs/suspended-page/massby2.php
[Fri Dec 26 17:03:03.697129 2025] [:error] [pid 7160:tid 7175] [client 74.225.189.166:17821] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qual.php"] [unique_id "aU5PR-w_ihNZR5L8vEVDXgAAAYw"]
[Fri Dec 26 17:03:04.031316 2025] [:error] [pid 15063:tid 15089] [client 74.225.189.166:17802] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qual.php"] [unique_id "aU5PSODsf_aL46Jy7z_V-wAAARg"]
[Fri Dec 26 17:03:04.380768 2025] [:error] [pid 28269:tid 28316] [client 74.225.189.166:17913] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qual.php"] [unique_id "aU5PSJ3ZK8bJ-c9-kjMnigAAAE4"]
[Fri Dec 26 17:03:04.724849 2025] [:error] [pid 15063:tid 15074] [client 74.225.189.166:17819] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qual.php"] [unique_id "aU5PSODsf_aL46Jy7z_V_gAAAQk"]
[Fri Dec 26 17:03:05.078294 2025] [:error] [pid 28270:tid 28351] [client 74.225.189.166:17878] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/udnkq.php"] [unique_id "aU5PSV9Ac79_ckdPN5IneAAAAJY"]
[Fri Dec 26 17:03:05.412219 2025] [:error] [pid 28268:tid 28278] [client 74.225.189.166:17798] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/udnkq.php"] [unique_id "aU5PSXc_KuO_55-uPTSCQQAAAAM"]
[Fri Dec 26 17:03:05.758245 2025] [:error] [pid 28355:tid 28370] [client 74.225.189.166:17916] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/udnkq.php"] [unique_id "aU5PSbsFqKXf7ADZcTbpFwAAAM0"]
[Fri Dec 26 17:03:06.119581 2025] [:error] [pid 28268:tid 28280] [client 74.225.189.166:17822] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/udnkq.php"] [unique_id "aU5PSnc_KuO_55-uPTSCQgAAAAU"]
[Fri Dec 26 17:03:06.477381 2025] [:error] [pid 7160:tid 7174] [client 74.225.189.166:17912] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aU5PSuw_ihNZR5L8vEVDZAAAAYs"]
[Fri Dec 26 17:03:06.830879 2025] [:error] [pid 7160:tid 7187] [client 74.225.189.166:17870] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aU5PSuw_ihNZR5L8vEVDZgAAAZg"]
[Fri Dec 26 17:03:07.174258 2025] [:error] [pid 15063:tid 15069] [client 74.225.189.166:17892] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aU5PS-Dsf_aL46Jy7z_WAQAAAQQ"]
[Fri Dec 26 17:03:07.493900 2025] [:error] [pid 7160:tid 7183] [client 74.225.189.166:17861] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aU5PS-w_ihNZR5L8vEVDZwAAAZQ"]
[Fri Dec 26 17:03:07.809742 2025] [:error] [pid 28270:tid 28330] [client 74.225.189.166:17838] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z4qmm5.php"] [unique_id "aU5PS19Ac79_ckdPN5IneQAAAIE"]
[Fri Dec 26 17:03:08.163721 2025] [:error] [pid 28270:tid 28329] [client 74.225.189.166:17801] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z4qmm5.php"] [unique_id "aU5PTF9Ac79_ckdPN5InewAAAIA"]
[Fri Dec 26 17:03:08.490274 2025] [:error] [pid 28270:tid 28335] [client 74.225.189.166:17889] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z4qmm5.php"] [unique_id "aU5PTF9Ac79_ckdPN5InfQAAAIY"]
[Fri Dec 26 17:03:08.826197 2025] [:error] [pid 7160:tid 7184] [client 74.225.189.166:17874] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z4qmm5.php"] [unique_id "aU5PTOw_ihNZR5L8vEVDagAAAZU"]
[Fri Dec 26 17:03:09.191290 2025] [:error] [pid 7160:tid 7171] [client 74.225.189.166:17919] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no3.php"] [unique_id "aU5PTew_ihNZR5L8vEVDawAAAYg"]
[Fri Dec 26 17:03:09.540513 2025] [:error] [pid 28270:tid 28337] [client 74.225.189.166:17849] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no3.php"] [unique_id "aU5PTV9Ac79_ckdPN5InfgAAAIg"]
[Fri Dec 26 17:03:09.879035 2025] [:error] [pid 7160:tid 7180] [client 74.225.189.166:17858] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no3.php"] [unique_id "aU5PTew_ihNZR5L8vEVDbQAAAZE"]
[Fri Dec 26 17:03:10.228003 2025] [:error] [pid 7160:tid 7175] [client 74.225.189.166:17809] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no3.php"] [unique_id "aU5PTuw_ihNZR5L8vEVDbwAAAYw"]
[Fri Dec 26 17:03:10.580398 2025] [:error] [pid 15063:tid 15065] [client 74.225.189.166:13256] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "aU5PTuDsf_aL46Jy7z_WAwAAAQA"]
[Fri Dec 26 17:03:10.927361 2025] [:error] [pid 15063:tid 15081] [client 74.225.189.166:17917] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "aU5PTuDsf_aL46Jy7z_WBAAAARA"]
[Fri Dec 26 17:03:11.290131 2025] [:error] [pid 7160:tid 7165] [client 74.225.189.166:17817] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "aU5PT-w_ihNZR5L8vEVDcAAAAYI"]
[Fri Dec 26 17:03:11.661430 2025] [:error] [pid 28355:tid 28359] [client 74.225.189.166:17805] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "aU5PT7sFqKXf7ADZcTbpGwAAAMI"]
[Fri Dec 26 17:03:12.000366 2025] [:error] [pid 28355:tid 28371] [client 74.225.189.166:17914] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webix.php"] [unique_id "aU5PT7sFqKXf7ADZcTbpHAAAAM4"]
[Fri Dec 26 17:03:12.338514 2025] [:error] [pid 28268:tid 28295] [client 74.225.189.166:17890] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webix.php"] [unique_id "aU5PUHc_KuO_55-uPTSCRwAAABQ"]
[Fri Dec 26 17:03:12.695078 2025] [:error] [pid 28355:tid 28381] [client 74.225.189.166:17893] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webix.php"] [unique_id "aU5PULsFqKXf7ADZcTbpHgAAANg"]
[Fri Dec 26 17:03:13.061875 2025] [:error] [pid 34865:tid 34877] [client 74.225.189.166:17829] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webix.php"] [unique_id "aU5PUai4zjVVKBdvuTS37gAAAUo"]
[Fri Dec 26 17:03:13.442643 2025] [:error] [pid 34865:tid 34878] [client 74.225.189.166:17792] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aU5PUai4zjVVKBdvuTS37wAAAUs"]
[Fri Dec 26 17:03:13.803946 2025] [:error] [pid 28269:tid 28303] [client 74.225.189.166:17888] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aU5PUZ3ZK8bJ-c9-kjMnkAAAAEE"]
[Fri Dec 26 17:03:14.158784 2025] [:error] [pid 28355:tid 28372] [client 74.225.189.166:17906] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aU5PUrsFqKXf7ADZcTbpIgAAAM8"]
[Fri Dec 26 17:03:14.495041 2025] [:error] [pid 28270:tid 28349] [client 74.225.189.166:17815] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aU5PUl9Ac79_ckdPN5IngQAAAJQ"]
[Fri Dec 26 17:03:14.832409 2025] [:error] [pid 34865:tid 34889] [client 74.225.189.166:17871] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cka.php"] [unique_id "aU5PUqi4zjVVKBdvuTS38AAAAVY"]
[Fri Dec 26 17:03:15.167912 2025] [:error] [pid 28355:tid 28366] [client 74.225.189.166:17905] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cka.php"] [unique_id "aU5PU7sFqKXf7ADZcTbpIwAAAMk"]
[Fri Dec 26 17:03:15.485238 2025] [:error] [pid 28270:tid 28334] [client 74.225.189.166:17839] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cka.php"] [unique_id "aU5PU19Ac79_ckdPN5InggAAAIU"]
[Fri Dec 26 17:03:15.817723 2025] [:error] [pid 28269:tid 28326] [client 74.225.189.166:17856] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cka.php"] [unique_id "aU5PU53ZK8bJ-c9-kjMnkgAAAFg"]
[Fri Dec 26 17:03:16.154213 2025] [:error] [pid 28270:tid 28338] [client 74.225.189.166:17806] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aU5PVF9Ac79_ckdPN5InhAAAAIk"]
[Fri Dec 26 17:03:16.484457 2025] [:error] [pid 15063:tid 15074] [client 74.225.189.166:17877] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aU5PVODsf_aL46Jy7z_WBgAAAQk"]
[Fri Dec 26 17:03:16.823380 2025] [:error] [pid 15063:tid 15088] [client 74.225.189.166:17795] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aU5PVODsf_aL46Jy7z_WCAAAARc"]
[Fri Dec 26 17:03:17.161096 2025] [:error] [pid 15063:tid 15080] [client 74.225.189.166:17872] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aU5PVeDsf_aL46Jy7z_WCgAAAQ8"]
[Fri Dec 26 17:03:17.500873 2025] [:error] [pid 15063:tid 15086] [client 74.225.189.166:17899] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU5PVeDsf_aL46Jy7z_WCwAAARU"]
[Fri Dec 26 17:03:17.835424 2025] [:error] [pid 15063:tid 15069] [client 74.225.189.166:17797] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU5PVeDsf_aL46Jy7z_WDQAAAQQ"]
[Fri Dec 26 17:03:18.168080 2025] [:error] [pid 28268:tid 28278] [client 74.225.189.166:17793] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU5PVnc_KuO_55-uPTSCSgAAAAM"]
[Fri Dec 26 17:03:18.513223 2025] [:error] [pid 15063:tid 15070] [client 74.225.189.166:17918] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU5PVuDsf_aL46Jy7z_WDwAAAQU"]
[Fri Dec 26 17:03:18.871396 2025] [:error] [pid 28269:tid 28309] [client 74.225.189.166:17882] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aU5PVp3ZK8bJ-c9-kjMnlgAAAEc"]
[Fri Dec 26 17:03:19.217791 2025] [:error] [pid 28269:tid 28305] [client 74.225.189.166:17841] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aU5PV53ZK8bJ-c9-kjMnmAAAAEM"]
[Fri Dec 26 17:03:19.577644 2025] [:error] [pid 28355:tid 28373] [client 74.225.189.166:17895] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aU5PV7sFqKXf7ADZcTbpJwAAANA"]
[Fri Dec 26 17:03:19.939648 2025] [:error] [pid 15063:tid 15079] [client 74.225.189.166:13303] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aU5PV-Dsf_aL46Jy7z_WEAAAAQ4"]
[Fri Dec 26 17:03:20.241014 2025] [:error] [pid 28269:tid 28311] [client 74.225.189.166:17866] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU5PWJ3ZK8bJ-c9-kjMnnQAAAEk"]
[Fri Dec 26 17:03:20.600122 2025] [:error] [pid 28269:tid 28302] [client 74.225.189.166:17867] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU5PWJ3ZK8bJ-c9-kjMnnwAAAEA"]
[Fri Dec 26 17:03:20.960731 2025] [:error] [pid 28355:tid 28359] [client 74.225.189.166:17824] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU5PWLsFqKXf7ADZcTbpKgAAAMI"]
[Fri Dec 26 17:03:21.328138 2025] [:error] [pid 15063:tid 15065] [client 74.225.189.166:13255] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU5PWeDsf_aL46Jy7z_WEQAAAQA"]
[Fri Dec 26 17:03:21.673023 2025] [:error] [pid 28355:tid 28381] [client 74.225.189.166:17832] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU5PWbsFqKXf7ADZcTbpLAAAANg"]
[Fri Dec 26 17:03:22.040376 2025] [:error] [pid 28268:tid 28284] [client 74.225.189.166:17887] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU5PWnc_KuO_55-uPTSCTQAAAAk"]
[Fri Dec 26 17:03:22.394897 2025] [:error] [pid 28355:tid 28378] [client 74.225.189.166:17857] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU5PWrsFqKXf7ADZcTbpLQAAANU"]
[Fri Dec 26 17:03:22.763499 2025] [:error] [pid 7160:tid 7175] [client 74.225.189.166:17807] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU5PWuw_ihNZR5L8vEVDdgAAAYw"]
[Fri Dec 26 17:03:23.123226 2025] [:error] [pid 28269:tid 28316] [client 74.225.189.166:13188] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU5PW53ZK8bJ-c9-kjMnoQAAAE4"]
[Fri Dec 26 17:03:23.484778 2025] [:error] [pid 28269:tid 28308] [client 74.225.189.166:17851] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU5PW53ZK8bJ-c9-kjMnogAAAEY"]
[Fri Dec 26 17:03:23.838932 2025] [:error] [pid 28269:tid 28314] [client 74.225.189.166:13271] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU5PW53ZK8bJ-c9-kjMnpAAAAEw"]
[Fri Dec 26 17:03:24.190755 2025] [:error] [pid 28269:tid 28324] [client 74.225.189.166:17810] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU5PXJ3ZK8bJ-c9-kjMnpgAAAFY"]
[Fri Dec 26 17:03:24.560023 2025] [:error] [pid 28355:tid 28379] [client 74.225.189.166:17881] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aU5PXLsFqKXf7ADZcTbpLwAAANY"]
[Fri Dec 26 17:03:24.916981 2025] [:error] [pid 15063:tid 15088] [client 74.225.189.166:13253] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aU5PXODsf_aL46Jy7z_WFAAAARc"]
[Fri Dec 26 17:03:25.274164 2025] [:error] [pid 28355:tid 28376] [client 74.225.189.166:17796] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aU5PXbsFqKXf7ADZcTbpMAAAANM"]
[Fri Dec 26 17:03:25.647920 2025] [:error] [pid 28355:tid 28372] [client 74.225.189.166:17840] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aU5PXbsFqKXf7ADZcTbpMQAAAM8"]
[Fri Dec 26 17:03:25.992925 2025] [:error] [pid 7160:tid 7177] [client 74.225.189.166:13250] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU5PXew_ihNZR5L8vEVDewAAAY4"]
[Fri Dec 26 17:03:26.354615 2025] [:error] [pid 28269:tid 28306] [client 74.225.189.166:17885] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU5PXp3ZK8bJ-c9-kjMnqQAAAEQ"]
[Fri Dec 26 17:03:26.705190 2025] [:error] [pid 28355:tid 28365] [client 74.225.189.166:17814] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU5PXrsFqKXf7ADZcTbpMwAAAMg"]
[Fri Dec 26 17:03:27.063534 2025] [:error] [pid 7160:tid 7166] [client 74.225.189.166:17886] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aU5PX-w_ihNZR5L8vEVDfgAAAYM"]
[Fri Dec 26 17:03:27.434785 2025] [:error] [pid 28269:tid 28311] [client 74.225.189.166:17803] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU5PX53ZK8bJ-c9-kjMnqgAAAEk"]
[Fri Dec 26 17:03:27.802936 2025] [:error] [pid 28269:tid 28307] [client 74.225.189.166:17823] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU5PX53ZK8bJ-c9-kjMnqwAAAEU"]
[Fri Dec 26 17:03:28.139847 2025] [:error] [pid 28269:tid 28319] [client 74.225.189.166:17830] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU5PYJ3ZK8bJ-c9-kjMnrAAAAFE"]
[Fri Dec 26 17:03:28.498011 2025] [:error] [pid 28269:tid 28321] [client 74.225.189.166:13263] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU5PYJ3ZK8bJ-c9-kjMnrgAAAFM"]
[Fri Dec 26 17:03:28.873059 2025] [:error] [pid 28269:tid 28303] [client 74.225.189.166:17799] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aU5PYJ3ZK8bJ-c9-kjMnsAAAAEE"]
[Fri Dec 26 17:03:29.217236 2025] [:error] [pid 7160:tid 7174] [client 74.225.189.166:13248] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aU5PYew_ihNZR5L8vEVDgAAAAYs"]
[Fri Dec 26 17:03:29.577728 2025] [:error] [pid 28270:tid 28347] [client 74.225.189.166:13292] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aU5PYV9Ac79_ckdPN5InhQAAAJI"]
[Fri Dec 26 17:03:29.936535 2025] [:error] [pid 7160:tid 7183] [client 74.225.189.166:13216] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aU5PYew_ihNZR5L8vEVDgQAAAZQ"]
[Fri Dec 26 17:03:30.306346 2025] [:error] [pid 28269:tid 28326] [client 74.225.189.166:17901] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU5PYp3ZK8bJ-c9-kjMnsgAAAFg"]
[Fri Dec 26 17:03:30.636896 2025] [:error] [pid 28269:tid 28322] [client 74.225.189.166:17880] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU5PYp3ZK8bJ-c9-kjMntAAAAFQ"]
[Fri Dec 26 17:03:30.972945 2025] [:error] [pid 28269:tid 28304] [client 74.225.189.166:17898] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU5PYp3ZK8bJ-c9-kjMntQAAAEI"]
[Fri Dec 26 17:03:31.328632 2025] [:error] [pid 15063:tid 15079] [client 74.225.189.166:17812] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU5PY-Dsf_aL46Jy7z_WHAAAAQ4"]
[Fri Dec 26 17:03:31.685629 2025] [:error] [pid 7160:tid 7176] [client 74.225.189.166:17844] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aU5PY-w_ihNZR5L8vEVDggAAAY0"]
[Fri Dec 26 17:03:32.060941 2025] [:error] [pid 34865:tid 34891] [client 74.225.189.166:13254] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aU5PZKi4zjVVKBdvuTS39AAAAVg"]
[Fri Dec 26 17:03:32.429314 2025] [:error] [pid 7160:tid 7186] [client 74.225.189.166:13267] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aU5PZOw_ihNZR5L8vEVDgwAAAZc"]
[Fri Dec 26 17:03:32.808183 2025] [:error] [pid 28270:tid 28344] [client 74.225.189.166:13206] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aU5PZF9Ac79_ckdPN5InhgAAAI8"]
[Fri Dec 26 17:03:33.181817 2025] [:error] [pid 28269:tid 28325] [client 74.225.189.166:17863] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aU5PZZ3ZK8bJ-c9-kjMnuQAAAFc"]
[Fri Dec 26 17:03:33.541886 2025] [:error] [pid 28269:tid 28309] [client 74.225.189.166:17845] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aU5PZZ3ZK8bJ-c9-kjMnuwAAAEc"]
[Fri Dec 26 17:03:33.907854 2025] [:error] [pid 34865:tid 34868] [client 74.225.189.166:13290] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aU5PZai4zjVVKBdvuTS39wAAAUE"]
[Fri Dec 26 17:03:34.253249 2025] [:error] [pid 15063:tid 15081] [client 74.225.189.166:17876] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aU5PZuDsf_aL46Jy7z_WHgAAARA"]
[Fri Dec 26 17:03:34.580404 2025] [:error] [pid 28268:tid 28296] [client 74.225.189.166:13272] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aU5PZnc_KuO_55-uPTSCTwAAABU"]
[Fri Dec 26 17:03:34.925784 2025] [:error] [pid 34865:tid 34887] [client 74.225.189.166:17909] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aU5PZqi4zjVVKBdvuTS3-QAAAVQ"]
[Fri Dec 26 17:03:35.255821 2025] [:error] [pid 34865:tid 34876] [client 74.225.189.166:13251] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aU5PZ6i4zjVVKBdvuTS3_gAAAUk"]
[Fri Dec 26 17:03:35.606392 2025] [:error] [pid 28268:tid 28281] [client 74.225.189.166:17811] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aU5PZ3c_KuO_55-uPTSCUgAAAAY"]
[Fri Dec 26 17:03:35.981119 2025] [:error] [pid 28268:tid 28294] [client 74.225.189.166:17834] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aU5PZ3c_KuO_55-uPTSCUwAAABM"]
[Fri Dec 26 17:03:36.352280 2025] [:error] [pid 28269:tid 28311] [client 74.225.189.166:17900] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aU5PaJ3ZK8bJ-c9-kjMnvAAAAEk"]
[Fri Dec 26 17:03:36.664131 2025] [:error] [pid 15063:tid 15071] [client 74.225.189.166:17804] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aU5PaODsf_aL46Jy7z_WHwAAAQY"]
[Fri Dec 26 17:03:36.961334 2025] [:error] [pid 15063:tid 15074] [client 74.225.189.166:17842] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aU5PaODsf_aL46Jy7z_WIQAAAQk"]
[Fri Dec 26 17:03:37.270421 2025] [:error] [pid 15063:tid 15076] [client 74.225.189.166:13278] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU5PaeDsf_aL46Jy7z_WIwAAAQs"]
[Fri Dec 26 17:03:37.568904 2025] [:error] [pid 15063:tid 15080] [client 74.225.189.166:17813] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU5PaeDsf_aL46Jy7z_WJAAAAQ8"]
[Fri Dec 26 17:03:37.897180 2025] [:error] [pid 15063:tid 15069] [client 74.225.189.166:13186] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU5PaeDsf_aL46Jy7z_WJQAAAQQ"]
[Fri Dec 26 17:03:38.206268 2025] [:error] [pid 15063:tid 15075] [client 74.225.189.166:13308] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aU5PauDsf_aL46Jy7z_WJgAAAQo"]
[Fri Dec 26 17:03:38.521920 2025] [:error] [pid 15063:tid 15086] [client 74.225.189.166:13258] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aU5PauDsf_aL46Jy7z_WJwAAARU"]
[Fri Dec 26 17:03:38.821464 2025] [:error] [pid 34865:tid 34875] [client 74.225.189.166:13265] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aU5Paqi4zjVVKBdvuTS4BQAAAUg"]
[Fri Dec 26 17:03:39.132076 2025] [:error] [pid 28268:tid 28278] [client 74.225.189.166:17848] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aU5Pa3c_KuO_55-uPTSCWgAAAAM"]
[Fri Dec 26 17:03:39.432354 2025] [:error] [pid 28268:tid 28291] [client 74.225.189.166:17883] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aU5Pa3c_KuO_55-uPTSCWwAAABA"]
[Fri Dec 26 17:03:39.729704 2025] [:error] [pid 28268:tid 28279] [client 74.225.189.166:17894] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU5Pa3c_KuO_55-uPTSCXAAAAAQ"]
[Fri Dec 26 17:03:40.034597 2025] [:error] [pid 7160:tid 7166] [client 74.225.189.166:17855] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU5PbOw_ihNZR5L8vEVDigAAAYM"]
[Fri Dec 26 17:03:40.337782 2025] [:error] [pid 15063:tid 15070] [client 74.225.189.166:17891] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU5PbODsf_aL46Jy7z_WKAAAAQU"]
[Fri Dec 26 17:03:40.647813 2025] [:error] [pid 28269:tid 28320] [client 74.225.189.166:13189] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aU5PbJ3ZK8bJ-c9-kjMnwAAAAFI"]
[Fri Dec 26 17:03:40.976197 2025] [:error] [pid 28269:tid 28326] [client 74.225.189.166:17879] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aU5PbJ3ZK8bJ-c9-kjMnwQAAAFg"]
[Fri Dec 26 17:03:41.323749 2025] [:error] [pid 7160:tid 7168] [client 74.225.189.166:13252] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aU5Pbew_ihNZR5L8vEVDjQAAAYU"]
[Fri Dec 26 17:03:41.691767 2025] [:error] [pid 28268:tid 28292] [client 74.225.189.166:17827] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aU5PbXc_KuO_55-uPTSCXQAAABE"]
[Fri Dec 26 17:03:41.996188 2025] [:error] [pid 28269:tid 28308] [client 74.225.189.166:13277] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aU5PbZ3ZK8bJ-c9-kjMnwgAAAEY"]
[Fri Dec 26 17:03:42.308479 2025] [:error] [pid 28269:tid 28313] [client 74.225.189.166:13205] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aU5Pbp3ZK8bJ-c9-kjMnxQAAAEs"]
[Fri Dec 26 17:03:42.584621 2025] [:error] [pid 28269:tid 28325] [client 74.225.189.166:17847] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aU5Pbp3ZK8bJ-c9-kjMnxgAAAFc"]
[Fri Dec 26 17:03:42.860865 2025] [:error] [pid 28269:tid 28314] [client 74.225.189.166:17816] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aU5Pbp3ZK8bJ-c9-kjMnxwAAAEw"]
[Fri Dec 26 17:03:43.209160 2025] [:error] [pid 28269:tid 28318] [client 74.225.189.166:17902] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aU5Pb53ZK8bJ-c9-kjMnyQAAAFA"]
[Fri Dec 26 17:03:43.678058 2025] [:error] [pid 34865:tid 34884] [client 74.225.189.166:17864] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aU5Pb6i4zjVVKBdvuTS4BwAAAVE"]
[Fri Dec 26 17:03:44.218775 2025] [:error] [pid 28355:tid 28359] [client 74.225.189.166:13299] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aU5PcLsFqKXf7ADZcTbpOAAAAMI"]
[Fri Dec 26 17:03:44.505771 2025] [:error] [pid 28355:tid 28380] [client 74.225.189.166:13285] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aU5PcLsFqKXf7ADZcTbpOQAAANc"]
[Fri Dec 26 17:03:44.779056 2025] [:error] [pid 28268:tid 28287] [client 74.225.189.166:17820] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aU5PcHc_KuO_55-uPTSCXwAAAAw"]
[Fri Dec 26 17:03:45.060961 2025] [:error] [pid 15063:tid 15067] [client 74.225.189.166:13203] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aU5PceDsf_aL46Jy7z_WKgAAAQI"]
[Fri Dec 26 17:03:45.333481 2025] [:error] [pid 15063:tid 15072] [client 74.225.189.166:13305] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aU5PceDsf_aL46Jy7z_WKwAAAQc"]
[Fri Dec 26 17:03:45.616590 2025] [:error] [pid 28270:tid 28336] [client 74.225.189.166:13279] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aU5PcV9Ac79_ckdPN5InjAAAAIc"]
[Fri Dec 26 17:03:45.900812 2025] [:error] [pid 28355:tid 28371] [client 74.225.189.166:13264] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aU5PcbsFqKXf7ADZcTbpOgAAAM4"]
[Fri Dec 26 17:03:46.177824 2025] [:error] [pid 15063:tid 15087] [client 74.225.189.166:13249] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aU5PcuDsf_aL46Jy7z_WLQAAARY"]
[Fri Dec 26 17:03:46.460255 2025] [:error] [pid 34865:tid 34880] [client 74.225.189.166:17904] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aU5Pcqi4zjVVKBdvuTS4CAAAAU0"]
[Fri Dec 26 17:03:46.729642 2025] [:error] [pid 15063:tid 15077] [client 74.225.189.166:17911] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aU5PcuDsf_aL46Jy7z_WLgAAAQw"]
[Fri Dec 26 17:03:47.037280 2025] [:error] [pid 15063:tid 15089] [client 74.225.189.166:17818] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aU5Pc-Dsf_aL46Jy7z_WLwAAARg"]
[Fri Dec 26 17:03:47.368412 2025] [:error] [pid 28270:tid 28348] [client 74.225.189.166:13289] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU5Pc19Ac79_ckdPN5InjgAAAJM"]
[Fri Dec 26 17:03:47.639589 2025] [:error] [pid 28268:tid 28299] [client 74.225.189.166:17852] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU5Pc3c_KuO_55-uPTSCYgAAABg"]
[Fri Dec 26 17:03:47.934454 2025] [:error] [pid 15063:tid 15084] [client 74.225.189.166:13261] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU5Pc-Dsf_aL46Jy7z_WMAAAARM"]
[Fri Dec 26 17:03:48.203036 2025] [:error] [pid 28268:tid 28290] [client 74.225.189.166:13276] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU5PdHc_KuO_55-uPTSCZQAAAA8"]
[Fri Dec 26 17:03:48.516342 2025] [:error] [pid 28268:tid 28289] [client 74.225.189.166:13270] [client 74.225.189.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aU5PdHc_KuO_55-uPTSCaAAAAA4"]
[Fri Dec 26 17:03:48.877844 2025] [:error] [pid 15063:tid 15071] [client 74.225.189.166:13297] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aU5PdODsf_aL46Jy7z_WMQAAAQY"]
[Fri Dec 26 17:03:49.208993 2025] [:error] [pid 28269:tid 28319] [client 74.225.189.166:17903] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aU5PdZ3ZK8bJ-c9-kjMnzAAAAFE"]
[Fri Dec 26 17:03:49.548644 2025] [:error] [pid 7160:tid 7172] [client 74.225.189.166:13268] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aU5Pdew_ihNZR5L8vEVDjwAAAYk"]
[Fri Dec 26 17:03:49.892114 2025] [:error] [pid 28269:tid 28323] [client 74.225.189.166:17826] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aU5PdZ3ZK8bJ-c9-kjMnzQAAAFU"]
[Fri Dec 26 17:03:50.247821 2025] [:error] [pid 28269:tid 28321] [client 74.225.189.166:17837] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aU5Pdp3ZK8bJ-c9-kjMn0AAAAFM"]
[Fri Dec 26 17:03:50.600191 2025] [:error] [pid 7160:tid 7171] [client 74.225.189.166:17836] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aU5Pduw_ihNZR5L8vEVDkAAAAYg"]
[Fri Dec 26 17:03:50.955819 2025] [:error] [pid 28269:tid 28320] [client 74.225.189.166:17828] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aU5Pdp3ZK8bJ-c9-kjMn0QAAAFI"]
[Fri Dec 26 17:03:51.298249 2025] [:error] [pid 28269:tid 28308] [client 74.225.189.166:13210] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aU5Pd53ZK8bJ-c9-kjMn0wAAAEY"]
[Fri Dec 26 17:03:51.646588 2025] [:error] [pid 28355:tid 28376] [client 74.225.189.166:13260] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aU5Pd7sFqKXf7ADZcTbpPgAAANM"]
[Fri Dec 26 17:03:51.989381 2025] [:error] [pid 28269:tid 28317] [client 74.225.189.166:17896] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aU5Pd53ZK8bJ-c9-kjMn1gAAAE8"]
[Fri Dec 26 17:03:52.349276 2025] [:error] [pid 15063:tid 15076] [client 74.225.189.166:13247] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aU5PeODsf_aL46Jy7z_WMwAAAQs"]
[Fri Dec 26 17:03:52.695803 2025] [:error] [pid 15063:tid 15088] [client 74.225.189.166:13296] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU5PeODsf_aL46Jy7z_WNAAAARc"]
[Fri Dec 26 17:03:53.040497 2025] [:error] [pid 28270:tid 28346] [client 74.225.189.166:13149] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU5PeV9Ac79_ckdPN5InjwAAAJE"]
[Fri Dec 26 17:03:53.401393 2025] [:error] [pid 28270:tid 28333] [client 74.225.189.166:13227] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU5PeV9Ac79_ckdPN5InkQAAAIQ"]
[Fri Dec 26 17:03:53.750698 2025] [:error] [pid 28270:tid 28350] [client 74.225.189.166:17825] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aU5PeV9Ac79_ckdPN5InkwAAAJU"]
[Fri Dec 26 17:03:54.075654 2025] [:error] [pid 34865:tid 34878] [client 74.225.189.166:17860] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aU5Peqi4zjVVKBdvuTS4CwAAAUs"]
[Fri Dec 26 17:03:54.432142 2025] [:error] [pid 7160:tid 7187] [client 74.225.189.166:17884] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aU5Peuw_ihNZR5L8vEVDkQAAAZg"]
[Fri Dec 26 17:03:54.757620 2025] [:error] [pid 7160:tid 7173] [client 74.225.189.166:17859] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aU5Peuw_ihNZR5L8vEVDkgAAAYo"]
[Fri Dec 26 17:03:55.105989 2025] [:error] [pid 7160:tid 7177] [client 74.225.189.166:13288] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aU5Pe-w_ihNZR5L8vEVDkwAAAY4"]
[Fri Dec 26 17:03:55.438610 2025] [:error] [pid 7160:tid 7181] [client 74.225.189.166:13293] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aU5Pe-w_ihNZR5L8vEVDlgAAAZI"]
[Fri Dec 26 17:03:55.777534 2025] [:error] [pid 7160:tid 7167] [client 74.225.189.166:17875] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aU5Pe-w_ihNZR5L8vEVDlwAAAYQ"]
[Fri Dec 26 17:03:56.086328 2025] [:error] [pid 15063:tid 15082] [client 74.225.189.166:17831] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aU5PfODsf_aL46Jy7z_WOAAAARE"]
[Fri Dec 26 17:03:56.398201 2025] [:error] [pid 15063:tid 15066] [client 74.225.189.166:13269] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aU5PfODsf_aL46Jy7z_WOgAAAQE"]
[Fri Dec 26 17:03:56.721328 2025] [:error] [pid 15063:tid 15067] [client 74.225.189.166:13225] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU5PfODsf_aL46Jy7z_WOwAAAQI"]
[Fri Dec 26 17:03:57.019441 2025] [:error] [pid 15063:tid 15079] [client 74.225.189.166:13143] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU5PfeDsf_aL46Jy7z_WPQAAAQ4"]
[Fri Dec 26 17:03:57.346671 2025] [:error] [pid 28270:tid 28344] [client 74.225.189.166:13185] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU5PfV9Ac79_ckdPN5InlQAAAI8"]
[Fri Dec 26 17:03:57.633982 2025] [:error] [pid 28270:tid 28351] [client 74.225.189.166:17873] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aU5PfV9Ac79_ckdPN5InlgAAAJY"]
[Fri Dec 26 17:03:57.913022 2025] [:error] [pid 28270:tid 28330] [client 74.225.189.166:17853] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU5PfV9Ac79_ckdPN5InlwAAAIE"]
[Fri Dec 26 17:03:58.207914 2025] [:error] [pid 28270:tid 28342] [client 74.225.189.166:13291] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU5Pfl9Ac79_ckdPN5InmAAAAI0"]
[Fri Dec 26 17:03:58.481807 2025] [:error] [pid 34865:tid 34889] [client 74.225.189.166:13281] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU5Pfqi4zjVVKBdvuTS4DQAAAVY"]
[Fri Dec 26 17:03:58.752876 2025] [:error] [pid 28270:tid 28329] [client 74.225.189.166:13195] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aU5Pfl9Ac79_ckdPN5InmQAAAIA"]
[Fri Dec 26 17:03:59.029294 2025] [:error] [pid 15063:tid 15074] [client 74.225.189.166:17915] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aU5Pf-Dsf_aL46Jy7z_WQwAAAQk"]
[Fri Dec 26 17:03:59.307657 2025] [:error] [pid 7160:tid 7163] [client 74.225.189.166:13287] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aU5Pf-w_ihNZR5L8vEVDmQAAAYA"]
[Fri Dec 26 17:03:59.587876 2025] [:error] [pid 28270:tid 28335] [client 74.225.189.166:13284] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aU5Pf19Ac79_ckdPN5InmwAAAIY"]
[Fri Dec 26 17:03:59.857294 2025] [:error] [pid 15063:tid 15080] [client 74.225.189.166:13262] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "aU5Pf-Dsf_aL46Jy7z_WRQAAAQ8"]
[Fri Dec 26 17:04:00.137238 2025] [:error] [pid 7160:tid 7169] [client 74.225.189.166:17869] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aU5PgOw_ihNZR5L8vEVDmgAAAYY"]
[Fri Dec 26 17:04:00.412731 2025] [:error] [pid 28270:tid 28339] [client 74.225.189.166:13302] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aU5PgF9Ac79_ckdPN5InnAAAAIo"]
[Fri Dec 26 17:04:00.686444 2025] [:error] [pid 28270:tid 28340] [client 74.225.189.166:17908] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aU5PgF9Ac79_ckdPN5InnQAAAIs"]
[Fri Dec 26 17:04:00.958462 2025] [:error] [pid 28270:tid 28337] [client 74.225.189.166:13136] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aU5PgF9Ac79_ckdPN5InngAAAIg"]
[Fri Dec 26 17:04:01.228942 2025] [:error] [pid 28270:tid 28348] [client 74.225.189.166:17850] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aU5PgV9Ac79_ckdPN5InoAAAAJM"]
[Fri Dec 26 17:04:01.503796 2025] [:error] [pid 15063:tid 15086] [client 74.225.189.166:13222] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aU5PgeDsf_aL46Jy7z_WSAAAARU"]
[Fri Dec 26 17:04:01.776096 2025] [:error] [pid 15063:tid 15073] [client 74.225.189.166:13280] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aU5PgeDsf_aL46Jy7z_WSQAAAQg"]
[Fri Dec 26 17:04:02.046583 2025] [:error] [pid 28269:tid 28306] [client 74.225.189.166:17846] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aU5Pgp3ZK8bJ-c9-kjMn2AAAAEQ"]
[Fri Dec 26 17:04:02.328026 2025] [:error] [pid 34865:tid 34879] [client 74.225.189.166:13228] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aU5Pgqi4zjVVKBdvuTS4FgAAAUw"]
[Fri Dec 26 17:04:02.597206 2025] [:error] [pid 34865:tid 34878] [client 74.225.189.166:13194] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aU5Pgqi4zjVVKBdvuTS4IgAAAUs"]
[Fri Dec 26 17:04:02.883807 2025] [:error] [pid 28270:tid 28351] [client 74.225.189.166:13294] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aU5Pgl9Ac79_ckdPN5InqQAAAJY"]
[Fri Dec 26 17:04:03.160217 2025] [:error] [pid 34865:tid 34883] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Fri Dec 26 17:04:03.298199 2025] [:error] [pid 34865:tid 34874] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Dec 26 17:04:03.438500 2025] [:error] [pid 34865:tid 34882] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Dec 26 17:04:03.577986 2025] [:error] [pid 34865:tid 34873] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Fri Dec 26 17:04:03.716277 2025] [:error] [pid 34865:tid 34871] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Fri Dec 26 17:04:04.143947 2025] [:error] [pid 34865:tid 34867] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Dec 26 17:04:04.426939 2025] [:error] [pid 34865:tid 34869] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Fri Dec 26 17:04:04.569746 2025] [:error] [pid 34865:tid 34877] [client 74.225.189.166:13273] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Fri Dec 26 17:04:04.706849 2025] [:error] [pid 34865:tid 34874] [client 74.225.189.166:13273] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aU5PhKi4zjVVKBdvuTS4XgAAAUc"]
[Fri Dec 26 17:04:04.978981 2025] [:error] [pid 28355:tid 28373] [client 74.225.189.166:13215] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aU5PhLsFqKXf7ADZcTbpQwAAANA"]
[Fri Dec 26 17:04:05.251733 2025] [:error] [pid 7160:tid 7176] [client 74.225.189.166:13209] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aU5Phew_ihNZR5L8vEVDnQAAAY0"]
[Fri Dec 26 17:04:05.531358 2025] [:error] [pid 7160:tid 7172] [client 74.225.189.166:13309] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aU5Phew_ihNZR5L8vEVDnwAAAYk"]
[Fri Dec 26 17:04:05.803789 2025] [:error] [pid 15063:tid 15078] [client 74.225.189.166:13295] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU5PheDsf_aL46Jy7z_WWAAAAQ0"]
[Fri Dec 26 17:04:06.078517 2025] [:error] [pid 7160:tid 7177] [client 74.225.189.166:13075] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU5Phuw_ihNZR5L8vEVDoQAAAY4"]
[Fri Dec 26 17:04:06.346007 2025] [:error] [pid 28270:tid 28333] [client 74.225.189.166:13232] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU5Phl9Ac79_ckdPN5IntgAAAIQ"]
[Fri Dec 26 17:04:06.624133 2025] [:error] [pid 7160:tid 7179] [client 74.225.189.166:17808] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU5Phuw_ihNZR5L8vEVDpQAAAZA"]
[Fri Dec 26 17:04:06.896123 2025] [:error] [pid 28355:tid 28380] [client 74.225.189.166:13201] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aU5PhrsFqKXf7ADZcTbpRwAAANc"]
[Fri Dec 26 17:04:07.168827 2025] [:error] [pid 7160:tid 7174] [client 74.225.189.166:13237] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aU5Ph-w_ihNZR5L8vEVDqQAAAYs"]
[Fri Dec 26 17:04:07.447792 2025] [:error] [pid 28355:tid 28378] [client 74.225.189.166:13266] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aU5Ph7sFqKXf7ADZcTbpSAAAANU"]
[Fri Dec 26 17:04:07.722598 2025] [:error] [pid 28355:tid 28357] [client 74.225.189.166:13224] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "aU5Ph7sFqKXf7ADZcTbpSgAAAMA"]
[Fri Dec 26 17:04:07.995935 2025] [:error] [pid 34865:tid 34868] [client 74.225.189.166:13240] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU5Ph6i4zjVVKBdvuTS4YwAAAUE"]
[Fri Dec 26 17:04:08.269210 2025] [:error] [pid 28270:tid 28350] [client 74.225.189.166:17794] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU5PiF9Ac79_ckdPN5InuAAAAJU"]
[Fri Dec 26 17:04:08.546604 2025] [:error] [pid 28355:tid 28364] [client 74.225.189.166:13147] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU5PiLsFqKXf7ADZcTbpSwAAAMc"]
[Fri Dec 26 17:04:08.833758 2025] [:error] [pid 28355:tid 28375] [client 74.225.189.166:17854] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aU5PiLsFqKXf7ADZcTbpTQAAANI"]
[Fri Dec 26 17:04:09.104919 2025] [:error] [pid 28270:tid 28331] [client 74.225.189.166:13191] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aU5PiV9Ac79_ckdPN5InuQAAAII"]
[Fri Dec 26 17:04:09.378889 2025] [:error] [pid 28269:tid 28323] [client 74.225.189.166:17808] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aU5PiZ3ZK8bJ-c9-kjMn2gAAAFU"]
[Fri Dec 26 17:04:09.650893 2025] [:error] [pid 7160:tid 7169] [client 74.225.189.166:13218] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aU5Piew_ihNZR5L8vEVDqgAAAYY"]
[Fri Dec 26 17:04:09.922115 2025] [:error] [pid 28269:tid 28307] [client 74.225.189.166:13202] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aU5PiZ3ZK8bJ-c9-kjMn2wAAAEU"]
[Fri Dec 26 17:04:10.197240 2025] [:error] [pid 7160:tid 7178] [client 74.225.189.166:13197] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aU5Piuw_ihNZR5L8vEVDrQAAAY8"]
[Fri Dec 26 17:04:10.467659 2025] [:error] [pid 28269:tid 28315] [client 74.225.189.166:13193] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aU5Pip3ZK8bJ-c9-kjMn3QAAAE0"]
[Fri Dec 26 17:04:10.739503 2025] [:error] [pid 7160:tid 7186] [client 74.225.189.166:13310] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aU5Piuw_ihNZR5L8vEVDrgAAAZc"]
[Fri Dec 26 17:04:11.017156 2025] [:error] [pid 28355:tid 28366] [client 74.225.189.166:13217] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aU5Pi7sFqKXf7ADZcTbpTwAAAMk"]
[Fri Dec 26 17:04:11.303003 2025] [:error] [pid 28355:tid 28377] [client 74.225.189.166:13235] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aU5Pi7sFqKXf7ADZcTbpUAAAANQ"]
[Fri Dec 26 17:04:11.574327 2025] [:error] [pid 28270:tid 28344] [client 74.225.189.166:13236] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aU5Pi19Ac79_ckdPN5InuwAAAI8"]
[Fri Dec 26 17:04:11.857129 2025] [:error] [pid 28355:tid 28365] [client 74.225.189.166:17900] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aU5Pi7sFqKXf7ADZcTbpUQAAAMg"]
[Fri Dec 26 17:04:12.130840 2025] [:error] [pid 28355:tid 28363] [client 74.225.189.166:13219] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aU5PjLsFqKXf7ADZcTbpUwAAAMY"]
[Fri Dec 26 17:04:12.402297 2025] [:error] [pid 28270:tid 28329] [client 74.225.189.166:13170] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU5PjF9Ac79_ckdPN5InvQAAAIA"]
[Fri Dec 26 17:04:12.689135 2025] [:error] [pid 28270:tid 28332] [client 74.225.189.166:13230] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU5PjF9Ac79_ckdPN5InvwAAAIM"]
[Fri Dec 26 17:04:12.957886 2025] [:error] [pid 28355:tid 28367] [client 74.225.189.166:13187] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU5PjLsFqKXf7ADZcTbpVQAAAMo"]
[Fri Dec 26 17:04:13.262434 2025] [:error] [pid 28355:tid 28359] [client 74.225.189.166:13213] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aU5PjbsFqKXf7ADZcTbpWAAAAMI"]
[Fri Dec 26 17:04:13.534180 2025] [:error] [pid 34865:tid 34869] [client 74.225.189.166:13184] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aU5Pjai4zjVVKBdvuTS4ZwAAAUI"]
[Fri Dec 26 17:04:13.805395 2025] [:error] [pid 28270:tid 28349] [client 74.225.189.166:17907] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aU5PjV9Ac79_ckdPN5InwQAAAJQ"]
[Fri Dec 26 17:04:14.078106 2025] [:error] [pid 28270:tid 28352] [client 74.225.189.166:13286] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aU5Pjl9Ac79_ckdPN5InxAAAAJc"]
[Fri Dec 26 17:04:14.348886 2025] [:error] [pid 28269:tid 28310] [client 74.225.189.166:13311] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aU5Pjp3ZK8bJ-c9-kjMn3wAAAEg"]
[Fri Dec 26 17:04:14.617866 2025] [:error] [pid 28269:tid 28304] [client 74.225.189.166:13122] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aU5Pjp3ZK8bJ-c9-kjMn4QAAAEI"]
[Fri Dec 26 17:04:14.887632 2025] [:error] [pid 34865:tid 34877] [client 74.225.189.166:13132] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aU5Pjqi4zjVVKBdvuTS4aAAAAUo"]
[Fri Dec 26 17:04:15.172767 2025] [:error] [pid 28268:tid 28298] [client 74.225.189.166:13151] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aU5Pj3c_KuO_55-uPTSCbQAAABc"]
[Fri Dec 26 17:04:15.442327 2025] [:error] [pid 34865:tid 34880] [client 74.225.189.166:13153] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aU5Pj6i4zjVVKBdvuTS4agAAAU0"]
[Fri Dec 26 17:04:15.711810 2025] [:error] [pid 7160:tid 7173] [client 74.225.189.166:13154] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aU5Pj-w_ihNZR5L8vEVDsAAAAYo"]
[Fri Dec 26 17:04:15.981683 2025] [:error] [pid 28269:tid 28314] [client 74.225.189.166:17843] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aU5Pj53ZK8bJ-c9-kjMn4wAAAEw"]
[Fri Dec 26 17:04:16.252430 2025] [:error] [pid 28269:tid 28318] [client 74.225.189.166:13200] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aU5PkJ3ZK8bJ-c9-kjMn5AAAAFA"]
[Fri Dec 26 17:04:16.521043 2025] [:error] [pid 28269:tid 28306] [client 74.225.189.166:13244] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "aU5PkJ3ZK8bJ-c9-kjMn5gAAAEQ"]
[Fri Dec 26 17:04:16.789663 2025] [:error] [pid 28269:tid 28319] [client 74.225.189.166:13234] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aU5PkJ3ZK8bJ-c9-kjMn5wAAAFE"]
[Fri Dec 26 17:04:17.060662 2025] [:error] [pid 28269:tid 28311] [client 74.225.189.166:13145] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aU5PkZ3ZK8bJ-c9-kjMn6QAAAEk"]
[Fri Dec 26 17:04:17.335524 2025] [:error] [pid 28269:tid 28307] [client 74.225.189.166:13146] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aU5PkZ3ZK8bJ-c9-kjMn6gAAAEU"]
[Fri Dec 26 17:04:17.606325 2025] [:error] [pid 15063:tid 15073] [client 74.225.189.166:13235] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aU5PkeDsf_aL46Jy7z_WXAAAAQg"]
[Fri Dec 26 17:04:17.901500 2025] [:error] [pid 7160:tid 7181] [client 74.225.189.166:17833] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU5Pkew_ihNZR5L8vEVDsQAAAZI"]
[Fri Dec 26 17:04:18.172658 2025] [:error] [pid 28268:tid 28296] [client 74.225.189.166:13298] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU5Pknc_KuO_55-uPTSCbgAAABU"]
[Fri Dec 26 17:04:18.456335 2025] [:error] [pid 28268:tid 28285] [client 74.225.189.166:13127] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU5Pknc_KuO_55-uPTSCbwAAAAo"]
[Fri Dec 26 17:04:18.736754 2025] [:error] [pid 15063:tid 15083] [client 74.225.189.166:13229] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aU5PkuDsf_aL46Jy7z_WXgAAARI"]
[Fri Dec 26 17:04:19.021076 2025] [:error] [pid 28268:tid 28281] [client 74.225.189.166:13121] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aU5Pk3c_KuO_55-uPTSCcAAAAAY"]
[Fri Dec 26 17:04:19.294661 2025] [:error] [pid 28268:tid 28299] [client 74.225.189.166:13133] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aU5Pk3c_KuO_55-uPTSCcQAAABg"]
[Fri Dec 26 17:04:19.565319 2025] [:error] [pid 28268:tid 28294] [client 74.225.189.166:13100] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aU5Pk3c_KuO_55-uPTSCcgAAABM"]
[Fri Dec 26 17:04:19.842362 2025] [:error] [pid 28268:tid 28276] [client 74.225.189.166:13190] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aU5Pk3c_KuO_55-uPTSCcwAAAAE"]
[Fri Dec 26 17:04:20.113604 2025] [:error] [pid 28268:tid 28282] [client 74.225.189.166:13192] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU5PlHc_KuO_55-uPTSCdAAAAAc"]
[Fri Dec 26 17:04:20.398895 2025] [:error] [pid 15063:tid 15072] [client 74.225.189.166:13135] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU5PlODsf_aL46Jy7z_WYAAAAQc"]
[Fri Dec 26 17:04:20.679494 2025] [:error] [pid 28270:tid 28350] [client 74.225.189.166:13302] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU5PlF9Ac79_ckdPN5InxgAAAJU"]
[Fri Dec 26 17:04:20.992463 2025] [:error] [pid 15063:tid 15081] [client 74.225.189.166:13259] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU5PlODsf_aL46Jy7z_WYQAAARA"]
[Fri Dec 26 17:04:21.266398 2025] [:error] [pid 15063:tid 15084] [client 74.225.189.166:13090] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aU5PleDsf_aL46Jy7z_WYwAAARM"]
[Fri Dec 26 17:04:21.548200 2025] [:error] [pid 28269:tid 28302] [client 74.225.189.166:13307] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aU5PlZ3ZK8bJ-c9-kjMn7gAAAEA"]
[Fri Dec 26 17:04:21.846057 2025] [:error] [pid 7160:tid 7165] [client 74.225.189.166:13196] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aU5Plew_ihNZR5L8vEVDtQAAAYI"]
[Fri Dec 26 17:04:22.127757 2025] [:error] [pid 28270:tid 28347] [client 74.225.189.166:13223] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aU5Pll9Ac79_ckdPN5InyQAAAJI"]
[Fri Dec 26 17:04:22.399475 2025] [:error] [pid 7160:tid 7177] [client 74.225.189.166:13179] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU5Pluw_ihNZR5L8vEVDtgAAAY4"]
[Fri Dec 26 17:04:22.681155 2025] [:error] [pid 28355:tid 28357] [client 74.225.189.166:13304] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU5PlrsFqKXf7ADZcTbpWwAAAMA"]
[Fri Dec 26 17:04:23.019025 2025] [:error] [pid 7160:tid 7163] [client 74.225.189.166:13158] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU5Pl-w_ihNZR5L8vEVDtwAAAYA"]
[Fri Dec 26 17:04:23.344894 2025] [:error] [pid 7160:tid 7169] [client 74.225.189.166:17800] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU5Pl-w_ihNZR5L8vEVDuAAAAYY"]
[Fri Dec 26 17:04:23.621650 2025] [:error] [pid 15063:tid 15065] [client 74.225.189.166:13259] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aU5Pl-Dsf_aL46Jy7z_WZAAAAQA"]
[Fri Dec 26 17:04:23.932416 2025] [:error] [pid 15063:tid 15071] [client 74.225.189.166:13163] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aU5Pl-Dsf_aL46Jy7z_WZQAAAQY"]
[Fri Dec 26 17:04:24.232811 2025] [:error] [pid 7160:tid 7178] [client 74.225.189.166:13130] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aU5PmOw_ihNZR5L8vEVDuwAAAY8"]
[Fri Dec 26 17:04:24.506088 2025] [:error] [pid 28355:tid 28374] [client 74.225.189.166:13059] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "aU5PmLsFqKXf7ADZcTbpXgAAANE"]
[Fri Dec 26 17:04:24.784771 2025] [:error] [pid 28269:tid 28313] [client 74.225.189.166:13134] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU5PmJ3ZK8bJ-c9-kjMn7wAAAEs"]
[Fri Dec 26 17:04:25.105471 2025] [:error] [pid 28269:tid 28317] [client 74.225.189.166:13070] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU5PmZ3ZK8bJ-c9-kjMn8QAAAE8"]
[Fri Dec 26 17:04:25.386672 2025] [:error] [pid 28269:tid 28312] [client 74.225.189.166:13142] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU5PmZ3ZK8bJ-c9-kjMn8gAAAEo"]
[Fri Dec 26 17:04:25.679818 2025] [:error] [pid 34865:tid 34890] [client 74.225.189.166:13217] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aU5Pmai4zjVVKBdvuTS4bgAAAVc"]
[Fri Dec 26 17:04:25.960227 2025] [:error] [pid 34865:tid 34878] [client 74.225.189.166:13126] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aU5Pmai4zjVVKBdvuTS4bwAAAUs"]
[Fri Dec 26 17:04:26.240081 2025] [:error] [pid 34865:tid 34882] [client 74.225.189.166:13233] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aU5Pmqi4zjVVKBdvuTS4cAAAAU8"]
[Fri Dec 26 17:04:26.521991 2025] [:error] [pid 28269:tid 28325] [client 74.225.189.166:13208] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aU5Pmp3ZK8bJ-c9-kjMn9QAAAFc"]
[Fri Dec 26 17:04:26.795431 2025] [:error] [pid 34865:tid 34885] [client 74.225.189.166:17865] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aU5Pmqi4zjVVKBdvuTS4cQAAAVI"]
[Fri Dec 26 17:04:27.096824 2025] [:error] [pid 28269:tid 28305] [client 74.225.189.166:13140] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aU5Pm53ZK8bJ-c9-kjMn9wAAAEM"]
[Fri Dec 26 17:04:27.385765 2025] [:error] [pid 34865:tid 34876] [client 74.225.189.166:13218] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aU5Pm6i4zjVVKBdvuTS4cgAAAUk"]
[Fri Dec 26 17:04:27.720686 2025] [:error] [pid 34865:tid 34881] [client 74.225.189.166:17862] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aU5Pm6i4zjVVKBdvuTS4cwAAAU4"]
[Fri Dec 26 17:04:28.029313 2025] [:error] [pid 28270:tid 28340] [client 74.225.189.166:13178] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aU5PnF9Ac79_ckdPN5InzgAAAIs"]
[Fri Dec 26 17:04:28.403163 2025] [:error] [pid 34865:tid 34873] [client 74.225.189.166:13204] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aU5PnKi4zjVVKBdvuTS4dAAAAUY"]
[Fri Dec 26 17:04:28.708525 2025] [:error] [pid 28269:tid 28323] [client 74.225.189.166:13123] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aU5PnJ3ZK8bJ-c9-kjMn-QAAAFU"]
[Fri Dec 26 17:04:29.000531 2025] [:error] [pid 34865:tid 34883] [client 74.225.189.166:13242] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aU5PnKi4zjVVKBdvuTS4dwAAAVA"]
[Fri Dec 26 17:04:29.348910 2025] [:error] [pid 28270:tid 28349] [client 74.225.189.166:13120] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "aU5PnV9Ac79_ckdPN5InzwAAAJQ"]
[Fri Dec 26 17:04:29.667822 2025] [:error] [pid 28269:tid 28307] [client 74.225.189.166:13180] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aU5PnZ3ZK8bJ-c9-kjMn-gAAAEU"]
[Fri Dec 26 17:04:29.943823 2025] [:error] [pid 28270:tid 28352] [client 74.225.189.166:13069] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aU5PnV9Ac79_ckdPN5In0AAAAJc"]
[Fri Dec 26 17:04:30.220328 2025] [:error] [pid 28355:tid 28366] [client 74.225.189.166:13211] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aU5PnrsFqKXf7ADZcTbpYAAAAMk"]
[Fri Dec 26 17:04:30.498915 2025] [:error] [pid 28269:tid 28310] [client 74.225.189.166:13152] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aU5Pnp3ZK8bJ-c9-kjMn_AAAAEg"]
[Fri Dec 26 17:04:30.772958 2025] [:error] [pid 34865:tid 34886] [client 74.225.189.166:13085] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aU5Pnqi4zjVVKBdvuTS4eQAAAVM"]
[Fri Dec 26 17:04:31.045150 2025] [:error] [pid 28270:tid 28333] [client 74.225.189.166:13282] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aU5Pn19Ac79_ckdPN5In0gAAAIQ"]
[Fri Dec 26 17:04:31.329322 2025] [:error] [pid 28269:tid 28317] [client 74.225.189.166:13156] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aU5Pn53ZK8bJ-c9-kjMn_gAAAE8"]
[Fri Dec 26 17:04:31.603073 2025] [:error] [pid 28268:tid 28283] [client 74.225.189.166:13083] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aU5Pn3c_KuO_55-uPTSCegAAAAg"]
[Fri Dec 26 17:04:31.877346 2025] [:error] [pid 28270:tid 28346] [client 74.225.189.166:13257] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU5Pn19Ac79_ckdPN5In0wAAAJE"]
[Fri Dec 26 17:04:32.156077 2025] [:error] [pid 28270:tid 28348] [client 74.225.189.166:13124] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU5PoF9Ac79_ckdPN5In1AAAAJM"]
[Fri Dec 26 17:04:32.441979 2025] [:error] [pid 34865:tid 34891] [client 74.225.189.166:13061] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU5PoKi4zjVVKBdvuTS4ewAAAVg"]
[Fri Dec 26 17:04:32.711863 2025] [:error] [pid 34865:tid 34872] [client 74.225.189.166:13220] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU5PoKi4zjVVKBdvuTS4fAAAAUU"]
[Fri Dec 26 17:04:32.984978 2025] [:error] [pid 34865:tid 34889] [client 74.225.189.166:13300] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aU5PoKi4zjVVKBdvuTS4fQAAAVY"]
[Fri Dec 26 17:04:33.264972 2025] [:error] [pid 34865:tid 34879] [client 74.225.189.166:17897] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aU5Poai4zjVVKBdvuTS4fwAAAUw"]
[Fri Dec 26 17:04:33.548631 2025] [:error] [pid 28270:tid 28338] [client 74.225.189.166:13164] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aU5PoV9Ac79_ckdPN5In1wAAAIk"]
[Fri Dec 26 17:04:33.821624 2025] [:error] [pid 34865:tid 34882] [client 74.225.189.166:13199] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aU5Poai4zjVVKBdvuTS4gAAAAU8"]
[Fri Dec 26 17:04:34.093628 2025] [:error] [pid 34865:tid 34885] [client 74.225.189.166:13241] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aU5Poqi4zjVVKBdvuTS4gQAAAVI"]
[Fri Dec 26 17:04:34.384761 2025] [:error] [pid 34865:tid 34876] [client 74.225.189.166:13281] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aU5Poqi4zjVVKBdvuTS4ggAAAUk"]
[Fri Dec 26 17:04:34.657042 2025] [:error] [pid 28268:tid 28298] [client 74.225.189.166:13160] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aU5Ponc_KuO_55-uPTSCfQAAABc"]
[Fri Dec 26 17:04:34.932612 2025] [:error] [pid 28268:tid 28285] [client 74.225.189.166:13306] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aU5Ponc_KuO_55-uPTSCfgAAAAo"]
[Fri Dec 26 17:04:35.204565 2025] [:error] [pid 7160:tid 7171] [client 74.225.189.166:13129] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU5Po-w_ihNZR5L8vEVDvgAAAYg"]
[Fri Dec 26 17:04:35.489887 2025] [:error] [pid 28268:tid 28299] [client 74.225.189.166:13212] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU5Po3c_KuO_55-uPTSCgAAAABg"]
[Fri Dec 26 17:04:35.762781 2025] [:error] [pid 28268:tid 28276] [client 74.225.189.166:13174] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU5Po3c_KuO_55-uPTSCgQAAAAE"]
[Fri Dec 26 17:04:36.071163 2025] [:error] [pid 28270:tid 28329] [client 74.225.189.166:13068] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aU5PpF9Ac79_ckdPN5In2wAAAIA"]
[Fri Dec 26 17:04:36.368243 2025] [:error] [pid 34865:tid 34881] [client 74.225.189.166:13058] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aU5PpKi4zjVVKBdvuTS4gwAAAU4"]
[Fri Dec 26 17:04:36.646053 2025] [:error] [pid 28269:tid 28311] [client 74.225.189.166:13198] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aU5PpJ3ZK8bJ-c9-kjMoBgAAAEk"]
[Fri Dec 26 17:04:36.916955 2025] [:error] [pid 28268:tid 28277] [client 74.225.189.166:13137] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aU5PpHc_KuO_55-uPTSCgwAAAAI"]
[Fri Dec 26 17:04:37.205232 2025] [:error] [pid 28270:tid 28335] [client 74.225.189.166:13155] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aU5PpV9Ac79_ckdPN5In3gAAAIY"]
[Fri Dec 26 17:04:37.482983 2025] [:error] [pid 28270:tid 28343] [client 74.225.189.166:13064] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU5PpV9Ac79_ckdPN5In3wAAAI4"]
[Fri Dec 26 17:04:37.759192 2025] [:error] [pid 28268:tid 28288] [client 74.225.189.166:13141] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU5PpXc_KuO_55-uPTSChQAAAA0"]
[Fri Dec 26 17:04:38.034993 2025] [:error] [pid 28268:tid 28286] [client 74.225.189.166:13239] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU5Ppnc_KuO_55-uPTSCiAAAAAs"]
[Fri Dec 26 17:04:38.306870 2025] [:error] [pid 28268:tid 28283] [client 74.225.189.166:13033] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aU5Ppnc_KuO_55-uPTSCiQAAAAg"]
[Fri Dec 26 17:04:38.591026 2025] [:error] [pid 7160:tid 7166] [client 74.225.189.166:13030] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU5Ppuw_ihNZR5L8vEVDwgAAAYM"]
[Fri Dec 26 17:04:38.867074 2025] [:error] [pid 28268:tid 28292] [client 74.225.189.166:13015] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU5Ppnc_KuO_55-uPTSCiwAAABE"]
[Fri Dec 26 17:04:39.149720 2025] [:error] [pid 7160:tid 7174] [client 74.225.189.166:13071] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU5Pp-w_ihNZR5L8vEVDwwAAAYs"]
[Fri Dec 26 17:04:39.422843 2025] [:error] [pid 28270:tid 28339] [client 74.225.189.166:13275] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aU5Pp19Ac79_ckdPN5In4QAAAIo"]
[Fri Dec 26 17:04:39.704658 2025] [:error] [pid 28269:tid 28320] [client 74.225.189.166:13104] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aU5Pp53ZK8bJ-c9-kjMoCAAAAFI"]
[Fri Dec 26 17:04:39.977680 2025] [:error] [pid 7160:tid 7163] [client 74.225.189.166:13242] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aU5Pp-w_ihNZR5L8vEVDxQAAAYA"]
[Fri Dec 26 17:04:40.279100 2025] [:error] [pid 28269:tid 28310] [client 74.225.189.166:13067] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aU5PqJ3ZK8bJ-c9-kjMoCQAAAEg"]
[Fri Dec 26 17:04:40.555792 2025] [:error] [pid 28269:tid 28302] [client 74.225.189.166:13128] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aU5PqJ3ZK8bJ-c9-kjMoCgAAAEA"]
[Fri Dec 26 17:04:40.845748 2025] [:error] [pid 28268:tid 28296] [client 74.225.189.166:12998] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aU5PqHc_KuO_55-uPTSCjQAAABU"]
[Fri Dec 26 17:04:41.117694 2025] [:error] [pid 28270:tid 28348] [client 74.225.189.166:13221] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aU5PqV9Ac79_ckdPN5In5AAAAJM"]
[Fri Dec 26 17:04:41.392348 2025] [:error] [pid 28268:tid 28281] [client 74.225.189.166:13080] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aU5PqXc_KuO_55-uPTSCjwAAAAY"]
[Fri Dec 26 17:04:41.672952 2025] [:error] [pid 7160:tid 7167] [client 74.225.189.166:13089] [client 74.225.189.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aU5Pqew_ihNZR5L8vEVDxwAAAYQ"]
[Fri Dec 26 18:11:18.250462 2025] [:error] [pid 28268:tid 28286] [client 49.7.227.204:42092] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aU5fRnc_KuO_55-uPTSRLgAAAAs"]
[Fri Dec 26 21:20:13.169474 2025] [:error] [pid 15063:tid 15066] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Dec 26 21:20:13.383117 2025] [:error] [pid 15063:tid 15083] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Fri Dec 26 21:20:13.532517 2025] [:error] [pid 15063:tid 15087] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Fri Dec 26 21:20:13.671086 2025] [:error] [pid 15063:tid 15071] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mails.php
[Fri Dec 26 21:20:13.809728 2025] [:error] [pid 15063:tid 15077] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/karma_57c3d4.php
[Fri Dec 26 21:20:13.947744 2025] [:error] [pid 15063:tid 15076] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-home.php
[Fri Dec 26 21:20:14.085783 2025] [:error] [pid 15063:tid 15089] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/z123.php
[Fri Dec 26 21:20:14.235050 2025] [:error] [pid 15063:tid 15070] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/doelr.php
[Fri Dec 26 21:20:14.386857 2025] [:error] [pid 15063:tid 15068] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/Contrller.php
[Fri Dec 26 21:20:14.524601 2025] [:error] [pid 15063:tid 15065] [client 20.196.90.232:20314] File does not exist: /usr/local/apache/htdocs/suspended-page/rp8zi.php
[Fri Dec 26 21:20:14.660252 2025] [:error] [pid 15063:tid 15080] [client 20.196.90.232:20314] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aU6LjuDsf_aL46Jy7z8cewAAAQ8"]
[Fri Dec 26 21:20:15.053347 2025] [:error] [pid 7160:tid 7166] [client 20.196.90.232:20232] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aU6Lj-w_ihNZR5L8vEWR3QAAAYM"]
[Fri Dec 26 21:20:15.459642 2025] [:error] [pid 28269:tid 28304] [client 20.196.90.232:20276] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aU6Lj53ZK8bJ-c9-kjOMPQAAAEI"]
[Fri Dec 26 21:20:15.900989 2025] [:error] [pid 28269:tid 28317] [client 20.196.90.232:20238] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-securitiy.php"] [unique_id "aU6Lj53ZK8bJ-c9-kjOMPgAAAE8"]
[Fri Dec 26 21:20:16.519044 2025] [:error] [pid 34865:tid 34872] [client 20.196.90.232:20339] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aU6LkKi4zjVVKBdvuTT3IgAAAUU"]
[Fri Dec 26 21:20:16.981664 2025] [:error] [pid 28269:tid 28322] [client 20.196.90.232:20268] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aU6LkJ3ZK8bJ-c9-kjOMQwAAAFQ"]
[Fri Dec 26 21:20:17.296807 2025] [:error] [pid 28268:tid 28284] [client 20.196.90.232:20313] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aU6LkXc_KuO_55-uPTS9EgAAAAk"]
[Fri Dec 26 21:20:17.656352 2025] [:error] [pid 28355:tid 28365] [client 20.196.90.232:20302] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aU6LkbsFqKXf7ADZcTYkzAAAAMg"]
[Fri Dec 26 21:20:18.007026 2025] [:error] [pid 15063:tid 15066] [client 20.196.90.232:20318] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aU6LkuDsf_aL46Jy7z8cgAAAAQE"]
[Fri Dec 26 21:20:18.345775 2025] [:error] [pid 7160:tid 7171] [client 20.196.90.232:20281] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aU6Lkuw_ihNZR5L8vEWR4AAAAYg"]
[Fri Dec 26 21:20:18.722242 2025] [:error] [pid 28270:tid 28351] [client 20.196.90.232:20338] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aU6Lkl9Ac79_ckdPN5JiFgAAAJY"]
[Fri Dec 26 21:20:19.095587 2025] [:error] [pid 28355:tid 28379] [client 20.196.90.232:1569] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/KV7EGJmhHzX.php"] [unique_id "aU6Lk7sFqKXf7ADZcTYkzgAAANY"]
[Fri Dec 26 21:20:19.574221 2025] [:error] [pid 28268:tid 28294] [client 20.196.90.232:20348] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "aU6Lk3c_KuO_55-uPTS9FAAAABM"]
[Fri Dec 26 21:20:19.917053 2025] [:error] [pid 34865:tid 34868] [client 20.196.90.232:20233] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "aU6Lk6i4zjVVKBdvuTT3KAAAAUE"]
[Fri Dec 26 21:20:20.312085 2025] [:error] [pid 28268:tid 28287] [client 20.196.90.232:20264] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "aU6LlHc_KuO_55-uPTS9FwAAAAw"]
[Fri Dec 26 21:20:20.722532 2025] [:error] [pid 28269:tid 28305] [client 20.196.90.232:20349] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "aU6LlJ3ZK8bJ-c9-kjOMSgAAAEM"]
[Fri Dec 26 21:20:21.118183 2025] [:error] [pid 15063:tid 15089] [client 20.196.90.232:20301] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yu.php"] [unique_id "aU6LleDsf_aL46Jy7z8chAAAARg"]
[Fri Dec 26 21:20:21.421479 2025] [:error] [pid 28268:tid 28288] [client 20.196.90.232:20248] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yu.php"] [unique_id "aU6LlXc_KuO_55-uPTS9GAAAAA0"]
[Fri Dec 26 21:20:21.830188 2025] [:error] [pid 28270:tid 28349] [client 20.196.90.232:20308] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yu.php"] [unique_id "aU6LlV9Ac79_ckdPN5JiGAAAAJQ"]
[Fri Dec 26 21:20:22.163765 2025] [:error] [pid 28270:tid 28340] [client 20.196.90.232:20237] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yu.php"] [unique_id "aU6Lll9Ac79_ckdPN5JiGQAAAIs"]
[Fri Dec 26 21:20:22.462062 2025] [:error] [pid 28270:tid 28342] [client 20.196.90.232:20335] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU6Lll9Ac79_ckdPN5JiGgAAAI0"]
[Fri Dec 26 21:20:22.769872 2025] [:error] [pid 28355:tid 28360] [client 20.196.90.232:20295] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU6LlrsFqKXf7ADZcTYkzwAAAMM"]
[Fri Dec 26 21:20:23.097458 2025] [:error] [pid 28269:tid 28323] [client 20.196.90.232:20273] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU6Ll53ZK8bJ-c9-kjOMUAAAAFU"]
[Fri Dec 26 21:20:23.425256 2025] [:error] [pid 7160:tid 7177] [client 20.196.90.232:20323] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aU6Ll-w_ihNZR5L8vEWR5gAAAY4"]
[Fri Dec 26 21:20:23.720746 2025] [:error] [pid 28355:tid 28371] [client 20.196.90.232:20310] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aU6Ll7sFqKXf7ADZcTYk0gAAAM4"]
[Fri Dec 26 21:20:24.003003 2025] [:error] [pid 7160:tid 7187] [client 20.196.90.232:20350] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aU6LmOw_ihNZR5L8vEWR6QAAAZg"]
[Fri Dec 26 21:20:24.427528 2025] [:error] [pid 28270:tid 28333] [client 20.196.90.232:20311] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aU6LmF9Ac79_ckdPN5JiHAAAAIQ"]
[Fri Dec 26 21:20:24.816933 2025] [:error] [pid 28268:tid 28283] [client 20.196.90.232:20298] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aU6LmHc_KuO_55-uPTS9GQAAAAg"]
[Fri Dec 26 21:20:25.160672 2025] [:error] [pid 28355:tid 28369] [client 20.196.90.232:20275] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesTyuj.php"] [unique_id "aU6LmbsFqKXf7ADZcTYk1AAAAMw"]
[Fri Dec 26 21:20:25.680366 2025] [:error] [pid 28355:tid 28364] [client 20.196.90.232:20288] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesTyuj.php"] [unique_id "aU6LmbsFqKXf7ADZcTYk1gAAAMc"]
[Fri Dec 26 21:20:26.055130 2025] [:error] [pid 15063:tid 15084] [client 20.196.90.232:20326] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesTyuj.php"] [unique_id "aU6LmuDsf_aL46Jy7z8ciwAAARM"]
[Fri Dec 26 21:20:26.469152 2025] [:error] [pid 28269:tid 28306] [client 20.196.90.232:20344] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesTyuj.php"] [unique_id "aU6Lmp3ZK8bJ-c9-kjOMUwAAAEQ"]
[Fri Dec 26 21:20:26.911164 2025] [:error] [pid 28268:tid 28282] [client 20.196.90.232:20239] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tqloh.php"] [unique_id "aU6Lmnc_KuO_55-uPTS9HAAAAAc"]
[Fri Dec 26 21:20:27.280840 2025] [:error] [pid 28270:tid 28346] [client 20.196.90.232:20242] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tqloh.php"] [unique_id "aU6Lm19Ac79_ckdPN5JiIQAAAJE"]
[Fri Dec 26 21:20:27.630891 2025] [:error] [pid 28270:tid 28341] [client 20.196.90.232:20257] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tqloh.php"] [unique_id "aU6Lm19Ac79_ckdPN5JiIgAAAIw"]
[Fri Dec 26 21:20:27.988700 2025] [:error] [pid 34865:tid 34883] [client 20.196.90.232:20294] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tqloh.php"] [unique_id "aU6Lm6i4zjVVKBdvuTT3MgAAAVA"]
[Fri Dec 26 21:20:28.325665 2025] [:error] [pid 28269:tid 28308] [client 20.196.90.232:20235] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w3llstore.php"] [unique_id "aU6LnJ3ZK8bJ-c9-kjOMVgAAAEY"]
[Fri Dec 26 21:20:28.796608 2025] [:error] [pid 28270:tid 28351] [client 20.196.90.232:20305] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w3llstore.php"] [unique_id "aU6LnF9Ac79_ckdPN5JiKAAAAJY"]
[Fri Dec 26 21:20:29.206606 2025] [:error] [pid 28270:tid 28349] [client 20.196.90.232:20247] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w3llstore.php"] [unique_id "aU6LnV9Ac79_ckdPN5JiKgAAAJQ"]
[Fri Dec 26 21:20:29.604259 2025] [:error] [pid 34865:tid 34869] [client 20.196.90.232:20274] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w3llstore.php"] [unique_id "aU6Lnai4zjVVKBdvuTT3MwAAAUI"]
[Fri Dec 26 21:20:29.931205 2025] [:error] [pid 28268:tid 28294] [client 20.196.90.232:20241] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ging.php"] [unique_id "aU6LnXc_KuO_55-uPTS9JQAAABM"]
[Fri Dec 26 21:20:30.488119 2025] [:error] [pid 34865:tid 34874] [client 20.196.90.232:1542] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ging.php"] [unique_id "aU6Lnqi4zjVVKBdvuTT3NgAAAUc"]
[Fri Dec 26 21:20:30.896695 2025] [:error] [pid 7160:tid 7165] [client 20.196.90.232:1553] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ging.php"] [unique_id "aU6Lnuw_ihNZR5L8vEWR8AAAAYI"]
[Fri Dec 26 21:20:31.630974 2025] [:error] [pid 7160:tid 7185] [client 20.196.90.232:1570] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ging.php"] [unique_id "aU6Ln-w_ihNZR5L8vEWR8QAAAZY"]
[Fri Dec 26 21:20:32.540050 2025] [:error] [pid 28270:tid 28334] [client 20.196.90.232:20236] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aU6LoF9Ac79_ckdPN5JiLAAAAIU"]
[Fri Dec 26 21:20:33.269469 2025] [:error] [pid 7160:tid 7170] [client 20.196.90.232:20340] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aU6Loew_ihNZR5L8vEWR8wAAAYc"]
[Fri Dec 26 21:20:33.747924 2025] [:error] [pid 28270:tid 28346] [client 20.196.90.232:20347] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aU6LoV9Ac79_ckdPN5JiLwAAAJE"]
[Fri Dec 26 21:20:34.130838 2025] [:error] [pid 34865:tid 34873] [client 20.196.90.232:20228] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fc72f.php"] [unique_id "aU6Loqi4zjVVKBdvuTT3OgAAAUY"]
[Fri Dec 26 21:20:34.501662 2025] [:error] [pid 28268:tid 28277] [client 20.196.90.232:20271] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aU6Lonc_KuO_55-uPTS9KwAAAAI"]
[Fri Dec 26 21:20:34.956233 2025] [:error] [pid 28270:tid 28332] [client 20.196.90.232:20300] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aU6Lol9Ac79_ckdPN5JiMQAAAIM"]
[Fri Dec 26 21:20:35.431835 2025] [:error] [pid 28268:tid 28291] [client 20.196.90.232:20243] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aU6Lo3c_KuO_55-uPTS9LgAAABA"]
[Fri Dec 26 21:20:35.776576 2025] [:error] [pid 28270:tid 28330] [client 20.196.90.232:20317] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aU6Lo19Ac79_ckdPN5JiMwAAAIE"]
[Fri Dec 26 21:20:36.116417 2025] [:error] [pid 34865:tid 34867] [client 20.196.90.232:20253] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU6LpKi4zjVVKBdvuTT3PwAAAUA"]
[Fri Dec 26 21:20:36.436668 2025] [:error] [pid 28270:tid 28350] [client 20.196.90.232:20307] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU6LpF9Ac79_ckdPN5JiNAAAAJU"]
[Fri Dec 26 21:20:36.787084 2025] [:error] [pid 28270:tid 28349] [client 20.196.90.232:20226] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU6LpF9Ac79_ckdPN5JiNQAAAJQ"]
[Fri Dec 26 21:20:37.069453 2025] [:error] [pid 28270:tid 28345] [client 20.196.90.232:20309] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aU6LpV9Ac79_ckdPN5JiNgAAAJA"]
[Fri Dec 26 21:20:37.511189 2025] [:error] [pid 28269:tid 28305] [client 20.196.90.232:20342] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s12.php"] [unique_id "aU6LpZ3ZK8bJ-c9-kjOMWwAAAEM"]
[Fri Dec 26 21:20:37.903418 2025] [:error] [pid 28269:tid 28313] [client 20.196.90.232:20272] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s12.php"] [unique_id "aU6LpZ3ZK8bJ-c9-kjOMXAAAAEs"]
[Fri Dec 26 21:20:38.318968 2025] [:error] [pid 15063:tid 15085] [client 20.196.90.232:1599] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s12.php"] [unique_id "aU6LpuDsf_aL46Jy7z8cmgAAARQ"]
[Fri Dec 26 21:20:38.786798 2025] [:error] [pid 15063:tid 15083] [client 20.196.90.232:20337] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s12.php"] [unique_id "aU6LpuDsf_aL46Jy7z8cnAAAARI"]
[Fri Dec 26 21:20:39.385864 2025] [:error] [pid 28270:tid 28344] [client 20.196.90.232:1564] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "aU6Lp19Ac79_ckdPN5JiOQAAAI8"]
[Fri Dec 26 21:20:39.705184 2025] [:error] [pid 28268:tid 28297] [client 20.196.90.232:20296] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "aU6Lp3c_KuO_55-uPTS9MwAAABY"]
[Fri Dec 26 21:20:40.126626 2025] [:error] [pid 28270:tid 28353] [client 20.196.90.232:18375] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "aU6LqF9Ac79_ckdPN5JiOwAAAJg"]
[Fri Dec 26 21:20:40.486278 2025] [:error] [pid 28270:tid 28338] [client 20.196.90.232:20225] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "aU6LqF9Ac79_ckdPN5JiPgAAAIk"]
[Fri Dec 26 21:20:41.037798 2025] [:error] [pid 28355:tid 28372] [client 20.196.90.232:20270] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aU6LqbsFqKXf7ADZcTYk3wAAAM8"]
[Fri Dec 26 21:20:41.518492 2025] [:error] [pid 28270:tid 28351] [client 20.196.90.232:20336] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aU6LqV9Ac79_ckdPN5JiQQAAAJY"]
[Fri Dec 26 21:20:42.186983 2025] [:error] [pid 28355:tid 28370] [client 20.196.90.232:20286] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aU6LqrsFqKXf7ADZcTYk4AAAAM0"]
[Fri Dec 26 21:20:42.605868 2025] [:error] [pid 28269:tid 28317] [client 20.196.90.232:20251] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm18.php"] [unique_id "aU6Lqp3ZK8bJ-c9-kjOMYgAAAE8"]
[Fri Dec 26 21:20:43.243476 2025] [:error] [pid 28355:tid 28375] [client 20.196.90.232:20341] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU6Lq7sFqKXf7ADZcTYk4QAAANI"]
[Fri Dec 26 21:20:43.765250 2025] [:error] [pid 34865:tid 34869] [client 20.196.90.232:20266] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU6Lq6i4zjVVKBdvuTT3RAAAAUI"]
[Fri Dec 26 21:20:44.129755 2025] [:error] [pid 28355:tid 28378] [client 20.196.90.232:18380] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU6LrLsFqKXf7ADZcTYk4wAAANU"]
[Fri Dec 26 21:20:44.663558 2025] [:error] [pid 28270:tid 28345] [client 20.196.90.232:20328] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aU6LrF9Ac79_ckdPN5JiRAAAAJA"]
[Fri Dec 26 21:20:45.045748 2025] [:error] [pid 28268:tid 28286] [client 20.196.90.232:20262] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6LrXc_KuO_55-uPTS9OAAAAAs"]
[Fri Dec 26 21:20:45.491731 2025] [:error] [pid 34865:tid 34882] [client 20.196.90.232:1595] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6Lrai4zjVVKBdvuTT3SwAAAU8"]
[Fri Dec 26 21:20:45.908689 2025] [:error] [pid 34865:tid 34870] [client 20.196.90.232:1593] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6Lrai4zjVVKBdvuTT3TgAAAUM"]
[Fri Dec 26 21:20:46.465877 2025] [:error] [pid 28355:tid 28368] [client 20.196.90.232:20256] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6LrrsFqKXf7ADZcTYk5AAAAMs"]
[Fri Dec 26 21:20:46.914001 2025] [:error] [pid 28268:tid 28280] [client 20.196.90.232:20322] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aU6Lrnc_KuO_55-uPTS9OgAAAAU"]
[Fri Dec 26 21:20:47.407877 2025] [:error] [pid 28355:tid 28367] [client 20.196.90.232:20291] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aU6Lr7sFqKXf7ADZcTYk6AAAAMo"]
[Fri Dec 26 21:20:47.797431 2025] [:error] [pid 34865:tid 34887] [client 20.196.90.232:20280] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aU6Lr6i4zjVVKBdvuTT3VAAAAVQ"]
[Fri Dec 26 21:20:48.150125 2025] [:error] [pid 28268:tid 28295] [client 20.196.90.232:1581] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aU6LsHc_KuO_55-uPTS9PAAAABQ"]
[Fri Dec 26 21:20:48.544215 2025] [:error] [pid 28355:tid 28377] [client 20.196.90.232:20330] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aU6LsLsFqKXf7ADZcTYk6wAAANQ"]
[Fri Dec 26 21:20:48.934077 2025] [:error] [pid 28355:tid 28380] [client 20.196.90.232:1573] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aU6LsLsFqKXf7ADZcTYk7AAAANc"]
[Fri Dec 26 21:20:49.577505 2025] [:error] [pid 28355:tid 28361] [client 20.196.90.232:20327] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aU6LsbsFqKXf7ADZcTYk7wAAAMQ"]
[Fri Dec 26 21:20:50.007699 2025] [:error] [pid 34865:tid 34876] [client 20.196.90.232:1558] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aU6Lsqi4zjVVKBdvuTT3WAAAAUk"]
[Fri Dec 26 21:20:51.138994 2025] [:error] [pid 28355:tid 28375] [client 20.196.90.232:20332] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aU6Ls7sFqKXf7ADZcTYk8QAAANI"]
[Fri Dec 26 21:20:52.004027 2025] [:error] [pid 15063:tid 15072] [client 20.196.90.232:20249] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aU6LtODsf_aL46Jy7z8cqgAAAQc"]
[Fri Dec 26 21:20:52.448410 2025] [:error] [pid 15063:tid 15086] [client 20.196.90.232:20319] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aU6LtODsf_aL46Jy7z8crgAAARU"]
[Fri Dec 26 21:20:53.150582 2025] [:error] [pid 15063:tid 15070] [client 20.196.90.232:20263] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l3gi0n.php"] [unique_id "aU6LteDsf_aL46Jy7z8csQAAAQU"]
[Fri Dec 26 21:20:53.949399 2025] [:error] [pid 28355:tid 28368] [client 20.196.90.232:20279] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aU6LtbsFqKXf7ADZcTYk9QAAAMs"]
[Fri Dec 26 21:20:54.430587 2025] [:error] [pid 28355:tid 28363] [client 20.196.90.232:20299] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aU6LtrsFqKXf7ADZcTYk9gAAAMY"]
[Fri Dec 26 21:20:55.068221 2025] [:error] [pid 7160:tid 7178] [client 20.196.90.232:1572] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aU6Lt-w_ihNZR5L8vEWSCAAAAY8"]
[Fri Dec 26 21:20:55.720359 2025] [:error] [pid 7160:tid 7176] [client 20.196.90.232:20289] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aU6Lt-w_ihNZR5L8vEWSCQAAAY0"]
[Fri Dec 26 21:20:56.504076 2025] [:error] [pid 15063:tid 15079] [client 20.196.90.232:20304] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccea.php"] [unique_id "aU6LuODsf_aL46Jy7z8cwgAAAQ4"]
[Fri Dec 26 21:20:56.932190 2025] [:error] [pid 7160:tid 7183] [client 20.196.90.232:20306] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccea.php"] [unique_id "aU6LuOw_ihNZR5L8vEWSDQAAAZQ"]
[Fri Dec 26 21:20:57.475517 2025] [:error] [pid 28355:tid 28374] [client 20.196.90.232:1586] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccea.php"] [unique_id "aU6LubsFqKXf7ADZcTYk_QAAANE"]
[Fri Dec 26 21:20:57.922868 2025] [:error] [pid 15063:tid 15081] [client 20.196.90.232:1596] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccea.php"] [unique_id "aU6LueDsf_aL46Jy7z8cygAAARA"]
[Fri Dec 26 21:20:58.406288 2025] [:error] [pid 28268:tid 28275] [client 20.196.90.232:20303] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aU6Lunc_KuO_55-uPTS9QwAAAAA"]
[Fri Dec 26 21:20:58.842596 2025] [:error] [pid 28270:tid 28347] [client 20.196.90.232:20230] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aU6Lul9Ac79_ckdPN5JiRgAAAJI"]
[Fri Dec 26 21:20:59.480261 2025] [:error] [pid 34865:tid 34873] [client 20.196.90.232:1544] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aU6Lu6i4zjVVKBdvuTT3WwAAAUY"]
[Fri Dec 26 21:21:00.045439 2025] [:error] [pid 34865:tid 34885] [client 20.196.90.232:1594] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-title.php"] [unique_id "aU6LvKi4zjVVKBdvuTT3XQAAAVI"]
[Fri Dec 26 21:21:00.857404 2025] [:error] [pid 28355:tid 28364] [client 20.196.90.232:1575] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-729.php"] [unique_id "aU6LvLsFqKXf7ADZcTYlBAAAAMc"]
[Fri Dec 26 21:21:01.395221 2025] [:error] [pid 28355:tid 28378] [client 20.196.90.232:18384] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-729.php"] [unique_id "aU6LvbsFqKXf7ADZcTYlBQAAANU"]
[Fri Dec 26 21:21:01.868442 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:1546] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-729.php"] [unique_id "aU6LvZ3ZK8bJ-c9-kjOMagAAAEE"]
[Fri Dec 26 21:21:02.366816 2025] [:error] [pid 28269:tid 28304] [client 20.196.90.232:20245] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-729.php"] [unique_id "aU6Lvp3ZK8bJ-c9-kjOMawAAAEI"]
[Fri Dec 26 21:21:02.978333 2025] [:error] [pid 28269:tid 28319] [client 20.196.90.232:1583] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ssxsl.php"] [unique_id "aU6Lvp3ZK8bJ-c9-kjOMbwAAAFE"]
[Fri Dec 26 21:21:03.476623 2025] [:error] [pid 7160:tid 7185] [client 20.196.90.232:18339] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ssxsl.php"] [unique_id "aU6Lv-w_ihNZR5L8vEWSEQAAAZY"]
[Fri Dec 26 21:21:03.863013 2025] [:error] [pid 34865:tid 34872] [client 20.196.90.232:1589] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ssxsl.php"] [unique_id "aU6Lv6i4zjVVKBdvuTT3YAAAAUU"]
[Fri Dec 26 21:21:04.329200 2025] [:error] [pid 15063:tid 15088] [client 20.196.90.232:1543] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ssxsl.php"] [unique_id "aU6LwODsf_aL46Jy7z8c0AAAARc"]
[Fri Dec 26 21:21:04.840090 2025] [:error] [pid 15063:tid 15089] [client 20.196.90.232:20246] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aU6LwODsf_aL46Jy7z8c0gAAARg"]
[Fri Dec 26 21:21:05.376186 2025] [:error] [pid 28270:tid 28343] [client 20.196.90.232:20250] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aU6LwV9Ac79_ckdPN5JiSgAAAI4"]
[Fri Dec 26 21:21:05.927052 2025] [:error] [pid 28268:tid 28276] [client 20.196.90.232:20331] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aU6LwXc_KuO_55-uPTS9UgAAAAE"]
[Fri Dec 26 21:21:06.581505 2025] [:error] [pid 28355:tid 28366] [client 20.196.90.232:18373] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aU6LwrsFqKXf7ADZcTYlCAAAAMk"]
[Fri Dec 26 21:21:06.928486 2025] [:error] [pid 28268:tid 28275] [client 20.196.90.232:20284] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sikma.php"] [unique_id "aU6Lwnc_KuO_55-uPTS9VgAAAAA"]
[Fri Dec 26 21:21:07.461178 2025] [:error] [pid 28269:tid 28322] [client 20.196.90.232:20231] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sikma.php"] [unique_id "aU6Lw53ZK8bJ-c9-kjOMcQAAAFQ"]
[Fri Dec 26 21:21:08.943977 2025] [:error] [pid 7160:tid 7187] [client 20.196.90.232:20334] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sikma.php"] [unique_id "aU6LxOw_ihNZR5L8vEWSEwAAAZg"]
[Fri Dec 26 21:21:09.569219 2025] [:error] [pid 28270:tid 28334] [client 20.196.90.232:1576] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sikma.php"] [unique_id "aU6LxV9Ac79_ckdPN5JiTQAAAIU"]
[Fri Dec 26 21:21:10.559085 2025] [:error] [pid 34865:tid 34879] [client 20.196.90.232:1548] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aU6Lxqi4zjVVKBdvuTT3ZAAAAUw"]
[Fri Dec 26 21:21:10.992974 2025] [:error] [pid 7160:tid 7176] [client 20.196.90.232:20287] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aU6Lxuw_ihNZR5L8vEWSFwAAAY0"]
[Fri Dec 26 21:21:11.432826 2025] [:error] [pid 15063:tid 15075] [client 20.196.90.232:20269] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aU6Lx-Dsf_aL46Jy7z8c1wAAAQo"]
[Fri Dec 26 21:21:11.878550 2025] [:error] [pid 34865:tid 34868] [client 20.196.90.232:18423] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aU6Lx6i4zjVVKBdvuTT3ZgAAAUE"]
[Fri Dec 26 21:21:12.218212 2025] [:error] [pid 28355:tid 28373] [client 20.196.90.232:20267] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwyjwrfr.php"] [unique_id "aU6LyLsFqKXf7ADZcTYlDAAAANA"]
[Fri Dec 26 21:21:12.556865 2025] [:error] [pid 28269:tid 28320] [client 20.196.90.232:1568] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwyjwrfr.php"] [unique_id "aU6LyJ3ZK8bJ-c9-kjOMdwAAAFI"]
[Fri Dec 26 21:21:13.388860 2025] [:error] [pid 34865:tid 34882] [client 20.196.90.232:20351] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwyjwrfr.php"] [unique_id "aU6Lyai4zjVVKBdvuTT3aAAAAU8"]
[Fri Dec 26 21:21:13.869458 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:18368] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwyjwrfr.php"] [unique_id "aU6LyZ3ZK8bJ-c9-kjOMegAAAEE"]
[Fri Dec 26 21:21:14.409540 2025] [:error] [pid 15063:tid 15083] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Fri Dec 26 21:21:14.579046 2025] [:error] [pid 15063:tid 15082] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Dec 26 21:21:14.751647 2025] [:error] [pid 15063:tid 15078] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/atex1.php
[Fri Dec 26 21:21:14.890040 2025] [:error] [pid 15063:tid 15087] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/xenium4x.php
[Fri Dec 26 21:21:15.061943 2025] [:error] [pid 15063:tid 15069] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/6kDPjgFTmvS.php
[Fri Dec 26 21:21:15.258917 2025] [:error] [pid 15063:tid 15073] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/xopvne.php
[Fri Dec 26 21:21:15.899079 2025] [:error] [pid 15063:tid 15070] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Fri Dec 26 21:21:16.042146 2025] [:error] [pid 15063:tid 15089] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Dec 26 21:21:16.277140 2025] [:error] [pid 15063:tid 15074] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Dec 26 21:21:16.425369 2025] [:error] [pid 15063:tid 15068] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/kao.php
[Fri Dec 26 21:21:16.570538 2025] [:error] [pid 15063:tid 15079] [client 20.196.90.232:1556] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Dec 26 21:21:16.775195 2025] [:error] [pid 15063:tid 15080] [client 20.196.90.232:1556] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aU6LzODsf_aL46Jy7z8c5wAAAQ8"]
[Fri Dec 26 21:21:17.380194 2025] [:error] [pid 7160:tid 7180] [client 20.196.90.232:20244] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aU6Lzew_ihNZR5L8vEWSIAAAAZE"]
[Fri Dec 26 21:21:17.870146 2025] [:error] [pid 15063:tid 15076] [client 20.196.90.232:20265] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aU6LzeDsf_aL46Jy7z8c6AAAAQs"]
[Fri Dec 26 21:21:18.333002 2025] [:error] [pid 7160:tid 7163] [client 20.196.90.232:1587] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aU6Lzuw_ihNZR5L8vEWSJgAAAYA"]
[Fri Dec 26 21:21:18.715292 2025] [:error] [pid 28268:tid 28283] [client 20.196.90.232:18390] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aU6Lznc_KuO_55-uPTS9XwAAAAg"]
[Fri Dec 26 21:21:19.150956 2025] [:error] [pid 28268:tid 28299] [client 20.196.90.232:18370] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aU6Lz3c_KuO_55-uPTS9ZAAAABg"]
[Fri Dec 26 21:21:19.674370 2025] [:error] [pid 34865:tid 34885] [client 20.196.90.232:1580] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aU6Lz6i4zjVVKBdvuTT3bQAAAVI"]
[Fri Dec 26 21:21:20.283332 2025] [:error] [pid 28270:tid 28345] [client 20.196.90.232:18372] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-ac.php"] [unique_id "aU6L0F9Ac79_ckdPN5JiUgAAAJA"]
[Fri Dec 26 21:21:20.806972 2025] [:error] [pid 28268:tid 28291] [client 20.196.90.232:20329] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU6L0Hc_KuO_55-uPTS9ZQAAABA"]
[Fri Dec 26 21:21:21.246597 2025] [:error] [pid 28355:tid 28371] [client 20.196.90.232:20255] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU6L0bsFqKXf7ADZcTYlDwAAAM4"]
[Fri Dec 26 21:21:21.724056 2025] [:error] [pid 7160:tid 7164] [client 20.196.90.232:1598] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU6L0ew_ihNZR5L8vEWSLgAAAYE"]
[Fri Dec 26 21:21:22.174650 2025] [:error] [pid 34865:tid 34869] [client 20.196.90.232:18398] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU6L0qi4zjVVKBdvuTT3dAAAAUI"]
[Fri Dec 26 21:21:22.876244 2025] [:error] [pid 34865:tid 34891] [client 20.196.90.232:20325] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aU6L0qi4zjVVKBdvuTT3dQAAAVg"]
[Fri Dec 26 21:21:23.403770 2025] [:error] [pid 28270:tid 28338] [client 20.196.90.232:20278] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aU6L019Ac79_ckdPN5JiVgAAAIk"]
[Fri Dec 26 21:21:23.834479 2025] [:error] [pid 28270:tid 28346] [client 20.196.90.232:20252] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aU6L019Ac79_ckdPN5JiWQAAAJE"]
[Fri Dec 26 21:21:24.282683 2025] [:error] [pid 34865:tid 34868] [client 20.196.90.232:1536] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jjrpo.php"] [unique_id "aU6L1Ki4zjVVKBdvuTT3eAAAAUE"]
[Fri Dec 26 21:21:24.704156 2025] [:error] [pid 34865:tid 34889] [client 20.196.90.232:18377] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU6L1Ki4zjVVKBdvuTT3egAAAVY"]
[Fri Dec 26 21:21:25.191457 2025] [:error] [pid 28268:tid 28294] [client 20.196.90.232:20346] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU6L1Xc_KuO_55-uPTS9aQAAABM"]
[Fri Dec 26 21:21:25.747714 2025] [:error] [pid 34865:tid 34884] [client 20.196.90.232:18376] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU6L1ai4zjVVKBdvuTT3gAAAAVE"]
[Fri Dec 26 21:21:26.295623 2025] [:error] [pid 34865:tid 34869] [client 20.196.90.232:1551] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU6L1qi4zjVVKBdvuTT3hgAAAUI"]
[Fri Dec 26 21:21:26.660787 2025] [:error] [pid 28269:tid 28319] [client 20.196.90.232:1591] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aU6L1p3ZK8bJ-c9-kjOMjQAAAFE"]
[Fri Dec 26 21:21:27.190875 2025] [:error] [pid 28268:tid 28290] [client 20.196.90.232:18408] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aU6L13c_KuO_55-uPTS9bAAAAA8"]
[Fri Dec 26 21:21:27.582059 2025] [:error] [pid 28269:tid 28323] [client 20.196.90.232:20292] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aU6L153ZK8bJ-c9-kjOMkQAAAFU"]
[Fri Dec 26 21:21:28.154159 2025] [:error] [pid 28270:tid 28330] [client 20.196.90.232:18327] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aU6L2F9Ac79_ckdPN5JiXwAAAIE"]
[Fri Dec 26 21:21:28.692348 2025] [:error] [pid 28268:tid 28280] [client 20.196.90.232:18383] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aU6L2Hc_KuO_55-uPTS9bQAAAAU"]
[Fri Dec 26 21:21:29.097484 2025] [:error] [pid 28355:tid 28368] [client 20.196.90.232:20324] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aU6L2bsFqKXf7ADZcTYlFgAAAMs"]
[Fri Dec 26 21:21:29.704172 2025] [:error] [pid 28270:tid 28347] [client 20.196.90.232:18312] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aU6L2V9Ac79_ckdPN5JiYgAAAJI"]
[Fri Dec 26 21:21:30.186789 2025] [:error] [pid 34865:tid 34875] [client 20.196.90.232:1538] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-64wscx6shd.php"] [unique_id "aU6L2qi4zjVVKBdvuTT3lQAAAUg"]
[Fri Dec 26 21:21:30.667175 2025] [:error] [pid 34865:tid 34890] [client 20.196.90.232:18378] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aU6L2qi4zjVVKBdvuTT3lwAAAVc"]
[Fri Dec 26 21:21:31.045961 2025] [:error] [pid 15063:tid 15087] [client 20.196.90.232:1559] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aU6L2-Dsf_aL46Jy7z8c7wAAARY"]
[Fri Dec 26 21:21:31.446506 2025] [:error] [pid 15063:tid 15073] [client 20.196.90.232:20240] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aU6L2-Dsf_aL46Jy7z8c8AAAAQg"]
[Fri Dec 26 21:21:31.968458 2025] [:error] [pid 28355:tid 28362] [client 20.196.90.232:1579] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aU6L27sFqKXf7ADZcTYlGAAAAMU"]
[Fri Dec 26 21:21:32.423156 2025] [:error] [pid 28269:tid 28304] [client 20.196.90.232:20258] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbyra.php"] [unique_id "aU6L3J3ZK8bJ-c9-kjOMlgAAAEI"]
[Fri Dec 26 21:21:32.842037 2025] [:error] [pid 28269:tid 28314] [client 20.196.90.232:18314] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbyra.php"] [unique_id "aU6L3J3ZK8bJ-c9-kjOMlwAAAEw"]
[Fri Dec 26 21:21:33.311449 2025] [:error] [pid 28270:tid 28333] [client 20.196.90.232:1537] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbyra.php"] [unique_id "aU6L3V9Ac79_ckdPN5JiZQAAAIQ"]
[Fri Dec 26 21:21:33.644515 2025] [:error] [pid 28270:tid 28352] [client 20.196.90.232:20261] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbyra.php"] [unique_id "aU6L3V9Ac79_ckdPN5JiZwAAAJc"]
[Fri Dec 26 21:21:34.025085 2025] [:error] [pid 15063:tid 15071] [client 20.196.90.232:18414] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/budmachine/web/s.php"] [unique_id "aU6L3uDsf_aL46Jy7z8c8QAAAQY"]
[Fri Dec 26 21:21:34.491596 2025] [:error] [pid 15063:tid 15088] [client 20.196.90.232:18410] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/budmachine/web/s.php"] [unique_id "aU6L3uDsf_aL46Jy7z8c8gAAARc"]
[Fri Dec 26 21:21:35.148766 2025] [:error] [pid 28269:tid 28307] [client 20.196.90.232:18409] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/budmachine/web/s.php"] [unique_id "aU6L353ZK8bJ-c9-kjOMoQAAAEU"]
[Fri Dec 26 21:21:35.674228 2025] [:error] [pid 28269:tid 28320] [client 20.196.90.232:18319] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/budmachine/web/s.php"] [unique_id "aU6L353ZK8bJ-c9-kjOMowAAAFI"]
[Fri Dec 26 21:21:36.164389 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:18324] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aU6L4J3ZK8bJ-c9-kjOMpAAAAEE"]
[Fri Dec 26 21:21:36.616026 2025] [:error] [pid 7160:tid 7171] [client 20.196.90.232:18406] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aU6L4Ow_ihNZR5L8vEWSPQAAAYg"]
[Fri Dec 26 21:21:37.269111 2025] [:error] [pid 28269:tid 28326] [client 20.196.90.232:1567] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aU6L4Z3ZK8bJ-c9-kjOMpgAAAFg"]
[Fri Dec 26 21:21:37.743638 2025] [:error] [pid 28269:tid 28322] [client 20.196.90.232:18326] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aU6L4Z3ZK8bJ-c9-kjOMqgAAAFQ"]
[Fri Dec 26 21:21:38.361663 2025] [:error] [pid 28268:tid 28291] [client 20.196.90.232:1597] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aU6L4nc_KuO_55-uPTS9dQAAABA"]
[Fri Dec 26 21:21:38.945999 2025] [:error] [pid 7160:tid 7167] [client 20.196.90.232:18404] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aU6L4uw_ihNZR5L8vEWSQwAAAYQ"]
[Fri Dec 26 21:21:39.558642 2025] [:error] [pid 7160:tid 7182] [client 20.196.90.232:1547] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aU6L4-w_ihNZR5L8vEWSRQAAAZM"]
[Fri Dec 26 21:21:40.064154 2025] [:error] [pid 7160:tid 7163] [client 20.196.90.232:20234] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xg5Bv6XIUw.php"] [unique_id "aU6L5Ow_ihNZR5L8vEWSRwAAAYA"]
[Fri Dec 26 21:21:40.521311 2025] [:error] [pid 28268:tid 28287] [client 20.196.90.232:1582] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aU6L5Hc_KuO_55-uPTS9eAAAAAw"]
[Fri Dec 26 21:21:40.976521 2025] [:error] [pid 15063:tid 15066] [client 20.196.90.232:20320] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aU6L5ODsf_aL46Jy7z8c-AAAAQE"]
[Fri Dec 26 21:21:41.387184 2025] [:error] [pid 28269:tid 28315] [client 20.196.90.232:1541] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aU6L5Z3ZK8bJ-c9-kjOMrgAAAE0"]
[Fri Dec 26 21:21:41.819402 2025] [:error] [pid 28268:tid 28295] [client 20.196.90.232:20224] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "aU6L5Xc_KuO_55-uPTS9fQAAABQ"]
[Fri Dec 26 21:21:42.262364 2025] [:error] [pid 15063:tid 15072] [client 20.196.90.232:18389] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aU6L5uDsf_aL46Jy7z8c-gAAAQc"]
[Fri Dec 26 21:21:42.671884 2025] [:error] [pid 28355:tid 28365] [client 20.196.90.232:18370] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aU6L5rsFqKXf7ADZcTYlGQAAAMg"]
[Fri Dec 26 21:21:43.143053 2025] [:error] [pid 28270:tid 28332] [client 20.196.90.232:20283] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aU6L519Ac79_ckdPN5JibAAAAIM"]
[Fri Dec 26 21:21:43.946136 2025] [:error] [pid 28269:tid 28302] [client 20.196.90.232:1554] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aU6L553ZK8bJ-c9-kjOMsQAAAEA"]
[Fri Dec 26 21:21:44.387637 2025] [:error] [pid 34865:tid 34873] [client 20.196.90.232:20282] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qV9GbcJwZgK.php"] [unique_id "aU6L6Ki4zjVVKBdvuTT3nAAAAUY"]
[Fri Dec 26 21:21:45.011863 2025] [:error] [pid 28268:tid 28296] [client 20.196.90.232:18374] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qV9GbcJwZgK.php"] [unique_id "aU6L6Xc_KuO_55-uPTS9gQAAABU"]
[Fri Dec 26 21:21:45.536920 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:18379] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qV9GbcJwZgK.php"] [unique_id "aU6L6Z3ZK8bJ-c9-kjOMtAAAAEE"]
[Fri Dec 26 21:21:46.398166 2025] [:error] [pid 7160:tid 7182] [client 20.196.90.232:18323] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qV9GbcJwZgK.php"] [unique_id "aU6L6uw_ihNZR5L8vEWSVAAAAZM"]
[Fri Dec 26 21:21:47.011001 2025] [:error] [pid 28268:tid 28275] [client 20.196.90.232:1590] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu8.php"] [unique_id "aU6L63c_KuO_55-uPTS9hAAAAAA"]
[Fri Dec 26 21:21:47.552700 2025] [:error] [pid 28355:tid 28369] [client 20.196.90.232:18401] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu8.php"] [unique_id "aU6L67sFqKXf7ADZcTYlIAAAAMw"]
[Fri Dec 26 21:21:48.012759 2025] [:error] [pid 28269:tid 28323] [client 20.196.90.232:20345] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu8.php"] [unique_id "aU6L7J3ZK8bJ-c9-kjOMtwAAAFU"]
[Fri Dec 26 21:21:48.346534 2025] [:error] [pid 28269:tid 28305] [client 20.196.90.232:1552] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu8.php"] [unique_id "aU6L7J3ZK8bJ-c9-kjOMuAAAAEM"]
[Fri Dec 26 21:21:49.614823 2025] [:error] [pid 28355:tid 28359] [client 20.196.90.232:20229] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aU6L7bsFqKXf7ADZcTYlJgAAAMI"]
[Fri Dec 26 21:21:50.249758 2025] [:error] [pid 7160:tid 7183] [client 20.196.90.232:18402] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aU6L7uw_ihNZR5L8vEWSWAAAAZQ"]
[Fri Dec 26 21:21:50.660340 2025] [:error] [pid 28269:tid 28325] [client 20.196.90.232:20293] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aU6L7p3ZK8bJ-c9-kjOMvQAAAFc"]
[Fri Dec 26 21:21:51.150835 2025] [:error] [pid 28268:tid 28287] [client 20.196.90.232:1539] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aU6L73c_KuO_55-uPTS9hQAAAAw"]
[Fri Dec 26 21:21:51.620707 2025] [:error] [pid 28269:tid 28324] [client 20.196.90.232:18388] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aU6L753ZK8bJ-c9-kjOMxgAAAFY"]
[Fri Dec 26 21:21:52.364957 2025] [:error] [pid 28270:tid 28331] [client 20.196.90.232:1574] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aU6L8F9Ac79_ckdPN5JifQAAAII"]
[Fri Dec 26 21:21:52.714986 2025] [:error] [pid 7160:tid 7166] [client 20.196.90.232:18321] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aU6L8Ow_ihNZR5L8vEWSWgAAAYM"]
[Fri Dec 26 21:21:53.177070 2025] [:error] [pid 28268:tid 28288] [client 20.196.90.232:1588] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aU6L8Xc_KuO_55-uPTS9iAAAAA0"]
[Fri Dec 26 21:21:53.752760 2025] [:error] [pid 28269:tid 28317] [client 20.196.90.232:18392] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aU6L8Z3ZK8bJ-c9-kjOMygAAAE8"]
[Fri Dec 26 21:21:54.298725 2025] [:error] [pid 28355:tid 28369] [client 20.196.90.232:18399] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aU6L8rsFqKXf7ADZcTYlLgAAAMw"]
[Fri Dec 26 21:21:54.921211 2025] [:error] [pid 7160:tid 7163] [client 20.196.90.232:1585] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aU6L8uw_ihNZR5L8vEWSXwAAAYA"]
[Fri Dec 26 21:21:55.389262 2025] [:error] [pid 28269:tid 28309] [client 20.196.90.232:2015] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ce.php"] [unique_id "aU6L853ZK8bJ-c9-kjOMzQAAAEc"]
[Fri Dec 26 21:21:55.875518 2025] [:error] [pid 15063:tid 15080] [client 20.196.90.232:1549] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aU6L8-Dsf_aL46Jy7z8dAwAAAQ8"]
[Fri Dec 26 21:21:56.421250 2025] [:error] [pid 28269:tid 28322] [client 20.196.90.232:18397] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aU6L9J3ZK8bJ-c9-kjOM0AAAAFQ"]
[Fri Dec 26 21:21:56.828929 2025] [:error] [pid 28269:tid 28304] [client 20.196.90.232:20290] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aU6L9J3ZK8bJ-c9-kjOM0QAAAEI"]
[Fri Dec 26 21:21:57.557964 2025] [:error] [pid 34865:tid 34877] [client 20.196.90.232:20260] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pNRzcP6wtYy.php"] [unique_id "aU6L9ai4zjVVKBdvuTT3rQAAAUo"]
[Fri Dec 26 21:21:58.042798 2025] [:error] [pid 34865:tid 34888] [client 20.196.90.232:1584] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aU6L9qi4zjVVKBdvuTT3sQAAAVU"]
[Fri Dec 26 21:21:58.720448 2025] [:error] [pid 28269:tid 28310] [client 20.196.90.232:18336] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aU6L9p3ZK8bJ-c9-kjOM0wAAAEg"]
[Fri Dec 26 21:21:59.469949 2025] [:error] [pid 34865:tid 34890] [client 20.196.90.232:18329] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aU6L96i4zjVVKBdvuTT3swAAAVc"]
[Fri Dec 26 21:21:59.847883 2025] [:error] [pid 7160:tid 7186] [client 20.196.90.232:18317] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aU6L9-w_ihNZR5L8vEWSaQAAAZc"]
[Fri Dec 26 21:22:00.224145 2025] [:error] [pid 7160:tid 7163] [client 20.196.90.232:1563] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh1.php"] [unique_id "aU6L-Ow_ihNZR5L8vEWSawAAAYA"]
[Fri Dec 26 21:22:00.601752 2025] [:error] [pid 34865:tid 34878] [client 20.196.90.232:18332] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh1.php"] [unique_id "aU6L-Ki4zjVVKBdvuTT3tAAAAUs"]
[Fri Dec 26 21:22:01.021258 2025] [:error] [pid 28355:tid 28364] [client 20.196.90.232:18371] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh1.php"] [unique_id "aU6L-bsFqKXf7ADZcTYlLwAAAMc"]
[Fri Dec 26 21:22:01.712723 2025] [:error] [pid 34865:tid 34876] [client 20.196.90.232:2021] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh1.php"] [unique_id "aU6L-ai4zjVVKBdvuTT3uAAAAUk"]
[Fri Dec 26 21:22:02.281798 2025] [:error] [pid 15063:tid 15071] [client 20.196.90.232:1575] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aU6L-uDsf_aL46Jy7z8dDQAAAQY"]
[Fri Dec 26 21:22:02.880596 2025] [:error] [pid 28270:tid 28340] [client 20.196.90.232:18305] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aU6L-l9Ac79_ckdPN5JihQAAAIs"]
[Fri Dec 26 21:22:03.621999 2025] [:error] [pid 15063:tid 15074] [client 20.196.90.232:18403] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aU6L--Dsf_aL46Jy7z8dDwAAAQk"]
[Fri Dec 26 21:22:04.490898 2025] [:error] [pid 28269:tid 28318] [client 20.196.90.232:1985] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aU6L_J3ZK8bJ-c9-kjOM3AAAAFA"]
[Fri Dec 26 21:22:05.003197 2025] [:error] [pid 28269:tid 28324] [client 20.196.90.232:1561] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aU6L_Z3ZK8bJ-c9-kjOM3wAAAFY"]
[Fri Dec 26 21:22:05.380949 2025] [:error] [pid 28270:tid 28334] [client 20.196.90.232:18418] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aU6L_V9Ac79_ckdPN5JiiAAAAIU"]
[Fri Dec 26 21:22:05.766182 2025] [:error] [pid 28270:tid 28335] [client 20.196.90.232:18346] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aU6L_V9Ac79_ckdPN5JiiQAAAIY"]
[Fri Dec 26 21:22:06.205200 2025] [:error] [pid 28268:tid 28298] [client 20.196.90.232:18391] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aU6L_nc_KuO_55-uPTS9kgAAABc"]
[Fri Dec 26 21:22:06.584358 2025] [:error] [pid 15063:tid 15076] [client 20.196.90.232:18318] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aU6L_uDsf_aL46Jy7z8dEwAAAQs"]
[Fri Dec 26 21:22:06.994502 2025] [:error] [pid 28270:tid 28350] [client 20.196.90.232:1993] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aU6L_l9Ac79_ckdPN5JijAAAAJU"]
[Fri Dec 26 21:22:07.377344 2025] [:error] [pid 28268:tid 28295] [client 20.196.90.232:18420] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aU6L_3c_KuO_55-uPTS9lAAAABQ"]
[Fri Dec 26 21:22:07.810713 2025] [:error] [pid 34865:tid 34886] [client 20.196.90.232:18411] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aU6L_6i4zjVVKBdvuTT3uwAAAVM"]
[Fri Dec 26 21:22:08.678479 2025] [:error] [pid 7160:tid 7173] [client 20.196.90.232:18304] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4fk6.php"] [unique_id "aU6MAOw_ihNZR5L8vEWScwAAAYo"]
[Fri Dec 26 21:22:09.207288 2025] [:error] [pid 28355:tid 28365] [client 20.196.90.232:1545] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4fk6.php"] [unique_id "aU6MAbsFqKXf7ADZcTYlNQAAAMg"]
[Fri Dec 26 21:22:09.534460 2025] [:error] [pid 28270:tid 28351] [client 20.196.90.232:18310] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4fk6.php"] [unique_id "aU6MAV9Ac79_ckdPN5JijgAAAJY"]
[Fri Dec 26 21:22:09.942726 2025] [:error] [pid 7160:tid 7186] [client 20.196.90.232:20259] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4fk6.php"] [unique_id "aU6MAew_ihNZR5L8vEWSdAAAAZc"]
[Fri Dec 26 21:22:10.318239 2025] [:error] [pid 15063:tid 15075] [client 20.196.90.232:1566] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "aU6MAuDsf_aL46Jy7z8dGQAAAQo"]
[Fri Dec 26 21:22:10.822309 2025] [:error] [pid 28270:tid 28345] [client 20.196.90.232:18425] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "aU6MAl9Ac79_ckdPN5JikAAAAJA"]
[Fri Dec 26 21:22:11.153006 2025] [:error] [pid 28269:tid 28307] [client 20.196.90.232:2012] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "aU6MA53ZK8bJ-c9-kjOM6AAAAEU"]
[Fri Dec 26 21:22:11.497219 2025] [:error] [pid 28355:tid 28371] [client 20.196.90.232:1557] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "aU6MA7sFqKXf7ADZcTYlOAAAAM4"]
[Fri Dec 26 21:22:12.035179 2025] [:error] [pid 28355:tid 28361] [client 20.196.90.232:18345] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aU6MBLsFqKXf7ADZcTYlOwAAAMQ"]
[Fri Dec 26 21:22:12.770365 2025] [:error] [pid 34865:tid 34874] [client 20.196.90.232:18306] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aU6MBKi4zjVVKBdvuTT3vwAAAUc"]
[Fri Dec 26 21:22:13.215962 2025] [:error] [pid 28269:tid 28310] [client 20.196.90.232:18322] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aU6MBZ3ZK8bJ-c9-kjOM8QAAAEg"]
[Fri Dec 26 21:22:13.662179 2025] [:error] [pid 34865:tid 34887] [client 20.196.90.232:1578] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BMjXQkgwpeb.php"] [unique_id "aU6MBai4zjVVKBdvuTT3wAAAAVQ"]
[Fri Dec 26 21:22:14.367068 2025] [:error] [pid 28268:tid 28291] [client 20.196.90.232:20254] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aU6MBnc_KuO_55-uPTS9mQAAABA"]
[Fri Dec 26 21:22:14.724073 2025] [:error] [pid 28269:tid 28321] [client 20.196.90.232:18315] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aU6MBp3ZK8bJ-c9-kjOM-AAAAFM"]
[Fri Dec 26 21:22:15.247967 2025] [:error] [pid 28268:tid 28297] [client 20.196.90.232:18307] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aU6MB3c_KuO_55-uPTS9mgAAABY"]
[Fri Dec 26 21:22:15.837526 2025] [:error] [pid 15063:tid 15076] [client 20.196.90.232:1562] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aU6MB-Dsf_aL46Jy7z8dIgAAAQs"]
[Fri Dec 26 21:22:16.257963 2025] [:error] [pid 28355:tid 28378] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/56c53.php
[Fri Dec 26 21:22:16.421654 2025] [:error] [pid 28355:tid 28359] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Fri Dec 26 21:22:16.629073 2025] [:error] [pid 28355:tid 28381] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sid.php
[Fri Dec 26 21:22:16.769892 2025] [:error] [pid 28355:tid 28358] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-Blogs.php
[Fri Dec 26 21:22:16.909960 2025] [:error] [pid 28355:tid 28365] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/krypton.php
[Fri Dec 26 21:22:17.065983 2025] [:error] [pid 28355:tid 28379] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Dec 26 21:22:17.223984 2025] [:error] [pid 28355:tid 28380] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/nucqsqeg.php
[Fri Dec 26 21:22:17.397225 2025] [:error] [pid 28355:tid 28371] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/jdlqi.php
[Fri Dec 26 21:22:17.544634 2025] [:error] [pid 28355:tid 28375] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Fri Dec 26 21:22:17.698384 2025] [:error] [pid 28355:tid 28361] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-front.php
[Fri Dec 26 21:22:17.892451 2025] [:error] [pid 28355:tid 28376] [client 20.196.90.232:1565] File does not exist: /usr/local/apache/htdocs/suspended-page/xenium4.php
[Fri Dec 26 21:22:18.071194 2025] [:error] [pid 28355:tid 28369] [client 20.196.90.232:1565] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aU6MCrsFqKXf7ADZcTYlTgAAAMw"]
[Fri Dec 26 21:22:18.388485 2025] [:error] [pid 28270:tid 28337] [client 20.196.90.232:1098] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aU6MCl9Ac79_ckdPN5JilwAAAIg"]
[Fri Dec 26 21:22:18.824153 2025] [:error] [pid 28270:tid 28343] [client 20.196.90.232:18381] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aU6MCl9Ac79_ckdPN5JimgAAAI4"]
[Fri Dec 26 21:22:19.186440 2025] [:error] [pid 28269:tid 28302] [client 20.196.90.232:18395] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid-file.php"] [unique_id "aU6MC53ZK8bJ-c9-kjONBgAAAEA"]
[Fri Dec 26 21:22:19.560929 2025] [:error] [pid 7160:tid 7187] [client 20.196.90.232:1592] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-user.php"] [unique_id "aU6MC-w_ihNZR5L8vEWSegAAAZg"]
[Fri Dec 26 21:22:19.965079 2025] [:error] [pid 28270:tid 28348] [client 20.196.90.232:1093] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-user.php"] [unique_id "aU6MC19Ac79_ckdPN5JimwAAAJM"]
[Fri Dec 26 21:22:20.411276 2025] [:error] [pid 28268:tid 28281] [client 20.196.90.232:18417] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-user.php"] [unique_id "aU6MDHc_KuO_55-uPTS9oQAAAAY"]
[Fri Dec 26 21:22:20.791152 2025] [:error] [pid 28269:tid 28313] [client 20.196.90.232:18331] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-user.php"] [unique_id "aU6MDJ3ZK8bJ-c9-kjONDwAAAEs"]
[Fri Dec 26 21:22:21.313731 2025] [:error] [pid 7160:tid 7173] [client 20.196.90.232:1987] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU6MDew_ihNZR5L8vEWSgQAAAYo"]
[Fri Dec 26 21:22:21.666972 2025] [:error] [pid 28269:tid 28315] [client 20.196.90.232:2030] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU6MDZ3ZK8bJ-c9-kjONEAAAAE0"]
[Fri Dec 26 21:22:22.107634 2025] [:error] [pid 34865:tid 34872] [client 20.196.90.232:1555] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU6MDqi4zjVVKBdvuTT3xwAAAUU"]
[Fri Dec 26 21:22:22.533973 2025] [:error] [pid 34865:tid 34876] [client 20.196.90.232:20227] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU6MDqi4zjVVKBdvuTT3yAAAAUk"]
[Fri Dec 26 21:22:22.900056 2025] [:error] [pid 28270:tid 28332] [client 20.196.90.232:18386] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aU6MDl9Ac79_ckdPN5JioQAAAIM"]
[Fri Dec 26 21:22:23.593451 2025] [:error] [pid 28270:tid 28352] [client 20.196.90.232:18325] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aU6MD19Ac79_ckdPN5JipAAAAJc"]
[Fri Dec 26 21:22:24.228782 2025] [:error] [pid 15063:tid 15081] [client 20.196.90.232:2003] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aU6MEODsf_aL46Jy7z8dKQAAARA"]
[Fri Dec 26 21:22:24.699763 2025] [:error] [pid 28268:tid 28277] [client 20.196.90.232:1126] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aU6MEHc_KuO_55-uPTS9pQAAAAI"]
[Fri Dec 26 21:22:25.278741 2025] [:error] [pid 28268:tid 28297] [client 20.196.90.232:18357] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mhpglaje.php"] [unique_id "aU6MEXc_KuO_55-uPTS9pwAAABY"]
[Fri Dec 26 21:22:25.693680 2025] [:error] [pid 7160:tid 7167] [client 20.196.90.232:18341] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mhpglaje.php"] [unique_id "aU6MEew_ihNZR5L8vEWShwAAAYQ"]
[Fri Dec 26 21:22:26.017967 2025] [:error] [pid 28270:tid 28344] [client 20.196.90.232:20285] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mhpglaje.php"] [unique_id "aU6MEl9Ac79_ckdPN5JipgAAAI8"]
[Fri Dec 26 21:22:26.383769 2025] [:error] [pid 15063:tid 15088] [client 20.196.90.232:18422] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mhpglaje.php"] [unique_id "aU6MEuDsf_aL46Jy7z8dKwAAARc"]
[Fri Dec 26 21:22:26.820698 2025] [:error] [pid 34865:tid 34877] [client 20.196.90.232:18356] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aU6MEqi4zjVVKBdvuTT3zgAAAUo"]
[Fri Dec 26 21:22:27.119055 2025] [:error] [pid 28269:tid 28323] [client 20.196.90.232:18393] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aU6ME53ZK8bJ-c9-kjONFgAAAFU"]
[Fri Dec 26 21:22:27.457654 2025] [:error] [pid 28269:tid 28305] [client 20.196.90.232:2029] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aU6ME53ZK8bJ-c9-kjONFwAAAEM"]
[Fri Dec 26 21:22:27.797564 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:18348] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aU6ME53ZK8bJ-c9-kjONGQAAAEE"]
[Fri Dec 26 21:22:28.071445 2025] [:error] [pid 28269:tid 28320] [client 20.196.90.232:2034] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aU6MFJ3ZK8bJ-c9-kjONGgAAAFI"]
[Fri Dec 26 21:22:28.389447 2025] [:error] [pid 28269:tid 28312] [client 20.196.90.232:20312] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aU6MFJ3ZK8bJ-c9-kjONHAAAAEo"]
[Fri Dec 26 21:22:28.780922 2025] [:error] [pid 28269:tid 28315] [client 20.196.90.232:18400] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aU6MFJ3ZK8bJ-c9-kjONHwAAAE0"]
[Fri Dec 26 21:22:29.188967 2025] [:error] [pid 28270:tid 28342] [client 20.196.90.232:18385] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aU6MFV9Ac79_ckdPN5JiqgAAAI0"]
[Fri Dec 26 21:22:29.621168 2025] [:error] [pid 28268:tid 28290] [client 20.196.90.232:2017] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU6MFXc_KuO_55-uPTS9rQAAAA8"]
[Fri Dec 26 21:22:30.218515 2025] [:error] [pid 28268:tid 28280] [client 20.196.90.232:18362] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU6MFnc_KuO_55-uPTS9rgAAAAU"]
[Fri Dec 26 21:22:30.605512 2025] [:error] [pid 28270:tid 28341] [client 20.196.90.232:18350] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU6MFl9Ac79_ckdPN5JirAAAAIw"]
[Fri Dec 26 21:22:31.141006 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:1550] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU6MF53ZK8bJ-c9-kjONJgAAAEE"]
[Fri Dec 26 21:22:31.783353 2025] [:error] [pid 28355:tid 28362] [client 20.196.90.232:1984] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qaez.php56"] [unique_id "aU6MF7sFqKXf7ADZcTYlVAAAAMU"]
[Fri Dec 26 21:22:32.189606 2025] [:error] [pid 28355:tid 28370] [client 20.196.90.232:18364] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qaez.php56"] [unique_id "aU6MGLsFqKXf7ADZcTYlVwAAAM0"]
[Fri Dec 26 21:22:32.681216 2025] [:error] [pid 28270:tid 28347] [client 20.196.90.232:1995] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qaez.php56"] [unique_id "aU6MGF9Ac79_ckdPN5JirwAAAJI"]
[Fri Dec 26 21:22:33.314582 2025] [:error] [pid 28270:tid 28330] [client 20.196.90.232:2025] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qaez.php56"] [unique_id "aU6MGV9Ac79_ckdPN5JisAAAAIE"]
[Fri Dec 26 21:22:33.669934 2025] [:error] [pid 28268:tid 28276] [client 20.196.90.232:20333] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aU6MGXc_KuO_55-uPTS9sgAAAAE"]
[Fri Dec 26 21:22:34.112779 2025] [:error] [pid 7160:tid 7177] [client 20.196.90.232:18424] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aU6MGuw_ihNZR5L8vEWSkgAAAY4"]
[Fri Dec 26 21:22:34.588433 2025] [:error] [pid 15063:tid 15085] [client 20.196.90.232:18425] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aU6MGuDsf_aL46Jy7z8dNwAAARQ"]
[Fri Dec 26 21:22:35.022719 2025] [:error] [pid 28355:tid 28372] [client 20.196.90.232:18320] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ijNdPI1Orya.php"] [unique_id "aU6MG7sFqKXf7ADZcTYlWAAAAM8"]
[Fri Dec 26 21:22:35.338722 2025] [:error] [pid 28268:tid 28278] [client 20.196.90.232:18412] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aU6MG3c_KuO_55-uPTS9tQAAAAM"]
[Fri Dec 26 21:22:35.757320 2025] [:error] [pid 7160:tid 7171] [client 20.196.90.232:20316] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aU6MG-w_ihNZR5L8vEWSlQAAAYg"]
[Fri Dec 26 21:22:36.104118 2025] [:error] [pid 28268:tid 28296] [client 20.196.90.232:18428] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aU6MHHc_KuO_55-uPTS9uAAAABU"]
[Fri Dec 26 21:22:36.576635 2025] [:error] [pid 34865:tid 34886] [client 20.196.90.232:1998] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aU6MHKi4zjVVKBdvuTT32gAAAVM"]
[Fri Dec 26 21:22:37.014856 2025] [:error] [pid 28355:tid 28373] [client 20.196.90.232:1577] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aU6MHbsFqKXf7ADZcTYlXQAAANA"]
[Fri Dec 26 21:22:37.565920 2025] [:error] [pid 7160:tid 7169] [client 20.196.90.232:18387] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aU6MHew_ihNZR5L8vEWSmAAAAYY"]
[Fri Dec 26 21:22:37.964691 2025] [:error] [pid 28268:tid 28275] [client 20.196.90.232:18419] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aU6MHXc_KuO_55-uPTS9uQAAAAA"]
[Fri Dec 26 21:22:38.391763 2025] [:error] [pid 28355:tid 28367] [client 20.196.90.232:18354] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HPum4ZEBJRC.php"] [unique_id "aU6MHrsFqKXf7ADZcTYlXgAAAMo"]
[Fri Dec 26 21:22:38.963559 2025] [:error] [pid 34865:tid 34874] [client 20.196.90.232:18309] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU6MHqi4zjVVKBdvuTT33QAAAUc"]
[Fri Dec 26 21:22:39.397127 2025] [:error] [pid 28269:tid 28316] [client 20.196.90.232:2046] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU6MH53ZK8bJ-c9-kjONMgAAAE4"]
[Fri Dec 26 21:22:39.941912 2025] [:error] [pid 7160:tid 7173] [client 20.196.90.232:18407] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU6MH-w_ihNZR5L8vEWSoQAAAYo"]
[Fri Dec 26 21:22:40.397356 2025] [:error] [pid 7160:tid 7165] [client 20.196.90.232:18396] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU6MIOw_ihNZR5L8vEWSogAAAYI"]
[Fri Dec 26 21:22:40.888180 2025] [:error] [pid 28269:tid 28323] [client 20.196.90.232:2014] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox8xhkkw.php"] [unique_id "aU6MIJ3ZK8bJ-c9-kjONNgAAAFU"]
[Fri Dec 26 21:22:41.861034 2025] [:error] [pid 28269:tid 28319] [client 20.196.90.232:18405] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox8xhkkw.php"] [unique_id "aU6MIZ3ZK8bJ-c9-kjONOgAAAFE"]
[Fri Dec 26 21:22:42.328590 2025] [:error] [pid 34865:tid 34890] [client 20.196.90.232:2033] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox8xhkkw.php"] [unique_id "aU6MIqi4zjVVKBdvuTT34wAAAVc"]
[Fri Dec 26 21:22:42.853372 2025] [:error] [pid 15063:tid 15073] [client 20.196.90.232:18330] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox8xhkkw.php"] [unique_id "aU6MIuDsf_aL46Jy7z8dQgAAAQg"]
[Fri Dec 26 21:22:43.525418 2025] [:error] [pid 28355:tid 28358] [client 20.196.90.232:2040] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aU6MI7sFqKXf7ADZcTYlYgAAAME"]
[Fri Dec 26 21:22:44.013481 2025] [:error] [pid 34865:tid 34867] [client 20.196.90.232:1107] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aU6MJKi4zjVVKBdvuTT35gAAAUA"]
[Fri Dec 26 21:22:44.454593 2025] [:error] [pid 7160:tid 7164] [client 20.196.90.232:1560] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aU6MJOw_ihNZR5L8vEWSpgAAAYE"]
[Fri Dec 26 21:22:44.954047 2025] [:error] [pid 34865:tid 34874] [client 20.196.90.232:20343] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-advaced.php"] [unique_id "aU6MJKi4zjVVKBdvuTT36AAAAUc"]
[Fri Dec 26 21:22:45.629731 2025] [:error] [pid 28270:tid 28343] [client 20.196.90.232:2009] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aU6MJV9Ac79_ckdPN5JiswAAAI4"]
[Fri Dec 26 21:22:46.086947 2025] [:error] [pid 28270:tid 28336] [client 20.196.90.232:18316] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aU6MJl9Ac79_ckdPN5JitAAAAIc"]
[Fri Dec 26 21:22:46.527642 2025] [:error] [pid 28269:tid 28308] [client 20.196.90.232:18340] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aU6MJp3ZK8bJ-c9-kjONRQAAAEY"]
[Fri Dec 26 21:22:46.911652 2025] [:error] [pid 28270:tid 28348] [client 20.196.90.232:18413] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aU6MJl9Ac79_ckdPN5JitgAAAJM"]
[Fri Dec 26 21:22:47.330127 2025] [:error] [pid 28270:tid 28342] [client 20.196.90.232:1318] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6MJ19Ac79_ckdPN5JiuAAAAI0"]
[Fri Dec 26 21:22:47.868695 2025] [:error] [pid 15063:tid 15082] [client 20.196.90.232:18369] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6MJ-Dsf_aL46Jy7z8dQwAAARE"]
[Fri Dec 26 21:22:48.242889 2025] [:error] [pid 34865:tid 34888] [client 20.196.90.232:1994] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6MKKi4zjVVKBdvuTT36wAAAVU"]
[Fri Dec 26 21:22:48.602351 2025] [:error] [pid 28355:tid 28375] [client 20.196.90.232:18358] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6MKLsFqKXf7ADZcTYlaAAAANI"]
[Fri Dec 26 21:22:48.961399 2025] [:error] [pid 7160:tid 7176] [client 20.196.90.232:1991] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MKOw_ihNZR5L8vEWSqQAAAY0"]
[Fri Dec 26 21:22:49.264177 2025] [:error] [pid 7160:tid 7166] [client 20.196.90.232:18363] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MKew_ihNZR5L8vEWSqwAAAYM"]
[Fri Dec 26 21:22:49.564688 2025] [:error] [pid 34865:tid 34882] [client 20.196.90.232:1095] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MKai4zjVVKBdvuTT37QAAAU8"]
[Fri Dec 26 21:22:49.897222 2025] [:error] [pid 7160:tid 7174] [client 20.196.90.232:1096] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MKew_ihNZR5L8vEWSrAAAAYs"]
[Fri Dec 26 21:22:50.352605 2025] [:error] [pid 28269:tid 28325] [client 20.196.90.232:1140] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dout.php"] [unique_id "aU6MKp3ZK8bJ-c9-kjONTAAAAFc"]
[Fri Dec 26 21:22:50.836472 2025] [:error] [pid 28270:tid 28347] [client 20.196.90.232:2042] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dout.php"] [unique_id "aU6MKl9Ac79_ckdPN5JiwAAAAJI"]
[Fri Dec 26 21:22:51.284419 2025] [:error] [pid 28270:tid 28338] [client 20.196.90.232:18338] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dout.php"] [unique_id "aU6MK19Ac79_ckdPN5JixAAAAIk"]
[Fri Dec 26 21:22:51.636434 2025] [:error] [pid 34865:tid 34873] [client 20.196.90.232:1313] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dout.php"] [unique_id "aU6MK6i4zjVVKBdvuTT37wAAAUY"]
[Fri Dec 26 21:22:52.053019 2025] [:error] [pid 28268:tid 28276] [client 20.196.90.232:18360] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aU6MLHc_KuO_55-uPTS9wAAAAAE"]
[Fri Dec 26 21:22:52.423386 2025] [:error] [pid 15063:tid 15077] [client 20.196.90.232:2038] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aU6MLODsf_aL46Jy7z8dRgAAAQw"]
[Fri Dec 26 21:22:52.834878 2025] [:error] [pid 28355:tid 28377] [client 20.196.90.232:2027] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aU6MLLsFqKXf7ADZcTYlagAAANQ"]
[Fri Dec 26 21:22:53.171388 2025] [:error] [pid 28355:tid 28363] [client 20.196.90.232:1127] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtt.php"] [unique_id "aU6MLbsFqKXf7ADZcTYlbQAAAMY"]
[Fri Dec 26 21:22:53.674433 2025] [:error] [pid 34865:tid 34890] [client 20.196.90.232:2006] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin836.php"] [unique_id "aU6MLai4zjVVKBdvuTT38QAAAVc"]
[Fri Dec 26 21:22:54.127627 2025] [:error] [pid 15063:tid 15086] [client 20.196.90.232:1090] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin836.php"] [unique_id "aU6MLuDsf_aL46Jy7z8dSQAAARU"]
[Fri Dec 26 21:22:54.773102 2025] [:error] [pid 15063:tid 15072] [client 20.196.90.232:18359] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin836.php"] [unique_id "aU6MLuDsf_aL46Jy7z8dSgAAAQc"]
[Fri Dec 26 21:22:55.167011 2025] [:error] [pid 34865:tid 34874] [client 20.196.90.232:18333] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin836.php"] [unique_id "aU6ML6i4zjVVKBdvuTT39AAAAUc"]
[Fri Dec 26 21:22:55.544260 2025] [:error] [pid 34865:tid 34875] [client 20.196.90.232:18426] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU6ML6i4zjVVKBdvuTT3-AAAAUg"]
[Fri Dec 26 21:22:56.053077 2025] [:error] [pid 34865:tid 34872] [client 20.196.90.232:2026] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU6MMKi4zjVVKBdvuTT3-QAAAUU"]
[Fri Dec 26 21:22:56.507248 2025] [:error] [pid 7160:tid 7173] [client 20.196.90.232:1571] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU6MMOw_ihNZR5L8vEWSrgAAAYo"]
[Fri Dec 26 21:22:56.962087 2025] [:error] [pid 7160:tid 7185] [client 20.196.90.232:1135] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aU6MMOw_ihNZR5L8vEWSrwAAAZY"]
[Fri Dec 26 21:22:57.401408 2025] [:error] [pid 28355:tid 28380] [client 20.196.90.232:1996] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dng.php"] [unique_id "aU6MMbsFqKXf7ADZcTYldQAAANc"]
[Fri Dec 26 21:22:57.903559 2025] [:error] [pid 28268:tid 28285] [client 20.196.90.232:1142] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dng.php"] [unique_id "aU6MMXc_KuO_55-uPTS9xwAAAAo"]
[Fri Dec 26 21:22:58.505153 2025] [:error] [pid 15063:tid 15088] [client 20.196.90.232:1109] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dng.php"] [unique_id "aU6MMuDsf_aL46Jy7z8dTAAAARc"]
[Fri Dec 26 21:22:58.890948 2025] [:error] [pid 15063:tid 15075] [client 20.196.90.232:18308] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dng.php"] [unique_id "aU6MMuDsf_aL46Jy7z8dTgAAAQo"]
[Fri Dec 26 21:22:59.219792 2025] [:error] [pid 7160:tid 7171] [client 20.196.90.232:1125] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aU6MM-w_ihNZR5L8vEWSswAAAYg"]
[Fri Dec 26 21:23:00.598976 2025] [:error] [pid 15063:tid 15073] [client 20.196.90.232:18344] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aU6MNODsf_aL46Jy7z8dTwAAAQg"]
[Fri Dec 26 21:23:00.994352 2025] [:error] [pid 7160:tid 7183] [client 20.196.90.232:1113] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aU6MNOw_ihNZR5L8vEWStwAAAZQ"]
[Fri Dec 26 21:23:01.331480 2025] [:error] [pid 7160:tid 7176] [client 20.196.90.232:2016] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inghl.php"] [unique_id "aU6MNew_ihNZR5L8vEWSugAAAY0"]
[Fri Dec 26 21:23:01.820048 2025] [:error] [pid 28269:tid 28325] [client 20.196.90.232:18342] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU6MNZ3ZK8bJ-c9-kjONWQAAAFc"]
[Fri Dec 26 21:23:02.230956 2025] [:error] [pid 7160:tid 7173] [client 20.196.90.232:18394] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU6MNuw_ihNZR5L8vEWSvQAAAYo"]
[Fri Dec 26 21:23:02.789022 2025] [:error] [pid 7160:tid 7163] [client 20.196.90.232:2008] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU6MNuw_ihNZR5L8vEWSvgAAAYA"]
[Fri Dec 26 21:23:03.235449 2025] [:error] [pid 28355:tid 28367] [client 20.196.90.232:18334] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aU6MN7sFqKXf7ADZcTYlegAAAMo"]
[Fri Dec 26 21:23:03.570180 2025] [:error] [pid 28270:tid 28352] [client 20.196.90.232:18361] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aU6MN19Ac79_ckdPN5Ji0QAAAJc"]
[Fri Dec 26 21:23:03.912332 2025] [:error] [pid 34865:tid 34872] [client 20.196.90.232:2023] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aU6MN6i4zjVVKBdvuTT4AgAAAUU"]
[Fri Dec 26 21:23:05.365191 2025] [:error] [pid 28268:tid 28278] [client 20.196.90.232:1143] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aU6MOXc_KuO_55-uPTS90gAAAAM"]
[Fri Dec 26 21:23:05.917631 2025] [:error] [pid 28355:tid 28362] [client 20.196.90.232:2020] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aU6MObsFqKXf7ADZcTYlggAAAMU"]
[Fri Dec 26 21:23:06.259019 2025] [:error] [pid 34865:tid 34869] [client 20.196.90.232:2002] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aU6MOqi4zjVVKBdvuTT4CwAAAUI"]
[Fri Dec 26 21:23:06.651671 2025] [:error] [pid 28268:tid 28294] [client 20.196.90.232:20290] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aU6MOnc_KuO_55-uPTS94AAAABM"]
[Fri Dec 26 21:23:07.188427 2025] [:error] [pid 28270:tid 28339] [client 20.196.90.232:1089] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aU6MO19Ac79_ckdPN5Ji1gAAAIo"]
[Fri Dec 26 21:23:07.678659 2025] [:error] [pid 28268:tid 28276] [client 20.196.90.232:20315] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aU6MO3c_KuO_55-uPTS95gAAAAE"]
[Fri Dec 26 21:23:08.061339 2025] [:error] [pid 28355:tid 28376] [client 20.196.90.232:18429] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NWqz649FIe7.php"] [unique_id "aU6MPLsFqKXf7ADZcTYlhAAAANM"]
[Fri Dec 26 21:23:08.451182 2025] [:error] [pid 28270:tid 28342] [client 20.196.90.232:18415] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NWqz649FIe7.php"] [unique_id "aU6MPF9Ac79_ckdPN5Ji1wAAAI0"]
[Fri Dec 26 21:23:08.828715 2025] [:error] [pid 28270:tid 28329] [client 20.196.90.232:1412] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NWqz649FIe7.php"] [unique_id "aU6MPF9Ac79_ckdPN5Ji2AAAAIA"]
[Fri Dec 26 21:23:09.288302 2025] [:error] [pid 28268:tid 28299] [client 20.196.90.232:18421] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NWqz649FIe7.php"] [unique_id "aU6MPXc_KuO_55-uPTS96QAAABg"]
[Fri Dec 26 21:23:09.706740 2025] [:error] [pid 28268:tid 28279] [client 20.196.90.232:2045] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aU6MPXc_KuO_55-uPTS96wAAAAQ"]
[Fri Dec 26 21:23:10.125403 2025] [:error] [pid 34865:tid 34880] [client 20.196.90.232:2019] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aU6MPqi4zjVVKBdvuTT4DgAAAU0"]
[Fri Dec 26 21:23:10.465751 2025] [:error] [pid 28270:tid 28341] [client 20.196.90.232:1540] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aU6MPl9Ac79_ckdPN5Ji2gAAAIw"]
[Fri Dec 26 21:23:10.871373 2025] [:error] [pid 7160:tid 7167] [client 20.196.90.232:2007] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdgok.php"] [unique_id "aU6MPuw_ihNZR5L8vEWS0AAAAYQ"]
[Fri Dec 26 21:23:11.258440 2025] [:error] [pid 28270:tid 28347] [client 20.196.90.232:18347] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aU6MP19Ac79_ckdPN5Ji2wAAAJI"]
[Fri Dec 26 21:23:11.608109 2025] [:error] [pid 15063:tid 15080] [client 20.196.90.232:18328] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aU6MP-Dsf_aL46Jy7z8dVQAAAQ8"]
[Fri Dec 26 21:23:12.027485 2025] [:error] [pid 15063:tid 15076] [client 20.196.90.232:2004] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aU6MQODsf_aL46Jy7z8dVwAAAQs"]
[Fri Dec 26 21:23:12.523257 2025] [:error] [pid 34865:tid 34888] [client 20.196.90.232:1115] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aU6MQKi4zjVVKBdvuTT4EAAAAVU"]
[Fri Dec 26 21:23:12.849441 2025] [:error] [pid 28355:tid 28378] [client 20.196.90.232:18382] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aU6MQLsFqKXf7ADZcTYliQAAANU"]
[Fri Dec 26 21:23:13.174895 2025] [:error] [pid 28268:tid 28292] [client 20.196.90.232:18337] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aU6MQXc_KuO_55-uPTS98wAAABE"]
[Fri Dec 26 21:23:13.497378 2025] [:error] [pid 7160:tid 7172] [client 20.196.90.232:1116] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aU6MQew_ihNZR5L8vEWS2AAAAYk"]
[Fri Dec 26 21:23:13.883016 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:1286] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aU6MQZ3ZK8bJ-c9-kjONcQAAAEE"]
[Fri Dec 26 21:23:14.279782 2025] [:error] [pid 28270:tid 28332] [client 20.196.90.232:18311] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aU6MQl9Ac79_ckdPN5Ji3gAAAIM"]
[Fri Dec 26 21:23:14.690128 2025] [:error] [pid 28270:tid 28349] [client 20.196.90.232:18355] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aU6MQl9Ac79_ckdPN5Ji3wAAAJQ"]
[Fri Dec 26 21:23:15.127341 2025] [:error] [pid 7160:tid 7177] [client 20.196.90.232:1136] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aU6MQ-w_ihNZR5L8vEWS3wAAAY4"]
[Fri Dec 26 21:23:15.504503 2025] [:error] [pid 28270:tid 28352] [client 20.196.90.232:1990] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aU6MQ19Ac79_ckdPN5Ji4wAAAJc"]
[Fri Dec 26 21:23:16.026679 2025] [:error] [pid 7160:tid 7167] [client 20.196.90.232:2043] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/783de.php"] [unique_id "aU6MROw_ihNZR5L8vEWS4QAAAYQ"]
[Fri Dec 26 21:23:16.479564 2025] [:error] [pid 7160:tid 7183] [client 20.196.90.232:1989] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/783de.php"] [unique_id "aU6MROw_ihNZR5L8vEWS4wAAAZQ"]
[Fri Dec 26 21:23:16.901366 2025] [:error] [pid 28269:tid 28311] [client 20.196.90.232:2047] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/783de.php"] [unique_id "aU6MRJ3ZK8bJ-c9-kjONdwAAAEk"]
[Fri Dec 26 21:23:17.310368 2025] [:error] [pid 28270:tid 28331] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/783de.php
[Fri Dec 26 21:23:17.451709 2025] [:error] [pid 28270:tid 28340] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/6kUgr4yGzxN.php
[Fri Dec 26 21:23:17.593711 2025] [:error] [pid 28270:tid 28343] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/oc460l3x.php
[Fri Dec 26 21:23:17.732607 2025] [:error] [pid 28270:tid 28339] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Fri Dec 26 21:23:17.891642 2025] [:error] [pid 28270:tid 28334] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-loccs.php
[Fri Dec 26 21:23:18.044104 2025] [:error] [pid 28270:tid 28342] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Fri Dec 26 21:23:18.185642 2025] [:error] [pid 28270:tid 28329] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/ii5file.php
[Fri Dec 26 21:23:18.326817 2025] [:error] [pid 28270:tid 28341] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Dec 26 21:23:18.476600 2025] [:error] [pid 28270:tid 28351] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Dec 26 21:23:18.618828 2025] [:error] [pid 28270:tid 28347] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Fri Dec 26 21:23:18.764251 2025] [:error] [pid 28270:tid 28333] [client 20.196.90.232:20277] File does not exist: /usr/local/apache/htdocs/suspended-page/FSCMNvnjPX4.php
[Fri Dec 26 21:23:18.915228 2025] [:error] [pid 28270:tid 28345] [client 20.196.90.232:20277] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qjaqjahu.php"] [unique_id "aU6MRl9Ac79_ckdPN5Ji8gAAAJA"]
[Fri Dec 26 21:23:19.722745 2025] [:error] [pid 15063:tid 15074] [client 20.196.90.232:1122] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qjaqjahu.php"] [unique_id "aU6MR-Dsf_aL46Jy7z8dYwAAAQk"]
[Fri Dec 26 21:23:20.106978 2025] [:error] [pid 34865:tid 34871] [client 20.196.90.232:1332] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qjaqjahu.php"] [unique_id "aU6MSKi4zjVVKBdvuTT4IgAAAUQ"]
[Fri Dec 26 21:23:20.731965 2025] [:error] [pid 28355:tid 28357] [client 20.196.90.232:1282] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qjaqjahu.php"] [unique_id "aU6MSLsFqKXf7ADZcTYlmAAAAMA"]
[Fri Dec 26 21:23:21.185729 2025] [:error] [pid 34865:tid 34872] [client 20.196.90.232:2044] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g7y.php"] [unique_id "aU6MSai4zjVVKBdvuTT4JQAAAUU"]
[Fri Dec 26 21:23:21.909314 2025] [:error] [pid 28269:tid 28323] [client 20.196.90.232:1285] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g7y.php"] [unique_id "aU6MSZ3ZK8bJ-c9-kjONhwAAAFU"]
[Fri Dec 26 21:23:22.299194 2025] [:error] [pid 7160:tid 7167] [client 20.196.90.232:1088] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g7y.php"] [unique_id "aU6MSuw_ihNZR5L8vEWS7gAAAYQ"]
[Fri Dec 26 21:23:22.711341 2025] [:error] [pid 28269:tid 28315] [client 20.196.90.232:2018] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g7y.php"] [unique_id "aU6MSp3ZK8bJ-c9-kjONigAAAE0"]
[Fri Dec 26 21:23:23.144904 2025] [:error] [pid 28268:tid 28291] [client 20.196.90.232:1413] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aU6MS3c_KuO_55-uPTS-CQAAABA"]
[Fri Dec 26 21:23:23.756222 2025] [:error] [pid 28270:tid 28339] [client 20.196.90.232:2036] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aU6MS19Ac79_ckdPN5Ji-wAAAIo"]
[Fri Dec 26 21:23:24.374072 2025] [:error] [pid 28268:tid 28287] [client 20.196.90.232:2005] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aU6MTHc_KuO_55-uPTS-DAAAAAw"]
[Fri Dec 26 21:23:24.870312 2025] [:error] [pid 28355:tid 28377] [client 20.196.90.232:1329] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/khgdl.php"] [unique_id "aU6MTLsFqKXf7ADZcTYlqAAAANQ"]
[Fri Dec 26 21:23:25.575061 2025] [:error] [pid 7160:tid 7165] [client 20.196.90.232:1298] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s121ws2s.php"] [unique_id "aU6MTew_ihNZR5L8vEWS9wAAAYI"]
[Fri Dec 26 21:23:26.058660 2025] [:error] [pid 28268:tid 28286] [client 20.196.90.232:2032] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s121ws2s.php"] [unique_id "aU6MTnc_KuO_55-uPTS-DgAAAAs"]
[Fri Dec 26 21:23:26.549233 2025] [:error] [pid 28355:tid 28373] [client 20.196.90.232:18352] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s121ws2s.php"] [unique_id "aU6MTrsFqKXf7ADZcTYlrAAAANA"]
[Fri Dec 26 21:23:26.930757 2025] [:error] [pid 7160:tid 7179] [client 20.196.90.232:18366] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s121ws2s.php"] [unique_id "aU6MTuw_ihNZR5L8vEWS-gAAAZA"]
[Fri Dec 26 21:23:27.348462 2025] [:error] [pid 34865:tid 34883] [client 20.196.90.232:1288] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU6MT6i4zjVVKBdvuTT4LQAAAVA"]
[Fri Dec 26 21:23:27.915618 2025] [:error] [pid 28355:tid 28365] [client 20.196.90.232:1112] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU6MT7sFqKXf7ADZcTYlsgAAAMg"]
[Fri Dec 26 21:23:28.340073 2025] [:error] [pid 28268:tid 28283] [client 20.196.90.232:1409] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU6MUHc_KuO_55-uPTS-EwAAAAg"]
[Fri Dec 26 21:23:28.770512 2025] [:error] [pid 28268:tid 28290] [client 20.196.90.232:18351] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aU6MUHc_KuO_55-uPTS-FAAAAA8"]
[Fri Dec 26 21:23:29.467601 2025] [:error] [pid 28268:tid 28281] [client 20.196.90.232:18353] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MUXc_KuO_55-uPTS-FgAAAAY"]
[Fri Dec 26 21:23:29.929441 2025] [:error] [pid 7160:tid 7186] [client 20.196.90.232:20321] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MUew_ihNZR5L8vEWS_QAAAZc"]
[Fri Dec 26 21:23:30.372228 2025] [:error] [pid 28270:tid 28349] [client 20.196.90.232:1986] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MUl9Ac79_ckdPN5JjAwAAAJQ"]
[Fri Dec 26 21:23:30.733611 2025] [:error] [pid 15063:tid 15066] [client 20.196.90.232:1102] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww3.php"] [unique_id "aU6MUuDsf_aL46Jy7z8ddAAAAQE"]
[Fri Dec 26 21:23:31.133802 2025] [:error] [pid 28268:tid 28299] [client 20.196.90.232:1320] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aU6MU3c_KuO_55-uPTS-GQAAABg"]
[Fri Dec 26 21:23:31.628382 2025] [:error] [pid 28269:tid 28313] [client 20.196.90.232:1417] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aU6MU53ZK8bJ-c9-kjONlQAAAEs"]
[Fri Dec 26 21:23:32.075352 2025] [:error] [pid 34865:tid 34891] [client 20.196.90.232:1094] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aU6MVKi4zjVVKBdvuTT4MQAAAVg"]
[Fri Dec 26 21:23:32.438615 2025] [:error] [pid 28270:tid 28346] [client 20.196.90.232:1111] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ghreshttryu.php"] [unique_id "aU6MVF9Ac79_ckdPN5JjBwAAAJE"]
[Fri Dec 26 21:23:32.916647 2025] [:error] [pid 34865:tid 34886] [client 20.196.90.232:1301] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU6MVKi4zjVVKBdvuTT4MwAAAVM"]
[Fri Dec 26 21:23:33.291849 2025] [:error] [pid 28268:tid 28279] [client 20.196.90.232:1309] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU6MVXc_KuO_55-uPTS-GgAAAAQ"]
[Fri Dec 26 21:23:33.793976 2025] [:error] [pid 28268:tid 28291] [client 20.196.90.232:18367] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU6MVXc_KuO_55-uPTS-HAAAABA"]
[Fri Dec 26 21:23:34.617515 2025] [:error] [pid 28269:tid 28317] [client 20.196.90.232:18427] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aU6MVp3ZK8bJ-c9-kjONmAAAAE8"]
[Fri Dec 26 21:23:35.099734 2025] [:error] [pid 28268:tid 28285] [client 20.196.90.232:1131] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aU6MV3c_KuO_55-uPTS-HwAAAAo"]
[Fri Dec 26 21:23:35.565384 2025] [:error] [pid 7160:tid 7171] [client 20.196.90.232:1105] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aU6MV-w_ihNZR5L8vEWTBgAAAYg"]
[Fri Dec 26 21:23:36.030352 2025] [:error] [pid 34865:tid 34877] [client 20.196.90.232:1427] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aU6MWKi4zjVVKBdvuTT4NgAAAUo"]
[Fri Dec 26 21:23:36.497314 2025] [:error] [pid 28270:tid 28334] [client 20.196.90.232:1099] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aU6MWF9Ac79_ckdPN5JjCgAAAIU"]
[Fri Dec 26 21:23:36.950885 2025] [:error] [pid 28269:tid 28315] [client 20.196.90.232:2010] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aU6MWJ3ZK8bJ-c9-kjONmgAAAE0"]
[Fri Dec 26 21:23:37.358621 2025] [:error] [pid 34865:tid 34882] [client 20.196.90.232:1293] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aU6MWai4zjVVKBdvuTT4OAAAAU8"]
[Fri Dec 26 21:23:37.720411 2025] [:error] [pid 28355:tid 28374] [client 20.196.90.232:1139] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aU6MWbsFqKXf7ADZcTYlvwAAANE"]
[Fri Dec 26 21:23:38.178619 2025] [:error] [pid 7160:tid 7175] [client 20.196.90.232:1314] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aU6MWuw_ihNZR5L8vEWTDAAAAYw"]
[Fri Dec 26 21:23:38.602786 2025] [:error] [pid 15063:tid 15066] [client 20.196.90.232:1322] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc3.php"] [unique_id "aU6MWuDsf_aL46Jy7z8dggAAAQE"]
[Fri Dec 26 21:23:39.036686 2025] [:error] [pid 28269:tid 28305] [client 20.196.90.232:2022] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc3.php"] [unique_id "aU6MW53ZK8bJ-c9-kjONnQAAAEM"]
[Fri Dec 26 21:23:39.473838 2025] [:error] [pid 28268:tid 28284] [client 20.196.90.232:1292] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc3.php"] [unique_id "aU6MW3c_KuO_55-uPTS-KQAAAAk"]
[Fri Dec 26 21:23:39.952794 2025] [:error] [pid 15063:tid 15089] [client 20.196.90.232:1123] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc3.php"] [unique_id "aU6MW-Dsf_aL46Jy7z8dhQAAARg"]
[Fri Dec 26 21:23:40.551682 2025] [:error] [pid 15063:tid 15075] [client 20.196.90.232:18356] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aU6MXODsf_aL46Jy7z8dhgAAAQo"]
[Fri Dec 26 21:23:40.916121 2025] [:error] [pid 15063:tid 15069] [client 20.196.90.232:2024] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aU6MXODsf_aL46Jy7z8dhwAAAQQ"]
[Fri Dec 26 21:23:41.434571 2025] [:error] [pid 28268:tid 28282] [client 20.196.90.232:18349] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aU6MXXc_KuO_55-uPTS-KgAAAAc"]
[Fri Dec 26 21:23:41.935704 2025] [:error] [pid 28270:tid 28332] [client 20.196.90.232:1418] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aU6MXV9Ac79_ckdPN5JjEgAAAIM"]
[Fri Dec 26 21:23:42.363687 2025] [:error] [pid 15063:tid 15072] [client 20.196.90.232:1326] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aU6MXuDsf_aL46Jy7z8diQAAAQc"]
[Fri Dec 26 21:23:42.791976 2025] [:error] [pid 28270:tid 28330] [client 20.196.90.232:2035] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aU6MXl9Ac79_ckdPN5JjFAAAAIE"]
[Fri Dec 26 21:23:43.228070 2025] [:error] [pid 7160:tid 7169] [client 20.196.90.232:1992] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aU6MX-w_ihNZR5L8vEWTEwAAAYY"]
[Fri Dec 26 21:23:43.769331 2025] [:error] [pid 28269:tid 28307] [client 20.196.90.232:1097] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aU6MX53ZK8bJ-c9-kjONogAAAEU"]
[Fri Dec 26 21:23:44.362563 2025] [:error] [pid 28355:tid 28359] [client 20.196.90.232:1141] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aU6MYLsFqKXf7ADZcTYlzAAAAMI"]
[Fri Dec 26 21:23:44.840471 2025] [:error] [pid 28270:tid 28334] [client 20.196.90.232:1106] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aU6MYF9Ac79_ckdPN5JjFgAAAIU"]
[Fri Dec 26 21:23:45.333293 2025] [:error] [pid 34865:tid 34873] [client 20.196.90.232:1324] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aU6MYai4zjVVKBdvuTT4RwAAAUY"]
[Fri Dec 26 21:23:45.726479 2025] [:error] [pid 28355:tid 28368] [client 20.196.90.232:18431] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aU6MYbsFqKXf7ADZcTYlzgAAAMs"]
[Fri Dec 26 21:23:46.224942 2025] [:error] [pid 15063:tid 15089] [client 20.196.90.232:2013] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aU6MYuDsf_aL46Jy7z8dkgAAARg"]
[Fri Dec 26 21:23:46.750506 2025] [:error] [pid 28270:tid 28347] [client 20.196.90.232:1129] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aU6MYl9Ac79_ckdPN5JjHAAAAJI"]
[Fri Dec 26 21:23:47.249380 2025] [:error] [pid 28355:tid 28371] [client 20.196.90.232:20297] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aU6MY7sFqKXf7ADZcTYl0AAAAM4"]
[Fri Dec 26 21:23:47.667326 2025] [:error] [pid 28355:tid 28364] [client 20.196.90.232:1337] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aU6MY7sFqKXf7ADZcTYl0gAAAMc"]
[Fri Dec 26 21:23:48.042320 2025] [:error] [pid 28355:tid 28373] [client 20.196.90.232:1300] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aU6MZLsFqKXf7ADZcTYl1AAAANA"]
[Fri Dec 26 21:23:48.419768 2025] [:error] [pid 34865:tid 34868] [client 20.196.90.232:1283] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aU6MZKi4zjVVKBdvuTT4SAAAAUE"]
[Fri Dec 26 21:23:48.774437 2025] [:error] [pid 15063:tid 15072] [client 20.196.90.232:1423] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aU6MZODsf_aL46Jy7z8dlQAAAQc"]
[Fri Dec 26 21:23:49.161888 2025] [:error] [pid 28268:tid 28287] [client 20.196.90.232:18419] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aU6MZXc_KuO_55-uPTS-LAAAAAw"]
[Fri Dec 26 21:23:49.584067 2025] [:error] [pid 7160:tid 7164] [client 20.196.90.232:2041] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aU6MZew_ihNZR5L8vEWTFQAAAYE"]
[Fri Dec 26 21:23:50.001877 2025] [:error] [pid 28270:tid 28352] [client 20.196.90.232:1108] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aU6MZl9Ac79_ckdPN5JjIAAAAJc"]
[Fri Dec 26 21:23:50.551823 2025] [:error] [pid 28355:tid 28365] [client 20.196.90.232:1411] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aU6MZrsFqKXf7ADZcTYl3AAAAMg"]
[Fri Dec 26 21:23:51.104408 2025] [:error] [pid 28355:tid 28369] [client 20.196.90.232:1335] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qhLaGswd9DS.php"] [unique_id "aU6MZ7sFqKXf7ADZcTYl3QAAAMw"]
[Fri Dec 26 21:23:51.608190 2025] [:error] [pid 34865:tid 34880] [client 20.196.90.232:1408] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aU6MZ6i4zjVVKBdvuTT4TgAAAU0"]
[Fri Dec 26 21:23:52.107861 2025] [:error] [pid 28268:tid 28295] [client 20.196.90.232:2037] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aU6MaHc_KuO_55-uPTS-LQAAABQ"]
[Fri Dec 26 21:23:52.594210 2025] [:error] [pid 28268:tid 28286] [client 20.196.90.232:18335] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aU6MaHc_KuO_55-uPTS-LwAAAAs"]
[Fri Dec 26 21:23:53.048493 2025] [:error] [pid 28270:tid 28341] [client 20.196.90.232:1092] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aU6MaV9Ac79_ckdPN5JjKAAAAIw"]
[Fri Dec 26 21:23:53.407675 2025] [:error] [pid 28270:tid 28351] [client 20.196.90.232:1114] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aU6MaV9Ac79_ckdPN5JjKwAAAJY"]
[Fri Dec 26 21:23:53.803871 2025] [:error] [pid 28269:tid 28312] [client 20.196.90.232:1104] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aU6MaZ3ZK8bJ-c9-kjONtQAAAEo"]
[Fri Dec 26 21:23:54.312013 2025] [:error] [pid 34865:tid 34877] [client 20.196.90.232:1118] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aU6Maqi4zjVVKBdvuTT4UQAAAUo"]
[Fri Dec 26 21:23:55.147072 2025] [:error] [pid 15063:tid 15069] [client 20.196.90.232:1410] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aU6Ma-Dsf_aL46Jy7z8dngAAAQQ"]
[Fri Dec 26 21:23:55.713589 2025] [:error] [pid 15063:tid 15082] [client 20.196.90.232:1328] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6Ma-Dsf_aL46Jy7z8dogAAARE"]
[Fri Dec 26 21:23:56.271563 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:1456] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6MbJ3ZK8bJ-c9-kjONuQAAAEE"]
[Fri Dec 26 21:23:56.744862 2025] [:error] [pid 28269:tid 28316] [client 20.196.90.232:1146] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6MbJ3ZK8bJ-c9-kjONugAAAE4"]
[Fri Dec 26 21:23:57.125659 2025] [:error] [pid 34865:tid 34889] [client 20.196.90.232:1110] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU6Mbai4zjVVKBdvuTT4UwAAAVY"]
[Fri Dec 26 21:23:57.533774 2025] [:error] [pid 28269:tid 28309] [client 20.196.90.232:1424] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6MbZ3ZK8bJ-c9-kjONvAAAAEc"]
[Fri Dec 26 21:23:57.943832 2025] [:error] [pid 7160:tid 7182] [client 20.196.90.232:1117] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6Mbew_ihNZR5L8vEWTFwAAAZM"]
[Fri Dec 26 21:23:58.387082 2025] [:error] [pid 7160:tid 7172] [client 20.196.90.232:1493] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6Mbuw_ihNZR5L8vEWTGAAAAYk"]
[Fri Dec 26 21:23:58.841776 2025] [:error] [pid 28268:tid 28290] [client 20.196.90.232:1342] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aU6Mbnc_KuO_55-uPTS-OAAAAA8"]
[Fri Dec 26 21:23:59.349207 2025] [:error] [pid 28269:tid 28306] [client 20.196.90.232:1336] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dparm.php"] [unique_id "aU6Mb53ZK8bJ-c9-kjONwgAAAEQ"]
[Fri Dec 26 21:23:59.792638 2025] [:error] [pid 28269:tid 28315] [client 20.196.90.232:1311] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dparm.php"] [unique_id "aU6Mb53ZK8bJ-c9-kjONxQAAAE0"]
[Fri Dec 26 21:24:00.348959 2025] [:error] [pid 15063:tid 15084] [client 20.196.90.232:1299] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dparm.php"] [unique_id "aU6McODsf_aL46Jy7z8drQAAARM"]
[Fri Dec 26 21:24:01.250864 2025] [:error] [pid 28268:tid 28291] [client 20.196.90.232:1290] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dparm.php"] [unique_id "aU6McXc_KuO_55-uPTS-PAAAABA"]
[Fri Dec 26 21:24:02.114578 2025] [:error] [pid 7160:tid 7176] [client 20.196.90.232:1132] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "aU6Mcuw_ihNZR5L8vEWTHgAAAY0"]
[Fri Dec 26 21:24:02.829036 2025] [:error] [pid 15063:tid 15074] [client 20.196.90.232:1421] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "aU6McuDsf_aL46Jy7z8dsAAAAQk"]
[Fri Dec 26 21:24:03.279683 2025] [:error] [pid 28269:tid 28303] [client 20.196.90.232:1491] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "aU6Mc53ZK8bJ-c9-kjONygAAAEE"]
[Fri Dec 26 21:24:03.773446 2025] [:error] [pid 28269:tid 28316] [client 20.196.90.232:1444] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "aU6Mc53ZK8bJ-c9-kjONywAAAE4"]
[Fri Dec 26 21:24:04.250495 2025] [:error] [pid 28269:tid 28309] [client 20.196.90.232:1294] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/veuntzdf.php"] [unique_id "aU6MdJ3ZK8bJ-c9-kjONzQAAAEc"]
[Fri Dec 26 21:24:04.653393 2025] [:error] [pid 28268:tid 28277] [client 20.196.90.232:1303] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/veuntzdf.php"] [unique_id "aU6MdHc_KuO_55-uPTS-QAAAAAI"]
[Fri Dec 26 21:24:05.152586 2025] [:error] [pid 28270:tid 28335] [client 20.196.90.232:1434] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/veuntzdf.php"] [unique_id "aU6MdV9Ac79_ckdPN5JjMgAAAIY"]
[Fri Dec 26 21:24:05.545440 2025] [:error] [pid 28270:tid 28333] [client 20.196.90.232:2011] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/veuntzdf.php"] [unique_id "aU6MdV9Ac79_ckdPN5JjMwAAAIQ"]
[Fri Dec 26 21:24:05.964707 2025] [:error] [pid 28355:tid 28367] [client 20.196.90.232:18320] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qsntqiho.php"] [unique_id "aU6MdbsFqKXf7ADZcTYl5gAAAMo"]
[Fri Dec 26 21:24:06.349904 2025] [:error] [pid 28269:tid 28306] [client 20.196.90.232:1137] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qsntqiho.php"] [unique_id "aU6Mdp3ZK8bJ-c9-kjON1QAAAEQ"]
[Fri Dec 26 21:24:07.027516 2025] [:error] [pid 7160:tid 7165] [client 20.196.90.232:1124] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qsntqiho.php"] [unique_id "aU6Md-w_ihNZR5L8vEWTJQAAAYI"]
[Fri Dec 26 21:24:07.784763 2025] [:error] [pid 28355:tid 28374] [client 20.196.90.232:1302] [client 20.196.90.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qsntqiho.php"] [unique_id "aU6Md7sFqKXf7ADZcTYl6gAAANE"]
[Sat Dec 27 01:36:22.458967 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:12888] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Sat Dec 27 01:36:22.598710 2025] [:error] [pid 47566:tid 47575] [client 4.213.20.183:12888] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Sat Dec 27 01:36:22.738807 2025] [:error] [pid 47566:tid 47585] [client 4.213.20.183:12888] File does not exist: /usr/local/apache/htdocs/suspended-page/13k.php
[Sat Dec 27 01:36:22.881641 2025] [:error] [pid 47566:tid 47582] [client 4.213.20.183:12888] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Sat Dec 27 01:36:23.030189 2025] [:error] [pid 47566:tid 47571] [client 4.213.20.183:12888] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Dec 27 01:36:23.309781 2025] [:error] [pid 47566:tid 47576] [client 4.213.20.183:12888] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Dec 27 01:36:23.446629 2025] [:error] [pid 47566:tid 47573] [client 4.213.20.183:12888] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aU7Hl6yYgLfR4YwO7bx3kwAAAQQ"]
[Sat Dec 27 01:36:23.809028 2025] [:error] [pid 47566:tid 47569] [client 4.213.20.183:12823] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aU7Hl6yYgLfR4YwO7bx3lAAAAQA"]
[Sat Dec 27 01:36:24.139690 2025] [:error] [pid 34189:tid 34249] [client 4.213.20.183:12805] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aU7HmAnn007DnMwSsfcjoAAAAII"]
[Sat Dec 27 01:36:24.447842 2025] [:error] [pid 34189:tid 34261] [client 4.213.20.183:12907] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aU7HmAnn007DnMwSsfcjogAAAI4"]
[Sat Dec 27 01:36:24.741157 2025] [:error] [pid 34188:tid 34226] [client 4.213.20.183:12820] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aU7HmA54j0mXgip5BAGmwQAAAEY"]
[Sat Dec 27 01:36:25.019694 2025] [:error] [pid 34188:tid 34229] [client 4.213.20.183:12865] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aU7HmQ54j0mXgip5BAGmwgAAAEk"]
[Sat Dec 27 01:36:25.312483 2025] [:error] [pid 34189:tid 34259] [client 4.213.20.183:12872] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aU7HmQnn007DnMwSsfcjpQAAAIw"]
[Sat Dec 27 01:36:25.675494 2025] [:error] [pid 34187:tid 34197] [client 4.213.20.183:12906] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aU7Hmav8srZGEpsIm8D0-wAAAAU"]
[Sat Dec 27 01:36:25.965806 2025] [:error] [pid 34187:tid 34212] [client 4.213.20.183:12874] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "aU7Hmav8srZGEpsIm8D0_AAAABQ"]
[Sat Dec 27 01:36:26.281858 2025] [:error] [pid 47566:tid 47570] [client 4.213.20.183:12818] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "aU7HmqyYgLfR4YwO7bx3mQAAAQE"]
[Sat Dec 27 01:36:26.667502 2025] [:error] [pid 34189:tid 34262] [client 4.213.20.183:12821] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "aU7Hmgnn007DnMwSsfcjpwAAAI8"]
[Sat Dec 27 01:36:27.006380 2025] [:error] [pid 34189:tid 34258] [client 4.213.20.183:12824] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "aU7Hmwnn007DnMwSsfcjqQAAAIs"]
[Sat Dec 27 01:36:27.297177 2025] [:error] [pid 47566:tid 47591] [client 4.213.20.183:12920] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aU7Hm6yYgLfR4YwO7bx3nAAAARY"]
[Sat Dec 27 01:36:27.578119 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:12924] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aU7Hm6yYgLfR4YwO7bx3nQAAARg"]
[Sat Dec 27 01:36:27.904714 2025] [:error] [pid 47566:tid 47580] [client 4.213.20.183:12825] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aU7Hm6yYgLfR4YwO7bx3oAAAAQs"]
[Sat Dec 27 01:36:28.207474 2025] [:error] [pid 47566:tid 47585] [client 4.213.20.183:12877] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aU7HnKyYgLfR4YwO7bx3owAAARA"]
[Sat Dec 27 01:36:28.485109 2025] [:error] [pid 47566:tid 47576] [client 4.213.20.183:12879] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aU7HnKyYgLfR4YwO7bx3pgAAAQc"]
[Sat Dec 27 01:36:28.779105 2025] [:error] [pid 47566:tid 47569] [client 4.213.20.183:12904] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aU7HnKyYgLfR4YwO7bx3qAAAAQA"]
[Sat Dec 27 01:36:29.146429 2025] [:error] [pid 34188:tid 34237] [client 4.213.20.183:12851] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aU7HnQ54j0mXgip5BAGmxQAAAFE"]
[Sat Dec 27 01:36:29.470325 2025] [:error] [pid 34189:tid 34266] [client 4.213.20.183:12902] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akc.php"] [unique_id "aU7HnQnn007DnMwSsfcjqwAAAJM"]
[Sat Dec 27 01:36:29.761225 2025] [:error] [pid 47566:tid 47583] [client 4.213.20.183:12873] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleet"] [unique_id "aU7HnayYgLfR4YwO7bx3rgAAAQ4"]
[Sat Dec 27 01:36:30.067659 2025] [:error] [pid 34188:tid 34242] [client 4.213.20.183:12921] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleet"] [unique_id "aU7Hng54j0mXgip5BAGmyQAAAFY"]
[Sat Dec 27 01:36:30.413106 2025] [:error] [pid 47566:tid 47577] [client 4.213.20.183:12830] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleet"] [unique_id "aU7HnqyYgLfR4YwO7bx3sAAAAQg"]
[Sat Dec 27 01:36:30.715949 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:12826] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xleet"] [unique_id "aU7HnqyYgLfR4YwO7bx3sgAAAQU"]
[Sat Dec 27 01:36:31.012165 2025] [:error] [pid 47566:tid 47585] [client 4.213.20.183:12908] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aU7Hn6yYgLfR4YwO7bx3tAAAARA"]
[Sat Dec 27 01:36:31.325729 2025] [:error] [pid 47566:tid 47582] [client 4.213.20.183:12868] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aU7Hn6yYgLfR4YwO7bx3tgAAAQ0"]
[Sat Dec 27 01:36:31.613250 2025] [:error] [pid 47566:tid 47576] [client 4.213.20.183:12926] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aU7Hn6yYgLfR4YwO7bx3uQAAAQc"]
[Sat Dec 27 01:36:31.953292 2025] [:error] [pid 47566:tid 47581] [client 4.213.20.183:12896] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aU7Hn6yYgLfR4YwO7bx3ugAAAQw"]
[Sat Dec 27 01:36:32.325038 2025] [:error] [pid 34188:tid 34235] [client 4.213.20.183:12814] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aU7HoA54j0mXgip5BAGmzAAAAE8"]
[Sat Dec 27 01:36:32.651831 2025] [:error] [pid 34188:tid 34226] [client 4.213.20.183:12819] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aU7HoA54j0mXgip5BAGmzgAAAEY"]
[Sat Dec 27 01:36:32.998729 2025] [:error] [pid 47566:tid 47579] [client 4.213.20.183:12841] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aU7HoKyYgLfR4YwO7bx3vQAAAQo"]
[Sat Dec 27 01:36:33.297880 2025] [:error] [pid 47566:tid 47583] [client 4.213.20.183:12919] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aU7HoayYgLfR4YwO7bx3vgAAAQ4"]
[Sat Dec 27 01:36:33.700441 2025] [:error] [pid 47566:tid 47577] [client 4.213.20.183:12842] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aU7HoayYgLfR4YwO7bx3wAAAAQg"]
[Sat Dec 27 01:36:34.042830 2025] [:error] [pid 34189:tid 34263] [client 4.213.20.183:12809] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aU7Hognn007DnMwSsfcjrAAAAJA"]
[Sat Dec 27 01:36:34.332629 2025] [:error] [pid 34188:tid 34224] [client 4.213.20.183:12923] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aU7Hog54j0mXgip5BAGm0AAAAEQ"]
[Sat Dec 27 01:36:34.619204 2025] [:error] [pid 34187:tid 34201] [client 4.213.20.183:12833] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aU7Hoqv8srZGEpsIm8D1AQAAAAk"]
[Sat Dec 27 01:36:34.960697 2025] [:error] [pid 47566:tid 47587] [client 4.213.20.183:12911] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aU7HoqyYgLfR4YwO7bx3xAAAARI"]
[Sat Dec 27 01:36:35.258764 2025] [:error] [pid 34189:tid 34261] [client 4.213.20.183:12852] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aU7Hownn007DnMwSsfcjrgAAAI4"]
[Sat Dec 27 01:36:35.577889 2025] [:error] [pid 34187:tid 34209] [client 4.213.20.183:12831] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aU7Ho6v8srZGEpsIm8D1AgAAABE"]
[Sat Dec 27 01:36:35.893253 2025] [:error] [pid 34188:tid 34244] [client 4.213.20.183:6088] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aU7How54j0mXgip5BAGm0gAAAFg"]
[Sat Dec 27 01:36:36.220659 2025] [:error] [pid 34187:tid 34200] [client 4.213.20.183:12844] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/doc.php"] [unique_id "aU7HpKv8srZGEpsIm8D1BQAAAAg"]
[Sat Dec 27 01:36:36.709632 2025] [:error] [pid 34189:tid 34262] [client 4.213.20.183:12893] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/doc.php"] [unique_id "aU7HpAnn007DnMwSsfcjswAAAI8"]
[Sat Dec 27 01:36:37.113474 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:12835] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/doc.php"] [unique_id "aU7HpayYgLfR4YwO7bx3xwAAARg"]
[Sat Dec 27 01:36:37.511509 2025] [:error] [pid 34189:tid 34256] [client 4.213.20.183:12880] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/doc.php"] [unique_id "aU7HpQnn007DnMwSsfcjtQAAAIk"]
[Sat Dec 27 01:36:37.814991 2025] [:error] [pid 34189:tid 34267] [client 4.213.20.183:6089] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aU7HpQnn007DnMwSsfcjtwAAAJQ"]
[Sat Dec 27 01:36:38.140246 2025] [:error] [pid 34188:tid 34239] [client 4.213.20.183:6092] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aU7Hpg54j0mXgip5BAGm1wAAAFM"]
[Sat Dec 27 01:36:38.475663 2025] [:error] [pid 34188:tid 34243] [client 4.213.20.183:12847] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aU7Hpg54j0mXgip5BAGm2AAAAFc"]
[Sat Dec 27 01:36:38.802083 2025] [:error] [pid 34189:tid 34250] [client 4.213.20.183:12806] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aU7Hpgnn007DnMwSsfcjuQAAAIM"]
[Sat Dec 27 01:36:39.203076 2025] [:error] [pid 34189:tid 34260] [client 4.213.20.183:12885] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aU7Hpwnn007DnMwSsfcjugAAAI0"]
[Sat Dec 27 01:36:39.644781 2025] [:error] [pid 47566:tid 47572] [client 4.213.20.183:12813] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aU7Hp6yYgLfR4YwO7bx3zAAAAQM"]
[Sat Dec 27 01:36:40.022725 2025] [:error] [pid 47566:tid 47588] [client 4.213.20.183:12871] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aU7HqKyYgLfR4YwO7bx3zwAAARM"]
[Sat Dec 27 01:36:40.363899 2025] [:error] [pid 34188:tid 34231] [client 4.213.20.183:12916] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aU7HqA54j0mXgip5BAGm2wAAAEs"]
[Sat Dec 27 01:36:40.674458 2025] [:error] [pid 34274:tid 34299] [client 4.213.20.183:12864] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU7HqM6fabpS0mfhiCEIjQAAANc"]
[Sat Dec 27 01:36:41.010762 2025] [:error] [pid 34188:tid 34235] [client 4.213.20.183:12870] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU7HqQ54j0mXgip5BAGm3AAAAE8"]
[Sat Dec 27 01:36:41.361153 2025] [:error] [pid 34274:tid 34287] [client 4.213.20.183:12807] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU7Hqc6fabpS0mfhiCEIkAAAAMs"]
[Sat Dec 27 01:36:41.661014 2025] [:error] [pid 34274:tid 34290] [client 4.213.20.183:12912] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aU7Hqc6fabpS0mfhiCEIkgAAAM4"]
[Sat Dec 27 01:36:42.018765 2025] [:error] [pid 34189:tid 34254] [client 4.213.20.183:12815] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7Hqgnn007DnMwSsfcjvAAAAIc"]
[Sat Dec 27 01:36:42.518819 2025] [:error] [pid 34188:tid 34222] [client 4.213.20.183:6017] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7Hqg54j0mXgip5BAGm3wAAAEI"]
[Sat Dec 27 01:36:42.863715 2025] [:error] [pid 34188:tid 34228] [client 4.213.20.183:6095] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7Hqg54j0mXgip5BAGm4QAAAEg"]
[Sat Dec 27 01:36:43.179748 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:12828] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap/function.php"] [unique_id "aU7Hq6yYgLfR4YwO7bx30QAAAQU"]
[Sat Dec 27 01:36:43.589709 2025] [:error] [pid 34189:tid 34262] [client 4.213.20.183:12913] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aU7Hqwnn007DnMwSsfcjvwAAAI8"]
[Sat Dec 27 01:36:43.980868 2025] [:error] [pid 47566:tid 47590] [client 4.213.20.183:12829] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aU7Hq6yYgLfR4YwO7bx31AAAARU"]
[Sat Dec 27 01:36:44.319428 2025] [:error] [pid 47566:tid 47569] [client 4.213.20.183:12836] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aU7HrKyYgLfR4YwO7bx31gAAAQA"]
[Sat Dec 27 01:36:44.713483 2025] [:error] [pid 34189:tid 34251] [client 4.213.20.183:6115] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aU7HrAnn007DnMwSsfcjwQAAAIQ"]
[Sat Dec 27 01:36:45.125183 2025] [:error] [pid 47566:tid 47570] [client 4.213.20.183:12900] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/fw.php"] [unique_id "aU7HrayYgLfR4YwO7bx32gAAAQE"]
[Sat Dec 27 01:36:45.490136 2025] [:error] [pid 34189:tid 34258] [client 4.213.20.183:12914] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/fw.php"] [unique_id "aU7HrQnn007DnMwSsfcjwwAAAIs"]
[Sat Dec 27 01:36:45.870921 2025] [:error] [pid 34188:tid 34227] [client 4.213.20.183:6094] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/fw.php"] [unique_id "aU7HrQ54j0mXgip5BAGm5QAAAEc"]
[Sat Dec 27 01:36:46.269378 2025] [:error] [pid 34189:tid 34249] [client 4.213.20.183:12887] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/fw.php"] [unique_id "aU7Hrgnn007DnMwSsfcjyAAAAII"]
[Sat Dec 27 01:36:46.772004 2025] [:error] [pid 47566:tid 47582] [client 4.213.20.183:12899] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bugz.php"] [unique_id "aU7HrqyYgLfR4YwO7bx33gAAAQ0"]
[Sat Dec 27 01:36:47.209162 2025] [:error] [pid 34189:tid 34261] [client 4.213.20.183:6127] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bugz.php"] [unique_id "aU7Hrwnn007DnMwSsfcjyQAAAI4"]
[Sat Dec 27 01:36:47.544035 2025] [:error] [pid 34187:tid 34213] [client 4.213.20.183:12822] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bugz.php"] [unique_id "aU7Hr6v8srZGEpsIm8D1EAAAABU"]
[Sat Dec 27 01:36:47.908639 2025] [:error] [pid 47566:tid 47581] [client 4.213.20.183:12811] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bugz.php"] [unique_id "aU7Hr6yYgLfR4YwO7bx34gAAAQw"]
[Sat Dec 27 01:36:48.263828 2025] [:error] [pid 34274:tid 34284] [client 4.213.20.183:12918] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aU7HsM6fabpS0mfhiCEIlQAAAMg"]
[Sat Dec 27 01:36:48.635501 2025] [:error] [pid 47566:tid 47578] [client 4.213.20.183:12803] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aU7HsKyYgLfR4YwO7bx35AAAAQk"]
[Sat Dec 27 01:36:49.185913 2025] [:error] [pid 47566:tid 47570] [client 4.213.20.183:6037] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aU7HsayYgLfR4YwO7bx35wAAAQE"]
[Sat Dec 27 01:36:49.536556 2025] [:error] [pid 34187:tid 34198] [client 4.213.20.183:12808] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aU7Hsav8srZGEpsIm8D1EgAAAAY"]
[Sat Dec 27 01:36:49.955308 2025] [:error] [pid 34187:tid 34197] [client 4.213.20.183:12817] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU7Hsav8srZGEpsIm8D1EwAAAAU"]
[Sat Dec 27 01:36:50.324800 2025] [:error] [pid 47566:tid 47571] [client 4.213.20.183:12910] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU7HsqyYgLfR4YwO7bx37AAAAQI"]
[Sat Dec 27 01:36:50.691148 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:12878] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU7HsqyYgLfR4YwO7bx37QAAAQU"]
[Sat Dec 27 01:36:51.054757 2025] [:error] [pid 34189:tid 34262] [client 4.213.20.183:6035] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aU7Hswnn007DnMwSsfcjywAAAI8"]
[Sat Dec 27 01:36:51.493161 2025] [:error] [pid 47566:tid 47580] [client 4.213.20.183:6120] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aU7Hs6yYgLfR4YwO7bx37gAAAQs"]
[Sat Dec 27 01:36:51.859669 2025] [:error] [pid 34188:tid 34229] [client 4.213.20.183:12827] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aU7Hsw54j0mXgip5BAGm5wAAAEk"]
[Sat Dec 27 01:36:52.254417 2025] [:error] [pid 47566:tid 47579] [client 4.213.20.183:6096] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aU7HtKyYgLfR4YwO7bx38AAAAQo"]
[Sat Dec 27 01:36:52.612017 2025] [:error] [pid 34189:tid 34253] [client 4.213.20.183:12901] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aU7HtAnn007DnMwSsfcjzgAAAIY"]
[Sat Dec 27 01:36:53.574416 2025] [:error] [pid 34189:tid 34256] [client 4.213.20.183:12867] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aU7HtQnn007DnMwSsfcjzwAAAIk"]
[Sat Dec 27 01:36:53.941219 2025] [:error] [pid 34189:tid 34267] [client 4.213.20.183:12802] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aU7HtQnn007DnMwSsfcj0AAAAJQ"]
[Sat Dec 27 01:36:54.343005 2025] [:error] [pid 34274:tid 34294] [client 4.213.20.183:12853] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aU7Hts6fabpS0mfhiCEIlwAAANI"]
[Sat Dec 27 01:36:54.838204 2025] [:error] [pid 34187:tid 34193] [client 4.213.20.183:12886] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aU7Htqv8srZGEpsIm8D1GQAAAAE"]
[Sat Dec 27 01:36:55.259908 2025] [:error] [pid 34189:tid 34271] [client 4.213.20.183:12862] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aU7Htwnn007DnMwSsfcj0gAAAJg"]
[Sat Dec 27 01:36:55.666681 2025] [:error] [pid 47566:tid 47590] [client 4.213.20.183:12800] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aU7Ht6yYgLfR4YwO7bx39wAAARU"]
[Sat Dec 27 01:36:56.055486 2025] [:error] [pid 34189:tid 34268] [client 4.213.20.183:12875] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aU7HuAnn007DnMwSsfcj1AAAAJU"]
[Sat Dec 27 01:36:56.399121 2025] [:error] [pid 34187:tid 34201] [client 4.213.20.183:12812] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aU7HuKv8srZGEpsIm8D1GwAAAAk"]
[Sat Dec 27 01:36:56.880787 2025] [:error] [pid 34189:tid 34257] [client 4.213.20.183:12881] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/composer.php"] [unique_id "aU7HuAnn007DnMwSsfcj1gAAAIo"]
[Sat Dec 27 01:36:57.290692 2025] [:error] [pid 34189:tid 34261] [client 4.213.20.183:12898] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/composer.php"] [unique_id "aU7HuQnn007DnMwSsfcj2AAAAI4"]
[Sat Dec 27 01:36:57.764131 2025] [:error] [pid 34189:tid 34255] [client 4.213.20.183:12882] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/composer.php"] [unique_id "aU7HuQnn007DnMwSsfcj2wAAAIg"]
[Sat Dec 27 01:36:58.170507 2025] [:error] [pid 34187:tid 34200] [client 4.213.20.183:12816] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/composer.php"] [unique_id "aU7Huqv8srZGEpsIm8D1HAAAAAg"]
[Sat Dec 27 01:36:58.672937 2025] [:error] [pid 34187:tid 34215] [client 4.213.20.183:12890] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU7Huqv8srZGEpsIm8D1HQAAABc"]
[Sat Dec 27 01:36:58.993025 2025] [:error] [pid 34187:tid 34213] [client 4.213.20.183:6126] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU7Huqv8srZGEpsIm8D1HgAAABU"]
[Sat Dec 27 01:36:59.317117 2025] [:error] [pid 34189:tid 34265] [client 4.213.20.183:12883] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU7Huwnn007DnMwSsfcj3QAAAJI"]
[Sat Dec 27 01:36:59.754107 2025] [:error] [pid 34189:tid 34253] [client 4.213.20.183:12845] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aU7Huwnn007DnMwSsfcj3wAAAIY"]
[Sat Dec 27 01:37:00.255453 2025] [:error] [pid 34274:tid 34299] [client 4.213.20.183:6097] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aU7HvM6fabpS0mfhiCEIowAAANc"]
[Sat Dec 27 01:37:00.618422 2025] [:error] [pid 34187:tid 34198] [client 4.213.20.183:12840] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aU7HvKv8srZGEpsIm8D1IAAAAAY"]
[Sat Dec 27 01:37:00.939403 2025] [:error] [pid 34187:tid 34212] [client 4.213.20.183:12922] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aU7HvKv8srZGEpsIm8D1IgAAABQ"]
[Sat Dec 27 01:37:01.284592 2025] [:error] [pid 34187:tid 34206] [client 4.213.20.183:12909] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "aU7Hvav8srZGEpsIm8D1IwAAAA4"]
[Sat Dec 27 01:37:01.622258 2025] [:error] [pid 34189:tid 34249] [client 4.213.20.183:12891] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aU7HvQnn007DnMwSsfcj4gAAAII"]
[Sat Dec 27 01:37:01.920542 2025] [:error] [pid 34274:tid 34288] [client 4.213.20.183:6106] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aU7Hvc6fabpS0mfhiCEIpQAAAMw"]
[Sat Dec 27 01:37:02.419284 2025] [:error] [pid 34189:tid 34254] [client 4.213.20.183:12834] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aU7Hvgnn007DnMwSsfcj5QAAAIc"]
[Sat Dec 27 01:37:02.850787 2025] [:error] [pid 34189:tid 34247] [client 4.213.20.183:12925] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aU7Hvgnn007DnMwSsfcj6AAAAIA"]
[Sat Dec 27 01:37:03.390167 2025] [:error] [pid 47566:tid 47585] [client 4.213.20.183:12839] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aU7Hv6yYgLfR4YwO7bx3-gAAARA"]
[Sat Dec 27 01:37:03.721520 2025] [:error] [pid 34274:tid 34280] [client 4.213.20.183:6049] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aU7Hv86fabpS0mfhiCEIpwAAAMQ"]
[Sat Dec 27 01:37:04.099888 2025] [:error] [pid 34189:tid 34269] [client 4.213.20.183:6140] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aU7HwAnn007DnMwSsfcj6gAAAJY"]
[Sat Dec 27 01:37:04.430784 2025] [:error] [pid 34188:tid 34221] [client 4.213.20.183:6085] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aU7HwA54j0mXgip5BAGm7AAAAEE"]
[Sat Dec 27 01:37:04.789309 2025] [:error] [pid 34274:tid 34279] [client 4.213.20.183:6040] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU7HwM6fabpS0mfhiCEIqAAAAMM"]
[Sat Dec 27 01:37:05.158645 2025] [:error] [pid 34274:tid 34284] [client 4.213.20.183:12848] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU7Hwc6fabpS0mfhiCEIqwAAAMg"]
[Sat Dec 27 01:37:05.601595 2025] [:error] [pid 47566:tid 47591] [client 4.213.20.183:12859] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU7HwayYgLfR4YwO7bx3_wAAARY"]
[Sat Dec 27 01:37:05.964372 2025] [:error] [pid 34274:tid 34287] [client 4.213.20.183:12810] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aU7Hwc6fabpS0mfhiCEIsAAAAMs"]
[Sat Dec 27 01:37:06.373122 2025] [:error] [pid 34274:tid 34290] [client 4.213.20.183:12927] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aU7Hws6fabpS0mfhiCEIswAAAM4"]
[Sat Dec 27 01:37:06.724739 2025] [:error] [pid 34187:tid 34201] [client 4.213.20.183:12894] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aU7Hwqv8srZGEpsIm8D1KwAAAAk"]
[Sat Dec 27 01:37:07.055992 2025] [:error] [pid 34189:tid 34266] [client 4.213.20.183:12860] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aU7Hwwnn007DnMwSsfcj8QAAAJM"]
[Sat Dec 27 01:37:07.368139 2025] [:error] [pid 34274:tid 34296] [client 4.213.20.183:6130] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aU7Hw86fabpS0mfhiCEIuwAAANQ"]
[Sat Dec 27 01:37:07.801777 2025] [:error] [pid 34274:tid 34284] [client 4.213.20.183:6047] [client 4.213.20.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aU7Hw86fabpS0mfhiCEIvQAAAMg"]
[Sat Dec 27 01:37:08.186815 2025] [:error] [pid 34189:tid 34250] [client 4.213.20.183:12889] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/index.php"] [unique_id "aU7HxAnn007DnMwSsfcj8gAAAIM"]
[Sat Dec 27 01:37:08.493307 2025] [:error] [pid 34274:tid 34293] [client 4.213.20.183:12801] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/index.php"] [unique_id "aU7HxM6fabpS0mfhiCEIvgAAANE"]
[Sat Dec 27 01:37:08.826168 2025] [:error] [pid 34189:tid 34271] [client 4.213.20.183:6087] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/index.php"] [unique_id "aU7HxAnn007DnMwSsfcj8wAAAJg"]
[Sat Dec 27 01:37:09.104631 2025] [:error] [pid 34189:tid 34249] [client 4.213.20.183:6100] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fix.php"] [unique_id "aU7HxQnn007DnMwSsfcj9AAAAII"]
[Sat Dec 27 01:37:09.425823 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:6073] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fix.php"] [unique_id "aU7HxayYgLfR4YwO7bx4BQAAARg"]
[Sat Dec 27 01:37:09.731715 2025] [:error] [pid 47566:tid 47578] [client 4.213.20.183:6105] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fix.php"] [unique_id "aU7HxayYgLfR4YwO7bx4CQAAAQk"]
[Sat Dec 27 01:37:10.019632 2025] [:error] [pid 34189:tid 34257] [client 4.213.20.183:5962] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fix.php"] [unique_id "aU7Hxgnn007DnMwSsfcj9QAAAIo"]
[Sat Dec 27 01:37:10.348962 2025] [:error] [pid 34189:tid 34263] [client 4.213.20.183:6132] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aU7Hxgnn007DnMwSsfcj-AAAAJA"]
[Sat Dec 27 01:37:10.627345 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:6090] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aU7HxqyYgLfR4YwO7bx4CwAAAQU"]
[Sat Dec 27 01:37:10.925866 2025] [:error] [pid 34274:tid 34278] [client 4.213.20.183:12905] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aU7Hxs6fabpS0mfhiCEIwgAAAMI"]
[Sat Dec 27 01:37:11.300808 2025] [:error] [pid 34187:tid 34215] [client 4.213.20.183:6098] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aU7Hx6v8srZGEpsIm8D1LwAAABc"]
[Sat Dec 27 01:37:11.602938 2025] [:error] [pid 34187:tid 34198] [client 4.213.20.183:12884] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fox.php"] [unique_id "aU7Hx6v8srZGEpsIm8D1MQAAAAY"]
[Sat Dec 27 01:37:12.063041 2025] [:error] [pid 34187:tid 34197] [client 4.213.20.183:12897] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fox.php"] [unique_id "aU7HyKv8srZGEpsIm8D1MwAAAAU"]
[Sat Dec 27 01:37:12.382310 2025] [:error] [pid 47566:tid 47570] [client 4.213.20.183:6082] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fox.php"] [unique_id "aU7HyKyYgLfR4YwO7bx4EwAAAQE"]
[Sat Dec 27 01:37:12.685700 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:12892] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fox.php"] [unique_id "aU7HyKyYgLfR4YwO7bx4FQAAARg"]
[Sat Dec 27 01:37:13.036735 2025] [:error] [pid 47566:tid 47586] [client 4.213.20.183:6041] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function/function.php"] [unique_id "aU7HyayYgLfR4YwO7bx4FwAAARE"]
[Sat Dec 27 01:37:13.361401 2025] [:error] [pid 34189:tid 34250] [client 4.213.20.183:6111] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function/function.php"] [unique_id "aU7HyQnn007DnMwSsfckBwAAAIM"]
[Sat Dec 27 01:37:13.684809 2025] [:error] [pid 47566:tid 47571] [client 4.213.20.183:6025] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function/function.php"] [unique_id "aU7HyayYgLfR4YwO7bx4GgAAAQI"]
[Sat Dec 27 01:37:13.981464 2025] [:error] [pid 34189:tid 34260] [client 4.213.20.183:6137] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function/function.php"] [unique_id "aU7HyQnn007DnMwSsfckDAAAAI0"]
[Sat Dec 27 01:37:14.266415 2025] [:error] [pid 34189:tid 34254] [client 4.213.20.183:6068] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aU7Hygnn007DnMwSsfckDQAAAIc"]
[Sat Dec 27 01:37:14.743998 2025] [:error] [pid 34274:tid 34281] [client 4.213.20.183:6043] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aU7Hys6fabpS0mfhiCEIyAAAAMU"]
[Sat Dec 27 01:37:15.101755 2025] [:error] [pid 47566:tid 47587] [client 4.213.20.183:6086] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aU7Hy6yYgLfR4YwO7bx4HwAAARI"]
[Sat Dec 27 01:37:15.425872 2025] [:error] [pid 47566:tid 47576] [client 4.213.20.183:12854] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aU7Hy6yYgLfR4YwO7bx4IwAAAQc"]
[Sat Dec 27 01:37:15.721369 2025] [:error] [pid 47566:tid 47578] [client 4.213.20.183:6059] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU7Hy6yYgLfR4YwO7bx4JwAAAQk"]
[Sat Dec 27 01:37:16.021192 2025] [:error] [pid 34274:tid 34276] [client 4.213.20.183:6101] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU7HzM6fabpS0mfhiCEIygAAAMA"]
[Sat Dec 27 01:37:16.344845 2025] [:error] [pid 34274:tid 34293] [client 4.213.20.183:12846] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU7HzM6fabpS0mfhiCEIywAAANE"]
[Sat Dec 27 01:37:16.765011 2025] [:error] [pid 34188:tid 34237] [client 4.213.20.183:6099] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aU7HzA54j0mXgip5BAGm_AAAAFE"]
[Sat Dec 27 01:37:17.183037 2025] [:error] [pid 34189:tid 34262] [client 4.213.20.183:6080] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "aU7HzQnn007DnMwSsfckEgAAAI8"]
[Sat Dec 27 01:37:17.587705 2025] [:error] [pid 34274:tid 34282] [client 4.213.20.183:6030] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "aU7Hzc6fabpS0mfhiCEIzgAAAMY"]
[Sat Dec 27 01:37:17.901863 2025] [:error] [pid 47566:tid 47591] [client 4.213.20.183:6142] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "aU7HzayYgLfR4YwO7bx4KgAAARY"]
[Sat Dec 27 01:37:18.185284 2025] [:error] [pid 34187:tid 34210] [client 4.213.20.183:12857] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "aU7Hzqv8srZGEpsIm8D1OAAAABI"]
[Sat Dec 27 01:37:18.499084 2025] [:error] [pid 47566:tid 47579] [client 4.213.20.183:6018] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "aU7HzqyYgLfR4YwO7bx4LAAAAQo"]
[Sat Dec 27 01:37:18.833849 2025] [:error] [pid 34274:tid 34280] [client 4.213.20.183:6053] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "aU7Hzs6fabpS0mfhiCEI0AAAAMQ"]
[Sat Dec 27 01:37:19.228286 2025] [:error] [pid 34274:tid 34296] [client 4.213.20.183:6113] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "aU7Hz86fabpS0mfhiCEI0QAAANQ"]
[Sat Dec 27 01:37:19.506069 2025] [:error] [pid 34188:tid 34224] [client 4.213.20.183:12855] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "aU7Hzw54j0mXgip5BAGm_gAAAEQ"]
[Sat Dec 27 01:37:19.796834 2025] [:error] [pid 34188:tid 34227] [client 4.213.20.183:12856] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU7Hzw54j0mXgip5BAGnAAAAAEc"]
[Sat Dec 27 01:37:20.090256 2025] [:error] [pid 34189:tid 34250] [client 4.213.20.183:6112] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU7H0Ann007DnMwSsfckFgAAAIM"]
[Sat Dec 27 01:37:20.387085 2025] [:error] [pid 34188:tid 34226] [client 4.213.20.183:6110] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU7H0A54j0mXgip5BAGnAgAAAEY"]
[Sat Dec 27 01:37:20.668242 2025] [:error] [pid 47566:tid 47592] [client 4.213.20.183:12917] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aU7H0KyYgLfR4YwO7bx4LQAAARc"]
[Sat Dec 27 01:37:21.081965 2025] [:error] [pid 34188:tid 34228] [client 4.213.20.183:6079] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aU7H0Q54j0mXgip5BAGnAwAAAEg"]
[Sat Dec 27 01:37:21.642655 2025] [:error] [pid 34274:tid 34279] [client 4.213.20.183:12869] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aU7H0c6fabpS0mfhiCEI0wAAAMM"]
[Sat Dec 27 01:37:21.997828 2025] [:error] [pid 34189:tid 34248] [client 4.213.20.183:6083] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aU7H0Qnn007DnMwSsfckGgAAAIE"]
[Sat Dec 27 01:37:22.661956 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:12876] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aU7H0qyYgLfR4YwO7bx4MAAAARg"]
[Sat Dec 27 01:37:22.991173 2025] [:error] [pid 34189:tid 34255] [client 4.213.20.183:6024] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aU7H0gnn007DnMwSsfckGwAAAIg"]
[Sat Dec 27 01:37:23.644355 2025] [:error] [pid 34274:tid 34299] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Dec 27 01:37:23.784384 2025] [:error] [pid 34274:tid 34276] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Sat Dec 27 01:37:24.548773 2025] [:error] [pid 34274:tid 34277] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sat Dec 27 01:37:24.699851 2025] [:error] [pid 34274:tid 34290] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/index.bak.php
[Sat Dec 27 01:37:25.036261 2025] [:error] [pid 34274:tid 34285] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Dec 27 01:37:25.197599 2025] [:error] [pid 34274:tid 34288] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sat Dec 27 01:37:25.360210 2025] [:error] [pid 34274:tid 34286] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Dec 27 01:37:25.559848 2025] [:error] [pid 34274:tid 34292] [client 4.213.20.183:6093] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Sat Dec 27 01:37:25.714778 2025] [:error] [pid 34274:tid 34278] [client 4.213.20.183:6093] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aU7H1c6fabpS0mfhiCEI4AAAAMI"]
[Sat Dec 27 01:37:26.057936 2025] [:error] [pid 34274:tid 34283] [client 4.213.20.183:6055] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aU7H1s6fabpS0mfhiCEI4QAAAMc"]
[Sat Dec 27 01:37:26.506859 2025] [:error] [pid 34188:tid 34236] [client 4.213.20.183:6031] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aU7H1g54j0mXgip5BAGnCwAAAFA"]
[Sat Dec 27 01:37:27.093913 2025] [:error] [pid 34188:tid 34234] [client 4.213.20.183:6063] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aU7H1w54j0mXgip5BAGnDQAAAE4"]
[Sat Dec 27 01:37:27.502789 2025] [:error] [pid 47566:tid 47576] [client 4.213.20.183:6091] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini"] [unique_id "aU7H16yYgLfR4YwO7bx4OQAAAQc"]
[Sat Dec 27 01:37:27.967000 2025] [:error] [pid 34188:tid 34230] [client 4.213.20.183:6016] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini"] [unique_id "aU7H1w54j0mXgip5BAGnDwAAAEo"]
[Sat Dec 27 01:37:28.524241 2025] [:error] [pid 34188:tid 34228] [client 4.213.20.183:6033] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini"] [unique_id "aU7H2A54j0mXgip5BAGnEAAAAEg"]
[Sat Dec 27 01:37:30.296923 2025] [:error] [pid 34274:tid 34289] [client 4.213.20.183:6108] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini"] [unique_id "aU7H2s6fabpS0mfhiCEI5gAAAM0"]
[Sat Dec 27 01:37:31.213670 2025] [:error] [pid 34188:tid 34242] [client 4.213.20.183:6122] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aU7H2w54j0mXgip5BAGnIwAAAFY"]
[Sat Dec 27 01:37:32.519471 2025] [:error] [pid 34274:tid 34282] [client 4.213.20.183:6062] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aU7H3M6fabpS0mfhiCEI7gAAAMY"]
[Sat Dec 27 01:37:33.864359 2025] [:error] [pid 47566:tid 47585] [client 4.213.20.183:6114] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aU7H3ayYgLfR4YwO7bx4SgAAARA"]
[Sat Dec 27 01:37:34.825195 2025] [:error] [pid 34188:tid 34237] [client 4.213.20.183:6124] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aU7H3g54j0mXgip5BAGnMwAAAFE"]
[Sat Dec 27 01:37:35.330965 2025] [:error] [pid 34189:tid 34261] [client 4.213.20.183:6116] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mm.php"] [unique_id "aU7H3wnn007DnMwSsfckQAAAAI4"]
[Sat Dec 27 01:37:36.094222 2025] [:error] [pid 34274:tid 34281] [client 4.213.20.183:6136] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mm.php"] [unique_id "aU7H4M6fabpS0mfhiCEI-gAAAMU"]
[Sat Dec 27 01:37:36.431644 2025] [:error] [pid 34189:tid 34257] [client 4.213.20.183:6048] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mm.php"] [unique_id "aU7H4Ann007DnMwSsfckQwAAAIo"]
[Sat Dec 27 01:37:36.795635 2025] [:error] [pid 34188:tid 34234] [client 4.213.20.183:6107] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mm.php"] [unique_id "aU7H4A54j0mXgip5BAGnPQAAAE4"]
[Sat Dec 27 01:37:37.143249 2025] [:error] [pid 34189:tid 34271] [client 4.213.20.183:6028] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aU7H4Qnn007DnMwSsfckRwAAAJg"]
[Sat Dec 27 01:37:37.480467 2025] [:error] [pid 34274:tid 34286] [client 4.213.20.183:6029] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aU7H4c6fabpS0mfhiCEJAAAAAMo"]
[Sat Dec 27 01:37:37.903383 2025] [:error] [pid 34274:tid 34296] [client 4.213.20.183:6084] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aU7H4c6fabpS0mfhiCEJAwAAANQ"]
[Sat Dec 27 01:37:38.336978 2025] [:error] [pid 34274:tid 34289] [client 4.213.20.183:6021] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aU7H4s6fabpS0mfhiCEJCQAAAM0"]
[Sat Dec 27 01:37:38.741127 2025] [:error] [pid 34274:tid 34284] [client 4.213.20.183:6118] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-themes.php"] [unique_id "aU7H4s6fabpS0mfhiCEJDAAAAMg"]
[Sat Dec 27 01:37:39.117780 2025] [:error] [pid 34274:tid 34290] [client 4.213.20.183:6066] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-themes.php"] [unique_id "aU7H486fabpS0mfhiCEJEAAAAM4"]
[Sat Dec 27 01:37:39.466275 2025] [:error] [pid 34274:tid 34286] [client 4.213.20.183:6125] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-themes.php"] [unique_id "aU7H486fabpS0mfhiCEJEwAAAMo"]
[Sat Dec 27 01:37:39.807387 2025] [:error] [pid 34189:tid 34259] [client 4.213.20.183:5982] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-themes.php"] [unique_id "aU7H4wnn007DnMwSsfckTAAAAIw"]
[Sat Dec 27 01:37:40.096963 2025] [:error] [pid 34189:tid 34269] [client 4.213.20.183:6050] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-reading.php"] [unique_id "aU7H5Ann007DnMwSsfckTgAAAJY"]
[Sat Dec 27 01:37:40.470768 2025] [:error] [pid 47566:tid 47578] [client 4.213.20.183:12863] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-reading.php"] [unique_id "aU7H5KyYgLfR4YwO7bx4TAAAAQk"]
[Sat Dec 27 01:37:40.770993 2025] [:error] [pid 34274:tid 34292] [client 4.213.20.183:5981] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-reading.php"] [unique_id "aU7H5M6fabpS0mfhiCEJGAAAANA"]
[Sat Dec 27 01:37:41.215892 2025] [:error] [pid 47566:tid 47589] [client 4.213.20.183:6121] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-reading.php"] [unique_id "aU7H5ayYgLfR4YwO7bx4TgAAARQ"]
[Sat Dec 27 01:37:41.518313 2025] [:error] [pid 34189:tid 34253] [client 4.213.20.183:6074] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-writing.php"] [unique_id "aU7H5Qnn007DnMwSsfckUQAAAIY"]
[Sat Dec 27 01:37:41.816026 2025] [:error] [pid 34187:tid 34199] [client 4.213.20.183:12850] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-writing.php"] [unique_id "aU7H5av8srZGEpsIm8D1VAAAAAc"]
[Sat Dec 27 01:37:42.213143 2025] [:error] [pid 34189:tid 34265] [client 4.213.20.183:6057] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-writing.php"] [unique_id "aU7H5gnn007DnMwSsfckUwAAAJI"]
[Sat Dec 27 01:37:42.540070 2025] [:error] [pid 34189:tid 34267] [client 4.213.20.183:12838] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-writing.php"] [unique_id "aU7H5gnn007DnMwSsfckVQAAAJQ"]
[Sat Dec 27 01:37:42.931941 2025] [:error] [pid 47566:tid 47582] [client 4.213.20.183:6143] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "aU7H5qyYgLfR4YwO7bx4UwAAAQ0"]
[Sat Dec 27 01:37:43.337651 2025] [:error] [pid 34189:tid 34254] [client 4.213.20.183:6054] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "aU7H5wnn007DnMwSsfckWAAAAIc"]
[Sat Dec 27 01:37:43.692336 2025] [:error] [pid 47566:tid 47571] [client 4.213.20.183:12861] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "aU7H56yYgLfR4YwO7bx4VwAAAQI"]
[Sat Dec 27 01:37:44.089162 2025] [:error] [pid 34188:tid 34229] [client 4.213.20.183:6032] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "aU7H6A54j0mXgip5BAGnSAAAAEk"]
[Sat Dec 27 01:37:44.618469 2025] [:error] [pid 34188:tid 34225] [client 4.213.20.183:6103] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aU7H6A54j0mXgip5BAGnSgAAAEU"]
[Sat Dec 27 01:37:44.969896 2025] [:error] [pid 47566:tid 47590] [client 4.213.20.183:6123] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aU7H6KyYgLfR4YwO7bx4XgAAARU"]
[Sat Dec 27 01:37:45.264864 2025] [:error] [pid 47566:tid 47583] [client 4.213.20.183:5961] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aU7H6ayYgLfR4YwO7bx4YQAAAQ4"]
[Sat Dec 27 01:37:45.625407 2025] [:error] [pid 47566:tid 47570] [client 4.213.20.183:6071] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aU7H6ayYgLfR4YwO7bx4ZgAAAQE"]
[Sat Dec 27 01:37:46.016398 2025] [:error] [pid 34188:tid 34223] [client 4.213.20.183:6039] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-config-sample.php"] [unique_id "aU7H6g54j0mXgip5BAGnTAAAAEM"]
[Sat Dec 27 01:37:46.514462 2025] [:error] [pid 34189:tid 34248] [client 4.213.20.183:12866] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-config-sample.php"] [unique_id "aU7H6gnn007DnMwSsfckXAAAAIE"]
[Sat Dec 27 01:37:46.862627 2025] [:error] [pid 34189:tid 34269] [client 4.213.20.183:5964] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-config-sample.php"] [unique_id "aU7H6gnn007DnMwSsfckXgAAAJY"]
[Sat Dec 27 01:37:47.144008 2025] [:error] [pid 47566:tid 47580] [client 4.213.20.183:5966] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-config-sample.php"] [unique_id "aU7H66yYgLfR4YwO7bx4bQAAAQs"]
[Sat Dec 27 01:37:47.615831 2025] [:error] [pid 34274:tid 34280] [client 4.213.20.183:12832] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activat.php"] [unique_id "aU7H686fabpS0mfhiCEJJwAAAMQ"]
[Sat Dec 27 01:37:47.928994 2025] [:error] [pid 34188:tid 34242] [client 4.213.20.183:5995] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activat.php"] [unique_id "aU7H6w54j0mXgip5BAGnUAAAAFY"]
[Sat Dec 27 01:37:48.315620 2025] [:error] [pid 34274:tid 34294] [client 4.213.20.183:5983] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activat.php"] [unique_id "aU7H7M6fabpS0mfhiCEJKQAAANI"]
[Sat Dec 27 01:37:48.672370 2025] [:error] [pid 47566:tid 47583] [client 4.213.20.183:6128] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activat.php"] [unique_id "aU7H7KyYgLfR4YwO7bx4bwAAAQ4"]
[Sat Dec 27 01:37:48.970343 2025] [:error] [pid 34188:tid 34239] [client 4.213.20.183:6141] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pages.php"] [unique_id "aU7H7A54j0mXgip5BAGnUwAAAFM"]
[Sat Dec 27 01:37:49.296335 2025] [:error] [pid 34187:tid 34205] [client 4.213.20.183:12828] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pages.php"] [unique_id "aU7H7av8srZGEpsIm8D1XgAAAA0"]
[Sat Dec 27 01:37:49.608784 2025] [:error] [pid 34187:tid 34193] [client 4.213.20.183:5975] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pages.php"] [unique_id "aU7H7av8srZGEpsIm8D1YAAAAAE"]
[Sat Dec 27 01:37:49.919675 2025] [:error] [pid 34188:tid 34241] [client 4.213.20.183:6104] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pages.php"] [unique_id "aU7H7Q54j0mXgip5BAGnWwAAAFU"]
[Sat Dec 27 01:37:50.288416 2025] [:error] [pid 34274:tid 34288] [client 4.213.20.183:6046] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU7H7s6fabpS0mfhiCEJMgAAAMw"]
[Sat Dec 27 01:37:50.608222 2025] [:error] [pid 34188:tid 34228] [client 4.213.20.183:5986] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU7H7g54j0mXgip5BAGnXQAAAEg"]
[Sat Dec 27 01:37:50.925468 2025] [:error] [pid 47566:tid 47575] [client 4.213.20.183:6129] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU7H7qyYgLfR4YwO7bx4dAAAAQY"]
[Sat Dec 27 01:37:51.216753 2025] [:error] [pid 34188:tid 34226] [client 4.213.20.183:5985] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aU7H7w54j0mXgip5BAGnXgAAAEY"]
[Sat Dec 27 01:37:51.515000 2025] [:error] [pid 34188:tid 34223] [client 4.213.20.183:5979] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nf.php"] [unique_id "aU7H7w54j0mXgip5BAGnXwAAAEM"]
[Sat Dec 27 01:37:51.805043 2025] [:error] [pid 34187:tid 34200] [client 4.213.20.183:5970] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nf.php"] [unique_id "aU7H76v8srZGEpsIm8D1ZQAAAAg"]
[Sat Dec 27 01:37:52.093148 2025] [:error] [pid 34187:tid 34199] [client 4.213.20.183:6135] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nf.php"] [unique_id "aU7H8Kv8srZGEpsIm8D1aAAAAAc"]
[Sat Dec 27 01:37:52.414274 2025] [:error] [pid 34189:tid 34265] [client 4.213.20.183:5891] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nf.php"] [unique_id "aU7H8Ann007DnMwSsfckZAAAAJI"]
[Sat Dec 27 01:37:52.754026 2025] [:error] [pid 34189:tid 34260] [client 4.213.20.183:12837] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aU7H8Ann007DnMwSsfckZwAAAI0"]
[Sat Dec 27 01:37:53.049646 2025] [:error] [pid 34189:tid 34257] [client 4.213.20.183:5965] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aU7H8Qnn007DnMwSsfckaAAAAIo"]
[Sat Dec 27 01:37:53.385804 2025] [:error] [pid 34188:tid 34238] [client 4.213.20.183:5852] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aU7H8Q54j0mXgip5BAGnZAAAAFI"]
[Sat Dec 27 01:37:53.694774 2025] [:error] [pid 34188:tid 34222] [client 4.213.20.183:6056] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aU7H8Q54j0mXgip5BAGnZQAAAEI"]
[Sat Dec 27 01:37:54.045769 2025] [:error] [pid 34274:tid 34281] [client 4.213.20.183:6060] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aU7H8s6fabpS0mfhiCEJOQAAAMU"]
[Sat Dec 27 01:37:54.416281 2025] [:error] [pid 34274:tid 34299] [client 4.213.20.183:12849] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aU7H8s6fabpS0mfhiCEJPQAAANc"]
[Sat Dec 27 01:37:54.807740 2025] [:error] [pid 34189:tid 34271] [client 4.213.20.183:5973] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aU7H8gnn007DnMwSsfckagAAAJg"]
[Sat Dec 27 01:37:55.164306 2025] [:error] [pid 34187:tid 34205] [client 4.213.20.183:12903] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aU7H86v8srZGEpsIm8D1bwAAAA0"]
[Sat Dec 27 01:37:55.546416 2025] [:error] [pid 34187:tid 34194] [client 4.213.20.183:12843] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aU7H86v8srZGEpsIm8D1cAAAAAI"]
[Sat Dec 27 01:37:55.862202 2025] [:error] [pid 34188:tid 34232] [client 4.213.20.183:5957] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aU7H8w54j0mXgip5BAGnaAAAAEw"]
[Sat Dec 27 01:37:56.266232 2025] [:error] [pid 34188:tid 34220] [client 4.213.20.183:6034] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aU7H9A54j0mXgip5BAGnaQAAAEA"]
[Sat Dec 27 01:37:56.594247 2025] [:error] [pid 47566:tid 47588] [client 4.213.20.183:6089] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aU7H9KyYgLfR4YwO7bx4gQAAARM"]
[Sat Dec 27 01:37:56.880729 2025] [:error] [pid 47566:tid 47589] [client 4.213.20.183:5997] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aU7H9KyYgLfR4YwO7bx4gwAAARQ"]
[Sat Dec 27 01:37:57.212231 2025] [:error] [pid 34274:tid 34279] [client 4.213.20.183:5956] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aU7H9c6fabpS0mfhiCEJRAAAAMM"]
[Sat Dec 27 01:37:57.582992 2025] [:error] [pid 34274:tid 34285] [client 4.213.20.183:6026] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aU7H9c6fabpS0mfhiCEJRQAAAMk"]
[Sat Dec 27 01:37:57.906957 2025] [:error] [pid 34189:tid 34259] [client 4.213.20.183:5908] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aU7H9Qnn007DnMwSsfckbwAAAIw"]
[Sat Dec 27 01:37:58.190792 2025] [:error] [pid 47566:tid 47572] [client 4.213.20.183:5901] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "aU7H9qyYgLfR4YwO7bx4hgAAAQM"]
[Sat Dec 27 01:37:58.527619 2025] [:error] [pid 34274:tid 34300] [client 4.213.20.183:5952] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "aU7H9s6fabpS0mfhiCEJRgAAANg"]
[Sat Dec 27 01:37:58.838246 2025] [:error] [pid 34188:tid 34222] [client 4.213.20.183:6134] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "aU7H9g54j0mXgip5BAGndgAAAEI"]
[Sat Dec 27 01:37:59.126685 2025] [:error] [pid 34187:tid 34207] [client 4.213.20.183:12858] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "aU7H96v8srZGEpsIm8D1dAAAAA8"]
[Sat Dec 27 01:37:59.415768 2025] [:error] [pid 47566:tid 47580] [client 4.213.20.183:6036] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aU7H96yYgLfR4YwO7bx4iwAAAQs"]
[Sat Dec 27 01:37:59.815740 2025] [:error] [pid 34274:tid 34289] [client 4.213.20.183:5977] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aU7H986fabpS0mfhiCEJSAAAAM0"]
[Sat Dec 27 01:38:00.195197 2025] [:error] [pid 34188:tid 34220] [client 4.213.20.183:5988] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aU7H-A54j0mXgip5BAGneQAAAEA"]
[Sat Dec 27 01:38:00.558429 2025] [:error] [pid 34274:tid 34276] [client 4.213.20.183:12915] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "aU7H-M6fabpS0mfhiCEJSwAAAMA"]
[Sat Dec 27 01:38:00.872799 2025] [:error] [pid 47566:tid 47584] [client 4.213.20.183:5996] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aU7H-KyYgLfR4YwO7bx4kAAAAQ8"]
[Sat Dec 27 01:38:01.160998 2025] [:error] [pid 34189:tid 34270] [client 4.213.20.183:6052] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aU7H-Qnn007DnMwSsfckcgAAAJc"]
[Sat Dec 27 01:38:01.469739 2025] [:error] [pid 34189:tid 34252] [client 4.213.20.183:5953] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aU7H-Qnn007DnMwSsfckdAAAAIU"]
[Sat Dec 27 01:38:01.786599 2025] [:error] [pid 34188:tid 34234] [client 4.213.20.183:12882] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aU7H-Q54j0mXgip5BAGnfgAAAE4"]
[Sat Dec 27 01:38:02.127698 2025] [:error] [pid 34188:tid 34228] [client 4.213.20.183:6109] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aU7H-g54j0mXgip5BAGngAAAAEg"]
[Sat Dec 27 01:38:02.454217 2025] [:error] [pid 34188:tid 34226] [client 4.213.20.183:5937] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aU7H-g54j0mXgip5BAGnggAAAEY"]
[Sat Dec 27 01:38:02.905697 2025] [:error] [pid 34188:tid 34237] [client 4.213.20.183:5824] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aU7H-g54j0mXgip5BAGnhQAAAFE"]
[Sat Dec 27 01:38:03.272087 2025] [:error] [pid 34274:tid 34296] [client 4.213.20.183:5967] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aU7H-86fabpS0mfhiCEJUwAAANQ"]
[Sat Dec 27 01:38:03.572293 2025] [:error] [pid 34188:tid 34242] [client 4.213.20.183:6067] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/robots.php"] [unique_id "aU7H-w54j0mXgip5BAGnhwAAAFY"]
[Sat Dec 27 01:38:03.941094 2025] [:error] [pid 34187:tid 34201] [client 4.213.20.183:6077] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/robots.php"] [unique_id "aU7H-6v8srZGEpsIm8D1eQAAAAk"]
[Sat Dec 27 01:38:04.245802 2025] [:error] [pid 34188:tid 34221] [client 4.213.20.183:6012] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/robots.php"] [unique_id "aU7H_A54j0mXgip5BAGniQAAAEE"]
[Sat Dec 27 01:38:04.567117 2025] [:error] [pid 34188:tid 34235] [client 4.213.20.183:5998] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/robots.php"] [unique_id "aU7H_A54j0mXgip5BAGnjQAAAE8"]
[Sat Dec 27 01:38:04.895182 2025] [:error] [pid 47566:tid 47578] [client 4.213.20.183:6061] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aU7H_KyYgLfR4YwO7bx4lAAAAQk"]
[Sat Dec 27 01:38:05.224327 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:5991] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aU7H_ayYgLfR4YwO7bx4lQAAAQU"]
[Sat Dec 27 01:38:05.544408 2025] [:error] [pid 34188:tid 34229] [client 4.213.20.183:6019] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aU7H_Q54j0mXgip5BAGnjwAAAEk"]
[Sat Dec 27 01:38:05.899257 2025] [:error] [pid 47566:tid 47572] [client 4.213.20.183:5903] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aU7H_ayYgLfR4YwO7bx4lwAAAQM"]
[Sat Dec 27 01:38:06.185190 2025] [:error] [pid 47566:tid 47569] [client 4.213.20.183:5999] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function.php"] [unique_id "aU7H_qyYgLfR4YwO7bx4mwAAAQA"]
[Sat Dec 27 01:38:06.537950 2025] [:error] [pid 34189:tid 34257] [client 4.213.20.183:6058] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function.php"] [unique_id "aU7H_gnn007DnMwSsfckeAAAAIo"]
[Sat Dec 27 01:38:06.844201 2025] [:error] [pid 34188:tid 34236] [client 4.213.20.183:5917] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function.php"] [unique_id "aU7H_g54j0mXgip5BAGnkAAAAFA"]
[Sat Dec 27 01:38:07.241752 2025] [:error] [pid 47566:tid 47590] [client 4.213.20.183:5992] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function.php"] [unique_id "aU7H_6yYgLfR4YwO7bx4oQAAARU"]
[Sat Dec 27 01:38:07.700287 2025] [:error] [pid 34189:tid 34254] [client 4.213.20.183:5974] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aU7H_wnn007DnMwSsfckewAAAIc"]
[Sat Dec 27 01:38:08.079332 2025] [:error] [pid 34189:tid 34271] [client 4.213.20.183:6065] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aU7IAAnn007DnMwSsfckfAAAAJg"]
[Sat Dec 27 01:38:08.400950 2025] [:error] [pid 34188:tid 34230] [client 4.213.20.183:5960] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aU7IAA54j0mXgip5BAGnkwAAAEo"]
[Sat Dec 27 01:38:08.736064 2025] [:error] [pid 34187:tid 34215] [client 4.213.20.183:6042] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aU7IAKv8srZGEpsIm8D1kQAAABc"]
[Sat Dec 27 01:38:09.132624 2025] [:error] [pid 47566:tid 47578] [client 4.213.20.183:6007] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thoms.php"] [unique_id "aU7IAayYgLfR4YwO7bx4pQAAAQk"]
[Sat Dec 27 01:38:09.485801 2025] [:error] [pid 34187:tid 34213] [client 4.213.20.183:6070] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thoms.php"] [unique_id "aU7IAav8srZGEpsIm8D1lAAAABU"]
[Sat Dec 27 01:38:09.788714 2025] [:error] [pid 47566:tid 47585] [client 4.213.20.183:5971] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thoms.php"] [unique_id "aU7IAayYgLfR4YwO7bx4qgAAARA"]
[Sat Dec 27 01:38:10.088184 2025] [:error] [pid 34188:tid 34223] [client 4.213.20.183:6133] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thoms.php"] [unique_id "aU7IAg54j0mXgip5BAGnmAAAAEM"]
[Sat Dec 27 01:38:10.402565 2025] [:error] [pid 34189:tid 34255] [client 4.213.20.183:6131] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rt.php"] [unique_id "aU7IAgnn007DnMwSsfckgwAAAIg"]
[Sat Dec 27 01:38:10.860788 2025] [:error] [pid 34274:tid 34283] [client 4.213.20.183:6009] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rt.php"] [unique_id "aU7IAs6fabpS0mfhiCEJYQAAAMc"]
[Sat Dec 27 01:38:11.230080 2025] [:error] [pid 34187:tid 34210] [client 4.213.20.183:6119] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rt.php"] [unique_id "aU7IA6v8srZGEpsIm8D1mgAAABI"]
[Sat Dec 27 01:38:11.610852 2025] [:error] [pid 34274:tid 34285] [client 4.213.20.183:5910] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rt.php"] [unique_id "aU7IA86fabpS0mfhiCEJYwAAAMk"]
[Sat Dec 27 01:38:11.983262 2025] [:error] [pid 47566:tid 47583] [client 4.213.20.183:6138] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU7IA6yYgLfR4YwO7bx4tQAAAQ4"]
[Sat Dec 27 01:38:12.344294 2025] [:error] [pid 34189:tid 34262] [client 4.213.20.183:6072] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU7IBAnn007DnMwSsfckiQAAAI8"]
[Sat Dec 27 01:38:12.653691 2025] [:error] [pid 34187:tid 34207] [client 4.213.20.183:5915] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU7IBKv8srZGEpsIm8D1nAAAAA8"]
[Sat Dec 27 01:38:12.962645 2025] [:error] [pid 34274:tid 34289] [client 4.213.20.183:5978] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aU7IBM6fabpS0mfhiCEJZwAAAM0"]
[Sat Dec 27 01:38:13.349826 2025] [:error] [pid 34274:tid 34276] [client 4.213.20.183:6022] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/setup.php"] [unique_id "aU7IBc6fabpS0mfhiCEJaQAAAMA"]
[Sat Dec 27 01:38:13.646454 2025] [:error] [pid 34188:tid 34229] [client 4.213.20.183:5955] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/setup.php"] [unique_id "aU7IBQ54j0mXgip5BAGnoQAAAEk"]
[Sat Dec 27 01:38:13.955719 2025] [:error] [pid 34188:tid 34236] [client 4.213.20.183:6002] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/setup.php"] [unique_id "aU7IBQ54j0mXgip5BAGnowAAAFA"]
[Sat Dec 27 01:38:14.256733 2025] [:error] [pid 34187:tid 34211] [client 4.213.20.183:6013] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/setup.php"] [unique_id "aU7IBqv8srZGEpsIm8D1oQAAABM"]
[Sat Dec 27 01:38:14.596703 2025] [:error] [pid 47566:tid 47573] [client 4.213.20.183:6081] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU7IBqyYgLfR4YwO7bx4vAAAAQQ"]
[Sat Dec 27 01:38:14.907692 2025] [:error] [pid 47566:tid 47579] [client 4.213.20.183:6001] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU7IBqyYgLfR4YwO7bx4vwAAAQo"]
[Sat Dec 27 01:38:15.246674 2025] [:error] [pid 34274:tid 34277] [client 4.213.20.183:5893] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU7IB86fabpS0mfhiCEJcAAAAME"]
[Sat Dec 27 01:38:15.585315 2025] [:error] [pid 34189:tid 34256] [client 4.213.20.183:5980] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aU7IBwnn007DnMwSsfckkgAAAIk"]
[Sat Dec 27 01:38:15.954225 2025] [:error] [pid 34274:tid 34288] [client 4.213.20.183:6064] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "aU7IB86fabpS0mfhiCEJcgAAAMw"]
[Sat Dec 27 01:38:16.363008 2025] [:error] [pid 34274:tid 34296] [client 4.213.20.183:5909] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "aU7ICM6fabpS0mfhiCEJcwAAANQ"]
[Sat Dec 27 01:38:16.687272 2025] [:error] [pid 47566:tid 47586] [client 4.213.20.183:5829] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "aU7ICKyYgLfR4YwO7bx4xQAAARE"]
[Sat Dec 27 01:38:17.012218 2025] [:error] [pid 34188:tid 34240] [client 4.213.20.183:5892] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "aU7ICQ54j0mXgip5BAGnqAAAAFQ"]
[Sat Dec 27 01:38:17.398248 2025] [:error] [pid 47566:tid 47587] [client 4.213.20.183:6117] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aU7ICayYgLfR4YwO7bx4yAAAARI"]
[Sat Dec 27 01:38:17.718700 2025] [:error] [pid 34189:tid 34249] [client 4.213.20.183:6078] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aU7ICQnn007DnMwSsfcklwAAAII"]
[Sat Dec 27 01:38:18.049676 2025] [:error] [pid 34188:tid 34242] [client 4.213.20.183:6015] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aU7ICg54j0mXgip5BAGnqgAAAFY"]
[Sat Dec 27 01:38:18.436251 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:5907] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aU7ICqyYgLfR4YwO7bx4zAAAARg"]
[Sat Dec 27 01:38:18.767244 2025] [:error] [pid 34189:tid 34252] [client 4.213.20.183:5958] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU7ICgnn007DnMwSsfckmwAAAIU"]
[Sat Dec 27 01:38:19.067359 2025] [:error] [pid 34189:tid 34265] [client 4.213.20.183:5972] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU7ICwnn007DnMwSsfckngAAAJI"]
[Sat Dec 27 01:38:19.359822 2025] [:error] [pid 34189:tid 34271] [client 4.213.20.183:5902] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU7ICwnn007DnMwSsfckoQAAAJg"]
[Sat Dec 27 01:38:19.692881 2025] [:error] [pid 34189:tid 34263] [client 4.213.20.183:12848] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "aU7ICwnn007DnMwSsfckpAAAAJA"]
[Sat Dec 27 01:38:19.992924 2025] [:error] [pid 34189:tid 34249] [client 4.213.20.183:5993] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file/function.php"] [unique_id "aU7ICwnn007DnMwSsfckpwAAAII"]
[Sat Dec 27 01:38:20.293281 2025] [:error] [pid 34188:tid 34244] [client 4.213.20.183:5946] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file/function.php"] [unique_id "aU7IDA54j0mXgip5BAGnrgAAAFg"]
[Sat Dec 27 01:38:20.570384 2025] [:error] [pid 34189:tid 34270] [client 4.213.20.183:6004] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file/function.php"] [unique_id "aU7IDAnn007DnMwSsfckrQAAAJc"]
[Sat Dec 27 01:38:20.882589 2025] [:error] [pid 34187:tid 34202] [client 4.213.20.183:6075] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file/function.php"] [unique_id "aU7IDKv8srZGEpsIm8D1sQAAAAo"]
[Sat Dec 27 01:38:21.168029 2025] [:error] [pid 34274:tid 34289] [client 4.213.20.183:6069] [client 4.213.20.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aU7IDc6fabpS0mfhiCEJfAAAAM0"]
[Sat Dec 27 01:38:21.479775 2025] [:error] [pid 34189:tid 34267] [client 4.213.20.183:6102] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aU7IDQnn007DnMwSsfckrwAAAJQ"]
[Sat Dec 27 01:38:21.778773 2025] [:error] [pid 34187:tid 34192] [client 4.213.20.183:6008] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aU7IDav8srZGEpsIm8D1swAAAAA"]
[Sat Dec 27 01:38:22.201603 2025] [:error] [pid 34274:tid 34290] [client 4.213.20.183:5987] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aU7IDs6fabpS0mfhiCEJggAAAM4"]
[Sat Dec 27 01:38:22.514230 2025] [:error] [pid 47566:tid 47579] [client 4.213.20.183:5919] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aU7IDqyYgLfR4YwO7bx41AAAAQo"]
[Sat Dec 27 01:38:22.833349 2025] [:error] [pid 47566:tid 47576] [client 4.213.20.183:5834] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aU7IDqyYgLfR4YwO7bx41gAAAQc"]
[Sat Dec 27 01:38:23.198083 2025] [:error] [pid 47566:tid 47586] [client 4.213.20.183:5894] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aU7ID6yYgLfR4YwO7bx42gAAARE"]
[Sat Dec 27 01:38:23.501726 2025] [:error] [pid 34274:tid 34282] [client 4.213.20.183:5889] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aU7ID86fabpS0mfhiCEJhAAAAMY"]
[Sat Dec 27 01:38:23.848591 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:5904] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aU7ID6yYgLfR4YwO7bx44AAAARg"]
[Sat Dec 27 01:38:24.138785 2025] [:error] [pid 34188:tid 34229] [client 4.213.20.183:5984] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aU7IEA54j0mXgip5BAGntAAAAEk"]
[Sat Dec 27 01:38:24.481757 2025] [:error] [pid 47566:tid 47570] [client 4.213.20.183:6139] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aU7IEKyYgLfR4YwO7bx44wAAAQE"]
[Sat Dec 27 01:38:24.831532 2025] [:error] [pid 34187:tid 34195] [client 4.213.20.183:6038] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aU7IEKv8srZGEpsIm8D1uQAAAAM"]
[Sat Dec 27 01:38:25.150760 2025] [:error] [pid 34274:tid 34288] [client 4.213.20.183:5976] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Dec 27 01:38:25.297732 2025] [:error] [pid 34274:tid 34296] [client 4.213.20.183:5976] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aa.php
[Sat Dec 27 01:38:25.447564 2025] [:error] [pid 34274:tid 34284] [client 4.213.20.183:5976] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sat Dec 27 01:38:25.735053 2025] [:error] [pid 34274:tid 34287] [client 4.213.20.183:5976] [client 4.213.20.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.213.20.183, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aU7IEc6fabpS0mfhiCEJiwAAAMs"]
[Sat Dec 27 01:38:26.738490 2025] [:error] [pid 34274:tid 34292] [client 4.213.20.183:5976] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7IEs6fabpS0mfhiCEJlgAAANA"]
[Sat Dec 27 01:38:27.086438 2025] [:error] [pid 34189:tid 34269] [client 4.213.20.183:5936] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7IEwnn007DnMwSsfcktwAAAJY"]
[Sat Dec 27 01:38:27.417153 2025] [:error] [pid 34274:tid 34286] [client 4.213.20.183:5865] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7IE86fabpS0mfhiCEJmAAAAMo"]
[Sat Dec 27 01:38:27.741615 2025] [:error] [pid 47566:tid 47591] [client 4.213.20.183:5945] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-admins.php"] [unique_id "aU7IE6yYgLfR4YwO7bx4-wAAARY"]
[Sat Dec 27 01:38:28.062450 2025] [:error] [pid 47566:tid 47590] [client 4.213.20.183:5905] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7IFKyYgLfR4YwO7bx5AQAAARU"]
[Sat Dec 27 01:38:28.404465 2025] [:error] [pid 34187:tid 34213] [client 4.213.20.183:5847] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7IFKv8srZGEpsIm8D1vAAAABU"]
[Sat Dec 27 01:38:28.684909 2025] [:error] [pid 47566:tid 47572] [client 4.213.20.183:5926] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7IFKyYgLfR4YwO7bx5CQAAAQM"]
[Sat Dec 27 01:38:29.129087 2025] [:error] [pid 47566:tid 47576] [client 4.213.20.183:5959] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aU7IFayYgLfR4YwO7bx5DwAAAQc"]
[Sat Dec 27 01:38:29.421679 2025] [:error] [pid 34187:tid 34205] [client 4.213.20.183:5922] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7IFav8srZGEpsIm8D1vwAAAA0"]
[Sat Dec 27 01:38:29.724886 2025] [:error] [pid 34188:tid 34231] [client 4.213.20.183:5944] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7IFQ54j0mXgip5BAGnwwAAAEs"]
[Sat Dec 27 01:38:30.000768 2025] [:error] [pid 47566:tid 47592] [client 4.213.20.183:5899] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7IFayYgLfR4YwO7bx5FAAAARc"]
[Sat Dec 27 01:38:30.328121 2025] [:error] [pid 47566:tid 47593] [client 4.213.20.183:5969] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp.php"] [unique_id "aU7IFqyYgLfR4YwO7bx5FQAAARg"]
[Sat Dec 27 01:38:30.632753 2025] [:error] [pid 47566:tid 47583] [client 4.213.20.183:5827] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aU7IFqyYgLfR4YwO7bx5GgAAAQ4"]
[Sat Dec 27 01:38:30.934639 2025] [:error] [pid 34187:tid 34204] [client 4.213.20.183:5968] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aU7IFqv8srZGEpsIm8D1xAAAAAw"]
[Sat Dec 27 01:38:31.232659 2025] [:error] [pid 34188:tid 34227] [client 4.213.20.183:6023] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aU7IFw54j0mXgip5BAGnxwAAAEc"]
[Sat Dec 27 01:38:31.531633 2025] [:error] [pid 34188:tid 34236] [client 4.213.20.183:5929] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aU7IFw54j0mXgip5BAGnyQAAAFA"]
[Sat Dec 27 01:38:31.833786 2025] [:error] [pid 47566:tid 47588] [client 4.213.20.183:5911] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-api.php"] [unique_id "aU7IF6yYgLfR4YwO7bx5IQAAARM"]
[Sat Dec 27 01:38:32.128730 2025] [:error] [pid 34274:tid 34285] [client 4.213.20.183:5942] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-api.php"] [unique_id "aU7IGM6fabpS0mfhiCEJngAAAMk"]
[Sat Dec 27 01:38:32.427011 2025] [:error] [pid 34187:tid 34210] [client 4.213.20.183:5916] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-api.php"] [unique_id "aU7IGKv8srZGEpsIm8D1ywAAABI"]
[Sat Dec 27 01:38:32.736897 2025] [:error] [pid 34187:tid 34213] [client 4.213.20.183:5925] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-api.php"] [unique_id "aU7IGKv8srZGEpsIm8D10AAAABU"]
[Sat Dec 27 01:38:33.052976 2025] [:error] [pid 34188:tid 34225] [client 4.213.20.183:5898] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments.php"] [unique_id "aU7IGQ54j0mXgip5BAGnywAAAEU"]
[Sat Dec 27 01:38:33.328635 2025] [:error] [pid 47566:tid 47584] [client 4.213.20.183:5826] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments.php"] [unique_id "aU7IGayYgLfR4YwO7bx5KwAAAQ8"]
[Sat Dec 27 01:38:33.626430 2025] [:error] [pid 34187:tid 34205] [client 4.213.20.183:5927] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments.php"] [unique_id "aU7IGav8srZGEpsIm8D10gAAAA0"]
[Sat Dec 27 01:38:33.947362 2025] [:error] [pid 34188:tid 34242] [client 4.213.20.183:5836] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments.php"] [unique_id "aU7IGQ54j0mXgip5BAGnzwAAAFY"]
[Sat Dec 27 01:38:34.249410 2025] [:error] [pid 34188:tid 34221] [client 4.213.20.183:5767] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/1.php"] [unique_id "aU7IGg54j0mXgip5BAGn0QAAAEE"]
[Sat Dec 27 01:38:34.580692 2025] [:error] [pid 34188:tid 34239] [client 4.213.20.183:5853] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/1.php"] [unique_id "aU7IGg54j0mXgip5BAGn0wAAAFM"]
[Sat Dec 27 01:38:35.027469 2025] [:error] [pid 47566:tid 47580] [client 4.213.20.183:5918] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/1.php"] [unique_id "aU7IG6yYgLfR4YwO7bx5OwAAAQs"]
[Sat Dec 27 01:38:35.489341 2025] [:error] [pid 34187:tid 34199] [client 4.213.20.183:5912] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/1.php"] [unique_id "aU7IG6v8srZGEpsIm8D12AAAAAc"]
[Sat Dec 27 01:38:35.814957 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:5920] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7IG6yYgLfR4YwO7bx5QQAAAQU"]
[Sat Dec 27 01:38:36.137261 2025] [:error] [pid 34274:tid 34289] [client 4.213.20.183:5924] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7IHM6fabpS0mfhiCEJoQAAAM0"]
[Sat Dec 27 01:38:36.551065 2025] [:error] [pid 34188:tid 34232] [client 4.213.20.183:6003] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7IHA54j0mXgip5BAGn1QAAAEw"]
[Sat Dec 27 01:38:36.870218 2025] [:error] [pid 47566:tid 47569] [client 4.213.20.183:6000] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "aU7IHKyYgLfR4YwO7bx5RQAAAQA"]
[Sat Dec 27 01:38:37.200798 2025] [:error] [pid 34188:tid 34237] [client 4.213.20.183:12895] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/about.php"] [unique_id "aU7IHQ54j0mXgip5BAGn2QAAAFE"]
[Sat Dec 27 01:38:37.492317 2025] [:error] [pid 34188:tid 34243] [client 4.213.20.183:6020] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/about.php"] [unique_id "aU7IHQ54j0mXgip5BAGn3AAAAFc"]
[Sat Dec 27 01:38:37.792933 2025] [:error] [pid 34274:tid 34298] [client 4.213.20.183:5896] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/about.php"] [unique_id "aU7IHc6fabpS0mfhiCEJpwAAANY"]
[Sat Dec 27 01:38:38.152099 2025] [:error] [pid 47566:tid 47582] [client 4.213.20.183:6044] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/about.php"] [unique_id "aU7IHqyYgLfR4YwO7bx5RwAAAQ0"]
[Sat Dec 27 01:38:38.488626 2025] [:error] [pid 34189:tid 34247] [client 4.213.20.183:5963] [client 4.213.20.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aU7IHgnn007DnMwSsfckvAAAAIA"]
[Sat Dec 27 01:38:38.769131 2025] [:error] [pid 34274:tid 34277] [client 4.213.20.183:5841] [client 4.213.20.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aU7IHs6fabpS0mfhiCEJqwAAAME"]
[Sat Dec 27 01:38:39.098950 2025] [:error] [pid 47566:tid 47583] [client 4.213.20.183:5990] [client 4.213.20.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aU7IH6yYgLfR4YwO7bx5SwAAAQ4"]
[Sat Dec 27 01:38:39.441160 2025] [:error] [pid 34274:tid 34278] [client 4.213.20.183:5848] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-logs.php"] [unique_id "aU7IH86fabpS0mfhiCEJrQAAAMI"]
[Sat Dec 27 01:38:39.745888 2025] [:error] [pid 34187:tid 34201] [client 4.213.20.183:6051] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-logs.php"] [unique_id "aU7IH6v8srZGEpsIm8D16QAAAAk"]
[Sat Dec 27 01:38:40.080160 2025] [:error] [pid 47566:tid 47573] [client 4.213.20.183:5838] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-logs.php"] [unique_id "aU7IIKyYgLfR4YwO7bx5TQAAAQQ"]
[Sat Dec 27 01:38:40.367719 2025] [:error] [pid 47566:tid 47590] [client 4.213.20.183:5881] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aU7IIKyYgLfR4YwO7bx5TwAAARU"]
[Sat Dec 27 01:38:40.792487 2025] [:error] [pid 47566:tid 47577] [client 4.213.20.183:5855] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aU7IIKyYgLfR4YwO7bx5UQAAAQg"]
[Sat Dec 27 01:38:41.125709 2025] [:error] [pid 47566:tid 47574] [client 4.213.20.183:6011] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aU7IIayYgLfR4YwO7bx5UwAAAQU"]
[Sat Dec 27 01:38:41.412223 2025] [:error] [pid 47566:tid 47592] [client 4.213.20.183:5828] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aU7IIayYgLfR4YwO7bx5VQAAARc"]
[Sat Dec 27 01:38:41.723927 2025] [:error] [pid 34188:tid 34231] [client 4.213.20.183:5837] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setup.php"] [unique_id "aU7IIQ54j0mXgip5BAGn5gAAAEs"]
[Sat Dec 27 01:38:42.101004 2025] [:error] [pid 34274:tid 34291] [client 4.213.20.183:5940] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setup.php"] [unique_id "aU7IIs6fabpS0mfhiCEJtAAAAM8"]
[Sat Dec 27 01:38:42.429498 2025] [:error] [pid 34188:tid 34224] [client 4.213.20.183:5934] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setup.php"] [unique_id "aU7IIg54j0mXgip5BAGn6gAAAEQ"]
[Sat Dec 27 01:38:42.766718 2025] [:error] [pid 34187:tid 34215] [client 4.213.20.183:5930] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setup.php"] [unique_id "aU7IIqv8srZGEpsIm8D16gAAABc"]
[Sat Dec 27 01:38:43.123195 2025] [:error] [pid 34187:tid 34206] [client 4.213.20.183:5913] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-signin.php"] [unique_id "aU7II6v8srZGEpsIm8D17AAAAA4"]
[Sat Dec 27 01:38:43.432620 2025] [:error] [pid 34187:tid 34213] [client 4.213.20.183:5777] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-signin.php"] [unique_id "aU7II6v8srZGEpsIm8D18AAAABU"]
[Sat Dec 27 01:38:43.763937 2025] [:error] [pid 34187:tid 34205] [client 4.213.20.183:5989] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-signin.php"] [unique_id "aU7II6v8srZGEpsIm8D19QAAAA0"]
[Sat Dec 27 01:38:44.081090 2025] [:error] [pid 34187:tid 34198] [client 4.213.20.183:5890] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-signin.php"] [unique_id "aU7IJKv8srZGEpsIm8D19wAAAAY"]
[Sat Dec 27 01:38:44.487844 2025] [:error] [pid 34274:tid 34285] [client 4.213.20.183:5923] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wso.php"] [unique_id "aU7IJM6fabpS0mfhiCEJvwAAAMk"]
[Sat Dec 27 01:38:44.845855 2025] [:error] [pid 34187:tid 34201] [client 4.213.20.183:6006] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wso.php"] [unique_id "aU7IJKv8srZGEpsIm8D1-wAAAAk"]
[Sat Dec 27 01:38:45.135137 2025] [:error] [pid 34188:tid 34227] [client 4.213.20.183:6004] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wso.php"] [unique_id "aU7IJQ54j0mXgip5BAGn7gAAAEc"]
[Sat Dec 27 01:38:45.432608 2025] [:error] [pid 34188:tid 34225] [client 4.213.20.183:5763] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wso.php"] [unique_id "aU7IJQ54j0mXgip5BAGn8AAAAEU"]
[Sat Dec 27 01:38:45.741712 2025] [:error] [pid 34188:tid 34226] [client 4.213.20.183:5879] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aU7IJQ54j0mXgip5BAGn8wAAAEY"]
[Sat Dec 27 01:38:46.074068 2025] [:error] [pid 34188:tid 34221] [client 4.213.20.183:5884] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aU7IJg54j0mXgip5BAGn9gAAAEE"]
[Sat Dec 27 01:38:46.382797 2025] [:error] [pid 47566:tid 47579] [client 4.213.20.183:5812] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aU7IJqyYgLfR4YwO7bx5XQAAAQo"]
[Sat Dec 27 01:38:46.664223 2025] [:error] [pid 47566:tid 47590] [client 4.213.20.183:5783] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aU7IJqyYgLfR4YwO7bx5YgAAARU"]
[Sat Dec 27 01:38:46.956009 2025] [:error] [pid 34187:tid 34211] [client 4.213.20.183:5941] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_wrong_datlib.php"] [unique_id "aU7IJqv8srZGEpsIm8D1_wAAABM"]
[Sat Dec 27 01:38:47.236521 2025] [:error] [pid 34187:tid 34206] [client 4.213.20.183:5825] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_wrong_datlib.php"] [unique_id "aU7IJ6v8srZGEpsIm8D2AAAAAA4"]
[Sat Dec 27 01:38:47.510739 2025] [:error] [pid 47566:tid 47575] [client 4.213.20.183:5787] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_wrong_datlib.php"] [unique_id "aU7IJ6yYgLfR4YwO7bx5ZAAAAQY"]
[Sat Dec 27 01:38:47.786266 2025] [:error] [pid 47566:tid 47585] [client 4.213.20.183:5862] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_wrong_datlib.php"] [unique_id "aU7IJ6yYgLfR4YwO7bx5ZgAAARA"]
[Sat Dec 27 01:38:48.063317 2025] [:error] [pid 47566:tid 47592] [client 4.213.20.183:6014] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aU7IKKyYgLfR4YwO7bx5aQAAARc"]
[Sat Dec 27 01:38:48.347040 2025] [:error] [pid 34274:tid 34279] [client 4.213.20.183:6045] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aU7IKM6fabpS0mfhiCEJzQAAAMM"]
[Sat Dec 27 01:38:48.637974 2025] [:error] [pid 34188:tid 34231] [client 4.213.20.183:5803] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aU7IKA54j0mXgip5BAGn-QAAAEs"]
[Sat Dec 27 01:38:48.948271 2025] [:error] [pid 47566:tid 47584] [client 4.213.20.183:5869] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aU7IKKyYgLfR4YwO7bx5bgAAAQ8"]
[Sat Dec 27 01:38:49.235385 2025] [:error] [pid 47566:tid 47581] [client 4.213.20.183:5760] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU7IKayYgLfR4YwO7bx5cAAAAQw"]
[Sat Dec 27 01:38:49.557319 2025] [:error] [pid 34274:tid 34293] [client 4.213.20.183:6076] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU7IKc6fabpS0mfhiCEJzwAAANE"]
[Sat Dec 27 01:38:49.926866 2025] [:error] [pid 34274:tid 34295] [client 4.213.20.183:5939] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU7IKc6fabpS0mfhiCEJ0QAAANM"]
[Sat Dec 27 01:38:50.271609 2025] [:error] [pid 47566:tid 47587] [client 4.213.20.183:5872] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aU7IKqyYgLfR4YwO7bx5dwAAARI"]
[Sat Dec 27 01:38:50.591296 2025] [:error] [pid 34189:tid 34260] [client 4.213.20.183:5954] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/y.php"] [unique_id "aU7IKgnn007DnMwSsfck0AAAAI0"]
[Sat Dec 27 01:38:51.031407 2025] [:error] [pid 34189:tid 34257] [client 4.213.20.183:5833] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/y.php"] [unique_id "aU7IKwnn007DnMwSsfck0QAAAIo"]
[Sat Dec 27 01:38:51.395011 2025] [:error] [pid 34189:tid 34263] [client 4.213.20.183:5771] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/y.php"] [unique_id "aU7IKwnn007DnMwSsfck1gAAAJA"]
[Sat Dec 27 01:38:51.706630 2025] [:error] [pid 34189:tid 34254] [client 4.213.20.183:5851] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/y.php"] [unique_id "aU7IKwnn007DnMwSsfck2AAAAIc"]
[Sat Dec 27 01:38:52.014954 2025] [:error] [pid 34187:tid 34213] [client 4.213.20.183:5878] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aU7ILKv8srZGEpsIm8D2BAAAABU"]
[Sat Dec 27 01:38:52.343374 2025] [:error] [pid 34189:tid 34255] [client 4.213.20.183:5831] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aU7ILAnn007DnMwSsfck2wAAAIg"]
[Sat Dec 27 01:38:52.658733 2025] [:error] [pid 34189:tid 34247] [client 4.213.20.183:5897] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aU7ILAnn007DnMwSsfck3gAAAIA"]
[Sat Dec 27 01:38:53.029605 2025] [:error] [pid 34187:tid 34205] [client 4.213.20.183:5888] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aU7ILav8srZGEpsIm8D2BwAAAA0"]
[Sat Dec 27 01:38:53.669185 2025] [:error] [pid 34189:tid 34261] [client 4.213.20.183:5943] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring"] [unique_id "aU7ILQnn007DnMwSsfck5gAAAI4"]
[Sat Dec 27 01:38:54.016962 2025] [:error] [pid 34187:tid 34202] [client 4.213.20.183:5846] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring"] [unique_id "aU7ILqv8srZGEpsIm8D2CgAAAAo"]
[Sat Dec 27 01:38:54.316082 2025] [:error] [pid 34187:tid 34200] [client 4.213.20.183:5926] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring"] [unique_id "aU7ILqv8srZGEpsIm8D2DgAAAAg"]
[Sat Dec 27 01:38:54.634624 2025] [:error] [pid 34187:tid 34201] [client 4.213.20.183:5840] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring"] [unique_id "aU7ILqv8srZGEpsIm8D2DwAAAAk"]
[Sat Dec 27 01:38:55.007394 2025] [:error] [pid 47566:tid 47577] [client 4.213.20.183:5779] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs"] [unique_id "aU7IL6yYgLfR4YwO7bx5jAAAAQg"]
[Sat Dec 27 01:38:55.401809 2025] [:error] [pid 34189:tid 34254] [client 4.213.20.183:5935] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs"] [unique_id "aU7ILwnn007DnMwSsfck6QAAAIc"]
[Sat Dec 27 01:38:55.768630 2025] [:error] [pid 34274:tid 34290] [client 4.213.20.183:5866] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs"] [unique_id "aU7IL86fabpS0mfhiCEJ4QAAAM4"]
[Sat Dec 27 01:38:56.099603 2025] [:error] [pid 34187:tid 34196] [client 4.213.20.183:5876] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs"] [unique_id "aU7IMKv8srZGEpsIm8D2GAAAAAQ"]
[Sat Dec 27 01:38:56.471804 2025] [:error] [pid 34187:tid 34193] [client 4.213.20.183:5873] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU7IMKv8srZGEpsIm8D2GgAAAAE"]
[Sat Dec 27 01:38:56.826381 2025] [:error] [pid 34188:tid 34243] [client 4.213.20.183:5868] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU7IMA54j0mXgip5BAGn_wAAAFc"]
[Sat Dec 27 01:38:57.129963 2025] [:error] [pid 34188:tid 34229] [client 4.213.20.183:5989] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU7IMQ54j0mXgip5BAGoAQAAAEk"]
[Sat Dec 27 01:38:57.480229 2025] [:error] [pid 34274:tid 34276] [client 4.213.20.183:5857] [client 4.213.20.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aU7IMc6fabpS0mfhiCEJ6QAAAMA"]
[Sun Dec 28 02:22:25.175863 2025] [:error] [pid 46653:tid 46668] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Sun Dec 28 02:22:25.311325 2025] [:error] [pid 46653:tid 46665] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/d4.php
[Sun Dec 28 02:22:25.443795 2025] [:error] [pid 46653:tid 46667] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/ad.php
[Sun Dec 28 02:22:25.571600 2025] [:error] [pid 46653:tid 46657] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/dlex.php
[Sun Dec 28 02:22:25.713718 2025] [:error] [pid 46653:tid 46674] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Dec 28 02:22:25.846928 2025] [:error] [pid 46653:tid 46658] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/pass.php
[Sun Dec 28 02:22:25.976834 2025] [:error] [pid 46653:tid 46675] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Sun Dec 28 02:22:26.104962 2025] [:error] [pid 46653:tid 46671] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Dec 28 02:22:26.231700 2025] [:error] [pid 46653:tid 46660] [client 13.70.25.249:16879] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Dec 28 02:22:26.781928 2025] [:error] [pid 46653:tid 46670] [client 13.70.25.249:16879] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aVAj4rj2DbiG6mG0UTPvQQAAAA0"]
[Sun Dec 28 02:22:28.863538 2025] [:error] [pid 46742:tid 46747] [client 13.70.25.249:16778] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aVAj5OioIIea_hBqsHemUgAAAMI"]
[Sun Dec 28 02:22:30.307386 2025] [:error] [pid 46655:tid 46733] [client 13.70.25.249:16876] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aVAj5hJiIF9AF5FHxvCaKgAAAJQ"]
[Sun Dec 28 02:22:32.629722 2025] [:error] [pid 46655:tid 46725] [client 13.70.25.249:16889] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aVAj6BJiIF9AF5FHxvCaLgAAAIw"]
[Sun Dec 28 02:22:36.072199 2025] [:error] [pid 46742:tid 46747] [client 13.70.25.249:16848] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aVAj7OioIIea_hBqsHemXQAAAMI"]
[Sun Dec 28 02:22:38.513933 2025] [:error] [pid 46742:tid 46754] [client 13.70.25.249:16866] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aVAj7uioIIea_hBqsHemZAAAAMg"]
[Sun Dec 28 02:22:40.103341 2025] [:error] [pid 46655:tid 46724] [client 13.70.25.249:16849] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aVAj8BJiIF9AF5FHxvCaOgAAAIs"]
[Sun Dec 28 02:22:43.170099 2025] [:error] [pid 46742:tid 46753] [client 13.70.25.249:16797] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/npi.php"] [unique_id "aVAj8-ioIIea_hBqsHemcgAAAMc"]
[Sun Dec 28 02:22:47.922375 2025] [:error] [pid 46654:tid 46697] [client 13.70.25.249:16890] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aVAj96yyuBQW4Tqizy6bnAAAAEs"]
[Sun Dec 28 02:22:55.765503 2025] [:error] [pid 46742:tid 46752] [client 13.70.25.249:16833] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aVAj_-ioIIea_hBqsHemiQAAAMY"]
[Sun Dec 28 02:22:56.840527 2025] [:error] [pid 46655:tid 46730] [client 13.70.25.249:16845] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "aVAkABJiIF9AF5FHxvCaWgAAAJE"]
[Sun Dec 28 02:23:01.219277 2025] [:error] [pid 46655:tid 46726] [client 13.70.25.249:16774] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aVAkBRJiIF9AF5FHxvCaawAAAI0"]
[Sun Dec 28 02:23:03.026736 2025] [:error] [pid 46742:tid 46757] [client 13.70.25.249:16784] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aVAkB-ioIIea_hBqsHemjQAAAMs"]
[Sun Dec 28 02:23:05.202672 2025] [:error] [pid 46654:tid 46702] [client 13.70.25.249:16799] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aVAkCayyuBQW4Tqizy6buQAAAFA"]
[Sun Dec 28 02:23:09.468463 2025] [:error] [pid 46654:tid 46687] [client 13.70.25.249:16868] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aVAkDayyuBQW4Tqizy6bwAAAAEE"]
[Sun Dec 28 02:23:10.776435 2025] [:error] [pid 46655:tid 46728] [client 13.70.25.249:16798] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVAkDhJiIF9AF5FHxvCafAAAAI8"]
[Sun Dec 28 02:23:12.187022 2025] [:error] [pid 46742:tid 46750] [client 13.70.25.249:12251] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVAkEOioIIea_hBqsHemogAAAMQ"]
[Sun Dec 28 02:23:13.952821 2025] [:error] [pid 46654:tid 46706] [client 13.70.25.249:16871] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVAkEayyuBQW4Tqizy6byAAAAFQ"]
[Sun Dec 28 02:23:16.307654 2025] [:error] [pid 46653:tid 46660] [client 13.70.25.249:16788] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVAkFLj2DbiG6mG0UTPvbwAAAAM"]
[Sun Dec 28 02:23:17.304382 2025] [:error] [pid 46653:tid 46663] [client 13.70.25.249:16781] [client 13.70.25.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aVAkFbj2DbiG6mG0UTPvcAAAAAY"]
[Sun Dec 28 02:23:21.587056 2025] [:error] [pid 46653:tid 46664] [client 13.70.25.249:16770] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVAkGbj2DbiG6mG0UTPvewAAAAc"]
[Sun Dec 28 02:23:22.607899 2025] [:error] [pid 46655:tid 46732] [client 13.70.25.249:16869] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVAkGhJiIF9AF5FHxvCaiAAAAJM"]
[Sun Dec 28 02:23:24.251275 2025] [:error] [pid 46654:tid 46696] [client 13.70.25.249:16800] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVAkHKyyuBQW4Tqizy6b2gAAAEo"]
[Sun Dec 28 02:23:25.672076 2025] [:error] [pid 46742:tid 46764] [client 13.70.25.249:16867] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litanies.php"] [unique_id "aVAkHeioIIea_hBqsHemswAAANI"]
[Sun Dec 28 02:23:27.372392 2025] [:error] [pid 46654:tid 46707] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/litanies.php
[Sun Dec 28 02:23:27.544019 2025] [:error] [pid 46654:tid 46703] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Dec 28 02:23:27.688386 2025] [:error] [pid 46654:tid 46698] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Sun Dec 28 02:23:27.808774 2025] [:error] [pid 46654:tid 46691] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/kwm4.php
[Sun Dec 28 02:23:27.935067 2025] [:error] [pid 46654:tid 46701] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/just2.php
[Sun Dec 28 02:23:28.068402 2025] [:error] [pid 46654:tid 46709] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Sun Dec 28 02:23:28.188587 2025] [:error] [pid 46654:tid 46695] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/geger.php
[Sun Dec 28 02:23:28.333853 2025] [:error] [pid 46654:tid 46693] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/let.php
[Sun Dec 28 02:23:28.465712 2025] [:error] [pid 46654:tid 46706] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/np.php
[Sun Dec 28 02:23:28.614299 2025] [:error] [pid 46654:tid 46699] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/ask.php
[Sun Dec 28 02:23:28.743157 2025] [:error] [pid 46654:tid 46690] [client 13.70.25.249:16894] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Sun Dec 28 02:23:28.860253 2025] [:error] [pid 46654:tid 46686] [client 13.70.25.249:16894] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aVAkIKyyuBQW4Tqizy6b7QAAAEA"]
[Sun Dec 28 02:23:30.837832 2025] [:error] [pid 46655:tid 46728] [client 13.70.25.249:16892] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aVAkIhJiIF9AF5FHxvCanAAAAI8"]
[Sun Dec 28 02:23:32.665729 2025] [:error] [pid 46655:tid 46720] [client 13.70.25.249:16796] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aVAkJBJiIF9AF5FHxvCapwAAAIc"]
[Sun Dec 28 02:23:36.964264 2025] [:error] [pid 46742:tid 46765] [client 13.70.25.249:16794] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "aVAkKOioIIea_hBqsHem0gAAANM"]
[Sun Dec 28 02:23:38.464491 2025] [:error] [pid 46655:tid 46735] [client 13.70.25.249:16878] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aVAkKhJiIF9AF5FHxvCarQAAAJY"]
[Sun Dec 28 02:23:39.880325 2025] [:error] [pid 46655:tid 46715] [client 13.70.25.249:16830] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aVAkKxJiIF9AF5FHxvCarwAAAII"]
[Sun Dec 28 02:23:40.520314 2025] [:error] [pid 46654:tid 46689] [client 13.70.25.249:16874] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aVAkLKyyuBQW4Tqizy6b8gAAAEM"]
[Sun Dec 28 02:23:44.160800 2025] [:error] [pid 46742:tid 46763] [client 13.70.25.249:16772] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mek.php"] [unique_id "aVAkMOioIIea_hBqsHem8gAAANE"]
[Sun Dec 28 02:23:50.574851 2025] [:error] [pid 46654:tid 46708] [client 13.70.25.249:16853] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aVAkNqyyuBQW4Tqizy6b-QAAAFY"]
[Sun Dec 28 02:23:55.060431 2025] [:error] [pid 46742:tid 46766] [client 13.70.25.249:16834] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aVAkO-ioIIea_hBqsHenCwAAANQ"]
[Sun Dec 28 02:23:56.550992 2025] [:error] [pid 46655:tid 46736] [client 13.70.25.249:16887] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aVAkPBJiIF9AF5FHxvCaywAAAJc"]
[Sun Dec 28 02:23:58.670411 2025] [:error] [pid 46654:tid 46709] [client 13.70.25.249:16872] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fjpeb.php"] [unique_id "aVAkPqyyuBQW4Tqizy6cBQAAAFc"]
[Sun Dec 28 02:24:00.603019 2025] [:error] [pid 46654:tid 46688] [client 13.70.25.249:16862] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aVAkQKyyuBQW4Tqizy6cCwAAAEI"]
[Sun Dec 28 02:24:02.006901 2025] [:error] [pid 46655:tid 46728] [client 13.70.25.249:16825] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aVAkQhJiIF9AF5FHxvCa0wAAAI8"]
[Sun Dec 28 02:24:04.558026 2025] [:error] [pid 46654:tid 46686] [client 13.70.25.249:16809] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aVAkRKyyuBQW4Tqizy6cGAAAAEA"]
[Sun Dec 28 02:24:05.899326 2025] [:error] [pid 46655:tid 46737] [client 13.70.25.249:16850] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ex.php"] [unique_id "aVAkRRJiIF9AF5FHxvCa5gAAAJg"]
[Sun Dec 28 02:24:09.894053 2025] [:error] [pid 46654:tid 46688] [client 13.70.25.249:16820] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVAkSayyuBQW4Tqizy6cJAAAAEI"]
[Sun Dec 28 02:24:11.888844 2025] [:error] [pid 46653:tid 46668] [client 13.70.25.249:16859] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVAkS7j2DbiG6mG0UTPvrgAAAAs"]
[Sun Dec 28 02:24:14.590326 2025] [:error] [pid 46654:tid 46692] [client 13.70.25.249:12280] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVAkTqyyuBQW4Tqizy6cKAAAAEY"]
[Sun Dec 28 02:24:17.516975 2025] [:error] [pid 46655:tid 46713] [client 13.70.25.249:16884] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVAkURJiIF9AF5FHxvCbBwAAAIA"]
[Sun Dec 28 02:24:18.757202 2025] [:error] [pid 46655:tid 46714] [client 13.70.25.249:16787] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVAkUhJiIF9AF5FHxvCbCgAAAIE"]
[Sun Dec 28 02:24:20.204539 2025] [:error] [pid 46655:tid 46716] [client 13.70.25.249:16782] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVAkVBJiIF9AF5FHxvCbDgAAAIM"]
[Sun Dec 28 02:24:20.965397 2025] [:error] [pid 46653:tid 46666] [client 13.70.25.249:16793] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVAkVLj2DbiG6mG0UTPwHAAAAAk"]
[Sun Dec 28 02:24:22.804737 2025] [:error] [pid 46655:tid 46723] [client 13.70.25.249:16860] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVAkVhJiIF9AF5FHxvCbFgAAAIo"]
[Sun Dec 28 02:24:24.659694 2025] [:error] [pid 46653:tid 46673] [client 13.70.25.249:16789] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aVAkWLj2DbiG6mG0UTPwIwAAABA"]
[Sun Dec 28 02:24:26.817599 2025] [:error] [pid 46655:tid 46733] [client 13.70.25.249:16854] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aVAkWhJiIF9AF5FHxvCbIwAAAJQ"]
[Sun Dec 28 02:24:27.946291 2025] [:error] [pid 46655:tid 46719] [client 13.70.25.249:16873] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aVAkWxJiIF9AF5FHxvCbJwAAAIY"]
[Sun Dec 28 02:24:29.581655 2025] [:error] [pid 46654:tid 46710] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Dec 28 02:24:29.710736 2025] [:error] [pid 46654:tid 46694] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/shlo.php
[Sun Dec 28 02:24:29.833030 2025] [:error] [pid 46654:tid 46702] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/sec.php
[Sun Dec 28 02:24:29.968232 2025] [:error] [pid 46654:tid 46692] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Dec 28 02:24:30.287957 2025] [:error] [pid 46654:tid 46708] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Dec 28 02:24:30.420625 2025] [:error] [pid 46654:tid 46707] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sun Dec 28 02:24:30.739017 2025] [:error] [pid 46654:tid 46691] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Sun Dec 28 02:24:30.867609 2025] [:error] [pid 46654:tid 46687] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/bluejackets.php
[Sun Dec 28 02:24:30.989101 2025] [:error] [pid 46654:tid 46700] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Sun Dec 28 02:24:31.116595 2025] [:error] [pid 46654:tid 46706] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/sx21_1.php
[Sun Dec 28 02:24:31.238832 2025] [:error] [pid 46654:tid 46698] [client 13.70.25.249:16843] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Sun Dec 28 02:24:31.373088 2025] [:error] [pid 46654:tid 46695] [client 13.70.25.249:16843] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aVAkX6yyuBQW4Tqizy6cUQAAAEk"]
[Sun Dec 28 02:24:32.279879 2025] [:error] [pid 46654:tid 46707] [client 13.70.25.249:16888] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aVAkYKyyuBQW4Tqizy6cWwAAAFU"]
[Sun Dec 28 02:24:33.259124 2025] [:error] [pid 46653:tid 46675] [client 13.70.25.249:16881] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aVAkYbj2DbiG6mG0UTPwLAAAABI"]
[Sun Dec 28 02:24:36.278587 2025] [:error] [pid 46654:tid 46702] [client 13.70.25.249:16827] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx9.php"] [unique_id "aVAkZKyyuBQW4Tqizy6cZwAAAFA"]
[Sun Dec 28 02:24:37.681091 2025] [:error] [pid 46742:tid 46746] [client 13.70.25.249:16776] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVAkZeioIIea_hBqsHenYAAAAME"]
[Sun Dec 28 02:24:39.174079 2025] [:error] [pid 46742:tid 46747] [client 13.70.25.249:16769] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVAkZ-ioIIea_hBqsHenagAAAMI"]
[Sun Dec 28 02:24:40.630929 2025] [:error] [pid 46742:tid 46764] [client 13.70.25.249:16791] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVAkaOioIIea_hBqsHenbgAAANI"]
[Sun Dec 28 02:24:47.539261 2025] [:error] [pid 46654:tid 46691] [client 13.70.25.249:16811] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVAkb6yyuBQW4Tqizy6cjAAAAEU"]
[Sun Dec 28 02:24:50.639354 2025] [:error] [pid 46655:tid 46713] [client 13.70.25.249:16882] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aVAkchJiIF9AF5FHxvCbTgAAAIA"]
[Sun Dec 28 02:24:51.873145 2025] [:error] [pid 46653:tid 46659] [client 13.70.25.249:16844] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aVAkc7j2DbiG6mG0UTPwWwAAAAI"]
[Sun Dec 28 02:24:53.712093 2025] [:error] [pid 46654:tid 46709] [client 13.70.25.249:16831] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aVAkdayyuBQW4Tqizy6cpQAAAFc"]
[Sun Dec 28 02:25:02.512932 2025] [:error] [pid 46742:tid 46769] [client 13.70.25.249:16829] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aVAkfuioIIea_hBqsHenowAAANc"]
[Sun Dec 28 02:25:03.904544 2025] [:error] [pid 46653:tid 46666] [client 13.70.25.249:16836] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfvul.php"] [unique_id "aVAkf7j2DbiG6mG0UTPwcQAAAAk"]
[Sun Dec 28 02:25:06.982719 2025] [:error] [pid 46653:tid 46677] [client 13.70.25.249:16771] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sfvul.php"] [unique_id "aVAkgrj2DbiG6mG0UTPwdgAAABQ"]
[Sun Dec 28 02:25:22.277830 2025] [:error] [pid 46742:tid 46745] [client 13.70.25.249:16861] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aVAkkuioIIea_hBqsHenwgAAAMA"]
[Sun Dec 28 02:25:26.099920 2025] [:error] [pid 46653:tid 46681] [client 13.70.25.249:12163] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aVAklrj2DbiG6mG0UTPwoQAAABg"]
[Sun Dec 28 02:25:27.135333 2025] [:error] [pid 46653:tid 46664] [client 13.70.25.249:16813] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aVAkl7j2DbiG6mG0UTPwpAAAAAc"]
[Sun Dec 28 02:25:28.874726 2025] [:error] [pid 46653:tid 46680] [client 13.70.25.249:16858] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/icdwb.php"] [unique_id "aVAkmLj2DbiG6mG0UTPwrQAAABc"]
[Sun Dec 28 02:25:29.993027 2025] [:error] [pid 46653:tid 46676] [client 13.70.25.249:16775] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "aVAkmbj2DbiG6mG0UTPwsQAAABM"]
[Sun Dec 28 02:25:32.990795 2025] [:error] [pid 46655:tid 46721] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/ticket.php
[Sun Dec 28 02:25:33.110793 2025] [:error] [pid 46655:tid 46726] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Dec 28 02:25:33.250780 2025] [:error] [pid 46655:tid 46728] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sun Dec 28 02:25:33.370320 2025] [:error] [pid 46655:tid 46733] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/amphicyon.php
[Sun Dec 28 02:25:33.500777 2025] [:error] [pid 46655:tid 46724] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sun Dec 28 02:25:33.971415 2025] [:error] [pid 46655:tid 46734] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/lock1.php
[Sun Dec 28 02:25:34.102512 2025] [:error] [pid 46655:tid 46719] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Dec 28 02:25:34.228837 2025] [:error] [pid 46655:tid 46736] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Sun Dec 28 02:25:34.368008 2025] [:error] [pid 46655:tid 46731] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Sun Dec 28 02:25:34.490479 2025] [:error] [pid 46655:tid 46723] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Sun Dec 28 02:25:34.611103 2025] [:error] [pid 46655:tid 46720] [client 13.70.25.249:16895] File does not exist: /usr/local/apache/htdocs/suspended-page/minik.php
[Sun Dec 28 02:25:34.727424 2025] [:error] [pid 46655:tid 46722] [client 13.70.25.249:16895] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aVAknhJiIF9AF5FHxvCblQAAAIk"]
[Sun Dec 28 02:25:37.380388 2025] [:error] [pid 46654:tid 46692] [client 13.70.25.249:16841] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aVAkoayyuBQW4Tqizy6c5wAAAEY"]
[Sun Dec 28 02:25:39.079474 2025] [:error] [pid 46654:tid 46710] [client 13.70.25.249:16780] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aVAko6yyuBQW4Tqizy6c8wAAAFg"]
[Sun Dec 28 02:25:41.319363 2025] [:error] [pid 46654:tid 46701] [client 13.70.25.249:16886] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aVAkpayyuBQW4Tqizy6c_gAAAE8"]
[Sun Dec 28 02:25:43.351402 2025] [:error] [pid 46655:tid 46731] [client 13.70.25.249:16891] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aVAkpxJiIF9AF5FHxvCbnAAAAJI"]
[Sun Dec 28 02:25:47.057864 2025] [:error] [pid 46742:tid 46760] [client 13.70.25.249:16828] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aVAkq-ioIIea_hBqsHen7wAAAM4"]
[Sun Dec 28 02:25:49.555946 2025] [:error] [pid 46655:tid 46737] [client 13.70.25.249:16863] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aVAkrRJiIF9AF5FHxvCbqAAAAJg"]
[Sun Dec 28 02:25:51.180278 2025] [:error] [pid 46654:tid 46707] [client 13.70.25.249:16773] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nx.php"] [unique_id "aVAkr6yyuBQW4Tqizy6dIwAAAFU"]
[Sun Dec 28 02:25:53.510247 2025] [:error] [pid 46655:tid 46716] [client 13.70.25.249:16779] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVAksRJiIF9AF5FHxvCbsgAAAIM"]
[Sun Dec 28 02:25:55.438445 2025] [:error] [pid 46742:tid 46749] [client 13.70.25.249:16865] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVAks-ioIIea_hBqsHen_gAAAMM"]
[Sun Dec 28 02:26:03.254964 2025] [:error] [pid 46653:tid 46671] [client 13.70.25.249:16808] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVAku7j2DbiG6mG0UTPw3wAAAA4"]
[Sun Dec 28 02:26:04.571565 2025] [:error] [pid 46655:tid 46719] [client 13.70.25.249:16786] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVAkvBJiIF9AF5FHxvCbxwAAAIY"]
[Sun Dec 28 02:26:06.285363 2025] [:error] [pid 46655:tid 46720] [client 13.70.25.249:12184] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVAkvhJiIF9AF5FHxvCbygAAAIc"]
[Sun Dec 28 02:26:08.580029 2025] [:error] [pid 46653:tid 46663] [client 13.70.25.249:12227] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVAkwLj2DbiG6mG0UTPw6wAAAAY"]
[Sun Dec 28 02:26:09.382031 2025] [:error] [pid 46653:tid 46661] [client 13.70.25.249:16818] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVAkwbj2DbiG6mG0UTPw7gAAAAQ"]
[Sun Dec 28 02:26:13.561402 2025] [:error] [pid 46655:tid 46727] [client 13.70.25.249:12269] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVAkxRJiIF9AF5FHxvCb2wAAAI4"]
[Sun Dec 28 02:26:15.454472 2025] [:error] [pid 46654:tid 46686] [client 13.70.25.249:12229] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aVAkx6yyuBQW4Tqizy6dWAAAAEA"]
[Sun Dec 28 02:26:16.389304 2025] [:error] [pid 46654:tid 46693] [client 13.70.25.249:16837] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aVAkyKyyuBQW4Tqizy6dWwAAAEc"]
[Sun Dec 28 02:26:17.961707 2025] [:error] [pid 46653:tid 46674] [client 13.70.25.249:16847] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aVAkybj2DbiG6mG0UTPxAwAAABE"]
[Sun Dec 28 02:26:19.370408 2025] [:error] [pid 46654:tid 46695] [client 13.70.25.249:16785] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpw.php"] [unique_id "aVAky6yyuBQW4Tqizy6dYAAAAEk"]
[Sun Dec 28 02:26:22.494156 2025] [:error] [pid 46742:tid 46769] [client 13.70.25.249:16846] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aVAkzuioIIea_hBqsHeoPAAAANc"]
[Sun Dec 28 02:26:23.734001 2025] [:error] [pid 46654:tid 46692] [client 13.70.25.249:16792] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aVAkz6yyuBQW4Tqizy6dagAAAEY"]
[Sun Dec 28 02:26:24.340475 2025] [:error] [pid 46654:tid 46701] [client 13.70.25.249:16804] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aVAk0KyyuBQW4Tqizy6dbwAAAE8"]
[Sun Dec 28 02:26:26.273673 2025] [:error] [pid 46654:tid 46688] [client 13.70.25.249:16842] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aVAk0qyyuBQW4Tqizy6deAAAAEI"]
[Sun Dec 28 02:26:26.937309 2025] [:error] [pid 46655:tid 46730] [client 13.70.25.249:16855] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aVAk0hJiIF9AF5FHxvCcAQAAAJE"]
[Sun Dec 28 02:26:28.840723 2025] [:error] [pid 46742:tid 46756] [client 13.70.25.249:12234] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aVAk1OioIIea_hBqsHeoSgAAAMo"]
[Sun Dec 28 02:26:29.314409 2025] [:error] [pid 46742:tid 46759] [client 13.70.25.249:12243] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aVAk1eioIIea_hBqsHeoSwAAAM0"]
[Sun Dec 28 02:26:29.985948 2025] [:error] [pid 46653:tid 46665] [client 13.70.25.249:12235] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akp.php"] [unique_id "aVAk1bj2DbiG6mG0UTPxFwAAAAg"]
[Sun Dec 28 02:26:31.094700 2025] [:error] [pid 46654:tid 46688] [client 13.70.25.249:16839] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aVAk16yyuBQW4Tqizy6djQAAAEI"]
[Sun Dec 28 02:26:31.809182 2025] [:error] [pid 46742:tid 46754] [client 13.70.25.249:16790] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aVAk1-ioIIea_hBqsHeoVgAAAMg"]
[Sun Dec 28 02:26:32.591910 2025] [:error] [pid 46655:tid 46729] [client 13.70.25.249:12259] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aVAk2BJiIF9AF5FHxvCcDwAAAJA"]
[Sun Dec 28 02:26:33.388438 2025] [:error] [pid 46653:tid 46672] [client 13.70.25.249:16783] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwsd.php"] [unique_id "aVAk2bj2DbiG6mG0UTPxHQAAAA8"]
[Sun Dec 28 02:26:35.499731 2025] [:error] [pid 46654:tid 46690] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/tll.php
[Sun Dec 28 02:26:35.627746 2025] [:error] [pid 46654:tid 46689] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Sun Dec 28 02:26:35.752683 2025] [:error] [pid 46654:tid 46702] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/idea.php
[Sun Dec 28 02:26:35.872217 2025] [:error] [pid 46654:tid 46703] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/pepe.php
[Sun Dec 28 02:26:35.991746 2025] [:error] [pid 46654:tid 46696] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sun Dec 28 02:26:36.319511 2025] [:error] [pid 46654:tid 46686] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/yca.php
[Sun Dec 28 02:26:36.460866 2025] [:error] [pid 46654:tid 46698] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Dec 28 02:26:36.591906 2025] [:error] [pid 46654:tid 46700] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/ot.php
[Sun Dec 28 02:26:36.711788 2025] [:error] [pid 46654:tid 46699] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sun Dec 28 02:26:36.835672 2025] [:error] [pid 46654:tid 46709] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/j.php
[Sun Dec 28 02:26:36.955125 2025] [:error] [pid 46654:tid 46693] [client 13.70.25.249:16795] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Sun Dec 28 02:26:37.071155 2025] [:error] [pid 46654:tid 46701] [client 13.70.25.249:16795] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aVAk3ayyuBQW4Tqizy6dsAAAAE8"]
[Sun Dec 28 02:26:38.444670 2025] [:error] [pid 46653:tid 46658] [client 13.70.25.249:16835] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aVAk3rj2DbiG6mG0UTPxIwAAAAE"]
[Sun Dec 28 02:26:39.447115 2025] [:error] [pid 46653:tid 46665] [client 13.70.25.249:12230] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aVAk37j2DbiG6mG0UTPxJgAAAAg"]
[Sun Dec 28 02:26:40.636351 2025] [:error] [pid 46655:tid 46721] [client 13.70.25.249:16817] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ucp.php"] [unique_id "aVAk4BJiIF9AF5FHxvCcKwAAAIg"]
[Sun Dec 28 02:26:41.397732 2025] [:error] [pid 46654:tid 46709] [client 13.70.25.249:12224] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aVAk4ayyuBQW4Tqizy6dwQAAAFc"]
[Sun Dec 28 02:26:42.150069 2025] [:error] [pid 46742:tid 46761] [client 13.70.25.249:16819] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aVAk4uioIIea_hBqsHeocAAAAM8"]
[Sun Dec 28 02:26:43.078747 2025] [:error] [pid 46742:tid 46753] [client 13.70.25.249:12255] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aVAk4-ioIIea_hBqsHeocwAAAMc"]
[Sun Dec 28 02:26:44.138055 2025] [:error] [pid 46655:tid 46722] [client 13.70.25.249:16864] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zse.php"] [unique_id "aVAk5BJiIF9AF5FHxvCcMwAAAIk"]
[Sun Dec 28 02:26:44.697828 2025] [:error] [pid 46742:tid 46755] [client 13.70.25.249:16832] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVAk5OioIIea_hBqsHeoewAAAMk"]
[Sun Dec 28 02:26:45.660618 2025] [:error] [pid 46655:tid 46731] [client 13.70.25.249:16826] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVAk5RJiIF9AF5FHxvCcNwAAAJI"]
[Sun Dec 28 02:26:47.283442 2025] [:error] [pid 46742:tid 46757] [client 13.70.25.249:16875] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVAk5-ioIIea_hBqsHeohAAAAMs"]
[Sun Dec 28 02:26:48.211369 2025] [:error] [pid 46653:tid 46660] [client 13.70.25.249:12239] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVAk6Lj2DbiG6mG0UTPxNwAAAAM"]
[Sun Dec 28 02:26:49.481601 2025] [:error] [pid 46653:tid 46668] [client 13.70.25.249:12231] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVAk6bj2DbiG6mG0UTPxPAAAAAs"]
[Sun Dec 28 02:26:51.228516 2025] [:error] [pid 46655:tid 46733] [client 13.70.25.249:12228] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVAk6xJiIF9AF5FHxvCcUwAAAJQ"]
[Sun Dec 28 02:26:52.160678 2025] [:error] [pid 46653:tid 46658] [client 13.70.25.249:12256] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVAk7Lj2DbiG6mG0UTPxQQAAAAE"]
[Sun Dec 28 02:26:54.172012 2025] [:error] [pid 46742:tid 46751] [client 13.70.25.249:12225] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVAk7uioIIea_hBqsHeooAAAAMU"]
[Sun Dec 28 02:26:55.103209 2025] [:error] [pid 46742:tid 46745] [client 13.70.25.249:12244] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVAk7-ioIIea_hBqsHeopQAAAMA"]
[Sun Dec 28 02:26:56.702984 2025] [:error] [pid 46654:tid 46707] [client 13.70.25.249:12270] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVAk8KyyuBQW4Tqizy6eCgAAAFU"]
[Sun Dec 28 02:26:57.982171 2025] [:error] [pid 46653:tid 46660] [client 13.70.25.249:12236] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVAk8bj2DbiG6mG0UTPxSQAAAAM"]
[Sun Dec 28 02:26:58.875500 2025] [:error] [pid 46742:tid 46759] [client 13.70.25.249:12240] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVAk8uioIIea_hBqsHeowwAAAM0"]
[Sun Dec 28 02:27:00.535094 2025] [:error] [pid 46654:tid 46705] [client 13.70.25.249:12286] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVAk9KyyuBQW4Tqizy6eEAAAAFM"]
[Sun Dec 28 02:27:01.312116 2025] [:error] [pid 46655:tid 46724] [client 13.70.25.249:16803] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVAk9RJiIF9AF5FHxvCccQAAAIs"]
[Sun Dec 28 02:27:02.744069 2025] [:error] [pid 46742:tid 46747] [client 13.70.25.249:12164] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVAk9uioIIea_hBqsHeo2AAAAMI"]
[Sun Dec 28 02:27:03.737538 2025] [:error] [pid 46742:tid 46760] [client 13.70.25.249:12246] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVAk9-ioIIea_hBqsHeo4QAAAM4"]
[Sun Dec 28 02:27:05.183511 2025] [:error] [pid 46655:tid 46718] [client 13.70.25.249:12268] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVAk-RJiIF9AF5FHxvCceAAAAIU"]
[Sun Dec 28 02:27:05.809044 2025] [:error] [pid 46654:tid 46697] [client 13.70.25.249:12284] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVAk-ayyuBQW4Tqizy6eFwAAAEs"]
[Sun Dec 28 02:27:07.543408 2025] [:error] [pid 46653:tid 46672] [client 13.70.25.249:12245] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVAk-7j2DbiG6mG0UTPxWAAAAA8"]
[Sun Dec 28 02:27:08.994565 2025] [:error] [pid 46654:tid 46689] [client 13.70.25.249:16802] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVAk_KyyuBQW4Tqizy6eHQAAAEM"]
[Sun Dec 28 02:27:09.458617 2025] [:error] [pid 46742:tid 46758] [client 13.70.25.249:16823] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ay.php"] [unique_id "aVAk_eioIIea_hBqsHepCAAAAMw"]
[Sun Dec 28 02:27:10.518584 2025] [:error] [pid 46742:tid 46763] [client 13.70.25.249:12162] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ay.php"] [unique_id "aVAk_uioIIea_hBqsHepEAAAANE"]
[Sun Dec 28 02:27:10.962073 2025] [:error] [pid 46742:tid 46757] [client 13.70.25.249:12264] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ay.php"] [unique_id "aVAk_uioIIea_hBqsHepFwAAAMs"]
[Sun Dec 28 02:27:11.927598 2025] [:error] [pid 46653:tid 46673] [client 13.70.25.249:12276] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ay.php"] [unique_id "aVAk_7j2DbiG6mG0UTPxXgAAABA"]
[Sun Dec 28 02:27:13.168888 2025] [:error] [pid 46653:tid 46671] [client 13.70.25.249:12277] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVAlAbj2DbiG6mG0UTPxYwAAAA4"]
[Sun Dec 28 02:27:14.313977 2025] [:error] [pid 46742:tid 46752] [client 13.70.25.249:12265] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVAlAuioIIea_hBqsHepMQAAAMY"]
[Sun Dec 28 02:27:14.913791 2025] [:error] [pid 46653:tid 46660] [client 13.70.25.249:12253] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVAlArj2DbiG6mG0UTPxaQAAAAM"]
[Sun Dec 28 02:27:15.742900 2025] [:error] [pid 46653:tid 46680] [client 13.70.25.249:16880] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVAlA7j2DbiG6mG0UTPxawAAABc"]
[Sun Dec 28 02:27:16.995164 2025] [:error] [pid 46655:tid 46730] [client 13.70.25.249:16857] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "aVAlBBJiIF9AF5FHxvCcjwAAAJE"]
[Sun Dec 28 02:27:17.753853 2025] [:error] [pid 46653:tid 46661] [client 13.70.25.249:12181] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "aVAlBbj2DbiG6mG0UTPxdQAAAAQ"]
[Sun Dec 28 02:27:18.337072 2025] [:error] [pid 46742:tid 46764] [client 13.70.25.249:12271] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "aVAlBuioIIea_hBqsHepTwAAANI"]
[Sun Dec 28 02:27:20.053211 2025] [:error] [pid 46654:tid 46689] [client 13.70.25.249:12257] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "aVAlCKyyuBQW4Tqizy6eKwAAAEM"]
[Sun Dec 28 02:27:20.858684 2025] [:error] [pid 46653:tid 46681] [client 13.70.25.249:12263] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aVAlCLj2DbiG6mG0UTPxeQAAABg"]
[Sun Dec 28 02:27:21.795722 2025] [:error] [pid 46653:tid 46680] [client 13.70.25.249:16883] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aVAlCbj2DbiG6mG0UTPxfAAAABc"]
[Sun Dec 28 02:27:22.315590 2025] [:error] [pid 46654:tid 46707] [client 13.70.25.249:12186] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aVAlCqyyuBQW4Tqizy6eOwAAAFU"]
[Sun Dec 28 02:27:23.634756 2025] [:error] [pid 46653:tid 46673] [client 13.70.25.249:12178] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsa.php"] [unique_id "aVAlC7j2DbiG6mG0UTPxggAAABA"]
[Sun Dec 28 02:27:24.516592 2025] [:error] [pid 46655:tid 46720] [client 13.70.25.249:12275] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aVAlDBJiIF9AF5FHxvCcnQAAAIc"]
[Sun Dec 28 02:27:25.017409 2025] [:error] [pid 46742:tid 46745] [client 13.70.25.249:12098] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aVAlDeioIIea_hBqsHepcQAAAMA"]
[Sun Dec 28 02:27:25.546979 2025] [:error] [pid 46655:tid 46730] [client 13.70.25.249:12101] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aVAlDRJiIF9AF5FHxvCcoAAAAJE"]
[Sun Dec 28 02:27:26.475014 2025] [:error] [pid 46654:tid 46702] [client 13.70.25.249:12198] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolv.php"] [unique_id "aVAlDqyyuBQW4Tqizy6eRwAAAFA"]
[Sun Dec 28 02:27:27.600971 2025] [:error] [pid 46653:tid 46669] [client 13.70.25.249:12126] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aVAlD7j2DbiG6mG0UTPxjAAAAAw"]
[Sun Dec 28 02:27:29.780890 2025] [:error] [pid 46742:tid 46762] [client 13.70.25.249:12172] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aVAlEeioIIea_hBqsHephgAAANA"]
[Sun Dec 28 02:27:30.229030 2025] [:error] [pid 46653:tid 46662] [client 13.70.25.249:12247] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aVAlErj2DbiG6mG0UTPxjwAAAAU"]
[Sun Dec 28 02:27:30.967652 2025] [:error] [pid 46654:tid 46701] [client 13.70.25.249:16856] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ea3f.php"] [unique_id "aVAlEqyyuBQW4Tqizy6eUAAAAE8"]
[Sun Dec 28 02:27:32.041796 2025] [:error] [pid 46654:tid 46710] [client 13.70.25.249:12183] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aVAlFKyyuBQW4Tqizy6eUgAAAFg"]
[Sun Dec 28 02:27:33.664737 2025] [:error] [pid 46655:tid 46724] [client 13.70.25.249:16807] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aVAlFRJiIF9AF5FHxvCcsQAAAIs"]
[Sun Dec 28 02:27:34.177634 2025] [:error] [pid 46654:tid 46689] [client 13.70.25.249:12283] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aVAlFqyyuBQW4Tqizy6eWgAAAEM"]
[Sun Dec 28 02:27:35.339416 2025] [:error] [pid 46742:tid 46758] [client 13.70.25.249:16885] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/price.php"] [unique_id "aVAlF-ioIIea_hBqsHepmwAAAMw"]
[Sun Dec 28 02:27:35.919933 2025] [:error] [pid 46653:tid 46665] [client 13.70.25.249:16866] [client 13.70.25.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVAlF7j2DbiG6mG0UTPxlAAAAAg"]
[Sun Dec 28 02:27:37.183212 2025] [:error] [pid 46653:tid 46679] [client 13.70.25.249:16812] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Sun Dec 28 07:41:33.600262 2025] [:error] [pid 42378:tid 42399] [client 144.172.97.40:57607] File does not exist: /usr/local/apache/htdocs/suspended-page/unzipper.php
[Sun Dec 28 11:11:29.022637 2025] [:error] [pid 42292:tid 42304] [client 159.89.181.56:49292] [client 159.89.181.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "aVCf4ZyOrM_vaFx1osb5jgAAAAg"], referer: binance.com
[Sun Dec 28 11:11:35.026205 2025] [:error] [pid 43789:tid 43811] [client 159.89.181.56:57703] [client 159.89.181.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aVCf5wa-tUppni4CcCbjJgAAARQ"], referer: binance.com
[Sun Dec 28 13:14:49.548449 2025] [:error] [pid 29437:tid 29481] [client 49.233.45.47:41094] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVC8yRhDotAbVk6pZLdvrQAAAc8"]
[Sun Dec 28 19:27:34.448123 2025] [:error] [pid 29436:tid 29456] [client 122.51.236.174:58362] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVEUJrchzOOtNL9VPNLi-AAAAZE"]
[Sun Dec 28 20:31:20.612910 2025] [:error] [pid 29388:tid 29399] [client 4.190.188.171:63631] [client 4.190.188.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVEjGNoLv2L2zI_SpdXpCwAAAUM"]
[Sun Dec 28 20:31:25.247412 2025] [:error] [pid 43789:tid 43805] [client 4.190.188.171:62139] [client 4.190.188.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVEjHQa-tUppni4CcCY84QAAAQ4"]
[Sun Dec 28 20:31:27.317334 2025] [:error] [pid 29436:tid 29450] [client 4.190.188.171:56966] [client 4.190.188.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVEjH7chzOOtNL9VPNL8QgAAAYs"]
[Sun Dec 28 20:31:28.630748 2025] [:error] [pid 29437:tid 29467] [client 4.190.188.171:62118] [client 4.190.188.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVEjIBhDotAbVk6pZLfNhwAAAcE"]
[Sun Dec 28 22:17:16.036420 2025] [:error] [pid 29388:tid 29418] [client 170.106.181.163:55844] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVE77NoLv2L2zI_SpdUImgAAAVY"]
[Sun Dec 28 23:09:13.772564 2025] [:error] [pid 42293:tid 42333] [client 43.166.244.66:57104] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVFIGcvc9B-5cwN385IWYAAAAEo"]
[Mon Dec 29 05:18:02.259705 2025] [:error] [pid 37389:tid 37457] [client 167.99.61.218:56056] [client 167.99.61.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aVGeisEYrQKI4GZ26QaDigAAAQM"], referer: binance.com
[Mon Dec 29 09:58:23.597698 2025] [:error] [pid 37389:tid 37455] [client 38.248.169.247:34730] [client 38.248.169.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVHgP8EYrQKI4GZ26QbuOwAAAQE"]
[Mon Dec 29 09:58:24.861868 2025] [:error] [pid 37389:tid 37470] [client 179.108.79.120:17805] [client 179.108.79.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVHgQMEYrQKI4GZ26QbuPQAAARA"]
[Mon Dec 29 20:02:22.404033 2025] [:error] [pid 24343:tid 24352] [client 1.15.52.154:37500] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVJtzsvqvAa0rISAVIRiIwAAAgQ"]
[Tue Dec 30 08:16:07.858045 2025] [:error] [pid 55722:tid 55766] [client 125.75.66.97:42706] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVMZx9APH64hQFBaDRizewAAAEg"]
[Tue Dec 30 09:12:01.384457 2025] [:error] [pid 55827:tid 55843] [client 43.165.135.242:33778] [client 43.165.135.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVMm4TGIC-EorhVIeG8P1QAAAM4"]
[Tue Dec 30 15:28:40.440824 2025] [:error] [pid 47441:tid 47449] [client 194.26.192.112:56113] [client 194.26.192.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.26.192.112, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aVN_KC6d2esGSN6Ne3MThgAAAUU"]
[Tue Dec 30 15:28:40.444473 2025] [:error] [pid 47441:tid 47449] [client 194.26.192.112:56113] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Dec 30 15:56:55.290602 2025] [:error] [pid 47553:tid 47571] [client 138.68.86.32:52028] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/api-docs"] [unique_id "aVOFx7vhy9HerwSnwITCHQAAAZA"]
[Tue Dec 30 15:56:56.290957 2025] [:error] [pid 28826:tid 28908] [client 138.68.86.32:52042] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3/api-docs"] [unique_id "aVOFyPOyQggePm1Ed9tp_wAAAQI"]
[Tue Dec 30 15:56:57.287231 2025] [:error] [pid 28954:tid 28965] [client 138.68.86.32:52052] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aVOFyaRZgqk7uuu8M0wKuAAAAAk"]
[Tue Dec 30 15:56:58.302146 2025] [:error] [pid 28954:tid 28968] [client 138.68.86.32:52060] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/swagger.json"] [unique_id "aVOFyqRZgqk7uuu8M0wKugAAAAw"]
[Tue Dec 30 15:56:59.282010 2025] [:error] [pid 28824:tid 28857] [client 138.68.86.32:37932] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/@vite/env"] [unique_id "aVOFy38FhtgLvBhuCR0fbwAAAIw"]
[Tue Dec 30 15:57:00.284856 2025] [:error] [pid 47441:tid 47464] [client 138.68.86.32:37936] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/actuator/env"] [unique_id "aVOFzC6d2esGSN6Ne3MZIQAAAVQ"]
[Tue Dec 30 15:57:01.297582 2025] [:error] [pid 47441:tid 47460] [client 138.68.86.32:37946] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server"] [unique_id "aVOFzS6d2esGSN6Ne3MZIwAAAVA"]
[Tue Dec 30 15:57:02.314214 2025] [:error] [pid 47441:tid 47452] [client 138.68.86.32:37952] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aVOFzi6d2esGSN6Ne3MZJQAAAUg"]
[Tue Dec 30 15:57:04.285279 2025] [:error] [pid 38777:tid 38787] [client 138.68.86.32:37962] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about"] [unique_id "aVOF0GLn9GPxJXPhnHbibwAAAEc"]
[Tue Dec 30 15:57:05.311857 2025] [:error] [pid 47441:tid 47456] [client 138.68.86.32:37966] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug/default/view"] [unique_id "aVOF0S6d2esGSN6Ne3MZKgAAAUw"]
[Tue Dec 30 15:57:06.299611 2025] [:error] [pid 47441:tid 47466] [client 138.68.86.32:37974] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/_catalog"] [unique_id "aVOF0i6d2esGSN6Ne3MZKwAAAVY"]
[Tue Dec 30 15:57:07.299976 2025] [:error] [pid 47441:tid 47461] [client 138.68.86.32:37978] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aVOF0y6d2esGSN6Ne3MZLAAAAVE"]
[Tue Dec 30 15:57:08.301909 2025] [:error] [pid 47553:tid 47564] [client 138.68.86.32:37986] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-status"] [unique_id "aVOF1Lvhy9HerwSnwITCIAAAAYk"]
[Tue Dec 30 15:57:09.300219 2025] [:error] [pid 47553:tid 47577] [client 138.68.86.32:33152] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login.action"] [unique_id "aVOF1bvhy9HerwSnwITCIgAAAZY"]
[Tue Dec 30 15:57:10.287492 2025] [:error] [pid 28826:tid 28906] [client 138.68.86.32:33168] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_all_dbs"] [unique_id "aVOF1vOyQggePm1Ed9tqDQAAAQA"]
[Tue Dec 30 15:57:11.290394 2025] [:error] [pid 47553:tid 47570] [client 138.68.86.32:33184] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.DS_Store"] [unique_id "aVOF17vhy9HerwSnwITCJAAAAY8"]
[Tue Dec 30 15:57:12.288236 2025] [:error] [pid 28954:tid 28956] [client 138.68.86.32:33190] [client 138.68.86.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aVOF2KRZgqk7uuu8M0wKxAAAAAA"]
[Tue Dec 30 15:57:14.301209 2025] [:error] [pid 47553:tid 47576] [client 138.68.86.32:33194] [client 138.68.86.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aVOF2rvhy9HerwSnwITCJwAAAZU"]
[Tue Dec 30 15:57:15.308477 2025] [:error] [pid 28825:tid 28899] [client 138.68.86.32:33198] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aVOF2z6dbc1G2hX-KfQtywAAANQ"]
[Tue Dec 30 15:57:16.289995 2025] [:error] [pid 28825:tid 28898] [client 138.68.86.32:33206] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.json"] [unique_id "aVOF3D6dbc1G2hX-KfQtzgAAANM"]
[Tue Dec 30 15:57:17.302481 2025] [:error] [pid 28954:tid 28978] [client 138.68.86.32:33212] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/telescope/requests"] [unique_id "aVOF3aRZgqk7uuu8M0wKxgAAABY"]
[Tue Dec 30 15:57:18.310856 2025] [:error] [pid 28825:tid 28903] [client 138.68.86.32:33220] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVOF3j6dbc1G2hX-KfQt0wAAANg"]
[Tue Dec 30 15:57:19.302315 2025] [:error] [pid 28954:tid 28972] [client 138.68.86.32:33406] [client 138.68.86.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVOF36RZgqk7uuu8M0wKyAAAABA"]
[Tue Dec 30 20:27:12.228967 2025] [:error] [pid 28954:tid 28968] [client 180.110.203.108:47515] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVPFIKRZgqk7uuu8M0w5XAAAAAw"]
[Tue Dec 30 20:54:17.098822 2025] [:error] [pid 47441:tid 47464] [client 103.77.106.57:54368] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/postnews.php"] [unique_id "aVPLeS6d2esGSN6Ne3NZjAAAAVQ"]
[Tue Dec 30 20:54:19.925981 2025] [:error] [pid 28824:tid 28845] [client 103.77.106.57:54797] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aVPLe38FhtgLvBhuCR1M3QAAAIA"]
[Tue Dec 30 20:54:21.844681 2025] [:error] [pid 38777:tid 38788] [client 103.77.106.57:55508] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aVPLfWLn9GPxJXPhnHYZAAAAAEg"]
[Tue Dec 30 22:19:21.053076 2025] [:error] [pid 28954:tid 28968] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/mda.php
[Tue Dec 30 22:19:21.261014 2025] [:error] [pid 28954:tid 28959] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/cheka.php
[Tue Dec 30 22:19:21.456324 2025] [:error] [pid 28954:tid 28963] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Tue Dec 30 22:19:21.673160 2025] [:error] [pid 28954:tid 28974] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Tue Dec 30 22:19:21.888627 2025] [:error] [pid 28954:tid 28966] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/zsz.php
[Tue Dec 30 22:19:22.125288 2025] [:error] [pid 28954:tid 28967] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/kaza.php
[Tue Dec 30 22:19:22.325470 2025] [:error] [pid 28954:tid 28961] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/lites.php
[Tue Dec 30 22:19:22.556716 2025] [:error] [pid 28954:tid 28975] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/bby.php
[Tue Dec 30 22:19:22.757035 2025] [:error] [pid 28954:tid 28958] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/get.php
[Tue Dec 30 22:19:22.978828 2025] [:error] [pid 28954:tid 28964] [client 158.23.84.113:25837] File does not exist: /usr/local/apache/htdocs/suspended-page/xtride.php
[Tue Dec 30 22:19:23.233495 2025] [:error] [pid 28954:tid 28970] [client 158.23.84.113:25837] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVPfa6RZgqk7uuu8M0xQHAAAAA4"]
[Tue Dec 30 22:19:25.074951 2025] [:error] [pid 28825:tid 28886] [client 158.23.84.113:16015] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVPfbT6dbc1G2hX-KfRpMAAAAMc"]
[Tue Dec 30 22:19:27.803960 2025] [:error] [pid 28824:tid 28867] [client 158.23.84.113:25804] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVPfb38FhtgLvBhuCR1bYwAAAJY"]
[Tue Dec 30 22:19:29.895076 2025] [:error] [pid 28824:tid 28854] [client 158.23.84.113:33171] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVPfcX8FhtgLvBhuCR1bZwAAAIk"]
[Tue Dec 30 22:19:31.365086 2025] [:error] [pid 28824:tid 28855] [client 158.23.84.113:12946] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVPfc38FhtgLvBhuCR1baQAAAIo"]
[Tue Dec 30 22:19:33.177419 2025] [:error] [pid 28825:tid 28884] [client 158.23.84.113:34691] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVPfdT6dbc1G2hX-KfRpNgAAAMU"]
[Tue Dec 30 22:19:34.786118 2025] [:error] [pid 28954:tid 28961] [client 158.23.84.113:15110] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVPfdqRZgqk7uuu8M0xQJAAAAAU"]
[Tue Dec 30 22:19:37.559625 2025] [:error] [pid 28825:tid 28886] [client 158.23.84.113:15146] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVPfeT6dbc1G2hX-KfRpPgAAAMc"]
[Tue Dec 30 22:19:38.977428 2025] [:error] [pid 38777:tid 38791] [client 158.23.84.113:12546] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVPfemLn9GPxJXPhnHYoqQAAAEs"]
[Tue Dec 30 22:19:40.288526 2025] [:error] [pid 28824:tid 28867] [client 158.23.84.113:25812] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVPffH8FhtgLvBhuCR1bbwAAAJY"]
[Tue Dec 30 22:19:42.315269 2025] [:error] [pid 47441:tid 47446] [client 158.23.84.113:35814] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVPffi6d2esGSN6Ne3NyWwAAAUI"]
[Tue Dec 30 22:19:43.721835 2025] [:error] [pid 38777:tid 38796] [client 158.23.84.113:25808] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVPff2Ln9GPxJXPhnHYoqwAAAFA"]
[Tue Dec 30 22:19:46.243243 2025] [:error] [pid 28824:tid 28862] [client 158.23.84.113:25843] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dir.php"] [unique_id "aVPfgn8FhtgLvBhuCR1bcgAAAJE"]
[Tue Dec 30 22:19:47.179974 2025] [:error] [pid 28824:tid 28866] [client 158.23.84.113:34035] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dir.php"] [unique_id "aVPfg38FhtgLvBhuCR1bcwAAAJU"]
[Tue Dec 30 22:19:48.584300 2025] [:error] [pid 28825:tid 28891] [client 158.23.84.113:29965] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dir.php"] [unique_id "aVPfhD6dbc1G2hX-KfRpQAAAAMw"]
[Tue Dec 30 22:19:49.930462 2025] [:error] [pid 47553:tid 47578] [client 158.23.84.113:27086] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dir.php"] [unique_id "aVPfhbvhy9HerwSnwIQjSwAAAZc"]
[Tue Dec 30 22:19:52.247349 2025] [:error] [pid 28826:tid 28924] [client 158.23.84.113:33994] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVPfiPOyQggePm1Ed9uo9AAAARE"]
[Tue Dec 30 22:19:53.024972 2025] [:error] [pid 38777:tid 38790] [client 158.23.84.113:25835] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVPfiWLn9GPxJXPhnHYorAAAAEo"]
[Tue Dec 30 22:19:54.995444 2025] [:error] [pid 28826:tid 28927] [client 158.23.84.113:14748] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVPfivOyQggePm1Ed9uo-AAAARQ"]
[Tue Dec 30 22:19:56.608874 2025] [:error] [pid 28826:tid 28931] [client 158.23.84.113:28835] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVPfjPOyQggePm1Ed9uo-gAAARg"]
[Tue Dec 30 22:19:57.738236 2025] [:error] [pid 47441:tid 47463] [client 158.23.84.113:34037] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVPfjS6d2esGSN6Ne3NyYgAAAVM"]
[Tue Dec 30 22:19:59.180786 2025] [:error] [pid 38777:tid 38804] [client 158.23.84.113:32841] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVPfj2Ln9GPxJXPhnHYorwAAAFg"]
[Tue Dec 30 22:20:00.797098 2025] [:error] [pid 28826:tid 28910] [client 158.23.84.113:12291] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVPfkPOyQggePm1Ed9uo_wAAAQQ"]
[Tue Dec 30 22:20:02.946567 2025] [:error] [pid 28825:tid 28886] [client 158.23.84.113:34817] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVPfkj6dbc1G2hX-KfRpSQAAAMc"]
[Tue Dec 30 22:20:04.110835 2025] [:error] [pid 47441:tid 47457] [client 158.23.84.113:35310] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aVPflC6d2esGSN6Ne3NyaQAAAU0"]
[Tue Dec 30 22:20:06.686689 2025] [:error] [pid 47553:tid 47572] [client 158.23.84.113:34012] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aVPflrvhy9HerwSnwIQjYwAAAZE"]
[Tue Dec 30 22:20:07.932817 2025] [:error] [pid 38777:tid 38795] [client 158.23.84.113:32883] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aVPfl2Ln9GPxJXPhnHYotQAAAE8"]
[Tue Dec 30 22:20:10.218668 2025] [:error] [pid 47441:tid 47452] [client 158.23.84.113:32847] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file51.php"] [unique_id "aVPfmi6d2esGSN6Ne3NycQAAAUg"]
[Tue Dec 30 22:20:11.465740 2025] [:error] [pid 28825:tid 28899] [client 158.23.84.113:32872] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVPfmz6dbc1G2hX-KfRpUAAAANQ"]
[Tue Dec 30 22:20:13.950517 2025] [:error] [pid 28954:tid 28972] [client 158.23.84.113:38270] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVPfnaRZgqk7uuu8M0xQXgAAABA"]
[Tue Dec 30 22:20:15.827220 2025] [:error] [pid 47441:tid 47445] [client 158.23.84.113:31743] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVPfny6d2esGSN6Ne3NyegAAAUE"]
[Tue Dec 30 22:20:17.202964 2025] [:error] [pid 28826:tid 28909] [client 158.23.84.113:31709] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVPfofOyQggePm1Ed9upBgAAAQM"]
[Tue Dec 30 22:20:18.447447 2025] [:error] [pid 38777:tid 38798] [client 158.23.84.113:35864] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVPfomLn9GPxJXPhnHYoxwAAAFI"]
[Tue Dec 30 22:20:19.946657 2025] [:error] [pid 28954:tid 28962] [client 158.23.84.113:19106] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVPfo6RZgqk7uuu8M0xQYAAAAAY"]
[Tue Dec 30 22:20:20.872564 2025] [:error] [pid 28954:tid 28965] [client 158.23.84.113:34855] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVPfpKRZgqk7uuu8M0xQZgAAAAk"]
[Tue Dec 30 22:20:21.929486 2025] [:error] [pid 28826:tid 28914] [client 158.23.84.113:12903] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVPfpfOyQggePm1Ed9upDAAAAQg"]
[Tue Dec 30 22:20:23.754164 2025] [:error] [pid 28826:tid 28911] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/File.php
[Tue Dec 30 22:20:23.971084 2025] [:error] [pid 28826:tid 28924] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/all.php
[Tue Dec 30 22:20:24.166708 2025] [:error] [pid 28826:tid 28913] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/bbn.php
[Tue Dec 30 22:20:24.361851 2025] [:error] [pid 28826:tid 28929] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/berlin.php
[Tue Dec 30 22:20:24.558225 2025] [:error] [pid 28826:tid 28930] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Tue Dec 30 22:20:24.753666 2025] [:error] [pid 28826:tid 28925] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/xz89.php
[Tue Dec 30 22:20:24.946767 2025] [:error] [pid 28826:tid 28927] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/thai.php
[Tue Dec 30 22:20:25.175057 2025] [:error] [pid 28826:tid 28909] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/lopst.php
[Tue Dec 30 22:20:25.371059 2025] [:error] [pid 28826:tid 28926] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/wft.php
[Tue Dec 30 22:20:25.565962 2025] [:error] [pid 28826:tid 28916] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/ws28.php
[Tue Dec 30 22:20:25.759832 2025] [:error] [pid 28826:tid 28920] [client 158.23.84.113:29070] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Tue Dec 30 22:20:25.950219 2025] [:error] [pid 28826:tid 28931] [client 158.23.84.113:29070] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aVPfqfOyQggePm1Ed9upGgAAARg"]
[Tue Dec 30 22:20:31.294880 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:19091] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aVPfry6d2esGSN6Ne3NylQAAAVI"]
[Tue Dec 30 22:20:31.892641 2025] [:error] [pid 47441:tid 47468] [client 158.23.84.113:15106] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aVPfry6d2esGSN6Ne3NymAAAAVg"]
[Tue Dec 30 22:20:33.683823 2025] [:error] [pid 28824:tid 28856] [client 158.23.84.113:12909] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbbn.php"] [unique_id "aVPfsX8FhtgLvBhuCR1buAAAAIs"]
[Tue Dec 30 22:20:35.875748 2025] [:error] [pid 28824:tid 28861] [client 158.23.84.113:19083] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVPfs38FhtgLvBhuCR1bugAAAJA"]
[Tue Dec 30 22:20:37.653284 2025] [:error] [pid 28826:tid 28931] [client 158.23.84.113:19124] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVPftfOyQggePm1Ed9upKgAAARg"]
[Tue Dec 30 22:20:40.211192 2025] [:error] [pid 47553:tid 47578] [client 158.23.84.113:12884] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVPfuLvhy9HerwSnwIQjkQAAAZc"]
[Tue Dec 30 22:20:42.597458 2025] [:error] [pid 38777:tid 38804] [client 158.23.84.113:12872] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVPfumLn9GPxJXPhnHYo1AAAAFg"]
[Tue Dec 30 22:20:44.775863 2025] [:error] [pid 47441:tid 47466] [client 158.23.84.113:12973] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aVPfvC6d2esGSN6Ne3NypgAAAVY"]
[Tue Dec 30 22:20:45.574259 2025] [:error] [pid 47441:tid 47450] [client 158.23.84.113:33422] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aVPfvS6d2esGSN6Ne3NyrAAAAUY"]
[Tue Dec 30 22:20:47.328665 2025] [:error] [pid 28825:tid 28890] [client 158.23.84.113:12877] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aVPfvz6dbc1G2hX-KfRpbQAAAMs"]
[Tue Dec 30 22:20:48.526670 2025] [:error] [pid 28954:tid 28962] [client 158.23.84.113:12882] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fz.php"] [unique_id "aVPfwKRZgqk7uuu8M0xQjgAAAAY"]
[Tue Dec 30 22:20:50.825455 2025] [:error] [pid 47553:tid 47555] [client 158.23.84.113:19104] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aVPfwrvhy9HerwSnwIQjnQAAAYA"]
[Tue Dec 30 22:20:52.572438 2025] [:error] [pid 38777:tid 38802] [client 158.23.84.113:35674] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aVPfxGLn9GPxJXPhnHYo3gAAAFY"]
[Tue Dec 30 22:20:54.165095 2025] [:error] [pid 28826:tid 28907] [client 158.23.84.113:15810] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aVPfxvOyQggePm1Ed9upOwAAAQE"]
[Tue Dec 30 22:20:55.748007 2025] [:error] [pid 28954:tid 28962] [client 158.23.84.113:31771] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sang.php"] [unique_id "aVPfx6RZgqk7uuu8M0xQmgAAAAY"]
[Tue Dec 30 22:20:57.185944 2025] [:error] [pid 47553:tid 47567] [client 158.23.84.113:12698] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aVPfybvhy9HerwSnwIQjpgAAAYw"]
[Tue Dec 30 22:20:58.985262 2025] [:error] [pid 28954:tid 28964] [client 158.23.84.113:31785] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aVPfyqRZgqk7uuu8M0xQnQAAAAg"]
[Tue Dec 30 22:21:00.663907 2025] [:error] [pid 47441:tid 47451] [client 158.23.84.113:30963] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aVPfzC6d2esGSN6Ne3NyvgAAAUc"]
[Tue Dec 30 22:21:04.439924 2025] [:error] [pid 28824:tid 28862] [client 158.23.84.113:31782] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0o0.php"] [unique_id "aVPf0H8FhtgLvBhuCR1b0wAAAJE"]
[Tue Dec 30 22:21:06.897791 2025] [:error] [pid 47441:tid 47460] [client 158.23.84.113:12887] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVPf0i6d2esGSN6Ne3NyxQAAAVA"]
[Tue Dec 30 22:21:10.157294 2025] [:error] [pid 28826:tid 28931] [client 158.23.84.113:31751] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVPf1vOyQggePm1Ed9upQwAAARg"]
[Tue Dec 30 22:21:11.344024 2025] [:error] [pid 28954:tid 28962] [client 158.23.84.113:29069] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVPf16RZgqk7uuu8M0xQsAAAAAY"]
[Tue Dec 30 22:21:12.858837 2025] [:error] [pid 28825:tid 28900] [client 158.23.84.113:12990] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVPf2D6dbc1G2hX-KfRpeQAAANU"]
[Tue Dec 30 22:21:14.501698 2025] [:error] [pid 47553:tid 47559] [client 158.23.84.113:33712] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVPf2rvhy9HerwSnwIQjuAAAAYQ"]
[Tue Dec 30 22:21:15.599841 2025] [:error] [pid 28954:tid 28957] [client 158.23.84.113:33675] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVPf26RZgqk7uuu8M0xQuQAAAAE"]
[Tue Dec 30 22:21:16.164098 2025] [:error] [pid 28954:tid 28959] [client 158.23.84.113:13285] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVPf3KRZgqk7uuu8M0xQugAAAAM"]
[Tue Dec 30 22:21:17.931758 2025] [:error] [pid 47441:tid 47444] [client 158.23.84.113:29064] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVPf3S6d2esGSN6Ne3NyzgAAAUA"]
[Tue Dec 30 22:21:18.741887 2025] [:error] [pid 28824:tid 28866] [client 158.23.84.113:33701] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVPf3n8FhtgLvBhuCR1b2gAAAJU"]
[Tue Dec 30 22:21:19.642848 2025] [:error] [pid 47441:tid 47467] [client 158.23.84.113:29105] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVPf3y6d2esGSN6Ne3Ny0wAAAVc"]
[Tue Dec 30 22:21:21.928042 2025] [:error] [pid 28954:tid 28974] [client 158.23.84.113:12920] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVPf4aRZgqk7uuu8M0xQxQAAABI"]
[Tue Dec 30 22:21:23.545143 2025] [:error] [pid 28954:tid 28956] [client 158.23.84.113:31777] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVPf46RZgqk7uuu8M0xQzAAAAAA"]
[Tue Dec 30 22:21:24.629323 2025] [:error] [pid 28824:tid 28854] [client 158.23.84.113:35505] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aVPf5H8FhtgLvBhuCR1b3AAAAIk"]
[Tue Dec 30 22:21:25.423146 2025] [:error] [pid 47441:tid 47458] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Tue Dec 30 22:21:25.692151 2025] [:error] [pid 47441:tid 47455] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Tue Dec 30 22:21:25.900508 2025] [:error] [pid 47441:tid 47464] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Dec 30 22:21:26.109986 2025] [:error] [pid 47441:tid 47461] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Dec 30 22:21:26.373967 2025] [:error] [pid 47441:tid 47456] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Tue Dec 30 22:21:26.632253 2025] [:error] [pid 47441:tid 47448] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Dec 30 22:21:26.871660 2025] [:error] [pid 47441:tid 47446] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/tx1.php
[Tue Dec 30 22:21:27.368293 2025] [:error] [pid 47441:tid 47460] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/xv.php
[Tue Dec 30 22:21:27.581537 2025] [:error] [pid 47441:tid 47467] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/htaccess.php
[Tue Dec 30 22:21:27.815882 2025] [:error] [pid 47441:tid 47458] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/fv.php
[Tue Dec 30 22:21:28.057503 2025] [:error] [pid 47441:tid 47457] [client 158.23.84.113:29072] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Dec 30 22:21:28.259979 2025] [:error] [pid 47441:tid 47450] [client 158.23.84.113:29072] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aVPf6C6d2esGSN6Ne3Ny8QAAAUY"]
[Tue Dec 30 22:21:29.487535 2025] [:error] [pid 28826:tid 28913] [client 158.23.84.113:30773] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aVPf6fOyQggePm1Ed9upSQAAAQc"]
[Tue Dec 30 22:21:31.678813 2025] [:error] [pid 28825:tid 28897] [client 158.23.84.113:38043] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aVPf6z6dbc1G2hX-KfRphgAAANI"]
[Tue Dec 30 22:21:33.134734 2025] [:error] [pid 28954:tid 28968] [client 158.23.84.113:38067] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aVPf7aRZgqk7uuu8M0xQ3gAAAAw"]
[Tue Dec 30 22:21:34.108167 2025] [:error] [pid 28954:tid 28979] [client 158.23.84.113:38018] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVPf7qRZgqk7uuu8M0xQ4QAAABc"]
[Tue Dec 30 22:21:36.569752 2025] [:error] [pid 47553:tid 47556] [client 158.23.84.113:29083] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVPf8Lvhy9HerwSnwIQjywAAAYE"]
[Tue Dec 30 22:21:37.753303 2025] [:error] [pid 28954:tid 28957] [client 158.23.84.113:36063] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVPf8aRZgqk7uuu8M0xQ6wAAAAE"]
[Tue Dec 30 22:21:39.057614 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:13299] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVPf8y6d2esGSN6Ne3Ny_QAAAVI"]
[Tue Dec 30 22:21:39.893401 2025] [:error] [pid 47441:tid 47461] [client 158.23.84.113:33691] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVPf8y6d2esGSN6Ne3NzAAAAAVE"]
[Tue Dec 30 22:21:41.928528 2025] [:error] [pid 47553:tid 47576] [client 158.23.84.113:34542] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVPf9bvhy9HerwSnwIQj0QAAAZU"]
[Tue Dec 30 22:21:43.855749 2025] [:error] [pid 38777:tid 38786] [client 158.23.84.113:28065] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVPf92Ln9GPxJXPhnHYpCAAAAEY"]
[Tue Dec 30 22:21:45.506158 2025] [:error] [pid 38777:tid 38803] [client 158.23.84.113:29084] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVPf-WLn9GPxJXPhnHYpCwAAAFc"]
[Tue Dec 30 22:21:46.445224 2025] [:error] [pid 47441:tid 47451] [client 158.23.84.113:38024] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVPf-i6d2esGSN6Ne3NzCQAAAUc"]
[Tue Dec 30 22:21:47.680352 2025] [:error] [pid 28825:tid 28879] [client 158.23.84.113:12351] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVPf-z6dbc1G2hX-KfRpjQAAAMA"]
[Tue Dec 30 22:21:50.334078 2025] [:error] [pid 28824:tid 28868] [client 158.23.84.113:13253] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVPf_n8FhtgLvBhuCR1b6QAAAJc"]
[Tue Dec 30 22:21:51.744539 2025] [:error] [pid 47441:tid 47453] [client 158.23.84.113:29056] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVPf_y6d2esGSN6Ne3NzCwAAAUk"]
[Tue Dec 30 22:21:53.633705 2025] [:error] [pid 47553:tid 47561] [client 158.23.84.113:33775] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVPgAbvhy9HerwSnwIQj3QAAAYY"]
[Tue Dec 30 22:21:55.274877 2025] [:error] [pid 47553:tid 47577] [client 158.23.84.113:34122] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVPgA7vhy9HerwSnwIQj4gAAAZY"]
[Tue Dec 30 22:21:56.440071 2025] [:error] [pid 28825:tid 28888] [client 158.23.84.113:35927] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVPgBD6dbc1G2hX-KfRplwAAAMk"]
[Tue Dec 30 22:21:57.849728 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:13254] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVPgBS6d2esGSN6Ne3NzFwAAAVI"]
[Tue Dec 30 22:21:59.604805 2025] [:error] [pid 47553:tid 47562] [client 158.23.84.113:35915] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVPgB7vhy9HerwSnwIQj5wAAAYc"]
[Tue Dec 30 22:22:01.441214 2025] [:error] [pid 38777:tid 38787] [client 158.23.84.113:35938] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVPgCWLn9GPxJXPhnHYpFAAAAEc"]
[Tue Dec 30 22:22:02.427343 2025] [:error] [pid 28824:tid 28865] [client 158.23.84.113:35271] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVPgCn8FhtgLvBhuCR1b7wAAAJQ"]
[Tue Dec 30 22:22:04.784153 2025] [:error] [pid 28825:tid 28886] [client 158.23.84.113:35524] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVPgDD6dbc1G2hX-KfRpnQAAAMc"]
[Tue Dec 30 22:22:06.190793 2025] [:error] [pid 28825:tid 28893] [client 158.23.84.113:35289] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVPgDj6dbc1G2hX-KfRpnwAAAM4"]
[Tue Dec 30 22:22:07.969752 2025] [:error] [pid 28824:tid 28860] [client 158.23.84.113:35629] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVPgD38FhtgLvBhuCR1b-AAAAI8"]
[Tue Dec 30 22:22:09.255383 2025] [:error] [pid 28825:tid 28888] [client 158.23.84.113:35284] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVPgET6dbc1G2hX-KfRpogAAAMk"]
[Tue Dec 30 22:22:11.006627 2025] [:error] [pid 47441:tid 47461] [client 158.23.84.113:35910] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVPgEy6d2esGSN6Ne3NzMgAAAVE"]
[Tue Dec 30 22:22:13.028743 2025] [:error] [pid 47441:tid 47449] [client 158.23.84.113:15815] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVPgFS6d2esGSN6Ne3NzOQAAAUU"]
[Tue Dec 30 22:22:13.554828 2025] [:error] [pid 47553:tid 47563] [client 158.23.84.113:30899] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVPgFbvhy9HerwSnwIQj-QAAAYg"]
[Tue Dec 30 22:22:14.817431 2025] [:error] [pid 28824:tid 28863] [client 158.23.84.113:14773] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVPgFn8FhtgLvBhuCR1b_AAAAJI"]
[Tue Dec 30 22:22:16.148058 2025] [:error] [pid 47441:tid 47456] [client 158.23.84.113:28861] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aVPgGC6d2esGSN6Ne3NzQgAAAUw"]
[Tue Dec 30 22:22:16.922208 2025] [:error] [pid 38777:tid 38799] [client 158.23.84.113:35286] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVPgGGLn9GPxJXPhnHYpKQAAAFM"]
[Tue Dec 30 22:22:17.759268 2025] [:error] [pid 47553:tid 47559] [client 158.23.84.113:34139] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVPgGbvhy9HerwSnwIQj_QAAAYQ"]
[Tue Dec 30 22:22:20.114255 2025] [:error] [pid 28825:tid 28889] [client 158.23.84.113:35282] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVPgHD6dbc1G2hX-KfRpqQAAAMo"]
[Tue Dec 30 22:22:21.547252 2025] [:error] [pid 38777:tid 38791] [client 158.23.84.113:12965] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVPgHWLn9GPxJXPhnHYpMgAAAEs"]
[Tue Dec 30 22:22:22.745801 2025] [:error] [pid 28954:tid 28956] [client 158.23.84.113:34171] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVPgHqRZgqk7uuu8M0xRDQAAAAA"]
[Tue Dec 30 22:22:23.683043 2025] [:error] [pid 28824:tid 28847] [client 158.23.84.113:32165] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVPgH38FhtgLvBhuCR1cCQAAAII"]
[Tue Dec 30 22:22:24.707509 2025] [:error] [pid 47441:tid 47444] [client 158.23.84.113:25883] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVPgIC6d2esGSN6Ne3NzTQAAAUA"]
[Tue Dec 30 22:22:26.130481 2025] [:error] [pid 47441:tid 47452] [client 158.23.84.113:12729] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVPgIi6d2esGSN6Ne3NzTwAAAUg"]
[Tue Dec 30 22:22:27.597167 2025] [:error] [pid 28954:tid 28957] [client 158.23.84.113:32132] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aVPgI6RZgqk7uuu8M0xREAAAAAE"]
[Tue Dec 30 22:22:29.725096 2025] [:error] [pid 28954:tid 28979] [client 158.23.84.113:32173] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Dec 30 22:22:29.965291 2025] [:error] [pid 28954:tid 28976] [client 158.23.84.113:32173] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Dec 30 22:22:30.962943 2025] [:error] [pid 28954:tid 28961] [client 158.23.84.113:32173] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Dec 30 22:22:31.158207 2025] [:error] [pid 28954:tid 28963] [client 158.23.84.113:32173] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Dec 30 22:22:31.352791 2025] [:error] [pid 28954:tid 28965] [client 158.23.84.113:32173] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Dec 30 22:22:31.544969 2025] [:error] [pid 28954:tid 28968] [client 158.23.84.113:32173] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aVPgJ6RZgqk7uuu8M0xRHQAAAAw"]
[Tue Dec 30 22:22:35.384264 2025] [:error] [pid 28826:tid 28926] [client 158.23.84.113:12448] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Dec 30 22:22:35.631168 2025] [:error] [pid 28826:tid 28915] [client 158.23.84.113:12448] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Dec 30 22:22:36.089115 2025] [:error] [pid 28826:tid 28909] [client 158.23.84.113:12448] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Dec 30 22:22:36.285645 2025] [:error] [pid 28826:tid 28931] [client 158.23.84.113:12448] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Dec 30 22:22:36.482328 2025] [:error] [pid 28826:tid 28910] [client 158.23.84.113:12448] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Dec 30 22:22:36.690282 2025] [:error] [pid 28826:tid 28916] [client 158.23.84.113:12448] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Dec 30 22:22:36.882777 2025] [:error] [pid 28826:tid 28923] [client 158.23.84.113:12448] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVPgLPOyQggePm1Ed9uphQAAARA"]
[Tue Dec 30 22:22:37.881175 2025] [:error] [pid 28954:tid 28976] [client 158.23.84.113:32140] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVPgLaRZgqk7uuu8M0xRMgAAABQ"]
[Tue Dec 30 22:22:39.523443 2025] [:error] [pid 28954:tid 28956] [client 158.23.84.113:12481] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVPgL6RZgqk7uuu8M0xROwAAAAA"]
[Tue Dec 30 22:22:40.566616 2025] [:error] [pid 28954:tid 28968] [client 158.23.84.113:32190] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVPgMKRZgqk7uuu8M0xRPgAAAAw"]
[Tue Dec 30 22:22:41.843464 2025] [:error] [pid 28824:tid 28856] [client 158.23.84.113:32183] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVPgMX8FhtgLvBhuCR1cEQAAAIs"]
[Tue Dec 30 22:22:43.903941 2025] [:error] [pid 28826:tid 28924] [client 158.23.84.113:30748] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVPgM_OyQggePm1Ed9upigAAARE"]
[Tue Dec 30 22:22:45.428085 2025] [:error] [pid 28824:tid 28852] [client 158.23.84.113:35707] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVPgNX8FhtgLvBhuCR1cFgAAAIc"]
[Tue Dec 30 22:22:47.064487 2025] [:error] [pid 28824:tid 28845] [client 158.23.84.113:27921] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVPgN38FhtgLvBhuCR1cGQAAAIA"]
[Tue Dec 30 22:22:48.798333 2025] [:error] [pid 28826:tid 28910] [client 158.23.84.113:16040] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVPgOPOyQggePm1Ed9upjwAAAQQ"]
[Tue Dec 30 22:22:51.627506 2025] [:error] [pid 47553:tid 47579] [client 158.23.84.113:32136] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVPgO7vhy9HerwSnwIQkFgAAAZg"]
[Tue Dec 30 22:22:54.688250 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:12988] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVPgPi6d2esGSN6Ne3NzZAAAAVI"]
[Tue Dec 30 22:22:55.987448 2025] [:error] [pid 38777:tid 38802] [client 158.23.84.113:32161] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVPgP2Ln9GPxJXPhnHYpRQAAAFY"]
[Tue Dec 30 22:22:57.982746 2025] [:error] [pid 38777:tid 38804] [client 158.23.84.113:25871] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVPgQWLn9GPxJXPhnHYpSAAAAFg"]
[Tue Dec 30 22:22:59.882016 2025] [:error] [pid 38777:tid 38795] [client 158.23.84.113:31906] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVPgQ2Ln9GPxJXPhnHYpTAAAAE8"]
[Tue Dec 30 22:23:01.754513 2025] [:error] [pid 28826:tid 28915] [client 158.23.84.113:35319] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVPgRfOyQggePm1Ed9upmwAAAQk"]
[Tue Dec 30 22:23:03.689507 2025] [:error] [pid 47553:tid 47566] [client 158.23.84.113:34552] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVPgR7vhy9HerwSnwIQkJQAAAYs"]
[Tue Dec 30 22:23:05.144973 2025] [:error] [pid 28826:tid 28910] [client 158.23.84.113:35276] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVPgSfOyQggePm1Ed9upnAAAAQQ"]
[Tue Dec 30 22:23:06.993202 2025] [:error] [pid 47553:tid 47577] [client 158.23.84.113:13249] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVPgSrvhy9HerwSnwIQkKwAAAZY"]
[Tue Dec 30 22:23:08.386472 2025] [:error] [pid 47553:tid 47555] [client 158.23.84.113:35264] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVPgTLvhy9HerwSnwIQkLQAAAYA"]
[Tue Dec 30 22:23:09.504734 2025] [:error] [pid 28954:tid 28960] [client 158.23.84.113:35285] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVPgTaRZgqk7uuu8M0xRUQAAAAQ"]
[Tue Dec 30 22:23:10.725024 2025] [:error] [pid 28824:tid 28867] [client 158.23.84.113:31125] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVPgTn8FhtgLvBhuCR1cNgAAAJY"]
[Tue Dec 30 22:23:12.206278 2025] [:error] [pid 47553:tid 47563] [client 158.23.84.113:35304] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVPgULvhy9HerwSnwIQkMQAAAYg"]
[Tue Dec 30 22:23:13.956802 2025] [:error] [pid 28826:tid 28907] [client 158.23.84.113:20546] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVPgUfOyQggePm1Ed9upowAAAQE"]
[Tue Dec 30 22:23:14.771144 2025] [:error] [pid 28825:tid 28894] [client 158.23.84.113:20582] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVPgUj6dbc1G2hX-KfRp5wAAAM8"]
[Tue Dec 30 22:23:15.917407 2025] [:error] [pid 47441:tid 47466] [client 158.23.84.113:36032] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVPgUy6d2esGSN6Ne3NzawAAAVY"]
[Tue Dec 30 22:23:17.339737 2025] [:error] [pid 28826:tid 28929] [client 158.23.84.113:20591] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVPgVfOyQggePm1Ed9upqwAAARY"]
[Tue Dec 30 22:23:18.420587 2025] [:error] [pid 28826:tid 28908] [client 158.23.84.113:31161] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVPgVvOyQggePm1Ed9uprQAAAQI"]
[Tue Dec 30 22:23:20.252294 2025] [:error] [pid 47441:tid 47453] [client 158.23.84.113:25897] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVPgWC6d2esGSN6Ne3NzdQAAAUk"]
[Tue Dec 30 22:23:22.368855 2025] [:error] [pid 47553:tid 47560] [client 158.23.84.113:31134] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aVPgWrvhy9HerwSnwIQkMwAAAYU"]
[Tue Dec 30 22:23:23.337213 2025] [:error] [pid 47441:tid 47445] [client 158.23.84.113:13287] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aVPgWy6d2esGSN6Ne3NzegAAAUE"]
[Tue Dec 30 22:23:24.056189 2025] [:error] [pid 28954:tid 28974] [client 158.23.84.113:20573] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aVPgXKRZgqk7uuu8M0xRWgAAABI"]
[Tue Dec 30 22:23:24.694637 2025] [:error] [pid 28825:tid 28882] [client 158.23.84.113:20566] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about3.php"] [unique_id "aVPgXD6dbc1G2hX-KfRp8gAAAMM"]
[Tue Dec 30 22:23:25.866038 2025] [:error] [pid 28954:tid 28967] [client 158.23.84.113:20550] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVPgXaRZgqk7uuu8M0xRZwAAAAs"]
[Tue Dec 30 22:23:27.726734 2025] [:error] [pid 47441:tid 47444] [client 158.23.84.113:35283] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVPgXy6d2esGSN6Ne3NzgAAAAUA"]
[Tue Dec 30 22:23:29.102108 2025] [:error] [pid 47441:tid 47467] [client 158.23.84.113:35479] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVPgYS6d2esGSN6Ne3NzhQAAAVc"]
[Tue Dec 30 22:23:30.246512 2025] [:error] [pid 28954:tid 28970] [client 158.23.84.113:28834] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVPgYqRZgqk7uuu8M0xRbQAAAA4"]
[Tue Dec 30 22:23:31.908458 2025] [:error] [pid 47553:tid 47574] [client 158.23.84.113:29701] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVPgY7vhy9HerwSnwIQkWwAAAZM"]
[Tue Dec 30 22:23:33.145229 2025] [:error] [pid 28825:tid 28887] [client 158.23.84.113:20559] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVPgZT6dbc1G2hX-KfRp-wAAAMg"]
[Tue Dec 30 22:23:34.775410 2025] [:error] [pid 28826:tid 28920] [client 158.23.84.113:12929] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVPgZvOyQggePm1Ed9upzQAAAQ0"]
[Tue Dec 30 22:23:35.656747 2025] [:error] [pid 38777:tid 38791] [client 158.23.84.113:35281] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVPgZ2Ln9GPxJXPhnHYpjAAAAEs"]
[Tue Dec 30 22:23:37.310959 2025] [:error] [pid 38777:tid 38785] [client 158.23.84.113:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Dec 30 22:23:37.509721 2025] [:error] [pid 38777:tid 38780] [client 158.23.84.113:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Dec 30 22:23:37.705340 2025] [:error] [pid 38777:tid 38798] [client 158.23.84.113:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Dec 30 22:23:38.299531 2025] [:error] [pid 38777:tid 38784] [client 158.23.84.113:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Tue Dec 30 22:23:38.719733 2025] [:error] [pid 38777:tid 38802] [client 158.23.84.113:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Dec 30 22:23:38.919368 2025] [:error] [pid 38777:tid 38794] [client 158.23.84.113:15157] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Dec 30 22:23:40.268455 2025] [:error] [pid 38777:tid 38788] [client 158.23.84.113:15157] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVPgbGLn9GPxJXPhnHYpmwAAAEg"]
[Tue Dec 30 22:23:41.305898 2025] [:error] [pid 28826:tid 28913] [client 158.23.84.113:29744] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVPgbfOyQggePm1Ed9up1AAAAQc"]
[Tue Dec 30 22:23:42.367999 2025] [:error] [pid 28824:tid 28866] [client 158.23.84.113:29728] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVPgbn8FhtgLvBhuCR1cUQAAAJU"]
[Tue Dec 30 22:23:44.297435 2025] [:error] [pid 38777:tid 38791] [client 158.23.84.113:13206] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVPgcGLn9GPxJXPhnHYpnwAAAEs"]
[Tue Dec 30 22:23:45.091961 2025] [:error] [pid 47441:tid 47466] [client 158.23.84.113:25867] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aVPgcS6d2esGSN6Ne3NzlQAAAVY"]
[Tue Dec 30 22:23:46.494094 2025] [:error] [pid 28824:tid 28849] [client 158.23.84.113:25857] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aVPgcn8FhtgLvBhuCR1cVgAAAIQ"]
[Tue Dec 30 22:23:47.602964 2025] [:error] [pid 28825:tid 28892] [client 158.23.84.113:27761] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aVPgcz6dbc1G2hX-KfRqFQAAAM0"]
[Tue Dec 30 22:23:48.294260 2025] [:error] [pid 28954:tid 28974] [client 158.23.84.113:27735] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aVPgdKRZgqk7uuu8M0xRhwAAABI"]
[Tue Dec 30 22:23:49.944376 2025] [:error] [pid 28954:tid 28958] [client 158.23.84.113:27713] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aVPgdaRZgqk7uuu8M0xRjAAAAAI"]
[Tue Dec 30 22:23:52.021126 2025] [:error] [pid 38777:tid 38804] [client 158.23.84.113:13229] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aVPgeGLn9GPxJXPhnHYppQAAAFg"]
[Tue Dec 30 22:23:53.257041 2025] [:error] [pid 47441:tid 47452] [client 158.23.84.113:27755] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVPgeS6d2esGSN6Ne3NznQAAAUg"]
[Tue Dec 30 22:23:54.662567 2025] [:error] [pid 28954:tid 28959] [client 158.23.84.113:25876] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVPgeqRZgqk7uuu8M0xRmgAAAAM"]
[Tue Dec 30 22:23:55.710313 2025] [:error] [pid 47553:tid 47567] [client 158.23.84.113:12288] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVPge7vhy9HerwSnwIQkewAAAYw"]
[Tue Dec 30 22:23:56.701256 2025] [:error] [pid 47553:tid 47560] [client 158.23.84.113:25903] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVPgfLvhy9HerwSnwIQkgQAAAYU"]
[Tue Dec 30 22:23:57.583239 2025] [:error] [pid 38777:tid 38802] [client 158.23.84.113:29998] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVPgfWLn9GPxJXPhnHYpqAAAAFY"]
[Tue Dec 30 22:23:59.075589 2025] [:error] [pid 28826:tid 28922] [client 158.23.84.113:25893] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVPgf_OyQggePm1Ed9up3QAAAQ8"]
[Tue Dec 30 22:24:00.399690 2025] [:error] [pid 28824:tid 28852] [client 158.23.84.113:25916] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aVPggH8FhtgLvBhuCR1cZgAAAIc"]
[Tue Dec 30 22:24:01.603247 2025] [:error] [pid 47553:tid 47562] [client 158.23.84.113:31091] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aVPggbvhy9HerwSnwIQkhwAAAYc"]
[Tue Dec 30 22:24:02.788075 2025] [:error] [pid 28954:tid 28976] [client 158.23.84.113:25868] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVPggqRZgqk7uuu8M0xRrwAAABQ"]
[Tue Dec 30 22:24:03.829891 2025] [:error] [pid 47441:tid 47450] [client 158.23.84.113:35668] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVPggy6d2esGSN6Ne3NzogAAAUY"]
[Tue Dec 30 22:24:04.711436 2025] [:error] [pid 28826:tid 28925] [client 158.23.84.113:30005] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVPghPOyQggePm1Ed9up5gAAARI"]
[Tue Dec 30 22:24:05.364015 2025] [:error] [pid 47441:tid 47464] [client 158.23.84.113:25900] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVPghS6d2esGSN6Ne3NzpAAAAVQ"]
[Tue Dec 30 22:24:06.417280 2025] [:error] [pid 28826:tid 28915] [client 158.23.84.113:29699] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aVPghvOyQggePm1Ed9up6QAAAQk"]
[Tue Dec 30 22:24:07.344970 2025] [:error] [pid 38777:tid 38802] [client 158.23.84.113:29981] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVPgh2Ln9GPxJXPhnHYptQAAAFY"]
[Tue Dec 30 22:24:09.726298 2025] [:error] [pid 28824:tid 28848] [client 158.23.84.113:35675] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVPgiX8FhtgLvBhuCR1cdgAAAIM"]
[Tue Dec 30 22:24:11.234220 2025] [:error] [pid 28824:tid 28851] [client 158.23.84.113:35704] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVPgi38FhtgLvBhuCR1ceAAAAIY"]
[Tue Dec 30 22:24:13.214235 2025] [:error] [pid 28824:tid 28866] [client 158.23.84.113:12939] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVPgjX8FhtgLvBhuCR1cewAAAJU"]
[Tue Dec 30 22:24:14.503323 2025] [:error] [pid 28825:tid 28901] [client 158.23.84.113:30001] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aVPgjj6dbc1G2hX-KfRqTwAAANY"]
[Tue Dec 30 22:24:15.402233 2025] [:error] [pid 38777:tid 38799] [client 158.23.84.113:25870] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aVPgj2Ln9GPxJXPhnHYpwgAAAFM"]
[Tue Dec 30 22:24:16.132903 2025] [:error] [pid 47553:tid 47562] [client 158.23.84.113:20641] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aVPgkLvhy9HerwSnwIQkkgAAAYc"]
[Tue Dec 30 22:24:17.393978 2025] [:error] [pid 28954:tid 28965] [client 158.23.84.113:31384] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "aVPgkaRZgqk7uuu8M0xR0AAAAAk"]
[Tue Dec 30 22:24:18.288961 2025] [:error] [pid 28826:tid 28924] [client 158.23.84.113:31076] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aVPgkvOyQggePm1Ed9up7wAAARE"]
[Tue Dec 30 22:24:19.548372 2025] [:error] [pid 28825:tid 28898] [client 158.23.84.113:12941] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aVPgkz6dbc1G2hX-KfRqVwAAANM"]
[Tue Dec 30 22:24:20.844359 2025] [:error] [pid 28825:tid 28900] [client 158.23.84.113:12980] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aVPglD6dbc1G2hX-KfRqXQAAANU"]
[Tue Dec 30 22:24:22.012407 2025] [:error] [pid 28954:tid 28962] [client 158.23.84.113:15158] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aVPglqRZgqk7uuu8M0xR2gAAAAY"]
[Tue Dec 30 22:24:23.588740 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:31372] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVPgly6d2esGSN6Ne3NzsQAAAVI"]
[Tue Dec 30 22:24:24.915246 2025] [:error] [pid 47441:tid 47455] [client 158.23.84.113:31939] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVPgmC6d2esGSN6Ne3NztQAAAUs"]
[Tue Dec 30 22:24:26.028426 2025] [:error] [pid 47553:tid 47560] [client 158.23.84.113:31418] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVPgmrvhy9HerwSnwIQkmwAAAYU"]
[Tue Dec 30 22:24:27.319989 2025] [:error] [pid 47441:tid 47454] [client 158.23.84.113:31986] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVPgmy6d2esGSN6Ne3NzvAAAAUo"]
[Tue Dec 30 22:24:28.363872 2025] [:error] [pid 38777:tid 38783] [client 158.23.84.113:31422] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVPgnGLn9GPxJXPhnHYpzAAAAEM"]
[Tue Dec 30 22:24:31.161634 2025] [:error] [pid 28954:tid 28965] [client 158.23.84.113:31956] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVPgn6RZgqk7uuu8M0xR4QAAAAk"]
[Tue Dec 30 22:24:34.343409 2025] [:error] [pid 28826:tid 28926] [client 158.23.84.113:15154] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVPgovOyQggePm1Ed9uqDAAAARM"]
[Tue Dec 30 22:24:36.964746 2025] [:error] [pid 47553:tid 47574] [client 158.23.84.113:31420] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVPgpLvhy9HerwSnwIQknwAAAZM"]
[Tue Dec 30 22:24:37.546244 2025] [:error] [pid 28826:tid 28913] [client 158.23.84.113:31365] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aVPgpfOyQggePm1Ed9uqGQAAAQc"]
[Tue Dec 30 22:24:38.132626 2025] [:error] [pid 28954:tid 28956] [client 158.23.84.113:34498] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aVPgpqRZgqk7uuu8M0xR-AAAAAA"]
[Tue Dec 30 22:24:39.227335 2025] [:error] [pid 28826:tid 28923] [client 158.23.84.113:32770] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Tue Dec 30 22:24:40.529606 2025] [:error] [pid 28826:tid 28928] [client 158.23.84.113:32770] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aVPgqPOyQggePm1Ed9uqJQAAARU"]
[Tue Dec 30 22:24:42.943582 2025] [:error] [pid 28826:tid 28923] [client 158.23.84.113:31370] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Dec 30 22:24:43.155352 2025] [:error] [pid 28826:tid 28916] [client 158.23.84.113:31370] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVPgq_OyQggePm1Ed9uqMQAAAQo"]
[Tue Dec 30 22:24:43.949282 2025] [:error] [pid 28826:tid 28917] [client 158.23.84.113:22297] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVPgq_OyQggePm1Ed9uqNAAAAQs"]
[Tue Dec 30 22:24:44.968011 2025] [:error] [pid 38777:tid 38779] [client 158.23.84.113:32790] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVPgrGLn9GPxJXPhnHYqDAAAAEA"]
[Tue Dec 30 22:24:46.451639 2025] [:error] [pid 28954:tid 28969] [client 158.23.84.113:31368] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVPgrqRZgqk7uuu8M0xSCAAAAA0"]
[Tue Dec 30 22:24:47.877296 2025] [:error] [pid 28825:tid 28880] [client 158.23.84.113:32827] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVPgrz6dbc1G2hX-KfRqeAAAAME"]
[Tue Dec 30 22:24:49.836319 2025] [:error] [pid 38777:tid 38789] [client 158.23.84.113:22316] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVPgsWLn9GPxJXPhnHYqEQAAAEk"]
[Tue Dec 30 22:24:50.937521 2025] [:error] [pid 28954:tid 28977] [client 158.23.84.113:34870] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVPgsqRZgqk7uuu8M0xSFwAAABU"]
[Tue Dec 30 22:24:52.606474 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:31377] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVPgtC6d2esGSN6Ne3Nz3gAAAVI"]
[Tue Dec 30 22:24:53.805633 2025] [:error] [pid 47441:tid 47460] [client 158.23.84.113:32772] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aVPgtS6d2esGSN6Ne3Nz4QAAAVA"]
[Tue Dec 30 22:24:55.475049 2025] [:error] [pid 28826:tid 28927] [client 158.23.84.113:34873] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aVPgt_OyQggePm1Ed9uqOQAAARQ"]
[Tue Dec 30 22:24:57.848434 2025] [:error] [pid 47441:tid 47456] [client 158.23.84.113:22330] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aVPguS6d2esGSN6Ne3Nz5wAAAUw"]
[Tue Dec 30 22:24:59.259823 2025] [:error] [pid 47441:tid 47449] [client 158.23.84.113:22278] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aVPguy6d2esGSN6Ne3Nz6QAAAUU"]
[Tue Dec 30 22:25:00.196965 2025] [:error] [pid 38777:tid 38786] [client 158.23.84.113:34843] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVPgvGLn9GPxJXPhnHYqIQAAAEY"]
[Tue Dec 30 22:25:02.785382 2025] [:error] [pid 28954:tid 28969] [client 158.23.84.113:35459] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVPgvqRZgqk7uuu8M0xSJgAAAA0"]
[Tue Dec 30 22:25:04.954322 2025] [:error] [pid 47553:tid 47561] [client 158.23.84.113:31125] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVPgwLvhy9HerwSnwIQkwAAAAYY"]
[Tue Dec 30 22:25:06.132630 2025] [:error] [pid 28826:tid 28919] [client 158.23.84.113:32837] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVPgwvOyQggePm1Ed9uqSAAAAQw"]
[Tue Dec 30 22:25:07.023581 2025] [:error] [pid 28826:tid 28911] [client 158.23.84.113:32885] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aVPgw_OyQggePm1Ed9uqSwAAAQU"]
[Tue Dec 30 22:25:08.241311 2025] [:error] [pid 47441:tid 47453] [client 158.23.84.113:15810] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aVPgxC6d2esGSN6Ne3Nz-AAAAUk"]
[Tue Dec 30 22:25:09.615232 2025] [:error] [pid 28826:tid 28910] [client 158.23.84.113:15167] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aVPgxfOyQggePm1Ed9uqVQAAAQQ"]
[Tue Dec 30 22:25:10.926903 2025] [:error] [pid 28826:tid 28908] [client 158.23.84.113:35751] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aVPgxvOyQggePm1Ed9uqVwAAAQI"]
[Tue Dec 30 22:25:12.218206 2025] [:error] [pid 47441:tid 47458] [client 158.23.84.113:33517] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVPgyC6d2esGSN6Ne3Nz_wAAAU4"]
[Tue Dec 30 22:25:13.191750 2025] [:error] [pid 47441:tid 47450] [client 158.23.84.113:38260] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVPgyS6d2esGSN6Ne3N0AgAAAUY"]
[Tue Dec 30 22:25:14.674920 2025] [:error] [pid 47441:tid 47451] [client 158.23.84.113:38246] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVPgyi6d2esGSN6Ne3N0AwAAAUc"]
[Tue Dec 30 22:25:16.452383 2025] [:error] [pid 28825:tid 28889] [client 158.23.84.113:12948] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVPgzD6dbc1G2hX-KfRqmwAAAMo"]
[Tue Dec 30 22:25:17.939114 2025] [:error] [pid 28954:tid 28962] [client 158.23.84.113:12973] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVPgzaRZgqk7uuu8M0xSOgAAAAY"]
[Tue Dec 30 22:25:18.884061 2025] [:error] [pid 47441:tid 47459] [client 158.23.84.113:38242] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVPgzi6d2esGSN6Ne3N0DAAAAU8"]
[Tue Dec 30 22:25:19.863488 2025] [:error] [pid 47441:tid 47447] [client 158.23.84.113:33166] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVPgzy6d2esGSN6Ne3N0DQAAAUM"]
[Tue Dec 30 22:25:21.099890 2025] [:error] [pid 28825:tid 28886] [client 158.23.84.113:30028] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVPg0T6dbc1G2hX-KfRqoAAAAMc"]
[Tue Dec 30 22:25:22.912904 2025] [:error] [pid 28954:tid 28956] [client 158.23.84.113:30057] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVPg0qRZgqk7uuu8M0xSQQAAAAA"]
[Tue Dec 30 22:25:24.078961 2025] [:error] [pid 28826:tid 28915] [client 158.23.84.113:30060] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVPg1POyQggePm1Ed9uqYwAAAQk"]
[Tue Dec 30 22:25:26.202996 2025] [:error] [pid 47553:tid 47558] [client 158.23.84.113:19614] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVPg1rvhy9HerwSnwIQk0wAAAYM"]
[Tue Dec 30 22:25:28.551600 2025] [:error] [pid 47553:tid 47562] [client 158.23.84.113:30042] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVPg2Lvhy9HerwSnwIQk3QAAAYc"]
[Tue Dec 30 22:25:29.917439 2025] [:error] [pid 47553:tid 47572] [client 158.23.84.113:38270] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVPg2bvhy9HerwSnwIQk3wAAAZE"]
[Tue Dec 30 22:25:31.995046 2025] [:error] [pid 28954:tid 28968] [client 158.23.84.113:19165] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVPg26RZgqk7uuu8M0xSTAAAAAw"]
[Tue Dec 30 22:25:33.846339 2025] [:error] [pid 28825:tid 28903] [client 158.23.84.113:19163] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVPg3T6dbc1G2hX-KfRqpwAAANg"]
[Tue Dec 30 22:25:36.091962 2025] [:error] [pid 38777:tid 38793] [client 158.23.84.113:30059] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVPg4GLn9GPxJXPhnHYqRAAAAE0"]
[Tue Dec 30 22:25:37.308284 2025] [:error] [pid 38777:tid 38783] [client 158.23.84.113:15848] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVPg4WLn9GPxJXPhnHYqSAAAAEM"]
[Tue Dec 30 22:25:38.451106 2025] [:error] [pid 47441:tid 47460] [client 158.23.84.113:15104] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVPg4i6d2esGSN6Ne3N0KQAAAVA"]
[Tue Dec 30 22:25:40.277407 2025] [:error] [pid 28954:tid 28969] [client 158.23.84.113:15831] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVPg5KRZgqk7uuu8M0xSWAAAAA0"]
[Tue Dec 30 22:25:41.712445 2025] [:error] [pid 28825:tid 28882] [client 158.23.84.113:19189] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVPg5T6dbc1G2hX-KfRqsQAAAMM"]
[Tue Dec 30 22:25:42.904263 2025] [:error] [pid 28825:tid 28902] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Dec 30 22:25:43.131589 2025] [:error] [pid 28825:tid 28884] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs15.php
[Tue Dec 30 22:25:43.348661 2025] [:error] [pid 28825:tid 28897] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Dec 30 22:25:43.776007 2025] [:error] [pid 28825:tid 28901] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Tue Dec 30 22:25:44.169930 2025] [:error] [pid 28825:tid 28882] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Tue Dec 30 22:25:44.380478 2025] [:error] [pid 28825:tid 28890] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Dec 30 22:25:44.618509 2025] [:error] [pid 28825:tid 28893] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Tue Dec 30 22:25:44.864561 2025] [:error] [pid 28825:tid 28894] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Tue Dec 30 22:25:45.084595 2025] [:error] [pid 28825:tid 28903] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Tue Dec 30 22:25:45.295408 2025] [:error] [pid 28825:tid 28892] [client 158.23.84.113:15855] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Tue Dec 30 22:25:45.501399 2025] [:error] [pid 28825:tid 28899] [client 158.23.84.113:15855] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aVPg6T6dbc1G2hX-KfRqyQAAANQ"]
[Tue Dec 30 22:25:47.163927 2025] [:error] [pid 28825:tid 28881] [client 158.23.84.113:33920] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aVPg6z6dbc1G2hX-KfRqzAAAAMI"]
[Tue Dec 30 22:25:48.502676 2025] [:error] [pid 47441:tid 47461] [client 158.23.84.113:35818] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aVPg7C6d2esGSN6Ne3N0QgAAAVE"]
[Tue Dec 30 22:25:49.519703 2025] [:error] [pid 28825:tid 28897] [client 158.23.84.113:15821] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aVPg7T6dbc1G2hX-KfRqzgAAANI"]
[Tue Dec 30 22:25:50.744794 2025] [:error] [pid 38777:tid 38785] [client 158.23.84.113:15817] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVPg7mLn9GPxJXPhnHYqTQAAAEU"]
[Tue Dec 30 22:25:51.781412 2025] [:error] [pid 28826:tid 28927] [client 158.23.84.113:35808] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVPg7_OyQggePm1Ed9uqhwAAARQ"]
[Tue Dec 30 22:25:52.631154 2025] [:error] [pid 28826:tid 28913] [client 158.23.84.113:27925] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVPg8POyQggePm1Ed9uqigAAAQc"]
[Tue Dec 30 22:25:54.258402 2025] [:error] [pid 28825:tid 28882] [client 158.23.84.113:15868] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVPg8j6dbc1G2hX-KfRq1QAAAMM"]
[Tue Dec 30 22:25:56.651721 2025] [:error] [pid 28826:tid 28908] [client 158.23.84.113:34542] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aVPg9POyQggePm1Ed9uqlgAAAQI"]
[Tue Dec 30 22:25:58.202962 2025] [:error] [pid 28825:tid 28891] [client 158.23.84.113:31790] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aVPg9j6dbc1G2hX-KfRq3gAAAMw"]
[Tue Dec 30 22:25:59.971171 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:12739] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aVPg9y6d2esGSN6Ne3N0TwAAAVI"]
[Tue Dec 30 22:26:01.426834 2025] [:error] [pid 28825:tid 28896] [client 158.23.84.113:13016] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aVPg-T6dbc1G2hX-KfRq5AAAANE"]
[Tue Dec 30 22:26:02.571926 2025] [:error] [pid 47553:tid 47559] [client 158.23.84.113:31765] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aVPg-rvhy9HerwSnwIQlSgAAAYQ"]
[Tue Dec 30 22:26:03.718951 2025] [:error] [pid 28824:tid 28865] [client 158.23.84.113:31759] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aVPg-38FhtgLvBhuCR1c8gAAAJQ"]
[Tue Dec 30 22:26:04.812016 2025] [:error] [pid 28825:tid 28894] [client 158.23.84.113:31786] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aVPg_D6dbc1G2hX-KfRq9wAAAM8"]
[Tue Dec 30 22:26:06.234769 2025] [:error] [pid 47441:tid 47453] [client 158.23.84.113:13022] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aVPg_i6d2esGSN6Ne3N0XQAAAUk"]
[Tue Dec 30 22:26:08.001262 2025] [:error] [pid 47553:tid 47573] [client 158.23.84.113:36063] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVPhALvhy9HerwSnwIQlTgAAAZI"]
[Tue Dec 30 22:26:09.354660 2025] [:error] [pid 38777:tid 38801] [client 158.23.84.113:30786] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVPhAWLn9GPxJXPhnHYqXwAAAFU"]
[Tue Dec 30 22:26:10.842043 2025] [:error] [pid 28954:tid 28961] [client 158.23.84.113:33217] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVPhAqRZgqk7uuu8M0xSgQAAAAU"]
[Tue Dec 30 22:26:12.633960 2025] [:error] [pid 28824:tid 28855] [client 158.23.84.113:30832] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVPhBH8FhtgLvBhuCR1c8wAAAIo"]
[Tue Dec 30 22:26:14.358877 2025] [:error] [pid 28954:tid 28956] [client 158.23.84.113:33791] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVPhBqRZgqk7uuu8M0xSiQAAAAA"]
[Tue Dec 30 22:26:16.895255 2025] [:error] [pid 47441:tid 47467] [client 158.23.84.113:13040] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVPhCC6d2esGSN6Ne3N0cwAAAVc"]
[Tue Dec 30 22:26:18.163205 2025] [:error] [pid 28824:tid 28867] [client 158.23.84.113:34042] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVPhCn8FhtgLvBhuCR1c-wAAAJY"]
[Tue Dec 30 22:26:18.914906 2025] [:error] [pid 28825:tid 28879] [client 158.23.84.113:12576] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVPhCj6dbc1G2hX-KfRrQwAAAMA"]
[Tue Dec 30 22:26:20.691091 2025] [:error] [pid 28954:tid 28973] [client 158.23.84.113:29089] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVPhDKRZgqk7uuu8M0xSlwAAABE"]
[Tue Dec 30 22:26:22.055387 2025] [:error] [pid 28824:tid 28846] [client 158.23.84.113:35553] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVPhDn8FhtgLvBhuCR1dAAAAAIE"]
[Tue Dec 30 22:26:23.041828 2025] [:error] [pid 47441:tid 47462] [client 158.23.84.113:35523] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVPhDy6d2esGSN6Ne3N0ggAAAVI"]
[Tue Dec 30 22:26:24.351299 2025] [:error] [pid 47441:tid 47465] [client 158.23.84.113:15144] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVPhEC6d2esGSN6Ne3N0hAAAAVU"]
[Tue Dec 30 22:26:24.960829 2025] [:error] [pid 28954:tid 28975] [client 158.23.84.113:29098] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVPhEKRZgqk7uuu8M0xSpgAAABM"]
[Tue Dec 30 22:26:26.277876 2025] [:error] [pid 28954:tid 28959] [client 158.23.84.113:35582] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVPhEqRZgqk7uuu8M0xSqgAAAAM"]
[Tue Dec 30 22:26:27.231025 2025] [:error] [pid 28825:tid 28891] [client 158.23.84.113:35524] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVPhEz6dbc1G2hX-KfRrTAAAAMw"]
[Tue Dec 30 22:26:27.941772 2025] [:error] [pid 28954:tid 28957] [client 158.23.84.113:35934] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVPhE6RZgqk7uuu8M0xSrwAAAAE"]
[Tue Dec 30 22:26:29.108476 2025] [:error] [pid 28825:tid 28894] [client 158.23.84.113:12889] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVPhFT6dbc1G2hX-KfRrVQAAAM8"]
[Tue Dec 30 22:26:29.866373 2025] [:error] [pid 28825:tid 28887] [client 158.23.84.113:12946] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVPhFT6dbc1G2hX-KfRrVwAAAMg"]
[Tue Dec 30 22:26:30.688498 2025] [:error] [pid 28954:tid 28974] [client 158.23.84.113:16048] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVPhFqRZgqk7uuu8M0xSuwAAABI"]
[Tue Dec 30 22:26:31.943002 2025] [:error] [pid 28826:tid 28922] [client 158.23.84.113:16012] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVPhF_OyQggePm1Ed9uqtAAAAQ8"]
[Tue Dec 30 22:26:32.639187 2025] [:error] [pid 47553:tid 47568] [client 158.23.84.113:35551] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVPhGLvhy9HerwSnwIQlVgAAAY0"]
[Tue Dec 30 22:26:34.135405 2025] [:error] [pid 47553:tid 47565] [client 158.23.84.113:35529] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVPhGrvhy9HerwSnwIQlWAAAAYo"]
[Tue Dec 30 22:26:35.401385 2025] [:error] [pid 28954:tid 28957] [client 158.23.84.113:35944] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVPhG6RZgqk7uuu8M0xSwQAAAAE"]
[Tue Dec 30 22:26:36.717863 2025] [:error] [pid 28824:tid 28868] [client 158.23.84.113:26240] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVPhHH8FhtgLvBhuCR1dCgAAAJc"]
[Tue Dec 30 22:26:37.312970 2025] [:error] [pid 28825:tid 28896] [client 158.23.84.113:29091] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVPhHT6dbc1G2hX-KfRrYwAAANE"]
[Tue Dec 30 22:26:39.625020 2025] [:error] [pid 47553:tid 47569] [client 158.23.84.113:14748] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVPhH7vhy9HerwSnwIQlYQAAAY4"]
[Tue Dec 30 22:26:40.718730 2025] [:error] [pid 47553:tid 47556] [client 158.23.84.113:38150] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVPhILvhy9HerwSnwIQlZgAAAYE"]
[Tue Dec 30 22:26:42.178067 2025] [:error] [pid 47441:tid 47467] [client 158.23.84.113:15110] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVPhIi6d2esGSN6Ne3N0mgAAAVc"]
[Tue Dec 30 22:26:43.545892 2025] [:error] [pid 28825:tid 28886] [client 158.23.84.113:35864] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aVPhIz6dbc1G2hX-KfRrbwAAAMc"]
[Tue Dec 30 22:26:44.960956 2025] [:error] [pid 28954:tid 28964] [client 158.23.84.113:13096] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/index.php"] [unique_id "aVPhJKRZgqk7uuu8M0xS1wAAAAg"]
[Tue Dec 30 22:26:46.653900 2025] [:error] [pid 38777:tid 38787] [client 158.23.84.113:29059] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aVPhJmLn9GPxJXPhnHYqZgAAAEc"]
[Tue Dec 30 22:26:48.294758 2025] [:error] [pid 28954:tid 28962] [client 158.23.84.113:16015] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Tue Dec 30 22:26:48.490211 2025] [:error] [pid 28954:tid 28979] [client 158.23.84.113:16015] File does not exist: /usr/local/apache/htdocs/suspended-page/shoyo.php
[Tue Dec 30 22:26:48.684963 2025] [:error] [pid 28954:tid 28956] [client 158.23.84.113:16015] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Dec 30 22:26:48.889640 2025] [:error] [pid 28954:tid 28965] [client 158.23.84.113:16015] File does not exist: /usr/local/apache/htdocs/suspended-page/waq.php
[Tue Dec 30 22:26:49.283217 2025] [:error] [pid 28954:tid 28958] [client 158.23.84.113:16015] File does not exist: /usr/local/apache/htdocs/suspended-page/wakak.php
[Tue Dec 30 22:26:49.494122 2025] [:error] [pid 28954:tid 28975] [client 158.23.84.113:16015] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Dec 30 22:26:49.691999 2025] [:error] [pid 28954:tid 28976] [client 158.23.84.113:16015] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aVPhKaRZgqk7uuu8M0xS_QAAABQ"]
[Tue Dec 30 22:26:50.460978 2025] [:error] [pid 28954:tid 28979] [client 158.23.84.113:37862] [client 158.23.84.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/index.php"] [unique_id "aVPhKqRZgqk7uuu8M0xTAgAAABc"]
[Tue Dec 30 22:26:52.065292 2025] [:error] [pid 38777:tid 38779] [client 158.23.84.113:37882] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Tue Dec 30 22:26:52.266031 2025] [:error] [pid 38777:tid 38800] [client 158.23.84.113:37882] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Tue Dec 30 22:26:52.459768 2025] [:error] [pid 38777:tid 38799] [client 158.23.84.113:37882] File does not exist: /usr/local/apache/htdocs/suspended-page/ah24.php
[Tue Dec 30 22:26:52.653839 2025] [:error] [pid 38777:tid 38786] [client 158.23.84.113:37882] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Tue Dec 30 22:26:52.848264 2025] [:error] [pid 38777:tid 38795] [client 158.23.84.113:37882] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVPhLGLn9GPxJXPhnHYqbgAAAE8"]
[Tue Dec 30 22:26:54.851327 2025] [:error] [pid 38777:tid 38788] [client 158.23.84.113:33745] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVPhLmLn9GPxJXPhnHYqdgAAAEg"]
[Tue Dec 30 22:26:55.863955 2025] [:error] [pid 38777:tid 38799] [client 158.23.84.113:31701] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVPhL2Ln9GPxJXPhnHYqewAAAFM"]
[Tue Dec 30 22:26:57.363942 2025] [:error] [pid 28954:tid 28966] [client 158.23.84.113:25812] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVPhMaRZgqk7uuu8M0xTEAAAAAo"]
[Tue Dec 30 22:26:58.626223 2025] [:error] [pid 28826:tid 28911] [client 158.23.84.113:12688] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVPhMvOyQggePm1Ed9uqyAAAAQU"]
[Tue Dec 30 22:26:59.472610 2025] [:error] [pid 47553:tid 47569] [client 158.23.84.113:35223] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVPhM7vhy9HerwSnwIQlbwAAAY4"]
[Tue Dec 30 22:27:01.255993 2025] [:error] [pid 28826:tid 28931] [client 158.23.84.113:25842] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVPhNfOyQggePm1Ed9uqzQAAARg"]
[Tue Dec 30 22:27:04.389982 2025] [:error] [pid 38777:tid 38792] [client 158.23.84.113:25831] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVPhOGLn9GPxJXPhnHYqhgAAAEw"]
[Tue Dec 30 22:27:06.846999 2025] [:error] [pid 28954:tid 28957] [client 158.23.84.113:12434] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVPhOqRZgqk7uuu8M0xTLQAAAAE"]
[Tue Dec 30 22:27:08.440439 2025] [:error] [pid 47441:tid 47445] [client 158.23.84.113:12660] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVPhPC6d2esGSN6Ne3N0vAAAAUE"]
[Tue Dec 30 22:27:11.946805 2025] [:error] [pid 28954:tid 28969] [client 158.23.84.113:12655] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVPhP6RZgqk7uuu8M0xTNwAAAA0"]
[Tue Dec 30 22:27:14.691009 2025] [:error] [pid 47553:tid 47558] [client 158.23.84.113:33738] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVPhQrvhy9HerwSnwIQldgAAAYM"]
[Tue Dec 30 22:27:16.312977 2025] [:error] [pid 47553:tid 47564] [client 158.23.84.113:31719] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVPhRLvhy9HerwSnwIQlfgAAAYk"]
[Tue Dec 30 22:27:18.483017 2025] [:error] [pid 28954:tid 28977] [client 158.23.84.113:31683] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVPhRqRZgqk7uuu8M0xTPQAAABU"]
[Tue Dec 30 22:27:19.804248 2025] [:error] [pid 47441:tid 47466] [client 158.23.84.113:12641] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVPhRy6d2esGSN6Ne3N02QAAAVY"]
[Tue Dec 30 22:27:22.130765 2025] [:error] [pid 47441:tid 47452] [client 158.23.84.113:12478] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVPhSi6d2esGSN6Ne3N04AAAAUg"]
[Tue Dec 30 22:27:23.543656 2025] [:error] [pid 28826:tid 28911] [client 158.23.84.113:31926] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVPhS_OyQggePm1Ed9uq1wAAAQU"]
[Tue Dec 30 22:27:24.357386 2025] [:error] [pid 47441:tid 47460] [client 158.23.84.113:32163] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVPhTC6d2esGSN6Ne3N05AAAAVA"]
[Tue Dec 30 22:27:26.251719 2025] [:error] [pid 28954:tid 28971] [client 158.23.84.113:12635] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVPhTqRZgqk7uuu8M0xTWAAAAA8"]
[Tue Dec 30 22:27:28.015836 2025] [:error] [pid 28824:tid 28862] [client 158.23.84.113:12638] [client 158.23.84.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVPhUH8FhtgLvBhuCR1dHgAAAJE"]
[Wed Dec 31 02:45:00.594347 2025] [:error] [pid 50068:tid 50085] [client 119.96.24.54:39778] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVQdrPJem-CRnWG3ZuyYWgAAAA8"]
[Wed Dec 31 02:57:17.111699 2025] [:error] [pid 49981:tid 50006] [client 159.89.181.56:59130] [client 159.89.181.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aVQgjZCCXHPw9uuzhEyDrgAAAJU"], referer: binance.com
[Wed Dec 31 04:08:18.526643 2025] [:error] [pid 33109:tid 33123] [client 195.178.110.190:55858] [client 195.178.110.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aVQxMsYN9k_fnLM-n46y1QAAAMw"]
[Wed Dec 31 08:42:34.349708 2025] [:error] [pid 57144:tid 57183] [client 43.153.49.151:53826] [client 43.153.49.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVRxeooIYDHY2wNlFkoaOAAAAUo"]
[Wed Dec 31 10:06:13.032547 2025] [:error] [pid 20453:tid 20467] [client 43.166.132.142:58784] [client 43.166.132.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVSFFbb_Ay51rPEgph7R5QAAAEs"]
[Wed Dec 31 14:41:47.946065 2025] [:error] [pid 48713:tid 48724] [client 203.2.64.59:50339] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVTFq0yNMVAGtWvMliO0QgAAAMY"]
[Wed Dec 31 15:03:36.103151 2025] [:error] [pid 48833:tid 48838] [client 49.51.203.164:42272] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVTKyGPnRNOqqZ1OQg-zcQAAAEM"]
[Wed Dec 31 16:44:59.279717 2025] [:error] [pid 48833:tid 48855] [client 138.197.17.1:52636] [client 138.197.17.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/"] [unique_id "aVTii2PnRNOqqZ1OQg_P3QAAAFQ"], referer: binance.com
[Wed Dec 31 16:45:00.053818 2025] [:error] [pid 64406:tid 64416] [client 138.197.17.1:53801] [client 138.197.17.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "aVTijCLRcJYP7e7OhBb4dgAAAQg"], referer: binance.com
[Wed Dec 31 16:45:00.852369 2025] [:error] [pid 48833:tid 48845] [client 138.197.17.1:53572] [client 138.197.17.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aVTijGPnRNOqqZ1OQg_P4AAAAEo"], referer: binance.com
[Wed Dec 31 18:34:25.097767 2025] [:error] [pid 7800:tid 7821] [client 43.166.130.123:49440] [client 43.166.130.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVT8MSN6RFoECeReAPVR3QAAAZI"]
[Thu Jan 01 00:40:06.342916 2026] [:error] [pid 48715:tid 48787] [client 150.109.119.38:57030] [client 150.109.119.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVVR5mamQpQY7KfuoW2GdwAAAI8"]
[Thu Jan 01 03:00:55.012101 2026] [:error] [pid 64406:tid 64431] [client 43.138.68.113:58490] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVVy5yLRcJYP7e7OhBZZCgAAARc"]
[Thu Jan 01 08:52:13.363845 2026] [:error] [pid 58924:tid 58938] [client 122.51.236.174:41066] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVXFPTYXM8NvhWQPUGvfEgAAAMw"]
[Thu Jan 01 09:11:14.446757 2026] [:error] [pid 58924:tid 58931] [client 43.130.154.56:45794] [client 43.130.154.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVXJsjYXM8NvhWQPUGvlMwAAAMU"]
[Thu Jan 01 10:06:13.764843 2026] [:error] [pid 58818:tid 58855] [client 43.159.152.4:54054] [client 43.159.152.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVXWlWr6b3Nsqkrqu80N4wAAAEI"]
[Thu Jan 01 10:49:33.527776 2026] [:error] [pid 58924:tid 58934] [client 170.106.187.106:54002] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVXgvTYXM8NvhWQPUGv8jwAAAMg"]
[Thu Jan 01 14:33:48.095469 2026] [:error] [pid 58818:tid 58861] [client 43.165.135.242:34864] [client 43.165.135.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVYVTGr6b3Nsqkrqu81HIgAAAEg"]
[Thu Jan 01 14:55:34.001264 2026] [:error] [pid 58819:tid 58897] [client 182.42.104.32:42828] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVYaZRMbLE49waxUJzMaagAAAJE"]
[Thu Jan 01 17:20:27.445914 2026] [:error] [pid 26613:tid 26633] [client 43.157.38.131:52662] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVY8W5ZHnkJdYNvbC--XJwAAAEs"]
[Thu Jan 01 21:02:28.676855 2026] [:error] [pid 63888:tid 63934] [client 43.135.135.57:52584] [client 43.135.135.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVZwZNoJ3YkVCYrOT1wR8gAAAI8"]
[Thu Jan 01 21:58:54.034370 2026] [:error] [pid 63888:tid 63928] [client 104.28.246.117:16647] [client 104.28.246.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aVZ9ntoJ3YkVCYrOT1wewQAAAIk"]
[Thu Jan 01 23:05:41.080250 2026] [:error] [pid 995:tid 999] [client 43.135.182.43:35740] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVaNRWJVFefxwdkvFzgfPAAAAQE"]
[Thu Jan 01 23:44:45.391943 2026] [:error] [pid 63981:tid 64008] [client 119.28.89.249:54654] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVaWbc5Wjyl5tWjDt5LmogAAANg"]
[Fri Jan 02 03:31:21.962415 2026] [:error] [pid 19495:tid 19518] [client 43.155.27.244:40716] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVbLicHOHGMziFVGMwAsYgAAAFI"]
[Fri Jan 02 03:35:11.257953 2026] [:error] [pid 965:tid 1018] [client 182.42.110.255:51412] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVbMbxgy371g2nPJimpCpQAAAE4"]
[Fri Jan 02 10:06:12.558851 2026] [:error] [pid 50186:tid 50210] [client 43.130.67.33:50138] [client 43.130.67.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVcoFFXqK_iX4f-S70LRnwAAAZY"]
[Fri Jan 02 10:20:03.266971 2026] [:error] [pid 50046:tid 50060] [client 54.236.84.252:32872] [client 54.236.84.252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aVcrUyzv7fgIiwkQYNA__wAAAUw"]
[Fri Jan 02 12:33:54.255358 2026] [:error] [pid 50186:tid 50195] [client 54.236.84.252:54512] [client 54.236.84.252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aVdKslXqK_iX4f-S70L-gwAAAYc"]
[Fri Jan 02 12:39:51.879989 2026] [:error] [pid 29316:tid 29332] [client 209.38.19.100:61205] [client 209.38.19.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.19.100, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aVdMF9fT9ty-7jZmgf9RCAAAAQ4"]
[Fri Jan 02 12:39:51.884516 2026] [:error] [pid 29316:tid 29332] [client 209.38.19.100:61205] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Jan 02 13:14:43.286795 2026] [:error] [pid 50046:tid 50070] [client 170.106.110.146:45242] [client 170.106.110.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVdUQyzv7fgIiwkQYNBmuAAAAVY"]
[Fri Jan 02 13:26:51.167260 2026] [:error] [pid 63100:tid 63162] [client 157.245.78.235:54201] [client 157.245.78.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.245.78.235, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aVdXGzuUXUKd3KTnKl8K1AAAAIE"]
[Fri Jan 02 13:26:51.171159 2026] [:error] [pid 63100:tid 63162] [client 157.245.78.235:54201] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Jan 02 15:40:54.882180 2026] [:error] [pid 63208:tid 63216] [client 175.6.217.4:55967] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVd2hnKLI9INGPLzfncaLwAAAMU"]
[Sat Jan 03 04:04:13.498303 2026] [:error] [pid 34260:tid 34275] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/lisa.php
[Sat Jan 03 04:04:13.751401 2026] [:error] [pid 34260:tid 34270] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Sat Jan 03 04:04:14.003541 2026] [:error] [pid 34260:tid 34263] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sat Jan 03 04:04:14.259658 2026] [:error] [pid 34260:tid 34269] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/bless14.php
[Sat Jan 03 04:04:14.566511 2026] [:error] [pid 34260:tid 34280] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/ws35.php
[Sat Jan 03 04:04:14.821841 2026] [:error] [pid 34260:tid 34267] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Sat Jan 03 04:04:15.074766 2026] [:error] [pid 34260:tid 34277] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Sat Jan 03 04:04:15.329031 2026] [:error] [pid 34260:tid 34285] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Jan 03 04:04:15.585185 2026] [:error] [pid 34260:tid 34266] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/acwfihfh.php
[Sat Jan 03 04:04:15.841877 2026] [:error] [pid 34260:tid 34279] [client 13.94.121.70:6246] File does not exist: /usr/local/apache/htdocs/suspended-page/f8.php
[Sat Jan 03 04:04:16.092507 2026] [:error] [pid 34260:tid 34275] [client 13.94.121.70:6246] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVgkwEWWhyvZ0O9KNVR6kwAAAQ0"]
[Sat Jan 03 04:04:16.819540 2026] [:error] [pid 34260:tid 34281] [client 13.94.121.70:7874] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVgkwEWWhyvZ0O9KNVR6lAAAARM"]
[Sat Jan 03 04:04:17.360489 2026] [:error] [pid 1929:tid 1959] [client 13.94.121.70:9041] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVgkwecFqdpu6TNsuWq9HAAAABU"]
[Sat Jan 03 04:04:17.990964 2026] [:error] [pid 34260:tid 34263] [client 13.94.121.70:4285] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVgkwUWWhyvZ0O9KNVR6lgAAAQE"]
[Sat Jan 03 04:04:18.629194 2026] [:error] [pid 2083:tid 2104] [client 13.94.121.70:5149] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVgkwjVlR_BmlMPnhV6qvwAAANM"]
[Sat Jan 03 04:04:19.196193 2026] [:error] [pid 1929:tid 1941] [client 13.94.121.70:10886] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVgkw-cFqdpu6TNsuWq9HwAAAAM"]
[Sat Jan 03 04:04:19.696866 2026] [:error] [pid 2083:tid 2099] [client 13.94.121.70:8503] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVgkwzVlR_BmlMPnhV6qwQAAAM4"]
[Sat Jan 03 04:04:20.227413 2026] [:error] [pid 1929:tid 1945] [client 13.94.121.70:8454] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVgkxOcFqdpu6TNsuWq9JAAAAAc"]
[Sat Jan 03 04:04:20.726755 2026] [:error] [pid 1929:tid 1949] [client 13.94.121.70:5201] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVgkxOcFqdpu6TNsuWq9JQAAAAs"]
[Sat Jan 03 04:04:21.232893 2026] [:error] [pid 2083:tid 2097] [client 13.94.121.70:10903] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVgkxTVlR_BmlMPnhV6qxgAAAMw"]
[Sat Jan 03 04:04:21.730895 2026] [:error] [pid 1931:tid 1996] [client 13.94.121.70:8628] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVgkxR8Tyw7ZoIdXlcbn_QAAAII"]
[Sat Jan 03 04:04:22.237674 2026] [:error] [pid 34260:tid 34284] [client 13.94.121.70:1532] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVgkxkWWhyvZ0O9KNVR6mgAAARY"]
[Sat Jan 03 04:04:22.737125 2026] [:error] [pid 1930:tid 1972] [client 13.94.121.70:12269] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVgkxpP-6mqhfUDa89zF7gAAAEY"]
[Sat Jan 03 04:04:23.245765 2026] [:error] [pid 1929:tid 1950] [client 13.94.121.70:7595] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVgkx-cFqdpu6TNsuWq9KgAAAAw"]
[Sat Jan 03 04:04:23.762130 2026] [:error] [pid 34260:tid 34273] [client 13.94.121.70:12254] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVgkx0WWhyvZ0O9KNVR6nQAAAQs"]
[Sat Jan 03 04:04:24.342627 2026] [:error] [pid 1931:tid 2030] [client 13.94.121.70:8473] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVgkyB8Tyw7ZoIdXlcboAwAAAIY"]
[Sat Jan 03 04:04:24.871407 2026] [:error] [pid 2083:tid 2106] [client 13.94.121.70:1432] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/out.php"] [unique_id "aVgkyDVlR_BmlMPnhV6q2AAAANU"]
[Sat Jan 03 04:04:25.382074 2026] [:error] [pid 2083:tid 2092] [client 13.94.121.70:3758] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/out.php"] [unique_id "aVgkyTVlR_BmlMPnhV6q2QAAAMc"]
[Sat Jan 03 04:04:25.929313 2026] [:error] [pid 2083:tid 2108] [client 13.94.121.70:13014] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/out.php"] [unique_id "aVgkyTVlR_BmlMPnhV6q3QAAANc"]
[Sat Jan 03 04:04:27.154220 2026] [:error] [pid 34260:tid 34263] [client 13.94.121.70:5832] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/out.php"] [unique_id "aVgky0WWhyvZ0O9KNVR6pAAAAQE"]
[Sat Jan 03 04:04:27.653249 2026] [:error] [pid 1930:tid 1977] [client 13.94.121.70:12269] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVgky5P-6mqhfUDa89zF8AAAAEs"]
[Sat Jan 03 04:04:28.158809 2026] [:error] [pid 1930:tid 1978] [client 13.94.121.70:6110] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVgkzJP-6mqhfUDa89zF8QAAAEw"]
[Sat Jan 03 04:04:28.670540 2026] [:error] [pid 1929:tid 1951] [client 13.94.121.70:3349] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVgkzOcFqdpu6TNsuWq9NwAAAA0"]
[Sat Jan 03 04:04:29.180570 2026] [:error] [pid 1931:tid 2046] [client 13.94.121.70:6089] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVgkzR8Tyw7ZoIdXlcboBgAAAJY"]
[Sat Jan 03 04:04:29.692492 2026] [:error] [pid 1929:tid 1960] [client 13.94.121.70:6100] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/family.php"] [unique_id "aVgkzecFqdpu6TNsuWq9OgAAABY"]
[Sat Jan 03 04:04:30.222962 2026] [:error] [pid 2083:tid 2090] [client 13.94.121.70:2253] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/family.php"] [unique_id "aVgkzjVlR_BmlMPnhV6q5QAAAMU"]
[Sat Jan 03 04:04:30.721416 2026] [:error] [pid 2083:tid 2091] [client 13.94.121.70:9902] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/family.php"] [unique_id "aVgkzjVlR_BmlMPnhV6q5gAAAMY"]
[Sat Jan 03 04:04:31.238135 2026] [:error] [pid 2083:tid 2085] [client 13.94.121.70:7214] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/family.php"] [unique_id "aVgkzzVlR_BmlMPnhV6q6AAAAMA"]
[Sat Jan 03 04:04:31.736513 2026] [:error] [pid 2083:tid 2098] [client 13.94.121.70:13569] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVgkzzVlR_BmlMPnhV6q6gAAAM0"]
[Sat Jan 03 04:04:32.236434 2026] [:error] [pid 2083:tid 2086] [client 13.94.121.70:17037] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVgk0DVlR_BmlMPnhV6q7AAAAME"]
[Sat Jan 03 04:04:32.802036 2026] [:error] [pid 2083:tid 2093] [client 13.94.121.70:5573] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVgk0DVlR_BmlMPnhV6q7gAAAMg"]
[Sat Jan 03 04:04:33.316114 2026] [:error] [pid 34260:tid 34273] [client 13.94.121.70:5571] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVgk0UWWhyvZ0O9KNVR6qwAAAQs"]
[Sat Jan 03 04:04:33.825491 2026] [:error] [pid 1929:tid 1952] [client 13.94.121.70:16857] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVgk0ecFqdpu6TNsuWq9SAAAAA4"]
[Sat Jan 03 04:04:34.334463 2026] [:error] [pid 34260:tid 34279] [client 13.94.121.70:11994] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVgk0kWWhyvZ0O9KNVR6rgAAARE"]
[Sat Jan 03 04:04:34.850394 2026] [:error] [pid 1931:tid 2027] [client 13.94.121.70:16860] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVgk0h8Tyw7ZoIdXlcboDgAAAIQ"]
[Sat Jan 03 04:04:35.350740 2026] [:error] [pid 34260:tid 34264] [client 13.94.121.70:2903] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVgk00WWhyvZ0O9KNVR6sgAAAQI"]
[Sat Jan 03 04:04:35.850659 2026] [:error] [pid 1929:tid 1951] [client 13.94.121.70:11433] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVgk0-cFqdpu6TNsuWq9SgAAAA0"]
[Sat Jan 03 04:04:36.363058 2026] [:error] [pid 1930:tid 1979] [client 13.94.121.70:11007] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVgk1JP-6mqhfUDa89zF9AAAAE0"]
[Sat Jan 03 04:04:37.007865 2026] [:error] [pid 1929:tid 1960] [client 13.94.121.70:3465] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVgk1ecFqdpu6TNsuWq9TAAAABY"]
[Sat Jan 03 04:04:37.507384 2026] [:error] [pid 1930:tid 1989] [client 13.94.121.70:15045] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVgk1ZP-6mqhfUDa89zF-AAAAFc"]
[Sat Jan 03 04:04:38.025447 2026] [:error] [pid 2083:tid 2109] [client 13.94.121.70:14064] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVgk1jVlR_BmlMPnhV6q8wAAANg"]
[Sat Jan 03 04:04:38.578132 2026] [:error] [pid 2083:tid 2097] [client 13.94.121.70:14219] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVgk1jVlR_BmlMPnhV6q9QAAAMw"]
[Sat Jan 03 04:04:39.233818 2026] [:error] [pid 1930:tid 1972] [client 13.94.121.70:9685] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVgk15P-6mqhfUDa89zF_gAAAEY"]
[Sat Jan 03 04:04:39.776353 2026] [:error] [pid 2083:tid 2090] [client 13.94.121.70:6413] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVgk1zVlR_BmlMPnhV6q-AAAAMU"]
[Sat Jan 03 04:04:40.274694 2026] [:error] [pid 2083:tid 2085] [client 13.94.121.70:15319] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeeex.php"] [unique_id "aVgk2DVlR_BmlMPnhV6q-wAAAMA"]
[Sat Jan 03 04:04:40.807966 2026] [:error] [pid 1930:tid 1977] [client 13.94.121.70:9727] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeeex.php"] [unique_id "aVgk2JP-6mqhfUDa89zGAgAAAEs"]
[Sat Jan 03 04:04:41.343144 2026] [:error] [pid 2083:tid 2098] [client 13.94.121.70:10162] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeeex.php"] [unique_id "aVgk2TVlR_BmlMPnhV6q_QAAAM0"]
[Sat Jan 03 04:04:41.927621 2026] [:error] [pid 34260:tid 34272] [client 13.94.121.70:1911] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeeex.php"] [unique_id "aVgk2UWWhyvZ0O9KNVR6tAAAAQo"]
[Sat Jan 03 04:04:42.474151 2026] [:error] [pid 1930:tid 1975] [client 13.94.121.70:9679] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVgk2pP-6mqhfUDa89zGBgAAAEk"]
[Sat Jan 03 04:04:43.030774 2026] [:error] [pid 1930:tid 1989] [client 13.94.121.70:14224] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVgk25P-6mqhfUDa89zGBwAAAFc"]
[Sat Jan 03 04:04:43.582970 2026] [:error] [pid 1930:tid 1990] [client 13.94.121.70:9689] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVgk25P-6mqhfUDa89zGCAAAAFg"]
[Sat Jan 03 04:04:44.107933 2026] [:error] [pid 34260:tid 34283] [client 13.94.121.70:9692] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVgk3EWWhyvZ0O9KNVR6twAAARU"]
[Sat Jan 03 04:04:44.617084 2026] [:error] [pid 1930:tid 1982] [client 13.94.121.70:16529] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpup.php"] [unique_id "aVgk3JP-6mqhfUDa89zGCgAAAFA"]
[Sat Jan 03 04:04:45.191779 2026] [:error] [pid 2083:tid 2096] [client 13.94.121.70:6427] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpup.php"] [unique_id "aVgk3TVlR_BmlMPnhV6rBQAAAMs"]
[Sat Jan 03 04:04:45.696242 2026] [:error] [pid 1929:tid 1962] [client 13.94.121.70:10015] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpup.php"] [unique_id "aVgk3ecFqdpu6TNsuWq9XQAAABg"]
[Sat Jan 03 04:04:46.233590 2026] [:error] [pid 1929:tid 1943] [client 13.94.121.70:14049] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpup.php"] [unique_id "aVgk3ucFqdpu6TNsuWq9YAAAAAU"]
[Sat Jan 03 04:04:46.748447 2026] [:error] [pid 2083:tid 2106] [client 13.94.121.70:14044] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVgk3jVlR_BmlMPnhV6rCAAAANU"]
[Sat Jan 03 04:04:47.270053 2026] [:error] [pid 34260:tid 34265] [client 13.94.121.70:2838] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVgk30WWhyvZ0O9KNVR6uQAAAQM"]
[Sat Jan 03 04:04:47.775496 2026] [:error] [pid 2083:tid 2097] [client 13.94.121.70:2888] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVgk3zVlR_BmlMPnhV6rCQAAAMw"]
[Sat Jan 03 04:04:48.294016 2026] [:error] [pid 1929:tid 1940] [client 13.94.121.70:10780] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVgk4OcFqdpu6TNsuWq9ZgAAAAI"]
[Sat Jan 03 04:04:48.833346 2026] [:error] [pid 2083:tid 2102] [client 13.94.121.70:3616] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVgk4DVlR_BmlMPnhV6rDAAAANE"]
[Sat Jan 03 04:04:49.359911 2026] [:error] [pid 1931:tid 2035] [client 13.94.121.70:11816] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVgk4R8Tyw7ZoIdXlcboIwAAAIs"]
[Sat Jan 03 04:04:49.913264 2026] [:error] [pid 34260:tid 34281] [client 13.94.121.70:14569] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVgk4UWWhyvZ0O9KNVR6wAAAARM"]
[Sat Jan 03 04:04:50.475455 2026] [:error] [pid 34260:tid 34264] [client 13.94.121.70:16587] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVgk4kWWhyvZ0O9KNVR6wQAAAQI"]
[Sat Jan 03 04:04:51.061462 2026] [:error] [pid 1929:tid 1949] [client 13.94.121.70:11117] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVgk4-cFqdpu6TNsuWq9agAAAAs"]
[Sat Jan 03 04:04:51.580048 2026] [:error] [pid 34260:tid 34274] [client 13.94.121.70:10194] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVgk40WWhyvZ0O9KNVR6xAAAAQw"]
[Sat Jan 03 04:04:52.142512 2026] [:error] [pid 1930:tid 1974] [client 13.94.121.70:2349] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVgk5JP-6mqhfUDa89zGFwAAAEg"]
[Sat Jan 03 04:04:52.645789 2026] [:error] [pid 1930:tid 1984] [client 13.94.121.70:14483] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVgk5JP-6mqhfUDa89zGGQAAAFI"]
[Sat Jan 03 04:04:53.154675 2026] [:error] [pid 2083:tid 2099] [client 13.94.121.70:1369] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVgk5TVlR_BmlMPnhV6rEQAAAM4"]
[Sat Jan 03 04:04:53.670612 2026] [:error] [pid 2083:tid 2095] [client 13.94.121.70:10783] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVgk5TVlR_BmlMPnhV6rFQAAAMo"]
[Sat Jan 03 04:04:54.178157 2026] [:error] [pid 1929:tid 1950] [client 13.94.121.70:14061] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVgk5ucFqdpu6TNsuWq9cQAAAAw"]
[Sat Jan 03 04:04:54.702234 2026] [:error] [pid 1930:tid 1972] [client 13.94.121.70:10811] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVgk5pP-6mqhfUDa89zGHQAAAEY"]
[Sat Jan 03 04:04:55.211508 2026] [:error] [pid 1931:tid 2040] [client 13.94.121.70:16637] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVgk5x8Tyw7ZoIdXlcboJwAAAJA"]
[Sat Jan 03 04:04:55.725332 2026] [:error] [pid 1930:tid 1976] [client 13.94.121.70:16928] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVgk55P-6mqhfUDa89zGHwAAAEo"]
[Sat Jan 03 04:04:56.238685 2026] [:error] [pid 34260:tid 34278] [client 13.94.121.70:9223] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVgk6EWWhyvZ0O9KNVR60AAAARA"]
[Sat Jan 03 04:04:56.737200 2026] [:error] [pid 34260:tid 34275] [client 13.94.121.70:5382] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVgk6EWWhyvZ0O9KNVR60QAAAQ0"]
[Sat Jan 03 04:04:57.245408 2026] [:error] [pid 2083:tid 2096] [client 13.94.121.70:15032] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d996699999.php"] [unique_id "aVgk6TVlR_BmlMPnhV6rGwAAAMs"]
[Sat Jan 03 04:04:57.743820 2026] [:error] [pid 1931:tid 2043] [client 13.94.121.70:15026] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d996699999.php"] [unique_id "aVgk6R8Tyw7ZoIdXlcboKAAAAJM"]
[Sat Jan 03 04:04:58.250263 2026] [:error] [pid 2083:tid 2087] [client 13.94.121.70:9452] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d996699999.php"] [unique_id "aVgk6jVlR_BmlMPnhV6rHQAAAMI"]
[Sat Jan 03 04:04:58.748042 2026] [:error] [pid 1931:tid 2032] [client 13.94.121.70:9834] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d996699999.php"] [unique_id "aVgk6h8Tyw7ZoIdXlcboKwAAAIg"]
[Sat Jan 03 04:04:59.277150 2026] [:error] [pid 2083:tid 2106] [client 13.94.121.70:6906] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xde.php"] [unique_id "aVgk6zVlR_BmlMPnhV6rHwAAANU"]
[Sat Jan 03 04:04:59.843522 2026] [:error] [pid 1931:tid 1994] [client 13.94.121.70:11180] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xde.php"] [unique_id "aVgk6x8Tyw7ZoIdXlcboMAAAAIE"]
[Sat Jan 03 04:05:00.448685 2026] [:error] [pid 1930:tid 1988] [client 13.94.121.70:14866] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xde.php"] [unique_id "aVgk7JP-6mqhfUDa89zGKQAAAFY"]
[Sat Jan 03 04:05:00.961085 2026] [:error] [pid 1930:tid 1971] [client 13.94.121.70:15030] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xde.php"] [unique_id "aVgk7JP-6mqhfUDa89zGKwAAAEU"]
[Sat Jan 03 04:05:01.488424 2026] [:error] [pid 1930:tid 1980] [client 13.94.121.70:2577] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1yade.php"] [unique_id "aVgk7ZP-6mqhfUDa89zGLgAAAE4"]
[Sat Jan 03 04:05:02.006185 2026] [:error] [pid 34260:tid 34284] [client 13.94.121.70:3530] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1yade.php"] [unique_id "aVgk7kWWhyvZ0O9KNVR66QAAARY"]
[Sat Jan 03 04:05:02.589737 2026] [:error] [pid 1930:tid 1966] [client 13.94.121.70:5672] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1yade.php"] [unique_id "aVgk7pP-6mqhfUDa89zGMQAAAEA"]
[Sat Jan 03 04:05:03.132661 2026] [:error] [pid 1931:tid 2042] [client 13.94.121.70:7315] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1yade.php"] [unique_id "aVgk7x8Tyw7ZoIdXlcboNwAAAJI"]
[Sat Jan 03 04:05:03.675705 2026] [:error] [pid 1931:tid 1996] [client 13.94.121.70:5675] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVgk7x8Tyw7ZoIdXlcboOAAAAII"]
[Sat Jan 03 04:05:04.221537 2026] [:error] [pid 1930:tid 1983] [client 13.94.121.70:10540] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVgk8JP-6mqhfUDa89zGNAAAAFE"]
[Sat Jan 03 04:05:04.745380 2026] [:error] [pid 1929:tid 1942] [client 13.94.121.70:8088] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVgk8OcFqdpu6TNsuWq9fQAAAAQ"]
[Sat Jan 03 04:05:05.342059 2026] [:error] [pid 1929:tid 1940] [client 13.94.121.70:7296] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVgk8ecFqdpu6TNsuWq9fgAAAAI"]
[Sat Jan 03 04:05:05.923140 2026] [:error] [pid 1930:tid 1969] [client 13.94.121.70:10097] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aVgk8ZP-6mqhfUDa89zGNwAAAEM"]
[Sat Jan 03 04:05:06.509089 2026] [:error] [pid 1930:tid 1989] [client 13.94.121.70:10504] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aVgk8pP-6mqhfUDa89zGOgAAAFc"]
[Sat Jan 03 04:05:07.114891 2026] [:error] [pid 1930:tid 1974] [client 13.94.121.70:8779] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aVgk85P-6mqhfUDa89zGPAAAAEg"]
[Sat Jan 03 04:05:07.716984 2026] [:error] [pid 1931:tid 2036] [client 13.94.121.70:7130] [client 13.94.121.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aVgk8x8Tyw7ZoIdXlcboOQAAAIw"]
[Sat Jan 03 05:43:25.761973 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Sat Jan 03 05:43:25.878812 2026] [:error] [pid 34260:tid 34278] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sat Jan 03 05:43:25.994884 2026] [:error] [pid 34260:tid 34269] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/Cachex.php
[Sat Jan 03 05:43:26.111457 2026] [:error] [pid 34260:tid 34274] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/wpup.php
[Sat Jan 03 05:43:26.227506 2026] [:error] [pid 34260:tid 34283] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Sat Jan 03 05:43:26.345391 2026] [:error] [pid 34260:tid 34279] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/wpupex.php
[Sat Jan 03 05:43:26.461781 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/halo.php
[Sat Jan 03 05:43:26.579927 2026] [:error] [pid 34260:tid 34270] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/nck.php
[Sat Jan 03 05:43:26.697497 2026] [:error] [pid 34260:tid 34271] [client 4.189.161.177:15806] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Jan 03 05:43:26.811229 2026] [:error] [pid 34260:tid 34280] [client 4.189.161.177:15806] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVg7_kWWhyvZ0O9KNVSuHgAAARI"]
[Sat Jan 03 05:43:27.043460 2026] [:error] [pid 1931:tid 2031] [client 4.189.161.177:15803] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVg7_x8Tyw7ZoIdXlcYMPgAAAIc"]
[Sat Jan 03 05:43:27.269421 2026] [:error] [pid 1931:tid 1994] [client 4.189.161.177:16031] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVg7_x8Tyw7ZoIdXlcYMQAAAAIE"]
[Sat Jan 03 05:43:27.497977 2026] [:error] [pid 1931:tid 2041] [client 4.189.161.177:16030] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aVg7_x8Tyw7ZoIdXlcYMQgAAAJE"]
[Sat Jan 03 05:43:27.724200 2026] [:error] [pid 2083:tid 2107] [client 4.189.161.177:16004] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activate.php"] [unique_id "aVg7_zVlR_BmlMPnhV7TcwAAANY"]
[Sat Jan 03 05:43:27.959032 2026] [:error] [pid 1931:tid 2044] [client 4.189.161.177:15744] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activate.php"] [unique_id "aVg7_x8Tyw7ZoIdXlcYMRgAAAJQ"]
[Sat Jan 03 05:43:28.185782 2026] [:error] [pid 1929:tid 1960] [client 4.189.161.177:15766] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activate.php"] [unique_id "aVg8AOcFqdpu6TNsuWrc7QAAABY"]
[Sat Jan 03 05:43:28.411883 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:15759] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-activate.php"] [unique_id "aVg8AB8Tyw7ZoIdXlcYMSwAAAJA"]
[Sat Jan 03 05:43:28.645020 2026] [:error] [pid 1930:tid 1968] [client 4.189.161.177:15767] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aVg8AJP-6mqhfUDa89znsAAAAEI"]
[Sat Jan 03 05:43:28.874882 2026] [:error] [pid 34260:tid 34265] [client 4.189.161.177:16024] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aVg8AEWWhyvZ0O9KNVSuIgAAAQM"]
[Sat Jan 03 05:43:29.101357 2026] [:error] [pid 1930:tid 1974] [client 4.189.161.177:15774] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aVg8AZP-6mqhfUDa89znsQAAAEg"]
[Sat Jan 03 05:43:29.335372 2026] [:error] [pid 1929:tid 1961] [client 4.189.161.177:15783] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aVg8AecFqdpu6TNsuWrc8AAAABc"]
[Sat Jan 03 05:43:29.562251 2026] [:error] [pid 1931:tid 2034] [client 4.189.161.177:15746] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aVg8AR8Tyw7ZoIdXlcYMTQAAAIo"]
[Sat Jan 03 05:43:29.787394 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:16005] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aVg8AUWWhyvZ0O9KNVSuJgAAARM"]
[Sat Jan 03 05:43:30.012827 2026] [:error] [pid 1929:tid 1941] [client 4.189.161.177:16020] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aVg8AucFqdpu6TNsuWrc8wAAAAM"]
[Sat Jan 03 05:43:30.238677 2026] [:error] [pid 1929:tid 1942] [client 4.189.161.177:16035] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aVg8AucFqdpu6TNsuWrc9QAAAAQ"]
[Sat Jan 03 05:43:30.464870 2026] [:error] [pid 1929:tid 1958] [client 4.189.161.177:15762] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8AucFqdpu6TNsuWrc9wAAABQ"]
[Sat Jan 03 05:43:30.694241 2026] [:error] [pid 1931:tid 2035] [client 4.189.161.177:16014] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8Ah8Tyw7ZoIdXlcYMTwAAAIs"]
[Sat Jan 03 05:43:30.920853 2026] [:error] [pid 1930:tid 1978] [client 4.189.161.177:16013] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8ApP-6mqhfUDa89znuQAAAEw"]
[Sat Jan 03 05:43:31.169494 2026] [:error] [pid 1931:tid 2037] [client 4.189.161.177:16016] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8Ax8Tyw7ZoIdXlcYMUAAAAI0"]
[Sat Jan 03 05:43:31.415134 2026] [:error] [pid 1931:tid 2048] [client 4.189.161.177:15787] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs.php"] [unique_id "aVg8Ax8Tyw7ZoIdXlcYMUgAAAJg"]
[Sat Jan 03 05:43:31.672795 2026] [:error] [pid 34260:tid 34279] [client 4.189.161.177:16006] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs.php"] [unique_id "aVg8A0WWhyvZ0O9KNVSuKwAAARE"]
[Sat Jan 03 05:43:31.897595 2026] [:error] [pid 2083:tid 2087] [client 4.189.161.177:16056] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs.php"] [unique_id "aVg8AzVlR_BmlMPnhV7TeQAAAMI"]
[Sat Jan 03 05:43:32.142422 2026] [:error] [pid 1930:tid 1967] [client 4.189.161.177:16034] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs.php"] [unique_id "aVg8BJP-6mqhfUDa89znvQAAAEE"]
[Sat Jan 03 05:43:32.369908 2026] [:error] [pid 1931:tid 2045] [client 4.189.161.177:16060] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVg8BB8Tyw7ZoIdXlcYMVgAAAJU"]
[Sat Jan 03 05:43:32.614315 2026] [:error] [pid 1931:tid 2033] [client 4.189.161.177:16158] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVg8BB8Tyw7ZoIdXlcYMWAAAAIk"]
[Sat Jan 03 05:43:32.840329 2026] [:error] [pid 1930:tid 1975] [client 4.189.161.177:15796] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVg8BJP-6mqhfUDa89znwgAAAEk"]
[Sat Jan 03 05:43:33.071269 2026] [:error] [pid 2083:tid 2104] [client 4.189.161.177:15782] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVg8BTVlR_BmlMPnhV7TfQAAANM"]
[Sat Jan 03 05:43:33.304087 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:16058] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aVg8BR8Tyw7ZoIdXlcYMWgAAAJM"]
[Sat Jan 03 05:43:33.529685 2026] [:error] [pid 1929:tid 1952] [client 4.189.161.177:15802] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aVg8BecFqdpu6TNsuWrc-QAAAA4"]
[Sat Jan 03 05:43:33.761647 2026] [:error] [pid 1929:tid 1962] [client 4.189.161.177:16137] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aVg8BecFqdpu6TNsuWrc-gAAABg"]
[Sat Jan 03 05:43:33.996850 2026] [:error] [pid 1929:tid 1950] [client 4.189.161.177:15800] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aVg8BecFqdpu6TNsuWrc_QAAAAw"]
[Sat Jan 03 05:43:34.227753 2026] [:error] [pid 1929:tid 1959] [client 4.189.161.177:16007] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aVg8BucFqdpu6TNsuWrc_wAAABU"]
[Sat Jan 03 05:43:34.455633 2026] [:error] [pid 1931:tid 2034] [client 4.189.161.177:16154] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aVg8Bh8Tyw7ZoIdXlcYMXwAAAIo"]
[Sat Jan 03 05:43:34.683048 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:16146] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aVg8BkWWhyvZ0O9KNVSuLAAAAQQ"]
[Sat Jan 03 05:43:34.909477 2026] [:error] [pid 2083:tid 2102] [client 4.189.161.177:16028] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "aVg8BjVlR_BmlMPnhV7TgAAAANE"]
[Sat Jan 03 05:43:35.138452 2026] [:error] [pid 1931:tid 2035] [client 4.189.161.177:15771] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aVg8Bx8Tyw7ZoIdXlcYMYAAAAIs"]
[Sat Jan 03 05:43:35.370184 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15797] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aVg8BzVlR_BmlMPnhV7ThAAAAM8"]
[Sat Jan 03 05:43:35.602409 2026] [:error] [pid 1931:tid 2048] [client 4.189.161.177:16143] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aVg8Bx8Tyw7ZoIdXlcYMYwAAAJg"]
[Sat Jan 03 05:43:35.833485 2026] [:error] [pid 1930:tid 1971] [client 4.189.161.177:15791] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/minik.php"] [unique_id "aVg8B5P-6mqhfUDa89znygAAAEU"]
[Sat Jan 03 05:43:36.059863 2026] [:error] [pid 34260:tid 34280] [client 4.189.161.177:16033] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aVg8CEWWhyvZ0O9KNVSuLgAAARI"]
[Sat Jan 03 05:43:36.286962 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:15772] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aVg8CEWWhyvZ0O9KNVSuMAAAARc"]
[Sat Jan 03 05:43:36.527136 2026] [:error] [pid 1931:tid 1994] [client 4.189.161.177:15788] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aVg8CB8Tyw7ZoIdXlcYMZwAAAIE"]
[Sat Jan 03 05:43:36.784670 2026] [:error] [pid 1931:tid 2046] [client 4.189.161.177:16145] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OK.php"] [unique_id "aVg8CB8Tyw7ZoIdXlcYMaQAAAJY"]
[Sat Jan 03 05:43:37.020423 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:16061] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aVg8CR8Tyw7ZoIdXlcYMawAAAJM"]
[Sat Jan 03 05:43:37.268546 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:15784] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aVg8CR8Tyw7ZoIdXlcYMbgAAAJA"]
[Sat Jan 03 05:43:37.504224 2026] [:error] [pid 1929:tid 1961] [client 4.189.161.177:16010] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aVg8CecFqdpu6TNsuWrdBQAAABc"]
[Sat Jan 03 05:43:37.734814 2026] [:error] [pid 34260:tid 34268] [client 4.189.161.177:15785] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php"] [unique_id "aVg8CUWWhyvZ0O9KNVSuNgAAAQY"]
[Sat Jan 03 05:43:37.961706 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:15781] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aVg8CUWWhyvZ0O9KNVSuOQAAAQU"]
[Sat Jan 03 05:43:38.198228 2026] [:error] [pid 2083:tid 2107] [client 4.189.161.177:15770] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aVg8CjVlR_BmlMPnhV7ThgAAANY"]
[Sat Jan 03 05:43:38.424961 2026] [:error] [pid 1930:tid 1987] [client 4.189.161.177:16045] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aVg8CpP-6mqhfUDa89znzAAAAFU"]
[Sat Jan 03 05:43:38.652761 2026] [:error] [pid 1930:tid 1988] [client 4.189.161.177:15795] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aVg8CpP-6mqhfUDa89znzQAAAFY"]
[Sat Jan 03 05:43:38.881210 2026] [:error] [pid 1930:tid 1968] [client 4.189.161.177:16029] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aVg8CpP-6mqhfUDa89zn0AAAAEI"]
[Sat Jan 03 05:43:39.107767 2026] [:error] [pid 34260:tid 34275] [client 4.189.161.177:16174] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aVg8C0WWhyvZ0O9KNVSuPAAAAQ0"]
[Sat Jan 03 05:43:39.334399 2026] [:error] [pid 34260:tid 34263] [client 4.189.161.177:16062] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aVg8C0WWhyvZ0O9KNVSuPgAAAQE"]
[Sat Jan 03 05:43:39.570266 2026] [:error] [pid 1930:tid 1979] [client 4.189.161.177:16001] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arig.php"] [unique_id "aVg8C5P-6mqhfUDa89zn0wAAAE0"]
[Sat Jan 03 05:43:39.797388 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:15758] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aVg8C0WWhyvZ0O9KNVSuQAAAAQQ"]
[Sat Jan 03 05:43:40.023523 2026] [:error] [pid 1930:tid 1970] [client 4.189.161.177:15778] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aVg8DJP-6mqhfUDa89zn1gAAAEQ"]
[Sat Jan 03 05:43:40.250955 2026] [:error] [pid 1930:tid 1981] [client 4.189.161.177:16134] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aVg8DJP-6mqhfUDa89zn2AAAAE8"]
[Sat Jan 03 05:43:40.481772 2026] [:error] [pid 1930:tid 1978] [client 4.189.161.177:16131] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aVg8DJP-6mqhfUDa89zn2gAAAEw"]
[Sat Jan 03 05:43:40.708973 2026] [:error] [pid 34260:tid 34270] [client 4.189.161.177:15799] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aVg8DEWWhyvZ0O9KNVSuQwAAAQg"]
[Sat Jan 03 05:43:40.939505 2026] [:error] [pid 1929:tid 1942] [client 4.189.161.177:16011] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aVg8DOcFqdpu6TNsuWrdBwAAAAQ"]
[Sat Jan 03 05:43:41.165779 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:15757] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aVg8DUWWhyvZ0O9KNVSuRAAAARc"]
[Sat Jan 03 05:43:41.391482 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:16032] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aVg8DUWWhyvZ0O9KNVSuRwAAAQs"]
[Sat Jan 03 05:43:41.617863 2026] [:error] [pid 1929:tid 1944] [client 4.189.161.177:16055] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aVg8DecFqdpu6TNsuWrdCAAAAAY"]
[Sat Jan 03 05:43:41.853181 2026] [:error] [pid 1929:tid 1958] [client 4.189.161.177:16054] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aVg8DecFqdpu6TNsuWrdCQAAABQ"]
[Sat Jan 03 05:43:42.079866 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:15792] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aVg8DkWWhyvZ0O9KNVSuTgAAARg"]
[Sat Jan 03 05:43:42.315902 2026] [:error] [pid 34260:tid 34275] [client 4.189.161.177:15636] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/af32.php"] [unique_id "aVg8DkWWhyvZ0O9KNVSuUgAAAQ0"]
[Sat Jan 03 05:43:42.541865 2026] [:error] [pid 34260:tid 34271] [client 4.189.161.177:15751] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aVg8DkWWhyvZ0O9KNVSuVAAAAQk"]
[Sat Jan 03 05:43:42.794722 2026] [:error] [pid 1930:tid 1971] [client 4.189.161.177:15790] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aVg8DpP-6mqhfUDa89zn3wAAAEU"]
[Sat Jan 03 05:43:43.037653 2026] [:error] [pid 1929:tid 1962] [client 4.189.161.177:15775] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aVg8D-cFqdpu6TNsuWrdDQAAABg"]
[Sat Jan 03 05:43:43.293876 2026] [:error] [pid 1929:tid 1955] [client 4.189.161.177:15786] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rz.php"] [unique_id "aVg8D-cFqdpu6TNsuWrdDgAAABE"]
[Sat Jan 03 05:43:43.526509 2026] [:error] [pid 1929:tid 1946] [client 4.189.161.177:15798] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hugo.php"] [unique_id "aVg8D-cFqdpu6TNsuWrdEQAAAAg"]
[Sat Jan 03 05:43:43.754172 2026] [:error] [pid 1929:tid 1949] [client 4.189.161.177:16012] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hugo.php"] [unique_id "aVg8D-cFqdpu6TNsuWrdFAAAAAs"]
[Sat Jan 03 05:43:43.979664 2026] [:error] [pid 1931:tid 1999] [client 4.189.161.177:16019] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hugo.php"] [unique_id "aVg8Dx8Tyw7ZoIdXlcYMfAAAAIM"]
[Sat Jan 03 05:43:44.205406 2026] [:error] [pid 1930:tid 1987] [client 4.189.161.177:15756] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hugo.php"] [unique_id "aVg8EJP-6mqhfUDa89zn4QAAAFU"]
[Sat Jan 03 05:43:44.437181 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:16027] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "aVg8EEWWhyvZ0O9KNVSuXwAAARM"]
[Sat Jan 03 05:43:44.663336 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:15777] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "aVg8EEWWhyvZ0O9KNVSuYAAAAQU"]
[Sat Jan 03 05:43:44.889231 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:15752] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "aVg8EEWWhyvZ0O9KNVSuYwAAARg"]
[Sat Jan 03 05:43:45.114983 2026] [:error] [pid 1930:tid 1968] [client 4.189.161.177:16135] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "aVg8EZP-6mqhfUDa89zn4gAAAEI"]
[Sat Jan 03 05:43:45.343632 2026] [:error] [pid 1930:tid 1974] [client 4.189.161.177:15646] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lzyrj.php"] [unique_id "aVg8EZP-6mqhfUDa89zn4wAAAEg"]
[Sat Jan 03 05:43:45.579747 2026] [:error] [pid 1930:tid 1990] [client 4.189.161.177:15750] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lzyrj.php"] [unique_id "aVg8EZP-6mqhfUDa89zn5QAAAFg"]
[Sat Jan 03 05:43:45.806249 2026] [:error] [pid 1929:tid 1958] [client 4.189.161.177:15780] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lzyrj.php"] [unique_id "aVg8EecFqdpu6TNsuWrdGwAAABQ"]
[Sat Jan 03 05:43:46.037126 2026] [:error] [pid 1929:tid 1952] [client 4.189.161.177:15747] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lzyrj.php"] [unique_id "aVg8EucFqdpu6TNsuWrdHQAAAA4"]
[Sat Jan 03 05:43:46.273284 2026] [:error] [pid 1929:tid 1946] [client 4.189.161.177:16171] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/laudq.php"] [unique_id "aVg8EucFqdpu6TNsuWrdHwAAAAg"]
[Sat Jan 03 05:43:46.499281 2026] [:error] [pid 1929:tid 1960] [client 4.189.161.177:16140] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/laudq.php"] [unique_id "aVg8EucFqdpu6TNsuWrdJQAAABY"]
[Sat Jan 03 05:43:46.726564 2026] [:error] [pid 34260:tid 34280] [client 4.189.161.177:16162] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/laudq.php"] [unique_id "aVg8EkWWhyvZ0O9KNVSuZwAAARI"]
[Sat Jan 03 05:43:46.963277 2026] [:error] [pid 1929:tid 1957] [client 4.189.161.177:15764] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/laudq.php"] [unique_id "aVg8EucFqdpu6TNsuWrdKAAAABM"]
[Sat Jan 03 05:43:47.212931 2026] [:error] [pid 34260:tid 34277] [client 4.189.161.177:16040] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anjay.php"] [unique_id "aVg8E0WWhyvZ0O9KNVSuaQAAAQ8"]
[Sat Jan 03 05:43:47.475488 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:16044] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anjay.php"] [unique_id "aVg8E0WWhyvZ0O9KNVSuawAAAQs"]
[Sat Jan 03 05:43:47.700766 2026] [:error] [pid 1931:tid 2047] [client 4.189.161.177:15794] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anjay.php"] [unique_id "aVg8Ex8Tyw7ZoIdXlcYMfwAAAJc"]
[Sat Jan 03 05:43:47.927679 2026] [:error] [pid 2083:tid 2089] [client 4.189.161.177:15789] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anjay.php"] [unique_id "aVg8EzVlR_BmlMPnhV7TjAAAAMQ"]
[Sat Jan 03 05:43:48.153447 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:16037] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aVg8FEWWhyvZ0O9KNVSubgAAARM"]
[Sat Jan 03 05:43:48.380875 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:16163] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aVg8FEWWhyvZ0O9KNVSubwAAAQU"]
[Sat Jan 03 05:43:48.611702 2026] [:error] [pid 1931:tid 2041] [client 4.189.161.177:16047] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aVg8FB8Tyw7ZoIdXlcYMhAAAAJE"]
[Sat Jan 03 05:43:48.858099 2026] [:error] [pid 34260:tid 34279] [client 4.189.161.177:15768] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/let.php"] [unique_id "aVg8FEWWhyvZ0O9KNVSucwAAARE"]
[Sat Jan 03 05:43:49.090224 2026] [:error] [pid 2083:tid 2088] [client 4.189.161.177:15782] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVg8FTVlR_BmlMPnhV7TjQAAAMM"]
[Sat Jan 03 05:43:49.319146 2026] [:error] [pid 1930:tid 1983] [client 4.189.161.177:16018] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVg8FZP-6mqhfUDa89zn7AAAAFE"]
[Sat Jan 03 05:43:49.548775 2026] [:error] [pid 2083:tid 2097] [client 4.189.161.177:16160] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVg8FTVlR_BmlMPnhV7TkAAAAMw"]
[Sat Jan 03 05:43:49.776800 2026] [:error] [pid 34260:tid 34283] [client 4.189.161.177:16147] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVg8FUWWhyvZ0O9KNVSudwAAARU"]
[Sat Jan 03 05:43:50.002906 2026] [:error] [pid 1931:tid 2030] [client 4.189.161.177:16000] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8Fh8Tyw7ZoIdXlcYMhgAAAIY"]
[Sat Jan 03 05:43:50.235720 2026] [:error] [pid 1931:tid 2031] [client 4.189.161.177:15801] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8Fh8Tyw7ZoIdXlcYMiQAAAIc"]
[Sat Jan 03 05:43:50.476767 2026] [:error] [pid 1930:tid 1985] [client 4.189.161.177:16132] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8FpP-6mqhfUDa89zn7QAAAFM"]
[Sat Jan 03 05:43:50.709233 2026] [:error] [pid 1929:tid 1952] [client 4.189.161.177:16130] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8FucFqdpu6TNsuWrdLwAAAA4"]
[Sat Jan 03 05:43:50.937759 2026] [:error] [pid 34260:tid 34262] [client 4.189.161.177:16038] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVg8FkWWhyvZ0O9KNVSufAAAAQA"]
[Sat Jan 03 05:43:51.174183 2026] [:error] [pid 1930:tid 1976] [client 4.189.161.177:15805] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVg8F5P-6mqhfUDa89zn7wAAAEo"]
[Sat Jan 03 05:43:51.410006 2026] [:error] [pid 1929:tid 1946] [client 4.189.161.177:16149] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVg8F-cFqdpu6TNsuWrdMQAAAAg"]
[Sat Jan 03 05:43:51.638776 2026] [:error] [pid 1929:tid 1953] [client 4.189.161.177:16036] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pn.php"] [unique_id "aVg8F-cFqdpu6TNsuWrdMgAAAA8"]
[Sat Jan 03 05:43:51.864785 2026] [:error] [pid 2083:tid 2093] [client 4.189.161.177:16180] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aVg8FzVlR_BmlMPnhV7TlAAAAMg"]
[Sat Jan 03 05:43:52.113750 2026] [:error] [pid 1930:tid 1987] [client 4.189.161.177:16155] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aVg8GJP-6mqhfUDa89zn8wAAAFU"]
[Sat Jan 03 05:43:52.349130 2026] [:error] [pid 1931:tid 2046] [client 4.189.161.177:16053] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aVg8GB8Tyw7ZoIdXlcYMiwAAAJY"]
[Sat Jan 03 05:43:52.578412 2026] [:error] [pid 34260:tid 34268] [client 4.189.161.177:15748] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aVg8GEWWhyvZ0O9KNVSufwAAAQY"]
[Sat Jan 03 05:43:52.807648 2026] [:error] [pid 2083:tid 2103] [client 4.189.161.177:16161] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aVg8GDVlR_BmlMPnhV7TmAAAANI"]
[Sat Jan 03 05:43:53.087366 2026] [:error] [pid 34260:tid 34275] [client 4.189.161.177:16046] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aVg8GUWWhyvZ0O9KNVSuhAAAAQ0"]
[Sat Jan 03 05:43:53.322269 2026] [:error] [pid 1929:tid 1949] [client 4.189.161.177:15769] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aVg8GecFqdpu6TNsuWrdMwAAAAs"]
[Sat Jan 03 05:43:53.567331 2026] [:error] [pid 1929:tid 1954] [client 4.189.161.177:16133] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aVg8GecFqdpu6TNsuWrdNAAAABA"]
[Sat Jan 03 05:43:53.793883 2026] [:error] [pid 1931:tid 1996] [client 4.189.161.177:15763] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aVg8GR8Tyw7ZoIdXlcYMjgAAAII"]
[Sat Jan 03 05:43:54.045380 2026] [:error] [pid 1930:tid 1990] [client 4.189.161.177:16129] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aVg8GpP-6mqhfUDa89zn9wAAAFg"]
[Sat Jan 03 05:43:54.276496 2026] [:error] [pid 1931:tid 2032] [client 4.189.161.177:16042] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aVg8Gh8Tyw7ZoIdXlcYMjwAAAIg"]
[Sat Jan 03 05:43:54.520851 2026] [:error] [pid 2083:tid 2091] [client 4.189.161.177:16189] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aVg8GjVlR_BmlMPnhV7TngAAAMY"]
[Sat Jan 03 05:43:54.747483 2026] [:error] [pid 2083:tid 2089] [client 4.189.161.177:16153] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aVg8GjVlR_BmlMPnhV7ToAAAAMQ"]
[Sat Jan 03 05:43:54.979121 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:16144] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aVg8GkWWhyvZ0O9KNVSuiAAAAQQ"]
[Sat Jan 03 05:43:55.206682 2026] [:error] [pid 34260:tid 34263] [client 4.189.161.177:16148] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aVg8G0WWhyvZ0O9KNVSuigAAAQE"]
[Sat Jan 03 05:43:55.451154 2026] [:error] [pid 2083:tid 2095] [client 4.189.161.177:16177] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cc.php"] [unique_id "aVg8GzVlR_BmlMPnhV7TowAAAMo"]
[Sat Jan 03 05:43:55.699340 2026] [:error] [pid 1929:tid 1939] [client 4.189.161.177:16128] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVg8G-cFqdpu6TNsuWrdNQAAAAE"]
[Sat Jan 03 05:43:55.937263 2026] [:error] [pid 2083:tid 2101] [client 4.189.161.177:15637] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVg8GzVlR_BmlMPnhV7TqAAAANA"]
[Sat Jan 03 05:43:56.163434 2026] [:error] [pid 2083:tid 2106] [client 4.189.161.177:16026] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVg8HDVlR_BmlMPnhV7TqQAAANU"]
[Sat Jan 03 05:43:56.415417 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:15659] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVg8HEWWhyvZ0O9KNVSujAAAAQs"]
[Sat Jan 03 05:43:56.669863 2026] [:error] [pid 2083:tid 2099] [client 4.189.161.177:16150] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aVg8HDVlR_BmlMPnhV7TrQAAAM4"]
[Sat Jan 03 05:43:56.900811 2026] [:error] [pid 2083:tid 2085] [client 4.189.161.177:16050] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aVg8HDVlR_BmlMPnhV7TrwAAAMA"]
[Sat Jan 03 05:43:57.126246 2026] [:error] [pid 1931:tid 2036] [client 4.189.161.177:15760] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aVg8HR8Tyw7ZoIdXlcYMkgAAAIw"]
[Sat Jan 03 05:43:57.356387 2026] [:error] [pid 2083:tid 2109] [client 4.189.161.177:16039] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cloud.php"] [unique_id "aVg8HTVlR_BmlMPnhV7TsQAAANg"]
[Sat Jan 03 05:43:57.597919 2026] [:error] [pid 1930:tid 1980] [client 4.189.161.177:15643] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8HZP-6mqhfUDa89zn_gAAAE4"]
[Sat Jan 03 05:43:57.823849 2026] [:error] [pid 1930:tid 1977] [client 4.189.161.177:16057] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8HZP-6mqhfUDa89zoAAAAAEs"]
[Sat Jan 03 05:43:58.059079 2026] [:error] [pid 34260:tid 34265] [client 4.189.161.177:16052] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8HkWWhyvZ0O9KNVSujwAAAQM"]
[Sat Jan 03 05:43:58.286195 2026] [:error] [pid 1930:tid 1982] [client 4.189.161.177:15619] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8HpP-6mqhfUDa89zoAwAAAFA"]
[Sat Jan 03 05:43:58.511909 2026] [:error] [pid 34260:tid 34284] [client 4.189.161.177:15749] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVg8HkWWhyvZ0O9KNVSukQAAARY"]
[Sat Jan 03 05:43:58.738659 2026] [:error] [pid 1930:tid 1987] [client 4.189.161.177:15650] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVg8HpP-6mqhfUDa89zoBgAAAFU"]
[Sat Jan 03 05:43:58.969606 2026] [:error] [pid 34260:tid 34269] [client 4.189.161.177:16022] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVg8HkWWhyvZ0O9KNVSulAAAAQc"]
[Sat Jan 03 05:43:59.195730 2026] [:error] [pid 1930:tid 1984] [client 4.189.161.177:16048] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVg8H5P-6mqhfUDa89zoCQAAAFI"]
[Sat Jan 03 05:43:59.431223 2026] [:error] [pid 1930:tid 1979] [client 4.189.161.177:16176] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aVg8H5P-6mqhfUDa89zoDAAAAE0"]
[Sat Jan 03 05:43:59.659884 2026] [:error] [pid 1930:tid 1975] [client 4.189.161.177:16003] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aVg8H5P-6mqhfUDa89zoDgAAAEk"]
[Sat Jan 03 05:43:59.886370 2026] [:error] [pid 1930:tid 1970] [client 4.189.161.177:15617] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aVg8H5P-6mqhfUDa89zoEQAAAEQ"]
[Sat Jan 03 05:44:00.113464 2026] [:error] [pid 2083:tid 2105] [client 4.189.161.177:16017] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aVg8IDVlR_BmlMPnhV7TugAAANQ"]
[Sat Jan 03 05:44:00.340886 2026] [:error] [pid 1930:tid 1969] [client 4.189.161.177:15626] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aVg8IJP-6mqhfUDa89zoFAAAAEM"]
[Sat Jan 03 05:44:00.567814 2026] [:error] [pid 1930:tid 1982] [client 4.189.161.177:15754] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aVg8IJP-6mqhfUDa89zoFgAAAFA"]
[Sat Jan 03 05:44:00.799903 2026] [:error] [pid 1930:tid 1967] [client 4.189.161.177:16159] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aVg8IJP-6mqhfUDa89zoGQAAAEE"]
[Sat Jan 03 05:44:01.028857 2026] [:error] [pid 1930:tid 1968] [client 4.189.161.177:16186] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aVg8IZP-6mqhfUDa89zoHAAAAEI"]
[Sat Jan 03 05:44:01.257874 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:15573] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8IUWWhyvZ0O9KNVSunAAAAQQ"]
[Sat Jan 03 05:44:01.494594 2026] [:error] [pid 34260:tid 34271] [client 4.189.161.177:16049] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8IUWWhyvZ0O9KNVSunQAAAQk"]
[Sat Jan 03 05:44:01.725743 2026] [:error] [pid 2083:tid 2091] [client 4.189.161.177:16188] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8ITVlR_BmlMPnhV7TvgAAAMY"]
[Sat Jan 03 05:44:01.955607 2026] [:error] [pid 2083:tid 2089] [client 4.189.161.177:16172] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8ITVlR_BmlMPnhV7TwAAAAMQ"]
[Sat Jan 03 05:44:02.180960 2026] [:error] [pid 1929:tid 1945] [client 4.189.161.177:15622] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVg8IucFqdpu6TNsuWrdOwAAAAc"]
[Sat Jan 03 05:44:02.408055 2026] [:error] [pid 1931:tid 2030] [client 4.189.161.177:15761] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVg8Ih8Tyw7ZoIdXlcYMlgAAAIY"]
[Sat Jan 03 05:44:02.646023 2026] [:error] [pid 2083:tid 2094] [client 4.189.161.177:15628] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVg8IjVlR_BmlMPnhV7TwwAAAMk"]
[Sat Jan 03 05:44:02.873321 2026] [:error] [pid 2083:tid 2093] [client 4.189.161.177:16142] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVg8IjVlR_BmlMPnhV7TxQAAAMg"]
[Sat Jan 03 05:44:03.103276 2026] [:error] [pid 1931:tid 1994] [client 4.189.161.177:16181] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aVg8Ix8Tyw7ZoIdXlcYMmAAAAIE"]
[Sat Jan 03 05:44:03.333404 2026] [:error] [pid 1931:tid 2033] [client 4.189.161.177:15644] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aVg8Ix8Tyw7ZoIdXlcYMmgAAAIk"]
[Sat Jan 03 05:44:03.564653 2026] [:error] [pid 1930:tid 1973] [client 4.189.161.177:16152] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aVg8I5P-6mqhfUDa89zoIgAAAEc"]
[Sat Jan 03 05:44:03.794869 2026] [:error] [pid 1931:tid 2044] [client 4.189.161.177:15627] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aVg8Ix8Tyw7ZoIdXlcYMmwAAAJQ"]
[Sat Jan 03 05:44:04.023906 2026] [:error] [pid 34260:tid 34284] [client 4.189.161.177:15776] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aVg8JEWWhyvZ0O9KNVSuogAAARY"]
[Sat Jan 03 05:44:04.262951 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:16041] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aVg8JEWWhyvZ0O9KNVSupAAAARg"]
[Sat Jan 03 05:44:04.517212 2026] [:error] [pid 34260:tid 34269] [client 4.189.161.177:16168] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aVg8JEWWhyvZ0O9KNVSupwAAAQc"]
[Sat Jan 03 05:44:04.745204 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15556] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aVg8JDVlR_BmlMPnhV7TywAAAM8"]
[Sat Jan 03 05:44:04.977363 2026] [:error] [pid 2083:tid 2096] [client 4.189.161.177:15672] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVg8JDVlR_BmlMPnhV7TzQAAAMs"]
[Sat Jan 03 05:44:05.228247 2026] [:error] [pid 1930:tid 1981] [client 4.189.161.177:15629] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVg8JZP-6mqhfUDa89zoJAAAAE8"]
[Sat Jan 03 05:44:05.462841 2026] [:error] [pid 34260:tid 34283] [client 4.189.161.177:15621] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVg8JUWWhyvZ0O9KNVSuqwAAARU"]
[Sat Jan 03 05:44:05.689988 2026] [:error] [pid 1930:tid 1980] [client 4.189.161.177:15793] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aVg8JZP-6mqhfUDa89zoJwAAAE4"]
[Sat Jan 03 05:44:05.930217 2026] [:error] [pid 1930:tid 1987] [client 4.189.161.177:16191] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVg8JZP-6mqhfUDa89zoKwAAAFU"]
[Sat Jan 03 05:44:06.168090 2026] [:error] [pid 1930:tid 1968] [client 4.189.161.177:15620] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVg8JpP-6mqhfUDa89zoLQAAAEI"]
[Sat Jan 03 05:44:06.395091 2026] [:error] [pid 34260:tid 34277] [client 4.189.161.177:15647] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVg8JkWWhyvZ0O9KNVSusAAAAQ8"]
[Sat Jan 03 05:44:06.626989 2026] [:error] [pid 1930:tid 1983] [client 4.189.161.177:15616] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVg8JpP-6mqhfUDa89zoMgAAAFE"]
[Sat Jan 03 05:44:06.861650 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:15640] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aVg8JkWWhyvZ0O9KNVSutQAAARg"]
[Sat Jan 03 05:44:07.089959 2026] [:error] [pid 34260:tid 34269] [client 4.189.161.177:16138] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aVg8J0WWhyvZ0O9KNVSuuAAAAQc"]
[Sat Jan 03 05:44:07.320338 2026] [:error] [pid 34260:tid 34283] [client 4.189.161.177:16157] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aVg8J0WWhyvZ0O9KNVSuvAAAARU"]
[Sat Jan 03 05:44:07.547442 2026] [:error] [pid 1930:tid 1973] [client 4.189.161.177:16190] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aVg8J5P-6mqhfUDa89zoMwAAAEc"]
[Sat Jan 03 05:44:07.776400 2026] [:error] [pid 1930:tid 1970] [client 4.189.161.177:16164] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aVg8J5P-6mqhfUDa89zoNAAAAEQ"]
[Sat Jan 03 05:44:08.018553 2026] [:error] [pid 1929:tid 1952] [client 4.189.161.177:15579] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aVg8KOcFqdpu6TNsuWrdQAAAAA4"]
[Sat Jan 03 05:44:08.254676 2026] [:error] [pid 1930:tid 1989] [client 4.189.161.177:16151] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aVg8KJP-6mqhfUDa89zoNwAAAFc"]
[Sat Jan 03 05:44:08.495407 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:16051] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uana.php"] [unique_id "aVg8KEWWhyvZ0O9KNVSuxAAAARc"]
[Sat Jan 03 05:44:08.756402 2026] [:error] [pid 1929:tid 1955] [client 4.189.161.177:16008] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVg8KOcFqdpu6TNsuWrdQQAAABE"]
[Sat Jan 03 05:44:09.003533 2026] [:error] [pid 1930:tid 1984] [client 4.189.161.177:16021] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVg8KZP-6mqhfUDa89zoPAAAAFI"]
[Sat Jan 03 05:44:09.231029 2026] [:error] [pid 34260:tid 34276] [client 4.189.161.177:15624] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVg8KUWWhyvZ0O9KNVSuygAAAQ4"]
[Sat Jan 03 05:44:09.465173 2026] [:error] [pid 2083:tid 2087] [client 4.189.161.177:16165] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aVg8KTVlR_BmlMPnhV7T1gAAAMI"]
[Sat Jan 03 05:44:09.691829 2026] [:error] [pid 2083:tid 2095] [client 4.189.161.177:16009] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVg8KTVlR_BmlMPnhV7T1wAAAMo"]
[Sat Jan 03 05:44:09.923954 2026] [:error] [pid 2083:tid 2108] [client 4.189.161.177:15632] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVg8KTVlR_BmlMPnhV7T2AAAANc"]
[Sat Jan 03 05:44:10.157166 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:15631] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVg8KkWWhyvZ0O9KNVSuzQAAARM"]
[Sat Jan 03 05:44:10.383656 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:15669] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVg8KkWWhyvZ0O9KNVSuzgAAAQU"]
[Sat Jan 03 05:44:10.629909 2026] [:error] [pid 34260:tid 34270] [client 4.189.161.177:15635] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8KkWWhyvZ0O9KNVSu0AAAAQg"]
[Sat Jan 03 05:44:10.866715 2026] [:error] [pid 1930:tid 1989] [client 4.189.161.177:15655] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8KpP-6mqhfUDa89zoRgAAAFc"]
[Sat Jan 03 05:44:11.093732 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:15664] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8K0WWhyvZ0O9KNVSu1AAAARc"]
[Sat Jan 03 05:44:11.320716 2026] [:error] [pid 1930:tid 1967] [client 4.189.161.177:16156] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8K5P-6mqhfUDa89zoSgAAAEE"]
[Sat Jan 03 05:44:11.546883 2026] [:error] [pid 34260:tid 34264] [client 4.189.161.177:15642] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aVg8K0WWhyvZ0O9KNVSu2AAAAQI"]
[Sat Jan 03 05:44:11.774152 2026] [:error] [pid 34260:tid 34274] [client 4.189.161.177:15633] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aVg8K0WWhyvZ0O9KNVSu2gAAAQw"]
[Sat Jan 03 05:44:12.007088 2026] [:error] [pid 1929:tid 1947] [client 4.189.161.177:16015] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aVg8LOcFqdpu6TNsuWrdQwAAAAk"]
[Sat Jan 03 05:44:12.238834 2026] [:error] [pid 1930:tid 1985] [client 4.189.161.177:16185] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aVg8LJP-6mqhfUDa89zoSwAAAFM"]
[Sat Jan 03 05:44:12.468494 2026] [:error] [pid 1931:tid 2037] [client 4.189.161.177:15639] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVg8LB8Tyw7ZoIdXlcYMpwAAAI0"]
[Sat Jan 03 05:44:12.703058 2026] [:error] [pid 1930:tid 1979] [client 4.189.161.177:16043] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVg8LJP-6mqhfUDa89zoTQAAAE0"]
[Sat Jan 03 05:44:12.930048 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:16023] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVg8LEWWhyvZ0O9KNVSu3AAAAQU"]
[Sat Jan 03 05:44:13.157243 2026] [:error] [pid 1930:tid 1975] [client 4.189.161.177:16141] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVg8LZP-6mqhfUDa89zoUQAAAEk"]
[Sat Jan 03 05:44:13.394003 2026] [:error] [pid 2083:tid 2105] [client 4.189.161.177:16179] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVg8LTVlR_BmlMPnhV7T3gAAANQ"]
[Sat Jan 03 05:44:13.621715 2026] [:error] [pid 1929:tid 1961] [client 4.189.161.177:15779] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVg8LecFqdpu6TNsuWrdSAAAABc"]
[Sat Jan 03 05:44:13.862524 2026] [:error] [pid 34260:tid 34263] [client 4.189.161.177:15625] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVg8LUWWhyvZ0O9KNVSu3gAAAQE"]
[Sat Jan 03 05:44:14.095401 2026] [:error] [pid 34260:tid 34272] [client 4.189.161.177:16175] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-rex4.php7"] [unique_id "aVg8LkWWhyvZ0O9KNVSu3wAAAQo"]
[Sat Jan 03 05:44:14.322857 2026] [:error] [pid 1929:tid 1956] [client 4.189.161.177:15765] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aVg8LucFqdpu6TNsuWrdSgAAABI"]
[Sat Jan 03 05:44:14.565439 2026] [:error] [pid 2083:tid 2090] [client 4.189.161.177:15576] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aVg8LjVlR_BmlMPnhV7T3wAAAMU"]
[Sat Jan 03 05:44:14.791576 2026] [:error] [pid 1931:tid 2032] [client 4.189.161.177:15623] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aVg8Lh8Tyw7ZoIdXlcYMtwAAAIg"]
[Sat Jan 03 05:44:15.034678 2026] [:error] [pid 1929:tid 1951] [client 4.189.161.177:15745] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aVg8L-cFqdpu6TNsuWrdTAAAAA0"]
[Sat Jan 03 05:44:15.261697 2026] [:error] [pid 1929:tid 1942] [client 4.189.161.177:16187] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aVg8L-cFqdpu6TNsuWrdTQAAAAQ"]
[Sat Jan 03 05:44:15.487718 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:16169] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aVg8L0WWhyvZ0O9KNVSu5QAAAQs"]
[Sat Jan 03 05:44:15.713432 2026] [:error] [pid 34260:tid 34264] [client 4.189.161.177:15598] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aVg8L0WWhyvZ0O9KNVSu5gAAAQI"]
[Sat Jan 03 05:44:15.941884 2026] [:error] [pid 2083:tid 2092] [client 4.189.161.177:16173] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aVg8LzVlR_BmlMPnhV7T4gAAAMc"]
[Sat Jan 03 05:44:16.182260 2026] [:error] [pid 2083:tid 2091] [client 4.189.161.177:15660] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aVg8MDVlR_BmlMPnhV7T5gAAAMY"]
[Sat Jan 03 05:44:16.409162 2026] [:error] [pid 1931:tid 2037] [client 4.189.161.177:15665] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aVg8MB8Tyw7ZoIdXlcYMvQAAAI0"]
[Sat Jan 03 05:44:16.638178 2026] [:error] [pid 2083:tid 2098] [client 4.189.161.177:16184] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aVg8MDVlR_BmlMPnhV7T6QAAAM0"]
[Sat Jan 03 05:44:16.868260 2026] [:error] [pid 1931:tid 2029] [client 4.189.161.177:15658] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/warm.PhP7"] [unique_id "aVg8MB8Tyw7ZoIdXlcYMwAAAAIU"]
[Sat Jan 03 05:44:17.099423 2026] [:error] [pid 1931:tid 2030] [client 4.189.161.177:15585] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aVg8MR8Tyw7ZoIdXlcYMwQAAAIY"]
[Sat Jan 03 05:44:17.326188 2026] [:error] [pid 2083:tid 2089] [client 4.189.161.177:15563] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aVg8MTVlR_BmlMPnhV7T6wAAAMQ"]
[Sat Jan 03 05:44:17.553382 2026] [:error] [pid 1931:tid 2033] [client 4.189.161.177:15753] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aVg8MR8Tyw7ZoIdXlcYMxQAAAIk"]
[Sat Jan 03 05:44:17.780993 2026] [:error] [pid 34260:tid 34278] [client 4.189.161.177:15602] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php7"] [unique_id "aVg8MUWWhyvZ0O9KNVSu6AAAARA"]
[Sat Jan 03 05:44:18.010252 2026] [:error] [pid 2083:tid 2086] [client 4.189.161.177:16025] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aVg8MjVlR_BmlMPnhV7T7wAAAME"]
[Sat Jan 03 05:44:18.239105 2026] [:error] [pid 34260:tid 34275] [client 4.189.161.177:15593] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aVg8MkWWhyvZ0O9KNVSu6QAAAQ0"]
[Sat Jan 03 05:44:18.465572 2026] [:error] [pid 1929:tid 1939] [client 4.189.161.177:15594] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aVg8MucFqdpu6TNsuWrdVQAAAAE"]
[Sat Jan 03 05:44:18.693801 2026] [:error] [pid 1930:tid 1967] [client 4.189.161.177:15651] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rss.php"] [unique_id "aVg8MpP-6mqhfUDa89zoWwAAAEE"]
[Sat Jan 03 05:44:18.926605 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15557] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aVg8MjVlR_BmlMPnhV7T8QAAAM8"]
[Sat Jan 03 05:44:19.160803 2026] [:error] [pid 1930:tid 1985] [client 4.189.161.177:15568] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aVg8M5P-6mqhfUDa89zoXQAAAFM"]
[Sat Jan 03 05:44:19.389191 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:15571] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aVg8M0WWhyvZ0O9KNVSu6wAAAQQ"]
[Sat Jan 03 05:44:19.623767 2026] [:error] [pid 34260:tid 34282] [client 4.189.161.177:15755] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pekok.php"] [unique_id "aVg8M0WWhyvZ0O9KNVSu7AAAARQ"]
[Sat Jan 03 05:44:19.850494 2026] [:error] [pid 1929:tid 1951] [client 4.189.161.177:15574] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aVg8M-cFqdpu6TNsuWrdWgAAAA0"]
[Sat Jan 03 05:44:20.076591 2026] [:error] [pid 1930:tid 1990] [client 4.189.161.177:15679] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aVg8NJP-6mqhfUDa89zoYQAAAFg"]
[Sat Jan 03 05:44:20.314608 2026] [:error] [pid 1931:tid 2042] [client 4.189.161.177:15673] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aVg8NB8Tyw7ZoIdXlcYMyAAAAJI"]
[Sat Jan 03 05:44:20.541495 2026] [:error] [pid 1931:tid 2047] [client 4.189.161.177:15657] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "aVg8NB8Tyw7ZoIdXlcYMygAAAJc"]
[Sat Jan 03 05:44:20.768002 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:15562] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aVg8NB8Tyw7ZoIdXlcYMzAAAAJA"]
[Sat Jan 03 05:44:20.994101 2026] [:error] [pid 1931:tid 2027] [client 4.189.161.177:15652] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aVg8NB8Tyw7ZoIdXlcYMzgAAAIQ"]
[Sat Jan 03 05:44:21.220294 2026] [:error] [pid 1931:tid 2034] [client 4.189.161.177:16259] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aVg8NR8Tyw7ZoIdXlcYM0QAAAIo"]
[Sat Jan 03 05:44:21.446573 2026] [:error] [pid 1930:tid 1968] [client 4.189.161.177:15656] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-aa.php"] [unique_id "aVg8NZP-6mqhfUDa89zoYgAAAEI"]
[Sat Jan 03 05:44:21.674678 2026] [:error] [pid 1929:tid 1941] [client 4.189.161.177:15670] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aVg8NecFqdpu6TNsuWrdXgAAAAM"]
[Sat Jan 03 05:44:21.900627 2026] [:error] [pid 2083:tid 2104] [client 4.189.161.177:15667] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aVg8NTVlR_BmlMPnhV7T-wAAANM"]
[Sat Jan 03 05:44:22.126677 2026] [:error] [pid 1929:tid 1953] [client 4.189.161.177:15595] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aVg8NucFqdpu6TNsuWrdYQAAAA8"]
[Sat Jan 03 05:44:22.352455 2026] [:error] [pid 2083:tid 2094] [client 4.189.161.177:16136] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cart.php"] [unique_id "aVg8NjVlR_BmlMPnhV7T_AAAAMk"]
[Sat Jan 03 05:44:22.577673 2026] [:error] [pid 2083:tid 2097] [client 4.189.161.177:15572] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aVg8NjVlR_BmlMPnhV7T_gAAAMw"]
[Sat Jan 03 05:44:22.803979 2026] [:error] [pid 2083:tid 2087] [client 4.189.161.177:15648] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aVg8NjVlR_BmlMPnhV7UAQAAAMI"]
[Sat Jan 03 05:44:23.036376 2026] [:error] [pid 2083:tid 2086] [client 4.189.161.177:16302] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aVg8NzVlR_BmlMPnhV7UAwAAAME"]
[Sat Jan 03 05:44:23.260899 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15653] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/compare.php"] [unique_id "aVg8NzVlR_BmlMPnhV7UBwAAAM8"]
[Sat Jan 03 05:44:23.486169 2026] [:error] [pid 34260:tid 34272] [client 4.189.161.177:16301] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVg8N0WWhyvZ0O9KNVSu7wAAAQo"]
[Sat Jan 03 05:44:23.712160 2026] [:error] [pid 1930:tid 1981] [client 4.189.161.177:16294] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVg8N5P-6mqhfUDa89zoZAAAAE8"]
[Sat Jan 03 05:44:24.001296 2026] [:error] [pid 1929:tid 1956] [client 4.189.161.177:15663] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVg8OOcFqdpu6TNsuWrdZwAAABI"]
[Sat Jan 03 05:44:24.279606 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:15609] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVg8OEWWhyvZ0O9KNVSu8QAAARc"]
[Sat Jan 03 05:44:24.505414 2026] [:error] [pid 34260:tid 34269] [client 4.189.161.177:15676] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8OEWWhyvZ0O9KNVSu9AAAAQc"]
[Sat Jan 03 05:44:24.733410 2026] [:error] [pid 1929:tid 1943] [client 4.189.161.177:16257] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8OOcFqdpu6TNsuWrdagAAAAU"]
[Sat Jan 03 05:44:24.963692 2026] [:error] [pid 1930:tid 1967] [client 4.189.161.177:15645] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8OJP-6mqhfUDa89zoagAAAEE"]
[Sat Jan 03 05:44:25.190013 2026] [:error] [pid 1930:tid 1988] [client 4.189.161.177:15677] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api.php"] [unique_id "aVg8OZP-6mqhfUDa89zoawAAAFY"]
[Sat Jan 03 05:44:25.418092 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:16260] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVg8OUWWhyvZ0O9KNVSu-gAAARM"]
[Sat Jan 03 05:44:25.648789 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:15581] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVg8OUWWhyvZ0O9KNVSu_AAAAQU"]
[Sat Jan 03 05:44:25.883655 2026] [:error] [pid 1931:tid 2045] [client 4.189.161.177:15575] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVg8OR8Tyw7ZoIdXlcYM1AAAAJU"]
[Sat Jan 03 05:44:26.111921 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Jan 03 05:44:26.227955 2026] [:error] [pid 1931:tid 1994] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/atom.php
[Sat Jan 03 05:44:26.346454 2026] [:error] [pid 1931:tid 2031] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/case.php
[Sat Jan 03 05:44:26.464482 2026] [:error] [pid 1931:tid 2033] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/docs.php
[Sat Jan 03 05:44:27.864263 2026] [:error] [pid 1931:tid 2033] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/ios.php
[Sat Jan 03 05:44:27.980747 2026] [:error] [pid 1931:tid 2042] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Jan 03 05:44:28.107922 2026] [:error] [pid 1931:tid 2038] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Jan 03 05:44:28.224676 2026] [:error] [pid 1931:tid 2047] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Jan 03 05:44:28.340495 2026] [:error] [pid 1931:tid 1996] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Jan 03 05:44:28.455965 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Jan 03 05:44:28.572206 2026] [:error] [pid 1931:tid 2032] [client 4.189.161.177:16178] File does not exist: /usr/local/apache/htdocs/suspended-page/goat1.php
[Sat Jan 03 05:44:28.685065 2026] [:error] [pid 1931:tid 2027] [client 4.189.161.177:16178] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aVg8PB8Tyw7ZoIdXlcYM5AAAAIQ"]
[Sat Jan 03 05:44:28.910707 2026] [:error] [pid 1930:tid 1970] [client 4.189.161.177:15630] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aVg8PJP-6mqhfUDa89zodgAAAEQ"]
[Sat Jan 03 05:44:29.136864 2026] [:error] [pid 2083:tid 2107] [client 4.189.161.177:15561] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aVg8PTVlR_BmlMPnhV7UDAAAANY"]
[Sat Jan 03 05:44:29.373720 2026] [:error] [pid 2083:tid 2106] [client 4.189.161.177:15552] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f.php"] [unique_id "aVg8PTVlR_BmlMPnhV7UDgAAANU"]
[Sat Jan 03 05:44:29.606059 2026] [:error] [pid 34260:tid 34274] [client 4.189.161.177:16182] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aVg8PUWWhyvZ0O9KNVSvAAAAAQw"]
[Sat Jan 03 05:44:29.842285 2026] [:error] [pid 34260:tid 34271] [client 4.189.161.177:16271] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aVg8PUWWhyvZ0O9KNVSvAgAAAQk"]
[Sat Jan 03 05:44:30.070852 2026] [:error] [pid 1931:tid 1993] [client 4.189.161.177:15553] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aVg8Ph8Tyw7ZoIdXlcYM5wAAAIA"]
[Sat Jan 03 05:44:30.297601 2026] [:error] [pid 34260:tid 34283] [client 4.189.161.177:16267] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/max.php"] [unique_id "aVg8PkWWhyvZ0O9KNVSvBQAAARU"]
[Sat Jan 03 05:44:30.524992 2026] [:error] [pid 1929:tid 1951] [client 4.189.161.177:15584] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aVg8PucFqdpu6TNsuWrdfAAAAA0"]
[Sat Jan 03 05:44:30.776741 2026] [:error] [pid 1931:tid 2029] [client 4.189.161.177:16311] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aVg8Ph8Tyw7ZoIdXlcYM6wAAAIU"]
[Sat Jan 03 05:44:31.007152 2026] [:error] [pid 1929:tid 1959] [client 4.189.161.177:15560] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aVg8P-cFqdpu6TNsuWrdgQAAABU"]
[Sat Jan 03 05:44:31.234155 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:15662] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "aVg8Px8Tyw7ZoIdXlcYM7QAAAJM"]
[Sat Jan 03 05:44:31.462154 2026] [:error] [pid 1931:tid 2044] [client 4.189.161.177:15649] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8Px8Tyw7ZoIdXlcYM7wAAAJQ"]
[Sat Jan 03 05:44:31.689628 2026] [:error] [pid 1929:tid 1946] [client 4.189.161.177:15583] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8P-cFqdpu6TNsuWrdhQAAAAg"]
[Sat Jan 03 05:44:31.947518 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:16293] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8P0WWhyvZ0O9KNVSvBwAAARg"]
[Sat Jan 03 05:44:32.173624 2026] [:error] [pid 1929:tid 1961] [client 4.189.161.177:15566] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVg8QOcFqdpu6TNsuWrdigAAABc"]
[Sat Jan 03 05:44:32.437832 2026] [:error] [pid 1929:tid 1948] [client 4.189.161.177:15589] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVg8QOcFqdpu6TNsuWrdjQAAAAo"]
[Sat Jan 03 05:44:32.672608 2026] [:error] [pid 1929:tid 1940] [client 4.189.161.177:15675] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVg8QOcFqdpu6TNsuWrdjwAAAAI"]
[Sat Jan 03 05:44:32.898558 2026] [:error] [pid 1929:tid 1960] [client 4.189.161.177:15661] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVg8QOcFqdpu6TNsuWrdkQAAABY"]
[Sat Jan 03 05:44:33.125012 2026] [:error] [pid 1930:tid 1966] [client 4.189.161.177:15621] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVg8QZP-6mqhfUDa89zoeQAAAEA"]
[Sat Jan 03 05:44:33.350946 2026] [:error] [pid 1930:tid 1977] [client 4.189.161.177:15638] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8QZP-6mqhfUDa89zofAAAAEs"]
[Sat Jan 03 05:44:33.584957 2026] [:error] [pid 1929:tid 1942] [client 4.189.161.177:15555] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8QecFqdpu6TNsuWrdlAAAAAQ"]
[Sat Jan 03 05:44:33.813902 2026] [:error] [pid 1929:tid 1955] [client 4.189.161.177:15610] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8QecFqdpu6TNsuWrdlgAAABE"]
[Sat Jan 03 05:44:34.043673 2026] [:error] [pid 1931:tid 2036] [client 4.189.161.177:15559] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVg8Qh8Tyw7ZoIdXlcYM9wAAAIw"]
[Sat Jan 03 05:44:34.274224 2026] [:error] [pid 1931:tid 2041] [client 4.189.161.177:16167] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aVg8Qh8Tyw7ZoIdXlcYM-gAAAJE"]
[Sat Jan 03 05:44:34.506626 2026] [:error] [pid 34260:tid 34264] [client 4.189.161.177:15569] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aVg8QkWWhyvZ0O9KNVSvCgAAAQI"]
[Sat Jan 03 05:44:34.737478 2026] [:error] [pid 1930:tid 1976] [client 4.189.161.177:15601] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aVg8QpP-6mqhfUDa89zofwAAAEo"]
[Sat Jan 03 05:44:34.987649 2026] [:error] [pid 1931:tid 2037] [client 4.189.161.177:16265] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vv.php"] [unique_id "aVg8Qh8Tyw7ZoIdXlcYM_QAAAI0"]
[Sat Jan 03 05:44:35.230611 2026] [:error] [pid 1931:tid 2045] [client 4.189.161.177:16183] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVg8Qx8Tyw7ZoIdXlcYM_gAAAJU"]
[Sat Jan 03 05:44:35.498763 2026] [:error] [pid 1929:tid 1956] [client 4.189.161.177:16281] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVg8Q-cFqdpu6TNsuWrdoQAAABI"]
[Sat Jan 03 05:44:35.725853 2026] [:error] [pid 1929:tid 1958] [client 4.189.161.177:15577] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVg8Q-cFqdpu6TNsuWrdpAAAABQ"]
[Sat Jan 03 05:44:35.953023 2026] [:error] [pid 1930:tid 1984] [client 4.189.161.177:15943] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVg8Q5P-6mqhfUDa89zogwAAAFI"]
[Sat Jan 03 05:44:36.188508 2026] [:error] [pid 1930:tid 1983] [client 4.189.161.177:15605] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aVg8RJP-6mqhfUDa89zohgAAAFE"]
[Sat Jan 03 05:44:36.415855 2026] [:error] [pid 1929:tid 1943] [client 4.189.161.177:16264] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aVg8ROcFqdpu6TNsuWrdpgAAAAU"]
[Sat Jan 03 05:44:36.642403 2026] [:error] [pid 2083:tid 2089] [client 4.189.161.177:16316] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aVg8RDVlR_BmlMPnhV7UFAAAAMQ"]
[Sat Jan 03 05:44:36.877697 2026] [:error] [pid 2083:tid 2095] [client 4.189.161.177:16276] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aVg8RDVlR_BmlMPnhV7UFQAAAMo"]
[Sat Jan 03 05:44:37.103204 2026] [:error] [pid 1930:tid 1971] [client 4.189.161.177:15612] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aVg8RZP-6mqhfUDa89zoigAAAEU"]
[Sat Jan 03 05:44:37.329112 2026] [:error] [pid 2083:tid 2087] [client 4.189.161.177:15671] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aVg8RTVlR_BmlMPnhV7UFgAAAMI"]
[Sat Jan 03 05:44:37.554428 2026] [:error] [pid 34260:tid 34278] [client 4.189.161.177:15804] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aVg8RUWWhyvZ0O9KNVSvDAAAARA"]
[Sat Jan 03 05:44:37.780581 2026] [:error] [pid 2083:tid 2105] [client 4.189.161.177:16298] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aVg8RTVlR_BmlMPnhV7UGwAAANQ"]
[Sat Jan 03 05:44:38.014489 2026] [:error] [pid 2083:tid 2097] [client 4.189.161.177:16269] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aVg8RjVlR_BmlMPnhV7UHwAAAMw"]
[Sat Jan 03 05:44:38.241086 2026] [:error] [pid 1929:tid 1957] [client 4.189.161.177:16261] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aVg8RucFqdpu6TNsuWrdqQAAABM"]
[Sat Jan 03 05:44:38.468875 2026] [:error] [pid 1929:tid 1938] [client 4.189.161.177:15597] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aVg8RucFqdpu6TNsuWrdrgAAAAA"]
[Sat Jan 03 05:44:38.694765 2026] [:error] [pid 34260:tid 34275] [client 4.189.161.177:15958] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aVg8RkWWhyvZ0O9KNVSvDQAAAQ0"]
[Sat Jan 03 05:44:38.921303 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:15606] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVg8RkWWhyvZ0O9KNVSvDgAAARM"]
[Sat Jan 03 05:44:39.149051 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:15558] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVg8Rx8Tyw7ZoIdXlcYNBQAAAJA"]
[Sat Jan 03 05:44:39.375702 2026] [:error] [pid 34260:tid 34279] [client 4.189.161.177:16305] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVg8R0WWhyvZ0O9KNVSvDwAAARE"]
[Sat Jan 03 05:44:39.602757 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:16262] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVg8R0WWhyvZ0O9KNVSvEAAAAQQ"]
[Sat Jan 03 05:44:39.833142 2026] [:error] [pid 34260:tid 34276] [client 4.189.161.177:15946] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVg8R0WWhyvZ0O9KNVSvEgAAAQ4"]
[Sat Jan 03 05:44:40.066434 2026] [:error] [pid 34260:tid 34282] [client 4.189.161.177:15954] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVg8SEWWhyvZ0O9KNVSvEwAAARQ"]
[Sat Jan 03 05:44:40.293930 2026] [:error] [pid 34260:tid 34271] [client 4.189.161.177:15607] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVg8SEWWhyvZ0O9KNVSvFAAAAQk"]
[Sat Jan 03 05:44:40.521448 2026] [:error] [pid 1929:tid 1948] [client 4.189.161.177:15582] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVg8SOcFqdpu6TNsuWrdtAAAAAo"]
[Sat Jan 03 05:44:40.753065 2026] [:error] [pid 34260:tid 34265] [client 4.189.161.177:16286] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVg8SEWWhyvZ0O9KNVSvFwAAAQM"]
[Sat Jan 03 05:44:40.979458 2026] [:error] [pid 34260:tid 34272] [client 4.189.161.177:15564] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVg8SEWWhyvZ0O9KNVSvGQAAAQo"]
[Sat Jan 03 05:44:41.205760 2026] [:error] [pid 1929:tid 1960] [client 4.189.161.177:16295] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVg8SecFqdpu6TNsuWrduAAAABY"]
[Sat Jan 03 05:44:41.432183 2026] [:error] [pid 1930:tid 1988] [client 4.189.161.177:15603] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVg8SZP-6mqhfUDa89zokwAAAFY"]
[Sat Jan 03 05:44:41.660461 2026] [:error] [pid 34260:tid 34280] [client 4.189.161.177:15604] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVg8SUWWhyvZ0O9KNVSvHAAAARI"]
[Sat Jan 03 05:44:41.886931 2026] [:error] [pid 34260:tid 34278] [client 4.189.161.177:15570] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVg8SUWWhyvZ0O9KNVSvHwAAARA"]
[Sat Jan 03 05:44:42.114632 2026] [:error] [pid 34260:tid 34265] [client 4.189.161.177:16280] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVg8SkWWhyvZ0O9KNVSvKgAAAQM"]
[Sat Jan 03 05:44:42.339216 2026] [:error] [pid 34260:tid 34282] [client 4.189.161.177:15941] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aVg8SkWWhyvZ0O9KNVSvMQAAARQ"]
[Sat Jan 03 05:44:42.571406 2026] [:error] [pid 1929:tid 1958] [client 4.189.161.177:16016] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aVg8SucFqdpu6TNsuWrduQAAABQ"]
[Sat Jan 03 05:44:42.801208 2026] [:error] [pid 2083:tid 2098] [client 4.189.161.177:15789] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aVg8SjVlR_BmlMPnhV7UKgAAAM0"]
[Sat Jan 03 05:44:43.034201 2026] [:error] [pid 34260:tid 34272] [client 4.189.161.177:16292] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aVg8S0WWhyvZ0O9KNVSvOgAAAQo"]
[Sat Jan 03 05:44:43.261422 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:16296] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/go.php"] [unique_id "aVg8S0WWhyvZ0O9KNVSvOwAAARc"]
[Sat Jan 03 05:44:43.487910 2026] [:error] [pid 1930:tid 1981] [client 4.189.161.177:15984] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aVg8S5P-6mqhfUDa89zolwAAAE8"]
[Sat Jan 03 05:44:43.719895 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15674] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aVg8SzVlR_BmlMPnhV7ULAAAAM8"]
[Sat Jan 03 05:44:43.945172 2026] [:error] [pid 1930:tid 1973] [client 4.189.161.177:16268] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aVg8S5P-6mqhfUDa89zomQAAAEc"]
[Sat Jan 03 05:44:44.170923 2026] [:error] [pid 2083:tid 2108] [client 4.189.161.177:16063] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aVg8TDVlR_BmlMPnhV7ULgAAANc"]
[Sat Jan 03 05:44:44.397285 2026] [:error] [pid 2083:tid 2088] [client 4.189.161.177:15567] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aVg8TDVlR_BmlMPnhV7UMgAAAMM"]
[Sat Jan 03 05:44:44.622842 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:15956] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aVg8TB8Tyw7ZoIdXlcYNEAAAAJM"]
[Sat Jan 03 05:44:44.850588 2026] [:error] [pid 1931:tid 2044] [client 4.189.161.177:15992] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aVg8TB8Tyw7ZoIdXlcYNEQAAAJQ"]
[Sat Jan 03 05:44:45.079595 2026] [:error] [pid 1931:tid 2046] [client 4.189.161.177:16256] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aVg8TR8Tyw7ZoIdXlcYNEwAAAJY"]
[Sat Jan 03 05:44:45.319683 2026] [:error] [pid 1930:tid 1985] [client 4.189.161.177:15944] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aVg8TZP-6mqhfUDa89zonwAAAFM"]
[Sat Jan 03 05:44:45.559297 2026] [:error] [pid 1931:tid 2030] [client 4.189.161.177:15807] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aVg8TR8Tyw7ZoIdXlcYNFgAAAIY"]
[Sat Jan 03 05:44:45.786546 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:15600] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aVg8TR8Tyw7ZoIdXlcYNGQAAAJA"]
[Sat Jan 03 05:44:46.021978 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:15618] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conflg.php"] [unique_id "aVg8TkWWhyvZ0O9KNVSvPwAAAQQ"]
[Sat Jan 03 05:44:46.250982 2026] [:error] [pid 34260:tid 34263] [client 4.189.161.177:16318] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aVg8TkWWhyvZ0O9KNVSvQAAAAQE"]
[Sat Jan 03 05:44:46.503914 2026] [:error] [pid 1931:tid 2048] [client 4.189.161.177:15986] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aVg8Th8Tyw7ZoIdXlcYNIAAAAJg"]
[Sat Jan 03 05:44:46.743819 2026] [:error] [pid 1931:tid 2045] [client 4.189.161.177:16263] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aVg8Th8Tyw7ZoIdXlcYNIgAAAJU"]
[Sat Jan 03 05:44:46.971170 2026] [:error] [pid 1931:tid 2044] [client 4.189.161.177:16258] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aVg8Th8Tyw7ZoIdXlcYNJQAAAJQ"]
[Sat Jan 03 05:44:47.200020 2026] [:error] [pid 34260:tid 34264] [client 4.189.161.177:15975] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aVg8T0WWhyvZ0O9KNVSvRQAAAQI"]
[Sat Jan 03 05:44:47.427797 2026] [:error] [pid 1929:tid 1962] [client 4.189.161.177:16287] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aVg8T-cFqdpu6TNsuWrdxgAAABg"]
[Sat Jan 03 05:44:47.654673 2026] [:error] [pid 1931:tid 2034] [client 4.189.161.177:16308] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aVg8Tx8Tyw7ZoIdXlcYNLAAAAIo"]
[Sat Jan 03 05:44:47.885174 2026] [:error] [pid 1929:tid 1947] [client 4.189.161.177:16274] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asas.php"] [unique_id "aVg8T-cFqdpu6TNsuWrdyAAAAAk"]
[Sat Jan 03 05:44:48.112128 2026] [:error] [pid 34260:tid 34283] [client 4.189.161.177:15592] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVg8UEWWhyvZ0O9KNVSvRgAAARU"]
[Sat Jan 03 05:44:48.348678 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:15867] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVg8UEWWhyvZ0O9KNVSvSAAAARg"]
[Sat Jan 03 05:44:48.579412 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:15939] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVg8UB8Tyw7ZoIdXlcYNMQAAAJM"]
[Sat Jan 03 05:44:48.805314 2026] [:error] [pid 1929:tid 1956] [client 4.189.161.177:15967] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVg8UOcFqdpu6TNsuWrdywAAABI"]
[Sat Jan 03 05:44:49.031204 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:15947] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVg8UUWWhyvZ0O9KNVSvSQAAAQs"]
[Sat Jan 03 05:44:49.277766 2026] [:error] [pid 1930:tid 1974] [client 4.189.161.177:15811] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVg8UZP-6mqhfUDa89zopAAAAEg"]
[Sat Jan 03 05:44:49.504381 2026] [:error] [pid 1930:tid 1990] [client 4.189.161.177:15554] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVg8UZP-6mqhfUDa89zopwAAAFg"]
[Sat Jan 03 05:44:49.731665 2026] [:error] [pid 1931:tid 2036] [client 4.189.161.177:15588] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVg8UR8Tyw7ZoIdXlcYNNQAAAIw"]
[Sat Jan 03 05:44:49.957677 2026] [:error] [pid 1929:tid 1938] [client 4.189.161.177:15587] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aVg8UecFqdpu6TNsuWrd0QAAAAA"]
[Sat Jan 03 05:44:50.188372 2026] [:error] [pid 1930:tid 1987] [client 4.189.161.177:15809] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aVg8UpP-6mqhfUDa89zoqQAAAFU"]
[Sat Jan 03 05:44:50.414456 2026] [:error] [pid 1931:tid 2033] [client 4.189.161.177:16314] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aVg8Uh8Tyw7ZoIdXlcYNNwAAAIk"]
[Sat Jan 03 05:44:50.640051 2026] [:error] [pid 1929:tid 1952] [client 4.189.161.177:16139] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "aVg8UucFqdpu6TNsuWrd0gAAAA4"]
[Sat Jan 03 05:44:50.875296 2026] [:error] [pid 1931:tid 1996] [client 4.189.161.177:15937] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVg8Uh8Tyw7ZoIdXlcYNOgAAAII"]
[Sat Jan 03 05:44:51.102734 2026] [:error] [pid 1929:tid 1939] [client 4.189.161.177:15998] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVg8U-cFqdpu6TNsuWrd1gAAAAE"]
[Sat Jan 03 05:44:51.331038 2026] [:error] [pid 1929:tid 1949] [client 4.189.161.177:16299] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVg8U-cFqdpu6TNsuWrd2QAAAAs"]
[Sat Jan 03 05:44:51.555763 2026] [:error] [pid 1931:tid 2027] [client 4.189.161.177:15948] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxl.php"] [unique_id "aVg8Ux8Tyw7ZoIdXlcYNPQAAAIQ"]
[Sat Jan 03 05:44:51.788429 2026] [:error] [pid 1929:tid 1950] [client 4.189.161.177:15938] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aVg8U-cFqdpu6TNsuWrd3AAAAAw"]
[Sat Jan 03 05:44:52.015426 2026] [:error] [pid 1929:tid 1960] [client 4.189.161.177:15578] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aVg8VOcFqdpu6TNsuWrd3gAAABY"]
[Sat Jan 03 05:44:52.261398 2026] [:error] [pid 2083:tid 2094] [client 4.189.161.177:15940] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aVg8VDVlR_BmlMPnhV7UOgAAAMk"]
[Sat Jan 03 05:44:52.494521 2026] [:error] [pid 1931:tid 2036] [client 4.189.161.177:16266] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r.php"] [unique_id "aVg8VB8Tyw7ZoIdXlcYNPwAAAIw"]
[Sat Jan 03 05:44:52.724209 2026] [:error] [pid 2083:tid 2089] [client 4.189.161.177:15591] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVg8VDVlR_BmlMPnhV7UPAAAAMQ"]
[Sat Jan 03 05:44:52.955457 2026] [:error] [pid 1929:tid 1943] [client 4.189.161.177:15968] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVg8VOcFqdpu6TNsuWrd4QAAAAU"]
[Sat Jan 03 05:44:53.193718 2026] [:error] [pid 34260:tid 34276] [client 4.189.161.177:15960] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVg8VUWWhyvZ0O9KNVSvUAAAAQ4"]
[Sat Jan 03 05:44:53.432773 2026] [:error] [pid 1930:tid 1966] [client 4.189.161.177:16297] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVg8VZP-6mqhfUDa89zosAAAAEA"]
[Sat Jan 03 05:44:53.665677 2026] [:error] [pid 1930:tid 1980] [client 4.189.161.177:15815] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aVg8VZP-6mqhfUDa89zosQAAAE4"]
[Sat Jan 03 05:44:53.901125 2026] [:error] [pid 1929:tid 1942] [client 4.189.161.177:16278] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aVg8VecFqdpu6TNsuWrd4gAAAAQ"]
[Sat Jan 03 05:44:54.127546 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15678] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aVg8VjVlR_BmlMPnhV7UPgAAAM8"]
[Sat Jan 03 05:44:54.354027 2026] [:error] [pid 1931:tid 2031] [client 4.189.161.177:16282] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js.php"] [unique_id "aVg8Vh8Tyw7ZoIdXlcYNQAAAAIc"]
[Sat Jan 03 05:44:54.580656 2026] [:error] [pid 2083:tid 2105] [client 4.189.161.177:15615] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aVg8VjVlR_BmlMPnhV7UPwAAANQ"]
[Sat Jan 03 05:44:54.807464 2026] [:error] [pid 1931:tid 2037] [client 4.189.161.177:16279] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aVg8Vh8Tyw7ZoIdXlcYNQQAAAI0"]
[Sat Jan 03 05:44:55.043614 2026] [:error] [pid 1929:tid 1952] [client 4.189.161.177:16303] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aVg8V-cFqdpu6TNsuWrd5QAAAA4"]
[Sat Jan 03 05:44:55.275712 2026] [:error] [pid 1931:tid 2035] [client 4.189.161.177:16270] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file1.php"] [unique_id "aVg8Vx8Tyw7ZoIdXlcYNQwAAAIs"]
[Sat Jan 03 05:44:55.508702 2026] [:error] [pid 1930:tid 1983] [client 4.189.161.177:15608] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aVg8V5P-6mqhfUDa89zoswAAAFE"]
[Sat Jan 03 05:44:55.739245 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:15961] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aVg8V0WWhyvZ0O9KNVSvUgAAAQU"]
[Sat Jan 03 05:44:55.965919 2026] [:error] [pid 1929:tid 1949] [client 4.189.161.177:15972] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aVg8V-cFqdpu6TNsuWrd6QAAAAs"]
[Sat Jan 03 05:44:56.204704 2026] [:error] [pid 1929:tid 1961] [client 4.189.161.177:15973] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "aVg8WOcFqdpu6TNsuWrd7AAAABc"]
[Sat Jan 03 05:44:56.462189 2026] [:error] [pid 1929:tid 1962] [client 4.189.161.177:15959] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aVg8WOcFqdpu6TNsuWrd7QAAABg"]
[Sat Jan 03 05:44:56.706944 2026] [:error] [pid 1929:tid 1960] [client 4.189.161.177:15949] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aVg8WOcFqdpu6TNsuWrd7gAAABY"]
[Sat Jan 03 05:44:56.955102 2026] [:error] [pid 1931:tid 2042] [client 4.189.161.177:15957] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aVg8WB8Tyw7ZoIdXlcYNRAAAAJI"]
[Sat Jan 03 05:44:57.185016 2026] [:error] [pid 1929:tid 1955] [client 4.189.161.177:15951] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aVg8WecFqdpu6TNsuWrd8gAAABE"]
[Sat Jan 03 05:44:57.411617 2026] [:error] [pid 34260:tid 34277] [client 4.189.161.177:16288] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aVg8WUWWhyvZ0O9KNVSvUwAAAQ8"]
[Sat Jan 03 05:44:57.642037 2026] [:error] [pid 1931:tid 1993] [client 4.189.161.177:15773] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aVg8WR8Tyw7ZoIdXlcYNRQAAAIA"]
[Sat Jan 03 05:44:57.868998 2026] [:error] [pid 34260:tid 34265] [client 4.189.161.177:15994] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aVg8WUWWhyvZ0O9KNVSvVAAAAQM"]
[Sat Jan 03 05:44:58.099307 2026] [:error] [pid 1930:tid 1988] [client 4.189.161.177:16002] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/321.php"] [unique_id "aVg8WpP-6mqhfUDa89zotAAAAFY"]
[Sat Jan 03 05:44:58.331699 2026] [:error] [pid 1930:tid 1974] [client 4.189.161.177:15847] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVg8WpP-6mqhfUDa89zotQAAAEg"]
[Sat Jan 03 05:44:58.559490 2026] [:error] [pid 1930:tid 1990] [client 4.189.161.177:15666] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVg8WpP-6mqhfUDa89zotgAAAFg"]
[Sat Jan 03 05:44:58.788384 2026] [:error] [pid 2083:tid 2099] [client 4.189.161.177:16166] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVg8WjVlR_BmlMPnhV7URgAAAM4"]
[Sat Jan 03 05:44:59.014041 2026] [:error] [pid 34260:tid 34269] [client 4.189.161.177:15955] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVg8W0WWhyvZ0O9KNVSvWAAAAQc"]
[Sat Jan 03 05:44:59.246218 2026] [:error] [pid 1931:tid 2030] [client 4.189.161.177:15979] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVg8Wx8Tyw7ZoIdXlcYNSAAAAIY"]
[Sat Jan 03 05:44:59.477748 2026] [:error] [pid 2083:tid 2085] [client 4.189.161.177:15963] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVg8WzVlR_BmlMPnhV7URwAAAMA"]
[Sat Jan 03 05:44:59.704902 2026] [:error] [pid 2083:tid 2091] [client 4.189.161.177:15990] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVg8WzVlR_BmlMPnhV7USQAAAMY"]
[Sat Jan 03 05:44:59.931704 2026] [:error] [pid 34260:tid 34283] [client 4.189.161.177:16290] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVg8W0WWhyvZ0O9KNVSvWQAAARU"]
[Sat Jan 03 05:45:00.160462 2026] [:error] [pid 2083:tid 2095] [client 4.189.161.177:15964] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aVg8XDVlR_BmlMPnhV7USgAAAMo"]
[Sat Jan 03 05:45:00.397651 2026] [:error] [pid 34260:tid 34280] [client 4.189.161.177:15950] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aVg8XEWWhyvZ0O9KNVSvWgAAARI"]
[Sat Jan 03 05:45:00.633429 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:15980] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aVg8XEWWhyvZ0O9KNVSvWwAAARg"]
[Sat Jan 03 05:45:00.863204 2026] [:error] [pid 1931:tid 2027] [client 4.189.161.177:15970] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/al.php"] [unique_id "aVg8XB8Tyw7ZoIdXlcYNSgAAAIQ"]
[Sat Jan 03 05:45:01.090142 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:15936] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVg8XUWWhyvZ0O9KNVSvXAAAAQs"]
[Sat Jan 03 05:45:01.324233 2026] [:error] [pid 2083:tid 2087] [client 4.189.161.177:15974] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVg8XTVlR_BmlMPnhV7UTQAAAMI"]
[Sat Jan 03 05:45:01.551942 2026] [:error] [pid 34260:tid 34275] [client 4.189.161.177:16314] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVg8XUWWhyvZ0O9KNVSvXgAAAQ0"]
[Sat Jan 03 05:45:01.791168 2026] [:error] [pid 34260:tid 34281] [client 4.189.161.177:15654] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVg8XUWWhyvZ0O9KNVSvXwAAARM"]
[Sat Jan 03 05:45:02.067339 2026] [:error] [pid 34260:tid 34279] [client 4.189.161.177:15985] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aVg8XkWWhyvZ0O9KNVSvYQAAARE"]
[Sat Jan 03 05:45:02.301865 2026] [:error] [pid 34260:tid 34284] [client 4.189.161.177:16059] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aVg8XkWWhyvZ0O9KNVSvYgAAARY"]
[Sat Jan 03 05:45:02.546629 2026] [:error] [pid 34260:tid 34263] [client 4.189.161.177:15596] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aVg8XkWWhyvZ0O9KNVSvYwAAAQE"]
[Sat Jan 03 05:45:02.805804 2026] [:error] [pid 1931:tid 1999] [client 4.189.161.177:15995] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aVg8Xh8Tyw7ZoIdXlcYNTAAAAIM"]
[Sat Jan 03 05:45:03.032674 2026] [:error] [pid 34260:tid 34274] [client 4.189.161.177:15993] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVg8X0WWhyvZ0O9KNVSvaAAAAQw"]
[Sat Jan 03 05:45:03.259098 2026] [:error] [pid 1931:tid 2045] [client 4.189.161.177:16043] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVg8Xx8Tyw7ZoIdXlcYNTQAAAJU"]
[Sat Jan 03 05:45:03.488069 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:16317] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVg8X0WWhyvZ0O9KNVSvaQAAAQs"]
[Sat Jan 03 05:45:03.715035 2026] [:error] [pid 1929:tid 1957] [client 4.189.161.177:15599] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVg8X-cFqdpu6TNsuWrd_AAAABM"]
[Sat Jan 03 05:45:03.943737 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:16310] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aVg8Xx8Tyw7ZoIdXlcYNTgAAAJM"]
[Sat Jan 03 05:45:04.207097 2026] [:error] [pid 1930:tid 1975] [client 4.189.161.177:15962] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aVg8YJP-6mqhfUDa89zouAAAAEk"]
[Sat Jan 03 05:45:04.432673 2026] [:error] [pid 34260:tid 34272] [client 4.189.161.177:15987] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aVg8YEWWhyvZ0O9KNVSvagAAAQo"]
[Sat Jan 03 05:45:04.658648 2026] [:error] [pid 34260:tid 34278] [client 4.189.161.177:16284] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aVg8YEWWhyvZ0O9KNVSvawAAARA"]
[Sat Jan 03 05:45:04.885735 2026] [:error] [pid 34260:tid 34270] [client 4.189.161.177:15825] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVg8YEWWhyvZ0O9KNVSvbQAAAQg"]
[Sat Jan 03 05:45:05.125329 2026] [:error] [pid 1930:tid 1987] [client 4.189.161.177:15846] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVg8YZP-6mqhfUDa89zouQAAAFU"]
[Sat Jan 03 05:45:05.351745 2026] [:error] [pid 34260:tid 34284] [client 4.189.161.177:15991] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVg8YUWWhyvZ0O9KNVSvbgAAARY"]
[Sat Jan 03 05:45:05.578021 2026] [:error] [pid 2083:tid 2090] [client 4.189.161.177:15978] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aVg8YTVlR_BmlMPnhV7UUwAAAMU"]
[Sat Jan 03 05:45:05.806793 2026] [:error] [pid 2083:tid 2096] [client 4.189.161.177:15813] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVg8YTVlR_BmlMPnhV7UVAAAAMs"]
[Sat Jan 03 05:45:06.034163 2026] [:error] [pid 2083:tid 2099] [client 4.189.161.177:15966] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVg8YjVlR_BmlMPnhV7UVgAAAM4"]
[Sat Jan 03 05:45:06.260588 2026] [:error] [pid 1931:tid 2031] [client 4.189.161.177:15853] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVg8Yh8Tyw7ZoIdXlcYNUQAAAIc"]
[Sat Jan 03 05:45:06.487812 2026] [:error] [pid 1930:tid 1969] [client 4.189.161.177:15982] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVg8YpP-6mqhfUDa89zougAAAEM"]
[Sat Jan 03 05:45:06.713348 2026] [:error] [pid 1929:tid 1938] [client 4.189.161.177:15668] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aVg8YucFqdpu6TNsuWreAgAAAAA"]
[Sat Jan 03 05:45:06.939264 2026] [:error] [pid 1929:tid 1958] [client 4.189.161.177:15819] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aVg8YucFqdpu6TNsuWreAwAAABQ"]
[Sat Jan 03 05:45:07.166059 2026] [:error] [pid 1930:tid 1973] [client 4.189.161.177:15860] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aVg8Y5P-6mqhfUDa89zouwAAAEc"]
[Sat Jan 03 05:45:07.392988 2026] [:error] [pid 1930:tid 1971] [client 4.189.161.177:15870] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "aVg8Y5P-6mqhfUDa89zovwAAAEU"]
[Sat Jan 03 05:45:07.627126 2026] [:error] [pid 1931:tid 1993] [client 4.189.161.177:15848] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aVg8Yx8Tyw7ZoIdXlcYNVAAAAIA"]
[Sat Jan 03 05:45:07.860025 2026] [:error] [pid 1930:tid 1966] [client 4.189.161.177:16306] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aVg8Y5P-6mqhfUDa89zowQAAAEA"]
[Sat Jan 03 05:45:08.086662 2026] [:error] [pid 2083:tid 2106] [client 4.189.161.177:15611] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aVg8ZDVlR_BmlMPnhV7UWAAAANU"]
[Sat Jan 03 05:45:08.312855 2026] [:error] [pid 1929:tid 1952] [client 4.189.161.177:16277] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xo.php"] [unique_id "aVg8ZOcFqdpu6TNsuWreBQAAAA4"]
[Sat Jan 03 05:45:08.538742 2026] [:error] [pid 1930:tid 1980] [client 4.189.161.177:15856] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVg8ZJP-6mqhfUDa89zowgAAAE4"]
[Sat Jan 03 05:45:08.765354 2026] [:error] [pid 2083:tid 2094] [client 4.189.161.177:15854] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVg8ZDVlR_BmlMPnhV7UWgAAAMk"]
[Sat Jan 03 05:45:08.992821 2026] [:error] [pid 2083:tid 2089] [client 4.189.161.177:15863] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVg8ZDVlR_BmlMPnhV7UXAAAAMQ"]
[Sat Jan 03 05:45:09.219438 2026] [:error] [pid 2083:tid 2087] [client 4.189.161.177:15976] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVg8ZTVlR_BmlMPnhV7UXQAAAMI"]
[Sat Jan 03 05:45:09.446247 2026] [:error] [pid 34260:tid 34262] [client 4.189.161.177:15580] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aVg8ZUWWhyvZ0O9KNVSvcQAAAQA"]
[Sat Jan 03 05:45:09.676378 2026] [:error] [pid 2083:tid 2102] [client 4.189.161.177:15942] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aVg8ZTVlR_BmlMPnhV7UYQAAANE"]
[Sat Jan 03 05:45:09.905744 2026] [:error] [pid 34260:tid 34276] [client 4.189.161.177:15971] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aVg8ZUWWhyvZ0O9KNVSvcgAAAQ4"]
[Sat Jan 03 05:45:10.146933 2026] [:error] [pid 2083:tid 2103] [client 4.189.161.177:15952] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk2.php"] [unique_id "aVg8ZjVlR_BmlMPnhV7UYwAAANI"]
[Sat Jan 03 05:45:10.384854 2026] [:error] [pid 34260:tid 34274] [client 4.189.161.177:15823] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aVg8ZkWWhyvZ0O9KNVSvdQAAAQw"]
[Sat Jan 03 05:45:10.611996 2026] [:error] [pid 1931:tid 2032] [client 4.189.161.177:16273] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aVg8Zh8Tyw7ZoIdXlcYNVwAAAIg"]
[Sat Jan 03 05:45:10.846567 2026] [:error] [pid 1930:tid 1986] [client 4.189.161.177:15965] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aVg8ZpP-6mqhfUDa89zoxAAAAFQ"]
[Sat Jan 03 05:45:11.073050 2026] [:error] [pid 1931:tid 1999] [client 4.189.161.177:16380] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso.php"] [unique_id "aVg8Zx8Tyw7ZoIdXlcYNWAAAAIM"]
[Sat Jan 03 05:45:11.300134 2026] [:error] [pid 1931:tid 2045] [client 4.189.161.177:15831] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aVg8Zx8Tyw7ZoIdXlcYNWQAAAJU"]
[Sat Jan 03 05:45:11.543064 2026] [:error] [pid 1931:tid 2043] [client 4.189.161.177:15840] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aVg8Zx8Tyw7ZoIdXlcYNWwAAAJM"]
[Sat Jan 03 05:45:11.770491 2026] [:error] [pid 1930:tid 1990] [client 4.189.161.177:16309] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aVg8Z5P-6mqhfUDa89zoxwAAAFg"]
[Sat Jan 03 05:45:11.996286 2026] [:error] [pid 2083:tid 2096] [client 4.189.161.177:16340] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aVg8ZzVlR_BmlMPnhV7UZAAAAMs"]
[Sat Jan 03 05:45:12.222752 2026] [:error] [pid 1929:tid 1946] [client 4.189.161.177:15810] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aVg8aOcFqdpu6TNsuWreCgAAAAg"]
[Sat Jan 03 05:45:12.450840 2026] [:error] [pid 1930:tid 1976] [client 4.189.161.177:16307] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aVg8aJP-6mqhfUDa89zoyAAAAEo"]
[Sat Jan 03 05:45:12.684507 2026] [:error] [pid 1930:tid 1968] [client 4.189.161.177:15820] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aVg8aJP-6mqhfUDa89zoyQAAAEI"]
[Sat Jan 03 05:45:12.910972 2026] [:error] [pid 2083:tid 2106] [client 4.189.161.177:15841] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aVg8aDVlR_BmlMPnhV7UaQAAANU"]
[Sat Jan 03 05:45:13.142289 2026] [:error] [pid 1931:tid 1994] [client 4.189.161.177:15824] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aVg8aR8Tyw7ZoIdXlcYNXgAAAIE"]
[Sat Jan 03 05:45:13.375879 2026] [:error] [pid 2083:tid 2091] [client 4.189.161.177:16329] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aVg8aTVlR_BmlMPnhV7UagAAAMY"]
[Sat Jan 03 05:45:13.602435 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:16328] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aVg8aUWWhyvZ0O9KNVSvdwAAARc"]
[Sat Jan 03 05:45:13.831446 2026] [:error] [pid 1931:tid 2033] [client 4.189.161.177:15590] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aVg8aR8Tyw7ZoIdXlcYNYAAAAIk"]
[Sat Jan 03 05:45:14.059807 2026] [:error] [pid 2083:tid 2092] [client 4.189.161.177:15613] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aVg8ajVlR_BmlMPnhV7UawAAAMc"]
[Sat Jan 03 05:45:14.288334 2026] [:error] [pid 1931:tid 2035] [client 4.189.161.177:15829] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aVg8ah8Tyw7ZoIdXlcYNYQAAAIs"]
[Sat Jan 03 05:45:14.514371 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:15817] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aVg8akWWhyvZ0O9KNVSvewAAAQs"]
[Sat Jan 03 05:45:14.740784 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:15989] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/406.php"] [unique_id "aVg8ah8Tyw7ZoIdXlcYNYwAAAJA"]
[Sat Jan 03 05:45:14.967152 2026] [:error] [pid 34260:tid 34272] [client 4.189.161.177:16319] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aVg8akWWhyvZ0O9KNVSvfAAAAQo"]
[Sat Jan 03 05:45:15.213700 2026] [:error] [pid 1929:tid 1960] [client 4.189.161.177:16327] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aVg8a-cFqdpu6TNsuWreDQAAABY"]
[Sat Jan 03 05:45:15.464869 2026] [:error] [pid 2083:tid 2095] [client 4.189.161.177:16304] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aVg8azVlR_BmlMPnhV7UbQAAAMo"]
[Sat Jan 03 05:45:15.692158 2026] [:error] [pid 1930:tid 1989] [client 4.189.161.177:16275] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mariju.php"] [unique_id "aVg8a5P-6mqhfUDa89zozQAAAFc"]
[Sat Jan 03 05:45:15.917980 2026] [:error] [pid 1930:tid 1978] [client 4.189.161.177:15814] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8a5P-6mqhfUDa89zozgAAAEw"]
[Sat Jan 03 05:45:16.145373 2026] [:error] [pid 1929:tid 1940] [client 4.189.161.177:15864] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8bOcFqdpu6TNsuWreEAAAAAI"]
[Sat Jan 03 05:45:16.374437 2026] [:error] [pid 34260:tid 34284] [client 4.189.161.177:15634] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8bEWWhyvZ0O9KNVSvfQAAARY"]
[Sat Jan 03 05:45:16.607724 2026] [:error] [pid 1931:tid 2039] [client 4.189.161.177:15827] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aVg8bB8Tyw7ZoIdXlcYNZQAAAI8"]
[Sat Jan 03 05:45:16.838905 2026] [:error] [pid 1930:tid 1986] [client 4.189.161.177:15826] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aVg8bJP-6mqhfUDa89zo0AAAAFQ"]
[Sat Jan 03 05:45:17.074480 2026] [:error] [pid 1930:tid 1972] [client 4.189.161.177:15565] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aVg8bZP-6mqhfUDa89zo0QAAAEY"]
[Sat Jan 03 05:45:17.301157 2026] [:error] [pid 2083:tid 2088] [client 4.189.161.177:15688] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aVg8bTVlR_BmlMPnhV7UcQAAAMM"]
[Sat Jan 03 05:45:17.527038 2026] [:error] [pid 2083:tid 2086] [client 4.189.161.177:15866] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aVg8bTVlR_BmlMPnhV7UcgAAAME"]
[Sat Jan 03 05:45:17.757223 2026] [:error] [pid 2083:tid 2090] [client 4.189.161.177:15861] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aVg8bTVlR_BmlMPnhV7UdwAAAMU"]
[Sat Jan 03 05:45:17.992774 2026] [:error] [pid 1931:tid 2032] [client 4.189.161.177:15837] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aVg8bR8Tyw7ZoIdXlcYNZgAAAIg"]
[Sat Jan 03 05:45:18.223008 2026] [:error] [pid 2083:tid 2106] [client 4.189.161.177:15695] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aVg8bjVlR_BmlMPnhV7UeAAAANU"]
[Sat Jan 03 05:45:18.449624 2026] [:error] [pid 34260:tid 34266] [client 4.189.161.177:16313] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zfile.php"] [unique_id "aVg8bkWWhyvZ0O9KNVSvfgAAAQQ"]
[Sat Jan 03 05:45:18.676232 2026] [:error] [pid 1929:tid 1948] [client 4.189.161.177:15838] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVg8bucFqdpu6TNsuWreFAAAAAo"]
[Sat Jan 03 05:45:18.902448 2026] [:error] [pid 1930:tid 1967] [client 4.189.161.177:16370] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVg8bpP-6mqhfUDa89zo0gAAAEE"]
[Sat Jan 03 05:45:19.129284 2026] [:error] [pid 34260:tid 34262] [client 4.189.161.177:15868] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVg8b0WWhyvZ0O9KNVSvfwAAAQA"]
[Sat Jan 03 05:45:19.357755 2026] [:error] [pid 1931:tid 2048] [client 4.189.161.177:16291] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVg8bx8Tyw7ZoIdXlcYNaAAAAJg"]
[Sat Jan 03 05:45:19.584173 2026] [:error] [pid 34260:tid 34276] [client 4.189.161.177:15818] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVg8b0WWhyvZ0O9KNVSvggAAAQ4"]
[Sat Jan 03 05:45:19.825068 2026] [:error] [pid 1929:tid 1954] [client 4.189.161.177:16368] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVg8b-cFqdpu6TNsuWreFgAAABA"]
[Sat Jan 03 05:45:20.051525 2026] [:error] [pid 1929:tid 1958] [client 4.189.161.177:16272] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVg8cOcFqdpu6TNsuWreFwAAABQ"]
[Sat Jan 03 05:45:20.278043 2026] [:error] [pid 1929:tid 1955] [client 4.189.161.177:16365] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVg8cOcFqdpu6TNsuWreGAAAABE"]
[Sat Jan 03 05:45:20.504618 2026] [:error] [pid 1929:tid 1945] [client 4.189.161.177:15862] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aVg8cOcFqdpu6TNsuWreGQAAAAc"]
[Sat Jan 03 05:45:20.731773 2026] [:error] [pid 1929:tid 1941] [client 4.189.161.177:15615] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aVg8cOcFqdpu6TNsuWreGgAAAAM"]
[Sat Jan 03 05:45:20.961903 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15945] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aVg8cDVlR_BmlMPnhV7UfAAAAM8"]
[Sat Jan 03 05:45:21.188977 2026] [:error] [pid 34260:tid 34267] [client 4.189.161.177:15849] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "aVg8cUWWhyvZ0O9KNVSvhAAAAQU"]
[Sat Jan 03 05:45:21.417712 2026] [:error] [pid 34260:tid 34277] [client 4.189.161.177:15852] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aVg8cUWWhyvZ0O9KNVSvhQAAAQ8"]
[Sat Jan 03 05:45:21.644322 2026] [:error] [pid 1929:tid 1949] [client 4.189.161.177:16339] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aVg8cecFqdpu6TNsuWreHQAAAAs"]
[Sat Jan 03 05:45:21.871341 2026] [:error] [pid 1931:tid 2041] [client 4.189.161.177:16323] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aVg8cR8Tyw7ZoIdXlcYNawAAAJE"]
[Sat Jan 03 05:45:22.099262 2026] [:error] [pid 34260:tid 34286] [client 4.189.161.177:15816] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "aVg8ckWWhyvZ0O9KNVSvhwAAARg"]
[Sat Jan 03 05:45:22.327023 2026] [:error] [pid 2083:tid 2103] [client 4.189.161.177:16355] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVg8cjVlR_BmlMPnhV7UgQAAANI"]
[Sat Jan 03 05:45:22.554413 2026] [:error] [pid 1931:tid 2036] [client 4.189.161.177:15839] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVg8ch8Tyw7ZoIdXlcYNbAAAAIw"]
[Sat Jan 03 05:45:22.782737 2026] [:error] [pid 1929:tid 1961] [client 4.189.161.177:15821] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVg8cucFqdpu6TNsuWreHwAAABc"]
[Sat Jan 03 05:45:23.010664 2026] [:error] [pid 1931:tid 2046] [client 4.189.161.177:16357] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVg8cx8Tyw7ZoIdXlcYNbgAAAJY"]
[Sat Jan 03 05:45:23.240756 2026] [:error] [pid 2083:tid 2093] [client 4.189.161.177:15641] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aVg8czVlR_BmlMPnhV7UhQAAAMg"]
[Sat Jan 03 05:45:23.466374 2026] [:error] [pid 1930:tid 1969] [client 4.189.161.177:15828] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aVg8c5P-6mqhfUDa89zo2AAAAEM"]
[Sat Jan 03 05:45:23.701712 2026] [:error] [pid 1930:tid 1973] [client 4.189.161.177:16354] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aVg8c5P-6mqhfUDa89zo2QAAAEc"]
[Sat Jan 03 05:45:23.934152 2026] [:error] [pid 2083:tid 2099] [client 4.189.161.177:15850] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aVg8czVlR_BmlMPnhV7UhgAAAM4"]
[Sat Jan 03 05:45:24.172161 2026] [:error] [pid 1931:tid 2040] [client 4.189.161.177:16383] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aVg8dB8Tyw7ZoIdXlcYNcQAAAJA"]
[Sat Jan 03 05:45:24.419358 2026] [:error] [pid 1931:tid 1996] [client 4.189.161.177:15836] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aVg8dB8Tyw7ZoIdXlcYNcgAAAII"]
[Sat Jan 03 05:45:24.684626 2026] [:error] [pid 1931:tid 2034] [client 4.189.161.177:15812] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aVg8dB8Tyw7ZoIdXlcYNdAAAAIo"]
[Sat Jan 03 05:45:24.911596 2026] [:error] [pid 1930:tid 1971] [client 4.189.161.177:16342] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aVg8dJP-6mqhfUDa89zo2wAAAEU"]
[Sat Jan 03 05:45:25.139235 2026] [:error] [pid 1931:tid 2047] [client 4.189.161.177:15983] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aVg8dR8Tyw7ZoIdXlcYNdQAAAJc"]
[Sat Jan 03 05:45:25.375951 2026] [:error] [pid 1930:tid 1977] [client 4.189.161.177:15988] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aVg8dZP-6mqhfUDa89zo3AAAAEs"]
[Sat Jan 03 05:45:25.618010 2026] [:error] [pid 2083:tid 2092] [client 4.189.161.177:15843] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aVg8dTVlR_BmlMPnhV7UiQAAAMc"]
[Sat Jan 03 05:45:25.854687 2026] [:error] [pid 34260:tid 34279] [client 4.189.161.177:16338] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc.php"] [unique_id "aVg8dUWWhyvZ0O9KNVSviwAAARE"]
[Sat Jan 03 05:45:26.081515 2026] [:error] [pid 34260:tid 34284] [client 4.189.161.177:16300] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVg8dkWWhyvZ0O9KNVSvjAAAARY"]
[Sat Jan 03 05:45:26.308099 2026] [:error] [pid 34260:tid 34269] [client 4.189.161.177:16356] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVg8dkWWhyvZ0O9KNVSvjgAAAQc"]
[Sat Jan 03 05:45:26.535939 2026] [:error] [pid 1931:tid 2027] [client 4.189.161.177:16343] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVg8dh8Tyw7ZoIdXlcYNdwAAAIQ"]
[Sat Jan 03 05:45:26.762959 2026] [:error] [pid 1931:tid 2032] [client 4.189.161.177:16330] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVg8dh8Tyw7ZoIdXlcYNeAAAAIg"]
[Sat Jan 03 05:45:26.988794 2026] [:error] [pid 1931:tid 2048] [client 4.189.161.177:15999] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aVg8dh8Tyw7ZoIdXlcYNegAAAJg"]
[Sat Jan 03 05:45:27.217853 2026] [:error] [pid 2083:tid 2094] [client 4.189.161.177:15969] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aVg8dzVlR_BmlMPnhV7UigAAAMk"]
[Sat Jan 03 05:45:27.444751 2026] [:error] [pid 2083:tid 2100] [client 4.189.161.177:15501] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aVg8dzVlR_BmlMPnhV7UiwAAAM8"]
[Sat Jan 03 05:45:27.673974 2026] [:error] [pid 1931:tid 2041] [client 4.189.161.177:15696] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mlex.php"] [unique_id "aVg8dx8Tyw7ZoIdXlcYNewAAAJE"]
[Sat Jan 03 05:45:27.902071 2026] [:error] [pid 1929:tid 1940] [client 4.189.161.177:16283] [client 4.189.161.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVg8d-cFqdpu6TNsuWreJQAAAAI"]
[Sat Jan 03 05:45:28.133200 2026] [:error] [pid 34260:tid 34264] [client 4.189.161.177:16332] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Sat Jan 03 05:45:28.250015 2026] [:error] [pid 34260:tid 34282] [client 4.189.161.177:16332] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Jan 03 05:45:28.368288 2026] [:error] [pid 34260:tid 34277] [client 4.189.161.177:16332] File does not exist: /usr/local/apache/htdocs/suspended-page/mpvloi.php
[Sat Jan 03 05:45:28.487382 2026] [:error] [pid 34260:tid 34285] [client 4.189.161.177:16332] File does not exist: /usr/local/apache/htdocs/suspended-page/v1.php
[Sat Jan 03 05:45:28.606100 2026] [:error] [pid 34260:tid 34280] [client 4.189.161.177:16332] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sat Jan 03 05:45:28.724429 2026] [:error] [pid 34260:tid 34265] [client 4.189.161.177:16332] File does not exist: /usr/local/apache/htdocs/suspended-page/dex.php
[Sat Jan 03 05:45:28.843318 2026] [:error] [pid 34260:tid 34273] [client 4.189.161.177:16332] File does not exist: /usr/local/apache/htdocs/suspended-page/angelV2.php
[Sat Jan 03 08:20:03.627427 2026] [:error] [pid 31630:tid 31640] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/lisa.php
[Sat Jan 03 08:20:03.843684 2026] [:error] [pid 31630:tid 31650] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Sat Jan 03 08:20:03.862608 2026] [:error] [pid 31630:tid 31639] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sat Jan 03 08:20:03.881503 2026] [:error] [pid 31630:tid 31654] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/bless14.php
[Sat Jan 03 08:20:04.050866 2026] [:error] [pid 31630:tid 31644] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/ws35.php
[Sat Jan 03 08:20:04.069208 2026] [:error] [pid 31630:tid 31646] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/87.php
[Sat Jan 03 08:20:04.099319 2026] [:error] [pid 31630:tid 31634] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Sat Jan 03 08:20:04.132655 2026] [:error] [pid 31630:tid 31647] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Jan 03 08:20:04.160683 2026] [:error] [pid 31630:tid 31641] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/acwfihfh.php
[Sat Jan 03 08:20:04.181878 2026] [:error] [pid 31630:tid 31638] [client 4.196.97.109:36510] File does not exist: /usr/local/apache/htdocs/suspended-page/f8.php
[Sat Jan 03 08:20:04.209766 2026] [:error] [pid 31630:tid 31633] [client 4.196.97.109:36510] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVhgtPUV_PU2SWgLPuidmwAAAYE"]
[Sat Jan 03 08:20:08.320092 2026] [:error] [pid 2083:tid 2101] [client 4.196.97.109:30277] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVhguDVlR_BmlMPnhV4pqgAAANA"]
[Sat Jan 03 08:20:16.053767 2026] [:error] [pid 2083:tid 2094] [client 4.196.97.109:25355] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVhgwDVlR_BmlMPnhV4pvQAAAMk"]
[Sat Jan 03 08:20:21.613493 2026] [:error] [pid 31630:tid 31653] [client 4.196.97.109:38633] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVhgxfUV_PU2SWgLPuiduAAAAZU"]
[Sat Jan 03 08:20:22.277716 2026] [:error] [pid 19639:tid 19652] [client 4.196.97.109:30298] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVhgxiQ7fWZUytnlHExRZwAAAUs"]
[Sat Jan 03 08:20:33.462484 2026] [:error] [pid 1929:tid 1955] [client 4.196.97.109:40803] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVhg0ecFqdpu6TNsuWoimQAAABE"]
[Sat Jan 03 08:20:33.708493 2026] [:error] [pid 34260:tid 34268] [client 4.196.97.109:40835] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVhg0UWWhyvZ0O9KNVT_fAAAAQY"]
[Sat Jan 03 08:20:52.151604 2026] [:error] [pid 19639:tid 19659] [client 4.196.97.109:3697] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVhg5CQ7fWZUytnlHExRsAAAAVI"]
[Sat Jan 03 08:20:53.522812 2026] [:error] [pid 1929:tid 1943] [client 4.196.97.109:44424] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVhg5ecFqdpu6TNsuWoirAAAAAU"]
[Sat Jan 03 08:20:56.257902 2026] [:error] [pid 31630:tid 31638] [client 4.196.97.109:44418] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVhg6PUV_PU2SWgLPuieBwAAAYY"]
[Sat Jan 03 08:20:57.909041 2026] [:error] [pid 2083:tid 2105] [client 4.196.97.109:32702] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVhg6TVlR_BmlMPnhV4qiAAAANQ"]
[Sat Jan 03 08:21:01.245313 2026] [:error] [pid 2083:tid 2086] [client 4.196.97.109:3698] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/out.php"] [unique_id "aVhg7TVlR_BmlMPnhV4qjwAAAME"]
[Sat Jan 03 08:21:04.611933 2026] [:error] [pid 1930:tid 1966] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/out.php
[Sat Jan 03 08:21:04.775791 2026] [:error] [pid 1930:tid 1967] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/flower2.php
[Sat Jan 03 08:21:04.798392 2026] [:error] [pid 1930:tid 1979] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/family.php
[Sat Jan 03 08:21:04.836945 2026] [:error] [pid 1930:tid 1969] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Sat Jan 03 08:21:04.857780 2026] [:error] [pid 1930:tid 1978] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Sat Jan 03 08:21:04.877125 2026] [:error] [pid 1930:tid 1971] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Sat Jan 03 08:21:04.895510 2026] [:error] [pid 1930:tid 1986] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/lanz.php
[Sat Jan 03 08:21:04.914212 2026] [:error] [pid 1930:tid 1990] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/xeeex.php
[Sat Jan 03 08:21:04.999649 2026] [:error] [pid 1930:tid 1968] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/tons.php
[Sat Jan 03 08:21:05.170821 2026] [:error] [pid 1930:tid 1984] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/wpup.php
[Sat Jan 03 08:21:05.204435 2026] [:error] [pid 1930:tid 1981] [client 4.196.97.109:35319] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Sat Jan 03 08:21:05.343689 2026] [:error] [pid 1930:tid 1973] [client 4.196.97.109:35319] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVhg8ZP-6mqhfUDa89wuewAAAEc"]
[Sat Jan 03 08:21:14.199652 2026] [:error] [pid 2083:tid 2105] [client 4.196.97.109:26615] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVhg-jVlR_BmlMPnhV4qogAAANQ"]
[Sat Jan 03 08:21:17.603521 2026] [:error] [pid 31630:tid 31656] [client 4.196.97.109:3579] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVhg_fUV_PU2SWgLPuieJQAAAZg"]
[Sat Jan 03 08:21:22.791737 2026] [:error] [pid 31630:tid 31652] [client 4.196.97.109:3561] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVhhAvUV_PU2SWgLPuieKQAAAZQ"]
[Sat Jan 03 08:21:24.946516 2026] [:error] [pid 1929:tid 1938] [client 4.196.97.109:40049] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVhhBOcFqdpu6TNsuWoi6wAAAAA"]
[Sat Jan 03 08:21:43.257208 2026] [:error] [pid 1931:tid 2036] [client 4.196.97.109:32631] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVhhFx8Tyw7ZoIdXlcZP6gAAAIw"]
[Sat Jan 03 08:21:56.387241 2026] [:error] [pid 2083:tid 2094] [client 4.196.97.109:32995] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVhhJDVlR_BmlMPnhV4rFQAAAMk"]
[Sat Jan 03 08:21:57.131269 2026] [:error] [pid 31630:tid 31641] [client 4.196.97.109:4039] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVhhJfUV_PU2SWgLPuieWQAAAYk"]
[Sat Jan 03 08:22:02.412428 2026] [:error] [pid 1929:tid 1960] [client 4.196.97.109:31722] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVhhKucFqdpu6TNsuWojEAAAABY"]
[Sat Jan 03 08:22:02.705310 2026] [:error] [pid 1930:tid 1980] [client 4.196.97.109:31707] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aVhhKpP-6mqhfUDa89wuwAAAAE4"]
[Sat Jan 03 08:22:24.522362 2026] [:error] [pid 31630:tid 31650] [client 4.196.97.109:45228] File does not exist: /usr/local/apache/htdocs/suspended-page/ierne.php
[Sat Jan 03 08:22:24.667339 2026] [:error] [pid 31630:tid 31651] [client 4.196.97.109:45228] File does not exist: /usr/local/apache/htdocs/suspended-page/xde.php
[Sat Jan 03 08:22:24.693510 2026] [:error] [pid 31630:tid 31645] [client 4.196.97.109:45228] File does not exist: /usr/local/apache/htdocs/suspended-page/1yade.php
[Sat Jan 03 08:22:24.726057 2026] [:error] [pid 31630:tid 31641] [client 4.196.97.109:45228] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Sat Jan 03 08:22:24.744702 2026] [:error] [pid 31630:tid 31640] [client 4.196.97.109:45228] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sat Jan 03 10:08:38.629521 2026] [:error] [pid 1931:tid 1996] [client 49.51.243.156:56286] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVh6Jh8Tyw7ZoIdXlcZn4gAAAII"]
[Sat Jan 03 12:07:57.890695 2026] [:error] [pid 1930:tid 1976] [client 43.166.250.187:39722] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aViWHZP-6mqhfUDa89xjwgAAAEo"]
[Sat Jan 03 15:47:47.867042 2026] [:error] [pid 19639:tid 19647] [client 43.130.139.136:56522] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVjJoyQ7fWZUytnlHEyxXAAAAUY"]
[Sat Jan 03 16:17:41.373692 2026] [:error] [pid 34260:tid 34284] [client 117.33.163.216:33024] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVjQpUWWhyvZ0O9KNVSquAAAARY"]
[Sat Jan 03 19:57:15.363925 2026] [:error] [pid 1929:tid 1954] [client 43.166.132.142:33972] [client 43.166.132.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVkEG-cFqdpu6TNsuWrVgAAAABA"]
[Sat Jan 03 21:43:28.475196 2026] [:error] [pid 2083:tid 2098] [client 4.217.187.11:52233] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Jan 03 21:43:28.614395 2026] [:error] [pid 2083:tid 2088] [client 4.217.187.11:52233] File does not exist: /usr/local/apache/htdocs/suspended-page/ups.php
[Sat Jan 03 21:43:28.888276 2026] [:error] [pid 2083:tid 2099] [client 4.217.187.11:52233] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Jan 03 21:43:29.033612 2026] [:error] [pid 2083:tid 2109] [client 4.217.187.11:52233] File does not exist: /usr/local/apache/htdocs/suspended-page/tgrs.php
[Sat Jan 03 21:43:29.204159 2026] [:error] [pid 2083:tid 2097] [client 4.217.187.11:52233] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Sat Jan 03 21:43:29.345562 2026] [:error] [pid 2083:tid 2108] [client 4.217.187.11:52233] [client 4.217.187.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aVkdATVlR_BmlMPnhV4eLQAAANc"]
[Sat Jan 03 21:43:32.046340 2026] [:error] [pid 19639:tid 19661] [client 4.217.187.11:52231] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sat Jan 03 21:43:32.208715 2026] [:error] [pid 19639:tid 19643] [client 4.217.187.11:52231] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the1me.php
[Sat Jan 03 21:43:32.348411 2026] [:error] [pid 19639:tid 19654] [client 4.217.187.11:52231] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Sat Jan 03 21:43:32.786813 2026] [:error] [pid 19639:tid 19665] [client 4.217.187.11:52231] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hk.php"] [unique_id "aVkdBCQ7fWZUytnlHEwCtgAAAVg"]
[Sat Jan 03 21:43:33.897676 2026] [:error] [pid 31630:tid 31641] [client 4.217.187.11:52258] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hk.php"] [unique_id "aVkdBfUV_PU2SWgLPuhkwwAAAYk"]
[Sat Jan 03 21:43:37.452339 2026] [:error] [pid 1930:tid 1980] [client 4.217.187.11:52246] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hk.php"] [unique_id "aVkdCZP-6mqhfUDa89zo1gAAAE4"]
[Sat Jan 03 21:43:38.281088 2026] [:error] [pid 1930:tid 1968] [client 4.217.187.11:52255] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hk.php"] [unique_id "aVkdCpP-6mqhfUDa89zo2AAAAEI"]
[Sat Jan 03 21:43:39.371114 2026] [:error] [pid 34260:tid 34265] [client 4.217.187.11:52239] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aVkdC0WWhyvZ0O9KNVQohAAAAQM"]
[Sat Jan 03 21:43:40.810783 2026] [:error] [pid 1930:tid 1971] [client 4.217.187.11:52273] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aVkdDJP-6mqhfUDa89zo4AAAAEU"]
[Sat Jan 03 21:43:41.508499 2026] [:error] [pid 19639:tid 19657] [client 4.217.187.11:43612] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aVkdDSQ7fWZUytnlHEwCwQAAAVA"]
[Sat Jan 03 21:43:43.611082 2026] [:error] [pid 2083:tid 2103] [client 4.217.187.11:52247] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/index.php"] [unique_id "aVkdDzVlR_BmlMPnhV4eNwAAANI"]
[Sat Jan 03 21:43:44.922956 2026] [:error] [pid 19639:tid 19642] [client 4.217.187.11:52263] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVkdECQ7fWZUytnlHEwC0AAAAUE"]
[Sat Jan 03 21:43:46.319578 2026] [:error] [pid 34260:tid 34262] [client 4.217.187.11:52279] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVkdEkWWhyvZ0O9KNVQohwAAAQA"]
[Sat Jan 03 21:43:48.970639 2026] [:error] [pid 31630:tid 31638] [client 4.217.187.11:52243] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVkdFPUV_PU2SWgLPuhk1QAAAYY"]
[Sat Jan 03 21:43:50.928096 2026] [:error] [pid 31630:tid 31656] [client 4.217.187.11:43587] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVkdFvUV_PU2SWgLPuhk2AAAAZg"]
[Sat Jan 03 21:43:55.928348 2026] [:error] [pid 31222:tid 31242] [client 4.217.187.11:43596] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxz.php"] [unique_id "aVkdG6Hw6nASHXAc2v_r5gAAAdI"]
[Sat Jan 03 21:43:57.517121 2026] [:error] [pid 1929:tid 1957] [client 4.217.187.11:52250] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxz.php"] [unique_id "aVkdHecFqdpu6TNsuWrxjAAAABM"]
[Sat Jan 03 21:43:59.359990 2026] [:error] [pid 34260:tid 34267] [client 4.217.187.11:43593] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxz.php"] [unique_id "aVkdH0WWhyvZ0O9KNVQomAAAAQU"]
[Sat Jan 03 21:44:00.499813 2026] [:error] [pid 2083:tid 2093] [client 4.217.187.11:43600] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxz.php"] [unique_id "aVkdIDVlR_BmlMPnhV4eTwAAAMg"]
[Sat Jan 03 21:44:03.061450 2026] [:error] [pid 2083:tid 2107] [client 4.217.187.11:52285] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aVkdIzVlR_BmlMPnhV4eUAAAANY"]
[Sat Jan 03 21:44:05.618559 2026] [:error] [pid 19639:tid 19646] [client 4.217.187.11:43621] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aVkdJSQ7fWZUytnlHEwC1gAAAUU"]
[Sat Jan 03 21:44:06.646592 2026] [:error] [pid 31630:tid 31635] [client 4.217.187.11:52244] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aVkdJvUV_PU2SWgLPuhk8QAAAYM"]
[Sat Jan 03 21:44:07.375085 2026] [:error] [pid 31222:tid 31233] [client 4.217.187.11:52237] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aVkdJ6Hw6nASHXAc2v_r8AAAAck"]
[Sat Jan 03 21:44:09.603047 2026] [:error] [pid 2083:tid 2087] [client 4.217.187.11:52232] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVkdKTVlR_BmlMPnhV4eWQAAAMI"]
[Sat Jan 03 21:44:11.804954 2026] [:error] [pid 1929:tid 1944] [client 4.217.187.11:52264] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVkdK-cFqdpu6TNsuWrxmgAAAAY"]
[Sat Jan 03 21:44:12.855586 2026] [:error] [pid 1931:tid 2046] [client 4.217.187.11:43613] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVkdLB8Tyw7ZoIdXlcYEbAAAAJY"]
[Sat Jan 03 21:44:15.855645 2026] [:error] [pid 19639:tid 19648] [client 4.217.187.11:43615] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "aVkdLyQ7fWZUytnlHEwC3wAAAUc"]
[Sat Jan 03 21:44:19.919706 2026] [:error] [pid 1931:tid 1993] [client 4.217.187.11:52262] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVkdMx8Tyw7ZoIdXlcYEdwAAAIA"]
[Sat Jan 03 21:44:21.788966 2026] [:error] [pid 34260:tid 34267] [client 4.217.187.11:52241] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVkdNUWWhyvZ0O9KNVQosQAAAQU"]
[Sat Jan 03 21:44:23.720410 2026] [:error] [pid 1931:tid 1996] [client 4.217.187.11:43592] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVkdNx8Tyw7ZoIdXlcYEfAAAAII"]
[Sat Jan 03 21:44:24.360652 2026] [:error] [pid 1929:tid 1944] [client 4.217.187.11:43586] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVkdOOcFqdpu6TNsuWrxtQAAAAY"]
[Sat Jan 03 21:44:25.285584 2026] [:error] [pid 19639:tid 19663] [client 4.217.187.11:52245] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell1.php"] [unique_id "aVkdOSQ7fWZUytnlHEwC6AAAAVY"]
[Sat Jan 03 21:44:26.801573 2026] [:error] [pid 2083:tid 2085] [client 4.217.187.11:52281] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell1.php"] [unique_id "aVkdOjVlR_BmlMPnhV4eagAAAMA"]
[Sat Jan 03 21:44:28.561029 2026] [:error] [pid 34260:tid 34283] [client 4.217.187.11:52286] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell1.php"] [unique_id "aVkdPEWWhyvZ0O9KNVQoxAAAARU"]
[Sat Jan 03 21:44:30.848084 2026] [:error] [pid 31630:tid 31633] [client 4.217.187.11:52283] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell1.php"] [unique_id "aVkdPvUV_PU2SWgLPuhlAgAAAYE"]
[Sat Jan 03 21:44:32.910169 2026] [:error] [pid 1929:tid 1938] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Jan 03 21:44:33.051381 2026] [:error] [pid 1929:tid 1951] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sat Jan 03 21:44:33.190565 2026] [:error] [pid 1929:tid 1947] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/n.php
[Sat Jan 03 21:44:33.465062 2026] [:error] [pid 1929:tid 1952] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/jmfi2.php
[Sat Jan 03 21:44:33.647705 2026] [:error] [pid 1929:tid 1940] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/nij.php
[Sat Jan 03 21:44:33.789948 2026] [:error] [pid 1929:tid 1943] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sat Jan 03 21:44:33.995949 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Jan 03 21:44:34.215671 2026] [:error] [pid 1929:tid 1959] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Sat Jan 03 21:44:34.372947 2026] [:error] [pid 1929:tid 1942] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Sat Jan 03 21:44:34.684156 2026] [:error] [pid 1929:tid 1957] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sat Jan 03 21:44:34.992516 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:43585] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Jan 03 21:44:35.158940 2026] [:error] [pid 1929:tid 1950] [client 4.217.187.11:43585] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aVkdQ-cFqdpu6TNsuWrxygAAAAw"]
[Sat Jan 03 21:44:40.574496 2026] [:error] [pid 1930:tid 1973] [client 4.217.187.11:52277] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aVkdSJP-6mqhfUDa89zpGQAAAEc"]
[Sat Jan 03 21:44:45.446562 2026] [:error] [pid 19639:tid 19641] [client 4.217.187.11:19675] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aVkdTSQ7fWZUytnlHEwDBQAAAUA"]
[Sat Jan 03 21:44:47.530000 2026] [:error] [pid 31630:tid 31632] [client 4.217.187.11:43589] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "aVkdT_UV_PU2SWgLPuhlEgAAAYA"]
[Sat Jan 03 21:44:48.746104 2026] [:error] [pid 1931:tid 1994] [client 4.217.187.11:19697] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-903.php"] [unique_id "aVkdUB8Tyw7ZoIdXlcYEngAAAIE"]
[Sat Jan 03 21:44:49.963193 2026] [:error] [pid 1931:tid 2035] [client 4.217.187.11:52236] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-903.php"] [unique_id "aVkdUR8Tyw7ZoIdXlcYEowAAAIs"]
[Sat Jan 03 21:44:51.235482 2026] [:error] [pid 31222:tid 31244] [client 4.217.187.11:52280] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-903.php"] [unique_id "aVkdU6Hw6nASHXAc2v_sKAAAAdQ"]
[Sat Jan 03 21:44:52.228663 2026] [:error] [pid 1931:tid 2042] [client 4.217.187.11:43625] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-903.php"] [unique_id "aVkdVB8Tyw7ZoIdXlcYErAAAAJI"]
[Sat Jan 03 21:44:54.283327 2026] [:error] [pid 31630:tid 31655] [client 4.217.187.11:43584] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVkdVvUV_PU2SWgLPuhlFwAAAZc"]
[Sat Jan 03 21:44:55.173696 2026] [:error] [pid 34260:tid 34274] [client 4.217.187.11:52260] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVkdV0WWhyvZ0O9KNVQo1AAAAQw"]
[Sat Jan 03 21:44:56.689994 2026] [:error] [pid 1930:tid 1978] [client 4.217.187.11:52274] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVkdWJP-6mqhfUDa89zpKAAAAEw"]
[Sat Jan 03 21:44:59.262212 2026] [:error] [pid 2083:tid 2086] [client 4.217.187.11:19666] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVkdWzVlR_BmlMPnhV4eiQAAAME"]
[Sat Jan 03 21:45:00.768908 2026] [:error] [pid 31222:tid 31239] [client 4.217.187.11:19708] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVkdXKHw6nASHXAc2v_sMwAAAc8"]
[Sat Jan 03 21:45:03.207592 2026] [:error] [pid 1929:tid 1941] [client 4.217.187.11:43647] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVkdX-cFqdpu6TNsuWrx5gAAAAM"]
[Sat Jan 03 21:45:08.693750 2026] [:error] [pid 1929:tid 1948] [client 4.217.187.11:52271] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVkdZOcFqdpu6TNsuWrx8AAAAAo"]
[Sat Jan 03 21:45:12.666761 2026] [:error] [pid 31630:tid 31656] [client 4.217.187.11:52235] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aVkdaPUV_PU2SWgLPuhlLQAAAZg"]
[Sat Jan 03 21:45:14.454094 2026] [:error] [pid 1930:tid 1980] [client 4.217.187.11:52275] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aVkdapP-6mqhfUDa89zpnQAAAE4"]
[Sat Jan 03 21:45:16.794700 2026] [:error] [pid 31630:tid 31648] [client 4.217.187.11:43620] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aVkdbPUV_PU2SWgLPuhlNAAAAZA"]
[Sat Jan 03 21:45:18.431871 2026] [:error] [pid 1929:tid 1944] [client 4.217.187.11:52259] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aVkdbucFqdpu6TNsuWrx-wAAAAY"]
[Sat Jan 03 21:45:20.304948 2026] [:error] [pid 34260:tid 34286] [client 4.217.187.11:43595] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geck.php"] [unique_id "aVkdcEWWhyvZ0O9KNVQo8gAAARg"]
[Sat Jan 03 21:45:23.406691 2026] [:error] [pid 1931:tid 2045] [client 4.217.187.11:43638] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aVkdcx8Tyw7ZoIdXlcYE4wAAAJU"]
[Sat Jan 03 21:45:24.424019 2026] [:error] [pid 19639:tid 19662] [client 4.217.187.11:52256] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aVkddCQ7fWZUytnlHEwDIwAAAVU"]
[Sat Jan 03 21:45:28.730155 2026] [:error] [pid 19639:tid 19645] [client 4.217.187.11:19649] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aVkdeCQ7fWZUytnlHEwDKwAAAUQ"]
[Sat Jan 03 21:45:29.796218 2026] [:error] [pid 1930:tid 1966] [client 4.217.187.11:52270] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aVkdeZP-6mqhfUDa89zprwAAAEA"]
[Sat Jan 03 21:45:30.813907 2026] [:error] [pid 1931:tid 2038] [client 4.217.187.11:52265] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aVkdeh8Tyw7ZoIdXlcYE7gAAAI4"]
[Sat Jan 03 21:45:31.611837 2026] [:error] [pid 31630:tid 31647] [client 4.217.187.11:19672] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aVkde_UV_PU2SWgLPuhlRwAAAY8"]
[Sat Jan 03 21:45:34.631573 2026] [:error] [pid 2083:tid 2092] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sat Jan 03 21:45:34.956017 2026] [:error] [pid 2083:tid 2094] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/hook.php
[Sat Jan 03 21:45:36.078078 2026] [:error] [pid 2083:tid 2094] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/wcas.php
[Sat Jan 03 21:45:36.399036 2026] [:error] [pid 2083:tid 2109] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sat Jan 03 21:45:36.536982 2026] [:error] [pid 2083:tid 2097] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Sat Jan 03 21:45:36.681177 2026] [:error] [pid 2083:tid 2108] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Jan 03 21:45:36.822486 2026] [:error] [pid 2083:tid 2105] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Sat Jan 03 21:45:36.960894 2026] [:error] [pid 2083:tid 2086] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Sat Jan 03 21:45:37.103053 2026] [:error] [pid 2083:tid 2095] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/himu.php
[Sat Jan 03 21:45:37.243694 2026] [:error] [pid 2083:tid 2091] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sat Jan 03 21:45:37.384257 2026] [:error] [pid 2083:tid 2107] [client 4.217.187.11:43637] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Sat Jan 03 21:45:37.518034 2026] [:error] [pid 2083:tid 2085] [client 4.217.187.11:43637] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abt.php"] [unique_id "aVkdgTVlR_BmlMPnhV4euwAAAMA"]
[Sat Jan 03 21:45:39.166395 2026] [:error] [pid 31222:tid 31225] [client 4.217.187.11:43618] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abt.php"] [unique_id "aVkdg6Hw6nASHXAc2v_sjwAAAcE"]
[Sat Jan 03 21:45:40.897352 2026] [:error] [pid 1931:tid 2047] [client 4.217.187.11:43616] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abt.php"] [unique_id "aVkdhB8Tyw7ZoIdXlcYE_gAAAJc"]
[Sat Jan 03 21:45:42.850514 2026] [:error] [pid 34260:tid 34278] [client 4.217.187.11:43608] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abt.php"] [unique_id "aVkdhkWWhyvZ0O9KNVQpDAAAARA"]
[Sat Jan 03 21:45:43.653508 2026] [:error] [pid 1929:tid 1958] [client 4.217.187.11:43611] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVkdh-cFqdpu6TNsuWryFwAAABQ"]
[Sat Jan 03 21:45:45.040170 2026] [:error] [pid 31630:tid 31646] [client 4.217.187.11:19660] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVkdifUV_PU2SWgLPuhlVAAAAY4"]
[Sat Jan 03 21:45:46.062883 2026] [:error] [pid 31222:tid 31230] [client 4.217.187.11:52282] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVkdiqHw6nASHXAc2v_slQAAAcY"]
[Sat Jan 03 21:45:47.108809 2026] [:error] [pid 1931:tid 2030] [client 4.217.187.11:19673] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVkdix8Tyw7ZoIdXlcYFCwAAAIY"]
[Sat Jan 03 21:45:47.836867 2026] [:error] [pid 31222:tid 31245] [client 4.217.187.11:19654] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v4.php"] [unique_id "aVkdi6Hw6nASHXAc2v_smAAAAdU"]
[Sat Jan 03 21:45:48.903299 2026] [:error] [pid 1931:tid 2042] [client 4.217.187.11:19685] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v4.php"] [unique_id "aVkdjB8Tyw7ZoIdXlcYFDAAAAJI"]
[Sat Jan 03 21:45:49.719325 2026] [:error] [pid 1929:tid 1944] [client 4.217.187.11:43598] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v4.php"] [unique_id "aVkdjecFqdpu6TNsuWryHQAAAAY"]
[Sat Jan 03 21:45:50.490980 2026] [:error] [pid 1929:tid 1957] [client 4.217.187.11:43601] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v4.php"] [unique_id "aVkdjucFqdpu6TNsuWryIAAAABM"]
[Sat Jan 03 21:45:51.786029 2026] [:error] [pid 34260:tid 34275] [client 4.217.187.11:19690] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wb.php"] [unique_id "aVkdj0WWhyvZ0O9KNVQpGQAAAQ0"]
[Sat Jan 03 21:45:57.327660 2026] [:error] [pid 19639:tid 19656] [client 4.217.187.11:52284] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wb.php"] [unique_id "aVkdlSQ7fWZUytnlHEwDQAAAAU8"]
[Sat Jan 03 21:45:58.418461 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:43626] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wb.php"] [unique_id "aVkdlucFqdpu6TNsuWryNAAAAAg"]
[Sat Jan 03 21:45:59.821322 2026] [:error] [pid 31222:tid 31232] [client 4.217.187.11:19667] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wb.php"] [unique_id "aVkdl6Hw6nASHXAc2v_sqQAAAcg"]
[Sat Jan 03 21:46:01.987873 2026] [:error] [pid 31222:tid 31246] [client 4.217.187.11:43624] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mnkalo.php"] [unique_id "aVkdmaHw6nASHXAc2v_srgAAAdY"]
[Sat Jan 03 21:46:03.515658 2026] [:error] [pid 2083:tid 2093] [client 4.217.187.11:43632] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mnkalo.php"] [unique_id "aVkdmzVlR_BmlMPnhV4ezgAAAMg"]
[Sat Jan 03 21:46:04.500604 2026] [:error] [pid 31630:tid 31638] [client 4.217.187.11:52252] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mnkalo.php"] [unique_id "aVkdnPUV_PU2SWgLPuhlYQAAAYY"]
[Sat Jan 03 21:46:05.182756 2026] [:error] [pid 31630:tid 31642] [client 4.217.187.11:52266] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mnkalo.php"] [unique_id "aVkdnfUV_PU2SWgLPuhlYwAAAYo"]
[Sat Jan 03 21:46:06.447268 2026] [:error] [pid 2083:tid 2085] [client 4.217.187.11:43630] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-x7.php"] [unique_id "aVkdnjVlR_BmlMPnhV4e0AAAAMA"]
[Sat Jan 03 21:46:07.750105 2026] [:error] [pid 2083:tid 2104] [client 4.217.187.11:52230] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-x7.php"] [unique_id "aVkdnzVlR_BmlMPnhV4e1QAAANM"]
[Sat Jan 03 21:46:08.873084 2026] [:error] [pid 31222:tid 31236] [client 4.217.187.11:19674] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-x7.php"] [unique_id "aVkdoKHw6nASHXAc2v_sugAAAcw"]
[Sat Jan 03 21:46:10.590963 2026] [:error] [pid 31222:tid 31243] [client 4.217.187.11:43603] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-x7.php"] [unique_id "aVkdoqHw6nASHXAc2v_swwAAAdM"]
[Sat Jan 03 21:46:12.796215 2026] [:error] [pid 1929:tid 1957] [client 4.217.187.11:43597] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVkdpOcFqdpu6TNsuWryPQAAABM"]
[Sat Jan 03 21:46:17.406171 2026] [:error] [pid 34260:tid 34262] [client 4.217.187.11:19650] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVkdqUWWhyvZ0O9KNVQpKwAAAQA"]
[Sat Jan 03 21:46:18.564152 2026] [:error] [pid 1931:tid 2043] [client 4.217.187.11:52234] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVkdqh8Tyw7ZoIdXlcYFMwAAAJM"]
[Sat Jan 03 21:46:19.799356 2026] [:error] [pid 31630:tid 31635] [client 4.217.187.11:43588] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aVkdq_UV_PU2SWgLPuhlgAAAAYM"]
[Sat Jan 03 21:46:21.322784 2026] [:error] [pid 1930:tid 1982] [client 4.217.187.11:19584] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aVkdrZP-6mqhfUDa89zp0wAAAFA"]
[Sat Jan 03 21:46:22.857824 2026] [:error] [pid 19639:tid 19641] [client 4.217.187.11:52240] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aVkdriQ7fWZUytnlHEwDRgAAAUA"]
[Sat Jan 03 21:46:24.831622 2026] [:error] [pid 1930:tid 1980] [client 4.217.187.11:19676] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aVkdsJP-6mqhfUDa89zp2QAAAE4"]
[Sat Jan 03 21:46:26.386297 2026] [:error] [pid 31222:tid 31237] [client 4.217.187.11:19677] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aVkdsqHw6nASHXAc2v_szAAAAc0"]
[Sat Jan 03 21:46:29.629757 2026] [:error] [pid 2083:tid 2105] [client 4.217.187.11:43591] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVkdtTVlR_BmlMPnhV4e7AAAANQ"]
[Sat Jan 03 21:46:30.550722 2026] [:error] [pid 1931:tid 2030] [client 4.217.187.11:52261] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVkdth8Tyw7ZoIdXlcYFPwAAAIY"]
[Sat Jan 03 21:46:32.023398 2026] [:error] [pid 2083:tid 2088] [client 4.217.187.11:43605] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVkduDVlR_BmlMPnhV4e8gAAAMM"]
[Sat Jan 03 21:46:34.684464 2026] [:error] [pid 1931:tid 2032] [client 4.217.187.11:19706] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aVkduh8Tyw7ZoIdXlcYFSwAAAIg"]
[Sat Jan 03 21:46:35.401641 2026] [:error] [pid 1931:tid 2040] [client 4.217.187.11:43633] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aVkdux8Tyw7ZoIdXlcYFUQAAAJA"]
[Sat Jan 03 21:46:37.159648 2026] [:error] [pid 31630:tid 31640] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Jan 03 21:46:37.304592 2026] [:error] [pid 31630:tid 31652] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Sat Jan 03 21:46:37.479418 2026] [:error] [pid 31630:tid 31647] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Jan 03 21:46:37.926831 2026] [:error] [pid 31630:tid 31648] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Sat Jan 03 21:46:38.065374 2026] [:error] [pid 31630:tid 31639] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Jan 03 21:46:38.202883 2026] [:error] [pid 31630:tid 31649] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Jan 03 21:46:38.533514 2026] [:error] [pid 31630:tid 31656] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp.php
[Sat Jan 03 21:46:38.671565 2026] [:error] [pid 31630:tid 31651] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/nope.php
[Sat Jan 03 21:46:38.816659 2026] [:error] [pid 31630:tid 31645] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sat Jan 03 21:46:38.989506 2026] [:error] [pid 31630:tid 31634] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/444.php
[Sat Jan 03 21:46:39.152911 2026] [:error] [pid 31630:tid 31635] [client 4.217.187.11:43590] File does not exist: /usr/local/apache/htdocs/suspended-page/mans.php
[Sat Jan 03 21:46:39.293409 2026] [:error] [pid 31630:tid 31644] [client 4.217.187.11:43590] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aVkdv_UV_PU2SWgLPuhlrwAAAYw"]
[Sat Jan 03 21:46:40.263677 2026] [:error] [pid 1930:tid 1971] [client 4.217.187.11:19691] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aVkdwJP-6mqhfUDa89zp6AAAAEU"]
[Sat Jan 03 21:46:41.321453 2026] [:error] [pid 1931:tid 1999] [client 4.217.187.11:43610] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aVkdwR8Tyw7ZoIdXlcYFYwAAAIM"]
[Sat Jan 03 21:46:42.928333 2026] [:error] [pid 1931:tid 2038] [client 4.217.187.11:19703] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hello.php"] [unique_id "aVkdwh8Tyw7ZoIdXlcYFbAAAAI4"]
[Sat Jan 03 21:46:44.408269 2026] [:error] [pid 2083:tid 2086] [client 4.217.187.11:19589] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVkdxDVlR_BmlMPnhV4e_QAAAME"]
[Sat Jan 03 21:46:45.328225 2026] [:error] [pid 1929:tid 1944] [client 4.217.187.11:19661] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVkdxecFqdpu6TNsuWryaAAAAAY"]
[Sat Jan 03 21:46:46.513712 2026] [:error] [pid 31222:tid 31244] [client 4.217.187.11:43606] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVkdxqHw6nASHXAc2v_s3QAAAdQ"]
[Sat Jan 03 21:46:47.925649 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:43607] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVkdx-cFqdpu6TNsuWrycAAAAAE"]
[Sat Jan 03 21:46:49.498956 2026] [:error] [pid 1930:tid 1989] [client 4.217.187.11:52251] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aVkdyZP-6mqhfUDa89zp7AAAAFc"]
[Sat Jan 03 21:46:50.831627 2026] [:error] [pid 31222:tid 31240] [client 4.217.187.11:52229] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aVkdyqHw6nASHXAc2v_s5AAAAdA"]
[Sat Jan 03 21:46:52.928667 2026] [:error] [pid 19639:tid 19663] [client 4.217.187.11:19599] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aVkdzCQ7fWZUytnlHEwDWwAAAVY"]
[Sat Jan 03 21:46:53.949021 2026] [:error] [pid 34260:tid 34276] [client 4.217.187.11:19585] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/usep.php"] [unique_id "aVkdzUWWhyvZ0O9KNVQpUwAAAQ4"]
[Sat Jan 03 21:46:58.759375 2026] [:error] [pid 19639:tid 19643] [client 4.217.187.11:19681] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVkd0iQ7fWZUytnlHEwDYAAAAUI"]
[Sat Jan 03 21:47:00.117740 2026] [:error] [pid 1931:tid 2039] [client 4.217.187.11:52248] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVkd1B8Tyw7ZoIdXlcYFgQAAAI8"]
[Sat Jan 03 21:47:02.418886 2026] [:error] [pid 1931:tid 2041] [client 4.217.187.11:43609] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVkd1h8Tyw7ZoIdXlcYFjQAAAJE"]
[Sat Jan 03 21:47:03.599703 2026] [:error] [pid 2083:tid 2103] [client 4.217.187.11:43617] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVkd1zVlR_BmlMPnhV4fDAAAANI"]
[Sat Jan 03 21:47:06.184137 2026] [:error] [pid 1930:tid 1969] [client 4.217.187.11:52226] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVkd2pP-6mqhfUDa89zp_wAAAEM"]
[Sat Jan 03 21:47:09.094197 2026] [:error] [pid 19639:tid 19654] [client 4.217.187.11:52267] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVkd3SQ7fWZUytnlHEwDbgAAAU0"]
[Sat Jan 03 21:47:15.253641 2026] [:error] [pid 19639:tid 19656] [client 4.217.187.11:19678] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVkd4yQ7fWZUytnlHEwDcAAAAU8"]
[Sat Jan 03 21:47:17.950451 2026] [:error] [pid 1930:tid 1980] [client 4.217.187.11:19699] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVkd5ZP-6mqhfUDa89zqDAAAAE4"]
[Sat Jan 03 21:47:18.913623 2026] [:error] [pid 19639:tid 19654] [client 4.217.187.11:19682] [client 4.217.187.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aVkd5iQ7fWZUytnlHEwDfAAAAU0"]
[Sat Jan 03 21:47:19.680242 2026] [:error] [pid 2083:tid 2104] [client 4.217.187.11:19704] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aVkd5zVlR_BmlMPnhV4fJQAAANM"]
[Sat Jan 03 21:47:20.518694 2026] [:error] [pid 31222:tid 31248] [client 4.217.187.11:19658] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aVkd6KHw6nASHXAc2v_s-wAAAdg"]
[Sat Jan 03 21:47:22.514198 2026] [:error] [pid 1931:tid 1999] [client 4.217.187.11:19638] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aVkd6h8Tyw7ZoIdXlcYFpwAAAIM"]
[Sat Jan 03 21:47:27.088649 2026] [:error] [pid 2083:tid 2106] [client 4.217.187.11:19634] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aVkd7zVlR_BmlMPnhV4fKgAAANU"]
[Sat Jan 03 21:47:29.142859 2026] [:error] [pid 1930:tid 1983] [client 4.217.187.11:43645] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "aVkd8ZP-6mqhfUDa89zqLQAAAFE"]
[Sat Jan 03 21:47:30.758330 2026] [:error] [pid 1931:tid 2033] [client 4.217.187.11:43604] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "aVkd8h8Tyw7ZoIdXlcYFuQAAAIk"]
[Sat Jan 03 21:47:31.934801 2026] [:error] [pid 1929:tid 1957] [client 4.217.187.11:43619] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "aVkd8-cFqdpu6TNsuWryqAAAABM"]
[Sat Jan 03 21:47:34.911036 2026] [:error] [pid 34260:tid 34273] [client 4.217.187.11:43634] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "aVkd9kWWhyvZ0O9KNVQpiQAAAQs"]
[Sat Jan 03 21:47:36.473565 2026] [:error] [pid 1931:tid 2040] [client 4.217.187.11:19598] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aVkd-B8Tyw7ZoIdXlcYFygAAAJA"]
[Sat Jan 03 21:47:39.491660 2026] [:error] [pid 1930:tid 1972] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Jan 03 21:47:39.647154 2026] [:error] [pid 1930:tid 1967] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Jan 03 21:47:39.973450 2026] [:error] [pid 1930:tid 1990] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Sat Jan 03 21:47:40.134916 2026] [:error] [pid 1930:tid 1981] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Sat Jan 03 21:47:40.387547 2026] [:error] [pid 1930:tid 1969] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/xtt.php
[Sat Jan 03 21:47:40.533295 2026] [:error] [pid 1930:tid 1980] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Jan 03 21:47:41.900128 2026] [:error] [pid 1930:tid 1980] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/luxe.php
[Sat Jan 03 21:47:42.381891 2026] [:error] [pid 1930:tid 1974] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Jan 03 21:47:42.521385 2026] [:error] [pid 1930:tid 1986] [client 4.217.187.11:43594] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Sat Jan 03 21:47:42.913940 2026] [:error] [pid 1930:tid 1986] [client 4.217.187.11:43594] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVkd_pP-6mqhfUDa89zqQAAAAFQ"]
[Sat Jan 03 21:47:45.447811 2026] [:error] [pid 1931:tid 2038] [client 4.217.187.11:52287] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVkeAR8Tyw7ZoIdXlcYF3QAAAI4"]
[Sat Jan 03 21:47:47.194444 2026] [:error] [pid 1930:tid 1982] [client 4.217.187.11:19680] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVkeA5P-6mqhfUDa89zqRAAAAFA"]
[Sat Jan 03 21:47:48.961620 2026] [:error] [pid 1930:tid 1973] [client 4.217.187.11:43627] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVkeBJP-6mqhfUDa89zqRwAAAEc"]
[Sat Jan 03 21:47:51.107791 2026] [:error] [pid 19639:tid 19650] [client 4.217.187.11:52233] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVkeByQ7fWZUytnlHEwDmAAAAUk"]
[Sat Jan 03 21:47:53.446833 2026] [:error] [pid 1930:tid 1985] [client 4.217.187.11:43635] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVkeCZP-6mqhfUDa89zqVAAAAFM"]
[Sat Jan 03 21:47:54.803342 2026] [:error] [pid 2083:tid 2099] [client 4.217.187.11:43644] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVkeCjVlR_BmlMPnhV4fPQAAAM4"]
[Sat Jan 03 21:47:55.924825 2026] [:error] [pid 19639:tid 19665] [client 4.217.187.11:19646] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVkeCyQ7fWZUytnlHEwDoQAAAVg"]
[Sat Jan 03 21:47:57.122602 2026] [:error] [pid 1929:tid 1951] [client 4.217.187.11:19653] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVkeDecFqdpu6TNsuWryywAAAA0"]
[Sat Jan 03 21:47:59.185948 2026] [:error] [pid 34260:tid 34275] [client 4.217.187.11:52249] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVkeD0WWhyvZ0O9KNVQpnQAAAQ0"]
[Sat Jan 03 21:48:01.770092 2026] [:error] [pid 2083:tid 2108] [client 4.217.187.11:43628] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVkeETVlR_BmlMPnhV4fQwAAANc"]
[Sat Jan 03 21:48:05.749725 2026] [:error] [pid 1931:tid 2027] [client 4.217.187.11:52263] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVkeFR8Tyw7ZoIdXlcYGAQAAAIQ"]
[Sat Jan 03 21:48:09.736863 2026] [:error] [pid 34260:tid 34278] [client 4.217.187.11:52246] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aVkeGUWWhyvZ0O9KNVQprAAAARA"]
[Sat Jan 03 21:48:11.933541 2026] [:error] [pid 1931:tid 2034] [client 4.217.187.11:52227] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aVkeGx8Tyw7ZoIdXlcYGBQAAAIo"]
[Sat Jan 03 21:48:14.711648 2026] [:error] [pid 31630:tid 31639] [client 4.217.187.11:43602] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aVkeHvUV_PU2SWgLPuhmHwAAAYc"]
[Sat Jan 03 21:48:17.676462 2026] [:error] [pid 1930:tid 1983] [client 4.217.187.11:19651] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aVkeIZP-6mqhfUDa89zqmQAAAFE"]
[Sat Jan 03 21:48:19.730759 2026] [:error] [pid 34260:tid 34266] [client 4.217.187.11:19656] [client 4.217.187.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aVkeI0WWhyvZ0O9KNVQpugAAAQQ"]
[Sat Jan 03 21:48:22.298191 2026] [:error] [pid 1929:tid 1962] [client 4.217.187.11:19664] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/777.php"] [unique_id "aVkeJucFqdpu6TNsuWrzDAAAABg"]
[Sat Jan 03 21:48:23.437675 2026] [:error] [pid 34260:tid 34263] [client 4.217.187.11:19663] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/777.php"] [unique_id "aVkeJ0WWhyvZ0O9KNVQpvwAAAQE"]
[Sat Jan 03 21:48:25.019979 2026] [:error] [pid 34260:tid 34265] [client 4.217.187.11:19695] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/777.php"] [unique_id "aVkeKUWWhyvZ0O9KNVQpwQAAAQM"]
[Sat Jan 03 21:48:30.824312 2026] [:error] [pid 34260:tid 34285] [client 4.217.187.11:43593] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/777.php"] [unique_id "aVkeLkWWhyvZ0O9KNVQpyAAAARc"]
[Sat Jan 03 21:48:32.125031 2026] [:error] [pid 1930:tid 1972] [client 4.217.187.11:43641] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z.php"] [unique_id "aVkeMJP-6mqhfUDa89zqsAAAAEY"]
[Sat Jan 03 21:48:33.419261 2026] [:error] [pid 1931:tid 2044] [client 4.217.187.11:52231] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z.php"] [unique_id "aVkeMR8Tyw7ZoIdXlcYGNAAAAJQ"]
[Sat Jan 03 21:48:35.056493 2026] [:error] [pid 34260:tid 34283] [client 4.217.187.11:43613] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z.php"] [unique_id "aVkeM0WWhyvZ0O9KNVQp0QAAARU"]
[Sat Jan 03 21:48:36.673775 2026] [:error] [pid 1929:tid 1949] [client 4.217.187.11:43638] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z.php"] [unique_id "aVkeNOcFqdpu6TNsuWrzJgAAAAs"]
[Sat Jan 03 21:48:37.474468 2026] [:error] [pid 19639:tid 19650] [client 4.217.187.11:52242] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aVkeNSQ7fWZUytnlHEwDxQAAAUk"]
[Sat Jan 03 21:48:39.402172 2026] [:error] [pid 1931:tid 2030] [client 4.217.187.11:52257] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aVkeNx8Tyw7ZoIdXlcYGQQAAAIY"]
[Sat Jan 03 21:48:42.468768 2026] [:error] [pid 1931:tid 2040] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php
[Sat Jan 03 21:48:42.606341 2026] [:error] [pid 1931:tid 2034] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Sat Jan 03 21:48:42.854684 2026] [:error] [pid 1931:tid 2027] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Sat Jan 03 21:48:43.703556 2026] [:error] [pid 1931:tid 2027] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/r4f_1.php
[Sat Jan 03 21:48:43.848489 2026] [:error] [pid 1931:tid 2041] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/031.php
[Sat Jan 03 21:48:44.023422 2026] [:error] [pid 1931:tid 2048] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/AxAo.php
[Sat Jan 03 21:48:44.178183 2026] [:error] [pid 1931:tid 2046] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/shellalfa.php
[Sat Jan 03 21:48:44.458087 2026] [:error] [pid 1931:tid 2034] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Jan 03 21:48:44.599085 2026] [:error] [pid 1931:tid 2038] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Sat Jan 03 21:48:44.759327 2026] [:error] [pid 1931:tid 2030] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Jan 03 21:48:44.929605 2026] [:error] [pid 1931:tid 1994] [client 4.217.187.11:52279] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Sat Jan 03 21:48:45.158846 2026] [:error] [pid 1931:tid 2036] [client 4.217.187.11:52279] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVkePR8Tyw7ZoIdXlcYGWQAAAIw"]
[Sat Jan 03 21:48:46.833961 2026] [:error] [pid 1930:tid 1989] [client 4.217.187.11:43612] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVkePpP-6mqhfUDa89zq2wAAAFc"]
[Sat Jan 03 21:48:48.386641 2026] [:error] [pid 31222:tid 31247] [client 4.217.187.11:43592] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVkeQKHw6nASHXAc2v_taAAAAdc"]
[Sat Jan 03 21:48:50.012994 2026] [:error] [pid 31630:tid 31651] [client 4.217.187.11:19686] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aVkeQvUV_PU2SWgLPuhmUAAAAZM"]
[Sat Jan 03 21:48:51.726919 2026] [:error] [pid 1931:tid 1996] [client 4.217.187.11:19602] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVkeQx8Tyw7ZoIdXlcYGYAAAAII"]
[Sat Jan 03 21:49:06.095090 2026] [:error] [pid 1931:tid 2027] [client 4.217.187.11:52272] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/packed.php"] [unique_id "aVkeUh8Tyw7ZoIdXlcYGbgAAAIQ"]
[Sat Jan 03 21:49:06.931261 2026] [:error] [pid 1929:tid 1950] [client 4.217.187.11:52247] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/packed.php"] [unique_id "aVkeUucFqdpu6TNsuWrzZgAAAAw"]
[Sat Jan 03 21:49:07.903378 2026] [:error] [pid 31222:tid 31243] [client 4.217.187.11:19620] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/packed.php"] [unique_id "aVkeU6Hw6nASHXAc2v_teQAAAdM"]
[Sat Jan 03 21:49:08.715109 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:19586] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/packed.php"] [unique_id "aVkeVOcFqdpu6TNsuWrzcAAAAAg"]
[Sat Jan 03 21:49:10.036482 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:19705] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVkeVucFqdpu6TNsuWrzdgAAAAE"]
[Sat Jan 03 21:49:10.888806 2026] [:error] [pid 1929:tid 1959] [client 4.217.187.11:52232] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVkeVucFqdpu6TNsuWrzewAAABU"]
[Sat Jan 03 21:49:11.849994 2026] [:error] [pid 1929:tid 1947] [client 4.217.187.11:19615] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVkeV-cFqdpu6TNsuWrzfQAAAAk"]
[Sat Jan 03 21:49:12.840310 2026] [:error] [pid 34260:tid 34286] [client 4.217.187.11:52276] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aVkeWEWWhyvZ0O9KNVQp7AAAARg"]
[Sat Jan 03 21:49:13.585038 2026] [:error] [pid 31630:tid 31642] [client 4.217.187.11:19657] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aVkeWfUV_PU2SWgLPuhmYwAAAYo"]
[Sat Jan 03 21:49:16.362966 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:52285] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aVkeXOcFqdpu6TNsuWrzhQAAAAg"]
[Sat Jan 03 21:49:18.025603 2026] [:error] [pid 34260:tid 34277] [client 4.217.187.11:19708] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aVkeXkWWhyvZ0O9KNVQp-QAAAQ8"]
[Sat Jan 03 21:49:20.197075 2026] [:error] [pid 19639:tid 19644] [client 4.217.187.11:19669] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aVkeYCQ7fWZUytnlHEwD7gAAAUM"]
[Sat Jan 03 21:49:21.543062 2026] [:error] [pid 31222:tid 31241] [client 4.217.187.11:43599] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVkeYaHw6nASHXAc2v_tkQAAAdE"]
[Sat Jan 03 21:49:25.831387 2026] [:error] [pid 34260:tid 34271] [client 4.217.187.11:19604] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVkeZUWWhyvZ0O9KNVQqCwAAAQk"]
[Sat Jan 03 21:49:27.855669 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:52271] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVkeZ-cFqdpu6TNsuWrzlAAAAAg"]
[Sat Jan 03 21:49:30.751514 2026] [:error] [pid 19639:tid 19665] [client 4.217.187.11:43600] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "aVkeaiQ7fWZUytnlHEwEBQAAAVg"]
[Sat Jan 03 21:49:32.618631 2026] [:error] [pid 1931:tid 2045] [client 4.217.187.11:52228] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "aVkebB8Tyw7ZoIdXlcYGgAAAAJU"]
[Sat Jan 03 21:49:36.964030 2026] [:error] [pid 31222:tid 31244] [client 4.217.187.11:19608] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "aVkecKHw6nASHXAc2v_tpQAAAdQ"]
[Sat Jan 03 21:49:39.833683 2026] [:error] [pid 19639:tid 19657] [client 4.217.187.11:43636] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "aVkecyQ7fWZUytnlHEwEEgAAAVA"]
[Sat Jan 03 21:49:41.825728 2026] [:error] [pid 1931:tid 2040] [client 4.217.187.11:52254] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "aVkedR8Tyw7ZoIdXlcYGiQAAAJA"]
[Sat Jan 03 21:49:43.395706 2026] [:error] [pid 2083:tid 2091] [client 4.217.187.11:43622] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mo.php"] [unique_id "aVkedzVlR_BmlMPnhV4fiAAAAMY"]
[Sat Jan 03 21:49:49.146327 2026] [:error] [pid 1929:tid 1947] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/mo.php
[Sat Jan 03 21:49:49.301278 2026] [:error] [pid 1929:tid 1958] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sat Jan 03 21:49:49.471894 2026] [:error] [pid 1929:tid 1942] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/miansha.php
[Sat Jan 03 21:49:49.654324 2026] [:error] [pid 1929:tid 1954] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Sat Jan 03 21:49:49.855814 2026] [:error] [pid 1929:tid 1941] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sat Jan 03 21:49:50.016122 2026] [:error] [pid 1929:tid 1938] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Jan 03 21:49:50.161141 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o2.php
[Sat Jan 03 21:49:50.493375 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sat Jan 03 21:49:50.805927 2026] [:error] [pid 1929:tid 1940] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/asas.php
[Sat Jan 03 21:49:50.986302 2026] [:error] [pid 1929:tid 1949] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/js.php
[Sat Jan 03 21:49:51.297208 2026] [:error] [pid 1929:tid 1952] [client 4.217.187.11:19648] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Jan 03 21:49:51.460791 2026] [:error] [pid 1929:tid 1948] [client 4.217.187.11:19648] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVkef-cFqdpu6TNsuWrztAAAAAo"]
[Sat Jan 03 21:49:54.866012 2026] [:error] [pid 1930:tid 1970] [client 4.217.187.11:43623] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVkegpP-6mqhfUDa89zrGAAAAEQ"]
[Sat Jan 03 21:49:56.277823 2026] [:error] [pid 31222:tid 31246] [client 4.217.187.11:19591] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVkehKHw6nASHXAc2v_tuwAAAdY"]
[Sat Jan 03 21:49:57.350922 2026] [:error] [pid 1931:tid 2043] [client 4.217.187.11:19588] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aVkehR8Tyw7ZoIdXlcYGogAAAJM"]
[Sat Jan 03 21:50:00.799962 2026] [:error] [pid 19639:tid 19653] [client 4.217.187.11:43608] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxin.php"] [unique_id "aVkeiCQ7fWZUytnlHEwEKAAAAUw"]
[Sat Jan 03 21:50:01.922783 2026] [:error] [pid 1930:tid 1982] [client 4.217.187.11:52256] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxin.php"] [unique_id "aVkeiZP-6mqhfUDa89zrJAAAAFA"]
[Sat Jan 03 21:50:03.840347 2026] [:error] [pid 34260:tid 34275] [client 4.217.187.11:43611] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxin.php"] [unique_id "aVkei0WWhyvZ0O9KNVQqOAAAAQ0"]
[Sat Jan 03 21:50:04.959912 2026] [:error] [pid 1929:tid 1958] [client 4.217.187.11:43642] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxin.php"] [unique_id "aVkejOcFqdpu6TNsuWrzywAAABQ"]
[Sat Jan 03 21:50:05.971251 2026] [:error] [pid 1931:tid 2045] [client 4.217.187.11:19710] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVkejR8Tyw7ZoIdXlcYGtwAAAJU"]
[Sat Jan 03 21:50:07.853882 2026] [:error] [pid 2083:tid 2095] [client 4.217.187.11:19696] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVkejzVlR_BmlMPnhV4fsAAAAMo"]
[Sat Jan 03 21:50:11.358642 2026] [:error] [pid 2083:tid 2092] [client 4.217.187.11:43615] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVkekzVlR_BmlMPnhV4fvAAAAMc"]
[Sat Jan 03 21:50:12.466263 2026] [:error] [pid 31222:tid 31226] [client 4.217.187.11:52269] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVkelKHw6nASHXAc2v_tzAAAAcI"]
[Sat Jan 03 21:50:15.003775 2026] [:error] [pid 2083:tid 2086] [client 4.217.187.11:19590] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aVkelzVlR_BmlMPnhV4fwwAAAME"]
[Sat Jan 03 21:50:17.387581 2026] [:error] [pid 31222:tid 31226] [client 4.217.187.11:43616] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aVkemaHw6nASHXAc2v_t2wAAAcI"]
[Sat Jan 03 21:50:18.941042 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:52273] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aVkemucFqdpu6TNsuWrz3gAAAAE"]
[Sat Jan 03 21:50:19.832766 2026] [:error] [pid 1930:tid 1981] [client 4.217.187.11:52252] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aVkem5P-6mqhfUDa89zrQQAAAE8"]
[Sat Jan 03 21:50:21.105020 2026] [:error] [pid 19639:tid 19660] [client 4.217.187.11:43587] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aVkenSQ7fWZUytnlHEwEOQAAAVM"]
[Sat Jan 03 21:50:22.119960 2026] [:error] [pid 1930:tid 1977] [client 4.217.187.11:43603] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aVkenpP-6mqhfUDa89zrRgAAAEs"]
[Sat Jan 03 21:50:23.352089 2026] [:error] [pid 1930:tid 1976] [client 4.217.187.11:19670] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aVken5P-6mqhfUDa89zrSgAAAEo"]
[Sat Jan 03 21:50:26.748611 2026] [:error] [pid 2083:tid 2096] [client 4.217.187.11:52278] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aVkeojVlR_BmlMPnhV4fywAAAMs"]
[Sat Jan 03 21:50:28.556728 2026] [:error] [pid 19639:tid 19643] [client 4.217.187.11:19654] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sto.php"] [unique_id "aVkepCQ7fWZUytnlHEwEPwAAAUI"]
[Sat Jan 03 21:50:29.968954 2026] [:error] [pid 1929:tid 1951] [client 4.217.187.11:52266] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sto.php"] [unique_id "aVkepecFqdpu6TNsuWrz_wAAAA0"]
[Sat Jan 03 21:50:32.007784 2026] [:error] [pid 1929:tid 1941] [client 4.217.187.11:19655] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sto.php"] [unique_id "aVkeqOcFqdpu6TNsuWr0BQAAAAM"]
[Sat Jan 03 21:50:36.865946 2026] [:error] [pid 1930:tid 1989] [client 4.217.187.11:43637] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sto.php"] [unique_id "aVkerJP-6mqhfUDa89zrXAAAAFc"]
[Sat Jan 03 21:50:38.204018 2026] [:error] [pid 1930:tid 1979] [client 4.217.187.11:19594] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aVkerpP-6mqhfUDa89zrYAAAAE0"]
[Sat Jan 03 21:50:38.810076 2026] [:error] [pid 19639:tid 19653] [client 4.217.187.11:43585] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aVkeriQ7fWZUytnlHEwESAAAAUw"]
[Sat Jan 03 21:50:42.832987 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:43586] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aVkesucFqdpu6TNsuWr0GQAAAAg"]
[Sat Jan 03 21:50:45.530712 2026] [:error] [pid 31222:tid 31226] [client 4.217.187.11:19614] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aVketaHw6nASHXAc2v_uEwAAAcI"]
[Sat Jan 03 21:50:48.316281 2026] [:error] [pid 34260:tid 34282] [client 4.217.187.11:19659] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mds.php"] [unique_id "aVkeuEWWhyvZ0O9KNVQqUgAAARQ"]
[Sat Jan 03 21:50:54.548753 2026] [:error] [pid 1930:tid 1968] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/mds.php
[Sat Jan 03 21:50:54.717008 2026] [:error] [pid 1930:tid 1966] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/fileas.php
[Sat Jan 03 21:50:55.098776 2026] [:error] [pid 1930:tid 1972] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sat Jan 03 21:50:56.137139 2026] [:error] [pid 1930:tid 1972] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Sat Jan 03 21:50:56.419807 2026] [:error] [pid 1930:tid 1989] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-gr.php
[Sat Jan 03 21:50:57.408986 2026] [:error] [pid 1930:tid 1981] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Sat Jan 03 21:50:57.546686 2026] [:error] [pid 1930:tid 1983] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/file1.php
[Sat Jan 03 21:50:57.847729 2026] [:error] [pid 1930:tid 1982] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sat Jan 03 21:50:58.356574 2026] [:error] [pid 1930:tid 1969] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sat Jan 03 21:50:58.494758 2026] [:error] [pid 1930:tid 1977] [client 4.217.187.11:19668] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Jan 03 21:50:58.629398 2026] [:error] [pid 1930:tid 1978] [client 4.217.187.11:19668] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVkewpP-6mqhfUDa89zrdQAAAEw"]
[Sat Jan 03 21:51:00.067077 2026] [:error] [pid 1931:tid 2044] [client 4.217.187.11:52277] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVkexB8Tyw7ZoIdXlcYHEwAAAJQ"]
[Sat Jan 03 21:51:01.645714 2026] [:error] [pid 1931:tid 2040] [client 4.217.187.11:19706] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVkexR8Tyw7ZoIdXlcYHGQAAAJA"]
[Sat Jan 03 21:51:04.092409 2026] [:error] [pid 31222:tid 31225] [client 4.217.187.11:52282] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVkeyKHw6nASHXAc2v_uIgAAAcE"]
[Sat Jan 03 21:51:07.824032 2026] [:error] [pid 1931:tid 2031] [client 4.217.187.11:43639] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aVkeyx8Tyw7ZoIdXlcYHOQAAAIc"]
[Sat Jan 03 21:51:09.357424 2026] [:error] [pid 34260:tid 34275] [client 4.217.187.11:52281] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aVkezUWWhyvZ0O9KNVQqegAAAQ0"]
[Sat Jan 03 21:51:13.904471 2026] [:error] [pid 2083:tid 2098] [client 4.217.187.11:19606] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aVke0TVlR_BmlMPnhV4f7QAAAM0"]
[Sat Jan 03 21:51:18.394939 2026] [:error] [pid 1931:tid 2038] [client 4.217.187.11:43626] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aVke1h8Tyw7ZoIdXlcYHTQAAAI4"]
[Sat Jan 03 21:51:20.081804 2026] [:error] [pid 1931:tid 2029] [client 4.217.187.11:43643] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owl.php"] [unique_id "aVke2B8Tyw7ZoIdXlcYHVAAAAIU"]
[Sat Jan 03 21:51:24.454026 2026] [:error] [pid 1930:tid 1975] [client 4.217.187.11:52255] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owl.php"] [unique_id "aVke3JP-6mqhfUDa89zrmQAAAEk"]
[Sat Jan 03 21:51:25.834961 2026] [:error] [pid 1929:tid 1958] [client 4.217.187.11:19671] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owl.php"] [unique_id "aVke3ecFqdpu6TNsuWr0UQAAABQ"]
[Sat Jan 03 21:51:28.299050 2026] [:error] [pid 1930:tid 1977] [client 4.217.187.11:19681] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owl.php"] [unique_id "aVke4JP-6mqhfUDa89zroQAAAEs"]
[Sat Jan 03 21:51:29.792272 2026] [:error] [pid 34260:tid 34270] [client 4.217.187.11:43620] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVke4UWWhyvZ0O9KNVQqiwAAAQg"]
[Sat Jan 03 21:51:34.018769 2026] [:error] [pid 1930:tid 1981] [client 4.217.187.11:52238] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVke5pP-6mqhfUDa89zrqQAAAE8"]
[Sat Jan 03 21:51:36.734076 2026] [:error] [pid 1930:tid 1978] [client 4.217.187.11:43630] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVke6JP-6mqhfUDa89zrrAAAAEw"]
[Sat Jan 03 21:51:38.523460 2026] [:error] [pid 1931:tid 2032] [client 4.217.187.11:19586] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVke6h8Tyw7ZoIdXlcYHaAAAAIg"]
[Sat Jan 03 21:51:40.351277 2026] [:error] [pid 31222:tid 31231] [client 4.217.187.11:43598] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVke7KHw6nASHXAc2v_uQgAAAcc"]
[Sat Jan 03 21:51:42.335712 2026] [:error] [pid 31222:tid 31246] [client 4.217.187.11:19730] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVke7qHw6nASHXAc2v_uRgAAAdY"]
[Sat Jan 03 21:51:43.160764 2026] [:error] [pid 1930:tid 1989] [client 4.217.187.11:43647] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVke75P-6mqhfUDa89zrtQAAAFc"]
[Sat Jan 03 21:51:48.245854 2026] [:error] [pid 31630:tid 31652] [client 4.217.187.11:52267] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dlu.php"] [unique_id "aVke9PUV_PU2SWgLPuhm3QAAAZQ"]
[Sat Jan 03 21:51:49.735047 2026] [:error] [pid 1930:tid 1983] [client 4.217.187.11:19673] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aVke9ZP-6mqhfUDa89zrxgAAAFE"]
[Sat Jan 03 21:51:51.748192 2026] [:error] [pid 19639:tid 19662] [client 4.217.187.11:52243] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aVke9yQ7fWZUytnlHEwEbgAAAVU"]
[Sat Jan 03 21:51:55.595294 2026] [:error] [pid 1929:tid 1952] [client 4.217.187.11:52253] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3.php"] [unique_id "aVke--cFqdpu6TNsuWr0fAAAAA4"]
[Sat Jan 03 21:52:05.335393 2026] [:error] [pid 2083:tid 2101] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Jan 03 21:52:05.473941 2026] [:error] [pid 2083:tid 2087] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Sat Jan 03 21:52:05.617000 2026] [:error] [pid 2083:tid 2093] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sat Jan 03 21:52:05.783718 2026] [:error] [pid 2083:tid 2094] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-is.php
[Sat Jan 03 21:52:05.945798 2026] [:error] [pid 2083:tid 2100] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv2.php
[Sat Jan 03 21:52:06.094349 2026] [:error] [pid 2083:tid 2090] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/ftp.php
[Sat Jan 03 21:52:06.298236 2026] [:error] [pid 2083:tid 2096] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/ouh.php
[Sat Jan 03 21:52:06.439800 2026] [:error] [pid 2083:tid 2107] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sat Jan 03 21:52:06.579066 2026] [:error] [pid 2083:tid 2106] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sat Jan 03 21:52:06.716347 2026] [:error] [pid 2083:tid 2097] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/mws.php
[Sat Jan 03 21:52:06.851965 2026] [:error] [pid 2083:tid 2086] [client 4.217.187.11:19607] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat Jan 03 21:52:07.171336 2026] [:error] [pid 2083:tid 2098] [client 4.217.187.11:19607] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVkfBzVlR_BmlMPnhV4gMwAAAM0"]
[Sat Jan 03 21:52:07.761933 2026] [:error] [pid 1929:tid 1948] [client 4.217.187.11:19667] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVkfB-cFqdpu6TNsuWr0kAAAAAo"]
[Sat Jan 03 21:52:09.251035 2026] [:error] [pid 1931:tid 2036] [client 4.217.187.11:52258] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVkfCR8Tyw7ZoIdXlcYHoQAAAIw"]
[Sat Jan 03 21:52:10.027644 2026] [:error] [pid 2083:tid 2106] [client 4.217.187.11:43605] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVkfCjVlR_BmlMPnhV4gQgAAANU"]
[Sat Jan 03 21:52:11.008176 2026] [:error] [pid 1929:tid 1944] [client 4.217.187.11:43632] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aVkfC-cFqdpu6TNsuWr0lQAAAAY"]
[Sat Jan 03 21:52:14.217566 2026] [:error] [pid 1931:tid 2036] [client 4.217.187.11:52280] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aVkfDh8Tyw7ZoIdXlcYHsgAAAIw"]
[Sat Jan 03 21:52:16.843140 2026] [:error] [pid 1929:tid 1938] [client 4.217.187.11:52235] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aVkfEOcFqdpu6TNsuWr0mwAAAAA"]
[Sat Jan 03 21:52:19.412569 2026] [:error] [pid 1930:tid 1983] [client 4.217.187.11:52251] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aVkfE5P-6mqhfUDa89zsFQAAAFE"]
[Sat Jan 03 21:52:22.231945 2026] [:error] [pid 1930:tid 1984] [client 4.217.187.11:43607] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/555.php"] [unique_id "aVkfFpP-6mqhfUDa89zsIgAAAFI"]
[Sat Jan 03 21:52:25.342267 2026] [:error] [pid 31630:tid 31634] [client 4.217.187.11:43597] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/555.php"] [unique_id "aVkfGfUV_PU2SWgLPuhnGgAAAYI"]
[Sat Jan 03 21:52:27.085384 2026] [:error] [pid 1930:tid 1966] [client 4.217.187.11:19683] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/555.php"] [unique_id "aVkfG5P-6mqhfUDa89zsKQAAAEA"]
[Sat Jan 03 21:52:29.916165 2026] [:error] [pid 34260:tid 34277] [client 4.217.187.11:43591] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/555.php"] [unique_id "aVkfHUWWhyvZ0O9KNVQqxAAAAQ8"]
[Sat Jan 03 21:52:33.506697 2026] [:error] [pid 31222:tid 31247] [client 4.217.187.11:19666] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/33.php"] [unique_id "aVkfIaHw6nASHXAc2v_unwAAAdc"]
[Sat Jan 03 21:52:39.094380 2026] [:error] [pid 31630:tid 31639] [client 4.217.187.11:52233] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/33.php"] [unique_id "aVkfJ_UV_PU2SWgLPuhnOwAAAYc"]
[Sat Jan 03 21:52:41.171239 2026] [:error] [pid 2083:tid 2107] [client 4.217.187.11:52250] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/33.php"] [unique_id "aVkfKTVlR_BmlMPnhV4gaQAAANY"]
[Sat Jan 03 21:52:46.614577 2026] [:error] [pid 31222:tid 31233] [client 4.217.187.11:19684] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aVkfLqHw6nASHXAc2v_uqgAAAck"]
[Sat Jan 03 21:52:48.298685 2026] [:error] [pid 19639:tid 19649] [client 4.217.187.11:52226] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aVkfMCQ7fWZUytnlHEwEqgAAAUg"]
[Sat Jan 03 21:52:52.357996 2026] [:error] [pid 2083:tid 2087] [client 4.217.187.11:52225] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aVkfNDVlR_BmlMPnhV4gcAAAAMI"]
[Sat Jan 03 21:52:54.054182 2026] [:error] [pid 2083:tid 2086] [client 4.217.187.11:52248] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aVkfNjVlR_BmlMPnhV4gdQAAAME"]
[Sat Jan 03 21:52:55.541717 2026] [:error] [pid 34260:tid 34285] [client 4.217.187.11:43594] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVkfN0WWhyvZ0O9KNVQq1QAAARc"]
[Sat Jan 03 21:52:56.463674 2026] [:error] [pid 1931:tid 2045] [client 4.217.187.11:43646] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVkfOB8Tyw7ZoIdXlcYH9wAAAJU"]
[Sat Jan 03 21:52:57.732668 2026] [:error] [pid 19639:tid 19658] [client 4.217.187.11:52236] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVkfOSQ7fWZUytnlHEwErgAAAVE"]
[Sat Jan 03 21:52:59.857208 2026] [:error] [pid 2083:tid 2091] [client 4.217.187.11:52242] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVkfOzVlR_BmlMPnhV4gewAAAMY"]
[Sat Jan 03 21:53:00.874040 2026] [:error] [pid 1929:tid 1947] [client 4.217.187.11:43604] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aVkfPOcFqdpu6TNsuWr0zQAAAAk"]
[Sat Jan 03 21:53:02.672418 2026] [:error] [pid 1930:tid 1977] [client 4.217.187.11:52275] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aVkfPpP-6mqhfUDa89zsOgAAAEs"]
[Sat Jan 03 21:53:03.256110 2026] [:error] [pid 19639:tid 19647] [client 4.217.187.11:19663] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aVkfPyQ7fWZUytnlHEwEtQAAAUY"]
[Sat Jan 03 21:53:04.456209 2026] [:error] [pid 31222:tid 31233] [client 4.217.187.11:52260] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lo.php"] [unique_id "aVkfQKHw6nASHXAc2v_uwAAAAck"]
[Sat Jan 03 21:53:06.454017 2026] [:error] [pid 1931:tid 1996] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/file32.php
[Sat Jan 03 21:53:06.620547 2026] [:error] [pid 1931:tid 2046] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/ava.php
[Sat Jan 03 21:53:06.758957 2026] [:error] [pid 1931:tid 2027] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sat Jan 03 21:53:08.157692 2026] [:error] [pid 1931:tid 2027] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/o.php
[Sat Jan 03 21:53:08.309732 2026] [:error] [pid 1931:tid 1999] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sat Jan 03 21:53:08.447960 2026] [:error] [pid 1931:tid 2037] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/noe.php
[Sat Jan 03 21:53:08.587248 2026] [:error] [pid 1931:tid 2038] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/wfile.php
[Sat Jan 03 21:53:08.759167 2026] [:error] [pid 1931:tid 2047] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/about3.php
[Sat Jan 03 21:53:08.897137 2026] [:error] [pid 1931:tid 2029] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/gelap.php
[Sat Jan 03 21:53:09.035387 2026] [:error] [pid 1931:tid 2045] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Jan 03 21:53:09.203272 2026] [:error] [pid 1931:tid 2040] [client 4.217.187.11:43627] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sat Jan 03 21:53:09.353935 2026] [:error] [pid 1931:tid 2030] [client 4.217.187.11:43627] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aVkfRR8Tyw7ZoIdXlcYIBwAAAIY"]
[Sat Jan 03 21:53:10.769895 2026] [:error] [pid 34260:tid 34264] [client 4.217.187.11:52261] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aVkfRkWWhyvZ0O9KNVQq3gAAAQI"]
[Sat Jan 03 21:53:12.004685 2026] [:error] [pid 31222:tid 31246] [client 4.217.187.11:19711] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aVkfSKHw6nASHXAc2v_uwgAAAdY"]
[Sat Jan 03 21:53:15.012126 2026] [:error] [pid 1931:tid 2031] [client 4.217.187.11:52263] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aVkfSx8Tyw7ZoIdXlcYICwAAAIc"]
[Sat Jan 03 21:53:17.907536 2026] [:error] [pid 1930:tid 1980] [client 4.217.187.11:43645] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVkfTZP-6mqhfUDa89zsSQAAAE4"]
[Sat Jan 03 21:53:19.171918 2026] [:error] [pid 1931:tid 2036] [client 4.217.187.11:43621] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVkfTx8Tyw7ZoIdXlcYIEgAAAIw"]
[Sat Jan 03 21:53:20.544969 2026] [:error] [pid 34260:tid 34276] [client 4.217.187.11:19703] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVkfUEWWhyvZ0O9KNVQq6AAAAQ4"]
[Sat Jan 03 21:53:21.672047 2026] [:error] [pid 34260:tid 34265] [client 4.217.187.11:43601] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVkfUUWWhyvZ0O9KNVQq6gAAAQM"]
[Sat Jan 03 21:53:23.078749 2026] [:error] [pid 31630:tid 31656] [client 4.217.187.11:43613] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/up.php"] [unique_id "aVkfU_UV_PU2SWgLPuhnXgAAAZg"]
[Sat Jan 03 21:53:23.734481 2026] [:error] [pid 1929:tid 1948] [client 4.217.187.11:19705] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/up.php"] [unique_id "aVkfU-cFqdpu6TNsuWr07QAAAAo"]
[Sat Jan 03 21:53:27.252031 2026] [:error] [pid 2083:tid 2098] [client 4.217.187.11:19680] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/up.php"] [unique_id "aVkfVzVlR_BmlMPnhV4giAAAAM0"]
[Sat Jan 03 21:53:28.689264 2026] [:error] [pid 2083:tid 2104] [client 4.217.187.11:52287] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/up.php"] [unique_id "aVkfWDVlR_BmlMPnhV4gigAAANM"]
[Sat Jan 03 21:53:29.381153 2026] [:error] [pid 1929:tid 1962] [client 4.217.187.11:52244] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inde.php"] [unique_id "aVkfWecFqdpu6TNsuWr09wAAABg"]
[Sat Jan 03 21:53:30.322629 2026] [:error] [pid 1931:tid 2035] [client 4.217.187.11:52285] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inde.php"] [unique_id "aVkfWh8Tyw7ZoIdXlcYIGAAAAIs"]
[Sat Jan 03 21:53:32.966674 2026] [:error] [pid 34260:tid 34268] [client 4.217.187.11:43629] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inde.php"] [unique_id "aVkfXEWWhyvZ0O9KNVQq-AAAAQY"]
[Sat Jan 03 21:53:35.101200 2026] [:error] [pid 19639:tid 19641] [client 4.217.187.11:19685] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inde.php"] [unique_id "aVkfXyQ7fWZUytnlHEwExAAAAUA"]
[Sat Jan 03 21:53:36.771512 2026] [:error] [pid 19639:tid 19644] [client 4.217.187.11:52264] [client 4.217.187.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aVkfYCQ7fWZUytnlHEwEyQAAAUM"]
[Sat Jan 03 21:53:37.776986 2026] [:error] [pid 34260:tid 34266] [client 4.217.187.11:43614] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkfYUWWhyvZ0O9KNVQrCgAAAQQ"]
[Sat Jan 03 21:53:40.413352 2026] [:error] [pid 31630:tid 31642] [client 4.217.187.11:43602] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkfZPUV_PU2SWgLPuhncAAAAYo"]
[Sat Jan 03 21:53:42.982223 2026] [:error] [pid 31630:tid 31640] [client 4.217.187.11:43624] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkfZvUV_PU2SWgLPuhncwAAAYg"]
[Sat Jan 03 21:53:46.361251 2026] [:error] [pid 19639:tid 19656] [client 4.217.187.11:19587] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkfaiQ7fWZUytnlHEwE1QAAAU8"]
[Sat Jan 03 21:53:48.765869 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:43618] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aVkfbOcFqdpu6TNsuWr1FAAAAAg"]
[Sat Jan 03 21:53:49.992354 2026] [:error] [pid 1929:tid 1960] [client 4.217.187.11:52286] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aVkfbecFqdpu6TNsuWr1HAAAABY"]
[Sat Jan 03 21:53:54.306823 2026] [:error] [pid 1929:tid 1961] [client 4.217.187.11:52276] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aVkfcucFqdpu6TNsuWr1KAAAABc"]
[Sat Jan 03 21:53:58.421460 2026] [:error] [pid 31222:tid 31235] [client 4.217.187.11:52265] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aVkfdqHw6nASHXAc2v_u4wAAAcs"]
[Sat Jan 03 21:54:02.362705 2026] [:error] [pid 34260:tid 34267] [client 4.217.187.11:19679] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aVkfekWWhyvZ0O9KNVQrMgAAAQU"]
[Sat Jan 03 21:54:05.194469 2026] [:error] [pid 1931:tid 2027] [client 4.217.187.11:43592] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aVkffR8Tyw7ZoIdXlcYINQAAAIQ"]
[Sat Jan 03 21:54:06.409935 2026] [:error] [pid 31222:tid 31238] [client 4.217.187.11:43588] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aVkffqHw6nASHXAc2v_u5wAAAc4"]
[Sat Jan 03 21:54:10.456037 2026] [:error] [pid 34260:tid 34265] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sat Jan 03 21:54:10.650193 2026] [:error] [pid 34260:tid 34276] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sat Jan 03 21:54:10.979581 2026] [:error] [pid 34260:tid 34282] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sat Jan 03 21:54:11.331660 2026] [:error] [pid 34260:tid 34270] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/an7.php
[Sat Jan 03 21:54:11.469367 2026] [:error] [pid 34260:tid 34277] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Jan 03 21:54:11.883838 2026] [:error] [pid 34260:tid 34272] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Jan 03 21:54:12.129618 2026] [:error] [pid 34260:tid 34286] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/ffile.php
[Sat Jan 03 21:54:12.343450 2026] [:error] [pid 34260:tid 34263] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Jan 03 21:54:12.507172 2026] [:error] [pid 34260:tid 34275] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sat Jan 03 21:54:12.646923 2026] [:error] [pid 34260:tid 34267] [client 4.217.187.11:52224] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sat Jan 03 21:54:12.794057 2026] [:error] [pid 34260:tid 34264] [client 4.217.187.11:52224] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aVkfhEWWhyvZ0O9KNVQrUQAAAQI"]
[Sat Jan 03 21:54:14.126409 2026] [:error] [pid 1931:tid 2043] [client 4.217.187.11:19698] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aVkfhh8Tyw7ZoIdXlcYIPQAAAJM"]
[Sat Jan 03 21:54:17.470894 2026] [:error] [pid 1931:tid 2041] [client 4.217.187.11:43599] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aVkfiR8Tyw7ZoIdXlcYIRgAAAJE"]
[Sat Jan 03 21:54:18.749222 2026] [:error] [pid 1930:tid 1970] [client 4.217.187.11:52231] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aVkfipP-6mqhfUDa89zsVgAAAEQ"]
[Sat Jan 03 21:54:20.551858 2026] [:error] [pid 31222:tid 31230] [client 4.217.187.11:52249] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aVkfjKHw6nASHXAc2v_u-QAAAcY"]
[Sat Jan 03 21:54:23.610858 2026] [:error] [pid 1931:tid 2042] [client 4.217.187.11:43634] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aVkfjx8Tyw7ZoIdXlcYIUwAAAJI"]
[Sat Jan 03 21:54:27.938951 2026] [:error] [pid 1931:tid 2031] [client 4.217.187.11:43631] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aVkfkx8Tyw7ZoIdXlcYIWQAAAIc"]
[Sat Jan 03 21:54:31.569525 2026] [:error] [pid 31222:tid 31244] [client 4.217.187.11:19699] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aVkfl6Hw6nASHXAc2v_vAAAAAdQ"]
[Sat Jan 03 21:54:36.077229 2026] [:error] [pid 19639:tid 19648] [client 4.217.187.11:52245] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lol.php"] [unique_id "aVkfnCQ7fWZUytnlHEwE3QAAAUc"]
[Sat Jan 03 21:54:37.169369 2026] [:error] [pid 1931:tid 2031] [client 4.217.187.11:19609] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lol.php"] [unique_id "aVkfnR8Tyw7ZoIdXlcYIaQAAAIc"]
[Sat Jan 03 21:54:39.932187 2026] [:error] [pid 1931:tid 2042] [client 4.217.187.11:19713] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lol.php"] [unique_id "aVkfnx8Tyw7ZoIdXlcYIbAAAAJI"]
[Sat Jan 03 21:54:41.251150 2026] [:error] [pid 19639:tid 19652] [client 4.217.187.11:43609] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lol.php"] [unique_id "aVkfoSQ7fWZUytnlHEwE3gAAAUs"]
[Sat Jan 03 21:54:42.950364 2026] [:error] [pid 31630:tid 31632] [client 4.217.187.11:43617] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aVkfovUV_PU2SWgLPuhnnAAAAYA"]
[Sat Jan 03 21:54:47.042849 2026] [:error] [pid 1930:tid 1978] [client 4.217.187.11:19664] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aVkfp5P-6mqhfUDa89zsWAAAAEw"]
[Sat Jan 03 21:54:47.673735 2026] [:error] [pid 2083:tid 2108] [client 4.217.187.11:43615] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aVkfpzVlR_BmlMPnhV4gqwAAANc"]
[Sat Jan 03 21:54:49.867363 2026] [:error] [pid 1930:tid 1985] [client 4.217.187.11:19672] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aVkfqZP-6mqhfUDa89zsWQAAAFM"]
[Sat Jan 03 21:54:52.211190 2026] [:error] [pid 1930:tid 1990] [client 4.217.187.11:43603] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cccc.php"] [unique_id "aVkfrJP-6mqhfUDa89zsWwAAAFg"]
[Sat Jan 03 21:54:55.060812 2026] [:error] [pid 1930:tid 1988] [client 4.217.187.11:43589] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cccc.php"] [unique_id "aVkfr5P-6mqhfUDa89zsXQAAAFY"]
[Sat Jan 03 21:54:57.005361 2026] [:error] [pid 2083:tid 2095] [client 4.217.187.11:43611] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cccc.php"] [unique_id "aVkfsTVlR_BmlMPnhV4grQAAAMo"]
[Sat Jan 03 21:55:00.598240 2026] [:error] [pid 34260:tid 34262] [client 4.217.187.11:52283] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cccc.php"] [unique_id "aVkftEWWhyvZ0O9KNVQraAAAAQA"]
[Sat Jan 03 21:55:02.556931 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:19712] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aVkftucFqdpu6TNsuWr1RgAAAAg"]
[Sat Jan 03 21:55:07.187168 2026] [:error] [pid 1929:tid 1947] [client 4.217.187.11:43644] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aVkfu-cFqdpu6TNsuWr1SgAAAAk"]
[Sat Jan 03 21:55:13.517563 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/sko.php
[Sat Jan 03 21:55:13.683307 2026] [:error] [pid 1929:tid 1948] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Sat Jan 03 21:55:15.037658 2026] [:error] [pid 1929:tid 1948] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq.php
[Sat Jan 03 21:55:15.179066 2026] [:error] [pid 1929:tid 1951] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Jan 03 21:55:15.336823 2026] [:error] [pid 1929:tid 1955] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Jan 03 21:55:15.672747 2026] [:error] [pid 1929:tid 1945] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Sat Jan 03 21:55:15.811692 2026] [:error] [pid 1929:tid 1946] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/ana.php
[Sat Jan 03 21:55:15.952933 2026] [:error] [pid 1929:tid 1957] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Sat Jan 03 21:55:16.095262 2026] [:error] [pid 1929:tid 1958] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sat Jan 03 21:55:16.489170 2026] [:error] [pid 1929:tid 1949] [client 4.217.187.11:43608] File does not exist: /usr/local/apache/htdocs/suspended-page/she.php
[Sat Jan 03 21:55:16.752923 2026] [:error] [pid 1929:tid 1956] [client 4.217.187.11:43608] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVkfxOcFqdpu6TNsuWr1WgAAABI"]
[Sat Jan 03 21:55:18.255387 2026] [:error] [pid 31222:tid 31226] [client 4.217.187.11:43612] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVkfxqHw6nASHXAc2v_vBgAAAcI"]
[Sat Jan 03 21:55:20.305716 2026] [:error] [pid 19639:tid 19655] [client 4.217.187.11:19650] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVkfyCQ7fWZUytnlHEwE5gAAAU4"]
[Sat Jan 03 21:55:21.823226 2026] [:error] [pid 1931:tid 2034] [client 4.217.187.11:43640] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVkfyR8Tyw7ZoIdXlcYIgwAAAIo"]
[Sat Jan 03 21:55:23.760641 2026] [:error] [pid 1929:tid 1942] [client 4.217.187.11:43628] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVkfy-cFqdpu6TNsuWr1WwAAAAQ"]
[Sat Jan 03 21:55:31.152497 2026] [:error] [pid 1929:tid 1960] [client 4.217.187.11:19668] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVkf0-cFqdpu6TNsuWr1XgAAABY"]
[Sat Jan 03 21:55:32.937161 2026] [:error] [pid 1931:tid 2036] [client 4.217.187.11:19657] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVkf1B8Tyw7ZoIdXlcYIlQAAAIw"]
[Sat Jan 03 21:55:34.730811 2026] [:error] [pid 1929:tid 1939] [client 4.217.187.11:19690] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVkf1ucFqdpu6TNsuWr1YQAAAAE"]
[Sat Jan 03 21:55:35.440860 2026] [:error] [pid 2083:tid 2089] [client 4.217.187.11:52252] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVkf1zVlR_BmlMPnhV4grwAAAMQ"]
[Sat Jan 03 21:55:37.279720 2026] [:error] [pid 1929:tid 1940] [client 4.217.187.11:52272] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVkf2ecFqdpu6TNsuWr1ZAAAAAI"]
[Sat Jan 03 21:55:40.322482 2026] [:error] [pid 34260:tid 34284] [client 4.217.187.11:19648] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVkf3EWWhyvZ0O9KNVQrbAAAARY"]
[Sat Jan 03 21:55:42.764846 2026] [:error] [pid 31222:tid 31247] [client 4.217.187.11:52255] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVkf3qHw6nASHXAc2v_vEQAAAdc"]
[Sat Jan 03 21:55:46.328895 2026] [:error] [pid 34260:tid 34263] [client 4.217.187.11:52239] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVkf4kWWhyvZ0O9KNVQrbwAAAQE"]
[Sat Jan 03 21:55:49.561026 2026] [:error] [pid 1931:tid 2046] [client 4.217.187.11:19694] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVkf5R8Tyw7ZoIdXlcYIoQAAAJY"]
[Sat Jan 03 21:55:50.353360 2026] [:error] [pid 1929:tid 1961] [client 4.217.187.11:19696] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVkf5ucFqdpu6TNsuWr1bQAAABc"]
[Sat Jan 03 21:55:51.845433 2026] [:error] [pid 31630:tid 31636] [client 4.217.187.11:52279] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVkf5_UV_PU2SWgLPuhnqgAAAYQ"]
[Sat Jan 03 21:55:53.073079 2026] [:error] [pid 1931:tid 2032] [client 4.217.187.11:52266] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aVkf6R8Tyw7ZoIdXlcYIpgAAAIg"]
[Sat Jan 03 21:55:57.291736 2026] [:error] [pid 31630:tid 31641] [client 4.217.187.11:52269] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aVkf7fUV_PU2SWgLPuhnrAAAAYk"]
[Sat Jan 03 21:56:06.653352 2026] [:error] [pid 19639:tid 19652] [client 4.217.187.11:52256] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aVkf9iQ7fWZUytnlHEwE6QAAAUs"]
[Sat Jan 03 21:56:08.639275 2026] [:error] [pid 1930:tid 1986] [client 4.217.187.11:19665] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVkf-JP-6mqhfUDa89zsZQAAAFQ"]
[Sat Jan 03 21:56:12.891131 2026] [:error] [pid 1929:tid 1941] [client 4.217.187.11:43585] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVkf_OcFqdpu6TNsuWr1hwAAAAM"]
[Sat Jan 03 21:56:14.525012 2026] [:error] [pid 34260:tid 34280] [client 4.217.187.11:52282] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVkf_kWWhyvZ0O9KNVQrcAAAARI"]
[Sat Jan 03 21:56:15.469735 2026] [:error] [pid 2083:tid 2091] [client 4.217.187.11:19733] [client 4.217.187.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVkf_zVlR_BmlMPnhV4guAAAAMY"]
[Sat Jan 03 21:56:16.436845 2026] [:error] [pid 31630:tid 31650] [client 4.217.187.11:52253] File does not exist: /usr/local/apache/htdocs/suspended-page/love.php
[Sat Jan 03 21:56:16.594752 2026] [:error] [pid 31630:tid 31635] [client 4.217.187.11:52253] File does not exist: /usr/local/apache/htdocs/suspended-page/wso3.php
[Sat Jan 03 21:56:16.732873 2026] [:error] [pid 31630:tid 31634] [client 4.217.187.11:52253] File does not exist: /usr/local/apache/htdocs/suspended-page/x7.php
[Sat Jan 03 21:56:16.912756 2026] [:error] [pid 31630:tid 31644] [client 4.217.187.11:52253] File does not exist: /usr/local/apache/htdocs/suspended-page/xxl.php
[Sat Jan 03 22:39:43.344335 2026] [:error] [pid 2083:tid 2092] [client 43.130.139.136:38212] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVkqLzVlR_BmlMPnhV4nwgAAAMc"]
[Sat Jan 03 23:05:34.938021 2026] [:error] [pid 31222:tid 31237] [client 43.135.142.7:53558] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVkwPqHw6nASHXAc2v_8pAAAAc0"]
[Sat Jan 03 23:19:02.926881 2026] [:error] [pid 31630:tid 31641] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzw9t.php
[Sat Jan 03 23:19:03.022178 2026] [:error] [pid 31630:tid 31640] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/klwc.php
[Sat Jan 03 23:19:03.112437 2026] [:error] [pid 31630:tid 31654] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/klbnm.php
[Sat Jan 03 23:19:03.204285 2026] [:error] [pid 31630:tid 31635] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/bkxzo.php
[Sat Jan 03 23:19:03.304547 2026] [:error] [pid 31630:tid 31637] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/zde.php
[Sat Jan 03 23:19:03.403710 2026] [:error] [pid 31630:tid 31636] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/ifm.php
[Sat Jan 03 23:19:03.494881 2026] [:error] [pid 31630:tid 31656] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/redi.php
[Sat Jan 03 23:19:03.584663 2026] [:error] [pid 31630:tid 31646] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/fns.php
[Sat Jan 03 23:19:03.674462 2026] [:error] [pid 31630:tid 31652] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/pent.php
[Sat Jan 03 23:19:03.800839 2026] [:error] [pid 31630:tid 31648] [client 4.193.194.67:22670] File does not exist: /usr/local/apache/htdocs/suspended-page/wsx.php
[Sat Jan 03 23:19:03.888447 2026] [:error] [pid 31630:tid 31642] [client 4.193.194.67:22670] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r79.php"] [unique_id "aVkzZ_UV_PU2SWgLPuh4CgAAAYo"]
[Sat Jan 03 23:19:04.117897 2026] [:error] [pid 1931:tid 2033] [client 4.193.194.67:22699] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r79.php"] [unique_id "aVkzaB8Tyw7ZoIdXlcYlvwAAAIk"]
[Sat Jan 03 23:19:04.349291 2026] [:error] [pid 31630:tid 31653] [client 4.193.194.67:22663] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r79.php"] [unique_id "aVkzaPUV_PU2SWgLPuh4DAAAAZU"]
[Sat Jan 03 23:19:04.547228 2026] [:error] [pid 31630:tid 31655] [client 4.193.194.67:22623] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r79.php"] [unique_id "aVkzaPUV_PU2SWgLPuh4DQAAAZc"]
[Sat Jan 03 23:19:04.829005 2026] [:error] [pid 1930:tid 1976] [client 4.193.194.67:22704] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVkzaJP-6mqhfUDa89z7cgAAAEo"]
[Sat Jan 03 23:19:05.051084 2026] [:error] [pid 31630:tid 31644] [client 4.193.194.67:22611] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVkzafUV_PU2SWgLPuh4DgAAAYw"]
[Sat Jan 03 23:19:05.261909 2026] [:error] [pid 1929:tid 1947] [client 4.193.194.67:22605] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVkzaecFqdpu6TNsuWoK_AAAAAk"]
[Sat Jan 03 23:19:05.517276 2026] [:error] [pid 1930:tid 1982] [client 4.193.194.67:22596] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVkzaZP-6mqhfUDa89z7dgAAAFA"]
[Sat Jan 03 23:19:05.713735 2026] [:error] [pid 1931:tid 2027] [client 4.193.194.67:22607] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVkzaR8Tyw7ZoIdXlcYlyAAAAIQ"]
[Sat Jan 03 23:19:05.920218 2026] [:error] [pid 1929:tid 1960] [client 4.193.194.67:22708] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVkzaecFqdpu6TNsuWoK_QAAABY"]
[Sat Jan 03 23:19:06.134859 2026] [:error] [pid 1929:tid 1956] [client 4.193.194.67:22599] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVkzaucFqdpu6TNsuWoK_wAAABI"]
[Sat Jan 03 23:19:06.420072 2026] [:error] [pid 31222:tid 31227] [client 4.193.194.67:22715] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVkzaqHw6nASHXAc2v8AzwAAAcM"]
[Sat Jan 03 23:19:06.722819 2026] [:error] [pid 31222:tid 31230] [client 4.193.194.67:22658] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RsR.php"] [unique_id "aVkzaqHw6nASHXAc2v8A0AAAAcY"]
[Sat Jan 03 23:19:06.918660 2026] [:error] [pid 31630:tid 31638] [client 4.193.194.67:22694] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RsR.php"] [unique_id "aVkzavUV_PU2SWgLPuh4EQAAAYY"]
[Sat Jan 03 23:19:07.105848 2026] [:error] [pid 19639:tid 19651] [client 4.193.194.67:22677] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RsR.php"] [unique_id "aVkzayQ7fWZUytnlHEwTrQAAAUo"]
[Sat Jan 03 23:19:07.289184 2026] [:error] [pid 19639:tid 19656] [client 4.193.194.67:22719] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RsR.php"] [unique_id "aVkzayQ7fWZUytnlHEwTrwAAAU8"]
[Sat Jan 03 23:19:07.502358 2026] [:error] [pid 31630:tid 31643] [client 4.193.194.67:22691] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ouh.php"] [unique_id "aVkza_UV_PU2SWgLPuh4EgAAAYs"]
[Sat Jan 03 23:19:07.697471 2026] [:error] [pid 34260:tid 34285] [client 4.193.194.67:22667] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ouh.php"] [unique_id "aVkza0WWhyvZ0O9KNVQ9agAAARc"]
[Sat Jan 03 23:19:07.981011 2026] [:error] [pid 1931:tid 2036] [client 4.193.194.67:22617] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ouh.php"] [unique_id "aVkzax8Tyw7ZoIdXlcYl0QAAAIw"]
[Sat Jan 03 23:19:08.205186 2026] [:error] [pid 31630:tid 31649] [client 4.193.194.67:22681] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ouh.php"] [unique_id "aVkzbPUV_PU2SWgLPuh4FQAAAZE"]
[Sat Jan 03 23:19:08.479043 2026] [:error] [pid 1929:tid 1959] [client 4.193.194.67:22595] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "aVkzbOcFqdpu6TNsuWoLBQAAABU"]
[Sat Jan 03 23:19:08.690960 2026] [:error] [pid 1929:tid 1961] [client 4.193.194.67:22713] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "aVkzbOcFqdpu6TNsuWoLBgAAABc"]
[Sat Jan 03 23:19:08.887243 2026] [:error] [pid 31222:tid 31247] [client 4.193.194.67:22627] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "aVkzbKHw6nASHXAc2v8A0wAAAdc"]
[Sat Jan 03 23:19:09.071647 2026] [:error] [pid 34260:tid 34286] [client 4.193.194.67:22621] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "aVkzbUWWhyvZ0O9KNVQ9bAAAARg"]
[Sat Jan 03 23:19:09.269083 2026] [:error] [pid 1930:tid 1986] [client 4.193.194.67:22656] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file10.php"] [unique_id "aVkzbZP-6mqhfUDa89z7egAAAFQ"]
[Sat Jan 03 23:19:09.465694 2026] [:error] [pid 19639:tid 19648] [client 4.193.194.67:22615] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file10.php"] [unique_id "aVkzbSQ7fWZUytnlHEwTsgAAAUc"]
[Sat Jan 03 23:19:09.663619 2026] [:error] [pid 34260:tid 34280] [client 4.193.194.67:22700] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file10.php"] [unique_id "aVkzbUWWhyvZ0O9KNVQ9bgAAARI"]
[Sat Jan 03 23:19:09.861671 2026] [:error] [pid 1930:tid 1981] [client 4.193.194.67:22679] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file10.php"] [unique_id "aVkzbZP-6mqhfUDa89z7fQAAAE8"]
[Sat Jan 03 23:19:10.130233 2026] [:error] [pid 1930:tid 1975] [client 4.193.194.67:22661] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hmvekhoh.php"] [unique_id "aVkzbpP-6mqhfUDa89z7fwAAAEk"]
[Sat Jan 03 23:19:10.389406 2026] [:error] [pid 34260:tid 34263] [client 4.193.194.67:22698] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hmvekhoh.php"] [unique_id "aVkzbkWWhyvZ0O9KNVQ9cwAAAQE"]
[Sat Jan 03 23:19:10.642998 2026] [:error] [pid 1930:tid 1968] [client 4.193.194.67:22696] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hmvekhoh.php"] [unique_id "aVkzbpP-6mqhfUDa89z7gQAAAEI"]
[Sat Jan 03 23:19:10.839688 2026] [:error] [pid 34260:tid 34279] [client 4.193.194.67:22689] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hmvekhoh.php"] [unique_id "aVkzbkWWhyvZ0O9KNVQ9dQAAARE"]
[Sat Jan 03 23:19:11.037968 2026] [:error] [pid 19639:tid 19663] [client 4.193.194.67:22697] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex.php"] [unique_id "aVkzbyQ7fWZUytnlHEwTtAAAAVY"]
[Sat Jan 03 23:19:11.298655 2026] [:error] [pid 34260:tid 34268] [client 4.193.194.67:22680] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex.php"] [unique_id "aVkzb0WWhyvZ0O9KNVQ9dwAAAQY"]
[Sat Jan 03 23:19:11.540959 2026] [:error] [pid 1931:tid 2046] [client 4.193.194.67:22608] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex.php"] [unique_id "aVkzbx8Tyw7ZoIdXlcYl2AAAAJY"]
[Sat Jan 03 23:19:11.738190 2026] [:error] [pid 19639:tid 19645] [client 4.193.194.67:22612] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex.php"] [unique_id "aVkzbyQ7fWZUytnlHEwTuQAAAUQ"]
[Sat Jan 03 23:19:11.973443 2026] [:error] [pid 1929:tid 1942] [client 4.193.194.67:22642] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aVkzb-cFqdpu6TNsuWoLCwAAAAQ"]
[Sat Jan 03 23:19:12.152028 2026] [:error] [pid 31222:tid 31236] [client 4.193.194.67:22603] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aVkzcKHw6nASHXAc2v8A1gAAAcw"]
[Sat Jan 03 23:19:12.374009 2026] [:error] [pid 1929:tid 1950] [client 4.193.194.67:22687] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aVkzcOcFqdpu6TNsuWoLDAAAAAw"]
[Sat Jan 03 23:19:12.594721 2026] [:error] [pid 19639:tid 19655] [client 4.193.194.67:22601] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex1.php"] [unique_id "aVkzcCQ7fWZUytnlHEwTugAAAU4"]
[Sat Jan 03 23:19:12.819852 2026] [:error] [pid 1931:tid 2031] [client 4.193.194.67:22645] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex2.php"] [unique_id "aVkzcB8Tyw7ZoIdXlcYl2wAAAIc"]
[Sat Jan 03 23:19:13.041108 2026] [:error] [pid 19639:tid 19650] [client 4.193.194.67:22688] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex2.php"] [unique_id "aVkzcSQ7fWZUytnlHEwTuwAAAUk"]
[Sat Jan 03 23:19:13.216588 2026] [:error] [pid 19639:tid 19658] [client 4.193.194.67:7154] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex2.php"] [unique_id "aVkzcSQ7fWZUytnlHEwTvAAAAVE"]
[Sat Jan 03 23:19:13.441153 2026] [:error] [pid 34260:tid 34265] [client 4.193.194.67:22703] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex2.php"] [unique_id "aVkzcUWWhyvZ0O9KNVQ9egAAAQM"]
[Sat Jan 03 23:19:13.737970 2026] [:error] [pid 31222:tid 31242] [client 4.193.194.67:22634] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex3.php"] [unique_id "aVkzcaHw6nASHXAc2v8A2QAAAdI"]
[Sat Jan 03 23:19:13.953699 2026] [:error] [pid 31222:tid 31244] [client 4.193.194.67:22654] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex3.php"] [unique_id "aVkzcaHw6nASHXAc2v8A2gAAAdQ"]
[Sat Jan 03 23:19:14.157832 2026] [:error] [pid 19639:tid 19651] [client 4.193.194.67:22635] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex3.php"] [unique_id "aVkzciQ7fWZUytnlHEwTwAAAAUo"]
[Sat Jan 03 23:19:14.376254 2026] [:error] [pid 31222:tid 31229] [client 4.193.194.67:22682] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex3.php"] [unique_id "aVkzcqHw6nASHXAc2v8A2wAAAcU"]
[Sat Jan 03 23:19:14.695797 2026] [:error] [pid 2083:tid 2108] [client 4.193.194.67:22683] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex4.php"] [unique_id "aVkzcjVlR_BmlMPnhV4xVgAAANc"]
[Sat Jan 03 23:19:14.889960 2026] [:error] [pid 19639:tid 19656] [client 4.193.194.67:22716] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex4.php"] [unique_id "aVkzciQ7fWZUytnlHEwTwwAAAU8"]
[Sat Jan 03 23:19:15.064626 2026] [:error] [pid 19639:tid 19652] [client 4.193.194.67:22614] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex4.php"] [unique_id "aVkzcyQ7fWZUytnlHEwTxQAAAUs"]
[Sat Jan 03 23:19:15.264592 2026] [:error] [pid 2083:tid 2101] [client 4.193.194.67:22711] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex4.php"] [unique_id "aVkzczVlR_BmlMPnhV4xWQAAANA"]
[Sat Jan 03 23:19:15.593705 2026] [:error] [pid 1931:tid 2038] [client 4.193.194.67:22620] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex5.php"] [unique_id "aVkzcx8Tyw7ZoIdXlcYl4AAAAI4"]
[Sat Jan 03 23:19:15.890540 2026] [:error] [pid 1931:tid 2041] [client 4.193.194.67:22714] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex5.php"] [unique_id "aVkzcx8Tyw7ZoIdXlcYl4gAAAJE"]
[Sat Jan 03 23:19:16.119723 2026] [:error] [pid 1931:tid 2036] [client 4.193.194.67:7121] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex5.php"] [unique_id "aVkzdB8Tyw7ZoIdXlcYl5gAAAIw"]
[Sat Jan 03 23:19:16.361620 2026] [:error] [pid 1929:tid 1941] [client 4.193.194.67:22613] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex5.php"] [unique_id "aVkzdOcFqdpu6TNsuWoLEgAAAAM"]
[Sat Jan 03 23:19:16.544819 2026] [:error] [pid 1931:tid 2033] [client 4.193.194.67:22602] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex6.php"] [unique_id "aVkzdB8Tyw7ZoIdXlcYl6wAAAIk"]
[Sat Jan 03 23:19:16.803275 2026] [:error] [pid 1929:tid 1947] [client 4.193.194.67:22622] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex6.php"] [unique_id "aVkzdOcFqdpu6TNsuWoLFAAAAAk"]
[Sat Jan 03 23:19:17.018128 2026] [:error] [pid 1929:tid 1944] [client 4.193.194.67:22671] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex6.php"] [unique_id "aVkzdecFqdpu6TNsuWoLFQAAAAY"]
[Sat Jan 03 23:19:17.267357 2026] [:error] [pid 2083:tid 2103] [client 4.193.194.67:22686] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex6.php"] [unique_id "aVkzdTVlR_BmlMPnhV4xXQAAANI"]
[Sat Jan 03 23:19:17.565986 2026] [:error] [pid 1929:tid 1962] [client 4.193.194.67:22665] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex7.php"] [unique_id "aVkzdecFqdpu6TNsuWoLGQAAABg"]
[Sat Jan 03 23:19:17.756990 2026] [:error] [pid 19639:tid 19644] [client 4.193.194.67:7104] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex7.php"] [unique_id "aVkzdSQ7fWZUytnlHEwTywAAAUM"]
[Sat Jan 03 23:19:17.980517 2026] [:error] [pid 2083:tid 2107] [client 4.193.194.67:22644] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex7.php"] [unique_id "aVkzdTVlR_BmlMPnhV4xXgAAANY"]
[Sat Jan 03 23:19:18.201002 2026] [:error] [pid 31222:tid 31235] [client 4.193.194.67:22597] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex7.php"] [unique_id "aVkzdqHw6nASHXAc2v8A3QAAAcs"]
[Sat Jan 03 23:19:18.419196 2026] [:error] [pid 1929:tid 1949] [client 4.193.194.67:22616] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex8.php"] [unique_id "aVkzducFqdpu6TNsuWoLHwAAAAs"]
[Sat Jan 03 23:19:18.691063 2026] [:error] [pid 31222:tid 31228] [client 4.193.194.67:22641] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex8.php"] [unique_id "aVkzdqHw6nASHXAc2v8A3wAAAcQ"]
[Sat Jan 03 23:19:18.950360 2026] [:error] [pid 34260:tid 34279] [client 4.193.194.67:22659] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex8.php"] [unique_id "aVkzdkWWhyvZ0O9KNVQ9hAAAARE"]
[Sat Jan 03 23:19:19.153618 2026] [:error] [pid 1929:tid 1952] [client 4.193.194.67:7045] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex8.php"] [unique_id "aVkzd-cFqdpu6TNsuWoLIAAAAA4"]
[Sat Jan 03 23:19:19.409280 2026] [:error] [pid 1929:tid 1951] [client 4.193.194.67:22624] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex9.php"] [unique_id "aVkzd-cFqdpu6TNsuWoLIwAAAA0"]
[Sat Jan 03 23:19:19.619489 2026] [:error] [pid 34260:tid 34268] [client 4.193.194.67:7114] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex9.php"] [unique_id "aVkzd0WWhyvZ0O9KNVQ9hwAAAQY"]
[Sat Jan 03 23:19:19.823647 2026] [:error] [pid 19639:tid 19657] [client 4.193.194.67:22673] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex9.php"] [unique_id "aVkzdyQ7fWZUytnlHEwTzwAAAVA"]
[Sat Jan 03 23:19:20.010420 2026] [:error] [pid 34260:tid 34282] [client 4.193.194.67:22646] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atex9.php"] [unique_id "aVkzeEWWhyvZ0O9KNVQ9iQAAARQ"]
[Sat Jan 03 23:19:20.266254 2026] [:error] [pid 1931:tid 1999] [client 4.193.194.67:7143] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/local.settings.php"] [unique_id "aVkzeB8Tyw7ZoIdXlcYl7QAAAIM"]
[Sat Jan 03 23:19:20.501774 2026] [:error] [pid 31630:tid 31638] [client 4.193.194.67:22626] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/local.settings.php"] [unique_id "aVkzePUV_PU2SWgLPuh4IwAAAYY"]
[Sat Jan 03 23:19:20.824928 2026] [:error] [pid 1929:tid 1958] [client 4.193.194.67:22652] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/local.settings.php"] [unique_id "aVkzeOcFqdpu6TNsuWoLJgAAABQ"]
[Sat Jan 03 23:19:21.020311 2026] [:error] [pid 34260:tid 34265] [client 4.193.194.67:22600] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/local.settings.php"] [unique_id "aVkzeUWWhyvZ0O9KNVQ9jAAAAQM"]
[Sat Jan 03 23:19:21.215683 2026] [:error] [pid 19639:tid 19650] [client 4.193.194.67:22695] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVkzeSQ7fWZUytnlHEwT0QAAAUk"]
[Sat Jan 03 23:19:21.430958 2026] [:error] [pid 34260:tid 34269] [client 4.193.194.67:22707] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVkzeUWWhyvZ0O9KNVQ9jwAAAQc"]
[Sat Jan 03 23:19:21.659675 2026] [:error] [pid 1931:tid 2043] [client 4.193.194.67:22693] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVkzeR8Tyw7ZoIdXlcYl8wAAAJM"]
[Sat Jan 03 23:19:21.863203 2026] [:error] [pid 2083:tid 2098] [client 4.193.194.67:7119] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aVkzeTVlR_BmlMPnhV4xaAAAAM0"]
[Sat Jan 03 23:19:22.274610 2026] [:error] [pid 31222:tid 31231] [client 4.193.194.67:7113] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoaps.php"] [unique_id "aVkzeqHw6nASHXAc2v8A6gAAAcc"]
[Sat Jan 03 23:19:22.472868 2026] [:error] [pid 1929:tid 1944] [client 4.193.194.67:22648] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoaps.php"] [unique_id "aVkzeucFqdpu6TNsuWoLKAAAAAY"]
[Sat Jan 03 23:19:22.700652 2026] [:error] [pid 1931:tid 2040] [client 4.193.194.67:7106] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoaps.php"] [unique_id "aVkzeh8Tyw7ZoIdXlcYl-QAAAJA"]
[Sat Jan 03 23:19:22.906896 2026] [:error] [pid 31630:tid 31639] [client 4.193.194.67:22593] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoaps.php"] [unique_id "aVkzevUV_PU2SWgLPuh4JQAAAYc"]
[Sat Jan 03 23:19:23.179197 2026] [:error] [pid 1929:tid 1948] [client 4.193.194.67:22653] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xadm-log.php"] [unique_id "aVkze-cFqdpu6TNsuWoLKwAAAAo"]
[Sat Jan 03 23:19:23.389839 2026] [:error] [pid 1931:tid 2039] [client 4.193.194.67:22619] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xadm-log.php"] [unique_id "aVkzex8Tyw7ZoIdXlcYmAAAAAI8"]
[Sat Jan 03 23:19:23.737858 2026] [:error] [pid 19639:tid 19654] [client 4.193.194.67:7065] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xadm-log.php"] [unique_id "aVkzeyQ7fWZUytnlHEwT0gAAAU0"]
[Sat Jan 03 23:19:23.984208 2026] [:error] [pid 2083:tid 2101] [client 4.193.194.67:22594] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xadm-log.php"] [unique_id "aVkzezVlR_BmlMPnhV4xawAAANA"]
[Sat Jan 03 23:19:24.333767 2026] [:error] [pid 1929:tid 1949] [client 4.193.194.67:7128] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/codex.php"] [unique_id "aVkzfOcFqdpu6TNsuWoLMgAAAAs"]
[Sat Jan 03 23:19:24.531873 2026] [:error] [pid 19639:tid 19656] [client 4.193.194.67:22702] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/codex.php"] [unique_id "aVkzfCQ7fWZUytnlHEwT1gAAAU8"]
[Sat Jan 03 23:19:24.729890 2026] [:error] [pid 31222:tid 31235] [client 4.193.194.67:7118] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/codex.php"] [unique_id "aVkzfKHw6nASHXAc2v8A7gAAAcs"]
[Sat Jan 03 23:19:24.944661 2026] [:error] [pid 2083:tid 2104] [client 4.193.194.67:22640] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/codex.php"] [unique_id "aVkzfDVlR_BmlMPnhV4xbAAAANM"]
[Sat Jan 03 23:19:25.132650 2026] [:error] [pid 2083:tid 2094] [client 4.193.194.67:7043] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/code.php"] [unique_id "aVkzfTVlR_BmlMPnhV4xbQAAAMk"]
[Sat Jan 03 23:19:25.344501 2026] [:error] [pid 2083:tid 2090] [client 4.193.194.67:7117] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/code.php"] [unique_id "aVkzfTVlR_BmlMPnhV4xbwAAAMU"]
[Sat Jan 03 23:19:25.553204 2026] [:error] [pid 2083:tid 2089] [client 4.193.194.67:22650] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/code.php"] [unique_id "aVkzfTVlR_BmlMPnhV4xcAAAAMQ"]
[Sat Jan 03 23:19:25.862588 2026] [:error] [pid 1931:tid 2045] [client 4.193.194.67:22649] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/code.php"] [unique_id "aVkzfR8Tyw7ZoIdXlcYmEgAAAJU"]
[Sat Jan 03 23:19:26.092790 2026] [:error] [pid 1929:tid 1953] [client 4.193.194.67:22717] [client 4.193.194.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/code.php"] [unique_id "aVkzfucFqdpu6TNsuWoLNgAAAA8"]
[Sat Jan 03 23:19:26.323762 2026] [:error] [pid 2083:tid 2096] [client 4.193.194.67:7044] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/neshe.php"] [unique_id "aVkzfjVlR_BmlMPnhV4xdAAAAMs"]
[Sat Jan 03 23:19:26.510399 2026] [:error] [pid 1930:tid 1984] [client 4.193.194.67:22706] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/neshe.php"] [unique_id "aVkzfpP-6mqhfUDa89z7jAAAAFI"]
[Sat Jan 03 23:19:26.758618 2026] [:error] [pid 2083:tid 2099] [client 4.193.194.67:7158] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/neshe.php"] [unique_id "aVkzfjVlR_BmlMPnhV4xdwAAAM4"]
[Sat Jan 03 23:19:27.077327 2026] [:error] [pid 1931:tid 2027] [client 4.193.194.67:22604] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asgtt.php"] [unique_id "aVkzfx8Tyw7ZoIdXlcYmFgAAAIQ"]
[Sat Jan 03 23:19:27.287741 2026] [:error] [pid 31222:tid 31239] [client 4.193.194.67:22676] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asgtt.php"] [unique_id "aVkzf6Hw6nASHXAc2v8A9AAAAc8"]
[Sat Jan 03 23:19:27.520206 2026] [:error] [pid 2083:tid 2085] [client 4.193.194.67:22609] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asgtt.php"] [unique_id "aVkzfzVlR_BmlMPnhV4xewAAAMA"]
[Sat Jan 03 23:19:27.700464 2026] [:error] [pid 2083:tid 2108] [client 4.193.194.67:22606] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asgtt.php"] [unique_id "aVkzfzVlR_BmlMPnhV4xfQAAANc"]
[Sat Jan 03 23:19:27.924797 2026] [:error] [pid 2083:tid 2091] [client 4.193.194.67:7110] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wok.php"] [unique_id "aVkzfzVlR_BmlMPnhV4xfwAAAMY"]
[Sat Jan 03 23:19:28.203664 2026] [:error] [pid 34260:tid 34262] [client 4.193.194.67:22631] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wok.php"] [unique_id "aVkzgEWWhyvZ0O9KNVQ9nQAAAQA"]
[Sat Jan 03 23:19:28.393936 2026] [:error] [pid 2083:tid 2089] [client 4.193.194.67:22709] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wok.php"] [unique_id "aVkzgDVlR_BmlMPnhV4xgQAAAMQ"]
[Sat Jan 03 23:19:28.578642 2026] [:error] [pid 1931:tid 2040] [client 4.193.194.67:7060] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wok.php"] [unique_id "aVkzgB8Tyw7ZoIdXlcYmHAAAAJA"]
[Sat Jan 03 23:19:28.790430 2026] [:error] [pid 1931:tid 2033] [client 4.193.194.67:22630] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadis.php"] [unique_id "aVkzgB8Tyw7ZoIdXlcYmHgAAAIk"]
[Sat Jan 03 23:19:29.068500 2026] [:error] [pid 1929:tid 1961] [client 4.193.194.67:7132] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadis.php"] [unique_id "aVkzgecFqdpu6TNsuWoLPQAAABc"]
[Sat Jan 03 23:19:29.270696 2026] [:error] [pid 2083:tid 2107] [client 4.193.194.67:22598] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadis.php"] [unique_id "aVkzgTVlR_BmlMPnhV4xgwAAANY"]
[Sat Jan 03 23:19:29.465991 2026] [:error] [pid 31630:tid 31634] [client 4.193.194.67:7126] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadis.php"] [unique_id "aVkzgfUV_PU2SWgLPuh4JwAAAYI"]
[Sat Jan 03 23:19:29.656469 2026] [:error] [pid 34260:tid 34280] [client 4.193.194.67:22712] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkzgUWWhyvZ0O9KNVQ9owAAARI"]
[Sat Jan 03 23:19:29.890863 2026] [:error] [pid 34260:tid 34273] [client 4.193.194.67:22718] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkzgUWWhyvZ0O9KNVQ9pAAAAQs"]
[Sat Jan 03 23:19:30.125033 2026] [:error] [pid 1929:tid 1952] [client 4.193.194.67:7131] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkzgucFqdpu6TNsuWoLQAAAAA4"]
[Sat Jan 03 23:19:30.420891 2026] [:error] [pid 31222:tid 31248] [client 4.193.194.67:7129] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "aVkzgqHw6nASHXAc2v8A_AAAAdg"]
[Sat Jan 03 23:19:30.627280 2026] [:error] [pid 1931:tid 2039] [client 4.193.194.67:7070] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/xadm-log.php"] [unique_id "aVkzgh8Tyw7ZoIdXlcYmJQAAAI8"]
[Sat Jan 03 23:19:30.814225 2026] [:error] [pid 31630:tid 31640] [client 4.193.194.67:22669] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/xadm-log.php"] [unique_id "aVkzgvUV_PU2SWgLPuh4KQAAAYg"]
[Sat Jan 03 23:19:31.022640 2026] [:error] [pid 2083:tid 2109] [client 4.193.194.67:7162] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/xadm-log.php"] [unique_id "aVkzgzVlR_BmlMPnhV4xhgAAANg"]
[Sat Jan 03 23:19:31.245012 2026] [:error] [pid 19639:tid 19657] [client 4.193.194.67:22647] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/xadm-log.php"] [unique_id "aVkzgyQ7fWZUytnlHEwT3QAAAVA"]
[Sat Jan 03 23:19:31.434344 2026] [:error] [pid 1929:tid 1953] [client 4.193.194.67:22592] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/xadm-log.php"] [unique_id "aVkzg-cFqdpu6TNsuWoLRQAAAA8"]
[Sat Jan 03 23:19:31.635881 2026] [:error] [pid 1931:tid 2031] [client 4.193.194.67:7064] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/xadm-log.php"] [unique_id "aVkzgx8Tyw7ZoIdXlcYmJwAAAIc"]
[Sat Jan 03 23:19:31.855770 2026] [:error] [pid 31222:tid 31227] [client 4.193.194.67:22701] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/xadm-log.php"] [unique_id "aVkzg6Hw6nASHXAc2v8BAAAAAcM"]
[Sat Jan 03 23:19:32.083243 2026] [:error] [pid 31630:tid 31637] [client 4.193.194.67:22690] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/xadm-log.php"] [unique_id "aVkzhPUV_PU2SWgLPuh4LQAAAYU"]
[Sat Jan 03 23:19:32.285160 2026] [:error] [pid 31630:tid 31652] [client 4.193.194.67:22628] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tentang_rmol.php"] [unique_id "aVkzhPUV_PU2SWgLPuh4MAAAAZQ"]
[Sat Jan 03 23:19:32.490478 2026] [:error] [pid 1930:tid 1983] [client 4.193.194.67:22632] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tentang_rmol.php"] [unique_id "aVkzhJP-6mqhfUDa89z7kgAAAFE"]
[Sat Jan 03 23:19:32.724015 2026] [:error] [pid 31222:tid 31239] [client 4.193.194.67:22675] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tentang_rmol.php"] [unique_id "aVkzhKHw6nASHXAc2v8BAgAAAc8"]
[Sat Jan 03 23:19:32.928703 2026] [:error] [pid 1931:tid 2043] [client 4.193.194.67:7137] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tentang_rmol.php"] [unique_id "aVkzhB8Tyw7ZoIdXlcYmKAAAAJM"]
[Sat Jan 03 23:19:33.139199 2026] [:error] [pid 19639:tid 19642] [client 4.193.194.67:7043] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update_with_pics.php"] [unique_id "aVkzhSQ7fWZUytnlHEwT4wAAAUE"]
[Sat Jan 03 23:19:33.320748 2026] [:error] [pid 31222:tid 31232] [client 4.193.194.67:22684] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update_with_pics.php"] [unique_id "aVkzhaHw6nASHXAc2v8BBAAAAcg"]
[Sat Jan 03 23:19:33.516754 2026] [:error] [pid 31222:tid 31247] [client 4.193.194.67:22692] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update_with_pics.php"] [unique_id "aVkzhaHw6nASHXAc2v8BBwAAAdc"]
[Sat Jan 03 23:19:33.725918 2026] [:error] [pid 31630:tid 31642] [client 4.193.194.67:7079] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update_with_pics.php"] [unique_id "aVkzhfUV_PU2SWgLPuh4MgAAAYo"]
[Sat Jan 03 23:19:34.054790 2026] [:error] [pid 34260:tid 34282] [client 4.193.194.67:7138] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aVkzhkWWhyvZ0O9KNVQ9pwAAARQ"]
[Sat Jan 03 23:19:34.278201 2026] [:error] [pid 31630:tid 31651] [client 4.193.194.67:22633] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aVkzhvUV_PU2SWgLPuh4MwAAAZM"]
[Sat Jan 03 23:19:34.468395 2026] [:error] [pid 1931:tid 2033] [client 4.193.194.67:7108] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aVkzhh8Tyw7ZoIdXlcYmLwAAAIk"]
[Sat Jan 03 23:19:34.668200 2026] [:error] [pid 1929:tid 1943] [client 4.193.194.67:7067] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asa.php"] [unique_id "aVkzhucFqdpu6TNsuWoLSwAAAAU"]
[Sat Jan 03 23:19:34.871276 2026] [:error] [pid 34260:tid 34283] [client 4.193.194.67:7139] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lla.php"] [unique_id "aVkzhkWWhyvZ0O9KNVQ9qQAAARU"]
[Sat Jan 03 23:19:35.126252 2026] [:error] [pid 19639:tid 19662] [client 4.193.194.67:7144] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lla.php"] [unique_id "aVkzhyQ7fWZUytnlHEwT5QAAAVU"]
[Sat Jan 03 23:19:35.341199 2026] [:error] [pid 31630:tid 31655] [client 4.193.194.67:7055] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lla.php"] [unique_id "aVkzh_UV_PU2SWgLPuh4NgAAAZc"]
[Sat Jan 03 23:19:35.572651 2026] [:error] [pid 31222:tid 31226] [client 4.193.194.67:7101] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lla.php"] [unique_id "aVkzh6Hw6nASHXAc2v8BCgAAAcI"]
[Sat Jan 03 23:19:35.807153 2026] [:error] [pid 34260:tid 34269] [client 4.193.194.67:7165] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dup.php"] [unique_id "aVkzh0WWhyvZ0O9KNVQ9qwAAAQc"]
[Sat Jan 03 23:19:36.019656 2026] [:error] [pid 34260:tid 34262] [client 4.193.194.67:7127] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dup.php"] [unique_id "aVkziEWWhyvZ0O9KNVQ9rAAAAQA"]
[Sat Jan 03 23:19:36.279857 2026] [:error] [pid 1929:tid 1954] [client 4.193.194.67:22639] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dup.php"] [unique_id "aVkziOcFqdpu6TNsuWoLTQAAABA"]
[Sat Jan 03 23:19:36.460307 2026] [:error] [pid 19639:tid 19646] [client 4.193.194.67:7069] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dup.php"] [unique_id "aVkziCQ7fWZUytnlHEwT5gAAAUU"]
[Sat Jan 03 23:19:36.674602 2026] [:error] [pid 31630:tid 31638] [client 4.193.194.67:7111] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifi.php"] [unique_id "aVkziPUV_PU2SWgLPuh4OQAAAYY"]
[Sat Jan 03 23:19:36.878510 2026] [:error] [pid 31222:tid 31246] [client 4.193.194.67:7149] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifi.php"] [unique_id "aVkziKHw6nASHXAc2v8BDAAAAdY"]
[Sat Jan 03 23:19:37.147223 2026] [:error] [pid 1930:tid 1971] [client 4.193.194.67:22610] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifi.php"] [unique_id "aVkziZP-6mqhfUDa89z7mAAAAEU"]
[Sat Jan 03 23:19:37.355877 2026] [:error] [pid 1930:tid 1978] [client 4.193.194.67:22651] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifi.php"] [unique_id "aVkziZP-6mqhfUDa89z7mQAAAEw"]
[Sat Jan 03 23:19:37.577110 2026] [:error] [pid 1930:tid 1976] [client 4.193.194.67:7090] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aVkziZP-6mqhfUDa89z7mgAAAEo"]
[Sat Jan 03 23:19:37.874648 2026] [:error] [pid 1931:tid 2037] [client 4.193.194.67:22660] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aVkziR8Tyw7ZoIdXlcYmNAAAAI0"]
[Sat Jan 03 23:19:38.082714 2026] [:error] [pid 1929:tid 1949] [client 4.193.194.67:7124] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aVkziucFqdpu6TNsuWoLUAAAAAs"]
[Sat Jan 03 23:19:38.281917 2026] [:error] [pid 31630:tid 31639] [client 4.193.194.67:7089] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fifii.php"] [unique_id "aVkzivUV_PU2SWgLPuh4OwAAAYc"]
[Sat Jan 03 23:19:38.485814 2026] [:error] [pid 2083:tid 2094] [client 4.193.194.67:7076] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wteed.php"] [unique_id "aVkzijVlR_BmlMPnhV4xjgAAAMk"]
[Sat Jan 03 23:19:38.686713 2026] [:error] [pid 34260:tid 34286] [client 4.193.194.67:7112] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wteed.php"] [unique_id "aVkzikWWhyvZ0O9KNVQ9sAAAARg"]
[Sat Jan 03 23:19:38.964690 2026] [:error] [pid 1931:tid 2034] [client 4.193.194.67:7148] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wteed.php"] [unique_id "aVkzih8Tyw7ZoIdXlcYmOAAAAIo"]
[Sat Jan 03 23:19:39.138696 2026] [:error] [pid 1931:tid 2047] [client 4.193.194.67:6983] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wteed.php"] [unique_id "aVkzix8Tyw7ZoIdXlcYmPAAAAJc"]
[Sat Jan 03 23:19:39.353266 2026] [:error] [pid 2083:tid 2093] [client 4.193.194.67:7049] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-rss4.php"] [unique_id "aVkzizVlR_BmlMPnhV4xjwAAAMg"]
[Sat Jan 03 23:19:39.531096 2026] [:error] [pid 31222:tid 31227] [client 4.193.194.67:22629] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-rss4.php"] [unique_id "aVkzi6Hw6nASHXAc2v8BEAAAAcM"]
[Sat Jan 03 23:19:39.729921 2026] [:error] [pid 2083:tid 2090] [client 4.193.194.67:7142] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-rss4.php"] [unique_id "aVkzizVlR_BmlMPnhV4xkAAAAMU"]
[Sat Jan 03 23:19:40.030120 2026] [:error] [pid 2083:tid 2107] [client 4.193.194.67:7166] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-rss4.php"] [unique_id "aVkzjDVlR_BmlMPnhV4xkgAAANY"]
[Sat Jan 03 23:19:40.221109 2026] [:error] [pid 34260:tid 34263] [client 4.193.194.67:22655] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "aVkzjEWWhyvZ0O9KNVQ9sQAAAQE"]
[Sat Jan 03 23:19:40.466849 2026] [:error] [pid 31222:tid 31233] [client 4.193.194.67:22685] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "aVkzjKHw6nASHXAc2v8BEwAAAck"]
[Sat Jan 03 23:19:40.675871 2026] [:error] [pid 34260:tid 34273] [client 4.193.194.67:7082] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "aVkzjEWWhyvZ0O9KNVQ9swAAAQs"]
[Sat Jan 03 23:19:41.028876 2026] [:error] [pid 31630:tid 31640] [client 4.193.194.67:7133] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "aVkzjfUV_PU2SWgLPuh4QAAAAYg"]
[Sat Jan 03 23:19:41.248220 2026] [:error] [pid 19639:tid 19661] [client 4.193.194.67:7042] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zr.php"] [unique_id "aVkzjSQ7fWZUytnlHEwT6QAAAVQ"]
[Sat Jan 03 23:19:41.464692 2026] [:error] [pid 19639:tid 19641] [client 4.193.194.67:7130] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zr.php"] [unique_id "aVkzjSQ7fWZUytnlHEwT6wAAAUA"]
[Sat Jan 03 23:19:41.638831 2026] [:error] [pid 19639:tid 19665] [client 4.193.194.67:7068] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zr.php"] [unique_id "aVkzjSQ7fWZUytnlHEwT7QAAAVg"]
[Sat Jan 03 23:19:41.845890 2026] [:error] [pid 19639:tid 19643] [client 4.193.194.67:7096] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zr.php"] [unique_id "aVkzjSQ7fWZUytnlHEwT7gAAAUI"]
[Sat Jan 03 23:19:42.117619 2026] [:error] [pid 34260:tid 34272] [client 4.193.194.67:7050] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2020.php"] [unique_id "aVkzjkWWhyvZ0O9KNVQ9tgAAAQo"]
[Sat Jan 03 23:19:42.367436 2026] [:error] [pid 1931:tid 1996] [client 4.193.194.67:22625] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2020.php"] [unique_id "aVkzjh8Tyw7ZoIdXlcYmQAAAAII"]
[Sat Jan 03 23:19:42.549095 2026] [:error] [pid 1931:tid 2036] [client 4.193.194.67:22637] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2020.php"] [unique_id "aVkzjh8Tyw7ZoIdXlcYmQgAAAIw"]
[Sat Jan 03 23:19:42.767802 2026] [:error] [pid 31630:tid 31648] [client 4.193.194.67:22618] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2020.php"] [unique_id "aVkzjvUV_PU2SWgLPuh4RAAAAZA"]
[Sat Jan 03 23:19:43.000471 2026] [:error] [pid 1931:tid 2041] [client 4.193.194.67:7150] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ENKI.php"] [unique_id "aVkzjh8Tyw7ZoIdXlcYmRwAAAJE"]
[Sat Jan 03 23:19:43.264500 2026] [:error] [pid 1931:tid 2046] [client 4.193.194.67:22657] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ENKI.php"] [unique_id "aVkzjx8Tyw7ZoIdXlcYmSAAAAJY"]
[Sat Jan 03 23:19:43.483036 2026] [:error] [pid 31222:tid 31246] [client 4.193.194.67:7157] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ENKI.php"] [unique_id "aVkzj6Hw6nASHXAc2v8BGQAAAdY"]
[Sat Jan 03 23:19:43.661061 2026] [:error] [pid 31222:tid 31248] [client 4.193.194.67:7046] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ENKI.php"] [unique_id "aVkzj6Hw6nASHXAc2v8BGgAAAdg"]
[Sat Jan 03 23:19:43.854228 2026] [:error] [pid 34260:tid 34281] [client 4.193.194.67:7123] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwebshell.php"] [unique_id "aVkzj0WWhyvZ0O9KNVQ9ugAAARM"]
[Sat Jan 03 23:19:44.089466 2026] [:error] [pid 19639:tid 19659] [client 4.193.194.67:6982] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwebshell.php"] [unique_id "aVkzkCQ7fWZUytnlHEwT8AAAAVI"]
[Sat Jan 03 23:19:44.274877 2026] [:error] [pid 1931:tid 2048] [client 4.193.194.67:7012] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwebshell.php"] [unique_id "aVkzkB8Tyw7ZoIdXlcYmSwAAAJg"]
[Sat Jan 03 23:19:44.541709 2026] [:error] [pid 19639:tid 19648] [client 4.193.194.67:7134] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwebshell.php"] [unique_id "aVkzkCQ7fWZUytnlHEwT8QAAAUc"]
[Sat Jan 03 23:19:44.751049 2026] [:error] [pid 1931:tid 2035] [client 4.193.194.67:22666] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hly.php"] [unique_id "aVkzkB8Tyw7ZoIdXlcYmUQAAAIs"]
[Sat Jan 03 23:19:45.103356 2026] [:error] [pid 19639:tid 19655] [client 4.193.194.67:7145] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hly.php"] [unique_id "aVkzkSQ7fWZUytnlHEwT9AAAAU4"]
[Sat Jan 03 23:19:45.337079 2026] [:error] [pid 1931:tid 1994] [client 4.193.194.67:7083] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hly.php"] [unique_id "aVkzkR8Tyw7ZoIdXlcYmVgAAAIE"]
[Sat Jan 03 23:19:45.581466 2026] [:error] [pid 1929:tid 1958] [client 4.193.194.67:7094] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hly.php"] [unique_id "aVkzkecFqdpu6TNsuWoLWwAAABQ"]
[Sat Jan 03 23:19:46.005306 2026] [:error] [pid 1931:tid 2032] [client 4.193.194.67:7120] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aVkzkh8Tyw7ZoIdXlcYmXwAAAIg"]
[Sat Jan 03 23:19:46.194829 2026] [:error] [pid 31222:tid 31234] [client 4.193.194.67:7077] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aVkzkqHw6nASHXAc2v8BGwAAAco"]
[Sat Jan 03 23:19:46.450475 2026] [:error] [pid 31222:tid 31244] [client 4.193.194.67:7146] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aVkzkqHw6nASHXAc2v8BHAAAAdQ"]
[Sat Jan 03 23:19:46.669528 2026] [:error] [pid 31630:tid 31647] [client 4.193.194.67:6916] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "aVkzkvUV_PU2SWgLPuh4RwAAAY8"]
[Sat Jan 03 23:19:46.890413 2026] [:error] [pid 34260:tid 34274] [client 4.193.194.67:7052] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gool.php"] [unique_id "aVkzkkWWhyvZ0O9KNVQ9xwAAAQw"]
[Sat Jan 03 23:19:47.102044 2026] [:error] [pid 1931:tid 1999] [client 4.193.194.67:7026] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gool.php"] [unique_id "aVkzkx8Tyw7ZoIdXlcYmZwAAAIM"]
[Sat Jan 03 23:19:47.299273 2026] [:error] [pid 2083:tid 2095] [client 4.193.194.67:22668] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gool.php"] [unique_id "aVkzkzVlR_BmlMPnhV4xmAAAAMo"]
[Sat Jan 03 23:19:47.518649 2026] [:error] [pid 19639:tid 19654] [client 4.193.194.67:6986] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gool.php"] [unique_id "aVkzkyQ7fWZUytnlHEwT9wAAAU0"]
[Sat Jan 03 23:19:47.773522 2026] [:error] [pid 19639:tid 19651] [client 4.193.194.67:7003] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/135.php"] [unique_id "aVkzkyQ7fWZUytnlHEwT-AAAAUo"]
[Sat Jan 03 23:19:48.007834 2026] [:error] [pid 19639:tid 19646] [client 4.193.194.67:7095] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/135.php"] [unique_id "aVkzlCQ7fWZUytnlHEwT-QAAAUU"]
[Sat Jan 03 23:19:48.255948 2026] [:error] [pid 34260:tid 34268] [client 4.193.194.67:7051] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/135.php"] [unique_id "aVkzlEWWhyvZ0O9KNVQ9ywAAAQY"]
[Sat Jan 03 23:19:48.483762 2026] [:error] [pid 19639:tid 19649] [client 4.193.194.67:7062] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/135.php"] [unique_id "aVkzlCQ7fWZUytnlHEwT-gAAAUg"]
[Sat Jan 03 23:19:48.749820 2026] [:error] [pid 31630:tid 31645] [client 4.193.194.67:7116] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xx.php"] [unique_id "aVkzlPUV_PU2SWgLPuh4SAAAAY0"]
[Sat Jan 03 23:19:49.009870 2026] [:error] [pid 34260:tid 34282] [client 4.193.194.67:7153] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xx.php"] [unique_id "aVkzlUWWhyvZ0O9KNVQ9zAAAARQ"]
[Sat Jan 03 23:19:49.435887 2026] [:error] [pid 34260:tid 34281] [client 4.193.194.67:6946] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xx.php"] [unique_id "aVkzlUWWhyvZ0O9KNVQ9zQAAARM"]
[Sat Jan 03 23:19:49.724205 2026] [:error] [pid 1929:tid 1962] [client 4.193.194.67:7072] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xx.php"] [unique_id "aVkzlecFqdpu6TNsuWoLYAAAABg"]
[Sat Jan 03 23:19:50.044255 2026] [:error] [pid 1929:tid 1945] [client 4.193.194.67:22705] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hq.php"] [unique_id "aVkzlucFqdpu6TNsuWoLYQAAAAc"]
[Sat Jan 03 23:19:50.470233 2026] [:error] [pid 34260:tid 34279] [client 4.193.194.67:6864] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hq.php"] [unique_id "aVkzlkWWhyvZ0O9KNVQ9zwAAARE"]
[Sat Jan 03 23:19:50.696348 2026] [:error] [pid 2083:tid 2098] [client 4.193.194.67:6913] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hq.php"] [unique_id "aVkzljVlR_BmlMPnhV4xnAAAAM0"]
[Sat Jan 03 23:19:50.880259 2026] [:error] [pid 1930:tid 1981] [client 4.193.194.67:7147] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hq.php"] [unique_id "aVkzlpP-6mqhfUDa89z7oQAAAE8"]
[Sat Jan 03 23:19:51.145580 2026] [:error] [pid 34260:tid 34267] [client 4.193.194.67:7084] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blox.php"] [unique_id "aVkzl0WWhyvZ0O9KNVQ90QAAAQU"]
[Sat Jan 03 23:19:51.352971 2026] [:error] [pid 34260:tid 34277] [client 4.193.194.67:7040] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blox.php"] [unique_id "aVkzl0WWhyvZ0O9KNVQ90wAAAQ8"]
[Sat Jan 03 23:19:51.678440 2026] [:error] [pid 1930:tid 1990] [client 4.193.194.67:7048] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blox.php"] [unique_id "aVkzl5P-6mqhfUDa89z7ogAAAFg"]
[Sat Jan 03 23:19:51.934558 2026] [:error] [pid 19639:tid 19665] [client 4.193.194.67:7141] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blox.php"] [unique_id "aVkzlyQ7fWZUytnlHEwT_QAAAVg"]
[Sat Jan 03 23:19:52.183835 2026] [:error] [pid 1931:tid 1994] [client 4.193.194.67:7100] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fso.php"] [unique_id "aVkzmB8Tyw7ZoIdXlcYmeQAAAIE"]
[Sat Jan 03 23:19:52.383869 2026] [:error] [pid 19639:tid 19647] [client 4.193.194.67:6985] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fso.php"] [unique_id "aVkzmCQ7fWZUytnlHEwUAAAAAUY"]
[Sat Jan 03 23:19:52.772071 2026] [:error] [pid 19639:tid 19653] [client 4.193.194.67:6991] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fso.php"] [unique_id "aVkzmCQ7fWZUytnlHEwUAgAAAUw"]
[Sat Jan 03 23:19:53.085653 2026] [:error] [pid 1929:tid 1953] [client 4.193.194.67:6995] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fso.php"] [unique_id "aVkzmecFqdpu6TNsuWoLZgAAAA8"]
[Sat Jan 03 23:19:53.390721 2026] [:error] [pid 1929:tid 1960] [client 4.193.194.67:7081] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVkzmecFqdpu6TNsuWoLaQAAABY"]
[Sat Jan 03 23:19:53.604404 2026] [:error] [pid 19639:tid 19645] [client 4.193.194.67:7098] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVkzmSQ7fWZUytnlHEwUBQAAAUQ"]
[Sat Jan 03 23:19:53.848028 2026] [:error] [pid 1930:tid 1987] [client 4.193.194.67:7115] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVkzmZP-6mqhfUDa89z7pwAAAFU"]
[Sat Jan 03 23:19:54.168430 2026] [:error] [pid 19639:tid 19655] [client 4.193.194.67:7122] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVkzmiQ7fWZUytnlHEwUBgAAAU4"]
[Sat Jan 03 23:19:54.410645 2026] [:error] [pid 19639:tid 19663] [client 4.193.194.67:6992] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoz.php"] [unique_id "aVkzmiQ7fWZUytnlHEwUBwAAAVY"]
[Sat Jan 03 23:19:54.685427 2026] [:error] [pid 2083:tid 2104] [client 4.193.194.67:7024] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoz.php"] [unique_id "aVkzmjVlR_BmlMPnhV4xnwAAANM"]
[Sat Jan 03 23:19:55.074360 2026] [:error] [pid 19639:tid 19658] [client 4.193.194.67:7161] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoz.php"] [unique_id "aVkzmyQ7fWZUytnlHEwUCgAAAVE"]
[Sat Jan 03 23:19:55.421931 2026] [:error] [pid 1931:tid 1996] [client 4.193.194.67:7031] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoz.php"] [unique_id "aVkzmx8Tyw7ZoIdXlcYmgAAAAII"]
[Sat Jan 03 23:19:55.646603 2026] [:error] [pid 34260:tid 34276] [client 4.193.194.67:7054] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aVkzm0WWhyvZ0O9KNVQ91gAAAQ4"]
[Sat Jan 03 23:19:55.994638 2026] [:error] [pid 1931:tid 2047] [client 4.193.194.67:7006] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aVkzmx8Tyw7ZoIdXlcYmhAAAAJc"]
[Sat Jan 03 23:19:56.236334 2026] [:error] [pid 31222:tid 31247] [client 4.193.194.67:7075] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aVkznKHw6nASHXAc2v8BIwAAAdc"]
[Sat Jan 03 23:19:56.553278 2026] [:error] [pid 19639:tid 19642] [client 4.193.194.67:7061] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless6.php"] [unique_id "aVkznCQ7fWZUytnlHEwUCwAAAUE"]
[Sat Jan 03 23:19:56.765079 2026] [:error] [pid 31222:tid 31245] [client 4.193.194.67:7109] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless10.php"] [unique_id "aVkznKHw6nASHXAc2v8BKQAAAdU"]
[Sat Jan 03 23:19:57.028931 2026] [:error] [pid 31222:tid 31225] [client 4.193.194.67:7022] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless10.php"] [unique_id "aVkznaHw6nASHXAc2v8BLQAAAcE"]
[Sat Jan 03 23:19:57.279970 2026] [:error] [pid 19639:tid 19662] [client 4.193.194.67:7167] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless10.php"] [unique_id "aVkznSQ7fWZUytnlHEwUDQAAAVU"]
[Sat Jan 03 23:19:57.481056 2026] [:error] [pid 1931:tid 2029] [client 4.193.194.67:7164] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless10.php"] [unique_id "aVkznR8Tyw7ZoIdXlcYmiAAAAIU"]
[Sat Jan 03 23:19:57.670030 2026] [:error] [pid 34260:tid 34263] [client 4.193.194.67:7025] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xcre1.php"] [unique_id "aVkznUWWhyvZ0O9KNVQ92QAAAQE"]
[Sat Jan 03 23:19:57.916111 2026] [:error] [pid 31630:tid 31647] [client 4.193.194.67:7105] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xcre1.php"] [unique_id "aVkznfUV_PU2SWgLPuh4XAAAAY8"]
[Sat Jan 03 23:19:58.232139 2026] [:error] [pid 34260:tid 34271] [client 4.193.194.67:6996] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xcre1.php"] [unique_id "aVkznkWWhyvZ0O9KNVQ92gAAAQk"]
[Sat Jan 03 23:19:58.685171 2026] [:error] [pid 1929:tid 1938] [client 4.193.194.67:7005] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xcre1.php"] [unique_id "aVkznucFqdpu6TNsuWoLbQAAAAA"]
[Sat Jan 03 23:19:59.073085 2026] [:error] [pid 34260:tid 34272] [client 4.193.194.67:22662] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jatuh.php"] [unique_id "aVkzn0WWhyvZ0O9KNVQ93wAAAQo"]
[Sat Jan 03 23:19:59.391095 2026] [:error] [pid 1929:tid 1943] [client 4.193.194.67:7011] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jatuh.php"] [unique_id "aVkzn-cFqdpu6TNsuWoLcAAAAAU"]
[Sat Jan 03 23:19:59.655818 2026] [:error] [pid 2083:tid 2102] [client 4.193.194.67:22643] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jatuh.php"] [unique_id "aVkznzVlR_BmlMPnhV4xqQAAANE"]
[Sat Jan 03 23:19:59.923238 2026] [:error] [pid 1929:tid 1961] [client 4.193.194.67:7152] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jatuh.php"] [unique_id "aVkzn-cFqdpu6TNsuWoLcQAAABc"]
[Sat Jan 03 23:20:00.206671 2026] [:error] [pid 19639:tid 19664] [client 4.193.194.67:7063] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fesa.php"] [unique_id "aVkzoCQ7fWZUytnlHEwUEQAAAVc"]
[Sat Jan 03 23:20:00.874629 2026] [:error] [pid 31630:tid 31650] [client 4.193.194.67:7071] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fesa.php"] [unique_id "aVkzoPUV_PU2SWgLPuh4XQAAAZI"]
[Sat Jan 03 23:20:01.284892 2026] [:error] [pid 31630:tid 31643] [client 4.193.194.67:7080] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fesa.php"] [unique_id "aVkzofUV_PU2SWgLPuh4XwAAAYs"]
[Sat Jan 03 23:20:01.537476 2026] [:error] [pid 1929:tid 1942] [client 4.193.194.67:6987] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fesa.php"] [unique_id "aVkzoecFqdpu6TNsuWoLdgAAAAQ"]
[Sat Jan 03 23:20:01.769025 2026] [:error] [pid 1931:tid 2043] [client 4.193.194.67:7107] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-.php"] [unique_id "aVkzoR8Tyw7ZoIdXlcYmkAAAAJM"]
[Sat Jan 03 23:20:02.124443 2026] [:error] [pid 1929:tid 1957] [client 4.193.194.67:6866] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-.php"] [unique_id "aVkzoucFqdpu6TNsuWoLeAAAABM"]
[Sat Jan 03 23:20:02.767637 2026] [:error] [pid 31222:tid 31224] [client 4.193.194.67:7087] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-.php"] [unique_id "aVkzoqHw6nASHXAc2v8BOAAAAcA"]
[Sat Jan 03 23:20:03.019028 2026] [:error] [pid 1929:tid 1960] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/class-.php
[Sat Jan 03 23:20:03.121213 2026] [:error] [pid 1929:tid 1944] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzgf5.php
[Sat Jan 03 23:20:03.211461 2026] [:error] [pid 1929:tid 1941] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/fs6.php
[Sat Jan 03 23:20:03.302087 2026] [:error] [pid 1929:tid 1947] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/qrops.php
[Sat Jan 03 23:20:03.392720 2026] [:error] [pid 1929:tid 1948] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/about25.php
[Sat Jan 03 23:20:03.484943 2026] [:error] [pid 1929:tid 1955] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/testo.php
[Sat Jan 03 23:20:03.576031 2026] [:error] [pid 1929:tid 1938] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/cvrvk.php
[Sat Jan 03 23:20:03.666220 2026] [:error] [pid 1929:tid 1943] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/siln.php
[Sat Jan 03 23:20:03.777804 2026] [:error] [pid 1929:tid 1958] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/zicgg.php
[Sat Jan 03 23:20:03.867774 2026] [:error] [pid 1929:tid 1959] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/shelp.php
[Sat Jan 03 23:20:03.968161 2026] [:error] [pid 1929:tid 1961] [client 4.193.194.67:7140] File does not exist: /usr/local/apache/htdocs/suspended-page/puvil.php
[Sat Jan 03 23:20:04.062636 2026] [:error] [pid 1929:tid 1949] [client 4.193.194.67:7140] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hans.php"] [unique_id "aVkzpOcFqdpu6TNsuWoLiAAAAAs"]
[Sat Jan 03 23:20:04.360626 2026] [:error] [pid 1929:tid 1956] [client 4.193.194.67:6943] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hans.php"] [unique_id "aVkzpOcFqdpu6TNsuWoLiQAAABI"]
[Sat Jan 03 23:20:04.767175 2026] [:error] [pid 19639:tid 19652] [client 4.193.194.67:7086] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hans.php"] [unique_id "aVkzpCQ7fWZUytnlHEwUGQAAAUs"]
[Sat Jan 03 23:20:05.111965 2026] [:error] [pid 19639:tid 19657] [client 4.193.194.67:6958] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hans.php"] [unique_id "aVkzpSQ7fWZUytnlHEwUHQAAAVA"]
[Sat Jan 03 23:20:05.609400 2026] [:error] [pid 34260:tid 34281] [client 4.193.194.67:6993] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVkzpUWWhyvZ0O9KNVQ94gAAARM"]
[Sat Jan 03 23:20:05.938018 2026] [:error] [pid 1931:tid 2039] [client 4.193.194.67:7047] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVkzpR8Tyw7ZoIdXlcYmlgAAAI8"]
[Sat Jan 03 23:20:06.167077 2026] [:error] [pid 1931:tid 2048] [client 4.193.194.67:7014] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVkzph8Tyw7ZoIdXlcYmlwAAAJg"]
[Sat Jan 03 23:20:06.466932 2026] [:error] [pid 31222:tid 31239] [client 4.193.194.67:22710] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "aVkzpqHw6nASHXAc2v8BRgAAAc8"]
[Sat Jan 03 23:20:06.785295 2026] [:error] [pid 31222:tid 31241] [client 4.193.194.67:7066] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2%25.php"] [unique_id "aVkzpqHw6nASHXAc2v8BSwAAAdE"]
[Sat Jan 03 23:20:07.094050 2026] [:error] [pid 19639:tid 19642] [client 4.193.194.67:7093] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2%25.php"] [unique_id "aVkzpyQ7fWZUytnlHEwUHgAAAUE"]
[Sat Jan 03 23:20:07.452522 2026] [:error] [pid 31222:tid 31226] [client 4.193.194.67:7078] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2%25.php"] [unique_id "aVkzp6Hw6nASHXAc2v8BTwAAAcI"]
[Sat Jan 03 23:20:07.652296 2026] [:error] [pid 31222:tid 31248] [client 4.193.194.67:7097] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2%25.php"] [unique_id "aVkzp6Hw6nASHXAc2v8BUQAAAdg"]
[Sat Jan 03 23:20:08.064962 2026] [:error] [pid 31630:tid 31652] [client 4.193.194.67:7029] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1%25.php"] [unique_id "aVkzqPUV_PU2SWgLPuh4ZwAAAZQ"]
[Sat Jan 03 23:20:08.319865 2026] [:error] [pid 1931:tid 2029] [client 4.193.194.67:7011] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1%25.php"] [unique_id "aVkzqB8Tyw7ZoIdXlcYmmwAAAIU"]
[Sat Jan 03 23:20:08.639718 2026] [:error] [pid 31222:tid 31228] [client 4.193.194.67:7092] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1%25.php"] [unique_id "aVkzqKHw6nASHXAc2v8BVAAAAcQ"]
[Sat Jan 03 23:20:09.332851 2026] [:error] [pid 19639:tid 19651] [client 4.193.194.67:7033] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1%25.php"] [unique_id "aVkzqSQ7fWZUytnlHEwUHwAAAUo"]
[Sat Jan 03 23:20:09.665063 2026] [:error] [pid 1930:tid 1984] [client 4.193.194.67:7074] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0%25.php"] [unique_id "aVkzqZP-6mqhfUDa89z7rwAAAFI"]
[Sat Jan 03 23:20:09.905661 2026] [:error] [pid 1930:tid 1969] [client 4.193.194.67:6957] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0%25.php"] [unique_id "aVkzqZP-6mqhfUDa89z7sgAAAEM"]
[Sat Jan 03 23:20:10.203257 2026] [:error] [pid 31630:tid 31656] [client 4.193.194.67:6980] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0%25.php"] [unique_id "aVkzqvUV_PU2SWgLPuh4agAAAZg"]
[Sat Jan 03 23:20:10.404115 2026] [:error] [pid 2083:tid 2096] [client 4.193.194.67:7091] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0%25.php"] [unique_id "aVkzqjVlR_BmlMPnhV4xtwAAAMs"]
[Sat Jan 03 23:20:11.029740 2026] [:error] [pid 1929:tid 1947] [client 4.193.194.67:7027] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hYdXrMgTbH.php"] [unique_id "aVkzq-cFqdpu6TNsuWoLkAAAAAk"]
[Sat Jan 03 23:20:11.316360 2026] [:error] [pid 1931:tid 2042] [client 4.193.194.67:7136] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hYdXrMgTbH.php"] [unique_id "aVkzqx8Tyw7ZoIdXlcYmoQAAAJI"]
[Sat Jan 03 23:20:11.618883 2026] [:error] [pid 2083:tid 2088] [client 4.193.194.67:7085] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hYdXrMgTbH.php"] [unique_id "aVkzqzVlR_BmlMPnhV4xugAAAMM"]
[Sat Jan 03 23:20:11.954672 2026] [:error] [pid 1931:tid 2045] [client 4.193.194.67:7088] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hYdXrMgTbH.php"] [unique_id "aVkzqx8Tyw7ZoIdXlcYmpAAAAJU"]
[Sat Jan 03 23:20:12.167508 2026] [:error] [pid 1931:tid 2039] [client 4.193.194.67:6912] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fucku.php"] [unique_id "aVkzrB8Tyw7ZoIdXlcYmpQAAAI8"]
[Sat Jan 03 23:20:12.410842 2026] [:error] [pid 2083:tid 2085] [client 4.193.194.67:6978] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fucku.php"] [unique_id "aVkzrDVlR_BmlMPnhV4xvAAAAMA"]
[Sat Jan 03 23:20:12.663126 2026] [:error] [pid 1931:tid 2044] [client 4.193.194.67:7156] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fucku.php"] [unique_id "aVkzrB8Tyw7ZoIdXlcYmpwAAAJQ"]
[Sat Jan 03 23:20:12.886100 2026] [:error] [pid 1931:tid 1993] [client 4.193.194.67:7053] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fucku.php"] [unique_id "aVkzrB8Tyw7ZoIdXlcYmqQAAAIA"]
[Sat Jan 03 23:20:13.157979 2026] [:error] [pid 1931:tid 2046] [client 4.193.194.67:6920] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-damin.php"] [unique_id "aVkzrR8Tyw7ZoIdXlcYmqwAAAJY"]
[Sat Jan 03 23:20:13.521987 2026] [:error] [pid 1931:tid 2042] [client 4.193.194.67:7099] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-damin.php"] [unique_id "aVkzrR8Tyw7ZoIdXlcYmrgAAAJI"]
[Sat Jan 03 23:20:14.407009 2026] [:error] [pid 1929:tid 1945] [client 4.193.194.67:7009] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-damin.php"] [unique_id "aVkzrucFqdpu6TNsuWoLmAAAAAc"]
[Sat Jan 03 23:20:14.624937 2026] [:error] [pid 1929:tid 1952] [client 4.193.194.67:7036] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-damin.php"] [unique_id "aVkzrucFqdpu6TNsuWoLmQAAAA4"]
[Sat Jan 03 23:20:15.022107 2026] [:error] [pid 19639:tid 19660] [client 4.193.194.67:6918] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aVkzryQ7fWZUytnlHEwUJAAAAVM"]
[Sat Jan 03 23:20:15.376460 2026] [:error] [pid 19639:tid 19643] [client 4.193.194.67:7102] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aVkzryQ7fWZUytnlHEwUJgAAAUI"]
[Sat Jan 03 23:20:15.590048 2026] [:error] [pid 1931:tid 2039] [client 4.193.194.67:7001] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aVkzrx8Tyw7ZoIdXlcYmtAAAAI8"]
[Sat Jan 03 23:20:15.889593 2026] [:error] [pid 19639:tid 19659] [client 4.193.194.67:6875] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aVkzryQ7fWZUytnlHEwUKAAAAVI"]
[Sat Jan 03 23:20:16.178816 2026] [:error] [pid 1931:tid 2030] [client 4.193.194.67:6966] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/category.tokens.php"] [unique_id "aVkzsB8Tyw7ZoIdXlcYmtgAAAIY"]
[Sat Jan 03 23:20:16.513713 2026] [:error] [pid 31222:tid 31245] [client 4.193.194.67:7013] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/category.tokens.php"] [unique_id "aVkzsKHw6nASHXAc2v8BXgAAAdU"]
[Sat Jan 03 23:20:17.045724 2026] [:error] [pid 1931:tid 2040] [client 4.193.194.67:7057] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/category.tokens.php"] [unique_id "aVkzsR8Tyw7ZoIdXlcYmugAAAJA"]
[Sat Jan 03 23:20:17.377581 2026] [:error] [pid 1931:tid 2032] [client 4.193.194.67:7023] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/category.tokens.php"] [unique_id "aVkzsR8Tyw7ZoIdXlcYmvQAAAIg"]
[Sat Jan 03 23:20:17.674862 2026] [:error] [pid 19639:tid 19663] [client 4.193.194.67:7163] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oxshell.php"] [unique_id "aVkzsSQ7fWZUytnlHEwULAAAAVY"]
[Sat Jan 03 23:20:17.933852 2026] [:error] [pid 31630:tid 31647] [client 4.193.194.67:6914] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oxshell.php"] [unique_id "aVkzsfUV_PU2SWgLPuh4bAAAAY8"]
[Sat Jan 03 23:20:18.186894 2026] [:error] [pid 19639:tid 19657] [client 4.193.194.67:7002] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oxshell.php"] [unique_id "aVkzsiQ7fWZUytnlHEwULgAAAVA"]
[Sat Jan 03 23:20:18.433301 2026] [:error] [pid 1929:tid 1960] [client 4.193.194.67:7103] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oxshell.php"] [unique_id "aVkzsucFqdpu6TNsuWoLpQAAABY"]
[Sat Jan 03 23:20:18.698508 2026] [:error] [pid 2083:tid 2097] [client 4.193.194.67:6935] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/nomad/aec.php"] [unique_id "aVkzsjVlR_BmlMPnhV4xvwAAAMw"]
[Sat Jan 03 23:20:18.888267 2026] [:error] [pid 1929:tid 1939] [client 4.193.194.67:6969] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/nomad/aec.php"] [unique_id "aVkzsucFqdpu6TNsuWoLqAAAAAE"]
[Sat Jan 03 23:20:19.137684 2026] [:error] [pid 34260:tid 34265] [client 4.193.194.67:7020] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/nomad/aec.php"] [unique_id "aVkzs0WWhyvZ0O9KNVQ95QAAAQM"]
[Sat Jan 03 23:20:19.475561 2026] [:error] [pid 2083:tid 2091] [client 4.193.194.67:6901] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/nomad/aec.php"] [unique_id "aVkzszVlR_BmlMPnhV4xwQAAAMY"]
[Sat Jan 03 23:20:19.818666 2026] [:error] [pid 2083:tid 2089] [client 4.193.194.67:6930] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aec.php"] [unique_id "aVkzszVlR_BmlMPnhV4xwwAAAMQ"]
[Sat Jan 03 23:20:20.263192 2026] [:error] [pid 1929:tid 1945] [client 4.193.194.67:7151] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aec.php"] [unique_id "aVkztOcFqdpu6TNsuWoLrgAAAAc"]
[Sat Jan 03 23:20:20.695013 2026] [:error] [pid 34260:tid 34267] [client 4.193.194.67:7056] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aec.php"] [unique_id "aVkztEWWhyvZ0O9KNVQ95gAAAQU"]
[Sat Jan 03 23:20:20.918893 2026] [:error] [pid 1929:tid 1954] [client 4.193.194.67:7034] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aec.php"] [unique_id "aVkztOcFqdpu6TNsuWoLsgAAABA"]
[Sat Jan 03 23:20:21.165272 2026] [:error] [pid 2083:tid 2096] [client 4.193.194.67:7032] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aVkztTVlR_BmlMPnhV4xygAAAMs"]
[Sat Jan 03 23:20:21.436335 2026] [:error] [pid 1929:tid 1946] [client 4.193.194.67:7058] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aVkztecFqdpu6TNsuWoLtAAAAAg"]
[Sat Jan 03 23:20:21.672922 2026] [:error] [pid 1931:tid 2048] [client 4.193.194.67:6933] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aVkztR8Tyw7ZoIdXlcYmxgAAAJg"]
[Sat Jan 03 23:20:21.995118 2026] [:error] [pid 31630:tid 31645] [client 4.193.194.67:6929] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aVkztfUV_PU2SWgLPuh4bQAAAY0"]
[Sat Jan 03 23:20:22.231434 2026] [:error] [pid 31222:tid 31248] [client 4.193.194.67:22674] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aVkztqHw6nASHXAc2v8BYwAAAdg"]
[Sat Jan 03 23:20:22.546502 2026] [:error] [pid 31222:tid 31243] [client 4.193.194.67:22638] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aVkztqHw6nASHXAc2v8BZAAAAdM"]
[Sat Jan 03 23:20:22.815958 2026] [:error] [pid 34260:tid 34277] [client 4.193.194.67:6989] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aVkztkWWhyvZ0O9KNVQ96AAAAQ8"]
[Sat Jan 03 23:20:23.068941 2026] [:error] [pid 1930:tid 1974] [client 4.193.194.67:22664] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aVkzt5P-6mqhfUDa89z7vgAAAEg"]
[Sat Jan 03 23:20:23.359595 2026] [:error] [pid 31630:tid 31643] [client 4.193.194.67:6886] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aiman.php"] [unique_id "aVkzt_UV_PU2SWgLPuh4bwAAAYs"]
[Sat Jan 03 23:20:23.645685 2026] [:error] [pid 1930:tid 1973] [client 4.193.194.67:6928] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aiman.php"] [unique_id "aVkzt5P-6mqhfUDa89z7wAAAAEc"]
[Sat Jan 03 23:20:23.875051 2026] [:error] [pid 34260:tid 34276] [client 4.193.194.67:6856] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aiman.php"] [unique_id "aVkzt0WWhyvZ0O9KNVQ96gAAAQ4"]
[Sat Jan 03 23:20:24.241497 2026] [:error] [pid 34260:tid 34284] [client 4.193.194.67:7135] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aiman.php"] [unique_id "aVkzuEWWhyvZ0O9KNVQ97AAAARY"]
[Sat Jan 03 23:20:24.675041 2026] [:error] [pid 1931:tid 2033] [client 4.193.194.67:7008] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf9.php"] [unique_id "aVkzuB8Tyw7ZoIdXlcYmygAAAIk"]
[Sat Jan 03 23:20:24.909337 2026] [:error] [pid 34260:tid 34286] [client 4.193.194.67:7004] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf9.php"] [unique_id "aVkzuEWWhyvZ0O9KNVQ97QAAARg"]
[Sat Jan 03 23:20:25.208593 2026] [:error] [pid 19639:tid 19644] [client 4.193.194.67:6797] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf9.php"] [unique_id "aVkzuSQ7fWZUytnlHEwUOgAAAUM"]
[Sat Jan 03 23:20:25.498962 2026] [:error] [pid 34260:tid 34263] [client 4.193.194.67:6862] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf9.php"] [unique_id "aVkzuUWWhyvZ0O9KNVQ97gAAAQE"]
[Sat Jan 03 23:20:25.966391 2026] [:error] [pid 31222:tid 31236] [client 4.193.194.67:7019] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "aVkzuaHw6nASHXAc2v8BawAAAcw"]
[Sat Jan 03 23:20:26.278225 2026] [:error] [pid 1931:tid 2037] [client 4.193.194.67:7000] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "aVkzuh8Tyw7ZoIdXlcYmzQAAAI0"]
[Sat Jan 03 23:20:26.505181 2026] [:error] [pid 1931:tid 1994] [client 4.193.194.67:6976] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "aVkzuh8Tyw7ZoIdXlcYmzwAAAIE"]
[Sat Jan 03 23:20:26.721751 2026] [:error] [pid 31222:tid 31239] [client 4.193.194.67:6977] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "aVkzuqHw6nASHXAc2v8BbQAAAc8"]
[Sat Jan 03 23:20:27.007616 2026] [:error] [pid 1930:tid 1966] [client 4.193.194.67:6925] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9v6.php"] [unique_id "aVkzu5P-6mqhfUDa89z7yAAAAEA"]
[Sat Jan 03 23:20:27.292237 2026] [:error] [pid 19639:tid 19652] [client 4.193.194.67:7059] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9v6.php"] [unique_id "aVkzuyQ7fWZUytnlHEwUPAAAAUs"]
[Sat Jan 03 23:20:27.592209 2026] [:error] [pid 31630:tid 31632] [client 4.193.194.67:22636] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9v6.php"] [unique_id "aVkzu_UV_PU2SWgLPuh4cQAAAYA"]
[Sat Jan 03 23:20:27.768907 2026] [:error] [pid 31630:tid 31641] [client 4.193.194.67:6949] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9v6.php"] [unique_id "aVkzu_UV_PU2SWgLPuh4cgAAAYk"]
[Sat Jan 03 23:20:28.156790 2026] [:error] [pid 2083:tid 2097] [client 4.193.194.67:6852] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lte7.php"] [unique_id "aVkzvDVlR_BmlMPnhV4x0AAAAMw"]
[Sat Jan 03 23:20:28.424966 2026] [:error] [pid 2083:tid 2107] [client 4.193.194.67:7039] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lte7.php"] [unique_id "aVkzvDVlR_BmlMPnhV4x0gAAANY"]
[Sat Jan 03 23:20:28.652154 2026] [:error] [pid 19639:tid 19650] [client 4.193.194.67:6937] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lte7.php"] [unique_id "aVkzvCQ7fWZUytnlHEwUPgAAAUk"]
[Sat Jan 03 23:20:28.896669 2026] [:error] [pid 1930:tid 1975] [client 4.193.194.67:7010] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lte7.php"] [unique_id "aVkzvJP-6mqhfUDa89z7zQAAAEk"]
[Sat Jan 03 23:20:29.137735 2026] [:error] [pid 19639:tid 19645] [client 4.193.194.67:7155] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1vbqo.php"] [unique_id "aVkzvSQ7fWZUytnlHEwUPwAAAUQ"]
[Sat Jan 03 23:20:29.400737 2026] [:error] [pid 1931:tid 1996] [client 4.193.194.67:6988] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1vbqo.php"] [unique_id "aVkzvR8Tyw7ZoIdXlcYm2QAAAII"]
[Sat Jan 03 23:20:29.819028 2026] [:error] [pid 31222:tid 31225] [client 4.193.194.67:6938] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1vbqo.php"] [unique_id "aVkzvaHw6nASHXAc2v8BcwAAAcE"]
[Sat Jan 03 23:20:30.071400 2026] [:error] [pid 2083:tid 2103] [client 4.193.194.67:6789] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1vbqo.php"] [unique_id "aVkzvjVlR_BmlMPnhV4x0wAAANI"]
[Sat Jan 03 23:20:30.306818 2026] [:error] [pid 31222:tid 31246] [client 4.193.194.67:6990] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tajj.php"] [unique_id "aVkzvqHw6nASHXAc2v8BdAAAAdY"]
[Sat Jan 03 23:20:30.514956 2026] [:error] [pid 1931:tid 1993] [client 4.193.194.67:6865] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tajj.php"] [unique_id "aVkzvh8Tyw7ZoIdXlcYm3AAAAIA"]
[Sat Jan 03 23:20:30.730749 2026] [:error] [pid 1931:tid 2032] [client 4.193.194.67:6973] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tajj.php"] [unique_id "aVkzvh8Tyw7ZoIdXlcYm3QAAAIg"]
[Sat Jan 03 23:20:30.948595 2026] [:error] [pid 19639:tid 19654] [client 4.193.194.67:7030] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tajj.php"] [unique_id "aVkzviQ7fWZUytnlHEwUQQAAAU0"]
[Sat Jan 03 23:20:31.182313 2026] [:error] [pid 1930:tid 1978] [client 4.193.194.67:6994] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fdd2.php"] [unique_id "aVkzv5P-6mqhfUDa89z71QAAAEw"]
[Sat Jan 03 23:20:31.399988 2026] [:error] [pid 1931:tid 1994] [client 4.193.194.67:7017] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fdd2.php"] [unique_id "aVkzvx8Tyw7ZoIdXlcYm3wAAAIE"]
[Sat Jan 03 23:20:31.658799 2026] [:error] [pid 2083:tid 2104] [client 4.193.194.67:6954] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fdd2.php"] [unique_id "aVkzvzVlR_BmlMPnhV4x1wAAANM"]
[Sat Jan 03 23:20:31.982980 2026] [:error] [pid 2083:tid 2088] [client 4.193.194.67:7073] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fdd2.php"] [unique_id "aVkzvzVlR_BmlMPnhV4x2AAAAMM"]
[Sat Jan 03 23:20:32.247851 2026] [:error] [pid 34260:tid 34268] [client 4.193.194.67:7041] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7h.php"] [unique_id "aVkzwEWWhyvZ0O9KNVQ98wAAAQY"]
[Sat Jan 03 23:20:32.471169 2026] [:error] [pid 31222:tid 31239] [client 4.193.194.67:6932] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7h.php"] [unique_id "aVkzwKHw6nASHXAc2v8BfQAAAc8"]
[Sat Jan 03 23:20:32.793891 2026] [:error] [pid 1930:tid 1984] [client 4.193.194.67:6962] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7h.php"] [unique_id "aVkzwJP-6mqhfUDa89z71gAAAFI"]
[Sat Jan 03 23:20:33.004052 2026] [:error] [pid 34260:tid 34282] [client 4.193.194.67:6793] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7h.php"] [unique_id "aVkzwUWWhyvZ0O9KNVQ99QAAARQ"]
[Sat Jan 03 23:20:33.269764 2026] [:error] [pid 1931:tid 2038] [client 4.193.194.67:6858] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aVkzwR8Tyw7ZoIdXlcYm5QAAAI4"]
[Sat Jan 03 23:20:33.813676 2026] [:error] [pid 1930:tid 1976] [client 4.193.194.67:6948] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aVkzwZP-6mqhfUDa89z72gAAAEo"]
[Sat Jan 03 23:20:34.062449 2026] [:error] [pid 31222:tid 31240] [client 4.193.194.67:6979] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aVkzwqHw6nASHXAc2v8BggAAAdA"]
[Sat Jan 03 23:20:34.431292 2026] [:error] [pid 34260:tid 34267] [client 4.193.194.67:6900] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fh26.php"] [unique_id "aVkzwkWWhyvZ0O9KNVQ9-AAAAQU"]
[Sat Jan 03 23:20:34.841173 2026] [:error] [pid 34260:tid 34266] [client 4.193.194.67:6951] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ixj.php"] [unique_id "aVkzwkWWhyvZ0O9KNVQ9-gAAAQQ"]
[Sat Jan 03 23:20:35.301265 2026] [:error] [pid 1930:tid 1975] [client 4.193.194.67:7021] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ixj.php"] [unique_id "aVkzw5P-6mqhfUDa89z73AAAAEk"]
[Sat Jan 03 23:20:35.618909 2026] [:error] [pid 31222:tid 31234] [client 4.193.194.67:7125] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ixj.php"] [unique_id "aVkzw6Hw6nASHXAc2v8BhgAAAco"]
[Sat Jan 03 23:20:36.051518 2026] [:error] [pid 2083:tid 2100] [client 4.193.194.67:6829] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ixj.php"] [unique_id "aVkzxDVlR_BmlMPnhV4x4QAAAM8"]
[Sat Jan 03 23:20:36.304727 2026] [:error] [pid 1930:tid 1974] [client 4.193.194.67:6971] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x23.php"] [unique_id "aVkzxJP-6mqhfUDa89z74QAAAEg"]
[Sat Jan 03 23:20:36.668138 2026] [:error] [pid 34260:tid 34284] [client 4.193.194.67:6922] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x23.php"] [unique_id "aVkzxEWWhyvZ0O9KNVQ9-wAAARY"]
[Sat Jan 03 23:20:37.061120 2026] [:error] [pid 19639:tid 19656] [client 4.193.194.67:6934] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x23.php"] [unique_id "aVkzxSQ7fWZUytnlHEwURwAAAU8"]
[Sat Jan 03 23:20:37.323940 2026] [:error] [pid 2083:tid 2097] [client 4.193.194.67:6974] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x23.php"] [unique_id "aVkzxTVlR_BmlMPnhV4x5AAAAMw"]
[Sat Jan 03 23:20:37.604149 2026] [:error] [pid 34260:tid 34285] [client 4.193.194.67:6848] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeu.php"] [unique_id "aVkzxUWWhyvZ0O9KNVQ9_AAAARc"]
[Sat Jan 03 23:20:37.968403 2026] [:error] [pid 19639:tid 19643] [client 4.193.194.67:6940] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeu.php"] [unique_id "aVkzxSQ7fWZUytnlHEwUSQAAAUI"]
[Sat Jan 03 23:20:38.321307 2026] [:error] [pid 1930:tid 1969] [client 4.193.194.67:6939] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeu.php"] [unique_id "aVkzxpP-6mqhfUDa89z75QAAAEM"]
[Sat Jan 03 23:20:38.573715 2026] [:error] [pid 1931:tid 2032] [client 4.193.194.67:6998] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeu.php"] [unique_id "aVkzxh8Tyw7ZoIdXlcYm6wAAAIg"]
[Sat Jan 03 23:20:38.922165 2026] [:error] [pid 1929:tid 1949] [client 4.193.194.67:6984] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2r4.php"] [unique_id "aVkzxucFqdpu6TNsuWoLyAAAAAs"]
[Sat Jan 03 23:20:39.471301 2026] [:error] [pid 1931:tid 2037] [client 4.193.194.67:6855] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2r4.php"] [unique_id "aVkzxx8Tyw7ZoIdXlcYm7QAAAI0"]
[Sat Jan 03 23:20:39.735030 2026] [:error] [pid 1931:tid 2035] [client 4.193.194.67:6924] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2r4.php"] [unique_id "aVkzxx8Tyw7ZoIdXlcYm7gAAAIs"]
[Sat Jan 03 23:20:40.053059 2026] [:error] [pid 31630:tid 31632] [client 4.193.194.67:6997] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2r4.php"] [unique_id "aVkzyPUV_PU2SWgLPuh4hAAAAYA"]
[Sat Jan 03 23:20:40.263585 2026] [:error] [pid 1931:tid 2043] [client 4.193.194.67:6999] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aVkzyB8Tyw7ZoIdXlcYm8AAAAJM"]
[Sat Jan 03 23:20:40.545845 2026] [:error] [pid 31630:tid 31641] [client 4.193.194.67:6915] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aVkzyPUV_PU2SWgLPuh4hQAAAYk"]
[Sat Jan 03 23:20:40.751421 2026] [:error] [pid 31630:tid 31634] [client 4.193.194.67:6947] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aVkzyPUV_PU2SWgLPuh4hgAAAYI"]
[Sat Jan 03 23:20:41.257321 2026] [:error] [pid 1931:tid 2031] [client 4.193.194.67:6931] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lopst.php"] [unique_id "aVkzyR8Tyw7ZoIdXlcYm8wAAAIc"]
[Sat Jan 03 23:20:41.527894 2026] [:error] [pid 1931:tid 2027] [client 4.193.194.67:6959] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xs.php"] [unique_id "aVkzyR8Tyw7ZoIdXlcYm9QAAAIQ"]
[Sat Jan 03 23:20:41.746262 2026] [:error] [pid 1931:tid 1996] [client 4.193.194.67:7007] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xs.php"] [unique_id "aVkzyR8Tyw7ZoIdXlcYm-AAAAII"]
[Sat Jan 03 23:20:42.064161 2026] [:error] [pid 1931:tid 2034] [client 4.193.194.67:6794] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xs.php"] [unique_id "aVkzyh8Tyw7ZoIdXlcYm-gAAAIo"]
[Sat Jan 03 23:20:42.514720 2026] [:error] [pid 31630:tid 31640] [client 4.193.194.67:6816] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0xs.php"] [unique_id "aVkzyvUV_PU2SWgLPuh4iQAAAYg"]
[Sat Jan 03 23:20:42.794820 2026] [:error] [pid 1929:tid 1960] [client 4.193.194.67:7016] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Zeiss.php"] [unique_id "aVkzyucFqdpu6TNsuWoLygAAABY"]
[Sat Jan 03 23:20:43.115799 2026] [:error] [pid 31222:tid 31237] [client 4.193.194.67:6870] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Zeiss.php"] [unique_id "aVkzy6Hw6nASHXAc2v8BkAAAAc0"]
[Sat Jan 03 23:20:43.404612 2026] [:error] [pid 1931:tid 2035] [client 4.193.194.67:6795] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Zeiss.php"] [unique_id "aVkzyx8Tyw7ZoIdXlcYnAgAAAIs"]
[Sat Jan 03 23:20:43.802953 2026] [:error] [pid 31630:tid 31652] [client 4.193.194.67:6817] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Zeiss.php"] [unique_id "aVkzy_UV_PU2SWgLPuh4iwAAAZQ"]
[Sat Jan 03 23:20:44.206559 2026] [:error] [pid 31222:tid 31225] [client 4.193.194.67:6972] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0x.php"] [unique_id "aVkzzKHw6nASHXAc2v8BkwAAAcE"]
[Sat Jan 03 23:20:44.492178 2026] [:error] [pid 31222:tid 31234] [client 4.193.194.67:6857] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0x.php"] [unique_id "aVkzzKHw6nASHXAc2v8BlgAAAco"]
[Sat Jan 03 23:20:45.097122 2026] [:error] [pid 34260:tid 34276] [client 4.193.194.67:7018] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0x.php"] [unique_id "aVkzzUWWhyvZ0O9KNVQ-CwAAAQ4"]
[Sat Jan 03 23:20:45.840591 2026] [:error] [pid 1930:tid 1982] [client 4.193.194.67:6981] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0x.php"] [unique_id "aVkzzZP-6mqhfUDa89z76QAAAFA"]
[Sat Jan 03 23:20:46.210141 2026] [:error] [pid 1931:tid 2046] [client 4.193.194.67:6882] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adin.php"] [unique_id "aVkzzh8Tyw7ZoIdXlcYnBQAAAJY"]
[Sat Jan 03 23:20:46.849290 2026] [:error] [pid 2083:tid 2090] [client 4.193.194.67:6965] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adin.php"] [unique_id "aVkzzjVlR_BmlMPnhV4x7AAAAMU"]
[Sat Jan 03 23:20:47.252322 2026] [:error] [pid 2083:tid 2099] [client 4.193.194.67:6950] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adin.php"] [unique_id "aVkzzzVlR_BmlMPnhV4x7QAAAM4"]
[Sat Jan 03 23:20:47.750578 2026] [:error] [pid 31222:tid 31225] [client 4.193.194.67:6872] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adin.php"] [unique_id "aVkzz6Hw6nASHXAc2v8BqQAAAcE"]
[Sat Jan 03 23:20:48.007239 2026] [:error] [pid 1931:tid 2033] [client 4.193.194.67:6859] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/villain.php"] [unique_id "aVkz0B8Tyw7ZoIdXlcYnCgAAAIk"]
[Sat Jan 03 23:20:48.729623 2026] [:error] [pid 1931:tid 1994] [client 4.193.194.67:6873] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/villain.php"] [unique_id "aVkz0B8Tyw7ZoIdXlcYnEAAAAIE"]
[Sat Jan 03 23:20:49.130728 2026] [:error] [pid 1931:tid 2040] [client 4.193.194.67:7037] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/villain.php"] [unique_id "aVkz0R8Tyw7ZoIdXlcYnEQAAAJA"]
[Sat Jan 03 23:20:49.499635 2026] [:error] [pid 34260:tid 34273] [client 4.193.194.67:6809] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/villain.php"] [unique_id "aVkz0UWWhyvZ0O9KNVQ-EAAAAQs"]
[Sat Jan 03 23:20:49.861018 2026] [:error] [pid 34260:tid 34279] [client 4.193.194.67:6878] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jhdnZ.php"] [unique_id "aVkz0UWWhyvZ0O9KNVQ-EQAAARE"]
[Sat Jan 03 23:20:50.479834 2026] [:error] [pid 34260:tid 34286] [client 4.193.194.67:6825] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jhdnZ.php"] [unique_id "aVkz0kWWhyvZ0O9KNVQ-EwAAARg"]
[Sat Jan 03 23:20:51.057679 2026] [:error] [pid 19639:tid 19651] [client 4.193.194.67:7159] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jhdnZ.php"] [unique_id "aVkz0yQ7fWZUytnlHEwUUQAAAUo"]
[Sat Jan 03 23:20:51.637763 2026] [:error] [pid 1930:tid 1973] [client 4.193.194.67:6802] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jhdnZ.php"] [unique_id "aVkz05P-6mqhfUDa89z77QAAAEc"]
[Sat Jan 03 23:20:52.417065 2026] [:error] [pid 31630:tid 31656] [client 4.193.194.67:7075] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aku.php"] [unique_id "aVkz1PUV_PU2SWgLPuh4kQAAAZg"]
[Sat Jan 03 23:20:53.077348 2026] [:error] [pid 1931:tid 2034] [client 4.193.194.67:6917] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aku.php"] [unique_id "aVkz1R8Tyw7ZoIdXlcYnGAAAAIo"]
[Sat Jan 03 23:20:53.440144 2026] [:error] [pid 19639:tid 19660] [client 4.193.194.67:7035] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aku.php"] [unique_id "aVkz1SQ7fWZUytnlHEwUVwAAAVM"]
[Sat Jan 03 23:20:53.738939 2026] [:error] [pid 19639:tid 19664] [client 4.193.194.67:6907] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aku.php"] [unique_id "aVkz1SQ7fWZUytnlHEwUWAAAAVc"]
[Sat Jan 03 23:20:53.964622 2026] [:error] [pid 19639:tid 19659] [client 4.193.194.67:6960] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVkz1SQ7fWZUytnlHEwUWQAAAVI"]
[Sat Jan 03 23:20:54.268404 2026] [:error] [pid 1930:tid 1969] [client 4.193.194.67:6849] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVkz1pP-6mqhfUDa89z79QAAAEM"]
[Sat Jan 03 23:20:55.283585 2026] [:error] [pid 1931:tid 2047] [client 4.193.194.67:6944] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVkz1x8Tyw7ZoIdXlcYnGwAAAJc"]
[Sat Jan 03 23:20:55.915539 2026] [:error] [pid 31630:tid 31654] [client 4.193.194.67:6784] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "aVkz1_UV_PU2SWgLPuh4lAAAAZY"]
[Sat Jan 03 23:20:56.591670 2026] [:error] [pid 31630:tid 31647] [client 4.193.194.67:6911] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aVkz2PUV_PU2SWgLPuh4lgAAAY8"]
[Sat Jan 03 23:20:57.040830 2026] [:error] [pid 31222:tid 31231] [client 4.193.194.67:6921] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aVkz2aHw6nASHXAc2v8BuwAAAcc"]
[Sat Jan 03 23:20:57.325382 2026] [:error] [pid 1930:tid 1983] [client 4.193.194.67:6919] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aVkz2ZP-6mqhfUDa89z8CAAAAFE"]
[Sat Jan 03 23:20:57.622609 2026] [:error] [pid 1930:tid 1977] [client 4.193.194.67:6936] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aVkz2ZP-6mqhfUDa89z8CwAAAEs"]
[Sat Jan 03 23:20:57.810694 2026] [:error] [pid 31222:tid 31225] [client 4.193.194.67:6909] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/zwso.php"] [unique_id "aVkz2aHw6nASHXAc2v8BvQAAAcE"]
[Sat Jan 03 23:20:58.096236 2026] [:error] [pid 31222:tid 31248] [client 4.193.194.67:6720] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/zwso.php"] [unique_id "aVkz2qHw6nASHXAc2v8BvgAAAdg"]
[Sat Jan 03 23:20:58.399874 2026] [:error] [pid 31222:tid 31228] [client 4.193.194.67:6897] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/zwso.php"] [unique_id "aVkz2qHw6nASHXAc2v8BwQAAAcQ"]
[Sat Jan 03 23:20:58.821975 2026] [:error] [pid 31222:tid 31230] [client 4.193.194.67:6800] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/zwso.php"] [unique_id "aVkz2qHw6nASHXAc2v8BwgAAAcY"]
[Sat Jan 03 23:20:59.091285 2026] [:error] [pid 31222:tid 31246] [client 4.193.194.67:7028] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpssl.php"] [unique_id "aVkz26Hw6nASHXAc2v8BxAAAAdY"]
[Sat Jan 03 23:20:59.409810 2026] [:error] [pid 1929:tid 1942] [client 4.193.194.67:7015] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpssl.php"] [unique_id "aVkz2-cFqdpu6TNsuWoL3QAAAAQ"]
[Sat Jan 03 23:20:59.659285 2026] [:error] [pid 31630:tid 31639] [client 4.193.194.67:6812] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpssl.php"] [unique_id "aVkz2_UV_PU2SWgLPuh4mQAAAYc"]
[Sat Jan 03 23:21:00.188053 2026] [:error] [pid 19639:tid 19665] [client 4.193.194.67:7160] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpssl.php"] [unique_id "aVkz3CQ7fWZUytnlHEwUWwAAAVg"]
[Sat Jan 03 23:21:00.530661 2026] [:error] [pid 1930:tid 1979] [client 4.193.194.67:6885] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/witmmm.php"] [unique_id "aVkz3JP-6mqhfUDa89z8FwAAAE0"]
[Sat Jan 03 23:21:00.792668 2026] [:error] [pid 31222:tid 31244] [client 4.193.194.67:6876] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/witmmm.php"] [unique_id "aVkz3KHw6nASHXAc2v8BygAAAdQ"]
[Sat Jan 03 23:21:01.078205 2026] [:error] [pid 1930:tid 1983] [client 4.193.194.67:7038] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/witmmm.php"] [unique_id "aVkz3ZP-6mqhfUDa89z8GQAAAFE"]
[Sat Jan 03 23:21:01.644001 2026] [:error] [pid 19639:tid 19663] [client 4.193.194.67:6884] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/witmmm.php"] [unique_id "aVkz3SQ7fWZUytnlHEwUXgAAAVY"]
[Sat Jan 03 23:21:01.908138 2026] [:error] [pid 31222:tid 31224] [client 4.193.194.67:6805] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/18299.php"] [unique_id "aVkz3aHw6nASHXAc2v8BzAAAAcA"]
[Sat Jan 03 23:21:02.162193 2026] [:error] [pid 34260:tid 34262] [client 4.193.194.67:6923] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/18299.php"] [unique_id "aVkz3kWWhyvZ0O9KNVQ-GgAAAQA"]
[Sat Jan 03 23:21:02.440990 2026] [:error] [pid 34260:tid 34267] [client 4.193.194.67:6871] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/18299.php"] [unique_id "aVkz3kWWhyvZ0O9KNVQ-GwAAAQU"]
[Sat Jan 03 23:21:02.705830 2026] [:error] [pid 31222:tid 31231] [client 4.193.194.67:6887] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/18299.php"] [unique_id "aVkz3qHw6nASHXAc2v8BzQAAAcc"]
[Sat Jan 03 23:21:02.948397 2026] [:error] [pid 31630:tid 31636] [client 4.193.194.67:6954] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxasd.php"] [unique_id "aVkz3vUV_PU2SWgLPuh4ngAAAYQ"]
[Sat Jan 03 23:21:03.147814 2026] [:error] [pid 31630:tid 31646] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/zxasd.php
[Sat Jan 03 23:21:03.239771 2026] [:error] [pid 31630:tid 31648] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/wpfile.php
[Sat Jan 03 23:21:03.329897 2026] [:error] [pid 31630:tid 31633] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/foyhd.php
[Sat Jan 03 23:21:03.420471 2026] [:error] [pid 31630:tid 31644] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/f350.php
[Sat Jan 03 23:21:03.538473 2026] [:error] [pid 31630:tid 31656] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/CmKHK.php
[Sat Jan 03 23:21:03.641798 2026] [:error] [pid 31630:tid 31653] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/rtg.php
[Sat Jan 03 23:21:03.784636 2026] [:error] [pid 31630:tid 31651] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/fluentform.php
[Sat Jan 03 23:21:03.875395 2026] [:error] [pid 31630:tid 31654] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/agqpec.php
[Sat Jan 03 23:21:03.966882 2026] [:error] [pid 31630:tid 31655] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/byuri.php
[Sat Jan 03 23:21:04.058315 2026] [:error] [pid 31630:tid 31647] [client 4.193.194.67:6868] File does not exist: /usr/local/apache/htdocs/suspended-page/oiko6u.php
[Sat Jan 03 23:21:04.267663 2026] [:error] [pid 31630:tid 31650] [client 4.193.194.67:6868] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9WOLF.php"] [unique_id "aVkz4PUV_PU2SWgLPuh4qgAAAZI"]
[Sat Jan 03 23:21:04.504175 2026] [:error] [pid 31222:tid 31248] [client 4.193.194.67:6963] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9WOLF.php"] [unique_id "aVkz4KHw6nASHXAc2v8B0QAAAdg"]
[Sat Jan 03 23:21:05.087963 2026] [:error] [pid 31630:tid 31634] [client 4.193.194.67:22672] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9WOLF.php"] [unique_id "aVkz4fUV_PU2SWgLPuh4sAAAAYI"]
[Sat Jan 03 23:21:05.347089 2026] [:error] [pid 31222:tid 31243] [client 4.193.194.67:6837] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9WOLF.php"] [unique_id "aVkz4aHw6nASHXAc2v8B0gAAAdM"]
[Sat Jan 03 23:21:05.545875 2026] [:error] [pid 34260:tid 34284] [client 4.193.194.67:6888] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crew.php"] [unique_id "aVkz4UWWhyvZ0O9KNVQ-HwAAARY"]
[Sat Jan 03 23:21:05.732640 2026] [:error] [pid 31222:tid 31228] [client 4.193.194.67:6890] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crew.php"] [unique_id "aVkz4aHw6nASHXAc2v8B1AAAAcQ"]
[Sat Jan 03 23:21:06.014931 2026] [:error] [pid 31222:tid 31236] [client 4.193.194.67:6883] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crew.php"] [unique_id "aVkz4qHw6nASHXAc2v8B1QAAAcw"]
[Sat Jan 03 23:21:06.287661 2026] [:error] [pid 1930:tid 1987] [client 4.193.194.67:6952] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crew.php"] [unique_id "aVkz4pP-6mqhfUDa89z8JgAAAFU"]
[Sat Jan 03 23:21:06.521752 2026] [:error] [pid 1931:tid 2027] [client 4.193.194.67:6970] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx_pms.php"] [unique_id "aVkz4h8Tyw7ZoIdXlcYnJAAAAIQ"]
[Sat Jan 03 23:21:06.773621 2026] [:error] [pid 1931:tid 2045] [client 4.193.194.67:6956] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx_pms.php"] [unique_id "aVkz4h8Tyw7ZoIdXlcYnJQAAAJU"]
[Sat Jan 03 23:21:07.013865 2026] [:error] [pid 2083:tid 2096] [client 4.193.194.67:6657] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx_pms.php"] [unique_id "aVkz4zVlR_BmlMPnhV4x-gAAAMs"]
[Sat Jan 03 23:21:07.233113 2026] [:error] [pid 1929:tid 1945] [client 4.193.194.67:6975] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx_pms.php"] [unique_id "aVkz4-cFqdpu6TNsuWoL4gAAAAc"]
[Sat Jan 03 23:21:07.504933 2026] [:error] [pid 19639:tid 19657] [client 4.193.194.67:6860] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btex.php"] [unique_id "aVkz4yQ7fWZUytnlHEwUXwAAAVA"]
[Sat Jan 03 23:21:07.732810 2026] [:error] [pid 31222:tid 31234] [client 4.193.194.67:6877] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btex.php"] [unique_id "aVkz46Hw6nASHXAc2v8B2gAAAco"]
[Sat Jan 03 23:21:07.992940 2026] [:error] [pid 19639:tid 19650] [client 4.193.194.67:6830] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btex.php"] [unique_id "aVkz4yQ7fWZUytnlHEwUYAAAAUk"]
[Sat Jan 03 23:21:08.278399 2026] [:error] [pid 2083:tid 2104] [client 4.193.194.67:6898] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btex.php"] [unique_id "aVkz5DVlR_BmlMPnhV4x_QAAANM"]
[Sat Jan 03 23:21:08.578370 2026] [:error] [pid 2083:tid 2085] [client 4.193.194.67:6847] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lptlo.php"] [unique_id "aVkz5DVlR_BmlMPnhV4x_wAAAMA"]
[Sat Jan 03 23:21:08.845267 2026] [:error] [pid 1930:tid 1989] [client 4.193.194.67:6945] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lptlo.php"] [unique_id "aVkz5JP-6mqhfUDa89z8LAAAAFc"]
[Sat Jan 03 23:21:09.111622 2026] [:error] [pid 1930:tid 1984] [client 4.193.194.67:6814] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lptlo.php"] [unique_id "aVkz5ZP-6mqhfUDa89z8LgAAAFI"]
[Sat Jan 03 23:21:09.430317 2026] [:error] [pid 1931:tid 1996] [client 4.193.194.67:6742] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lptlo.php"] [unique_id "aVkz5R8Tyw7ZoIdXlcYnJwAAAII"]
[Sat Jan 03 23:21:09.625163 2026] [:error] [pid 19639:tid 19648] [client 4.193.194.67:6785] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xlluw.php"] [unique_id "aVkz5SQ7fWZUytnlHEwUYwAAAUc"]
[Sat Jan 03 23:21:09.834084 2026] [:error] [pid 1930:tid 1975] [client 4.193.194.67:6819] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xlluw.php"] [unique_id "aVkz5ZP-6mqhfUDa89z8MQAAAEk"]
[Sat Jan 03 23:21:10.177778 2026] [:error] [pid 1931:tid 2034] [client 4.193.194.67:6861] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xlluw.php"] [unique_id "aVkz5h8Tyw7ZoIdXlcYnKAAAAIo"]
[Sat Jan 03 23:21:10.533871 2026] [:error] [pid 1931:tid 2042] [client 4.193.194.67:6961] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xlluw.php"] [unique_id "aVkz5h8Tyw7ZoIdXlcYnKQAAAJI"]
[Sat Jan 03 23:21:10.841035 2026] [:error] [pid 31222:tid 31228] [client 4.193.194.67:6895] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auot.php"] [unique_id "aVkz5qHw6nASHXAc2v8B4QAAAcQ"]
[Sat Jan 03 23:21:11.187639 2026] [:error] [pid 19639:tid 19642] [client 4.193.194.67:6889] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auot.php"] [unique_id "aVkz5yQ7fWZUytnlHEwUZwAAAUE"]
[Sat Jan 03 23:21:11.598679 2026] [:error] [pid 31222:tid 31235] [client 4.193.194.67:6827] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auot.php"] [unique_id "aVkz56Hw6nASHXAc2v8B5AAAAcs"]
[Sat Jan 03 23:21:11.869607 2026] [:error] [pid 1929:tid 1943] [client 4.193.194.67:6968] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auot.php"] [unique_id "aVkz5-cFqdpu6TNsuWoL4wAAAAU"]
[Sat Jan 03 23:21:12.164591 2026] [:error] [pid 1931:tid 2047] [client 4.193.194.67:6874] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ymq4nt.php"] [unique_id "aVkz6B8Tyw7ZoIdXlcYnKwAAAJc"]
[Sat Jan 03 23:21:12.585645 2026] [:error] [pid 31222:tid 31239] [client 4.193.194.67:6905] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ymq4nt.php"] [unique_id "aVkz6KHw6nASHXAc2v8B5gAAAc8"]
[Sat Jan 03 23:21:12.948878 2026] [:error] [pid 1929:tid 1956] [client 4.193.194.67:6806] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ymq4nt.php"] [unique_id "aVkz6OcFqdpu6TNsuWoL5QAAABI"]
[Sat Jan 03 23:21:13.281445 2026] [:error] [pid 1929:tid 1950] [client 4.193.194.67:6744] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ymq4nt.php"] [unique_id "aVkz6ecFqdpu6TNsuWoL6AAAAAw"]
[Sat Jan 03 23:21:13.501981 2026] [:error] [pid 1931:tid 2039] [client 4.193.194.67:6843] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inzrw.php"] [unique_id "aVkz6R8Tyw7ZoIdXlcYnNwAAAI8"]
[Sat Jan 03 23:21:13.796332 2026] [:error] [pid 19639:tid 19652] [client 4.193.194.67:6908] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inzrw.php"] [unique_id "aVkz6SQ7fWZUytnlHEwUcAAAAUs"]
[Sat Jan 03 23:21:14.070696 2026] [:error] [pid 1930:tid 1968] [client 4.193.194.67:6910] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inzrw.php"] [unique_id "aVkz6pP-6mqhfUDa89z8MwAAAEI"]
[Sat Jan 03 23:21:14.303069 2026] [:error] [pid 1929:tid 1952] [client 4.193.194.67:6815] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inzrw.php"] [unique_id "aVkz6ucFqdpu6TNsuWoL6QAAAA4"]
[Sat Jan 03 23:21:14.616370 2026] [:error] [pid 19639:tid 19657] [client 4.193.194.67:6927] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca.php"] [unique_id "aVkz6iQ7fWZUytnlHEwUcwAAAVA"]
[Sat Jan 03 23:21:14.851599 2026] [:error] [pid 19639:tid 19650] [client 4.193.194.67:6941] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca.php"] [unique_id "aVkz6iQ7fWZUytnlHEwUdAAAAUk"]
[Sat Jan 03 23:21:15.080669 2026] [:error] [pid 1930:tid 1973] [client 4.193.194.67:6786] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca.php"] [unique_id "aVkz65P-6mqhfUDa89z8NAAAAEc"]
[Sat Jan 03 23:21:15.283617 2026] [:error] [pid 1929:tid 1953] [client 4.193.194.67:6810] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca.php"] [unique_id "aVkz6-cFqdpu6TNsuWoL7wAAAA8"]
[Sat Jan 03 23:21:15.483984 2026] [:error] [pid 1929:tid 1948] [client 4.193.194.67:6879] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iuoqc.php"] [unique_id "aVkz6-cFqdpu6TNsuWoL8gAAAAo"]
[Sat Jan 03 23:21:15.686646 2026] [:error] [pid 19639:tid 19646] [client 4.193.194.67:6680] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iuoqc.php"] [unique_id "aVkz6yQ7fWZUytnlHEwUdwAAAUU"]
[Sat Jan 03 23:21:15.874267 2026] [:error] [pid 1929:tid 1951] [client 4.193.194.67:7119] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iuoqc.php"] [unique_id "aVkz6-cFqdpu6TNsuWoL9gAAAA0"]
[Sat Jan 03 23:21:16.099705 2026] [:error] [pid 19639:tid 19642] [client 4.193.194.67:6850] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iuoqc.php"] [unique_id "aVkz7CQ7fWZUytnlHEwUeAAAAUE"]
[Sat Jan 03 23:21:16.322950 2026] [:error] [pid 2083:tid 2108] [client 4.193.194.67:6826] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1j.php"] [unique_id "aVkz7DVlR_BmlMPnhV4yBAAAANc"]
[Sat Jan 03 23:21:16.563733 2026] [:error] [pid 19639:tid 19662] [client 4.193.194.67:6803] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1j.php"] [unique_id "aVkz7CQ7fWZUytnlHEwUeQAAAVU"]
[Sat Jan 03 23:21:16.739695 2026] [:error] [pid 19639:tid 19661] [client 4.193.194.67:6788] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1j.php"] [unique_id "aVkz7CQ7fWZUytnlHEwUegAAAVQ"]
[Sat Jan 03 23:21:17.035591 2026] [:error] [pid 19639:tid 19656] [client 4.193.194.67:6942] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1j.php"] [unique_id "aVkz7SQ7fWZUytnlHEwUfAAAAU8"]
[Sat Jan 03 23:21:17.319943 2026] [:error] [pid 19639:tid 19659] [client 4.193.194.67:6787] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qufsq.php"] [unique_id "aVkz7SQ7fWZUytnlHEwUgAAAAVI"]
[Sat Jan 03 23:21:17.669073 2026] [:error] [pid 1931:tid 2029] [client 4.193.194.67:6804] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qufsq.php"] [unique_id "aVkz7R8Tyw7ZoIdXlcYnQAAAAIU"]
[Sat Jan 03 23:21:17.885464 2026] [:error] [pid 1929:tid 1952] [client 4.193.194.67:6893] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qufsq.php"] [unique_id "aVkz7ecFqdpu6TNsuWoL-QAAAA4"]
[Sat Jan 03 23:21:18.194457 2026] [:error] [pid 1930:tid 1981] [client 4.193.194.67:6854] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qufsq.php"] [unique_id "aVkz7pP-6mqhfUDa89z8NwAAAE8"]
[Sat Jan 03 23:21:18.523506 2026] [:error] [pid 34260:tid 34280] [client 4.193.194.67:6745] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVkz7kWWhyvZ0O9KNVQ-NAAAARI"]
[Sat Jan 03 23:21:18.893560 2026] [:error] [pid 2083:tid 2107] [client 4.193.194.67:6754] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVkz7jVlR_BmlMPnhV4yBwAAANY"]
[Sat Jan 03 23:21:19.116064 2026] [:error] [pid 2083:tid 2097] [client 4.193.194.67:6798] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVkz7zVlR_BmlMPnhV4yCQAAAMw"]
[Sat Jan 03 23:21:19.392692 2026] [:error] [pid 19639:tid 19654] [client 4.193.194.67:6736] [client 4.193.194.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVkz7yQ7fWZUytnlHEwUhQAAAU0"]
[Sun Jan 04 03:00:56.743024 2026] [:error] [pid 11559:tid 11573] [client 43.156.109.53:35076] [client 43.156.109.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVlnaKYDjvbj8bSHy5rnnAAAAQs"]
[Sun Jan 04 04:45:29.298764 2026] [:error] [pid 37537:tid 37589] [client 104.28.246.116:35276] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aVl_6QjHz7EQ5p_4u2pPdwAAAFA"]
[Sun Jan 04 04:45:29.754643 2026] [:error] [pid 37636:tid 37653] [client 104.28.246.116:53027] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/style.php"] [unique_id "aVl_6S3kmZpEf9yy2b0p0QAAAM0"]
[Sun Jan 04 04:45:37.196385 2026] [:error] [pid 37636:tid 37650] [client 104.28.246.116:35227] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/themes/style.php"] [unique_id "aVl_8S3kmZpEf9yy2b0p6gAAAMo"]
[Sun Jan 04 04:45:39.056477 2026] [:error] [pid 37537:tid 37578] [client 104.28.246.116:40444] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/style.php"] [unique_id "aVl_8wjHz7EQ5p_4u2pPhQAAAEU"]
[Sun Jan 04 04:49:24.168206 2026] [:error] [pid 37636:tid 37664] [client 182.42.111.213:60086] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVmA1C3kmZpEf9yy2b0rxwAAANg"]
[Sun Jan 04 07:12:01.967247 2026] [:error] [pid 37538:tid 37603] [client 170.106.197.109:41038] [client 170.106.197.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVmiQYzU2j98LiSLQvRsCAAAAIM"]
[Sun Jan 04 09:08:52.990995 2026] [:error] [pid 21773:tid 21781] [client 49.51.36.179:53728] [client 49.51.36.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVm9pHvK0K5woa_VhGVO0QAAAcU"]
[Sun Jan 04 10:45:02.565746 2026] [:error] [pid 36501:tid 36528] [client 111.172.249.49:58940] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVnULmc_hXdR6wnjAmuqSgAAAhY"]
[Sun Jan 04 15:51:54.142119 2026] [:error] [pid 1080:tid 1154] [client 43.156.168.214:42456] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVocGiu2Hm9AcIiqg0qhrwAAA88"]
[Sun Jan 04 16:56:21.334432 2026] [:error] [pid 59250:tid 59266] [client 182.42.104.32:35758] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVorNfPJ-KGeNWdqpudPcwAAAMs"]
[Sun Jan 04 18:03:57.824717 2026] [:error] [pid 4365:tid 4398] [client 138.197.13.155:54070] [client 138.197.13.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aVo7DcMi25XHOoMs4mdmMwAAAYM"], referer: binance.com
[Sun Jan 04 21:36:30.811218 2026] [:error] [pid 34909:tid 34931] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/nz.php
[Sun Jan 04 21:36:31.301216 2026] [:error] [pid 34909:tid 34931] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Sun Jan 04 21:36:31.439219 2026] [:error] [pid 34909:tid 34930] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sun Jan 04 21:36:31.578412 2026] [:error] [pid 34909:tid 34933] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Sun Jan 04 21:36:31.716808 2026] [:error] [pid 34909:tid 34935] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Sun Jan 04 21:36:31.856961 2026] [:error] [pid 34909:tid 34927] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Jan 04 21:36:32.290200 2026] [:error] [pid 34909:tid 34921] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Sun Jan 04 21:36:32.430144 2026] [:error] [pid 34909:tid 34913] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Sun Jan 04 21:36:32.581600 2026] [:error] [pid 34909:tid 34936] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Sun Jan 04 21:36:32.735789 2026] [:error] [pid 34909:tid 34932] [client 4.213.62.73:50536] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sun Jan 04 21:36:33.530253 2026] [:error] [pid 34909:tid 34926] [client 4.213.62.73:50536] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVps4fapPFwNYuuHrErlvwAAAg0"]
[Sun Jan 04 21:36:35.025513 2026] [:error] [pid 30985:tid 31022] [client 4.213.62.73:62059] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVps40isiM0XfzVcTWCobgAAAcg"]
[Sun Jan 04 21:36:36.090041 2026] [:error] [pid 34877:tid 34903] [client 4.213.62.73:50544] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVps5N73XYSsDqIglow-qQAAAZg"]
[Sun Jan 04 21:36:37.317802 2026] [:error] [pid 30954:tid 30971] [client 4.213.62.73:62022] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVps5U4oIXUIQsb698rkVgAAAQ8"]
[Sun Jan 04 21:36:38.801705 2026] [:error] [pid 30985:tid 31017] [client 4.213.62.73:62032] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVps5kisiM0XfzVcTWCofAAAAcM"]
[Sun Jan 04 21:36:40.121385 2026] [:error] [pid 34909:tid 34937] [client 4.213.62.73:12739] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVps6PapPFwNYuuHrErl0gAAAhg"]
[Sun Jan 04 21:36:42.050823 2026] [:error] [pid 30985:tid 31031] [client 4.213.62.73:62078] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVps6kisiM0XfzVcTWCojgAAAdE"]
[Sun Jan 04 21:36:43.114159 2026] [:error] [pid 34968:tid 35020] [client 4.213.62.73:57608] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVps63fPZUTHI4LyaU3BaAAAA5Y"]
[Sun Jan 04 21:36:44.020328 2026] [:error] [pid 37227:tid 37288] [client 4.213.62.73:62043] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVps7JAQAfXb5IgCkZOU-QAAA8M"]
[Sun Jan 04 21:36:46.180475 2026] [:error] [pid 37164:tid 37195] [client 4.213.62.73:50515] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVps7utKMVhFX_Z4JX7DXQAAAVc"]
[Sun Jan 04 21:36:47.249038 2026] [:error] [pid 34909:tid 34932] [client 4.213.62.73:53497] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVps7_apPFwNYuuHrErl9gAAAhM"]
[Sun Jan 04 21:36:48.182173 2026] [:error] [pid 37227:tid 37286] [client 4.213.62.73:50537] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVps8JAQAfXb5IgCkZOVDgAAA8E"]
[Sun Jan 04 21:36:49.860979 2026] [:error] [pid 34968:tid 35008] [client 4.213.62.73:50516] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVps8XfPZUTHI4LyaU3BcAAAA4o"]
[Sun Jan 04 21:36:52.080345 2026] [:error] [pid 34877:tid 34895] [client 4.213.62.73:62058] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVps9N73XYSsDqIglow-0AAAAZA"]
[Sun Jan 04 21:36:54.655033 2026] [:error] [pid 34968:tid 34998] [client 4.213.62.73:51296] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVps9nfPZUTHI4LyaU3BfgAAA4A"]
[Sun Jan 04 21:36:58.242755 2026] [:error] [pid 30985:tid 31037] [client 4.213.62.73:56390] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVps-kisiM0XfzVcTWCopQAAAdc"]
[Sun Jan 04 21:37:00.076494 2026] [:error] [pid 34877:tid 34898] [client 4.213.62.73:62021] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVps_N73XYSsDqIglow-3QAAAZM"]
[Sun Jan 04 21:37:01.739129 2026] [:error] [pid 37165:tid 37218] [client 4.213.62.73:53447] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVps_VwRLzfe8wOrQpRU_AAAAlM"]
[Sun Jan 04 21:37:05.447818 2026] [:error] [pid 30954:tid 30975] [client 4.213.62.73:53452] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVptAU4oIXUIQsb698rkfgAAARM"]
[Sun Jan 04 21:37:08.066636 2026] [:error] [pid 37164:tid 37184] [client 4.213.62.73:62056] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVptBOtKMVhFX_Z4JX7DfAAAAUw"]
[Sun Jan 04 21:37:09.844409 2026] [:error] [pid 30985:tid 31018] [client 4.213.62.73:51299] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVptBUisiM0XfzVcTWCotAAAAcQ"]
[Sun Jan 04 21:37:11.227941 2026] [:error] [pid 37165:tid 37212] [client 4.213.62.73:62044] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVptB1wRLzfe8wOrQpRVEQAAAk0"]
[Sun Jan 04 21:37:13.441384 2026] [:error] [pid 30985:tid 31028] [client 4.213.62.73:50535] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVptCUisiM0XfzVcTWCouwAAAc4"]
[Sun Jan 04 21:37:14.635628 2026] [:error] [pid 23868:tid 23885] [client 4.213.62.73:50543] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVptCrbaf-JYFyQL_06FEAAAAEk"]
[Sun Jan 04 21:37:15.179651 2026] [:error] [pid 23868:tid 23895] [client 4.213.62.73:54559] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVptC7baf-JYFyQL_06FEQAAAFM"]
[Sun Jan 04 21:37:17.368789 2026] [:error] [pid 34909:tid 34922] [client 4.213.62.73:56435] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVptDfapPFwNYuuHrErmGgAAAgk"]
[Sun Jan 04 21:37:22.171747 2026] [:error] [pid 34968:tid 35004] [client 4.213.62.73:62030] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVptEnfPZUTHI4LyaU3BpgAAA4Y"]
[Sun Jan 04 21:37:26.311393 2026] [:error] [pid 37164:tid 37183] [client 4.213.62.73:54541] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVptFutKMVhFX_Z4JX7DkAAAAUs"]
[Sun Jan 04 21:37:29.189868 2026] [:error] [pid 34909:tid 34936] [client 4.213.62.73:63963] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blnux.php"] [unique_id "aVptGfapPFwNYuuHrErmJwAAAhc"]
[Sun Jan 04 21:37:32.006123 2026] [:error] [pid 37164:tid 37181] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Sun Jan 04 21:37:32.149049 2026] [:error] [pid 37164:tid 37183] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Sun Jan 04 21:37:32.304265 2026] [:error] [pid 37164:tid 37175] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/msy.php
[Sun Jan 04 21:37:32.460493 2026] [:error] [pid 37164:tid 37187] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/alog.php
[Sun Jan 04 21:37:32.600205 2026] [:error] [pid 37164:tid 37193] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/X7T6.php
[Sun Jan 04 21:37:32.740267 2026] [:error] [pid 37164:tid 37174] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Sun Jan 04 21:37:32.906667 2026] [:error] [pid 37164:tid 37177] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Sun Jan 04 21:37:33.045648 2026] [:error] [pid 37164:tid 37188] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Sun Jan 04 21:37:33.187221 2026] [:error] [pid 37164:tid 37190] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Sun Jan 04 21:37:33.382717 2026] [:error] [pid 37164:tid 37192] [client 4.213.62.73:63982] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Sun Jan 04 22:33:03.844590 2026] [:error] [pid 48633:tid 48653] [client 43.130.78.203:48202] [client 43.130.78.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVp6H3pmEoQIuLH2aWhLOgAAAFI"]
[Sun Jan 04 23:06:05.065411 2026] [:error] [pid 48667:tid 48715] [client 43.153.123.3:48940] [client 43.153.123.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVqB3XO6aihVIlrNAPj-2gAAARI"]
[Mon Jan 05 02:10:50.992925 2026] [:error] [pid 6937:tid 6969] [client 43.157.22.57:32830] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVqtKgfTYSkMJzNSH4VuQwAAAUY"]
[Mon Jan 05 03:03:32.625118 2026] [:error] [pid 22541:tid 22609] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Mon Jan 05 03:03:32.975650 2026] [:error] [pid 22541:tid 22615] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/ups.php
[Mon Jan 05 03:03:33.548369 2026] [:error] [pid 22541:tid 22619] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/xzs.php
[Mon Jan 05 03:03:33.670901 2026] [:error] [pid 22541:tid 22613] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Mon Jan 05 03:03:34.062108 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/ws35.php
[Mon Jan 05 03:03:34.507675 2026] [:error] [pid 22541:tid 22618] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Mon Jan 05 03:03:34.629898 2026] [:error] [pid 22541:tid 22603] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Jan 05 03:03:34.751117 2026] [:error] [pid 22541:tid 22610] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/f8.php
[Mon Jan 05 03:03:35.147645 2026] [:error] [pid 22541:tid 22607] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/ws28.php
[Mon Jan 05 03:03:35.279484 2026] [:error] [pid 22541:tid 22605] [client 4.189.161.78:23591] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Mon Jan 05 03:03:35.398740 2026] [:error] [pid 22541:tid 22602] [client 4.189.161.78:23591] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVq5h0kjzS6tgkL3JEu9dAAAAgE"]
[Mon Jan 05 03:03:36.681007 2026] [:error] [pid 11570:tid 11586] [client 4.189.161.78:23593] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVq5iFpq_sPZb-JYukUZ6wAAAs4"]
[Mon Jan 05 03:03:37.270858 2026] [:error] [pid 7155:tid 7167] [client 4.189.161.78:23555] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVq5iSD_CRsWjWrSXNJOTgAAAYo"]
[Mon Jan 05 03:03:37.982843 2026] [:error] [pid 6937:tid 6991] [client 4.189.161.78:23567] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVq5iQfTYSkMJzNSH4V9KAAAAVU"]
[Mon Jan 05 03:03:38.542376 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:30348] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVq5igfTYSkMJzNSH4V9KQAAAVY"]
[Mon Jan 05 03:03:39.301679 2026] [:error] [pid 6613:tid 6625] [client 4.189.161.78:65400] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVq5i8W2a9pc2Efh4D0ZbwAAAQo"]
[Mon Jan 05 03:03:39.930560 2026] [:error] [pid 22540:tid 22577] [client 4.189.161.78:23569] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVq5izQAa5AoSeJHBNqPWwAAAAM"]
[Mon Jan 05 03:03:40.965883 2026] [:error] [pid 6613:tid 6639] [client 4.189.161.78:23581] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVq5jMW2a9pc2Efh4D0ZcwAAARg"]
[Mon Jan 05 03:03:41.995257 2026] [:error] [pid 7626:tid 7659] [client 4.189.161.78:30360] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVq5jVjhVzHrevQ2GQzt7wAAAdQ"]
[Mon Jan 05 03:03:43.091873 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:30391] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVq5jwfTYSkMJzNSH4V9LAAAAVE"]
[Mon Jan 05 03:03:44.202658 2026] [:error] [pid 7626:tid 7646] [client 4.189.161.78:23553] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVq5kFjhVzHrevQ2GQzt8QAAAcc"]
[Mon Jan 05 03:03:44.690055 2026] [:error] [pid 7626:tid 7657] [client 4.189.161.78:30381] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVq5kFjhVzHrevQ2GQzt8gAAAdI"]
[Mon Jan 05 03:03:45.976605 2026] [:error] [pid 22541:tid 22611] [client 4.189.161.78:30363] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVq5kUkjzS6tgkL3JEu9egAAAgo"]
[Mon Jan 05 03:03:46.531163 2026] [:error] [pid 8447:tid 8461] [client 4.189.161.78:30367] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVq5krlwvJttJsvQpd_spQAAAos"]
[Mon Jan 05 03:03:47.391743 2026] [:error] [pid 8447:tid 8466] [client 4.189.161.78:23586] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVq5k7lwvJttJsvQpd_sqAAAApA"]
[Mon Jan 05 03:03:48.695480 2026] [:error] [pid 22540:tid 22582] [client 4.189.161.78:23584] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVq5lDQAa5AoSeJHBNqPYQAAAAg"]
[Mon Jan 05 03:03:49.802539 2026] [:error] [pid 11570:tid 11580] [client 4.189.161.78:23594] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVq5lVpq_sPZb-JYukUZ7wAAAsg"]
[Mon Jan 05 03:03:50.461318 2026] [:error] [pid 7626:tid 7651] [client 4.189.161.78:30350] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVq5lljhVzHrevQ2GQzt-AAAAcw"]
[Mon Jan 05 03:03:51.504810 2026] [:error] [pid 22540:tid 22585] [client 4.189.161.78:23562] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVq5lzQAa5AoSeJHBNqPYgAAAAs"]
[Mon Jan 05 03:03:52.103469 2026] [:error] [pid 7716:tid 7746] [client 4.189.161.78:23557] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVq5mDZZYbEubuUOjjbsaQAAAlY"]
[Mon Jan 05 03:03:52.606108 2026] [:error] [pid 22540:tid 22586] [client 4.189.161.78:23596] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVq5mDQAa5AoSeJHBNqPZAAAAAw"]
[Mon Jan 05 03:03:54.023121 2026] [:error] [pid 7716:tid 7739] [client 4.189.161.78:23565] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVq5mjZZYbEubuUOjjbsawAAAk8"]
[Mon Jan 05 03:03:55.304014 2026] [:error] [pid 6613:tid 6637] [client 4.189.161.78:65314] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVq5m8W2a9pc2Efh4D0ZgwAAARY"]
[Mon Jan 05 03:03:55.908683 2026] [:error] [pid 1221:tid 1268] [client 4.189.161.78:30353] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVq5m5_3f4CdEKVLTXUYWwAAAI0"]
[Mon Jan 05 03:03:56.924390 2026] [:error] [pid 22540:tid 22588] [client 4.189.161.78:30372] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless14.php"] [unique_id "aVq5nDQAa5AoSeJHBNqPagAAAA4"]
[Mon Jan 05 03:03:58.732154 2026] [:error] [pid 7155:tid 7169] [client 4.189.161.78:23611] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless14.php"] [unique_id "aVq5niD_CRsWjWrSXNJOWAAAAYw"]
[Mon Jan 05 03:04:01.134359 2026] [:error] [pid 8447:tid 8471] [client 4.189.161.78:30390] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless14.php"] [unique_id "aVq5oblwvJttJsvQpd_ssAAAApU"]
[Mon Jan 05 03:04:02.231012 2026] [:error] [pid 11570:tid 11575] [client 4.189.161.78:30395] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless14.php"] [unique_id "aVq5olpq_sPZb-JYukUZ-gAAAsM"]
[Mon Jan 05 03:04:04.565525 2026] [:error] [pid 11570:tid 11576] [client 4.189.161.78:65382] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/87.php"] [unique_id "aVq5pFpq_sPZb-JYukUZ-wAAAsQ"]
[Mon Jan 05 03:04:09.896126 2026] [:error] [pid 22541:tid 22606] [client 4.189.161.78:65362] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/87.php"] [unique_id "aVq5qUkjzS6tgkL3JEu9igAAAgU"]
[Mon Jan 05 03:04:10.214614 2026] [:error] [pid 1221:tid 1261] [client 4.189.161.78:23577] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/87.php"] [unique_id "aVq5qp_3f4CdEKVLTXUYZwAAAIY"]
[Mon Jan 05 03:04:10.526396 2026] [:error] [pid 6937:tid 6980] [client 4.189.161.78:23609] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/87.php"] [unique_id "aVq5qgfTYSkMJzNSH4V9OgAAAUs"]
[Mon Jan 05 03:04:12.019445 2026] [:error] [pid 6937:tid 6993] [client 4.189.161.78:23564] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVq5rAfTYSkMJzNSH4V9OwAAAVc"]
[Mon Jan 05 03:04:13.180589 2026] [:error] [pid 7626:tid 7650] [client 4.189.161.78:65392] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVq5rVjhVzHrevQ2GQzuAwAAAcs"]
[Mon Jan 05 03:04:15.286287 2026] [:error] [pid 11570:tid 11595] [client 4.189.161.78:30368] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVq5r1pq_sPZb-JYukUaBwAAAtc"]
[Mon Jan 05 03:04:16.657023 2026] [:error] [pid 1221:tid 1273] [client 4.189.161.78:30356] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVq5sJ_3f4CdEKVLTXUYcgAAAJI"]
[Mon Jan 05 03:04:17.212956 2026] [:error] [pid 1221:tid 1278] [client 4.189.161.78:30352] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVq5sZ_3f4CdEKVLTXUYdAAAAJc"]
[Mon Jan 05 03:04:17.712209 2026] [:error] [pid 8447:tid 8465] [client 4.189.161.78:30340] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVq5sblwvJttJsvQpd_suAAAAo8"]
[Mon Jan 05 03:04:19.098368 2026] [:error] [pid 1221:tid 1256] [client 4.189.161.78:23614] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVq5s5_3f4CdEKVLTXUYeAAAAIE"]
[Mon Jan 05 03:04:19.809827 2026] [:error] [pid 7626:tid 7657] [client 4.189.161.78:30389] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVq5s1jhVzHrevQ2GQzuBwAAAdI"]
[Mon Jan 05 03:04:21.042277 2026] [:error] [pid 11570:tid 11588] [client 4.189.161.78:23599] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acwfihfh.php"] [unique_id "aVq5tVpq_sPZb-JYukUaDAAAAtA"]
[Mon Jan 05 03:04:22.629055 2026] [:error] [pid 22541:tid 22620] [client 4.189.161.78:30374] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acwfihfh.php"] [unique_id "aVq5tkkjzS6tgkL3JEu9mQAAAhM"]
[Mon Jan 05 03:04:23.405587 2026] [:error] [pid 6613:tid 6615] [client 4.189.161.78:23590] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acwfihfh.php"] [unique_id "aVq5t8W2a9pc2Efh4D0ZmAAAAQA"]
[Mon Jan 05 03:04:24.533598 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:30351] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acwfihfh.php"] [unique_id "aVq5uAfTYSkMJzNSH4V9QwAAAVY"]
[Mon Jan 05 03:04:25.520791 2026] [:error] [pid 11570:tid 11572] [client 4.189.161.78:23610] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVq5uVpq_sPZb-JYukUaDwAAAsA"]
[Mon Jan 05 03:04:26.569135 2026] [:error] [pid 22540:tid 22598] [client 4.189.161.78:30396] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVq5ujQAa5AoSeJHBNqPfQAAABg"]
[Mon Jan 05 03:04:27.724292 2026] [:error] [pid 7626:tid 7643] [client 4.189.161.78:65310] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVq5u1jhVzHrevQ2GQzuDwAAAcQ"]
[Mon Jan 05 03:04:28.550342 2026] [:error] [pid 7155:tid 7168] [client 4.189.161.78:65398] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVq5vCD_CRsWjWrSXNJOZAAAAYs"]
[Mon Jan 05 03:04:29.473636 2026] [:error] [pid 6937:tid 6965] [client 4.189.161.78:30380] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVq5vQfTYSkMJzNSH4V9RQAAAUM"]
[Mon Jan 05 03:04:30.350373 2026] [:error] [pid 6937:tid 6983] [client 4.189.161.78:65283] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVq5vgfTYSkMJzNSH4V9SAAAAU4"]
[Mon Jan 05 03:04:33.070745 2026] [:error] [pid 8447:tid 8470] [client 4.189.161.78:65282] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVq5wblwvJttJsvQpd_sxgAAApQ"]
[Mon Jan 05 03:04:33.546828 2026] [:error] [pid 8447:tid 8460] [client 4.189.161.78:30376] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVq5wblwvJttJsvQpd_syAAAAoo"]
[Mon Jan 05 03:04:34.181684 2026] [:error] [pid 7155:tid 7171] [client 4.189.161.78:23573] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVq5wiD_CRsWjWrSXNJOawAAAY4"]
[Mon Jan 05 03:04:35.448612 2026] [:error] [pid 7716:tid 7724] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/esp.php
[Mon Jan 05 03:04:35.701146 2026] [:error] [pid 7716:tid 7743] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/21x.php
[Mon Jan 05 03:04:35.878480 2026] [:error] [pid 7716:tid 7735] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/out.php
[Mon Jan 05 03:04:36.576210 2026] [:error] [pid 7716:tid 7740] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/flower2.php
[Mon Jan 05 03:04:36.720223 2026] [:error] [pid 7716:tid 7741] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/family.php
[Mon Jan 05 03:04:36.839214 2026] [:error] [pid 7716:tid 7736] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Mon Jan 05 03:04:36.963727 2026] [:error] [pid 7716:tid 7737] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/lanz.php
[Mon Jan 05 03:04:37.087281 2026] [:error] [pid 7716:tid 7739] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/xeeex.php
[Mon Jan 05 03:04:37.210861 2026] [:error] [pid 7716:tid 7726] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/tons.php
[Mon Jan 05 03:04:37.327714 2026] [:error] [pid 7716:tid 7745] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/wpup.php
[Mon Jan 05 03:04:37.460364 2026] [:error] [pid 7716:tid 7748] [client 4.189.161.78:23583] File does not exist: /usr/local/apache/htdocs/suspended-page/f2f.php
[Mon Jan 05 03:04:37.593770 2026] [:error] [pid 7716:tid 7733] [client 4.189.161.78:23583] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVq5xTZZYbEubuUOjjbshwAAAkk"]
[Mon Jan 05 03:04:38.681026 2026] [:error] [pid 11570:tid 11583] [client 4.189.161.78:23561] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVq5xlpq_sPZb-JYukUaGgAAAss"]
[Mon Jan 05 03:04:39.344486 2026] [:error] [pid 6937:tid 6967] [client 4.189.161.78:30362] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVq5xwfTYSkMJzNSH4V9UwAAAUU"]
[Mon Jan 05 03:04:39.883911 2026] [:error] [pid 8447:tid 8469] [client 4.189.161.78:30386] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVq5x7lwvJttJsvQpd_szQAAApM"]
[Mon Jan 05 03:04:41.210286 2026] [:error] [pid 7155:tid 7179] [client 4.189.161.78:23604] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVq5ySD_CRsWjWrSXNJOcgAAAZY"]
[Mon Jan 05 03:04:43.443613 2026] [:error] [pid 6613:tid 6618] [client 4.189.161.78:65363] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVq5y8W2a9pc2Efh4D0ZsAAAAQM"]
[Mon Jan 05 03:04:44.325797 2026] [:error] [pid 11570:tid 11588] [client 4.189.161.78:65344] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVq5zFpq_sPZb-JYukUaHwAAAtA"]
[Mon Jan 05 03:04:46.110267 2026] [:error] [pid 6613:tid 6625] [client 4.189.161.78:23615] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aVq5zsW2a9pc2Efh4D0ZswAAAQo"]
[Mon Jan 05 03:04:47.149998 2026] [:error] [pid 6937:tid 6982] [client 4.189.161.78:65288] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVq5zwfTYSkMJzNSH4V9WwAAAU0"]
[Mon Jan 05 03:04:48.217025 2026] [:error] [pid 11570:tid 11578] [client 4.189.161.78:30397] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVq50Fpq_sPZb-JYukUaIwAAAsY"]
[Mon Jan 05 03:04:49.247211 2026] [:error] [pid 7716:tid 7740] [client 4.189.161.78:23597] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVq50TZZYbEubuUOjjbsjgAAAlA"]
[Mon Jan 05 03:04:49.672465 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:23587] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "aVq50UkjzS6tgkL3JEu9qAAAAhg"]
[Mon Jan 05 03:04:50.742163 2026] [:error] [pid 11570:tid 11591] [client 4.189.161.78:30365] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z57.php"] [unique_id "aVq50lpq_sPZb-JYukUaJAAAAtM"]
[Mon Jan 05 03:04:51.539536 2026] [:error] [pid 7716:tid 7739] [client 4.189.161.78:65320] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z57.php"] [unique_id "aVq50zZZYbEubuUOjjbskAAAAk8"]
[Mon Jan 05 03:04:52.769239 2026] [:error] [pid 7716:tid 7733] [client 4.189.161.78:65373] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z57.php"] [unique_id "aVq51DZZYbEubuUOjjbskgAAAkk"]
[Mon Jan 05 03:04:53.191619 2026] [:error] [pid 7716:tid 7723] [client 4.189.161.78:65284] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z57.php"] [unique_id "aVq51TZZYbEubuUOjjbslAAAAkA"]
[Mon Jan 05 03:04:53.729154 2026] [:error] [pid 8447:tid 8464] [client 4.189.161.78:23574] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aVq51blwvJttJsvQpd_s1AAAAo4"]
[Mon Jan 05 03:04:55.104591 2026] [:error] [pid 7716:tid 7724] [client 4.189.161.78:23607] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aVq51zZZYbEubuUOjjbsmAAAAkE"]
[Mon Jan 05 03:04:56.072441 2026] [:error] [pid 7716:tid 7743] [client 4.189.161.78:30342] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aVq52DZZYbEubuUOjjbsmgAAAlM"]
[Mon Jan 05 03:04:57.874273 2026] [:error] [pid 6613:tid 6615] [client 4.189.161.78:65355] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o2.php"] [unique_id "aVq52cW2a9pc2Efh4D0ZvQAAAQA"]
[Mon Jan 05 03:04:59.453449 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:65354] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/new2.php"] [unique_id "aVq52wfTYSkMJzNSH4V9YwAAAUg"]
[Mon Jan 05 03:05:00.503320 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:30337] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/new2.php"] [unique_id "aVq53AfTYSkMJzNSH4V9aAAAAVE"]
[Mon Jan 05 03:05:01.724644 2026] [:error] [pid 6613:tid 6617] [client 4.189.161.78:65357] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/new2.php"] [unique_id "aVq53cW2a9pc2Efh4D0ZwQAAAQI"]
[Mon Jan 05 03:05:02.448511 2026] [:error] [pid 11570:tid 11578] [client 4.189.161.78:23579] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/new2.php"] [unique_id "aVq53lpq_sPZb-JYukUaLQAAAsY"]
[Mon Jan 05 03:05:03.769957 2026] [:error] [pid 8447:tid 8471] [client 4.189.161.78:65367] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nae.php"] [unique_id "aVq537lwvJttJsvQpd_s2QAAApU"]
[Mon Jan 05 03:05:04.855175 2026] [:error] [pid 11570:tid 11584] [client 4.189.161.78:30392] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nae.php"] [unique_id "aVq54Fpq_sPZb-JYukUaLgAAAsw"]
[Mon Jan 05 03:05:06.228733 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:30346] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nae.php"] [unique_id "aVq54gfTYSkMJzNSH4V9bAAAAVY"]
[Mon Jan 05 03:05:07.643495 2026] [:error] [pid 22540:tid 22578] [client 4.189.161.78:23606] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nae.php"] [unique_id "aVq54zQAa5AoSeJHBNqPiAAAAAQ"]
[Mon Jan 05 03:05:08.666102 2026] [:error] [pid 7626:tid 7662] [client 4.189.161.78:65347] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eru.php"] [unique_id "aVq55FjhVzHrevQ2GQzuFwAAAdc"]
[Mon Jan 05 03:05:09.138787 2026] [:error] [pid 22541:tid 22610] [client 4.189.161.78:30341] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eru.php"] [unique_id "aVq55UkjzS6tgkL3JEu9swAAAgk"]
[Mon Jan 05 03:05:09.542881 2026] [:error] [pid 1221:tid 1277] [client 4.189.161.78:65290] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eru.php"] [unique_id "aVq55Z_3f4CdEKVLTXUYjQAAAJY"]
[Mon Jan 05 03:05:10.563048 2026] [:error] [pid 1221:tid 1259] [client 4.189.161.78:65403] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eru.php"] [unique_id "aVq55p_3f4CdEKVLTXUYkgAAAIQ"]
[Mon Jan 05 03:05:11.472659 2026] [:error] [pid 11570:tid 11590] [client 4.189.161.78:23600] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/JPG.php"] [unique_id "aVq551pq_sPZb-JYukUaNgAAAtI"]
[Mon Jan 05 03:05:13.230195 2026] [:error] [pid 7716:tid 7741] [client 4.189.161.78:30344] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/JPG.php"] [unique_id "aVq56TZZYbEubuUOjjbspgAAAlE"]
[Mon Jan 05 03:05:15.683040 2026] [:error] [pid 6613:tid 6617] [client 4.189.161.78:23585] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/JPG.php"] [unique_id "aVq568W2a9pc2Efh4D0ZxwAAAQI"]
[Mon Jan 05 03:05:17.198766 2026] [:error] [pid 11570:tid 11577] [client 4.189.161.78:65388] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/JPG.php"] [unique_id "aVq57Vpq_sPZb-JYukUaOQAAAsU"]
[Mon Jan 05 03:05:19.505260 2026] [:error] [pid 6937:tid 6989] [client 4.189.161.78:23563] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsz.php"] [unique_id "aVq57wfTYSkMJzNSH4V9dgAAAVQ"]
[Mon Jan 05 03:05:20.348237 2026] [:error] [pid 8447:tid 8462] [client 4.189.161.78:23602] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsz.php"] [unique_id "aVq58LlwvJttJsvQpd_s4AAAAow"]
[Mon Jan 05 03:05:21.760732 2026] [:error] [pid 6613:tid 6632] [client 4.189.161.78:23566] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsz.php"] [unique_id "aVq58cW2a9pc2Efh4D0Z2AAAARE"]
[Mon Jan 05 03:05:22.488262 2026] [:error] [pid 6937:tid 6985] [client 4.189.161.78:30388] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsz.php"] [unique_id "aVq58gfTYSkMJzNSH4V9ewAAAVA"]
[Mon Jan 05 03:05:23.228040 2026] [:error] [pid 6937:tid 6972] [client 4.189.161.78:65394] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lok.php"] [unique_id "aVq58wfTYSkMJzNSH4V9fAAAAUk"]
[Mon Jan 05 03:05:24.781874 2026] [:error] [pid 7155:tid 7158] [client 4.189.161.78:30338] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lok.php"] [unique_id "aVq59CD_CRsWjWrSXNJOiQAAAYE"]
[Mon Jan 05 03:05:26.317295 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:30370] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lok.php"] [unique_id "aVq59kkjzS6tgkL3JEu9wQAAAhg"]
[Mon Jan 05 03:05:27.740314 2026] [:error] [pid 7626:tid 7654] [client 4.189.161.78:23612] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lok.php"] [unique_id "aVq591jhVzHrevQ2GQzuHQAAAc8"]
[Mon Jan 05 03:05:28.263595 2026] [:error] [pid 6613:tid 6619] [client 4.189.161.78:65345] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVq5-MW2a9pc2Efh4D0Z3gAAAQQ"]
[Mon Jan 05 03:05:28.974652 2026] [:error] [pid 11570:tid 11577] [client 4.189.161.78:23576] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVq5-Fpq_sPZb-JYukUaQgAAAsU"]
[Mon Jan 05 03:05:29.551207 2026] [:error] [pid 22540:tid 22587] [client 4.189.161.78:65406] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVq5-TQAa5AoSeJHBNqPmwAAAA0"]
[Mon Jan 05 03:05:29.953277 2026] [:error] [pid 11570:tid 11583] [client 4.189.161.78:65300] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wan.php"] [unique_id "aVq5-Vpq_sPZb-JYukUaQwAAAss"]
[Mon Jan 05 03:05:30.923075 2026] [:error] [pid 7155:tid 7164] [client 4.189.161.78:23595] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dds.php"] [unique_id "aVq5-iD_CRsWjWrSXNJOjgAAAYc"]
[Mon Jan 05 03:05:31.871198 2026] [:error] [pid 7155:tid 7178] [client 4.189.161.78:23582] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dds.php"] [unique_id "aVq5-yD_CRsWjWrSXNJOjwAAAZU"]
[Mon Jan 05 03:05:33.159440 2026] [:error] [pid 22541:tid 22603] [client 4.189.161.78:65383] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dds.php"] [unique_id "aVq5_UkjzS6tgkL3JEu9xgAAAgI"]
[Mon Jan 05 03:05:34.190449 2026] [:error] [pid 7716:tid 7728] [client 4.189.161.78:23605] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dds.php"] [unique_id "aVq5_jZZYbEubuUOjjbstAAAAkU"]
[Mon Jan 05 03:05:34.810759 2026] [:error] [pid 6937:tid 6994] [client 4.189.161.78:65376] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yyy.php"] [unique_id "aVq5_gfTYSkMJzNSH4V9iAAAAVg"]
[Mon Jan 05 03:05:35.425070 2026] [:error] [pid 8447:tid 8466] [client 4.189.161.78:65399] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yyy.php"] [unique_id "aVq5_7lwvJttJsvQpd_s6AAAApA"]
[Mon Jan 05 03:05:36.047415 2026] [:error] [pid 7155:tid 7160] [client 4.189.161.78:23552] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yyy.php"] [unique_id "aVq6ACD_CRsWjWrSXNJOkAAAAYM"]
[Mon Jan 05 03:05:36.986506 2026] [:error] [pid 7716:tid 7741] [client 4.189.161.78:65280] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yyy.php"] [unique_id "aVq6ADZZYbEubuUOjjbstgAAAlE"]
[Mon Jan 05 03:05:38.715006 2026] [:error] [pid 6937:tid 6966] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/h8h9.php
[Mon Jan 05 03:05:38.830682 2026] [:error] [pid 6937:tid 6980] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php
[Mon Jan 05 03:05:40.131719 2026] [:error] [pid 6937:tid 6980] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/vxrl.php
[Mon Jan 05 03:05:40.521136 2026] [:error] [pid 6937:tid 6984] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Mon Jan 05 03:05:40.921328 2026] [:error] [pid 6937:tid 6964] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/berm.php
[Mon Jan 05 03:05:41.041893 2026] [:error] [pid 6937:tid 6981] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/led.php
[Mon Jan 05 03:05:41.185540 2026] [:error] [pid 6937:tid 6988] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Mon Jan 05 03:05:41.302713 2026] [:error] [pid 6937:tid 6994] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/7f8c8.php
[Mon Jan 05 03:05:41.420005 2026] [:error] [pid 6937:tid 6963] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/tua.php
[Mon Jan 05 03:05:41.542872 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/class-db.php
[Mon Jan 05 03:05:41.753229 2026] [:error] [pid 6937:tid 6993] [client 4.189.161.78:65387] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Mon Jan 05 03:05:41.869903 2026] [:error] [pid 6937:tid 6967] [client 4.189.161.78:65387] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVq6BQfTYSkMJzNSH4V9nAAAAUU"]
[Mon Jan 05 03:05:42.988171 2026] [:error] [pid 7626:tid 7656] [client 4.189.161.78:30387] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVq6BljhVzHrevQ2GQzuJgAAAdE"]
[Mon Jan 05 03:05:43.648253 2026] [:error] [pid 7626:tid 7644] [client 4.189.161.78:65401] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVq6B1jhVzHrevQ2GQzuJwAAAcU"]
[Mon Jan 05 03:05:44.804221 2026] [:error] [pid 7716:tid 7727] [client 4.189.161.78:65351] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aVq6CDZZYbEubuUOjjbsvAAAAkQ"]
[Mon Jan 05 03:05:45.191713 2026] [:error] [pid 22540:tid 22577] [client 4.189.161.78:30357] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aVq6CTQAa5AoSeJHBNqPogAAAAM"]
[Mon Jan 05 03:05:45.647036 2026] [:error] [pid 8447:tid 8455] [client 4.189.161.78:23575] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aVq6CblwvJttJsvQpd_s7AAAAoU"]
[Mon Jan 05 03:05:46.412253 2026] [:error] [pid 6937:tid 6966] [client 4.189.161.78:65389] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aVq6CgfTYSkMJzNSH4V9nwAAAUQ"]
[Mon Jan 05 03:05:47.550363 2026] [:error] [pid 22541:tid 22608] [client 4.189.161.78:65381] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dox.php"] [unique_id "aVq6C0kjzS6tgkL3JEu90gAAAgc"]
[Mon Jan 05 03:05:49.190195 2026] [:error] [pid 22541:tid 22604] [client 4.189.161.78:23571] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVq6DUkjzS6tgkL3JEu91QAAAgM"]
[Mon Jan 05 03:05:50.364142 2026] [:error] [pid 7155:tid 7164] [client 4.189.161.78:30383] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVq6DiD_CRsWjWrSXNJOmgAAAYc"]
[Mon Jan 05 03:05:51.610324 2026] [:error] [pid 22541:tid 22619] [client 4.189.161.78:23560] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVq6D0kjzS6tgkL3JEu91wAAAhI"]
[Mon Jan 05 03:05:52.245113 2026] [:error] [pid 22540:tid 22582] [client 4.189.161.78:30354] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aVq6EDQAa5AoSeJHBNqPpwAAAAg"]
[Mon Jan 05 03:05:52.906245 2026] [:error] [pid 22541:tid 22603] [client 4.189.161.78:65349] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zil.php"] [unique_id "aVq6EEkjzS6tgkL3JEu92QAAAgI"]
[Mon Jan 05 03:05:53.896742 2026] [:error] [pid 22540:tid 22574] [client 4.189.161.78:65295] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zil.php"] [unique_id "aVq6ETQAa5AoSeJHBNqPqQAAAAA"]
[Mon Jan 05 03:05:55.049173 2026] [:error] [pid 6613:tid 6630] [client 4.189.161.78:65366] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zil.php"] [unique_id "aVq6E8W2a9pc2Efh4D0Z8gAAAQ8"]
[Mon Jan 05 03:05:56.058000 2026] [:error] [pid 8447:tid 8451] [client 4.189.161.78:65296] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zil.php"] [unique_id "aVq6FLlwvJttJsvQpd_s9AAAAoE"]
[Mon Jan 05 03:05:57.133966 2026] [:error] [pid 22540:tid 22590] [client 4.189.161.78:65285] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l.php"] [unique_id "aVq6FTQAa5AoSeJHBNqPqgAAABA"]
[Mon Jan 05 03:05:58.942372 2026] [:error] [pid 1221:tid 1277] [client 4.189.161.78:23568] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l.php"] [unique_id "aVq6Fp_3f4CdEKVLTXUYqwAAAJY"]
[Mon Jan 05 03:05:59.654423 2026] [:error] [pid 6937:tid 6963] [client 4.189.161.78:65365] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l.php"] [unique_id "aVq6FwfTYSkMJzNSH4V9qQAAAUE"]
[Mon Jan 05 03:06:00.776375 2026] [:error] [pid 8447:tid 8464] [client 4.189.161.78:30385] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/l.php"] [unique_id "aVq6GLlwvJttJsvQpd_s-wAAAo4"]
[Mon Jan 05 03:06:01.976843 2026] [:error] [pid 22540:tid 22583] [client 4.189.161.78:30349] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Eva.php"] [unique_id "aVq6GTQAa5AoSeJHBNqPtgAAAAk"]
[Mon Jan 05 03:06:03.012422 2026] [:error] [pid 6937:tid 6982] [client 4.189.161.78:65384] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Eva.php"] [unique_id "aVq6GwfTYSkMJzNSH4V9rwAAAU0"]
[Mon Jan 05 03:06:04.105344 2026] [:error] [pid 22541:tid 22620] [client 4.189.161.78:65306] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Eva.php"] [unique_id "aVq6HEkjzS6tgkL3JEu93wAAAhM"]
[Mon Jan 05 03:06:05.111391 2026] [:error] [pid 7155:tid 7165] [client 4.189.161.78:30364] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Eva.php"] [unique_id "aVq6HSD_CRsWjWrSXNJOoQAAAYg"]
[Mon Jan 05 03:06:05.603341 2026] [:error] [pid 22540:tid 22581] [client 4.189.161.78:64833] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dop.php"] [unique_id "aVq6HTQAa5AoSeJHBNqPvAAAAAc"]
[Mon Jan 05 03:06:05.927587 2026] [:error] [pid 7626:tid 7662] [client 4.189.161.78:65380] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dop.php"] [unique_id "aVq6HVjhVzHrevQ2GQzuNwAAAdc"]
[Mon Jan 05 03:06:06.761249 2026] [:error] [pid 1221:tid 1256] [client 4.189.161.78:65312] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dop.php"] [unique_id "aVq6Hp_3f4CdEKVLTXUYsAAAAIE"]
[Mon Jan 05 03:06:07.617398 2026] [:error] [pid 7716:tid 7745] [client 4.189.161.78:23556] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dop.php"] [unique_id "aVq6HzZZYbEubuUOjjbsywAAAlU"]
[Mon Jan 05 03:06:08.004742 2026] [:error] [pid 7716:tid 7727] [client 4.189.161.78:23613] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ula.php"] [unique_id "aVq6IDZZYbEubuUOjjbszAAAAkQ"]
[Mon Jan 05 03:06:08.574832 2026] [:error] [pid 7716:tid 7724] [client 4.189.161.78:23601] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ula.php"] [unique_id "aVq6IDZZYbEubuUOjjbszgAAAkE"]
[Mon Jan 05 03:06:09.300820 2026] [:error] [pid 7626:tid 7640] [client 4.189.161.78:30371] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ula.php"] [unique_id "aVq6IVjhVzHrevQ2GQzuOgAAAcE"]
[Mon Jan 05 03:06:10.223091 2026] [:error] [pid 22541:tid 22601] [client 4.189.161.78:23559] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ula.php"] [unique_id "aVq6IkkjzS6tgkL3JEu96QAAAgA"]
[Mon Jan 05 03:06:13.496629 2026] [:error] [pid 6613:tid 6621] [client 4.189.161.78:65407] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVq6JcW2a9pc2Efh4D0Z-wAAAQY"]
[Mon Jan 05 03:06:13.862933 2026] [:error] [pid 8447:tid 8472] [client 4.189.161.78:23598] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVq6JblwvJttJsvQpd_s_gAAApY"]
[Mon Jan 05 03:06:14.714635 2026] [:error] [pid 8447:tid 8455] [client 4.189.161.78:65371] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVq6JrlwvJttJsvQpd_s_wAAAoU"]
[Mon Jan 05 03:06:15.341676 2026] [:error] [pid 22541:tid 22615] [client 4.189.161.78:30369] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aVq6J0kjzS6tgkL3JEu98AAAAg4"]
[Mon Jan 05 03:06:15.797164 2026] [:error] [pid 22540:tid 22577] [client 4.189.161.78:23572] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/card.php"] [unique_id "aVq6JzQAa5AoSeJHBNqPxwAAAAM"]
[Mon Jan 05 03:06:16.246920 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:65404] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/card.php"] [unique_id "aVq6KAfTYSkMJzNSH4V9tgAAAUg"]
[Mon Jan 05 03:06:16.753640 2026] [:error] [pid 22540:tid 22579] [client 4.189.161.78:64886] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/card.php"] [unique_id "aVq6KDQAa5AoSeJHBNqPyAAAAAU"]
[Mon Jan 05 03:06:17.520282 2026] [:error] [pid 6937:tid 6965] [client 4.189.161.78:65359] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/card.php"] [unique_id "aVq6KQfTYSkMJzNSH4V9vAAAAUM"]
[Mon Jan 05 03:06:18.175024 2026] [:error] [pid 11570:tid 11580] [client 4.189.161.78:64784] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hum.php"] [unique_id "aVq6Klpq_sPZb-JYukUaXAAAAsg"]
[Mon Jan 05 03:06:19.395607 2026] [:error] [pid 6937:tid 6966] [client 4.189.161.78:30336] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hum.php"] [unique_id "aVq6KwfTYSkMJzNSH4V9vgAAAUQ"]
[Mon Jan 05 03:06:20.304129 2026] [:error] [pid 11570:tid 11596] [client 4.189.161.78:64871] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hum.php"] [unique_id "aVq6LFpq_sPZb-JYukUaXQAAAtg"]
[Mon Jan 05 03:06:21.389766 2026] [:error] [pid 7155:tid 7165] [client 4.189.161.78:30347] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hum.php"] [unique_id "aVq6LSD_CRsWjWrSXNJOrQAAAYg"]
[Mon Jan 05 03:06:22.489148 2026] [:error] [pid 6937:tid 6972] [client 4.189.161.78:64853] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bq.php"] [unique_id "aVq6LgfTYSkMJzNSH4V9wgAAAUk"]
[Mon Jan 05 03:06:23.143932 2026] [:error] [pid 6613:tid 6635] [client 4.189.161.78:23608] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bq.php"] [unique_id "aVq6L8W2a9pc2Efh4D0Z_gAAARQ"]
[Mon Jan 05 03:06:23.793460 2026] [:error] [pid 7626:tid 7660] [client 4.189.161.78:30394] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bq.php"] [unique_id "aVq6L1jhVzHrevQ2GQzuSAAAAdU"]
[Mon Jan 05 03:06:24.988533 2026] [:error] [pid 1221:tid 1272] [client 4.189.161.78:30384] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bq.php"] [unique_id "aVq6MJ_3f4CdEKVLTXUYwQAAAJE"]
[Mon Jan 05 03:06:25.894195 2026] [:error] [pid 6613:tid 6623] [client 4.189.161.78:65358] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xm.php"] [unique_id "aVq6McW2a9pc2Efh4D0aCQAAAQg"]
[Mon Jan 05 03:06:26.521354 2026] [:error] [pid 6613:tid 6616] [client 4.189.161.78:64867] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xm.php"] [unique_id "aVq6MsW2a9pc2Efh4D0aDgAAAQE"]
[Mon Jan 05 03:06:26.903447 2026] [:error] [pid 11570:tid 11593] [client 4.189.161.78:23592] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xm.php"] [unique_id "aVq6Mlpq_sPZb-JYukUabwAAAtU"]
[Mon Jan 05 03:06:27.668568 2026] [:error] [pid 11570:tid 11590] [client 4.189.161.78:65304] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xm.php"] [unique_id "aVq6M1pq_sPZb-JYukUadQAAAtI"]
[Mon Jan 05 03:06:28.259835 2026] [:error] [pid 6613:tid 6615] [client 4.189.161.78:30365] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1.php"] [unique_id "aVq6NMW2a9pc2Efh4D0aGQAAAQA"]
[Mon Jan 05 03:06:28.634929 2026] [:error] [pid 6613:tid 6617] [client 4.189.161.78:65305] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1.php"] [unique_id "aVq6NMW2a9pc2Efh4D0aGwAAAQI"]
[Mon Jan 05 03:06:29.055397 2026] [:error] [pid 7626:tid 7661] [client 4.189.161.78:65308] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1.php"] [unique_id "aVq6NVjhVzHrevQ2GQzuSgAAAdY"]
[Mon Jan 05 03:06:29.606361 2026] [:error] [pid 6613:tid 6622] [client 4.189.161.78:65364] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1.php"] [unique_id "aVq6NcW2a9pc2Efh4D0aHgAAAQc"]
[Mon Jan 05 03:06:30.520699 2026] [:error] [pid 7626:tid 7662] [client 4.189.161.78:30393] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/73106.php"] [unique_id "aVq6NljhVzHrevQ2GQzuSwAAAdc"]
[Mon Jan 05 03:06:31.182357 2026] [:error] [pid 22541:tid 22616] [client 4.189.161.78:65292] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/73106.php"] [unique_id "aVq6N0kjzS6tgkL3JEu9_AAAAg8"]
[Mon Jan 05 03:06:31.762192 2026] [:error] [pid 22541:tid 22608] [client 4.189.161.78:65294] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/73106.php"] [unique_id "aVq6N0kjzS6tgkL3JEu9_gAAAgc"]
[Mon Jan 05 03:06:32.695316 2026] [:error] [pid 6937:tid 6964] [client 4.189.161.78:65390] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/73106.php"] [unique_id "aVq6OAfTYSkMJzNSH4V9yAAAAUI"]
[Mon Jan 05 03:06:33.942002 2026] [:error] [pid 7155:tid 7181] [client 4.189.161.78:30345] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aVq6OSD_CRsWjWrSXNJOsgAAAZg"]
[Mon Jan 05 03:06:34.608336 2026] [:error] [pid 7716:tid 7724] [client 4.189.161.78:65298] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aVq6OjZZYbEubuUOjjbs2AAAAkE"]
[Mon Jan 05 03:06:35.436192 2026] [:error] [pid 7155:tid 7166] [client 4.189.161.78:30366] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aVq6OyD_CRsWjWrSXNJOtQAAAYk"]
[Mon Jan 05 03:06:36.253380 2026] [:error] [pid 22540:tid 22594] [client 4.189.161.78:64845] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aVq6PDQAa5AoSeJHBNqP6AAAABQ"]
[Mon Jan 05 03:06:36.853620 2026] [:error] [pid 22540:tid 22574] [client 4.189.161.78:64838] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVq6PDQAa5AoSeJHBNqP6QAAAAA"]
[Mon Jan 05 03:06:37.591613 2026] [:error] [pid 22541:tid 22615] [client 4.189.161.78:30399] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVq6PUkjzS6tgkL3JEu-AgAAAg4"]
[Mon Jan 05 03:06:38.730103 2026] [:error] [pid 11570:tid 11574] [client 4.189.161.78:65386] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVq6Plpq_sPZb-JYukUafQAAAsI"]
[Mon Jan 05 03:06:39.202328 2026] [:error] [pid 6937:tid 6963] [client 4.189.161.78:65281] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aVq6PwfTYSkMJzNSH4V9zAAAAUE"]
[Mon Jan 05 03:06:40.202153 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:65331] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1254.php"] [unique_id "aVq6QEkjzS6tgkL3JEu-CAAAAhg"]
[Mon Jan 05 03:06:41.414866 2026] [:error] [pid 1221:tid 1261] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/1254.php
[Mon Jan 05 03:06:41.531198 2026] [:error] [pid 1221:tid 1259] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/gib.php
[Mon Jan 05 03:06:41.649819 2026] [:error] [pid 1221:tid 1260] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/hob.php
[Mon Jan 05 03:06:41.767220 2026] [:error] [pid 1221:tid 1265] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/poj.php
[Mon Jan 05 03:06:42.030837 2026] [:error] [pid 1221:tid 1268] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/.an5.php
[Mon Jan 05 03:06:42.150114 2026] [:error] [pid 1221:tid 1255] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/re.php
[Mon Jan 05 03:06:42.274533 2026] [:error] [pid 1221:tid 1272] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/twso.php
[Mon Jan 05 03:06:42.823796 2026] [:error] [pid 1221:tid 1273] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/pes.php
[Mon Jan 05 03:06:42.941722 2026] [:error] [pid 1221:tid 1263] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/file30.php
[Mon Jan 05 03:06:43.061794 2026] [:error] [pid 1221:tid 1256] [client 4.189.161.78:65301] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cliner.php
[Mon Jan 05 03:06:43.619374 2026] [:error] [pid 1221:tid 1270] [client 4.189.161.78:65301] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdrex.php"] [unique_id "aVq6Q5_3f4CdEKVLTXUY4wAAAI8"]
[Mon Jan 05 03:06:44.314781 2026] [:error] [pid 6937:tid 6982] [client 4.189.161.78:65361] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdrex.php"] [unique_id "aVq6RAfTYSkMJzNSH4V9zwAAAU0"]
[Mon Jan 05 03:06:45.605939 2026] [:error] [pid 7716:tid 7739] [client 4.189.161.78:65385] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdrex.php"] [unique_id "aVq6RTZZYbEubuUOjjbs3AAAAk8"]
[Mon Jan 05 03:06:46.792114 2026] [:error] [pid 7716:tid 7733] [client 4.189.161.78:30375] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kdrex.php"] [unique_id "aVq6RjZZYbEubuUOjjbs3wAAAkk"]
[Mon Jan 05 03:06:47.555172 2026] [:error] [pid 7155:tid 7157] [client 4.189.161.78:64836] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "aVq6RyD_CRsWjWrSXNJOugAAAYA"]
[Mon Jan 05 03:06:48.695324 2026] [:error] [pid 22541:tid 22615] [client 4.189.161.78:65391] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "aVq6SEkjzS6tgkL3JEu-CgAAAg4"]
[Mon Jan 05 03:06:50.548051 2026] [:error] [pid 1221:tid 1264] [client 4.189.161.78:65322] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "aVq6Sp_3f4CdEKVLTXUY6wAAAIk"]
[Mon Jan 05 03:06:51.596813 2026] [:error] [pid 22540:tid 22595] [client 4.189.161.78:23603] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "aVq6SzQAa5AoSeJHBNqP8QAAABU"]
[Mon Jan 05 03:06:52.733630 2026] [:error] [pid 11570:tid 11574] [client 4.189.161.78:64775] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aVq6TFpq_sPZb-JYukUahAAAAsI"]
[Mon Jan 05 03:06:53.597893 2026] [:error] [pid 22541:tid 22606] [client 4.189.161.78:65317] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aVq6TUkjzS6tgkL3JEu-EAAAAgU"]
[Mon Jan 05 03:06:54.515293 2026] [:error] [pid 7626:tid 7659] [client 4.189.161.78:65372] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aVq6TljhVzHrevQ2GQzuVQAAAdQ"]
[Mon Jan 05 03:06:55.487532 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:64842] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aVq6TwfTYSkMJzNSH4V91gAAAUg"]
[Mon Jan 05 03:06:56.155209 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:65339] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moo.php"] [unique_id "aVq6UEkjzS6tgkL3JEu-EQAAAhg"]
[Mon Jan 05 03:06:57.410340 2026] [:error] [pid 7626:tid 7647] [client 4.189.161.78:30378] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moo.php"] [unique_id "aVq6UVjhVzHrevQ2GQzuWQAAAcg"]
[Mon Jan 05 03:06:58.014284 2026] [:error] [pid 6937:tid 6989] [client 4.189.161.78:65377] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moo.php"] [unique_id "aVq6UgfTYSkMJzNSH4V91wAAAVQ"]
[Mon Jan 05 03:06:58.771281 2026] [:error] [pid 7155:tid 7162] [client 4.189.161.78:23588] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moo.php"] [unique_id "aVq6UiD_CRsWjWrSXNJOwgAAAYU"]
[Mon Jan 05 03:06:59.156965 2026] [:error] [pid 22540:tid 22585] [client 4.189.161.78:30377] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haf.php"] [unique_id "aVq6UzQAa5AoSeJHBNqP9gAAAAs"]
[Mon Jan 05 03:06:59.748414 2026] [:error] [pid 7626:tid 7656] [client 4.189.161.78:65323] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haf.php"] [unique_id "aVq6U1jhVzHrevQ2GQzuWwAAAdE"]
[Mon Jan 05 03:07:00.523309 2026] [:error] [pid 11570:tid 11587] [client 4.189.161.78:64880] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haf.php"] [unique_id "aVq6VFpq_sPZb-JYukUajAAAAs8"]
[Mon Jan 05 03:07:01.073757 2026] [:error] [pid 11570:tid 11576] [client 4.189.161.78:30358] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haf.php"] [unique_id "aVq6VVpq_sPZb-JYukUajwAAAsQ"]
[Mon Jan 05 03:07:01.789194 2026] [:error] [pid 8447:tid 8457] [client 4.189.161.78:65348] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aVq6VblwvJttJsvQpd_tIQAAAoc"]
[Mon Jan 05 03:07:02.405905 2026] [:error] [pid 11570:tid 11595] [client 4.189.161.78:65396] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aVq6Vlpq_sPZb-JYukUakgAAAtc"]
[Mon Jan 05 03:07:03.500291 2026] [:error] [pid 7716:tid 7748] [client 4.189.161.78:65333] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aVq6VzZZYbEubuUOjjbs6AAAAlg"]
[Mon Jan 05 03:07:04.192066 2026] [:error] [pid 6937:tid 6987] [client 4.189.161.78:64860] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "aVq6WAfTYSkMJzNSH4V92gAAAVI"]
[Mon Jan 05 03:07:05.310273 2026] [:error] [pid 11570:tid 11579] [client 4.189.161.78:65318] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sec.php"] [unique_id "aVq6WVpq_sPZb-JYukUalAAAAsc"]
[Mon Jan 05 03:07:06.681657 2026] [:error] [pid 11570:tid 11573] [client 4.189.161.78:64870] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sec.php"] [unique_id "aVq6Wlpq_sPZb-JYukUamQAAAsE"]
[Mon Jan 05 03:07:12.005211 2026] [:error] [pid 7155:tid 7174] [client 4.189.161.78:64895] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sec.php"] [unique_id "aVq6YCD_CRsWjWrSXNJOywAAAZE"]
[Mon Jan 05 03:07:13.964215 2026] [:error] [pid 22541:tid 22614] [client 4.189.161.78:64844] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sec.php"] [unique_id "aVq6YUkjzS6tgkL3JEu-GAAAAg0"]
[Mon Jan 05 03:07:15.883514 2026] [:error] [pid 7626:tid 7651] [client 4.189.161.78:64803] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gul.php"] [unique_id "aVq6Y1jhVzHrevQ2GQzuYQAAAcw"]
[Mon Jan 05 03:07:17.624463 2026] [:error] [pid 22541:tid 22620] [client 4.189.161.78:64882] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gul.php"] [unique_id "aVq6ZUkjzS6tgkL3JEu-GwAAAhM"]
[Mon Jan 05 03:07:18.766223 2026] [:error] [pid 7716:tid 7734] [client 4.189.161.78:64865] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gul.php"] [unique_id "aVq6ZjZZYbEubuUOjjbs7wAAAko"]
[Mon Jan 05 03:07:19.882392 2026] [:error] [pid 1221:tid 1275] [client 4.189.161.78:65291] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gul.php"] [unique_id "aVq6Z5_3f4CdEKVLTXUZAAAAAJQ"]
[Mon Jan 05 03:07:22.081203 2026] [:error] [pid 7626:tid 7639] [client 4.189.161.78:64799] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1a.php"] [unique_id "aVq6aljhVzHrevQ2GQzuZwAAAcA"]
[Mon Jan 05 03:07:22.918254 2026] [:error] [pid 6613:tid 6621] [client 4.189.161.78:64847] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1a.php"] [unique_id "aVq6asW2a9pc2Efh4D0aTwAAAQY"]
[Mon Jan 05 03:07:23.727374 2026] [:error] [pid 7626:tid 7660] [client 4.189.161.78:65369] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1a.php"] [unique_id "aVq6a1jhVzHrevQ2GQzuagAAAdU"]
[Mon Jan 05 03:07:25.015902 2026] [:error] [pid 11570:tid 11589] [client 4.189.161.78:23589] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1a.php"] [unique_id "aVq6bVpq_sPZb-JYukUapAAAAtE"]
[Mon Jan 05 03:07:25.909147 2026] [:error] [pid 22541:tid 22619] [client 4.189.161.78:30359] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nbr.php"] [unique_id "aVq6bUkjzS6tgkL3JEu-IQAAAhI"]
[Mon Jan 05 03:07:26.549114 2026] [:error] [pid 7626:tid 7643] [client 4.189.161.78:64852] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nbr.php"] [unique_id "aVq6bljhVzHrevQ2GQzubQAAAcQ"]
[Mon Jan 05 03:07:27.365315 2026] [:error] [pid 7155:tid 7177] [client 4.189.161.78:64866] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nbr.php"] [unique_id "aVq6byD_CRsWjWrSXNJO2QAAAZQ"]
[Mon Jan 05 03:07:28.286309 2026] [:error] [pid 7155:tid 7166] [client 4.189.161.78:64863] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nbr.php"] [unique_id "aVq6cCD_CRsWjWrSXNJO2gAAAYk"]
[Mon Jan 05 03:07:28.858773 2026] [:error] [pid 7626:tid 7651] [client 4.189.161.78:64857] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2index.php"] [unique_id "aVq6cFjhVzHrevQ2GQzubgAAAcw"]
[Mon Jan 05 03:07:30.711723 2026] [:error] [pid 7155:tid 7172] [client 4.189.161.78:65302] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2index.php"] [unique_id "aVq6ciD_CRsWjWrSXNJO3AAAAY8"]
[Mon Jan 05 03:07:30.990234 2026] [:error] [pid 8447:tid 8464] [client 4.189.161.78:65289] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2index.php"] [unique_id "aVq6crlwvJttJsvQpd_tPQAAAo4"]
[Mon Jan 05 03:07:31.442797 2026] [:error] [pid 7155:tid 7160] [client 4.189.161.78:65324] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2index.php"] [unique_id "aVq6cyD_CRsWjWrSXNJO3wAAAYM"]
[Mon Jan 05 03:07:31.772799 2026] [:error] [pid 7155:tid 7176] [client 4.189.161.78:65303] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVq6cyD_CRsWjWrSXNJO4AAAAZM"]
[Mon Jan 05 03:07:32.138615 2026] [:error] [pid 8447:tid 8462] [client 4.189.161.78:64862] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVq6dLlwvJttJsvQpd_tPgAAAow"]
[Mon Jan 05 03:07:32.648518 2026] [:error] [pid 6937:tid 6965] [client 4.189.161.78:65405] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVq6dAfTYSkMJzNSH4V95AAAAUM"]
[Mon Jan 05 03:07:32.901640 2026] [:error] [pid 7626:tid 7662] [client 4.189.161.78:64786] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "aVq6dFjhVzHrevQ2GQzugAAAAdc"]
[Mon Jan 05 03:07:33.549613 2026] [:error] [pid 8447:tid 8461] [client 4.189.161.78:64876] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh77.php"] [unique_id "aVq6dblwvJttJsvQpd_tQQAAAos"]
[Mon Jan 05 03:07:33.999045 2026] [:error] [pid 22540:tid 22575] [client 4.189.161.78:64850] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh77.php"] [unique_id "aVq6dTQAa5AoSeJHBNqQFAAAAAE"]
[Mon Jan 05 03:07:34.657061 2026] [:error] [pid 7626:tid 7644] [client 4.189.161.78:64773] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh77.php"] [unique_id "aVq6dljhVzHrevQ2GQzuigAAAcU"]
[Mon Jan 05 03:07:35.400623 2026] [:error] [pid 22540:tid 22580] [client 4.189.161.78:64777] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh77.php"] [unique_id "aVq6dzQAa5AoSeJHBNqQFwAAAAY"]
[Mon Jan 05 03:07:35.919111 2026] [:error] [pid 7155:tid 7164] [client 4.189.161.78:65378] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aVq6dyD_CRsWjWrSXNJO5AAAAYc"]
[Mon Jan 05 03:07:36.412030 2026] [:error] [pid 7626:tid 7651] [client 4.189.161.78:65297] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aVq6eFjhVzHrevQ2GQzukwAAAcw"]
[Mon Jan 05 03:07:37.039822 2026] [:error] [pid 8447:tid 8466] [client 4.189.161.78:65374] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aVq6eblwvJttJsvQpd_tRQAAApA"]
[Mon Jan 05 03:07:37.820153 2026] [:error] [pid 22541:tid 22602] [client 4.189.161.78:65321] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aVq6eUkjzS6tgkL3JEu-JQAAAgE"]
[Mon Jan 05 03:07:38.131850 2026] [:error] [pid 6613:tid 6633] [client 4.189.161.78:65396] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sow.php"] [unique_id "aVq6esW2a9pc2Efh4D0aVAAAARI"]
[Mon Jan 05 03:07:38.498402 2026] [:error] [pid 1221:tid 1265] [client 4.189.161.78:30355] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sow.php"] [unique_id "aVq6ep_3f4CdEKVLTXUZEQAAAIo"]
[Mon Jan 05 03:07:38.855690 2026] [:error] [pid 22540:tid 22598] [client 4.189.161.78:64877] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sow.php"] [unique_id "aVq6ejQAa5AoSeJHBNqQIAAAABg"]
[Mon Jan 05 03:07:39.488952 2026] [:error] [pid 11570:tid 11584] [client 4.189.161.78:65326] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sow.php"] [unique_id "aVq6e1pq_sPZb-JYukUaqQAAAsw"]
[Mon Jan 05 03:07:40.032179 2026] [:error] [pid 7626:tid 7652] [client 4.189.161.78:23578] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hgm.php"] [unique_id "aVq6fFjhVzHrevQ2GQzunQAAAc0"]
[Mon Jan 05 03:07:40.797232 2026] [:error] [pid 6937:tid 6993] [client 4.189.161.78:65336] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hgm.php"] [unique_id "aVq6fAfTYSkMJzNSH4V97QAAAVc"]
[Mon Jan 05 03:07:42.201938 2026] [:error] [pid 7155:tid 7158] [client 4.189.161.78:23580] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hgm.php"] [unique_id "aVq6fiD_CRsWjWrSXNJO7AAAAYE"]
[Mon Jan 05 03:07:42.898020 2026] [:error] [pid 22541:tid 22613] [client 4.189.161.78:64806] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hgm.php"] [unique_id "aVq6fkkjzS6tgkL3JEu-KgAAAgw"]
[Mon Jan 05 03:07:43.546217 2026] [:error] [pid 22541:tid 22622] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/agdew.php
[Mon Jan 05 03:07:43.675710 2026] [:error] [pid 22541:tid 22601] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/ker.php
[Mon Jan 05 03:07:44.161691 2026] [:error] [pid 22541:tid 22606] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/efa4f.php
[Mon Jan 05 03:07:44.425282 2026] [:error] [pid 22541:tid 22607] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/zuk.php
[Mon Jan 05 03:07:44.542125 2026] [:error] [pid 22541:tid 22614] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/tro.php
[Mon Jan 05 03:07:44.683057 2026] [:error] [pid 22541:tid 22621] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/skj.php
[Mon Jan 05 03:07:44.803832 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/aol7.php
[Mon Jan 05 03:07:44.922501 2026] [:error] [pid 22541:tid 22611] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/ad24f.php
[Mon Jan 05 03:07:45.040867 2026] [:error] [pid 22541:tid 22623] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/waff.php
[Mon Jan 05 03:07:45.161316 2026] [:error] [pid 22541:tid 22624] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/klwc.php
[Mon Jan 05 03:07:45.279249 2026] [:error] [pid 22541:tid 22602] [client 4.189.161.78:64795] File does not exist: /usr/local/apache/htdocs/suspended-page/zeal.php
[Mon Jan 05 03:07:45.500020 2026] [:error] [pid 22541:tid 22604] [client 4.189.161.78:64795] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVq6gUkjzS6tgkL3JEu-OQAAAgM"]
[Mon Jan 05 03:07:46.629509 2026] [:error] [pid 22540:tid 22585] [client 4.189.161.78:64878] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVq6gjQAa5AoSeJHBNqQJgAAAAs"]
[Mon Jan 05 03:07:47.434773 2026] [:error] [pid 8447:tid 8450] [client 4.189.161.78:65334] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVq6g7lwvJttJsvQpd_tUgAAAoA"]
[Mon Jan 05 03:07:48.516284 2026] [:error] [pid 6613:tid 6634] [client 4.189.161.78:65393] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aVq6hMW2a9pc2Efh4D0aZAAAARM"]
[Mon Jan 05 03:07:49.418403 2026] [:error] [pid 6937:tid 6989] [client 4.189.161.78:65353] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aVq6hQfTYSkMJzNSH4V9-wAAAVQ"]
[Mon Jan 05 03:07:50.164100 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:65347] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aVq6hgfTYSkMJzNSH4V9_QAAAVE"]
[Mon Jan 05 03:07:51.464869 2026] [:error] [pid 1221:tid 1262] [client 4.189.161.78:65375] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aVq6h5_3f4CdEKVLTXUZGQAAAIc"]
[Mon Jan 05 03:07:52.392260 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:65351] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "aVq6iEkjzS6tgkL3JEu-QQAAAhg"]
[Mon Jan 05 03:07:52.987195 2026] [:error] [pid 22541:tid 22608] [client 4.189.161.78:64768] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/33.php"] [unique_id "aVq6iEkjzS6tgkL3JEu-QgAAAgc"]
[Mon Jan 05 03:07:53.681174 2026] [:error] [pid 11570:tid 11573] [client 4.189.161.78:64848] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/33.php"] [unique_id "aVq6iVpq_sPZb-JYukUavAAAAsE"]
[Mon Jan 05 03:07:54.817225 2026] [:error] [pid 6937:tid 6970] [client 4.189.161.78:64861] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/33.php"] [unique_id "aVq6igfTYSkMJzNSH4V9_wAAAUc"]
[Mon Jan 05 03:07:56.069824 2026] [:error] [pid 22540:tid 22598] [client 4.189.161.78:65311] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/33.php"] [unique_id "aVq6jDQAa5AoSeJHBNqQJwAAABg"]
[Mon Jan 05 03:07:56.868128 2026] [:error] [pid 8447:tid 8457] [client 4.189.161.78:64253] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "aVq6jLlwvJttJsvQpd_tXwAAAoc"]
[Mon Jan 05 03:07:57.395178 2026] [:error] [pid 11570:tid 11589] [client 4.189.161.78:64816] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "aVq6jVpq_sPZb-JYukUavQAAAtE"]
[Mon Jan 05 03:07:57.773930 2026] [:error] [pid 7626:tid 7639] [client 4.189.161.78:30373] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "aVq6jVjhVzHrevQ2GQzuqAAAAcA"]
[Mon Jan 05 03:07:58.237496 2026] [:error] [pid 7716:tid 7731] [client 4.189.161.78:64839] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "aVq6jjZZYbEubuUOjjbs_AAAAkc"]
[Mon Jan 05 03:07:58.619643 2026] [:error] [pid 11570:tid 11583] [client 4.189.161.78:64837] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aVq6jlpq_sPZb-JYukUawAAAAss"]
[Mon Jan 05 03:07:59.282934 2026] [:error] [pid 7716:tid 7727] [client 4.189.161.78:64805] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aVq6jzZZYbEubuUOjjbs_QAAAkQ"]
[Mon Jan 05 03:07:59.594351 2026] [:error] [pid 6613:tid 6626] [client 4.189.161.78:65400] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aVq6j8W2a9pc2Efh4D0aawAAAQs"]
[Mon Jan 05 03:07:59.939763 2026] [:error] [pid 6937:tid 6993] [client 4.189.161.78:23558] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aVq6jwfTYSkMJzNSH4V-BgAAAVc"]
[Mon Jan 05 03:08:00.387479 2026] [:error] [pid 7716:tid 7737] [client 4.189.161.78:64807] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wui.php"] [unique_id "aVq6kDZZYbEubuUOjjbtAAAAAk0"]
[Mon Jan 05 03:08:01.007995 2026] [:error] [pid 7626:tid 7645] [client 4.189.161.78:65307] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wui.php"] [unique_id "aVq6kVjhVzHrevQ2GQzuqwAAAcY"]
[Mon Jan 05 03:08:01.436111 2026] [:error] [pid 22540:tid 22577] [client 4.189.161.78:65360] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wui.php"] [unique_id "aVq6kTQAa5AoSeJHBNqQKAAAAAM"]
[Mon Jan 05 03:08:02.552672 2026] [:error] [pid 6937:tid 6981] [client 4.189.161.78:65332] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wui.php"] [unique_id "aVq6kgfTYSkMJzNSH4V-EAAAAUw"]
[Mon Jan 05 03:08:03.148995 2026] [:error] [pid 7716:tid 7744] [client 4.189.161.78:30382] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVq6kzZZYbEubuUOjjbtAQAAAlQ"]
[Mon Jan 05 03:08:03.818864 2026] [:error] [pid 8447:tid 8453] [client 4.189.161.78:23593] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVq6k7lwvJttJsvQpd_tZQAAAoM"]
[Mon Jan 05 03:08:04.431263 2026] [:error] [pid 7716:tid 7734] [client 4.189.161.78:30363] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVq6lDZZYbEubuUOjjbtBAAAAko"]
[Mon Jan 05 03:08:04.923683 2026] [:error] [pid 22540:tid 22580] [client 4.189.161.78:30339] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/des.php"] [unique_id "aVq6lDQAa5AoSeJHBNqQKwAAAAY"]
[Mon Jan 05 03:08:06.136444 2026] [:error] [pid 11570:tid 11577] [client 4.189.161.78:65335] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ryuk.php"] [unique_id "aVq6llpq_sPZb-JYukUaxwAAAsU"]
[Mon Jan 05 03:08:06.751837 2026] [:error] [pid 6937:tid 6964] [client 4.189.161.78:64869] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ryuk.php"] [unique_id "aVq6lgfTYSkMJzNSH4V-FgAAAUI"]
[Mon Jan 05 03:08:07.726799 2026] [:error] [pid 1221:tid 1273] [client 4.189.161.78:64864] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ryuk.php"] [unique_id "aVq6l5_3f4CdEKVLTXUZTQAAAJI"]
[Mon Jan 05 03:08:08.346449 2026] [:error] [pid 6613:tid 6638] [client 4.189.161.78:23570] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ryuk.php"] [unique_id "aVq6mMW2a9pc2Efh4D0acAAAARc"]
[Mon Jan 05 03:08:09.910887 2026] [:error] [pid 7155:tid 7157] [client 4.189.161.78:30391] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoro.php"] [unique_id "aVq6mSD_CRsWjWrSXNJO_AAAAYA"]
[Mon Jan 05 03:08:10.603976 2026] [:error] [pid 6613:tid 6628] [client 4.189.161.78:64796] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoro.php"] [unique_id "aVq6msW2a9pc2Efh4D0adAAAAQ0"]
[Mon Jan 05 03:08:11.068336 2026] [:error] [pid 8447:tid 8450] [client 4.189.161.78:64772] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoro.php"] [unique_id "aVq6m7lwvJttJsvQpd_tawAAAoA"]
[Mon Jan 05 03:08:11.462805 2026] [:error] [pid 8447:tid 8460] [client 4.189.161.78:64800] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoro.php"] [unique_id "aVq6m7lwvJttJsvQpd_tbAAAAoo"]
[Mon Jan 05 03:08:11.843126 2026] [:error] [pid 1221:tid 1265] [client 4.189.161.78:30372] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kal.php"] [unique_id "aVq6m5_3f4CdEKVLTXUZYAAAAIo"]
[Mon Jan 05 03:08:12.310141 2026] [:error] [pid 11570:tid 11591] [client 4.189.161.78:65328] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kal.php"] [unique_id "aVq6nFpq_sPZb-JYukUazgAAAtM"]
[Mon Jan 05 03:08:12.863406 2026] [:error] [pid 22540:tid 22589] [client 4.189.161.78:23557] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kal.php"] [unique_id "aVq6nDQAa5AoSeJHBNqQMAAAAA8"]
[Mon Jan 05 03:08:14.150371 2026] [:error] [pid 6613:tid 6623] [client 4.189.161.78:64785] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kal.php"] [unique_id "aVq6nsW2a9pc2Efh4D0adgAAAQg"]
[Mon Jan 05 03:08:15.823222 2026] [:error] [pid 1221:tid 1260] [client 4.189.161.78:23555] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVq6n5_3f4CdEKVLTXUZcgAAAIU"]
[Mon Jan 05 03:08:16.200027 2026] [:error] [pid 22540:tid 22594] [client 4.189.161.78:64883] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVq6oDQAa5AoSeJHBNqQMQAAABQ"]
[Mon Jan 05 03:08:16.880628 2026] [:error] [pid 1221:tid 1269] [client 4.189.161.78:64894] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVq6oJ_3f4CdEKVLTXUZdwAAAI4"]
[Mon Jan 05 03:08:17.483203 2026] [:error] [pid 6937:tid 6966] [client 4.189.161.78:65337] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aVq6oQfTYSkMJzNSH4V-IQAAAUQ"]
[Mon Jan 05 03:08:17.900106 2026] [:error] [pid 22540:tid 22576] [client 4.189.161.78:65286] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/racs3.php"] [unique_id "aVq6oTQAa5AoSeJHBNqQMwAAAAI"]
[Mon Jan 05 03:08:18.274251 2026] [:error] [pid 7155:tid 7171] [client 4.189.161.78:64893] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/racs3.php"] [unique_id "aVq6oiD_CRsWjWrSXNJO_QAAAY4"]
[Mon Jan 05 03:08:18.644954 2026] [:error] [pid 1221:tid 1276] [client 4.189.161.78:23596] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/racs3.php"] [unique_id "aVq6op_3f4CdEKVLTXUZgAAAAJU"]
[Mon Jan 05 03:08:19.269612 2026] [:error] [pid 8447:tid 8471] [client 4.189.161.78:64835] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/racs3.php"] [unique_id "aVq6o7lwvJttJsvQpd_tbQAAApU"]
[Mon Jan 05 03:08:20.015147 2026] [:error] [pid 8447:tid 8451] [client 4.189.161.78:23565] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ed35f.php"] [unique_id "aVq6pLlwvJttJsvQpd_tbwAAAoE"]
[Mon Jan 05 03:08:20.766247 2026] [:error] [pid 7155:tid 7162] [client 4.189.161.78:23611] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ed35f.php"] [unique_id "aVq6pCD_CRsWjWrSXNJO_wAAAYU"]
[Mon Jan 05 03:08:21.230226 2026] [:error] [pid 1221:tid 1271] [client 4.189.161.78:65309] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ed35f.php"] [unique_id "aVq6pZ_3f4CdEKVLTXUZjQAAAJA"]
[Mon Jan 05 03:08:21.624975 2026] [:error] [pid 8447:tid 8455] [client 4.189.161.78:65356] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ed35f.php"] [unique_id "aVq6pblwvJttJsvQpd_tcQAAAoU"]
[Mon Jan 05 03:08:22.131399 2026] [:error] [pid 6937:tid 6987] [client 4.189.161.78:64232] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fresh3.php"] [unique_id "aVq6pgfTYSkMJzNSH4V-JAAAAVI"]
[Mon Jan 05 03:08:23.528809 2026] [:error] [pid 7155:tid 7176] [client 4.189.161.78:30348] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fresh3.php"] [unique_id "aVq6pyD_CRsWjWrSXNJPAgAAAZM"]
[Mon Jan 05 03:08:23.884700 2026] [:error] [pid 7155:tid 7169] [client 4.189.161.78:65319] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fresh3.php"] [unique_id "aVq6pyD_CRsWjWrSXNJPAwAAAYw"]
[Mon Jan 05 03:08:24.477025 2026] [:error] [pid 1221:tid 1272] [client 4.189.161.78:64801] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fresh3.php"] [unique_id "aVq6qJ_3f4CdEKVLTXUZkgAAAJE"]
[Mon Jan 05 03:08:25.213188 2026] [:error] [pid 22541:tid 22605] [client 4.189.161.78:23584] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aVq6qUkjzS6tgkL3JEu-TQAAAgQ"]
[Mon Jan 05 03:08:26.139938 2026] [:error] [pid 22540:tid 22575] [client 4.189.161.78:64890] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aVq6qjQAa5AoSeJHBNqQNwAAAAE"]
[Mon Jan 05 03:08:26.866187 2026] [:error] [pid 6937:tid 6993] [client 4.189.161.78:64776] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aVq6qgfTYSkMJzNSH4V-JwAAAVc"]
[Mon Jan 05 03:08:27.354484 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:23614] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aVq6qwfTYSkMJzNSH4V-KQAAAVE"]
[Mon Jan 05 03:08:28.095282 2026] [:error] [pid 6937:tid 6991] [client 4.189.161.78:65314] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hey.php"] [unique_id "aVq6rAfTYSkMJzNSH4V-LAAAAVU"]
[Mon Jan 05 03:08:28.530233 2026] [:error] [pid 11570:tid 11583] [client 4.189.161.78:30353] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hey.php"] [unique_id "aVq6rFpq_sPZb-JYukUa2gAAAss"]
[Mon Jan 05 03:08:28.919296 2026] [:error] [pid 6613:tid 6630] [client 4.189.161.78:30379] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hey.php"] [unique_id "aVq6rMW2a9pc2Efh4D0agAAAAQ8"]
[Mon Jan 05 03:08:29.393868 2026] [:error] [pid 6613:tid 6635] [client 4.189.161.78:64872] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hey.php"] [unique_id "aVq6rcW2a9pc2Efh4D0agQAAARQ"]
[Mon Jan 05 03:08:29.827568 2026] [:error] [pid 22541:tid 22613] [client 4.189.161.78:64784] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suy.php"] [unique_id "aVq6rUkjzS6tgkL3JEu-TwAAAgw"]
[Mon Jan 05 03:08:30.772447 2026] [:error] [pid 1221:tid 1262] [client 4.189.161.78:64879] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suy.php"] [unique_id "aVq6rp_3f4CdEKVLTXUZmQAAAIc"]
[Mon Jan 05 03:08:32.037621 2026] [:error] [pid 6937:tid 6981] [client 4.189.161.78:65338] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suy.php"] [unique_id "aVq6sAfTYSkMJzNSH4V-LwAAAUw"]
[Mon Jan 05 03:08:32.567304 2026] [:error] [pid 7155:tid 7177] [client 4.189.161.78:64203] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suy.php"] [unique_id "aVq6sCD_CRsWjWrSXNJPBgAAAZQ"]
[Mon Jan 05 03:08:32.938177 2026] [:error] [pid 7155:tid 7161] [client 4.189.161.78:23569] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/giclass.php"] [unique_id "aVq6sCD_CRsWjWrSXNJPBwAAAYQ"]
[Mon Jan 05 03:08:33.360646 2026] [:error] [pid 1221:tid 1271] [client 4.189.161.78:64789] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/giclass.php"] [unique_id "aVq6sZ_3f4CdEKVLTXUZmwAAAJA"]
[Mon Jan 05 03:08:33.852845 2026] [:error] [pid 6937:tid 6963] [client 4.189.161.78:65330] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/giclass.php"] [unique_id "aVq6sQfTYSkMJzNSH4V-MwAAAUE"]
[Mon Jan 05 03:08:34.560720 2026] [:error] [pid 8447:tid 8455] [client 4.189.161.78:64859] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/giclass.php"] [unique_id "aVq6srlwvJttJsvQpd_tfAAAAoU"]
[Mon Jan 05 03:08:35.347621 2026] [:error] [pid 7716:tid 7740] [client 4.189.161.78:23562] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhitrgp.php"] [unique_id "aVq6szZZYbEubuUOjjbtOwAAAlA"]
[Mon Jan 05 03:08:36.012625 2026] [:error] [pid 22540:tid 22585] [client 4.189.161.78:65366] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhitrgp.php"] [unique_id "aVq6tDQAa5AoSeJHBNqQPgAAAAs"]
[Mon Jan 05 03:08:36.995204 2026] [:error] [pid 22540:tid 22576] [client 4.189.161.78:65397] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhitrgp.php"] [unique_id "aVq6tDQAa5AoSeJHBNqQQgAAAAI"]
[Mon Jan 05 03:08:38.045298 2026] [:error] [pid 7716:tid 7731] [client 4.189.161.78:65343] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhitrgp.php"] [unique_id "aVq6tjZZYbEubuUOjjbtQwAAAkc"]
[Mon Jan 05 03:08:39.159720 2026] [:error] [pid 22541:tid 22621] [client 4.189.161.78:64869] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nas.php"] [unique_id "aVq6t0kjzS6tgkL3JEu-VQAAAhQ"]
[Mon Jan 05 03:08:39.612772 2026] [:error] [pid 8447:tid 8472] [client 4.189.161.78:23581] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nas.php"] [unique_id "aVq6t7lwvJttJsvQpd_tfwAAApY"]
[Mon Jan 05 03:08:40.181587 2026] [:error] [pid 6613:tid 6615] [client 4.189.161.78:23577] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nas.php"] [unique_id "aVq6uMW2a9pc2Efh4D0aiAAAAQA"]
[Mon Jan 05 03:08:40.466763 2026] [:error] [pid 7626:tid 7642] [client 4.189.161.78:23599] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nas.php"] [unique_id "aVq6uFjhVzHrevQ2GQzuvQAAAcM"]
[Mon Jan 05 03:08:41.434838 2026] [:error] [pid 6937:tid 6981] [client 4.189.161.78:65341] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reyha.php"] [unique_id "aVq6uQfTYSkMJzNSH4V-OgAAAUw"]
[Mon Jan 05 03:08:42.499193 2026] [:error] [pid 7155:tid 7177] [client 4.189.161.78:64855] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reyha.php"] [unique_id "aVq6uiD_CRsWjWrSXNJPFwAAAZQ"]
[Mon Jan 05 03:08:43.381879 2026] [:error] [pid 7716:tid 7731] [client 4.189.161.78:64201] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reyha.php"] [unique_id "aVq6uzZZYbEubuUOjjbtVwAAAkc"]
[Mon Jan 05 03:08:45.911983 2026] [:error] [pid 6937:tid 6963] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/reyha.php
[Mon Jan 05 03:08:46.030153 2026] [:error] [pid 6937:tid 6989] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/shorw.php
[Mon Jan 05 03:08:46.157784 2026] [:error] [pid 6937:tid 6972] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/law.php
[Mon Jan 05 03:08:46.312824 2026] [:error] [pid 6937:tid 6993] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/admi.php
[Mon Jan 05 03:08:46.432404 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/nok.php
[Mon Jan 05 03:08:46.577539 2026] [:error] [pid 6937:tid 6964] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/c451f.php
[Mon Jan 05 03:08:47.124887 2026] [:error] [pid 6937:tid 6991] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/zasd.php
[Mon Jan 05 03:08:47.246770 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Mon Jan 05 03:08:47.385995 2026] [:error] [pid 6937:tid 6981] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Mon Jan 05 03:08:47.536195 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/zcxb.php
[Mon Jan 05 03:08:47.841172 2026] [:error] [pid 6937:tid 6987] [client 4.189.161.78:64854] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Mon Jan 05 03:08:48.163016 2026] [:error] [pid 6937:tid 6969] [client 4.189.161.78:64854] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ink.php"] [unique_id "aVq6wAfTYSkMJzNSH4V-SwAAAUY"]
[Mon Jan 05 03:08:49.299449 2026] [:error] [pid 7155:tid 7171] [client 4.189.161.78:23610] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ink.php"] [unique_id "aVq6wSD_CRsWjWrSXNJPLwAAAY4"]
[Mon Jan 05 03:08:49.949980 2026] [:error] [pid 11570:tid 11590] [client 4.189.161.78:30390] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ink.php"] [unique_id "aVq6wVpq_sPZb-JYukUa5AAAAtI"]
[Mon Jan 05 03:08:50.673947 2026] [:error] [pid 11570:tid 11587] [client 4.189.161.78:30386] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ink.php"] [unique_id "aVq6wlpq_sPZb-JYukUa5gAAAs8"]
[Mon Jan 05 03:08:51.717126 2026] [:error] [pid 1221:tid 1268] [client 4.189.161.78:30398] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc1.php"] [unique_id "aVq6w5_3f4CdEKVLTXUZswAAAI0"]
[Mon Jan 05 03:08:52.369762 2026] [:error] [pid 1221:tid 1264] [client 4.189.161.78:65287] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc1.php"] [unique_id "aVq6xJ_3f4CdEKVLTXUZtgAAAIk"]
[Mon Jan 05 03:08:53.291439 2026] [:error] [pid 22541:tid 22606] [client 4.189.161.78:65352] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc1.php"] [unique_id "aVq6xUkjzS6tgkL3JEu-XgAAAgU"]
[Mon Jan 05 03:08:54.361723 2026] [:error] [pid 6937:tid 6983] [client 4.189.161.78:65340] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpc1.php"] [unique_id "aVq6xgfTYSkMJzNSH4V-TwAAAU4"]
[Mon Jan 05 03:08:55.080187 2026] [:error] [pid 22540:tid 22581] [client 4.189.161.78:65379] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G6.php"] [unique_id "aVq6xzQAa5AoSeJHBNqQXQAAAAc"]
[Mon Jan 05 03:08:55.678475 2026] [:error] [pid 22540:tid 22574] [client 4.189.161.78:65315] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G6.php"] [unique_id "aVq6xzQAa5AoSeJHBNqQYQAAAAA"]
[Mon Jan 05 03:08:56.359677 2026] [:error] [pid 22541:tid 22614] [client 4.189.161.78:23615] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G6.php"] [unique_id "aVq6yEkjzS6tgkL3JEu-YAAAAg0"]
[Mon Jan 05 03:08:57.198854 2026] [:error] [pid 22541:tid 22625] [client 4.189.161.78:64875] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G6.php"] [unique_id "aVq6yUkjzS6tgkL3JEu-YQAAAhg"]
[Mon Jan 05 03:08:57.974632 2026] [:error] [pid 6613:tid 6624] [client 4.189.161.78:64770] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xrp.php"] [unique_id "aVq6ycW2a9pc2Efh4D0aogAAAQk"]
[Mon Jan 05 03:08:58.528814 2026] [:error] [pid 1221:tid 1258] [client 4.189.161.78:30396] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xrp.php"] [unique_id "aVq6yp_3f4CdEKVLTXUZuQAAAIM"]
[Mon Jan 05 03:09:00.181902 2026] [:error] [pid 7626:tid 7647] [client 4.189.161.78:30395] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xrp.php"] [unique_id "aVq6zFjhVzHrevQ2GQzuzgAAAcg"]
[Mon Jan 05 03:09:01.448518 2026] [:error] [pid 7716:tid 7739] [client 4.189.161.78:30356] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xrp.php"] [unique_id "aVq6zTZZYbEubuUOjjbtdgAAAk8"]
[Mon Jan 05 03:09:02.306771 2026] [:error] [pid 8447:tid 8463] [client 4.189.161.78:64851] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aVq6zrlwvJttJsvQpd_tjQAAAo0"]
[Mon Jan 05 03:09:04.117840 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:30367] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aVq60AfTYSkMJzNSH4V-WAAAAVE"]
[Mon Jan 05 03:09:04.927418 2026] [:error] [pid 6937:tid 6962] [client 4.189.161.78:65284] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aVq60AfTYSkMJzNSH4V-WgAAAUA"]
[Mon Jan 05 03:09:05.630093 2026] [:error] [pid 22540:tid 22575] [client 4.189.161.78:64782] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aVq60TQAa5AoSeJHBNqQagAAAAE"]
[Mon Jan 05 03:09:06.249397 2026] [:error] [pid 22540:tid 22578] [client 4.189.161.78:65355] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVq60jQAa5AoSeJHBNqQbgAAAAQ"]
[Mon Jan 05 03:09:07.260939 2026] [:error] [pid 1221:tid 1256] [client 4.189.161.78:64829] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVq605_3f4CdEKVLTXUZvgAAAIE"]
[Mon Jan 05 03:09:08.039976 2026] [:error] [pid 6613:tid 6625] [client 4.189.161.78:30343] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVq61MW2a9pc2Efh4D0aqwAAAQo"]
[Mon Jan 05 03:09:08.640711 2026] [:error] [pid 22540:tid 22576] [client 4.189.161.78:64219] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aVq61DQAa5AoSeJHBNqQcQAAAAI"]
[Mon Jan 05 03:09:09.245879 2026] [:error] [pid 6613:tid 6617] [client 4.189.161.78:23553] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tarc.php"] [unique_id "aVq61cW2a9pc2Efh4D0argAAAQI"]
[Mon Jan 05 03:09:09.745674 2026] [:error] [pid 6613:tid 6621] [client 4.189.161.78:64888] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tarc.php"] [unique_id "aVq61cW2a9pc2Efh4D0asAAAAQY"]
[Mon Jan 05 03:09:10.066585 2026] [:error] [pid 6613:tid 6637] [client 4.189.161.78:23561] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tarc.php"] [unique_id "aVq61sW2a9pc2Efh4D0asQAAARY"]
[Mon Jan 05 03:09:10.387693 2026] [:error] [pid 22541:tid 22618] [client 4.189.161.78:23609] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tarc.php"] [unique_id "aVq61kkjzS6tgkL3JEu-aQAAAhE"]
[Mon Jan 05 03:09:10.839710 2026] [:error] [pid 22541:tid 22617] [client 4.189.161.78:64233] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aVq61kkjzS6tgkL3JEu-awAAAhA"]
[Mon Jan 05 03:09:11.751181 2026] [:error] [pid 22540:tid 22598] [client 4.189.161.78:64240] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aVq61zQAa5AoSeJHBNqQdgAAABg"]
[Mon Jan 05 03:09:12.286231 2026] [:error] [pid 22540:tid 22574] [client 4.189.161.78:65392] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aVq62DQAa5AoSeJHBNqQdwAAAAA"]
[Mon Jan 05 03:09:12.915885 2026] [:error] [pid 8447:tid 8457] [client 4.189.161.78:65288] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aVq62LlwvJttJsvQpd_tlAAAAoc"]
[Mon Jan 05 03:09:13.507428 2026] [:error] [pid 8447:tid 8463] [client 4.189.161.78:64827] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lov.php"] [unique_id "aVq62blwvJttJsvQpd_tlwAAAo0"]
[Mon Jan 05 03:09:14.078728 2026] [:error] [pid 22541:tid 22616] [client 4.189.161.78:64778] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lov.php"] [unique_id "aVq62kkjzS6tgkL3JEu-bwAAAg8"]
[Mon Jan 05 03:09:14.503829 2026] [:error] [pid 22540:tid 22578] [client 4.189.161.78:65350] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lov.php"] [unique_id "aVq62jQAa5AoSeJHBNqQfAAAAAQ"]
[Mon Jan 05 03:09:15.188496 2026] [:error] [pid 7716:tid 7735] [client 4.189.161.78:30360] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lov.php"] [unique_id "aVq62zZZYbEubuUOjjbtfQAAAks"]
[Mon Jan 05 03:09:15.847197 2026] [:error] [pid 22540:tid 22576] [client 4.189.161.78:64220] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ppp.php"] [unique_id "aVq62zQAa5AoSeJHBNqQgQAAAAI"]
[Mon Jan 05 03:09:16.529650 2026] [:error] [pid 22540:tid 22581] [client 4.189.161.78:23590] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ppp.php"] [unique_id "aVq63DQAa5AoSeJHBNqQggAAAAc"]
[Mon Jan 05 03:09:17.211609 2026] [:error] [pid 22540:tid 22583] [client 4.189.161.78:30351] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ppp.php"] [unique_id "aVq63TQAa5AoSeJHBNqQhAAAAAk"]
[Mon Jan 05 03:09:17.762266 2026] [:error] [pid 7155:tid 7160] [client 4.189.161.78:23597] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ppp.php"] [unique_id "aVq63SD_CRsWjWrSXNJPNgAAAYM"]
[Mon Jan 05 03:09:18.364335 2026] [:error] [pid 11570:tid 11574] [client 4.189.161.78:64247] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aVq63lpq_sPZb-JYukUa7wAAAsI"]
[Mon Jan 05 03:09:19.441260 2026] [:error] [pid 11570:tid 11592] [client 4.189.161.78:64788] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aVq631pq_sPZb-JYukUa8gAAAtQ"]
[Mon Jan 05 03:09:19.977382 2026] [:error] [pid 8447:tid 8451] [client 4.189.161.78:30374] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aVq637lwvJttJsvQpd_tmAAAAoE"]
[Mon Jan 05 03:09:20.463655 2026] [:error] [pid 6937:tid 6980] [client 4.189.161.78:30352] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aVq64AfTYSkMJzNSH4V-XwAAAUs"]
[Mon Jan 05 03:09:20.919302 2026] [:error] [pid 22541:tid 22623] [client 4.189.161.78:64769] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wto.php"] [unique_id "aVq64EkjzS6tgkL3JEu-cgAAAhY"]
[Mon Jan 05 03:09:21.649759 2026] [:error] [pid 7626:tid 7644] [client 4.189.161.78:65368] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wto.php"] [unique_id "aVq64VjhVzHrevQ2GQzu0QAAAcU"]
[Mon Jan 05 03:09:22.099661 2026] [:error] [pid 1221:tid 1265] [client 4.189.161.78:64771] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wto.php"] [unique_id "aVq64p_3f4CdEKVLTXUZvwAAAIo"]
[Mon Jan 05 03:09:22.613840 2026] [:error] [pid 22541:tid 22622] [client 4.189.161.78:23604] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wto.php"] [unique_id "aVq64kkjzS6tgkL3JEu-dgAAAhU"]
[Mon Jan 05 03:09:23.292750 2026] [:error] [pid 11570:tid 11584] [client 4.189.161.78:65320] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVq641pq_sPZb-JYukUa9QAAAsw"]
[Mon Jan 05 03:09:24.186777 2026] [:error] [pid 6937:tid 6965] [client 4.189.161.78:64132] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVq65AfTYSkMJzNSH4V-YQAAAUM"]
[Mon Jan 05 03:09:25.163820 2026] [:error] [pid 11570:tid 11593] [client 4.189.161.78:65329] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVq65Vpq_sPZb-JYukUa-AAAAtU"]
[Mon Jan 05 03:09:26.129148 2026] [:error] [pid 7716:tid 7740] [client 4.189.161.78:23586] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aVq65jZZYbEubuUOjjbtggAAAlA"]
[Mon Jan 05 03:09:27.478847 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:64216] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tech5pr.php"] [unique_id "aVq65wfTYSkMJzNSH4V-bAAAAVY"]
[Mon Jan 05 03:09:28.497393 2026] [:error] [pid 7716:tid 7723] [client 4.189.161.78:64790] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tech5pr.php"] [unique_id "aVq66DZZYbEubuUOjjbthQAAAkA"]
[Mon Jan 05 03:09:29.337213 2026] [:error] [pid 6937:tid 6965] [client 4.189.161.78:64889] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tech5pr.php"] [unique_id "aVq66QfTYSkMJzNSH4V-bgAAAUM"]
[Mon Jan 05 03:09:29.811869 2026] [:error] [pid 1221:tid 1277] [client 4.189.161.78:23603] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tech5pr.php"] [unique_id "aVq66Z_3f4CdEKVLTXUZwwAAAJY"]
[Mon Jan 05 03:09:30.300514 2026] [:error] [pid 1221:tid 1257] [client 4.189.161.78:64832] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sty.php"] [unique_id "aVq66p_3f4CdEKVLTXUZxAAAAII"]
[Mon Jan 05 03:09:31.066372 2026] [:error] [pid 1221:tid 1258] [client 4.189.161.78:65367] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sty.php"] [unique_id "aVq665_3f4CdEKVLTXUZxQAAAIM"]
[Mon Jan 05 03:09:32.558404 2026] [:error] [pid 11570:tid 11590] [client 4.189.161.78:64141] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sty.php"] [unique_id "aVq67Fpq_sPZb-JYukUa_AAAAtI"]
[Mon Jan 05 03:09:33.879911 2026] [:error] [pid 1221:tid 1271] [client 4.189.161.78:23579] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sty.php"] [unique_id "aVq67Z_3f4CdEKVLTXUZxgAAAJA"]
[Mon Jan 05 03:09:34.474276 2026] [:error] [pid 7716:tid 7734] [client 4.189.161.78:64199] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVq67jZZYbEubuUOjjbtiQAAAko"]
[Mon Jan 05 03:09:35.064765 2026] [:error] [pid 11570:tid 11592] [client 4.189.161.78:64797] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVq671pq_sPZb-JYukUa_QAAAtQ"]
[Mon Jan 05 03:09:35.363484 2026] [:error] [pid 1221:tid 1279] [client 4.189.161.78:30370] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVq675_3f4CdEKVLTXUZyAAAAJg"]
[Mon Jan 05 03:09:35.969582 2026] [:error] [pid 1221:tid 1256] [client 4.189.161.78:65394] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc.php"] [unique_id "aVq675_3f4CdEKVLTXUZyQAAAIE"]
[Mon Jan 05 03:09:36.552087 2026] [:error] [pid 6613:tid 6639] [client 4.189.161.78:64791] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "aVq68MW2a9pc2Efh4D0auwAAARg"]
[Mon Jan 05 03:09:37.105451 2026] [:error] [pid 6613:tid 6629] [client 4.189.161.78:64248] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "aVq68cW2a9pc2Efh4D0avQAAAQ4"]
[Mon Jan 05 03:09:37.453125 2026] [:error] [pid 11570:tid 11577] [client 4.189.161.78:23612] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "aVq68Vpq_sPZb-JYukUbAQAAAsU"]
[Mon Jan 05 03:09:38.044674 2026] [:error] [pid 11570:tid 11573] [client 4.189.161.78:65402] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "aVq68lpq_sPZb-JYukUbAwAAAsE"]
[Mon Jan 05 03:09:38.484010 2026] [:error] [pid 11570:tid 11596] [client 4.189.161.78:64874] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sko.php"] [unique_id "aVq68lpq_sPZb-JYukUbBAAAAtg"]
[Mon Jan 05 03:09:38.785847 2026] [:error] [pid 7626:tid 7662] [client 4.189.161.78:65363] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sko.php"] [unique_id "aVq68ljhVzHrevQ2GQzu1gAAAdc"]
[Mon Jan 05 03:09:39.568967 2026] [:error] [pid 7626:tid 7643] [client 4.189.161.78:30368] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sko.php"] [unique_id "aVq681jhVzHrevQ2GQzu2AAAAcQ"]
[Mon Jan 05 03:09:40.154611 2026] [:error] [pid 6613:tid 6630] [client 4.189.161.78:65282] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sko.php"] [unique_id "aVq69MW2a9pc2Efh4D0avwAAAQ8"]
[Mon Jan 05 03:09:40.552740 2026] [:error] [pid 8447:tid 8453] [client 4.189.161.78:23574] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVq69LlwvJttJsvQpd_tnAAAAoM"]
[Mon Jan 05 03:09:40.835827 2026] [:error] [pid 6613:tid 6626] [client 4.189.161.78:30340] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVq69MW2a9pc2Efh4D0awQAAAQs"]
[Mon Jan 05 03:09:41.240078 2026] [:error] [pid 22540:tid 22583] [client 4.189.161.78:23585] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVq69TQAa5AoSeJHBNqQmQAAAAk"]
[Mon Jan 05 03:09:41.837917 2026] [:error] [pid 22541:tid 22622] [client 4.189.161.78:65310] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVq69UkjzS6tgkL3JEu-hgAAAhU"]
[Mon Jan 05 03:09:42.570450 2026] [:error] [pid 7716:tid 7733] [client 4.189.161.78:65406] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skk.php"] [unique_id "aVq69jZZYbEubuUOjjbtigAAAkk"]
[Mon Jan 05 03:09:43.387620 2026] [:error] [pid 6937:tid 6984] [client 4.189.161.78:23606] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skk.php"] [unique_id "aVq69wfTYSkMJzNSH4V-ewAAAU8"]
[Mon Jan 05 03:09:44.438285 2026] [:error] [pid 6937:tid 6985] [client 4.189.161.78:23591] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skk.php"] [unique_id "aVq6-AfTYSkMJzNSH4V-fQAAAVA"]
[Mon Jan 05 03:09:45.331404 2026] [:error] [pid 6937:tid 6980] [client 4.189.161.78:65327] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skk.php"] [unique_id "aVq6-QfTYSkMJzNSH4V-gAAAAUs"]
[Mon Jan 05 03:09:46.070706 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:64856] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/testas.php"] [unique_id "aVq6-gfTYSkMJzNSH4V-gQAAAVY"]
[Mon Jan 05 03:09:46.529603 2026] [:error] [pid 22540:tid 22591] [client 4.189.161.78:65346] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/testas.php"] [unique_id "aVq6-jQAa5AoSeJHBNqQnQAAABE"]
[Mon Jan 05 03:09:47.038198 2026] [:error] [pid 6937:tid 6972] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/testas.php
[Mon Jan 05 03:09:47.155160 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/ma1.php
[Mon Jan 05 03:09:47.334750 2026] [:error] [pid 6937:tid 6962] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/loi.php
[Mon Jan 05 03:09:47.451988 2026] [:error] [pid 6937:tid 6983] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/wolv2.php
[Mon Jan 05 03:09:47.633659 2026] [:error] [pid 6937:tid 6964] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Mon Jan 05 03:09:47.754365 2026] [:error] [pid 6937:tid 6988] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/4ff11.php
[Mon Jan 05 03:09:47.886040 2026] [:error] [pid 6937:tid 6984] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/kla.php
[Mon Jan 05 03:09:48.066929 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/hzz.php
[Mon Jan 05 03:09:48.216269 2026] [:error] [pid 6937:tid 6969] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/mtvcrew.php
[Mon Jan 05 03:09:48.369425 2026] [:error] [pid 6937:tid 6985] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/z58.php
[Mon Jan 05 03:09:48.485949 2026] [:error] [pid 6937:tid 6987] [client 4.189.161.78:23600] File does not exist: /usr/local/apache/htdocs/suspended-page/wle.php
[Mon Jan 05 03:09:48.610027 2026] [:error] [pid 6937:tid 6981] [client 4.189.161.78:23600] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aVq6_AfTYSkMJzNSH4V-kAAAAUw"]
[Mon Jan 05 03:09:49.291639 2026] [:error] [pid 7716:tid 7745] [client 4.189.161.78:64808] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aVq6_TZZYbEubuUOjjbtiwAAAlU"]
[Mon Jan 05 03:09:51.820530 2026] [:error] [pid 1221:tid 1262] [client 4.189.161.78:64783] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aVq6_5_3f4CdEKVLTXUZzwAAAIc"]
[Mon Jan 05 03:09:53.323153 2026] [:error] [pid 6613:tid 6629] [client 4.189.161.78:64222] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aVq7AcW2a9pc2Efh4D0axwAAAQ4"]
[Mon Jan 05 03:09:54.178438 2026] [:error] [pid 1221:tid 1258] [client 4.189.161.78:30342] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/09fa6.php"] [unique_id "aVq7Ap_3f4CdEKVLTXUZ0QAAAIM"]
[Mon Jan 05 03:09:54.632936 2026] [:error] [pid 1221:tid 1274] [client 4.189.161.78:64811] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/09fa6.php"] [unique_id "aVq7Ap_3f4CdEKVLTXUZ1AAAAJM"]
[Mon Jan 05 03:09:55.117850 2026] [:error] [pid 6613:tid 6636] [client 4.189.161.78:23552] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/09fa6.php"] [unique_id "aVq7A8W2a9pc2Efh4D0ayQAAARU"]
[Mon Jan 05 03:09:55.656793 2026] [:error] [pid 11570:tid 11584] [client 4.189.161.78:64798] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/09fa6.php"] [unique_id "aVq7A1pq_sPZb-JYukUbCwAAAsw"]
[Mon Jan 05 03:09:56.563911 2026] [:error] [pid 11570:tid 11573] [client 4.189.161.78:23605] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/89.php"] [unique_id "aVq7BFpq_sPZb-JYukUbDQAAAsE"]
[Mon Jan 05 03:09:56.991185 2026] [:error] [pid 11570:tid 11596] [client 4.189.161.78:64818] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/89.php"] [unique_id "aVq7BFpq_sPZb-JYukUbDwAAAtg"]
[Mon Jan 05 03:09:57.276635 2026] [:error] [pid 11570:tid 11593] [client 4.189.161.78:64885] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/89.php"] [unique_id "aVq7BVpq_sPZb-JYukUbEAAAAtU"]
[Mon Jan 05 03:09:57.601934 2026] [:error] [pid 7626:tid 7644] [client 4.189.161.78:64812] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/89.php"] [unique_id "aVq7BVjhVzHrevQ2GQzu3QAAAcU"]
[Mon Jan 05 03:09:58.167662 2026] [:error] [pid 7155:tid 7159] [client 4.189.161.78:23563] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVq7BiD_CRsWjWrSXNJPQQAAAYI"]
[Mon Jan 05 03:09:59.059813 2026] [:error] [pid 22541:tid 22607] [client 4.189.161.78:30389] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVq7B0kjzS6tgkL3JEu-jAAAAgY"]
[Mon Jan 05 03:09:59.476672 2026] [:error] [pid 6613:tid 6616] [client 4.189.161.78:65403] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVq7B8W2a9pc2Efh4D0azgAAAQE"]
[Mon Jan 05 03:10:00.305744 2026] [:error] [pid 6613:tid 6637] [client 4.189.161.78:23575] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tox.php"] [unique_id "aVq7CMW2a9pc2Efh4D0a0QAAARY"]
[Mon Jan 05 03:10:01.043276 2026] [:error] [pid 11570:tid 11585] [client 4.189.161.78:64226] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/has.php"] [unique_id "aVq7CVpq_sPZb-JYukUbEwAAAs0"]
[Mon Jan 05 03:10:02.081287 2026] [:error] [pid 22541:tid 22610] [client 4.189.161.78:30357] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/has.php"] [unique_id "aVq7CkkjzS6tgkL3JEu-jgAAAgk"]
[Mon Jan 05 03:10:02.392517 2026] [:error] [pid 7626:tid 7656] [client 4.189.161.78:65389] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/has.php"] [unique_id "aVq7CljhVzHrevQ2GQzu4AAAAdE"]
[Mon Jan 05 03:10:02.936899 2026] [:error] [pid 7626:tid 7650] [client 4.189.161.78:64249] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/has.php"] [unique_id "aVq7CljhVzHrevQ2GQzu4gAAAcs"]
[Mon Jan 05 03:10:03.432504 2026] [:error] [pid 6613:tid 6630] [client 4.189.161.78:64229] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nax.php"] [unique_id "aVq7C8W2a9pc2Efh4D0a1gAAAQ8"]
[Mon Jan 05 03:10:04.341064 2026] [:error] [pid 6613:tid 6618] [client 4.189.161.78:30350] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nax.php"] [unique_id "aVq7DMW2a9pc2Efh4D0a2gAAAQM"]
[Mon Jan 05 03:10:05.107281 2026] [:error] [pid 6613:tid 6628] [client 4.189.161.78:64191] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nax.php"] [unique_id "aVq7DcW2a9pc2Efh4D0a3QAAAQ0"]
[Mon Jan 05 03:10:06.130428 2026] [:error] [pid 7155:tid 7174] [client 4.189.161.78:23564] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nax.php"] [unique_id "aVq7DiD_CRsWjWrSXNJPRQAAAZE"]
[Mon Jan 05 03:10:07.560762 2026] [:error] [pid 6613:tid 6635] [client 4.189.161.78:65285] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ooj.php"] [unique_id "aVq7D8W2a9pc2Efh4D0a5wAAARQ"]
[Mon Jan 05 03:10:08.814037 2026] [:error] [pid 11570:tid 11580] [client 4.189.161.78:64846] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ooj.php"] [unique_id "aVq7EFpq_sPZb-JYukUbGAAAAsg"]
[Mon Jan 05 03:10:09.700914 2026] [:error] [pid 7626:tid 7658] [client 4.189.161.78:65376] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ooj.php"] [unique_id "aVq7EVjhVzHrevQ2GQzu6QAAAdM"]
[Mon Jan 05 03:10:10.308263 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:65394] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ooj.php"] [unique_id "aVq7EgfTYSkMJzNSH4V-owAAAVE"]
[Mon Jan 05 03:10:10.812487 2026] [:error] [pid 8447:tid 8470] [client 4.189.161.78:23560] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVq7ErlwvJttJsvQpd_trQAAApQ"]
[Mon Jan 05 03:10:11.987325 2026] [:error] [pid 1221:tid 1266] [client 4.189.161.78:23583] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVq7E5_3f4CdEKVLTXUZ2gAAAIs"]
[Mon Jan 05 03:10:12.693816 2026] [:error] [pid 11570:tid 11583] [client 4.189.161.78:23576] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVq7FFpq_sPZb-JYukUbHgAAAss"]
[Mon Jan 05 03:10:13.199419 2026] [:error] [pid 7155:tid 7161] [client 4.189.161.78:64817] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orm.php"] [unique_id "aVq7FSD_CRsWjWrSXNJPSQAAAYQ"]
[Mon Jan 05 03:10:13.895098 2026] [:error] [pid 1221:tid 1260] [client 4.189.161.78:65300] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mo.php"] [unique_id "aVq7FZ_3f4CdEKVLTXUZ3QAAAIU"]
[Mon Jan 05 03:10:14.462376 2026] [:error] [pid 8447:tid 8471] [client 4.189.161.78:65306] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mo.php"] [unique_id "aVq7FrlwvJttJsvQpd_tsQAAApU"]
[Mon Jan 05 03:10:15.085632 2026] [:error] [pid 7626:tid 7663] [client 4.189.161.78:23607] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mo.php"] [unique_id "aVq7F1jhVzHrevQ2GQzu6wAAAdg"]
[Mon Jan 05 03:10:15.420106 2026] [:error] [pid 11570:tid 11587] [client 4.189.161.78:23568] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mo.php"] [unique_id "aVq7F1pq_sPZb-JYukUbIAAAAs8"]
[Mon Jan 05 03:10:22.679471 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:30376] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yep.php"] [unique_id "aVq7HgfTYSkMJzNSH4V-rQAAAUg"]
[Mon Jan 05 03:10:23.246945 2026] [:error] [pid 6937:tid 6969] [client 4.189.161.78:64194] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yep.php"] [unique_id "aVq7HwfTYSkMJzNSH4V-rwAAAUY"]
[Mon Jan 05 03:10:24.721276 2026] [:error] [pid 8447:tid 8459] [client 4.189.161.78:64881] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yep.php"] [unique_id "aVq7ILlwvJttJsvQpd_tugAAAok"]
[Mon Jan 05 03:10:25.272054 2026] [:error] [pid 6613:tid 6623] [client 4.189.161.78:65362] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yep.php"] [unique_id "aVq7IcW2a9pc2Efh4D0a8wAAAQg"]
[Mon Jan 05 03:10:25.629379 2026] [:error] [pid 22540:tid 22586] [client 4.189.161.78:65388] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVq7ITQAa5AoSeJHBNqQqwAAAAw"]
[Mon Jan 05 03:10:26.305582 2026] [:error] [pid 6613:tid 6619] [client 4.189.161.78:65312] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVq7IsW2a9pc2Efh4D0a9QAAAQQ"]
[Mon Jan 05 03:10:26.938460 2026] [:error] [pid 6613:tid 6627] [client 4.189.161.78:23598] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVq7IsW2a9pc2Efh4D0a9gAAAQw"]
[Mon Jan 05 03:10:27.695009 2026] [:error] [pid 22540:tid 22574] [client 4.189.161.78:23582] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3.php"] [unique_id "aVq7IzQAa5AoSeJHBNqQsAAAAAA"]
[Mon Jan 05 03:10:28.487601 2026] [:error] [pid 8447:tid 8460] [client 4.189.161.78:65354] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6erg.php"] [unique_id "aVq7JLlwvJttJsvQpd_tvAAAAoo"]
[Mon Jan 05 03:10:29.083134 2026] [:error] [pid 7626:tid 7647] [client 4.189.161.78:65283] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6erg.php"] [unique_id "aVq7JVjhVzHrevQ2GQzu8AAAAcg"]
[Mon Jan 05 03:10:29.764269 2026] [:error] [pid 22541:tid 22617] [client 4.189.161.78:64780] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6erg.php"] [unique_id "aVq7JUkjzS6tgkL3JEu-nAAAAhA"]
[Mon Jan 05 03:10:30.298446 2026] [:error] [pid 1221:tid 1271] [client 4.189.161.78:65291] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6erg.php"] [unique_id "aVq7Jp_3f4CdEKVLTXUZ6wAAAJA"]
[Mon Jan 05 03:10:30.999098 2026] [:error] [pid 22541:tid 22606] [client 4.189.161.78:30361] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggfi.php"] [unique_id "aVq7JkkjzS6tgkL3JEu-nQAAAgU"]
[Mon Jan 05 03:10:31.742484 2026] [:error] [pid 22540:tid 22587] [client 4.189.161.78:34516] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggfi.php"] [unique_id "aVq7JzQAa5AoSeJHBNqQswAAAA0"]
[Mon Jan 05 03:10:32.494762 2026] [:error] [pid 22540:tid 22596] [client 4.189.161.78:30383] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggfi.php"] [unique_id "aVq7KDQAa5AoSeJHBNqQtQAAABY"]
[Mon Jan 05 03:10:32.997419 2026] [:error] [pid 1221:tid 1269] [client 4.189.161.78:65345] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggfi.php"] [unique_id "aVq7KJ_3f4CdEKVLTXUZ7AAAAI4"]
[Mon Jan 05 03:10:33.567702 2026] [:error] [pid 6937:tid 6982] [client 4.189.161.78:64230] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aVq7KQfTYSkMJzNSH4V-tgAAAU0"]
[Mon Jan 05 03:10:34.062080 2026] [:error] [pid 22541:tid 22605] [client 4.189.161.78:64873] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aVq7KkkjzS6tgkL3JEu-pQAAAgQ"]
[Mon Jan 05 03:10:34.498460 2026] [:error] [pid 1221:tid 1257] [client 4.189.161.78:30392] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aVq7Kp_3f4CdEKVLTXUZ7gAAAII"]
[Mon Jan 05 03:10:35.105124 2026] [:error] [pid 7626:tid 7663] [client 4.189.161.78:64184] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "aVq7K1jhVzHrevQ2GQzu9wAAAdg"]
[Mon Jan 05 03:10:35.558779 2026] [:error] [pid 7626:tid 7656] [client 4.189.161.78:64826] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVq7K1jhVzHrevQ2GQzu-AAAAdE"]
[Mon Jan 05 03:10:36.000635 2026] [:error] [pid 7626:tid 7650] [client 4.189.161.78:64814] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVq7K1jhVzHrevQ2GQzu-gAAAcs"]
[Mon Jan 05 03:10:36.360230 2026] [:error] [pid 7626:tid 7661] [client 4.189.161.78:65325] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVq7LFjhVzHrevQ2GQzu_QAAAdY"]
[Mon Jan 05 03:10:36.786789 2026] [:error] [pid 7716:tid 7732] [client 4.189.161.78:65387] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aVq7LDZZYbEubuUOjjbtnAAAAkg"]
[Mon Jan 05 03:10:37.043401 2026] [:error] [pid 7716:tid 7729] [client 4.189.161.78:64824] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jju.php"] [unique_id "aVq7LTZZYbEubuUOjjbtnQAAAkY"]
[Mon Jan 05 03:10:37.407946 2026] [:error] [pid 22540:tid 22581] [client 4.189.161.78:64887] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jju.php"] [unique_id "aVq7LTQAa5AoSeJHBNqQtgAAAAc"]
[Mon Jan 05 03:10:37.661791 2026] [:error] [pid 11570:tid 11576] [client 4.189.161.78:65371] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jju.php"] [unique_id "aVq7LVpq_sPZb-JYukUbLQAAAsQ"]
[Mon Jan 05 03:10:37.940096 2026] [:error] [pid 11570:tid 11596] [client 4.189.161.78:23567] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jju.php"] [unique_id "aVq7LVpq_sPZb-JYukUbLgAAAtg"]
[Mon Jan 05 03:10:38.635022 2026] [:error] [pid 22540:tid 22574] [client 4.189.161.78:64804] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rsnu.php"] [unique_id "aVq7LjQAa5AoSeJHBNqQuQAAAAA"]
[Mon Jan 05 03:10:39.466702 2026] [:error] [pid 8447:tid 8452] [client 4.189.161.78:64823] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rsnu.php"] [unique_id "aVq7L7lwvJttJsvQpd_twgAAAoI"]
[Mon Jan 05 03:10:39.974660 2026] [:error] [pid 8447:tid 8457] [client 4.189.161.78:64840] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rsnu.php"] [unique_id "aVq7L7lwvJttJsvQpd_twwAAAoc"]
[Mon Jan 05 03:10:40.263857 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:30362] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rsnu.php"] [unique_id "aVq7MAfTYSkMJzNSH4V-twAAAVY"]
[Mon Jan 05 03:10:40.605135 2026] [:error] [pid 8447:tid 8459] [client 4.189.161.78:65305] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffile.php"] [unique_id "aVq7MLlwvJttJsvQpd_txgAAAok"]
[Mon Jan 05 03:10:40.949477 2026] [:error] [pid 22541:tid 22621] [client 4.189.161.78:23573] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffile.php"] [unique_id "aVq7MEkjzS6tgkL3JEu-qwAAAhQ"]
[Mon Jan 05 03:10:41.285055 2026] [:error] [pid 6613:tid 6624] [client 4.189.161.78:30369] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffile.php"] [unique_id "aVq7McW2a9pc2Efh4D0bCwAAAQk"]
[Mon Jan 05 03:10:41.727990 2026] [:error] [pid 6613:tid 6621] [client 4.189.161.78:65359] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffile.php"] [unique_id "aVq7McW2a9pc2Efh4D0bDAAAAQY"]
[Mon Jan 05 03:10:42.230925 2026] [:error] [pid 22541:tid 22613] [client 4.189.161.78:65383] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVq7MkkjzS6tgkL3JEu-rwAAAgw"]
[Mon Jan 05 03:10:42.873174 2026] [:error] [pid 6613:tid 6639] [client 4.189.161.78:30337] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVq7MsW2a9pc2Efh4D0bDwAAARg"]
[Mon Jan 05 03:10:43.778893 2026] [:error] [pid 7155:tid 7159] [client 4.189.161.78:65349] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVq7MyD_CRsWjWrSXNJPXgAAAYI"]
[Mon Jan 05 03:10:44.528218 2026] [:error] [pid 22541:tid 22619] [client 4.189.161.78:65358] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVq7NEkjzS6tgkL3JEu-twAAAhI"]
[Mon Jan 05 03:10:44.905071 2026] [:error] [pid 6613:tid 6618] [client 4.189.161.78:64871] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aVq7NMW2a9pc2Efh4D0bEwAAAQM"]
[Mon Jan 05 03:10:45.288642 2026] [:error] [pid 1221:tid 1269] [client 4.189.161.78:64884] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aVq7NZ_3f4CdEKVLTXUZ9gAAAI4"]
[Mon Jan 05 03:10:45.656309 2026] [:error] [pid 7155:tid 7179] [client 4.189.161.78:30364] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aVq7NSD_CRsWjWrSXNJPXwAAAZY"]
[Mon Jan 05 03:10:46.218824 2026] [:error] [pid 11570:tid 11588] [client 4.189.161.78:64794] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aVq7Nlpq_sPZb-JYukUbNAAAAtA"]
[Mon Jan 05 03:10:46.461628 2026] [:error] [pid 11570:tid 11584] [client 4.189.161.78:23594] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aVq7Nlpq_sPZb-JYukUbNgAAAsw"]
[Mon Jan 05 03:10:47.321114 2026] [:error] [pid 6613:tid 6635] [client 4.189.161.78:65404] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aVq7N8W2a9pc2Efh4D0bFQAAARQ"]
[Mon Jan 05 03:10:47.977700 2026] [:error] [pid 22540:tid 22596] [client 4.189.161.78:65293] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CLA.php"] [unique_id "aVq7NzQAa5AoSeJHBNqQvwAAABY"]
[Mon Jan 05 03:10:48.402787 2026] [:error] [pid 22540:tid 22576] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/CLA.php
[Mon Jan 05 03:10:49.786400 2026] [:error] [pid 22540:tid 22576] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/lol.php
[Mon Jan 05 03:10:49.902970 2026] [:error] [pid 22540:tid 22581] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Mon Jan 05 03:10:50.065697 2026] [:error] [pid 22540:tid 22583] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/cccc.php
[Mon Jan 05 03:10:50.302318 2026] [:error] [pid 22540:tid 22579] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq.php
[Mon Jan 05 03:10:50.589601 2026] [:error] [pid 22540:tid 22574] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Mon Jan 05 03:10:50.707417 2026] [:error] [pid 22540:tid 22593] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Mon Jan 05 03:10:50.877363 2026] [:error] [pid 22540:tid 22592] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/ana.php
[Mon Jan 05 03:10:50.995067 2026] [:error] [pid 22540:tid 22575] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Mon Jan 05 03:10:51.125601 2026] [:error] [pid 22540:tid 22591] [client 4.189.161.78:64239] File does not exist: /usr/local/apache/htdocs/suspended-page/she.php
[Mon Jan 05 03:10:51.406293 2026] [:error] [pid 22540:tid 22587] [client 4.189.161.78:64239] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVq7OzQAa5AoSeJHBNqQzgAAAA0"]
[Mon Jan 05 03:10:52.237748 2026] [:error] [pid 22540:tid 22588] [client 4.189.161.78:23554] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVq7PDQAa5AoSeJHBNqQzwAAAA4"]
[Mon Jan 05 03:10:52.753836 2026] [:error] [pid 22541:tid 22607] [client 4.189.161.78:65294] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVq7PEkjzS6tgkL3JEu-uwAAAgY"]
[Mon Jan 05 03:10:53.455906 2026] [:error] [pid 7155:tid 7163] [client 4.189.161.78:23587] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aVq7PSD_CRsWjWrSXNJPZQAAAYY"]
[Mon Jan 05 03:10:54.696826 2026] [:error] [pid 6937:tid 6971] [client 4.189.161.78:30387] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVq7PgfTYSkMJzNSH4V-vwAAAUg"]
[Mon Jan 05 03:10:55.071033 2026] [:error] [pid 6937:tid 6985] [client 4.189.161.78:30354] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVq7PwfTYSkMJzNSH4V-wQAAAVA"]
[Mon Jan 05 03:10:55.635119 2026] [:error] [pid 6937:tid 6980] [client 4.189.161.78:64196] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVq7PwfTYSkMJzNSH4V-wgAAAUs"]
[Mon Jan 05 03:10:55.959682 2026] [:error] [pid 6937:tid 6994] [client 4.189.161.78:64853] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/excel.php"] [unique_id "aVq7PwfTYSkMJzNSH4V-xQAAAVg"]
[Mon Jan 05 03:10:56.443257 2026] [:error] [pid 22540:tid 22576] [client 4.189.161.78:64209] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVq7QDQAa5AoSeJHBNqQ0gAAAAI"]
[Mon Jan 05 03:10:57.780307 2026] [:error] [pid 6937:tid 6972] [client 4.189.161.78:65382] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVq7QQfTYSkMJzNSH4V-xwAAAUk"]
[Mon Jan 05 03:10:59.109870 2026] [:error] [pid 22540:tid 22581] [client 4.189.161.78:23595] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVq7QzQAa5AoSeJHBNqQ1AAAAAc"]
[Mon Jan 05 03:11:00.224586 2026] [:error] [pid 6937:tid 6983] [client 4.189.161.78:30381] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aVq7RAfTYSkMJzNSH4V-yQAAAU4"]
[Mon Jan 05 03:11:01.073927 2026] [:error] [pid 22541:tid 22609] [client 4.189.161.78:64787] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVq7RUkjzS6tgkL3JEu-wgAAAgg"]
[Mon Jan 05 03:11:01.801510 2026] [:error] [pid 7626:tid 7650] [client 4.189.161.78:65299] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVq7RVjhVzHrevQ2GQzvBAAAAcs"]
[Mon Jan 05 03:11:02.352785 2026] [:error] [pid 8447:tid 8474] [client 4.189.161.78:30346] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVq7RrlwvJttJsvQpd_tywAAApg"]
[Mon Jan 05 03:11:02.760564 2026] [:error] [pid 8447:tid 8472] [client 4.189.161.78:65316] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ap.php"] [unique_id "aVq7RrlwvJttJsvQpd_tzAAAApY"]
[Mon Jan 05 03:11:03.509675 2026] [:error] [pid 7155:tid 7169] [client 4.189.161.78:65384] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVq7RyD_CRsWjWrSXNJPbQAAAYw"]
[Mon Jan 05 03:11:03.966095 2026] [:error] [pid 7626:tid 7655] [client 4.189.161.78:65331] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVq7R1jhVzHrevQ2GQzvBwAAAdA"]
[Mon Jan 05 03:11:05.550334 2026] [:error] [pid 1221:tid 1262] [client 4.189.161.78:64820] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVq7SZ_3f4CdEKVLTXUZ_gAAAIc"]
[Mon Jan 05 03:11:06.441471 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:64822] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "aVq7SgfTYSkMJzNSH4V-1wAAAVE"]
[Mon Jan 05 03:11:07.605043 2026] [:error] [pid 7155:tid 7164] [client 4.189.161.78:64181] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/love.php"] [unique_id "aVq7SyD_CRsWjWrSXNJPcQAAAYc"]
[Mon Jan 05 03:11:08.708940 2026] [:error] [pid 1221:tid 1258] [client 4.189.161.78:23559] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/love.php"] [unique_id "aVq7TJ_3f4CdEKVLTXUZ_wAAAIM"]
[Mon Jan 05 03:11:09.675186 2026] [:error] [pid 8447:tid 8462] [client 4.189.161.78:30371] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/love.php"] [unique_id "aVq7TblwvJttJsvQpd_t1QAAAow"]
[Mon Jan 05 03:11:10.877161 2026] [:error] [pid 8447:tid 8453] [client 4.189.161.78:30378] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/love.php"] [unique_id "aVq7TrlwvJttJsvQpd_t1wAAAoM"]
[Mon Jan 05 03:11:11.703690 2026] [:error] [pid 7626:tid 7648] [client 4.189.161.78:64146] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso3.php"] [unique_id "aVq7T1jhVzHrevQ2GQzvDQAAAck"]
[Mon Jan 05 03:11:12.532235 2026] [:error] [pid 7716:tid 7738] [client 4.189.161.78:65377] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso3.php"] [unique_id "aVq7UDZZYbEubuUOjjbttQAAAk4"]
[Mon Jan 05 03:11:13.576615 2026] [:error] [pid 1221:tid 1259] [client 4.189.161.78:65296] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso3.php"] [unique_id "aVq7UZ_3f4CdEKVLTXUaAQAAAIQ"]
[Mon Jan 05 03:11:14.514282 2026] [:error] [pid 7716:tid 7740] [client 4.189.161.78:30338] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso3.php"] [unique_id "aVq7UjZZYbEubuUOjjbtuAAAAlA"]
[Mon Jan 05 03:11:15.718287 2026] [:error] [pid 22541:tid 22614] [client 4.189.161.78:64245] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aVq7U0kjzS6tgkL3JEu-xQAAAg0"]
[Mon Jan 05 03:11:16.911930 2026] [:error] [pid 22540:tid 22589] [client 4.189.161.78:64815] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aVq7VDQAa5AoSeJHBNqQ2gAAAA8"]
[Mon Jan 05 03:11:17.851531 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:64867] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aVq7VQfTYSkMJzNSH4V-4AAAAVY"]
[Mon Jan 05 03:11:18.344337 2026] [:error] [pid 22541:tid 22602] [client 4.189.161.78:64870] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aVq7VkkjzS6tgkL3JEu-zQAAAgE"]
[Mon Jan 05 03:11:18.726267 2026] [:error] [pid 22540:tid 22582] [client 4.189.161.78:65348] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxl.php"] [unique_id "aVq7VjQAa5AoSeJHBNqQ2wAAAAg"]
[Mon Jan 05 03:11:19.282859 2026] [:error] [pid 22540:tid 22597] [client 4.189.161.78:65380] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxl.php"] [unique_id "aVq7VzQAa5AoSeJHBNqQ3AAAABc"]
[Mon Jan 05 03:11:20.244440 2026] [:error] [pid 1221:tid 1268] [client 4.189.161.78:64221] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxl.php"] [unique_id "aVq7WJ_3f4CdEKVLTXUaBgAAAI0"]
[Mon Jan 05 03:11:20.513911 2026] [:error] [pid 6937:tid 6969] [client 4.189.161.78:65301] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxl.php"] [unique_id "aVq7WAfTYSkMJzNSH4V-6QAAAUY"]
[Mon Jan 05 03:11:20.815236 2026] [:error] [pid 7716:tid 7731] [client 4.189.161.78:30377] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aVq7WDZZYbEubuUOjjbtvQAAAkc"]
[Mon Jan 05 03:11:21.066695 2026] [:error] [pid 6937:tid 6985] [client 4.189.161.78:65344] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aVq7WQfTYSkMJzNSH4V-6gAAAVA"]
[Mon Jan 05 03:11:21.368255 2026] [:error] [pid 6937:tid 6991] [client 4.189.161.78:65298] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aVq7WQfTYSkMJzNSH4V-7AAAAVU"]
[Mon Jan 05 03:11:21.814790 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:64151] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aVq7WQfTYSkMJzNSH4V-7gAAAVY"]
[Mon Jan 05 03:11:22.353533 2026] [:error] [pid 1221:tid 1277] [client 4.189.161.78:23613] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aVq7Wp_3f4CdEKVLTXUaCAAAAJY"]
[Mon Jan 05 03:11:23.387285 2026] [:error] [pid 8447:tid 8461] [client 4.189.161.78:64160] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aVq7W7lwvJttJsvQpd_t3gAAAos"]
[Mon Jan 05 03:11:24.429272 2026] [:error] [pid 6937:tid 6983] [client 4.189.161.78:30349] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aVq7XAfTYSkMJzNSH4V-9gAAAU4"]
[Mon Jan 05 03:11:25.052918 2026] [:error] [pid 8447:tid 8458] [client 4.189.161.78:23556] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aVq7XblwvJttJsvQpd_t3wAAAog"]
[Mon Jan 05 03:11:25.347870 2026] [:error] [pid 8447:tid 8451] [client 4.189.161.78:64214] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVq7XblwvJttJsvQpd_t4QAAAoE"]
[Mon Jan 05 03:11:25.728099 2026] [:error] [pid 7716:tid 7747] [client 4.189.161.78:30345] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVq7XTZZYbEubuUOjjbtvgAAAlc"]
[Mon Jan 05 03:11:26.116266 2026] [:error] [pid 8447:tid 8473] [client 4.189.161.78:64779] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVq7XrlwvJttJsvQpd_t4wAAApc"]
[Mon Jan 05 03:11:26.469857 2026] [:error] [pid 8447:tid 8455] [client 4.189.161.78:65308] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aVq7XrlwvJttJsvQpd_t5AAAAoU"]
[Mon Jan 05 03:11:27.200897 2026] [:error] [pid 6937:tid 6987] [client 4.189.161.78:65313] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVq7XwfTYSkMJzNSH4V--AAAAVI"]
[Mon Jan 05 03:11:28.283114 2026] [:error] [pid 8447:tid 8468] [client 4.189.161.78:65333] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVq7YLlwvJttJsvQpd_t5QAAApI"]
[Mon Jan 05 03:11:28.624336 2026] [:error] [pid 11570:tid 11578] [client 4.189.161.78:64833] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVq7YFpq_sPZb-JYukUbRAAAAsY"]
[Mon Jan 05 03:11:29.071370 2026] [:error] [pid 22540:tid 22580] [client 4.189.161.78:64235] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfile.php"] [unique_id "aVq7YTQAa5AoSeJHBNqQ5gAAAAY"]
[Mon Jan 05 03:11:29.444904 2026] [:error] [pid 6613:tid 6623] [client 4.189.161.78:64841] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gold.php"] [unique_id "aVq7YcW2a9pc2Efh4D0bMAAAAQg"]
[Mon Jan 05 03:11:30.275181 2026] [:error] [pid 6937:tid 6986] [client 4.189.161.78:30388] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gold.php"] [unique_id "aVq7YgfTYSkMJzNSH4V-_gAAAVE"]
[Mon Jan 05 03:11:31.843466 2026] [:error] [pid 6937:tid 6993] [client 4.189.161.78:30375] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gold.php"] [unique_id "aVq7YwfTYSkMJzNSH4V-_wAAAVc"]
[Mon Jan 05 03:11:32.496195 2026] [:error] [pid 6937:tid 6987] [client 4.189.161.78:64845] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gold.php"] [unique_id "aVq7ZAfTYSkMJzNSH4V_AQAAAVI"]
[Mon Jan 05 03:11:34.297497 2026] [:error] [pid 7716:tid 7723] [client 4.189.161.78:64813] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aua.php"] [unique_id "aVq7ZjZZYbEubuUOjjbtxQAAAkA"]
[Mon Jan 05 03:11:35.114160 2026] [:error] [pid 7716:tid 7727] [client 4.189.161.78:65391] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aua.php"] [unique_id "aVq7ZzZZYbEubuUOjjbtxwAAAkQ"]
[Mon Jan 05 03:11:35.557648 2026] [:error] [pid 7716:tid 7724] [client 4.189.161.78:30384] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aua.php"] [unique_id "aVq7ZzZZYbEubuUOjjbtyAAAAkE"]
[Mon Jan 05 03:11:36.161660 2026] [:error] [pid 22540:tid 22581] [client 4.189.161.78:64137] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aua.php"] [unique_id "aVq7aDQAa5AoSeJHBNqQ6QAAAAc"]
[Mon Jan 05 03:11:36.481087 2026] [:error] [pid 22540:tid 22598] [client 4.189.161.78:64799] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aVq7aDQAa5AoSeJHBNqQ6gAAABg"]
[Mon Jan 05 03:11:36.726340 2026] [:error] [pid 7155:tid 7168] [client 4.189.161.78:65370] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aVq7aCD_CRsWjWrSXNJPfgAAAYs"]
[Mon Jan 05 03:11:37.195820 2026] [:error] [pid 1221:tid 1269] [client 4.189.161.78:64223] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aVq7aZ_3f4CdEKVLTXUaDQAAAI4"]
[Mon Jan 05 03:11:37.506146 2026] [:error] [pid 6937:tid 6967] [client 4.189.161.78:64145] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aVq7aQfTYSkMJzNSH4V_BAAAAUU"]
[Mon Jan 05 03:11:38.123843 2026] [:error] [pid 22540:tid 22592] [client 4.189.161.78:64161] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aVq7ajQAa5AoSeJHBNqQ7QAAABI"]
[Mon Jan 05 03:11:38.706726 2026] [:error] [pid 22541:tid 22613] [client 4.189.161.78:64792] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aVq7akkjzS6tgkL3JEu-3wAAAgw"]
[Mon Jan 05 03:11:39.591269 2026] [:error] [pid 8447:tid 8465] [client 4.189.161.78:64236] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aVq7a7lwvJttJsvQpd_t6gAAAo8"]
[Mon Jan 05 03:11:40.877457 2026] [:error] [pid 11570:tid 11586] [client 4.189.161.78:65323] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/great.php"] [unique_id "aVq7bFpq_sPZb-JYukUbTAAAAs4"]
[Mon Jan 05 03:11:41.471697 2026] [:error] [pid 6613:tid 6628] [client 4.189.161.78:23608] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVq7bcW2a9pc2Efh4D0bOAAAAQ0"]
[Mon Jan 05 03:11:42.083399 2026] [:error] [pid 6613:tid 6639] [client 4.189.161.78:65365] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVq7bsW2a9pc2Efh4D0bOQAAARg"]
[Mon Jan 05 03:11:42.900848 2026] [:error] [pid 8447:tid 8460] [client 4.189.161.78:23571] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVq7brlwvJttJsvQpd_t7AAAAoo"]
[Mon Jan 05 03:11:43.718674 2026] [:error] [pid 11570:tid 11583] [client 4.189.161.78:65280] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVq7b1pq_sPZb-JYukUbTgAAAss"]
[Mon Jan 05 03:11:44.338828 2026] [:error] [pid 8447:tid 8454] [client 4.189.161.78:65292] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aVq7cLlwvJttJsvQpd_t7gAAAoQ"]
[Mon Jan 05 03:11:44.626822 2026] [:error] [pid 6613:tid 6619] [client 4.189.161.78:23589] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aVq7cMW2a9pc2Efh4D0bPAAAAQQ"]
[Mon Jan 05 03:11:45.041896 2026] [:error] [pid 7716:tid 7740] [client 4.189.161.78:64774] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aVq7cTZZYbEubuUOjjbt0AAAAlA"]
[Mon Jan 05 03:11:46.003885 2026] [:error] [pid 6613:tid 6636] [client 4.189.161.78:65302] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aVq7csW2a9pc2Efh4D0bPgAAARU"]
[Mon Jan 05 03:11:46.981736 2026] [:error] [pid 8447:tid 8461] [client 4.189.161.78:64195] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aVq7crlwvJttJsvQpd_t7wAAAos"]
[Mon Jan 05 03:11:47.735033 2026] [:error] [pid 7155:tid 7169] [client 4.189.161.78:64838] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aVq7cyD_CRsWjWrSXNJPhwAAAYw"]
[Mon Jan 05 03:11:48.407671 2026] [:error] [pid 11570:tid 11588] [client 4.189.161.78:65364] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aVq7dFpq_sPZb-JYukUbUQAAAtA"]
[Mon Jan 05 03:11:49.758044 2026] [:error] [pid 11570:tid 11595] [client 4.189.161.78:64190] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ot.php"] [unique_id "aVq7dVpq_sPZb-JYukUbUgAAAtc"]
[Mon Jan 05 03:11:50.580261 2026] [:error] [pid 11570:tid 11591] [client 4.189.161.78:65398] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/witmm.php"] [unique_id "aVq7dlpq_sPZb-JYukUbVQAAAtM"]
[Mon Jan 05 03:11:50.861989 2026] [:error] [pid 8447:tid 8474] [client 4.189.161.78:23578] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/witmm.php"] [unique_id "aVq7drlwvJttJsvQpd_t8AAAApg"]
[Mon Jan 05 03:11:51.295610 2026] [:error] [pid 6613:tid 6633] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/witmm.php
[Mon Jan 05 03:11:51.413381 2026] [:error] [pid 6613:tid 6635] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/rxzx.php
[Mon Jan 05 03:11:51.530279 2026] [:error] [pid 6613:tid 6626] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/ocxla.php
[Mon Jan 05 03:11:51.691077 2026] [:error] [pid 6613:tid 6616] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Mon Jan 05 03:11:51.816097 2026] [:error] [pid 6613:tid 6634] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Mon Jan 05 03:11:51.933057 2026] [:error] [pid 6613:tid 6630] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/resp.php
[Mon Jan 05 03:11:52.052095 2026] [:error] [pid 6613:tid 6625] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/100.kb.php
[Mon Jan 05 03:11:52.197881 2026] [:error] [pid 6613:tid 6624] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/gec.php
[Mon Jan 05 03:11:52.319756 2026] [:error] [pid 6613:tid 6621] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/wqqs.php
[Mon Jan 05 03:11:52.512661 2026] [:error] [pid 6613:tid 6615] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq13.php
[Mon Jan 05 03:11:52.646810 2026] [:error] [pid 6613:tid 6639] [client 4.189.161.78:65295] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Mon Jan 05 03:11:52.807393 2026] [:error] [pid 6613:tid 6637] [client 4.189.161.78:65295] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "aVq7eMW2a9pc2Efh4D0bTAAAARY"]
[Mon Jan 05 03:11:54.129871 2026] [:error] [pid 1221:tid 1264] [client 4.189.161.78:65386] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "aVq7ep_3f4CdEKVLTXUaEgAAAIk"]
[Mon Jan 05 03:11:55.458748 2026] [:error] [pid 7716:tid 7736] [client 4.189.161.78:30359] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "aVq7ezZZYbEubuUOjjbt0gAAAkw"]
[Mon Jan 05 03:11:56.153771 2026] [:error] [pid 6937:tid 6988] [client 4.189.161.78:65297] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "aVq7fAfTYSkMJzNSH4V_CgAAAVM"]
[Mon Jan 05 03:11:57.177130 2026] [:error] [pid 8447:tid 8464] [client 4.189.161.78:64775] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "aVq7fblwvJttJsvQpd_t9wAAAo4"]
[Mon Jan 05 03:11:58.009311 2026] [:error] [pid 1221:tid 1275] [client 4.189.161.78:65378] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "aVq7fp_3f4CdEKVLTXUaFQAAAJQ"]
[Mon Jan 05 03:11:58.985273 2026] [:error] [pid 22540:tid 22577] [client 4.189.161.78:64858] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "aVq7fjQAa5AoSeJHBNqQ-QAAAAM"]
[Mon Jan 05 03:12:00.123155 2026] [:error] [pid 22541:tid 22620] [client 4.189.161.78:64852] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "aVq7gEkjzS6tgkL3JEu-5gAAAhM"]
[Mon Jan 05 03:12:00.572230 2026] [:error] [pid 6937:tid 6992] [client 4.189.161.78:65289] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aVq7gAfTYSkMJzNSH4V_DQAAAVY"]
[Mon Jan 05 03:12:00.907218 2026] [:error] [pid 1221:tid 1265] [client 4.189.161.78:65399] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aVq7gJ_3f4CdEKVLTXUaFgAAAIo"]
[Mon Jan 05 03:12:01.209862 2026] [:error] [pid 6937:tid 6962] [client 4.189.161.78:64773] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aVq7gQfTYSkMJzNSH4V_DwAAAUA"]
[Mon Jan 05 03:12:01.686443 2026] [:error] [pid 11570:tid 11576] [client 4.189.161.78:65381] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aVq7gVpq_sPZb-JYukUbVwAAAsQ"]
[Mon Jan 05 03:12:02.183507 2026] [:error] [pid 6937:tid 6980] [client 4.189.161.78:64821] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp8.php"] [unique_id "aVq7ggfTYSkMJzNSH4V_EQAAAUs"]
[Mon Jan 05 03:12:02.590222 2026] [:error] [pid 6937:tid 6984] [client 4.189.161.78:30344] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp8.php"] [unique_id "aVq7ggfTYSkMJzNSH4V_FAAAAU8"]
[Mon Jan 05 03:12:02.982798 2026] [:error] [pid 22541:tid 22610] [client 4.189.161.78:30341] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp8.php"] [unique_id "aVq7gkkjzS6tgkL3JEu-5wAAAgk"]
[Mon Jan 05 03:12:04.144145 2026] [:error] [pid 6937:tid 6979] [client 4.189.161.78:65304] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp8.php"] [unique_id "aVq7hAfTYSkMJzNSH4V_FgAAAUo"]
[Mon Jan 05 03:12:06.058796 2026] [:error] [pid 6937:tid 6989] [client 4.189.161.78:23601] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aVq7hgfTYSkMJzNSH4V_FwAAAVQ"]
[Mon Jan 05 03:12:06.732611 2026] [:error] [pid 1221:tid 1259] [client 4.189.161.78:64880] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aVq7hp_3f4CdEKVLTXUaGQAAAIQ"]
[Mon Jan 05 03:12:07.531421 2026] [:error] [pid 7155:tid 7163] [client 4.189.161.78:65311] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aVq7hyD_CRsWjWrSXNJPjgAAAYY"]
[Mon Jan 05 03:12:08.116623 2026] [:error] [pid 7716:tid 7729] [client 4.189.161.78:23566] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aVq7iDZZYbEubuUOjjbt1QAAAkY"]
[Mon Jan 05 03:12:09.820262 2026] [:error] [pid 7155:tid 7171] [client 4.189.161.78:65324] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fasx.php"] [unique_id "aVq7iSD_CRsWjWrSXNJPjwAAAY4"]
[Mon Jan 05 03:12:11.279203 2026] [:error] [pid 1221:tid 1277] [client 4.189.161.78:65360] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fasx.php"] [unique_id "aVq7i5_3f4CdEKVLTXUaHwAAAJY"]
[Mon Jan 05 03:12:13.149032 2026] [:error] [pid 7155:tid 7176] [client 4.189.161.78:64161] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fasx.php"] [unique_id "aVq7jSD_CRsWjWrSXNJPkwAAAZM"]
[Mon Jan 05 03:12:14.116277 2026] [:error] [pid 1221:tid 1260] [client 4.189.161.78:65283] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fasx.php"] [unique_id "aVq7jp_3f4CdEKVLTXUaJQAAAIU"]
[Mon Jan 05 03:12:14.756306 2026] [:error] [pid 22541:tid 22609] [client 4.189.161.78:30382] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon3.php"] [unique_id "aVq7jkkjzS6tgkL3JEu-7QAAAgg"]
[Mon Jan 05 03:12:15.622261 2026] [:error] [pid 1221:tid 1263] [client 4.189.161.78:64202] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon3.php"] [unique_id "aVq7j5_3f4CdEKVLTXUaKAAAAIg"]
[Mon Jan 05 03:12:16.338794 2026] [:error] [pid 1221:tid 1268] [client 4.189.161.78:65317] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon3.php"] [unique_id "aVq7kJ_3f4CdEKVLTXUaLQAAAI0"]
[Mon Jan 05 03:12:18.032829 2026] [:error] [pid 8447:tid 8455] [client 4.189.161.78:64158] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon3.php"] [unique_id "aVq7krlwvJttJsvQpd_t_gAAAoU"]
[Mon Jan 05 03:12:19.756081 2026] [:error] [pid 6937:tid 6972] [client 4.189.161.78:65335] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVq7kwfTYSkMJzNSH4V_HgAAAUk"]
[Mon Jan 05 03:12:22.507707 2026] [:error] [pid 6613:tid 6628] [client 4.189.161.78:30373] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVq7lsW2a9pc2Efh4D0bVQAAAQ0"]
[Mon Jan 05 03:12:24.672504 2026] [:error] [pid 22541:tid 22622] [client 4.189.161.78:64777] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVq7mEkjzS6tgkL3JEu--QAAAhU"]
[Mon Jan 05 03:12:25.193312 2026] [:error] [pid 7716:tid 7726] [client 4.189.161.78:64876] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aVq7mTZZYbEubuUOjjbt5AAAAkM"]
[Mon Jan 05 03:12:25.658036 2026] [:error] [pid 6937:tid 6988] [client 4.189.161.78:23558] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c4.php"] [unique_id "aVq7mQfTYSkMJzNSH4V_JAAAAVM"]
[Mon Jan 05 03:12:26.724592 2026] [:error] [pid 1221:tid 1279] [client 4.189.161.78:34520] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c4.php"] [unique_id "aVq7mp_3f4CdEKVLTXUaOQAAAJg"]
[Mon Jan 05 03:12:28.357972 2026] [:error] [pid 22540:tid 22584] [client 4.189.161.78:23557] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c4.php"] [unique_id "aVq7nDQAa5AoSeJHBNqRBAAAAAo"]
[Mon Jan 05 03:12:29.067722 2026] [:error] [pid 8447:tid 8456] [client 4.189.161.78:64213] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c4.php"] [unique_id "aVq7nblwvJttJsvQpd_uAQAAAoY"]
[Mon Jan 05 03:12:29.464877 2026] [:error] [pid 6613:tid 6634] [client 4.189.161.78:65396] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aVq7ncW2a9pc2Efh4D0bXgAAARM"]
[Mon Jan 05 03:12:29.925975 2026] [:error] [pid 7716:tid 7737] [client 4.189.161.78:64844] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aVq7nTZZYbEubuUOjjbt5gAAAk0"]
[Mon Jan 05 03:12:32.542090 2026] [:error] [pid 6613:tid 6618] [client 4.189.161.78:64877] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aVq7oMW2a9pc2Efh4D0bYgAAAQM"]
[Mon Jan 05 03:12:34.532619 2026] [:error] [pid 7155:tid 7165] [client 4.189.161.78:64848] [client 4.189.161.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aVq7oiD_CRsWjWrSXNJPnwAAAYg"]
[Mon Jan 05 05:16:49.164486 2026] [:error] [pid 5536:tid 5613] [client 182.43.70.143:37205] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVrYwQRtMZNG6xI8yDzERgAAAJA"]
[Mon Jan 05 06:42:56.404756 2026] [:error] [pid 5632:tid 5654] [client 216.73.160.152:46421] [client 216.73.160.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVrs8IN3ZWvlOh-nbt_DxgAAAMo"]
[Mon Jan 05 06:42:57.190624 2026] [:error] [pid 6680:tid 6695] [client 216.73.160.132:62049] [client 216.73.160.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aVrs8aE58uNoazzTmx33qQAAAQ0"]
[Mon Jan 05 06:42:57.975364 2026] [:error] [pid 5534:tid 5566] [client 216.73.160.140:53247] [client 216.73.160.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/media/system/js/core.js"] [unique_id "aVrs8ZNs9XmbR6unB0zKaQAAABc"]
[Mon Jan 05 08:29:33.367886 2026] [:error] [pid 5534:tid 5545] [client 43.130.105.21:58256] [client 43.130.105.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVsF7ZNs9XmbR6unB0zwlQAAAAI"]
[Mon Jan 05 14:55:17.285942 2026] [:error] [pid 5536:tid 5598] [client 43.164.197.209:41038] [client 43.164.197.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVtgVQRtMZNG6xI8yDyA5QAAAIE"]
[Mon Jan 05 16:28:07.873878 2026] [:error] [pid 5536:tid 5620] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/bless14.php
[Mon Jan 05 16:28:08.013591 2026] [:error] [pid 5536:tid 5597] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/nwflm.php
[Mon Jan 05 16:28:08.153346 2026] [:error] [pid 5536:tid 5610] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs19.php
[Mon Jan 05 16:28:08.293614 2026] [:error] [pid 5536:tid 5619] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/qa.php
[Mon Jan 05 16:28:08.434133 2026] [:error] [pid 5536:tid 5609] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/sidfile.php
[Mon Jan 05 16:28:08.573454 2026] [:error] [pid 5536:tid 5608] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-los.php
[Mon Jan 05 16:28:08.714200 2026] [:error] [pid 5536:tid 5606] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/xxw.php
[Mon Jan 05 16:28:08.853866 2026] [:error] [pid 5536:tid 5612] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/file58.php
[Mon Jan 05 16:28:08.995146 2026] [:error] [pid 5536:tid 5613] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/0w1d.php
[Mon Jan 05 16:28:09.135687 2026] [:error] [pid 5536:tid 5617] [client 4.240.125.246:17938] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Mon Jan 05 16:28:09.272460 2026] [:error] [pid 5536:tid 5599] [client 4.240.125.246:17938] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/strift.php"] [unique_id "aVt2GQRtMZNG6xI8yDyamQAAAII"]
[Mon Jan 05 16:28:09.546438 2026] [:error] [pid 5632:tid 5656] [client 4.240.125.246:18028] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/strift.php"] [unique_id "aVt2GYN3ZWvlOh-nbt-IvQAAAMw"]
[Mon Jan 05 16:28:09.819459 2026] [:error] [pid 5632:tid 5650] [client 4.240.125.246:18024] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/strift.php"] [unique_id "aVt2GYN3ZWvlOh-nbt-IvgAAAMY"]
[Mon Jan 05 16:28:10.098817 2026] [:error] [pid 6680:tid 6688] [client 4.240.125.246:17943] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/strift.php"] [unique_id "aVt2GqE58uNoazzTmx2sigAAAQY"]
[Mon Jan 05 16:28:10.371615 2026] [:error] [pid 6680:tid 6683] [client 4.240.125.246:18009] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bel.php"] [unique_id "aVt2GqE58uNoazzTmx2sjAAAAQE"]
[Mon Jan 05 16:28:10.643537 2026] [:error] [pid 6680:tid 6697] [client 4.240.125.246:18027] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bel.php"] [unique_id "aVt2GqE58uNoazzTmx2sjQAAAQ8"]
[Mon Jan 05 16:28:10.915983 2026] [:error] [pid 28407:tid 28420] [client 4.240.125.246:17997] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bel.php"] [unique_id "aVt2Gtercd3ptydUzM0HHgAAAYk"]
[Mon Jan 05 16:28:11.199852 2026] [:error] [pid 28407:tid 28434] [client 4.240.125.246:17950] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bel.php"] [unique_id "aVt2G9ercd3ptydUzM0HHwAAAZc"]
[Mon Jan 05 16:28:11.473942 2026] [:error] [pid 28407:tid 28426] [client 4.240.125.246:17999] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk1.php"] [unique_id "aVt2G9ercd3ptydUzM0HIAAAAY8"]
[Mon Jan 05 16:28:11.760393 2026] [:error] [pid 54081:tid 54097] [client 4.240.125.246:7126] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk1.php"] [unique_id "aVt2G1L4jLgtF-b9w4dIBQAAAU0"]
[Mon Jan 05 16:28:12.031951 2026] [:error] [pid 5535:tid 5586] [client 4.240.125.246:18040] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk1.php"] [unique_id "aVt2HGnkedMjhVX0PTU4NgAAAFA"]
[Mon Jan 05 16:28:12.303710 2026] [:error] [pid 28407:tid 28412] [client 4.240.125.246:17986] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rk1.php"] [unique_id "aVt2HNercd3ptydUzM0HIQAAAYI"]
[Mon Jan 05 16:28:12.574008 2026] [:error] [pid 28407:tid 28421] [client 4.240.125.246:18039] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aVt2HNercd3ptydUzM0HIgAAAYo"]
[Mon Jan 05 16:28:12.846582 2026] [:error] [pid 28407:tid 28414] [client 4.240.125.246:7111] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aVt2HNercd3ptydUzM0HJAAAAYQ"]
[Mon Jan 05 16:28:13.121898 2026] [:error] [pid 28407:tid 28433] [client 4.240.125.246:17993] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aVt2Hdercd3ptydUzM0HJwAAAZY"]
[Mon Jan 05 16:28:13.392797 2026] [:error] [pid 6680:tid 6687] [client 4.240.125.246:17942] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aVt2HaE58uNoazzTmx2sjgAAAQU"]
[Mon Jan 05 16:28:13.679366 2026] [:error] [pid 28407:tid 28415] [client 4.240.125.246:17948] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVt2Hdercd3ptydUzM0HKAAAAYU"]
[Mon Jan 05 16:28:13.952224 2026] [:error] [pid 54081:tid 54091] [client 4.240.125.246:17929] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVt2HVL4jLgtF-b9w4dIBgAAAUc"]
[Mon Jan 05 16:28:14.228561 2026] [:error] [pid 28407:tid 28410] [client 4.240.125.246:18042] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVt2Htercd3ptydUzM0HKQAAAYA"]
[Mon Jan 05 16:28:14.500208 2026] [:error] [pid 28407:tid 28430] [client 4.240.125.246:18020] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aVt2Htercd3ptydUzM0HKwAAAZM"]
[Mon Jan 05 16:28:14.774879 2026] [:error] [pid 28407:tid 28417] [client 4.240.125.246:18037] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oga.php"] [unique_id "aVt2Htercd3ptydUzM0HLgAAAYc"]
[Mon Jan 05 16:28:15.053679 2026] [:error] [pid 28407:tid 28422] [client 4.240.125.246:17920] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oga.php"] [unique_id "aVt2H9ercd3ptydUzM0HLwAAAYs"]
[Mon Jan 05 16:28:15.325193 2026] [:error] [pid 6680:tid 6702] [client 4.240.125.246:17939] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oga.php"] [unique_id "aVt2H6E58uNoazzTmx2sjwAAARQ"]
[Mon Jan 05 16:28:15.600202 2026] [:error] [pid 6680:tid 6704] [client 4.240.125.246:17923] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oga.php"] [unique_id "aVt2H6E58uNoazzTmx2skAAAARY"]
[Mon Jan 05 16:28:15.869910 2026] [:error] [pid 5534:tid 5565] [client 4.240.125.246:17975] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVt2H5Ns9XmbR6unB0xn8gAAABY"]
[Mon Jan 05 16:28:16.147238 2026] [:error] [pid 5632:tid 5651] [client 4.240.125.246:17994] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVt2IIN3ZWvlOh-nbt-IxAAAAMc"]
[Mon Jan 05 16:28:16.416001 2026] [:error] [pid 5536:tid 5607] [client 4.240.125.246:17977] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVt2IARtMZNG6xI8yDyamgAAAIo"]
[Mon Jan 05 16:28:16.683906 2026] [:error] [pid 5536:tid 5620] [client 4.240.125.246:18008] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aVt2IARtMZNG6xI8yDyamwAAAJc"]
[Mon Jan 05 16:28:16.957753 2026] [:error] [pid 5535:tid 5581] [client 4.240.125.246:17934] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVt2IGnkedMjhVX0PTU4OgAAAEs"]
[Mon Jan 05 16:28:17.228717 2026] [:error] [pid 5535:tid 5587] [client 4.240.125.246:18026] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVt2IWnkedMjhVX0PTU4PAAAAFE"]
[Mon Jan 05 16:28:17.501059 2026] [:error] [pid 28407:tid 28426] [client 4.240.125.246:17922] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVt2Idercd3ptydUzM0HMgAAAY8"]
[Mon Jan 05 16:28:17.780609 2026] [:error] [pid 5534:tid 5560] [client 4.240.125.246:18023] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aVt2IZNs9XmbR6unB0xn9gAAABE"]
[Mon Jan 05 16:28:18.049881 2026] [:error] [pid 5534:tid 5564] [client 4.240.125.246:18011] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVt2IpNs9XmbR6unB0xn9wAAABU"]
[Mon Jan 05 16:28:18.319067 2026] [:error] [pid 5536:tid 5597] [client 4.240.125.246:17991] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVt2IgRtMZNG6xI8yDyangAAAIA"]
[Mon Jan 05 16:28:18.589989 2026] [:error] [pid 5534:tid 5548] [client 4.240.125.246:18016] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVt2IpNs9XmbR6unB0xn-AAAAAU"]
[Mon Jan 05 16:28:18.859729 2026] [:error] [pid 5536:tid 5603] [client 4.240.125.246:18031] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f2f.php"] [unique_id "aVt2IgRtMZNG6xI8yDyanwAAAIY"]
[Mon Jan 05 16:28:19.128118 2026] [:error] [pid 5536:tid 5601] [client 4.240.125.246:17931] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVt2IwRtMZNG6xI8yDyaoQAAAIQ"]
[Mon Jan 05 16:28:19.408334 2026] [:error] [pid 6680:tid 6694] [client 4.240.125.246:18017] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVt2I6E58uNoazzTmx2skgAAAQw"]
[Mon Jan 05 16:28:19.680092 2026] [:error] [pid 54081:tid 54086] [client 4.240.125.246:17947] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVt2I1L4jLgtF-b9w4dICAAAAUI"]
[Mon Jan 05 16:28:19.952287 2026] [:error] [pid 6680:tid 6703] [client 4.240.125.246:17988] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ths.php"] [unique_id "aVt2I6E58uNoazzTmx2slAAAARU"]
[Mon Jan 05 16:28:20.232606 2026] [:error] [pid 5536:tid 5621] [client 4.240.125.246:7144] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xw.php"] [unique_id "aVt2JARtMZNG6xI8yDyaogAAAJg"]
[Mon Jan 05 16:28:20.505099 2026] [:error] [pid 5534:tid 5544] [client 4.240.125.246:18046] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xw.php"] [unique_id "aVt2JJNs9XmbR6unB0xn-gAAAAE"]
[Mon Jan 05 16:28:20.777140 2026] [:error] [pid 5536:tid 5619] [client 4.240.125.246:7112] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xw.php"] [unique_id "aVt2JARtMZNG6xI8yDyapAAAAJY"]
[Mon Jan 05 16:28:21.049280 2026] [:error] [pid 5535:tid 5577] [client 4.240.125.246:17937] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xw.php"] [unique_id "aVt2JWnkedMjhVX0PTU4RwAAAEc"]
[Mon Jan 05 16:28:21.317664 2026] [:error] [pid 28407:tid 28428] [client 4.240.125.246:18005] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVt2Jdercd3ptydUzM0HNgAAAZE"]
[Mon Jan 05 16:28:21.589469 2026] [:error] [pid 6680:tid 6700] [client 4.240.125.246:18025] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVt2JaE58uNoazzTmx2slQAAARI"]
[Mon Jan 05 16:28:21.862167 2026] [:error] [pid 6680:tid 6698] [client 4.240.125.246:7156] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVt2JaE58uNoazzTmx2slgAAARA"]
[Mon Jan 05 16:28:22.134945 2026] [:error] [pid 5632:tid 5667] [client 4.240.125.246:17992] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ma.php"] [unique_id "aVt2JoN3ZWvlOh-nbt-IygAAANc"]
[Mon Jan 05 16:28:22.407943 2026] [:error] [pid 5536:tid 5618] [client 4.240.125.246:17961] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVt2JgRtMZNG6xI8yDyapQAAAJU"]
[Mon Jan 05 16:28:22.688298 2026] [:error] [pid 5632:tid 5656] [client 4.240.125.246:18006] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVt2JoN3ZWvlOh-nbt-IywAAAMw"]
[Mon Jan 05 16:28:22.958624 2026] [:error] [pid 5534:tid 5562] [client 4.240.125.246:17940] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVt2JpNs9XmbR6unB0xn_AAAABM"]
[Mon Jan 05 16:28:23.229489 2026] [:error] [pid 54081:tid 54102] [client 4.240.125.246:18041] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanz.php"] [unique_id "aVt2J1L4jLgtF-b9w4dICgAAAVI"]
[Mon Jan 05 16:28:23.515969 2026] [:error] [pid 5536:tid 5608] [client 4.240.125.246:17935] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVt2JwRtMZNG6xI8yDyapgAAAIs"]
[Mon Jan 05 16:28:23.788288 2026] [:error] [pid 54081:tid 54095] [client 4.240.125.246:18004] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVt2J1L4jLgtF-b9w4dICwAAAUs"]
[Mon Jan 05 16:28:24.061050 2026] [:error] [pid 5534:tid 5559] [client 4.240.125.246:18000] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVt2KJNs9XmbR6unB0xn_gAAABA"]
[Mon Jan 05 16:28:24.332919 2026] [:error] [pid 5536:tid 5611] [client 4.240.125.246:7140] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tons.php"] [unique_id "aVt2KARtMZNG6xI8yDyaqAAAAI4"]
[Mon Jan 05 16:28:24.603208 2026] [:error] [pid 5535:tid 5578] [client 4.240.125.246:17995] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVt2KGnkedMjhVX0PTU4UgAAAEg"]
[Mon Jan 05 16:28:24.872984 2026] [:error] [pid 5536:tid 5607] [client 4.240.125.246:17927] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVt2KARtMZNG6xI8yDyaqgAAAIo"]
[Mon Jan 05 16:28:25.157267 2026] [:error] [pid 5536:tid 5620] [client 4.240.125.246:17933] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVt2KQRtMZNG6xI8yDyaqwAAAJc"]
[Mon Jan 05 16:28:25.452683 2026] [:error] [pid 5534:tid 5567] [client 4.240.125.246:18030] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aVt2KZNs9XmbR6unB0xn_wAAABg"]
[Mon Jan 05 16:28:25.724171 2026] [:error] [pid 54081:tid 54093] [client 4.240.125.246:18010] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVt2KVL4jLgtF-b9w4dIDAAAAUk"]
[Mon Jan 05 16:28:26.001401 2026] [:error] [pid 6680:tid 6695] [client 4.240.125.246:17953] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVt2KqE58uNoazzTmx2smgAAAQ0"]
[Mon Jan 05 16:28:26.269067 2026] [:error] [pid 6680:tid 6688] [client 4.240.125.246:18012] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVt2KqE58uNoazzTmx2smwAAAQY"]
[Mon Jan 05 16:28:26.537850 2026] [:error] [pid 6680:tid 6705] [client 4.240.125.246:18002] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aVt2KqE58uNoazzTmx2sngAAARc"]
[Mon Jan 05 16:28:26.819973 2026] [:error] [pid 28407:tid 28419] [client 4.240.125.246:18015] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f8.php"] [unique_id "aVt2Ktercd3ptydUzM0HOQAAAYg"]
[Mon Jan 05 16:28:27.090220 2026] [:error] [pid 5536:tid 5614] [client 4.240.125.246:17987] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f8.php"] [unique_id "aVt2KwRtMZNG6xI8yDyarQAAAJE"]
[Mon Jan 05 16:28:27.358760 2026] [:error] [pid 6680:tid 6694] [client 4.240.125.246:17946] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f8.php"] [unique_id "aVt2K6E58uNoazzTmx2soAAAAQw"]
[Mon Jan 05 16:28:27.634651 2026] [:error] [pid 5632:tid 5661] [client 4.240.125.246:7107] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f8.php"] [unique_id "aVt2K4N3ZWvlOh-nbt-IzwAAANE"]
[Mon Jan 05 16:28:27.909647 2026] [:error] [pid 54081:tid 54107] [client 4.240.125.246:7114] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVt2K1L4jLgtF-b9w4dIDgAAAVc"]
[Mon Jan 05 16:28:28.182388 2026] [:error] [pid 54081:tid 54101] [client 4.240.125.246:18043] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVt2LFL4jLgtF-b9w4dIDwAAAVE"]
[Mon Jan 05 16:28:28.456575 2026] [:error] [pid 54081:tid 54106] [client 4.240.125.246:7141] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVt2LFL4jLgtF-b9w4dIEAAAAVY"]
[Mon Jan 05 16:28:28.726919 2026] [:error] [pid 54081:tid 54084] [client 4.240.125.246:17982] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bras.php"] [unique_id "aVt2LFL4jLgtF-b9w4dIEgAAAUA"]
[Mon Jan 05 16:28:28.997341 2026] [:error] [pid 5534:tid 5550] [client 4.240.125.246:18007] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVt2LJNs9XmbR6unB0xoAAAAAAc"]
[Mon Jan 05 16:28:29.280883 2026] [:error] [pid 54081:tid 54105] [client 4.240.125.246:18014] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVt2LVL4jLgtF-b9w4dIFAAAAVU"]
[Mon Jan 05 16:28:29.556379 2026] [:error] [pid 5534:tid 5554] [client 4.240.125.246:18036] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVt2LZNs9XmbR6unB0xoAQAAAAs"]
[Mon Jan 05 16:28:29.826913 2026] [:error] [pid 5534:tid 5547] [client 4.240.125.246:17976] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an8.php"] [unique_id "aVt2LZNs9XmbR6unB0xoAgAAAAQ"]
[Mon Jan 05 16:28:30.123490 2026] [:error] [pid 54081:tid 54104] [client 4.240.125.246:17932] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVt2LlL4jLgtF-b9w4dIFgAAAVQ"]
[Mon Jan 05 16:28:30.394831 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:17960] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVt2LpNs9XmbR6unB0xoAwAAAAI"]
[Mon Jan 05 16:28:30.663186 2026] [:error] [pid 28407:tid 28411] [client 4.240.125.246:17926] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVt2Ltercd3ptydUzM0HPAAAAYE"]
[Mon Jan 05 16:28:30.943872 2026] [:error] [pid 6680:tid 6693] [client 4.240.125.246:7164] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/esp.php"] [unique_id "aVt2LqE58uNoazzTmx2sqwAAAQs"]
[Mon Jan 05 16:28:31.214601 2026] [:error] [pid 28407:tid 28420] [client 4.240.125.246:7104] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVt2L9ercd3ptydUzM0HPQAAAYk"]
[Mon Jan 05 16:28:31.486925 2026] [:error] [pid 28407:tid 28434] [client 4.240.125.246:17928] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVt2L9ercd3ptydUzM0HPgAAAZc"]
[Mon Jan 05 16:28:31.757675 2026] [:error] [pid 6680:tid 6697] [client 4.240.125.246:18038] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVt2L6E58uNoazzTmx2sswAAAQ8"]
[Mon Jan 05 16:28:32.030733 2026] [:error] [pid 5536:tid 5621] [client 4.240.125.246:7134] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/21x.php"] [unique_id "aVt2MARtMZNG6xI8yDyasQAAAJg"]
[Mon Jan 05 16:28:32.323292 2026] [:error] [pid 28407:tid 28421] [client 4.240.125.246:17967] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xe.php"] [unique_id "aVt2MNercd3ptydUzM0HQQAAAYo"]
[Mon Jan 05 16:28:32.599425 2026] [:error] [pid 28407:tid 28425] [client 4.240.125.246:17958] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xe.php"] [unique_id "aVt2MNercd3ptydUzM0HQgAAAY4"]
[Mon Jan 05 16:28:32.870740 2026] [:error] [pid 5536:tid 5600] [client 4.240.125.246:17955] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xe.php"] [unique_id "aVt2MARtMZNG6xI8yDyasgAAAIM"]
[Mon Jan 05 16:28:33.150346 2026] [:error] [pid 54081:tid 54100] [client 4.240.125.246:17945] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xe.php"] [unique_id "aVt2MVL4jLgtF-b9w4dIGQAAAVA"]
[Mon Jan 05 16:28:33.421539 2026] [:error] [pid 5535:tid 5590] [client 4.240.125.246:7117] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVt2MWnkedMjhVX0PTU4bwAAAFQ"]
[Mon Jan 05 16:28:33.693422 2026] [:error] [pid 54081:tid 54088] [client 4.240.125.246:7109] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVt2MVL4jLgtF-b9w4dIGgAAAUQ"]
[Mon Jan 05 16:28:33.973706 2026] [:error] [pid 6680:tid 6682] [client 4.240.125.246:18045] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVt2MaE58uNoazzTmx2svwAAAQA"]
[Mon Jan 05 16:28:34.252876 2026] [:error] [pid 5536:tid 5618] [client 4.240.125.246:7133] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower2.php"] [unique_id "aVt2MgRtMZNG6xI8yDyatQAAAJU"]
[Mon Jan 05 16:28:34.532352 2026] [:error] [pid 28407:tid 28410] [client 4.240.125.246:17951] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws35.php"] [unique_id "aVt2Mtercd3ptydUzM0HRAAAAYA"]
[Mon Jan 05 16:28:34.819961 2026] [:error] [pid 6680:tid 6686] [client 4.240.125.246:17989] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws35.php"] [unique_id "aVt2MqE58uNoazzTmx2swAAAAQQ"]
[Mon Jan 05 16:28:35.088604 2026] [:error] [pid 5536:tid 5611] [client 4.240.125.246:17981] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws35.php"] [unique_id "aVt2MwRtMZNG6xI8yDyatwAAAI4"]
[Mon Jan 05 16:28:35.363958 2026] [:error] [pid 5535:tid 5587] [client 4.240.125.246:18033] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws35.php"] [unique_id "aVt2M2nkedMjhVX0PTU4dgAAAFE"]
[Mon Jan 05 16:28:35.640028 2026] [:error] [pid 5535:tid 5571] [client 4.240.125.246:18034] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2M2nkedMjhVX0PTU4egAAAEE"]
[Mon Jan 05 16:28:35.909207 2026] [:error] [pid 54081:tid 54102] [client 4.240.125.246:17983] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2M1L4jLgtF-b9w4dIGwAAAVI"]
[Mon Jan 05 16:28:36.190032 2026] [:error] [pid 54081:tid 54107] [client 4.240.125.246:7119] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2NFL4jLgtF-b9w4dIHgAAAVc"]
[Mon Jan 05 16:28:36.464389 2026] [:error] [pid 54081:tid 54084] [client 4.240.125.246:18044] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2NFL4jLgtF-b9w4dIIAAAAUA"]
[Mon Jan 05 16:28:36.736038 2026] [:error] [pid 54081:tid 54094] [client 4.240.125.246:7159] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws13.php"] [unique_id "aVt2NFL4jLgtF-b9w4dIIQAAAUo"]
[Mon Jan 05 16:28:37.011482 2026] [:error] [pid 6680:tid 6696] [client 4.240.125.246:7047] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws13.php"] [unique_id "aVt2NaE58uNoazzTmx2swwAAAQ4"]
[Mon Jan 05 16:28:37.284164 2026] [:error] [pid 28407:tid 28422] [client 4.240.125.246:17952] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws13.php"] [unique_id "aVt2Ndercd3ptydUzM0HSAAAAYs"]
[Mon Jan 05 16:28:37.556071 2026] [:error] [pid 54081:tid 54105] [client 4.240.125.246:17936] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws13.php"] [unique_id "aVt2NVL4jLgtF-b9w4dIIwAAAVU"]
[Mon Jan 05 16:28:37.825372 2026] [:error] [pid 54081:tid 54090] [client 4.240.125.246:17957] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss1.php"] [unique_id "aVt2NVL4jLgtF-b9w4dIJAAAAUY"]
[Mon Jan 05 16:28:38.103764 2026] [:error] [pid 54081:tid 54085] [client 4.240.125.246:17924] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss1.php"] [unique_id "aVt2NlL4jLgtF-b9w4dIJgAAAUE"]
[Mon Jan 05 16:28:38.379704 2026] [:error] [pid 54081:tid 54104] [client 4.240.125.246:7142] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss1.php"] [unique_id "aVt2NlL4jLgtF-b9w4dIJwAAAVQ"]
[Mon Jan 05 16:28:38.665410 2026] [:error] [pid 5536:tid 5612] [client 4.240.125.246:17930] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss1.php"] [unique_id "aVt2NgRtMZNG6xI8yDyauAAAAI8"]
[Mon Jan 05 16:28:38.939323 2026] [:error] [pid 5536:tid 5599] [client 4.240.125.246:7132] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww7.php"] [unique_id "aVt2NgRtMZNG6xI8yDyaugAAAII"]
[Mon Jan 05 16:28:39.217411 2026] [:error] [pid 5536:tid 5620] [client 4.240.125.246:17944] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww7.php"] [unique_id "aVt2NwRtMZNG6xI8yDyauwAAAJc"]
[Mon Jan 05 16:28:39.488723 2026] [:error] [pid 28407:tid 28413] [client 4.240.125.246:7106] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww7.php"] [unique_id "aVt2N9ercd3ptydUzM0HSgAAAYM"]
[Mon Jan 05 16:28:39.760947 2026] [:error] [pid 5536:tid 5614] [client 4.240.125.246:7105] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww7.php"] [unique_id "aVt2NwRtMZNG6xI8yDyavAAAAJE"]
[Mon Jan 05 16:28:40.045161 2026] [:error] [pid 5535:tid 5589] [client 4.240.125.246:7064] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aVt2OGnkedMjhVX0PTU4ggAAAFM"]
[Mon Jan 05 16:28:40.318538 2026] [:error] [pid 5536:tid 5615] [client 4.240.125.246:7125] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aVt2OARtMZNG6xI8yDyavQAAAJI"]
[Mon Jan 05 16:28:40.595959 2026] [:error] [pid 5536:tid 5616] [client 4.240.125.246:17984] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aVt2OARtMZNG6xI8yDyavwAAAJM"]
[Mon Jan 05 16:28:40.869633 2026] [:error] [pid 5536:tid 5601] [client 4.240.125.246:7127] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aVt2OARtMZNG6xI8yDyawAAAAIQ"]
[Mon Jan 05 16:28:41.147743 2026] [:error] [pid 5535:tid 5583] [client 4.240.125.246:17964] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVt2OWnkedMjhVX0PTU4gwAAAE0"]
[Mon Jan 05 16:28:41.426523 2026] [:error] [pid 28407:tid 28410] [client 4.240.125.246:17949] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVt2Odercd3ptydUzM0HTwAAAYA"]
[Mon Jan 05 16:28:41.718451 2026] [:error] [pid 28407:tid 28430] [client 4.240.125.246:7161] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVt2Odercd3ptydUzM0HUgAAAZM"]
[Mon Jan 05 16:28:41.995024 2026] [:error] [pid 5535:tid 5573] [client 4.240.125.246:7128] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lisa.php"] [unique_id "aVt2OWnkedMjhVX0PTU4hQAAAEM"]
[Mon Jan 05 16:28:42.266117 2026] [:error] [pid 5536:tid 5600] [client 4.240.125.246:7137] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVt2OgRtMZNG6xI8yDyawwAAAIM"]
[Mon Jan 05 16:28:42.548864 2026] [:error] [pid 5632:tid 5656] [client 4.240.125.246:7041] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVt2OoN3ZWvlOh-nbt-I3gAAAMw"]
[Mon Jan 05 16:28:42.820759 2026] [:error] [pid 5534:tid 5544] [client 4.240.125.246:7097] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVt2OpNs9XmbR6unB0xoGwAAAAE"]
[Mon Jan 05 16:28:43.093507 2026] [:error] [pid 5534:tid 5549] [client 4.240.125.246:7053] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aVt2O5Ns9XmbR6unB0xoHQAAAAY"]
[Mon Jan 05 16:28:43.365837 2026] [:error] [pid 5534:tid 5562] [client 4.240.125.246:7129] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVt2O5Ns9XmbR6unB0xoHwAAABM"]
[Mon Jan 05 16:28:43.638818 2026] [:error] [pid 6680:tid 6682] [client 4.240.125.246:17971] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVt2O6E58uNoazzTmx2sygAAAQA"]
[Mon Jan 05 16:28:43.911761 2026] [:error] [pid 5536:tid 5605] [client 4.240.125.246:7121] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVt2OwRtMZNG6xI8yDyaxQAAAIg"]
[Mon Jan 05 16:28:44.182956 2026] [:error] [pid 5536:tid 5613] [client 4.240.125.246:7118] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aVt2PARtMZNG6xI8yDyaxgAAAJA"]
[Mon Jan 05 16:28:44.468410 2026] [:error] [pid 5536:tid 5617] [client 4.240.125.246:17941] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVt2PARtMZNG6xI8yDyayQAAAJQ"]
[Mon Jan 05 16:28:44.742050 2026] [:error] [pid 5536:tid 5614] [client 4.240.125.246:17921] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVt2PARtMZNG6xI8yDyaygAAAJE"]
[Mon Jan 05 16:28:45.013849 2026] [:error] [pid 5632:tid 5650] [client 4.240.125.246:7113] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVt2PYN3ZWvlOh-nbt-I4AAAAMY"]
[Mon Jan 05 16:28:45.305878 2026] [:error] [pid 54081:tid 54087] [client 4.240.125.246:7059] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aVt2PVL4jLgtF-b9w4dILAAAAUM"]
[Mon Jan 05 16:28:45.579734 2026] [:error] [pid 5534:tid 5550] [client 4.240.125.246:7157] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVt2PZNs9XmbR6unB0xoIQAAAAc"]
[Mon Jan 05 16:28:45.847689 2026] [:error] [pid 5536:tid 5603] [client 4.240.125.246:17974] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVt2PQRtMZNG6xI8yDyaywAAAIY"]
[Mon Jan 05 16:28:46.132530 2026] [:error] [pid 54081:tid 54107] [client 4.240.125.246:18019] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVt2PlL4jLgtF-b9w4dILQAAAVc"]
[Mon Jan 05 16:28:46.401618 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:7135] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aVt2PpNs9XmbR6unB0xoIgAAAAI"]
[Mon Jan 05 16:28:46.670842 2026] [:error] [pid 5534:tid 5547] [client 4.240.125.246:7155] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aVt2PpNs9XmbR6unB0xoIwAAAAQ"]
[Mon Jan 05 16:28:46.945246 2026] [:error] [pid 5536:tid 5610] [client 4.240.125.246:6978] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aVt2PgRtMZNG6xI8yDya0AAAAI0"]
[Mon Jan 05 16:28:47.216029 2026] [:error] [pid 5536:tid 5600] [client 4.240.125.246:7055] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aVt2PwRtMZNG6xI8yDya0gAAAIM"]
[Mon Jan 05 16:28:47.489403 2026] [:error] [pid 6680:tid 6695] [client 4.240.125.246:18003] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rtx.php"] [unique_id "aVt2P6E58uNoazzTmx2szAAAAQ0"]
[Mon Jan 05 16:28:47.801375 2026] [:error] [pid 6680:tid 6696] [client 4.240.125.246:7048] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVt2P6E58uNoazzTmx2szQAAAQ4"]
[Mon Jan 05 16:28:48.069828 2026] [:error] [pid 5534:tid 5566] [client 4.240.125.246:17956] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVt2QJNs9XmbR6unB0xoJgAAABc"]
[Mon Jan 05 16:28:48.351907 2026] [:error] [pid 5534:tid 5564] [client 4.240.125.246:7136] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVt2QJNs9XmbR6unB0xoKAAAABU"]
[Mon Jan 05 16:28:48.642783 2026] [:error] [pid 5534:tid 5558] [client 4.240.125.246:7124] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bipas.php"] [unique_id "aVt2QJNs9XmbR6unB0xoKwAAAA8"]
[Mon Jan 05 16:28:48.911219 2026] [:error] [pid 6680:tid 6688] [client 4.240.125.246:7162] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVt2QKE58uNoazzTmx2szgAAAQY"]
[Mon Jan 05 16:28:49.194648 2026] [:error] [pid 5535:tid 5576] [client 4.240.125.246:7040] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVt2QWnkedMjhVX0PTU4iQAAAEY"]
[Mon Jan 05 16:28:49.464194 2026] [:error] [pid 5535:tid 5575] [client 4.240.125.246:17973] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVt2QWnkedMjhVX0PTU4igAAAEU"]
[Mon Jan 05 16:28:49.736613 2026] [:error] [pid 6680:tid 6703] [client 4.240.125.246:7130] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/conte.php"] [unique_id "aVt2QaE58uNoazzTmx2szwAAARU"]
[Mon Jan 05 16:28:50.028699 2026] [:error] [pid 5534:tid 5554] [client 4.240.125.246:17996] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVt2QpNs9XmbR6unB0xoMAAAAAs"]
[Mon Jan 05 16:28:50.304227 2026] [:error] [pid 5535:tid 5585] [client 4.240.125.246:7122] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVt2QmnkedMjhVX0PTU4jAAAAE8"]
[Mon Jan 05 16:28:50.576236 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:7115] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVt2QpNs9XmbR6unB0xoMgAAAAI"]
[Mon Jan 05 16:28:50.846793 2026] [:error] [pid 5632:tid 5652] [client 4.240.125.246:7069] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class3.php"] [unique_id "aVt2QoN3ZWvlOh-nbt-I5AAAAMg"]
[Mon Jan 05 16:28:51.118350 2026] [:error] [pid 5632:tid 5647] [client 4.240.125.246:7092] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVt2Q4N3ZWvlOh-nbt-I5QAAAMM"]
[Mon Jan 05 16:28:51.388807 2026] [:error] [pid 5535:tid 5589] [client 4.240.125.246:18029] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVt2Q2nkedMjhVX0PTU4jgAAAFM"]
[Mon Jan 05 16:28:51.667161 2026] [:error] [pid 6680:tid 6705] [client 4.240.125.246:7150] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVt2Q6E58uNoazzTmx2s0QAAARc"]
[Mon Jan 05 16:28:51.941419 2026] [:error] [pid 5632:tid 5655] [client 4.240.125.246:7106] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aVt2Q4N3ZWvlOh-nbt-I5gAAAMs"]
[Mon Jan 05 16:28:52.209840 2026] [:error] [pid 5534:tid 5553] [client 4.240.125.246:17966] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVt2RJNs9XmbR6unB0xoNAAAAAo"]
[Mon Jan 05 16:28:52.478887 2026] [:error] [pid 6680:tid 6697] [client 4.240.125.246:6979] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVt2RKE58uNoazzTmx2s0gAAAQ8"]
[Mon Jan 05 16:28:52.750502 2026] [:error] [pid 5535:tid 5578] [client 4.240.125.246:7084] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVt2RGnkedMjhVX0PTU4kQAAAEg"]
[Mon Jan 05 16:28:53.023223 2026] [:error] [pid 5535:tid 5573] [client 4.240.125.246:7049] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/claa.php"] [unique_id "aVt2RWnkedMjhVX0PTU4kgAAAEM"]
[Mon Jan 05 16:28:53.291504 2026] [:error] [pid 5534:tid 5557] [client 4.240.125.246:17968] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoyo.php"] [unique_id "aVt2RZNs9XmbR6unB0xoNgAAAA4"]
[Mon Jan 05 16:28:53.563826 2026] [:error] [pid 6680:tid 6687] [client 4.240.125.246:7063] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoyo.php"] [unique_id "aVt2RaE58uNoazzTmx2s1AAAAQU"]
[Mon Jan 05 16:28:53.833337 2026] [:error] [pid 5536:tid 5614] [client 4.240.125.246:7065] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoyo.php"] [unique_id "aVt2RQRtMZNG6xI8yDya1gAAAJE"]
[Mon Jan 05 16:28:54.104316 2026] [:error] [pid 5535:tid 5571] [client 4.240.125.246:7090] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shoyo.php"] [unique_id "aVt2RmnkedMjhVX0PTU4kwAAAEE"]
[Mon Jan 05 16:28:54.378027 2026] [:error] [pid 5536:tid 5597] [client 4.240.125.246:17965] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aVt2RgRtMZNG6xI8yDya1wAAAIA"]
[Mon Jan 05 16:28:54.646290 2026] [:error] [pid 6680:tid 6691] [client 4.240.125.246:7085] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aVt2RqE58uNoazzTmx2s1gAAAQk"]
[Mon Jan 05 16:28:54.919660 2026] [:error] [pid 5632:tid 5653] [client 4.240.125.246:17959] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aVt2RoN3ZWvlOh-nbt-I6AAAAMk"]
[Mon Jan 05 16:28:55.189751 2026] [:error] [pid 5536:tid 5598] [client 4.240.125.246:7067] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aVt2RwRtMZNG6xI8yDya2AAAAIE"]
[Mon Jan 05 16:28:55.465317 2026] [:error] [pid 5535:tid 5580] [client 4.240.125.246:17969] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aVt2R2nkedMjhVX0PTU4lAAAAEo"]
[Mon Jan 05 16:28:55.733262 2026] [:error] [pid 5536:tid 5601] [client 4.240.125.246:7108] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aVt2RwRtMZNG6xI8yDya2wAAAIQ"]
[Mon Jan 05 16:28:56.004603 2026] [:error] [pid 6680:tid 6704] [client 4.240.125.246:6987] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aVt2SKE58uNoazzTmx2s2AAAARY"]
[Mon Jan 05 16:28:56.289165 2026] [:error] [pid 28407:tid 28412] [client 4.240.125.246:17972] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/waq.php"] [unique_id "aVt2SNercd3ptydUzM0HWAAAAYI"]
[Mon Jan 05 16:28:56.559782 2026] [:error] [pid 54081:tid 54098] [client 4.240.125.246:7143] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aVt2SFL4jLgtF-b9w4dIMwAAAU4"]
[Mon Jan 05 16:28:56.835100 2026] [:error] [pid 6680:tid 6690] [client 4.240.125.246:17962] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aVt2SKE58uNoazzTmx2s2QAAAQg"]
[Mon Jan 05 16:28:57.106920 2026] [:error] [pid 5632:tid 5648] [client 4.240.125.246:7167] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aVt2SYN3ZWvlOh-nbt-I6gAAAMQ"]
[Mon Jan 05 16:28:57.383913 2026] [:error] [pid 5536:tid 5615] [client 4.240.125.246:7123] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wakak.php"] [unique_id "aVt2SQRtMZNG6xI8yDya3QAAAJI"]
[Mon Jan 05 16:28:57.652435 2026] [:error] [pid 6680:tid 6682] [client 4.240.125.246:18038] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVt2SaE58uNoazzTmx2s2wAAAQA"]
[Mon Jan 05 16:28:57.923100 2026] [:error] [pid 6680:tid 6686] [client 4.240.125.246:7131] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVt2SaE58uNoazzTmx2s3QAAAQQ"]
[Mon Jan 05 16:28:58.195906 2026] [:error] [pid 5535:tid 5591] [client 4.240.125.246:7089] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVt2SmnkedMjhVX0PTU4lgAAAFU"]
[Mon Jan 05 16:28:58.468485 2026] [:error] [pid 5632:tid 5664] [client 4.240.125.246:7086] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVt2SoN3ZWvlOh-nbt-I6wAAANQ"]
[Mon Jan 05 16:28:58.740832 2026] [:error] [pid 5536:tid 5600] [client 4.240.125.246:17970] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVt2SgRtMZNG6xI8yDya3gAAAIM"]
[Mon Jan 05 16:28:59.012891 2026] [:error] [pid 6680:tid 6706] [client 4.240.125.246:7022] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVt2S6E58uNoazzTmx2s3gAAARg"]
[Mon Jan 05 16:28:59.293353 2026] [:error] [pid 54081:tid 54091] [client 4.240.125.246:7066] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVt2S1L4jLgtF-b9w4dINQAAAUc"]
[Mon Jan 05 16:28:59.564860 2026] [:error] [pid 5536:tid 5619] [client 4.240.125.246:7060] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aVt2SwRtMZNG6xI8yDya3wAAAJY"]
[Mon Jan 05 16:28:59.852328 2026] [:error] [pid 5534:tid 5563] [client 4.240.125.246:7042] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVt2S5Ns9XmbR6unB0xoOAAAABQ"]
[Mon Jan 05 16:29:00.125815 2026] [:error] [pid 54081:tid 54100] [client 4.240.125.246:7163] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVt2TFL4jLgtF-b9w4dINgAAAVA"]
[Mon Jan 05 16:29:00.400236 2026] [:error] [pid 5632:tid 5667] [client 4.240.125.246:18035] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVt2TIN3ZWvlOh-nbt-I7AAAANc"]
[Mon Jan 05 16:29:00.676045 2026] [:error] [pid 5536:tid 5605] [client 4.240.125.246:7149] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xse25.php"] [unique_id "aVt2TARtMZNG6xI8yDya4QAAAIg"]
[Mon Jan 05 16:29:00.952109 2026] [:error] [pid 28407:tid 28425] [client 4.240.125.246:7001] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2TNercd3ptydUzM0HWgAAAY4"]
[Mon Jan 05 16:29:01.230132 2026] [:error] [pid 5632:tid 5666] [client 4.240.125.246:7154] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2TYN3ZWvlOh-nbt-I7gAAANY"]
[Mon Jan 05 16:29:01.515806 2026] [:error] [pid 5536:tid 5611] [client 4.240.125.246:7079] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2TQRtMZNG6xI8yDya4wAAAI4"]
[Mon Jan 05 16:29:01.782928 2026] [:error] [pid 6680:tid 6695] [client 4.240.125.246:7058] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aVt2TaE58uNoazzTmx2s3wAAAQ0"]
[Mon Jan 05 16:29:02.050258 2026] [:error] [pid 5534:tid 5550] [client 4.240.125.246:7110] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aVt2TpNs9XmbR6unB0xoOgAAAAc"]
[Mon Jan 05 16:29:02.319120 2026] [:error] [pid 54081:tid 54086] [client 4.240.125.246:7075] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aVt2TlL4jLgtF-b9w4dINwAAAUI"]
[Mon Jan 05 16:29:02.628952 2026] [:error] [pid 5535:tid 5575] [client 4.240.125.246:7091] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aVt2TmnkedMjhVX0PTU4mQAAAEU"]
[Mon Jan 05 16:29:02.900624 2026] [:error] [pid 6680:tid 6688] [client 4.240.125.246:7100] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aVt2TqE58uNoazzTmx2s4AAAAQY"]
[Mon Jan 05 16:29:03.178778 2026] [:error] [pid 5535:tid 5577] [client 4.240.125.246:17963] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVt2T2nkedMjhVX0PTU4mwAAAEc"]
[Mon Jan 05 16:29:03.449174 2026] [:error] [pid 28407:tid 28426] [client 4.240.125.246:18047] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVt2T9ercd3ptydUzM0HXQAAAY8"]
[Mon Jan 05 16:29:03.720389 2026] [:error] [pid 5536:tid 5617] [client 4.240.125.246:18021] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVt2TwRtMZNG6xI8yDya5AAAAJQ"]
[Mon Jan 05 16:29:03.997307 2026] [:error] [pid 5536:tid 5612] [client 4.240.125.246:7148] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aVt2TwRtMZNG6xI8yDya5QAAAI8"]
[Mon Jan 05 16:29:04.274596 2026] [:error] [pid 5535:tid 5584] [client 4.240.125.246:7077] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVt2UGnkedMjhVX0PTU4nAAAAE4"]
[Mon Jan 05 16:29:04.546260 2026] [:error] [pid 6680:tid 6703] [client 4.240.125.246:7096] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVt2UKE58uNoazzTmx2s4gAAARU"]
[Mon Jan 05 16:29:04.814697 2026] [:error] [pid 5535:tid 5581] [client 4.240.125.246:7146] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVt2UGnkedMjhVX0PTU4ngAAAEs"]
[Mon Jan 05 16:29:05.085068 2026] [:error] [pid 5535:tid 5578] [client 4.240.125.246:7006] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aVt2UWnkedMjhVX0PTU4nwAAAEg"]
[Mon Jan 05 16:29:05.358380 2026] [:error] [pid 6680:tid 6705] [client 4.240.125.246:7151] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aVt2UaE58uNoazzTmx2s4wAAARc"]
[Mon Jan 05 16:29:05.632064 2026] [:error] [pid 5535:tid 5573] [client 4.240.125.246:7035] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aVt2UWnkedMjhVX0PTU4oQAAAEM"]
[Mon Jan 05 16:29:05.904525 2026] [:error] [pid 54081:tid 54097] [client 4.240.125.246:7116] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aVt2UVL4jLgtF-b9w4dIOQAAAU0"]
[Mon Jan 05 16:29:06.175227 2026] [:error] [pid 5535:tid 5593] [client 4.240.125.246:7120] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aVt2UmnkedMjhVX0PTU4ogAAAFc"]
[Mon Jan 05 16:29:06.458177 2026] [:error] [pid 5535:tid 5580] [client 4.240.125.246:6988] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVt2UmnkedMjhVX0PTU4pAAAAEo"]
[Mon Jan 05 16:29:06.731306 2026] [:error] [pid 6680:tid 6683] [client 4.240.125.246:7020] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVt2UqE58uNoazzTmx2s5gAAAQE"]
[Mon Jan 05 16:29:07.001245 2026] [:error] [pid 6680:tid 6694] [client 4.240.125.246:6921] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVt2U6E58uNoazzTmx2s5wAAAQw"]
[Mon Jan 05 16:29:07.290461 2026] [:error] [pid 5534:tid 5566] [client 4.240.125.246:17979] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aVt2U5Ns9XmbR6unB0xoQAAAABc"]
[Mon Jan 05 16:29:07.566596 2026] [:error] [pid 5535:tid 5588] [client 4.240.125.246:7070] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVt2U2nkedMjhVX0PTU4pgAAAFI"]
[Mon Jan 05 16:29:07.838255 2026] [:error] [pid 28407:tid 28424] [client 4.240.125.246:7108] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVt2U9ercd3ptydUzM0HZAAAAY0"]
[Mon Jan 05 16:29:08.107138 2026] [:error] [pid 5535:tid 5572] [client 4.240.125.246:6853] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVt2VGnkedMjhVX0PTU4pwAAAEI"]
[Mon Jan 05 16:29:08.378117 2026] [:error] [pid 28407:tid 28429] [client 4.240.125.246:18032] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "aVt2VNercd3ptydUzM0HZQAAAZI"]
[Mon Jan 05 16:29:08.650422 2026] [:error] [pid 5632:tid 5650] [client 4.240.125.246:7147] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aVt2VIN3ZWvlOh-nbt-I7wAAAMY"]
[Mon Jan 05 16:29:08.935639 2026] [:error] [pid 5534:tid 5558] [client 4.240.125.246:17925] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "aVt2VJNs9XmbR6unB0xoRAAAAA8"]
[Mon Jan 05 16:29:09.211598 2026] [:error] [pid 5534:tid 5548] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Mon Jan 05 16:29:09.352976 2026] [:error] [pid 5534:tid 5563] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Mon Jan 05 16:29:09.492526 2026] [:error] [pid 5534:tid 5567] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Mon Jan 05 16:29:09.632251 2026] [:error] [pid 5534:tid 5552] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Jan 05 16:29:09.772945 2026] [:error] [pid 5534:tid 5543] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Mon Jan 05 16:29:09.912434 2026] [:error] [pid 5534:tid 5547] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Mon Jan 05 16:29:10.053481 2026] [:error] [pid 5534:tid 5565] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Jan 05 16:29:10.193168 2026] [:error] [pid 5534:tid 5561] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Jan 05 16:29:10.332911 2026] [:error] [pid 5534:tid 5566] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Mon Jan 05 16:29:10.472348 2026] [:error] [pid 5534:tid 5556] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Mon Jan 05 16:29:10.613955 2026] [:error] [pid 5534:tid 5549] [client 4.240.125.246:7057] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Mon Jan 05 16:29:10.750712 2026] [:error] [pid 5534:tid 5557] [client 4.240.125.246:7057] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVt2VpNs9XmbR6unB0xoVAAAAA4"]
[Mon Jan 05 16:29:11.021200 2026] [:error] [pid 54081:tid 54093] [client 4.240.125.246:6976] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVt2V1L4jLgtF-b9w4dIOgAAAUk"]
[Mon Jan 05 16:29:11.309332 2026] [:error] [pid 28407:tid 28414] [client 4.240.125.246:7080] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVt2V9ercd3ptydUzM0HaAAAAYQ"]
[Mon Jan 05 16:29:11.580671 2026] [:error] [pid 54081:tid 54107] [client 4.240.125.246:7051] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aVt2V1L4jLgtF-b9w4dIPAAAAVc"]
[Mon Jan 05 16:29:11.851501 2026] [:error] [pid 5536:tid 5616] [client 4.240.125.246:7071] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVt2VwRtMZNG6xI8yDya6QAAAJM"]
[Mon Jan 05 16:29:12.136217 2026] [:error] [pid 5534:tid 5560] [client 4.240.125.246:6994] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVt2WJNs9XmbR6unB0xoVQAAABE"]
[Mon Jan 05 16:29:12.405566 2026] [:error] [pid 54081:tid 54106] [client 4.240.125.246:7153] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVt2WFL4jLgtF-b9w4dIPgAAAVY"]
[Mon Jan 05 16:29:12.683010 2026] [:error] [pid 54081:tid 54108] [client 4.240.125.246:7152] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aVt2WFL4jLgtF-b9w4dIPwAAAVg"]
[Mon Jan 05 16:29:12.965872 2026] [:error] [pid 54081:tid 54105] [client 4.240.125.246:6983] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVt2WFL4jLgtF-b9w4dIQAAAAVU"]
[Mon Jan 05 16:29:13.247518 2026] [:error] [pid 5534:tid 5551] [client 4.240.125.246:6996] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVt2WZNs9XmbR6unB0xoVwAAAAg"]
[Mon Jan 05 16:29:13.518265 2026] [:error] [pid 54081:tid 54094] [client 4.240.125.246:7072] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVt2WVL4jLgtF-b9w4dIQwAAAUo"]
[Mon Jan 05 16:29:13.789773 2026] [:error] [pid 54081:tid 54099] [client 4.240.125.246:7076] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVt2WVL4jLgtF-b9w4dIRAAAAU8"]
[Mon Jan 05 16:29:14.061321 2026] [:error] [pid 28407:tid 28411] [client 4.240.125.246:7023] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVt2Wtercd3ptydUzM0HawAAAYE"]
[Mon Jan 05 16:29:14.332103 2026] [:error] [pid 54081:tid 54100] [client 4.240.125.246:7044] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVt2WlL4jLgtF-b9w4dIRwAAAVA"]
[Mon Jan 05 16:29:14.607539 2026] [:error] [pid 5534:tid 5559] [client 4.240.125.246:7094] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVt2WpNs9XmbR6unB0xoWgAAABA"]
[Mon Jan 05 16:29:14.879000 2026] [:error] [pid 28407:tid 28433] [client 4.240.125.246:7103] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aVt2Wtercd3ptydUzM0HbAAAAZY"]
[Mon Jan 05 16:29:15.153532 2026] [:error] [pid 5632:tid 5660] [client 4.240.125.246:6914] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs15.php"] [unique_id "aVt2W4N3ZWvlOh-nbt-I8QAAANA"]
[Mon Jan 05 16:29:15.424558 2026] [:error] [pid 5632:tid 5663] [client 4.240.125.246:18001] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs15.php"] [unique_id "aVt2W4N3ZWvlOh-nbt-I8wAAANM"]
[Mon Jan 05 16:29:15.695318 2026] [:error] [pid 28407:tid 28415] [client 4.240.125.246:7045] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs15.php"] [unique_id "aVt2W9ercd3ptydUzM0HbQAAAYU"]
[Mon Jan 05 16:29:15.965341 2026] [:error] [pid 5534:tid 5565] [client 4.240.125.246:7138] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs15.php"] [unique_id "aVt2W5Ns9XmbR6unB0xoXQAAABY"]
[Mon Jan 05 16:29:16.243210 2026] [:error] [pid 54081:tid 54089] [client 4.240.125.246:7095] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aVt2XFL4jLgtF-b9w4dISgAAAUU"]
[Mon Jan 05 16:29:16.519915 2026] [:error] [pid 5535:tid 5585] [client 4.240.125.246:7099] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aVt2XGnkedMjhVX0PTU4qQAAAE8"]
[Mon Jan 05 16:29:16.789567 2026] [:error] [pid 5535:tid 5574] [client 4.240.125.246:6985] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aVt2XGnkedMjhVX0PTU4qwAAAEQ"]
[Mon Jan 05 16:29:17.070338 2026] [:error] [pid 5534:tid 5556] [client 4.240.125.246:6929] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aVt2XZNs9XmbR6unB0xoXgAAAA0"]
[Mon Jan 05 16:29:17.338877 2026] [:error] [pid 5534:tid 5549] [client 4.240.125.246:6980] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aVt2XZNs9XmbR6unB0xoXwAAAAY"]
[Mon Jan 05 16:29:17.612039 2026] [:error] [pid 5534:tid 5562] [client 4.240.125.246:6992] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aVt2XZNs9XmbR6unB0xoYAAAABM"]
[Mon Jan 05 16:29:17.904518 2026] [:error] [pid 5632:tid 5658] [client 4.240.125.246:7003] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aVt2XYN3ZWvlOh-nbt-I9QAAAM4"]
[Mon Jan 05 16:29:18.174059 2026] [:error] [pid 5534:tid 5557] [client 4.240.125.246:7004] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aVt2XpNs9XmbR6unB0xoYgAAAA4"]
[Mon Jan 05 16:29:18.448272 2026] [:error] [pid 5534:tid 5553] [client 4.240.125.246:6917] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVt2XpNs9XmbR6unB0xoZAAAAAo"]
[Mon Jan 05 16:29:18.721407 2026] [:error] [pid 5535:tid 5582] [client 4.240.125.246:7032] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVt2XmnkedMjhVX0PTU4rQAAAEw"]
[Mon Jan 05 16:29:18.991663 2026] [:error] [pid 54081:tid 54097] [client 4.240.125.246:7166] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVt2XlL4jLgtF-b9w4dISwAAAU0"]
[Mon Jan 05 16:29:19.263712 2026] [:error] [pid 5535:tid 5587] [client 4.240.125.246:6989] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "aVt2X2nkedMjhVX0PTU4sAAAAFE"]
[Mon Jan 05 16:29:19.553557 2026] [:error] [pid 54081:tid 54087] [client 4.240.125.246:7083] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aVt2X1L4jLgtF-b9w4dITAAAAUM"]
[Mon Jan 05 16:29:19.826133 2026] [:error] [pid 5535:tid 5571] [client 4.240.125.246:7061] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aVt2X2nkedMjhVX0PTU4swAAAEE"]
[Mon Jan 05 16:29:20.100563 2026] [:error] [pid 5535:tid 5592] [client 4.240.125.246:7026] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aVt2YGnkedMjhVX0PTU4tAAAAFY"]
[Mon Jan 05 16:29:20.378192 2026] [:error] [pid 5535:tid 5588] [client 4.240.125.246:17990] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aVt2YGnkedMjhVX0PTU4uQAAAFI"]
[Mon Jan 05 16:29:20.660377 2026] [:error] [pid 5534:tid 5551] [client 4.240.125.246:7062] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVt2YJNs9XmbR6unB0xoaAAAAAg"]
[Mon Jan 05 16:29:20.930966 2026] [:error] [pid 5536:tid 5619] [client 4.240.125.246:7145] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVt2YARtMZNG6xI8yDya7QAAAJY"]
[Mon Jan 05 16:29:21.205903 2026] [:error] [pid 5535:tid 5572] [client 4.240.125.246:17954] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVt2YWnkedMjhVX0PTU4uwAAAEI"]
[Mon Jan 05 16:29:21.478454 2026] [:error] [pid 6680:tid 6683] [client 4.240.125.246:6947] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aVt2YaE58uNoazzTmx2s8gAAAQE"]
[Mon Jan 05 16:29:21.748175 2026] [:error] [pid 5632:tid 5649] [client 4.240.125.246:6879] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aVt2YYN3ZWvlOh-nbt-I9wAAAMU"]
[Mon Jan 05 16:29:22.046894 2026] [:error] [pid 5535:tid 5574] [client 4.240.125.246:17978] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aVt2YmnkedMjhVX0PTU4vwAAAEQ"]
[Mon Jan 05 16:29:22.318300 2026] [:error] [pid 5536:tid 5606] [client 4.240.125.246:7031] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aVt2YgRtMZNG6xI8yDya8AAAAIk"]
[Mon Jan 05 16:29:22.592640 2026] [:error] [pid 6680:tid 6691] [client 4.240.125.246:7074] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aVt2YqE58uNoazzTmx2s9AAAAQk"]
[Mon Jan 05 16:29:22.863110 2026] [:error] [pid 6680:tid 6684] [client 4.240.125.246:7027] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aVt2YqE58uNoazzTmx2s9gAAAQI"]
[Mon Jan 05 16:29:23.130578 2026] [:error] [pid 5536:tid 5605] [client 4.240.125.246:6922] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aVt2YwRtMZNG6xI8yDya8QAAAIg"]
[Mon Jan 05 16:29:23.400414 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:7007] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aVt2Y5Ns9XmbR6unB0xoawAAAAI"]
[Mon Jan 05 16:29:23.670215 2026] [:error] [pid 5535:tid 5579] [client 4.240.125.246:17980] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "aVt2Y2nkedMjhVX0PTU4wgAAAEk"]
[Mon Jan 05 16:29:23.941542 2026] [:error] [pid 5535:tid 5582] [client 4.240.125.246:7054] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVt2Y2nkedMjhVX0PTU4wwAAAEw"]
[Mon Jan 05 16:29:24.209923 2026] [:error] [pid 54081:tid 54100] [client 4.240.125.246:6999] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVt2ZFL4jLgtF-b9w4dIVAAAAVA"]
[Mon Jan 05 16:29:24.480936 2026] [:error] [pid 6680:tid 6682] [client 4.240.125.246:6956] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVt2ZKE58uNoazzTmx2s-AAAAQA"]
[Mon Jan 05 16:29:24.770377 2026] [:error] [pid 5534:tid 5551] [client 4.240.125.246:7019] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aVt2ZJNs9XmbR6unB0xoeAAAAAg"]
[Mon Jan 05 16:29:25.038322 2026] [:error] [pid 28407:tid 28410] [client 4.240.125.246:7025] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVt2Zdercd3ptydUzM0HfgAAAYA"]
[Mon Jan 05 16:29:25.307368 2026] [:error] [pid 5535:tid 5575] [client 4.240.125.246:6940] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVt2ZWnkedMjhVX0PTU40QAAAEU"]
[Mon Jan 05 16:29:25.577087 2026] [:error] [pid 28407:tid 28417] [client 4.240.125.246:6916] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVt2Zdercd3ptydUzM0HlwAAAYc"]
[Mon Jan 05 16:29:25.851299 2026] [:error] [pid 5534:tid 5550] [client 4.240.125.246:7002] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aVt2ZZNs9XmbR6unB0xokQAAAAc"]
[Mon Jan 05 16:29:26.122536 2026] [:error] [pid 5632:tid 5660] [client 4.240.125.246:7102] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVt2ZoN3ZWvlOh-nbt-JBQAAANA"]
[Mon Jan 05 16:29:26.403921 2026] [:error] [pid 5534:tid 5565] [client 4.240.125.246:7018] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVt2ZpNs9XmbR6unB0xolwAAABY"]
[Mon Jan 05 16:29:26.676901 2026] [:error] [pid 5536:tid 5613] [client 4.240.125.246:6981] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVt2ZgRtMZNG6xI8yDybCAAAAJA"]
[Mon Jan 05 16:29:26.949276 2026] [:error] [pid 54081:tid 54107] [client 4.240.125.246:7000] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVt2ZlL4jLgtF-b9w4dIXgAAAVc"]
[Mon Jan 05 16:29:27.221185 2026] [:error] [pid 5534:tid 5544] [client 4.240.125.246:7010] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVt2Z5Ns9XmbR6unB0xomAAAAAE"]
[Mon Jan 05 16:29:27.505475 2026] [:error] [pid 5534:tid 5556] [client 4.240.125.246:6912] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVt2Z5Ns9XmbR6unB0xomQAAAA0"]
[Mon Jan 05 16:29:27.774622 2026] [:error] [pid 5632:tid 5651] [client 4.240.125.246:7043] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVt2Z4N3ZWvlOh-nbt-JBwAAAMc"]
[Mon Jan 05 16:29:28.046880 2026] [:error] [pid 54081:tid 54108] [client 4.240.125.246:7038] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aVt2aFL4jLgtF-b9w4dIXwAAAVg"]
[Mon Jan 05 16:29:28.336673 2026] [:error] [pid 28407:tid 28429] [client 4.240.125.246:7028] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2aNercd3ptydUzM0HsQAAAZI"]
[Mon Jan 05 16:29:28.616559 2026] [:error] [pid 6680:tid 6704] [client 4.240.125.246:6919] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2aKE58uNoazzTmx2tDAAAARY"]
[Mon Jan 05 16:29:28.886446 2026] [:error] [pid 54081:tid 54102] [client 4.240.125.246:6875] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2aFL4jLgtF-b9w4dIYAAAAVI"]
[Mon Jan 05 16:29:29.173637 2026] [:error] [pid 5632:tid 5649] [client 4.240.125.246:18022] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2aYN3ZWvlOh-nbt-JCAAAAMU"]
[Mon Jan 05 16:29:29.443342 2026] [:error] [pid 54081:tid 54105] [client 4.240.125.246:7008] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVt2aVL4jLgtF-b9w4dIYgAAAVU"]
[Mon Jan 05 16:29:29.726117 2026] [:error] [pid 5536:tid 5603] [client 4.240.125.246:7093] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVt2aQRtMZNG6xI8yDybDgAAAIY"]
[Mon Jan 05 16:29:29.998629 2026] [:error] [pid 5535:tid 5590] [client 4.240.125.246:7050] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVt2aWnkedMjhVX0PTU44wAAAFQ"]
[Mon Jan 05 16:29:30.273898 2026] [:error] [pid 5534:tid 5566] [client 4.240.125.246:18000] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aVt2apNs9XmbR6unB0xonQAAABc"]
[Mon Jan 05 16:29:30.548241 2026] [:error] [pid 6680:tid 6689] [client 4.240.125.246:6925] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVt2aqE58uNoazzTmx2tDgAAAQc"]
[Mon Jan 05 16:29:30.830373 2026] [:error] [pid 5534:tid 5551] [client 4.240.125.246:6887] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVt2apNs9XmbR6unB0xooQAAAAg"]
[Mon Jan 05 16:29:31.103849 2026] [:error] [pid 5534:tid 5554] [client 4.240.125.246:6944] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVt2a5Ns9XmbR6unB0xoowAAAAs"]
[Mon Jan 05 16:29:31.375666 2026] [:error] [pid 28407:tid 28426] [client 4.240.125.246:7005] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aVt2a9ercd3ptydUzM0HtgAAAY8"]
[Mon Jan 05 16:29:31.664819 2026] [:error] [pid 28407:tid 28431] [client 4.240.125.246:6993] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVt2a9ercd3ptydUzM0HtwAAAZQ"]
[Mon Jan 05 16:29:31.941877 2026] [:error] [pid 5536:tid 5615] [client 4.240.125.246:6850] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVt2awRtMZNG6xI8yDybEgAAAJI"]
[Mon Jan 05 16:29:32.212932 2026] [:error] [pid 5632:tid 5653] [client 4.240.125.246:7082] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVt2bIN3ZWvlOh-nbt-JDAAAAMk"]
[Mon Jan 05 16:29:32.494433 2026] [:error] [pid 6680:tid 6693] [client 4.240.125.246:7017] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aVt2bKE58uNoazzTmx2tEAAAAQs"]
[Mon Jan 05 16:29:32.769005 2026] [:error] [pid 54081:tid 54099] [client 4.240.125.246:6796] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVt2bFL4jLgtF-b9w4dIZAAAAU8"]
[Mon Jan 05 16:29:33.046611 2026] [:error] [pid 6680:tid 6688] [client 4.240.125.246:6854] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVt2baE58uNoazzTmx2tEgAAAQY"]
[Mon Jan 05 16:29:33.317741 2026] [:error] [pid 5536:tid 5605] [client 4.240.125.246:7011] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVt2bQRtMZNG6xI8yDybFQAAAIg"]
[Mon Jan 05 16:29:33.593261 2026] [:error] [pid 5632:tid 5644] [client 4.240.125.246:7158] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aVt2bYN3ZWvlOh-nbt-JDwAAAMA"]
[Mon Jan 05 16:29:33.875151 2026] [:error] [pid 54081:tid 54104] [client 4.240.125.246:6936] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2bVL4jLgtF-b9w4dIZgAAAVQ"]
[Mon Jan 05 16:29:34.147631 2026] [:error] [pid 5632:tid 5667] [client 4.240.125.246:6934] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2boN3ZWvlOh-nbt-JEQAAANc"]
[Mon Jan 05 16:29:34.418701 2026] [:error] [pid 5535:tid 5581] [client 4.240.125.246:6977] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2bmnkedMjhVX0PTU46AAAAEs"]
[Mon Jan 05 16:29:34.689628 2026] [:error] [pid 6680:tid 6695] [client 4.240.125.246:6995] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2bqE58uNoazzTmx2tFAAAAQ0"]
[Mon Jan 05 16:29:34.960995 2026] [:error] [pid 5534:tid 5564] [client 4.240.125.246:7052] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVt2bpNs9XmbR6unB0xoqgAAABU"]
[Mon Jan 05 16:29:35.237640 2026] [:error] [pid 5535:tid 5572] [client 4.240.125.246:7165] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVt2b2nkedMjhVX0PTU46QAAAEI"]
[Mon Jan 05 16:29:35.511393 2026] [:error] [pid 5632:tid 5666] [client 4.240.125.246:6970] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVt2b4N3ZWvlOh-nbt-JEgAAANY"]
[Mon Jan 05 16:29:35.782119 2026] [:error] [pid 28407:tid 28425] [client 4.240.125.246:6982] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aVt2b9ercd3ptydUzM0HvQAAAY4"]
[Mon Jan 05 16:29:36.052226 2026] [:error] [pid 28407:tid 28435] [client 4.240.125.246:7024] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aVt2cNercd3ptydUzM0HvgAAAZg"]
[Mon Jan 05 16:29:36.326806 2026] [:error] [pid 5534:tid 5563] [client 4.240.125.246:6928] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aVt2cJNs9XmbR6unB0xoqwAAABQ"]
[Mon Jan 05 16:29:36.618395 2026] [:error] [pid 5534:tid 5560] [client 4.240.125.246:7087] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aVt2cJNs9XmbR6unB0xorQAAABE"]
[Mon Jan 05 16:29:36.887354 2026] [:error] [pid 6680:tid 6702] [client 4.240.125.246:7046] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aVt2cKE58uNoazzTmx2tGgAAARQ"]
[Mon Jan 05 16:29:37.172513 2026] [:error] [pid 5632:tid 5654] [client 4.240.125.246:6935] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aVt2cYN3ZWvlOh-nbt-JFQAAAMo"]
[Mon Jan 05 16:29:37.444905 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:6920] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aVt2cZNs9XmbR6unB0xorwAAAAI"]
[Mon Jan 05 16:29:37.716181 2026] [:error] [pid 5534:tid 5550] [client 4.240.125.246:6881] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aVt2cZNs9XmbR6unB0xosgAAAAc"]
[Mon Jan 05 16:29:37.986025 2026] [:error] [pid 5536:tid 5597] [client 4.240.125.246:7056] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aVt2cQRtMZNG6xI8yDybFwAAAIA"]
[Mon Jan 05 16:29:38.255510 2026] [:error] [pid 5632:tid 5658] [client 4.240.125.246:6913] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVt2coN3ZWvlOh-nbt-JFwAAAM4"]
[Mon Jan 05 16:29:38.525352 2026] [:error] [pid 6680:tid 6686] [client 4.240.125.246:6924] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVt2cqE58uNoazzTmx2tIAAAAQQ"]
[Mon Jan 05 16:29:38.795769 2026] [:error] [pid 5535:tid 5586] [client 4.240.125.246:17985] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVt2cmnkedMjhVX0PTU46wAAAFA"]
[Mon Jan 05 16:29:39.080197 2026] [:error] [pid 5536:tid 5616] [client 4.240.125.246:6932] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aVt2cwRtMZNG6xI8yDybGAAAAJM"]
[Mon Jan 05 16:29:39.350820 2026] [:error] [pid 6680:tid 6695] [client 4.240.125.246:6942] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2c6E58uNoazzTmx2tIwAAAQ0"]
[Mon Jan 05 16:29:39.628668 2026] [:error] [pid 5535:tid 5580] [client 4.240.125.246:6939] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2c2nkedMjhVX0PTU47AAAAEo"]
[Mon Jan 05 16:29:39.899502 2026] [:error] [pid 5536:tid 5603] [client 4.240.125.246:6931] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2cwRtMZNG6xI8yDybGgAAAIY"]
[Mon Jan 05 16:29:40.181190 2026] [:error] [pid 6680:tid 6703] [client 4.240.125.246:6954] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aVt2dKE58uNoazzTmx2tJwAAARU"]
[Mon Jan 05 16:29:40.454179 2026] [:error] [pid 6680:tid 6682] [client 4.240.125.246:7139] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1n.php"] [unique_id "aVt2dKE58uNoazzTmx2tKQAAAQA"]
[Mon Jan 05 16:29:40.727272 2026] [:error] [pid 6680:tid 6685] [client 4.240.125.246:6953] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1n.php"] [unique_id "aVt2dKE58uNoazzTmx2tKgAAAQM"]
[Mon Jan 05 16:29:40.997379 2026] [:error] [pid 5534:tid 5562] [client 4.240.125.246:6959] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1n.php"] [unique_id "aVt2dJNs9XmbR6unB0xotAAAABM"]
[Mon Jan 05 16:29:41.272235 2026] [:error] [pid 5535:tid 5574] [client 4.240.125.246:18013] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1n.php"] [unique_id "aVt2dWnkedMjhVX0PTU47wAAAEQ"]
[Mon Jan 05 16:29:41.544627 2026] [:error] [pid 54081:tid 54095] [client 4.240.125.246:7037] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aVt2dVL4jLgtF-b9w4dIaQAAAUs"]
[Mon Jan 05 16:29:41.816991 2026] [:error] [pid 5632:tid 5645] [client 4.240.125.246:7081] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aVt2dYN3ZWvlOh-nbt-JGgAAAME"]
[Mon Jan 05 16:29:42.086743 2026] [:error] [pid 5536:tid 5600] [client 4.240.125.246:6972] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aVt2dgRtMZNG6xI8yDybHQAAAIM"]
[Mon Jan 05 16:29:42.371996 2026] [:error] [pid 6680:tid 6683] [client 4.240.125.246:17998] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aVt2dqE58uNoazzTmx2tLQAAAQE"]
[Mon Jan 05 16:29:42.680038 2026] [:error] [pid 28407:tid 28431] [client 4.240.125.246:6914] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aVt2dtercd3ptydUzM0HwQAAAZQ"]
[Mon Jan 05 16:29:42.974120 2026] [:error] [pid 54081:tid 54096] [client 4.240.125.246:7014] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aVt2dlL4jLgtF-b9w4dIawAAAUw"]
[Mon Jan 05 16:29:43.246960 2026] [:error] [pid 28407:tid 28411] [client 4.240.125.246:6918] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aVt2d9ercd3ptydUzM0HwwAAAYE"]
[Mon Jan 05 16:29:43.525348 2026] [:error] [pid 5534:tid 5558] [client 4.240.125.246:7073] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aVt2d5Ns9XmbR6unB0xotwAAAA8"]
[Mon Jan 05 16:29:43.795265 2026] [:error] [pid 6680:tid 6695] [client 4.240.125.246:6869] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2d6E58uNoazzTmx2tLgAAAQ0"]
[Mon Jan 05 16:29:44.066066 2026] [:error] [pid 5534:tid 5549] [client 4.240.125.246:6938] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2eJNs9XmbR6unB0xouAAAAAY"]
[Mon Jan 05 16:29:44.337422 2026] [:error] [pid 54081:tid 54101] [client 4.240.125.246:6990] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2eFL4jLgtF-b9w4dIbAAAAVE"]
[Mon Jan 05 16:29:44.606873 2026] [:error] [pid 5536:tid 5618] [client 4.240.125.246:6863] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aVt2eARtMZNG6xI8yDybHwAAAJU"]
[Mon Jan 05 16:29:44.895808 2026] [:error] [pid 5536:tid 5612] [client 4.240.125.246:6867] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aVt2eARtMZNG6xI8yDybIgAAAI8"]
[Mon Jan 05 16:29:45.179713 2026] [:error] [pid 28407:tid 28416] [client 4.240.125.246:7078] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aVt2edercd3ptydUzM0HxgAAAYY"]
[Mon Jan 05 16:29:45.454600 2026] [:error] [pid 28407:tid 28424] [client 4.240.125.246:6859] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aVt2edercd3ptydUzM0HxwAAAY0"]
[Mon Jan 05 16:29:45.735118 2026] [:error] [pid 54081:tid 54105] [client 4.240.125.246:7009] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "aVt2eVL4jLgtF-b9w4dIcAAAAVU"]
[Mon Jan 05 16:29:46.010794 2026] [:error] [pid 28407:tid 28412] [client 4.240.125.246:7088] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVt2etercd3ptydUzM0HygAAAYI"]
[Mon Jan 05 16:29:46.323749 2026] [:error] [pid 5535:tid 5570] [client 4.240.125.246:6926] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVt2emnkedMjhVX0PTU48gAAAEA"]
[Mon Jan 05 16:29:46.591648 2026] [:error] [pid 6680:tid 6703] [client 4.240.125.246:6826] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVt2eqE58uNoazzTmx2tMgAAARU"]
[Mon Jan 05 16:29:46.861186 2026] [:error] [pid 54081:tid 54091] [client 4.240.125.246:7015] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aVt2elL4jLgtF-b9w4dIcwAAAUc"]
[Mon Jan 05 16:29:47.137784 2026] [:error] [pid 6680:tid 6682] [client 4.240.125.246:6949] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aVt2e6E58uNoazzTmx2tNAAAAQA"]
[Mon Jan 05 16:29:47.409999 2026] [:error] [pid 6680:tid 6694] [client 4.240.125.246:7021] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aVt2e6E58uNoazzTmx2tNQAAAQw"]
[Mon Jan 05 16:29:47.686453 2026] [:error] [pid 6680:tid 6691] [client 4.240.125.246:7034] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aVt2e6E58uNoazzTmx2tNgAAAQk"]
[Mon Jan 05 16:29:47.958237 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:7068] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aVt2e5Ns9XmbR6unB0xovAAAAAI"]
[Mon Jan 05 16:29:48.234900 2026] [:error] [pid 28407:tid 28420] [client 4.240.125.246:7101] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aVt2fNercd3ptydUzM0HzQAAAYk"]
[Mon Jan 05 16:29:48.518707 2026] [:error] [pid 6680:tid 6702] [client 4.240.125.246:6971] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aVt2fKE58uNoazzTmx2tOAAAARQ"]
[Mon Jan 05 16:29:48.788031 2026] [:error] [pid 6680:tid 6683] [client 4.240.125.246:7033] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aVt2fKE58uNoazzTmx2tOQAAAQE"]
[Mon Jan 05 16:29:49.059308 2026] [:error] [pid 5535:tid 5592] [client 4.240.125.246:6961] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aVt2fWnkedMjhVX0PTU49AAAAFY"]
[Mon Jan 05 16:29:49.331424 2026] [:error] [pid 5632:tid 5650] [client 4.240.125.246:7039] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aVt2fYN3ZWvlOh-nbt-JHwAAAMY"]
[Mon Jan 05 16:29:49.604916 2026] [:error] [pid 5535:tid 5577] [client 4.240.125.246:6909] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aVt2fWnkedMjhVX0PTU49QAAAEc"]
[Mon Jan 05 16:29:49.882607 2026] [:error] [pid 6680:tid 6690] [client 4.240.125.246:6848] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aVt2faE58uNoazzTmx2tOgAAAQg"]
[Mon Jan 05 16:29:50.157657 2026] [:error] [pid 6680:tid 6699] [client 4.240.125.246:6946] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aVt2fqE58uNoazzTmx2tPQAAARE"]
[Mon Jan 05 16:29:50.432312 2026] [:error] [pid 5536:tid 5600] [client 4.240.125.246:6915] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVt2fgRtMZNG6xI8yDybOAAAAIM"]
[Mon Jan 05 16:29:50.729810 2026] [:error] [pid 6680:tid 6701] [client 4.240.125.246:6975] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVt2fqE58uNoazzTmx2tRAAAARM"]
[Mon Jan 05 16:29:51.005813 2026] [:error] [pid 5534:tid 5560] [client 4.240.125.246:6883] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVt2f5Ns9XmbR6unB0xoyAAAABE"]
[Mon Jan 05 16:29:51.275098 2026] [:error] [pid 5632:tid 5654] [client 4.240.125.246:6991] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aVt2f4N3ZWvlOh-nbt-JIAAAAMo"]
[Mon Jan 05 16:29:51.551411 2026] [:error] [pid 5536:tid 5604] [client 4.240.125.246:7029] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVt2fwRtMZNG6xI8yDybSQAAAIc"]
[Mon Jan 05 16:29:51.820682 2026] [:error] [pid 5536:tid 5600] [client 4.240.125.246:6805] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVt2fwRtMZNG6xI8yDybSwAAAIM"]
[Mon Jan 05 16:29:52.089134 2026] [:error] [pid 5536:tid 5602] [client 4.240.125.246:6937] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVt2gARtMZNG6xI8yDybTwAAAIU"]
[Mon Jan 05 16:29:52.363826 2026] [:error] [pid 5632:tid 5661] [client 4.240.125.246:6967] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aVt2gIN3ZWvlOh-nbt-JIgAAANE"]
[Mon Jan 05 16:29:52.641506 2026] [:error] [pid 5632:tid 5647] [client 4.240.125.246:6895] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVt2gIN3ZWvlOh-nbt-JJAAAAMM"]
[Mon Jan 05 16:29:52.911353 2026] [:error] [pid 5632:tid 5657] [client 4.240.125.246:6966] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVt2gIN3ZWvlOh-nbt-JJgAAAM0"]
[Mon Jan 05 16:29:53.197472 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:7012] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVt2gZNs9XmbR6unB0xoygAAAAI"]
[Mon Jan 05 16:29:53.466287 2026] [:error] [pid 28407:tid 28416] [client 4.240.125.246:6851] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aVt2gdercd3ptydUzM0H0wAAAYY"]
[Mon Jan 05 16:29:53.734501 2026] [:error] [pid 6680:tid 6691] [client 4.240.125.246:6889] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVt2gaE58uNoazzTmx2tWgAAAQk"]
[Mon Jan 05 16:29:54.004948 2026] [:error] [pid 28407:tid 28424] [client 4.240.125.246:6864] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVt2gtercd3ptydUzM0H1QAAAY0"]
[Mon Jan 05 16:29:54.277883 2026] [:error] [pid 54081:tid 54094] [client 4.240.125.246:6865] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVt2glL4jLgtF-b9w4dIhwAAAUo"]
[Mon Jan 05 16:29:54.552970 2026] [:error] [pid 54081:tid 54091] [client 4.240.125.246:6930] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "aVt2glL4jLgtF-b9w4dIiAAAAUc"]
[Mon Jan 05 16:29:54.829962 2026] [:error] [pid 5534:tid 5555] [client 4.240.125.246:7013] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVt2gpNs9XmbR6unB0xozwAAAAw"]
[Mon Jan 05 16:29:55.100477 2026] [:error] [pid 5632:tid 5668] [client 4.240.125.246:6969] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVt2g4N3ZWvlOh-nbt-JKAAAANg"]
[Mon Jan 05 16:29:55.370717 2026] [:error] [pid 28407:tid 28430] [client 4.240.125.246:6886] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVt2g9ercd3ptydUzM0H2AAAAZM"]
[Mon Jan 05 16:29:55.647201 2026] [:error] [pid 5534:tid 5558] [client 4.240.125.246:6795] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "aVt2g5Ns9XmbR6unB0xo0wAAAA8"]
[Mon Jan 05 16:29:55.920400 2026] [:error] [pid 5534:tid 5552] [client 4.240.125.246:7036] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cheka.php"] [unique_id "aVt2g5Ns9XmbR6unB0xo1AAAAAk"]
[Mon Jan 05 16:29:56.194609 2026] [:error] [pid 6680:tid 6686] [client 4.240.125.246:18018] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cheka.php"] [unique_id "aVt2hKE58uNoazzTmx2tYQAAAQQ"]
[Mon Jan 05 16:29:56.480791 2026] [:error] [pid 5534:tid 5566] [client 4.240.125.246:6964] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cheka.php"] [unique_id "aVt2hJNs9XmbR6unB0xo1QAAABc"]
[Mon Jan 05 16:29:56.748882 2026] [:error] [pid 6680:tid 6701] [client 4.240.125.246:6891] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cheka.php"] [unique_id "aVt2hKE58uNoazzTmx2tYwAAARM"]
[Mon Jan 05 16:29:57.026538 2026] [:error] [pid 5534:tid 5567] [client 4.240.125.246:6945] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "aVt2hZNs9XmbR6unB0xo1wAAABg"]
[Mon Jan 05 16:29:57.320820 2026] [:error] [pid 54081:tid 54104] [client 4.240.125.246:6904] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "aVt2hVL4jLgtF-b9w4dIiwAAAVQ"]
[Mon Jan 05 16:29:57.590375 2026] [:error] [pid 54081:tid 54095] [client 4.240.125.246:6670] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "aVt2hVL4jLgtF-b9w4dIjQAAAUs"]
[Mon Jan 05 16:29:57.861332 2026] [:error] [pid 54081:tid 54101] [client 4.240.125.246:6787] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "aVt2hVL4jLgtF-b9w4dIjwAAAVE"]
[Mon Jan 05 16:29:58.154309 2026] [:error] [pid 54081:tid 54087] [client 4.240.125.246:6902] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtride.php"] [unique_id "aVt2hlL4jLgtF-b9w4dIkQAAAUM"]
[Mon Jan 05 16:29:58.426435 2026] [:error] [pid 28407:tid 28431] [client 4.240.125.246:7016] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtride.php"] [unique_id "aVt2htercd3ptydUzM0H2wAAAZQ"]
[Mon Jan 05 16:29:58.710092 2026] [:error] [pid 5632:tid 5656] [client 4.240.125.246:7030] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtride.php"] [unique_id "aVt2hoN3ZWvlOh-nbt-JLAAAAMw"]
[Mon Jan 05 16:29:58.990637 2026] [:error] [pid 6680:tid 6696] [client 4.240.125.246:6874] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xtride.php"] [unique_id "aVt2hqE58uNoazzTmx2taQAAAQ4"]
[Mon Jan 05 16:29:59.261604 2026] [:error] [pid 28407:tid 28432] [client 4.240.125.246:6877] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVt2h9ercd3ptydUzM0H3gAAAZU"]
[Mon Jan 05 16:29:59.536107 2026] [:error] [pid 28407:tid 28414] [client 4.240.125.246:6788] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVt2h9ercd3ptydUzM0H3wAAAYQ"]
[Mon Jan 05 16:29:59.808502 2026] [:error] [pid 28407:tid 28428] [client 4.240.125.246:6952] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVt2h9ercd3ptydUzM0H4AAAAZE"]
[Mon Jan 05 16:30:00.089033 2026] [:error] [pid 28407:tid 28410] [client 4.240.125.246:6948] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws29.php"] [unique_id "aVt2iNercd3ptydUzM0H4QAAAYA"]
[Mon Jan 05 16:30:00.384612 2026] [:error] [pid 6680:tid 6704] [client 4.240.125.246:6729] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVt2iKE58uNoazzTmx2tagAAARY"]
[Mon Jan 05 16:30:00.657973 2026] [:error] [pid 6680:tid 6685] [client 4.240.125.246:6905] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVt2iKE58uNoazzTmx2tbAAAAQM"]
[Mon Jan 05 16:30:00.938334 2026] [:error] [pid 5632:tid 5652] [client 4.240.125.246:6812] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVt2iIN3ZWvlOh-nbt-JLgAAAMg"]
[Mon Jan 05 16:30:01.215159 2026] [:error] [pid 5534:tid 5544] [client 4.240.125.246:6898] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oo.php"] [unique_id "aVt2iZNs9XmbR6unB0xo3AAAAAE"]
[Mon Jan 05 16:30:01.486562 2026] [:error] [pid 5534:tid 5549] [client 4.240.125.246:6997] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVt2iZNs9XmbR6unB0xo3wAAAAY"]
[Mon Jan 05 16:30:01.755557 2026] [:error] [pid 5534:tid 5561] [client 4.240.125.246:6856] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVt2iZNs9XmbR6unB0xo4QAAABI"]
[Mon Jan 05 16:30:02.048521 2026] [:error] [pid 6680:tid 6689] [client 4.240.125.246:6794] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVt2iqE58uNoazzTmx2tbgAAAQc"]
[Mon Jan 05 16:30:02.323394 2026] [:error] [pid 5535:tid 5580] [client 4.240.125.246:7054] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s11.php"] [unique_id "aVt2imnkedMjhVX0PTU4-AAAAEo"]
[Mon Jan 05 16:30:02.592990 2026] [:error] [pid 5534:tid 5546] [client 4.240.125.246:6984] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aVt2ipNs9XmbR6unB0xo5AAAAAM"]
[Mon Jan 05 16:30:02.882018 2026] [:error] [pid 5632:tid 5663] [client 4.240.125.246:6986] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aVt2ioN3ZWvlOh-nbt-JMAAAANM"]
[Mon Jan 05 16:30:03.159152 2026] [:error] [pid 5632:tid 5661] [client 4.240.125.246:6860] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aVt2i4N3ZWvlOh-nbt-JMQAAANE"]
[Mon Jan 05 16:30:03.430145 2026] [:error] [pid 5534:tid 5545] [client 4.240.125.246:6862] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aVt2i5Ns9XmbR6unB0xo5gAAAAI"]
[Mon Jan 05 16:30:03.701192 2026] [:error] [pid 6680:tid 6693] [client 4.240.125.246:7098] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVt2i6E58uNoazzTmx2tcgAAAQs"]
[Mon Jan 05 16:30:04.068823 2026] [:error] [pid 5534:tid 5554] [client 4.240.125.246:6799] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVt2jJNs9XmbR6unB0xo5wAAAAs"]
[Mon Jan 05 16:30:04.359020 2026] [:error] [pid 5534:tid 5555] [client 4.240.125.246:6955] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVt2jJNs9XmbR6unB0xo6QAAAAw"]
[Mon Jan 05 16:30:04.641330 2026] [:error] [pid 5535:tid 5576] [client 4.240.125.246:6900] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aqw.php"] [unique_id "aVt2jGnkedMjhVX0PTU4-wAAAEY"]
[Mon Jan 05 16:30:05.107034 2026] [:error] [pid 5632:tid 5658] [client 4.240.125.246:6907] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVt2jYN3ZWvlOh-nbt-JMgAAAM4"]
[Mon Jan 05 16:30:05.399068 2026] [:error] [pid 54081:tid 54103] [client 4.240.125.246:6832] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVt2jVL4jLgtF-b9w4dIlwAAAVM"]
[Mon Jan 05 16:30:05.731648 2026] [:error] [pid 6680:tid 6700] [client 4.240.125.246:6838] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVt2jaE58uNoazzTmx2tdAAAARI"]
[Mon Jan 05 16:30:06.074752 2026] [:error] [pid 6680:tid 6696] [client 4.240.125.246:6724] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ca1.php"] [unique_id "aVt2jqE58uNoazzTmx2tdQAAAQ4"]
[Mon Jan 05 16:30:06.413382 2026] [:error] [pid 5534:tid 5558] [client 4.240.125.246:6785] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVt2jpNs9XmbR6unB0xo7QAAAA8"]
[Mon Jan 05 16:30:06.800423 2026] [:error] [pid 5534:tid 5556] [client 4.240.125.246:6876] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVt2jpNs9XmbR6unB0xo7gAAAA0"]
[Mon Jan 05 16:30:07.167014 2026] [:error] [pid 54081:tid 54104] [client 4.240.125.246:6958] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVt2j1L4jLgtF-b9w4dImAAAAVQ"]
[Mon Jan 05 16:30:07.554315 2026] [:error] [pid 5534:tid 5566] [client 4.240.125.246:6857] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouta.php"] [unique_id "aVt2j5Ns9XmbR6unB0xo8QAAABc"]
[Mon Jan 05 16:30:07.928813 2026] [:error] [pid 28407:tid 28420] [client 4.240.125.246:6960] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVt2j9ercd3ptydUzM0H5gAAAYk"]
[Mon Jan 05 16:30:08.289220 2026] [:error] [pid 5535:tid 5571] [client 4.240.125.246:6963] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVt2kGnkedMjhVX0PTU5AAAAAEE"]
[Mon Jan 05 16:30:08.698560 2026] [:error] [pid 5535:tid 5591] [client 4.240.125.246:6792] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVt2kGnkedMjhVX0PTU5AQAAAFU"]
[Mon Jan 05 16:30:09.050521 2026] [:error] [pid 28407:tid 28413] [client 4.240.125.246:6830] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fclas.php"] [unique_id "aVt2kdercd3ptydUzM0H5wAAAYM"]
[Mon Jan 05 16:30:09.628274 2026] [:error] [pid 5536:tid 5603] [client 4.240.125.246:6896] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aVt2kQRtMZNG6xI8yDybYQAAAIY"]
[Mon Jan 05 16:30:09.977117 2026] [:error] [pid 5536:tid 5606] [client 4.240.125.246:6823] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bbn.php"] [unique_id "aVt2kQRtMZNG6xI8yDybYgAAAIk"]
[Mon Jan 05 16:30:10.449137 2026] [:error] [pid 5535:tid 5581] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/bbn.php
[Mon Jan 05 16:30:10.587276 2026] [:error] [pid 5535:tid 5572] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon Jan 05 16:30:10.726966 2026] [:error] [pid 5535:tid 5578] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/xz89.php
[Mon Jan 05 16:30:10.926212 2026] [:error] [pid 5535:tid 5587] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/wft.php
[Mon Jan 05 16:30:11.083970 2026] [:error] [pid 5535:tid 5575] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/ws28.php
[Mon Jan 05 16:30:11.221970 2026] [:error] [pid 5535:tid 5574] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/wsvvs.php
[Mon Jan 05 16:30:11.359773 2026] [:error] [pid 5535:tid 5579] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/pn.php
[Mon Jan 05 16:30:11.497975 2026] [:error] [pid 5535:tid 5594] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/fz.php
[Mon Jan 05 16:30:12.983178 2026] [:error] [pid 5535:tid 5594] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/sang.php
[Mon Jan 05 16:30:13.120772 2026] [:error] [pid 5535:tid 5590] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/0o0.php
[Mon Jan 05 16:30:13.258405 2026] [:error] [pid 5535:tid 5570] [client 4.240.125.246:6861] File does not exist: /usr/local/apache/htdocs/suspended-page/zxl.php
[Mon Jan 05 16:30:13.393645 2026] [:error] [pid 5535:tid 5589] [client 4.240.125.246:6861] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVt2lWnkedMjhVX0PTU5EwAAAFM"]
[Mon Jan 05 16:30:13.668217 2026] [:error] [pid 54081:tid 54101] [client 4.240.125.246:6880] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVt2lVL4jLgtF-b9w4dInAAAAVE"]
[Mon Jan 05 16:30:13.951570 2026] [:error] [pid 6680:tid 6686] [client 4.240.125.246:6954] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVt2laE58uNoazzTmx2tegAAAQQ"]
[Mon Jan 05 16:30:14.221707 2026] [:error] [pid 5534:tid 5565] [client 4.240.125.246:6951] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aVt2lpNs9XmbR6unB0xo-gAAABY"]
[Mon Jan 05 16:30:14.540766 2026] [:error] [pid 5632:tid 5646] [client 4.240.125.246:6870] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "aVt2loN3ZWvlOh-nbt-JOwAAAMI"]
[Mon Jan 05 16:30:14.813482 2026] [:error] [pid 6680:tid 6695] [client 4.240.125.246:6764] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "aVt2lqE58uNoazzTmx2tfQAAAQ0"]
[Mon Jan 05 16:30:15.090128 2026] [:error] [pid 5534:tid 5564] [client 4.240.125.246:6737] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "aVt2l5Ns9XmbR6unB0xo-wAAABU"]
[Mon Jan 05 16:30:15.364569 2026] [:error] [pid 6680:tid 6687] [client 4.240.125.246:6927] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "aVt2l6E58uNoazzTmx2tggAAAQU"]
[Mon Jan 05 16:30:15.635293 2026] [:error] [pid 6680:tid 6697] [client 4.240.125.246:6819] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVt2l6E58uNoazzTmx2tgwAAAQ8"]
[Mon Jan 05 16:30:15.908188 2026] [:error] [pid 5534:tid 5553] [client 4.240.125.246:6923] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVt2l5Ns9XmbR6unB0xo_QAAAAo"]
[Mon Jan 05 16:30:16.208639 2026] [:error] [pid 5535:tid 5572] [client 4.240.125.246:6962] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVt2mGnkedMjhVX0PTU5FgAAAEI"]
[Mon Jan 05 16:30:16.498802 2026] [:error] [pid 5534:tid 5566] [client 4.240.125.246:6950] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aVt2mJNs9XmbR6unB0xpAQAAABc"]
[Mon Jan 05 16:30:16.807836 2026] [:error] [pid 54081:tid 54100] [client 4.240.125.246:6974] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aVt2mFL4jLgtF-b9w4dIoAAAAVA"]
[Mon Jan 05 16:30:17.079863 2026] [:error] [pid 5536:tid 5610] [client 4.240.125.246:6784] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aVt2mQRtMZNG6xI8yDybaAAAAI0"]
[Mon Jan 05 16:30:17.352010 2026] [:error] [pid 28407:tid 28421] [client 4.240.125.246:6968] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aVt2mdercd3ptydUzM0H8QAAAYo"]
[Mon Jan 05 16:30:17.620966 2026] [:error] [pid 5534:tid 5567] [client 4.240.125.246:6957] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aVt2mZNs9XmbR6unB0xpBAAAABg"]
[Mon Jan 05 16:30:17.892561 2026] [:error] [pid 6680:tid 6694] [client 4.240.125.246:6789] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aVt2maE58uNoazzTmx2thwAAAQw"]
[Mon Jan 05 16:30:18.182908 2026] [:error] [pid 5534:tid 5559] [client 4.240.125.246:6899] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aVt2mpNs9XmbR6unB0xpCAAAABA"]
[Mon Jan 05 16:30:18.454013 2026] [:error] [pid 5536:tid 5609] [client 4.240.125.246:6782] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aVt2mgRtMZNG6xI8yDybawAAAIw"]
[Mon Jan 05 16:30:18.737484 2026] [:error] [pid 28407:tid 28412] [client 4.240.125.246:6728] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aVt2mtercd3ptydUzM0H8wAAAYI"]
[Mon Jan 05 16:30:19.009873 2026] [:error] [pid 54081:tid 54105] [client 4.240.125.246:6827] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsrer.php"] [unique_id "aVt2m1L4jLgtF-b9w4dIowAAAVU"]
[Mon Jan 05 16:30:19.278836 2026] [:error] [pid 54081:tid 54093] [client 4.240.125.246:6790] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsrer.php"] [unique_id "aVt2m1L4jLgtF-b9w4dIpAAAAUk"]
[Mon Jan 05 16:30:19.564612 2026] [:error] [pid 5536:tid 5621] [client 4.240.125.246:6731] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsrer.php"] [unique_id "aVt2mwRtMZNG6xI8yDybcQAAAJg"]
[Mon Jan 05 16:30:19.848372 2026] [:error] [pid 5632:tid 5654] [client 4.240.125.246:6852] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsrer.php"] [unique_id "aVt2m4N3ZWvlOh-nbt-JPAAAAMo"]
[Mon Jan 05 16:30:20.119622 2026] [:error] [pid 5534:tid 5562] [client 4.240.125.246:6893] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVt2nJNs9XmbR6unB0xpDgAAABM"]
[Mon Jan 05 16:30:20.400055 2026] [:error] [pid 28407:tid 28411] [client 4.240.125.246:6810] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVt2nNercd3ptydUzM0H9gAAAYE"]
[Mon Jan 05 16:30:20.671568 2026] [:error] [pid 5536:tid 5620] [client 4.240.125.246:6763] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVt2nARtMZNG6xI8yDybcwAAAJc"]
[Mon Jan 05 16:30:20.949250 2026] [:error] [pid 5632:tid 5660] [client 4.240.125.246:6800] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aVt2nIN3ZWvlOh-nbt-JPgAAANA"]
[Mon Jan 05 16:30:21.222291 2026] [:error] [pid 5534:tid 5553] [client 4.240.125.246:6836] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/enclas.php"] [unique_id "aVt2nZNs9XmbR6unB0xpDwAAAAo"]
[Mon Jan 05 16:30:21.496606 2026] [:error] [pid 28407:tid 28428] [client 4.240.125.246:6843] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/enclas.php"] [unique_id "aVt2ndercd3ptydUzM0H-AAAAZE"]
[Mon Jan 05 16:30:21.768564 2026] [:error] [pid 54081:tid 54091] [client 4.240.125.246:6892] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/enclas.php"] [unique_id "aVt2nVL4jLgtF-b9w4dIqAAAAUc"]
[Mon Jan 05 16:30:22.041095 2026] [:error] [pid 54081:tid 54103] [client 4.240.125.246:6777] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/enclas.php"] [unique_id "aVt2nlL4jLgtF-b9w4dIqQAAAVM"]
[Mon Jan 05 16:30:22.313994 2026] [:error] [pid 5536:tid 5611] [client 4.240.125.246:6657] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aVt2ngRtMZNG6xI8yDybdwAAAI4"]
[Mon Jan 05 16:30:22.587726 2026] [:error] [pid 5534:tid 5556] [client 4.240.125.246:6941] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aVt2npNs9XmbR6unB0xpEwAAAA0"]
[Mon Jan 05 16:30:22.858688 2026] [:error] [pid 5632:tid 5645] [client 4.240.125.246:6840] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aVt2noN3ZWvlOh-nbt-JQQAAAME"]
[Mon Jan 05 16:30:23.142095 2026] [:error] [pid 5632:tid 5655] [client 4.240.125.246:6721] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aVt2n4N3ZWvlOh-nbt-JQwAAAMs"]
[Mon Jan 05 16:30:23.410333 2026] [:error] [pid 5632:tid 5659] [client 4.240.125.246:7118] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid.php"] [unique_id "aVt2n4N3ZWvlOh-nbt-JRQAAAM8"]
[Mon Jan 05 16:30:23.680055 2026] [:error] [pid 5632:tid 5668] [client 4.240.125.246:6814] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid.php"] [unique_id "aVt2n4N3ZWvlOh-nbt-JRwAAANg"]
[Mon Jan 05 16:30:23.965790 2026] [:error] [pid 54081:tid 54092] [client 4.240.125.246:6778] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid.php"] [unique_id "aVt2n1L4jLgtF-b9w4dIrAAAAUg"]
[Mon Jan 05 16:30:24.240624 2026] [:error] [pid 5632:tid 5664] [client 4.240.125.246:6797] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid.php"] [unique_id "aVt2oIN3ZWvlOh-nbt-JSQAAANQ"]
[Mon Jan 05 16:30:24.510942 2026] [:error] [pid 5535:tid 5582] [client 4.240.125.246:6690] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVt2oGnkedMjhVX0PTU5GQAAAEw"]
[Mon Jan 05 16:30:24.783894 2026] [:error] [pid 54081:tid 54086] [client 4.240.125.246:6689] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVt2oFL4jLgtF-b9w4dIrQAAAUI"]
[Mon Jan 05 16:30:25.064007 2026] [:error] [pid 5534:tid 5559] [client 4.240.125.246:7133] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVt2oZNs9XmbR6unB0xpFgAAABA"]
[Mon Jan 05 16:30:25.337121 2026] [:error] [pid 5534:tid 5546] [client 4.240.125.246:6911] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aVt2oZNs9XmbR6unB0xpFwAAAAM"]
[Mon Jan 05 16:30:25.638338 2026] [:error] [pid 6680:tid 6684] [client 4.240.125.246:6844] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aVt2oaE58uNoazzTmx2tjAAAAQI"]
[Mon Jan 05 16:30:25.909488 2026] [:error] [pid 5632:tid 5652] [client 4.240.125.246:6835] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aVt2oYN3ZWvlOh-nbt-JTQAAAMg"]
[Mon Jan 05 16:30:26.178256 2026] [:error] [pid 54081:tid 54107] [client 4.240.125.246:6693] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aVt2olL4jLgtF-b9w4dIsQAAAVc"]
[Mon Jan 05 16:30:26.461267 2026] [:error] [pid 54081:tid 54097] [client 4.240.125.246:6829] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aVt2olL4jLgtF-b9w4dItAAAAU0"]
[Mon Jan 05 16:30:26.732100 2026] [:error] [pid 5536:tid 5603] [client 4.240.125.246:6872] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVt2ogRtMZNG6xI8yDybfQAAAIY"]
[Mon Jan 05 16:30:27.003708 2026] [:error] [pid 5536:tid 5618] [client 4.240.125.246:6871] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVt2owRtMZNG6xI8yDybfgAAAJU"]
[Mon Jan 05 16:30:27.275310 2026] [:error] [pid 28407:tid 28415] [client 4.240.125.246:6884] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVt2o9ercd3ptydUzM0H_wAAAYU"]
[Mon Jan 05 16:30:27.554085 2026] [:error] [pid 5536:tid 5615] [client 4.240.125.246:6878] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVt2owRtMZNG6xI8yDybggAAAJI"]
[Mon Jan 05 16:30:27.827225 2026] [:error] [pid 5536:tid 5605] [client 4.240.125.246:6738] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aVt2owRtMZNG6xI8yDybhQAAAIg"]
[Mon Jan 05 16:30:28.115151 2026] [:error] [pid 5536:tid 5620] [client 4.240.125.246:6751] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aVt2pARtMZNG6xI8yDybhgAAAJc"]
[Mon Jan 05 16:30:28.386215 2026] [:error] [pid 54081:tid 54099] [client 4.240.125.246:6849] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aVt2pFL4jLgtF-b9w4dIuAAAAU8"]
[Mon Jan 05 16:30:28.656587 2026] [:error] [pid 54081:tid 54091] [client 4.240.125.246:6759] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aVt2pFL4jLgtF-b9w4dIuQAAAUc"]
[Mon Jan 05 16:30:28.940057 2026] [:error] [pid 5534:tid 5547] [client 4.240.125.246:6831] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVt2pJNs9XmbR6unB0xpGwAAAAQ"]
[Mon Jan 05 16:30:29.214845 2026] [:error] [pid 5536:tid 5598] [client 4.240.125.246:6802] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVt2pQRtMZNG6xI8yDybigAAAIE"]
[Mon Jan 05 16:30:29.485905 2026] [:error] [pid 5632:tid 5658] [client 4.240.125.246:6841] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVt2pYN3ZWvlOh-nbt-JUQAAAM4"]
[Mon Jan 05 16:30:29.777367 2026] [:error] [pid 5632:tid 5648] [client 4.240.125.246:6882] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aVt2pYN3ZWvlOh-nbt-JUgAAAMQ"]
[Mon Jan 05 16:30:30.048286 2026] [:error] [pid 6680:tid 6692] [client 4.240.125.246:6824] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVt2pqE58uNoazzTmx2tkAAAAQo"]
[Mon Jan 05 16:30:30.346208 2026] [:error] [pid 54081:tid 54086] [client 4.240.125.246:6774] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVt2plL4jLgtF-b9w4dIvQAAAUI"]
[Mon Jan 05 16:30:30.654492 2026] [:error] [pid 5535:tid 5572] [client 4.240.125.246:6901] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVt2pmnkedMjhVX0PTU5HgAAAEI"]
[Mon Jan 05 16:30:30.945393 2026] [:error] [pid 5534:tid 5554] [client 4.240.125.246:6815] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVt2ppNs9XmbR6unB0xpIAAAAAs"]
[Mon Jan 05 16:30:31.221165 2026] [:error] [pid 54081:tid 54095] [client 4.240.125.246:6720] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVt2p1L4jLgtF-b9w4dIwQAAAUs"]
[Mon Jan 05 16:30:31.494481 2026] [:error] [pid 5534:tid 5543] [client 4.240.125.246:6816] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVt2p5Ns9XmbR6unB0xpIQAAAAA"]
[Mon Jan 05 16:30:31.778941 2026] [:error] [pid 5632:tid 5662] [client 4.240.125.246:6659] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVt2p4N3ZWvlOh-nbt-JUwAAANI"]
[Mon Jan 05 16:30:32.049758 2026] [:error] [pid 5534:tid 5561] [client 4.240.125.246:6845] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aVt2qJNs9XmbR6unB0xpIwAAABI"]
[Mon Jan 05 16:30:32.320136 2026] [:error] [pid 5534:tid 5559] [client 4.240.125.246:6804] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVt2qJNs9XmbR6unB0xpJAAAABA"]
[Mon Jan 05 16:30:32.630433 2026] [:error] [pid 6680:tid 6689] [client 4.240.125.246:6833] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVt2qKE58uNoazzTmx2tlAAAAQc"]
[Mon Jan 05 16:30:32.901334 2026] [:error] [pid 5536:tid 5619] [client 4.240.125.246:7160] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVt2qARtMZNG6xI8yDybjwAAAJY"]
[Mon Jan 05 16:30:33.190442 2026] [:error] [pid 5632:tid 5644] [client 4.240.125.246:6965] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVt2qYN3ZWvlOh-nbt-JWAAAAMA"]
[Mon Jan 05 16:30:33.470738 2026] [:error] [pid 5536:tid 5611] [client 4.240.125.246:6848] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVt2qQRtMZNG6xI8yDybkQAAAI4"]
[Mon Jan 05 16:30:33.740058 2026] [:error] [pid 5534:tid 5544] [client 4.240.125.246:6818] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVt2qZNs9XmbR6unB0xpJQAAAAE"]
[Mon Jan 05 16:30:34.039177 2026] [:error] [pid 5535:tid 5587] [client 4.240.125.246:6858] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVt2qmnkedMjhVX0PTU5IgAAAFE"]
[Mon Jan 05 16:30:34.310773 2026] [:error] [pid 5535:tid 5586] [client 4.240.125.246:6828] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aVt2qmnkedMjhVX0PTU5IwAAAFA"]
[Mon Jan 05 16:30:34.590305 2026] [:error] [pid 5632:tid 5664] [client 4.240.125.246:6998] [client 4.240.125.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aVt2qoN3ZWvlOh-nbt-JWgAAANQ"]
[Mon Jan 05 16:30:34.892783 2026] [:error] [pid 6680:tid 6701] [client 4.240.125.246:6748] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVt2qqE58uNoazzTmx2tlQAAARM"]
[Mon Jan 05 16:30:35.190648 2026] [:error] [pid 5536:tid 5598] [client 4.240.125.246:6910] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVt2qwRtMZNG6xI8yDybkwAAAIE"]
[Mon Jan 05 16:30:35.468382 2026] [:error] [pid 5632:tid 5656] [client 4.240.125.246:6780] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVt2q4N3ZWvlOh-nbt-JXAAAAMw"]
[Mon Jan 05 16:30:35.739577 2026] [:error] [pid 28407:tid 28424] [client 4.240.125.246:6808] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aVt2q9ercd3ptydUzM0ICQAAAY0"]
[Mon Jan 05 16:30:36.032487 2026] [:error] [pid 5536:tid 5610] [client 4.240.125.246:6685] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aVt2rARtMZNG6xI8yDyblAAAAI0"]
[Mon Jan 05 16:30:36.304623 2026] [:error] [pid 5534:tid 5563] [client 4.240.125.246:6866] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aVt2rJNs9XmbR6unB0xpKwAAABQ"]
[Mon Jan 05 16:30:36.585167 2026] [:error] [pid 5534:tid 5567] [client 4.240.125.246:6973] [client 4.240.125.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aVt2rJNs9XmbR6unB0xpLAAAABg"]
[Mon Jan 05 17:28:02.472438 2026] [:error] [pid 5632:tid 5650] [client 125.75.66.97:55967] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVuEIoN3ZWvlOh-nbt-a1QAAAMY"]
[Mon Jan 05 17:43:25.131789 2026] [:error] [pid 5536:tid 5608] [client 43.130.139.136:45790] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVuHvQRtMZNG6xI8yDy3cAAAAIs"]
[Mon Jan 05 19:18:05.872827 2026] [:error] [pid 54081:tid 54089] [client 4.188.235.115:19853] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Mon Jan 05 19:18:06.012915 2026] [:error] [pid 54081:tid 54106] [client 4.188.235.115:19853] File does not exist: /usr/local/apache/htdocs/suspended-page/990.php
[Mon Jan 05 19:18:06.154879 2026] [:error] [pid 54081:tid 54090] [client 4.188.235.115:19853] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Mon Jan 05 19:18:06.296207 2026] [:error] [pid 54081:tid 54102] [client 4.188.235.115:19853] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Mon Jan 05 22:28:42.584045 2026] [:error] [pid 5536:tid 5616] [client 20.89.211.88:40391] [client 20.89.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVvKmgRtMZNG6xI8yDwXhgAAAJM"]
[Mon Jan 05 22:28:43.725828 2026] [:error] [pid 6680:tid 6689] [client 20.89.211.88:40443] [client 20.89.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVvKm6E58uNoazzTmx0b4wAAAQc"]
[Mon Jan 05 22:28:44.652637 2026] [:error] [pid 5535:tid 5571] [client 20.89.211.88:20723] [client 20.89.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVvKnGnkedMjhVX0PTWTggAAAEE"]
[Mon Jan 05 22:28:46.107287 2026] [:error] [pid 28407:tid 28419] [client 20.89.211.88:15030] [client 20.89.211.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aVvKntercd3ptydUzM1wrwAAAYg"]
[Mon Jan 05 22:40:06.976061 2026] [:error] [pid 5535:tid 5579] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Mon Jan 05 22:40:07.114154 2026] [:error] [pid 5535:tid 5592] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Mon Jan 05 22:40:07.239600 2026] [:error] [pid 5535:tid 5590] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Mon Jan 05 22:40:07.360681 2026] [:error] [pid 5535:tid 5585] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Mon Jan 05 22:40:07.482637 2026] [:error] [pid 5535:tid 5594] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Mon Jan 05 22:40:07.813504 2026] [:error] [pid 5535:tid 5578] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Mon Jan 05 22:40:07.953471 2026] [:error] [pid 5535:tid 5576] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Mon Jan 05 22:40:08.074877 2026] [:error] [pid 5535:tid 5587] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Mon Jan 05 22:40:08.203098 2026] [:error] [pid 5535:tid 5588] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Mon Jan 05 22:40:08.324167 2026] [:error] [pid 5535:tid 5571] [client 20.205.40.135:33928] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Mon Jan 05 22:40:08.441667 2026] [:error] [pid 5535:tid 5575] [client 20.205.40.135:33928] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvNSGnkedMjhVX0PTWXTQAAAEU"]
[Mon Jan 05 22:40:15.323455 2026] [:error] [pid 5632:tid 5655] [client 20.205.40.135:29964] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvNT4N3ZWvlOh-nbt_vCwAAAMs"]
[Mon Jan 05 22:40:16.824840 2026] [:error] [pid 5536:tid 5620] [client 20.205.40.135:58033] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvNUARtMZNG6xI8yDwbSwAAAJc"]
[Mon Jan 05 22:40:18.307542 2026] [:error] [pid 6680:tid 6689] [client 20.205.40.135:63790] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvNUqE58uNoazzTmx0f3AAAAQc"]
[Mon Jan 05 22:40:21.229687 2026] [:error] [pid 5534:tid 5561] [client 20.205.40.135:29661] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvNVZNs9XmbR6unB0wJ-gAAABI"]
[Mon Jan 05 22:40:22.138032 2026] [:error] [pid 5534:tid 5545] [client 20.205.40.135:33981] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvNVpNs9XmbR6unB0wJ_wAAAAI"]
[Mon Jan 05 22:40:24.725266 2026] [:error] [pid 6680:tid 6690] [client 20.205.40.135:33966] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvNWKE58uNoazzTmx0f6QAAAQg"]
[Mon Jan 05 22:40:29.294982 2026] [:error] [pid 5534:tid 5566] [client 20.205.40.135:61792] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvNXZNs9XmbR6unB0wKEwAAABc"]
[Mon Jan 05 22:40:34.046366 2026] [:error] [pid 54081:tid 54094] [client 20.205.40.135:54728] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvNYlL4jLgtF-b9w4erLwAAAUo"]
[Mon Jan 05 22:40:37.412886 2026] [:error] [pid 5535:tid 5586] [client 20.205.40.135:58007] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvNZWnkedMjhVX0PTWXbAAAAFA"]
[Mon Jan 05 22:40:38.812716 2026] [:error] [pid 5632:tid 5648] [client 20.205.40.135:54727] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvNZoN3ZWvlOh-nbt_vOAAAAMQ"]
[Mon Jan 05 22:40:40.504674 2026] [:error] [pid 5534:tid 5543] [client 20.205.40.135:29679] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvNaJNs9XmbR6unB0wKJQAAAAA"]
[Mon Jan 05 22:40:41.263977 2026] [:error] [pid 5632:tid 5664] [client 20.205.40.135:33942] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVvNaYN3ZWvlOh-nbt_vPAAAANQ"]
[Mon Jan 05 22:40:51.064786 2026] [:error] [pid 5536:tid 5617] [client 20.205.40.135:33946] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVvNcwRtMZNG6xI8yDwbgwAAAJQ"]
[Mon Jan 05 22:40:53.063981 2026] [:error] [pid 5534:tid 5565] [client 20.205.40.135:54263] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVvNdZNs9XmbR6unB0wKRAAAABY"]
[Mon Jan 05 22:40:58.138916 2026] [:error] [pid 5534:tid 5553] [client 20.205.40.135:11029] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVvNepNs9XmbR6unB0wKTgAAAAo"]
[Mon Jan 05 22:41:35.540698 2026] [:error] [pid 5535:tid 5589] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Mon Jan 05 22:41:35.660834 2026] [:error] [pid 5535:tid 5583] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Mon Jan 05 22:41:35.814971 2026] [:error] [pid 5535:tid 5573] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/msy.php
[Mon Jan 05 22:41:35.987976 2026] [:error] [pid 5535:tid 5579] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/alog.php
[Mon Jan 05 22:41:36.108347 2026] [:error] [pid 5535:tid 5582] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/X7T6.php
[Mon Jan 05 22:41:36.229084 2026] [:error] [pid 5535:tid 5576] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Mon Jan 05 22:41:36.357796 2026] [:error] [pid 5535:tid 5592] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Mon Jan 05 22:41:36.493489 2026] [:error] [pid 5535:tid 5588] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Mon Jan 05 22:41:36.614752 2026] [:error] [pid 5535:tid 5587] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Mon Jan 05 22:41:36.735624 2026] [:error] [pid 5535:tid 5575] [client 20.205.40.135:11023] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Mon Jan 05 23:04:11.975124 2026] [:error] [pid 5534:tid 5566] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Mon Jan 05 23:04:12.083739 2026] [:error] [pid 5534:tid 5544] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Mon Jan 05 23:04:13.538225 2026] [:error] [pid 5534:tid 5544] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Mon Jan 05 23:04:13.629047 2026] [:error] [pid 5534:tid 5564] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Mon Jan 05 23:04:13.728263 2026] [:error] [pid 5534:tid 5559] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Mon Jan 05 23:04:13.821099 2026] [:error] [pid 5534:tid 5551] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Mon Jan 05 23:04:13.911609 2026] [:error] [pid 5534:tid 5560] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Mon Jan 05 23:04:14.009219 2026] [:error] [pid 5534:tid 5548] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Mon Jan 05 23:04:14.099697 2026] [:error] [pid 5534:tid 5558] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Mon Jan 05 23:04:14.202438 2026] [:error] [pid 5534:tid 5565] [client 4.193.229.169:32924] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Mon Jan 05 23:04:14.297050 2026] [:error] [pid 5534:tid 5561] [client 4.193.229.169:32924] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvS7pNs9XmbR6unB0wTigAAABI"]
[Mon Jan 05 23:04:17.825205 2026] [:error] [pid 5534:tid 5545] [client 4.193.229.169:32212] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvS8ZNs9XmbR6unB0wTkgAAAAI"]
[Mon Jan 05 23:04:19.879682 2026] [:error] [pid 54081:tid 54089] [client 4.193.229.169:29217] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvS81L4jLgtF-b9w4eyEwAAAUU"]
[Mon Jan 05 23:04:23.080076 2026] [:error] [pid 5535:tid 5589] [client 4.193.229.169:31551] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aVvS92nkedMjhVX0PTWdgAAAAFM"]
[Mon Jan 05 23:04:24.859678 2026] [:error] [pid 5632:tid 5663] [client 4.193.229.169:31497] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvS-IN3ZWvlOh-nbt_1ggAAANM"]
[Mon Jan 05 23:04:25.597615 2026] [:error] [pid 5632:tid 5653] [client 4.193.229.169:50836] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvS-YN3ZWvlOh-nbt_1hAAAAMk"]
[Mon Jan 05 23:04:32.617982 2026] [:error] [pid 54081:tid 54108] [client 4.193.229.169:36065] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvTAFL4jLgtF-b9w4eyLQAAAVg"]
[Mon Jan 05 23:04:33.031315 2026] [:error] [pid 6680:tid 6695] [client 4.193.229.169:50865] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aVvTAaE58uNoazzTmx0oAQAAAQ0"]
[Mon Jan 05 23:04:33.631644 2026] [:error] [pid 5534:tid 5543] [client 4.193.229.169:50854] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvTAZNs9XmbR6unB0wTpAAAAAA"]
[Mon Jan 05 23:04:34.340081 2026] [:error] [pid 5632:tid 5655] [client 4.193.229.169:36047] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvTAoN3ZWvlOh-nbt_1igAAAMs"]
[Mon Jan 05 23:04:34.872270 2026] [:error] [pid 6680:tid 6688] [client 4.193.229.169:50841] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvTAqE58uNoazzTmx0oBAAAAQY"]
[Mon Jan 05 23:04:35.628950 2026] [:error] [pid 5632:tid 5662] [client 4.193.229.169:51114] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aVvTA4N3ZWvlOh-nbt_1iwAAANI"]
[Mon Jan 05 23:04:36.911347 2026] [:error] [pid 6680:tid 6703] [client 4.193.229.169:32898] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVvTBKE58uNoazzTmx0oCAAAARU"]
[Mon Jan 05 23:04:43.990717 2026] [:error] [pid 54081:tid 54092] [client 4.193.229.169:32214] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVvTC1L4jLgtF-b9w4eyQQAAAUg"]
[Mon Jan 05 23:04:46.390162 2026] [:error] [pid 5536:tid 5606] [client 4.193.229.169:8222] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVvTDgRtMZNG6xI8yDwiPQAAAIk"]
[Mon Jan 05 23:04:47.504090 2026] [:error] [pid 54081:tid 54095] [client 4.193.229.169:29191] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aVvTD1L4jLgtF-b9w4eySwAAAUs"]
[Mon Jan 05 23:04:50.180434 2026] [:error] [pid 5535:tid 5576] [client 4.193.229.169:31528] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVvTEmnkedMjhVX0PTWdkAAAAEY"]
[Mon Jan 05 23:04:50.853742 2026] [:error] [pid 54081:tid 54084] [client 4.193.229.169:33734] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVvTElL4jLgtF-b9w4eyUAAAAUA"]
[Mon Jan 05 23:04:53.691013 2026] [:error] [pid 54081:tid 54100] [client 4.193.229.169:32955] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVvTFVL4jLgtF-b9w4eyVgAAAVA"]
[Mon Jan 05 23:05:00.448697 2026] [:error] [pid 6680:tid 6688] [client 4.193.229.169:32919] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aVvTHKE58uNoazzTmx0oVgAAAQY"]
[Mon Jan 05 23:05:03.105385 2026] [:error] [pid 6680:tid 6701] [client 4.193.229.169:31536] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVvTH6E58uNoazzTmx0oWgAAARM"]
[Mon Jan 05 23:05:05.901170 2026] [:error] [pid 54081:tid 54107] [client 4.193.229.169:31515] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVvTIVL4jLgtF-b9w4eybgAAAVc"]
[Mon Jan 05 23:05:09.710479 2026] [:error] [pid 6680:tid 6698] [client 4.193.229.169:32926] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVvTJaE58uNoazzTmx0obAAAARA"]
[Mon Jan 05 23:05:11.356276 2026] [:error] [pid 54081:tid 54088] [client 4.193.229.169:32935] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaje.php"] [unique_id "aVvTJ1L4jLgtF-b9w4eydQAAAUQ"]
[Mon Jan 05 23:05:12.675313 2026] [:error] [pid 5534:tid 5546] [client 4.193.229.169:32208] [client 4.193.229.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blnux.php"] [unique_id "aVvTKJNs9XmbR6unB0wT4wAAAAM"]
[Mon Jan 05 23:05:16.001649 2026] [:error] [pid 5632:tid 5653] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Mon Jan 05 23:05:16.101262 2026] [:error] [pid 5632:tid 5648] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Mon Jan 05 23:05:16.190997 2026] [:error] [pid 5632:tid 5650] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/msy.php
[Mon Jan 05 23:05:16.416977 2026] [:error] [pid 5632:tid 5661] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/alog.php
[Mon Jan 05 23:05:16.507024 2026] [:error] [pid 5632:tid 5664] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/X7T6.php
[Mon Jan 05 23:05:16.616312 2026] [:error] [pid 5632:tid 5666] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Mon Jan 05 23:05:16.707323 2026] [:error] [pid 5632:tid 5645] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Mon Jan 05 23:05:16.795424 2026] [:error] [pid 5632:tid 5644] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Mon Jan 05 23:05:16.896696 2026] [:error] [pid 5632:tid 5646] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Mon Jan 05 23:05:16.988727 2026] [:error] [pid 5632:tid 5655] [client 4.193.229.169:31547] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Mon Jan 05 23:29:35.551258 2026] [:error] [pid 54081:tid 54099] [client 43.131.45.213:54288] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVvY31L4jLgtF-b9w4e4hgAAAU8"]
[Mon Jan 05 23:55:08.760429 2026] [:error] [pid 5535:tid 5588] [client 60.188.57.0:54969] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVve3GnkedMjhVX0PTWr_wAAAFI"]
[Tue Jan 06 00:13:15.931824 2026] [:error] [pid 60514:tid 60598] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/mda.php
[Tue Jan 06 00:13:16.071175 2026] [:error] [pid 60514:tid 60585] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/cheka.php
[Tue Jan 06 00:13:16.211120 2026] [:error] [pid 60514:tid 60577] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Tue Jan 06 00:13:16.353613 2026] [:error] [pid 60514:tid 60588] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Tue Jan 06 00:13:16.520768 2026] [:error] [pid 60514:tid 60578] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/zsz.php
[Tue Jan 06 00:13:16.673259 2026] [:error] [pid 60514:tid 60587] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/kaza.php
[Tue Jan 06 00:13:17.290358 2026] [:error] [pid 60514:tid 60595] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/lites.php
[Tue Jan 06 00:13:17.449255 2026] [:error] [pid 60514:tid 60594] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/bby.php
[Tue Jan 06 00:13:17.604705 2026] [:error] [pid 60514:tid 60597] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/get.php
[Tue Jan 06 00:13:17.766696 2026] [:error] [pid 60514:tid 60582] [client 20.214.243.233:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/xtride.php
[Tue Jan 06 00:13:18.726859 2026] [:error] [pid 60514:tid 60576] [client 20.214.243.233:12435] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aVvjHm70C0kefOIBEs9JegAAAME"]
[Tue Jan 06 00:13:20.020396 2026] [:error] [pid 60605:tid 60626] [client 20.214.243.233:12337] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aVvjIJGdDsTlcaRtgxQs_QAAARM"]
[Tue Jan 06 00:13:20.376014 2026] [:error] [pid 60509:tid 60533] [client 20.214.243.233:12439] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aVvjIKBSiT1_wVwKSvQQwAAAAEw"]
[Tue Jan 06 00:13:21.453126 2026] [:error] [pid 60605:tid 60622] [client 20.214.243.233:12373] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aVvjIZGdDsTlcaRtgxQtAgAAAQ8"]
[Tue Jan 06 00:13:22.832387 2026] [:error] [pid 60514:tid 60585] [client 20.214.243.233:12332] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aVvjIm70C0kefOIBEs9JgwAAAMo"]
[Tue Jan 06 00:13:25.968924 2026] [:error] [pid 60605:tid 60628] [client 20.214.243.233:12320] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aVvjJZGdDsTlcaRtgxQtDwAAARU"]
[Tue Jan 06 00:13:28.573243 2026] [:error] [pid 60510:tid 60554] [client 20.214.243.233:12301] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aVvjKG3HNEkuMRrTL0L5mgAAAIY"]
[Tue Jan 06 00:13:29.730953 2026] [:error] [pid 60514:tid 60590] [client 20.214.243.233:12303] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aVvjKW70C0kefOIBEs9JjwAAAM8"]
[Tue Jan 06 00:13:33.964368 2026] [:error] [pid 60605:tid 60627] [client 20.214.243.233:12418] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s11.php"] [unique_id "aVvjLZGdDsTlcaRtgxQtMQAAARQ"]
[Tue Jan 06 00:13:37.955967 2026] [:error] [pid 60514:tid 60585] [client 20.214.243.233:12338] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s11.php"] [unique_id "aVvjMW70C0kefOIBEs9JngAAAMo"]
[Tue Jan 06 00:13:38.301509 2026] [:error] [pid 60509:tid 60538] [client 20.214.243.233:12321] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s11.php"] [unique_id "aVvjMqBSiT1_wVwKSvQQ2gAAAFE"]
[Tue Jan 06 00:13:38.693061 2026] [:error] [pid 60509:tid 60539] [client 20.214.243.233:12447] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s11.php"] [unique_id "aVvjMqBSiT1_wVwKSvQQ2wAAAFI"]
[Tue Jan 06 00:13:39.397622 2026] [:error] [pid 60509:tid 60525] [client 20.214.243.233:12316] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dir.php"] [unique_id "aVvjM6BSiT1_wVwKSvQQ3gAAAEQ"]
[Tue Jan 06 00:13:40.031541 2026] [:error] [pid 60514:tid 60596] [client 20.214.243.233:12362] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dir.php"] [unique_id "aVvjNG70C0kefOIBEs9JpQAAANU"]
[Tue Jan 06 00:13:40.726342 2026] [:error] [pid 60514:tid 60576] [client 20.214.243.233:12314] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dir.php"] [unique_id "aVvjNG70C0kefOIBEs9JqAAAAME"]
[Tue Jan 06 00:13:41.658838 2026] [:error] [pid 60514:tid 60594] [client 20.214.243.233:12445] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dir.php"] [unique_id "aVvjNW70C0kefOIBEs9JqwAAANM"]
[Tue Jan 06 00:13:43.882113 2026] [:error] [pid 60514:tid 60598] [client 20.214.243.233:12420] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aqw.php"] [unique_id "aVvjN270C0kefOIBEs9JswAAANc"]
[Tue Jan 06 00:13:46.664287 2026] [:error] [pid 60509:tid 60543] [client 20.214.243.233:12304] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aqw.php"] [unique_id "aVvjOqBSiT1_wVwKSvQQ7AAAAFY"]
[Tue Jan 06 00:13:49.017976 2026] [:error] [pid 60605:tid 60622] [client 20.214.243.233:12431] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aqw.php"] [unique_id "aVvjPZGdDsTlcaRtgxQtTQAAAQ8"]
[Tue Jan 06 00:13:51.932588 2026] [:error] [pid 60605:tid 60627] [client 20.214.243.233:12340] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aqw.php"] [unique_id "aVvjP5GdDsTlcaRtgxQtVgAAARQ"]
[Tue Jan 06 00:13:55.129990 2026] [:error] [pid 60605:tid 60620] [client 20.214.243.233:12430] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ca1.php"] [unique_id "aVvjQ5GdDsTlcaRtgxQtXAAAAQ0"]
[Tue Jan 06 00:13:57.117070 2026] [:error] [pid 60514:tid 60594] [client 20.214.243.233:12297] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ca1.php"] [unique_id "aVvjRW70C0kefOIBEs9J2gAAANM"]
[Tue Jan 06 00:14:00.305608 2026] [:error] [pid 60605:tid 60607] [client 20.214.243.233:12313] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ca1.php"] [unique_id "aVvjSJGdDsTlcaRtgxQtZwAAAQA"]
[Tue Jan 06 00:14:02.553083 2026] [:error] [pid 60509:tid 60524] [client 20.214.243.233:12350] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ca1.php"] [unique_id "aVvjSqBSiT1_wVwKSvQQ-wAAAEM"]
[Tue Jan 06 00:14:04.853747 2026] [:error] [pid 60514:tid 60587] [client 20.214.243.233:12416] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file51.php"] [unique_id "aVvjTG70C0kefOIBEs9J8AAAAMw"]
[Tue Jan 06 00:14:06.555498 2026] [:error] [pid 60510:tid 60559] [client 20.214.243.233:12438] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file51.php"] [unique_id "aVvjTm3HNEkuMRrTL0L51QAAAIs"]
[Tue Jan 06 00:14:08.408803 2026] [:error] [pid 60605:tid 60631] [client 20.214.243.233:12460] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file51.php"] [unique_id "aVvjUJGdDsTlcaRtgxQteAAAARg"]
[Tue Jan 06 00:14:09.464536 2026] [:error] [pid 60509:tid 60521] [client 20.214.243.233:12311] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file51.php"] [unique_id "aVvjUaBSiT1_wVwKSvQRAAAAAEA"]
[Tue Jan 06 00:14:11.455976 2026] [:error] [pid 60510:tid 60552] [client 20.214.243.233:12346] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abouta.php"] [unique_id "aVvjU23HNEkuMRrTL0L53wAAAIQ"]
[Tue Jan 06 00:14:13.299220 2026] [:error] [pid 60510:tid 60564] [client 20.214.243.233:12300] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abouta.php"] [unique_id "aVvjVW3HNEkuMRrTL0L54wAAAJA"]
[Tue Jan 06 00:14:15.045053 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:12339] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abouta.php"] [unique_id "aVvjV5GdDsTlcaRtgxQtjQAAAQQ"]
[Tue Jan 06 00:14:16.633494 2026] [:error] [pid 60509:tid 60524] [client 20.214.243.233:12289] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abouta.php"] [unique_id "aVvjWKBSiT1_wVwKSvQREQAAAEM"]
[Tue Jan 06 00:14:17.897922 2026] [:error] [pid 60509:tid 60539] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/fclas.php
[Tue Jan 06 00:14:18.037745 2026] [:error] [pid 60509:tid 60535] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/File.php
[Tue Jan 06 00:14:18.182677 2026] [:error] [pid 60509:tid 60538] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/all.php
[Tue Jan 06 00:14:18.369362 2026] [:error] [pid 60509:tid 60533] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/bbn.php
[Tue Jan 06 00:14:18.513669 2026] [:error] [pid 60509:tid 60537] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/berlin.php
[Tue Jan 06 00:14:18.653891 2026] [:error] [pid 60509:tid 60526] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Tue Jan 06 00:14:18.793097 2026] [:error] [pid 60509:tid 60524] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/xz89.php
[Tue Jan 06 00:14:18.931579 2026] [:error] [pid 60509:tid 60521] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/thai.php
[Tue Jan 06 00:14:19.069913 2026] [:error] [pid 60509:tid 60536] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/lopst.php
[Tue Jan 06 00:14:19.213995 2026] [:error] [pid 60509:tid 60523] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/wft.php
[Tue Jan 06 00:14:19.354758 2026] [:error] [pid 60509:tid 60542] [client 20.214.243.233:12335] File does not exist: /usr/local/apache/htdocs/suspended-page/ws28.php
[Tue Jan 06 00:14:19.490746 2026] [:error] [pid 60509:tid 60539] [client 20.214.243.233:12335] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "aVvjW6BSiT1_wVwKSvQRJQAAAFI"]
[Tue Jan 06 00:14:20.657425 2026] [:error] [pid 60514:tid 60594] [client 20.214.243.233:12331] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "aVvjXG70C0kefOIBEs9KDgAAANM"]
[Tue Jan 06 00:14:21.843429 2026] [:error] [pid 60605:tid 60626] [client 20.214.243.233:12315] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "aVvjXZGdDsTlcaRtgxQtpQAAARM"]
[Tue Jan 06 00:14:22.578253 2026] [:error] [pid 60509:tid 60529] [client 20.214.243.233:12425] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "aVvjXqBSiT1_wVwKSvQRKAAAAEg"]
[Tue Jan 06 00:14:24.029971 2026] [:error] [pid 60510:tid 60561] [client 20.214.243.233:25159] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vbbn.php"] [unique_id "aVvjYG3HNEkuMRrTL0L59gAAAI0"]
[Tue Jan 06 00:14:25.903039 2026] [:error] [pid 60514:tid 60588] [client 20.214.243.233:12380] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vbbn.php"] [unique_id "aVvjYW70C0kefOIBEs9KGAAAAM0"]
[Tue Jan 06 00:14:26.836376 2026] [:error] [pid 60605:tid 60629] [client 20.214.243.233:12294] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vbbn.php"] [unique_id "aVvjYpGdDsTlcaRtgxQtvAAAARY"]
[Tue Jan 06 00:14:28.144022 2026] [:error] [pid 60605:tid 60623] [client 20.214.243.233:12329] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vbbn.php"] [unique_id "aVvjZJGdDsTlcaRtgxQtxQAAARA"]
[Tue Jan 06 00:14:29.767446 2026] [:error] [pid 60514:tid 60589] [client 20.214.243.233:12401] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pn.php"] [unique_id "aVvjZW70C0kefOIBEs9KIAAAAM4"]
[Tue Jan 06 00:14:31.228286 2026] [:error] [pid 60510:tid 60572] [client 20.214.243.233:12310] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pn.php"] [unique_id "aVvjZ23HNEkuMRrTL0L6BgAAAJg"]
[Tue Jan 06 00:14:32.273725 2026] [:error] [pid 60605:tid 60612] [client 20.214.243.233:12351] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pn.php"] [unique_id "aVvjaJGdDsTlcaRtgxQt2QAAAQU"]
[Tue Jan 06 00:14:33.702123 2026] [:error] [pid 60509:tid 60526] [client 20.214.243.233:12424] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pn.php"] [unique_id "aVvjaaBSiT1_wVwKSvQROwAAAEU"]
[Tue Jan 06 00:14:34.548480 2026] [:error] [pid 60605:tid 60621] [client 20.214.243.233:12451] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fz.php"] [unique_id "aVvjapGdDsTlcaRtgxQt3gAAAQ4"]
[Tue Jan 06 00:14:35.284865 2026] [:error] [pid 60605:tid 60620] [client 20.214.243.233:12434] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fz.php"] [unique_id "aVvja5GdDsTlcaRtgxQt4QAAAQ0"]
[Tue Jan 06 00:14:36.168138 2026] [:error] [pid 60605:tid 60616] [client 20.214.243.233:12432] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fz.php"] [unique_id "aVvjbJGdDsTlcaRtgxQt5AAAAQk"]
[Tue Jan 06 00:14:37.000293 2026] [:error] [pid 60514:tid 60580] [client 20.214.243.233:12442] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fz.php"] [unique_id "aVvjbG70C0kefOIBEs9KJgAAAMU"]
[Tue Jan 06 00:14:37.745736 2026] [:error] [pid 60514:tid 60597] [client 20.214.243.233:12472] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sang.php"] [unique_id "aVvjbW70C0kefOIBEs9KKAAAANY"]
[Tue Jan 06 00:14:38.247278 2026] [:error] [pid 60514:tid 60589] [client 20.214.243.233:12319] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sang.php"] [unique_id "aVvjbm70C0kefOIBEs9KKgAAAM4"]
[Tue Jan 06 00:14:39.743745 2026] [:error] [pid 60510:tid 60559] [client 20.214.243.233:12308] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sang.php"] [unique_id "aVvjb23HNEkuMRrTL0L6FQAAAIs"]
[Tue Jan 06 00:14:40.775781 2026] [:error] [pid 60510:tid 60553] [client 20.214.243.233:12307] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sang.php"] [unique_id "aVvjcG3HNEkuMRrTL0L6GAAAAIU"]
[Tue Jan 06 00:14:42.910528 2026] [:error] [pid 60510:tid 60552] [client 20.214.243.233:12288] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0o0.php"] [unique_id "aVvjcm3HNEkuMRrTL0L6HQAAAIQ"]
[Tue Jan 06 00:14:45.117801 2026] [:error] [pid 60605:tid 60610] [client 20.214.243.233:12348] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0o0.php"] [unique_id "aVvjdZGdDsTlcaRtgxQt-gAAAQM"]
[Tue Jan 06 00:14:47.573946 2026] [:error] [pid 60605:tid 60620] [client 20.214.243.233:12374] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0o0.php"] [unique_id "aVvjd5GdDsTlcaRtgxQt_gAAAQ0"]
[Tue Jan 06 00:14:48.522463 2026] [:error] [pid 60509:tid 60538] [client 20.214.243.233:12429] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0o0.php"] [unique_id "aVvjeKBSiT1_wVwKSvQRYQAAAFE"]
[Tue Jan 06 00:14:50.390643 2026] [:error] [pid 60510:tid 60567] [client 20.214.243.233:12448] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxl.php"] [unique_id "aVvjem3HNEkuMRrTL0L6KAAAAJM"]
[Tue Jan 06 00:14:52.026207 2026] [:error] [pid 60509:tid 60531] [client 20.214.243.233:12309] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxl.php"] [unique_id "aVvjfKBSiT1_wVwKSvQRZQAAAEo"]
[Tue Jan 06 00:14:53.929868 2026] [:error] [pid 60514:tid 60577] [client 20.214.243.233:12327] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxl.php"] [unique_id "aVvjfW70C0kefOIBEs9KQgAAAMI"]
[Tue Jan 06 00:14:55.284759 2026] [:error] [pid 60510:tid 60570] [client 20.214.243.233:12317] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zxl.php"] [unique_id "aVvjf23HNEkuMRrTL0L6LAAAAJY"]
[Tue Jan 06 00:14:57.486477 2026] [:error] [pid 60510:tid 60551] [client 20.214.243.233:12354] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aVvjgW3HNEkuMRrTL0L6LwAAAIM"]
[Tue Jan 06 00:14:59.195271 2026] [:error] [pid 60514:tid 60590] [client 20.214.243.233:12419] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aVvjg270C0kefOIBEs9KRwAAAM8"]
[Tue Jan 06 00:15:00.672967 2026] [:error] [pid 60510:tid 60565] [client 20.214.243.233:12384] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aVvjhG3HNEkuMRrTL0L6MwAAAJE"]
[Tue Jan 06 00:15:02.816776 2026] [:error] [pid 60510:tid 60562] [client 20.214.243.233:12344] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwso.php"] [unique_id "aVvjhm3HNEkuMRrTL0L6NwAAAI4"]
[Tue Jan 06 00:15:05.655174 2026] [:error] [pid 60605:tid 60627] [client 20.214.243.233:12305] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVvjiZGdDsTlcaRtgxQuDwAAARQ"]
[Tue Jan 06 00:15:10.399818 2026] [:error] [pid 60514:tid 60584] [client 20.214.243.233:12446] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVvjjm70C0kefOIBEs9KWAAAAMk"]
[Tue Jan 06 00:15:14.135271 2026] [:error] [pid 60605:tid 60608] [client 20.214.243.233:12325] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVvjkpGdDsTlcaRtgxQuLQAAAQE"]
[Tue Jan 06 00:15:16.191531 2026] [:error] [pid 60509:tid 60538] [client 20.214.243.233:12361] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVvjlKBSiT1_wVwKSvQRjgAAAFE"]
[Tue Jan 06 00:15:18.163372 2026] [:error] [pid 60605:tid 60626] [client 20.214.243.233:12355] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class19.php"] [unique_id "aVvjlpGdDsTlcaRtgxQuMQAAARM"]
[Tue Jan 06 00:15:19.635690 2026] [:error] [pid 60605:tid 60609] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Tue Jan 06 00:15:19.795849 2026] [:error] [pid 60605:tid 60631] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Tue Jan 06 00:15:19.935970 2026] [:error] [pid 60605:tid 60629] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Jan 06 00:15:20.106220 2026] [:error] [pid 60605:tid 60630] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Jan 06 00:15:20.245517 2026] [:error] [pid 60605:tid 60608] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Tue Jan 06 00:15:20.402598 2026] [:error] [pid 60605:tid 60621] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Jan 06 00:15:20.539845 2026] [:error] [pid 60605:tid 60614] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/tx1.php
[Tue Jan 06 00:15:20.685441 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/xv.php
[Tue Jan 06 00:15:20.830779 2026] [:error] [pid 60605:tid 60624] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/htaccess.php
[Tue Jan 06 00:15:20.969275 2026] [:error] [pid 60605:tid 60622] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/fv.php
[Tue Jan 06 00:15:21.110763 2026] [:error] [pid 60605:tid 60625] [client 20.214.243.233:12345] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Jan 06 00:15:21.265128 2026] [:error] [pid 60605:tid 60619] [client 20.214.243.233:12345] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aVvjmZGdDsTlcaRtgxQuQwAAAQw"]
[Tue Jan 06 00:15:23.818855 2026] [:error] [pid 60605:tid 60631] [client 20.214.243.233:12357] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aVvjm5GdDsTlcaRtgxQuSwAAARg"]
[Tue Jan 06 00:15:26.465879 2026] [:error] [pid 60605:tid 60620] [client 20.214.243.233:12436] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aVvjnpGdDsTlcaRtgxQuVAAAAQ0"]
[Tue Jan 06 00:15:28.519634 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:12426] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aVvjoJGdDsTlcaRtgxQuXwAAAQQ"]
[Tue Jan 06 00:15:29.378534 2026] [:error] [pid 60514:tid 60579] [client 20.214.243.233:12473] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aVvjoW70C0kefOIBEs9KdQAAAMQ"]
[Tue Jan 06 00:15:31.083449 2026] [:error] [pid 60509:tid 60542] [client 20.214.243.233:25163] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aVvjo6BSiT1_wVwKSvQRoAAAAFU"]
[Tue Jan 06 00:15:33.206942 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:12358] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aVvjpZGdDsTlcaRtgxQubgAAAQQ"]
[Tue Jan 06 00:15:36.325973 2026] [:error] [pid 60605:tid 60628] [client 20.214.243.233:12299] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aVvjqJGdDsTlcaRtgxQufgAAARU"]
[Tue Jan 06 00:15:44.646693 2026] [:error] [pid 60509:tid 60538] [client 20.214.243.233:12478] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aVvjsKBSiT1_wVwKSvQRrwAAAFE"]
[Tue Jan 06 00:15:45.027447 2026] [:error] [pid 60514:tid 60596] [client 20.214.243.233:12324] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aVvjsW70C0kefOIBEs9KhQAAANU"]
[Tue Jan 06 00:15:47.407802 2026] [:error] [pid 60510:tid 60551] [client 20.214.243.233:12381] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aVvjs23HNEkuMRrTL0L6cgAAAIM"]
[Tue Jan 06 00:15:48.861786 2026] [:error] [pid 60605:tid 60629] [client 20.214.243.233:12428] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aVvjtJGdDsTlcaRtgxQupgAAARY"]
[Tue Jan 06 00:15:49.952455 2026] [:error] [pid 60605:tid 60618] [client 20.214.243.233:12312] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aVvjtZGdDsTlcaRtgxQuqQAAAQs"]
[Tue Jan 06 00:15:51.566380 2026] [:error] [pid 60605:tid 60631] [client 20.214.243.233:12462] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aVvjt5GdDsTlcaRtgxQurAAAARg"]
[Tue Jan 06 00:15:53.787981 2026] [:error] [pid 60605:tid 60618] [client 20.214.243.233:12477] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aVvjuZGdDsTlcaRtgxQuswAAAQs"]
[Tue Jan 06 00:15:55.156378 2026] [:error] [pid 60605:tid 60612] [client 20.214.243.233:12421] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aVvju5GdDsTlcaRtgxQutAAAAQU"]
[Tue Jan 06 00:15:56.659191 2026] [:error] [pid 60514:tid 60593] [client 20.214.243.233:12323] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aVvjvG70C0kefOIBEs9KnQAAANI"]
[Tue Jan 06 00:15:58.575222 2026] [:error] [pid 60605:tid 60629] [client 20.214.243.233:12302] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aVvjvpGdDsTlcaRtgxQuugAAARY"]
[Tue Jan 06 00:16:00.375853 2026] [:error] [pid 60514:tid 60577] [client 20.214.243.233:25162] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aVvjwG70C0kefOIBEs9KpgAAAMI"]
[Tue Jan 06 00:16:02.297466 2026] [:error] [pid 60605:tid 60616] [client 20.214.243.233:12444] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aVvjwpGdDsTlcaRtgxQuxAAAAQk"]
[Tue Jan 06 00:16:05.473935 2026] [:error] [pid 60514:tid 60594] [client 20.214.243.233:12349] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aVvjxW70C0kefOIBEs9KtQAAANM"]
[Tue Jan 06 00:16:06.570966 2026] [:error] [pid 60605:tid 60620] [client 20.214.243.233:12293] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aVvjxpGdDsTlcaRtgxQuzwAAAQ0"]
[Tue Jan 06 00:16:08.075255 2026] [:error] [pid 60605:tid 60630] [client 20.214.243.233:12342] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aVvjyJGdDsTlcaRtgxQu1gAAARc"]
[Tue Jan 06 00:16:09.852714 2026] [:error] [pid 60605:tid 60613] [client 20.214.243.233:12454] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aVvjyZGdDsTlcaRtgxQu2wAAAQY"]
[Tue Jan 06 00:16:11.339428 2026] [:error] [pid 60510:tid 60564] [client 20.214.243.233:12364] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvjy23HNEkuMRrTL0L6igAAAJA"]
[Tue Jan 06 00:16:12.561827 2026] [:error] [pid 60605:tid 60630] [client 20.214.243.233:25175] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvjzJGdDsTlcaRtgxQu4QAAARc"]
[Tue Jan 06 00:16:13.674642 2026] [:error] [pid 60605:tid 60616] [client 20.214.243.233:25189] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvjzZGdDsTlcaRtgxQu4wAAAQk"]
[Tue Jan 06 00:16:15.925123 2026] [:error] [pid 60510:tid 60569] [client 20.214.243.233:12375] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvjz23HNEkuMRrTL0L6kwAAAJU"]
[Tue Jan 06 00:16:17.091214 2026] [:error] [pid 60605:tid 60624] [client 20.214.243.233:12441] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aVvj0ZGdDsTlcaRtgxQu7AAAARE"]
[Tue Jan 06 00:16:17.961240 2026] [:error] [pid 60510:tid 60564] [client 20.214.243.233:12479] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aVvj0W3HNEkuMRrTL0L6lQAAAJA"]
[Tue Jan 06 00:16:19.399531 2026] [:error] [pid 60605:tid 60613] [client 20.214.243.233:12367] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aVvj05GdDsTlcaRtgxQu8AAAAQY"]
[Tue Jan 06 00:16:21.602355 2026] [:error] [pid 60510:tid 60559] [client 20.214.243.233:25094] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Jan 06 00:16:22.890097 2026] [:error] [pid 60510:tid 60554] [client 20.214.243.233:25094] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Jan 06 00:16:23.029701 2026] [:error] [pid 60510:tid 60571] [client 20.214.243.233:25094] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Jan 06 00:16:23.171623 2026] [:error] [pid 60510:tid 60567] [client 20.214.243.233:25094] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Jan 06 00:16:23.311135 2026] [:error] [pid 60510:tid 60572] [client 20.214.243.233:25094] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Jan 06 00:16:23.493345 2026] [:error] [pid 60510:tid 60549] [client 20.214.243.233:25094] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Jan 06 00:16:23.631087 2026] [:error] [pid 60510:tid 60550] [client 20.214.243.233:25094] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aVvj123HNEkuMRrTL0L6qgAAAII"]
[Tue Jan 06 00:16:25.272696 2026] [:error] [pid 60605:tid 60607] [client 20.214.243.233:12343] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Jan 06 00:16:25.453066 2026] [:error] [pid 60605:tid 60622] [client 20.214.243.233:12343] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Jan 06 00:16:25.593281 2026] [:error] [pid 60605:tid 60619] [client 20.214.243.233:12343] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Jan 06 00:16:25.728602 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:12343] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aVvj2ZGdDsTlcaRtgxQu_gAAAQQ"]
[Tue Jan 06 00:16:27.091090 2026] [:error] [pid 60509:tid 60524] [client 20.214.243.233:12465] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aVvj26BSiT1_wVwKSvQR6QAAAEM"]
[Tue Jan 06 00:16:28.705789 2026] [:error] [pid 60510:tid 60560] [client 20.214.243.233:12443] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aVvj3G3HNEkuMRrTL0L6tAAAAIw"]
[Tue Jan 06 00:16:31.165662 2026] [:error] [pid 60514:tid 60587] [client 20.214.243.233:12452] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aVvj3270C0kefOIBEs9LBwAAAMw"]
[Tue Jan 06 00:16:34.446316 2026] [:error] [pid 60510:tid 60559] [client 20.214.243.233:12341] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aVvj4m3HNEkuMRrTL0L6wQAAAIs"]
[Tue Jan 06 00:16:37.219360 2026] [:error] [pid 60605:tid 60612] [client 20.214.243.233:12347] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aVvj5ZGdDsTlcaRtgxQvNQAAAQU"]
[Tue Jan 06 00:16:40.092773 2026] [:error] [pid 60510:tid 60552] [client 20.214.243.233:12427] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aVvj6G3HNEkuMRrTL0L6zwAAAIQ"]
[Tue Jan 06 00:16:42.135415 2026] [:error] [pid 60514:tid 60575] [client 20.214.243.233:12291] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aVvj6m70C0kefOIBEs9LTQAAAMA"]
[Tue Jan 06 00:16:44.972627 2026] [:error] [pid 60514:tid 60596] [client 20.214.243.233:12376] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aVvj7G70C0kefOIBEs9LUgAAANU"]
[Tue Jan 06 00:16:48.041714 2026] [:error] [pid 60510:tid 60554] [client 20.214.243.233:12330] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aVvj8G3HNEkuMRrTL0L64AAAAIY"]
[Tue Jan 06 00:16:51.409968 2026] [:error] [pid 60509:tid 60524] [client 20.214.243.233:12383] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aVvj86BSiT1_wVwKSvQSqQAAAEM"]
[Tue Jan 06 00:16:55.660991 2026] [:error] [pid 60510:tid 60570] [client 20.214.243.233:12459] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aVvj923HNEkuMRrTL0L64gAAAJY"]
[Tue Jan 06 00:16:57.750130 2026] [:error] [pid 60605:tid 60618] [client 20.214.243.233:12379] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVvj-ZGdDsTlcaRtgxQvkgAAAQs"]
[Tue Jan 06 00:16:59.872978 2026] [:error] [pid 60605:tid 60623] [client 20.214.243.233:25155] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVvj-5GdDsTlcaRtgxQvnQAAARA"]
[Tue Jan 06 00:17:02.407322 2026] [:error] [pid 60605:tid 60607] [client 20.214.243.233:12433] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVvj_pGdDsTlcaRtgxQvqQAAAQA"]
[Tue Jan 06 00:17:04.870767 2026] [:error] [pid 60605:tid 60628] [client 20.214.243.233:12422] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aVvkAJGdDsTlcaRtgxQvtQAAARU"]
[Tue Jan 06 00:17:07.483647 2026] [:error] [pid 60509:tid 60540] [client 20.214.243.233:12410] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aVvkA6BSiT1_wVwKSvQS0gAAAFM"]
[Tue Jan 06 00:17:10.228784 2026] [:error] [pid 60514:tid 60584] [client 20.214.243.233:12390] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aVvkBm70C0kefOIBEs9LhgAAAMk"]
[Tue Jan 06 00:17:11.640652 2026] [:error] [pid 60509:tid 60537] [client 20.214.243.233:25195] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aVvkB6BSiT1_wVwKSvQS4QAAAFA"]
[Tue Jan 06 00:17:13.611050 2026] [:error] [pid 60605:tid 60619] [client 20.214.243.233:12326] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aVvkCZGdDsTlcaRtgxQvyQAAAQw"]
[Tue Jan 06 00:17:15.191310 2026] [:error] [pid 60605:tid 60630] [client 20.214.243.233:12476] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVvkC5GdDsTlcaRtgxQvzAAAARc"]
[Tue Jan 06 00:17:16.866946 2026] [:error] [pid 60509:tid 60541] [client 20.214.243.233:12298] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVvkDKBSiT1_wVwKSvQS7AAAAFQ"]
[Tue Jan 06 00:17:18.519701 2026] [:error] [pid 60514:tid 60577] [client 20.214.243.233:12385] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVvkDm70C0kefOIBEs9LngAAAMI"]
[Tue Jan 06 00:17:20.514143 2026] [:error] [pid 60510:tid 60554] [client 20.214.243.233:12292] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVvkEG3HNEkuMRrTL0L6-AAAAIY"]
[Tue Jan 06 00:17:24.537228 2026] [:error] [pid 60510:tid 60556] [client 20.214.243.233:12461] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aVvkFG3HNEkuMRrTL0L6_wAAAIg"]
[Tue Jan 06 00:17:25.787256 2026] [:error] [pid 60605:tid 60609] [client 20.214.243.233:12475] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Jan 06 00:17:26.823000 2026] [:error] [pid 60605:tid 60610] [client 20.214.243.233:12475] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue Jan 06 00:17:26.971710 2026] [:error] [pid 60605:tid 60614] [client 20.214.243.233:12475] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Jan 06 00:17:27.117123 2026] [:error] [pid 60605:tid 60621] [client 20.214.243.233:12475] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Jan 06 00:17:27.296608 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:12475] File does not exist: /usr/local/apache/htdocs/suspended-page/about3.php
[Tue Jan 06 00:17:29.004623 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:12475] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Jan 06 00:17:29.141927 2026] [:error] [pid 60605:tid 60617] [client 20.214.243.233:12475] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Jan 06 00:17:29.285254 2026] [:error] [pid 60605:tid 60622] [client 20.214.243.233:12475] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aVvkGZGdDsTlcaRtgxQwAAAAAQ8"]
[Tue Jan 06 00:17:31.332916 2026] [:error] [pid 60510:tid 60554] [client 20.214.243.233:12412] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aVvkG23HNEkuMRrTL0L7DwAAAIY"]
[Tue Jan 06 00:17:40.095912 2026] [:error] [pid 60514:tid 60592] [client 20.214.243.233:12371] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aVvkJG70C0kefOIBEs9L2AAAANE"]
[Tue Jan 06 00:17:51.219017 2026] [:error] [pid 29187:tid 29191] [client 20.214.243.233:12453] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVvkL4SYYRtfmMXGZCp07wAAAAI"]
[Tue Jan 06 00:17:51.923584 2026] [:error] [pid 29187:tid 29201] [client 20.214.243.233:12437] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVvkL4SYYRtfmMXGZCp09QAAAAw"]
[Tue Jan 06 00:17:55.479111 2026] [:error] [pid 60514:tid 60587] [client 20.214.243.233:12391] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVvkM270C0kefOIBEs9L-gAAAMw"]
[Tue Jan 06 00:17:59.598670 2026] [:error] [pid 60510:tid 60572] [client 20.214.243.233:25191] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aVvkN23HNEkuMRrTL0L7ZQAAAJg"]
[Tue Jan 06 00:18:03.188245 2026] [:error] [pid 60509:tid 60533] [client 20.214.243.233:12353] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aVvkO6BSiT1_wVwKSvQTagAAAEw"]
[Tue Jan 06 00:18:05.151501 2026] [:error] [pid 29187:tid 29212] [client 20.214.243.233:25185] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aVvkPYSYYRtfmMXGZCp1YgAAABc"]
[Tue Jan 06 00:18:06.529957 2026] [:error] [pid 60510:tid 60572] [client 20.214.243.233:12423] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aVvkPm3HNEkuMRrTL0L7dQAAAJg"]
[Tue Jan 06 00:18:08.673375 2026] [:error] [pid 29187:tid 29199] [client 20.214.243.233:12400] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aVvkQISYYRtfmMXGZCp1dAAAAAo"]
[Tue Jan 06 00:18:10.452896 2026] [:error] [pid 29187:tid 29204] [client 20.214.243.233:12439] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVvkQoSYYRtfmMXGZCp1dwAAAA8"]
[Tue Jan 06 00:18:15.102409 2026] [:error] [pid 60509:tid 60529] [client 20.214.243.233:12403] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVvkR6BSiT1_wVwKSvQTmwAAAEg"]
[Tue Jan 06 00:18:17.479433 2026] [:error] [pid 60605:tid 60614] [client 20.214.243.233:12397] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVvkSZGdDsTlcaRtgxQwuwAAAQc"]
[Tue Jan 06 00:18:30.161823 2026] [:error] [pid 60509:tid 60539] [client 20.214.243.233:25099] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Jan 06 00:18:30.323170 2026] [:error] [pid 60509:tid 60540] [client 20.214.243.233:25099] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Jan 06 00:18:32.668373 2026] [:error] [pid 60509:tid 60525] [client 20.214.243.233:25099] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aVvkWKBSiT1_wVwKSvQTwgAAAEQ"]
[Tue Jan 06 00:18:34.190612 2026] [:error] [pid 60514:tid 60578] [client 20.214.243.233:12314] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aVvkWm70C0kefOIBEs9MRAAAAMM"]
[Tue Jan 06 00:18:36.200128 2026] [:error] [pid 60509:tid 60542] [client 20.214.243.233:12368] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aVvkXKBSiT1_wVwKSvQT0wAAAFU"]
[Tue Jan 06 00:18:38.258630 2026] [:error] [pid 60510:tid 60567] [client 20.214.243.233:12430] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aVvkXm3HNEkuMRrTL0L7twAAAJM"]
[Tue Jan 06 00:18:39.448539 2026] [:error] [pid 29187:tid 29206] [client 20.214.243.233:12417] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Tue Jan 06 00:18:39.974972 2026] [:error] [pid 29187:tid 29201] [client 20.214.243.233:12417] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVvkX4SYYRtfmMXGZCp1xgAAAAw"]
[Tue Jan 06 00:18:41.087630 2026] [:error] [pid 60514:tid 60592] [client 20.214.243.233:12359] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVvkYW70C0kefOIBEs9MVQAAANE"]
[Tue Jan 06 00:18:42.448349 2026] [:error] [pid 60514:tid 60575] [client 20.214.243.233:12389] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVvkYm70C0kefOIBEs9MWgAAAMA"]
[Tue Jan 06 00:18:44.283816 2026] [:error] [pid 60605:tid 60630] [client 20.214.243.233:12445] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVvkZJGdDsTlcaRtgxQxEgAAARc"]
[Tue Jan 06 00:18:49.859683 2026] [:error] [pid 60514:tid 60581] [client 20.214.243.233:25211] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVvkaW70C0kefOIBEs9MZgAAAMY"]
[Tue Jan 06 00:18:53.972133 2026] [:error] [pid 60514:tid 60596] [client 20.214.243.233:12463] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVvkbW70C0kefOIBEs9MbQAAANU"]
[Tue Jan 06 00:18:59.892056 2026] [:error] [pid 60514:tid 60597] [client 20.214.243.233:12331] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aVvkc270C0kefOIBEs9MfQAAANY"]
[Tue Jan 06 00:19:04.361953 2026] [:error] [pid 60509:tid 60527] [client 20.214.243.233:12360] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aVvkeKBSiT1_wVwKSvQT_gAAAEY"]
[Tue Jan 06 00:19:09.050358 2026] [:error] [pid 60605:tid 60617] [client 20.214.243.233:12311] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aVvkfZGdDsTlcaRtgxQxNQAAAQo"]
[Tue Jan 06 00:19:12.066738 2026] [:error] [pid 60605:tid 60630] [client 20.214.243.233:25183] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aVvkgJGdDsTlcaRtgxQxOgAAARc"]
[Tue Jan 06 00:19:15.322746 2026] [:error] [pid 60605:tid 60614] [client 20.214.243.233:12346] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aVvkg5GdDsTlcaRtgxQxPwAAAQc"]
[Tue Jan 06 00:19:16.316999 2026] [:error] [pid 29187:tid 29207] [client 20.214.243.233:12382] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aVvkhISYYRtfmMXGZCp2AAAAABI"]
[Tue Jan 06 00:19:19.771296 2026] [:error] [pid 60605:tid 60617] [client 20.214.243.233:12340] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aVvkh5GdDsTlcaRtgxQxSgAAAQo"]
[Tue Jan 06 00:19:23.475685 2026] [:error] [pid 29187:tid 29198] [client 20.214.243.233:25202] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aVvki4SYYRtfmMXGZCp2BQAAAAk"]
[Tue Jan 06 00:19:26.472611 2026] [:error] [pid 60605:tid 60621] [client 20.214.243.233:12474] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aVvkjpGdDsTlcaRtgxQxawAAAQ4"]
[Tue Jan 06 00:19:28.212512 2026] [:error] [pid 60510:tid 60551] [client 20.214.243.233:12442] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aVvkkG3HNEkuMRrTL0L8AAAAAIM"]
[Tue Jan 06 00:19:30.196654 2026] [:error] [pid 29187:tid 29199] [client 20.214.243.233:12377] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aVvkkoSYYRtfmMXGZCp2DAAAAAo"]
[Tue Jan 06 00:19:34.535974 2026] [:error] [pid 60605:tid 60625] [client 20.214.243.233:12472] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aVvklpGdDsTlcaRtgxQxhAAAARI"]
[Tue Jan 06 00:19:38.999388 2026] [:error] [pid 60605:tid 60621] [client 20.214.243.233:12301] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aVvkmpGdDsTlcaRtgxQxkgAAAQ4"]
[Tue Jan 06 00:19:41.039666 2026] [:error] [pid 60605:tid 60612] [client 20.214.243.233:12334] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aVvknZGdDsTlcaRtgxQxlgAAAQU"]
[Tue Jan 06 00:19:50.638001 2026] [:error] [pid 60509:tid 60534] [client 20.214.243.233:12434] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Jan 06 00:19:50.814732 2026] [:error] [pid 60509:tid 60538] [client 20.214.243.233:12434] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Tue Jan 06 00:19:50.967044 2026] [:error] [pid 60509:tid 60533] [client 20.214.243.233:12434] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Jan 06 00:19:51.103402 2026] [:error] [pid 60509:tid 60524] [client 20.214.243.233:12434] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Jan 06 00:19:51.267793 2026] [:error] [pid 60509:tid 60542] [client 20.214.243.233:12434] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVvkp6BSiT1_wVwKSvQUTgAAAFU"]
[Tue Jan 06 00:19:54.125680 2026] [:error] [pid 60509:tid 60545] [client 20.214.243.233:25181] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVvkqqBSiT1_wVwKSvQUVAAAAFg"]
[Tue Jan 06 00:19:56.391595 2026] [:error] [pid 60514:tid 60582] [client 20.214.243.233:12296] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVvkrG70C0kefOIBEs9M3wAAAMc"]
[Tue Jan 06 00:19:58.274642 2026] [:error] [pid 29187:tid 29198] [client 20.214.243.233:12318] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aVvkroSYYRtfmMXGZCp2XQAAAAk"]
[Tue Jan 06 00:20:03.289427 2026] [:error] [pid 60514:tid 60583] [client 20.214.243.233:12470] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ha.php"] [unique_id "aVvks270C0kefOIBEs9M7AAAAMg"]
[Tue Jan 06 00:20:05.356158 2026] [:error] [pid 29187:tid 29202] [client 20.214.243.233:12425] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ha.php"] [unique_id "aVvktYSYYRtfmMXGZCp2gAAAAA0"]
[Tue Jan 06 00:20:15.105020 2026] [:error] [pid 29187:tid 29195] [client 20.214.243.233:12456] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aVvkv4SYYRtfmMXGZCp2kwAAAAY"]
[Tue Jan 06 00:20:15.704769 2026] [:error] [pid 29187:tid 29208] [client 20.214.243.233:25173] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aVvkv4SYYRtfmMXGZCp2lgAAABM"]
[Tue Jan 06 00:20:16.610732 2026] [:error] [pid 29187:tid 29210] [client 20.214.243.233:12339] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aVvkwISYYRtfmMXGZCp2mgAAABU"]
[Tue Jan 06 00:20:18.155452 2026] [:error] [pid 60514:tid 60581] [client 20.214.243.233:12394] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aVvkwm70C0kefOIBEs9M_QAAAMY"]
[Tue Jan 06 00:20:20.290812 2026] [:error] [pid 60509:tid 60542] [client 20.214.243.233:12327] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aVvkxKBSiT1_wVwKSvQUawAAAFU"]
[Tue Jan 06 00:20:22.047481 2026] [:error] [pid 29187:tid 29201] [client 20.214.243.233:12440] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aVvkxoSYYRtfmMXGZCp2rAAAAAw"]
[Tue Jan 06 00:20:24.150945 2026] [:error] [pid 29187:tid 29191] [client 20.214.243.233:12290] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aVvkyISYYRtfmMXGZCp2rwAAAAI"]
[Tue Jan 06 00:20:25.103885 2026] [:error] [pid 60514:tid 60599] [client 20.214.243.233:12428] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aVvkyW70C0kefOIBEs9NBgAAANg"]
[Tue Jan 06 00:20:26.749786 2026] [:error] [pid 60510:tid 60571] [client 20.214.243.233:12426] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aVvkym3HNEkuMRrTL0L8XwAAAJc"]
[Tue Jan 06 00:20:28.055824 2026] [:error] [pid 60605:tid 60622] [client 20.214.243.233:12345] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aVvkzJGdDsTlcaRtgxQyKAAAAQ8"]
[Tue Jan 06 00:20:28.915815 2026] [:error] [pid 60605:tid 60611] [client 20.214.243.233:25157] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aVvkzJGdDsTlcaRtgxQyKwAAAQQ"]
[Tue Jan 06 00:20:31.541026 2026] [:error] [pid 60605:tid 60626] [client 20.214.243.233:12300] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aVvkz5GdDsTlcaRtgxQyNgAAARM"]
[Tue Jan 06 00:20:33.808107 2026] [:error] [pid 60605:tid 60628] [client 20.214.243.233:12333] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aVvk0ZGdDsTlcaRtgxQyOgAAARU"]
[Tue Jan 06 00:20:36.854110 2026] [:error] [pid 60510:tid 60562] [client 20.214.243.233:13258] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aVvk1G3HNEkuMRrTL0L8cwAAAI4"]
[Tue Jan 06 00:20:40.418872 2026] [:error] [pid 60605:tid 60622] [client 20.214.243.233:12332] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aVvk2JGdDsTlcaRtgxQyUQAAAQ8"]
[Tue Jan 06 00:20:46.386778 2026] [:error] [pid 60510:tid 60549] [client 20.214.243.233:12416] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aVvk3m3HNEkuMRrTL0L8hwAAAIE"]
[Tue Jan 06 00:20:49.894310 2026] [:error] [pid 60509:tid 60529] [client 20.214.243.233:12418] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aVvk4aBSiT1_wVwKSvQUoAAAAEg"]
[Tue Jan 06 00:21:00.635185 2026] [:error] [pid 60509:tid 60529] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Tue Jan 06 00:21:00.775173 2026] [:error] [pid 60509:tid 60541] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Jan 06 00:21:00.934314 2026] [:error] [pid 60509:tid 60533] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs15.php
[Tue Jan 06 00:21:01.150093 2026] [:error] [pid 60509:tid 60527] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Jan 06 00:21:01.445346 2026] [:error] [pid 60509:tid 60524] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Tue Jan 06 00:21:01.600172 2026] [:error] [pid 60509:tid 60534] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Tue Jan 06 00:21:01.742313 2026] [:error] [pid 60509:tid 60536] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Jan 06 00:21:01.895914 2026] [:error] [pid 60509:tid 60532] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Tue Jan 06 00:21:02.034673 2026] [:error] [pid 60509:tid 60531] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Tue Jan 06 00:21:02.191165 2026] [:error] [pid 60509:tid 60537] [client 20.214.243.233:12324] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Tue Jan 06 00:21:02.335622 2026] [:error] [pid 60509:tid 60529] [client 20.214.243.233:12324] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvk7qBSiT1_wVwKSvQUygAAAEg"]
[Tue Jan 06 00:21:06.015433 2026] [:error] [pid 29187:tid 29196] [client 20.214.243.233:25199] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvk8oSYYRtfmMXGZCp3HQAAAAc"]
[Tue Jan 06 00:21:13.143628 2026] [:error] [pid 60605:tid 60629] [client 20.214.243.233:12413] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvk-ZGdDsTlcaRtgxQyswAAARY"]
[Tue Jan 06 00:21:17.750881 2026] [:error] [pid 60510:tid 60559] [client 20.214.243.233:12446] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aVvk_W3HNEkuMRrTL0L8zQAAAIs"]
[Tue Jan 06 00:21:23.824528 2026] [:error] [pid 60514:tid 60582] [client 20.214.243.233:12419] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aVvlA270C0kefOIBEs9NhAAAAMc"]
[Tue Jan 06 00:21:26.637044 2026] [:error] [pid 29187:tid 29197] [client 20.214.243.233:12441] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aVvlBoSYYRtfmMXGZCp3dwAAAAg"]
[Tue Jan 06 00:21:30.045225 2026] [:error] [pid 60514:tid 60578] [client 20.214.243.233:12289] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aVvlCm70C0kefOIBEs9NjgAAAMM"]
[Tue Jan 06 00:21:31.333132 2026] [:error] [pid 60510:tid 60566] [client 20.214.243.233:12464] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aVvlC23HNEkuMRrTL0L84wAAAJI"]
[Tue Jan 06 00:21:34.626023 2026] [:error] [pid 60510:tid 60558] [client 20.214.243.233:25203] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aVvlDm3HNEkuMRrTL0L87QAAAIo"]
[Tue Jan 06 00:21:38.467816 2026] [:error] [pid 60514:tid 60593] [client 20.214.243.233:25176] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aVvlEm70C0kefOIBEs9NnwAAANI"]
[Tue Jan 06 00:21:41.530636 2026] [:error] [pid 60514:tid 60593] [client 20.214.243.233:12375] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aVvlFW70C0kefOIBEs9NqAAAANI"]
[Tue Jan 06 00:21:46.196732 2026] [:error] [pid 60509:tid 60521] [client 20.214.243.233:12435] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aVvlGqBSiT1_wVwKSvQVFAAAAEA"]
[Tue Jan 06 00:21:50.485580 2026] [:error] [pid 60514:tid 60584] [client 20.214.243.233:12330] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aVvlHm70C0kefOIBEs9N0gAAAMk"]
[Tue Jan 06 00:21:56.110738 2026] [:error] [pid 60509:tid 60542] [client 20.214.243.233:12422] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aVvlJKBSiT1_wVwKSvQVKgAAAFU"]
[Tue Jan 06 00:21:58.035943 2026] [:error] [pid 60509:tid 60521] [client 20.214.243.233:12337] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aVvlJqBSiT1_wVwKSvQVLAAAAEA"]
[Tue Jan 06 00:22:00.033481 2026] [:error] [pid 29187:tid 29202] [client 20.214.243.233:12379] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aVvlKISYYRtfmMXGZCp37QAAAA0"]
[Tue Jan 06 00:22:01.657659 2026] [:error] [pid 60509:tid 60533] [client 20.214.243.233:12341] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aVvlKaBSiT1_wVwKSvQVNQAAAEw"]
[Tue Jan 06 00:22:05.538632 2026] [:error] [pid 60509:tid 60537] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Tue Jan 06 00:22:05.677344 2026] [:error] [pid 60509:tid 60544] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Tue Jan 06 00:22:05.884287 2026] [:error] [pid 60509:tid 60543] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Jan 06 00:22:06.022007 2026] [:error] [pid 60509:tid 60529] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Tue Jan 06 00:22:06.184669 2026] [:error] [pid 60509:tid 60542] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Jan 06 00:22:06.325284 2026] [:error] [pid 60509:tid 60530] [client 20.214.243.233:12325] [client 20.214.243.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.214.243.233, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVvlLqBSiT1_wVwKSvQVTQAAAEk"]
[Tue Jan 06 00:22:06.329083 2026] [:error] [pid 60509:tid 60530] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Tue Jan 06 00:22:06.488296 2026] [:error] [pid 60509:tid 60545] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Jan 06 00:22:06.757502 2026] [:error] [pid 60509:tid 60535] [client 20.214.243.233:12325] File does not exist: /usr/local/apache/htdocs/suspended-page/xse25.php
[Tue Jan 06 00:22:07.143037 2026] [:error] [pid 60509:tid 60544] [client 20.214.243.233:12325] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aVvlL6BSiT1_wVwKSvQVVAAAAFc"]
[Tue Jan 06 00:22:08.684203 2026] [:error] [pid 60510:tid 60571] [client 20.214.243.233:12312] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Tue Jan 06 00:22:08.837651 2026] [:error] [pid 60510:tid 60552] [client 20.214.243.233:12312] File does not exist: /usr/local/apache/htdocs/suspended-page/shoyo.php
[Tue Jan 06 00:22:08.983637 2026] [:error] [pid 60510:tid 60555] [client 20.214.243.233:12312] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aVvlMG3HNEkuMRrTL0L9OwAAAIc"]
[Tue Jan 06 00:22:11.546472 2026] [:error] [pid 60605:tid 60621] [client 20.214.243.233:12343] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aVvlM5GdDsTlcaRtgxQzLAAAAQ4"]
[Tue Jan 06 00:22:14.001391 2026] [:error] [pid 29187:tid 29203] [client 20.214.243.233:12342] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aVvlNoSYYRtfmMXGZCp4HwAAAA4"]
[Tue Jan 06 00:22:22.144952 2026] [:error] [pid 60509:tid 60540] [client 20.214.243.233:12438] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/flower.php"] [unique_id "aVvlPqBSiT1_wVwKSvQVewAAAFM"]
[Tue Jan 06 00:22:23.306270 2026] [:error] [pid 60605:tid 60614] [client 20.214.243.233:12304] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aVvlP5GdDsTlcaRtgxQzPgAAAQc"]
[Tue Jan 06 00:22:23.907751 2026] [:error] [pid 60605:tid 60615] [client 20.214.243.233:12299] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aVvlP5GdDsTlcaRtgxQzQgAAAQg"]
[Tue Jan 06 00:22:24.456396 2026] [:error] [pid 29187:tid 29213] [client 20.214.243.233:12350] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aVvlQISYYRtfmMXGZCp4OwAAABg"]
[Tue Jan 06 00:22:27.437447 2026] [:error] [pid 60509:tid 60544] [client 20.214.243.233:12310] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/waq.php"] [unique_id "aVvlQ6BSiT1_wVwKSvQVhwAAAFc"]
[Tue Jan 06 00:22:31.051717 2026] [:error] [pid 60514:tid 60584] [client 20.214.243.233:12450] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wakak.php"] [unique_id "aVvlR270C0kefOIBEs9OMgAAAMk"]
[Tue Jan 06 00:22:39.555378 2026] [:error] [pid 60514:tid 60576] [client 20.214.243.233:12429] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wakak.php"] [unique_id "aVvlT270C0kefOIBEs9OQQAAAME"]
[Tue Jan 06 00:22:41.180706 2026] [:error] [pid 60514:tid 60595] [client 20.214.243.233:12308] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wakak.php"] [unique_id "aVvlUW70C0kefOIBEs9OQgAAANQ"]
[Tue Jan 06 00:22:44.894953 2026] [:error] [pid 29187:tid 29209] [client 20.214.243.233:12476] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVvlVISYYRtfmMXGZCp4nwAAABQ"]
[Tue Jan 06 00:22:47.885626 2026] [:error] [pid 60514:tid 60581] [client 20.214.243.233:12306] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVvlV270C0kefOIBEs9OSQAAAMY"]
[Tue Jan 06 00:22:51.744837 2026] [:error] [pid 60514:tid 60576] [client 20.214.243.233:25167] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVvlW270C0kefOIBEs9OWQAAAME"]
[Tue Jan 06 00:22:56.348695 2026] [:error] [pid 60509:tid 60527] [client 20.214.243.233:12433] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aVvlYKBSiT1_wVwKSvQVyQAAAEY"]
[Tue Jan 06 00:22:59.648100 2026] [:error] [pid 29187:tid 29206] [client 20.214.243.233:12363] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aVvlY4SYYRtfmMXGZCp40QAAABE"]
[Tue Jan 06 00:23:03.175083 2026] [:error] [pid 60509:tid 60543] [client 20.214.243.233:12420] [client 20.214.243.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/widgets/index.php"] [unique_id "aVvlZ6BSiT1_wVwKSvQV3QAAAFY"]
[Tue Jan 06 00:23:06.131995 2026] [:error] [pid 29187:tid 29203] [client 20.214.243.233:12378] [client 20.214.243.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wen.php"] [unique_id "aVvlaoSYYRtfmMXGZCp44QAAAA4"]
[Tue Jan 06 00:23:09.266899 2026] [:error] [pid 60510:tid 60548] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Tue Jan 06 00:23:09.406416 2026] [:error] [pid 60510:tid 60572] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Tue Jan 06 00:23:09.544265 2026] [:error] [pid 60510:tid 60560] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/ah24.php
[Tue Jan 06 00:23:09.695051 2026] [:error] [pid 60510:tid 60552] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Tue Jan 06 00:23:10.108426 2026] [:error] [pid 60510:tid 60556] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/bipas.php
[Tue Jan 06 00:23:10.248795 2026] [:error] [pid 60510:tid 60549] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/conte.php
[Tue Jan 06 00:23:10.529523 2026] [:error] [pid 60510:tid 60558] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/class3.php
[Tue Jan 06 00:23:10.677423 2026] [:error] [pid 60510:tid 60557] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs18.php
[Tue Jan 06 00:23:11.053517 2026] [:error] [pid 60510:tid 60566] [client 20.214.243.233:12366] File does not exist: /usr/local/apache/htdocs/suspended-page/claa.php
[Tue Jan 06 02:55:08.926901 2026] [:error] [pid 60510:tid 60568] [client 43.153.27.244:50984] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVwJDG3HNEkuMRrTL0IsKQAAAJQ"]
[Tue Jan 06 06:03:13.777196 2026] [:error] [pid 45012:tid 45017] [client 182.42.105.144:57879] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVw1IRaMAxCuju1d0uYGagAAAMM"]
[Tue Jan 06 08:44:00.000972 2026] [:error] [pid 44905:tid 44979] [client 3.107.116.179:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php, referer: https://rejuva.au
[Tue Jan 06 11:46:56.042516 2026] [:error] [pid 45959:tid 45985] [client 43.159.145.153:59014] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aVyFsFajdn8P3hjgMYwTmgAAAVc"]
[Tue Jan 06 12:02:01.482822 2026] [:error] [pid 44903:tid 44907] [client 117.62.235.53:48083] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aVyJOdhHqjs38zbkQPCgoAAAAAA"]
[Tue Jan 06 19:44:04.288963 2026] [:error] [pid 45959:tid 45967] [client 155.117.98.117:63806] [client 155.117.98.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e/data/js/ajax.js"] [unique_id "aVz1hFajdn8P3hjgMYy5uQAAAUU"]
[Tue Jan 06 20:14:17.072022 2026] [:error] [pid 44903:tid 44928] [client 111.68.9.66:56276] [client 111.68.9.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/js/welcome.min.js"] [unique_id "aVz8mdhHqjs38zbkQPANJAAAABU"]
[Tue Jan 06 21:44:38.227783 2026] [:error] [pid 45959:tid 45977] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Tue Jan 06 21:44:38.469974 2026] [:error] [pid 45959:tid 45981] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Tue Jan 06 21:44:38.937933 2026] [:error] [pid 45959:tid 45965] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Tue Jan 06 21:44:39.062469 2026] [:error] [pid 45959:tid 45973] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Tue Jan 06 21:44:39.293842 2026] [:error] [pid 45959:tid 45966] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Tue Jan 06 21:44:39.422275 2026] [:error] [pid 45959:tid 45970] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Tue Jan 06 21:44:39.550269 2026] [:error] [pid 45959:tid 45976] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Tue Jan 06 21:44:39.673126 2026] [:error] [pid 45959:tid 45964] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Tue Jan 06 21:44:39.811691 2026] [:error] [pid 45959:tid 45974] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Jan 06 21:44:39.967010 2026] [:error] [pid 45959:tid 45978] [client 20.78.178.192:15593] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Tue Jan 06 21:44:40.102271 2026] [:error] [pid 45959:tid 45979] [client 20.78.178.192:15593] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aV0RyFajdn8P3hjgMYzvHwAAAVE"]
[Tue Jan 06 21:44:46.118951 2026] [:error] [pid 45959:tid 45977] [client 20.78.178.192:15519] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aV0Rzlajdn8P3hjgMYzvMQAAAU8"]
[Tue Jan 06 21:44:49.829015 2026] [:error] [pid 45959:tid 45974] [client 20.78.178.192:15588] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aV0R0Vajdn8P3hjgMYzvPwAAAUw"]
[Tue Jan 06 21:44:52.419248 2026] [:error] [pid 45959:tid 45979] [client 20.78.178.192:15613] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "aV0R1Fajdn8P3hjgMYzvVwAAAVE"]
[Tue Jan 06 21:45:00.377937 2026] [:error] [pid 45012:tid 45024] [client 20.78.178.192:15517] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aV0R3BaMAxCuju1d0uYPJAAAAMo"]
[Tue Jan 06 21:45:02.527936 2026] [:error] [pid 44905:tid 44975] [client 20.78.178.192:15611] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aV0R3ru7ufwWVst9EAvxFQAAAIc"]
[Tue Jan 06 21:45:04.310491 2026] [:error] [pid 45012:tid 45031] [client 20.78.178.192:15572] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aV0R4BaMAxCuju1d0uYPLAAAANE"]
[Tue Jan 06 21:45:07.491787 2026] [:error] [pid 45959:tid 45977] [client 20.78.178.192:15497] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnn_.php"] [unique_id "aV0R41ajdn8P3hjgMYzvfAAAAU8"]
[Tue Jan 06 21:45:08.490829 2026] [:error] [pid 44905:tid 44972] [client 20.78.178.192:15612] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aV0R5Lu7ufwWVst9EAvxKAAAAIQ"]
[Tue Jan 06 21:45:11.644748 2026] [:error] [pid 44905:tid 44985] [client 20.78.178.192:15590] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aV0R57u7ufwWVst9EAvxMQAAAJE"]
[Tue Jan 06 21:45:14.288224 2026] [:error] [pid 45959:tid 45964] [client 20.78.178.192:15614] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aV0R6lajdn8P3hjgMYzviwAAAUI"]
[Tue Jan 06 21:45:16.788709 2026] [:error] [pid 45959:tid 45963] [client 20.78.178.192:15491] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aV0R7Fajdn8P3hjgMYzvnwAAAUE"]
[Tue Jan 06 21:45:24.056901 2026] [:error] [pid 45959:tid 45972] [client 20.78.178.192:15597] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aV0R9Fajdn8P3hjgMYzvuwAAAUo"]
[Tue Jan 06 21:45:25.986922 2026] [:error] [pid 45959:tid 45970] [client 20.78.178.192:15490] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aV0R9Vajdn8P3hjgMYzvwwAAAUg"]
[Tue Jan 06 21:45:27.041034 2026] [:error] [pid 45959:tid 45964] [client 20.78.178.192:15508] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "aV0R91ajdn8P3hjgMYzvxwAAAUI"]
[Tue Jan 06 21:45:33.987127 2026] [:error] [pid 44905:tid 44987] [client 20.78.178.192:15584] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aV0R_bu7ufwWVst9EAvxRwAAAJM"]
[Tue Jan 06 21:45:38.026150 2026] [:error] [pid 45012:tid 45030] [client 20.78.178.192:15556] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aV0SAhaMAxCuju1d0uYPvAAAANA"]
[Tue Jan 06 21:45:38.649792 2026] [:error] [pid 44904:tid 44961] [client 20.78.178.192:15553] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "aV0SAjtieuI1BJEZcvdBAwAAAFQ"]
[Tue Jan 06 21:45:40.182686 2026] [:error] [pid 45959:tid 45964] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/kure.php
[Tue Jan 06 21:45:40.315829 2026] [:error] [pid 45959:tid 45979] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/gaje.php
[Tue Jan 06 21:45:40.439782 2026] [:error] [pid 45959:tid 45967] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Tue Jan 06 21:45:40.564980 2026] [:error] [pid 45959:tid 45966] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Tue Jan 06 21:45:40.750969 2026] [:error] [pid 45959:tid 45978] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/msy.php
[Tue Jan 06 21:45:40.873820 2026] [:error] [pid 45959:tid 45982] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/alog.php
[Tue Jan 06 21:45:41.001508 2026] [:error] [pid 45959:tid 45972] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/X7T6.php
[Tue Jan 06 21:45:41.132182 2026] [:error] [pid 45959:tid 45976] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Tue Jan 06 21:45:41.676666 2026] [:error] [pid 45959:tid 45975] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/Rk41.php
[Tue Jan 06 21:45:41.989184 2026] [:error] [pid 45959:tid 45971] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/ztv.php
[Tue Jan 06 21:45:42.122707 2026] [:error] [pid 45959:tid 45984] [client 20.78.178.192:4043] File does not exist: /usr/local/apache/htdocs/suspended-page/sef.php
[Tue Jan 06 21:45:42.243690 2026] [:error] [pid 45959:tid 45968] [client 20.78.178.192:4043] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aV0SBlajdn8P3hjgMYzv5wAAAUY"]
[Tue Jan 06 21:45:44.099079 2026] [:error] [pid 45959:tid 45981] [client 20.78.178.192:15496] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aV0SCFajdn8P3hjgMYzv7AAAAVM"]
[Tue Jan 06 21:45:45.232432 2026] [:error] [pid 35140:tid 35143] [client 20.78.178.192:15603] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aV0SCXoQaIDFMbT-XMzeZAAAAQE"]
[Tue Jan 06 21:45:46.489647 2026] [:error] [pid 45012:tid 45030] [client 20.78.178.192:15533] [client 20.78.178.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aV0SChaMAxCuju1d0uYP2gAAANA"]
[Tue Jan 06 23:08:17.773312 2026] [:error] [pid 45012:tid 45017] [client 49.51.245.241:44248] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV0lYRaMAxCuju1d0uYo3gAAAMM"]
[Tue Jan 06 23:19:41.064401 2026] [:error] [pid 44905:tid 44990] [client 4.247.167.136:4100] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV0oDbu7ufwWVst9EAsNmQAAAJY"]
[Tue Jan 06 23:19:49.112500 2026] [:error] [pid 45959:tid 45968] [client 4.247.167.136:4556] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV0oFVajdn8P3hjgMYwZBwAAAUY"]
[Tue Jan 06 23:19:54.507332 2026] [:error] [pid 44903:tid 44922] [client 4.247.167.136:4899] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV0oGthHqjs38zbkQPA94gAAAA8"]
[Wed Jan 07 05:44:11.963480 2026] [:error] [pid 51200:tid 51254] [client 43.158.91.71:36922] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aV2CK4jhb00oxKSD4lecSAAAAQY"]
[Wed Jan 07 09:20:48.484484 2026] [:error] [pid 30633:tid 30669] [client 43.153.119.119:54192] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV208PZiVWlF7303nMghdAAAAEY"]
[Wed Jan 07 09:33:12.633822 2026] [:error] [pid 30632:tid 30657] [client 95.154.200.35:59770] [client 95.154.200.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aV232Od3_LCpBJzo02d-WAAAABU"]
[Wed Jan 07 09:33:13.680164 2026] [:error] [pid 58330:tid 58350] [client 95.154.200.35:59772] [client 95.154.200.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aV232Q8kGngKGK7_wndIsAAAARI"]
[Wed Jan 07 09:33:14.715992 2026] [:error] [pid 58330:tid 58348] [client 95.154.200.35:59786] [client 95.154.200.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/tools.js"] [unique_id "aV232g8kGngKGK7_wndItAAAARA"]
[Wed Jan 07 09:33:15.752832 2026] [:error] [pid 30632:tid 30647] [client 95.154.200.35:59788] [client 95.154.200.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/translate_inline.js"] [unique_id "aV232-d3_LCpBJzo02d-WgAAAAs"]
[Wed Jan 07 09:33:16.787499 2026] [:error] [pid 58330:tid 58336] [client 95.154.200.35:59804] [client 95.154.200.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skin/adminhtml/default/default/boxes.css"] [unique_id "aV233A8kGngKGK7_wndIuQAAAQQ"]
[Wed Jan 07 09:33:17.835385 2026] [:error] [pid 30632:tid 30643] [client 95.154.200.35:59812] [client 95.154.200.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/prototype/validation.js"] [unique_id "aV233ed3_LCpBJzo02d-XAAAAAc"]
[Wed Jan 07 09:33:18.871176 2026] [:error] [pid 30632:tid 30655] [client 95.154.200.35:55136] [client 95.154.200.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RELEASE_NOTES.txt"] [unique_id "aV233ud3_LCpBJzo02d-YQAAABM"]
[Wed Jan 07 10:06:40.569568 2026] [:error] [pid 30633:tid 30669] [client 43.130.139.177:38000] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV2_sPZiVWlF7303nMgr6gAAAEY"]
[Wed Jan 07 10:53:23.154413 2026] [:error] [pid 58330:tid 58333] [client 195.178.110.161:59632] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aV3Kow8kGngKGK7_wndm9QAAAQE"]
[Wed Jan 07 12:44:26.614827 2026] [:error] [pid 58294:tid 58311] [client 195.178.110.161:36194] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aV3kqlfzA7c0ITpf3nHITgAAAI8"]
[Wed Jan 07 15:09:48.767979 2026] [:error] [pid 58294:tid 58299] [client 34.82.186.217:59174] [client 34.82.186.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.82.186.217, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aV4GvFfzA7c0ITpf3nHo4gAAAIM"]
[Wed Jan 07 15:09:48.771659 2026] [:error] [pid 58294:tid 58299] [client 34.82.186.217:59174] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 07 15:09:50.801835 2026] [:error] [pid 58294:tid 58314] [client 34.82.186.217:59174] [client 34.82.186.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aV4GvlfzA7c0ITpf3nHo8gAAAJI"]
[Wed Jan 07 15:09:51.202244 2026] [:error] [pid 30633:tid 30677] [client 34.82.186.217:60107] [client 34.82.186.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aV4Gv_ZiVWlF7303nMhldQAAAE4"]
[Wed Jan 07 15:09:51.638531 2026] [:error] [pid 30633:tid 30680] [client 34.82.186.217:56170] [client 34.82.186.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aV4Gv_ZiVWlF7303nMhldgAAAFE"]
[Wed Jan 07 15:09:51.998109 2026] [:error] [pid 30634:tid 30709] [client 34.82.186.217:49928] [client 34.82.186.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aV4Gv4CIPBibObtmZtu94AAAANM"]
[Wed Jan 07 15:09:52.436823 2026] [:error] [pid 30633:tid 30668] [client 34.82.186.217:63389] [client 34.82.186.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aV4GwPZiVWlF7303nMhleQAAAEU"]
[Wed Jan 07 15:09:52.796728 2026] [:error] [pid 30633:tid 30676] [client 34.82.186.217:60290] [client 34.82.186.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aV4GwPZiVWlF7303nMhlegAAAE0"]
[Wed Jan 07 15:09:53.192430 2026] [:error] [pid 58294:tid 58302] [client 34.82.186.217:52477] [client 34.82.186.217] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aV4GwVfzA7c0ITpf3nHo9AAAAIY"]
[Wed Jan 07 19:25:31.373287 2026] [:error] [pid 30632:tid 30660] [client 167.71.90.72:60652] [client 167.71.90.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/"] [unique_id "aV5Cq-d3_LCpBJzo02f2EQAAABg"], referer: binance.com
[Wed Jan 07 19:25:32.214468 2026] [:error] [pid 30633:tid 30671] [client 167.71.90.72:61269] [client 167.71.90.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "aV5CrPZiVWlF7303nMifrAAAAEg"], referer: binance.com
[Wed Jan 07 19:25:42.026500 2026] [:error] [pid 30720:tid 30745] [client 167.71.90.72:51308] [client 167.71.90.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aV5CtodgcpQjqzUi9WZ-FwAAAVc"], referer: binance.com
[Wed Jan 07 19:47:46.543641 2026] [:error] [pid 58330:tid 58355] [client 35.236.241.175:52189] [client 35.236.241.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.236.241.175, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aV5H4g8kGngKGK7_wnfzagAAARc"]
[Wed Jan 07 19:47:46.547130 2026] [:error] [pid 58330:tid 58355] [client 35.236.241.175:52189] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 07 19:47:49.266021 2026] [:error] [pid 58330:tid 58342] [client 35.236.241.175:52189] [client 35.236.241.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aV5H5Q8kGngKGK7_wnfzdQAAAQo"]
[Wed Jan 07 19:47:49.754729 2026] [:error] [pid 58330:tid 58349] [client 35.236.241.175:64721] [client 35.236.241.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aV5H5Q8kGngKGK7_wnfzdgAAARE"]
[Wed Jan 07 19:47:50.325900 2026] [:error] [pid 30633:tid 30677] [client 35.236.241.175:59954] [client 35.236.241.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aV5H5vZiVWlF7303nMikSwAAAE4"]
[Wed Jan 07 19:47:50.819057 2026] [:error] [pid 30634:tid 30710] [client 35.236.241.175:49247] [client 35.236.241.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aV5H5oCIPBibObtmZtv8swAAANQ"]
[Wed Jan 07 19:47:51.626023 2026] [:error] [pid 30634:tid 30693] [client 35.236.241.175:53905] [client 35.236.241.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aV5H54CIPBibObtmZtv8tQAAAMM"]
[Wed Jan 07 19:47:52.455815 2026] [:error] [pid 30632:tid 30654] [client 35.236.241.175:58147] [client 35.236.241.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aV5H6Od3_LCpBJzo02f7PgAAABI"]
[Wed Jan 07 19:47:53.169102 2026] [:error] [pid 30632:tid 30638] [client 35.236.241.175:55796] [client 35.236.241.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aV5H6ed3_LCpBJzo02f7QAAAAAI"]
[Wed Jan 07 19:48:00.136438 2026] [:error] [pid 30634:tid 30708] [client 34.11.24.30:62202] [client 34.11.24.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.24.30, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aV5H8ICIPBibObtmZtv8vQAAANI"]
[Wed Jan 07 19:48:00.140079 2026] [:error] [pid 30634:tid 30708] [client 34.11.24.30:62202] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 07 19:48:03.062883 2026] [:error] [pid 30634:tid 30691] [client 34.11.24.30:62202] [client 34.11.24.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aV5H84CIPBibObtmZtv8yAAAAME"]
[Wed Jan 07 19:48:03.513305 2026] [:error] [pid 58330:tid 58352] [client 34.11.24.30:62113] [client 34.11.24.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aV5H8w8kGngKGK7_wnfzfQAAARQ"]
[Wed Jan 07 19:48:03.952982 2026] [:error] [pid 30634:tid 30693] [client 34.11.24.30:51622] [client 34.11.24.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aV5H84CIPBibObtmZtv8yQAAAMM"]
[Wed Jan 07 19:48:04.387490 2026] [:error] [pid 51128:tid 51146] [client 34.11.24.30:54147] [client 34.11.24.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aV5H9EGjtE8U88mrwueaRAAAAZA"]
[Wed Jan 07 19:48:04.832140 2026] [:error] [pid 58330:tid 58343] [client 34.11.24.30:54783] [client 34.11.24.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aV5H9A8kGngKGK7_wnfzgAAAAQs"]
[Wed Jan 07 19:48:05.279835 2026] [:error] [pid 30634:tid 30705] [client 34.11.24.30:62603] [client 34.11.24.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aV5H9YCIPBibObtmZtv8ygAAAM8"]
[Wed Jan 07 19:48:05.709904 2026] [:error] [pid 58330:tid 58342] [client 34.11.24.30:58513] [client 34.11.24.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aV5H9Q8kGngKGK7_wnfzhAAAAQo"]
[Wed Jan 07 21:50:27.098898 2026] [:error] [pid 58330:tid 58337] [client 49.51.233.95:47564] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV5kow8kGngKGK7_wncLfAAAAQU"]
[Wed Jan 07 23:05:02.245928 2026] [:error] [pid 50905:tid 50910] [client 43.166.142.76:43924] [client 43.166.142.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV52HmpNgk5-gt30I7afDAAAAkM"]
[Thu Jan 08 00:20:20.217986 2026] [:error] [pid 58294:tid 58309] [client 49.51.245.241:42846] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aV6HxFfzA7c0ITpf3nFMvwAAAI0"]
[Thu Jan 08 01:30:56.999271 2026] [:error] [pid 50870:tid 50872] [client 60.188.57.0:56891] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV6YUBlePfspAt1Bzoub3AAAAgA"]
[Thu Jan 08 01:32:44.597583 2026] [:error] [pid 51128:tid 51151] [client 138.197.32.240:56319] [client 138.197.32.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aV6YvEGjtE8U88mrwufQOAAAAZU"], referer: binance.com
[Thu Jan 08 04:37:30.675662 2026] [:error] [pid 15358:tid 15387] [client 170.106.161.78:57840] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV7ECioRk9xWJ3toSBKlXgAAANE"]
[Thu Jan 08 05:42:00.167327 2026] [:error] [pid 2484:tid 2511] [client 103.163.208.86:51743] File does not exist: /usr/local/apache/htdocs/suspended-page/1234.php
[Thu Jan 08 05:48:00.315401 2026] [:error] [pid 2484:tid 2506] [client 13.70.6.109:12539] File does not exist: /usr/local/apache/htdocs/suspended-page/mad.php
[Thu Jan 08 05:48:01.161946 2026] [:error] [pid 2484:tid 2510] [client 13.70.6.109:12539] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Thu Jan 08 05:48:01.284712 2026] [:error] [pid 2484:tid 2498] [client 13.70.6.109:12539] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Jan 08 05:48:01.530274 2026] [:error] [pid 2484:tid 2499] [client 13.70.6.109:12539] File does not exist: /usr/local/apache/htdocs/suspended-page/7x.php
[Thu Jan 08 05:48:01.655436 2026] [:error] [pid 2484:tid 2507] [client 13.70.6.109:12539] File does not exist: /usr/local/apache/htdocs/suspended-page/x7.php
[Thu Jan 08 05:48:01.775474 2026] [:error] [pid 2484:tid 2504] [client 13.70.6.109:12539] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Jan 08 05:48:01.897346 2026] [:error] [pid 2484:tid 2493] [client 13.70.6.109:12539] File does not exist: /usr/local/apache/htdocs/suspended-page/anon.php
[Thu Jan 08 05:48:02.014958 2026] [:error] [pid 2484:tid 2502] [client 13.70.6.109:12539] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anonymous.php"] [unique_id "aV7UkjiDlnlaQQK_AEOGkQAAAU4"]
[Thu Jan 08 05:48:02.796387 2026] [:error] [pid 15265:tid 15335] [client 13.70.6.109:12535] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anonymous.php"] [unique_id "aV7UkqE6VBKhew2LTFSfnQAAAIk"]
[Thu Jan 08 05:48:03.460288 2026] [:error] [pid 15264:tid 15304] [client 13.70.6.109:12532] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anonymous.php"] [unique_id "aV7Uk4ov6_kvS0Owh-p8mwAAAEU"]
[Thu Jan 08 05:48:04.945842 2026] [:error] [pid 2424:tid 2429] [client 13.70.6.109:12537] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anonymous.php"] [unique_id "aV7UlLTDJR8aofkBk9RhfQAAAQM"]
[Thu Jan 08 05:48:05.938565 2026] [:error] [pid 15263:tid 15283] [client 13.70.6.109:12514] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aV7Uldv61bxum7WG_e9Y4AAAAAs"]
[Thu Jan 08 05:48:07.429000 2026] [:error] [pid 2484:tid 2511] [client 13.70.6.109:12509] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aV7UlziDlnlaQQK_AEOGmAAAAVc"]
[Thu Jan 08 05:48:09.253761 2026] [:error] [pid 15265:tid 15332] [client 13.70.6.109:12503] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aV7UmaE6VBKhew2LTFSfoQAAAIY"]
[Thu Jan 08 05:48:10.633963 2026] [:error] [pid 15264:tid 15303] [client 13.70.6.109:12439] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aV7Umoov6_kvS0Owh-p8pQAAAEQ"]
[Thu Jan 08 05:48:12.627667 2026] [:error] [pid 2424:tid 2441] [client 13.70.6.109:12543] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sh3ll.php"] [unique_id "aV7UnLTDJR8aofkBk9RhgwAAAQ8"]
[Thu Jan 08 05:48:14.146354 2026] [:error] [pid 2484:tid 2494] [client 13.70.6.109:12428] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sh3ll.php"] [unique_id "aV7UnjiDlnlaQQK_AEOGqAAAAUc"]
[Thu Jan 08 05:48:15.405238 2026] [:error] [pid 15264:tid 15321] [client 13.70.6.109:12481] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sh3ll.php"] [unique_id "aV7Un4ov6_kvS0Owh-p8qgAAAFY"]
[Thu Jan 08 05:48:16.297284 2026] [:error] [pid 15265:tid 15339] [client 13.70.6.109:12523] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sh3ll.php"] [unique_id "aV7UoKE6VBKhew2LTFSfpwAAAI0"]
[Thu Jan 08 05:48:17.241237 2026] [:error] [pid 15263:tid 15292] [client 13.70.6.109:12426] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/madspotshell.php"] [unique_id "aV7Uodv61bxum7WG_e9Y8QAAABQ"]
[Thu Jan 08 05:48:17.964996 2026] [:error] [pid 2424:tid 2429] [client 13.70.6.109:12504] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/madspotshell.php"] [unique_id "aV7UobTDJR8aofkBk9RhiwAAAQM"]
[Thu Jan 08 05:48:19.578907 2026] [:error] [pid 15265:tid 15328] [client 13.70.6.109:12432] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/madspotshell.php"] [unique_id "aV7Uo6E6VBKhew2LTFSfqwAAAII"]
[Thu Jan 08 05:48:21.083499 2026] [:error] [pid 15263:tid 15281] [client 13.70.6.109:8132] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/madspotshell.php"] [unique_id "aV7Updv61bxum7WG_e9Y8wAAAAk"]
[Thu Jan 08 05:48:22.271352 2026] [:error] [pid 15265:tid 15326] [client 13.70.6.109:12524] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b374k.php"] [unique_id "aV7UpqE6VBKhew2LTFSfrgAAAIA"]
[Thu Jan 08 05:48:23.862882 2026] [:error] [pid 15264:tid 15322] [client 13.70.6.109:12424] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b374k.php"] [unique_id "aV7Up4ov6_kvS0Owh-p8sgAAAFc"]
[Thu Jan 08 05:48:25.457072 2026] [:error] [pid 2484:tid 2490] [client 13.70.6.109:12516] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b374k.php"] [unique_id "aV7UqTiDlnlaQQK_AEOGsgAAAUQ"]
[Thu Jan 08 05:48:26.276337 2026] [:error] [pid 2424:tid 2448] [client 13.70.6.109:12442] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b374k.php"] [unique_id "aV7UqrTDJR8aofkBk9RhlwAAARY"]
[Thu Jan 08 05:48:27.217327 2026] [:error] [pid 15358:tid 15393] [client 13.70.6.109:8149] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c100.php"] [unique_id "aV7UqyoRk9xWJ3toSBLIZAAAANc"]
[Thu Jan 08 05:48:28.725225 2026] [:error] [pid 15263:tid 15294] [client 13.70.6.109:12513] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c100.php"] [unique_id "aV7UrNv61bxum7WG_e9Y-wAAABY"]
[Thu Jan 08 05:48:33.014800 2026] [:error] [pid 2484:tid 2504] [client 13.70.6.109:12425] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c100.php"] [unique_id "aV7UsTiDlnlaQQK_AEOGtwAAAVA"]
[Thu Jan 08 05:48:34.362173 2026] [:error] [pid 15263:tid 15278] [client 13.70.6.109:12444] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c100.php"] [unique_id "aV7Ustv61bxum7WG_e9ZCQAAAAY"]
[Thu Jan 08 05:48:36.012293 2026] [:error] [pid 2484:tid 2501] [client 13.70.6.109:12484] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/priv8.php"] [unique_id "aV7UtDiDlnlaQQK_AEOGugAAAU0"]
[Thu Jan 08 05:48:37.351589 2026] [:error] [pid 15264:tid 15312] [client 13.70.6.109:12473] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/priv8.php"] [unique_id "aV7UtYov6_kvS0Owh-p8vgAAAE0"]
[Thu Jan 08 05:48:37.962845 2026] [:error] [pid 2484:tid 2498] [client 13.70.6.109:12485] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/priv8.php"] [unique_id "aV7UtTiDlnlaQQK_AEOGxAAAAUs"]
[Thu Jan 08 05:48:39.506450 2026] [:error] [pid 15358:tid 15394] [client 13.70.6.109:12511] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/priv8.php"] [unique_id "aV7UtyoRk9xWJ3toSBLIdwAAANg"]
[Thu Jan 08 05:48:40.507750 2026] [:error] [pid 15358:tid 15381] [client 13.70.6.109:12541] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/private.php"] [unique_id "aV7UuCoRk9xWJ3toSBLIeQAAAMs"]
[Thu Jan 08 05:48:41.419952 2026] [:error] [pid 15263:tid 15282] [client 13.70.6.109:12418] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/private.php"] [unique_id "aV7Uudv61bxum7WG_e9ZDwAAAAo"]
[Thu Jan 08 05:48:42.410984 2026] [:error] [pid 2484:tid 2486] [client 13.70.6.109:12533] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/private.php"] [unique_id "aV7UujiDlnlaQQK_AEOGxgAAAUA"]
[Thu Jan 08 05:48:43.697702 2026] [:error] [pid 15265:tid 15334] [client 13.70.6.109:12438] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/private.php"] [unique_id "aV7Uu6E6VBKhew2LTFSfvgAAAIg"]
[Thu Jan 08 05:48:45.146946 2026] [:error] [pid 2424:tid 2428] [client 13.70.6.109:12540] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aV7UvbTDJR8aofkBk9RhoQAAAQI"]
[Thu Jan 08 05:48:47.789672 2026] [:error] [pid 15263:tid 15286] [client 13.70.6.109:12435] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aV7Uv9v61bxum7WG_e9ZFgAAAA4"]
[Thu Jan 08 05:48:49.584764 2026] [:error] [pid 15264:tid 15310] [client 13.70.6.109:12508] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aV7UwYov6_kvS0Owh-p8xQAAAEs"]
[Thu Jan 08 05:48:51.672273 2026] [:error] [pid 15263:tid 15280] [client 13.70.6.109:8153] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aV7Uw9v61bxum7WG_e9ZHgAAAAg"]
[Thu Jan 08 05:48:53.759938 2026] [:error] [pid 15263:tid 15283] [client 13.70.6.109:8140] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV7Uxdv61bxum7WG_e9ZIAAAAAs"]
[Thu Jan 08 05:48:54.907145 2026] [:error] [pid 15263:tid 15294] [client 13.70.6.109:12437] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV7Uxtv61bxum7WG_e9ZIQAAABY"]
[Thu Jan 08 05:48:56.170494 2026] [:error] [pid 15263:tid 15292] [client 13.70.6.109:12496] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV7UyNv61bxum7WG_e9ZJAAAABQ"]
[Thu Jan 08 05:48:58.609920 2026] [:error] [pid 15358:tid 15390] [client 13.70.6.109:12422] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "aV7UyioRk9xWJ3toSBLIggAAANQ"]
[Thu Jan 08 05:49:00.632817 2026] [:error] [pid 2484:tid 2497] [client 13.70.6.109:12542] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aV7UzDiDlnlaQQK_AEOG1AAAAUo"]
[Thu Jan 08 05:49:02.982200 2026] [:error] [pid 15263:tid 15285] [client 13.70.6.109:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Jan 08 05:49:03.375501 2026] [:error] [pid 15263:tid 15288] [client 13.70.6.109:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Jan 08 05:49:03.496367 2026] [:error] [pid 15263:tid 15291] [client 13.70.6.109:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Jan 08 05:49:05.901716 2026] [:error] [pid 15263:tid 15273] [client 13.70.6.109:12494] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Jan 08 05:49:06.436787 2026] [:error] [pid 15263:tid 15276] [client 13.70.6.109:12494] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV7U0tv61bxum7WG_e9ZNAAAAAQ"]
[Thu Jan 08 05:49:08.832795 2026] [:error] [pid 2424:tid 2437] [client 13.70.6.109:12427] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV7U1LTDJR8aofkBk9RhsAAAAQs"]
[Thu Jan 08 05:49:11.975507 2026] [:error] [pid 15265:tid 15334] [client 13.70.6.109:12502] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV7U16E6VBKhew2LTFSf0QAAAIg"]
[Thu Jan 08 05:49:14.866893 2026] [:error] [pid 15358:tid 15393] [client 13.70.6.109:12447] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aV7U2ioRk9xWJ3toSBLIkQAAANc"]
[Thu Jan 08 05:49:17.443430 2026] [:error] [pid 2484:tid 2505] [client 13.70.6.109:12456] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV7U3TiDlnlaQQK_AEOG4AAAAVE"]
[Thu Jan 08 05:49:19.282667 2026] [:error] [pid 15263:tid 15286] [client 13.70.6.109:12451] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV7U39v61bxum7WG_e9ZQAAAAA4"]
[Thu Jan 08 05:49:20.838321 2026] [:error] [pid 15264:tid 15304] [client 13.70.6.109:12528] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV7U4Iov6_kvS0Owh-p82QAAAEU"]
[Thu Jan 08 05:49:22.429003 2026] [:error] [pid 2484:tid 2502] [client 13.70.6.109:12529] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aV7U4jiDlnlaQQK_AEOG5QAAAU4"]
[Thu Jan 08 05:49:23.411634 2026] [:error] [pid 2484:tid 2497] [client 13.70.6.109:8171] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV7U4ziDlnlaQQK_AEOG6gAAAUo"]
[Thu Jan 08 05:49:24.139157 2026] [:error] [pid 2484:tid 2487] [client 13.70.6.109:12538] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV7U5DiDlnlaQQK_AEOG6wAAAUE"]
[Thu Jan 08 05:49:25.545971 2026] [:error] [pid 2424:tid 2448] [client 13.70.6.109:12501] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV7U5bTDJR8aofkBk9RhxQAAARY"]
[Thu Jan 08 05:49:26.521608 2026] [:error] [pid 2424:tid 2437] [client 13.70.6.109:12505] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/ango/sett.php"] [unique_id "aV7U5rTDJR8aofkBk9RhxwAAAQs"]
[Thu Jan 08 05:49:27.500232 2026] [:error] [pid 15265:tid 15348] [client 13.70.6.109:8152] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aV7U56E6VBKhew2LTFSf3wAAAJY"]
[Thu Jan 08 05:49:28.421524 2026] [:error] [pid 15265:tid 15332] [client 13.70.6.109:12526] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aV7U6KE6VBKhew2LTFSf4wAAAIY"]
[Thu Jan 08 05:49:29.439445 2026] [:error] [pid 2424:tid 2447] [client 13.70.6.109:12521] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aV7U6bTDJR8aofkBk9RhygAAARU"]
[Thu Jan 08 05:49:30.512434 2026] [:error] [pid 2484:tid 2503] [client 13.70.6.109:12457] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aV7U6jiDlnlaQQK_AEOG7wAAAU8"]
[Thu Jan 08 05:49:31.573713 2026] [:error] [pid 2484:tid 2498] [client 13.70.6.109:12520] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cp.php"] [unique_id "aV7U6ziDlnlaQQK_AEOG9AAAAUs"]
[Thu Jan 08 05:49:33.101000 2026] [:error] [pid 2484:tid 2505] [client 13.70.6.109:12459] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cp.php"] [unique_id "aV7U7TiDlnlaQQK_AEOG9wAAAVE"]
[Thu Jan 08 05:49:34.075898 2026] [:error] [pid 15358:tid 15383] [client 13.70.6.109:12463] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cp.php"] [unique_id "aV7U7ioRk9xWJ3toSBLInQAAAM0"]
[Thu Jan 08 05:49:34.633859 2026] [:error] [pid 2484:tid 2489] [client 13.70.6.109:12419] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cp.php"] [unique_id "aV7U7jiDlnlaQQK_AEOG-wAAAUM"]
[Thu Jan 08 05:49:35.302659 2026] [:error] [pid 2424:tid 2439] [client 13.70.6.109:12527] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpbrute.php"] [unique_id "aV7U77TDJR8aofkBk9RhzgAAAQ0"]
[Thu Jan 08 05:49:36.120984 2026] [:error] [pid 15358:tid 15394] [client 13.70.6.109:12421] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpbrute.php"] [unique_id "aV7U8CoRk9xWJ3toSBLInwAAANg"]
[Thu Jan 08 05:49:37.068742 2026] [:error] [pid 15358:tid 15388] [client 13.70.6.109:12462] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpbrute.php"] [unique_id "aV7U8SoRk9xWJ3toSBLIoAAAANI"]
[Thu Jan 08 05:49:38.204893 2026] [:error] [pid 15358:tid 15391] [client 13.70.6.109:8161] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpbrute.php"] [unique_id "aV7U8ioRk9xWJ3toSBLIpQAAANU"]
[Thu Jan 08 05:49:39.697198 2026] [:error] [pid 2484:tid 2512] [client 13.70.6.109:12536] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/404/404.php"] [unique_id "aV7U8ziDlnlaQQK_AEOHAAAAAVg"]
[Thu Jan 08 05:49:40.914773 2026] [:error] [pid 15358:tid 15374] [client 13.70.6.109:12492] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/404/404.php"] [unique_id "aV7U9CoRk9xWJ3toSBLIqwAAAMQ"]
[Thu Jan 08 05:49:42.117811 2026] [:error] [pid 2484:tid 2487] [client 13.70.6.109:12416] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/404/404.php"] [unique_id "aV7U9jiDlnlaQQK_AEOHBgAAAUE"]
[Thu Jan 08 05:49:42.993202 2026] [:error] [pid 15358:tid 15370] [client 13.70.6.109:8138] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/404/404.php"] [unique_id "aV7U9ioRk9xWJ3toSBLItAAAAMA"]
[Thu Jan 08 05:49:43.639494 2026] [:error] [pid 2424:tid 2443] [client 13.70.6.109:12445] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/atomic/index.php"] [unique_id "aV7U97TDJR8aofkBk9Rh2QAAARE"]
[Thu Jan 08 05:49:45.636380 2026] [:error] [pid 15263:tid 15287] [client 13.70.6.109:12525] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/atomic/index.php"] [unique_id "aV7U-dv61bxum7WG_e9ZUgAAAA8"]
[Thu Jan 08 05:49:46.502690 2026] [:error] [pid 2424:tid 2441] [client 13.70.6.109:12429] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/atomic/index.php"] [unique_id "aV7U-rTDJR8aofkBk9Rh4wAAAQ8"]
[Thu Jan 08 05:49:48.500640 2026] [:error] [pid 2424:tid 2432] [client 13.70.6.109:12472] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/atomic/index.php"] [unique_id "aV7U_LTDJR8aofkBk9Rh5wAAAQY"]
[Thu Jan 08 05:49:50.064296 2026] [:error] [pid 15358:tid 15389] [client 13.70.6.109:8182] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez5/index.php"] [unique_id "aV7U_ioRk9xWJ3toSBLIvQAAANM"]
[Thu Jan 08 05:49:53.167801 2026] [:error] [pid 2484:tid 2509] [client 13.70.6.109:8141] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez5/index.php"] [unique_id "aV7VATiDlnlaQQK_AEOHEAAAAVU"]
[Thu Jan 08 05:49:55.917953 2026] [:error] [pid 2424:tid 2441] [client 13.70.6.109:8129] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez5/index.php"] [unique_id "aV7VA7TDJR8aofkBk9Rh8QAAAQ8"]
[Thu Jan 08 05:49:57.014799 2026] [:error] [pid 2484:tid 2490] [client 13.70.6.109:8013] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez5/index.php"] [unique_id "aV7VBTiDlnlaQQK_AEOHGQAAAUQ"]
[Thu Jan 08 05:49:59.137002 2026] [:error] [pid 2484:tid 2487] [client 13.70.6.109:12434] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upp.php"] [unique_id "aV7VBziDlnlaQQK_AEOHHAAAAUE"]
[Thu Jan 08 05:50:00.676060 2026] [:error] [pid 15265:tid 15330] [client 13.70.6.109:12458] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upp.php"] [unique_id "aV7VCKE6VBKhew2LTFSf7AAAAIQ"]
[Thu Jan 08 05:50:01.362901 2026] [:error] [pid 2424:tid 2443] [client 13.70.6.109:8165] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upp.php"] [unique_id "aV7VCbTDJR8aofkBk9Rh9AAAARE"]
[Thu Jan 08 05:50:03.328478 2026] [:error] [pid 2424:tid 2427] [client 13.70.6.109:12518] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upp.php"] [unique_id "aV7VC7TDJR8aofkBk9Rh9gAAAQE"]
[Thu Jan 08 05:50:04.339254 2026] [:error] [pid 2484:tid 2512] [client 13.70.6.109:8128] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Shellton.php"] [unique_id "aV7VDDiDlnlaQQK_AEOHKQAAAVg"]
[Thu Jan 08 05:50:05.056785 2026] [:error] [pid 2424:tid 2437] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/Shellton.php
[Thu Jan 08 05:50:05.644577 2026] [:error] [pid 2424:tid 2430] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/ShellTon.php
[Thu Jan 08 05:50:05.772805 2026] [:error] [pid 2424:tid 2436] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Jan 08 05:50:05.892842 2026] [:error] [pid 2424:tid 2444] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/hacked.php
[Thu Jan 08 05:50:06.158983 2026] [:error] [pid 2424:tid 2440] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Jan 08 05:50:06.303229 2026] [:error] [pid 2424:tid 2438] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/wso24.php
[Thu Jan 08 05:50:06.781721 2026] [:error] [pid 2424:tid 2446] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/wso26.php
[Thu Jan 08 05:50:06.901342 2026] [:error] [pid 2424:tid 2441] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/wso404.php
[Thu Jan 08 05:50:07.022856 2026] [:error] [pid 2424:tid 2431] [client 13.70.6.109:8139] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Thu Jan 08 05:50:07.139731 2026] [:error] [pid 2424:tid 2433] [client 13.70.6.109:8139] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aV7VD7TDJR8aofkBk9RiAgAAAQc"]
[Thu Jan 08 05:50:08.945401 2026] [:error] [pid 2424:tid 2435] [client 13.70.6.109:12486] [client 13.70.6.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.70.6.109, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aV7VELTDJR8aofkBk9RiBQAAAQk"]
[Thu Jan 08 05:50:09.069645 2026] [:error] [pid 2424:tid 2443] [client 13.70.6.109:12486] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aV7VEbTDJR8aofkBk9RiBgAAARE"]
[Thu Jan 08 05:50:10.776711 2026] [:error] [pid 15264:tid 15309] [client 13.70.6.109:8134] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aV7VEoov6_kvS0Owh-p84gAAAEo"]
[Thu Jan 08 05:50:12.307460 2026] [:error] [pid 15358:tid 15372] [client 13.70.6.109:12431] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aV7VFCoRk9xWJ3toSBLIxQAAAMI"]
[Thu Jan 08 05:50:12.835967 2026] [:error] [pid 2424:tid 2446] [client 13.70.6.109:12485] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fm.php"] [unique_id "aV7VFLTDJR8aofkBk9RiEQAAARQ"]
[Thu Jan 08 05:50:13.631233 2026] [:error] [pid 2424:tid 2442] [client 13.70.6.109:12420] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV7VFbTDJR8aofkBk9RiFQAAARA"]
[Thu Jan 08 05:50:14.677104 2026] [:error] [pid 15265:tid 15346] [client 13.70.6.109:12470] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV7VFqE6VBKhew2LTFSf8wAAAJQ"]
[Thu Jan 08 05:50:15.628965 2026] [:error] [pid 15264:tid 15319] [client 13.70.6.109:8179] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV7VF4ov6_kvS0Owh-p86AAAAFQ"]
[Thu Jan 08 05:50:16.391655 2026] [:error] [pid 15358:tid 15386] [client 13.70.6.109:12468] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aV7VGCoRk9xWJ3toSBLIyQAAANA"]
[Thu Jan 08 05:50:17.299773 2026] [:error] [pid 2484:tid 2499] [client 13.70.6.109:8133] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV7VGTiDlnlaQQK_AEOHPQAAAUw"]
[Thu Jan 08 05:50:18.076088 2026] [:error] [pid 15264:tid 15301] [client 13.70.6.109:12446] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV7VGoov6_kvS0Owh-p86wAAAEI"]
[Thu Jan 08 05:50:19.223923 2026] [:error] [pid 15265:tid 15327] [client 13.70.6.109:12423] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV7VG6E6VBKhew2LTFSf_QAAAIE"]
[Thu Jan 08 05:50:20.003847 2026] [:error] [pid 2424:tid 2433] [client 13.70.6.109:12417] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "aV7VHLTDJR8aofkBk9RiJAAAAQc"]
[Thu Jan 08 05:50:20.500225 2026] [:error] [pid 2424:tid 2445] [client 13.70.6.109:12506] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aV7VHLTDJR8aofkBk9RiJQAAARM"]
[Thu Jan 08 05:50:21.138565 2026] [:error] [pid 2424:tid 2443] [client 13.70.6.109:8131] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aV7VHbTDJR8aofkBk9RiJgAAARE"]
[Thu Jan 08 05:50:22.867987 2026] [:error] [pid 15263:tid 15282] [client 13.70.6.109:8147] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aV7VHtv61bxum7WG_e9ZZwAAAAo"]
[Thu Jan 08 05:50:24.176385 2026] [:error] [pid 2484:tid 2502] [client 13.70.6.109:12474] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aV7VIDiDlnlaQQK_AEOHSAAAAU4"]
[Thu Jan 08 05:50:25.123165 2026] [:error] [pid 15358:tid 15381] [client 13.70.6.109:8178] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aV7VISoRk9xWJ3toSBLI0QAAAMs"]
[Thu Jan 08 05:50:26.368615 2026] [:error] [pid 15263:tid 15272] [client 13.70.6.109:12431] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aV7VItv61bxum7WG_e9ZagAAAAA"]
[Thu Jan 08 05:50:27.253082 2026] [:error] [pid 15263:tid 15280] [client 13.70.6.109:12510] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aV7VI9v61bxum7WG_e9ZbAAAAAg"]
[Thu Jan 08 05:50:27.807687 2026] [:error] [pid 2424:tid 2435] [client 13.70.6.109:12534] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aV7VI7TDJR8aofkBk9RiNwAAAQk"]
[Thu Jan 08 05:50:28.736406 2026] [:error] [pid 15264:tid 15304] [client 13.70.6.109:12480] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV7VJIov6_kvS0Owh-p8-QAAAEU"]
[Thu Jan 08 05:50:29.833072 2026] [:error] [pid 2424:tid 2433] [client 13.70.6.109:8151] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV7VJbTDJR8aofkBk9RiPQAAAQc"]
[Thu Jan 08 05:50:30.583982 2026] [:error] [pid 2424:tid 2446] [client 13.70.6.109:12476] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV7VJrTDJR8aofkBk9RiPgAAARQ"]
[Thu Jan 08 05:50:31.561511 2026] [:error] [pid 2424:tid 2437] [client 13.70.6.109:12441] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/cay-van-phong/filemanager.php"] [unique_id "aV7VJ7TDJR8aofkBk9RiQgAAAQs"]
[Thu Jan 08 05:50:32.992145 2026] [:error] [pid 2424:tid 2450] [client 13.70.6.109:12487] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aV7VKLTDJR8aofkBk9RiRQAAARg"]
[Thu Jan 08 05:50:33.785405 2026] [:error] [pid 15265:tid 15343] [client 13.70.6.109:8082] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aV7VKaE6VBKhew2LTFSgAAAAAJE"]
[Thu Jan 08 05:50:34.944178 2026] [:error] [pid 2484:tid 2498] [client 13.70.6.109:12515] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aV7VKjiDlnlaQQK_AEOHVgAAAUs"]
[Thu Jan 08 05:50:36.094926 2026] [:error] [pid 15263:tid 15293] [client 13.70.6.109:12483] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/seoplugins/index.php"] [unique_id "aV7VLNv61bxum7WG_e9ZeQAAABU"]
[Thu Jan 08 05:50:37.523641 2026] [:error] [pid 2484:tid 2499] [client 13.70.6.109:12440] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aV7VLTiDlnlaQQK_AEOHXQAAAUw"]
[Thu Jan 08 05:50:39.415274 2026] [:error] [pid 15265:tid 15327] [client 13.70.6.109:12482] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aV7VL6E6VBKhew2LTFSgBgAAAIE"]
[Thu Jan 08 05:50:40.658371 2026] [:error] [pid 2484:tid 2497] [client 13.70.6.109:8165] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aV7VMDiDlnlaQQK_AEOHZAAAAUo"]
[Thu Jan 08 05:50:41.283264 2026] [:error] [pid 15265:tid 15332] [client 13.70.6.109:8076] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ini.php"] [unique_id "aV7VMaE6VBKhew2LTFSgDAAAAIY"]
[Thu Jan 08 05:50:42.095224 2026] [:error] [pid 15263:tid 15296] [client 13.70.6.109:12531] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV7VMtv61bxum7WG_e9ZhQAAABg"]
[Thu Jan 08 05:50:42.736860 2026] [:error] [pid 15264:tid 15307] [client 13.70.6.109:8075] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV7VMoov6_kvS0Owh-p9BAAAAEg"]
[Thu Jan 08 05:50:43.575995 2026] [:error] [pid 15265:tid 15343] [client 13.70.6.109:8007] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV7VM6E6VBKhew2LTFSgDwAAAJE"]
[Thu Jan 08 05:50:44.519029 2026] [:error] [pid 2424:tid 2439] [client 13.70.6.109:8175] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libraries/legacy/info.php"] [unique_id "aV7VNLTDJR8aofkBk9RiUAAAAQ0"]
[Thu Jan 08 05:50:46.290279 2026] [:error] [pid 15263:tid 15289] [client 13.70.6.109:8065] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV7VNtv61bxum7WG_e9ZiAAAABE"]
[Thu Jan 08 05:50:47.010287 2026] [:error] [pid 15265:tid 15340] [client 13.70.6.109:12471] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV7VN6E6VBKhew2LTFSgFgAAAI4"]
[Thu Jan 08 05:50:47.741307 2026] [:error] [pid 2484:tid 2507] [client 13.70.6.109:8163] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV7VNziDlnlaQQK_AEOHbwAAAVM"]
[Thu Jan 08 05:50:48.428629 2026] [:error] [pid 15358:tid 15380] [client 13.70.6.109:8169] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/include.php"] [unique_id "aV7VOCoRk9xWJ3toSBLI9AAAAMo"]
[Thu Jan 08 05:50:49.439613 2026] [:error] [pid 15358:tid 15385] [client 13.70.6.109:8154] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV7VOSoRk9xWJ3toSBLI9wAAAM8"]
[Thu Jan 08 05:50:50.953007 2026] [:error] [pid 15265:tid 15334] [client 13.70.6.109:12495] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV7VOqE6VBKhew2LTFSgHQAAAIg"]
[Thu Jan 08 05:50:51.936456 2026] [:error] [pid 2484:tid 2490] [client 13.70.6.109:8172] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV7VOziDlnlaQQK_AEOHdwAAAUQ"]
[Thu Jan 08 05:50:53.416691 2026] [:error] [pid 15358:tid 15387] [client 13.70.6.109:12519] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/about.php"] [unique_id "aV7VPSoRk9xWJ3toSBLI-gAAANE"]
[Thu Jan 08 05:50:54.053749 2026] [:error] [pid 15265:tid 15328] [client 13.70.6.109:12443] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aV7VPqE6VBKhew2LTFSgIwAAAII"]
[Thu Jan 08 05:50:55.346382 2026] [:error] [pid 15265:tid 15331] [client 13.70.6.109:8166] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aV7VP6E6VBKhew2LTFSgLAAAAIU"]
[Thu Jan 08 05:50:57.813056 2026] [:error] [pid 15265:tid 15349] [client 13.70.6.109:8187] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aV7VQaE6VBKhew2LTFSgNAAAAJc"]
[Thu Jan 08 05:50:59.133192 2026] [:error] [pid 15265:tid 15350] [client 13.70.6.109:12479] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aV7VQ6E6VBKhew2LTFSgNgAAAJg"]
[Thu Jan 08 05:51:00.401422 2026] [:error] [pid 15265:tid 15328] [client 13.70.6.109:8186] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV7VRKE6VBKhew2LTFSgQAAAAII"]
[Thu Jan 08 05:51:01.687205 2026] [:error] [pid 15264:tid 15306] [client 13.70.6.109:8088] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV7VRYov6_kvS0Owh-p9DgAAAEc"]
[Thu Jan 08 05:51:02.366132 2026] [:error] [pid 15264:tid 15304] [client 13.70.6.109:8143] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV7VRoov6_kvS0Owh-p9DwAAAEU"]
[Thu Jan 08 05:51:03.191514 2026] [:error] [pid 2484:tid 2488] [client 13.70.6.109:8004] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/rk2.php"] [unique_id "aV7VRziDlnlaQQK_AEOHfgAAAUI"]
[Thu Jan 08 05:51:03.666718 2026] [:error] [pid 2484:tid 2486] [client 13.70.6.109:8074] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV7VRziDlnlaQQK_AEOHfwAAAUA"]
[Thu Jan 08 05:51:04.125019 2026] [:error] [pid 2484:tid 2489] [client 13.70.6.109:8109] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV7VSDiDlnlaQQK_AEOHgwAAAUM"]
[Thu Jan 08 05:51:04.713171 2026] [:error] [pid 2484:tid 2487] [client 13.70.6.109:8091] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV7VSDiDlnlaQQK_AEOHhgAAAUE"]
[Thu Jan 08 05:51:05.194547 2026] [:error] [pid 2484:tid 2495] [client 13.70.6.109:8130] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "aV7VSTiDlnlaQQK_AEOHigAAAUg"]
[Thu Jan 08 05:51:05.905016 2026] [:error] [pid 2424:tid 2447] [client 13.70.6.109:8142] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV7VSbTDJR8aofkBk9RiWwAAARU"]
[Thu Jan 08 05:51:06.474413 2026] [:error] [pid 2424:tid 2450] [client 13.70.6.109:12464] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV7VSrTDJR8aofkBk9RiXQAAARg"]
[Thu Jan 08 05:51:07.085696 2026] [:error] [pid 2484:tid 2512] [client 13.70.6.109:8010] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV7VSziDlnlaQQK_AEOHjQAAAVg"]
[Thu Jan 08 05:51:07.874529 2026] [:error] [pid 2424:tid 2438] [client 13.70.6.109:12522] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "aV7VS7TDJR8aofkBk9RiYAAAAQw"]
[Thu Jan 08 05:51:08.300563 2026] [:error] [pid 15263:tid 15275] [client 13.70.6.109:8188] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Jan 08 05:51:08.418307 2026] [:error] [pid 15263:tid 15282] [client 13.70.6.109:8188] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aV7VTNv61bxum7WG_e9ZlQAAAAo"]
[Thu Jan 08 05:51:08.980962 2026] [:error] [pid 15263:tid 15290] [client 13.70.6.109:8146] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aV7VTNv61bxum7WG_e9ZlwAAABI"]
[Thu Jan 08 05:51:09.522569 2026] [:error] [pid 15358:tid 15389] [client 13.70.6.109:12436] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aV7VTSoRk9xWJ3toSBLI_gAAANM"]
[Thu Jan 08 05:51:10.388930 2026] [:error] [pid 2484:tid 2487] [client 13.70.6.109:12490] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Jan 08 05:51:10.639718 2026] [:error] [pid 2484:tid 2496] [client 13.70.6.109:12490] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aV7VTjiDlnlaQQK_AEOHlgAAAUk"]
[Thu Jan 08 05:51:11.184057 2026] [:error] [pid 15265:tid 15349] [client 13.70.6.109:12435] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Thu Jan 08 05:51:11.390211 2026] [:error] [pid 15265:tid 15343] [client 13.70.6.109:12435] [client 13.70.6.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.70.6.109, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ectoplasm/wp-login.php"] [unique_id "aV7VT6E6VBKhew2LTFSgXAAAAJE"]
[Thu Jan 08 05:51:12.040616 2026] [:error] [pid 15265:tid 15339] [client 13.70.6.109:12435] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/preferences/index.php"] [unique_id "aV7VUKE6VBKhew2LTFSgYgAAAI0"]
[Thu Jan 08 05:51:12.889224 2026] [:error] [pid 15358:tid 15386] [client 13.70.6.109:8173] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/log.php"] [unique_id "aV7VUCoRk9xWJ3toSBLJAgAAANA"]
[Thu Jan 08 05:51:13.323674 2026] [:error] [pid 15358:tid 15385] [client 13.70.6.109:12452] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/log.php"] [unique_id "aV7VUSoRk9xWJ3toSBLJBAAAAM8"]
[Thu Jan 08 05:51:14.042421 2026] [:error] [pid 15265:tid 15340] [client 13.70.6.109:12491] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/log.php"] [unique_id "aV7VUqE6VBKhew2LTFSgZwAAAI4"]
[Thu Jan 08 05:51:15.299914 2026] [:error] [pid 2424:tid 2449] [client 13.70.6.109:12478] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/log.php"] [unique_id "aV7VU7TDJR8aofkBk9RiagAAARc"]
[Thu Jan 08 05:51:16.452670 2026] [:error] [pid 15264:tid 15301] [client 13.70.6.109:8014] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aV7VVIov6_kvS0Owh-p9EwAAAEI"]
[Thu Jan 08 05:51:17.569849 2026] [:error] [pid 15265:tid 15343] [client 13.70.6.109:8144] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aV7VVaE6VBKhew2LTFSgbwAAAJE"]
[Thu Jan 08 05:51:18.723063 2026] [:error] [pid 15265:tid 15339] [client 13.70.6.109:8180] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aV7VVqE6VBKhew2LTFSgcQAAAI0"]
[Thu Jan 08 05:51:19.684931 2026] [:error] [pid 2424:tid 2431] [client 13.70.6.109:12497] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aV7VV7TDJR8aofkBk9RibQAAAQU"]
[Thu Jan 08 05:51:20.284844 2026] [:error] [pid 15265:tid 15344] [client 13.70.6.109:8150] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aV7VWKE6VBKhew2LTFSgdgAAAJI"]
[Thu Jan 08 05:51:21.578086 2026] [:error] [pid 15264:tid 15318] [client 13.70.6.109:8155] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aV7VWYov6_kvS0Owh-p9GgAAAFM"]
[Thu Jan 08 05:51:22.306159 2026] [:error] [pid 2484:tid 2498] [client 13.70.6.109:8094] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/vuln.php"] [unique_id "aV7VWjiDlnlaQQK_AEOHoAAAAUs"]
[Thu Jan 08 05:51:23.509584 2026] [:error] [pid 2424:tid 2429] [client 13.70.6.109:12475] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aV7VW7TDJR8aofkBk9RicQAAAQM"]
[Thu Jan 08 05:51:25.583443 2026] [:error] [pid 15358:tid 15385] [client 13.70.6.109:8170] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aV7VXSoRk9xWJ3toSBLJFQAAAM8"]
[Thu Jan 08 05:51:26.105453 2026] [:error] [pid 2424:tid 2444] [client 13.70.6.109:12455] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "aV7VXrTDJR8aofkBk9RidQAAARI"]
[Thu Jan 08 05:51:26.881519 2026] [:error] [pid 15265:tid 15350] [client 13.70.6.109:8159] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "aV7VXqE6VBKhew2LTFSggAAAAJg"]
[Thu Jan 08 05:51:27.692677 2026] [:error] [pid 15358:tid 15375] [client 13.70.6.109:8092] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "aV7VXyoRk9xWJ3toSBLJFwAAAMU"]
[Thu Jan 08 05:51:28.117623 2026] [:error] [pid 15265:tid 15337] [client 13.70.6.109:8124] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "aV7VYKE6VBKhew2LTFSgggAAAIs"]
[Thu Jan 08 05:51:29.332065 2026] [:error] [pid 15264:tid 15320] [client 13.70.6.109:8084] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/404.php"] [unique_id "aV7VYYov6_kvS0Owh-p9HwAAAFU"]
[Thu Jan 08 05:51:29.713211 2026] [:error] [pid 15263:tid 15295] [client 13.70.6.109:8079] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/404.php"] [unique_id "aV7VYdv61bxum7WG_e9ZpwAAABc"]
[Thu Jan 08 05:51:30.398822 2026] [:error] [pid 15263:tid 15273] [client 13.70.6.109:8016] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/404.php"] [unique_id "aV7VYtv61bxum7WG_e9ZqQAAAAE"]
[Thu Jan 08 05:51:30.979234 2026] [:error] [pid 2484:tid 2493] [client 13.70.6.109:12469] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/404.php"] [unique_id "aV7VYjiDlnlaQQK_AEOHpgAAAUY"]
[Thu Jan 08 05:51:31.712925 2026] [:error] [pid 2424:tid 2436] [client 13.70.6.109:12461] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/languages/asus.php"] [unique_id "aV7VY7TDJR8aofkBk9RieQAAAQo"]
[Thu Jan 08 05:51:32.970144 2026] [:error] [pid 15264:tid 15311] [client 13.70.6.109:8160] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/languages/asus.php"] [unique_id "aV7VZIov6_kvS0Owh-p9IQAAAEw"]
[Thu Jan 08 05:51:33.447646 2026] [:error] [pid 2484:tid 2487] [client 13.70.6.109:8119] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/languages/asus.php"] [unique_id "aV7VZTiDlnlaQQK_AEOHqQAAAUE"]
[Thu Jan 08 05:51:34.114000 2026] [:error] [pid 2484:tid 2510] [client 13.70.6.109:12530] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/languages/asus.php"] [unique_id "aV7VZjiDlnlaQQK_AEOHrAAAAVY"]
[Thu Jan 08 05:51:34.657154 2026] [:error] [pid 2484:tid 2498] [client 13.70.6.109:12512] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aV7VZjiDlnlaQQK_AEOHrgAAAUs"]
[Thu Jan 08 05:51:35.167117 2026] [:error] [pid 15264:tid 15322] [client 13.70.6.109:8191] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aV7VZ4ov6_kvS0Owh-p9IgAAAFc"]
[Thu Jan 08 05:51:36.779000 2026] [:error] [pid 15358:tid 15386] [client 13.70.6.109:8158] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aV7VaCoRk9xWJ3toSBLJIwAAANA"]
[Thu Jan 08 05:51:37.469063 2026] [:error] [pid 2484:tid 2494] [client 13.70.6.109:8111] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aV7VaTiDlnlaQQK_AEOHsAAAAUc"]
[Thu Jan 08 05:51:38.001648 2026] [:error] [pid 15265:tid 15342] [client 13.70.6.109:8097] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/parx.php"] [unique_id "aV7VaqE6VBKhew2LTFSgjAAAAJA"]
[Thu Jan 08 05:51:38.754150 2026] [:error] [pid 15264:tid 15304] [client 13.70.6.109:12448] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/parx.php"] [unique_id "aV7Vaoov6_kvS0Owh-p9KAAAAEU"]
[Thu Jan 08 05:51:39.570166 2026] [:error] [pid 15264:tid 15303] [client 13.70.6.109:8087] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/parx.php"] [unique_id "aV7Va4ov6_kvS0Owh-p9KQAAAEQ"]
[Thu Jan 08 05:51:40.383808 2026] [:error] [pid 15358:tid 15383] [client 13.70.6.109:8125] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/parx.php"] [unique_id "aV7VbCoRk9xWJ3toSBLJLQAAAM0"]
[Thu Jan 08 05:51:41.169699 2026] [:error] [pid 15264:tid 15313] [client 13.70.6.109:8114] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aV7VbYov6_kvS0Owh-p9KwAAAE4"]
[Thu Jan 08 05:51:41.938001 2026] [:error] [pid 15264:tid 15302] [client 13.70.6.109:8189] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aV7VbYov6_kvS0Owh-p9LgAAAEM"]
[Thu Jan 08 05:51:42.867879 2026] [:error] [pid 2424:tid 2427] [client 13.70.6.109:12453] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aV7VbrTDJR8aofkBk9RifwAAAQE"]
[Thu Jan 08 05:51:43.593013 2026] [:error] [pid 2484:tid 2486] [client 13.70.6.109:12466] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aV7VbziDlnlaQQK_AEOHtwAAAUA"]
[Thu Jan 08 05:51:44.337271 2026] [:error] [pid 15264:tid 15314] [client 13.70.6.109:8181] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12wudscz.php"] [unique_id "aV7VcIov6_kvS0Owh-p9MgAAAE8"]
[Thu Jan 08 05:51:44.876768 2026] [:error] [pid 15264:tid 15309] [client 13.70.6.109:8167] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12wudscz.php"] [unique_id "aV7VcIov6_kvS0Owh-p9NQAAAEo"]
[Thu Jan 08 05:51:45.912083 2026] [:error] [pid 2424:tid 2436] [client 13.70.6.109:8085] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12wudscz.php"] [unique_id "aV7VcbTDJR8aofkBk9RihAAAAQo"]
[Thu Jan 08 05:51:47.082937 2026] [:error] [pid 15265:tid 15340] [client 13.70.6.109:8137] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12wudscz.php"] [unique_id "aV7Vc6E6VBKhew2LTFSgmwAAAI4"]
[Thu Jan 08 05:51:47.347606 2026] [:error] [pid 2424:tid 2433] [client 13.70.6.109:8043] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV7Vc7TDJR8aofkBk9RihQAAAQc"]
[Thu Jan 08 05:51:48.504142 2026] [:error] [pid 15358:tid 15379] [client 13.70.6.109:8078] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV7VdCoRk9xWJ3toSBLJPwAAAMk"]
[Thu Jan 08 05:51:49.615618 2026] [:error] [pid 15263:tid 15296] [client 13.70.6.109:8162] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV7Vddv61bxum7WG_e9ZtwAAABg"]
[Thu Jan 08 05:51:50.402337 2026] [:error] [pid 15263:tid 15279] [client 13.70.6.109:8136] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/wp-pridmag/admin.php"] [unique_id "aV7Vdtv61bxum7WG_e9ZuQAAAAc"]
[Thu Jan 08 05:51:50.809391 2026] [:error] [pid 15358:tid 15390] [client 13.70.6.109:8148] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aV7VdioRk9xWJ3toSBLJRAAAANQ"]
[Thu Jan 08 05:51:51.633903 2026] [:error] [pid 2424:tid 2431] [client 13.70.6.109:8100] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV7Vd7TDJR8aofkBk9RihwAAAQU"]
[Thu Jan 08 05:51:52.258534 2026] [:error] [pid 2424:tid 2429] [client 13.70.6.109:8102] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV7VeLTDJR8aofkBk9RiigAAAQM"]
[Thu Jan 08 05:51:52.855695 2026] [:error] [pid 15263:tid 15277] [client 13.70.6.109:7943] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV7VeNv61bxum7WG_e9ZvgAAAAU"]
[Thu Jan 08 05:51:53.555064 2026] [:error] [pid 15358:tid 15385] [client 13.70.6.109:8164] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/background-image-cropper/plugins.php"] [unique_id "aV7VeSoRk9xWJ3toSBLJSAAAAM8"]
[Thu Jan 08 05:51:54.083973 2026] [:error] [pid 2484:tid 2503] [client 13.70.6.109:12449] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aV7VejiDlnlaQQK_AEOHugAAAU8"]
[Thu Jan 08 05:51:54.375875 2026] [:error] [pid 2484:tid 2512] [client 13.70.6.109:7952] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aV7VejiDlnlaQQK_AEOHuwAAAVg"]
[Thu Jan 08 05:51:54.945281 2026] [:error] [pid 15264:tid 15309] [client 13.70.6.109:8116] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aV7Veoov6_kvS0Owh-p9OgAAAEo"]
[Thu Jan 08 05:51:55.394009 2026] [:error] [pid 15358:tid 15394] [client 13.70.6.109:8174] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aV7VeyoRk9xWJ3toSBLJSwAAANg"]
[Thu Jan 08 05:51:56.753219 2026] [:error] [pid 15264:tid 15303] [client 13.70.6.109:8135] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/wp-login.php"] [unique_id "aV7VfIov6_kvS0Owh-p9PQAAAEQ"]
[Thu Jan 08 05:51:57.311267 2026] [:error] [pid 15265:tid 15333] [client 13.70.6.109:8190] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV7VfaE6VBKhew2LTFSgrgAAAIc"]
[Thu Jan 08 05:51:58.453812 2026] [:error] [pid 15264:tid 15313] [client 13.70.6.109:8045] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV7Vfoov6_kvS0Owh-p9PwAAAE4"]
[Thu Jan 08 05:51:59.437974 2026] [:error] [pid 2484:tid 2506] [client 13.70.6.109:8110] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV7VfziDlnlaQQK_AEOHvgAAAVI"]
[Thu Jan 08 05:52:00.410240 2026] [:error] [pid 2484:tid 2487] [client 13.70.6.109:8022] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/users.php"] [unique_id "aV7VgDiDlnlaQQK_AEOHwQAAAUE"]
[Thu Jan 08 05:52:01.480215 2026] [:error] [pid 15265:tid 15329] [client 13.70.6.109:8086] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aV7VgaE6VBKhew2LTFSgtQAAAIM"]
[Thu Jan 08 05:52:02.442837 2026] [:error] [pid 15263:tid 15287] [client 13.70.6.109:8098] [client 13.70.6.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aV7Vgtv61bxum7WG_e9ZyAAAAA8"]
[Thu Jan 08 05:52:03.188018 2026] [:error] [pid 15264:tid 15302] [client 13.70.6.109:8120] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/about.php"] [unique_id "aV7Vg4ov6_kvS0Owh-p9QQAAAEM"]
[Thu Jan 08 05:52:03.765044 2026] [:error] [pid 15264:tid 15321] [client 13.70.6.109:8061] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/about.php"] [unique_id "aV7Vg4ov6_kvS0Owh-p9RAAAAFY"]
[Thu Jan 08 05:52:04.214909 2026] [:error] [pid 15358:tid 15385] [client 13.70.6.109:12498] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/about.php"] [unique_id "aV7VhCoRk9xWJ3toSBLJVgAAAM8"]
[Thu Jan 08 05:52:04.682794 2026] [:error] [pid 15265:tid 15328] [client 13.70.6.109:8039] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/about.php"] [unique_id "aV7VhKE6VBKhew2LTFSgvQAAAII"]
[Thu Jan 08 05:52:05.406789 2026] [:error] [pid 15264:tid 15304] [client 13.70.6.109:8157] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aV7VhYov6_kvS0Owh-p9SAAAAEU"]
[Thu Jan 08 05:52:10.758991 2026] [:error] [pid 15264:tid 15305] [client 13.70.6.109:12517] [client 13.70.6.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aV7Vioov6_kvS0Owh-p9TQAAAEY"]
[Thu Jan 08 05:52:11.157438 2026] [:error] [pid 15264:tid 15310] [client 13.70.6.109:8002] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Jan 08 07:13:35.428683 2026] [:error] [pid 15265:tid 15330] [client 43.154.140.188:37810] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aV7on6E6VBKhew2LTFSw5gAAAIQ"]
[Thu Jan 08 09:45:10.731931 2026] [:error] [pid 15265:tid 15346] [client 103.163.208.141:56220] File does not exist: /usr/local/apache/htdocs/suspended-page/baker.php
[Thu Jan 08 11:05:59.403728 2026] [:error] [pid 7586:tid 7599] [client 170.106.113.159:34380] [client 170.106.113.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV8fF8Jyk37GdXP5TmUN-wAAAcs"]
[Thu Jan 08 13:56:50.182828 2026] [:error] [pid 15263:tid 15296] [client 36.111.67.189:41111] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV9HItv61bxum7WG_e_FrwAAABg"]
[Thu Jan 08 17:19:31.227133 2026] [:error] [pid 17404:tid 17420] [client 43.166.247.82:47874] [client 43.166.247.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV92o2Vd_oH193N6AnWcAQAAAY4"]
[Thu Jan 08 19:48:53.633170 2026] [:error] [pid 17404:tid 17417] [client 43.134.141.244:44910] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aV-ZpWVd_oH193N6AnWyxwAAAYs"]
[Thu Jan 08 23:06:40.699695 2026] [:error] [pid 15263:tid 15278] [client 43.153.15.51:34394] [client 43.153.15.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aV_IANv61bxum7WG_e8ZIwAAAAY"]
[Fri Jan 09 01:51:12.424756 2026] [:error] [pid 15263:tid 15294] [client 170.106.65.93:55122] [client 170.106.65.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aV_ukNv61bxum7WG_e87hAAAABY"]
[Fri Jan 09 06:09:55.823959 2026] [:error] [pid 10431:tid 10434] [client 43.166.246.180:49660] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWArMykUbiVdwQzsJJTd-AAAAQA"]
[Fri Jan 09 08:21:59.965443 2026] [:error] [pid 35812:tid 35881] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Fri Jan 09 08:22:00.085938 2026] [:error] [pid 35812:tid 35884] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Fri Jan 09 08:22:00.206092 2026] [:error] [pid 35812:tid 35897] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Jan 09 08:22:00.328115 2026] [:error] [pid 35812:tid 35882] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Jan 09 08:22:00.449765 2026] [:error] [pid 35812:tid 35878] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/an8.php
[Fri Jan 09 08:22:00.571772 2026] [:error] [pid 35812:tid 35894] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Fri Jan 09 08:22:00.692646 2026] [:error] [pid 35812:tid 35895] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Jan 09 08:22:00.814274 2026] [:error] [pid 35812:tid 35880] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/ma.php
[Fri Jan 09 08:22:00.935914 2026] [:error] [pid 35812:tid 35875] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Fri Jan 09 08:22:01.056175 2026] [:error] [pid 35812:tid 35893] [client 20.205.123.55:16001] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Fri Jan 09 08:22:01.173586 2026] [:error] [pid 35812:tid 35877] [client 20.205.123.55:16001] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xrp.php"] [unique_id "aWBKKUAss1qSj44c-n02bwAAAIM"]
[Fri Jan 09 08:22:01.407672 2026] [:error] [pid 35811:tid 35862] [client 20.205.123.55:16098] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xrp.php"] [unique_id "aWBKKW7lx9V0CvYJJf348QAAAE8"]
[Fri Jan 09 08:22:01.648644 2026] [:error] [pid 35810:tid 35826] [client 20.205.123.55:16016] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xrp.php"] [unique_id "aWBKKYrJrhH8tOUNM5AuTAAAAAc"]
[Fri Jan 09 08:22:01.884158 2026] [:error] [pid 35916:tid 35925] [client 20.205.123.55:16099] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xrp.php"] [unique_id "aWBKKfnSLfzabNjOjwzl-QAAAMc"]
[Fri Jan 09 08:22:02.117093 2026] [:error] [pid 35811:tid 35849] [client 20.205.123.55:16010] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aWBKKm7lx9V0CvYJJf348wAAAEI"]
[Fri Jan 09 08:22:02.352126 2026] [:error] [pid 35810:tid 35827] [client 20.205.123.55:16124] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aWBKKorJrhH8tOUNM5AuTgAAAAg"]
[Fri Jan 09 08:22:02.585245 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:16026] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aWBKKkAss1qSj44c-n02cgAAAJg"]
[Fri Jan 09 08:22:02.828734 2026] [:error] [pid 35916:tid 35936] [client 20.205.123.55:16127] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aWBKKvnSLfzabNjOjwzl_QAAANI"]
[Fri Jan 09 08:22:03.068352 2026] [:error] [pid 10431:tid 10437] [client 20.205.123.55:16111] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws28.php"] [unique_id "aWBKKykUbiVdwQzsJJQnNQAAAQM"]
[Fri Jan 09 08:22:03.305087 2026] [:error] [pid 35810:tid 35841] [client 20.205.123.55:16122] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws28.php"] [unique_id "aWBKK4rJrhH8tOUNM5AuUgAAABY"]
[Fri Jan 09 08:22:03.542100 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:16085] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws28.php"] [unique_id "aWBKK_nSLfzabNjOjwzl_gAAAME"]
[Fri Jan 09 08:22:03.775627 2026] [:error] [pid 35810:tid 35828] [client 20.205.123.55:16041] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws28.php"] [unique_id "aWBKK4rJrhH8tOUNM5AuVAAAAAk"]
[Fri Jan 09 08:22:04.015595 2026] [:error] [pid 35810:tid 35837] [client 20.205.123.55:16094] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aWBKLIrJrhH8tOUNM5AuVQAAABI"]
[Fri Jan 09 08:22:04.256396 2026] [:error] [pid 35916:tid 35923] [client 20.205.123.55:16123] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aWBKLPnSLfzabNjOjwzmAQAAAMU"]
[Fri Jan 09 08:22:04.497932 2026] [:error] [pid 10431:tid 10435] [client 20.205.123.55:16019] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aWBKLCkUbiVdwQzsJJQnOQAAAQE"]
[Fri Jan 09 08:22:04.745480 2026] [:error] [pid 35916:tid 35931] [client 20.205.123.55:16093] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/num.php"] [unique_id "aWBKLPnSLfzabNjOjwzmAgAAAM0"]
[Fri Jan 09 08:22:04.996506 2026] [:error] [pid 35810:tid 35823] [client 20.205.123.55:16105] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aWBKLIrJrhH8tOUNM5AuXAAAAAQ"]
[Fri Jan 09 08:22:05.237068 2026] [:error] [pid 35810:tid 35840] [client 20.205.123.55:16000] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aWBKLYrJrhH8tOUNM5AuXgAAABU"]
[Fri Jan 09 08:22:05.473071 2026] [:error] [pid 35812:tid 35885] [client 20.205.123.55:16028] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aWBKLUAss1qSj44c-n02fwAAAIs"]
[Fri Jan 09 08:22:05.718063 2026] [:error] [pid 10431:tid 10438] [client 20.205.123.55:16092] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gmo.php"] [unique_id "aWBKLSkUbiVdwQzsJJQnOwAAAQQ"]
[Fri Jan 09 08:22:05.997171 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:16084] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app.php"] [unique_id "aWBKLUAss1qSj44c-n02gQAAAJg"]
[Fri Jan 09 08:22:06.256830 2026] [:error] [pid 35812:tid 35874] [client 20.205.123.55:8186] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app.php"] [unique_id "aWBKLkAss1qSj44c-n02gwAAAIA"]
[Fri Jan 09 08:22:06.507008 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:16029] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app.php"] [unique_id "aWBKLkAss1qSj44c-n02hAAAAII"]
[Fri Jan 09 08:22:06.741175 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:16096] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app.php"] [unique_id "aWBKLvnSLfzabNjOjwzmBQAAANY"]
[Fri Jan 09 08:22:07.002610 2026] [:error] [pid 10431:tid 10434] [client 20.205.123.55:16107] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aWBKLykUbiVdwQzsJJQnQQAAAQA"]
[Fri Jan 09 08:22:07.243349 2026] [:error] [pid 35810:tid 35830] [client 20.205.123.55:8138] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aWBKL4rJrhH8tOUNM5AuYAAAAAs"]
[Fri Jan 09 08:22:07.479161 2026] [:error] [pid 10431:tid 10448] [client 20.205.123.55:16079] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aWBKLykUbiVdwQzsJJQnQgAAAQ4"]
[Fri Jan 09 08:22:07.714250 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:16014] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aWBKLykUbiVdwQzsJJQnQwAAAQo"]
[Fri Jan 09 08:22:07.949367 2026] [:error] [pid 35812:tid 35877] [client 20.205.123.55:16108] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dox.php"] [unique_id "aWBKL0Ass1qSj44c-n02iwAAAIM"]
[Fri Jan 09 08:22:08.183188 2026] [:error] [pid 35810:tid 35839] [client 20.205.123.55:16119] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dox.php"] [unique_id "aWBKMIrJrhH8tOUNM5AuYgAAABQ"]
[Fri Jan 09 08:22:08.418586 2026] [:error] [pid 35916:tid 35923] [client 20.205.123.55:16020] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dox.php"] [unique_id "aWBKMPnSLfzabNjOjwzmCgAAAMU"]
[Fri Jan 09 08:22:08.718564 2026] [:error] [pid 35811:tid 35865] [client 20.205.123.55:16054] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dox.php"] [unique_id "aWBKMG7lx9V0CvYJJf35BAAAAFI"]
[Fri Jan 09 08:22:08.953645 2026] [:error] [pid 35811:tid 35851] [client 20.205.123.55:16015] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aWBKMG7lx9V0CvYJJf35BQAAAEQ"]
[Fri Jan 09 08:22:09.193330 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:16021] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aWBKMUAss1qSj44c-n02jQAAAJg"]
[Fri Jan 09 08:22:09.448770 2026] [:error] [pid 35811:tid 35868] [client 20.205.123.55:8147] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aWBKMW7lx9V0CvYJJf35BgAAAFU"]
[Fri Jan 09 08:22:09.773197 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:16075] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aWBKMUAss1qSj44c-n02jwAAAII"]
[Fri Jan 09 08:22:10.031409 2026] [:error] [pid 35812:tid 35879] [client 20.205.123.55:16103] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aWBKMkAss1qSj44c-n02kgAAAIU"]
[Fri Jan 09 08:22:10.272467 2026] [:error] [pid 35811:tid 35863] [client 20.205.123.55:16025] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aWBKMm7lx9V0CvYJJf35CgAAAFA"]
[Fri Jan 09 08:22:10.515471 2026] [:error] [pid 35812:tid 35894] [client 20.205.123.55:16068] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aWBKMkAss1qSj44c-n02lQAAAJQ"]
[Fri Jan 09 08:22:10.749737 2026] [:error] [pid 10431:tid 10453] [client 20.205.123.55:16052] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aWBKMikUbiVdwQzsJJQnSgAAARM"]
[Fri Jan 09 08:22:10.983099 2026] [:error] [pid 10431:tid 10436] [client 20.205.123.55:8133] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aWBKMikUbiVdwQzsJJQnSwAAAQI"]
[Fri Jan 09 08:22:11.217006 2026] [:error] [pid 10431:tid 10447] [client 20.205.123.55:16117] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aWBKMykUbiVdwQzsJJQnTAAAAQ0"]
[Fri Jan 09 08:22:11.459451 2026] [:error] [pid 35811:tid 35856] [client 20.205.123.55:16051] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aWBKM27lx9V0CvYJJf35DAAAAEk"]
[Fri Jan 09 08:22:11.704699 2026] [:error] [pid 35811:tid 35859] [client 20.205.123.55:16121] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aWBKM27lx9V0CvYJJf35DQAAAEw"]
[Fri Jan 09 08:22:11.939742 2026] [:error] [pid 35812:tid 35886] [client 20.205.123.55:16017] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aWBKM0Ass1qSj44c-n02nAAAAIw"]
[Fri Jan 09 08:22:12.174310 2026] [:error] [pid 35811:tid 35865] [client 20.205.123.55:16126] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aWBKNG7lx9V0CvYJJf35DwAAAFI"]
[Fri Jan 09 08:22:12.408244 2026] [:error] [pid 35916:tid 35924] [client 20.205.123.55:16061] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aWBKNPnSLfzabNjOjwzmDgAAAMY"]
[Fri Jan 09 08:22:12.641619 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:16113] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aWBKNPnSLfzabNjOjwzmDwAAANY"]
[Fri Jan 09 08:22:12.874648 2026] [:error] [pid 35812:tid 35887] [client 20.205.123.55:16047] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f8.php"] [unique_id "aWBKNEAss1qSj44c-n02nwAAAI0"]
[Fri Jan 09 08:22:13.109794 2026] [:error] [pid 35812:tid 35882] [client 20.205.123.55:16066] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f8.php"] [unique_id "aWBKNUAss1qSj44c-n02ogAAAIg"]
[Fri Jan 09 08:22:13.345302 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:16006] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f8.php"] [unique_id "aWBKNfnSLfzabNjOjwzmEwAAAME"]
[Fri Jan 09 08:22:13.577920 2026] [:error] [pid 35916:tid 35920] [client 20.205.123.55:16031] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f8.php"] [unique_id "aWBKNfnSLfzabNjOjwzmFAAAAMI"]
[Fri Jan 09 08:22:13.856126 2026] [:error] [pid 35916:tid 35929] [client 20.205.123.55:16078] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moon3.php"] [unique_id "aWBKNfnSLfzabNjOjwzmFgAAAMs"]
[Fri Jan 09 08:22:14.088592 2026] [:error] [pid 35916:tid 35923] [client 20.205.123.55:16042] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moon3.php"] [unique_id "aWBKNvnSLfzabNjOjwzmGAAAAMU"]
[Fri Jan 09 08:22:14.328732 2026] [:error] [pid 35916:tid 35933] [client 20.205.123.55:16071] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moon3.php"] [unique_id "aWBKNvnSLfzabNjOjwzmGwAAAM8"]
[Fri Jan 09 08:22:14.567913 2026] [:error] [pid 35810:tid 35831] [client 20.205.123.55:16118] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moon3.php"] [unique_id "aWBKNorJrhH8tOUNM5AubAAAAAw"]
[Fri Jan 09 08:22:14.808355 2026] [:error] [pid 10431:tid 10455] [client 20.205.123.55:8145] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ffile.php"] [unique_id "aWBKNikUbiVdwQzsJJQnUQAAARU"]
[Fri Jan 09 08:22:15.050242 2026] [:error] [pid 35812:tid 35891] [client 20.205.123.55:8174] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ffile.php"] [unique_id "aWBKN0Ass1qSj44c-n02pwAAAJE"]
[Fri Jan 09 08:22:15.291019 2026] [:error] [pid 10431:tid 10443] [client 20.205.123.55:16002] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ffile.php"] [unique_id "aWBKNykUbiVdwQzsJJQnUgAAAQk"]
[Fri Jan 09 08:22:15.532996 2026] [:error] [pid 35810:tid 35823] [client 20.205.123.55:16083] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ffile.php"] [unique_id "aWBKN4rJrhH8tOUNM5AubgAAAAQ"]
[Fri Jan 09 08:22:15.773015 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:8140] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X7x.php"] [unique_id "aWBKN_nSLfzabNjOjwzmHgAAANY"]
[Fri Jan 09 08:22:16.014856 2026] [:error] [pid 10431:tid 10441] [client 20.205.123.55:8156] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X7x.php"] [unique_id "aWBKOCkUbiVdwQzsJJQnVQAAAQc"]
[Fri Jan 09 08:22:16.257859 2026] [:error] [pid 35811:tid 35854] [client 20.205.123.55:8073] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X7x.php"] [unique_id "aWBKOG7lx9V0CvYJJf35FgAAAEc"]
[Fri Jan 09 08:22:16.497269 2026] [:error] [pid 35916:tid 35932] [client 20.205.123.55:16090] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X7x.php"] [unique_id "aWBKOPnSLfzabNjOjwzmIQAAAM4"]
[Fri Jan 09 08:22:16.747356 2026] [:error] [pid 35811:tid 35855] [client 20.205.123.55:8132] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxxx.php"] [unique_id "aWBKOG7lx9V0CvYJJf35GAAAAEg"]
[Fri Jan 09 08:22:17.008586 2026] [:error] [pid 10431:tid 10436] [client 20.205.123.55:16109] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxxx.php"] [unique_id "aWBKOSkUbiVdwQzsJJQnVwAAAQI"]
[Fri Jan 09 08:22:17.246679 2026] [:error] [pid 35811:tid 35848] [client 20.205.123.55:8160] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxxx.php"] [unique_id "aWBKOW7lx9V0CvYJJf35GgAAAEE"]
[Fri Jan 09 08:22:17.488656 2026] [:error] [pid 35916:tid 35923] [client 20.205.123.55:16038] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxxx.php"] [unique_id "aWBKOfnSLfzabNjOjwzmIwAAAMU"]
[Fri Jan 09 08:22:17.728517 2026] [:error] [pid 35812:tid 35878] [client 20.205.123.55:16053] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aWBKOUAss1qSj44c-n02rQAAAIQ"]
[Fri Jan 09 08:22:17.962239 2026] [:error] [pid 35916:tid 35928] [client 20.205.123.55:16069] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aWBKOfnSLfzabNjOjwzmJQAAAMo"]
[Fri Jan 09 08:22:18.196843 2026] [:error] [pid 35916:tid 35941] [client 20.205.123.55:8146] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aWBKOvnSLfzabNjOjwzmJgAAANc"]
[Fri Jan 09 08:22:18.436825 2026] [:error] [pid 10431:tid 10447] [client 20.205.123.55:16018] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aWBKOikUbiVdwQzsJJQnWAAAAQ0"]
[Fri Jan 09 08:22:18.677187 2026] [:error] [pid 10431:tid 10451] [client 20.205.123.55:8148] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gec.php"] [unique_id "aWBKOikUbiVdwQzsJJQnWQAAARE"]
[Fri Jan 09 08:22:18.910856 2026] [:error] [pid 35810:tid 35833] [client 20.205.123.55:16076] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gec.php"] [unique_id "aWBKOorJrhH8tOUNM5AucgAAAA4"]
[Fri Jan 09 08:22:19.179151 2026] [:error] [pid 35811:tid 35869] [client 20.205.123.55:8080] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gec.php"] [unique_id "aWBKO27lx9V0CvYJJf35HgAAAFY"]
[Fri Jan 09 08:22:19.413043 2026] [:error] [pid 35810:tid 35824] [client 20.205.123.55:16097] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gec.php"] [unique_id "aWBKO4rJrhH8tOUNM5AucwAAAAU"]
[Fri Jan 09 08:22:19.646771 2026] [:error] [pid 10431:tid 10452] [client 20.205.123.55:16081] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aWBKOykUbiVdwQzsJJQnXgAAARI"]
[Fri Jan 09 08:22:19.881145 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:16023] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aWBKOykUbiVdwQzsJJQnXwAAAQw"]
[Fri Jan 09 08:22:20.115579 2026] [:error] [pid 35810:tid 35839] [client 20.205.123.55:8143] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aWBKPIrJrhH8tOUNM5AudQAAABQ"]
[Fri Jan 09 08:22:20.349707 2026] [:error] [pid 35810:tid 35842] [client 20.205.123.55:16013] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aWBKPIrJrhH8tOUNM5AudgAAABc"]
[Fri Jan 09 08:22:20.584173 2026] [:error] [pid 35810:tid 35838] [client 20.205.123.55:8150] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file30.php"] [unique_id "aWBKPIrJrhH8tOUNM5AueQAAABM"]
[Fri Jan 09 08:22:20.819943 2026] [:error] [pid 35811:tid 35867] [client 20.205.123.55:16072] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file30.php"] [unique_id "aWBKPG7lx9V0CvYJJf35JwAAAFQ"]
[Fri Jan 09 08:22:21.072162 2026] [:error] [pid 35812:tid 35891] [client 20.205.123.55:16106] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file30.php"] [unique_id "aWBKPUAss1qSj44c-n02swAAAJE"]
[Fri Jan 09 08:22:21.333678 2026] [:error] [pid 35916:tid 35929] [client 20.205.123.55:16039] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file30.php"] [unique_id "aWBKPfnSLfzabNjOjwzmKgAAAMs"]
[Fri Jan 09 08:22:21.583636 2026] [:error] [pid 35812:tid 35874] [client 20.205.123.55:8155] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aWBKPUAss1qSj44c-n02tgAAAIA"]
[Fri Jan 09 08:22:21.836490 2026] [:error] [pid 35812:tid 35879] [client 20.205.123.55:8070] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aWBKPUAss1qSj44c-n02uAAAAIU"]
[Fri Jan 09 08:22:22.087154 2026] [:error] [pid 35812:tid 35887] [client 20.205.123.55:16040] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aWBKPkAss1qSj44c-n02uQAAAI0"]
[Fri Jan 09 08:22:22.366636 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:16104] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aWBKPm7lx9V0CvYJJf35LQAAAEA"]
[Fri Jan 09 08:22:22.600335 2026] [:error] [pid 35916:tid 35925] [client 20.205.123.55:16012] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aWBKPvnSLfzabNjOjwzmLgAAAMc"]
[Fri Jan 09 08:22:22.841647 2026] [:error] [pid 35916:tid 35933] [client 20.205.123.55:16100] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aWBKPvnSLfzabNjOjwzmMAAAAM8"]
[Fri Jan 09 08:22:23.077576 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:16004] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aWBKP_nSLfzabNjOjwzmMQAAANY"]
[Fri Jan 09 08:22:23.313061 2026] [:error] [pid 35916:tid 35937] [client 20.205.123.55:16048] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aWBKP_nSLfzabNjOjwzmMwAAANM"]
[Fri Jan 09 08:22:23.552934 2026] [:error] [pid 35916:tid 35932] [client 20.205.123.55:16091] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xml.php"] [unique_id "aWBKP_nSLfzabNjOjwzmNgAAAM4"]
[Fri Jan 09 08:22:23.793084 2026] [:error] [pid 10431:tid 10454] [client 20.205.123.55:8141] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xml.php"] [unique_id "aWBKPykUbiVdwQzsJJQnZQAAARQ"]
[Fri Jan 09 08:22:24.033876 2026] [:error] [pid 35812:tid 35884] [client 20.205.123.55:8144] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xml.php"] [unique_id "aWBKQEAss1qSj44c-n02vAAAAIo"]
[Fri Jan 09 08:22:24.280746 2026] [:error] [pid 10431:tid 10453] [client 20.205.123.55:8139] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xml.php"] [unique_id "aWBKQCkUbiVdwQzsJJQnZgAAARM"]
[Fri Jan 09 08:22:24.514665 2026] [:error] [pid 10431:tid 10458] [client 20.205.123.55:8159] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless14.php"] [unique_id "aWBKQCkUbiVdwQzsJJQnZwAAARg"]
[Fri Jan 09 08:22:24.748665 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:16080] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless14.php"] [unique_id "aWBKQEAss1qSj44c-n02vgAAAJg"]
[Fri Jan 09 08:22:24.981688 2026] [:error] [pid 10431:tid 10434] [client 20.205.123.55:16045] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless14.php"] [unique_id "aWBKQCkUbiVdwQzsJJQnagAAAQA"]
[Fri Jan 09 08:22:25.214245 2026] [:error] [pid 35812:tid 35883] [client 20.205.123.55:16125] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless14.php"] [unique_id "aWBKQUAss1qSj44c-n02wAAAAIk"]
[Fri Jan 09 08:22:25.447809 2026] [:error] [pid 35810:tid 35837] [client 20.205.123.55:16008] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aWBKQYrJrhH8tOUNM5AuhAAAABI"]
[Fri Jan 09 08:22:25.680188 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:8116] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aWBKQSkUbiVdwQzsJJQnbAAAAQw"]
[Fri Jan 09 08:22:25.913440 2026] [:error] [pid 35811:tid 35848] [client 20.205.123.55:16011] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aWBKQW7lx9V0CvYJJf35MgAAAEE"]
[Fri Jan 09 08:22:26.166364 2026] [:error] [pid 35916:tid 35927] [client 20.205.123.55:16009] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aWBKQvnSLfzabNjOjwzmSAAAAMk"]
[Fri Jan 09 08:22:26.437724 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:16049] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aWBKQm7lx9V0CvYJJf35NAAAAEA"]
[Fri Jan 09 08:22:26.671893 2026] [:error] [pid 35916:tid 35938] [client 20.205.123.55:8158] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aWBKQvnSLfzabNjOjwzmTwAAANQ"]
[Fri Jan 09 08:22:26.907671 2026] [:error] [pid 35811:tid 35855] [client 20.205.123.55:16095] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aWBKQm7lx9V0CvYJJf35NQAAAEg"]
[Fri Jan 09 08:22:27.148073 2026] [:error] [pid 35916:tid 35934] [client 20.205.123.55:8157] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/oo.php"] [unique_id "aWBKQ_nSLfzabNjOjwzmVgAAANA"]
[Fri Jan 09 08:22:27.385433 2026] [:error] [pid 35916:tid 35941] [client 20.205.123.55:16033] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aWBKQ_nSLfzabNjOjwzmWgAAANc"]
[Fri Jan 09 08:22:27.620035 2026] [:error] [pid 35811:tid 35865] [client 20.205.123.55:8182] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aWBKQ27lx9V0CvYJJf35NgAAAFI"]
[Fri Jan 09 08:22:27.861118 2026] [:error] [pid 35810:tid 35828] [client 20.205.123.55:8172] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aWBKQ4rJrhH8tOUNM5AuiAAAAAk"]
[Fri Jan 09 08:22:28.103945 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:8130] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aWBKREAss1qSj44c-n02xgAAAII"]
[Fri Jan 09 08:22:28.348207 2026] [:error] [pid 10431:tid 10454] [client 20.205.123.55:8037] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aWBKRCkUbiVdwQzsJJQncAAAARQ"]
[Fri Jan 09 08:22:28.627411 2026] [:error] [pid 35811:tid 35860] [client 20.205.123.55:8187] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aWBKRG7lx9V0CvYJJf35OwAAAE0"]
[Fri Jan 09 08:22:28.867206 2026] [:error] [pid 10431:tid 10447] [client 20.205.123.55:16035] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aWBKRCkUbiVdwQzsJJQncgAAAQ0"]
[Fri Jan 09 08:22:29.107813 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:8113] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aWBKRW7lx9V0CvYJJf35PAAAAEA"]
[Fri Jan 09 08:22:29.358950 2026] [:error] [pid 35812:tid 35880] [client 20.205.123.55:16088] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aWBKRUAss1qSj44c-n02ygAAAIY"]
[Fri Jan 09 08:22:29.599299 2026] [:error] [pid 10431:tid 10452] [client 20.205.123.55:16043] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aWBKRSkUbiVdwQzsJJQndAAAARI"]
[Fri Jan 09 08:22:29.836294 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:16063] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aWBKRSkUbiVdwQzsJJQndQAAAQo"]
[Fri Jan 09 08:22:30.069617 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:16057] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aWBKRikUbiVdwQzsJJQndwAAAQw"]
[Fri Jan 09 08:22:30.315213 2026] [:error] [pid 35812:tid 35897] [client 20.205.123.55:16015] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aWBKRkAss1qSj44c-n02zQAAAJc"]
[Fri Jan 09 08:22:30.568974 2026] [:error] [pid 35810:tid 35833] [client 20.205.123.55:16007] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aWBKRorJrhH8tOUNM5AuigAAAA4"]
[Fri Jan 09 08:22:30.808253 2026] [:error] [pid 10431:tid 10453] [client 20.205.123.55:16120] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aWBKRikUbiVdwQzsJJQnfAAAARM"]
[Fri Jan 09 08:22:31.047481 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:8120] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gg.php"] [unique_id "aWBKRykUbiVdwQzsJJQnfQAAAQ8"]
[Fri Jan 09 08:22:31.279878 2026] [:error] [pid 35810:tid 35819] [client 20.205.123.55:16055] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aWBKR4rJrhH8tOUNM5AujgAAAAA"]
[Fri Jan 09 08:22:31.515008 2026] [:error] [pid 35810:tid 35829] [client 20.205.123.55:16070] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aWBKR4rJrhH8tOUNM5AujwAAAAo"]
[Fri Jan 09 08:22:31.754680 2026] [:error] [pid 35810:tid 35840] [client 20.205.123.55:16077] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aWBKR4rJrhH8tOUNM5AukAAAABU"]
[Fri Jan 09 08:22:31.987221 2026] [:error] [pid 35810:tid 35825] [client 20.205.123.55:16030] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/new2.php"] [unique_id "aWBKR4rJrhH8tOUNM5AukgAAAAY"]
[Fri Jan 09 08:22:32.221875 2026] [:error] [pid 35810:tid 35832] [client 20.205.123.55:16062] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aWBKSIrJrhH8tOUNM5AukwAAAA0"]
[Fri Jan 09 08:22:32.455456 2026] [:error] [pid 35812:tid 35890] [client 20.205.123.55:16101] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aWBKSEAss1qSj44c-n020wAAAJA"]
[Fri Jan 09 08:22:32.687562 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:8171] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aWBKSCkUbiVdwQzsJJQnhgAAAQw"]
[Fri Jan 09 08:22:32.927314 2026] [:error] [pid 10431:tid 10453] [client 20.205.123.55:8065] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws29.php"] [unique_id "aWBKSCkUbiVdwQzsJJQnigAAARM"]
[Fri Jan 09 08:22:33.167507 2026] [:error] [pid 10431:tid 10456] [client 20.205.123.55:16056] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wen.php"] [unique_id "aWBKSSkUbiVdwQzsJJQnjQAAARY"]
[Fri Jan 09 08:22:33.407489 2026] [:error] [pid 35811:tid 35850] [client 20.205.123.55:16064] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wen.php"] [unique_id "aWBKSW7lx9V0CvYJJf35QAAAAEM"]
[Fri Jan 09 08:22:33.693573 2026] [:error] [pid 35811:tid 35854] [client 20.205.123.55:16027] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wen.php"] [unique_id "aWBKSW7lx9V0CvYJJf35QQAAAEc"]
[Fri Jan 09 08:22:33.932692 2026] [:error] [pid 35916:tid 35921] [client 20.205.123.55:16044] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wen.php"] [unique_id "aWBKSfnSLfzabNjOjwzmkQAAAMM"]
[Fri Jan 09 08:22:34.164738 2026] [:error] [pid 35811:tid 35848] [client 20.205.123.55:16114] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass.php"] [unique_id "aWBKSm7lx9V0CvYJJf35QgAAAEE"]
[Fri Jan 09 08:22:34.404196 2026] [:error] [pid 35812:tid 35894] [client 20.205.123.55:8135] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass.php"] [unique_id "aWBKSkAss1qSj44c-n024gAAAJQ"]
[Fri Jan 09 08:22:34.643895 2026] [:error] [pid 35810:tid 35834] [client 20.205.123.55:16003] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass.php"] [unique_id "aWBKSorJrhH8tOUNM5AulgAAAA8"]
[Fri Jan 09 08:22:34.880451 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:8169] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass.php"] [unique_id "aWBKSkAss1qSj44c-n026gAAAII"]
[Fri Jan 09 08:22:35.114026 2026] [:error] [pid 10431:tid 10452] [client 20.205.123.55:8128] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aWBKSykUbiVdwQzsJJQnlAAAARI"]
[Fri Jan 09 08:22:35.346959 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:16032] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aWBKSykUbiVdwQzsJJQnlgAAAQo"]
[Fri Jan 09 08:22:35.580314 2026] [:error] [pid 35810:tid 35826] [client 20.205.123.55:8112] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aWBKS4rJrhH8tOUNM5AumAAAAAc"]
[Fri Jan 09 08:22:35.816372 2026] [:error] [pid 35810:tid 35835] [client 20.205.123.55:16058] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aWBKS4rJrhH8tOUNM5AumgAAABA"]
[Fri Jan 09 08:22:36.049116 2026] [:error] [pid 35810:tid 35837] [client 20.205.123.55:8163] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aWBKTIrJrhH8tOUNM5AunQAAABI"]
[Fri Jan 09 08:22:36.288148 2026] [:error] [pid 35811:tid 35851] [client 20.205.123.55:16050] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aWBKTG7lx9V0CvYJJf35RgAAAEQ"]
[Fri Jan 09 08:22:36.523240 2026] [:error] [pid 10431:tid 10451] [client 20.205.123.55:8129] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aWBKTCkUbiVdwQzsJJQnmAAAARE"]
[Fri Jan 09 08:22:36.757346 2026] [:error] [pid 35811:tid 35871] [client 20.205.123.55:16067] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/log.php"] [unique_id "aWBKTG7lx9V0CvYJJf35SAAAAFg"]
[Fri Jan 09 08:22:36.990406 2026] [:error] [pid 35812:tid 35893] [client 20.205.123.55:8136] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sitemaps.php"] [unique_id "aWBKTEAss1qSj44c-n028QAAAJM"]
[Fri Jan 09 08:22:37.249817 2026] [:error] [pid 35810:tid 35831] [client 20.205.123.55:8167] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sitemaps.php"] [unique_id "aWBKTYrJrhH8tOUNM5AuogAAAAw"]
[Fri Jan 09 08:22:37.516379 2026] [:error] [pid 10431:tid 10445] [client 20.205.123.55:8043] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sitemaps.php"] [unique_id "aWBKTSkUbiVdwQzsJJQnnAAAAQs"]
[Fri Jan 09 08:22:37.783014 2026] [:error] [pid 35811:tid 35868] [client 20.205.123.55:8137] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sitemaps.php"] [unique_id "aWBKTW7lx9V0CvYJJf35TAAAAFU"]
[Fri Jan 09 08:22:38.056431 2026] [:error] [pid 10431:tid 10434] [client 20.205.123.55:8168] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aWBKTikUbiVdwQzsJJQnngAAAQA"]
[Fri Jan 09 08:22:38.295868 2026] [:error] [pid 35811:tid 35866] [client 20.205.123.55:8175] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aWBKTm7lx9V0CvYJJf35UAAAAFM"]
[Fri Jan 09 08:22:38.578839 2026] [:error] [pid 35810:tid 35821] [client 20.205.123.55:8106] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aWBKTorJrhH8tOUNM5AupAAAAAI"]
[Fri Jan 09 08:22:38.866925 2026] [:error] [pid 35812:tid 35894] [client 20.205.123.55:8104] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aWBKTkAss1qSj44c-n029QAAAJQ"]
[Fri Jan 09 08:22:39.108443 2026] [:error] [pid 35811:tid 35858] [client 20.205.123.55:16024] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/install.php"] [unique_id "aWBKT27lx9V0CvYJJf35VwAAAEs"]
[Fri Jan 09 08:22:39.342327 2026] [:error] [pid 35916:tid 35927] [client 20.205.123.55:8071] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/install.php"] [unique_id "aWBKT_nSLfzabNjOjwzmtgAAAMk"]
[Fri Jan 09 08:22:39.575486 2026] [:error] [pid 35811:tid 35852] [client 20.205.123.55:8134] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/install.php"] [unique_id "aWBKT27lx9V0CvYJJf35YAAAAEU"]
[Fri Jan 09 08:22:39.808706 2026] [:error] [pid 10431:tid 10458] [client 20.205.123.55:8107] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/install.php"] [unique_id "aWBKTykUbiVdwQzsJJQnpAAAARg"]
[Fri Jan 09 08:22:40.042890 2026] [:error] [pid 35810:tid 35836] [client 20.205.123.55:8173] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aWBKUIrJrhH8tOUNM5AupwAAABE"]
[Fri Jan 09 08:22:40.280041 2026] [:error] [pid 35810:tid 35835] [client 20.205.123.55:8176] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aWBKUIrJrhH8tOUNM5AuqAAAABA"]
[Fri Jan 09 08:22:40.513587 2026] [:error] [pid 10431:tid 10447] [client 20.205.123.55:8075] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aWBKUCkUbiVdwQzsJJQnpQAAAQ0"]
[Fri Jan 09 08:22:40.747656 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:8078] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cc.php"] [unique_id "aWBKUCkUbiVdwQzsJJQnpgAAAQ8"]
[Fri Jan 09 08:22:40.990248 2026] [:error] [pid 10431:tid 10456] [client 20.205.123.55:16059] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aWBKUCkUbiVdwQzsJJQnpwAAARY"]
[Fri Jan 09 08:22:41.225010 2026] [:error] [pid 10431:tid 10455] [client 20.205.123.55:8066] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aWBKUSkUbiVdwQzsJJQnqQAAARU"]
[Fri Jan 09 08:22:41.478378 2026] [:error] [pid 35812:tid 35893] [client 20.205.123.55:8131] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aWBKUUAss1qSj44c-n02_wAAAJM"]
[Fri Jan 09 08:22:41.717994 2026] [:error] [pid 35812:tid 35888] [client 20.205.123.55:8089] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aWBKUUAss1qSj44c-n03AQAAAI4"]
[Fri Jan 09 08:22:41.959075 2026] [:error] [pid 35811:tid 35867] [client 20.205.123.55:8105] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/img.php"] [unique_id "aWBKUW7lx9V0CvYJJf35eAAAAFQ"]
[Fri Jan 09 08:22:42.201035 2026] [:error] [pid 35812:tid 35897] [client 20.205.123.55:8190] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/img.php"] [unique_id "aWBKUkAss1qSj44c-n03AgAAAJc"]
[Fri Jan 09 08:22:42.441711 2026] [:error] [pid 35812:tid 35877] [client 20.205.123.55:8026] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/img.php"] [unique_id "aWBKUkAss1qSj44c-n03BQAAAIM"]
[Fri Jan 09 08:22:42.688762 2026] [:error] [pid 10431:tid 10452] [client 20.205.123.55:16005] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/img.php"] [unique_id "aWBKUikUbiVdwQzsJJQnrgAAARI"]
[Fri Jan 09 08:22:42.929713 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:8183] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aWBKUikUbiVdwQzsJJQnrwAAAQo"]
[Fri Jan 09 08:22:43.171789 2026] [:error] [pid 10431:tid 10438] [client 20.205.123.55:8088] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aWBKUykUbiVdwQzsJJQnsQAAAQQ"]
[Fri Jan 09 08:22:43.413336 2026] [:error] [pid 35812:tid 35896] [client 20.205.123.55:8151] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aWBKU0Ass1qSj44c-n03CgAAAJY"]
[Fri Jan 09 08:22:43.653317 2026] [:error] [pid 10431:tid 10439] [client 20.205.123.55:8102] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aWBKUykUbiVdwQzsJJQntQAAAQU"]
[Fri Jan 09 08:22:43.886620 2026] [:error] [pid 35916:tid 35926] [client 20.205.123.55:16112] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aWBKU_nSLfzabNjOjwzmuQAAAMg"]
[Fri Jan 09 08:22:44.149815 2026] [:error] [pid 35916:tid 35921] [client 20.205.123.55:8162] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aWBKVPnSLfzabNjOjwzmuwAAAMM"]
[Fri Jan 09 08:22:44.399598 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:8119] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aWBKVCkUbiVdwQzsJJQnuQAAAQw"]
[Fri Jan 09 08:22:44.632398 2026] [:error] [pid 35916:tid 35935] [client 20.205.123.55:8098] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aWBKVPnSLfzabNjOjwzmvgAAANE"]
[Fri Jan 09 08:22:44.864857 2026] [:error] [pid 35916:tid 35931] [client 20.205.123.55:8188] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/user.php"] [unique_id "aWBKVPnSLfzabNjOjwzmvwAAAM0"]
[Fri Jan 09 08:22:45.099000 2026] [:error] [pid 35811:tid 35860] [client 20.205.123.55:8139] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/user.php"] [unique_id "aWBKVW7lx9V0CvYJJf35lwAAAE0"]
[Fri Jan 09 08:22:45.333903 2026] [:error] [pid 35811:tid 35856] [client 20.205.123.55:8093] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/user.php"] [unique_id "aWBKVW7lx9V0CvYJJf35mgAAAEk"]
[Fri Jan 09 08:22:45.568288 2026] [:error] [pid 35810:tid 35827] [client 20.205.123.55:8185] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/user.php"] [unique_id "aWBKVYrJrhH8tOUNM5AurQAAAAg"]
[Fri Jan 09 08:22:45.801704 2026] [:error] [pid 35812:tid 35885] [client 20.205.123.55:8180] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aWBKVUAss1qSj44c-n03EAAAAIs"]
[Fri Jan 09 08:22:46.034665 2026] [:error] [pid 10431:tid 10450] [client 20.205.123.55:8115] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aWBKVikUbiVdwQzsJJQnvwAAARA"]
[Fri Jan 09 08:22:46.268465 2026] [:error] [pid 35812:tid 35888] [client 20.205.123.55:8012] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aWBKVkAss1qSj44c-n03EQAAAI4"]
[Fri Jan 09 08:22:46.501624 2026] [:error] [pid 35916:tid 35941] [client 20.205.123.55:8074] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aWBKVvnSLfzabNjOjwzmxwAAANc"]
[Fri Jan 09 08:22:46.734729 2026] [:error] [pid 35811:tid 35860] [client 20.205.123.55:8004] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aWBKVm7lx9V0CvYJJf35qAAAAE0"]
[Fri Jan 09 08:22:46.976798 2026] [:error] [pid 10431:tid 10456] [client 20.205.123.55:8124] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aWBKVikUbiVdwQzsJJQnygAAARY"]
[Fri Jan 09 08:22:47.210395 2026] [:error] [pid 35916:tid 35927] [client 20.205.123.55:8084] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aWBKV_nSLfzabNjOjwzmywAAAMk"]
[Fri Jan 09 08:22:47.445805 2026] [:error] [pid 35812:tid 35895] [client 20.205.123.55:8109] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aWBKV0Ass1qSj44c-n03FwAAAJU"]
[Fri Jan 09 08:22:47.678999 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:8161] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aWBKV0Ass1qSj44c-n03GQAAAII"]
[Fri Jan 09 08:22:47.912283 2026] [:error] [pid 10431:tid 10441] [client 20.205.123.55:8033] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aWBKVykUbiVdwQzsJJQn1AAAAQc"]
[Fri Jan 09 08:22:48.145931 2026] [:error] [pid 35811:tid 35863] [client 20.205.123.55:16087] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aWBKWG7lx9V0CvYJJf35qQAAAFA"]
[Fri Jan 09 08:22:48.379502 2026] [:error] [pid 35812:tid 35878] [client 20.205.123.55:8021] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "aWBKWEAss1qSj44c-n03GwAAAIQ"]
[Fri Jan 09 08:22:48.612270 2026] [:error] [pid 35811:tid 35865] [client 20.205.123.55:8101] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-sign.php"] [unique_id "aWBKWG7lx9V0CvYJJf35rQAAAFI"]
[Fri Jan 09 08:22:48.844546 2026] [:error] [pid 10431:tid 10439] [client 20.205.123.55:8126] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-sign.php"] [unique_id "aWBKWCkUbiVdwQzsJJQn2gAAAQU"]
[Fri Jan 09 08:22:49.096165 2026] [:error] [pid 35811:tid 35855] [client 20.205.123.55:8154] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-sign.php"] [unique_id "aWBKWW7lx9V0CvYJJf35sQAAAEg"]
[Fri Jan 09 08:22:49.346730 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:8166] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-sign.php"] [unique_id "aWBKWSkUbiVdwQzsJJQn3AAAAQg"]
[Fri Jan 09 08:22:49.581374 2026] [:error] [pid 10431:tid 10454] [client 20.205.123.55:8064] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ppp.php"] [unique_id "aWBKWSkUbiVdwQzsJJQn3gAAARQ"]
[Fri Jan 09 08:22:49.819918 2026] [:error] [pid 35812:tid 35881] [client 20.205.123.55:8164] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ppp.php"] [unique_id "aWBKWUAss1qSj44c-n03HgAAAIc"]
[Fri Jan 09 08:22:50.072528 2026] [:error] [pid 10431:tid 10438] [client 20.205.123.55:8092] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ppp.php"] [unique_id "aWBKWikUbiVdwQzsJJQn4gAAAQQ"]
[Fri Jan 09 08:22:50.305645 2026] [:error] [pid 10431:tid 10448] [client 20.205.123.55:8149] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ppp.php"] [unique_id "aWBKWikUbiVdwQzsJJQn5QAAAQ4"]
[Fri Jan 09 08:22:50.565247 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:8165] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aWBKWikUbiVdwQzsJJQn6QAAAQ8"]
[Fri Jan 09 08:22:50.798054 2026] [:error] [pid 35810:tid 35840] [client 20.205.123.55:8191] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aWBKWorJrhH8tOUNM5AuuQAAABU"]
[Fri Jan 09 08:22:51.031115 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:8095] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aWBKW0Ass1qSj44c-n03HwAAAJg"]
[Fri Jan 09 08:22:51.264609 2026] [:error] [pid 35810:tid 35830] [client 20.205.123.55:16036] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aWBKW4rJrhH8tOUNM5AuuwAAAAs"]
[Fri Jan 09 08:22:51.505290 2026] [:error] [pid 10431:tid 10441] [client 20.205.123.55:16073] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aWBKWykUbiVdwQzsJJQn7QAAAQc"]
[Fri Jan 09 08:22:51.745446 2026] [:error] [pid 35812:tid 35893] [client 20.205.123.55:8051] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aWBKW0Ass1qSj44c-n03IgAAAJM"]
[Fri Jan 09 08:22:52.029164 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:16089] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aWBKXPnSLfzabNjOjwzm1gAAAME"]
[Fri Jan 09 08:22:52.276877 2026] [:error] [pid 35916:tid 35926] [client 20.205.123.55:16088] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aWBKXPnSLfzabNjOjwzm2QAAAMg"]
[Fri Jan 09 08:22:52.519370 2026] [:error] [pid 35812:tid 35890] [client 20.205.123.55:7963] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aWBKXEAss1qSj44c-n03JAAAAJA"]
[Fri Jan 09 08:22:52.755852 2026] [:error] [pid 35810:tid 35832] [client 20.205.123.55:8142] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aWBKXIrJrhH8tOUNM5AuvgAAAA0"]
[Fri Jan 09 08:22:52.996470 2026] [:error] [pid 10431:tid 10451] [client 20.205.123.55:8117] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aWBKXCkUbiVdwQzsJJQn8QAAARE"]
[Fri Jan 09 08:22:53.228984 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:7941] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aWBKXSkUbiVdwQzsJJQn8gAAAQg"]
[Fri Jan 09 08:22:53.464412 2026] [:error] [pid 35811:tid 35865] [client 20.205.123.55:8020] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-configs.php"] [unique_id "aWBKXW7lx9V0CvYJJf35uQAAAFI"]
[Fri Jan 09 08:22:53.704844 2026] [:error] [pid 35812:tid 35897] [client 20.205.123.55:8036] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-configs.php"] [unique_id "aWBKXUAss1qSj44c-n03KQAAAJc"]
[Fri Jan 09 08:22:53.947129 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:8006] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-configs.php"] [unique_id "aWBKXUAss1qSj44c-n03KgAAAII"]
[Fri Jan 09 08:22:54.179685 2026] [:error] [pid 35811:tid 35855] [client 20.205.123.55:7948] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-configs.php"] [unique_id "aWBKXm7lx9V0CvYJJf35vAAAAEg"]
[Fri Jan 09 08:22:54.424209 2026] [:error] [pid 35812:tid 35896] [client 20.205.123.55:8096] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-help.php"] [unique_id "aWBKXkAss1qSj44c-n03KwAAAJY"]
[Fri Jan 09 08:22:54.664800 2026] [:error] [pid 35916:tid 35931] [client 20.205.123.55:8072] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-help.php"] [unique_id "aWBKXvnSLfzabNjOjwzm3QAAAM0"]
[Fri Jan 09 08:22:54.911056 2026] [:error] [pid 35810:tid 35822] [client 20.205.123.55:16060] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-help.php"] [unique_id "aWBKXorJrhH8tOUNM5AuwwAAAAM"]
[Fri Jan 09 08:22:55.144438 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:8076] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-help.php"] [unique_id "aWBKX0Ass1qSj44c-n03LQAAAJg"]
[Fri Jan 09 08:22:55.378785 2026] [:error] [pid 35811:tid 35853] [client 20.205.123.55:8123] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xc.php"] [unique_id "aWBKX27lx9V0CvYJJf35vwAAAEY"]
[Fri Jan 09 08:22:55.618406 2026] [:error] [pid 35916:tid 35942] [client 20.205.123.55:8082] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xc.php"] [unique_id "aWBKX_nSLfzabNjOjwzm3wAAANg"]
[Fri Jan 09 08:22:55.858763 2026] [:error] [pid 35810:tid 35836] [client 20.205.123.55:8039] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xc.php"] [unique_id "aWBKX4rJrhH8tOUNM5AuxQAAABE"]
[Fri Jan 09 08:22:56.093237 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:8118] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xc.php"] [unique_id "aWBKYPnSLfzabNjOjwzm4AAAAME"]
[Fri Jan 09 08:22:56.327804 2026] [:error] [pid 35810:tid 35839] [client 20.205.123.55:16022] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/wp-trackback.php"] [unique_id "aWBKYIrJrhH8tOUNM5AuxwAAABQ"]
[Fri Jan 09 08:22:56.560288 2026] [:error] [pid 35810:tid 35837] [client 20.205.123.55:8091] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/wp-trackback.php"] [unique_id "aWBKYIrJrhH8tOUNM5AuyAAAABI"]
[Fri Jan 09 08:22:56.795757 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:8015] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/wp-trackback.php"] [unique_id "aWBKYCkUbiVdwQzsJJQn9gAAAQo"]
[Fri Jan 09 08:22:57.031650 2026] [:error] [pid 10431:tid 10455] [client 20.205.123.55:8014] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/wp-trackback.php"] [unique_id "aWBKYSkUbiVdwQzsJJQn9wAAARU"]
[Fri Jan 09 08:22:57.264608 2026] [:error] [pid 35810:tid 35830] [client 20.205.123.55:8067] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aWBKYYrJrhH8tOUNM5AuygAAAAs"]
[Fri Jan 09 08:22:57.497181 2026] [:error] [pid 35916:tid 35939] [client 20.205.123.55:8152] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aWBKYfnSLfzabNjOjwzm5gAAANU"]
[Fri Jan 09 08:22:57.730922 2026] [:error] [pid 35916:tid 35937] [client 20.205.123.55:7977] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aWBKYfnSLfzabNjOjwzm5wAAANM"]
[Fri Jan 09 08:22:57.972623 2026] [:error] [pid 35810:tid 35828] [client 20.205.123.55:8001] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aWBKYYrJrhH8tOUNM5AuzgAAAAk"]
[Fri Jan 09 08:22:58.214626 2026] [:error] [pid 35916:tid 35936] [client 20.205.123.55:8097] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hly.php"] [unique_id "aWBKYvnSLfzabNjOjwzm6QAAANI"]
[Fri Jan 09 08:22:58.448134 2026] [:error] [pid 35812:tid 35883] [client 20.205.123.55:7965] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hly.php"] [unique_id "aWBKYkAss1qSj44c-n03OAAAAIk"]
[Fri Jan 09 08:22:58.687518 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:8090] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hly.php"] [unique_id "aWBKYkAss1qSj44c-n03OwAAAJg"]
[Fri Jan 09 08:22:58.931460 2026] [:error] [pid 35810:tid 35836] [client 20.205.123.55:8023] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hly.php"] [unique_id "aWBKYorJrhH8tOUNM5Au1AAAABE"]
[Fri Jan 09 08:22:59.171963 2026] [:error] [pid 10431:tid 10445] [client 20.205.123.55:8077] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/text.php"] [unique_id "aWBKYykUbiVdwQzsJJQn_QAAAQs"]
[Fri Jan 09 08:22:59.415580 2026] [:error] [pid 35916:tid 35935] [client 20.205.123.55:8048] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/text.php"] [unique_id "aWBKY_nSLfzabNjOjwzm7QAAANE"]
[Fri Jan 09 08:22:59.655494 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:8011] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/text.php"] [unique_id "aWBKY27lx9V0CvYJJf35xgAAAEA"]
[Fri Jan 09 08:22:59.914024 2026] [:error] [pid 35810:tid 35838] [client 20.205.123.55:7987] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/text.php"] [unique_id "aWBKY4rJrhH8tOUNM5Au1wAAABM"]
[Fri Jan 09 08:23:00.154394 2026] [:error] [pid 10431:tid 10454] [client 20.205.123.55:16065] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aWBKZCkUbiVdwQzsJJQn_gAAARQ"]
[Fri Jan 09 08:23:00.389897 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:7946] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aWBKZCkUbiVdwQzsJJQoAQAAAQ8"]
[Fri Jan 09 08:23:00.627197 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:7981] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aWBKZCkUbiVdwQzsJJQoBgAAAQg"]
[Fri Jan 09 08:23:00.861002 2026] [:error] [pid 10431:tid 10453] [client 20.205.123.55:8125] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aWBKZCkUbiVdwQzsJJQoBwAAARM"]
[Fri Jan 09 08:23:01.095604 2026] [:error] [pid 35811:tid 35856] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Jan 09 08:23:01.215621 2026] [:error] [pid 35811:tid 35854] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Jan 09 08:23:02.681685 2026] [:error] [pid 35811:tid 35854] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Jan 09 08:23:02.800678 2026] [:error] [pid 35811:tid 35849] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Fri Jan 09 08:23:02.923206 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/yes.php
[Fri Jan 09 08:23:03.042733 2026] [:error] [pid 35811:tid 35851] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/09fa6.php
[Fri Jan 09 08:23:03.163515 2026] [:error] [pid 35811:tid 35862] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/89.php
[Fri Jan 09 08:23:03.283708 2026] [:error] [pid 35811:tid 35848] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/has.php
[Fri Jan 09 08:23:03.404683 2026] [:error] [pid 35811:tid 35868] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/nax.php
[Fri Jan 09 08:23:03.524729 2026] [:error] [pid 35811:tid 35853] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/ooj.php
[Fri Jan 09 08:23:03.645647 2026] [:error] [pid 35811:tid 35864] [client 20.205.123.55:8179] File does not exist: /usr/local/apache/htdocs/suspended-page/orm.php
[Fri Jan 09 08:23:03.763794 2026] [:error] [pid 35811:tid 35852] [client 20.205.123.55:8179] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yep.php"] [unique_id "aWBKZ27lx9V0CvYJJf352QAAAEU"]
[Fri Jan 09 08:23:04.003962 2026] [:error] [pid 10431:tid 10456] [client 20.205.123.55:8005] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yep.php"] [unique_id "aWBKaCkUbiVdwQzsJJQoGQAAARY"]
[Fri Jan 09 08:23:04.244366 2026] [:error] [pid 35916:tid 35939] [client 20.205.123.55:8050] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yep.php"] [unique_id "aWBKaPnSLfzabNjOjwzm-wAAANU"]
[Fri Jan 09 08:23:04.478365 2026] [:error] [pid 35916:tid 35924] [client 20.205.123.55:16086] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yep.php"] [unique_id "aWBKaPnSLfzabNjOjwzm_wAAAMY"]
[Fri Jan 09 08:23:04.721987 2026] [:error] [pid 35916:tid 35936] [client 20.205.123.55:8087] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x3.php"] [unique_id "aWBKaPnSLfzabNjOjwznAAAAANI"]
[Fri Jan 09 08:23:04.968278 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:8099] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x3.php"] [unique_id "aWBKaCkUbiVdwQzsJJQoHQAAAQo"]
[Fri Jan 09 08:23:05.219905 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:8181] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x3.php"] [unique_id "aWBKaSkUbiVdwQzsJJQoHwAAAQ8"]
[Fri Jan 09 08:23:05.455536 2026] [:error] [pid 10431:tid 10443] [client 20.205.123.55:8170] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x3.php"] [unique_id "aWBKaSkUbiVdwQzsJJQoIQAAAQk"]
[Fri Jan 09 08:23:05.688619 2026] [:error] [pid 35812:tid 35895] [client 20.205.123.55:7951] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6erg.php"] [unique_id "aWBKaUAss1qSj44c-n03VAAAAJU"]
[Fri Jan 09 08:23:05.926163 2026] [:error] [pid 35812:tid 35879] [client 20.205.123.55:8189] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6erg.php"] [unique_id "aWBKaUAss1qSj44c-n03VgAAAIU"]
[Fri Jan 09 08:23:06.159640 2026] [:error] [pid 35916:tid 35922] [client 20.205.123.55:8022] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6erg.php"] [unique_id "aWBKavnSLfzabNjOjwznAwAAAMQ"]
[Fri Jan 09 08:23:06.441443 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:16034] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6erg.php"] [unique_id "aWBKakAss1qSj44c-n03WQAAAJg"]
[Fri Jan 09 08:23:06.681778 2026] [:error] [pid 35812:tid 35891] [client 20.205.123.55:8031] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ggfi.php"] [unique_id "aWBKakAss1qSj44c-n03WgAAAJE"]
[Fri Jan 09 08:23:06.924427 2026] [:error] [pid 35812:tid 35887] [client 20.205.123.55:8108] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ggfi.php"] [unique_id "aWBKakAss1qSj44c-n03XQAAAI0"]
[Fri Jan 09 08:23:07.206188 2026] [:error] [pid 35811:tid 35870] [client 20.205.123.55:8177] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ggfi.php"] [unique_id "aWBKa27lx9V0CvYJJf355AAAAFc"]
[Fri Jan 09 08:23:07.439721 2026] [:error] [pid 35810:tid 35826] [client 20.205.123.55:8003] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ggfi.php"] [unique_id "aWBKa4rJrhH8tOUNM5Au5AAAAAc"]
[Fri Jan 09 08:23:07.698446 2026] [:error] [pid 35916:tid 35929] [client 20.205.123.55:7976] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aWBKa_nSLfzabNjOjwznBAAAAMs"]
[Fri Jan 09 08:23:07.950991 2026] [:error] [pid 35916:tid 35933] [client 20.205.123.55:8016] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aWBKa_nSLfzabNjOjwznBgAAAM8"]
[Fri Jan 09 08:23:08.190021 2026] [:error] [pid 35812:tid 35890] [client 20.205.123.55:8052] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aWBKbEAss1qSj44c-n03YwAAAJA"]
[Fri Jan 09 08:23:08.432542 2026] [:error] [pid 35916:tid 35921] [client 20.205.123.55:8100] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aWBKbPnSLfzabNjOjwznBwAAAMM"]
[Fri Jan 09 08:23:08.666457 2026] [:error] [pid 35812:tid 35882] [client 20.205.123.55:8111] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jju.php"] [unique_id "aWBKbEAss1qSj44c-n03ZQAAAIg"]
[Fri Jan 09 08:23:08.903330 2026] [:error] [pid 35812:tid 35895] [client 20.205.123.55:7983] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jju.php"] [unique_id "aWBKbEAss1qSj44c-n03ZwAAAJU"]
[Fri Jan 09 08:23:09.165940 2026] [:error] [pid 35916:tid 35923] [client 20.205.123.55:8040] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jju.php"] [unique_id "aWBKbfnSLfzabNjOjwznCQAAAMU"]
[Fri Jan 09 08:23:09.399147 2026] [:error] [pid 35811:tid 35871] [client 20.205.123.55:8153] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jju.php"] [unique_id "aWBKbW7lx9V0CvYJJf356AAAAFg"]
[Fri Jan 09 08:23:09.633019 2026] [:error] [pid 35916:tid 35926] [client 20.205.123.55:8178] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rsnu.php"] [unique_id "aWBKbfnSLfzabNjOjwznDgAAAMg"]
[Fri Jan 09 08:23:09.884345 2026] [:error] [pid 35916:tid 35918] [client 20.205.123.55:16110] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rsnu.php"] [unique_id "aWBKbfnSLfzabNjOjwznDwAAAMA"]
[Fri Jan 09 08:23:10.141370 2026] [:error] [pid 35916:tid 35938] [client 20.205.123.55:8061] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rsnu.php"] [unique_id "aWBKbvnSLfzabNjOjwznEAAAANQ"]
[Fri Jan 09 08:23:10.382357 2026] [:error] [pid 35810:tid 35823] [client 20.205.123.55:7990] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rsnu.php"] [unique_id "aWBKborJrhH8tOUNM5Au6QAAAAQ"]
[Fri Jan 09 08:23:10.621757 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:8094] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lc.php"] [unique_id "aWBKbvnSLfzabNjOjwznFAAAAME"]
[Fri Jan 09 08:23:10.854286 2026] [:error] [pid 35812:tid 35888] [client 20.205.123.55:7947] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lc.php"] [unique_id "aWBKbkAss1qSj44c-n03bwAAAI4"]
[Fri Jan 09 08:23:11.089230 2026] [:error] [pid 35810:tid 35822] [client 20.205.123.55:7975] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lc.php"] [unique_id "aWBKb4rJrhH8tOUNM5Au6wAAAAM"]
[Fri Jan 09 08:23:11.342446 2026] [:error] [pid 35811:tid 35868] [client 20.205.123.55:8122] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lc.php"] [unique_id "aWBKb27lx9V0CvYJJf356wAAAFU"]
[Fri Jan 09 08:23:11.601449 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:8049] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gfile.php"] [unique_id "aWBKb27lx9V0CvYJJf357QAAAEA"]
[Fri Jan 09 08:23:11.836076 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:8103] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gfile.php"] [unique_id "aWBKb0Ass1qSj44c-n03cwAAAII"]
[Fri Jan 09 08:23:12.070724 2026] [:error] [pid 35810:tid 35842] [client 20.205.123.55:8042] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gfile.php"] [unique_id "aWBKcIrJrhH8tOUNM5Au7gAAABc"]
[Fri Jan 09 08:23:12.312213 2026] [:error] [pid 35812:tid 35874] [client 20.205.123.55:7953] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gfile.php"] [unique_id "aWBKcEAss1qSj44c-n03dwAAAIA"]
[Fri Jan 09 08:23:12.597398 2026] [:error] [pid 35810:tid 35834] [client 20.205.123.55:8060] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gold.php"] [unique_id "aWBKcIrJrhH8tOUNM5Au7wAAAA8"]
[Fri Jan 09 08:23:12.830139 2026] [:error] [pid 10431:tid 10452] [client 20.205.123.55:8110] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gold.php"] [unique_id "aWBKcCkUbiVdwQzsJJQoKQAAARI"]
[Fri Jan 09 08:23:13.066382 2026] [:error] [pid 35811:tid 35856] [client 20.205.123.55:8027] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gold.php"] [unique_id "aWBKcW7lx9V0CvYJJf358AAAAEk"]
[Fri Jan 09 08:23:13.313868 2026] [:error] [pid 35810:tid 35826] [client 20.205.123.55:8017] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gold.php"] [unique_id "aWBKcYrJrhH8tOUNM5Au8QAAAAc"]
[Fri Jan 09 08:23:13.563247 2026] [:error] [pid 35811:tid 35850] [client 20.205.123.55:7734] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aWBKcW7lx9V0CvYJJf358gAAAEM"]
[Fri Jan 09 08:23:13.830566 2026] [:error] [pid 35812:tid 35881] [client 20.205.123.55:8058] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aWBKcUAss1qSj44c-n03egAAAIc"]
[Fri Jan 09 08:23:14.132382 2026] [:error] [pid 35810:tid 35831] [client 20.205.123.55:16082] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aWBKcorJrhH8tOUNM5Au9wAAAAw"]
[Fri Jan 09 08:23:14.398372 2026] [:error] [pid 10431:tid 10457] [client 20.205.123.55:8000] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aWBKcikUbiVdwQzsJJQoLgAAARc"]
[Fri Jan 09 08:23:14.637039 2026] [:error] [pid 35810:tid 35837] [client 20.205.123.55:8018] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aua.php"] [unique_id "aWBKcorJrhH8tOUNM5Au-AAAABI"]
[Fri Jan 09 08:23:14.875491 2026] [:error] [pid 35812:tid 35897] [client 20.205.123.55:8062] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aua.php"] [unique_id "aWBKckAss1qSj44c-n03fgAAAJc"]
[Fri Jan 09 08:23:15.112326 2026] [:error] [pid 35812:tid 35882] [client 20.205.123.55:7996] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aua.php"] [unique_id "aWBKc0Ass1qSj44c-n03fwAAAIg"]
[Fri Jan 09 08:23:15.346817 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:7966] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aua.php"] [unique_id "aWBKc27lx9V0CvYJJf359gAAAEA"]
[Fri Jan 09 08:23:15.596080 2026] [:error] [pid 10431:tid 10436] [client 20.205.123.55:7971] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/great.php"] [unique_id "aWBKcykUbiVdwQzsJJQoNAAAAQI"]
[Fri Jan 09 08:23:15.828626 2026] [:error] [pid 35812:tid 35880] [client 20.205.123.55:7997] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/great.php"] [unique_id "aWBKc0Ass1qSj44c-n03hAAAAIY"]
[Fri Jan 09 08:23:16.068516 2026] [:error] [pid 35811:tid 35861] [client 20.205.123.55:7999] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/great.php"] [unique_id "aWBKdG7lx9V0CvYJJf35-gAAAE4"]
[Fri Jan 09 08:23:16.315662 2026] [:error] [pid 35916:tid 35935] [client 20.205.123.55:8028] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/great.php"] [unique_id "aWBKdPnSLfzabNjOjwznHwAAANE"]
[Fri Jan 09 08:23:16.600049 2026] [:error] [pid 35916:tid 35933] [client 20.205.123.55:8047] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aWBKdPnSLfzabNjOjwznIgAAAM8"]
[Fri Jan 09 08:23:16.833346 2026] [:error] [pid 35810:tid 35827] [client 20.205.123.55:7938] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aWBKdIrJrhH8tOUNM5Au_AAAAAg"]
[Fri Jan 09 08:23:17.066665 2026] [:error] [pid 35810:tid 35843] [client 20.205.123.55:7969] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aWBKdYrJrhH8tOUNM5Au_QAAABg"]
[Fri Jan 09 08:23:17.302152 2026] [:error] [pid 35810:tid 35826] [client 20.205.123.55:16102] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aWBKdYrJrhH8tOUNM5Au_gAAAAc"]
[Fri Jan 09 08:23:17.544807 2026] [:error] [pid 10431:tid 10437] [client 20.205.123.55:8054] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ot.php"] [unique_id "aWBKdSkUbiVdwQzsJJQoOAAAAQM"]
[Fri Jan 09 08:23:17.778247 2026] [:error] [pid 10431:tid 10435] [client 20.205.123.55:7943] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ot.php"] [unique_id "aWBKdSkUbiVdwQzsJJQoOQAAAQE"]
[Fri Jan 09 08:23:18.023762 2026] [:error] [pid 35916:tid 35927] [client 20.205.123.55:8010] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ot.php"] [unique_id "aWBKdvnSLfzabNjOjwznJgAAAMk"]
[Fri Jan 09 08:23:18.259662 2026] [:error] [pid 10431:tid 10448] [client 20.205.123.55:8045] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ot.php"] [unique_id "aWBKdikUbiVdwQzsJJQoPAAAAQ4"]
[Fri Jan 09 08:23:18.501376 2026] [:error] [pid 35810:tid 35821] [client 20.205.123.55:8069] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/witmm.php"] [unique_id "aWBKdorJrhH8tOUNM5AvAAAAAAI"]
[Fri Jan 09 08:23:18.764173 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:8081] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/witmm.php"] [unique_id "aWBKdikUbiVdwQzsJJQoQgAAAQw"]
[Fri Jan 09 08:23:19.021153 2026] [:error] [pid 10431:tid 10445] [client 20.205.123.55:7682] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/witmm.php"] [unique_id "aWBKdykUbiVdwQzsJJQoRQAAAQs"]
[Fri Jan 09 08:23:19.253830 2026] [:error] [pid 10431:tid 10448] [client 20.205.123.55:7713] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/witmm.php"] [unique_id "aWBKdykUbiVdwQzsJJQoSgAAAQ4"]
[Fri Jan 09 08:23:19.486361 2026] [:error] [pid 10431:tid 10443] [client 20.205.123.55:8063] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ocxla.php"] [unique_id "aWBKdykUbiVdwQzsJJQoTQAAAQk"]
[Fri Jan 09 08:23:19.721818 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:7696] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ocxla.php"] [unique_id "aWBKdykUbiVdwQzsJJQoTwAAAQg"]
[Fri Jan 09 08:23:19.955296 2026] [:error] [pid 10431:tid 10454] [client 20.205.123.55:7693] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ocxla.php"] [unique_id "aWBKdykUbiVdwQzsJJQoUgAAARQ"]
[Fri Jan 09 08:23:20.193729 2026] [:error] [pid 10431:tid 10447] [client 20.205.123.55:7991] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ocxla.php"] [unique_id "aWBKeCkUbiVdwQzsJJQoVQAAAQ0"]
[Fri Jan 09 08:23:20.428142 2026] [:error] [pid 10431:tid 10458] [client 20.205.123.55:8056] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aWBKeCkUbiVdwQzsJJQoWQAAARg"]
[Fri Jan 09 08:23:20.660521 2026] [:error] [pid 10431:tid 10435] [client 20.205.123.55:7992] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aWBKeCkUbiVdwQzsJJQoWwAAAQE"]
[Fri Jan 09 08:23:20.893256 2026] [:error] [pid 35916:tid 35918] [client 20.205.123.55:8127] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aWBKePnSLfzabNjOjwznKgAAAMA"]
[Fri Jan 09 08:23:21.128190 2026] [:error] [pid 35916:tid 35941] [client 20.205.123.55:8055] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aWBKefnSLfzabNjOjwznKwAAANc"]
[Fri Jan 09 08:23:21.360209 2026] [:error] [pid 35811:tid 35866] [client 20.205.123.55:8046] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/resp.php"] [unique_id "aWBKeW7lx9V0CvYJJf36AgAAAFM"]
[Fri Jan 09 08:23:21.593668 2026] [:error] [pid 35810:tid 35831] [client 20.205.123.55:8083] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/resp.php"] [unique_id "aWBKeYrJrhH8tOUNM5AvAgAAAAw"]
[Fri Jan 09 08:23:21.825486 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:8121] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/resp.php"] [unique_id "aWBKeSkUbiVdwQzsJJQoYgAAAQo"]
[Fri Jan 09 08:23:22.060565 2026] [:error] [pid 35812:tid 35874] [client 20.205.123.55:8008] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/resp.php"] [unique_id "aWBKekAss1qSj44c-n03iQAAAIA"]
[Fri Jan 09 08:23:22.295942 2026] [:error] [pid 35810:tid 35837] [client 20.205.123.55:16037] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.kb.php"] [unique_id "aWBKeorJrhH8tOUNM5AvBAAAABI"]
[Fri Jan 09 08:23:22.530794 2026] [:error] [pid 35916:tid 35933] [client 20.205.123.55:7961] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.kb.php"] [unique_id "aWBKevnSLfzabNjOjwznMgAAAM8"]
[Fri Jan 09 08:23:22.764504 2026] [:error] [pid 10431:tid 10435] [client 20.205.123.55:7995] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.kb.php"] [unique_id "aWBKeikUbiVdwQzsJJQoZwAAAQE"]
[Fri Jan 09 08:23:22.996937 2026] [:error] [pid 35811:tid 35857] [client 20.205.123.55:8009] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.kb.php"] [unique_id "aWBKem7lx9V0CvYJJf36CQAAAEo"]
[Fri Jan 09 08:23:23.235108 2026] [:error] [pid 10431:tid 10453] [client 20.205.123.55:7968] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wqqs.php"] [unique_id "aWBKeykUbiVdwQzsJJQoagAAARM"]
[Fri Jan 09 08:23:23.468326 2026] [:error] [pid 10431:tid 10436] [client 20.205.123.55:8038] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wqqs.php"] [unique_id "aWBKeykUbiVdwQzsJJQobAAAAQI"]
[Fri Jan 09 08:23:23.701731 2026] [:error] [pid 35811:tid 35849] [client 20.205.123.55:7707] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wqqs.php"] [unique_id "aWBKe27lx9V0CvYJJf36CwAAAEI"]
[Fri Jan 09 08:23:23.934102 2026] [:error] [pid 35916:tid 35930] [client 20.205.123.55:7720] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wqqs.php"] [unique_id "aWBKe_nSLfzabNjOjwznOAAAAMw"]
[Fri Jan 09 08:23:24.177795 2026] [:error] [pid 35916:tid 35928] [client 20.205.123.55:8034] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwq13.php"] [unique_id "aWBKfPnSLfzabNjOjwznOwAAAMo"]
[Fri Jan 09 08:23:24.410398 2026] [:error] [pid 35810:tid 35834] [client 20.205.123.55:7683] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwq13.php"] [unique_id "aWBKfIrJrhH8tOUNM5AvCgAAAA8"]
[Fri Jan 09 08:23:24.643881 2026] [:error] [pid 35811:tid 35860] [client 20.205.123.55:8032] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwq13.php"] [unique_id "aWBKfG7lx9V0CvYJJf36DwAAAE0"]
[Fri Jan 09 08:23:24.876870 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:7950] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zwq13.php"] [unique_id "aWBKfCkUbiVdwQzsJJQobwAAAQ8"]
[Fri Jan 09 08:23:25.109778 2026] [:error] [pid 10431:tid 10439] [client 20.205.123.55:8079] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rtx.php"] [unique_id "aWBKfSkUbiVdwQzsJJQocgAAAQU"]
[Fri Jan 09 08:23:25.343397 2026] [:error] [pid 35810:tid 35841] [client 20.205.123.55:7936] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rtx.php"] [unique_id "aWBKfYrJrhH8tOUNM5AvDAAAABY"]
[Fri Jan 09 08:23:25.577289 2026] [:error] [pid 35811:tid 35863] [client 20.205.123.55:7942] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rtx.php"] [unique_id "aWBKfW7lx9V0CvYJJf36EAAAAFA"]
[Fri Jan 09 08:23:25.810331 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:8041] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rtx.php"] [unique_id "aWBKffnSLfzabNjOjwznPgAAAME"]
[Fri Jan 09 08:23:26.044333 2026] [:error] [pid 35916:tid 35931] [client 20.205.123.55:8190] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1index.php"] [unique_id "aWBKfvnSLfzabNjOjwznQAAAAM0"]
[Fri Jan 09 08:23:26.277936 2026] [:error] [pid 35810:tid 35839] [client 20.205.123.55:7967] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1index.php"] [unique_id "aWBKforJrhH8tOUNM5AvDgAAABQ"]
[Fri Jan 09 08:23:26.510788 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:7978] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1index.php"] [unique_id "aWBKfvnSLfzabNjOjwznQgAAANY"]
[Fri Jan 09 08:23:26.743009 2026] [:error] [pid 35810:tid 35840] [client 20.205.123.55:8184] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1index.php"] [unique_id "aWBKforJrhH8tOUNM5AvEQAAABU"]
[Fri Jan 09 08:23:26.975289 2026] [:error] [pid 35810:tid 35830] [client 20.205.123.55:8031] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs6.php"] [unique_id "aWBKforJrhH8tOUNM5AvEwAAAAs"]
[Fri Jan 09 08:23:27.208889 2026] [:error] [pid 35810:tid 35822] [client 20.205.123.55:7727] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs6.php"] [unique_id "aWBKf4rJrhH8tOUNM5AvFQAAAAM"]
[Fri Jan 09 08:23:27.442175 2026] [:error] [pid 35810:tid 35838] [client 20.205.123.55:16046] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs6.php"] [unique_id "aWBKf4rJrhH8tOUNM5AvFgAAABM"]
[Fri Jan 09 08:23:27.675502 2026] [:error] [pid 35810:tid 35826] [client 20.205.123.55:8030] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs6.php"] [unique_id "aWBKf4rJrhH8tOUNM5AvHAAAAAc"]
[Fri Jan 09 08:23:27.908129 2026] [:error] [pid 35916:tid 35930] [client 20.205.123.55:8059] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/clasa99.php"] [unique_id "aWBKf_nSLfzabNjOjwznSAAAAMw"]
[Fri Jan 09 08:23:28.141630 2026] [:error] [pid 35916:tid 35937] [client 20.205.123.55:8019] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/clasa99.php"] [unique_id "aWBKgPnSLfzabNjOjwznSQAAANM"]
[Fri Jan 09 08:23:28.376698 2026] [:error] [pid 35811:tid 35857] [client 20.205.123.55:7883] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/clasa99.php"] [unique_id "aWBKgG7lx9V0CvYJJf36EwAAAEo"]
[Fri Jan 09 08:23:28.609780 2026] [:error] [pid 35810:tid 35821] [client 20.205.123.55:8029] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/clasa99.php"] [unique_id "aWBKgIrJrhH8tOUNM5AvIAAAAAI"]
[Fri Jan 09 08:23:28.845138 2026] [:error] [pid 35916:tid 35936] [client 20.205.123.55:7686] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fasx.php"] [unique_id "aWBKgPnSLfzabNjOjwznTQAAANI"]
[Fri Jan 09 08:23:29.135949 2026] [:error] [pid 35810:tid 35831] [client 20.205.123.55:7712] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fasx.php"] [unique_id "aWBKgYrJrhH8tOUNM5AvIwAAAAw"]
[Fri Jan 09 08:23:29.369829 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:7874] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fasx.php"] [unique_id "aWBKgUAss1qSj44c-n03nQAAAII"]
[Fri Jan 09 08:23:29.603426 2026] [:error] [pid 10431:tid 10455] [client 20.205.123.55:8040] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fasx.php"] [unique_id "aWBKgSkUbiVdwQzsJJQoewAAARU"]
[Fri Jan 09 08:23:29.842862 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:7993] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/c4.php"] [unique_id "aWBKgUAss1qSj44c-n03oAAAAJg"]
[Fri Jan 09 08:23:30.077072 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:8025] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/c4.php"] [unique_id "aWBKgikUbiVdwQzsJJQoggAAAQw"]
[Fri Jan 09 08:23:30.318716 2026] [:error] [pid 35812:tid 35881] [client 20.205.123.55:7998] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/c4.php"] [unique_id "aWBKgkAss1qSj44c-n03oQAAAIc"]
[Fri Jan 09 08:23:30.552241 2026] [:error] [pid 10431:tid 10448] [client 20.205.123.55:7710] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/c4.php"] [unique_id "aWBKgikUbiVdwQzsJJQohwAAAQ4"]
[Fri Jan 09 08:23:30.784874 2026] [:error] [pid 10431:tid 10457] [client 20.205.123.55:7980] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock1.php"] [unique_id "aWBKgikUbiVdwQzsJJQoiwAAARc"]
[Fri Jan 09 08:23:31.018102 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:16116] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock1.php"] [unique_id "aWBKgykUbiVdwQzsJJQojgAAAQg"]
[Fri Jan 09 08:23:31.252048 2026] [:error] [pid 35916:tid 35932] [client 20.205.123.55:7685] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock1.php"] [unique_id "aWBKg_nSLfzabNjOjwznUwAAAM4"]
[Fri Jan 09 08:23:31.500360 2026] [:error] [pid 10431:tid 10446] [client 20.205.123.55:7737] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock1.php"] [unique_id "aWBKgykUbiVdwQzsJJQolAAAAQw"]
[Fri Jan 09 08:23:31.738405 2026] [:error] [pid 35812:tid 35896] [client 20.205.123.55:7956] [client 20.205.123.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aWBKg0Ass1qSj44c-n03owAAAJY"]
[Fri Jan 09 08:23:31.976484 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:7680] [client 20.205.123.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/codemirror/info.php"] [unique_id "aWBKgykUbiVdwQzsJJQomQAAAQo"]
[Fri Jan 09 08:23:32.210760 2026] [:error] [pid 35811:tid 35859] [client 20.205.123.55:7944] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/en/gastenboek.php"] [unique_id "aWBKhG7lx9V0CvYJJf36FwAAAEw"]
[Fri Jan 09 08:23:32.451045 2026] [:error] [pid 10431:tid 10456] [client 20.205.123.55:7939] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/en/gastenboek.php"] [unique_id "aWBKhCkUbiVdwQzsJJQomgAAARY"]
[Fri Jan 09 08:23:32.687222 2026] [:error] [pid 35810:tid 35839] [client 20.205.123.55:7937] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/en/gastenboek.php"] [unique_id "aWBKhIrJrhH8tOUNM5AvJgAAABQ"]
[Fri Jan 09 08:23:32.919998 2026] [:error] [pid 35812:tid 35898] [client 20.205.123.55:7681] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/third_party/kcfinder/upload.php"] [unique_id "aWBKhEAss1qSj44c-n03qQAAAJg"]
[Fri Jan 09 08:23:33.154988 2026] [:error] [pid 10431:tid 10441] [client 20.205.123.55:7699] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/third_party/kcfinder/upload.php"] [unique_id "aWBKhSkUbiVdwQzsJJQonwAAAQc"]
[Fri Jan 09 08:23:33.390433 2026] [:error] [pid 35810:tid 35830] [client 20.205.123.55:7742] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/third_party/kcfinder/upload.php"] [unique_id "aWBKhYrJrhH8tOUNM5AvJwAAAAs"]
[Fri Jan 09 08:23:33.623626 2026] [:error] [pid 35811:tid 35862] [client 20.205.123.55:7701] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/third_party/kcfinder/upload.php"] [unique_id "aWBKhW7lx9V0CvYJJf36HgAAAE8"]
[Fri Jan 09 08:23:33.857232 2026] [:error] [pid 10431:tid 10447] [client 20.205.123.55:7982] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock11.php"] [unique_id "aWBKhSkUbiVdwQzsJJQopAAAAQ0"]
[Fri Jan 09 08:23:34.097655 2026] [:error] [pid 10431:tid 10434] [client 20.205.123.55:7732] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock11.php"] [unique_id "aWBKhikUbiVdwQzsJJQoqAAAAQA"]
[Fri Jan 09 08:23:34.331494 2026] [:error] [pid 35810:tid 35834] [client 20.205.123.55:7945] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock11.php"] [unique_id "aWBKhorJrhH8tOUNM5AvKgAAAA8"]
[Fri Jan 09 08:23:34.565441 2026] [:error] [pid 35810:tid 35827] [client 20.205.123.55:7704] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock11.php"] [unique_id "aWBKhorJrhH8tOUNM5AvKwAAAAg"]
[Fri Jan 09 08:23:34.800460 2026] [:error] [pid 35916:tid 35937] [client 20.205.123.55:7687] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api137.php"] [unique_id "aWBKhvnSLfzabNjOjwznYAAAANM"]
[Fri Jan 09 08:23:35.034964 2026] [:error] [pid 35916:tid 35928] [client 20.205.123.55:7972] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api137.php"] [unique_id "aWBKh_nSLfzabNjOjwznYQAAAMo"]
[Fri Jan 09 08:23:35.277049 2026] [:error] [pid 35812:tid 35896] [client 20.205.123.55:7684] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api137.php"] [unique_id "aWBKh0Ass1qSj44c-n03qwAAAJY"]
[Fri Jan 09 08:23:35.510887 2026] [:error] [pid 10431:tid 10447] [client 20.205.123.55:8057] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api137.php"] [unique_id "aWBKhykUbiVdwQzsJJQorQAAAQ0"]
[Fri Jan 09 08:23:35.753413 2026] [:error] [pid 35916:tid 35922] [client 20.205.123.55:7726] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class629.php"] [unique_id "aWBKh_nSLfzabNjOjwznYgAAAMQ"]
[Fri Jan 09 08:23:35.986034 2026] [:error] [pid 35811:tid 35861] [client 20.205.123.55:8044] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class629.php"] [unique_id "aWBKh27lx9V0CvYJJf36IQAAAE4"]
[Fri Jan 09 08:23:36.219145 2026] [:error] [pid 35810:tid 35834] [client 20.205.123.55:16074] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class629.php"] [unique_id "aWBKiIrJrhH8tOUNM5AvOQAAAA8"]
[Fri Jan 09 08:23:36.453922 2026] [:error] [pid 35810:tid 35827] [client 20.205.123.55:8013] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class629.php"] [unique_id "aWBKiIrJrhH8tOUNM5AvOwAAAAg"]
[Fri Jan 09 08:23:36.687976 2026] [:error] [pid 35916:tid 35936] [client 20.205.123.55:7714] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp670.php"] [unique_id "aWBKiPnSLfzabNjOjwznZQAAANI"]
[Fri Jan 09 08:23:36.921487 2026] [:error] [pid 35810:tid 35836] [client 20.205.123.55:8035] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp670.php"] [unique_id "aWBKiIrJrhH8tOUNM5AvPwAAABE"]
[Fri Jan 09 08:23:37.157929 2026] [:error] [pid 35812:tid 35887] [client 20.205.123.55:8007] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp670.php"] [unique_id "aWBKiUAss1qSj44c-n03rgAAAI0"]
[Fri Jan 09 08:23:37.392181 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:7882] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp670.php"] [unique_id "aWBKifnSLfzabNjOjwznZgAAANY"]
[Fri Jan 09 08:23:37.626003 2026] [:error] [pid 35916:tid 35932] [client 20.205.123.55:8086] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v1.php"] [unique_id "aWBKifnSLfzabNjOjwznZwAAAM4"]
[Fri Jan 09 08:23:37.859895 2026] [:error] [pid 35916:tid 35942] [client 20.205.123.55:7940] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v1.php"] [unique_id "aWBKifnSLfzabNjOjwznagAAANg"]
[Fri Jan 09 08:23:38.094084 2026] [:error] [pid 35812:tid 35890] [client 20.205.123.55:7728] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v1.php"] [unique_id "aWBKikAss1qSj44c-n03sAAAAJA"]
[Fri Jan 09 08:23:38.328008 2026] [:error] [pid 35811:tid 35853] [client 20.205.123.55:7912] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v1.php"] [unique_id "aWBKim7lx9V0CvYJJf36IwAAAEY"]
[Fri Jan 09 08:23:38.575023 2026] [:error] [pid 35811:tid 35869] [client 20.205.123.55:7875] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aWBKim7lx9V0CvYJJf36JAAAAFY"]
[Fri Jan 09 08:23:38.808416 2026] [:error] [pid 35812:tid 35876] [client 20.205.123.55:7715] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aWBKikAss1qSj44c-n03sQAAAII"]
[Fri Jan 09 08:23:39.041364 2026] [:error] [pid 35812:tid 35894] [client 20.205.123.55:7723] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aWBKi0Ass1qSj44c-n03swAAAJQ"]
[Fri Jan 09 08:23:39.288215 2026] [:error] [pid 35811:tid 35857] [client 20.205.123.55:7698] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aWBKi27lx9V0CvYJJf36JwAAAEo"]
[Fri Jan 09 08:23:39.527562 2026] [:error] [pid 35916:tid 35920] [client 20.205.123.55:8068] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/userk.php"] [unique_id "aWBKi_nSLfzabNjOjwznbQAAAMI"]
[Fri Jan 09 08:23:39.774657 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:7730] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/userk.php"] [unique_id "aWBKi_nSLfzabNjOjwznbwAAAME"]
[Fri Jan 09 08:23:40.011363 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:7630] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/userk.php"] [unique_id "aWBKjPnSLfzabNjOjwzncQAAANY"]
[Fri Jan 09 08:23:40.257840 2026] [:error] [pid 10431:tid 10456] [client 20.205.123.55:7949] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/userk.php"] [unique_id "aWBKjCkUbiVdwQzsJJQougAAARY"]
[Fri Jan 09 08:23:40.491727 2026] [:error] [pid 10431:tid 10454] [client 20.205.123.55:8024] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/skinmain.php"] [unique_id "aWBKjCkUbiVdwQzsJJQovAAAARQ"]
[Fri Jan 09 08:23:40.727113 2026] [:error] [pid 10431:tid 10441] [client 20.205.123.55:7716] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/skinmain.php"] [unique_id "aWBKjCkUbiVdwQzsJJQovQAAAQc"]
[Fri Jan 09 08:23:40.961076 2026] [:error] [pid 35810:tid 35828] [client 20.205.123.55:7738] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/skinmain.php"] [unique_id "aWBKjIrJrhH8tOUNM5AvTQAAAAk"]
[Fri Jan 09 08:23:41.196335 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:8125] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/skinmain.php"] [unique_id "aWBKjSkUbiVdwQzsJJQovwAAAQg"]
[Fri Jan 09 08:23:41.448688 2026] [:error] [pid 35810:tid 35831] [client 20.205.123.55:7952] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/new.php"] [unique_id "aWBKjYrJrhH8tOUNM5AvTgAAAAw"]
[Fri Jan 09 08:23:41.684607 2026] [:error] [pid 35810:tid 35841] [client 20.205.123.55:16115] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/new.php"] [unique_id "aWBKjYrJrhH8tOUNM5AvUAAAABY"]
[Fri Jan 09 08:23:41.918153 2026] [:error] [pid 35810:tid 35823] [client 20.205.123.55:7695] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/new.php"] [unique_id "aWBKjYrJrhH8tOUNM5AvUwAAAAQ"]
[Fri Jan 09 08:23:42.154317 2026] [:error] [pid 10431:tid 10445] [client 20.205.123.55:7989] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/new.php"] [unique_id "aWBKjikUbiVdwQzsJJQowgAAAQs"]
[Fri Jan 09 08:23:42.387767 2026] [:error] [pid 35812:tid 35896] [client 20.205.123.55:7703] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/orxnwdbb.php"] [unique_id "aWBKjkAss1qSj44c-n03ugAAAJY"]
[Fri Jan 09 08:23:42.622129 2026] [:error] [pid 35811:tid 35857] [client 20.205.123.55:8085] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/orxnwdbb.php"] [unique_id "aWBKjm7lx9V0CvYJJf36NgAAAEo"]
[Fri Jan 09 08:23:42.855393 2026] [:error] [pid 35916:tid 35938] [client 20.205.123.55:7898] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/orxnwdbb.php"] [unique_id "aWBKjvnSLfzabNjOjwznfwAAANQ"]
[Fri Jan 09 08:23:43.089389 2026] [:error] [pid 35810:tid 35824] [client 20.205.123.55:8002] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/orxnwdbb.php"] [unique_id "aWBKj4rJrhH8tOUNM5AvVwAAAAU"]
[Fri Jan 09 08:23:43.324175 2026] [:error] [pid 35811:tid 35861] [client 20.205.123.55:7891] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aWBKj27lx9V0CvYJJf36NwAAAE4"]
[Fri Jan 09 08:23:43.557471 2026] [:error] [pid 10431:tid 10456] [client 20.205.123.55:7974] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aWBKjykUbiVdwQzsJJQoyAAAARY"]
[Fri Jan 09 08:23:43.790478 2026] [:error] [pid 35811:tid 35858] [client 20.205.123.55:8053] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aWBKj27lx9V0CvYJJf36OQAAAEs"]
[Fri Jan 09 08:23:44.023591 2026] [:error] [pid 35811:tid 35852] [client 20.205.123.55:7889] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3.php"] [unique_id "aWBKkG7lx9V0CvYJJf36OwAAAEU"]
[Fri Jan 09 08:23:44.257342 2026] [:error] [pid 35916:tid 35927] [client 20.205.123.55:7959] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs8.php"] [unique_id "aWBKkPnSLfzabNjOjwznhQAAAMk"]
[Fri Jan 09 08:23:44.490776 2026] [:error] [pid 35812:tid 35887] [client 20.205.123.55:7910] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs8.php"] [unique_id "aWBKkEAss1qSj44c-n03vgAAAI0"]
[Fri Jan 09 08:23:44.724118 2026] [:error] [pid 35810:tid 35826] [client 20.205.123.55:7739] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs8.php"] [unique_id "aWBKkIrJrhH8tOUNM5AvWQAAAAc"]
[Fri Jan 09 08:23:44.957972 2026] [:error] [pid 35811:tid 35855] [client 20.205.123.55:7923] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs8.php"] [unique_id "aWBKkG7lx9V0CvYJJf36QAAAAEg"]
[Fri Jan 09 08:23:45.191688 2026] [:error] [pid 35811:tid 35851] [client 20.205.123.55:7894] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/links.php"] [unique_id "aWBKkW7lx9V0CvYJJf36QQAAAEQ"]
[Fri Jan 09 08:23:45.424830 2026] [:error] [pid 35916:tid 35939] [client 20.205.123.55:7904] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/links.php"] [unique_id "aWBKkfnSLfzabNjOjwznjAAAANU"]
[Fri Jan 09 08:23:45.661360 2026] [:error] [pid 35810:tid 35831] [client 20.205.123.55:7988] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/links.php"] [unique_id "aWBKkYrJrhH8tOUNM5AvWgAAAAw"]
[Fri Jan 09 08:23:45.895898 2026] [:error] [pid 35812:tid 35889] [client 20.205.123.55:7731] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/links.php"] [unique_id "aWBKkUAss1qSj44c-n03wwAAAI8"]
[Fri Jan 09 08:23:46.129498 2026] [:error] [pid 35812:tid 35882] [client 20.205.123.55:7711] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/backup/dumper.php"] [unique_id "aWBKkkAss1qSj44c-n03xQAAAIg"]
[Fri Jan 09 08:23:46.362963 2026] [:error] [pid 10431:tid 10439] [client 20.205.123.55:7692] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/backup/dumper.php"] [unique_id "aWBKkikUbiVdwQzsJJQo1gAAAQU"]
[Fri Jan 09 08:23:46.598216 2026] [:error] [pid 10431:tid 10434] [client 20.205.123.55:7702] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/backup/dumper.php"] [unique_id "aWBKkikUbiVdwQzsJJQo2AAAAQA"]
[Fri Jan 09 08:23:46.878854 2026] [:error] [pid 35811:tid 35852] [client 20.205.123.55:7689] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/backup/dumper.php"] [unique_id "aWBKkm7lx9V0CvYJJf36RQAAAEU"]
[Fri Jan 09 08:23:47.128830 2026] [:error] [pid 35812:tid 35895] [client 20.205.123.55:7994] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer-4.5.0-mysql.php"] [unique_id "aWBKk0Ass1qSj44c-n03yQAAAJU"]
[Fri Jan 09 08:23:47.362093 2026] [:error] [pid 10431:tid 10451] [client 20.205.123.55:7895] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer-4.5.0-mysql.php"] [unique_id "aWBKkykUbiVdwQzsJJQo4AAAARE"]
[Fri Jan 09 08:23:47.595931 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:8019] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer-4.5.0-mysql.php"] [unique_id "aWBKkykUbiVdwQzsJJQo4QAAAQ8"]
[Fri Jan 09 08:23:47.828497 2026] [:error] [pid 10431:tid 10445] [client 20.205.123.55:7708] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer-4.5.0-mysql.php"] [unique_id "aWBKkykUbiVdwQzsJJQo5AAAAQs"]
[Fri Jan 09 08:23:48.065056 2026] [:error] [pid 10431:tid 10455] [client 20.205.123.55:7885] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/site/wp-class.php"] [unique_id "aWBKlCkUbiVdwQzsJJQo5wAAARU"]
[Fri Jan 09 08:23:48.299017 2026] [:error] [pid 35916:tid 35923] [client 20.205.123.55:7705] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/site/wp-class.php"] [unique_id "aWBKlPnSLfzabNjOjwznkAAAAMU"]
[Fri Jan 09 08:23:48.538746 2026] [:error] [pid 35811:tid 35853] [client 20.205.123.55:7694] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/site/wp-class.php"] [unique_id "aWBKlG7lx9V0CvYJJf36RwAAAEY"]
[Fri Jan 09 08:23:48.771318 2026] [:error] [pid 35916:tid 35924] [client 20.205.123.55:7984] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/site/wp-class.php"] [unique_id "aWBKlPnSLfzabNjOjwznkgAAAMY"]
[Fri Jan 09 08:23:49.004568 2026] [:error] [pid 35916:tid 35936] [client 20.205.123.55:7962] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/video.php"] [unique_id "aWBKlfnSLfzabNjOjwznlAAAANI"]
[Fri Jan 09 08:23:49.237622 2026] [:error] [pid 35916:tid 35941] [client 20.205.123.55:7916] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/video.php"] [unique_id "aWBKlfnSLfzabNjOjwznlQAAANc"]
[Fri Jan 09 08:23:49.473437 2026] [:error] [pid 35916:tid 35940] [client 20.205.123.55:7743] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/video.php"] [unique_id "aWBKlfnSLfzabNjOjwznmgAAANY"]
[Fri Jan 09 08:23:49.714439 2026] [:error] [pid 10431:tid 10454] [client 20.205.123.55:7735] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/video.php"] [unique_id "aWBKlSkUbiVdwQzsJJQo7QAAARQ"]
[Fri Jan 09 08:23:49.950613 2026] [:error] [pid 10431:tid 10443] [client 20.205.123.55:7907] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/scgi-bin.php"] [unique_id "aWBKlSkUbiVdwQzsJJQo8AAAAQk"]
[Fri Jan 09 08:23:50.188397 2026] [:error] [pid 35812:tid 35875] [client 20.205.123.55:7960] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/scgi-bin.php"] [unique_id "aWBKlkAss1qSj44c-n030AAAAIE"]
[Fri Jan 09 08:23:50.424373 2026] [:error] [pid 35812:tid 35883] [client 20.205.123.55:7927] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/scgi-bin.php"] [unique_id "aWBKlkAss1qSj44c-n030QAAAIk"]
[Fri Jan 09 08:23:50.661419 2026] [:error] [pid 35812:tid 35882] [client 20.205.123.55:7721] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/scgi-bin.php"] [unique_id "aWBKlkAss1qSj44c-n030wAAAIg"]
[Fri Jan 09 08:23:50.893956 2026] [:error] [pid 35811:tid 35852] [client 20.205.123.55:7973] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/finest09.php"] [unique_id "aWBKlm7lx9V0CvYJJf36UwAAAEU"]
[Fri Jan 09 08:23:51.146303 2026] [:error] [pid 35811:tid 35849] [client 20.205.123.55:7736] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/finest09.php"] [unique_id "aWBKl27lx9V0CvYJJf36VQAAAEI"]
[Fri Jan 09 08:23:51.380275 2026] [:error] [pid 35811:tid 35859] [client 20.205.123.55:7979] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/finest09.php"] [unique_id "aWBKl27lx9V0CvYJJf36WAAAAEw"]
[Fri Jan 09 08:23:51.613277 2026] [:error] [pid 35811:tid 35860] [client 20.205.123.55:7954] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/finest09.php"] [unique_id "aWBKl27lx9V0CvYJJf36WQAAAE0"]
[Fri Jan 09 08:23:51.845816 2026] [:error] [pid 10431:tid 10440] [client 20.205.123.55:7741] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1100.php"] [unique_id "aWBKlykUbiVdwQzsJJQo9AAAAQY"]
[Fri Jan 09 08:23:52.079170 2026] [:error] [pid 35812:tid 35891] [client 20.205.123.55:7638] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1100.php"] [unique_id "aWBKmEAss1qSj44c-n032QAAAJE"]
[Fri Jan 09 08:23:52.313195 2026] [:error] [pid 35916:tid 35937] [client 20.205.123.55:7623] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1100.php"] [unique_id "aWBKmPnSLfzabNjOjwznogAAANM"]
[Fri Jan 09 08:23:52.546497 2026] [:error] [pid 10431:tid 10435] [client 20.205.123.55:7909] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1100.php"] [unique_id "aWBKmCkUbiVdwQzsJJQo-QAAAQE"]
[Fri Jan 09 08:23:52.785278 2026] [:error] [pid 35811:tid 35871] [client 20.205.123.55:7897] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/iov.php"] [unique_id "aWBKmG7lx9V0CvYJJf36XwAAAFg"]
[Fri Jan 09 08:23:53.025533 2026] [:error] [pid 35916:tid 35923] [client 20.205.123.55:7893] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/iov.php"] [unique_id "aWBKmfnSLfzabNjOjwznpwAAAMU"]
[Fri Jan 09 08:23:53.258652 2026] [:error] [pid 35811:tid 35868] [client 20.205.123.55:7740] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/iov.php"] [unique_id "aWBKmW7lx9V0CvYJJf36YQAAAFU"]
[Fri Jan 09 08:23:53.492506 2026] [:error] [pid 35811:tid 35858] [client 20.205.123.55:7888] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/iov.php"] [unique_id "aWBKmW7lx9V0CvYJJf36YgAAAEs"]
[Fri Jan 09 08:23:53.726618 2026] [:error] [pid 10431:tid 10440] [client 20.205.123.55:7905] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app/config.php"] [unique_id "aWBKmSkUbiVdwQzsJJQpAAAAAQY"]
[Fri Jan 09 08:23:53.960033 2026] [:error] [pid 35812:tid 35879] [client 20.205.123.55:7906] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app/config.php"] [unique_id "aWBKmUAss1qSj44c-n033gAAAIU"]
[Fri Jan 09 08:23:54.195011 2026] [:error] [pid 35916:tid 35924] [client 20.205.123.55:7958] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app/config.php"] [unique_id "aWBKmvnSLfzabNjOjwznqQAAAMY"]
[Fri Jan 09 08:23:54.430467 2026] [:error] [pid 35812:tid 35888] [client 20.205.123.55:7662] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/app/config.php"] [unique_id "aWBKmkAss1qSj44c-n033wAAAI4"]
[Fri Jan 09 08:23:54.663115 2026] [:error] [pid 35811:tid 35859] [client 20.205.123.55:7896] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/ioxi-o.php"] [unique_id "aWBKmm7lx9V0CvYJJf36ZwAAAEw"]
[Fri Jan 09 08:23:54.895843 2026] [:error] [pid 35916:tid 35922] [client 20.205.123.55:7733] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/ioxi-o.php"] [unique_id "aWBKmvnSLfzabNjOjwznqgAAAMQ"]
[Fri Jan 09 08:23:55.136220 2026] [:error] [pid 35810:tid 35822] [client 20.205.123.55:7660] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/ioxi-o.php"] [unique_id "aWBKm4rJrhH8tOUNM5AvYQAAAAM"]
[Fri Jan 09 08:23:55.372438 2026] [:error] [pid 10431:tid 10449] [client 20.205.123.55:7917] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/ioxi-o.php"] [unique_id "aWBKmykUbiVdwQzsJJQpBwAAAQ8"]
[Fri Jan 09 08:23:55.605652 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:7717] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known.php"] [unique_id "aWBKmykUbiVdwQzsJJQpCgAAAQg"]
[Fri Jan 09 08:23:55.838990 2026] [:error] [pid 35812:tid 35895] [client 20.205.123.55:7918] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known.php"] [unique_id "aWBKm0Ass1qSj44c-n034wAAAJU"]
[Fri Jan 09 08:23:56.071860 2026] [:error] [pid 35812:tid 35874] [client 20.205.123.55:7873] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known.php"] [unique_id "aWBKnEAss1qSj44c-n035gAAAIA"]
[Fri Jan 09 08:23:56.306095 2026] [:error] [pid 35812:tid 35890] [client 20.205.123.55:7722] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known.php"] [unique_id "aWBKnEAss1qSj44c-n035wAAAJA"]
[Fri Jan 09 08:23:56.540139 2026] [:error] [pid 10431:tid 10452] [client 20.205.123.55:7631] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/02.php"] [unique_id "aWBKnCkUbiVdwQzsJJQpEAAAARI"]
[Fri Jan 09 08:23:56.773996 2026] [:error] [pid 35812:tid 35877] [client 20.205.123.55:7625] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/02.php"] [unique_id "aWBKnEAss1qSj44c-n036AAAAIM"]
[Fri Jan 09 08:23:57.007379 2026] [:error] [pid 10431:tid 10453] [client 20.205.123.55:7955] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/02.php"] [unique_id "aWBKnSkUbiVdwQzsJJQpEgAAARM"]
[Fri Jan 09 08:23:57.283208 2026] [:error] [pid 10431:tid 10435] [client 20.205.123.55:7920] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/02.php"] [unique_id "aWBKnSkUbiVdwQzsJJQpFQAAAQE"]
[Fri Jan 09 08:23:57.516568 2026] [:error] [pid 35812:tid 35875] [client 20.205.123.55:7933] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/13.php"] [unique_id "aWBKnUAss1qSj44c-n036wAAAIE"]
[Fri Jan 09 08:23:57.750739 2026] [:error] [pid 35812:tid 35889] [client 20.205.123.55:7931] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/13.php"] [unique_id "aWBKnUAss1qSj44c-n037AAAAI8"]
[Fri Jan 09 08:23:57.984961 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:7921] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/13.php"] [unique_id "aWBKnfnSLfzabNjOjwznrwAAAME"]
[Fri Jan 09 08:23:58.222138 2026] [:error] [pid 35812:tid 35893] [client 20.205.123.55:7632] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/13.php"] [unique_id "aWBKnkAss1qSj44c-n037QAAAJM"]
[Fri Jan 09 08:23:58.455883 2026] [:error] [pid 35916:tid 35922] [client 20.205.123.55:7985] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2024.php"] [unique_id "aWBKnvnSLfzabNjOjwznsQAAAMQ"]
[Fri Jan 09 08:23:58.696333 2026] [:error] [pid 35812:tid 35888] [client 20.205.123.55:7691] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2024.php"] [unique_id "aWBKnkAss1qSj44c-n037wAAAI4"]
[Fri Jan 09 08:23:58.929006 2026] [:error] [pid 35812:tid 35874] [client 20.205.123.55:7915] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2024.php"] [unique_id "aWBKnkAss1qSj44c-n038QAAAIA"]
[Fri Jan 09 08:23:59.188051 2026] [:error] [pid 10431:tid 10444] [client 20.205.123.55:7718] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2024.php"] [unique_id "aWBKnykUbiVdwQzsJJQpIAAAAQo"]
[Fri Jan 09 08:23:59.421745 2026] [:error] [pid 10431:tid 10443] [client 20.205.123.55:7957] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aWBKnykUbiVdwQzsJJQpIgAAAQk"]
[Fri Jan 09 08:23:59.654623 2026] [:error] [pid 10431:tid 10442] [client 20.205.123.55:7678] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aWBKnykUbiVdwQzsJJQpIwAAAQg"]
[Fri Jan 09 08:23:59.887640 2026] [:error] [pid 10431:tid 10445] [client 20.205.123.55:7729] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aWBKnykUbiVdwQzsJJQpJQAAAQs"]
[Fri Jan 09 08:24:00.122640 2026] [:error] [pid 35812:tid 35892] [client 20.205.123.55:7649] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aWBKoEAss1qSj44c-n039AAAAJI"]
[Fri Jan 09 08:24:00.357512 2026] [:error] [pid 10431:tid 10451] [client 20.205.123.55:7643] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Diff.php"] [unique_id "aWBKoCkUbiVdwQzsJJQpKAAAARE"]
[Fri Jan 09 08:24:00.589973 2026] [:error] [pid 35916:tid 35928] [client 20.205.123.55:7880] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Diff.php"] [unique_id "aWBKoPnSLfzabNjOjwznugAAAMo"]
[Fri Jan 09 08:24:00.824877 2026] [:error] [pid 35811:tid 35854] [client 20.205.123.55:7616] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Diff.php"] [unique_id "aWBKoG7lx9V0CvYJJf36bAAAAEc"]
[Fri Jan 09 08:24:01.061708 2026] [:error] [pid 35916:tid 35919] [client 20.205.123.55:7881] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Diff.php"] [unique_id "aWBKofnSLfzabNjOjwznuwAAAME"]
[Fri Jan 09 08:24:01.295383 2026] [:error] [pid 35812:tid 35875] [client 20.205.123.55:7700] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Engine.php"] [unique_id "aWBKoUAss1qSj44c-n039QAAAIE"]
[Fri Jan 09 08:24:01.531656 2026] [:error] [pid 35811:tid 35847] [client 20.205.123.55:7878] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Engine.php"] [unique_id "aWBKoW7lx9V0CvYJJf36bgAAAEA"]
[Fri Jan 09 08:24:01.775919 2026] [:error] [pid 35811:tid 35868] [client 20.205.123.55:7877] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Engine.php"] [unique_id "aWBKoW7lx9V0CvYJJf36cgAAAFU"]
[Fri Jan 09 08:24:02.015782 2026] [:error] [pid 35811:tid 35858] [client 20.205.123.55:7830] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Engine.php"] [unique_id "aWBKom7lx9V0CvYJJf36dAAAAEs"]
[Fri Jan 09 08:24:02.248649 2026] [:error] [pid 35810:tid 35832] [client 20.205.123.55:7868] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ID3.php"] [unique_id "aWBKoorJrhH8tOUNM5AvagAAAA0"]
[Fri Jan 09 08:24:02.497902 2026] [:error] [pid 35810:tid 35834] [client 20.205.123.55:7928] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ID3.php"] [unique_id "aWBKoorJrhH8tOUNM5AvbQAAAA8"]
[Fri Jan 09 08:24:02.734343 2026] [:error] [pid 35811:tid 35859] [client 20.205.123.55:7964] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ID3.php"] [unique_id "aWBKom7lx9V0CvYJJf36dwAAAEw"]
[Fri Jan 09 08:24:02.968041 2026] [:error] [pid 35916:tid 35936] [client 20.205.123.55:7628] [client 20.205.123.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ID3.php"] [unique_id "aWBKovnSLfzabNjOjwznwQAAANI"]
[Fri Jan 09 08:24:03.205319 2026] [:error] [pid 35812:tid 35888] [client 20.205.123.55:7908] File does not exist: /usr/local/apache/htdocs/suspended-page/IXR.php
[Fri Jan 09 08:24:03.326784 2026] [:error] [pid 35812:tid 35884] [client 20.205.123.55:7908] File does not exist: /usr/local/apache/htdocs/suspended-page/SimplePie.php
[Fri Jan 09 08:24:03.447345 2026] [:error] [pid 35812:tid 35874] [client 20.205.123.55:7908] File does not exist: /usr/local/apache/htdocs/suspended-page/Text.php
[Fri Jan 09 08:24:03.567075 2026] [:error] [pid 35812:tid 35895] [client 20.205.123.55:7908] File does not exist: /usr/local/apache/htdocs/suspended-page/aahana.php
[Fri Jan 09 08:24:03.687130 2026] [:error] [pid 35812:tid 35894] [client 20.205.123.55:7908] File does not exist: /usr/local/apache/htdocs/suspended-page/ws35.php
[Fri Jan 09 09:08:19.816207 2026] [:error] [pid 35916:tid 35933] [client 43.157.147.3:41224] [client 43.157.147.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWBVA_nSLfzabNjOjwz_1QAAAM8"]
[Fri Jan 09 10:06:58.698659 2026] [:error] [pid 44848:tid 44857] [client 119.28.89.249:40504] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWBiwqjajoTJAbEk87wh0gAAAEc"]
[Fri Jan 09 11:19:28.609754 2026] [:error] [pid 30113:tid 30117] [client 143.244.141.160:62271] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aWBzwKsz80DbrolLWsH_2QAAAQE"], referer: binance.com
[Fri Jan 09 13:45:10.503808 2026] [:error] [pid 1366:tid 1382] [client 170.106.35.153:48666] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWCV5hmasveKu8_ec1XxQwAAAY0"]
[Fri Jan 09 15:21:32.225000 2026] [:error] [pid 30020:tid 30061] [client 182.44.8.254:35873] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWCsfMrjc66qOisG6L2xVgAAAIc"]
[Fri Jan 09 22:06:58.470149 2026] [:error] [pid 14770:tid 14776] [client 43.159.149.56:56150] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWELgh5QbaVZ-6newJZL3wAAAgQ"]
[Fri Jan 09 23:07:11.880958 2026] [:error] [pid 14801:tid 14824] [client 101.32.208.70:49248] [client 101.32.208.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWEZn98UWXrz_OQYgF19TAAAAlU"]
[Fri Jan 09 23:19:01.461406 2026] [:error] [pid 1366:tid 1386] [client 43.201.30.201:40912] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aWEcZRmasveKu8_ec1WebwAAAZE"]
[Fri Jan 09 23:19:02.036927 2026] [:error] [pid 1366:tid 1382] [client 43.201.30.201:41062] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aWEcZhmasveKu8_ec1WecQAAAY0"]
[Fri Jan 09 23:19:03.205923 2026] [:error] [pid 14739:tid 14760] [client 43.201.30.201:41392] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/backup.sql"] [unique_id "aWEcZ163M6_PkLt_IJKCiwAAAdM"]
[Fri Jan 09 23:19:03.789117 2026] [:error] [pid 1366:tid 1373] [client 43.201.30.201:41538] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/debug.log"] [unique_id "aWEcZxmasveKu8_ec1WedQAAAYQ"]
[Fri Jan 09 23:19:04.375251 2026] [:error] [pid 14739:tid 14749] [client 43.201.30.201:41682] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/database.sql"] [unique_id "aWEcaF63M6_PkLt_IJKCjAAAAcg"]
[Fri Jan 09 23:19:04.963075 2026] [:error] [pid 14739:tid 14763] [client 43.201.30.201:41836] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/storage/logs/laravel.log"] [unique_id "aWEcaF63M6_PkLt_IJKCjwAAAdY"]
[Fri Jan 09 23:19:07.878361 2026] [:error] [pid 14831:tid 14833] [client 43.201.30.201:42552] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/dump.sql"] [unique_id "aWEca_aKOMCmJcAyBm1VNAAAAoA"]
[Fri Jan 09 23:19:09.032129 2026] [:error] [pid 14831:tid 14839] [client 43.201.30.201:42770] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "aWEcbfaKOMCmJcAyBm1VNgAAAoY"]
[Fri Jan 09 23:19:09.612774 2026] [:error] [pid 30020:tid 30077] [client 43.201.30.201:42906] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/log/error.log"] [unique_id "aWEcbcrjc66qOisG6L3yowAAAJc"]
[Fri Jan 09 23:19:10.188704 2026] [:error] [pid 30020:tid 30056] [client 43.201.30.201:43044] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backend/.env"] [unique_id "aWEcbsrjc66qOisG6L3ypQAAAII"]
[Fri Jan 09 23:19:11.356943 2026] [:error] [pid 14831:tid 14855] [client 43.201.30.201:43298] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Fri Jan 09 23:19:12.517608 2026] [:error] [pid 30020:tid 30070] [client 43.201.30.201:43592] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aWEccMrjc66qOisG6L3yqQAAAJA"]
[Fri Jan 09 23:19:13.097141 2026] [:error] [pid 30020:tid 30054] [client 43.201.30.201:43744] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Jan 09 23:19:13.670429 2026] [:error] [pid 44848:tid 44851] [client 43.201.30.201:43898] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aWEccajajoTJAbEk87zw8wAAAEE"]
[Fri Jan 09 23:19:14.258497 2026] [:error] [pid 44848:tid 44868] [client 43.201.30.201:44052] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env"] [unique_id "aWEccqjajoTJAbEk87zw9QAAAFI"]
[Fri Jan 09 23:19:14.832920 2026] [:error] [pid 14801:tid 14823] [client 43.201.30.201:44208] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/core/.env"] [unique_id "aWEcct8UWXrz_OQYgF1_aAAAAlQ"]
[Fri Jan 09 23:19:15.413295 2026] [:error] [pid 1366:tid 1377] [client 43.201.30.201:44370] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/laravel/.env"] [unique_id "aWEccxmasveKu8_ec1WeegAAAYg"]
[Fri Jan 09 23:19:15.996777 2026] [:error] [pid 30021:tid 30101] [client 43.201.30.201:44508] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Fri Jan 09 23:19:16.577217 2026] [:error] [pid 30021:tid 30090] [client 43.201.30.201:44674] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/config/.env"] [unique_id "aWEcdA_M8aRtsTog5J_AWQAAAMk"]
[Fri Jan 09 23:19:17.156885 2026] [:error] [pid 44848:tid 44874] [client 43.201.30.201:44816] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "aWEcdajajoTJAbEk87zw9wAAAFg"]
[Fri Jan 09 23:19:17.732184 2026] [:error] [pid 14739:tid 14764] [client 43.201.30.201:44974] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/src/.env"] [unique_id "aWEcdV63M6_PkLt_IJKClwAAAdc"]
[Fri Jan 09 23:19:18.315014 2026] [:error] [pid 1366:tid 1371] [client 43.201.30.201:45150] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/storage/.env"] [unique_id "aWEcdhmasveKu8_ec1WefAAAAYM"]
[Fri Jan 09 23:19:18.890427 2026] [:error] [pid 44848:tid 44857] [client 43.201.30.201:45302] [client 43.201.30.201] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/vendor/.env"] [unique_id "aWEcdqjajoTJAbEk87zw-gAAAEc"]
[Sat Jan 10 01:56:23.597631 2026] [:error] [pid 1366:tid 1376] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sat Jan 10 01:56:23.737307 2026] [:error] [pid 1366:tid 1369] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Sat Jan 10 01:56:23.944715 2026] [:error] [pid 1366:tid 1371] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Sat Jan 10 01:56:24.129052 2026] [:error] [pid 1366:tid 1375] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Sat Jan 10 01:56:24.268605 2026] [:error] [pid 1366:tid 1385] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/baee.php
[Sat Jan 10 01:56:24.406716 2026] [:error] [pid 1366:tid 1380] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/iov.php
[Sat Jan 10 01:56:24.546230 2026] [:error] [pid 1366:tid 1386] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/mds.php
[Sat Jan 10 01:56:24.733263 2026] [:error] [pid 1366:tid 1389] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/mga.php
[Sat Jan 10 01:56:24.924173 2026] [:error] [pid 1366:tid 1381] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/rendi59.php
[Sat Jan 10 01:56:25.062255 2026] [:error] [pid 1366:tid 1393] [client 4.217.185.172:43999] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sat Jan 10 01:56:25.224177 2026] [:error] [pid 1366:tid 1383] [client 4.217.185.172:43999] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assacc.php"] [unique_id "aWFBSRmasveKu8_ec1XIFAAAAY4"]
[Sat Jan 10 01:56:25.652795 2026] [:error] [pid 30019:tid 30046] [client 4.217.185.172:44016] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assacc.php"] [unique_id "aWFBSUz3igHGwX5f7IoibQAAABY"]
[Sat Jan 10 01:56:26.397741 2026] [:error] [pid 1366:tid 1384] [client 4.217.185.172:44013] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assacc.php"] [unique_id "aWFBShmasveKu8_ec1XIFgAAAY8"]
[Sat Jan 10 01:56:26.950429 2026] [:error] [pid 14739:tid 14751] [client 4.217.185.172:44031] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assacc.php"] [unique_id "aWFBSl63M6_PkLt_IJKTCwAAAco"]
[Sat Jan 10 01:56:27.901617 2026] [:error] [pid 14770:tid 14779] [client 4.217.185.172:44027] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6y7t.php"] [unique_id "aWFBSx5QbaVZ-6newJZr_wAAAgc"]
[Sat Jan 10 01:56:28.243097 2026] [:error] [pid 1366:tid 1373] [client 4.217.185.172:43916] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6y7t.php"] [unique_id "aWFBTBmasveKu8_ec1XIGQAAAYQ"]
[Sat Jan 10 01:56:28.552484 2026] [:error] [pid 14739:tid 14755] [client 4.217.185.172:43908] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6y7t.php"] [unique_id "aWFBTF63M6_PkLt_IJKTDgAAAc4"]
[Sat Jan 10 01:56:28.938752 2026] [:error] [pid 30020:tid 30069] [client 4.217.185.172:44015] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6y7t.php"] [unique_id "aWFBTMrjc66qOisG6L0EowAAAI8"]
[Sat Jan 10 01:56:29.688448 2026] [:error] [pid 30020:tid 30064] [client 4.217.185.172:43988] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/monso.php"] [unique_id "aWFBTcrjc66qOisG6L0EpAAAAIo"]
[Sat Jan 10 01:56:30.507570 2026] [:error] [pid 14872:tid 14887] [client 4.217.185.172:43906] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/monso.php"] [unique_id "aWFBTqIUELhgYLNp1sZrFAAAAs0"]
[Sat Jan 10 01:56:31.052514 2026] [:error] [pid 1366:tid 1368] [client 4.217.185.172:43924] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/monso.php"] [unique_id "aWFBTxmasveKu8_ec1XIHAAAAYA"]
[Sat Jan 10 01:56:31.625957 2026] [:error] [pid 44848:tid 44857] [client 4.217.185.172:44008] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/monso.php"] [unique_id "aWFBT6jajoTJAbEk87wOGwAAAEc"]
[Sat Jan 10 01:56:32.040774 2026] [:error] [pid 14831:tid 14834] [client 4.217.185.172:44020] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnnof6.php"] [unique_id "aWFBUPaKOMCmJcAyBm1odwAAAoE"]
[Sat Jan 10 01:56:32.386823 2026] [:error] [pid 14801:tid 14811] [client 4.217.185.172:15303] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnnof6.php"] [unique_id "aWFBUN8UWXrz_OQYgF2TsgAAAkg"]
[Sat Jan 10 01:56:32.834406 2026] [:error] [pid 1366:tid 1380] [client 4.217.185.172:44009] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnnof6.php"] [unique_id "aWFBUBmasveKu8_ec1XIIQAAAYs"]
[Sat Jan 10 01:56:33.151829 2026] [:error] [pid 30019:tid 30039] [client 4.217.185.172:44019] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnnof6.php"] [unique_id "aWFBUUz3igHGwX5f7IoieAAAAA8"]
[Sat Jan 10 01:56:33.498424 2026] [:error] [pid 14801:tid 14822] [client 4.217.185.172:44026] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/str.php"] [unique_id "aWFBUd8UWXrz_OQYgF2TtAAAAlM"]
[Sat Jan 10 01:56:34.217094 2026] [:error] [pid 1366:tid 1381] [client 4.217.185.172:43912] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/str.php"] [unique_id "aWFBUhmasveKu8_ec1XIJAAAAYw"]
[Sat Jan 10 01:56:34.794704 2026] [:error] [pid 14801:tid 14827] [client 4.217.185.172:44014] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/str.php"] [unique_id "aWFBUt8UWXrz_OQYgF2TtwAAAlg"]
[Sat Jan 10 01:56:35.252535 2026] [:error] [pid 1366:tid 1384] [client 4.217.185.172:43973] [client 4.217.185.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/str.php"] [unique_id "aWFBUxmasveKu8_ec1XIJgAAAY8"]
[Sat Jan 10 03:57:43.128194 2026] [:error] [pid 20648:tid 20715] [client 45.127.32.74:40730] [client 45.127.32.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/livewire/livewire.js"] [unique_id "aWFdtzBnnIoBkEBdx9DhXwAAAIY"]
[Sat Jan 10 03:57:45.139772 2026] [:error] [pid 20647:tid 20693] [client 45.127.32.74:40732] [client 45.127.32.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/livewire/message"] [unique_id "aWFduavb0x69MarUHzCFLAAAAEs"]
[Sat Jan 10 03:57:46.463585 2026] [:error] [pid 20647:tid 20683] [client 45.127.32.74:40746] [client 45.127.32.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/livewire/components"] [unique_id "aWFduqvb0x69MarUHzCFMAAAAEE"]
[Sat Jan 10 03:57:48.295986 2026] [:error] [pid 20744:tid 20770] [client 45.127.32.74:39674] [client 45.127.32.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWFdvEA8oR5jvkFpcP81-AAAAM0"]
[Sat Jan 10 07:42:26.418450 2026] [:error] [pid 20744:tid 20772] [client 49.51.195.195:40274] [client 49.51.195.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWGSYkA8oR5jvkFpcP99JQAAAM8"]
[Sat Jan 10 13:31:39.352064 2026] [:error] [pid 1125:tid 1139] [client 43.166.244.251:42910] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWHkO3qAWYc4UwRgeOc84AAAAEw"]
[Sat Jan 10 16:18:23.009657 2026] [:error] [pid 1383:tid 1387] [client 182.44.67.97:40144] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWILTySbzyQbm27sbcIwDAAAA8I"]
[Sat Jan 10 16:33:08.783277 2026] [:error] [pid 1125:tid 1150] [client 101.32.208.70:34894] [client 101.32.208.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWIOxHqAWYc4UwRgeOdQCAAAAFc"]
[Sat Jan 10 18:54:32.155747 2026] [:error] [pid 1296:tid 1319] [client 143.244.141.160:49307] [client 143.244.141.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aWIv6CbQW-fowWjMNKB9pQAAAlU"], referer: binance.com
[Sat Jan 10 20:13:35.312468 2026] [:error] [pid 1339:tid 1349] [client 49.51.36.179:40148] [client 49.51.36.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWJCbycsOJx4B_mSFzlUTQAAA4c"]
[Sun Jan 11 01:22:31.789252 2026] [:error] [pid 1383:tid 1408] [client 34.106.129.53:38366] [client 34.106.129.53] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aWKK1ySbzyQbm27sbcKVHgAAA9M"]
[Sun Jan 11 02:00:21.994890 2026] [:error] [pid 1296:tid 1303] [client 138.197.13.155:54810] [client 138.197.13.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aWKTtSbQW-fowWjMNKDGdQAAAkU"], referer: binance.com
[Sun Jan 11 05:00:03.434709 2026] [:error] [pid 5155:tid 5235] [client 101.42.46.71:38818] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWK901gEKFpNs0_zLGmFtAAAAJM"]
[Sun Jan 11 10:07:34.901820 2026] [:error] [pid 5152:tid 5176] [client 43.157.191.20:42064] [client 43.157.191.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWMF5hm0axGMFrpuXHBVNwAAAA4"]
[Sun Jan 11 11:20:59.067389 2026] [:error] [pid 5272:tid 5283] [client 43.157.156.190:33364] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWMXG1p55bCsukUvYGYG-gAAAMk"]
[Sun Jan 11 18:05:02.428696 2026] [:error] [pid 35730:tid 35742] [client 162.62.231.139:42874] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWN1zji7U_mfHtESQHkvPwAAAco"]
[Sun Jan 11 19:02:23.021638 2026] [:error] [pid 35977:tid 35993] [client 34.182.26.180:50495] [client 34.182.26.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.26.180, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aWODP7DST5RMqStLeP1lswAAAg0"]
[Sun Jan 11 19:02:23.024697 2026] [:error] [pid 35977:tid 35993] [client 34.182.26.180:50495] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Jan 11 19:02:25.376463 2026] [:error] [pid 35977:tid 35986] [client 34.182.26.180:50495] [client 34.182.26.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aWODQbDST5RMqStLeP1lvwAAAgY"]
[Sun Jan 11 19:02:25.757796 2026] [:error] [pid 11748:tid 11778] [client 34.182.26.180:49925] [client 34.182.26.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aWODQQC5xybrWOCNnobwsAAAAYA"]
[Sun Jan 11 19:02:26.136896 2026] [:error] [pid 5155:tid 5223] [client 34.182.26.180:52714] [client 34.182.26.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aWODQlgEKFpNs0_zLGkL6AAAAIc"]
[Sun Jan 11 19:02:26.515116 2026] [:error] [pid 5155:tid 5236] [client 34.182.26.180:63927] [client 34.182.26.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aWODQlgEKFpNs0_zLGkL6QAAAJQ"]
[Sun Jan 11 19:02:26.887786 2026] [:error] [pid 40191:tid 40201] [client 34.182.26.180:63645] [client 34.182.26.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aWODQkm2BH1CV1p0EUHDJQAAAsg"]
[Sun Jan 11 19:02:27.300984 2026] [:error] [pid 40191:tid 40197] [client 34.182.26.180:60346] [client 34.182.26.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aWODQ0m2BH1CV1p0EUHDJgAAAsQ"]
[Sun Jan 11 19:02:27.785066 2026] [:error] [pid 40191:tid 40216] [client 34.182.26.180:50326] [client 34.182.26.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aWODQ0m2BH1CV1p0EUHDJwAAAtc"]
[Sun Jan 11 23:07:13.257394 2026] [:error] [pid 5153:tid 5197] [client 49.51.183.220:43816] [client 49.51.183.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWO8oc1QbNSPD9bRi77dyQAAAEg"]
[Mon Jan 12 08:41:33.741314 2026] [:error] [pid 48213:tid 48234] [client 43.132.214.228:32856] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWRDPWRmaItaLCBvAhhzOwAAANM"]
[Mon Jan 12 09:06:04.054417 2026] [:error] [pid 48213:tid 48232] [client 43.157.38.228:51046] [client 43.157.38.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWRI_GRmaItaLCBvAhh8CQAAANE"]
[Mon Jan 12 18:00:46.839060 2026] [:error] [pid 51637:tid 51662] [client 175.6.217.4:44908] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWTGTnrTvTmO_ovDgVCxCAAAAZM"]
[Mon Jan 12 20:01:35.971402 2026] [:error] [pid 51986:tid 52027] [client 101.33.66.34:55966] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWTinxiI5CoFGIbwGZZpEQAAA0w"]
[Mon Jan 12 20:06:49.640234 2026] [:error] [pid 51637:tid 51657] [client 167.172.235.216:49336] [client 167.172.235.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aWTj2XrTvTmO_ovDgVDRhwAAAY4"], referer: binance.com
[Mon Jan 12 22:43:27.470108 2026] [:error] [pid 48213:tid 48222] [client 195.178.110.161:48388] [client 195.178.110.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aWUIj2RmaItaLCBvAhgUKwAAAMc"]
[Tue Jan 13 00:30:40.484651 2026] [:error] [pid 48105:tid 48143] [client 125.75.66.97:53229] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWUhsDbe4SdLfSmtJe2wOQAAAEM"]
[Tue Jan 13 01:30:54.929246 2026] [:error] [pid 51897:tid 51933] [client 170.106.37.134:59980] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWUvztwDOJmYnFxYfDUahgAAAoc"]
[Tue Jan 13 01:59:36.062686 2026] [:error] [pid 51896:tid 51900] [client 103.177.150.27:64236] [client 103.177.150.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.177.150.27, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aWU2iN2Y52W2afNXn_W02QAAAkE"]
[Tue Jan 13 01:59:36.066318 2026] [:error] [pid 51896:tid 51900] [client 103.177.150.27:64236] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Jan 13 06:39:43.755601 2026] [:error] [pid 57660:tid 57718] [client 180.110.203.108:48047] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWV4L9MDflPZjoqTTeFcRgAAAIE"]
[Tue Jan 13 12:49:34.736396 2026] [:error] [pid 22425:tid 22452] [client 43.135.185.59:34302] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWXO3nLEE_SEuOZ0WBRw6wAAAJU"]
[Tue Jan 13 16:21:36.740358 2026] [:error] [pid 27597:tid 27602] [client 43.130.32.245:54488] [client 43.130.32.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWYAkD8Db8v8HoJ3n4DR2gAAAAM"]
[Tue Jan 13 18:53:35.013580 2026] [:error] [pid 22389:tid 22399] [client 43.157.180.116:60546] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWYkLyLIB_8b411qalI7QgAAAUg"]
[Wed Jan 14 01:15:31.624651 2026] [:error] [pid 63843:tid 63882] [client 36.111.67.189:44836] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWZ9s4qxEwB7D1-DxXfc-wAAAIg"]
[Wed Jan 14 02:42:16.315793 2026] [:error] [pid 43494:tid 43519] [client 103.177.150.27:49861] [client 103.177.150.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.177.150.27, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aWaSCMiBIyHKw4YELOkXlgAAAZA"]
[Wed Jan 14 02:42:16.319435 2026] [:error] [pid 43494:tid 43519] [client 103.177.150.27:49861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Jan 14 06:54:29.932121 2026] [:error] [pid 24710:tid 24720] [client 43.159.136.201:44482] [client 43.159.136.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWbNJWXBo5bEhDEEhs15lAAAAMg"]
[Wed Jan 14 10:45:56.733281 2026] [:error] [pid 37225:tid 37229] [client 43.133.139.6:55832] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWcDZOYdRPDSEpBLRUPlswAAAQE"]
[Wed Jan 14 12:57:11.832974 2026] [:error] [pid 19278:tid 19283] [client 104.28.246.114:63333] [client 104.28.246.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aWciJ1GofyyxZQcTd1VtLQAAAAM"]
[Wed Jan 14 13:27:09.704221 2026] [:error] [pid 36986:tid 37007] [client 60.188.57.0:42108] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWcpLde0JvHv1YdpWx4OKgAAAJI"]
[Wed Jan 14 19:12:14.283089 2026] [:error] [pid 7961:tid 7973] [client 43.135.183.82:45528] [client 43.135.183.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWd6DpjhjzEJ3QX9Hub2gQAAAEo"]
[Wed Jan 14 19:42:22.142773 2026] [:error] [pid 21490:tid 21499] [client 182.42.111.213:43961] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWeBHu26AHzy1muKyudAoAAAAQY"]
[Thu Jan 15 02:01:01.841728 2026] [:error] [pid 23355:tid 23368] [client 49.235.136.28:56384] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWfZ3YgRLUaz7Nmrre25gQAAAMs"]
[Thu Jan 15 04:29:45.004632 2026] [:error] [pid 5389:tid 5392] [client 43.131.243.61:43746] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWf8uUkzfklDSWCNrVIeMgAAAME"]
[Thu Jan 15 07:11:52.526723 2026] [:error] [pid 51807:tid 51810] [client 170.106.165.186:54684] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWgiuMMrH4_ge4gLwN0kCAAAAQE"]
[Thu Jan 15 08:00:43.331954 2026] [:error] [pid 5292:tid 5359] [client 182.42.111.213:60581] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWguK2WxK-ai3L9DjxYhJgAAAIQ"]
[Thu Jan 15 08:03:55.142421 2026] [:error] [pid 51807:tid 51816] [client 195.178.110.191:35698] [client 195.178.110.191] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aWgu68MrH4_ge4gLwN1BUwAAAQc"]
[Thu Jan 15 13:40:37.379827 2026] [:error] [pid 5292:tid 5367] [client 43.130.154.56:49370] [client 43.130.154.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWh91WWxK-ai3L9DjxaGWQAAAIw"]
[Thu Jan 15 17:04:47.535127 2026] [:error] [pid 5292:tid 5362] [client 43.153.86.78:50052] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWitr2WxK-ai3L9DjxbS4wAAAIc"]
[Thu Jan 15 20:22:15.813293 2026] [:error] [pid 51807:tid 51809] [client 203.2.64.59:39797] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWjb98MrH4_ge4gLwN0dVgAAAQA"]
[Fri Jan 16 00:49:44.170728 2026] [:error] [pid 5290:tid 5318] [client 124.156.225.181:55646] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWkaqDiQRfcmyoePXPf2awAAABM"]
[Fri Jan 16 08:41:46.521119 2026] [:error] [pid 43435:tid 43441] [client 117.33.163.216:56488] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWmJSsTShPLPoPKNBO1_iQAAAQQ"]
[Fri Jan 16 11:33:23.937259 2026] [:error] [pid 9260:tid 9283] [client 43.164.197.209:49634] [client 43.164.197.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWmxg13AAooR8oZsCwlbeQAAABU"]
[Fri Jan 16 14:00:58.374865 2026] [:error] [pid 29908:tid 29911] [client 170.106.148.137:35226] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWnUGmVs7GIQKAJ2aTXFcQAAAEE"]
[Fri Jan 16 14:46:08.935266 2026] [:error] [pid 9260:tid 9282] [client 110.166.71.39:48434] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWnesF3AAooR8oZsCwmizgAAABQ"]
[Fri Jan 16 17:01:37.588690 2026] [:error] [pid 30865:tid 30888] [client 84.247.169.220:55683] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWn-cRCR_HCYGnC3FS-zNAAAAVQ"]
[Fri Jan 16 17:01:38.789711 2026] [:error] [pid 54008:tid 54030] [client 84.247.169.220:55808] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-json/wc/v3/payment_gateways"] [unique_id "aWn-cseowS6CyLOmCzOjHgAAAJQ"]
[Fri Jan 16 17:01:40.136079 2026] [:error] [pid 30925:tid 30945] [client 84.247.169.220:55915] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-json/wc/v2/payment_gateways"] [unique_id "aWn-dLPyx6TwF5dNaFqiQAAAAZI"]
[Fri Jan 16 17:01:41.395832 2026] [:error] [pid 30865:tid 30886] [client 84.247.169.220:56114] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-json/wc/store/v1/cart"] [unique_id "aWn-dRCR_HCYGnC3FS-zRgAAAVI"]
[Fri Jan 16 17:01:42.678030 2026] [:error] [pid 30957:tid 30964] [client 84.247.169.220:56291] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-json/wc/store/v1/payment_methods"] [unique_id "aWn-dt2pbRtnni7K9w8qSQAAAEQ"]
[Fri Jan 16 19:46:21.226339 2026] [:error] [pid 30865:tid 30883] [client 43.152.72.244:43074] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWolDRCR_HCYGnC3FS__NQAAAU8"]
[Sat Jan 17 03:17:51.412259 2026] [:error] [pid 777:tid 790] [client 36.111.67.189:53471] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWqO31trqGZ8HjfI6hRWiAAAAMQ"]
[Sat Jan 17 08:52:43.091799 2026] [:error] [pid 31322:tid 31335] [client 43.153.96.79:56476] [client 43.153.96.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWrdW3xOW98yk2MBlypQ3AAAAME"]
[Sat Jan 17 09:18:41.227028 2026] [:error] [pid 31223:tid 31250] [client 43.140.247.223:43128] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWrjcUMnpeq0T1sEOlJ3wAAAABE"]
[Sat Jan 17 16:58:27.441165 2026] [:error] [pid 31225:tid 31290] [client 43.157.180.116:47504] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWtPM-nu2L2yWFDbzyW9RwAAAII"]
[Sat Jan 17 19:37:51.808836 2026] [:error] [pid 31225:tid 31295] [client 43.158.91.71:51732] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWt0j-nu2L2yWFDbzyXxhQAAAIc"]
[Sat Jan 17 21:56:18.427994 2026] [:error] [pid 31225:tid 31299] [client 43.140.247.223:56848] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWuVAunu2L2yWFDbzyUchwAAAIs"]
[Sat Jan 17 22:55:38.190042 2026] [:error] [pid 31698:tid 31707] [client 43.166.7.113:55018] [client 43.166.7.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWui6rjKZJSxKAfZqrLxtwAAAQU"]
[Sun Jan 18 00:49:58.716054 2026] [:error] [pid 31224:tid 31282] [client 104.28.161.73:44438] [client 104.28.161.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aWu9tjgpVpEMk8-OQkhqzAAAAFU"]
[Sun Jan 18 04:14:36.579606 2026] [:error] [pid 13034:tid 13043] [client 110.166.71.39:58905] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWvtrMRGpUu1E8cmbmjt_wAAAMU"]
[Sun Jan 18 16:57:48.219531 2026] [:error] [pid 13034:tid 13062] [client 43.156.204.134:41364] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWygjMRGpUu1E8cmbmhPQgAAANg"]
[Sun Jan 18 22:52:52.192681 2026] [:error] [pid 11650:tid 11666] [client 43.164.196.57:49406] [client 43.164.196.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aWzzxEJ_hGOO27rOLtGmGQAAAgw"]
[Sun Jan 18 22:55:19.500677 2026] [:error] [pid 11620:tid 11626] [client 114.96.103.33:43688] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aWz0V2CcXLNx7aML8kFEmAAAAcQ"]
[Mon Jan 19 02:08:16.179042 2026] [:error] [pid 33494:tid 33517] [client 43.153.73.200:55214] [client 43.153.73.200] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW0hkLxmLR_50TtKxDJauwAAARM"]
[Mon Jan 19 04:46:50.970838 2026] [:error] [pid 55093:tid 55148] [client 43.157.149.188:38768] [client 43.157.149.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aW1GulvejPZGx2OquyX7zgAAAFM"]
[Mon Jan 19 09:57:35.742971 2026] [:error] [pid 1541:tid 1574] [client 173.214.167.46:60728] [client 173.214.167.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aW2Pj0YFhTurKCJuQsZ6bgAAAEA"]
[Mon Jan 19 11:03:20.964743 2026] [:error] [pid 26513:tid 26538] [client 49.234.192.248:53276] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW2e-GtcP8UVP577s5jQ4wAAABQ"]
[Mon Jan 19 13:52:42.178785 2026] [:error] [pid 47089:tid 47105] [client 43.165.69.68:39398] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW3GqhlIzijVNfdIsZ5ZpAAAAQ4"]
[Mon Jan 19 17:18:12.941448 2026] [:error] [pid 45563:tid 45643] [client 216.118.251.70:50563] [client 216.118.251.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/apps/admin/view/default/images/logo.png"] [unique_id "aW321JI4--OKA-Pqumxp7QAAAJY"]
[Mon Jan 19 17:18:14.592746 2026] [:error] [pid 47089:tid 47110] [client 112.121.183.178:52454] [client 112.121.183.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Public/ckeditor/styles.js"] [unique_id "aW321hlIzijVNfdIsZ7DyQAAARM"]
[Mon Jan 19 17:27:17.967835 2026] [:error] [pid 45657:tid 45664] [client 112.121.183.178:49850] [client 112.121.183.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Public/ckeditor/styles.js"] [unique_id "aW349Q4XFYp2OcwCx-BYWAAAAMU"]
[Mon Jan 19 17:28:39.141544 2026] [:error] [pid 47089:tid 47093] [client 216.118.251.70:61500] [client 216.118.251.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/apps/admin/view/default/images/logo.png"] [unique_id "aW35RxlIzijVNfdIsZ7ICAAAAQI"]
[Mon Jan 19 17:57:32.331614 2026] [:error] [pid 36216:tid 36222] [client 103.163.208.106:53669] [client 103.163.208.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.php"] [unique_id "aW4ADMIpfKKs9fzB-yBYYAAAAUQ"]
[Mon Jan 19 18:22:05.883421 2026] [:error] [pid 45561:tid 45578] [client 103.70.76.30:61603] [client 103.70.76.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yseoa/login.php"] [unique_id "aW4Fza4ONSZn4nkTayJHxAAAAAw"]
[Mon Jan 19 21:25:42.848913 2026] [:error] [pid 36216:tid 36234] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/ver.php
[Mon Jan 19 21:25:43.039015 2026] [:error] [pid 36216:tid 36224] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/ultra.php
[Mon Jan 19 21:25:43.386224 2026] [:error] [pid 36216:tid 36219] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/pro.php
[Mon Jan 19 21:25:43.695434 2026] [:error] [pid 36216:tid 36233] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Mon Jan 19 21:25:43.889551 2026] [:error] [pid 36216:tid 36236] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Mon Jan 19 21:25:44.081739 2026] [:error] [pid 36216:tid 36221] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/data.php
[Mon Jan 19 21:25:44.272403 2026] [:error] [pid 36216:tid 36232] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Mon Jan 19 21:25:44.464631 2026] [:error] [pid 36216:tid 36229] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Mon Jan 19 21:25:44.658016 2026] [:error] [pid 36216:tid 36227] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Mon Jan 19 21:25:44.858216 2026] [:error] [pid 36216:tid 36242] [client 132.196.60.193:20558] File does not exist: /usr/local/apache/htdocs/suspended-page/image.php
[Mon Jan 19 21:25:45.045554 2026] [:error] [pid 36216:tid 36240] [client 132.196.60.193:20558] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aW4w2cIpfKKs9fzB-yCmpwAAAVY"]
[Mon Jan 19 21:25:45.705702 2026] [:error] [pid 45562:tid 45610] [client 132.196.60.193:20490] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aW4w2ToUil_kwpvtDW7jfgAAAFA"]
[Mon Jan 19 21:25:46.129777 2026] [:error] [pid 45563:tid 45631] [client 132.196.60.193:20570] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aW4w2pI4--OKA-PqumyzqQAAAIo"]
[Mon Jan 19 21:25:46.716615 2026] [:error] [pid 45561:tid 45571] [client 132.196.60.193:20501] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file22.php"] [unique_id "aW4w2q4ONSZn4nkTayJrQwAAAAU"]
[Mon Jan 19 21:25:47.253621 2026] [:error] [pid 45657:tid 45677] [client 132.196.60.193:20557] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/check.php"] [unique_id "aW4w2w4XFYp2OcwCx-CUwAAAANI"]
[Mon Jan 19 21:25:48.170654 2026] [:error] [pid 45561:tid 45577] [client 132.196.60.193:20553] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/check.php"] [unique_id "aW4w3K4ONSZn4nkTayJrRgAAAAs"]
[Mon Jan 19 21:25:48.843617 2026] [:error] [pid 45563:tid 45642] [client 132.196.60.193:20500] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/check.php"] [unique_id "aW4w3JI4--OKA-PqumyzrgAAAJU"]
[Mon Jan 19 21:25:49.882082 2026] [:error] [pid 45561:tid 45574] [client 132.196.60.193:20545] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/check.php"] [unique_id "aW4w3a4ONSZn4nkTayJrRwAAAAg"]
[Mon Jan 19 21:25:50.716256 2026] [:error] [pid 45561:tid 45582] [client 132.196.60.193:20607] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-header-json.php"] [unique_id "aW4w3q4ONSZn4nkTayJrSAAAABA"]
[Mon Jan 19 21:25:51.287707 2026] [:error] [pid 45561:tid 45579] [client 132.196.60.193:20571] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-header-json.php"] [unique_id "aW4w364ONSZn4nkTayJrSQAAAA0"]
[Mon Jan 19 21:25:52.007777 2026] [:error] [pid 45561:tid 45572] [client 132.196.60.193:20569] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-header-json.php"] [unique_id "aW4w4K4ONSZn4nkTayJrTQAAAAY"]
[Mon Jan 19 21:25:52.522459 2026] [:error] [pid 45561:tid 45584] [client 132.196.60.193:20556] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-header-json.php"] [unique_id "aW4w4K4ONSZn4nkTayJrTwAAABI"]
[Mon Jan 19 21:25:53.219837 2026] [:error] [pid 36216:tid 36232] [client 132.196.60.193:20603] [client 132.196.60.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aW4w4cIpfKKs9fzB-yCmqQAAAU4"]
[Mon Jan 19 21:25:54.089480 2026] [:error] [pid 36216:tid 36238] [client 132.196.60.193:20544] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aW4w4sIpfKKs9fzB-yCmrAAAAVQ"]
[Mon Jan 19 21:25:54.654534 2026] [:error] [pid 45563:tid 45634] [client 132.196.60.193:20506] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aW4w4pI4--OKA-PqumyzswAAAI0"]
[Mon Jan 19 21:25:55.127240 2026] [:error] [pid 45561:tid 45568] [client 132.196.60.193:20594] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aW4w464ONSZn4nkTayJrVwAAAAI"]
[Mon Jan 19 21:25:55.595624 2026] [:error] [pid 47089:tid 47112] [client 132.196.60.193:20495] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aW4w4xlIzijVNfdIsZ4BewAAARU"]
[Mon Jan 19 21:25:56.064671 2026] [:error] [pid 47089:tid 47093] [client 132.196.60.193:20511] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "aW4w5BlIzijVNfdIsZ4BfAAAAQI"]
[Mon Jan 19 21:25:56.691941 2026] [:error] [pid 45657:tid 45680] [client 132.196.60.193:20498] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "aW4w5A4XFYp2OcwCx-CUzAAAANU"]
[Mon Jan 19 21:25:57.206729 2026] [:error] [pid 47089:tid 47113] [client 132.196.60.193:20483] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "aW4w5RlIzijVNfdIsZ4BgAAAARY"]
[Mon Jan 19 21:25:57.627245 2026] [:error] [pid 47089:tid 47096] [client 132.196.60.193:20576] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "aW4w5RlIzijVNfdIsZ4BggAAAQU"]
[Mon Jan 19 21:25:58.124680 2026] [:error] [pid 45563:tid 45641] [client 132.196.60.193:20510] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aW4w5pI4--OKA-PqumyztgAAAJQ"]
[Mon Jan 19 21:25:58.671858 2026] [:error] [pid 36216:tid 36240] [client 132.196.60.193:20488] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aW4w5sIpfKKs9fzB-yCmsAAAAVY"]
[Mon Jan 19 21:25:59.348271 2026] [:error] [pid 36216:tid 36223] [client 132.196.60.193:7122] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aW4w58IpfKKs9fzB-yCmsQAAAUU"]
[Mon Jan 19 21:26:00.235721 2026] [:error] [pid 36216:tid 36218] [client 132.196.60.193:20606] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aW4w6MIpfKKs9fzB-yCmtQAAAUA"]
[Mon Jan 19 21:26:01.585636 2026] [:error] [pid 36216:tid 36242] [client 132.196.60.193:20563] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configs.php"] [unique_id "aW4w6cIpfKKs9fzB-yCmtwAAAVg"]
[Mon Jan 19 21:26:02.120761 2026] [:error] [pid 36216:tid 36226] [client 132.196.60.193:20547] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configs.php"] [unique_id "aW4w6sIpfKKs9fzB-yCmuQAAAUg"]
[Mon Jan 19 21:26:02.765902 2026] [:error] [pid 47089:tid 47099] [client 132.196.60.193:20559] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configs.php"] [unique_id "aW4w6hlIzijVNfdIsZ4BhwAAAQg"]
[Mon Jan 19 21:26:03.460103 2026] [:error] [pid 45657:tid 45675] [client 132.196.60.193:20480] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configs.php"] [unique_id "aW4w6w4XFYp2OcwCx-CUzQAAANA"]
[Mon Jan 19 21:26:04.049106 2026] [:error] [pid 45563:tid 45628] [client 132.196.60.193:7128] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aW4w7JI4--OKA-PqumyzuwAAAIc"]
[Mon Jan 19 21:26:04.677914 2026] [:error] [pid 45563:tid 45629] [client 132.196.60.193:20504] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aW4w7JI4--OKA-PqumyzvgAAAIg"]
[Mon Jan 19 21:26:05.402002 2026] [:error] [pid 45561:tid 45588] [client 132.196.60.193:20604] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aW4w7a4ONSZn4nkTayJrZgAAABY"]
[Mon Jan 19 21:26:05.945867 2026] [:error] [pid 45561:tid 45586] [client 132.196.60.193:20605] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aW4w7a4ONSZn4nkTayJraAAAABQ"]
[Mon Jan 19 21:26:06.811413 2026] [:error] [pid 45562:tid 45597] [client 132.196.60.193:7139] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file56.php"] [unique_id "aW4w7joUil_kwpvtDW7jkQAAAEM"]
[Mon Jan 19 21:26:09.623975 2026] [:error] [pid 45562:tid 45605] [client 132.196.60.193:20502] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file56.php"] [unique_id "aW4w8ToUil_kwpvtDW7jlAAAAEs"]
[Mon Jan 19 21:26:10.675158 2026] [:error] [pid 36216:tid 36240] [client 132.196.60.193:20582] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file56.php"] [unique_id "aW4w8sIpfKKs9fzB-yCmxAAAAVY"]
[Mon Jan 19 21:26:11.352650 2026] [:error] [pid 45563:tid 45635] [client 132.196.60.193:7138] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file56.php"] [unique_id "aW4w85I4--OKA-PqumyzxQAAAI4"]
[Mon Jan 19 21:26:12.024021 2026] [:error] [pid 45657:tid 45671] [client 132.196.60.193:20581] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aW4w9A4XFYp2OcwCx-CU0wAAAMw"]
[Mon Jan 19 21:26:12.663356 2026] [:error] [pid 45562:tid 45616] [client 132.196.60.193:20586] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aW4w9DoUil_kwpvtDW7jlgAAAFY"]
[Mon Jan 19 21:26:13.121433 2026] [:error] [pid 36216:tid 36231] [client 132.196.60.193:20508] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aW4w9cIpfKKs9fzB-yCmxwAAAU0"]
[Mon Jan 19 21:26:13.985995 2026] [:error] [pid 45561:tid 45590] [client 132.196.60.193:20580] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/990.php"] [unique_id "aW4w9a4ONSZn4nkTayJrbgAAABg"]
[Mon Jan 19 21:26:14.825625 2026] [:error] [pid 47089:tid 47109] [client 132.196.60.193:20572] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aW4w9hlIzijVNfdIsZ4BkAAAARI"]
[Mon Jan 19 21:26:16.029686 2026] [:error] [pid 45563:tid 45623] [client 132.196.60.193:20583] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aW4w-JI4--OKA-PqumyzygAAAII"]
[Mon Jan 19 21:26:16.585678 2026] [:error] [pid 45561:tid 45571] [client 132.196.60.193:20579] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aW4w-K4ONSZn4nkTayJrbwAAAAU"]
[Mon Jan 19 21:26:17.380647 2026] [:error] [pid 36216:tid 36229] [client 132.196.60.193:7135] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error.php"] [unique_id "aW4w-cIpfKKs9fzB-yCmzQAAAUs"]
[Mon Jan 19 21:26:18.811228 2026] [:error] [pid 47089:tid 47108] [client 132.196.60.193:20484] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aW4w-hlIzijVNfdIsZ4BlwAAARE"]
[Mon Jan 19 21:26:20.658149 2026] [:error] [pid 45562:tid 45597] [client 132.196.60.193:20600] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aW4w_DoUil_kwpvtDW7jmgAAAEM"]
[Mon Jan 19 21:26:21.729642 2026] [:error] [pid 45657:tid 45662] [client 132.196.60.193:20505] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aW4w_Q4XFYp2OcwCx-CU3AAAAMM"]
[Mon Jan 19 21:26:22.446320 2026] [:error] [pid 45562:tid 45601] [client 132.196.60.193:20564] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aW4w_joUil_kwpvtDW7jngAAAEc"]
[Mon Jan 19 21:26:23.192786 2026] [:error] [pid 45562:tid 45605] [client 132.196.60.193:20597] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aW4w_zoUil_kwpvtDW7joAAAAEs"]
[Mon Jan 19 21:26:23.663693 2026] [:error] [pid 45561:tid 45584] [client 132.196.60.193:20561] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aW4w_64ONSZn4nkTayJrdwAAABI"]
[Mon Jan 19 21:26:24.510190 2026] [:error] [pid 45657:tid 45660] [client 132.196.60.193:7152] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aW4xAA4XFYp2OcwCx-CU3gAAAME"]
[Mon Jan 19 21:26:25.340844 2026] [:error] [pid 45657:tid 45682] [client 132.196.60.193:20562] [client 132.196.60.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aW4xAQ4XFYp2OcwCx-CU3wAAANc"]
[Mon Jan 19 21:39:19.246698 2026] [:error] [pid 45657:tid 45661] [client 43.157.179.227:55802] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aW40Bw4XFYp2OcwCx-CX-wAAAMI"]
[Mon Jan 19 23:24:20.391623 2026] [:error] [pid 45657:tid 45663] [client 49.7.227.204:50378] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW5MpA4XFYp2OcwCx-CwPgAAAMQ"]
[Tue Jan 20 00:09:34.488399 2026] [:error] [pid 36216:tid 36224] [client 104.28.246.115:25152] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aW5XPsIpfKKs9fzB-yDe1AAAAUY"]
[Tue Jan 20 00:09:41.949021 2026] [:error] [pid 45561:tid 45588] [client 104.28.246.115:44144] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/style.php"] [unique_id "aW5XRa4ONSZn4nkTayKW1QAAABY"]
[Tue Jan 20 03:16:26.983718 2026] [:error] [pid 45561:tid 45587] [client 170.106.187.106:57550] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aW6DCq4ONSZn4nkTayLR_wAAABU"]
[Tue Jan 20 06:48:35.501369 2026] [:error] [pid 17622:tid 17691] [client 43.166.250.187:39320] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW60wy4cbbp8XKl0Ahl12AAAAIY"]
[Tue Jan 20 11:20:50.321698 2026] [:error] [pid 54382:tid 54408] [client 1.15.52.154:47936] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW70kkTJlZ9SJ6sBOEtL4wAAABc"]
[Tue Jan 20 12:41:24.671836 2026] [:error] [pid 54382:tid 54386] [client 43.130.67.33:43954] [client 43.130.67.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW8HdETJlZ9SJ6sBOEteNgAAAAE"]
[Tue Jan 20 15:08:25.487570 2026] [:error] [pid 56326:tid 56345] [client 43.153.36.110:60220] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aW8p6RA6mi8Uwf45Uy_nzwAAANE"]
[Tue Jan 20 15:17:44.207975 2026] [:error] [pid 56360:tid 56369] [client 64.225.8.2:57408] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.vscode/sftp-config.json"] [unique_id "aW8sGE1J8CD1rR-wXXsaRgAAAQc"]
[Tue Jan 20 15:17:50.507673 2026] [:error] [pid 8416:tid 8425] [client 64.225.8.2:63691] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "aW8sHjN6cbQyA2ecQV2oQgAAAwc"]
[Tue Jan 20 23:51:05.351588 2026] [:error] [pid 54259:tid 54290] [client 64.225.8.2:58660] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp-config.json"] [unique_id "aW-kaQ2q1USrePnOoFQUFQAAAI0"]
[Tue Jan 20 23:51:08.422437 2026] [:error] [pid 17340:tid 17376] [client 64.225.8.2:54749] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ftp.json"] [unique_id "aW-kbPAsOSYVgw_35t3E1QAAAlQ"]
[Tue Jan 20 23:51:10.837759 2026] [:error] [pid 54260:tid 54315] [client 64.225.8.2:50147] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ftp.json"] [unique_id "aW-kbtg7jS3jmpUN0WA3uQAAAUc"]
[Tue Jan 20 23:51:12.880550 2026] [:error] [pid 17340:tid 17359] [client 64.225.8.2:61255] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ftp-config.json"] [unique_id "aW-kcPAsOSYVgw_35t3E2QAAAkM"]
[Tue Jan 20 23:51:14.762633 2026] [:error] [pid 17295:tid 17322] [client 64.225.8.2:59095] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ftp-config.json"] [unique_id "aW-kcvZJhGdrcqZICT-t3QAAAZg"]
[Tue Jan 20 23:51:16.694939 2026] [:error] [pid 56360:tid 56365] [client 64.225.8.2:55401] [client 64.225.8.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ftp-config.json"] [unique_id "aW-kdE1J8CD1rR-wXXt5rwAAAQM"]
[Tue Jan 20 23:51:18.952594 2026] [:error] [pid 54382:tid 54394] [client 64.225.8.2:54247] [client 64.225.8.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/sftp-config.json"] [unique_id "aW-kdkTJlZ9SJ6sBOEvaagAAAAk"]
[Wed Jan 21 00:00:55.834387 2026] [:error] [pid 56326:tid 56345] [client 182.42.111.156:52234] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW-mtxA6mi8Uwf45Uy9W9gAAANE"]
[Wed Jan 21 00:05:13.952694 2026] [:error] [pid 17340:tid 17377] [client 170.106.15.3:50642] [client 170.106.15.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aW-nufAsOSYVgw_35t3IcwAAAlU"]
[Wed Jan 21 02:33:48.689818 2026] [:error] [pid 17295:tid 17315] [client 170.106.107.87:50392] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aW_KjPZJhGdrcqZICT_diQAAAZE"]
[Wed Jan 21 04:11:26.906978 2026] [:error] [pid 21454:tid 21464] [client 104.28.246.112:46197] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aW_hbjwp5UZmMFzY2bpIXAAAAAA"]
[Wed Jan 21 12:12:20.617839 2026] [:error] [pid 59863:tid 59873] [client 43.156.228.27:45880] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXBSJLHQ1zVZ4yLuI-xdSgAAAQY"]
[Wed Jan 21 20:40:54.222139 2026] [:error] [pid 21454:tid 21472] [client 43.130.31.17:34538] [client 43.130.31.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXDJVjwp5UZmMFzY2bpFJwAAAAg"]
[Thu Jan 22 00:56:18.666784 2026] [:error] [pid 56352:tid 56354] [client 119.96.24.54:34614] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXEFMtWN6wYNPTU3efU_iwAAAUA"]
[Thu Jan 22 08:52:09.932837 2026] [:error] [pid 27550:tid 27569] [client 100.24.208.151:53828] [client 100.24.208.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||rejuva.au|F|4"] [data "Web Downloader"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXF0ueOQDPzfV5R2LYRubAAAARE"]
[Thu Jan 22 10:39:27.454424 2026] [:error] [pid 52446:tid 52497] [client 136.144.19.89:32035] [client 136.144.19.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.89, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aXGN37J6clMw4kdrHYGQUAAAAE8"]
[Thu Jan 22 10:39:27.459080 2026] [:error] [pid 52446:tid 52497] [client 136.144.19.89:32035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Jan 22 12:49:31.105282 2026] [:error] [pid 27550:tid 27560] [client 43.130.141.193:53310] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXGsW-OQDPzfV5R2LYS8DwAAAQg"]
[Thu Jan 22 12:49:53.704734 2026] [:error] [pid 52445:tid 52471] [client 60.188.57.0:34915] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXGscevMmsFgpSSb5L3vjwAAABE"]
[Thu Jan 22 22:29:03.684847 2026] [:error] [pid 52447:tid 52525] [client 95.216.63.67:56858] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php, referer: www.google.com
[Fri Jan 23 01:26:33.726098 2026] [:error] [pid 52445:tid 52462] [client 60.188.57.0:37425] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXJdyevMmsFgpSSb5L27NQAAAAg"]
[Fri Jan 23 13:51:07.666487 2026] [:error] [pid 11607:tid 11669] [client 170.106.181.163:40772] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXMMSwucTAUsUUzKw5e9PQAAAFg"]
[Fri Jan 23 16:58:42.914165 2026] [:error] [pid 64230:tid 64253] [client 170.205.31.138:61901] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: http://www.google.com
[Fri Jan 23 19:37:54.087617 2026] [:error] [pid 1517:tid 1525] [client 162.62.132.25:47648] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXNdkiZNw8-8ydKHCJtsZAAAAcU"]
[Fri Jan 23 19:44:09.356973 2026] [:error] [pid 64230:tid 64241] [client 43.138.68.113:57180] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXNfCa2JXmVjD91caKK2ygAAAUg"]
[Sat Jan 24 03:46:03.033909 2026] [:error] [pid 41009:tid 41028] [client 102.152.213.184:31679] [client 102.152.213.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 102.152.213.184, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aXPP-2rewfoFUDD3TM0-GQAAANE"]
[Sat Jan 24 03:46:03.037827 2026] [:error] [pid 41009:tid 41028] [client 102.152.213.184:31679] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Jan 24 05:12:09.126114 2026] [:error] [pid 40905:tid 40978] [client 104.28.235.57:10361] [client 104.28.235.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aXPkKV3rUAneNkh7mXDvXAAAAIw"]
[Sat Jan 24 05:12:10.651249 2026] [:error] [pid 22900:tid 22903] [client 104.28.235.57:34149] [client 104.28.235.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/style.php"] [unique_id "aXPkKlr6h1PpdlYV7gUT-wAAAQA"]
[Sat Jan 24 05:12:11.044710 2026] [:error] [pid 40902:tid 40922] [client 104.28.235.57:35257] [client 104.28.235.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/themes/style.php"] [unique_id "aXPkKwSCceZpurDgOev_vwAAAAo"]
[Sat Jan 24 05:12:11.440540 2026] [:error] [pid 40905:tid 40985] [client 104.28.203.60:16057] [client 104.28.203.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/style.php"] [unique_id "aXPkK13rUAneNkh7mXDvYgAAAJM"]
[Sat Jan 24 05:12:11.835123 2026] [:error] [pid 22900:tid 22904] [client 104.28.235.57:50053] [client 104.28.235.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style.php"] [unique_id "aXPkK1r6h1PpdlYV7gUT_gAAAQE"]
[Sat Jan 24 08:13:48.637720 2026] [:error] [pid 22900:tid 22903] [client 49.234.192.248:43940] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXQOvFr6h1PpdlYV7gVTgAAAAQA"]
[Sat Jan 24 08:41:36.368807 2026] [:error] [pid 40902:tid 40936] [client 170.205.31.138:53316] [client 170.205.31.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-confiq.php"] [unique_id "aXQVQASCceZpurDgOes1zAAAABg"]
[Sat Jan 24 20:49:07.499820 2026] [:error] [pid 14976:tid 14987] [client 14.215.163.132:54675] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXS_w2vdigydYOB2KS9suQAAAYk"]
[Sun Jan 25 03:19:02.669180 2026] [:error] [pid 45747:tid 45752] [client 120.71.59.24:37175] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXUbJkisFA8eZRPU2N6AAAAAAMM"]
[Sun Jan 25 05:07:00.169980 2026] [:error] [pid 53419:tid 53431] [client 43.166.1.243:48174] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXU0dCNxBUypy_ALgwM4gQAAAAM"]
[Sun Jan 25 06:59:02.032725 2026] [:error] [pid 53421:tid 53485] [client 3.127.203.41:47438] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sun Jan 25 09:39:15.286897 2026] [:error] [pid 33687:tid 33695] [client 170.106.15.3:54984] [client 170.106.15.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXV0Q4c6VUyZP5DZSy4CnAAAAQU"]
[Sun Jan 25 19:09:54.456912 2026] [:error] [pid 9070:tid 9083] [client 54.91.15.207:50124] [client 54.91.15.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||rejuva.au|F|4"] [data "Microsoft URL"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXX6ArLNl7Vxe1mYetFbUQAAAUs"]
[Sun Jan 25 19:31:51.818145 2026] [:error] [pid 53420:tid 53475] [client 43.173.1.57:55464] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXX_J45y-t2ZKNqnnbUtRgAAAFM"]
[Sun Jan 25 22:00:40.413872 2026] [:error] [pid 53521:tid 53557] [client 14.215.163.132:49708] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXYiCEAzLL1HphkAdX5iGwAAANg"]
[Mon Jan 26 00:52:58.610096 2026] [:error] [pid 48920:tid 48999] [client 20.121.152.214:24072] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 00:52:58.976377 2026] [:error] [pid 48920:tid 48991] [client 20.121.152.214:24072] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 00:52:59.434325 2026] [:error] [pid 48920:tid 49003] [client 20.121.152.214:24072] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 00:52:59.811980 2026] [:error] [pid 48920:tid 49001] [client 20.121.152.214:24072] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 01:04:40.448777 2026] [:error] [pid 49084:tid 49090] [client 4.147.25.85:16465] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 01:04:40.581328 2026] [:error] [pid 49084:tid 49106] [client 4.147.25.85:16465] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 01:04:40.742240 2026] [:error] [pid 49084:tid 49099] [client 4.147.25.85:16465] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 01:04:40.828979 2026] [:error] [pid 49084:tid 49110] [client 4.147.25.85:16465] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Mon Jan 26 01:22:39.858852 2026] [:error] [pid 6612:tid 6623] [client 167.172.158.128:49620] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/api-docs"] [unique_id "aXZRXw7OocbZdUpuWVs0OgAAAAk"]
[Mon Jan 26 01:22:40.143589 2026] [:error] [pid 6612:tid 6618] [client 157.245.105.107:60084] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/api-docs"] [unique_id "aXZRYA7OocbZdUpuWVs0PAAAAAQ"]
[Mon Jan 26 01:22:40.904986 2026] [:error] [pid 6612:tid 6635] [client 167.172.158.128:49626] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v3/api-docs"] [unique_id "aXZRYA7OocbZdUpuWVs0PgAAABU"]
[Mon Jan 26 01:22:41.217645 2026] [:error] [pid 48920:tid 48991] [client 157.245.105.107:60090] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v3/api-docs"] [unique_id "aXZRYZsnZS3G6U7VdJMXeQAAAQc"]
[Mon Jan 26 01:22:41.856146 2026] [:error] [pid 6738:tid 6778] [client 167.172.158.128:44824] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aXZRYWxKUXbdUVtnLFZqOgAAAFA"]
[Mon Jan 26 01:22:42.166055 2026] [:error] [pid 48919:tid 48972] [client 157.245.105.107:60102] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api-docs/swagger.json"] [unique_id "aXZRYjVs1aLFg9jpyYq1OgAAANE"]
[Mon Jan 26 01:22:42.848340 2026] [:error] [pid 48919:tid 48978] [client 167.172.158.128:44832] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/api/swagger.json"] [unique_id "aXZRYjVs1aLFg9jpyYq1PAAAANY"]
[Mon Jan 26 01:22:43.130476 2026] [:error] [pid 6612:tid 6634] [client 157.245.105.107:53528] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/swagger.json"] [unique_id "aXZRYw7OocbZdUpuWVs0QQAAABQ"]
[Mon Jan 26 01:22:43.868247 2026] [:error] [pid 49084:tid 49109] [client 167.172.158.128:44846] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/@vite/env"] [unique_id "aXZRY5HUOXll3XccoO4hkQAAAVc"]
[Mon Jan 26 01:22:44.140132 2026] [:error] [pid 48920:tid 49008] [client 157.245.105.107:53542] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/@vite/env"] [unique_id "aXZRZJsnZS3G6U7VdJMXggAAARg"]
[Mon Jan 26 01:22:44.862764 2026] [:error] [pid 13569:tid 13636] [client 167.172.158.128:44856] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/actuator/env"] [unique_id "aXZRZPjY_vt91DmOz5XCygAAAZg"]
[Mon Jan 26 01:22:45.175234 2026] [:error] [pid 49084:tid 49100] [client 157.245.105.107:53544] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/actuator/env"] [unique_id "aXZRZZHUOXll3XccoO4hlQAAAU4"]
[Mon Jan 26 01:22:45.850315 2026] [:error] [pid 48918:tid 48941] [client 167.172.158.128:44864] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server"] [unique_id "aXZRZbFdNV6RkULOt6ErhwAAAI0"]
[Mon Jan 26 01:22:46.122588 2026] [:error] [pid 13569:tid 13627] [client 157.245.105.107:53548] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server"] [unique_id "aXZRZvjY_vt91DmOz5XCzAAAAY8"]
[Mon Jan 26 01:22:46.862270 2026] [:error] [pid 48920:tid 48988] [client 167.172.158.128:44866] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aXZRZpsnZS3G6U7VdJMXhwAAAQQ"]
[Mon Jan 26 01:22:47.162846 2026] [:error] [pid 49084:tid 49096] [client 157.245.105.107:53550] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aXZRZ5HUOXll3XccoO4hlgAAAUo"]
[Mon Jan 26 01:22:48.863093 2026] [:error] [pid 6612:tid 6633] [client 167.172.158.128:44872] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about"] [unique_id "aXZRaA7OocbZdUpuWVs0SAAAABM"]
[Mon Jan 26 01:22:49.136484 2026] [:error] [pid 13569:tid 13623] [client 157.245.105.107:53560] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about"] [unique_id "aXZRafjY_vt91DmOz5XC0AAAAYs"]
[Mon Jan 26 01:22:49.864343 2026] [:error] [pid 48918:tid 48948] [client 167.172.158.128:44874] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/debug/default/view"] [unique_id "aXZRabFdNV6RkULOt6EriwAAAJQ"]
[Mon Jan 26 01:22:50.143848 2026] [:error] [pid 49084:tid 49105] [client 157.245.105.107:53574] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug/default/view"] [unique_id "aXZRapHUOXll3XccoO4hmgAAAVM"]
[Mon Jan 26 01:22:50.860611 2026] [:error] [pid 48919:tid 48971] [client 167.172.158.128:44882] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/v2/_catalog"] [unique_id "aXZRajVs1aLFg9jpyYq1QwAAANA"]
[Mon Jan 26 01:22:51.148149 2026] [:error] [pid 49084:tid 49109] [client 157.245.105.107:53590] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/_catalog"] [unique_id "aXZRa5HUOXll3XccoO4hnwAAAVc"]
[Mon Jan 26 01:22:51.865638 2026] [:error] [pid 13569:tid 13613] [client 167.172.158.128:47574] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aXZRa_jY_vt91DmOz5XC2wAAAYE"]
[Mon Jan 26 01:22:52.140948 2026] [:error] [pid 48919:tid 48958] [client 157.245.105.107:53596] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aXZRbDVs1aLFg9jpyYq1RAAAAMM"]
[Mon Jan 26 01:22:52.867934 2026] [:error] [pid 6612:tid 6627] [client 167.172.158.128:47576] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status"] [unique_id "aXZRbA7OocbZdUpuWVs0TQAAAA0"]
[Mon Jan 26 01:22:53.202170 2026] [:error] [pid 13569:tid 13634] [client 157.245.105.107:54698] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-status"] [unique_id "aXZRbfjY_vt91DmOz5XC4AAAAZY"]
[Mon Jan 26 01:22:53.865822 2026] [:error] [pid 13569:tid 13624] [client 167.172.158.128:47586] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login.action"] [unique_id "aXZRbfjY_vt91DmOz5XC5AAAAYw"]
[Mon Jan 26 01:22:54.144102 2026] [:error] [pid 13569:tid 13623] [client 157.245.105.107:54714] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login.action"] [unique_id "aXZRbvjY_vt91DmOz5XC5gAAAYs"]
[Mon Jan 26 01:22:54.866952 2026] [:error] [pid 48920:tid 48997] [client 167.172.158.128:47596] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_all_dbs"] [unique_id "aXZRbpsnZS3G6U7VdJMXlAAAAQ0"]
[Mon Jan 26 01:22:55.144375 2026] [:error] [pid 13569:tid 13613] [client 157.245.105.107:54722] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_all_dbs"] [unique_id "aXZRb_jY_vt91DmOz5XC6gAAAYE"]
[Mon Jan 26 01:22:55.867791 2026] [:error] [pid 49084:tid 49089] [client 167.172.158.128:47612] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "aXZRb5HUOXll3XccoO4hpgAAAUM"]
[Mon Jan 26 01:22:56.145000 2026] [:error] [pid 48918:tid 48937] [client 157.245.105.107:54724] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.DS_Store"] [unique_id "aXZRcLFdNV6RkULOt6ErjwAAAIk"]
[Mon Jan 26 01:22:56.867638 2026] [:error] [pid 13569:tid 13621] [client 167.172.158.128:47622] [client 167.172.158.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aXZRcPjY_vt91DmOz5XC6wAAAYk"]
[Mon Jan 26 01:22:57.203108 2026] [:error] [pid 13569:tid 13633] [client 157.245.105.107:54728] [client 157.245.105.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aXZRcfjY_vt91DmOz5XC7QAAAZU"]
[Mon Jan 26 01:22:58.855623 2026] [:error] [pid 13569:tid 13620] [client 167.172.158.128:47636] [client 167.172.158.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aXZRcvjY_vt91DmOz5XC8AAAAYg"]
[Mon Jan 26 01:22:59.186830 2026] [:error] [pid 13569:tid 13626] [client 157.245.105.107:54740] [client 157.245.105.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aXZRc_jY_vt91DmOz5XC8gAAAY4"]
[Mon Jan 26 01:22:59.866077 2026] [:error] [pid 49084:tid 49106] [client 167.172.158.128:47644] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aXZRc5HUOXll3XccoO4hqwAAAVQ"]
[Mon Jan 26 01:23:00.143275 2026] [:error] [pid 49084:tid 49109] [client 157.245.105.107:54752] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aXZRdJHUOXll3XccoO4hrAAAAVc"]
[Mon Jan 26 01:23:00.857822 2026] [:error] [pid 6738:tid 6781] [client 167.172.158.128:47650] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/config.json"] [unique_id "aXZRdGxKUXbdUVtnLFZqWwAAAFM"]
[Mon Jan 26 01:23:01.252814 2026] [:error] [pid 49084:tid 49095] [client 157.245.105.107:54766] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.json"] [unique_id "aXZRdZHUOXll3XccoO4hrwAAAUk"]
[Mon Jan 26 01:23:01.873181 2026] [:error] [pid 49084:tid 49098] [client 167.172.158.128:35858] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/telescope/requests"] [unique_id "aXZRdZHUOXll3XccoO4hsAAAAUw"]
[Mon Jan 26 01:23:02.169806 2026] [:error] [pid 49084:tid 49100] [client 157.245.105.107:54770] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/telescope/requests"] [unique_id "aXZRdpHUOXll3XccoO4hswAAAU4"]
[Mon Jan 26 01:23:02.872125 2026] [:error] [pid 6738:tid 6766] [client 167.172.158.128:35872] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aXZRdmxKUXbdUVtnLFZqXAAAAEQ"]
[Mon Jan 26 01:23:03.161966 2026] [:error] [pid 6738:tid 6768] [client 157.245.105.107:46944] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aXZRd2xKUXbdUVtnLFZqXQAAAEY"]
[Mon Jan 26 01:23:03.359758 2026] [:error] [pid 49084:tid 49095] [client 157.245.105.107:54766] [client 157.245.105.107] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "172.98.32.187_82aa6a482bd276cff149740478a603a5fe834840"): Internal error (specific information not available) [hostname "rejuva.au"] [uri "/config.json"] [unique_id "aXZRdZHUOXll3XccoO4hrwAAAUk"]
[Mon Jan 26 01:23:03.867908 2026] [:error] [pid 48920:tid 48991] [client 167.172.158.128:35878] [client 167.172.158.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXZRd5snZS3G6U7VdJMXmgAAAQc"]
[Mon Jan 26 01:23:04.185126 2026] [:error] [pid 48918:tid 48944] [client 157.245.105.107:46960] [client 157.245.105.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXZReLFdNV6RkULOt6ErkgAAAJA"]
[Mon Jan 26 04:15:35.589998 2026] [:error] [pid 24557:tid 24618] [client 182.44.8.254:42609] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXZ55-rlG7Vm9pxV14xCBQAAAFg"]
[Mon Jan 26 11:53:21.624877 2026] [:error] [pid 24557:tid 24607] [client 134.122.65.2:54527] [client 134.122.65.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.65.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aXblMerlG7Vm9pxV14yllQAAAE0"]
[Mon Jan 26 11:53:21.628423 2026] [:error] [pid 24557:tid 24607] [client 134.122.65.2:54527] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Jan 26 22:50:29.233684 2026] [:error] [pid 61287:tid 61321] [client 43.130.37.243:44264] [client 43.130.37.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXd_NdimZOwAM64CfR5vYwAAAYQ"]
[Mon Jan 26 23:14:17.089745 2026] [:error] [pid 24666:tid 24672] [client 45.133.5.69:30783] [client 45.133.5.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.69, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aXeEyZmH-L0_jbK3i9HroQAAAMQ"]
[Mon Jan 26 23:14:17.094684 2026] [:error] [pid 24666:tid 24672] [client 45.133.5.69:30783] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Jan 27 01:16:48.226611 2026] [:error] [pid 44586:tid 44768] [client 43.130.174.37:46374] [client 43.130.174.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXehgKZDnq-dPBqM5LiecAAAAIQ"]
[Tue Jan 27 04:53:22.593869 2026] [:error] [pid 41780:tid 41793] [client 170.106.82.209:44288] [client 170.106.82.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXfUQlvu-XLQ0TaZ4FFXgQAAAQs"]
[Tue Jan 27 11:42:03.311753 2026] [:error] [pid 48446:tid 48493] [client 64.225.49.30:60150] [client 64.225.49.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aXg0C8DRSaZ8F8aaLxkznAAAAc8"], referer: binance.com
[Tue Jan 27 17:48:51.400678 2026] [:error] [pid 7453:tid 7500] [client 43.166.244.192:53474] [client 43.166.244.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXiKAxfsyA2ws_ADquiCRQAAAEs"]
[Tue Jan 27 20:24:20.473483 2026] [:error] [pid 7454:tid 7528] [client 43.131.32.36:51216] [client 43.131.32.36] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXiudJltCoZEfMmfl8AdkgAAAIw"]
[Tue Jan 27 23:56:05.507294 2026] [:error] [pid 48446:tid 48498] [client 36.111.67.189:46543] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXjgFcDRSaZ8F8aaLxm8lgAAAdQ"]
[Wed Jan 28 04:29:36.220286 2026] [:error] [pid 17424:tid 17445] [client 93.123.109.175:36996] [client 93.123.109.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aXkgMGRvtDRvGDe-pIsmqgAAAAw"]
[Wed Jan 28 05:10:48.129480 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.45:43249] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Jan 28 05:10:49.063197 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.45:43249] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Jan 28 05:10:49.533808 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.45:43249] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aXkp2VuAAQZ5AN_SnDbkTgAAAVY"]
[Wed Jan 28 05:10:50.474618 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.38:52807] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Jan 28 05:10:50.934685 2026] [:error] [pid 17424:tid 17452] [client 45.154.138.38:52807] [client 45.154.138.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aXkp2mRvtDRvGDe-pIszJwAAABM"]
[Wed Jan 28 05:10:51.878986 2026] [:error] [pid 17426:tid 17507] [client 45.154.138.8:46791] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Jan 28 05:10:52.811860 2026] [:error] [pid 17426:tid 17497] [client 45.154.138.8:46791] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Jan 28 05:10:53.274779 2026] [:error] [pid 17426:tid 17506] [client 45.154.138.8:46791] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Jan 28 05:10:53.742125 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.8:46791] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Jan 28 05:10:54.674733 2026] [:error] [pid 17426:tid 17492] [client 45.154.138.8:46791] [client 45.154.138.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aXkp3k8zvf_03BnziRfptgAAAIM"]
[Wed Jan 28 05:10:55.598145 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.17:35363] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Jan 28 05:10:56.066580 2026] [:error] [pid 58254:tid 58268] [client 45.154.138.17:35363] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Jan 28 05:10:56.535722 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.17:35363] [client 45.154.138.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aXkp4PF8nSyBg9wOsa_54AAAARU"]
[Wed Jan 28 05:10:57.458611 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.30:48475] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aXkp4U8zvf_03BnziRfpzwAAAIE"]
[Wed Jan 28 05:10:58.391424 2026] [:error] [pid 64842:tid 64844] [client 45.154.138.32:25011] [client 45.154.138.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aXkp4luAAQZ5AN_SnDbkpwAAAUA"]
[Wed Jan 28 05:10:59.792206 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.9:46491] [client 45.154.138.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aXkp463QiSMgVscnN5IBnwAAAMc"]
[Wed Jan 28 05:11:01.211858 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.23:36081] [client 45.154.138.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aXkp5fF8nSyBg9wOsa_6EwAAAQA"]
[Wed Jan 28 05:11:03.083431 2026] [:error] [pid 17425:tid 17469] [client 45.154.138.20:26763] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Jan 28 05:11:04.492263 2026] [:error] [pid 17425:tid 17482] [client 45.154.138.20:26763] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Jan 28 05:11:04.955727 2026] [:error] [pid 17425:tid 17473] [client 45.154.138.20:26763] [client 45.154.138.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aXkp6KrcODKH1Dl7aZAQ-AAAAEs"]
[Wed Jan 28 05:11:05.877934 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.19:24547] [client 45.154.138.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aXkp6arcODKH1Dl7aZARAAAAAFA"]
[Wed Jan 28 05:11:07.269515 2026] [:error] [pid 17425:tid 17472] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Wed Jan 28 05:11:07.732943 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Wed Jan 28 05:11:08.197984 2026] [:error] [pid 17425:tid 17465] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Jan 28 05:11:08.668112 2026] [:error] [pid 17425:tid 17482] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Jan 28 05:11:09.155498 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Wed Jan 28 05:11:09.621133 2026] [:error] [pid 17425:tid 17465] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Wed Jan 28 05:11:10.095872 2026] [:error] [pid 17425:tid 17481] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Wed Jan 28 05:11:10.557862 2026] [:error] [pid 17425:tid 17466] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Jan 28 05:11:11.023677 2026] [:error] [pid 17425:tid 17471] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Wed Jan 28 05:11:11.493078 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Jan 28 05:11:11.975935 2026] [:error] [pid 17425:tid 17487] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Wed Jan 28 05:11:12.442245 2026] [:error] [pid 17425:tid 17468] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Jan 28 05:11:12.911854 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Jan 28 05:11:13.382096 2026] [:error] [pid 17425:tid 17483] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Wed Jan 28 05:11:13.853181 2026] [:error] [pid 17425:tid 17465] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Wed Jan 28 05:11:14.320123 2026] [:error] [pid 17425:tid 17471] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Jan 28 05:11:14.795909 2026] [:error] [pid 17425:tid 17481] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Wed Jan 28 05:11:15.265025 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed Jan 28 05:11:15.731185 2026] [:error] [pid 17425:tid 17469] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Wed Jan 28 05:11:16.193466 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Jan 28 05:11:16.656105 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Wed Jan 28 05:11:17.120997 2026] [:error] [pid 17425:tid 17486] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Jan 28 05:11:17.586839 2026] [:error] [pid 17425:tid 17462] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Jan 28 05:11:18.053270 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Jan 28 05:11:18.522027 2026] [:error] [pid 17425:tid 17485] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Jan 28 05:11:18.992375 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Wed Jan 28 05:11:19.466745 2026] [:error] [pid 17425:tid 17486] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Jan 28 05:11:19.937721 2026] [:error] [pid 17425:tid 17467] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Wed Jan 28 05:11:20.404261 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Wed Jan 28 05:11:20.867173 2026] [:error] [pid 17425:tid 17486] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Wed Jan 28 05:11:21.332139 2026] [:error] [pid 17425:tid 17487] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Wed Jan 28 05:11:21.793788 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Wed Jan 28 05:11:22.261403 2026] [:error] [pid 17425:tid 17473] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Jan 28 05:11:22.726665 2026] [:error] [pid 17425:tid 17479] [client 45.154.138.29:60885] [client 45.154.138.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.29, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aXkp-qrcODKH1Dl7aZARxQAAAFE"]
[Wed Jan 28 05:11:22.730224 2026] [:error] [pid 17425:tid 17479] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Jan 28 05:11:23.660907 2026] [:error] [pid 17425:tid 17479] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Wed Jan 28 05:11:24.131140 2026] [:error] [pid 17425:tid 17473] [client 45.154.138.29:60885] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Jan 28 05:11:24.592269 2026] [:error] [pid 17425:tid 17467] [client 45.154.138.29:60885] [client 45.154.138.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aXkp_KrcODKH1Dl7aZAR4QAAAEU"]
[Wed Jan 28 05:11:25.515613 2026] [:error] [pid 17426:tid 17501] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Wed Jan 28 05:11:25.996433 2026] [:error] [pid 17426:tid 17504] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Jan 28 05:11:26.929151 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Wed Jan 28 05:11:27.401831 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Wed Jan 28 05:11:27.870702 2026] [:error] [pid 17426:tid 17513] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Wed Jan 28 05:11:28.340623 2026] [:error] [pid 17426:tid 17509] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Wed Jan 28 05:11:28.804096 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Wed Jan 28 05:11:29.271522 2026] [:error] [pid 17426:tid 17510] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Wed Jan 28 05:11:29.738752 2026] [:error] [pid 17426:tid 17508] [client 45.154.138.19:41771] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Wed Jan 28 05:11:30.663184 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.19:41771] [client 45.154.138.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aXkqAk8zvf_03BnziRfq6QAAAIA"]
[Wed Jan 28 05:11:31.626074 2026] [:error] [pid 17426:tid 17491] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Wed Jan 28 05:11:32.090258 2026] [:error] [pid 17426:tid 17505] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Wed Jan 28 05:11:35.839950 2026] [:error] [pid 17426:tid 17510] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Jan 28 05:11:36.329765 2026] [:error] [pid 17426:tid 17508] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Wed Jan 28 05:11:36.820244 2026] [:error] [pid 17426:tid 17506] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Wed Jan 28 05:11:37.342003 2026] [:error] [pid 17426:tid 17496] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Wed Jan 28 05:11:37.806430 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Wed Jan 28 05:11:39.247186 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Wed Jan 28 05:11:39.715115 2026] [:error] [pid 17426:tid 17491] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Wed Jan 28 05:11:40.178437 2026] [:error] [pid 17426:tid 17511] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Wed Jan 28 05:11:40.643197 2026] [:error] [pid 17426:tid 17500] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Wed Jan 28 05:11:41.112316 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Wed Jan 28 05:11:41.576292 2026] [:error] [pid 17426:tid 17491] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Wed Jan 28 05:11:42.040872 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Wed Jan 28 05:11:42.983161 2026] [:error] [pid 17426:tid 17500] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Wed Jan 28 05:11:43.448522 2026] [:error] [pid 17426:tid 17510] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Wed Jan 28 05:11:44.377791 2026] [:error] [pid 17426:tid 17499] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Wed Jan 28 05:11:44.852079 2026] [:error] [pid 17426:tid 17498] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Wed Jan 28 05:11:45.318187 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Wed Jan 28 05:11:45.784510 2026] [:error] [pid 17426:tid 17499] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Wed Jan 28 05:11:46.247492 2026] [:error] [pid 17426:tid 17504] [client 45.154.138.48:35963] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Wed Jan 28 05:11:46.708651 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.48:35963] [client 45.154.138.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/lx.php"] [unique_id "aXkqEk8zvf_03BnziRfrnAAAAI4"]
[Wed Jan 28 05:11:48.561597 2026] [:error] [pid 17535:tid 17539] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Wed Jan 28 05:11:49.026081 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Wed Jan 28 05:11:49.496081 2026] [:error] [pid 17535:tid 17551] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Wed Jan 28 05:11:49.967197 2026] [:error] [pid 17535:tid 17555] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Wed Jan 28 05:11:50.432595 2026] [:error] [pid 17535:tid 17554] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Wed Jan 28 05:11:50.901465 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Wed Jan 28 05:11:51.364138 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Wed Jan 28 05:11:51.828058 2026] [:error] [pid 17535:tid 17554] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Wed Jan 28 05:11:52.295032 2026] [:error] [pid 17535:tid 17548] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Wed Jan 28 05:11:52.765004 2026] [:error] [pid 17535:tid 17542] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Wed Jan 28 05:11:53.226471 2026] [:error] [pid 17535:tid 17540] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Jan 28 05:11:53.689890 2026] [:error] [pid 17535:tid 17541] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Wed Jan 28 05:11:54.152110 2026] [:error] [pid 17535:tid 17554] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Wed Jan 28 05:11:54.614729 2026] [:error] [pid 17535:tid 17540] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Wed Jan 28 05:11:55.077770 2026] [:error] [pid 17535:tid 17558] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Wed Jan 28 05:11:55.539411 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Wed Jan 28 05:11:56.000860 2026] [:error] [pid 17535:tid 17549] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Wed Jan 28 05:11:56.466463 2026] [:error] [pid 17535:tid 17551] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Wed Jan 28 05:11:56.935899 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Wed Jan 28 05:11:57.399846 2026] [:error] [pid 17535:tid 17548] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Wed Jan 28 05:11:57.900967 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Wed Jan 28 05:11:58.372280 2026] [:error] [pid 17535:tid 17539] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Jan 28 05:11:58.859214 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Wed Jan 28 05:11:59.323483 2026] [:error] [pid 17535:tid 17538] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Wed Jan 28 05:11:59.802720 2026] [:error] [pid 17535:tid 17542] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Wed Jan 28 05:12:00.270207 2026] [:error] [pid 17535:tid 17538] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Jan 28 05:12:00.732752 2026] [:error] [pid 17535:tid 17540] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Wed Jan 28 05:12:01.223986 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Jan 28 05:12:01.692476 2026] [:error] [pid 17535:tid 17557] [client 45.154.138.101:63153] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Wed Jan 28 05:12:11.064000 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.101:63153] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aXkqK63QiSMgVscnN5IEnAAAAM8"]
[Wed Jan 28 05:12:12.453854 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Wed Jan 28 05:12:16.644822 2026] [:error] [pid 64842:tid 64844] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Wed Jan 28 05:12:17.107805 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Wed Jan 28 05:12:17.570395 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Wed Jan 28 05:12:18.964874 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Wed Jan 28 05:12:21.748601 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Wed Jan 28 05:12:22.220330 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Wed Jan 28 05:12:22.687756 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Jan 28 05:12:23.153245 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Wed Jan 28 05:12:23.618829 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Wed Jan 28 05:12:24.094212 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.14:56683] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Wed Jan 28 05:12:25.020690 2026] [:error] [pid 64842:tid 64851] [client 45.154.138.14:56683] [client 45.154.138.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aXkqOVuAAQZ5AN_SnDbniQAAAUc"]
[Wed Jan 28 05:12:25.949748 2026] [:error] [pid 17425:tid 17462] [client 45.154.138.41:38979] [client 45.154.138.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.154.138.41, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aXkqOarcODKH1Dl7aZAUmAAAAEA"]
[Wed Jan 28 05:12:25.953447 2026] [:error] [pid 17425:tid 17462] [client 45.154.138.41:38979] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Jan 28 05:12:26.418049 2026] [:error] [pid 17425:tid 17473] [client 45.154.138.41:38979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Wed Jan 28 05:12:27.356048 2026] [:error] [pid 17425:tid 17481] [client 45.154.138.41:38979] [client 45.154.138.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aXkqO6rcODKH1Dl7aZAUrgAAAFM"]
[Wed Jan 28 05:12:28.754643 2026] [:error] [pid 17425:tid 17465] [client 45.154.138.17:47265] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Wed Jan 28 05:12:31.098927 2026] [:error] [pid 17425:tid 17479] [client 45.154.138.17:47265] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Jan 28 05:12:32.037096 2026] [:error] [pid 17425:tid 17465] [client 45.154.138.17:47265] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Wed Jan 28 05:12:32.498666 2026] [:error] [pid 17425:tid 17466] [client 45.154.138.17:47265] [client 45.154.138.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aXkqQKrcODKH1Dl7aZAU-QAAAEQ"]
[Wed Jan 28 05:12:33.423276 2026] [:error] [pid 17424:tid 17438] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Wed Jan 28 05:12:33.903661 2026] [:error] [pid 17424:tid 17454] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Wed Jan 28 05:12:34.378430 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Wed Jan 28 05:12:36.278895 2026] [:error] [pid 17424:tid 17454] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Wed Jan 28 05:12:36.754301 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Jan 28 05:12:37.225851 2026] [:error] [pid 17424:tid 17440] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Jan 28 05:12:37.694884 2026] [:error] [pid 17424:tid 17435] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Wed Jan 28 05:12:39.558962 2026] [:error] [pid 17424:tid 17452] [client 45.154.138.4:21039] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Jan 28 05:12:40.488563 2026] [:error] [pid 17424:tid 17445] [client 45.154.138.4:21039] [client 45.154.138.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aXkqSGRvtDRvGDe-pIs3YAAAAAw"]
[Wed Jan 28 05:12:41.410805 2026] [:error] [pid 17535:tid 17561] [client 45.154.138.50:51615] [client 45.154.138.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aXkqSa3QiSMgVscnN5IFrAAAANc"]
[Wed Jan 28 05:12:42.346894 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.42:57353] [client 45.154.138.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aXkqSq3QiSMgVscnN5IFtQAAAMw"]
[Wed Jan 28 05:12:43.265222 2026] [:error] [pid 64842:tid 64849] [client 45.154.138.4:28739] [client 45.154.138.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aXkqS1uAAQZ5AN_SnDbocwAAAUU"]
[Wed Jan 28 05:12:44.200251 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.29:56989] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Wed Jan 28 05:12:44.666563 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.29:56989] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Wed Jan 28 05:12:45.601558 2026] [:error] [pid 58254:tid 58262] [client 45.154.138.29:56989] [client 45.154.138.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.29, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aXkqTfF8nSyBg9wOsa__GAAAAQY"]
[Wed Jan 28 05:12:48.401462 2026] [:error] [pid 58254:tid 58258] [client 45.154.138.29:56989] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Wed Jan 28 05:12:49.331638 2026] [:error] [pid 58254:tid 58273] [client 45.154.138.29:56989] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Wed Jan 28 05:12:52.124485 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.29:56989] [client 45.154.138.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aXkqVPF8nSyBg9wOsa__WQAAARU"]
[Wed Jan 28 05:12:53.046696 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.43:45707] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Jan 28 05:12:54.436547 2026] [:error] [pid 58254:tid 58267] [client 45.154.138.43:45707] [client 45.154.138.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.43, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aXkqVvF8nSyBg9wOsa__bwAAAQs"]
[Wed Jan 28 05:12:54.903741 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.43:45707] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Wed Jan 28 05:12:55.833763 2026] [:error] [pid 58254:tid 58267] [client 45.154.138.43:45707] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Wed Jan 28 05:12:56.302117 2026] [:error] [pid 58254:tid 58274] [client 45.154.138.43:45707] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Wed Jan 28 05:12:57.229510 2026] [:error] [pid 58254:tid 58262] [client 45.154.138.43:45707] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Jan 28 05:12:57.693237 2026] [:error] [pid 58254:tid 58274] [client 45.154.138.43:45707] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Jan 28 05:12:58.152307 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.43:45707] [client 45.154.138.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aXkqWvF8nSyBg9wOsa__ngAAARA"]
[Wed Jan 28 05:12:59.078818 2026] [:error] [pid 17425:tid 17469] [client 45.154.138.32:55415] [client 45.154.138.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aXkqW6rcODKH1Dl7aZAWHwAAAEc"]
[Wed Jan 28 05:13:00.000071 2026] [:error] [pid 17425:tid 17487] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Wed Jan 28 05:13:00.465824 2026] [:error] [pid 17425:tid 17470] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Wed Jan 28 05:13:00.970099 2026] [:error] [pid 17425:tid 17476] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Wed Jan 28 05:13:01.440033 2026] [:error] [pid 17425:tid 17462] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Jan 28 05:13:02.372638 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Wed Jan 28 05:13:04.260657 2026] [:error] [pid 17425:tid 17471] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/zmFM.php
[Wed Jan 28 05:13:08.475274 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Wed Jan 28 05:13:08.940991 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Jan 28 05:13:09.411166 2026] [:error] [pid 17425:tid 17479] [client 45.154.138.45:48315] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Wed Jan 28 05:13:10.347533 2026] [:error] [pid 17425:tid 17473] [client 45.154.138.45:48315] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aXkqZqrcODKH1Dl7aZAWrQAAAEs"]
[Wed Jan 28 05:13:14.155019 2026] [:error] [pid 17425:tid 17487] [client 45.154.138.35:57475] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bak.php"] [unique_id "aXkqaqrcODKH1Dl7aZAW1AAAAFg"]
[Wed Jan 28 05:13:16.081455 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.8:53599] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Wed Jan 28 05:13:16.547634 2026] [:error] [pid 64842:tid 64853] [client 45.154.138.8:53599] [client 45.154.138.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aXkqbFuAAQZ5AN_SnDbp_AAAAUk"]
[Wed Jan 28 05:13:18.416734 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.101:27363] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Wed Jan 28 05:13:19.346170 2026] [:error] [pid 17424:tid 17451] [client 45.154.138.101:27363] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Jan 28 05:13:19.811564 2026] [:error] [pid 17424:tid 17457] [client 45.154.138.101:27363] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aXkqb2RvtDRvGDe-pIs5MwAAABg"]
[Wed Jan 28 05:13:20.729701 2026] [:error] [pid 17426:tid 17513] [client 45.154.138.23:50219] [client 45.154.138.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aXkqcE8zvf_03BnziRfvWgAAAJg"]
[Wed Jan 28 05:13:21.648682 2026] [:error] [pid 64842:tid 64851] [client 45.154.138.43:31623] [client 45.154.138.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.43, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aXkqcVuAAQZ5AN_SnDbqRwAAAUc"]
[Wed Jan 28 05:13:22.117052 2026] [:error] [pid 64842:tid 64849] [client 45.154.138.43:31623] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Wed Jan 28 05:13:23.047666 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.43:31623] [client 45.154.138.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/themes.php"] [unique_id "aXkqc1uAAQZ5AN_SnDbqXAAAAU4"]
[Wed Jan 28 05:13:23.974421 2026] [:error] [pid 17426:tid 17495] [client 45.154.138.101:63477] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Jan 28 05:13:24.905084 2026] [:error] [pid 17426:tid 17501] [client 45.154.138.101:63477] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Wed Jan 28 05:13:27.231598 2026] [:error] [pid 17426:tid 17504] [client 45.154.138.101:63477] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aXkqd08zvf_03BnziRfvowAAAI8"]
[Wed Jan 28 05:13:28.161049 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.7:42543] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Jan 28 05:13:29.086958 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.7:42543] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aXkqeVuAAQZ5AN_SnDbqpgAAAVU"]
[Wed Jan 28 05:13:30.480859 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.235:34657] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Wed Jan 28 05:13:31.006179 2026] [:error] [pid 17424:tid 17457] [client 45.154.138.235:34657] [client 45.154.138.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aXkqe2RvtDRvGDe-pIs5vQAAABg"]
[Wed Jan 28 05:13:32.877990 2026] [:error] [pid 17425:tid 17473] [client 45.154.138.7:35415] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Wed Jan 28 05:13:33.339765 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.7:35415] [client 45.154.138.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.7, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aXkqfarcODKH1Dl7aZAXbgAAAFA"]
[Wed Jan 28 05:13:34.749633 2026] [:error] [pid 17425:tid 17470] [client 45.154.138.7:35415] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aXkqfqrcODKH1Dl7aZAXfAAAAEg"]
[Wed Jan 28 05:13:35.672305 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.24:34407] [client 45.154.138.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aXkqf1uAAQZ5AN_SnDbrDAAAAVI"]
[Wed Jan 28 05:13:37.984914 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.49:50217] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Wed Jan 28 05:13:39.381461 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.49:50217] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Wed Jan 28 05:13:40.332086 2026] [:error] [pid 17535:tid 17544] [client 45.154.138.49:50217] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Jan 28 05:13:40.799472 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.49:50217] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Wed Jan 28 05:13:41.735001 2026] [:error] [pid 17535:tid 17540] [client 45.154.138.49:50217] [client 45.154.138.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aXkqha3QiSMgVscnN5II2QAAAMI"]
[Wed Jan 28 05:13:43.590472 2026] [:error] [pid 17535:tid 17540] [client 45.154.138.50:25295] [client 45.154.138.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aXkqh63QiSMgVscnN5II7wAAAMI"]
[Wed Jan 28 05:13:44.517400 2026] [:error] [pid 17424:tid 17455] [client 45.154.138.43:34527] [client 45.154.138.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aXkqiGRvtDRvGDe-pIs6JAAAABY"]
[Wed Jan 28 05:13:45.445797 2026] [:error] [pid 17424:tid 17441] [client 45.154.138.26:64091] [client 45.154.138.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aXkqiWRvtDRvGDe-pIs6LwAAAAg"]
[Wed Jan 28 05:13:46.365263 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.39:64461] [client 45.154.138.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aXkqiq3QiSMgVscnN5IJFQAAAMg"]
[Wed Jan 28 05:13:49.173664 2026] [:error] [pid 17424:tid 17435] [client 45.154.138.48:21971] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Wed Jan 28 05:13:49.636523 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.48:21971] [client 45.154.138.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aXkqjWRvtDRvGDe-pIs6awAAAAQ"]
[Wed Jan 28 05:13:51.030525 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.2:42473] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Jan 28 05:13:51.495264 2026] [:error] [pid 17535:tid 17557] [client 45.154.138.2:42473] File does not exist: /usr/local/apache/htdocs/suspended-page/rcc.php
[Wed Jan 28 05:13:51.955906 2026] [:error] [pid 17535:tid 17541] [client 45.154.138.2:42473] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aXkqj63QiSMgVscnN5IJVAAAAMM"]
[Wed Jan 28 05:13:52.880330 2026] [:error] [pid 17425:tid 17487] [client 45.154.138.15:29287] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Jan 28 05:13:53.357814 2026] [:error] [pid 17425:tid 17483] [client 45.154.138.15:29287] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Wed Jan 28 05:13:53.822995 2026] [:error] [pid 17425:tid 17468] [client 45.154.138.15:29287] [client 45.154.138.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aXkqkarcODKH1Dl7aZAYagAAAEY"]
[Wed Jan 28 05:13:54.745960 2026] [:error] [pid 58254:tid 58262] [client 45.154.138.12:29213] File does not exist: /usr/local/apache/htdocs/suspended-page/history.php
[Wed Jan 28 05:13:55.207163 2026] [:error] [pid 58254:tid 58268] [client 45.154.138.12:29213] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aXkqk_F8nSyBg9wOsa8CUgAAAQw"]
[Wed Jan 28 05:13:57.525502 2026] [:error] [pid 17426:tid 17507] [client 45.154.138.17:56835] [client 45.154.138.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aXkqlU8zvf_03BnziRfxDwAAAJI"]
[Wed Jan 28 05:13:58.495757 2026] [:error] [pid 64842:tid 64844] [client 45.154.138.47:50525] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aXkqlluAAQZ5AN_SnDbsbQAAAUA"]
[Wed Jan 28 05:14:02.199129 2026] [:error] [pid 17426:tid 17495] [client 45.154.138.16:40247] [client 45.154.138.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aXkqmk8zvf_03BnziRfxRQAAAIY"]
[Wed Jan 28 05:14:03.126983 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.47:64859] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Jan 28 05:14:04.064564 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.47:64859] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Jan 28 05:14:04.535573 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.47:64859] [client 45.154.138.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.47, incrementing brute counter"] [hostname "rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aXkqnFuAAQZ5AN_SnDbsyAAAAUo"]
[Wed Jan 28 05:14:05.491418 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.47:64859] [client 45.154.138.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aXkqnVuAAQZ5AN_SnDbs2AAAAVU"]
[Wed Jan 28 05:14:06.433136 2026] [:error] [pid 58254:tid 58259] [client 45.154.138.37:49175] [client 45.154.138.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aXkqnvF8nSyBg9wOsa8C1gAAAQM"]
[Wed Jan 28 05:14:07.358432 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.7:34765] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Jan 28 05:14:07.825485 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.7:34765] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Jan 28 05:14:09.714429 2026] [:error] [pid 17535:tid 17541] [client 45.154.138.7:34765] File does not exist: /usr/local/apache/htdocs/suspended-page/login.php
[Wed Jan 28 05:14:11.167060 2026] [:error] [pid 17535:tid 17550] [client 45.154.138.7:34765] [client 45.154.138.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.7, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aXkqo63QiSMgVscnN5IKTQAAAMw"]
[Wed Jan 28 05:14:11.629914 2026] [:error] [pid 17535:tid 17548] [client 45.154.138.7:34765] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aXkqo63QiSMgVscnN5IKUwAAAMo"]
[Wed Jan 28 05:14:12.550333 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.42:32197] [client 45.154.138.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aXkqpPF8nSyBg9wOsa8DKwAAAQg"]
[Wed Jan 28 05:14:13.486455 2026] [:error] [pid 64842:tid 64849] [client 45.154.138.43:37615] [client 45.154.138.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aXkqpVuAAQZ5AN_SnDbtTAAAAUU"]
[Wed Jan 28 05:14:15.812599 2026] [:error] [pid 64842:tid 64847] [client 45.154.138.23:61235] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Wed Jan 28 05:14:16.277660 2026] [:error] [pid 64842:tid 64846] [client 45.154.138.23:61235] [client 45.154.138.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aXkqqFuAAQZ5AN_SnDbtegAAAUI"]
[Wed Jan 28 05:14:17.685485 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.28:23337] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Wed Jan 28 05:14:20.050443 2026] [:error] [pid 64842:tid 64860] [client 45.154.138.28:23337] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Jan 28 05:14:21.455357 2026] [:error] [pid 64842:tid 64846] [client 45.154.138.28:23337] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Wed Jan 28 05:14:21.915732 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.28:23337] [client 45.154.138.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aXkqrVuAAQZ5AN_SnDbtygAAAUs"]
[Wed Jan 28 05:14:26.399734 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.23:49855] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Wed Jan 28 05:14:27.336106 2026] [:error] [pid 17535:tid 17558] [client 45.154.138.23:49855] [client 45.154.138.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aXkqs63QiSMgVscnN5ILTwAAANQ"]
[Wed Jan 28 05:14:28.728783 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.42:31419] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Jan 28 05:14:30.162877 2026] [:error] [pid 58254:tid 58260] [client 45.154.138.42:31419] [client 45.154.138.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aXkqtvF8nSyBg9wOsa8EUQAAAQQ"]
[Wed Jan 28 05:14:31.845399 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.33:50331] [client 45.154.138.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aXkqt1uAAQZ5AN_SnDbuRQAAAVU"]
[Wed Jan 28 05:14:33.238712 2026] [:error] [pid 17426:tid 17508] [client 45.154.138.46:20405] [client 45.154.138.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aXkquU8zvf_03BnziRfygQAAAJM"]
[Wed Jan 28 05:14:34.634663 2026] [:error] [pid 17424:tid 17455] [client 45.154.138.44:58923] [client 45.154.138.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aXkqumRvtDRvGDe-pIs73wAAABY"]
[Wed Jan 28 05:14:36.018610 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.25:56063] [client 45.154.138.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aXkqvGRvtDRvGDe-pIs75wAAAAs"]
[Wed Jan 28 05:14:37.891594 2026] [:error] [pid 58254:tid 58273] [client 45.154.138.7:44817] [client 45.154.138.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aXkqvfF8nSyBg9wOsa8E1QAAARE"]
[Wed Jan 28 05:14:39.283197 2026] [:error] [pid 17426:tid 17507] [client 45.154.138.41:46513] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Jan 28 05:14:40.232316 2026] [:error] [pid 17426:tid 17500] [client 45.154.138.41:46513] [client 45.154.138.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aXkqwE8zvf_03BnziRfyygAAAIs"]
[Wed Jan 28 05:14:41.632159 2026] [:error] [pid 17425:tid 17470] [client 45.154.138.33:39209] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Wed Jan 28 05:14:42.113917 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.33:39209] File does not exist: /usr/local/apache/htdocs/suspended-page/conf_upload.php
[Wed Jan 28 05:14:42.596451 2026] [:error] [pid 17425:tid 17482] [client 45.154.138.33:39209] [client 45.154.138.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aXkqwqrcODKH1Dl7aZAabgAAAFQ"]
[Wed Jan 28 05:14:44.500804 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.12:31539] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aXkqxPF8nSyBg9wOsa8FXgAAAQA"]
[Wed Jan 28 05:14:45.429888 2026] [:error] [pid 17535:tid 17538] [client 45.154.138.10:35885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Wed Jan 28 05:14:46.361881 2026] [:error] [pid 17535:tid 17560] [client 45.154.138.10:35885] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Wed Jan 28 05:14:47.305055 2026] [:error] [pid 17535:tid 17538] [client 45.154.138.10:35885] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Jan 28 05:14:47.772684 2026] [:error] [pid 17535:tid 17561] [client 45.154.138.10:35885] [client 45.154.138.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aXkqx63QiSMgVscnN5IMYQAAANc"]
[Wed Jan 28 05:14:49.162486 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.26:56509] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Jan 28 05:14:50.606280 2026] [:error] [pid 58254:tid 58280] [client 45.154.138.26:56509] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Wed Jan 28 05:14:51.079750 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.26:56509] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Jan 28 05:14:52.487658 2026] [:error] [pid 58254:tid 58267] [client 45.154.138.26:56509] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Wed Jan 28 05:14:52.954083 2026] [:error] [pid 58254:tid 58276] [client 45.154.138.26:56509] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Wed Jan 28 05:14:54.818700 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.26:56509] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Wed Jan 28 05:14:55.279327 2026] [:error] [pid 58254:tid 58265] [client 45.154.138.26:56509] [client 45.154.138.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aXkqz_F8nSyBg9wOsa8GIwAAAQk"]
[Wed Jan 28 05:14:56.200183 2026] [:error] [pid 58254:tid 58274] [client 45.154.138.6:51725] [client 45.154.138.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aXkq0PF8nSyBg9wOsa8GOwAAARI"]
[Wed Jan 28 05:14:57.122370 2026] [:error] [pid 64842:tid 64844] [client 45.154.138.9:20039] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Jan 28 05:14:57.589022 2026] [:error] [pid 64842:tid 64853] [client 45.154.138.9:20039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Jan 28 05:14:58.053038 2026] [:error] [pid 64842:tid 64863] [client 45.154.138.9:20039] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Jan 28 05:14:58.515288 2026] [:error] [pid 64842:tid 64851] [client 45.154.138.9:20039] [client 45.154.138.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aXkq0luAAQZ5AN_SnDbvlwAAAUc"]
[Wed Jan 28 05:14:59.436803 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.30:56871] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aXkq02RvtDRvGDe-pIs8zwAAABE"]
[Wed Jan 28 05:15:00.369353 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.48:20563] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Jan 28 05:15:00.945006 2026] [:error] [pid 17425:tid 17467] [client 45.154.138.48:20563] [client 45.154.138.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aXkq1KrcODKH1Dl7aZAbWgAAAEU"]
[Wed Jan 28 05:15:01.920239 2026] [:error] [pid 17535:tid 17542] [client 45.154.138.32:60199] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Wed Jan 28 05:15:02.423043 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.32:60199] File does not exist: /usr/local/apache/htdocs/suspended-page/sck.php
[Wed Jan 28 05:15:02.922917 2026] [:error] [pid 17535:tid 17561] [client 45.154.138.32:60199] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Wed Jan 28 05:15:03.915594 2026] [:error] [pid 17535:tid 17558] [client 45.154.138.32:60199] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Wed Jan 28 05:15:04.389255 2026] [:error] [pid 17535:tid 17557] [client 45.154.138.32:60199] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Jan 28 05:15:04.849287 2026] [:error] [pid 17535:tid 17547] [client 45.154.138.32:60199] [client 45.154.138.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aXkq2K3QiSMgVscnN5INUgAAAMk"]
[Wed Jan 28 05:15:06.239912 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.42:62535] [client 45.154.138.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.42, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aXkq2mRvtDRvGDe-pIs9EwAAAAQ"]
[Wed Jan 28 05:15:06.718694 2026] [:error] [pid 17424:tid 17455] [client 45.154.138.42:62535] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Wed Jan 28 05:15:07.211613 2026] [:error] [pid 17424:tid 17434] [client 45.154.138.42:62535] [client 45.154.138.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aXkq22RvtDRvGDe-pIs9HAAAAAE"]
[Wed Jan 28 05:15:08.169661 2026] [:error] [pid 17535:tid 17543] [client 45.154.138.44:62923] [client 45.154.138.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aXkq3K3QiSMgVscnN5INhAAAAMU"]
[Wed Jan 28 05:15:09.559041 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.44:63507] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Jan 28 05:15:10.032719 2026] [:error] [pid 17424:tid 17445] [client 45.154.138.44:63507] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Wed Jan 28 05:15:10.500680 2026] [:error] [pid 17424:tid 17457] [client 45.154.138.44:63507] [client 45.154.138.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aXkq3mRvtDRvGDe-pIs9NgAAABg"]
[Wed Jan 28 05:15:11.434465 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.32:62905] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Wed Jan 28 05:15:11.897754 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.32:62905] [client 45.154.138.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aXkq3_F8nSyBg9wOsa8HZgAAAQA"]
[Wed Jan 28 05:15:14.331725 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.9:60503] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Jan 28 05:15:14.818302 2026] [:error] [pid 17426:tid 17501] [client 45.154.138.9:60503] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Wed Jan 28 05:15:15.310585 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.9:60503] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/cloud.php
[Wed Jan 28 05:15:17.717458 2026] [:error] [pid 17426:tid 17500] [client 45.154.138.9:60503] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Wed Jan 28 05:15:18.196779 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.9:60503] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/class_api.php
[Wed Jan 28 05:15:19.184574 2026] [:error] [pid 17426:tid 17509] [client 45.154.138.9:60503] [client 45.154.138.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aXkq508zvf_03BnziRf0cgAAAJQ"]
[Wed Jan 28 05:15:20.123668 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.43:58715] File does not exist: /usr/local/apache/htdocs/suspended-page/base.php
[Wed Jan 28 05:15:21.092615 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.43:58715] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Wed Jan 28 05:15:21.562598 2026] [:error] [pid 17424:tid 17436] [client 45.154.138.43:58715] [client 45.154.138.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aXkq6WRvtDRvGDe-pIs9vgAAAAM"]
[Wed Jan 28 05:15:22.959088 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.32:53699] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Jan 28 05:15:23.427357 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.32:53699] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Jan 28 05:15:23.895503 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.32:53699] [client 45.154.138.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.32, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aXkq6_F8nSyBg9wOsa8IQAAAARM"]
[Wed Jan 28 05:15:23.899732 2026] [:error] [pid 58254:tid 58275] [client 45.154.138.32:53699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Wed Jan 28 05:15:25.304321 2026] [:error] [pid 58254:tid 58256] [client 45.154.138.32:53699] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Wed Jan 28 05:15:25.773253 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.32:53699] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Jan 28 05:15:26.738863 2026] [:error] [pid 58254:tid 58268] [client 45.154.138.32:53699] [client 45.154.138.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mah.php"] [unique_id "aXkq7vF8nSyBg9wOsa8IhAAAAQw"]
[Wed Jan 28 05:15:27.676605 2026] [:error] [pid 17535:tid 17543] [client 45.154.138.15:47119] [client 45.154.138.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.15, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aXkq763QiSMgVscnN5IOfwAAAMU"]
[Wed Jan 28 05:15:28.143909 2026] [:error] [pid 17535:tid 17552] [client 45.154.138.15:47119] [client 45.154.138.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aXkq8K3QiSMgVscnN5IOhAAAAM4"]
[Wed Jan 28 05:15:29.160974 2026] [:error] [pid 17426:tid 17490] [client 45.154.138.43:58923] [client 45.154.138.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/images/about.php"] [unique_id "aXkq8U8zvf_03BnziRf01AAAAIE"]
[Wed Jan 28 05:15:32.982005 2026] [:error] [pid 17424:tid 17434] [client 45.154.138.2:62323] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Wed Jan 28 05:15:34.406506 2026] [:error] [pid 17424:tid 17448] [client 45.154.138.2:62323] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aXkq9mRvtDRvGDe-pIs-UQAAAA8"]
[Wed Jan 28 05:15:35.336914 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.49:41287] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Jan 28 05:15:36.269651 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.49:41287] [client 45.154.138.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aXkq-FuAAQZ5AN_SnDbxcgAAAU0"]
[Wed Jan 28 05:15:37.702184 2026] [:error] [pid 64842:tid 64845] [client 45.154.138.45:31681] [client 45.154.138.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.45, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aXkq-VuAAQZ5AN_SnDbxjQAAAUE"]
[Wed Jan 28 05:15:39.108280 2026] [:error] [pid 64842:tid 64845] [client 45.154.138.45:31681] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Wed Jan 28 05:15:39.573190 2026] [:error] [pid 64842:tid 64861] [client 45.154.138.45:31681] File does not exist: /usr/local/apache/htdocs/suspended-page/bulk.php
[Wed Jan 28 05:15:40.044984 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.45:31681] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Wed Jan 28 05:15:40.981279 2026] [:error] [pid 64842:tid 64860] [client 45.154.138.45:31681] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logout.php
[Wed Jan 28 05:15:41.453928 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.45:31681] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aXkq_VuAAQZ5AN_SnDbxxwAAAVc"]
[Wed Jan 28 05:15:42.840190 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.2:43459] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/packed.php"] [unique_id "aXkq_q3QiSMgVscnN5IPHwAAAM8"]
[Wed Jan 28 05:15:43.769111 2026] [:error] [pid 17424:tid 17451] [client 45.154.138.16:65535] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Jan 28 05:15:44.235840 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.16:65535] [client 45.154.138.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setup.php"] [unique_id "aXkrAGRvtDRvGDe-pIs-6gAAAA0"]
[Wed Jan 28 05:15:45.161443 2026] [:error] [pid 17535:tid 17547] [client 45.154.138.13:65133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Jan 28 05:15:46.565161 2026] [:error] [pid 17535:tid 17541] [client 45.154.138.13:65133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Wed Jan 28 05:15:47.027596 2026] [:error] [pid 17535:tid 17549] [client 45.154.138.13:65133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-simple.php
[Wed Jan 28 05:15:48.423215 2026] [:error] [pid 17535:tid 17557] [client 45.154.138.13:65133] [client 45.154.138.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aXkrBK3QiSMgVscnN5IPcwAAANM"]
[Wed Jan 28 05:15:49.818034 2026] [:error] [pid 17535:tid 17559] [client 45.154.138.13:55269] [client 45.154.138.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aXkrBa3QiSMgVscnN5IPiQAAANU"]
[Wed Jan 28 05:15:51.218145 2026] [:error] [pid 17535:tid 17551] [client 45.154.138.3:57775] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aXkrB63QiSMgVscnN5IPlwAAAM0"]
[Wed Jan 28 05:15:52.150495 2026] [:error] [pid 64842:tid 64847] [client 45.154.138.5:43767] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Jan 28 05:15:54.035563 2026] [:error] [pid 64842:tid 64846] [client 45.154.138.5:43767] [client 45.154.138.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.5, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aXkrCluAAQZ5AN_SnDbyeQAAAUI"]
[Wed Jan 28 05:15:54.504180 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.5:43767] [client 45.154.138.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aXkrCluAAQZ5AN_SnDbygQAAAVQ"]
[Wed Jan 28 05:15:56.925147 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.37:20937] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Wed Jan 28 05:15:57.393129 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.37:20937] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Wed Jan 28 05:15:58.343717 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.37:20937] [client 45.154.138.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aXkrDluAAQZ5AN_SnDbyugAAAUY"]
[Wed Jan 28 05:15:59.269435 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.10:31589] [client 45.154.138.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aXkrD1uAAQZ5AN_SnDbyxgAAAUo"]
[Wed Jan 28 05:16:00.196266 2026] [:error] [pid 58254:tid 58272] [client 45.154.138.12:23403] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Wed Jan 28 05:16:02.125945 2026] [:error] [pid 58254:tid 58269] [client 45.154.138.12:23403] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/moon.php
[Wed Jan 28 05:16:03.528240 2026] [:error] [pid 58254:tid 58265] [client 45.154.138.12:23403] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/dropdown.php
[Wed Jan 28 05:16:03.992101 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.12:23403] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aXkrE_F8nSyBg9wOsa8LJQAAAQg"]
[Wed Jan 28 05:16:04.914639 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.33:37829] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Jan 28 05:16:05.393400 2026] [:error] [pid 17426:tid 17491] [client 45.154.138.33:37829] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Wed Jan 28 05:16:06.489071 2026] [:error] [pid 17426:tid 17499] [client 45.154.138.33:37829] [client 45.154.138.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/votes.php"] [unique_id "aXkrFk8zvf_03BnziRf3RQAAAIo"]
[Wed Jan 28 05:16:09.397299 2026] [:error] [pid 64842:tid 64859] [client 45.154.138.28:35427] File does not exist: /usr/local/apache/htdocs/suspended-page/sk.php
[Wed Jan 28 05:16:10.360201 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.28:35427] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/blurbs.php
[Wed Jan 28 05:16:11.290282 2026] [:error] [pid 64842:tid 64847] [client 45.154.138.28:35427] [client 45.154.138.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "aXkrG1uAAQZ5AN_SnDbzYAAAAUM"]
[Wed Jan 28 05:16:14.088775 2026] [:error] [pid 17424:tid 17443] [client 45.154.138.22:51183] [client 45.154.138.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aXkrHmRvtDRvGDe-pItAjAAAAAo"]
[Wed Jan 28 05:16:16.423075 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.14:48513] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Wed Jan 28 05:16:17.821225 2026] [:error] [pid 17425:tid 17479] [client 45.154.138.14:48513] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Jan 28 05:16:18.288737 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.14:48513] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Wed Jan 28 05:16:18.752055 2026] [:error] [pid 17425:tid 17467] [client 45.154.138.14:48513] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Wed Jan 28 05:16:19.211770 2026] [:error] [pid 17425:tid 17468] [client 45.154.138.14:48513] [client 45.154.138.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aXkrI6rcODKH1Dl7aZAf_wAAAEY"]
[Wed Jan 28 05:16:20.140802 2026] [:error] [pid 17426:tid 17496] [client 45.154.138.30:62677] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/doc.php
[Wed Jan 28 05:16:20.606961 2026] [:error] [pid 17426:tid 17501] [client 45.154.138.30:62677] File does not exist: /usr/local/apache/htdocs/suspended-page/fm1.php
[Wed Jan 28 05:16:22.012674 2026] [:error] [pid 17426:tid 17508] [client 45.154.138.30:62677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Wed Jan 28 05:16:22.476725 2026] [:error] [pid 17426:tid 17496] [client 45.154.138.30:62677] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aXkrJk8zvf_03BnziRf4HwAAAIc"]
[Wed Jan 28 05:16:23.401042 2026] [:error] [pid 64842:tid 64847] [client 45.154.138.2:23871] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Wed Jan 28 05:16:23.886090 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.2:23871] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Jan 28 05:16:24.825210 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.2:23871] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Wed Jan 28 05:16:25.774716 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.2:23871] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi01.php
[Wed Jan 28 05:16:27.193732 2026] [:error] [pid 64842:tid 64853] [client 45.154.138.2:23871] [client 45.154.138.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/item.php"] [unique_id "aXkrK1uAAQZ5AN_SnDb0NwAAAUk"]
[Wed Jan 28 05:16:31.039082 2026] [:error] [pid 17424:tid 17445] [client 45.154.138.50:38871] [client 45.154.138.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.50, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aXkrL2RvtDRvGDe-pItB-AAAAAw"]
[Wed Jan 28 05:16:31.511006 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.50:38871] [client 45.154.138.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.50, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aXkrL2RvtDRvGDe-pItCAQAAAAk"]
[Wed Jan 28 05:16:32.006120 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.50:38871] [client 45.154.138.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mani.php"] [unique_id "aXkrMGRvtDRvGDe-pItCDAAAAA0"]
[Wed Jan 28 05:16:32.950328 2026] [:error] [pid 17426:tid 17495] [client 45.154.138.46:55533] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Jan 28 05:16:36.808682 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.46:55533] [client 45.154.138.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aXkrNE8zvf_03BnziRf40QAAAIU"]
[Wed Jan 28 05:16:37.749066 2026] [:error] [pid 17426:tid 17508] [client 45.154.138.18:47021] File does not exist: /usr/local/apache/htdocs/suspended-page/images.php
[Wed Jan 28 05:16:38.224760 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.18:47021] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aespa.php
[Wed Jan 28 05:16:38.687577 2026] [:error] [pid 17426:tid 17506] [client 45.154.138.18:47021] [client 45.154.138.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aXkrNk8zvf_03BnziRf46wAAAJE"]
[Wed Jan 28 05:16:41.537480 2026] [:error] [pid 58254:tid 58279] [client 45.154.138.25:56107] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mariju.php
[Wed Jan 28 05:16:42.943783 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.25:56107] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/themes.php
[Wed Jan 28 05:16:43.895788 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.25:56107] [client 45.154.138.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aXkrO_F8nSyBg9wOsa8N7wAAAQc"]
[Wed Jan 28 05:16:44.818971 2026] [:error] [pid 17424:tid 17440] [client 45.154.138.35:32973] [client 45.154.138.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aXkrPGRvtDRvGDe-pItCvAAAAAc"]
[Wed Jan 28 05:16:46.270830 2026] [:error] [pid 58254:tid 58259] [client 45.154.138.3:63731] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Jan 28 05:16:47.706874 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.3:63731] [client 45.154.138.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.3, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/wp-login.php"] [unique_id "aXkrP_F8nSyBg9wOsa8OJQAAAQc"]
[Wed Jan 28 05:16:49.611876 2026] [:error] [pid 58254:tid 58274] [client 45.154.138.3:63731] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aXkrQfF8nSyBg9wOsa8ONgAAARI"]
[Wed Jan 28 05:16:50.590123 2026] [:error] [pid 17425:tid 17467] [client 45.154.138.3:60057] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Jan 28 05:16:51.084889 2026] [:error] [pid 17425:tid 17470] [client 45.154.138.3:60057] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aXkrQ6rcODKH1Dl7aZAh8AAAAEg"]
[Wed Jan 28 05:16:52.004977 2026] [:error] [pid 17426:tid 17504] [client 45.154.138.6:58567] [client 45.154.138.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aXkrRE8zvf_03BnziRf5cQAAAI8"]
[Wed Jan 28 05:16:53.455757 2026] [:error] [pid 17426:tid 17494] [client 45.154.138.17:57301] [client 45.154.138.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aXkrRU8zvf_03BnziRf5hgAAAIU"]
[Wed Jan 28 05:16:57.006087 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.18:32267] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/parx.php
[Wed Jan 28 05:16:57.956997 2026] [:error] [pid 2454:tid 2461] [client 45.154.138.18:32267] [client 45.154.138.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aXkrSZvv4I21Ywd7NNbkwQAAAYM"]
[Wed Jan 28 05:16:59.346207 2026] [:error] [pid 17426:tid 17504] [client 45.154.138.3:30165] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Wed Jan 28 05:16:59.812215 2026] [:error] [pid 17426:tid 17512] [client 45.154.138.3:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Jan 28 05:17:01.737256 2026] [:error] [pid 17426:tid 17509] [client 45.154.138.3:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Wed Jan 28 05:17:02.205013 2026] [:error] [pid 17426:tid 17510] [client 45.154.138.3:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Wed Jan 28 05:17:02.691019 2026] [:error] [pid 17426:tid 17492] [client 45.154.138.3:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Wed Jan 28 05:17:03.156007 2026] [:error] [pid 17426:tid 17513] [client 45.154.138.3:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Jan 28 05:17:04.130727 2026] [:error] [pid 17426:tid 17488] [client 45.154.138.3:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Jan 28 05:17:05.552214 2026] [:error] [pid 17426:tid 17506] [client 45.154.138.3:30165] [client 45.154.138.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/radio.php"] [unique_id "aXkrUU8zvf_03BnziRf6RwAAAJE"]
[Wed Jan 28 05:17:06.945095 2026] [:error] [pid 2454:tid 2472] [client 45.154.138.5:61269] File does not exist: /usr/local/apache/htdocs/suspended-page/payout.php
[Wed Jan 28 05:17:07.420416 2026] [:error] [pid 2454:tid 2477] [client 45.154.138.5:61269] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Jan 28 05:17:07.928630 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.5:61269] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Jan 28 05:17:08.397246 2026] [:error] [pid 2454:tid 2475] [client 45.154.138.5:61269] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Wed Jan 28 05:17:09.362594 2026] [:error] [pid 2454:tid 2482] [client 45.154.138.5:61269] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Wed Jan 28 05:17:09.831179 2026] [:error] [pid 2454:tid 2477] [client 45.154.138.5:61269] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Wed Jan 28 05:17:10.765014 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.5:61269] [client 45.154.138.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aXkrVpvv4I21Ywd7NNblmwAAAY0"]
[Wed Jan 28 05:17:14.100906 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.31:54543] [client 45.154.138.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aXkrWvF8nSyBg9wOsa8PWwAAARU"]
[Wed Jan 28 05:17:15.491799 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.235:26441] [client 45.154.138.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aXkrW2RvtDRvGDe-pItEXgAAABE"]
[Wed Jan 28 05:17:16.413161 2026] [:error] [pid 2454:tid 2461] [client 45.154.138.19:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Jan 28 05:17:16.896364 2026] [:error] [pid 2454:tid 2468] [client 45.154.138.19:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/fox.php
[Wed Jan 28 05:17:17.374952 2026] [:error] [pid 2454:tid 2459] [client 45.154.138.19:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/google.php
[Wed Jan 28 05:17:18.327578 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.19:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/ovatools.php
[Wed Jan 28 05:17:18.800444 2026] [:error] [pid 2454:tid 2480] [client 45.154.138.19:63015] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwso.php
[Wed Jan 28 05:17:19.260018 2026] [:error] [pid 2454:tid 2462] [client 45.154.138.19:63015] [client 45.154.138.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/worksec.php"] [unique_id "aXkrX5vv4I21Ywd7NNbmOAAAAYQ"]
[Wed Jan 28 05:17:20.183183 2026] [:error] [pid 17535:tid 17548] [client 45.154.138.101:51789] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Wed Jan 28 05:17:20.645751 2026] [:error] [pid 17535:tid 17541] [client 45.154.138.101:51789] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aXkrYK3QiSMgVscnN5IUuAAAAMM"]
[Wed Jan 28 05:17:21.566057 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.1:39649] [client 45.154.138.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aXkrYVuAAQZ5AN_SnDb2uwAAAVg"]
[Wed Jan 28 05:17:23.445749 2026] [:error] [pid 17424:tid 17438] [client 45.154.138.32:35983] [client 45.154.138.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aXkrY2RvtDRvGDe-pItE7wAAAAU"]
[Wed Jan 28 05:17:24.890199 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Wed Jan 28 05:17:25.358830 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Wed Jan 28 05:17:29.220132 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/style2.php
[Wed Jan 28 05:17:29.695994 2026] [:error] [pid 17424:tid 17435] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scripts.php
[Wed Jan 28 05:17:30.159274 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Jan 28 05:17:30.628007 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Wed Jan 28 05:17:31.178017 2026] [:error] [pid 17424:tid 17455] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/comfunctions.php
[Wed Jan 28 05:17:31.642155 2026] [:error] [pid 17424:tid 17439] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Wed Jan 28 05:17:32.105522 2026] [:error] [pid 17424:tid 17455] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Wed Jan 28 05:17:32.600396 2026] [:error] [pid 17424:tid 17442] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Wed Jan 28 05:17:33.086496 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/hinfofuns.php
[Wed Jan 28 05:17:33.562686 2026] [:error] [pid 17424:tid 17439] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/qfunctions.php
[Wed Jan 28 05:17:34.038946 2026] [:error] [pid 17424:tid 17444] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/qinfofuns.php
[Wed Jan 28 05:17:34.503381 2026] [:error] [pid 17424:tid 17450] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Wed Jan 28 05:17:34.969048 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Wed Jan 28 05:17:35.434860 2026] [:error] [pid 17424:tid 17435] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php
[Wed Jan 28 05:17:35.925744 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Wed Jan 28 05:17:36.388567 2026] [:error] [pid 17424:tid 17434] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Jan 28 05:17:36.852805 2026] [:error] [pid 17424:tid 17438] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/my-sites.php
[Wed Jan 28 05:17:37.318591 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Wed Jan 28 05:17:37.784154 2026] [:error] [pid 17424:tid 17438] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/nav-menus.php
[Wed Jan 28 05:17:38.251743 2026] [:error] [pid 17424:tid 17453] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Wed Jan 28 05:17:38.716083 2026] [:error] [pid 17424:tid 17455] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Wed Jan 28 05:17:39.184328 2026] [:error] [pid 17424:tid 17441] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/revision.php
[Wed Jan 28 05:17:39.650484 2026] [:error] [pid 17424:tid 17448] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Wed Jan 28 05:17:40.118218 2026] [:error] [pid 17424:tid 17447] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Jan 28 05:17:40.590813 2026] [:error] [pid 17424:tid 17448] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Jan 28 05:17:41.055082 2026] [:error] [pid 17424:tid 17456] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Wed Jan 28 05:17:41.523675 2026] [:error] [pid 17424:tid 17451] [client 45.154.138.28:54009] File does not exist: /usr/local/apache/htdocs/suspended-page/moded.php
[Wed Jan 28 05:17:41.983986 2026] [:error] [pid 17424:tid 17433] [client 45.154.138.28:54009] [client 45.154.138.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aXkrdWRvtDRvGDe-pItGBAAAAAA"]
[Wed Jan 28 05:17:42.910866 2026] [:error] [pid 17535:tid 17560] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/upgrade.php
[Wed Jan 28 05:17:43.376435 2026] [:error] [pid 17535:tid 17548] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/gh.php
[Wed Jan 28 05:17:43.843261 2026] [:error] [pid 17535:tid 17541] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/version.php
[Wed Jan 28 05:17:44.312477 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/head.php
[Wed Jan 28 05:17:44.782921 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Wed Jan 28 05:17:45.249670 2026] [:error] [pid 17535:tid 17554] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/theme-insqbzk.php
[Wed Jan 28 05:17:45.718777 2026] [:error] [pid 17535:tid 17539] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Wed Jan 28 05:17:46.181781 2026] [:error] [pid 17535:tid 17560] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Wed Jan 28 05:17:47.138299 2026] [:error] [pid 17535:tid 17546] [client 45.154.138.48:62321] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Wed Jan 28 05:17:47.599483 2026] [:error] [pid 17535:tid 17542] [client 45.154.138.48:62321] [client 45.154.138.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "aXkre63QiSMgVscnN5IWOwAAAMQ"]
[Wed Jan 28 05:17:49.952120 2026] [:error] [pid 64842:tid 64858] [client 45.154.138.19:49397] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Wed Jan 28 05:17:54.756012 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.19:49397] [client 45.154.138.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aXkrgluAAQZ5AN_SnDb4JwAAAU0"]
[Wed Jan 28 05:17:55.736756 2026] [:error] [pid 17425:tid 17476] [client 45.154.138.41:51161] [client 45.154.138.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aXkrg6rcODKH1Dl7aZAkQwAAAE4"]
[Wed Jan 28 05:17:57.611653 2026] [:error] [pid 2454:tid 2460] [client 45.154.138.46:30759] [client 45.154.138.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aXkrhZvv4I21Ywd7NNbo3gAAAYI"]
[Wed Jan 28 05:17:59.009458 2026] [:error] [pid 17425:tid 17466] [client 45.154.138.30:32877] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/repeater.php"] [unique_id "aXkrh6rcODKH1Dl7aZAkdgAAAEQ"]
[Wed Jan 28 05:18:01.382515 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.101:37277] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php
[Wed Jan 28 05:18:01.849566 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.101:37277] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php
[Wed Jan 28 05:18:02.812452 2026] [:error] [pid 64842:tid 64852] [client 45.154.138.101:37277] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php
[Wed Jan 28 05:18:06.684781 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.101:37277] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aXkrjluAAQZ5AN_SnDb4ywAAAVY"]
[Wed Jan 28 05:18:07.612669 2026] [:error] [pid 2454:tid 2459] [client 45.154.138.8:45829] [client 45.154.138.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aXkrj5vv4I21Ywd7NNbpZQAAAYE"]
[Wed Jan 28 05:18:08.995724 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.45:25393] [client 45.154.138.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/options.php"] [unique_id "aXkrkFuAAQZ5AN_SnDb47gAAAVQ"]
[Wed Jan 28 05:18:13.264966 2026] [:error] [pid 2454:tid 2477] [client 45.154.138.4:36529] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Wed Jan 28 05:18:14.190394 2026] [:error] [pid 2454:tid 2464] [client 45.154.138.4:36529] [client 45.154.138.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aXkrlpvv4I21Ywd7NNbpvwAAAYY"]
[Wed Jan 28 05:18:15.116567 2026] [:error] [pid 17424:tid 17439] [client 45.154.138.28:56547] [client 45.154.138.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aXkrl2RvtDRvGDe-pItHgwAAAAY"]
[Wed Jan 28 05:18:21.957503 2026] [:error] [pid 2454:tid 2475] [client 45.154.138.11:43343] [client 45.154.138.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.11, incrementing brute counter"] [hostname "rejuva.au"] [uri "/images/wp-login.php"] [unique_id "aXkrnZvv4I21Ywd7NNbqEgAAAZE"]
[Wed Jan 28 05:18:22.425614 2026] [:error] [pid 2454:tid 2478] [client 45.154.138.11:43343] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Jan 28 05:18:23.815665 2026] [:error] [pid 2454:tid 2460] [client 45.154.138.11:43343] [client 45.154.138.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aXkrn5vv4I21Ywd7NNbqKAAAAYI"]
[Wed Jan 28 05:18:24.740699 2026] [:error] [pid 2454:tid 2480] [client 45.154.138.101:41103] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads-config.php
[Wed Jan 28 05:18:26.623975 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.101:41103] [client 45.154.138.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aXkropvv4I21Ywd7NNbqWgAAAYs"]
[Wed Jan 28 05:18:27.553028 2026] [:error] [pid 17535:tid 17561] [client 45.154.138.23:54961] [client 45.154.138.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aXkro63QiSMgVscnN5IYNgAAANc"]
[Wed Jan 28 05:18:28.492183 2026] [:error] [pid 17426:tid 17502] [client 45.154.138.4:61531] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/autoload_classmap.php
[Wed Jan 28 05:18:28.954946 2026] [:error] [pid 17426:tid 17503] [client 45.154.138.4:61531] [client 45.154.138.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.4, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aXkrpE8zvf_03BnziRf-ygAAAI4"]
[Wed Jan 28 05:18:29.427093 2026] [:error] [pid 17426:tid 17513] [client 45.154.138.4:61531] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Wed Jan 28 05:18:31.774841 2026] [:error] [pid 17426:tid 17513] [client 45.154.138.4:61531] [client 45.154.138.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aXkrp08zvf_03BnziRf-8AAAAJg"]
[Wed Jan 28 05:18:32.707058 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.22:48443] File does not exist: /usr/local/apache/htdocs/suspended-page/indeex.php
[Wed Jan 28 05:18:33.183240 2026] [:error] [pid 2454:tid 2472] [client 45.154.138.22:48443] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Jan 28 05:18:34.587453 2026] [:error] [pid 2454:tid 2478] [client 45.154.138.22:48443] [client 45.154.138.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aXkrqpvv4I21Ywd7NNbq3QAAAZQ"]
[Wed Jan 28 05:18:35.522703 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Wed Jan 28 05:18:36.463044 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/credits.php
[Wed Jan 28 05:18:36.946168 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-comments.php
[Wed Jan 28 05:18:37.419940 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Wed Jan 28 05:18:37.908099 2026] [:error] [pid 64842:tid 64861] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Wed Jan 28 05:18:38.380898 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Wed Jan 28 05:18:38.885673 2026] [:error] [pid 64842:tid 64847] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/load-scripts.php
[Wed Jan 28 05:18:39.352846 2026] [:error] [pid 64842:tid 64845] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/load-styles.php
[Wed Jan 28 05:18:39.826674 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/options-discussion.php
[Wed Jan 28 05:18:40.298058 2026] [:error] [pid 64842:tid 64863] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/options-general.php
[Wed Jan 28 05:18:40.766460 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/options-permalink.php
[Wed Jan 28 05:18:41.230792 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/options-privacy.php
[Wed Jan 28 05:18:41.694703 2026] [:error] [pid 64842:tid 64848] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Wed Jan 28 05:18:42.158656 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Wed Jan 28 05:18:42.634918 2026] [:error] [pid 64842:tid 64848] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/post-new.php
[Wed Jan 28 05:18:43.099832 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Wed Jan 28 05:18:43.564070 2026] [:error] [pid 64842:tid 64851] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Wed Jan 28 05:18:44.037049 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/site-health.php
[Wed Jan 28 05:18:44.502960 2026] [:error] [pid 64842:tid 64861] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Wed Jan 28 05:18:44.985466 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Wed Jan 28 05:18:45.450082 2026] [:error] [pid 64842:tid 64848] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/user-edit.php
[Wed Jan 28 05:18:45.913863 2026] [:error] [pid 64842:tid 64846] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/user-new.php
[Wed Jan 28 05:18:46.394991 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Wed Jan 28 05:18:46.857762 2026] [:error] [pid 64842:tid 64864] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/bar.php
[Wed Jan 28 05:18:47.327472 2026] [:error] [pid 64842:tid 64865] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Wed Jan 28 05:18:47.792686 2026] [:error] [pid 64842:tid 64855] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Jan 28 05:18:48.255563 2026] [:error] [pid 64842:tid 64854] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Jan 28 05:18:48.720161 2026] [:error] [pid 64842:tid 64860] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Wed Jan 28 05:18:49.203864 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/km.php
[Wed Jan 28 05:18:49.676233 2026] [:error] [pid 64842:tid 64850] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/LA.php
[Wed Jan 28 05:18:50.164715 2026] [:error] [pid 64842:tid 64851] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Jan 28 05:18:50.628698 2026] [:error] [pid 64842:tid 64862] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ldd.php
[Wed Jan 28 05:18:51.106229 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/sgd.php
[Wed Jan 28 05:18:51.581444 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/wzy.php
[Wed Jan 28 05:18:57.188018 2026] [:error] [pid 64842:tid 64863] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Jan 28 05:18:58.120204 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Jan 28 05:18:59.976102 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Jan 28 05:19:00.436845 2026] [:error] [pid 64842:tid 64868] [client 45.154.138.18:37765] [client 45.154.138.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.18, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aXkrxFuAAQZ5AN_SnDb7gAAAAVg"]
[Wed Jan 28 05:19:00.951003 2026] [:error] [pid 64842:tid 64848] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Wed Jan 28 05:19:02.403003 2026] [:error] [pid 64842:tid 64867] [client 45.154.138.18:37765] [client 45.154.138.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.18, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.tmb/wp-login.php"] [unique_id "aXkrxluAAQZ5AN_SnDb7nAAAAVc"]
[Wed Jan 28 05:19:03.349832 2026] [:error] [pid 64842:tid 64866] [client 45.154.138.18:37765] File does not exist: /usr/local/apache/htdocs/suspended-page/FroggBaba.php
[Wed Jan 28 05:19:03.838013 2026] [:error] [pid 64842:tid 64859] [client 45.154.138.18:37765] [client 45.154.138.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aXkrx1uAAQZ5AN_SnDb7rwAAAU8"]
[Wed Jan 28 05:19:04.759825 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.14:46767] [client 45.154.138.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aXkryJvv4I21Ywd7NNbtGwAAAZc"]
[Wed Jan 28 05:19:05.681834 2026] [:error] [pid 17426:tid 17491] [client 45.154.138.40:59163] [client 45.154.138.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aXkryU8zvf_03BnziRcAOAAAAII"]
[Wed Jan 28 05:19:06.635480 2026] [:error] [pid 2454:tid 2472] [client 45.154.138.20:23465] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Wed Jan 28 05:19:09.513422 2026] [:error] [pid 2454:tid 2463] [client 45.154.138.20:23465] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Wed Jan 28 05:19:09.980859 2026] [:error] [pid 2454:tid 2463] [client 45.154.138.20:23465] File does not exist: /usr/local/apache/htdocs/suspended-page/GA13.php
[Wed Jan 28 05:19:11.855225 2026] [:error] [pid 2454:tid 2462] [client 45.154.138.20:23465] [client 45.154.138.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.20, incrementing brute counter"] [hostname "rejuva.au"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aXkrz5vv4I21Ywd7NNbtrgAAAYQ"]
[Wed Jan 28 05:19:12.318612 2026] [:error] [pid 2454:tid 2482] [client 45.154.138.20:23465] [client 45.154.138.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aXkr0Jvv4I21Ywd7NNbttwAAAZg"]
[Wed Jan 28 05:19:13.715412 2026] [:error] [pid 58254:tid 58263] [client 45.154.138.31:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/crop.php
[Wed Jan 28 05:19:14.176981 2026] [:error] [pid 58254:tid 58278] [client 45.154.138.31:36755] [client 45.154.138.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.31, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aXkr0vF8nSyBg9wOsa8VNwAAARY"]
[Wed Jan 28 05:19:15.138839 2026] [:error] [pid 58254:tid 58261] [client 45.154.138.31:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/gali.php
[Wed Jan 28 05:19:16.597180 2026] [:error] [pid 58254:tid 58257] [client 45.154.138.31:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Wed Jan 28 05:19:17.063766 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.31:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/dirs.php
[Wed Jan 28 05:19:17.543667 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.31:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/abouts.php
[Wed Jan 28 05:19:18.013679 2026] [:error] [pid 58254:tid 58265] [client 45.154.138.31:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/malls.php
[Wed Jan 28 05:19:18.487145 2026] [:error] [pid 58254:tid 58266] [client 45.154.138.31:36755] File does not exist: /usr/local/apache/htdocs/suspended-page/liefs.php
[Wed Jan 28 05:19:18.956013 2026] [:error] [pid 58254:tid 58277] [client 45.154.138.31:36755] [client 45.154.138.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uc.php"] [unique_id "aXkr1vF8nSyBg9wOsa8VpgAAARU"]
[Wed Jan 28 05:19:19.898269 2026] [:error] [pid 58254:tid 58268] [client 45.154.138.22:28437] File does not exist: /usr/local/apache/htdocs/suspended-page/uc.php
[Wed Jan 28 05:19:20.366820 2026] [:error] [pid 58254:tid 58267] [client 45.154.138.22:28437] File does not exist: /usr/local/apache/htdocs/suspended-page/locks.php
[Wed Jan 28 05:19:20.846155 2026] [:error] [pid 58254:tid 58265] [client 45.154.138.22:28437] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-dsdd.php
[Wed Jan 28 05:19:22.738699 2026] [:error] [pid 58254:tid 58270] [client 45.154.138.22:28437] [client 45.154.138.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aXkr2vF8nSyBg9wOsa8V4QAAAQ4"]
[Wed Jan 28 05:19:23.676421 2026] [:error] [pid 2454:tid 2460] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Wed Jan 28 05:19:24.153755 2026] [:error] [pid 2454:tid 2469] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Wed Jan 28 05:19:24.634261 2026] [:error] [pid 2454:tid 2458] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Wed Jan 28 05:19:25.102441 2026] [:error] [pid 2454:tid 2468] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Jan 28 05:19:25.566728 2026] [:error] [pid 2454:tid 2463] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/stindex.php
[Wed Jan 28 05:19:26.048915 2026] [:error] [pid 2454:tid 2480] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Wed Jan 28 05:19:26.983875 2026] [:error] [pid 2454:tid 2470] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/exit.php
[Wed Jan 28 05:19:27.450637 2026] [:error] [pid 2454:tid 2461] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Jan 28 05:19:27.916951 2026] [:error] [pid 2454:tid 2471] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Wed Jan 28 05:19:28.394396 2026] [:error] [pid 2454:tid 2472] [client 45.154.138.12:37319] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Wed Jan 28 05:19:28.865738 2026] [:error] [pid 2454:tid 2477] [client 45.154.138.12:37319] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aXkr4Jvv4I21Ywd7NNbvBQAAAZM"]
[Wed Jan 28 05:19:29.838263 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Jan 28 05:19:31.480051 2026] [:error] [pid 17425:tid 17477] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/shellv3.php
[Wed Jan 28 05:19:31.965323 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/sh.php
[Wed Jan 28 05:19:33.383728 2026] [:error] [pid 17425:tid 17481] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Jan 28 05:19:33.878333 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Jan 28 05:19:34.345824 2026] [:error] [pid 17425:tid 17463] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/delete3.php
[Wed Jan 28 05:19:35.304221 2026] [:error] [pid 17425:tid 17465] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/mm.php
[Wed Jan 28 05:19:36.234898 2026] [:error] [pid 17425:tid 17468] [client 45.154.138.20:54709] [client 45.154.138.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.20, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aXkr6KrcODKH1Dl7aZApawAAAEY"]
[Wed Jan 28 05:19:36.704573 2026] [:error] [pid 17425:tid 17476] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Wed Jan 28 05:19:37.634933 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/mailer.php
[Wed Jan 28 05:19:38.104524 2026] [:error] [pid 17425:tid 17467] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/www.php
[Wed Jan 28 05:19:39.051137 2026] [:error] [pid 17425:tid 17474] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Jan 28 05:19:40.463246 2026] [:error] [pid 17425:tid 17466] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Jan 28 05:19:40.926767 2026] [:error] [pid 17425:tid 17475] [client 45.154.138.20:54709] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Wed Jan 28 05:19:42.802999 2026] [autoindex:error] [pid 17425:tid 17466] [client 45.154.138.20:54709] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:19:55.781452 2026] [:error] [pid 17425:tid 17464] [client 45.154.138.20:54709] [client 45.154.138.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-includes/"] [unique_id "aXkr-6rcODKH1Dl7aZAqawAAAEI"]
[Wed Jan 28 05:20:39.211310 2026] [:error] [pid 64842:tid 64860] [client 45.154.138.46:32297] [client 45.154.138.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/simple-file-list/"] [unique_id "aXksJ1uAAQZ5AN_SnDYAhwAAAVA"]
[Wed Jan 28 05:20:55.717558 2026] [:error] [pid 17535:tid 17561] [client 45.154.138.30:60697] [client 45.154.138.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/"] [unique_id "aXksN63QiSMgVscnN5If9QAAANc"]
[Wed Jan 28 05:20:59.987198 2026] [:error] [pid 2454:tid 2481] [client 45.154.138.46:60105] [client 45.154.138.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez3/"] [unique_id "aXksO5vv4I21Ywd7NNb0sAAAAZc"]
[Wed Jan 28 05:21:03.282018 2026] [:error] [pid 17425:tid 17467] [client 45.154.138.30:46021] [client 45.154.138.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aXksP6rcODKH1Dl7aZAtggAAAEU"]
[Wed Jan 28 05:21:10.379165 2026] [:error] [pid 17426:tid 17499] [client 45.154.138.34:54149] [client 45.154.138.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "aXksRk8zvf_03BnziRcG5gAAAIo"]
[Wed Jan 28 05:22:06.191917 2026] [:error] [pid 17535:tid 17543] [client 45.154.138.27:42429] [client 45.154.138.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/ioptimization/"] [unique_id "aXksfq3QiSMgVscnN5IjagAAAMU"]
[Wed Jan 28 05:22:17.456521 2026] [:error] [pid 17426:tid 17495] [client 45.154.138.3:47987] [client 45.154.138.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pki-validation/"] [unique_id "aXksiU8zvf_03BnziRcKagAAAIY"]
[Wed Jan 28 05:22:44.161331 2026] [:error] [pid 17424:tid 17437] [client 45.154.138.36:61719] [client 45.154.138.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Requests/Transport/"] [unique_id "aXkspGRvtDRvGDe-pItUKgAAAAQ"]
[Wed Jan 28 05:22:45.086067 2026] [:error] [pid 17535:tid 17560] [client 45.154.138.36:22263] [client 45.154.138.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Requests/Transport/"] [unique_id "aXkspa3QiSMgVscnN5IlLgAAANY"]
[Wed Jan 28 05:45:37.541383 2026] [:error] [pid 17426:tid 17491] [client 43.159.152.184:54884] [client 43.159.152.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXkyAU8zvf_03BnziRcvdwAAAII"]
[Wed Jan 28 11:57:22.542044 2026] [:error] [pid 33636:tid 33654] [client 43.155.195.141:45342] [client 43.155.195.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXmJItIVZAudQH0BSC7CBQAAAhA"]
[Wed Jan 28 12:08:33.161150 2026] [:error] [pid 33580:tid 33590] [client 182.42.111.156:44378] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXmLwZlb0QJtwfka8l7sGgAAAQM"]
[Wed Jan 28 14:26:47.200384 2026] [:error] [pid 2625:tid 2649] [client 162.62.213.187:39348] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXmsJ1ZhY64HvuPd7w0RJQAAAVI"]
[Wed Jan 28 23:15:50.905271 2026] [:error] [pid 33636:tid 33647] [client 213.209.159.151:45794] [client 213.209.159.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXooJtIVZAudQH0BSC5b9AAAAgk"]
[Thu Jan 29 03:34:03.948937 2026] [:error] [pid 15948:tid 15987] [client 47.90.227.150:53602] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXpkq8s8-GxRVq8LLTWeBwAAABc"]
[Thu Jan 29 03:34:04.606483 2026] [:error] [pid 16050:tid 16069] [client 47.90.227.150:57536] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXpkrOFPpSEbViHfa9KQswAAAM8"]
[Thu Jan 29 06:59:15.903457 2026] [:error] [pid 20486:tid 20491] [client 60.188.57.0:41251] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXqUw3gqSZb6GBx5nnP-nAAAAQI"]
[Thu Jan 29 08:40:02.406268 2026] [:error] [pid 20486:tid 20513] [client 43.134.186.61:54318] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXqsYngqSZb6GBx5nnMjowAAARg"]
[Thu Jan 29 19:18:44.330368 2026] [:error] [pid 20519:tid 20569] [client 182.44.10.67:33830] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXtCFAo4s4fyROrkyRnUSQAAAZU"]
[Thu Jan 29 20:33:19.915676 2026] [:error] [pid 20519:tid 20555] [client 144.172.112.114:36640] [client 144.172.112.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aXtTjwo4s4fyROrkyRnhngAAAYc"]
[Thu Jan 29 21:58:14.319926 2026] [:error] [pid 20576:tid 20609] [client 20.89.146.26:14846] [client 20.89.146.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aXtndirDZws_FlQGi9eAJQAAAdc"]
[Thu Jan 29 21:58:15.922474 2026] [:error] [pid 39863:tid 39889] [client 20.89.146.26:11560] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Jan 29 21:58:16.054686 2026] [:error] [pid 39863:tid 39872] [client 20.89.146.26:11560] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Thu Jan 29 21:58:16.169656 2026] [:error] [pid 39863:tid 39880] [client 20.89.146.26:11560] [client 20.89.146.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aXtneLsHJJGGu8set58CCQAAAU4"]
[Thu Jan 29 21:58:17.460009 2026] [:error] [pid 39863:tid 39886] [client 20.89.146.26:12971] [client 20.89.146.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aXtnebsHJJGGu8set58CCgAAAVQ"]
[Thu Jan 29 21:58:18.393282 2026] [:error] [pid 20486:tid 20512] [client 20.89.146.26:13216] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Jan 29 21:58:18.527459 2026] [:error] [pid 20486:tid 20504] [client 20.89.146.26:13216] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aXtnengqSZb6GBx5nnMNnwAAAQ8"]
[Thu Jan 29 21:58:20.829738 2026] [:error] [pid 19069:tid 19086] [client 20.89.146.26:11532] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aXtnfPDHsRM4BJ9a4Qt7SwAAAAg"]
[Thu Jan 29 21:58:23.033017 2026] [:error] [pid 40273:tid 40290] [client 20.89.146.26:14448] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aXtnfxN1IJpP__zZvujJpQAAAE8"]
[Thu Jan 29 21:58:25.293424 2026] [:error] [pid 20580:tid 20678] [client 20.89.146.26:14093] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aXtngZCZ5HHdXPmeL59G2QAAAoo"]
[Thu Jan 29 21:58:28.636155 2026] [:error] [pid 40273:tid 40285] [client 20.89.146.26:12613] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aXtnhBN1IJpP__zZvujJrgAAAEo"]
[Thu Jan 29 21:58:29.153854 2026] [:error] [pid 20579:tid 20643] [client 20.89.146.26:13806] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aXtnhTVXNopcNyjJc9UsIAAAAkI"]
[Thu Jan 29 21:58:29.990837 2026] [:error] [pid 19071:tid 19148] [client 20.89.146.26:13796] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aXtnhZfa8Ix5wWmtmJybywAAAI8"]
[Thu Jan 29 21:58:30.972901 2026] [:error] [pid 20580:tid 20680] [client 20.89.146.26:12074] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aXtnhpCZ5HHdXPmeL59G4AAAAow"]
[Thu Jan 29 21:58:32.766661 2026] [:error] [pid 20578:tid 20624] [client 20.89.146.26:12038] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aXtniA6UX7yOMwQFiydEgwAAAgs"]
[Thu Jan 29 21:58:34.754662 2026] [:error] [pid 20579:tid 20647] [client 20.89.146.26:17533] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aXtnijVXNopcNyjJc9UsIwAAAkY"]
[Thu Jan 29 21:58:36.082343 2026] [:error] [pid 40273:tid 40275] [client 20.89.146.26:23488] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aXtnjBN1IJpP__zZvujJsgAAAEA"]
[Thu Jan 29 21:58:38.533356 2026] [:error] [pid 20486:tid 20504] [client 20.89.146.26:13699] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aXtnjngqSZb6GBx5nnMNuQAAAQ8"]
[Thu Jan 29 21:58:39.313921 2026] [:error] [pid 20519:tid 20569] [client 20.89.146.26:3986] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aXtnjwo4s4fyROrkyRn0zAAAAZU"]
[Thu Jan 29 21:58:40.674800 2026] [:error] [pid 20578:tid 20614] [client 20.89.146.26:22422] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aXtnkA6UX7yOMwQFiydEigAAAgE"]
[Thu Jan 29 21:58:42.847887 2026] [:error] [pid 39863:tid 39881] [client 20.89.146.26:14944] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aXtnkrsHJJGGu8set58CLAAAAU8"]
[Thu Jan 29 21:58:44.028921 2026] [:error] [pid 20579:tid 20653] [client 20.89.146.26:16069] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aXtnlDVXNopcNyjJc9UsLQAAAkw"]
[Thu Jan 29 21:58:45.772345 2026] [:error] [pid 19071:tid 19141] [client 20.89.146.26:16124] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aXtnlZfa8Ix5wWmtmJyb3wAAAIg"]
[Thu Jan 29 21:58:47.114028 2026] [:error] [pid 20578:tid 20637] [client 20.89.146.26:15891] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aXtnlw6UX7yOMwQFiydEkAAAAhg"]
[Thu Jan 29 21:58:48.762405 2026] [:error] [pid 20576:tid 20586] [client 20.89.146.26:3777] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aXtnmCrDZws_FlQGi9eATwAAAcA"]
[Thu Jan 29 21:58:49.822825 2026] [:error] [pid 39863:tid 39871] [client 20.89.146.26:16171] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aXtnmbsHJJGGu8set58CMAAAAUU"]
[Thu Jan 29 21:58:50.833958 2026] [:error] [pid 19069:tid 19082] [client 20.89.146.26:3786] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aXtnmvDHsRM4BJ9a4Qt7XAAAAAQ"]
[Thu Jan 29 21:58:51.835789 2026] [:error] [pid 40273:tid 40287] [client 20.89.146.26:3191] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aXtnmxN1IJpP__zZvujJwAAAAEw"]
[Thu Jan 29 21:58:53.626054 2026] [:error] [pid 20579:tid 20659] [client 20.89.146.26:12301] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aXtnnTVXNopcNyjJc9UsNgAAAlI"]
[Thu Jan 29 21:58:54.779925 2026] [:error] [pid 19069:tid 19098] [client 20.89.146.26:12559] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aXtnnvDHsRM4BJ9a4Qt7YgAAABQ"]
[Thu Jan 29 21:58:55.669371 2026] [:error] [pid 39863:tid 39885] [client 20.89.146.26:14304] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aXtnn7sHJJGGu8set58CNQAAAVM"]
[Thu Jan 29 21:58:57.039882 2026] [:error] [pid 20578:tid 20620] [client 20.89.146.26:14293] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aXtnoQ6UX7yOMwQFiydEnAAAAgc"]
[Thu Jan 29 21:58:58.483887 2026] [:error] [pid 20579:tid 20655] [client 20.89.146.26:15146] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aXtnojVXNopcNyjJc9UsPQAAAk4"]
[Thu Jan 29 21:59:00.723526 2026] [:error] [pid 20486:tid 20494] [client 20.89.146.26:17218] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aXtnpHgqSZb6GBx5nnMN0QAAAQU"]
[Thu Jan 29 21:59:01.652013 2026] [:error] [pid 39863:tid 39882] [client 20.89.146.26:17276] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aXtnpbsHJJGGu8set58CPgAAAVA"]
[Thu Jan 29 21:59:03.371243 2026] [:error] [pid 39863:tid 39889] [client 20.89.146.26:12328] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aXtnp7sHJJGGu8set58CRAAAAVc"]
[Thu Jan 29 21:59:04.757707 2026] [:error] [pid 20486:tid 20497] [client 20.89.146.26:16826] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aXtnqHgqSZb6GBx5nnMN2gAAAQg"]
[Thu Jan 29 21:59:06.335589 2026] [:error] [pid 19069:tid 19097] [client 20.89.146.26:3171] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aXtnqvDHsRM4BJ9a4Qt7agAAABM"]
[Thu Jan 29 21:59:07.299836 2026] [:error] [pid 20519:tid 20554] [client 20.89.146.26:12299] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aXtnqwo4s4fyROrkyRn05QAAAYY"]
[Thu Jan 29 21:59:08.488306 2026] [:error] [pid 20519:tid 20572] [client 20.89.146.26:12296] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aXtnrAo4s4fyROrkyRn05wAAAZg"]
[Thu Jan 29 21:59:09.450121 2026] [:error] [pid 20580:tid 20682] [client 20.89.146.26:14306] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aXtnrZCZ5HHdXPmeL59G9wAAAo4"]
[Thu Jan 29 21:59:11.818518 2026] [:error] [pid 40273:tid 40292] [client 20.89.146.26:17262] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aXtnrxN1IJpP__zZvujJzQAAAFE"]
[Thu Jan 29 21:59:13.585566 2026] [:error] [pid 39863:tid 39887] [client 20.89.146.26:3905] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aXtnsbsHJJGGu8set58CXQAAAVU"]
[Thu Jan 29 21:59:14.778453 2026] [:error] [pid 20486:tid 20508] [client 20.89.146.26:12330] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aXtnsngqSZb6GBx5nnMN9QAAARM"]
[Thu Jan 29 21:59:18.140527 2026] [:error] [pid 39863:tid 39877] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Jan 29 21:59:18.273170 2026] [:error] [pid 39863:tid 39881] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Jan 29 21:59:18.392195 2026] [:error] [pid 39863:tid 39870] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Thu Jan 29 21:59:18.510732 2026] [:error] [pid 39863:tid 39885] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Thu Jan 29 21:59:18.949852 2026] [:error] [pid 39863:tid 39883] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/ave.php
[Thu Jan 29 21:59:19.066203 2026] [:error] [pid 39863:tid 39878] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Thu Jan 29 21:59:19.186930 2026] [:error] [pid 39863:tid 39868] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Thu Jan 29 21:59:19.307040 2026] [:error] [pid 39863:tid 39876] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Jan 29 21:59:19.466741 2026] [:error] [pid 39863:tid 39871] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Jan 29 21:59:20.121666 2026] [:error] [pid 39863:tid 39879] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Thu Jan 29 21:59:21.023907 2026] [:error] [pid 39863:tid 39890] [client 20.89.146.26:24624] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Jan 29 21:59:21.137916 2026] [:error] [pid 39863:tid 39877] [client 20.89.146.26:24624] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aXtnubsHJJGGu8set58CcgAAAUs"]
[Thu Jan 29 21:59:22.508732 2026] [:error] [pid 20579:tid 20659] [client 20.89.146.26:3567] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aXtnujVXNopcNyjJc9UsUwAAAlI"]
[Thu Jan 29 21:59:23.568787 2026] [:error] [pid 20579:tid 20641] [client 20.89.146.26:17255] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aXtnuzVXNopcNyjJc9UsVAAAAkA"]
[Thu Jan 29 21:59:24.922931 2026] [:error] [pid 39863:tid 39874] [client 20.89.146.26:3150] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aXtnvLsHJJGGu8set58CegAAAUg"]
[Thu Jan 29 21:59:26.188161 2026] [:error] [pid 20576:tid 20605] [client 20.89.146.26:12410] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aXtnvirDZws_FlQGi9eAggAAAdM"]
[Thu Jan 29 21:59:27.041125 2026] [:error] [pid 20519:tid 20565] [client 20.89.146.26:3564] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aXtnvwo4s4fyROrkyRn0_gAAAZE"]
[Thu Jan 29 21:59:28.975100 2026] [:error] [pid 19071:tid 19154] [client 20.89.146.26:15980] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aXtnwJfa8Ix5wWmtmJycBgAAAJU"]
[Thu Jan 29 21:59:31.433231 2026] [:error] [pid 39863:tid 39868] [client 20.89.146.26:15989] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aXtnw7sHJJGGu8set58ChwAAAUI"]
[Thu Jan 29 21:59:33.115648 2026] [:error] [pid 19071:tid 19138] [client 20.89.146.26:3148] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aXtnxZfa8Ix5wWmtmJycEQAAAIU"]
[Thu Jan 29 21:59:35.437730 2026] [:error] [pid 20519:tid 20572] [client 20.89.146.26:17234] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aXtnxwo4s4fyROrkyRn1CQAAAZg"]
[Thu Jan 29 21:59:38.415778 2026] [:error] [pid 20580:tid 20684] [client 20.89.146.26:17274] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aXtnypCZ5HHdXPmeL59HDAAAApA"]
[Thu Jan 29 21:59:39.975658 2026] [:error] [pid 39863:tid 39886] [client 20.89.146.26:3540] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aXtny7sHJJGGu8set58CkgAAAVQ"]
[Thu Jan 29 21:59:40.338177 2026] [:error] [pid 19071:tid 19141] [client 20.89.146.26:24608] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aXtnzJfa8Ix5wWmtmJycFgAAAIg"]
[Thu Jan 29 21:59:40.817875 2026] [:error] [pid 20519:tid 20564] [client 20.89.146.26:15947] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aXtnzAo4s4fyROrkyRn1GQAAAZA"]
[Thu Jan 29 21:59:41.565376 2026] [:error] [pid 20580:tid 20686] [client 20.89.146.26:24614] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aXtnzZCZ5HHdXPmeL59HEgAAApI"]
[Thu Jan 29 21:59:43.367091 2026] [:error] [pid 19069:tid 19099] [client 20.89.146.26:3600] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aXtnz_DHsRM4BJ9a4Qt7jAAAABU"]
[Thu Jan 29 21:59:46.395487 2026] [:error] [pid 20576:tid 20603] [client 20.89.146.26:3616] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aXtn0irDZws_FlQGi9eApAAAAdE"]
[Thu Jan 29 21:59:47.553565 2026] [:error] [pid 20578:tid 20621] [client 20.89.146.26:12390] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aXtn0w6UX7yOMwQFiydExgAAAgg"]
[Thu Jan 29 21:59:48.164435 2026] [:error] [pid 20578:tid 20631] [client 20.89.146.26:3160] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aXtn1A6UX7yOMwQFiydEyAAAAhI"]
[Thu Jan 29 21:59:50.351124 2026] [:error] [pid 19071:tid 19146] [client 20.89.146.26:3193] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aXtn1pfa8Ix5wWmtmJycJQAAAI0"]
[Thu Jan 29 21:59:52.003952 2026] [:error] [pid 40273:tid 40291] [client 20.89.146.26:22732] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aXtn2BN1IJpP__zZvujJ-gAAAFA"]
[Thu Jan 29 21:59:52.948119 2026] [:error] [pid 20578:tid 20614] [client 20.89.146.26:24594] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aXtn2A6UX7yOMwQFiydEzAAAAgE"]
[Thu Jan 29 21:59:54.732039 2026] [:error] [pid 20579:tid 20663] [client 20.89.146.26:3845] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aXtn2jVXNopcNyjJc9UsdQAAAlU"]
[Thu Jan 29 21:59:56.352633 2026] [:error] [pid 20519:tid 20567] [client 20.89.146.26:3897] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aXtn3Ao4s4fyROrkyRn1LAAAAZM"]
[Thu Jan 29 21:59:58.332865 2026] [:error] [pid 20578:tid 20637] [client 20.89.146.26:17217] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aXtn3g6UX7yOMwQFiydE1QAAAhg"]
[Thu Jan 29 22:00:00.034703 2026] [:error] [pid 20486:tid 20509] [client 20.89.146.26:3842] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aXtn4HgqSZb6GBx5nnMOPwAAARQ"]
[Thu Jan 29 22:00:01.497935 2026] [:error] [pid 20486:tid 20506] [client 20.89.146.26:4020] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aXtn4XgqSZb6GBx5nnMOQgAAARE"]
[Thu Jan 29 22:00:02.321311 2026] [:error] [pid 19069:tid 19089] [client 20.89.146.26:24601] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aXtn4vDHsRM4BJ9a4Qt7pgAAAAs"]
[Thu Jan 29 22:00:02.880643 2026] [:error] [pid 19069:tid 19097] [client 20.89.146.26:11369] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aXtn4vDHsRM4BJ9a4Qt7qAAAABM"]
[Thu Jan 29 22:00:03.830733 2026] [:error] [pid 20486:tid 20496] [client 20.89.146.26:15964] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aXtn43gqSZb6GBx5nnMORgAAAQc"]
[Thu Jan 29 22:00:05.143306 2026] [:error] [pid 20578:tid 20614] [client 20.89.146.26:15952] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aXtn5Q6UX7yOMwQFiydE2wAAAgE"]
[Thu Jan 29 22:00:06.048841 2026] [:error] [pid 39863:tid 39877] [client 20.89.146.26:15381] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aXtn5rsHJJGGu8set58CwgAAAUs"]
[Thu Jan 29 22:00:06.997881 2026] [:error] [pid 20580:tid 20690] [client 20.89.146.26:24606] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aXtn5pCZ5HHdXPmeL59HKQAAApY"]
[Thu Jan 29 22:00:07.691468 2026] [:error] [pid 20576:tid 20599] [client 20.89.146.26:11330] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aXtn5yrDZws_FlQGi9eAvQAAAc0"]
[Thu Jan 29 22:00:08.217804 2026] [:error] [pid 39863:tid 39870] [client 20.89.146.26:11373] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aXtn6LsHJJGGu8set58CxgAAAUQ"]
[Thu Jan 29 22:00:08.584139 2026] [:error] [pid 20580:tid 20685] [client 20.89.146.26:24591] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aXtn6JCZ5HHdXPmeL59HLAAAApE"]
[Thu Jan 29 22:00:09.909476 2026] [:error] [pid 40273:tid 40291] [client 20.89.146.26:3976] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aXtn6RN1IJpP__zZvujKEAAAAFA"]
[Thu Jan 29 22:00:10.656144 2026] [:error] [pid 20580:tid 20665] [client 20.89.146.26:3872] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aXtn6pCZ5HHdXPmeL59HOQAAAoA"]
[Thu Jan 29 22:00:11.400784 2026] [:error] [pid 20519:tid 20560] [client 20.89.146.26:3856] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aXtn6wo4s4fyROrkyRn1OQAAAYw"]
[Thu Jan 29 22:00:13.631585 2026] [:error] [pid 20576:tid 20610] [client 20.89.146.26:3873] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aXtn7SrDZws_FlQGi9eAwAAAAdg"]
[Thu Jan 29 22:00:15.278031 2026] [:error] [pid 20576:tid 20589] [client 20.89.146.26:3899] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aXtn7yrDZws_FlQGi9eAxgAAAcM"]
[Thu Jan 29 22:00:17.635753 2026] [:error] [pid 19071:tid 19146] [client 20.89.146.26:3901] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aXtn8Zfa8Ix5wWmtmJycPgAAAI0"]
[Thu Jan 29 22:00:18.469882 2026] [:error] [pid 19071:tid 19140] [client 20.89.146.26:15009] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "aXtn8pfa8Ix5wWmtmJycQAAAAIc"]
[Thu Jan 29 22:00:21.357987 2026] [:error] [pid 20578:tid 20633] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Thu Jan 29 22:00:21.479385 2026] [:error] [pid 20578:tid 20628] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Thu Jan 29 22:00:22.076029 2026] [:error] [pid 20578:tid 20626] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Jan 29 22:00:22.194126 2026] [:error] [pid 20578:tid 20620] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Thu Jan 29 22:00:22.314282 2026] [:error] [pid 20578:tid 20618] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Thu Jan 29 22:00:22.431075 2026] [:error] [pid 20578:tid 20624] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Thu Jan 29 22:00:22.562468 2026] [:error] [pid 20578:tid 20613] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Thu Jan 29 22:00:22.683651 2026] [:error] [pid 20578:tid 20632] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Thu Jan 29 22:00:23.044399 2026] [:error] [pid 20578:tid 20619] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Jan 29 22:00:23.161449 2026] [:error] [pid 20578:tid 20623] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Thu Jan 29 22:00:23.279809 2026] [:error] [pid 20578:tid 20637] [client 20.89.146.26:16459] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Thu Jan 29 22:00:23.399713 2026] [:error] [pid 20578:tid 20621] [client 20.89.146.26:16459] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aXtn9w6UX7yOMwQFiydE9AAAAgg"]
[Thu Jan 29 22:00:25.781029 2026] [:error] [pid 20486:tid 20496] [client 20.89.146.26:17598] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aXtn-XgqSZb6GBx5nnMOYAAAAQc"]
[Thu Jan 29 22:00:27.141268 2026] [:error] [pid 20486:tid 20503] [client 20.89.146.26:22607] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aXtn-3gqSZb6GBx5nnMOZwAAAQ4"]
[Thu Jan 29 22:00:30.549296 2026] [:error] [pid 39863:tid 39873] [client 20.89.146.26:17577] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aXtn_rsHJJGGu8set58C8gAAAUc"]
[Thu Jan 29 22:00:30.980179 2026] [:error] [pid 20578:tid 20618] [client 20.89.146.26:14984] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aXtn_g6UX7yOMwQFiydE-wAAAgU"]
[Thu Jan 29 22:00:31.443449 2026] [:error] [pid 20578:tid 20613] [client 20.89.146.26:17553] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aXtn_w6UX7yOMwQFiydE_AAAAgA"]
[Thu Jan 29 22:00:32.207741 2026] [:error] [pid 20576:tid 20588] [client 20.89.146.26:3442] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aXtoACrDZws_FlQGi9eA3AAAAcI"]
[Thu Jan 29 22:00:33.343983 2026] [:error] [pid 40273:tid 40293] [client 20.89.146.26:22604] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aXtoARN1IJpP__zZvujKJgAAAFI"]
[Thu Jan 29 22:00:34.671247 2026] [:error] [pid 20579:tid 20664] [client 20.89.146.26:16465] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aXtoAjVXNopcNyjJc9UsigAAAlY"]
[Thu Jan 29 22:00:35.598295 2026] [:error] [pid 20486:tid 20495] [client 20.89.146.26:17554] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aXtoA3gqSZb6GBx5nnMOcQAAAQY"]
[Thu Jan 29 22:00:37.496371 2026] [:error] [pid 19071:tid 19149] [client 20.89.146.26:15022] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aXtoBZfa8Ix5wWmtmJycXwAAAJA"]
[Thu Jan 29 22:00:40.103713 2026] [:error] [pid 20579:tid 20658] [client 20.89.146.26:14653] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aXtoCDVXNopcNyjJc9UskAAAAlE"]
[Thu Jan 29 22:00:41.566865 2026] [:error] [pid 20579:tid 20644] [client 20.89.146.26:13472] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aXtoCTVXNopcNyjJc9UskgAAAkM"]
[Thu Jan 29 22:00:43.052053 2026] [:error] [pid 40273:tid 40285] [client 20.89.146.26:22640] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aXtoCxN1IJpP__zZvujKPwAAAEo"]
[Thu Jan 29 22:00:44.291060 2026] [:error] [pid 20578:tid 20619] [client 20.89.146.26:22620] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aXtoDA6UX7yOMwQFiydFCQAAAgY"]
[Thu Jan 29 22:00:45.363774 2026] [:error] [pid 20486:tid 20512] [client 20.89.146.26:13440] [client 20.89.146.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aXtoDXgqSZb6GBx5nnMOfAAAARc"]
[Thu Jan 29 22:28:33.426634 2026] [:error] [pid 20576:tid 20597] [client 47.90.227.150:44340] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXtukSrDZws_FlQGi9eHHgAAAcs"]
[Thu Jan 29 22:28:34.060528 2026] [:error] [pid 20576:tid 20599] [client 47.90.227.150:60678] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXtukirDZws_FlQGi9eHIQAAAc0"]
[Fri Jan 30 06:26:32.629464 2026] [:error] [pid 24711:tid 24728] [client 164.90.142.198:61212] [client 164.90.142.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aXvemK5Gwh4var6T23JOxgAAAU4"], referer: binance.com
[Fri Jan 30 09:22:46.237297 2026] [:error] [pid 46913:tid 46962] [client 43.130.131.18:48114] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXwH5jMWmKL8hOfC3uRIrgAAAEs"]
[Fri Jan 30 13:06:42.931272 2026] [:error] [pid 46914:tid 46997] [client 43.131.243.61:56108] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXw8YlgSfJ4kZxNKlb9D5gAAAJM"]
[Fri Jan 30 13:41:47.141753 2026] [:error] [pid 46914:tid 46986] [client 20.223.150.246:16552] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Jan 30 15:50:59.406749 2026] [:error] [pid 47021:tid 47039] [client 43.130.9.111:41674] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXxi49ap1k13UdZUNSQGngAAANA"]
[Fri Jan 30 20:32:08.550823 2026] [:error] [pid 24711:tid 24715] [client 182.43.70.143:58942] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXykyK5Gwh4var6T23KOngAAAUE"]
[Fri Jan 30 22:02:51.174280 2026] [:error] [pid 38686:tid 38691] [client 43.130.3.120:51724] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aXy6CwoE8BAjgw1_sAVyogAAAcE"]
[Sat Jan 31 02:46:00.532164 2026] [:error] [pid 59748:tid 59757] [client 170.106.192.208:44364] [client 170.106.192.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aXz8aGlxTen-ziDxotSY-AAAAMY"]
[Sat Jan 31 03:11:22.115735 2026] [:error] [pid 60001:tid 60022] [client 125.75.66.97:57321] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX0CWqM2ziQ7JN4IjDxosAAAARM"]
[Sat Jan 31 05:00:00.556830 2026] [:error] [pid 20836:tid 20864] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/thebe.php
[Sat Jan 31 05:00:00.825264 2026] [:error] [pid 20836:tid 20865] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Sat Jan 31 05:00:01.092778 2026] [:error] [pid 20836:tid 20843] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/sanity.php
[Sat Jan 31 05:00:01.543727 2026] [:error] [pid 20836:tid 20854] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/anj.php
[Sat Jan 31 05:00:01.812012 2026] [:error] [pid 20836:tid 20857] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/baixy.php
[Sat Jan 31 05:00:02.079893 2026] [:error] [pid 20836:tid 20847] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Sat Jan 31 05:00:02.361434 2026] [:error] [pid 20836:tid 20852] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Sat Jan 31 05:00:02.628508 2026] [:error] [pid 20836:tid 20860] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Sat Jan 31 05:00:02.896297 2026] [:error] [pid 20836:tid 20864] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/zmia.php
[Sat Jan 31 05:00:03.164273 2026] [:error] [pid 20836:tid 20848] [client 20.240.47.47:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/edorxrr.php
[Sat Jan 31 05:00:03.427908 2026] [:error] [pid 20836:tid 20856] [client 20.240.47.47:44639] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doko.php"] [unique_id "aX0b04ACllgWRWVrYITQfwAAAU8"]
[Sat Jan 31 05:00:08.550070 2026] [:error] [pid 39339:tid 39344] [client 20.240.47.47:45923] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doko.php"] [unique_id "aX0b2MWi-IjigR3oHY6KuQAAAMM"]
[Sat Jan 31 05:00:13.108514 2026] [:error] [pid 39243:tid 39305] [client 20.240.47.47:5583] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doko.php"] [unique_id "aX0b3RBW1k4JK8a4v0Y9DgAAAFc"]
[Sat Jan 31 05:00:15.583476 2026] [:error] [pid 39243:tid 39287] [client 20.240.47.47:39103] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doko.php"] [unique_id "aX0b3xBW1k4JK8a4v0Y9EAAAAEU"]
[Sat Jan 31 05:00:19.266610 2026] [:error] [pid 39243:tid 39303] [client 20.240.47.47:29462] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sst.php"] [unique_id "aX0b4xBW1k4JK8a4v0Y9EQAAAFU"]
[Sat Jan 31 05:00:20.606237 2026] [:error] [pid 39242:tid 39266] [client 20.240.47.47:44001] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sst.php"] [unique_id "aX0b5NOgXnkKGGSSCINiDAAAAAw"]
[Sat Jan 31 05:00:22.027513 2026] [:error] [pid 39243:tid 39282] [client 20.240.47.47:49318] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sst.php"] [unique_id "aX0b5hBW1k4JK8a4v0Y9FgAAAEA"]
[Sat Jan 31 05:00:24.177264 2026] [:error] [pid 20210:tid 20224] [client 20.240.47.47:44009] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sst.php"] [unique_id "aX0b6HKy7OGBlTY8MCengQAAAQw"]
[Sat Jan 31 05:00:27.529224 2026] [:error] [pid 20836:tid 20852] [client 20.240.47.47:5585] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/easy.php"] [unique_id "aX0b64ACllgWRWVrYITQtQAAAUs"]
[Sat Jan 31 05:00:28.968984 2026] [:error] [pid 39339:tid 39357] [client 20.240.47.47:16659] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/easy.php"] [unique_id "aX0b7MWi-IjigR3oHY6K0wAAANA"]
[Sat Jan 31 05:00:42.792583 2026] [:error] [pid 20836:tid 20864] [client 20.240.47.47:16672] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-rss4.php"] [unique_id "aX0b-oACllgWRWVrYITQygAAAVc"]
[Sat Jan 31 05:00:49.725812 2026] [:error] [pid 39339:tid 39356] [client 20.240.47.47:49299] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-rss4.php"] [unique_id "aX0cAcWi-IjigR3oHY6K9AAAAM8"]
[Sat Jan 31 05:00:57.047697 2026] [:error] [pid 39243:tid 39288] [client 20.240.47.47:26291] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nlvbr.php"] [unique_id "aX0cCRBW1k4JK8a4v0Y9PgAAAEY"]
[Sat Jan 31 05:01:02.342131 2026] [:error] [pid 20836:tid 20843] [client 20.240.47.47:26247] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nlvbr.php"] [unique_id "aX0cDoACllgWRWVrYITRCgAAAUI"]
[Sat Jan 31 05:01:04.854394 2026] [:error] [pid 20836:tid 20865] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/nlvbr.php
[Sat Jan 31 05:01:06.010823 2026] [:error] [pid 20836:tid 20850] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Sat Jan 31 05:01:06.714397 2026] [:error] [pid 20836:tid 20857] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/icoxp.php
[Sat Jan 31 05:01:06.980294 2026] [:error] [pid 20836:tid 20844] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Sat Jan 31 05:01:07.246064 2026] [:error] [pid 20836:tid 20859] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Sat Jan 31 05:01:07.522250 2026] [:error] [pid 20836:tid 20864] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Jan 31 05:01:07.917608 2026] [:error] [pid 20836:tid 20856] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Sat Jan 31 05:01:08.183816 2026] [:error] [pid 20836:tid 20863] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/tempae.php
[Sat Jan 31 05:01:08.450830 2026] [:error] [pid 20836:tid 20852] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/drfabyqp.php
[Sat Jan 31 05:01:08.737250 2026] [:error] [pid 20836:tid 20850] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sat Jan 31 05:01:09.021312 2026] [:error] [pid 20836:tid 20860] [client 20.240.47.47:49295] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sat Jan 31 05:01:09.284268 2026] [:error] [pid 20836:tid 20842] [client 20.240.47.47:49295] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "aX0cFYACllgWRWVrYITRKgAAAUE"]
[Sat Jan 31 05:01:12.648037 2026] [:error] [pid 39244:tid 39320] [client 20.240.47.47:29464] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "aX0cGHo-KRTvg3jHEDzLvgAAAIo"]
[Sat Jan 31 05:01:16.829816 2026] [:error] [pid 39339:tid 39359] [client 20.240.47.47:45889] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "aX0cHMWi-IjigR3oHY6LKwAAANI"]
[Sat Jan 31 05:01:21.287114 2026] [:error] [pid 39243:tid 39284] [client 20.240.47.47:5582] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "aX0cIRBW1k4JK8a4v0Y9cQAAAEI"]
[Sat Jan 31 05:01:27.518135 2026] [:error] [pid 39242:tid 39273] [client 20.240.47.47:36793] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bayss.php"] [unique_id "aX0cJ9OgXnkKGGSSCINiZgAAABM"]
[Sat Jan 31 05:01:38.136634 2026] [:error] [pid 20836:tid 20855] [client 20.240.47.47:36751] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1.php"] [unique_id "aX0cMoACllgWRWVrYITRcQAAAU4"]
[Sat Jan 31 05:01:39.675820 2026] [:error] [pid 20210:tid 20232] [client 20.240.47.47:29485] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1.php"] [unique_id "aX0cM3Ky7OGBlTY8MCeongAAARQ"]
[Sat Jan 31 05:01:42.511633 2026] [:error] [pid 39244:tid 39329] [client 20.240.47.47:5628] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1.php"] [unique_id "aX0cNno-KRTvg3jHEDzMAAAAAJM"]
[Sat Jan 31 05:01:48.042693 2026] [:error] [pid 39242:tid 39263] [client 20.240.47.47:44017] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w1.php"] [unique_id "aX0cPNOgXnkKGGSSCINioAAAAAk"]
[Sat Jan 31 05:01:49.671160 2026] [:error] [pid 39339:tid 39354] [client 20.240.47.47:45937] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dgdaolin.php"] [unique_id "aX0cPcWi-IjigR3oHY6LYAAAAM0"]
[Sat Jan 31 05:01:50.697415 2026] [:error] [pid 39242:tid 39269] [client 20.240.47.47:30739] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dgdaolin.php"] [unique_id "aX0cPtOgXnkKGGSSCINipgAAAA8"]
[Sat Jan 31 05:01:51.958800 2026] [:error] [pid 39339:tid 39362] [client 20.240.47.47:44030] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dgdaolin.php"] [unique_id "aX0cP8Wi-IjigR3oHY6LZgAAANU"]
[Sat Jan 31 05:01:53.558064 2026] [:error] [pid 20836:tid 20852] [client 20.240.47.47:49308] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dgdaolin.php"] [unique_id "aX0cQYACllgWRWVrYITRkgAAAUs"]
[Sat Jan 31 05:01:54.588988 2026] [:error] [pid 39243:tid 39294] [client 20.240.47.47:36749] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rrhbdzdz.php"] [unique_id "aX0cQhBW1k4JK8a4v0Y9qwAAAEw"]
[Sat Jan 31 05:02:00.674824 2026] [:error] [pid 39244:tid 39311] [client 20.240.47.47:39044] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rrhbdzdz.php"] [unique_id "aX0cSHo-KRTvg3jHEDzMEAAAAII"]
[Sat Jan 31 05:02:02.765082 2026] [:error] [pid 39339:tid 39350] [client 20.240.47.47:34235] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rrhbdzdz.php"] [unique_id "aX0cSsWi-IjigR3oHY6LdQAAAMk"]
[Sat Jan 31 05:02:04.867627 2026] [:error] [pid 39339:tid 39342] [client 20.240.47.47:16690] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rrhbdzdz.php"] [unique_id "aX0cTMWi-IjigR3oHY6LfgAAAME"]
[Sat Jan 31 05:02:06.510136 2026] [:error] [pid 39339:tid 39346] [client 20.240.47.47:45893] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aX0cTsWi-IjigR3oHY6LgwAAAMU"]
[Sat Jan 31 05:02:09.380567 2026] [:error] [pid 20210:tid 20226] [client 20.240.47.47:36798] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Sat Jan 31 12:13:14.542748 2026] [:error] [pid 52520:tid 52528] [client 3.127.203.41:33567] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sat Jan 31 14:08:28.608132 2026] [:error] [pid 8166:tid 8168] [client 43.153.74.75:45684] [client 43.153.74.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aX2cXFVdBgUeopOXLAfYNgAAAEA"]
[Sat Jan 31 15:40:16.671840 2026] [:error] [pid 31430:tid 31453] [client 43.138.68.113:60890] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX2x4Mcb14YPxXg_g5EbRAAAAFM"]
[Sat Jan 31 15:51:57.198449 2026] [:error] [pid 18773:tid 18778] [client 204.10.194.20:50420] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Jan 31 15:52:17.415057 2026] [:error] [pid 18803:tid 18819] [client 204.10.194.20:58068] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Jan 31 16:51:37.768922 2026] [:error] [pid 39242:tid 39255] [client 196.70.125.9:64864] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aX3CmdOgXnkKGGSSCIMQGgAAAAE"], referer: https://en.wikipedia.org/w/index.php?title=Python&action=edit
[Sat Jan 31 16:51:39.415990 2026] [:error] [pid 31465:tid 31510] [client 196.70.125.9:65516] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aX3CmzkaGp475ez0mlzA9wAAAlA"], referer: https://pypi.org/search/?q=data+visualization
[Sat Jan 31 16:51:41.076669 2026] [:error] [pid 59523:tid 59530] [client 196.70.125.9:50187] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "aX3CnZEkxOIGmVhqUWJeMQAAAwM"], referer: https://www.youtube.com/watch?v=abcdEFGHijk&feature=share
[Sat Jan 31 16:51:42.677010 2026] [:error] [pid 31465:tid 31495] [client 196.70.125.9:50939] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aX3CnjkaGp475ez0mlzBCQAAAkE"], referer: https://scholar.google.com/scholar?q=machine+learning+history
[Sat Jan 31 16:51:44.312999 2026] [:error] [pid 18803:tid 18826] [client 196.70.125.9:51590] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aX3CoC2kTcRk9EBIxOFczAAAAhQ"], referer: https://twitter.com/
[Sat Jan 31 16:51:45.906105 2026] [:error] [pid 18803:tid 18824] [client 196.70.125.9:52277] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "aX3CoS2kTcRk9EBIxOFczgAAAhI"], referer: https://search.yahoo.com/
[Sat Jan 31 16:51:47.511442 2026] [:error] [pid 31465:tid 31495] [client 196.70.125.9:52915] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "aX3CozkaGp475ez0mlzBEgAAAkE"], referer: https://www.reddit.com/r/aww/comments/abc456/cute_puppy/?utm_source=share&utm_medium=web2x
[Sat Jan 31 16:51:50.135053 2026] [:error] [pid 39242:tid 39274] [client 196.70.125.9:53623] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "aX3CptOgXnkKGGSSCIMQJwAAABQ"], referer: https://www.aliexpress.com/wholesale?SearchText=phone+case&catId=0
[Sat Jan 31 16:51:51.750646 2026] [:error] [pid 39339:tid 39341] [client 196.70.125.9:54775] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.example"] [unique_id "aX3Cp8Wi-IjigR3oHY5BCAAAAMA"], referer: https://www.ecosia.org/search?q=indoor+plant+care+tips
[Sat Jan 31 16:51:54.587126 2026] [:error] [pid 31465:tid 31511] [client 196.70.125.9:55482] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-config.php"] [unique_id "aX3CqjkaGp475ez0mlzBGQAAAlE"], referer: https://www.instagram.com/explore/tags/landscapephotography/
[Sat Jan 31 16:52:01.669769 2026] [:error] [pid 31465:tid 31497] [client 196.70.125.9:56646] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php, referer: https://www.startpage.com/sp/search?query=coffee+recipes
[Sat Jan 31 16:52:02.204479 2026] [:error] [pid 31465:tid 31507] [client 196.70.125.9:56646] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-config.php"] [unique_id "aX3CsjkaGp475ez0mlzBMAAAAk0"], referer: https://m.facebook.com/
[Sat Jan 31 16:52:06.641922 2026] [:error] [pid 39339:tid 39347] [client 196.70.125.9:59283] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/config.ini"] [unique_id "aX3CtsWi-IjigR3oHY5BGwAAAMY"], referer: https://search.yahoo.com/
[Sat Jan 31 16:52:07.189522 2026] [:error] [pid 39339:tid 39348] [client 196.70.125.9:59283] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/web.config"] [unique_id "aX3Ct8Wi-IjigR3oHY5BHQAAAMc"], referer: https://github.com/
[Sat Jan 31 16:52:09.524042 2026] [:error] [pid 39339:tid 39343] [client 196.70.125.9:61472] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".config"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/app.config"] [unique_id "aX3CucWi-IjigR3oHY5BIQAAAMI"], referer: https://en.wikipedia.org/w/index.php?title=Python&action=edit
[Sat Jan 31 16:52:18.834184 2026] [:error] [pid 18803:tid 18811] [client 196.70.125.9:49890] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aX3Cwi2kTcRk9EBIxOFc5QAAAgU"], referer: https://www.aliexpress.com/wholesale?SearchText=phone+case&catId=0
[Sat Jan 31 16:52:19.760142 2026] [:error] [pid 39242:tid 39277] [client 196.70.125.9:50401] [client 196.70.125.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aX3Cw9OgXnkKGGSSCIMQTgAAABc"], referer: https://www.qwant.com/
[Sat Jan 31 22:12:56.327124 2026] [:error] [pid 39339:tid 39351] [client 123.187.240.242:44674] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aX4N6MWi-IjigR3oHY6OiwAAAMo"]
[Sun Feb 01 04:33:56.134530 2026] [:error] [pid 10506:tid 10537] [client 106.227.49.113:38926] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX5nNK32IC2Db4uwFyOAsQAAABU"]
[Sun Feb 01 14:57:23.787974 2026] [:error] [pid 2033:tid 2042] [client 43.159.135.203:36304] [client 43.159.135.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX75U_F7B4oR5nK3T_O99wAAAQc"]
[Sun Feb 01 15:55:19.816879 2026] [:error] [pid 10616:tid 10630] [client 94.72.115.194:63084] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Sun Feb 01 21:11:26.836798 2026] [:error] [pid 51610:tid 51633] [client 43.135.186.135:59476] [client 43.135.186.135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX9Q_t7GFdNFAqImMQAlgwAAAVM"]
[Mon Feb 02 01:35:25.292323 2026] [:error] [pid 8877:tid 8890] [client 104.28.203.58:37970] [client 104.28.203.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aX-O3VjWRgIEkmjg6ouoDwAAAsk"]
[Mon Feb 02 04:48:03.467238 2026] [:error] [pid 63034:tid 63122] [client 45.92.229.243:51935] [client 45.92.229.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX-8A-KXlgw75_wfbHoRwgAAAIQ"]
[Mon Feb 02 04:48:04.065760 2026] [:error] [pid 63153:tid 63167] [client 45.130.83.177:39895] [client 45.130.83.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.130.83.177, counter = 10"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX-8BHC9GXHnmLkdgdmjfAAAAMY"]
[Mon Feb 02 09:26:52.747594 2026] [:error] [pid 46008:tid 46013] [client 43.135.140.225:44294] [client 43.135.140.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aX_9XCRa52iYn7SlSMkVzgAAAUM"]
[Mon Feb 02 12:50:08.636984 2026] [:error] [pid 56989:tid 57013] [client 43.173.1.57:58208] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYAtAEp44HnChN-GZliFfAAAAhY"]
[Mon Feb 02 15:22:36.201070 2026] [:error] [pid 33612:tid 33625] [client 43.166.246.180:47164] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYBQvMtFn80qQEmo5QrMZQAAAQs"]
[Mon Feb 02 18:46:25.043136 2026] [:error] [pid 46008:tid 46011] [client 49.51.203.164:45940] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYCAgSRa52iYn7SlSMmSqQAAAUE"]
[Mon Feb 02 19:53:36.386422 2026] [:error] [pid 56989:tid 57008] [client 35.196.123.152:64774] [client 35.196.123.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.196.123.152, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aYCQQEp44HnChN-GZlgGpAAAAhE"]
[Mon Feb 02 19:53:36.392996 2026] [:error] [pid 56989:tid 57008] [client 35.196.123.152:64774] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 02 19:53:38.917776 2026] [:error] [pid 56989:tid 57010] [client 35.196.123.152:64774] [client 35.196.123.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aYCQQkp44HnChN-GZlgGsgAAAhM"]
[Mon Feb 02 19:53:39.362433 2026] [:error] [pid 57080:tid 57107] [client 35.196.123.152:64447] [client 35.196.123.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aYCQQ49Utn0ZlfnF10NU4wAAAtQ"]
[Mon Feb 02 19:53:39.802789 2026] [:error] [pid 56989:tid 57006] [client 35.196.123.152:53342] [client 35.196.123.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aYCQQ0p44HnChN-GZlgGswAAAg8"]
[Mon Feb 02 19:53:40.268696 2026] [:error] [pid 63032:tid 63077] [client 35.196.123.152:59159] [client 35.196.123.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aYCQRHyEQ1PkpebvdRjdlAAAAA4"]
[Mon Feb 02 19:53:40.694734 2026] [:error] [pid 63153:tid 63165] [client 35.196.123.152:57246] [client 35.196.123.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aYCQRHC9GXHnmLkdgdl-rwAAAMQ"]
[Mon Feb 02 19:53:41.140747 2026] [:error] [pid 57022:tid 57068] [client 35.196.123.152:58210] [client 35.196.123.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aYCQRRnEgLMzfcurxflGZQAAApA"]
[Mon Feb 02 19:53:41.559780 2026] [:error] [pid 57021:tid 57041] [client 35.196.123.152:61936] [client 35.196.123.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aYCQRf7AEpx7VcmYK3H3FAAAAlA"]
[Mon Feb 02 21:26:55.212005 2026] [:error] [pid 63034:tid 63134] [client 4.194.216.14:26838] [client 4.194.216.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aYCmH-KXlgw75_wfbHroQAAAAJA"]
[Mon Feb 02 21:26:55.393489 2026] [:error] [pid 57022:tid 57072] [client 4.194.216.14:33055] [client 4.194.216.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aYCmHxnEgLMzfcurxflVQQAAApQ"]
[Mon Feb 02 21:26:55.584668 2026] [:error] [pid 57021:tid 57037] [client 4.194.216.14:48491] [client 4.194.216.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aYCmH_7AEpx7VcmYK3EGqAAAAkw"]
[Mon Feb 02 21:26:55.783968 2026] [:error] [pid 46008:tid 46025] [client 4.194.216.14:30159] [client 4.194.216.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aYCmHyRa52iYn7SlSMmuVQAAAU4"]
[Mon Feb 02 22:38:13.585898 2026] [:error] [pid 63153:tid 63167] [client 136.118.211.156:51184] [client 136.118.211.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.118.211.156, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aYC21XC9GXHnmLkdgdmzugAAAMY"]
[Mon Feb 02 22:38:13.589961 2026] [:error] [pid 63153:tid 63167] [client 136.118.211.156:51184] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Feb 02 22:38:15.668781 2026] [:error] [pid 63153:tid 63172] [client 136.118.211.156:51184] [client 136.118.211.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aYC213C9GXHnmLkdgdmzxQAAAMs"]
[Mon Feb 02 22:38:16.029176 2026] [:error] [pid 63153:tid 63165] [client 136.118.211.156:62629] [client 136.118.211.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aYC22HC9GXHnmLkdgdmzxgAAAMQ"]
[Mon Feb 02 22:38:16.392127 2026] [:error] [pid 33612:tid 33638] [client 136.118.211.156:49219] [client 136.118.211.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aYC22MtFn80qQEmo5QoZGAAAARg"]
[Mon Feb 02 22:38:16.754056 2026] [:error] [pid 33612:tid 33632] [client 136.118.211.156:52131] [client 136.118.211.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aYC22MtFn80qQEmo5QoZGQAAARI"]
[Mon Feb 02 22:38:17.192339 2026] [:error] [pid 57021:tid 57029] [client 136.118.211.156:50436] [client 136.118.211.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aYC22f7AEpx7VcmYK3ESsQAAAkQ"]
[Mon Feb 02 22:38:17.559150 2026] [:error] [pid 33612:tid 33619] [client 136.118.211.156:63726] [client 136.118.211.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aYC22ctFn80qQEmo5QoZGgAAAQU"]
[Mon Feb 02 22:38:17.945704 2026] [:error] [pid 57022:tid 57054] [client 136.118.211.156:61764] [client 136.118.211.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aYC22RnEgLMzfcurxflg2QAAAoI"]
[Tue Feb 03 00:18:18.967136 2026] [:error] [pid 63153:tid 63173] [client 34.29.171.82:62654] [client 34.29.171.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.171.82, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aYDOSnC9GXHnmLkdgdnR6AAAAMw"]
[Tue Feb 03 00:18:18.970839 2026] [:error] [pid 63153:tid 63173] [client 34.29.171.82:62654] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Feb 03 00:18:21.314736 2026] [:error] [pid 63153:tid 63173] [client 34.29.171.82:62654] [client 34.29.171.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aYDOTXC9GXHnmLkdgdnR-QAAAMw"]
[Tue Feb 03 00:18:21.769418 2026] [:error] [pid 33612:tid 33631] [client 34.29.171.82:59211] [client 34.29.171.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aYDOTctFn80qQEmo5QooSwAAARE"]
[Tue Feb 03 00:18:22.247592 2026] [:error] [pid 63153:tid 63172] [client 34.29.171.82:64668] [client 34.29.171.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aYDOTnC9GXHnmLkdgdnR_AAAAMs"]
[Tue Feb 03 00:18:22.696128 2026] [:error] [pid 33612:tid 33630] [client 34.29.171.82:49858] [client 34.29.171.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aYDOTstFn80qQEmo5QooTAAAARA"]
[Tue Feb 03 00:18:23.175770 2026] [:error] [pid 63034:tid 63132] [client 34.29.171.82:64331] [client 34.29.171.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aYDOT-KXlgw75_wfbHoJQQAAAI4"]
[Tue Feb 03 00:18:23.684769 2026] [:error] [pid 63034:tid 63134] [client 34.29.171.82:61304] [client 34.29.171.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aYDOT-KXlgw75_wfbHoJRAAAAJA"]
[Tue Feb 03 00:18:24.227591 2026] [:error] [pid 63032:tid 63079] [client 34.29.171.82:60237] [client 34.29.171.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aYDOUHyEQ1PkpebvdRgTYAAAABA"]
[Tue Feb 03 00:22:09.539793 2026] [:error] [pid 63034:tid 63131] [client 35.190.153.163:55172] [client 35.190.153.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aYDPMeKXlgw75_wfbHoJzwAAAI0"]
[Tue Feb 03 00:27:04.690787 2026] [:error] [pid 63153:tid 63174] [client 43.135.134.127:60490] [client 43.135.134.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYDQWHC9GXHnmLkdgdnUVwAAAM0"]
[Tue Feb 03 03:15:22.837459 2026] [:error] [pid 56989:tid 57012] [client 119.96.24.54:55594] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYD3ykp44HnChN-GZlhtgwAAAhU"]
[Tue Feb 03 06:13:33.257676 2026] [:error] [pid 42922:tid 42989] [client 43.153.10.13:47656] [client 43.153.10.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYEhjWazX4WPS_dQRkiq7gAAAIQ"]
[Tue Feb 03 08:43:31.480151 2026] [:error] [pid 28720:tid 28738] [client 43.130.9.111:44668] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYFEs2mRXm2bmr_sYiYG0wAAARA"]
[Tue Feb 03 12:27:07.382252 2026] [:error] [pid 42921:tid 42958] [client 37.27.119.185:51628] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYF5G4blShffGl-01of8eQAAAEA"], referer: https://www.bbc.com
[Tue Feb 03 12:27:08.088945 2026] [:error] [pid 5229:tid 5249] [client 37.27.119.185:52189] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYF5HEKmEgmJub93yUo20AAAAZI"], referer: https://www.wikipedia.org
[Tue Feb 03 17:45:55.177399 2026] [:error] [pid 5148:tid 5159] [client 52.155.110.228:44089] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Feb 03 18:16:28.494561 2026] [:error] [pid 5229:tid 5234] [client 20.205.110.134:23417] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Feb 03 18:25:50.093168 2026] [:error] [pid 28720:tid 28730] [client 104.248.207.115:55437] [client 104.248.207.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.207.115, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aYHNLmmRXm2bmr_sYiaoOgAAAQg"]
[Tue Feb 03 18:25:50.097288 2026] [:error] [pid 28720:tid 28730] [client 104.248.207.115:55437] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Feb 03 19:38:16.202703 2026] [:error] [pid 43028:tid 43047] [client 52.155.110.228:45197] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Feb 03 23:49:35.323293 2026] [:error] [pid 5148:tid 5175] [client 43.130.131.18:52170] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYIZD783HCHLtUIbS7IaTgAAAVg"]
[Wed Feb 04 06:24:28.633326 2026] [:error] [pid 47676:tid 47683] [client 49.235.136.28:37420] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYJ1nArYSkTgZEfUDqF6mwAAAMU"]
[Wed Feb 04 12:21:50.328205 2026] [:error] [pid 47404:tid 47424] [client 43.153.48.240:44928] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYLJXltGjJnGFKjTTuaaxgAAAI4"]
[Wed Feb 04 14:54:11.729331 2026] [:error] [pid 8285:tid 8295] [client 43.130.31.17:58786] [client 43.130.31.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYLtExpweS7ndDaunz-b-QAAAEg"]
[Wed Feb 04 18:06:12.422019 2026] [:error] [pid 47500:tid 47517] [client 43.153.48.240:38406] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYMaFLrUat0rhPdY3A3mjAAAAU0"]
[Wed Feb 04 20:23:17.492670 2026] [:error] [pid 47404:tid 47410] [client 43.165.190.5:57586] [client 43.165.190.5] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYM6NVtGjJnGFKjTTuYnhAAAAIA"]
[Wed Feb 04 23:40:12.403456 2026] [:error] [pid 63686:tid 63751] [client 43.159.145.153:51970] [client 43.159.145.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYNoXByaRl9O5jmngTz6wwAAAQg"]
[Thu Feb 05 02:18:07.790281 2026] [:error] [pid 26443:tid 26452] [client 150.109.230.210:56620] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYONX9RUJ4b_jBAfhPKCawAAAUc"]
[Thu Feb 05 02:56:04.944920 2026] [:error] [pid 63685:tid 63734] [client 217.77.10.74:57062] [client 217.77.10.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aYOWRI6Dyg716yRb8FC_4gAAANI"]
[Thu Feb 05 09:24:54.136211 2026] [:error] [pid 50624:tid 50631] [client 43.130.3.120:52728] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYPxZtICUaNaYRCGlHJHPgAAAQQ"]
[Thu Feb 05 12:50:47.242070 2026] [:error] [pid 31739:tid 31749] [client 43.130.57.76:57564] [client 43.130.57.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYQhpwGrHl_5BvMstJJXsgAAAAg"]
[Thu Feb 05 18:47:24.968299 2026] [:error] [pid 19213:tid 19239] [client 43.133.14.237:38374] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYR1PF7WBXhXgHKWAIBOsAAAAdU"]
[Fri Feb 06 02:38:48.611279 2026] [:error] [pid 64116:tid 64143] [client 20.78.154.212:8438] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Feb 06 04:15:56.623988 2026] [:error] [pid 1665:tid 1751] [client 110.166.71.39:49991] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYT6fDYZLE6gThXvZMqDtAAAAJg"]
[Fri Feb 06 08:48:16.840738 2026] [:error] [pid 1665:tid 1749] [client 20.220.62.160:48491] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Feb 06 14:41:46.603740 2026] [:error] [pid 3380:tid 3392] [client 3.36.47.30:33252] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aYWNKhFAlUvBGSBK2jfgpgAAAAg"]
[Fri Feb 06 14:41:47.201643 2026] [:error] [pid 3513:tid 3532] [client 3.36.47.30:33256] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/HEAD"] [unique_id "aYWNKzSw3-HAlzpqSxxdOQAAAVE"]
[Fri Feb 06 14:41:47.800308 2026] [:error] [pid 3382:tid 3448] [client 3.36.47.30:33268] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/credentials"] [unique_id "aYWNK8IgU1HR0rhYrE_LjQAAAIg"]
[Fri Feb 06 14:41:48.404300 2026] [:error] [pid 3513:tid 3526] [client 3.36.47.30:33270] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config.bak"] [unique_id "aYWNLDSw3-HAlzpqSxxdOwAAAUs"]
[Fri Feb 06 14:41:49.003398 2026] [:error] [pid 3381:tid 3421] [client 3.36.47.30:33272] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config.old"] [unique_id "aYWNLS81zqRg96ZREgjvgQAAAEg"]
[Fri Feb 06 14:41:55.633720 2026] [:error] [pid 3477:tid 3484] [client 3.36.47.30:41094] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aYWNM7L0Hdh40C7HYgXwogAAAMU"]
[Fri Feb 06 14:41:56.238360 2026] [:error] [pid 3513:tid 3534] [client 3.36.47.30:41100] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "aYWNNDSw3-HAlzpqSxxdTAAAAVM"]
[Fri Feb 06 14:41:56.835195 2026] [:error] [pid 3513:tid 3529] [client 3.36.47.30:41106] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "aYWNNDSw3-HAlzpqSxxdTwAAAU4"]
[Fri Feb 06 14:41:57.434262 2026] [:error] [pid 3513:tid 3516] [client 3.36.47.30:41110] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aYWNNTSw3-HAlzpqSxxdUgAAAUE"]
[Fri Feb 06 14:41:58.029834 2026] [:error] [pid 3382:tid 3445] [client 3.36.47.30:41118] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "aYWNNsIgU1HR0rhYrE_LnwAAAIU"]
[Fri Feb 06 14:41:58.628436 2026] [:error] [pid 3477:tid 3503] [client 3.36.47.30:41124] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aYWNNrL0Hdh40C7HYgXwqAAAANg"]
[Fri Feb 06 14:41:59.226014 2026] [:error] [pid 3380:tid 3405] [client 3.36.47.30:41126] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "aYWNNxFAlUvBGSBK2jfgxwAAABU"]
[Fri Feb 06 14:41:59.823839 2026] [:error] [pid 3381:tid 3430] [client 3.36.47.30:41138] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "aYWNNy81zqRg96ZREgjvnAAAAFE"]
[Fri Feb 06 14:42:00.422802 2026] [:error] [pid 3382:tid 3463] [client 3.36.47.30:41150] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dist"] [unique_id "aYWNOMIgU1HR0rhYrE_LowAAAJc"]
[Fri Feb 06 14:42:01.024005 2026] [:error] [pid 3513:tid 3529] [client 3.36.47.30:41164] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aYWNOTSw3-HAlzpqSxxdWQAAAU4"]
[Fri Feb 06 14:42:01.624305 2026] [:error] [pid 3381:tid 3413] [client 3.36.47.30:41180] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.php"] [unique_id "aYWNOS81zqRg96ZREgjvpQAAAEA"]
[Fri Feb 06 14:42:02.225261 2026] [:error] [pid 3380:tid 3399] [client 3.36.47.30:41194] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.example"] [unique_id "aYWNOhFAlUvBGSBK2jfg1AAAAA8"]
[Fri Feb 06 14:42:02.826882 2026] [:error] [pid 3513:tid 3520] [client 3.36.47.30:41198] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.sample"] [unique_id "aYWNOjSw3-HAlzpqSxxdXQAAAUU"]
[Fri Feb 06 14:42:03.427773 2026] [:error] [pid 3477:tid 3494] [client 3.36.47.30:41206] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev"] [unique_id "aYWNO7L0Hdh40C7HYgXwswAAAM8"]
[Fri Feb 06 14:42:04.024048 2026] [:error] [pid 3380:tid 3400] [client 3.36.47.30:41220] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.prod"] [unique_id "aYWNPBFAlUvBGSBK2jfg3QAAABA"]
[Fri Feb 06 14:42:04.621771 2026] [:error] [pid 3380:tid 3384] [client 3.36.47.30:41232] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.stage"] [unique_id "aYWNPBFAlUvBGSBK2jfg4QAAAAA"]
[Fri Feb 06 14:42:05.218821 2026] [:error] [pid 3513:tid 3529] [client 3.36.47.30:41242] [client 3.36.47.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.live"] [unique_id "aYWNPTSw3-HAlzpqSxxdYgAAAU4"]
[Fri Feb 06 14:42:06.420146 2026] [:error] [pid 3477:tid 3491] [client 3.36.47.30:41740] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bitbucket_keys.json"] [unique_id "aYWNPrL0Hdh40C7HYgXwuQAAAMw"]
[Fri Feb 06 14:42:07.017366 2026] [:error] [pid 3380:tid 3398] [client 3.36.47.30:41742] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.bitbucket_keys"] [unique_id "aYWNPxFAlUvBGSBK2jfg5gAAAA4"]
[Fri Feb 06 14:42:07.614088 2026] [:error] [pid 3477:tid 3503] [client 3.36.47.30:41750] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php"] [unique_id "aYWNP7L0Hdh40C7HYgXwvAAAANg"]
[Fri Feb 06 14:42:08.213067 2026] [:error] [pid 3380:tid 3399] [client 3.36.47.30:41758] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aYWNQBFAlUvBGSBK2jfg7AAAAA8"]
[Fri Feb 06 14:42:08.813909 2026] [:error] [pid 3381:tid 3420] [client 3.36.47.30:41762] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "aYWNQC81zqRg96ZREgjvqwAAAEc"]
[Fri Feb 06 14:42:09.410472 2026] [:error] [pid 3513:tid 3528] [client 3.36.47.30:41770] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php.php"] [unique_id "aYWNQTSw3-HAlzpqSxxdbAAAAU0"]
[Fri Feb 06 14:42:10.005928 2026] [:error] [pid 3477:tid 3487] [client 3.36.47.30:41784] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php.bak"] [unique_id "aYWNQrL0Hdh40C7HYgXwwgAAAMg"]
[Fri Feb 06 14:42:10.606979 2026] [:error] [pid 3381:tid 3435] [client 3.36.47.30:41794] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/phpinfo.php"] [unique_id "aYWNQi81zqRg96ZREgjvsgAAAFY"]
[Fri Feb 06 14:42:11.202759 2026] [:error] [pid 3513:tid 3525] [client 3.36.47.30:41802] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/info.php"] [unique_id "aYWNQzSw3-HAlzpqSxxdcgAAAUo"]
[Fri Feb 06 14:42:11.800685 2026] [:error] [pid 3477:tid 3491] [client 3.36.47.30:41810] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/phpinfo.php"] [unique_id "aYWNQ7L0Hdh40C7HYgXwxgAAAMw"]
[Fri Feb 06 14:42:12.400445 2026] [:error] [pid 3382:tid 3453] [client 3.36.47.30:41822] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server.php"] [unique_id "aYWNRMIgU1HR0rhYrE_LugAAAI0"]
[Fri Feb 06 14:42:13.000868 2026] [:error] [pid 3477:tid 3493] [client 3.36.47.30:41828] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug.php"] [unique_id "aYWNRLL0Hdh40C7HYgXwywAAAM4"]
[Fri Feb 06 14:42:13.599897 2026] [:error] [pid 3513:tid 3532] [client 3.36.47.30:41832] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php_info.php"] [unique_id "aYWNRTSw3-HAlzpqSxxddgAAAVE"]
[Fri Feb 06 14:42:14.197384 2026] [:error] [pid 3477:tid 3491] [client 3.36.47.30:41836] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/testphp.php"] [unique_id "aYWNRrL0Hdh40C7HYgXw1QAAAMw"]
[Fri Feb 06 14:42:14.799284 2026] [:error] [pid 3477:tid 3488] [client 3.36.47.30:41842] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/probe.php"] [unique_id "aYWNRrL0Hdh40C7HYgXw2wAAAMk"]
[Fri Feb 06 14:42:15.397842 2026] [:error] [pid 3381:tid 3413] [client 3.36.47.30:42542] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/check.php"] [unique_id "aYWNRy81zqRg96ZREgjvtQAAAEA"]
[Fri Feb 06 14:42:15.996788 2026] [:error] [pid 3513:tid 3520] [client 3.36.47.30:42548] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/phpinfo.php"] [unique_id "aYWNRzSw3-HAlzpqSxxdegAAAUU"]
[Fri Feb 06 14:42:16.596363 2026] [:error] [pid 3382:tid 3460] [client 3.36.47.30:42562] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/info.php"] [unique_id "aYWNSMIgU1HR0rhYrE_LwAAAAJQ"]
[Fri Feb 06 14:42:17.195969 2026] [:error] [pid 3381:tid 3419] [client 3.36.47.30:42574] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo"] [unique_id "aYWNSS81zqRg96ZREgjvvQAAAEY"]
[Fri Feb 06 14:42:17.796675 2026] [:error] [pid 3380:tid 3408] [client 3.36.47.30:42584] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info"] [unique_id "aYWNSRFAlUvBGSBK2jfg9wAAABg"]
[Fri Feb 06 14:42:18.399244 2026] [:error] [pid 3513:tid 3524] [client 3.36.47.30:42598] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test"] [unique_id "aYWNSjSw3-HAlzpqSxxdgQAAAUk"]
[Fri Feb 06 14:42:18.996325 2026] [:error] [pid 3380:tid 3403] [client 3.36.47.30:42606] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php"] [unique_id "aYWNShFAlUvBGSBK2jfg_QAAABM"]
[Fri Feb 06 14:42:19.592722 2026] [:error] [pid 3477:tid 3479] [client 3.36.47.30:42608] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.bak"] [unique_id "aYWNS7L0Hdh40C7HYgXw5AAAAMA"]
[Fri Feb 06 14:42:20.189688 2026] [:error] [pid 3513:tid 3531] [client 3.36.47.30:42610] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/phpinfo"] [unique_id "aYWNTDSw3-HAlzpqSxxdiAAAAVA"]
[Fri Feb 06 14:42:20.788614 2026] [:error] [pid 3381:tid 3436] [client 3.36.47.30:42622] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/info"] [unique_id "aYWNTC81zqRg96ZREgjvzQAAAFc"]
[Fri Feb 06 14:42:21.384863 2026] [:error] [pid 3513:tid 3537] [client 3.36.47.30:42638] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/phpinfo"] [unique_id "aYWNTTSw3-HAlzpqSxxdjQAAAVY"]
[Fri Feb 06 14:42:22.006710 2026] [:error] [pid 3381:tid 3431] [client 3.36.47.30:42648] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server"] [unique_id "aYWNTi81zqRg96ZREgjv1AAAAFI"]
[Fri Feb 06 14:42:22.603864 2026] [:error] [pid 3477:tid 3485] [client 3.36.47.30:42658] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/debug"] [unique_id "aYWNTrL0Hdh40C7HYgXw8gAAAMY"]
[Fri Feb 06 14:42:23.201718 2026] [:error] [pid 3381:tid 3430] [client 3.36.47.30:42672] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php_info"] [unique_id "aYWNTy81zqRg96ZREgjv3AAAAFE"]
[Fri Feb 06 14:42:23.800381 2026] [:error] [pid 3381:tid 3435] [client 3.36.47.30:42688] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/testphp"] [unique_id "aYWNTy81zqRg96ZREgjv4QAAAFY"]
[Fri Feb 06 14:42:24.399143 2026] [:error] [pid 3513:tid 3525] [client 3.36.47.30:42694] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/probe"] [unique_id "aYWNUDSw3-HAlzpqSxxdmAAAAUo"]
[Fri Feb 06 14:42:25.001111 2026] [:error] [pid 3513:tid 3531] [client 3.36.47.30:42698] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/check"] [unique_id "aYWNUDSw3-HAlzpqSxxdmgAAAVA"]
[Fri Feb 06 14:42:25.600871 2026] [:error] [pid 3380:tid 3400] [client 3.36.47.30:38318] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/phpinfo"] [unique_id "aYWNURFAlUvBGSBK2jfhIgAAABA"]
[Fri Feb 06 14:42:26.200002 2026] [:error] [pid 3513:tid 3537] [client 3.36.47.30:38320] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/info"] [unique_id "aYWNUjSw3-HAlzpqSxxdoAAAAVY"]
[Fri Feb 06 14:42:26.798048 2026] [:error] [pid 3381:tid 3418] [client 3.36.47.30:38326] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php.old"] [unique_id "aYWNUi81zqRg96ZREgjv9QAAAEU"]
[Fri Feb 06 14:42:27.393593 2026] [:error] [pid 3513:tid 3530] [client 3.36.47.30:38330] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_profiler/phpinfo"] [unique_id "aYWNUzSw3-HAlzpqSxxdpwAAAU8"]
[Fri Feb 06 14:42:27.992404 2026] [:error] [pid 3381:tid 3415] [client 3.36.47.30:38338] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpanel/phpinfo.php"] [unique_id "aYWNUy81zqRg96ZREgjv_QAAAEI"]
[Fri Feb 06 14:42:28.592925 2026] [:error] [pid 3477:tid 3492] [client 3.36.47.30:38344] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/www/phpinfo.php"] [unique_id "aYWNVLL0Hdh40C7HYgXxGQAAAM0"]
[Fri Feb 06 14:42:29.191322 2026] [:error] [pid 3513:tid 3518] [client 3.36.47.30:38358] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web/phpinfo.php"] [unique_id "aYWNVTSw3-HAlzpqSxxdrQAAAUM"]
[Fri Feb 06 14:42:29.787635 2026] [:error] [pid 3382:tid 3441] [client 3.36.47.30:38372] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server/phpinfo.php"] [unique_id "aYWNVcIgU1HR0rhYrE_LzwAAAIE"]
[Fri Feb 06 14:42:30.383145 2026] [:error] [pid 3381:tid 3435] [client 3.36.47.30:38376] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info2.php"] [unique_id "aYWNVi81zqRg96ZREgjwAgAAAFY"]
[Fri Feb 06 14:42:30.980932 2026] [:error] [pid 3381:tid 3431] [client 3.36.47.30:38390] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info1.php"] [unique_id "aYWNVi81zqRg96ZREgjwAwAAAFI"]
[Fri Feb 06 14:42:31.578186 2026] [:error] [pid 3380:tid 3398] [client 3.36.47.30:38392] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info3.php"] [unique_id "aYWNVxFAlUvBGSBK2jfhMwAAAA4"]
[Fri Feb 06 14:42:32.176728 2026] [:error] [pid 3513:tid 3535] [client 3.36.47.30:38404] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php-info.php"] [unique_id "aYWNWDSw3-HAlzpqSxxdtgAAAVQ"]
[Fri Feb 06 14:42:32.774767 2026] [:error] [pid 3513:tid 3521] [client 3.36.47.30:38412] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phptest.php"] [unique_id "aYWNWDSw3-HAlzpqSxxduAAAAUY"]
[Fri Feb 06 14:42:33.370741 2026] [:error] [pid 3381:tid 3416] [client 3.36.47.30:38414] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpversion.php"] [unique_id "aYWNWS81zqRg96ZREgjwBgAAAEM"]
[Fri Feb 06 14:42:33.967222 2026] [:error] [pid 3513:tid 3522] [client 3.36.47.30:38426] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php_version.php"] [unique_id "aYWNWTSw3-HAlzpqSxxdugAAAUc"]
[Fri Feb 06 14:42:34.567140 2026] [:error] [pid 3380:tid 3384] [client 3.36.47.30:38432] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/serverinfo.php"] [unique_id "aYWNWhFAlUvBGSBK2jfhOQAAAAA"]
[Fri Feb 06 14:42:35.162854 2026] [:error] [pid 3477:tid 3485] [client 3.36.47.30:38446] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_debug"] [unique_id "aYWNW7L0Hdh40C7HYgXxIQAAAMY"]
[Fri Feb 06 14:42:35.757561 2026] [:error] [pid 3382:tid 3460] [client 3.36.47.30:46208] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pi.php"] [unique_id "aYWNW8IgU1HR0rhYrE_L1gAAAJQ"]
[Fri Feb 06 14:42:36.356428 2026] [:error] [pid 3380:tid 3398] [client 3.36.47.30:46222] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aYWNXBFAlUvBGSBK2jfhPQAAAA4"]
[Fri Feb 06 14:42:36.953770 2026] [:error] [pid 3380:tid 3392] [client 3.36.47.30:46236] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aYWNXBFAlUvBGSBK2jfhPwAAAAg"]
[Fri Feb 06 14:42:37.552600 2026] [:error] [pid 3380:tid 3393] [client 3.36.47.30:46252] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aYWNXRFAlUvBGSBK2jfhQQAAAAk"]
[Fri Feb 06 14:42:38.150820 2026] [:error] [pid 3380:tid 3397] [client 3.36.47.30:46254] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aYWNXhFAlUvBGSBK2jfhRAAAAA0"]
[Fri Feb 06 14:42:38.749063 2026] [:error] [pid 3382:tid 3459] [client 3.36.47.30:46256] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aYWNXsIgU1HR0rhYrE_L3gAAAJM"]
[Fri Feb 06 14:42:39.346685 2026] [:error] [pid 3477:tid 3503] [client 3.36.47.30:46258] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aYWNX7L0Hdh40C7HYgXxJgAAANg"]
[Fri Feb 06 14:42:39.944444 2026] [:error] [pid 3380:tid 3390] [client 3.36.47.30:46264] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/diagnostic.php"] [unique_id "aYWNXxFAlUvBGSBK2jfhRwAAAAY"]
[Fri Feb 06 14:42:40.544587 2026] [:error] [pid 3381:tid 3415] [client 3.36.47.30:46268] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.txt"] [unique_id "aYWNYC81zqRg96ZREgjwFQAAAEI"]
[Fri Feb 06 14:42:41.139239 2026] [:error] [pid 3380:tid 3403] [client 3.36.47.30:46274] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.txt"] [unique_id "aYWNYRFAlUvBGSBK2jfhSQAAABM"]
[Fri Feb 06 14:42:41.736632 2026] [:error] [pid 3380:tid 3386] [client 3.36.47.30:46282] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.html"] [unique_id "aYWNYRFAlUvBGSBK2jfhTAAAAAI"]
[Fri Feb 06 14:42:42.333736 2026] [:error] [pid 3381:tid 3419] [client 3.36.47.30:46288] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.html"] [unique_id "aYWNYi81zqRg96ZREgjwGQAAAEY"]
[Fri Feb 06 14:42:42.929629 2026] [:error] [pid 3513:tid 3518] [client 3.36.47.30:46296] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php~"] [unique_id "aYWNYjSw3-HAlzpqSxxdzQAAAUM"]
[Fri Feb 06 14:42:43.526558 2026] [:error] [pid 3477:tid 3491] [client 3.36.47.30:46310] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php.save"] [unique_id "aYWNY7L0Hdh40C7HYgXxMwAAAMw"]
[Fri Feb 06 14:42:44.124718 2026] [:error] [pid 3477:tid 3488] [client 3.36.47.30:46320] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/info.php"] [unique_id "aYWNZLL0Hdh40C7HYgXxOQAAAMk"]
[Fri Feb 06 14:42:44.723769 2026] [:error] [pid 3382:tid 3461] [client 3.36.47.30:46330] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/phpinfo.php"] [unique_id "aYWNZMIgU1HR0rhYrE_L5wAAAJU"]
[Fri Feb 06 14:42:45.324922 2026] [:error] [pid 3380:tid 3404] [client 3.36.47.30:56814] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/phpinfo.php"] [unique_id "aYWNZRFAlUvBGSBK2jfhVAAAABQ"]
[Fri Feb 06 14:42:45.925919 2026] [:error] [pid 3380:tid 3396] [client 3.36.47.30:56828] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v1/phpinfo.php"] [unique_id "aYWNZRFAlUvBGSBK2jfhVwAAAAw"]
[Fri Feb 06 14:42:46.524159 2026] [:error] [pid 3380:tid 3392] [client 3.36.47.30:56830] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2/phpinfo.php"] [unique_id "aYWNZhFAlUvBGSBK2jfhWgAAAAg"]
[Fri Feb 06 14:42:47.121151 2026] [:error] [pid 3477:tid 3497] [client 3.36.47.30:56840] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.gitlab-ci.yml"] [unique_id "aYWNZ7L0Hdh40C7HYgXxOwAAANI"]
[Fri Feb 06 14:42:47.722748 2026] [:error] [pid 3513:tid 3530] [client 3.36.47.30:56856] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.gitlab/config"] [unique_id "aYWNZzSw3-HAlzpqSxxd0gAAAU8"]
[Fri Feb 06 14:42:48.323682 2026] [:error] [pid 3477:tid 3501] [client 3.36.47.30:56872] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gitlab/config"] [unique_id "aYWNaLL0Hdh40C7HYgXxRAAAANY"]
[Fri Feb 06 14:42:48.921360 2026] [:error] [pid 3380:tid 3398] [client 3.36.47.30:56882] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config/gitlab.json"] [unique_id "aYWNaBFAlUvBGSBK2jfhYwAAAA4"]
[Fri Feb 06 14:42:49.525194 2026] [:error] [pid 3513:tid 3535] [client 3.36.47.30:56890] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.config/git/config"] [unique_id "aYWNaTSw3-HAlzpqSxxd1gAAAVQ"]
[Fri Feb 06 14:42:50.125268 2026] [:error] [pid 3381:tid 3436] [client 3.36.47.30:56892] [client 3.36.47.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.config/git/credentials"] [unique_id "aYWNai81zqRg96ZREgjwJwAAAFc"]
[Fri Feb 06 16:55:55.825278 2026] [:error] [pid 3513:tid 3529] [client 49.51.52.250:37488] [client 49.51.52.250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYWsmzSw3-HAlzpqSxyiCgAAAU4"]
[Fri Feb 06 21:33:23.865114 2026] [:error] [pid 3477:tid 3499] [client 143.110.253.198:54757] [client 143.110.253.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.253.198, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aYXto7L0Hdh40C7HYgV5EwAAANQ"]
[Fri Feb 06 21:33:23.868939 2026] [:error] [pid 3477:tid 3499] [client 143.110.253.198:54757] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 06 21:54:37.478853 2026] [:error] [pid 3382:tid 3440] [client 146.70.250.132:56200] [client 146.70.250.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aYXyncIgU1HR0rhYrE9jWgAAAIA"]
[Sat Feb 07 00:18:33.200392 2026] [:error] [pid 36928:tid 36934] [client 64.227.149.66:58899] [client 64.227.149.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.149.66, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aYYUWZs7fyU8D36r-OqZuQAAAcI"]
[Sat Feb 07 00:18:33.204591 2026] [:error] [pid 36928:tid 36934] [client 64.227.149.66:58899] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 07 02:36:29.432837 2026] [:error] [pid 55701:tid 55772] [client 170.106.72.178:34972] [client 170.106.72.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYY0rcDNf5Dni-14pBDnBgAAAVA"]
[Sat Feb 07 03:17:32.568059 2026] [:error] [pid 47481:tid 47563] [client 87.106.209.183:49621] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Sat Feb 07 03:17:33.827923 2026] [:error] [pid 47607:tid 47633] [client 87.106.209.183:52980] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php, referer: www.google.com
[Sat Feb 07 03:18:18.553863 2026] [:error] [pid 47481:tid 47546] [client 87.106.209.183:59169] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Sat Feb 07 03:18:24.460193 2026] [:error] [pid 47481:tid 47554] [client 87.106.209.183:56751] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php, referer: www.google.com
[Sat Feb 07 12:01:50.384828 2026] [:error] [pid 58058:tid 58063] [client 49.233.45.47:48294] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYa5Lrz-Qlvs65S4DP-fqQAAAYI"]
[Sat Feb 07 22:00:29.020740 2026] [:error] [pid 30684:tid 30700] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sat Feb 07 22:00:29.501563 2026] [:error] [pid 30684:tid 30706] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 07 22:00:30.002152 2026] [:error] [pid 30684:tid 30709] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sat Feb 07 22:00:30.599440 2026] [:error] [pid 30684:tid 30703] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Feb 07 22:00:31.108640 2026] [:error] [pid 30684:tid 30688] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 07 22:00:31.674800 2026] [:error] [pid 30684:tid 30711] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sat Feb 07 22:00:32.173538 2026] [:error] [pid 30684:tid 30699] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sat Feb 07 22:00:32.654664 2026] [:error] [pid 30684:tid 30708] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 07 22:00:33.642115 2026] [:error] [pid 30684:tid 30709] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sat Feb 07 22:00:34.610625 2026] [:error] [pid 30684:tid 30690] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sat Feb 07 22:00:35.094889 2026] [:error] [pid 30684:tid 30702] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sat Feb 07 22:00:35.615445 2026] [:error] [pid 30684:tid 30701] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 07 22:00:36.130905 2026] [:error] [pid 30684:tid 30687] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Feb 07 22:00:36.646027 2026] [:error] [pid 30684:tid 30690] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Feb 07 22:00:37.164904 2026] [:error] [pid 30684:tid 30692] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Feb 07 22:00:37.655797 2026] [:error] [pid 30684:tid 30701] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sat Feb 07 22:00:38.133108 2026] [:error] [pid 30684:tid 30688] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Feb 07 22:00:38.622563 2026] [:error] [pid 30684:tid 30696] [client 31.171.130.141:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 07 22:00:45.630850 2026] [:error] [pid 30684:tid 30710] [client 31.171.130.141:34165] [client 31.171.130.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aYdFjbqwdxwowLt-_LweNwAAAdc"]
[Sat Feb 07 22:00:48.150789 2026] [:error] [pid 55157:tid 55175] [client 31.171.130.148:22069] [client 31.171.130.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aYdFkH36JdtTn2bTEozZiwAAAQ0"]
[Sat Feb 07 22:00:50.618914 2026] [:error] [pid 43182:tid 43199] [client 31.171.130.131:57257] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Feb 07 22:00:52.298193 2026] [:error] [pid 43182:tid 43188] [client 31.171.130.131:57257] [client 31.171.130.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aYdFlPEC82JnxmrnFYnbAwAAAUQ"]
[Sat Feb 07 22:00:54.314415 2026] [:error] [pid 30684:tid 30689] [client 31.171.130.132:25189] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 07 22:00:54.846602 2026] [:error] [pid 30684:tid 30709] [client 31.171.130.132:25189] [client 31.171.130.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aYdFlrqwdxwowLt-_LwedgAAAdY"]
[Sat Feb 07 22:00:56.425349 2026] [:error] [pid 43182:tid 43195] [client 31.171.130.149:62171] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sat Feb 07 22:00:58.895478 2026] [:error] [pid 43182:tid 43194] [client 31.171.130.149:62171] [client 31.171.130.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aYdFmvEC82JnxmrnFYnbKwAAAUo"]
[Sat Feb 07 22:01:02.688996 2026] [:error] [pid 50673:tid 50746] [client 31.171.130.133:53305] [client 31.171.130.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aYdFnmVwLsaZ7aKO2ckeGwAAAIs"]
[Sat Feb 07 22:01:03.770874 2026] [:error] [pid 43182:tid 43206] [client 31.171.130.143:36509] [client 31.171.130.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aYdFn_EC82JnxmrnFYnbQwAAAVY"]
[Sun Feb 08 01:05:06.934453 2026] [:error] [pid 62341:tid 62407] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sun Feb 08 01:05:07.287074 2026] [:error] [pid 62341:tid 62415] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Sun Feb 08 01:05:07.530470 2026] [:error] [pid 62341:tid 62418] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/nnyvn.php
[Sun Feb 08 01:05:07.770162 2026] [:error] [pid 62341:tid 62410] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Sun Feb 08 01:05:08.033003 2026] [:error] [pid 62341:tid 62408] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/lul.php
[Sun Feb 08 01:05:08.273721 2026] [:error] [pid 62341:tid 62426] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Sun Feb 08 01:05:08.517744 2026] [:error] [pid 62341:tid 62414] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/lp5.php
[Sun Feb 08 01:05:08.819864 2026] [:error] [pid 62341:tid 62424] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/ee8.php
[Sun Feb 08 01:05:09.058674 2026] [:error] [pid 62341:tid 62422] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/V2_xml.php
[Sun Feb 08 01:05:09.301958 2026] [:error] [pid 62341:tid 62413] [client 20.111.26.104:30678] File does not exist: /usr/local/apache/htdocs/suspended-page/ya.php
[Sun Feb 08 01:05:09.541654 2026] [:error] [pid 62341:tid 62402] [client 20.111.26.104:30678] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmff.php"] [unique_id "aYdwxZ-t2yekx5OosV4frwAAAEA"]
[Sun Feb 08 01:05:10.409612 2026] [:error] [pid 17001:tid 17023] [client 20.111.26.104:10641] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmff.php"] [unique_id "aYdwxt0X31QDRSlPKmRnIAAAAYc"]
[Sun Feb 08 01:05:11.396163 2026] [:error] [pid 62342:tid 62431] [client 20.111.26.104:32846] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmff.php"] [unique_id "aYdwx-wzANoqjscwU_6_VQAAAII"]
[Sun Feb 08 01:05:12.305848 2026] [:error] [pid 17001:tid 17030] [client 20.111.26.104:38506] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmff.php"] [unique_id "aYdwyN0X31QDRSlPKmRnJQAAAY4"]
[Sun Feb 08 01:05:13.193622 2026] [:error] [pid 62340:tid 62376] [client 20.111.26.104:14495] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oDR.php"] [unique_id "aYdwyQp6H49g9bqshiuC_wAAAAE"]
[Sun Feb 08 01:05:14.057011 2026] [:error] [pid 62340:tid 62399] [client 20.111.26.104:17197] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oDR.php"] [unique_id "aYdwygp6H49g9bqshiuDBAAAABg"]
[Sun Feb 08 01:05:15.017107 2026] [:error] [pid 46302:tid 46357] [client 20.111.26.104:2987] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oDR.php"] [unique_id "aYdwy-Lz0c8aDYK5YhbJ1QAAAQc"]
[Sun Feb 08 01:05:16.072932 2026] [:error] [pid 46302:tid 46355] [client 20.111.26.104:13822] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oDR.php"] [unique_id "aYdwzOLz0c8aDYK5YhbJ2AAAAQU"]
[Sun Feb 08 01:05:16.954639 2026] [:error] [pid 62641:tid 62666] [client 20.111.26.104:35091] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aYdwzC_seVuUK_C4AppgtAAAANc"]
[Sun Feb 08 01:05:18.688906 2026] [:error] [pid 62342:tid 62453] [client 20.111.26.104:43753] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aYdwzuwzANoqjscwU_6_XwAAAJg"]
[Sun Feb 08 01:05:19.436169 2026] [:error] [pid 62342:tid 62434] [client 20.111.26.104:35130] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aYdwz-wzANoqjscwU_6_YQAAAIU"]
[Sun Feb 08 01:05:20.394186 2026] [:error] [pid 17001:tid 17021] [client 20.111.26.104:14138] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aYdw0N0X31QDRSlPKmRnNQAAAYU"]
[Sun Feb 08 01:05:21.175088 2026] [:error] [pid 62641:tid 62647] [client 20.111.26.104:31217] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ova-Simple.php"] [unique_id "aYdw0S_seVuUK_C4AppguwAAAMQ"]
[Sun Feb 08 01:05:21.872293 2026] [:error] [pid 16829:tid 16845] [client 20.111.26.104:33449] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ova-Simple.php"] [unique_id "aYdw0QQFls00VxRngXuiNgAAAUQ"]
[Sun Feb 08 01:05:22.850264 2026] [:error] [pid 16829:tid 16850] [client 20.111.26.104:14871] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ova-Simple.php"] [unique_id "aYdw0gQFls00VxRngXuiPAAAAUk"]
[Sun Feb 08 01:05:23.559397 2026] [:error] [pid 16829:tid 16854] [client 20.111.26.104:51237] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ova-Simple.php"] [unique_id "aYdw0wQFls00VxRngXuiQQAAAU0"]
[Sun Feb 08 01:05:24.445624 2026] [:error] [pid 17001:tid 17026] [client 20.111.26.104:46104] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aYdw1N0X31QDRSlPKmRnOgAAAYo"]
[Sun Feb 08 01:05:25.135396 2026] [:error] [pid 62340:tid 62378] [client 20.111.26.104:2632] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aYdw1Qp6H49g9bqshiuDEQAAAAM"]
[Sun Feb 08 01:05:26.168158 2026] [:error] [pid 17001:tid 17033] [client 20.111.26.104:26703] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aYdw1t0X31QDRSlPKmRnQQAAAZE"]
[Sun Feb 08 01:05:27.220028 2026] [:error] [pid 62641:tid 62657] [client 20.111.26.104:34073] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aYdw1y_seVuUK_C4AppgwgAAAM4"]
[Sun Feb 08 01:05:28.581888 2026] [:error] [pid 17001:tid 17038] [client 20.111.26.104:20746] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aYdw2N0X31QDRSlPKmRnbAAAAZY"]
[Sun Feb 08 01:05:29.614726 2026] [:error] [pid 46302:tid 46359] [client 20.111.26.104:36167] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aYdw2eLz0c8aDYK5YhbJ5AAAAQg"]
[Sun Feb 08 01:05:30.411758 2026] [:error] [pid 17001:tid 17028] [client 20.111.26.104:26734] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aYdw2t0X31QDRSlPKmRncwAAAYw"]
[Sun Feb 08 01:05:31.662194 2026] [:error] [pid 62641:tid 62664] [client 20.111.26.104:27936] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aYdw2y_seVuUK_C4AppgyQAAANU"]
[Sun Feb 08 01:05:32.726182 2026] [:error] [pid 62641:tid 62658] [client 20.111.26.104:36205] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aYdw3C_seVuUK_C4AppgzAAAAM8"]
[Sun Feb 08 01:05:33.931582 2026] [:error] [pid 62641:tid 62660] [client 20.111.26.104:31647] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aYdw3S_seVuUK_C4AppgzQAAANE"]
[Sun Feb 08 01:05:35.807280 2026] [:error] [pid 17001:tid 17022] [client 20.111.26.104:46339] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aYdw390X31QDRSlPKmRndwAAAYY"]
[Sun Feb 08 01:05:36.553263 2026] [:error] [pid 62641:tid 62645] [client 20.111.26.104:37838] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aYdw4C_seVuUK_C4Appg1AAAAMI"]
[Sun Feb 08 01:05:38.520667 2026] [:error] [pid 17001:tid 17031] [client 20.111.26.104:46380] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aYdw4t0X31QDRSlPKmRngwAAAY8"]
[Sun Feb 08 01:05:39.510403 2026] [:error] [pid 62342:tid 62452] [client 20.111.26.104:40162] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aYdw4-wzANoqjscwU_6_fgAAAJc"]
[Sun Feb 08 01:05:41.470133 2026] [:error] [pid 62641:tid 62659] [client 20.111.26.104:25083] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aYdw5S_seVuUK_C4Appg3QAAANA"]
[Sun Feb 08 01:05:42.352204 2026] [:error] [pid 17001:tid 17017] [client 20.111.26.104:36669] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aYdw5t0X31QDRSlPKmRniwAAAYE"]
[Sun Feb 08 01:05:43.057375 2026] [:error] [pid 62340:tid 62377] [client 20.111.26.104:32796] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aYdw5wp6H49g9bqshiuDLQAAAAI"]
[Sun Feb 08 01:05:43.774327 2026] [:error] [pid 62342:tid 62436] [client 20.111.26.104:15981] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aYdw5-wzANoqjscwU_6_hAAAAIc"]
[Sun Feb 08 01:05:45.235971 2026] [:error] [pid 62341:tid 62424] [client 20.111.26.104:16443] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aYdw6Z-t2yekx5OosV4fzQAAAFY"]
[Sun Feb 08 01:05:46.987332 2026] [:error] [pid 16829:tid 16859] [client 20.111.26.104:25056] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aYdw6gQFls00VxRngXuiXQAAAVI"]
[Sun Feb 08 01:05:47.735940 2026] [:error] [pid 62342:tid 62452] [client 20.111.26.104:54156] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aYdw6-wzANoqjscwU_6_igAAAJc"]
[Sun Feb 08 01:05:48.702818 2026] [:error] [pid 62341:tid 62418] [client 20.111.26.104:39511] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aYdw7J-t2yekx5OosV4f1gAAAFA"]
[Sun Feb 08 01:05:49.319378 2026] [:error] [pid 16829:tid 16845] [client 20.111.26.104:31671] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aYdw7QQFls00VxRngXuiYQAAAUQ"]
[Sun Feb 08 01:05:50.264273 2026] [:error] [pid 16829:tid 16843] [client 20.111.26.104:43667] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aYdw7gQFls00VxRngXuiYgAAAUI"]
[Sun Feb 08 01:05:51.754960 2026] [:error] [pid 62342:tid 62444] [client 20.111.26.104:31629] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aYdw7-wzANoqjscwU_6_kgAAAI8"]
[Sun Feb 08 01:05:52.695652 2026] [:error] [pid 62341:tid 62416] [client 20.111.26.104:51326] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aYdw8J-t2yekx5OosV4f2gAAAE4"]
[Sun Feb 08 01:05:54.300421 2026] [:error] [pid 16829:tid 16843] [client 20.111.26.104:43689] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aYdw8gQFls00VxRngXuibQAAAUI"]
[Sun Feb 08 01:05:55.100872 2026] [:error] [pid 16829:tid 16857] [client 20.111.26.104:31635] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/te.php"] [unique_id "aYdw8wQFls00VxRngXuicQAAAVA"]
[Sun Feb 08 01:05:56.465011 2026] [:error] [pid 62342:tid 62433] [client 20.111.26.104:15517] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aYdw9OwzANoqjscwU_6_lwAAAIQ"]
[Sun Feb 08 01:05:57.424749 2026] [:error] [pid 17001:tid 17025] [client 20.111.26.104:43695] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aYdw9d0X31QDRSlPKmRnqQAAAYk"]
[Sun Feb 08 01:05:58.423928 2026] [:error] [pid 62341:tid 62408] [client 20.111.26.104:43690] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aYdw9p-t2yekx5OosV4f4gAAAEY"]
[Sun Feb 08 01:05:59.427917 2026] [:error] [pid 16829:tid 16858] [client 20.111.26.104:36124] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aYdw9wQFls00VxRngXuieQAAAVE"]
[Sun Feb 08 01:06:00.484723 2026] [:error] [pid 62340:tid 62383] [client 20.111.26.104:36654] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x--krood.php"] [unique_id "aYdw-Ap6H49g9bqshiuDNgAAAAg"]
[Sun Feb 08 01:06:01.243629 2026] [:error] [pid 46302:tid 46357] [client 20.111.26.104:36691] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x--krood.php"] [unique_id "aYdw-eLz0c8aDYK5YhbJ9wAAAQc"]
[Sun Feb 08 01:06:02.250621 2026] [:error] [pid 46302:tid 46359] [client 20.111.26.104:15963] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x--krood.php"] [unique_id "aYdw-uLz0c8aDYK5YhbJ-gAAAQg"]
[Sun Feb 08 01:06:02.827028 2026] [:error] [pid 17001:tid 17035] [client 20.111.26.104:43659] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x--krood.php"] [unique_id "aYdw-t0X31QDRSlPKmRntAAAAZM"]
[Sun Feb 08 01:06:04.914953 2026] [:error] [pid 16829:tid 16846] [client 20.111.26.104:15608] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "aYdw_AQFls00VxRngXuigAAAAUU"]
[Sun Feb 08 01:06:06.462421 2026] [:error] [pid 17001:tid 17037] [client 20.111.26.104:15579] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "aYdw_t0X31QDRSlPKmRnvAAAAZU"]
[Sun Feb 08 01:06:09.549670 2026] [:error] [pid 17001:tid 17019] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Sun Feb 08 01:06:09.972709 2026] [:error] [pid 17001:tid 17019] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Sun Feb 08 01:06:10.221750 2026] [:error] [pid 17001:tid 17038] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/vdb.php
[Sun Feb 08 01:06:10.475112 2026] [:error] [pid 17001:tid 17037] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sun Feb 08 01:06:10.804602 2026] [:error] [pid 17001:tid 17017] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Sun Feb 08 01:06:11.302914 2026] [:error] [pid 17001:tid 17024] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/ffd.php
[Sun Feb 08 01:06:11.613055 2026] [:error] [pid 17001:tid 17021] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/admiin.php
[Sun Feb 08 01:06:11.851854 2026] [:error] [pid 17001:tid 17029] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Sun Feb 08 01:06:12.090999 2026] [:error] [pid 17001:tid 17020] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/jmfi2.php
[Sun Feb 08 01:06:12.330165 2026] [:error] [pid 17001:tid 17033] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/ez.php
[Sun Feb 08 01:06:12.615102 2026] [:error] [pid 17001:tid 17034] [client 20.111.26.104:19603] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Feb 08 01:06:12.925423 2026] [:error] [pid 17001:tid 17016] [client 20.111.26.104:19603] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxBN0X31QDRSlPKmRn1wAAAYA"]
[Sun Feb 08 01:06:14.029752 2026] [:error] [pid 16829:tid 16854] [client 20.111.26.104:17429] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxBgQFls00VxRngXuikQAAAU0"]
[Sun Feb 08 01:06:15.547003 2026] [:error] [pid 62340:tid 62385] [client 20.111.26.104:11531] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxBwp6H49g9bqshiuDPAAAAAo"]
[Sun Feb 08 01:06:18.428256 2026] [:error] [pid 46302:tid 46373] [client 20.111.26.104:36733] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxCuLz0c8aDYK5YhbKCgAAARY"]
[Sun Feb 08 01:06:19.134646 2026] [:error] [pid 62641:tid 62656] [client 20.111.26.104:36715] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aYdxCy_seVuUK_C4Appg9gAAAM0"]
[Sun Feb 08 01:06:20.351622 2026] [:error] [pid 62341:tid 62413] [client 20.111.26.104:16791] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aYdxDJ-t2yekx5OosV4f_AAAAEs"]
[Sun Feb 08 01:06:21.675835 2026] [:error] [pid 62340:tid 62376] [client 20.111.26.104:41142] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aYdxDQp6H49g9bqshiuDRQAAAAE"]
[Sun Feb 08 01:06:22.433820 2026] [:error] [pid 62641:tid 62655] [client 20.111.26.104:16430] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aYdxDi_seVuUK_C4Appg_gAAAMw"]
[Sun Feb 08 01:06:24.020015 2026] [:error] [pid 17001:tid 17027] [client 20.111.26.104:36731] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "aYdxEN0X31QDRSlPKmRn5QAAAYs"]
[Sun Feb 08 01:06:24.599907 2026] [:error] [pid 62340:tid 62377] [client 20.111.26.104:30118] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "aYdxEAp6H49g9bqshiuDSAAAAAI"]
[Sun Feb 08 01:06:25.604120 2026] [:error] [pid 17001:tid 17016] [client 20.111.26.104:41124] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "aYdxEd0X31QDRSlPKmRn6gAAAYA"]
[Sun Feb 08 01:06:26.570589 2026] [:error] [pid 16829:tid 16856] [client 20.111.26.104:11529] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "aYdxEgQFls00VxRngXuirgAAAU8"]
[Sun Feb 08 01:06:27.610004 2026] [:error] [pid 16829:tid 16860] [client 20.111.26.104:17414] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aYdxEwQFls00VxRngXuisAAAAVM"]
[Sun Feb 08 01:06:28.381355 2026] [:error] [pid 62342:tid 62437] [client 20.111.26.104:29429] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aYdxFOwzANoqjscwU_6_twAAAIg"]
[Sun Feb 08 01:06:29.586450 2026] [:error] [pid 62641:tid 62664] [client 20.111.26.104:43179] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aYdxFS_seVuUK_C4ApphBwAAANU"]
[Sun Feb 08 01:06:31.473712 2026] [:error] [pid 62341:tid 62414] [client 20.111.26.104:29435] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aYdxF5-t2yekx5OosV4gEAAAAEw"]
[Sun Feb 08 01:06:34.042523 2026] [:error] [pid 62342:tid 62438] [client 20.111.26.104:30115] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aYdxGuwzANoqjscwU_6_vwAAAIk"]
[Sun Feb 08 01:06:34.698746 2026] [:error] [pid 62340:tid 62385] [client 20.111.26.104:35163] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aYdxGgp6H49g9bqshiuDWgAAAAo"]
[Sun Feb 08 01:06:36.029107 2026] [:error] [pid 62342:tid 62451] [client 20.111.26.104:31724] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aYdxHOwzANoqjscwU_6_wgAAAJY"]
[Sun Feb 08 01:06:37.159973 2026] [:error] [pid 62341:tid 62414] [client 20.111.26.104:15891] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aYdxHZ-t2yekx5OosV4gEwAAAEw"]
[Sun Feb 08 01:06:38.234801 2026] [:error] [pid 46302:tid 46352] [client 20.111.26.104:35145] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxHuLz0c8aDYK5YhbKHwAAAQI"]
[Sun Feb 08 01:06:39.438083 2026] [:error] [pid 46302:tid 46357] [client 20.111.26.104:2785] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxH-Lz0c8aDYK5YhbKIAAAAQc"]
[Sun Feb 08 01:06:40.245532 2026] [:error] [pid 62341:tid 62407] [client 20.111.26.104:30120] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxIJ-t2yekx5OosV4gGAAAAEU"]
[Sun Feb 08 01:06:42.831993 2026] [:error] [pid 17001:tid 17039] [client 20.111.26.104:29379] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aYdxIt0X31QDRSlPKmRoBQAAAZc"]
[Sun Feb 08 01:06:44.633775 2026] [:error] [pid 46302:tid 46374] [client 20.111.26.104:43658] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aYdxJOLz0c8aDYK5YhbKJwAAARc"]
[Sun Feb 08 01:06:45.973105 2026] [:error] [pid 17001:tid 17039] [client 20.111.26.104:11108] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aYdxJd0X31QDRSlPKmRoEAAAAZc"]
[Sun Feb 08 01:06:47.464871 2026] [:error] [pid 62342:tid 62447] [client 20.111.26.104:17457] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aYdxJ-wzANoqjscwU_6_zwAAAJI"]
[Sun Feb 08 01:06:48.629882 2026] [:error] [pid 16829:tid 16847] [client 20.111.26.104:31728] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aYdxKAQFls00VxRngXuizAAAAUY"]
[Sun Feb 08 01:06:50.129168 2026] [:error] [pid 62341:tid 62421] [client 20.111.26.104:10208] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aYdxKp-t2yekx5OosV4gIQAAAFM"]
[Sun Feb 08 01:06:52.345888 2026] [:error] [pid 17001:tid 17016] [client 20.111.26.104:36720] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aYdxLN0X31QDRSlPKmRoFwAAAYA"]
[Sun Feb 08 01:06:55.497727 2026] [:error] [pid 17001:tid 17029] [client 20.111.26.104:11554] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aYdxL90X31QDRSlPKmRoHQAAAY0"]
[Sun Feb 08 01:06:56.720123 2026] [:error] [pid 17001:tid 17036] [client 20.111.26.104:10234] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aYdxMN0X31QDRSlPKmRoIAAAAZQ"]
[Sun Feb 08 01:07:01.913280 2026] [:error] [pid 62341:tid 62412] [client 20.111.26.104:10196] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aYdxNZ-t2yekx5OosV4gLAAAAEo"]
[Sun Feb 08 01:07:07.562727 2026] [:error] [pid 62340:tid 62381] [client 20.111.26.104:17229] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aYdxOwp6H49g9bqshiuDcwAAAAY"]
[Sun Feb 08 01:07:09.094384 2026] [:error] [pid 16829:tid 16847] [client 20.111.26.104:16780] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aYdxPQQFls00VxRngXui5gAAAUY"]
[Sun Feb 08 01:07:11.536623 2026] [:error] [pid 17001:tid 17039] [client 20.111.26.104:11530] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aYdxP90X31QDRSlPKmRoNwAAAZc"]
[Sun Feb 08 01:07:13.122451 2026] [:error] [pid 17001:tid 17026] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Feb 08 01:07:13.361239 2026] [:error] [pid 17001:tid 17018] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/karak.php
[Sun Feb 08 01:07:13.639521 2026] [:error] [pid 17001:tid 17038] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/trd.php
[Sun Feb 08 01:07:14.049095 2026] [:error] [pid 17001:tid 17017] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php
[Sun Feb 08 01:07:14.290798 2026] [:error] [pid 17001:tid 17028] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Sun Feb 08 01:07:14.574754 2026] [:error] [pid 17001:tid 17027] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sun Feb 08 01:07:15.075490 2026] [:error] [pid 17001:tid 17030] [client 20.111.26.104:11579] [client 20.111.26.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.111.26.104, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aYdxQ90X31QDRSlPKmRoRQAAAY4"]
[Sun Feb 08 01:07:15.078903 2026] [:error] [pid 17001:tid 17030] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Feb 08 01:07:15.389206 2026] [:error] [pid 17001:tid 17024] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/aw.php
[Sun Feb 08 01:07:15.681855 2026] [:error] [pid 17001:tid 17021] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Sun Feb 08 01:07:16.986468 2026] [:error] [pid 17001:tid 17021] [client 20.111.26.104:11579] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Feb 08 01:07:17.223345 2026] [:error] [pid 17001:tid 17028] [client 20.111.26.104:11579] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aYdxRd0X31QDRSlPKmRoTQAAAYw"]
[Sun Feb 08 01:07:18.315994 2026] [:error] [pid 46302:tid 46371] [client 20.111.26.104:32322] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aYdxRuLz0c8aDYK5YhbKNwAAARQ"]
[Sun Feb 08 01:07:18.923599 2026] [:error] [pid 62342:tid 62452] [client 20.111.26.104:41115] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aYdxRuwzANoqjscwU_6_8gAAAJc"]
[Sun Feb 08 01:07:19.594740 2026] [:error] [pid 17001:tid 17024] [client 20.111.26.104:36638] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aYdxR90X31QDRSlPKmRoUQAAAYg"]
[Sun Feb 08 01:07:20.313316 2026] [:error] [pid 62341:tid 62420] [client 20.111.26.104:31618] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aYdxSJ-t2yekx5OosV4gPQAAAFI"]
[Sun Feb 08 01:07:21.173329 2026] [:error] [pid 62341:tid 62402] [client 20.111.26.104:51277] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aYdxSZ-t2yekx5OosV4gPgAAAEA"]
[Sun Feb 08 01:07:22.027287 2026] [:error] [pid 17001:tid 17017] [client 20.111.26.104:15997] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aYdxSt0X31QDRSlPKmRoVAAAAYE"]
[Sun Feb 08 01:07:23.186021 2026] [:error] [pid 62342:tid 62452] [client 20.111.26.104:15358] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aYdxS-wzANoqjscwU_7AAAAAAJc"]
[Sun Feb 08 01:07:23.960337 2026] [:error] [pid 62641:tid 62659] [client 20.111.26.104:51312] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aYdxSy_seVuUK_C4ApphPgAAANA"]
[Sun Feb 08 01:07:25.983909 2026] [:error] [pid 62341:tid 62418] [client 20.111.26.104:16413] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aYdxTZ-t2yekx5OosV4gQwAAAFA"]
[Sun Feb 08 01:07:27.237706 2026] [:error] [pid 46302:tid 46372] [client 20.111.26.104:32794] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aYdxT-Lz0c8aDYK5YhbKPAAAARU"]
[Sun Feb 08 01:07:28.453472 2026] [:error] [pid 17001:tid 17030] [client 20.111.26.104:41124] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aYdxUN0X31QDRSlPKmRocwAAAY4"]
[Sun Feb 08 01:07:29.438040 2026] [:error] [pid 62340:tid 62377] [client 20.111.26.104:11999] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aYdxUQp6H49g9bqshiuDgQAAAAI"]
[Sun Feb 08 01:07:30.438784 2026] [:error] [pid 62341:tid 62410] [client 20.111.26.104:34174] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aYdxUp-t2yekx5OosV4gZQAAAEg"]
[Sun Feb 08 01:07:31.454166 2026] [:error] [pid 46302:tid 46371] [client 20.111.26.104:34145] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aYdxU-Lz0c8aDYK5YhbKQQAAARQ"]
[Sun Feb 08 01:07:33.266504 2026] [:error] [pid 17001:tid 17016] [client 20.111.26.104:54163] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aYdxVd0X31QDRSlPKmRoiwAAAYA"]
[Sun Feb 08 01:07:34.002106 2026] [:error] [pid 62342:tid 62453] [client 20.111.26.104:30633] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/199.php"] [unique_id "aYdxVuwzANoqjscwU_7ACgAAAJg"]
[Sun Feb 08 01:07:35.279143 2026] [:error] [pid 17001:tid 17038] [client 20.111.26.104:20766] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/199.php"] [unique_id "aYdxV90X31QDRSlPKmRolQAAAZY"]
[Sun Feb 08 01:07:36.022408 2026] [:error] [pid 46302:tid 46359] [client 20.111.26.104:46081] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/199.php"] [unique_id "aYdxWOLz0c8aDYK5YhbKSAAAAQg"]
[Sun Feb 08 01:07:36.814681 2026] [:error] [pid 62342:tid 62446] [client 20.111.26.104:33445] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/199.php"] [unique_id "aYdxWOwzANoqjscwU_7ADQAAAJE"]
[Sun Feb 08 01:07:38.189363 2026] [:error] [pid 16829:tid 16858] [client 20.111.26.104:28472] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aYdxWgQFls00VxRngXujDQAAAVE"]
[Sun Feb 08 01:07:39.247544 2026] [:error] [pid 46302:tid 46374] [client 20.111.26.104:12534] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aYdxW-Lz0c8aDYK5YhbKTQAAARc"]
[Sun Feb 08 01:07:40.994592 2026] [:error] [pid 62340:tid 62393] [client 20.111.26.104:46194] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aYdxXAp6H49g9bqshiuDkgAAABI"]
[Sun Feb 08 01:07:41.768164 2026] [:error] [pid 62641:tid 62658] [client 20.111.26.104:34105] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aYdxXS_seVuUK_C4ApphUAAAAM8"]
[Sun Feb 08 01:07:43.107905 2026] [:error] [pid 62342:tid 62438] [client 20.111.26.104:49821] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdxX-wzANoqjscwU_7AFQAAAIk"]
[Sun Feb 08 01:07:44.209409 2026] [:error] [pid 17001:tid 17035] [client 20.111.26.104:31230] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdxYN0X31QDRSlPKmRopQAAAZM"]
[Sun Feb 08 01:07:45.230451 2026] [:error] [pid 62641:tid 62667] [client 20.111.26.104:14862] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdxYS_seVuUK_C4ApphVgAAANg"]
[Sun Feb 08 01:07:46.729747 2026] [:error] [pid 17001:tid 17037] [client 20.111.26.104:2284] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdxYt0X31QDRSlPKmRopgAAAZU"]
[Sun Feb 08 01:07:47.751416 2026] [:error] [pid 62340:tid 62388] [client 20.111.26.104:10690] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aYdxYwp6H49g9bqshiuDngAAAA0"]
[Sun Feb 08 01:07:48.596300 2026] [:error] [pid 62341:tid 62402] [client 20.111.26.104:21123] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aYdxZJ-t2yekx5OosV4gdQAAAEA"]
[Sun Feb 08 01:07:50.436738 2026] [:error] [pid 46302:tid 46351] [client 20.111.26.104:43765] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aYdxZuLz0c8aDYK5YhbKVwAAAQE"]
[Sun Feb 08 01:07:51.091950 2026] [:error] [pid 62342:tid 62445] [client 20.111.26.104:45727] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aYdxZ-wzANoqjscwU_7AGwAAAJA"]
[Sun Feb 08 01:07:52.112975 2026] [:error] [pid 62341:tid 62409] [client 20.111.26.104:17163] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aYdxaJ-t2yekx5OosV4ggAAAAEc"]
[Sun Feb 08 01:07:52.767027 2026] [:error] [pid 62641:tid 62659] [client 20.111.26.104:42703] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aYdxaC_seVuUK_C4ApphWwAAANA"]
[Sun Feb 08 01:07:53.646818 2026] [:error] [pid 46302:tid 46360] [client 20.111.26.104:43752] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aYdxaeLz0c8aDYK5YhbKXAAAAQk"]
[Sun Feb 08 01:07:54.244163 2026] [:error] [pid 17001:tid 17021] [client 20.111.26.104:12439] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aYdxat0X31QDRSlPKmRotAAAAYU"]
[Sun Feb 08 01:07:54.928971 2026] [:error] [pid 62340:tid 62399] [client 20.111.26.104:27472] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aYdxagp6H49g9bqshiuDpwAAABg"]
[Sun Feb 08 01:07:56.047171 2026] [:error] [pid 62342:tid 62438] [client 20.111.26.104:17180] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aYdxbOwzANoqjscwU_7AIQAAAIk"]
[Sun Feb 08 01:07:57.333067 2026] [:error] [pid 16829:tid 16858] [client 20.111.26.104:10673] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aYdxbQQFls00VxRngXujJwAAAVE"]
[Sun Feb 08 01:07:59.383274 2026] [:error] [pid 17001:tid 17036] [client 20.111.26.104:12427] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aYdxb90X31QDRSlPKmRowgAAAZQ"]
[Sun Feb 08 01:08:01.460885 2026] [:error] [pid 62641:tid 62643] [client 20.111.26.104:2603] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdxcS_seVuUK_C4ApphYQAAAMA"]
[Sun Feb 08 01:08:03.469377 2026] [:error] [pid 62340:tid 62395] [client 20.111.26.104:2581] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdxcwp6H49g9bqshiuDsQAAABQ"]
[Sun Feb 08 01:08:04.663266 2026] [:error] [pid 46302:tid 46370] [client 20.111.26.104:2918] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdxdOLz0c8aDYK5YhbKZQAAARM"]
[Sun Feb 08 01:08:05.512654 2026] [:error] [pid 62340:tid 62379] [client 20.111.26.104:46405] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aYdxdQp6H49g9bqshiuDswAAAAQ"]
[Sun Feb 08 01:08:06.980604 2026] [:error] [pid 16829:tid 16841] [client 20.111.26.104:32875] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aYdxdgQFls00VxRngXujMwAAAUA"]
[Sun Feb 08 01:08:07.910937 2026] [:error] [pid 16829:tid 16861] [client 20.111.26.104:52959] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aYdxdwQFls00VxRngXujNAAAAVQ"]
[Sun Feb 08 01:08:08.587068 2026] [:error] [pid 62342:tid 62449] [client 20.111.26.104:10648] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aYdxeOwzANoqjscwU_7AKwAAAJQ"]
[Sun Feb 08 01:08:10.867293 2026] [:error] [pid 62340:tid 62395] [client 20.111.26.104:28031] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aYdxegp6H49g9bqshiuDugAAABQ"]
[Sun Feb 08 01:08:11.876449 2026] [:error] [pid 62342:tid 62442] [client 20.111.26.104:14939] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aYdxe-wzANoqjscwU_7AMwAAAI0"]
[Sun Feb 08 01:08:13.706201 2026] [:error] [pid 46302:tid 46373] [client 20.111.26.104:22287] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aYdxfeLz0c8aDYK5YhbKcAAAARY"]
[Sun Feb 08 01:08:15.290226 2026] [:error] [pid 62341:tid 62411] [client 20.111.26.104:10662] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aYdxf5-t2yekx5OosV4gkQAAAEk"]
[Sun Feb 08 01:08:17.040048 2026] [:error] [pid 62342:tid 62435] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Feb 08 01:08:17.282790 2026] [:error] [pid 62342:tid 62442] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Feb 08 01:08:17.579411 2026] [:error] [pid 62342:tid 62439] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi2.php
[Sun Feb 08 01:08:17.818749 2026] [:error] [pid 62342:tid 62451] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/nope.php
[Sun Feb 08 01:08:18.057122 2026] [:error] [pid 62342:tid 62438] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/class.1.php
[Sun Feb 08 01:08:18.317258 2026] [:error] [pid 62342:tid 62448] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Feb 08 01:08:18.610634 2026] [:error] [pid 62342:tid 62440] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/async.php
[Sun Feb 08 01:08:18.880310 2026] [:error] [pid 62342:tid 62450] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/file17.php
[Sun Feb 08 01:08:19.282374 2026] [:error] [pid 62342:tid 62446] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Sun Feb 08 01:08:19.523910 2026] [:error] [pid 62342:tid 62435] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Feb 08 01:08:19.800632 2026] [:error] [pid 62342:tid 62429] [client 20.111.26.104:21204] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Sun Feb 08 01:08:20.036872 2026] [:error] [pid 62342:tid 62437] [client 20.111.26.104:21204] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aYdxhOwzANoqjscwU_7ASwAAAIg"]
[Sun Feb 08 01:08:21.526475 2026] [:error] [pid 17001:tid 17031] [client 20.111.26.104:51787] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aYdxhd0X31QDRSlPKmRo1wAAAY8"]
[Sun Feb 08 01:08:22.488244 2026] [:error] [pid 62341:tid 62405] [client 20.111.26.104:25022] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aYdxhp-t2yekx5OosV4glwAAAEM"]
[Sun Feb 08 01:08:25.881247 2026] [:error] [pid 62342:tid 62453] [client 20.111.26.104:21531] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v2.php"] [unique_id "aYdxiewzANoqjscwU_7AUAAAAJg"]
[Sun Feb 08 01:08:26.996053 2026] [:error] [pid 46302:tid 46370] [client 20.111.26.104:39443] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aYdxiuLz0c8aDYK5YhbKeAAAARM"]
[Sun Feb 08 01:08:28.675316 2026] [:error] [pid 46302:tid 46361] [client 20.111.26.104:39425] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aYdxjOLz0c8aDYK5YhbKfgAAAQo"]
[Sun Feb 08 01:08:30.379209 2026] [:error] [pid 62342:tid 62435] [client 20.111.26.104:9808] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aYdxjuwzANoqjscwU_7AVQAAAIY"]
[Sun Feb 08 01:08:31.508969 2026] [:error] [pid 62641:tid 62647] [client 20.111.26.104:23704] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aYdxjy_seVuUK_C4ApphgAAAAMQ"]
[Sun Feb 08 01:08:32.683016 2026] [:error] [pid 16829:tid 16849] [client 20.111.26.104:20456] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aYdxkAQFls00VxRngXujRwAAAUg"]
[Sun Feb 08 01:08:33.660730 2026] [:error] [pid 16829:tid 16843] [client 20.111.26.104:9822] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aYdxkQQFls00VxRngXujSAAAAUI"]
[Sun Feb 08 01:08:35.934500 2026] [:error] [pid 62341:tid 62415] [client 20.111.26.104:20416] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aYdxk5-t2yekx5OosV4gsAAAAE0"]
[Sun Feb 08 01:08:37.316818 2026] [:error] [pid 17001:tid 17035] [client 20.111.26.104:9395] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aYdxld0X31QDRSlPKmRo7QAAAZM"]
[Sun Feb 08 01:08:38.365942 2026] [:error] [pid 17001:tid 17030] [client 20.111.26.104:22324] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/188.php"] [unique_id "aYdxlt0X31QDRSlPKmRo8wAAAY4"]
[Sun Feb 08 01:08:39.322038 2026] [:error] [pid 17001:tid 17039] [client 20.111.26.104:28926] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/188.php"] [unique_id "aYdxl90X31QDRSlPKmRo9QAAAZc"]
[Sun Feb 08 01:08:40.630068 2026] [:error] [pid 16829:tid 16854] [client 20.111.26.104:53640] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/188.php"] [unique_id "aYdxmAQFls00VxRngXujWQAAAU0"]
[Sun Feb 08 01:08:41.798206 2026] [:error] [pid 62641:tid 62645] [client 20.111.26.104:28903] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/188.php"] [unique_id "aYdxmS_seVuUK_C4ApphhgAAAMI"]
[Sun Feb 08 01:08:42.579158 2026] [:error] [pid 16829:tid 16851] [client 20.111.26.104:53663] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aYdxmgQFls00VxRngXujWgAAAUo"]
[Sun Feb 08 01:08:43.530053 2026] [:error] [pid 16829:tid 16863] [client 20.111.26.104:28864] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aYdxmwQFls00VxRngXujWwAAAVY"]
[Sun Feb 08 01:08:45.193622 2026] [:error] [pid 62342:tid 62452] [client 20.111.26.104:52225] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aYdxnewzANoqjscwU_7AeAAAAJc"]
[Sun Feb 08 01:08:46.038983 2026] [:error] [pid 16829:tid 16862] [client 20.111.26.104:19661] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aYdxngQFls00VxRngXujXgAAAVU"]
[Sun Feb 08 01:08:47.765623 2026] [:error] [pid 62641:tid 62644] [client 20.111.26.104:24625] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aYdxny_seVuUK_C4ApphiwAAAME"]
[Sun Feb 08 01:08:48.346374 2026] [:error] [pid 62341:tid 62410] [client 20.111.26.104:26633] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aYdxoJ-t2yekx5OosV4gxwAAAEg"]
[Sun Feb 08 01:08:49.278966 2026] [:error] [pid 62341:tid 62422] [client 20.111.26.104:21624] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aYdxoZ-t2yekx5OosV4gyQAAAFQ"]
[Sun Feb 08 01:08:51.714320 2026] [:error] [pid 17001:tid 17038] [client 20.111.26.104:38412] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aYdxo90X31QDRSlPKmRpBgAAAZY"]
[Sun Feb 08 01:08:52.419031 2026] [:error] [pid 62340:tid 62387] [client 20.111.26.104:26675] [client 20.111.26.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aYdxpAp6H49g9bqshiuD7QAAAAw"]
[Sun Feb 08 01:08:53.601024 2026] [:error] [pid 62340:tid 62388] [client 20.111.26.104:14152] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aYdxpQp6H49g9bqshiuD7gAAAA0"]
[Sun Feb 08 01:08:56.199957 2026] [:error] [pid 62342:tid 62449] [client 20.111.26.104:19666] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aYdxqOwzANoqjscwU_7AiQAAAJQ"]
[Sun Feb 08 01:08:57.722891 2026] [:error] [pid 16829:tid 16850] [client 20.111.26.104:24606] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aYdxqQQFls00VxRngXujbQAAAUk"]
[Sun Feb 08 01:08:58.285280 2026] [:error] [pid 62641:tid 62645] [client 20.111.26.104:14186] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aYdxqi_seVuUK_C4ApphkAAAAMI"]
[Sun Feb 08 01:08:59.167987 2026] [:error] [pid 62342:tid 62444] [client 20.111.26.104:32305] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aYdxq-wzANoqjscwU_7AkAAAAI8"]
[Sun Feb 08 01:08:59.986203 2026] [:error] [pid 62342:tid 62441] [client 20.111.26.104:14200] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aYdxq-wzANoqjscwU_7AkgAAAIw"]
[Sun Feb 08 01:09:01.681747 2026] [:error] [pid 62641:tid 62665] [client 20.111.26.104:46868] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aYdxrS_seVuUK_C4ApphkgAAANY"]
[Sun Feb 08 01:09:03.252089 2026] [:error] [pid 62341:tid 62422] [client 20.111.26.104:13026] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aYdxr5-t2yekx5OosV4g1AAAAFQ"]
[Sun Feb 08 01:09:04.674566 2026] [:error] [pid 46302:tid 46355] [client 20.111.26.104:13054] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aYdxsOLz0c8aDYK5YhbKoAAAAQU"]
[Sun Feb 08 01:09:06.442710 2026] [:error] [pid 62342:tid 62453] [client 20.111.26.104:21604] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aYdxsuwzANoqjscwU_7AmgAAAJg"]
[Sun Feb 08 01:09:08.511071 2026] [:error] [pid 17001:tid 17016] [client 20.111.26.104:18262] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aYdxtN0X31QDRSlPKmRpHQAAAYA"]
[Sun Feb 08 01:09:10.223813 2026] [:error] [pid 62340:tid 62392] [client 20.111.26.104:52917] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aYdxtgp6H49g9bqshiuD_wAAABE"]
[Sun Feb 08 01:09:15.128074 2026] [:error] [pid 16829:tid 16852] [client 20.111.26.104:41682] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aYdxuwQFls00VxRngXujfAAAAUs"]
[Sun Feb 08 01:09:16.300651 2026] [:error] [pid 46302:tid 46357] [client 20.111.26.104:52905] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aYdxvOLz0c8aDYK5YhbKowAAAQc"]
[Sun Feb 08 01:09:17.410360 2026] [:error] [pid 62341:tid 62417] [client 20.111.26.104:24074] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aYdxvZ-t2yekx5OosV4g4AAAAE8"]
[Sun Feb 08 01:09:19.558400 2026] [:error] [pid 17001:tid 17024] [client 20.111.26.104:37185] File does not exist: /usr/local/apache/htdocs/suspended-page/cbrfo.php
[Sun Feb 08 01:09:19.845022 2026] [:error] [pid 17001:tid 17016] [client 20.111.26.104:37185] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Feb 08 01:09:20.161075 2026] [:error] [pid 17001:tid 17028] [client 20.111.26.104:37185] File does not exist: /usr/local/apache/htdocs/suspended-page/jquery.php
[Sun Feb 08 01:09:20.448850 2026] [:error] [pid 17001:tid 17021] [client 20.111.26.104:37185] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Feb 08 01:09:20.699263 2026] [:error] [pid 17001:tid 17039] [client 20.111.26.104:37185] File does not exist: /usr/local/apache/htdocs/suspended-page/miansha.php
[Sun Feb 08 01:09:21.080963 2026] [:error] [pid 17001:tid 17026] [client 20.111.26.104:37185] [client 20.111.26.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aYdxwd0X31QDRSlPKmRpKgAAAYo"]
[Sun Feb 08 01:09:22.414627 2026] [:error] [pid 62341:tid 62426] [client 20.111.26.104:24110] File does not exist: /usr/local/apache/htdocs/suspended-page/xfile25.php
[Sun Feb 08 01:09:22.729005 2026] [:error] [pid 62341:tid 62415] [client 20.111.26.104:24110] File does not exist: /usr/local/apache/htdocs/suspended-page/122.php
[Sun Feb 08 01:09:23.034498 2026] [:error] [pid 62341:tid 62410] [client 20.111.26.104:24110] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sun Feb 08 01:09:23.291089 2026] [:error] [pid 62341:tid 62420] [client 20.111.26.104:24110] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Sun Feb 08 01:09:23.583242 2026] [:error] [pid 62341:tid 62404] [client 20.111.26.104:24110] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Sun Feb 08 01:09:23.956925 2026] [:error] [pid 62341:tid 62425] [client 20.111.26.104:24110] File does not exist: /usr/local/apache/htdocs/suspended-page/reze.php
[Sun Feb 08 01:09:24.375072 2026] [:error] [pid 62341:tid 62406] [client 20.111.26.104:24110] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aYdxxJ-t2yekx5OosV4g7QAAAEQ"]
[Sun Feb 08 01:09:25.467592 2026] [:error] [pid 17001:tid 17035] [client 20.111.26.104:37211] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aYdxxd0X31QDRSlPKmRpMAAAAZM"]
[Sun Feb 08 01:09:26.516495 2026] [:error] [pid 17001:tid 17028] [client 20.111.26.104:40606] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aYdxxt0X31QDRSlPKmRpMwAAAYw"]
[Sun Feb 08 01:09:27.834053 2026] [:error] [pid 16829:tid 16864] [client 20.111.26.104:53725] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aYdxxwQFls00VxRngXujhwAAAVc"]
[Sun Feb 08 01:09:29.139055 2026] [:error] [pid 17001:tid 17029] [client 20.111.26.104:51788] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aYdxyd0X31QDRSlPKmRpNwAAAY0"]
[Sun Feb 08 01:09:31.151908 2026] [:error] [pid 16829:tid 16861] [client 20.111.26.104:24064] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aYdxywQFls00VxRngXujiwAAAVQ"]
[Sun Feb 08 01:09:33.189972 2026] [:error] [pid 16829:tid 16853] [client 20.111.26.104:40595] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aYdxzQQFls00VxRngXujjwAAAUw"]
[Sun Feb 08 01:09:34.815442 2026] [:error] [pid 46302:tid 46375] [client 20.111.26.104:53739] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aYdxzuLz0c8aDYK5YhbKsQAAARg"]
[Sun Feb 08 01:09:37.052477 2026] [:error] [pid 62342:tid 62445] [client 20.111.26.104:14153] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aYdx0ewzANoqjscwU_7AvAAAAJA"]
[Sun Feb 08 01:09:38.386686 2026] [:error] [pid 62342:tid 62429] [client 20.111.26.104:13022] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aYdx0uwzANoqjscwU_7AwAAAAIA"]
[Sun Feb 08 01:09:39.239168 2026] [:error] [pid 46302:tid 46352] [client 20.111.26.104:2158] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aYdx0-Lz0c8aDYK5YhbKtAAAAQI"]
[Sun Feb 08 01:09:40.379063 2026] [:error] [pid 62340:tid 62397] [client 20.111.26.104:53722] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aYdx1Ap6H49g9bqshiuEEQAAABY"]
[Sun Feb 08 01:09:41.501921 2026] [:error] [pid 16829:tid 16859] [client 20.111.26.104:14189] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aYdx1QQFls00VxRngXujmAAAAVI"]
[Sun Feb 08 01:09:43.826787 2026] [:error] [pid 16829:tid 16863] [client 20.111.26.104:40620] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aYdx1wQFls00VxRngXujnwAAAVY"]
[Sun Feb 08 01:09:45.108366 2026] [:error] [pid 62641:tid 62663] [client 20.111.26.104:24122] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aYdx2S_seVuUK_C4ApphoQAAANQ"]
[Sun Feb 08 01:09:46.832625 2026] [:error] [pid 16829:tid 16861] [client 20.111.26.104:13044] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aYdx2gQFls00VxRngXujpwAAAVQ"]
[Sun Feb 08 01:09:49.561480 2026] [:error] [pid 62641:tid 62650] [client 20.111.26.104:19219] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aYdx3S_seVuUK_C4ApphpQAAAMc"]
[Sun Feb 08 01:09:50.439985 2026] [:error] [pid 62641:tid 62659] [client 20.111.26.104:2131] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aYdx3i_seVuUK_C4ApphpwAAANA"]
[Sun Feb 08 01:09:51.206716 2026] [:error] [pid 62342:tid 62452] [client 20.111.26.104:2165] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aYdx3-wzANoqjscwU_7A1gAAAJc"]
[Sun Feb 08 01:09:52.367084 2026] [:error] [pid 16829:tid 16843] [client 20.111.26.104:19657] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aYdx4AQFls00VxRngXujswAAAUI"]
[Sun Feb 08 01:09:53.110930 2026] [:error] [pid 62641:tid 62656] [client 20.111.26.104:13025] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f355.php"] [unique_id "aYdx4S_seVuUK_C4ApphqgAAAM0"]
[Sun Feb 08 01:09:56.004181 2026] [:error] [pid 17001:tid 17017] [client 20.111.26.104:15354] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f355.php"] [unique_id "aYdx5N0X31QDRSlPKmRpVQAAAYE"]
[Sun Feb 08 01:09:57.136385 2026] [:error] [pid 17001:tid 17036] [client 20.111.26.104:20847] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f355.php"] [unique_id "aYdx5d0X31QDRSlPKmRpWAAAAZQ"]
[Sun Feb 08 01:10:00.015138 2026] [:error] [pid 17001:tid 17021] [client 20.111.26.104:37198] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f355.php"] [unique_id "aYdx6N0X31QDRSlPKmRpaAAAAYU"]
[Sun Feb 08 01:10:02.552849 2026] [:error] [pid 46302:tid 46361] [client 20.111.26.104:14164] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aYdx6uLz0c8aDYK5YhbKxAAAAQo"]
[Sun Feb 08 01:10:04.433174 2026] [:error] [pid 62641:tid 62651] [client 20.111.26.104:19226] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aYdx7C_seVuUK_C4ApphuAAAAMg"]
[Sun Feb 08 01:10:05.400183 2026] [:error] [pid 62641:tid 62663] [client 20.111.26.104:24117] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aYdx7S_seVuUK_C4ApphugAAANQ"]
[Sun Feb 08 01:10:06.874423 2026] [:error] [pid 62641:tid 62658] [client 20.111.26.104:16870] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aYdx7i_seVuUK_C4ApphvQAAAM8"]
[Sun Feb 08 01:10:08.063633 2026] [:error] [pid 16829:tid 16848] [client 20.111.26.104:2160] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "aYdx8AQFls00VxRngXujygAAAUc"]
[Sun Feb 08 01:10:09.046054 2026] [:error] [pid 16829:tid 16865] [client 20.111.26.104:52876] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "aYdx8QQFls00VxRngXujzAAAAVg"]
[Sun Feb 08 01:10:10.010157 2026] [:error] [pid 62341:tid 62402] [client 20.111.26.104:41187] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "aYdx8p-t2yekx5OosV4hDgAAAEA"]
[Sun Feb 08 01:10:10.799957 2026] [:error] [pid 62641:tid 62659] [client 20.111.26.104:62603] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "aYdx8i_seVuUK_C4ApphwQAAANA"]
[Sun Feb 08 01:10:11.565690 2026] [:error] [pid 62641:tid 62644] [client 20.111.26.104:52890] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aYdx8y_seVuUK_C4ApphxAAAAME"]
[Sun Feb 08 01:10:12.720481 2026] [:error] [pid 46302:tid 46356] [client 20.111.26.104:15348] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aYdx9OLz0c8aDYK5YhbK0gAAAQY"]
[Sun Feb 08 01:10:14.039732 2026] [:error] [pid 62641:tid 62655] [client 20.111.26.104:40605] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aYdx9i_seVuUK_C4ApphyAAAAMw"]
[Sun Feb 08 01:10:15.111120 2026] [:error] [pid 17001:tid 17036] [client 20.111.26.104:16881] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aYdx990X31QDRSlPKmRpgwAAAZQ"]
[Sun Feb 08 01:10:16.113037 2026] [:error] [pid 46302:tid 46369] [client 20.111.26.104:17522] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdx-OLz0c8aDYK5YhbK1QAAARI"]
[Sun Feb 08 01:10:17.652101 2026] [:error] [pid 16829:tid 16844] [client 20.111.26.104:20811] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdx-QQFls00VxRngXuj4gAAAUM"]
[Sun Feb 08 01:10:18.770117 2026] [:error] [pid 17001:tid 17040] [client 20.111.26.104:19208] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdx-t0X31QDRSlPKmRpjAAAAZg"]
[Sun Feb 08 01:10:20.933539 2026] [:error] [pid 62340:tid 62385] [client 20.111.26.104:51828] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aYdx_Ap6H49g9bqshiuEJQAAAAo"]
[Sun Feb 08 01:10:22.299328 2026] [:error] [pid 17001:tid 17029] [client 20.111.26.104:41173] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "aYdx_t0X31QDRSlPKmRpkgAAAY0"]
[Sun Feb 08 01:10:24.772315 2026] [:error] [pid 62641:tid 62667] [client 20.111.26.104:41205] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Sun Feb 08 01:10:25.072339 2026] [:error] [pid 62641:tid 62655] [client 20.111.26.104:41205] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Sun Feb 08 01:10:25.310680 2026] [:error] [pid 62641:tid 62664] [client 20.111.26.104:41205] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Feb 08 01:10:26.696097 2026] [:error] [pid 62641:tid 62657] [client 20.111.26.104:41205] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Feb 08 01:10:27.088770 2026] [:error] [pid 62641:tid 62645] [client 20.111.26.104:41205] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Feb 08 01:10:27.685348 2026] [:error] [pid 62641:tid 62650] [client 20.111.26.104:41205] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Sun Feb 08 01:10:28.056528 2026] [:error] [pid 62641:tid 62659] [client 20.111.26.104:41205] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aYdyBC_seVuUK_C4Apph2gAAANA"]
[Sun Feb 08 01:10:29.016829 2026] [:error] [pid 62641:tid 62644] [client 20.111.26.104:19669] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aYdyBS_seVuUK_C4Apph2wAAAME"]
[Sun Feb 08 01:10:30.034647 2026] [:error] [pid 62341:tid 62422] [client 20.111.26.104:16873] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aYdyBp-t2yekx5OosV4hIgAAAFQ"]
[Sun Feb 08 01:10:30.909960 2026] [:error] [pid 62641:tid 62667] [client 20.111.26.104:17475] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aYdyBi_seVuUK_C4Apph4AAAANg"]
[Sun Feb 08 01:10:33.443846 2026] [:error] [pid 17001:tid 17039] [client 20.111.26.104:41165] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYdyCd0X31QDRSlPKmRpqAAAAZc"]
[Sun Feb 08 01:10:34.494727 2026] [:error] [pid 62342:tid 62450] [client 20.111.26.104:17527] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYdyCuwzANoqjscwU_7A8gAAAJU"]
[Sun Feb 08 01:10:37.581531 2026] [:error] [pid 62341:tid 62421] [client 20.111.26.104:24123] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYdyDZ-t2yekx5OosV4hMAAAAFM"]
[Sun Feb 08 01:10:38.636586 2026] [:error] [pid 62342:tid 62434] [client 20.111.26.104:53730] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/code/"] [unique_id "aYdyDuwzANoqjscwU_7A9wAAAIU"]
[Sun Feb 08 01:10:39.571627 2026] [:error] [pid 17001:tid 17032] [client 20.111.26.104:53739] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aYdyD90X31QDRSlPKmRpvQAAAZA"]
[Sun Feb 08 01:10:40.781297 2026] [:error] [pid 62641:tid 62651] [client 20.111.26.104:20823] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aYdyEC_seVuUK_C4Apph8AAAAMg"]
[Sun Feb 08 01:10:41.517019 2026] [:error] [pid 62340:tid 62392] [client 20.111.26.104:19212] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aYdyEQp6H49g9bqshiuEOAAAABE"]
[Sun Feb 08 01:10:42.695423 2026] [:error] [pid 62340:tid 62381] [client 20.111.26.104:2159] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aYdyEgp6H49g9bqshiuEPQAAAAY"]
[Sun Feb 08 01:10:44.458108 2026] [:error] [pid 62641:tid 62662] [client 20.111.26.104:2175] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYdyFC_seVuUK_C4Apph-AAAANM"]
[Sun Feb 08 01:10:45.199126 2026] [:error] [pid 62641:tid 62656] [client 20.111.26.104:51795] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYdyFS_seVuUK_C4Apph-gAAAM0"]
[Sun Feb 08 01:10:47.046743 2026] [:error] [pid 17001:tid 17027] [client 20.111.26.104:37203] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYdyF90X31QDRSlPKmRpzwAAAYs"]
[Sun Feb 08 01:10:48.232491 2026] [:error] [pid 62340:tid 62397] [client 20.111.26.104:49912] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aYdyGAp6H49g9bqshiuETQAAABY"]
[Sun Feb 08 01:10:49.410883 2026] [:error] [pid 17001:tid 17025] [client 20.111.26.104:2791] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aYdyGd0X31QDRSlPKmRp2AAAAYk"]
[Sun Feb 08 01:10:50.517881 2026] [:error] [pid 62641:tid 62657] [client 20.111.26.104:28443] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aYdyGi_seVuUK_C4AppiDAAAAM4"]
[Sun Feb 08 01:10:51.915332 2026] [:error] [pid 62341:tid 62411] [client 20.111.26.104:19204] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aYdyG5-t2yekx5OosV4hSAAAAEk"]
[Sun Feb 08 01:10:52.625258 2026] [:error] [pid 17001:tid 17022] [client 20.111.26.104:15351] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aYdyHN0X31QDRSlPKmRp6QAAAYY"]
[Sun Feb 08 01:10:55.099238 2026] [:error] [pid 62641:tid 62663] [client 20.111.26.104:49407] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdyHy_seVuUK_C4AppiFgAAANQ"]
[Sun Feb 08 01:10:57.174760 2026] [:error] [pid 46302:tid 46375] [client 20.111.26.104:35141] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdyIeLz0c8aDYK5YhbLCwAAARg"]
[Sun Feb 08 01:11:00.821073 2026] [:error] [pid 17001:tid 17034] [client 20.111.26.104:41160] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdyJN0X31QDRSlPKmRp9QAAAZI"]
[Sun Feb 08 01:11:01.676812 2026] [:error] [pid 62341:tid 62403] [client 20.111.26.104:37194] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYdyJZ-t2yekx5OosV4hVQAAAEE"]
[Sun Feb 08 01:11:02.613603 2026] [:error] [pid 17001:tid 17039] [client 20.111.26.104:2117] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aYdyJt0X31QDRSlPKmRp-wAAAZc"]
[Sun Feb 08 01:11:03.458468 2026] [:error] [pid 62340:tid 62377] [client 20.111.26.104:53705] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aYdyJwp6H49g9bqshiuEVgAAAAI"]
[Sun Feb 08 01:11:04.451469 2026] [:error] [pid 62340:tid 62391] [client 20.111.26.104:53702] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aYdyKAp6H49g9bqshiuEWQAAABA"]
[Sun Feb 08 01:11:05.595893 2026] [:error] [pid 17001:tid 17020] [client 20.111.26.104:49865] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aYdyKd0X31QDRSlPKmRqBQAAAYQ"]
[Sun Feb 08 01:11:06.361989 2026] [:error] [pid 17001:tid 17038] [client 20.111.26.104:37188] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aYdyKt0X31QDRSlPKmRqCwAAAZY"]
[Sun Feb 08 01:11:07.159599 2026] [:error] [pid 62641:tid 62646] [client 20.111.26.104:23807] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aYdyKy_seVuUK_C4AppiHAAAAMM"]
[Sun Feb 08 01:11:07.916282 2026] [:error] [pid 62340:tid 62382] [client 20.111.26.104:11097] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aYdyKwp6H49g9bqshiuEXgAAAAc"]
[Sun Feb 08 01:11:08.578378 2026] [:error] [pid 46302:tid 46370] [client 20.111.26.104:24068] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aYdyLOLz0c8aDYK5YhbLGQAAARM"]
[Sun Feb 08 01:11:09.519452 2026] [:error] [pid 46302:tid 46365] [client 20.111.26.104:24094] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aYdyLeLz0c8aDYK5YhbLHwAAAQ4"]
[Sun Feb 08 01:11:10.677791 2026] [:error] [pid 62341:tid 62406] [client 20.111.26.104:2156] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aYdyLp-t2yekx5OosV4hYAAAAEQ"]
[Sun Feb 08 01:11:11.454765 2026] [:error] [pid 62341:tid 62426] [client 20.111.26.104:23744] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aYdyL5-t2yekx5OosV4hYQAAAFg"]
[Sun Feb 08 01:11:12.109335 2026] [:error] [pid 62341:tid 62413] [client 20.111.26.104:30087] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aYdyMJ-t2yekx5OosV4hZQAAAEs"]
[Sun Feb 08 01:11:13.282782 2026] [:error] [pid 17001:tid 17027] [client 20.111.26.104:9451] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aYdyMd0X31QDRSlPKmRqEwAAAYs"]
[Sun Feb 08 01:11:14.626288 2026] [:error] [pid 16829:tid 16859] [client 20.111.26.104:43186] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aYdyMgQFls00VxRngXukOQAAAVI"]
[Sun Feb 08 01:11:15.305881 2026] [:error] [pid 62641:tid 62664] [client 20.111.26.104:28441] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aYdyMy_seVuUK_C4AppiKAAAANU"]
[Sun Feb 08 01:11:16.518673 2026] [:error] [pid 16829:tid 16861] [client 20.111.26.104:62654] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aYdyNAQFls00VxRngXukPgAAAVQ"]
[Sun Feb 08 01:11:19.031596 2026] [:error] [pid 62641:tid 62654] [client 20.111.26.104:49867] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aYdyNy_seVuUK_C4AppiMgAAAMs"]
[Sun Feb 08 01:11:28.787860 2026] [:error] [pid 16829:tid 16846] [client 20.111.26.104:31702] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Feb 08 01:11:29.637142 2026] [:error] [pid 16829:tid 16853] [client 20.111.26.104:31702] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Feb 08 01:11:29.934474 2026] [:error] [pid 16829:tid 16859] [client 20.111.26.104:31702] [client 20.111.26.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aYdyQQQFls00VxRngXukUAAAAVI"]
[Sun Feb 08 01:11:31.038477 2026] [:error] [pid 62340:tid 62377] [client 20.111.26.104:19584] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Sun Feb 08 01:11:31.333907 2026] [:error] [pid 62340:tid 62399] [client 20.111.26.104:19584] File does not exist: /usr/local/apache/htdocs/suspended-page/jane.php
[Sun Feb 08 01:11:31.572585 2026] [:error] [pid 62340:tid 62376] [client 20.111.26.104:19584] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Feb 08 01:11:31.810490 2026] [:error] [pid 62340:tid 62391] [client 20.111.26.104:19584] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Feb 08 01:11:32.049246 2026] [:error] [pid 62340:tid 62382] [client 20.111.26.104:19584] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Sun Feb 08 01:11:32.304784 2026] [:error] [pid 62340:tid 62392] [client 20.111.26.104:19584] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Feb 08 01:11:32.543908 2026] [:error] [pid 62340:tid 62388] [client 20.111.26.104:19584] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Sun Feb 08 01:11:32.794161 2026] [:error] [pid 62340:tid 62398] [client 20.111.26.104:19584] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aYdyRAp6H49g9bqshiuEdwAAABc"]
[Sun Feb 08 01:11:34.356183 2026] [:error] [pid 16829:tid 16851] [client 20.111.26.104:40166] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aYdyRgQFls00VxRngXukWAAAAUo"]
[Sun Feb 08 01:11:35.309801 2026] [:error] [pid 62341:tid 62422] [client 20.111.26.104:32784] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aYdyR5-t2yekx5OosV4hfAAAAFQ"]
[Sun Feb 08 01:11:36.203739 2026] [:error] [pid 62641:tid 62656] [client 20.111.26.104:15953] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aYdySC_seVuUK_C4AppiTQAAAM0"]
[Sun Feb 08 01:11:37.040482 2026] [:error] [pid 62641:tid 62661] [client 20.111.26.104:11577] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aYdySS_seVuUK_C4AppiTgAAANI"]
[Sun Feb 08 01:11:37.624965 2026] [:error] [pid 62641:tid 62664] [client 20.111.26.104:39535] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aYdySS_seVuUK_C4AppiUAAAANU"]
[Sun Feb 08 01:11:40.486763 2026] [:error] [pid 16829:tid 16845] [client 20.111.26.104:51298] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aYdyTAQFls00VxRngXukXQAAAUQ"]
[Sun Feb 08 01:11:41.416796 2026] [:error] [pid 62340:tid 62398] [client 20.111.26.104:54205] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aYdyTQp6H49g9bqshiuEggAAABc"]
[Sun Feb 08 01:11:42.143348 2026] [:error] [pid 62341:tid 62416] [client 20.111.26.104:42628] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aYdyTp-t2yekx5OosV4hhAAAAE4"]
[Sun Feb 08 01:11:43.268293 2026] [:error] [pid 62340:tid 62383] [client 20.111.26.104:42667] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aYdyTwp6H49g9bqshiuEhwAAAAg"]
[Sun Feb 08 01:11:45.428308 2026] [:error] [pid 62341:tid 62405] [client 20.111.26.104:46187] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aYdyUZ-t2yekx5OosV4hiQAAAEM"]
[Sun Feb 08 01:11:46.861152 2026] [:error] [pid 17001:tid 17023] [client 20.111.26.104:37831] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aYdyUt0X31QDRSlPKmRqNQAAAYc"]
[Sun Feb 08 01:11:49.003515 2026] [:error] [pid 17001:tid 17025] [client 20.111.26.104:23063] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aYdyVd0X31QDRSlPKmRqPAAAAYk"]
[Sun Feb 08 01:11:51.469332 2026] [:error] [pid 62342:tid 62439] [client 20.111.26.104:26735] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aYdyV-wzANoqjscwU_7BMQAAAIo"]
[Sun Feb 08 01:11:52.347078 2026] [:error] [pid 17001:tid 17016] [client 20.111.26.104:33422] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aYdyWN0X31QDRSlPKmRqQgAAAYA"]
[Sun Feb 08 01:11:54.668427 2026] [:error] [pid 16829:tid 16861] [client 20.111.26.104:2875] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aYdyWgQFls00VxRngXukbwAAAVQ"]
[Sun Feb 08 01:11:56.975049 2026] [:error] [pid 62340:tid 62398] [client 20.111.26.104:49817] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aYdyXAp6H49g9bqshiuElgAAABc"]
[Sun Feb 08 01:11:58.531191 2026] [:error] [pid 46302:tid 46353] [client 20.111.26.104:40100] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aYdyXuLz0c8aDYK5YhbLQQAAAQM"]
[Sun Feb 08 01:12:00.118377 2026] [:error] [pid 17001:tid 17023] [client 20.111.26.104:14870] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aYdyYN0X31QDRSlPKmRqSAAAAYc"]
[Sun Feb 08 01:12:01.778432 2026] [:error] [pid 17001:tid 17018] [client 20.111.26.104:2824] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aYdyYd0X31QDRSlPKmRqTAAAAYI"]
[Sun Feb 08 01:12:03.253007 2026] [:error] [pid 62340:tid 62387] [client 20.111.26.104:49818] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aYdyYwp6H49g9bqshiuEmAAAAAw"]
[Sun Feb 08 01:12:04.979253 2026] [:error] [pid 62342:tid 62441] [client 20.111.26.104:2646] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aYdyZOwzANoqjscwU_7BTwAAAIw"]
[Sun Feb 08 01:12:05.622764 2026] [:error] [pid 62342:tid 62430] [client 20.111.26.104:12536] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aYdyZewzANoqjscwU_7BUwAAAIE"]
[Sun Feb 08 01:12:08.595106 2026] [:error] [pid 62340:tid 62399] [client 20.111.26.104:40114] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aYdyaAp6H49g9bqshiuEogAAABg"]
[Sun Feb 08 01:12:09.421926 2026] [:error] [pid 17001:tid 17018] [client 20.111.26.104:34103] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aYdyad0X31QDRSlPKmRqYgAAAYI"]
[Sun Feb 08 01:12:10.519025 2026] [:error] [pid 62641:tid 62656] [client 20.111.26.104:26715] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aYdyai_seVuUK_C4AppibgAAAM0"]
[Sun Feb 08 01:12:11.613211 2026] [:error] [pid 62342:tid 62437] [client 20.111.26.104:20787] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aYdya-wzANoqjscwU_7BZAAAAIg"]
[Sun Feb 08 01:12:12.672411 2026] [:error] [pid 62340:tid 62386] [client 20.111.26.104:29359] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aYdybAp6H49g9bqshiuEpwAAAAs"]
[Sun Feb 08 01:12:13.724826 2026] [:error] [pid 16829:tid 16845] [client 20.111.26.104:42654] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYdybQQFls00VxRngXukhgAAAUQ"]
[Sun Feb 08 01:12:14.607791 2026] [:error] [pid 46302:tid 46365] [client 20.111.26.104:26711] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYdybuLz0c8aDYK5YhbLSAAAAQ4"]
[Sun Feb 08 01:12:16.339188 2026] [:error] [pid 62342:tid 62445] [client 20.111.26.104:27962] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYdycOwzANoqjscwU_7BawAAAJA"]
[Sun Feb 08 01:12:17.283735 2026] [:error] [pid 17001:tid 17031] [client 20.111.26.104:37872] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aYdycd0X31QDRSlPKmRqcQAAAY8"]
[Sun Feb 08 01:12:18.706846 2026] [:error] [pid 17001:tid 17020] [client 20.111.26.104:37843] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdyct0X31QDRSlPKmRqdwAAAYQ"]
[Sun Feb 08 01:12:19.951036 2026] [:error] [pid 46302:tid 46368] [client 20.111.26.104:23040] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdyc-Lz0c8aDYK5YhbLTwAAARE"]
[Sun Feb 08 01:12:20.642154 2026] [:error] [pid 17001:tid 17019] [client 20.111.26.104:27938] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdydN0X31QDRSlPKmRqggAAAYM"]
[Sun Feb 08 01:12:21.719073 2026] [:error] [pid 62342:tid 62448] [client 20.111.26.104:20776] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aYdydewzANoqjscwU_7BewAAAJM"]
[Sun Feb 08 01:12:22.628603 2026] [:error] [pid 62340:tid 62380] [client 20.111.26.104:27958] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aYdydgp6H49g9bqshiuEsAAAAAU"]
[Sun Feb 08 01:12:23.736605 2026] [:error] [pid 62341:tid 62414] [client 20.111.26.104:50426] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aYdyd5-t2yekx5OosV4hkgAAAEw"]
[Sun Feb 08 01:12:25.315308 2026] [:error] [pid 62341:tid 62413] [client 20.111.26.104:54195] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aYdyeZ-t2yekx5OosV4hlgAAAEs"]
[Sun Feb 08 01:12:26.282943 2026] [:error] [pid 62340:tid 62376] [client 20.111.26.104:25083] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aYdyegp6H49g9bqshiuEvwAAAAE"]
[Sun Feb 08 01:12:27.230900 2026] [:error] [pid 16829:tid 16850] [client 20.111.26.104:32352] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYdyewQFls00VxRngXukjQAAAUk"]
[Sun Feb 08 01:12:28.090383 2026] [:error] [pid 46302:tid 46366] [client 20.111.26.104:42000] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYdyfOLz0c8aDYK5YhbLVwAAAQ8"]
[Sun Feb 08 01:12:29.241370 2026] [:error] [pid 62342:tid 62445] [client 20.111.26.104:54203] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYdyfewzANoqjscwU_7BkAAAAJA"]
[Sun Feb 08 01:12:29.934354 2026] [:error] [pid 17001:tid 17018] [client 20.111.26.104:16787] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aYdyfd0X31QDRSlPKmRqjwAAAYI"]
[Sun Feb 08 01:12:31.814819 2026] [:error] [pid 17001:tid 17017] [client 20.111.26.104:46383] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYdyf90X31QDRSlPKmRqkwAAAYE"]
[Sun Feb 08 01:12:33.575398 2026] [:error] [pid 17001:tid 17029] [client 20.111.26.104:36669] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Sun Feb 08 01:12:33.815644 2026] [:error] [pid 17001:tid 17033] [client 20.111.26.104:36669] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Feb 08 01:12:35.744996 2026] [:error] [pid 17001:tid 17037] [client 20.111.26.104:36669] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sun Feb 08 01:12:35.996659 2026] [:error] [pid 17001:tid 17032] [client 20.111.26.104:36669] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Feb 08 01:12:36.322763 2026] [:error] [pid 17001:tid 17028] [client 20.111.26.104:36669] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Sun Feb 08 01:12:36.565515 2026] [:error] [pid 17001:tid 17022] [client 20.111.26.104:36669] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Sun Feb 08 01:12:36.804071 2026] [:error] [pid 17001:tid 17019] [client 20.111.26.104:36669] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Sun Feb 08 01:12:37.404482 2026] [:error] [pid 17001:tid 17040] [client 20.111.26.104:36669] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/177.php"] [unique_id "aYdyhd0X31QDRSlPKmRqqQAAAZg"]
[Sun Feb 08 01:12:38.862499 2026] [:error] [pid 62641:tid 62651] [client 20.111.26.104:28465] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/177.php"] [unique_id "aYdyhi_seVuUK_C4AppiiwAAAMg"]
[Sun Feb 08 01:12:39.795213 2026] [:error] [pid 62340:tid 62394] [client 20.111.26.104:13022] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/177.php"] [unique_id "aYdyhwp6H49g9bqshiuEygAAABM"]
[Sun Feb 08 01:12:40.511806 2026] [:error] [pid 16829:tid 16847] [client 20.111.26.104:9466] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/177.php"] [unique_id "aYdyiAQFls00VxRngXukswAAAUY"]
[Sun Feb 08 01:12:42.150599 2026] [:error] [pid 62341:tid 62404] [client 20.111.26.104:2776] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aYdyip-t2yekx5OosV4hpwAAAEI"]
[Sun Feb 08 01:12:43.139236 2026] [:error] [pid 46302:tid 46353] [client 20.111.26.104:40616] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aYdyi-Lz0c8aDYK5YhbLZgAAAQM"]
[Sun Feb 08 01:12:46.265744 2026] [:error] [pid 17001:tid 17026] [client 20.111.26.104:51787] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aYdyjt0X31QDRSlPKmRquQAAAYo"]
[Sun Feb 08 01:12:47.080248 2026] [:error] [pid 62340:tid 62380] [client 20.111.26.104:41676] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aYdyjwp6H49g9bqshiuE0AAAAAU"]
[Sun Feb 08 01:12:48.075857 2026] [:error] [pid 62641:tid 62663] [client 20.111.26.104:22763] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aYdykC_seVuUK_C4AppilgAAANQ"]
[Sun Feb 08 01:12:48.999882 2026] [:error] [pid 62340:tid 62397] [client 20.111.26.104:41716] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aYdykAp6H49g9bqshiuE1AAAABY"]
[Sun Feb 08 01:12:50.420379 2026] [:error] [pid 16829:tid 16845] [client 20.111.26.104:49355] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aYdykgQFls00VxRngXukugAAAUQ"]
[Sun Feb 08 01:12:51.312538 2026] [:error] [pid 17001:tid 17031] [client 20.111.26.104:28905] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aYdyk90X31QDRSlPKmRqzAAAAY8"]
[Sun Feb 08 01:12:52.236836 2026] [:error] [pid 46302:tid 46367] [client 20.111.26.104:53670] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aYdylOLz0c8aDYK5YhbLggAAARA"]
[Sun Feb 08 01:12:52.925193 2026] [:error] [pid 46302:tid 46370] [client 20.111.26.104:22285] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aYdylOLz0c8aDYK5YhbLhQAAARM"]
[Sun Feb 08 01:12:53.698893 2026] [:error] [pid 16829:tid 16847] [client 20.111.26.104:26625] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aYdylQQFls00VxRngXukwwAAAUY"]
[Sun Feb 08 01:12:55.988515 2026] [:error] [pid 16829:tid 16854] [client 20.111.26.104:28522] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aYdylwQFls00VxRngXukxwAAAU0"]
[Sun Feb 08 01:12:56.641823 2026] [:error] [pid 62341:tid 62416] [client 20.111.26.104:22659] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aYdymJ-t2yekx5OosV4htAAAAE4"]
[Sun Feb 08 01:12:57.463631 2026] [:error] [pid 62341:tid 62417] [client 20.111.26.104:2457] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aYdymZ-t2yekx5OosV4htwAAAE8"]
[Sun Feb 08 01:12:58.507713 2026] [:error] [pid 62342:tid 62445] [client 20.111.26.104:9754] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aYdymuwzANoqjscwU_7BtgAAAJA"]
[Sun Feb 08 01:12:59.565471 2026] [:error] [pid 62340:tid 62396] [client 20.111.26.104:2443] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aYdymwp6H49g9bqshiuE2QAAABU"]
[Sun Feb 08 01:13:00.379659 2026] [:error] [pid 62341:tid 62420] [client 20.111.26.104:2336] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aYdynJ-t2yekx5OosV4hvAAAAFI"]
[Sun Feb 08 01:13:01.417833 2026] [:error] [pid 16829:tid 16862] [client 20.111.26.104:50755] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aYdynQQFls00VxRngXuk0QAAAVU"]
[Sun Feb 08 01:13:02.380411 2026] [:error] [pid 17001:tid 17040] [client 20.111.26.104:50785] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aYdynt0X31QDRSlPKmRq1QAAAZg"]
[Sun Feb 08 01:13:03.306863 2026] [:error] [pid 16829:tid 16855] [client 20.111.26.104:9743] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aYdynwQFls00VxRngXuk1QAAAU4"]
[Sun Feb 08 01:13:06.030241 2026] [:error] [pid 62342:tid 62447] [client 20.111.26.104:25525] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aYdyouwzANoqjscwU_7BvgAAAJI"]
[Sun Feb 08 01:13:07.043377 2026] [:error] [pid 17001:tid 17029] [client 20.111.26.104:27422] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aYdyo90X31QDRSlPKmRq3AAAAY0"]
[Sun Feb 08 01:13:07.798114 2026] [:error] [pid 16829:tid 16845] [client 20.111.26.104:13364] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aYdyowQFls00VxRngXuk2gAAAUQ"]
[Sun Feb 08 01:13:09.677312 2026] [:error] [pid 62341:tid 62419] [client 20.111.26.104:25980] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aYdypZ-t2yekx5OosV4hwQAAAFE"]
[Sun Feb 08 01:13:10.786234 2026] [:error] [pid 62341:tid 62425] [client 20.111.26.104:13354] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aYdypp-t2yekx5OosV4hxAAAAFc"]
[Sun Feb 08 01:13:11.559938 2026] [:error] [pid 62342:tid 62440] [client 20.111.26.104:49281] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aYdyp-wzANoqjscwU_7BxQAAAIs"]
[Sun Feb 08 01:13:12.642038 2026] [:error] [pid 62641:tid 62648] [client 20.111.26.104:37792] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aYdyqC_seVuUK_C4AppiugAAAMU"]
[Sun Feb 08 01:13:13.454145 2026] [:error] [pid 62342:tid 62432] [client 20.111.26.104:13378] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aYdyqewzANoqjscwU_7ByAAAAIM"]
[Sun Feb 08 01:13:14.340954 2026] [:error] [pid 46302:tid 46372] [client 20.111.26.104:13438] [client 20.111.26.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aYdyquLz0c8aDYK5YhbLngAAARU"]
[Sun Feb 08 01:13:15.717996 2026] [:error] [pid 62340:tid 62392] [client 20.111.26.104:2317] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aYdyqwp6H49g9bqshiuE4gAAABE"]
[Sun Feb 08 01:13:16.772621 2026] [:error] [pid 46302:tid 46350] [client 20.111.26.104:49309] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aYdyrOLz0c8aDYK5YhbLogAAAQA"]
[Sun Feb 08 01:13:17.473325 2026] [:error] [pid 16829:tid 16860] [client 20.111.26.104:37795] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aYdyrQQFls00VxRngXuk7QAAAVM"]
[Sun Feb 08 01:13:18.160128 2026] [:error] [pid 16829:tid 16845] [client 20.111.26.104:11941] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nyan.php"] [unique_id "aYdyrgQFls00VxRngXuk8AAAAUQ"]
[Sun Feb 08 01:13:18.920265 2026] [:error] [pid 62641:tid 62661] [client 20.111.26.104:37823] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nyan.php"] [unique_id "aYdyri_seVuUK_C4AppivwAAANI"]
[Sun Feb 08 01:13:19.867670 2026] [:error] [pid 46302:tid 46356] [client 20.111.26.104:13406] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nyan.php"] [unique_id "aYdyr-Lz0c8aDYK5YhbLpQAAAQY"]
[Sun Feb 08 01:13:21.050532 2026] [:error] [pid 62340:tid 62386] [client 20.111.26.104:42106] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nyan.php"] [unique_id "aYdysQp6H49g9bqshiuE6AAAAAs"]
[Sun Feb 08 01:13:21.917509 2026] [:error] [pid 16829:tid 16849] [client 20.111.26.104:33507] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jsond.php"] [unique_id "aYdysQQFls00VxRngXuk9wAAAUg"]
[Sun Feb 08 01:13:22.746133 2026] [:error] [pid 62641:tid 62649] [client 20.111.26.104:2193] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jsond.php"] [unique_id "aYdysi_seVuUK_C4AppiwgAAAMY"]
[Sun Feb 08 01:13:23.563193 2026] [:error] [pid 62340:tid 62375] [client 20.111.26.104:11920] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jsond.php"] [unique_id "aYdyswp6H49g9bqshiuE7gAAAAA"]
[Sun Feb 08 01:13:24.306916 2026] [:error] [pid 16829:tid 16843] [client 20.111.26.104:37783] [client 20.111.26.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jsond.php"] [unique_id "aYdytAQFls00VxRngXuk-QAAAUI"]
[Sun Feb 08 01:19:40.789655 2026] [:error] [pid 17001:tid 17021] [client 43.166.136.153:43036] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYd0LN0X31QDRSlPKmRtywAAAYU"]
[Sun Feb 08 03:17:16.282458 2026] [:error] [pid 62340:tid 62399] [client 54.224.44.213:51977] [client 54.224.44.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.224.44.213, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aYePvAp6H49g9bqshiucSgAAABg"]
[Sun Feb 08 03:17:16.286768 2026] [:error] [pid 62340:tid 62399] [client 54.224.44.213:51977] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Feb 08 03:46:26.328187 2026] [:error] [pid 16509:tid 16603] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/x9.php
[Sun Feb 08 03:46:26.537699 2026] [:error] [pid 16509:tid 16597] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sun Feb 08 03:46:26.741442 2026] [:error] [pid 16509:tid 16595] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/byel.php
[Sun Feb 08 03:46:26.996722 2026] [:error] [pid 16509:tid 16602] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/layou.php
[Sun Feb 08 03:46:27.207648 2026] [:error] [pid 16509:tid 16594] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/lgsts.php
[Sun Feb 08 03:46:27.411291 2026] [:error] [pid 16509:tid 16604] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/tourpa.php
[Sun Feb 08 03:46:27.614797 2026] [:error] [pid 16509:tid 16596] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/yvtuizub.php
[Sun Feb 08 03:46:27.818760 2026] [:error] [pid 16509:tid 16588] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/mln.php
[Sun Feb 08 03:46:28.022561 2026] [:error] [pid 16509:tid 16600] [client 23.100.66.55:49995] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Sun Feb 08 05:10:57.332277 2026] [:error] [pid 24530:tid 24532] [client 43.133.66.51:59308] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYeqYUazNRCs1GRWrh7yegAAAMA"]
[Sun Feb 08 12:21:27.909537 2026] [:error] [pid 24530:tid 24547] [client 84.233.212.39:62986] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sun Feb 08 12:21:28.621206 2026] [:error] [pid 24421:tid 24454] [client 84.233.212.39:63341] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sun Feb 08 12:21:30.041606 2026] [:error] [pid 24530:tid 24553] [client 84.233.212.39:64138] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aYgPSkazNRCs1GRWrh6GxgAAANU"]
[Sun Feb 08 12:21:30.750668 2026] [:error] [pid 24421:tid 24433] [client 84.233.212.39:64507] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/db.sql"] [unique_id "aYgPSqp7cTzhX5M1IP_DJwAAAAI"]
[Sun Feb 08 12:21:31.461207 2026] [:error] [pid 43900:tid 43919] [client 84.233.212.39:64850] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/dump.sql"] [unique_id "aYgPS-Wrhnpm_Csk3kkw6wAAAVA"]
[Sun Feb 08 12:21:32.186075 2026] [:error] [pid 56906:tid 56914] [client 84.233.212.39:65209] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/database.sql"] [unique_id "aYgPTPxl3WX27-WXfDhoTwAAAQY"]
[Sun Feb 08 12:21:32.926892 2026] [:error] [pid 24423:tid 24487] [client 84.233.212.39:65526] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/backup.sql"] [unique_id "aYgPTE3f9n1Y0TpV5YYIXgAAAII"]
[Sun Feb 08 12:21:33.640843 2026] [:error] [pid 43900:tid 43927] [client 84.233.212.39:49540] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/config/db.sql"] [unique_id "aYgPTeWrhnpm_Csk3kkw7QAAAVg"]
[Sun Feb 08 12:21:34.353276 2026] [:error] [pid 56906:tid 56928] [client 84.233.212.39:49845] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/sql/db.sql"] [unique_id "aYgPTvxl3WX27-WXfDhoUQAAARQ"]
[Sun Feb 08 12:21:35.064763 2026] [:error] [pid 24530:tid 24539] [client 84.233.212.39:50237] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/data/dump.sql"] [unique_id "aYgPT0azNRCs1GRWrh6GywAAAMc"]
[Sun Feb 08 12:21:35.777002 2026] [:error] [pid 24530:tid 24550] [client 84.233.212.39:50557] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/backups/database.sql"] [unique_id "aYgPT0azNRCs1GRWrh6GzwAAANI"]
[Sun Feb 08 12:21:36.487115 2026] [:error] [pid 24422:tid 24474] [client 84.233.212.39:50948] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/mysql.sql"] [unique_id "aYgPUCNNjcLoSCLKhTcZ1QAAAFA"]
[Sun Feb 08 12:21:37.199948 2026] [:error] [pid 56906:tid 56923] [client 84.233.212.39:51316] [client 84.233.212.39] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/db_backup.sql"] [unique_id "aYgPUfxl3WX27-WXfDhoUwAAAQ8"]
[Sun Feb 08 16:46:15.646940 2026] [:error] [pid 54609:tid 54636] [client 43.135.130.202:54842] [client 43.135.130.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYhNV6RRnRH9N52BW9J4dwAAAZg"]
[Sun Feb 08 19:12:25.233577 2026] [:error] [pid 24421:tid 24450] [client 43.166.238.12:59334] [client 43.166.238.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYhvmap7cTzhX5M1IP8kkAAAABM"]
[Sun Feb 08 22:29:26.559611 2026] [:error] [pid 9482:tid 9539] [client 101.32.52.164:43262] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYidxsTkGH_puEFp5zPDaQAAA8A"]
[Mon Feb 09 11:32:57.544734 2026] [:error] [pid 60678:tid 60736] [client 43.157.181.189:44810] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYlVae8Gd_fDFrcNu4NXiwAAAwQ"]
[Mon Feb 09 15:44:01.333764 2026] [:error] [pid 60508:tid 60521] [client 45.92.1.94:54062] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Mon Feb 09 15:44:02.507771 2026] [:error] [pid 47938:tid 47980] [client 45.92.1.94:58719] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aYmQQrVCzWE6fQJEkNLkugAAAEE"]
[Mon Feb 09 15:44:03.088391 2026] [:error] [pid 47937:tid 47947] [client 45.92.1.94:58116] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aYmQQ84Fd42MP2DhNrW53QAAAAE"]
[Mon Feb 09 15:44:03.663915 2026] [:error] [pid 60508:tid 60511] [client 45.92.1.94:60033] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aYmQQ-XDvLC4ADfnEzOXXQAAAYE"]
[Mon Feb 09 15:44:04.826951 2026] [:error] [pid 60679:tid 60757] [client 45.92.1.94:64574] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "aYmQRMixhoT1e6Iv6g-3RgAAA00"]
[Mon Feb 09 15:44:05.407760 2026] [:error] [pid 60619:tid 60666] [client 45.92.1.94:51747] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Mon Feb 09 15:44:05.990266 2026] [:error] [pid 60508:tid 60527] [client 45.92.1.94:49772] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Mon Feb 09 15:45:59.854299 2026] [:error] [pid 47938:tid 47991] [client 182.42.104.32:53492] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYmQt7VCzWE6fQJEkNLlOQAAAEw"]
[Mon Feb 09 17:31:05.109212 2026] [:error] [pid 60677:tid 60776] [client 101.33.66.34:59778] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYmpWVyBgzfmDf6GaeuejAAAAtc"]
[Mon Feb 09 22:27:55.276754 2026] [:error] [pid 60677:tid 60737] [client 117.33.163.216:55994] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYnu61yBgzfmDf6GaesEXwAAAs0"]
[Tue Feb 10 01:36:41.279262 2026] [:error] [pid 34139:tid 34154] [client 150.109.230.210:57144] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYobKegedr85OdF4Mt35IgAAAIs"]
[Tue Feb 10 05:03:52.324705 2026] [:error] [pid 30054:tid 30063] [client 123.187.240.242:53833] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYpLuGecgOOXCu-GgYUJtwAAAQc"]
[Tue Feb 10 05:12:43.943714 2026] [:error] [pid 47937:tid 47940] [client 101.33.80.42:51080] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYpNy8pqXpC2CvJ3fOOEoQAAAME"]
[Tue Feb 10 07:42:44.662129 2026] [:error] [pid 47937:tid 47950] [client 43.157.153.236:36422] [client 43.157.153.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYpw9MpqXpC2CvJ3fOPFGQAAAMs"]
[Wed Feb 11 06:20:38.336744 2026] [:error] [pid 27964:tid 27976] [client 217.77.10.74:64667] [client 217.77.10.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aYuvNsp0XgWYHLcQtEjg3QAAAAE"]
[Wed Feb 11 07:31:43.212871 2026] [:error] [pid 17401:tid 17422] [client 194.5.82.39:64369] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aYu_3w0lHeayTY40t364PQAAARM"]
[Wed Feb 11 07:31:44.198814 2026] [:error] [pid 27965:tid 28010] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Feb 11 07:31:44.320909 2026] [:error] [pid 27965:tid 28019] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Wed Feb 11 07:31:44.632169 2026] [:error] [pid 27965:tid 28011] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 11 07:31:44.729940 2026] [:error] [pid 27965:tid 28005] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Feb 11 07:31:44.829998 2026] [:error] [pid 27965:tid 28007] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Wed Feb 11 07:31:44.939999 2026] [:error] [pid 27965:tid 28027] [client 194.5.82.25:35339] [client 194.5.82.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.5.82.25, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aYu_4NHLAUAIo8qpZyF0_gAAAFg"]
[Wed Feb 11 07:31:44.943537 2026] [:error] [pid 27965:tid 28027] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 11 07:31:45.223341 2026] [:error] [pid 27965:tid 28004] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Feb 11 07:31:45.327796 2026] [:error] [pid 27965:tid 28008] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 11 07:31:45.433003 2026] [:error] [pid 27965:tid 28014] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Feb 11 07:31:45.810146 2026] [:error] [pid 27965:tid 28006] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Feb 11 07:31:46.130752 2026] [:error] [pid 27965:tid 28009] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Feb 11 07:31:46.509402 2026] [:error] [pid 27965:tid 28025] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Feb 11 07:31:46.627690 2026] [:error] [pid 27965:tid 28023] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Wed Feb 11 07:31:46.919964 2026] [:error] [pid 27965:tid 28024] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Wed Feb 11 07:31:47.023763 2026] [:error] [pid 27965:tid 28011] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Feb 11 07:31:47.125451 2026] [:error] [pid 27965:tid 28007] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Wed Feb 11 07:31:47.224543 2026] [:error] [pid 27965:tid 28018] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Feb 11 07:31:47.328223 2026] [:error] [pid 27965:tid 28021] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Wed Feb 11 07:31:47.531110 2026] [:error] [pid 27965:tid 28014] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Feb 11 07:31:47.635585 2026] [:error] [pid 27965:tid 28026] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Feb 11 07:31:47.808223 2026] [:error] [pid 27965:tid 28017] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Feb 11 07:31:47.919622 2026] [:error] [pid 27965:tid 28009] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Feb 11 07:31:48.112064 2026] [:error] [pid 27965:tid 28022] [client 194.5.82.25:35339] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Feb 11 07:31:48.314972 2026] [:error] [pid 27965:tid 28022] [client 194.5.82.25:35339] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aYu_5NHLAUAIo8qpZyF1HAAAAFM"]
[Wed Feb 11 07:31:49.225372 2026] [:error] [pid 17401:tid 17406] [client 194.5.82.166:57077] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Wed Feb 11 07:31:49.318970 2026] [:error] [pid 17401:tid 17407] [client 194.5.82.166:57077] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aYu_5Q0lHeayTY40t364RAAAAQQ"]
[Wed Feb 11 07:31:49.708176 2026] [:error] [pid 22537:tid 22552] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Wed Feb 11 07:31:49.827105 2026] [:error] [pid 22537:tid 22553] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/form.php
[Wed Feb 11 07:31:50.119733 2026] [:error] [pid 22537:tid 22561] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Feb 11 07:31:50.227152 2026] [:error] [pid 22537:tid 22555] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Wed Feb 11 07:31:51.715425 2026] [:error] [pid 22537:tid 22555] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Feb 11 07:31:51.950434 2026] [:error] [pid 22537:tid 22551] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Feb 11 07:31:52.118376 2026] [:error] [pid 22537:tid 22540] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Feb 11 07:31:52.220720 2026] [:error] [pid 22537:tid 22544] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 11 07:31:52.319891 2026] [:error] [pid 22537:tid 22558] [client 194.5.82.17:53613] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Feb 11 07:31:52.421513 2026] [:error] [pid 22537:tid 22543] [client 194.5.82.17:53613] [client 194.5.82.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aYu_6Cfg2TagwM3bvQND5gAAAUQ"]
[Wed Feb 11 07:31:53.006921 2026] [:error] [pid 27964:tid 27975] [client 194.5.82.30:55097] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Feb 11 07:31:53.116023 2026] [:error] [pid 27964:tid 27984] [client 194.5.82.30:55097] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Feb 11 07:31:53.217844 2026] [:error] [pid 27964:tid 27979] [client 194.5.82.30:55097] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-atom.php"] [unique_id "aYu_6cp0XgWYHLcQtEjwWQAAAAQ"]
[Wed Feb 11 07:31:53.699147 2026] [:error] [pid 22537:tid 22547] [client 194.5.82.35:22803] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Feb 11 07:31:54.017390 2026] [:error] [pid 22537:tid 22559] [client 194.5.82.35:22803] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Wed Feb 11 07:31:54.322320 2026] [:error] [pid 22537:tid 22545] [client 194.5.82.35:22803] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Wed Feb 11 07:31:54.525342 2026] [:error] [pid 22537:tid 22553] [client 194.5.82.35:22803] File does not exist: /usr/local/apache/htdocs/suspended-page/gel4y.php
[Wed Feb 11 07:31:54.629445 2026] [:error] [pid 22537:tid 22561] [client 194.5.82.35:22803] [client 194.5.82.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aYu_6ifg2TagwM3bvQND7gAAAVY"]
[Wed Feb 11 07:31:56.520111 2026] [:error] [pid 17401:tid 17414] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Feb 11 07:31:56.623907 2026] [:error] [pid 17401:tid 17415] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Feb 11 07:31:56.719941 2026] [:error] [pid 17401:tid 17413] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Feb 11 07:31:56.826839 2026] [:error] [pid 17401:tid 17404] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Feb 11 07:31:56.931071 2026] [:error] [pid 17401:tid 17405] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Feb 11 07:31:57.030246 2026] [:error] [pid 17401:tid 17427] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Feb 11 07:31:57.225623 2026] [:error] [pid 17401:tid 17407] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Wed Feb 11 07:31:57.321843 2026] [:error] [pid 17401:tid 17409] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Feb 11 07:31:57.423165 2026] [:error] [pid 17401:tid 17425] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Feb 11 07:31:57.531474 2026] [:error] [pid 17401:tid 17412] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Wed Feb 11 07:31:57.824894 2026] [:error] [pid 17401:tid 17417] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed Feb 11 07:31:57.943557 2026] [:error] [pid 17401:tid 17416] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Feb 11 07:31:58.117364 2026] [:error] [pid 17401:tid 17419] [client 194.5.82.26:49267] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Feb 11 07:31:58.219005 2026] [:error] [pid 17401:tid 17420] [client 194.5.82.26:49267] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aYu_7g0lHeayTY40t364XQAAARE"]
[Wed Feb 11 07:32:00.008388 2026] [:error] [pid 27965:tid 28021] [client 194.5.82.9:55647] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Feb 11 07:32:00.320536 2026] [:error] [pid 27965:tid 28027] [client 194.5.82.9:55647] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Feb 11 07:32:00.432888 2026] [:error] [pid 27965:tid 28005] [client 194.5.82.9:55647] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Wed Feb 11 07:32:00.534326 2026] [:error] [pid 27965:tid 28014] [client 194.5.82.9:55647] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Wed Feb 11 07:32:00.640611 2026] [:error] [pid 27965:tid 28019] [client 194.5.82.9:55647] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Wed Feb 11 07:32:00.945066 2026] [:error] [pid 27965:tid 28026] [client 194.5.82.9:55647] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Wed Feb 11 07:32:01.234686 2026] [:error] [pid 27965:tid 28017] [client 194.5.82.9:55647] File does not exist: /usr/local/apache/htdocs/suspended-page/yas.php
[Wed Feb 11 07:32:01.636861 2026] [:error] [pid 27965:tid 28016] [client 194.5.82.9:55647] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aYu_8dHLAUAIo8qpZyF1NAAAAE0"]
[Wed Feb 11 07:32:03.513381 2026] [:error] [pid 27965:tid 28018] [client 194.5.82.50:63435] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Feb 11 07:32:03.625137 2026] [:error] [pid 27965:tid 28025] [client 194.5.82.50:63435] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Feb 11 07:32:03.728106 2026] [:error] [pid 27965:tid 28021] [client 194.5.82.50:63435] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Feb 11 07:32:03.825564 2026] [:error] [pid 27965:tid 28020] [client 194.5.82.50:63435] File does not exist: /usr/local/apache/htdocs/suspended-page/www.php
[Wed Feb 11 07:32:03.924091 2026] [:error] [pid 27965:tid 28027] [client 194.5.82.50:63435] [client 194.5.82.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aYu_89HLAUAIo8qpZyF1PgAAAFg"]
[Wed Feb 11 07:32:04.709691 2026] [:error] [pid 22569:tid 22588] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Feb 11 07:32:04.831957 2026] [:error] [pid 22569:tid 22584] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Wed Feb 11 07:32:04.936631 2026] [:error] [pid 22569:tid 22573] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Feb 11 07:32:05.029933 2026] [:error] [pid 22569:tid 22585] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Wed Feb 11 07:32:05.130731 2026] [:error] [pid 22569:tid 22587] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/past.php
[Wed Feb 11 07:32:05.226174 2026] [:error] [pid 22569:tid 22595] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/xa.php
[Wed Feb 11 07:32:05.325268 2026] [:error] [pid 22569:tid 22581] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Feb 11 07:32:05.532777 2026] [:error] [pid 22569:tid 22596] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Feb 11 07:32:06.011437 2026] [:error] [pid 22569:tid 22594] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Feb 11 07:32:06.134240 2026] [:error] [pid 22569:tid 22579] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Feb 11 07:32:06.230772 2026] [:error] [pid 22569:tid 22589] [client 194.5.82.28:40941] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Feb 11 07:32:06.326825 2026] [:error] [pid 22569:tid 22591] [client 194.5.82.28:40941] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aYu_9sAhSI7iX9G3enhvTQAAAZI"]
[Wed Feb 11 07:32:07.410755 2026] [:error] [pid 27965:tid 28018] [client 194.5.82.9:38205] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Wed Feb 11 07:32:07.521405 2026] [:error] [pid 27965:tid 28007] [client 194.5.82.9:38205] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYu_99HLAUAIo8qpZyF1RQAAAEQ"]
[Wed Feb 11 07:32:10.415200 2026] [:error] [pid 22537:tid 22555] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Feb 11 07:32:11.210898 2026] [:error] [pid 22537:tid 22547] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Feb 11 07:32:11.329872 2026] [:error] [pid 22537:tid 22542] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Wed Feb 11 07:32:11.722626 2026] [:error] [pid 22537:tid 22556] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Feb 11 07:32:11.821743 2026] [:error] [pid 22537:tid 22553] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Wed Feb 11 07:32:12.132117 2026] [:error] [pid 22537:tid 22561] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Feb 11 07:32:12.235090 2026] [:error] [pid 22537:tid 22541] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Feb 11 07:32:12.423247 2026] [:error] [pid 22537:tid 22554] [client 194.5.82.166:40533] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Wed Feb 11 07:32:12.706820 2026] [:error] [pid 22537:tid 22551] [client 194.5.82.166:40533] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aYu__Cfg2TagwM3bvQNEFQAAAUw"]
[Wed Feb 11 07:32:14.338184 2026] [:error] [pid 27965:tid 28021] [client 194.5.82.18:57353] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aYu__tHLAUAIo8qpZyF1TwAAAFI"]
[Wed Feb 11 07:32:15.215732 2026] [:error] [pid 27966:tid 28037] [client 194.5.82.4:51031] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Wed Feb 11 07:32:15.329202 2026] [:error] [pid 27966:tid 28039] [client 194.5.82.4:51031] File does not exist: /usr/local/apache/htdocs/suspended-page/hilk.php
[Wed Feb 11 07:32:15.432267 2026] [:error] [pid 27966:tid 28030] [client 194.5.82.4:51031] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Feb 11 07:32:15.609770 2026] [:error] [pid 27966:tid 28036] [client 194.5.82.4:51031] [client 194.5.82.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aYu__18HJ9ydyf0SPu7X9AAAAIY"]
[Wed Feb 11 07:32:17.912794 2026] [:error] [pid 22570:tid 22608] [client 194.5.82.9:55757] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Wed Feb 11 07:32:18.226738 2026] [:error] [pid 22570:tid 22611] [client 194.5.82.9:55757] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Feb 11 07:32:18.438114 2026] [:error] [pid 22570:tid 22609] [client 194.5.82.9:55757] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Wed Feb 11 07:32:18.537136 2026] [:error] [pid 22570:tid 22618] [client 194.5.82.9:55757] [client 194.5.82.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aYvAAiE5uSe043FXwQqrUAAAAdI"]
[Wed Feb 11 07:32:19.814137 2026] [:error] [pid 28073:tid 28097] [client 194.5.82.24:55811] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Feb 11 07:32:19.932142 2026] [:error] [pid 28073:tid 28090] [client 194.5.82.24:55811] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Feb 11 07:32:20.133770 2026] [:error] [pid 28073:tid 28078] [client 194.5.82.24:55811] File does not exist: /usr/local/apache/htdocs/suspended-page/api.php
[Wed Feb 11 07:32:20.228657 2026] [:error] [pid 28073:tid 28084] [client 194.5.82.24:55811] [client 194.5.82.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aYvABIeHYIlOlF-DsMywRgAAAMk"]
[Wed Feb 11 07:32:21.228346 2026] [:error] [pid 22537:tid 22556] [client 194.5.82.21:26137] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Wed Feb 11 07:32:21.515663 2026] [:error] [pid 22537:tid 22561] [client 194.5.82.21:26137] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Feb 11 07:32:21.749950 2026] [:error] [pid 22537:tid 22554] [client 194.5.82.21:26137] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Feb 11 07:32:22.029106 2026] [:error] [pid 22537:tid 22558] [client 194.5.82.21:26137] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Feb 11 07:32:22.128599 2026] [:error] [pid 22537:tid 22544] [client 194.5.82.21:26137] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aYvABifg2TagwM3bvQNELgAAAUU"]
[Wed Feb 11 07:32:23.236419 2026] [:error] [pid 27965:tid 28010] [client 194.5.82.11:54273] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aYvAB9HLAUAIo8qpZyF1YQAAAEc"]
[Wed Feb 11 07:32:24.109724 2026] [:error] [pid 27964:tid 27981] [client 194.5.82.33:23421] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 11 07:32:24.313735 2026] [:error] [pid 27964:tid 27984] [client 194.5.82.33:23421] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Feb 11 07:32:24.413416 2026] [:error] [pid 27964:tid 27988] [client 194.5.82.33:23421] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Feb 11 07:32:24.527875 2026] [:error] [pid 27964:tid 27992] [client 194.5.82.33:23421] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Wed Feb 11 07:32:24.626977 2026] [:error] [pid 27964:tid 27987] [client 194.5.82.33:23421] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aYvACMp0XgWYHLcQtEjweQAAAAw"]
[Wed Feb 11 07:32:26.705144 2026] [:error] [pid 27965:tid 28025] [client 194.5.82.33:44427] [client 194.5.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aYvACtHLAUAIo8qpZyF1bgAAAFY"]
[Wed Feb 11 07:32:28.224874 2026] [:error] [pid 22537:tid 22550] [client 194.5.82.166:22617] [client 194.5.82.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aYvADCfg2TagwM3bvQNEMgAAAUs"]
[Wed Feb 11 07:32:29.323058 2026] [:error] [pid 28073:tid 28079] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Feb 11 07:32:29.720367 2026] [:error] [pid 28073:tid 28097] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Wed Feb 11 07:32:29.932691 2026] [:error] [pid 28073:tid 28098] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Wed Feb 11 07:32:30.317834 2026] [:error] [pid 28073:tid 28078] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Wed Feb 11 07:32:30.429221 2026] [:error] [pid 28073:tid 28084] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/rzki.php
[Wed Feb 11 07:32:30.531646 2026] [:error] [pid 28073:tid 28095] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Feb 11 07:32:31.133508 2026] [:error] [pid 28073:tid 28093] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/fm1.php
[Wed Feb 11 07:32:31.241897 2026] [:error] [pid 28073:tid 28083] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Wed Feb 11 07:32:31.529970 2026] [:error] [pid 28073:tid 28082] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Feb 11 07:32:32.022161 2026] [:error] [pid 28073:tid 28086] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Wed Feb 11 07:32:32.213220 2026] [:error] [pid 28073:tid 28085] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Feb 11 07:32:32.332258 2026] [:error] [pid 28073:tid 28077] [client 194.5.82.32:33617] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Feb 11 07:32:32.436812 2026] [:error] [pid 28073:tid 28075] [client 194.5.82.32:33617] [client 194.5.82.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aYvAEIeHYIlOlF-DsMywYAAAAMA"]
[Wed Feb 11 07:32:33.406596 2026] [:error] [pid 27964:tid 27989] [client 194.5.82.22:61025] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Wed Feb 11 07:32:33.515392 2026] [:error] [pid 27964:tid 27981] [client 194.5.82.22:61025] [client 194.5.82.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aYvAEcp0XgWYHLcQtEjwigAAAAY"]
[Wed Feb 11 07:32:35.322429 2026] [:error] [pid 27965:tid 28017] [client 194.5.82.11:20907] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Wed Feb 11 07:32:35.429111 2026] [:error] [pid 27965:tid 28008] [client 194.5.82.11:20907] File does not exist: /usr/local/apache/htdocs/suspended-page/option-old.php
[Wed Feb 11 07:32:36.371987 2026] [:error] [pid 27965:tid 28003] [client 194.5.82.11:20907] [client 194.5.82.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aYvAFNHLAUAIo8qpZyF1kwAAAEA"]
[Wed Feb 11 07:32:37.412739 2026] [:error] [pid 22537:tid 22548] [client 194.5.82.38:50361] [client 194.5.82.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aYvAFSfg2TagwM3bvQNEPQAAAUk"]
[Wed Feb 11 07:32:39.317610 2026] [:error] [pid 27965:tid 28016] [client 194.5.82.43:23131] File does not exist: /usr/local/apache/htdocs/suspended-page/cord.php
[Wed Feb 11 07:32:39.430427 2026] [:error] [pid 27965:tid 28011] [client 194.5.82.43:23131] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Wed Feb 11 07:32:40.979206 2026] [:error] [pid 27965:tid 28011] [client 194.5.82.43:23131] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Feb 11 07:32:42.026996 2026] [:error] [pid 27965:tid 28018] [client 194.5.82.43:23131] [client 194.5.82.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aYvAGtHLAUAIo8qpZyF1ogAAAE8"]
[Wed Feb 11 07:32:43.434851 2026] [:error] [pid 27966:tid 28040] [client 194.5.82.21:59003] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Feb 11 07:32:43.537205 2026] [:error] [pid 27966:tid 28037] [client 194.5.82.21:59003] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Feb 11 07:32:44.111328 2026] [:error] [pid 27966:tid 28054] [client 194.5.82.21:59003] File does not exist: /usr/local/apache/htdocs/suspended-page/file-manager.php
[Wed Feb 11 07:32:44.214096 2026] [:error] [pid 27966:tid 28042] [client 194.5.82.21:59003] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aYvAHF8HJ9ydyf0SPu7YHAAAAIw"]
[Wed Feb 11 07:32:46.307115 2026] [:error] [pid 27964:tid 27985] [client 194.5.82.20:40413] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Wed Feb 11 07:32:46.420122 2026] [:error] [pid 27964:tid 27994] [client 194.5.82.20:40413] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Wed Feb 11 07:32:46.526973 2026] [:error] [pid 27964:tid 27976] [client 194.5.82.20:40413] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Feb 11 07:32:46.742082 2026] [:error] [pid 27964:tid 27982] [client 194.5.82.20:40413] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Feb 11 07:32:47.839332 2026] [:error] [pid 27964:tid 27991] [client 194.5.82.20:40413] [client 194.5.82.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aYvAH8p0XgWYHLcQtEjwrgAAABA"]
[Wed Feb 11 07:32:49.203519 2026] [:error] [pid 27964:tid 27987] [client 194.5.82.27:32903] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Feb 11 07:32:49.317788 2026] [:error] [pid 27964:tid 27990] [client 194.5.82.27:32903] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Feb 11 07:32:49.883208 2026] [:error] [pid 27964:tid 27978] [client 194.5.82.27:32903] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Wed Feb 11 07:32:50.017566 2026] [:error] [pid 27964:tid 27985] [client 194.5.82.27:32903] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Feb 11 07:32:50.128029 2026] [:error] [pid 27964:tid 27994] [client 194.5.82.27:32903] File does not exist: /usr/local/apache/htdocs/suspended-page/tx20.php
[Wed Feb 11 07:32:50.227465 2026] [:error] [pid 27964:tid 27976] [client 194.5.82.27:32903] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Feb 11 07:32:50.427366 2026] [:error] [pid 27964:tid 27997] [client 194.5.82.27:32903] [client 194.5.82.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aYvAIsp0XgWYHLcQtEjwvAAAABY"]
[Wed Feb 11 07:32:51.227775 2026] [:error] [pid 27964:tid 27991] [client 194.5.82.39:49631] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Wed Feb 11 07:32:51.519384 2026] [:error] [pid 27964:tid 27992] [client 194.5.82.39:49631] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Wed Feb 11 07:32:51.725433 2026] [:error] [pid 27964:tid 27988] [client 194.5.82.39:49631] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Feb 11 07:32:51.908946 2026] [:error] [pid 27964:tid 27987] [client 194.5.82.39:49631] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Wed Feb 11 07:32:52.324272 2026] [:error] [pid 27964:tid 27979] [client 194.5.82.39:49631] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Wed Feb 11 07:32:52.524629 2026] [:error] [pid 27964:tid 27978] [client 194.5.82.39:49631] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Feb 11 07:32:52.623543 2026] [:error] [pid 27964:tid 27999] [client 194.5.82.39:49631] [client 194.5.82.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aYvAJMp0XgWYHLcQtEjwygAAABg"]
[Wed Feb 11 07:32:54.426129 2026] [:error] [pid 17401:tid 17416] [client 194.5.82.12:32665] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Wed Feb 11 07:32:54.769723 2026] [:error] [pid 17401:tid 17416] [client 194.5.82.12:32665] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Wed Feb 11 07:32:54.919565 2026] [:error] [pid 17401:tid 17414] [client 194.5.82.12:32665] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Wed Feb 11 07:32:55.017091 2026] [:error] [pid 17401:tid 17417] [client 194.5.82.12:32665] [client 194.5.82.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "aYvAJw0lHeayTY40t364mQAAAQ4"]
[Wed Feb 11 07:32:57.034503 2026] [:error] [pid 27966:tid 28036] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Wed Feb 11 07:32:57.226368 2026] [:error] [pid 27966:tid 28040] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Wed Feb 11 07:32:57.329358 2026] [:error] [pid 27966:tid 28037] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Wed Feb 11 07:32:57.433167 2026] [:error] [pid 27966:tid 28038] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Wed Feb 11 07:32:57.610758 2026] [:error] [pid 27966:tid 28053] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Wed Feb 11 07:32:57.722173 2026] [:error] [pid 27966:tid 28041] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Feb 11 07:32:57.825282 2026] [:error] [pid 27966:tid 28030] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Wed Feb 11 07:32:58.026294 2026] [:error] [pid 27966:tid 28044] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Wed Feb 11 07:32:58.211453 2026] [:error] [pid 27966:tid 28042] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Wed Feb 11 07:32:58.323799 2026] [:error] [pid 27966:tid 28031] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/options.php
[Wed Feb 11 07:32:58.631707 2026] [:error] [pid 27966:tid 28047] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Wed Feb 11 07:32:58.728398 2026] [:error] [pid 27966:tid 28033] [client 194.5.82.41:60999] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Wed Feb 11 07:32:59.020082 2026] [:error] [pid 27966:tid 28036] [client 194.5.82.41:60999] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/layout.php"] [unique_id "aYvAK18HJ9ydyf0SPu7YPAAAAIY"]
[Wed Feb 11 07:33:01.230758 2026] [:error] [pid 28073:tid 28094] [client 194.5.82.18:37457] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aYvALYeHYIlOlF-DsMywgAAAANM"]
[Wed Feb 11 07:33:02.610819 2026] [:error] [pid 27964:tid 27997] [client 194.5.82.52:20185] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aYvALsp0XgWYHLcQtEjw3wAAABY"]
[Wed Feb 11 07:33:04.984192 2026] [:error] [pid 27965:tid 28026] [client 194.5.82.47:53773] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Feb 11 07:33:05.121744 2026] [:error] [pid 27965:tid 28017] [client 194.5.82.47:53773] [client 194.5.82.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aYvAMdHLAUAIo8qpZyF1yAAAAE4"]
[Wed Feb 11 07:33:06.632698 2026] [:error] [pid 27965:tid 28008] [client 194.5.82.5:27523] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Wed Feb 11 07:33:06.811071 2026] [:error] [pid 27965:tid 28013] [client 194.5.82.5:27523] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Feb 11 07:33:07.230380 2026] [:error] [pid 27965:tid 28021] [client 194.5.82.5:27523] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 11 07:33:07.520583 2026] [:error] [pid 27965:tid 28006] [client 194.5.82.5:27523] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aYvAM9HLAUAIo8qpZyF11QAAAEM"]
[Wed Feb 11 07:33:09.917824 2026] [:error] [pid 22570:tid 22601] [client 194.5.82.25:58541] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/generated-classname.php"] [unique_id "aYvANSE5uSe043FXwQqrmQAAAcE"]
[Wed Feb 11 07:33:12.134072 2026] [:error] [pid 22570:tid 22609] [client 194.5.82.8:34321] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Wed Feb 11 07:33:12.334512 2026] [:error] [pid 22570:tid 22607] [client 194.5.82.8:34321] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Wed Feb 11 07:33:12.512778 2026] [:error] [pid 22570:tid 22610] [client 194.5.82.8:34321] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Wed Feb 11 07:33:13.433404 2026] [:error] [pid 22570:tid 22604] [client 194.5.82.8:34321] File does not exist: /usr/local/apache/htdocs/suspended-page/tx24.php
[Wed Feb 11 07:33:13.526316 2026] [:error] [pid 22570:tid 22617] [client 194.5.82.8:34321] [client 194.5.82.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/dashboard.php"] [unique_id "aYvAOSE5uSe043FXwQqrqgAAAdE"]
[Wed Feb 11 07:33:15.818692 2026] [:error] [pid 22537:tid 22546] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Feb 11 07:33:15.922779 2026] [:error] [pid 22537:tid 22558] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/akc.php
[Wed Feb 11 07:33:16.032364 2026] [:error] [pid 22537:tid 22541] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Wed Feb 11 07:33:16.213445 2026] [:error] [pid 22537:tid 22562] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Wed Feb 11 07:33:16.434886 2026] [:error] [pid 22537:tid 22553] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Wed Feb 11 07:33:16.542155 2026] [:error] [pid 22537:tid 22549] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Wed Feb 11 07:33:16.727265 2026] [:error] [pid 22537:tid 22552] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Feb 11 07:33:16.843237 2026] [:error] [pid 22537:tid 22550] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/class_api.php
[Wed Feb 11 07:33:17.014029 2026] [:error] [pid 22537:tid 22551] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Feb 11 07:33:17.409433 2026] [:error] [pid 22537:tid 22544] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/xxl.php
[Wed Feb 11 07:33:17.518846 2026] [:error] [pid 22537:tid 22546] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/wp2.php
[Wed Feb 11 07:33:17.712255 2026] [:error] [pid 22537:tid 22541] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/sitemap.php
[Wed Feb 11 07:33:18.123348 2026] [:error] [pid 22537:tid 22562] [client 194.5.82.21:49825] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Wed Feb 11 07:33:18.230349 2026] [:error] [pid 22537:tid 22542] [client 194.5.82.21:49825] [client 194.5.82.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/chosen.php"] [unique_id "aYvAPifg2TagwM3bvQNEfQAAAUM"]
[Wed Feb 11 07:33:19.030954 2026] [:error] [pid 27966:tid 28039] [client 194.5.82.52:62301] [client 194.5.82.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/bala.php"] [unique_id "aYvAP18HJ9ydyf0SPu7YUQAAAIk"]
[Wed Feb 11 07:33:19.498396 2026] [:error] [pid 27965:tid 28017] [client 194.5.82.28:38073] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/themes.php"] [unique_id "aYvAP9HLAUAIo8qpZyF14wAAAE4"]
[Wed Feb 11 07:33:20.907687 2026] [:error] [pid 27965:tid 28003] [client 194.5.82.26:41815] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Wed Feb 11 07:33:21.014462 2026] [:error] [pid 27965:tid 28024] [client 194.5.82.26:41815] File does not exist: /usr/local/apache/htdocs/suspended-page/lf.php
[Wed Feb 11 07:33:21.129967 2026] [:error] [pid 27965:tid 28014] [client 194.5.82.26:41815] File does not exist: /usr/local/apache/htdocs/suspended-page/bala.php
[Wed Feb 11 07:33:21.223105 2026] [:error] [pid 27965:tid 28021] [client 194.5.82.26:41815] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aYvAQdHLAUAIo8qpZyF18QAAAFI"]
[Wed Feb 11 07:33:24.713199 2026] [:error] [pid 22537:tid 22552] [client 194.5.82.6:63557] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Wed Feb 11 07:33:25.005886 2026] [:error] [pid 22537:tid 22556] [client 194.5.82.6:63557] [client 194.5.82.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aYvARSfg2TagwM3bvQNEjAAAAVE"]
[Wed Feb 11 07:33:26.713973 2026] [:error] [pid 22570:tid 22613] [client 194.5.82.37:52277] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-load.php"] [unique_id "aYvARiE5uSe043FXwQqrtQAAAc0"]
[Wed Feb 11 07:33:27.501673 2026] [:error] [pid 22537:tid 22543] [client 194.5.82.34:59927] File does not exist: /usr/local/apache/htdocs/suspended-page/cux.php
[Wed Feb 11 07:33:27.818826 2026] [:error] [pid 22537:tid 22544] [client 194.5.82.34:59927] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Wed Feb 11 07:33:27.932599 2026] [:error] [pid 22537:tid 22540] [client 194.5.82.34:59927] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Wed Feb 11 07:33:28.027479 2026] [:error] [pid 22537:tid 22541] [client 194.5.82.34:59927] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Feb 11 07:33:28.130378 2026] [:error] [pid 22537:tid 22563] [client 194.5.82.34:59927] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Wed Feb 11 07:33:28.237869 2026] [:error] [pid 22537:tid 22542] [client 194.5.82.34:59927] File does not exist: /usr/local/apache/htdocs/suspended-page/r.php
[Wed Feb 11 07:33:28.346114 2026] [:error] [pid 22537:tid 22559] [client 194.5.82.34:59927] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aYvASCfg2TagwM3bvQNElgAAAVQ"]
[Wed Feb 11 07:33:29.423652 2026] [:error] [pid 27965:tid 28010] [client 194.5.82.41:58485] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/my1.php
[Wed Feb 11 07:33:29.628634 2026] [:error] [pid 27965:tid 28012] [client 194.5.82.41:58485] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Feb 11 07:33:29.844799 2026] [:error] [pid 27965:tid 28023] [client 194.5.82.41:58485] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Wed Feb 11 07:33:30.122652 2026] [:error] [pid 27965:tid 28013] [client 194.5.82.41:58485] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-22.php
[Wed Feb 11 07:33:30.526278 2026] [:error] [pid 27965:tid 28008] [client 194.5.82.41:58485] File does not exist: /usr/local/apache/htdocs/suspended-page/smm.php
[Wed Feb 11 07:33:30.625312 2026] [:error] [pid 27965:tid 28020] [client 194.5.82.41:58485] [client 194.5.82.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "aYvAStHLAUAIo8qpZyF2CgAAAFE"]
[Wed Feb 11 07:33:31.107261 2026] [:error] [pid 27964:tid 27990] [client 194.5.82.13:20411] File does not exist: /usr/local/apache/htdocs/suspended-page/wso-x569.php
[Wed Feb 11 07:33:31.263363 2026] [:error] [pid 27964:tid 27996] [client 194.5.82.13:20411] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Wed Feb 11 07:33:31.630359 2026] [:error] [pid 27964:tid 27980] [client 194.5.82.13:20411] File does not exist: /usr/local/apache/htdocs/suspended-page/a1vx.php
[Wed Feb 11 07:33:31.727695 2026] [:error] [pid 27964:tid 27997] [client 194.5.82.13:20411] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Wed Feb 11 07:33:31.905611 2026] [:error] [pid 27964:tid 27976] [client 194.5.82.13:20411] [client 194.5.82.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Proxy/HTTP.term.php"] [unique_id "aYvAS8p0XgWYHLcQtEjxEgAAAAE"]
[Wed Feb 11 07:33:32.932506 2026] [:error] [pid 22537:tid 22543] [client 194.5.82.34:50275] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Feb 11 07:33:33.208292 2026] [:error] [pid 22537:tid 22544] [client 194.5.82.34:50275] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_class_datalib.php
[Wed Feb 11 07:33:33.427561 2026] [:error] [pid 22537:tid 22540] [client 194.5.82.34:50275] [client 194.5.82.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/utils.php"] [unique_id "aYvATSfg2TagwM3bvQNEoAAAAUE"]
[Wed Feb 11 07:33:34.023449 2026] [:error] [pid 27964:tid 27975] [client 194.5.82.46:55861] File does not exist: /usr/local/apache/htdocs/suspended-page/kex.php
[Wed Feb 11 07:33:34.727581 2026] [:error] [pid 27964:tid 27983] [client 194.5.82.46:55861] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 11 07:33:34.831400 2026] [:error] [pid 27964:tid 27987] [client 194.5.82.46:55861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Feb 11 07:33:36.116301 2026] [:error] [pid 27964:tid 27996] [client 194.5.82.46:55861] [client 194.5.82.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/db-update.php"] [unique_id "aYvAUMp0XgWYHLcQtEjxIQAAABU"]
[Wed Feb 11 07:33:37.017968 2026] [:error] [pid 28073:tid 28084] [client 194.5.82.19:49595] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Feb 11 07:33:37.232831 2026] [:error] [pid 28073:tid 28089] [client 194.5.82.19:49595] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Wed Feb 11 07:33:37.420256 2026] [:error] [pid 28073:tid 28081] [client 194.5.82.19:49595] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Wed Feb 11 07:33:37.729496 2026] [:error] [pid 28073:tid 28099] [client 194.5.82.19:49595] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-comments.php
[Wed Feb 11 07:33:37.909414 2026] [:error] [pid 28073:tid 28094] [client 194.5.82.19:49595] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/ini_db_model.php"] [unique_id "aYvAUYeHYIlOlF-DsMywpwAAANM"]
[Wed Feb 11 07:33:38.521914 2026] [:error] [pid 27966:tid 28039] [client 194.5.82.5:51783] File does not exist: /usr/local/apache/htdocs/suspended-page/tx17.php
[Wed Feb 11 07:33:40.315577 2026] [:error] [pid 27966:tid 28034] [client 194.5.82.5:51783] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 11 07:33:40.611822 2026] [:error] [pid 27966:tid 28051] [client 194.5.82.5:51783] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Wed Feb 11 07:33:41.115092 2026] [:error] [pid 27966:tid 28053] [client 194.5.82.5:51783] File does not exist: /usr/local/apache/htdocs/suspended-page/dex.php
[Wed Feb 11 07:33:41.405912 2026] [:error] [pid 27966:tid 28031] [client 194.5.82.5:51783] [client 194.5.82.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/sx.php"] [unique_id "aYvAVV8HJ9ydyf0SPu7YeQAAAIE"]
[Wed Feb 11 07:33:42.115113 2026] [:error] [pid 27965:tid 28015] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/02.php
[Wed Feb 11 07:33:42.225960 2026] [:error] [pid 27965:tid 28003] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Feb 11 07:33:42.516004 2026] [:error] [pid 27965:tid 28008] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Wed Feb 11 07:33:42.920835 2026] [:error] [pid 27965:tid 28027] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/Yanzmini.php
[Wed Feb 11 07:33:43.428872 2026] [:error] [pid 27965:tid 28008] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/0.php
[Wed Feb 11 07:33:43.812527 2026] [:error] [pid 27965:tid 28006] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/million.php
[Wed Feb 11 07:33:44.019126 2026] [:error] [pid 27965:tid 28015] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/ava.php
[Wed Feb 11 07:33:44.440003 2026] [:error] [pid 27965:tid 28023] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/system.php
[Wed Feb 11 07:33:44.618876 2026] [:error] [pid 27965:tid 28026] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/uplozvb.php
[Wed Feb 11 07:33:45.132056 2026] [:error] [pid 27965:tid 28012] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/network_xo.php
[Wed Feb 11 07:33:45.230936 2026] [:error] [pid 27965:tid 28010] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/22.php
[Wed Feb 11 07:33:45.630899 2026] [:error] [pid 27965:tid 28027] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Wed Feb 11 07:33:47.333597 2026] [:error] [pid 27965:tid 28007] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Wed Feb 11 07:33:47.534507 2026] [:error] [pid 27965:tid 28006] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Feb 11 07:33:47.629262 2026] [:error] [pid 27965:tid 28012] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Feb 11 07:33:47.737402 2026] [:error] [pid 27965:tid 28010] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Wed Feb 11 07:33:47.840129 2026] [:error] [pid 27965:tid 28025] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Wed Feb 11 07:33:48.025631 2026] [:error] [pid 27965:tid 28003] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Wed Feb 11 07:33:48.328737 2026] [:error] [pid 27965:tid 28018] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/klbnm.php
[Wed Feb 11 07:33:48.717750 2026] [:error] [pid 27965:tid 28026] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Feb 11 07:33:48.819860 2026] [:error] [pid 27965:tid 28023] [client 194.5.82.37:41175] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Wed Feb 11 07:33:49.025416 2026] [:error] [pid 27965:tid 28011] [client 194.5.82.37:41175] [client 194.5.82.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/custom-classname.php"] [unique_id "aYvAXdHLAUAIo8qpZyF2cgAAAEg"]
[Wed Feb 11 07:33:49.723454 2026] [:error] [pid 22537:tid 22545] [client 194.5.82.26:23645] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Feb 11 07:33:49.840635 2026] [:error] [pid 22537:tid 22547] [client 194.5.82.26:23645] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/cloud.php
[Wed Feb 11 07:33:50.338283 2026] [:error] [pid 22537:tid 22551] [client 194.5.82.26:23645] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Wed Feb 11 07:33:50.522255 2026] [:error] [pid 22537:tid 22554] [client 194.5.82.26:23645] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add-admin.php
[Wed Feb 11 07:33:50.634100 2026] [:error] [pid 22537:tid 22561] [client 194.5.82.26:23645] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aYvAXifg2TagwM3bvQNEtgAAAVY"]
[Wed Feb 11 07:33:51.325275 2026] [:error] [pid 22570:tid 22608] [client 194.5.82.30:29479] [client 194.5.82.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/db_model.php"] [unique_id "aYvAXyE5uSe043FXwQqr2QAAAcg"]
[Wed Feb 11 07:33:52.210092 2026] [:error] [pid 17401:tid 17414] [client 194.5.82.28:37533] File does not exist: /usr/local/apache/htdocs/suspended-page/v.php
[Wed Feb 11 07:33:53.655079 2026] [:error] [pid 17401:tid 17414] [client 194.5.82.28:37533] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Wed Feb 11 07:33:53.819198 2026] [:error] [pid 17401:tid 17421] [client 194.5.82.28:37533] File does not exist: /usr/local/apache/htdocs/suspended-page/22.php
[Wed Feb 11 07:33:53.923656 2026] [:error] [pid 17401:tid 17424] [client 194.5.82.28:37533] [client 194.5.82.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aYvAYQ0lHeayTY40t3641QAAARU"]
[Wed Feb 11 07:33:54.931911 2026] [:error] [pid 27966:tid 28045] [client 194.5.82.26:23033] File does not exist: /usr/local/apache/htdocs/suspended-page/tyasd.php
[Wed Feb 11 07:33:55.436195 2026] [:error] [pid 27966:tid 28041] [client 194.5.82.26:23033] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Wed Feb 11 07:33:55.907202 2026] [:error] [pid 27966:tid 28035] [client 194.5.82.26:23033] [client 194.5.82.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aYvAY18HJ9ydyf0SPu7YigAAAIU"]
[Wed Feb 11 07:33:56.813712 2026] [:error] [pid 22569:tid 22579] [client 194.5.82.25:25185] File does not exist: /usr/local/apache/htdocs/suspended-page/xtride.php
[Wed Feb 11 07:33:57.117539 2026] [:error] [pid 22569:tid 22596] [client 194.5.82.25:25185] File does not exist: /usr/local/apache/htdocs/suspended-page/WSO.php
[Wed Feb 11 07:33:57.229099 2026] [:error] [pid 22569:tid 22597] [client 194.5.82.25:25185] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Wed Feb 11 07:33:57.525771 2026] [:error] [pid 22569:tid 22583] [client 194.5.82.25:25185] [client 194.5.82.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aYvAZcAhSI7iX9G3enhv2wAAAYo"]
[Wed Feb 11 07:33:58.114814 2026] [:error] [pid 22569:tid 22573] [client 194.5.82.19:32043] [client 194.5.82.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "aYvAZsAhSI7iX9G3enhv3AAAAYA"]
[Wed Feb 11 07:33:58.904861 2026] [:error] [pid 27965:tid 28009] [client 194.5.82.40:49929] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Wed Feb 11 07:33:59.224813 2026] [:error] [pid 27965:tid 28010] [client 194.5.82.40:49929] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Feb 11 07:33:59.326507 2026] [:error] [pid 27965:tid 28024] [client 194.5.82.40:49929] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Feb 11 07:33:59.431647 2026] [:error] [pid 27965:tid 28014] [client 194.5.82.40:49929] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Feb 11 07:33:59.544326 2026] [:error] [pid 27965:tid 28003] [client 194.5.82.40:49929] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Wed Feb 11 07:33:59.842317 2026] [:error] [pid 27965:tid 28026] [client 194.5.82.40:49929] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi2.php
[Wed Feb 11 07:34:26.521097 2026] [autoindex:error] [pid 27966:tid 28053] [client 194.5.82.18:55355] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 11 07:34:32.740761 2026] [:error] [pid 27966:tid 28046] [client 194.5.82.18:55355] [client 194.5.82.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager"] [unique_id "aYvAiF8HJ9ydyf0SPu7ZFgAAAJA"]
[Wed Feb 11 13:39:46.569177 2026] [:error] [pid 27965:tid 28018] [client 49.51.183.75:55506] [client 49.51.183.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYwWItHLAUAIo8qpZyHr7wAAAE8"]
[Wed Feb 11 15:35:54.946519 2026] [:error] [pid 28073:tid 28089] [client 95.154.200.40:60990] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aYwxWoeHYIlOlF-DsMxfVgAAAM4"]
[Wed Feb 11 15:35:55.905173 2026] [:error] [pid 27964:tid 27999] [client 95.154.200.40:50384] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aYwxW8p0XgWYHLcQtEiAQwAAABg"]
[Wed Feb 11 15:35:56.860840 2026] [:error] [pid 27965:tid 28011] [client 95.154.200.40:50390] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/tools.js"] [unique_id "aYwxXNHLAUAIo8qpZyEMZwAAAEg"]
[Wed Feb 11 15:35:57.825925 2026] [:error] [pid 27964:tid 27975] [client 95.154.200.40:50400] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/translate_inline.js"] [unique_id "aYwxXcp0XgWYHLcQtEiASwAAAAA"]
[Wed Feb 11 15:35:58.796094 2026] [:error] [pid 22537:tid 22541] [client 95.154.200.40:50406] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skin/adminhtml/default/default/boxes.css"] [unique_id "aYwxXifg2TagwM3bvQO3YgAAAUI"]
[Wed Feb 11 15:35:59.755029 2026] [:error] [pid 27964:tid 27977] [client 95.154.200.40:50420] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/prototype/validation.js"] [unique_id "aYwxX8p0XgWYHLcQtEiATgAAAAI"]
[Wed Feb 11 15:36:00.723303 2026] [:error] [pid 27965:tid 28015] [client 95.154.200.40:50436] [client 95.154.200.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RELEASE_NOTES.txt"] [unique_id "aYwxYNHLAUAIo8qpZyEMbQAAAEw"]
[Wed Feb 11 17:08:29.707606 2026] [:error] [pid 28073:tid 28085] [client 43.130.111.40:38430] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYxHDYeHYIlOlF-DsMyLgQAAAMo"]
[Wed Feb 11 22:51:50.893109 2026] [:error] [pid 28073:tid 28099] [client 43.159.128.237:57766] [client 43.159.128.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYyXhoeHYIlOlF-DsMwXdgAAANg"]
[Wed Feb 11 23:20:58.037712 2026] [:error] [pid 28073:tid 28076] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Feb 11 23:20:58.287746 2026] [:error] [pid 28073:tid 28089] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/.info.php
[Wed Feb 11 23:20:58.611937 2026] [:error] [pid 28073:tid 28075] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Wed Feb 11 23:20:58.852271 2026] [:error] [pid 28073:tid 28099] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Feb 11 23:20:59.095984 2026] [:error] [pid 28073:tid 28094] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Feb 11 23:20:59.346266 2026] [:error] [pid 28073:tid 28088] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Wed Feb 11 23:20:59.586983 2026] [:error] [pid 28073:tid 28087] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Feb 11 23:20:59.830821 2026] [:error] [pid 28073:tid 28079] [client 40.89.133.161:61810] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 12 02:52:36.986875 2026] [:error] [pid 49093:tid 49109] [client 34.148.198.67:62398] [client 34.148.198.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.148.198.67, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aYzP9AYzxX9Zu4qZ-D2ZmAAAAEs"]
[Thu Feb 12 02:52:36.990622 2026] [:error] [pid 49093:tid 49109] [client 34.148.198.67:62398] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 12 02:52:40.872216 2026] [:error] [pid 49093:tid 49119] [client 34.148.198.67:62398] [client 34.148.198.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aYzP-AYzxX9Zu4qZ-D2ZpgAAAFU"]
[Thu Feb 12 02:52:41.362833 2026] [:error] [pid 49095:tid 49160] [client 34.148.198.67:49965] [client 34.148.198.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aYzP-YDzbTIrmslQGKT5rwAAAQc"]
[Thu Feb 12 02:52:41.843629 2026] [:error] [pid 49093:tid 49122] [client 34.148.198.67:54062] [client 34.148.198.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aYzP-QYzxX9Zu4qZ-D2ZqAAAAFg"]
[Thu Feb 12 03:39:05.610428 2026] [:error] [pid 57533:tid 57576] [client 182.44.12.37:53194] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aYza2cBMbk5EwuXt4Zex2wAAAEE"]
[Thu Feb 12 05:36:30.292326 2026] [:error] [pid 57532:tid 57564] [client 43.155.140.157:37758] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aYz2XofDW9Kql6FLJINTfQAAABY"]
[Thu Feb 12 10:09:10.669315 2026] [:error] [pid 50169:tid 50244] [client 114.96.103.33:54164] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aY02RrQmA2Sph23KFXBL4gAAAdI"]
[Thu Feb 12 12:02:45.323913 2026] [:error] [pid 50169:tid 50229] [client 43.166.132.142:53042] [client 43.166.132.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aY1Q5bQmA2Sph23KFXBxWQAAAcM"]
[Thu Feb 12 14:39:16.989649 2026] [:error] [pid 50167:tid 50179] [client 170.106.187.106:33790] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aY11lDOWAjqME-_ayFPc2AAAAMg"]
[Thu Feb 12 17:14:36.163876 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Feb 12 17:14:36.432276 2026] [:error] [pid 21434:tid 21504] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/xoot.php
[Thu Feb 12 17:14:36.701145 2026] [:error] [pid 21434:tid 21497] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/er.php
[Thu Feb 12 17:14:36.985383 2026] [:error] [pid 21434:tid 21499] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/fault.php
[Thu Feb 12 17:14:37.256122 2026] [:error] [pid 21434:tid 21510] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/x2x.php
[Thu Feb 12 17:14:37.524175 2026] [:error] [pid 21434:tid 21515] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Thu Feb 12 17:14:37.792388 2026] [:error] [pid 21434:tid 21509] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Feb 12 17:14:38.061057 2026] [:error] [pid 21434:tid 21513] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/leuk.php
[Thu Feb 12 17:14:38.341990 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/bc-456.php
[Thu Feb 12 17:14:38.611100 2026] [:error] [pid 21434:tid 21501] [client 20.111.8.41:13565] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php
[Thu Feb 12 17:14:38.881660 2026] [:error] [pid 21434:tid 21497] [client 20.111.8.41:13565] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bvb.php"] [unique_id "aY2Z_gbL1v6OC5G-tE-Y0AAAAcA"]
[Thu Feb 12 17:14:39.399089 2026] [:error] [pid 21434:tid 21499] [client 20.111.8.41:8211] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bvb.php"] [unique_id "aY2Z_wbL1v6OC5G-tE-Y0gAAAcI"]
[Thu Feb 12 17:14:39.975726 2026] [:error] [pid 21431:tid 21445] [client 20.111.8.41:7477] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bvb.php"] [unique_id "aY2Z_5gxKQsNF5X8gtSHsQAAAMk"]
[Thu Feb 12 17:14:40.526479 2026] [:error] [pid 21434:tid 21514] [client 20.111.8.41:7831] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bvb.php"] [unique_id "aY2aAAbL1v6OC5G-tE-Y1QAAAdE"]
[Thu Feb 12 17:14:41.101050 2026] [:error] [pid 21434:tid 21512] [client 20.111.8.41:23404] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aY2aAQbL1v6OC5G-tE-Y2AAAAc8"]
[Thu Feb 12 17:14:41.689273 2026] [:error] [pid 39777:tid 39796] [client 20.111.8.41:9743] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aY2aAVzexR6hGUkt5pPVFgAAAFE"]
[Thu Feb 12 17:14:42.253517 2026] [:error] [pid 21434:tid 21517] [client 20.111.8.41:23352] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aY2aAgbL1v6OC5G-tE-Y3gAAAdQ"]
[Thu Feb 12 17:14:42.753391 2026] [:error] [pid 21431:tid 21450] [client 20.111.8.41:10504] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aY2aApgxKQsNF5X8gtSHvQAAAM4"]
[Thu Feb 12 17:14:43.318218 2026] [:error] [pid 21434:tid 21505] [client 20.111.8.41:7436] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kolda.php"] [unique_id "aY2aAwbL1v6OC5G-tE-Y4AAAAcg"]
[Thu Feb 12 17:14:43.866309 2026] [:error] [pid 21527:tid 21543] [client 20.111.8.41:7444] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kolda.php"] [unique_id "aY2aAyaer9JPUXlMLuHAWgAAAA4"]
[Thu Feb 12 17:14:44.337692 2026] [:error] [pid 21527:tid 21544] [client 20.111.8.41:9746] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kolda.php"] [unique_id "aY2aBCaer9JPUXlMLuHAXAAAAA8"]
[Thu Feb 12 17:14:44.936254 2026] [:error] [pid 21434:tid 21498] [client 20.111.8.41:16596] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kolda.php"] [unique_id "aY2aBAbL1v6OC5G-tE-Y5QAAAcE"]
[Thu Feb 12 17:14:45.486568 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:1946] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aY2aBZgxKQsNF5X8gtSHwQAAANc"]
[Thu Feb 12 17:14:45.970382 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:10514] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aY2aBSaer9JPUXlMLuHAbQAAAAk"]
[Thu Feb 12 17:14:46.524624 2026] [:error] [pid 21433:tid 21479] [client 20.111.8.41:14542] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aY2aBtc_9AdG3uAKpzvvQgAAAYk"]
[Thu Feb 12 17:14:47.096219 2026] [:error] [pid 21527:tid 21536] [client 20.111.8.41:1974] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aY2aByaer9JPUXlMLuHAfQAAAAc"]
[Thu Feb 12 17:14:47.577232 2026] [:error] [pid 21431:tid 21445] [client 20.111.8.41:25213] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god.php"] [unique_id "aY2aB5gxKQsNF5X8gtSHxQAAAMk"]
[Thu Feb 12 17:14:48.054883 2026] [:error] [pid 21431:tid 21438] [client 20.111.8.41:7449] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god.php"] [unique_id "aY2aCJgxKQsNF5X8gtSHxwAAAMI"]
[Thu Feb 12 17:14:48.618802 2026] [:error] [pid 21431:tid 21439] [client 20.111.8.41:1245] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god.php"] [unique_id "aY2aCJgxKQsNF5X8gtSHyQAAAMM"]
[Thu Feb 12 17:14:49.199884 2026] [:error] [pid 21527:tid 21532] [client 20.111.8.41:14591] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god.php"] [unique_id "aY2aCSaer9JPUXlMLuHAoQAAAAM"]
[Thu Feb 12 17:14:49.854390 2026] [:error] [pid 21431:tid 21441] [client 20.111.8.41:1959] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aY2aCZgxKQsNF5X8gtSHzAAAAMU"]
[Thu Feb 12 17:14:50.469167 2026] [:error] [pid 21431:tid 21436] [client 20.111.8.41:23386] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aY2aCpgxKQsNF5X8gtSH0QAAAMA"]
[Thu Feb 12 17:14:51.100738 2026] [:error] [pid 21434:tid 21502] [client 20.111.8.41:1239] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aY2aCwbL1v6OC5G-tE-Y8gAAAcU"]
[Thu Feb 12 17:14:51.644200 2026] [:error] [pid 21431:tid 21453] [client 20.111.8.41:10557] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aY2aC5gxKQsNF5X8gtSH1QAAANE"]
[Thu Feb 12 17:14:52.191178 2026] [:error] [pid 21431:tid 21438] [client 20.111.8.41:14568] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aY2aDJgxKQsNF5X8gtSH1gAAAMI"]
[Thu Feb 12 17:14:52.853752 2026] [:error] [pid 39777:tid 39794] [client 20.111.8.41:1257] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aY2aDFzexR6hGUkt5pPVVQAAAE8"]
[Thu Feb 12 17:14:53.572154 2026] [:error] [pid 21527:tid 21541] [client 20.111.8.41:8209] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aY2aDSaer9JPUXlMLuHAwwAAAAw"]
[Thu Feb 12 17:14:54.181365 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:32775] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aY2aDpgxKQsNF5X8gtSH3AAAANc"]
[Thu Feb 12 17:14:55.163960 2026] [:error] [pid 21527:tid 21546] [client 20.111.8.41:32821] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aY2aDyaer9JPUXlMLuHAzQAAABE"]
[Thu Feb 12 17:14:56.168697 2026] [:error] [pid 21433:tid 21486] [client 20.111.8.41:9330] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aY2aENc_9AdG3uAKpzvvbwAAAZA"]
[Thu Feb 12 17:14:57.258906 2026] [:error] [pid 21434:tid 21504] [client 20.111.8.41:12171] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aY2aEQbL1v6OC5G-tE-ZDgAAAcc"]
[Thu Feb 12 17:14:58.069356 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:11421] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aY2aEiaer9JPUXlMLuHA8gAAAAI"]
[Thu Feb 12 17:14:58.703418 2026] [:error] [pid 39777:tid 39779] [client 20.111.8.41:16618] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aY2aElzexR6hGUkt5pPVZwAAAEA"]
[Thu Feb 12 17:14:59.264812 2026] [:error] [pid 21434:tid 21514] [client 20.111.8.41:7442] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aY2aEwbL1v6OC5G-tE-ZGgAAAdE"]
[Thu Feb 12 17:14:59.810743 2026] [:error] [pid 21527:tid 21534] [client 20.111.8.41:19383] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aY2aEyaer9JPUXlMLuHBCgAAAAU"]
[Thu Feb 12 17:15:00.718763 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:16377] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aY2aFCaer9JPUXlMLuHBFwAAAAE"]
[Thu Feb 12 17:15:01.563394 2026] [:error] [pid 21527:tid 21551] [client 20.111.8.41:16375] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lts.php"] [unique_id "aY2aFSaer9JPUXlMLuHBHgAAABY"]
[Thu Feb 12 17:15:02.193173 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:7474] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lts.php"] [unique_id "aY2aFiaer9JPUXlMLuHBJQAAAAE"]
[Thu Feb 12 17:15:02.926057 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:16537] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lts.php"] [unique_id "aY2aFiaer9JPUXlMLuHBKwAAAAk"]
[Thu Feb 12 17:15:03.523204 2026] [:error] [pid 21527:tid 21539] [client 20.111.8.41:38054] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lts.php"] [unique_id "aY2aFyaer9JPUXlMLuHBNAAAAAo"]
[Thu Feb 12 17:15:04.245032 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:23334] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aY2aGCaer9JPUXlMLuHBPAAAAAI"]
[Thu Feb 12 17:15:04.804269 2026] [:error] [pid 21431:tid 21440] [client 20.111.8.41:7826] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aY2aGJgxKQsNF5X8gtSH_QAAAMQ"]
[Thu Feb 12 17:15:05.345295 2026] [:error] [pid 21527:tid 21550] [client 20.111.8.41:7840] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aY2aGSaer9JPUXlMLuHBRwAAABU"]
[Thu Feb 12 17:15:05.828163 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:1313] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aY2aGSaer9JPUXlMLuHBTwAAAAQ"]
[Thu Feb 12 17:15:06.418297 2026] [:error] [pid 21527:tid 21547] [client 20.111.8.41:10170] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login8.php"] [unique_id "aY2aGiaer9JPUXlMLuHBVwAAABI"]
[Thu Feb 12 17:15:07.041448 2026] [:error] [pid 39777:tid 39782] [client 20.111.8.41:12209] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login8.php"] [unique_id "aY2aG1zexR6hGUkt5pPVhQAAAEM"]
[Thu Feb 12 17:15:07.684775 2026] [:error] [pid 39777:tid 39801] [client 20.111.8.41:16536] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login8.php"] [unique_id "aY2aG1zexR6hGUkt5pPViwAAAFY"]
[Thu Feb 12 17:15:08.240169 2026] [:error] [pid 21434:tid 21509] [client 20.111.8.41:7820] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/login8.php"] [unique_id "aY2aHAbL1v6OC5G-tE-ZLQAAAcw"]
[Thu Feb 12 17:15:08.843905 2026] [:error] [pid 21527:tid 21532] [client 20.111.8.41:16522] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nnyvn.php"] [unique_id "aY2aHCaer9JPUXlMLuHBZAAAAAM"]
[Thu Feb 12 17:15:09.382006 2026] [:error] [pid 21434:tid 21502] [client 20.111.8.41:8842] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nnyvn.php"] [unique_id "aY2aHQbL1v6OC5G-tE-ZMgAAAcU"]
[Thu Feb 12 17:15:10.049890 2026] [:error] [pid 21434:tid 21519] [client 20.111.8.41:12213] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nnyvn.php"] [unique_id "aY2aHgbL1v6OC5G-tE-ZPQAAAdY"]
[Thu Feb 12 17:15:10.689798 2026] [:error] [pid 21434:tid 21505] [client 20.111.8.41:7854] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nnyvn.php"] [unique_id "aY2aHgbL1v6OC5G-tE-ZQgAAAcg"]
[Thu Feb 12 17:15:11.269583 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:11449] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aY2aH5gxKQsNF5X8gtSIBwAAANc"]
[Thu Feb 12 17:15:11.886964 2026] [:error] [pid 21431:tid 21451] [client 20.111.8.41:7833] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aY2aH5gxKQsNF5X8gtSICgAAAM8"]
[Thu Feb 12 17:15:12.552504 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:7871] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aY2aICaer9JPUXlMLuHBpQAAAAg"]
[Thu Feb 12 17:15:13.119377 2026] [:error] [pid 21434:tid 21502] [client 20.111.8.41:13512] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aY2aIQbL1v6OC5G-tE-ZTgAAAcU"]
[Thu Feb 12 17:15:13.685869 2026] [:error] [pid 21433:tid 21485] [client 20.111.8.41:16563] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lul.php"] [unique_id "aY2aIdc_9AdG3uAKpzvvowAAAY8"]
[Thu Feb 12 17:15:14.267772 2026] [:error] [pid 39777:tid 39783] [client 20.111.8.41:16552] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lul.php"] [unique_id "aY2aIlzexR6hGUkt5pPV1QAAAEQ"]
[Thu Feb 12 17:15:14.949383 2026] [:error] [pid 21431:tid 21439] [client 20.111.8.41:38059] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lul.php"] [unique_id "aY2aIpgxKQsNF5X8gtSIEwAAAMM"]
[Thu Feb 12 17:15:15.487126 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:16323] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lul.php"] [unique_id "aY2aI5gxKQsNF5X8gtSIFQAAANc"]
[Thu Feb 12 17:15:16.048259 2026] [:error] [pid 39777:tid 39784] [client 20.111.8.41:10113] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aY2aJFzexR6hGUkt5pPV3gAAAEU"]
[Thu Feb 12 17:15:16.695178 2026] [:error] [pid 21431:tid 21437] [client 20.111.8.41:7235] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aY2aJJgxKQsNF5X8gtSIGQAAAME"]
[Thu Feb 12 17:15:17.240907 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:30147] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aY2aJSaer9JPUXlMLuHBuAAAABQ"]
[Thu Feb 12 17:15:17.804075 2026] [:error] [pid 21434:tid 21508] [client 20.111.8.41:1197] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aY2aJQbL1v6OC5G-tE-ZVwAAAcs"]
[Thu Feb 12 17:15:18.598633 2026] [:error] [pid 21431:tid 21436] [client 20.111.8.41:30814] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aY2aJpgxKQsNF5X8gtSIHAAAAMA"]
[Thu Feb 12 17:15:19.155482 2026] [:error] [pid 21431:tid 21460] [client 20.111.8.41:10514] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aY2aJ5gxKQsNF5X8gtSIHQAAANg"]
[Thu Feb 12 17:15:19.713923 2026] [:error] [pid 21433:tid 21494] [client 20.111.8.41:30809] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aY2aJ9c_9AdG3uAKpzvvywAAAZg"]
[Thu Feb 12 17:15:20.418029 2026] [:error] [pid 21433:tid 21489] [client 20.111.8.41:17536] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aY2aKNc_9AdG3uAKpzvvzQAAAZM"]
[Thu Feb 12 17:15:20.892502 2026] [:error] [pid 21433:tid 21480] [client 20.111.8.41:8455] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ya.php"] [unique_id "aY2aKNc_9AdG3uAKpzvv0AAAAYo"]
[Thu Feb 12 17:15:21.539624 2026] [:error] [pid 21431:tid 21446] [client 20.111.8.41:17870] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ya.php"] [unique_id "aY2aKZgxKQsNF5X8gtSIIQAAAMo"]
[Thu Feb 12 17:15:22.169713 2026] [:error] [pid 21434:tid 21501] [client 20.111.8.41:30173] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ya.php"] [unique_id "aY2aKgbL1v6OC5G-tE-ZcQAAAcQ"]
[Thu Feb 12 17:15:22.734803 2026] [:error] [pid 21434:tid 21509] [client 20.111.8.41:1805] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ya.php"] [unique_id "aY2aKgbL1v6OC5G-tE-ZdgAAAcw"]
[Thu Feb 12 17:15:23.298710 2026] [:error] [pid 21527:tid 21535] [client 20.111.8.41:9085] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aY2aKyaer9JPUXlMLuHBwgAAAAY"]
[Thu Feb 12 17:15:23.969094 2026] [:error] [pid 21431:tid 21448] [client 20.111.8.41:1819] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aY2aK5gxKQsNF5X8gtSIJQAAAMw"]
[Thu Feb 12 17:15:24.735962 2026] [:error] [pid 21434:tid 21507] [client 20.111.8.41:7246] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aY2aLAbL1v6OC5G-tE-ZfwAAAco"]
[Thu Feb 12 17:15:25.258109 2026] [:error] [pid 21527:tid 21542] [client 20.111.8.41:7244] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aY2aLSaer9JPUXlMLuHByQAAAA0"]
[Thu Feb 12 17:15:25.901890 2026] [:error] [pid 21527:tid 21534] [client 20.111.8.41:7236] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aY2aLSaer9JPUXlMLuHB0gAAAAU"]
[Thu Feb 12 17:15:26.424321 2026] [:error] [pid 21527:tid 21553] [client 20.111.8.41:7261] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aY2aLiaer9JPUXlMLuHB1gAAABg"]
[Thu Feb 12 17:15:27.037203 2026] [:error] [pid 21431:tid 21446] [client 20.111.8.41:30180] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aY2aL5gxKQsNF5X8gtSIKgAAAMo"]
[Thu Feb 12 17:15:27.659511 2026] [:error] [pid 21431:tid 21444] [client 20.111.8.41:13567] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aY2aL5gxKQsNF5X8gtSILAAAAMg"]
[Thu Feb 12 17:15:28.465156 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:25875] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aY2aMCaer9JPUXlMLuHB1wAAAAE"]
[Thu Feb 12 17:15:29.094209 2026] [:error] [pid 21434:tid 21519] [client 20.111.8.41:1198] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aY2aMQbL1v6OC5G-tE-ZhAAAAdY"]
[Thu Feb 12 17:15:29.703158 2026] [:error] [pid 39777:tid 39800] [client 20.111.8.41:18345] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aY2aMVzexR6hGUkt5pPV_QAAAFU"]
[Thu Feb 12 17:15:30.374127 2026] [:error] [pid 21431:tid 21437] [client 20.111.8.41:17817] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftem.php"] [unique_id "aY2aMpgxKQsNF5X8gtSINwAAAME"]
[Thu Feb 12 17:15:30.976627 2026] [:error] [pid 21434:tid 21511] [client 20.111.8.41:25893] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7wom.php"] [unique_id "aY2aMgbL1v6OC5G-tE-ZigAAAc4"]
[Thu Feb 12 17:15:31.503421 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:17806] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7wom.php"] [unique_id "aY2aMyaer9JPUXlMLuHB4QAAABQ"]
[Thu Feb 12 17:15:32.083338 2026] [:error] [pid 21431:tid 21443] [client 20.111.8.41:1167] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7wom.php"] [unique_id "aY2aNJgxKQsNF5X8gtSIOQAAAMc"]
[Thu Feb 12 17:15:32.660499 2026] [:error] [pid 21431:tid 21454] [client 20.111.8.41:10153] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7wom.php"] [unique_id "aY2aNJgxKQsNF5X8gtSIPgAAANI"]
[Thu Feb 12 17:15:33.235763 2026] [:error] [pid 39777:tid 39779] [client 20.111.8.41:9077] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aY2aNVzexR6hGUkt5pPWBQAAAEA"]
[Thu Feb 12 17:15:33.872646 2026] [:error] [pid 21434:tid 21516] [client 20.111.8.41:30844] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aY2aNQbL1v6OC5G-tE-ZjgAAAdM"]
[Thu Feb 12 17:15:34.377181 2026] [:error] [pid 21433:tid 21471] [client 20.111.8.41:30805] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aY2aNtc_9AdG3uAKpzvv9gAAAYE"]
[Thu Feb 12 17:15:34.955778 2026] [:error] [pid 21527:tid 21534] [client 20.111.8.41:9060] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aY2aNiaer9JPUXlMLuHB6gAAAAU"]
[Thu Feb 12 17:15:35.513690 2026] [:error] [pid 21434:tid 21514] [client 20.111.8.41:10275] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aY2aNwbL1v6OC5G-tE-ZkAAAAdE"]
[Thu Feb 12 17:15:36.071425 2026] [:error] [pid 21527:tid 21540] [client 20.111.8.41:20181] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aY2aOCaer9JPUXlMLuHB8gAAAAs"]
[Thu Feb 12 17:15:36.669748 2026] [:error] [pid 39777:tid 39789] [client 20.111.8.41:10270] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aY2aOFzexR6hGUkt5pPWCQAAAEo"]
[Thu Feb 12 17:15:37.141386 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:9080] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aY2aOSaer9JPUXlMLuHB9QAAAAQ"]
[Thu Feb 12 17:15:37.660249 2026] [:error] [pid 21527:tid 21543] [client 20.111.8.41:17821] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aY2aOSaer9JPUXlMLuHB-AAAAA4"]
[Thu Feb 12 17:15:38.191745 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Thu Feb 12 17:15:38.514927 2026] [:error] [pid 21527:tid 21534] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Feb 12 17:15:38.778645 2026] [:error] [pid 21527:tid 21536] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Thu Feb 12 17:15:39.042879 2026] [:error] [pid 21527:tid 21547] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Thu Feb 12 17:15:39.344753 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/fot.php
[Thu Feb 12 17:15:39.608200 2026] [:error] [pid 21527:tid 21553] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Thu Feb 12 17:15:39.892162 2026] [:error] [pid 21527:tid 21552] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Thu Feb 12 17:15:40.156806 2026] [:error] [pid 21527:tid 21540] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Thu Feb 12 17:15:40.435366 2026] [:error] [pid 21527:tid 21535] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Thu Feb 12 17:15:40.704138 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/ffd.php
[Thu Feb 12 17:15:40.972040 2026] [:error] [pid 21527:tid 21532] [client 20.111.8.41:11725] File does not exist: /usr/local/apache/htdocs/suspended-page/admiin.php
[Thu Feb 12 17:15:41.282806 2026] [:error] [pid 21527:tid 21532] [client 20.111.8.41:11725] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aY2aPSaer9JPUXlMLuHCBwAAAAM"]
[Thu Feb 12 17:15:41.895639 2026] [:error] [pid 39777:tid 39789] [client 20.111.8.41:12215] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aY2aPVzexR6hGUkt5pPWGgAAAEo"]
[Thu Feb 12 17:15:42.430248 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:10281] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aY2aPiaer9JPUXlMLuHCCwAAAAI"]
[Thu Feb 12 17:15:42.922459 2026] [:error] [pid 21433:tid 21489] [client 20.111.8.41:30839] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aY2aPtc_9AdG3uAKpzvwAAAAAZM"]
[Thu Feb 12 17:15:43.428970 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:30169] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aY2aP5gxKQsNF5X8gtSIVwAAANc"]
[Thu Feb 12 17:15:43.912434 2026] [:error] [pid 21434:tid 21514] [client 20.111.8.41:30149] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aY2aPwbL1v6OC5G-tE-ZmgAAAdE"]
[Thu Feb 12 17:15:44.495451 2026] [:error] [pid 21433:tid 21485] [client 20.111.8.41:38052] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aY2aQNc_9AdG3uAKpzvwBQAAAY8"]
[Thu Feb 12 17:15:45.146918 2026] [:error] [pid 21431:tid 21446] [client 20.111.8.41:11769] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aY2aQZgxKQsNF5X8gtSIWwAAAMo"]
[Thu Feb 12 17:15:45.701337 2026] [:error] [pid 21527:tid 21552] [client 20.111.8.41:14214] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aQSaer9JPUXlMLuHCEAAAABc"]
[Thu Feb 12 17:15:46.284233 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:11768] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aQiaer9JPUXlMLuHCFAAAAAE"]
[Thu Feb 12 17:15:46.833134 2026] [:error] [pid 21433:tid 21478] [client 20.111.8.41:16331] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aQtc_9AdG3uAKpzvwCgAAAYg"]
[Thu Feb 12 17:15:47.539710 2026] [:error] [pid 21434:tid 21497] [client 20.111.8.41:8615] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aQwbL1v6OC5G-tE-ZogAAAcA"]
[Thu Feb 12 17:15:48.144333 2026] [:error] [pid 21434:tid 21513] [client 20.111.8.41:11451] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aY2aRAbL1v6OC5G-tE-ZpQAAAdA"]
[Thu Feb 12 17:15:48.701777 2026] [:error] [pid 21433:tid 21482] [client 20.111.8.41:7220] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aY2aRNc_9AdG3uAKpzvwEAAAAYw"]
[Thu Feb 12 17:15:49.556486 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:13534] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aY2aRVzexR6hGUkt5pPWLAAAAEc"]
[Thu Feb 12 17:15:50.358890 2026] [:error] [pid 21431:tid 21448] [client 20.111.8.41:8394] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aY2aRpgxKQsNF5X8gtSIYgAAAMw"]
[Thu Feb 12 17:15:50.978565 2026] [:error] [pid 39777:tid 39795] [client 20.111.8.41:9242] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aY2aRlzexR6hGUkt5pPWLwAAAFA"]
[Thu Feb 12 17:15:51.674085 2026] [:error] [pid 39777:tid 39788] [client 20.111.8.41:25829] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aY2aR1zexR6hGUkt5pPWMwAAAEk"]
[Thu Feb 12 17:15:52.379581 2026] [:error] [pid 21433:tid 21493] [client 20.111.8.41:20162] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aY2aSNc_9AdG3uAKpzvwFgAAAZc"]
[Thu Feb 12 17:15:53.005881 2026] [:error] [pid 21431:tid 21447] [client 20.111.8.41:8384] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aY2aSZgxKQsNF5X8gtSIbgAAAMs"]
[Thu Feb 12 17:15:53.711684 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:14764] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aY2aSSaer9JPUXlMLuHCHQAAAAk"]
[Thu Feb 12 17:15:54.383616 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:25836] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aY2aSgbL1v6OC5G-tE-ZrQAAAcY"]
[Thu Feb 12 17:15:55.196065 2026] [:error] [pid 21433:tid 21479] [client 20.111.8.41:16524] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aY2aS9c_9AdG3uAKpzvwGQAAAYk"]
[Thu Feb 12 17:15:55.780502 2026] [:error] [pid 21527:tid 21545] [client 20.111.8.41:25825] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aY2aSyaer9JPUXlMLuHCJAAAABA"]
[Thu Feb 12 17:15:56.451715 2026] [:error] [pid 21527:tid 21544] [client 20.111.8.41:11438] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aTCaer9JPUXlMLuHCJgAAAA8"]
[Thu Feb 12 17:15:57.197747 2026] [:error] [pid 21433:tid 21481] [client 20.111.8.41:16561] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aTdc_9AdG3uAKpzvwIAAAAYs"]
[Thu Feb 12 17:15:57.929195 2026] [:error] [pid 39777:tid 39795] [client 20.111.8.41:23854] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aTVzexR6hGUkt5pPWPgAAAFA"]
[Thu Feb 12 17:15:58.620506 2026] [:error] [pid 21527:tid 21536] [client 20.111.8.41:9225] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aY2aTiaer9JPUXlMLuHCLAAAAAc"]
[Thu Feb 12 17:15:59.328652 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:11586] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aY2aTyaer9JPUXlMLuHCMAAAAAg"]
[Thu Feb 12 17:16:00.043826 2026] [:error] [pid 21431:tid 21455] [client 20.111.8.41:7213] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aY2aUJgxKQsNF5X8gtSIewAAANM"]
[Thu Feb 12 17:16:00.768788 2026] [:error] [pid 39777:tid 39788] [client 20.111.8.41:7394] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aY2aUFzexR6hGUkt5pPWQQAAAEk"]
[Thu Feb 12 17:16:01.285047 2026] [:error] [pid 21431:tid 21452] [client 20.111.8.41:11985] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aY2aUZgxKQsNF5X8gtSIfQAAANA"]
[Thu Feb 12 17:16:01.934221 2026] [:error] [pid 21434:tid 21517] [client 20.111.8.41:8630] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aY2aUQbL1v6OC5G-tE-ZtAAAAdQ"]
[Thu Feb 12 17:16:02.508063 2026] [:error] [pid 39777:tid 39791] [client 20.111.8.41:11974] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aY2aUlzexR6hGUkt5pPWRQAAAEw"]
[Thu Feb 12 17:16:03.294507 2026] [:error] [pid 21433:tid 21473] [client 20.111.8.41:14779] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aY2aU9c_9AdG3uAKpzvwLAAAAYM"]
[Thu Feb 12 17:16:03.850706 2026] [:error] [pid 21433:tid 21494] [client 20.111.8.41:8409] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aY2aU9c_9AdG3uAKpzvwLwAAAZg"]
[Thu Feb 12 17:16:05.174159 2026] [:error] [pid 39777:tid 39785] [client 20.111.8.41:8441] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aY2aVVzexR6hGUkt5pPWSAAAAEY"]
[Thu Feb 12 17:16:06.083658 2026] [:error] [pid 21431:tid 21455] [client 20.111.8.41:14757] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aY2aVpgxKQsNF5X8gtSIiwAAANM"]
[Thu Feb 12 17:16:06.940175 2026] [:error] [pid 21431:tid 21456] [client 20.111.8.41:25854] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aY2aVpgxKQsNF5X8gtSIkwAAANQ"]
[Thu Feb 12 17:16:07.689454 2026] [:error] [pid 21431:tid 21439] [client 20.111.8.41:14781] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aY2aV5gxKQsNF5X8gtSIoAAAAMM"]
[Thu Feb 12 17:16:08.315916 2026] [:error] [pid 21434:tid 21499] [client 20.111.8.41:8859] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aY2aWAbL1v6OC5G-tE-ZvAAAAcI"]
[Thu Feb 12 17:16:08.989962 2026] [:error] [pid 21434:tid 21518] [client 20.111.8.41:32730] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aY2aWAbL1v6OC5G-tE-ZvQAAAdU"]
[Thu Feb 12 17:16:09.571825 2026] [:error] [pid 39777:tid 39795] [client 20.111.8.41:9420] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aY2aWVzexR6hGUkt5pPWUAAAAFA"]
[Thu Feb 12 17:16:10.150961 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:7217] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aY2aWgbL1v6OC5G-tE-ZwAAAAck"]
[Thu Feb 12 17:16:11.241117 2026] [:error] [pid 21527:tid 21553] [client 20.111.8.41:9459] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aY2aWyaer9JPUXlMLuHCQAAAABg"]
[Thu Feb 12 17:16:11.765020 2026] [:error] [pid 21433:tid 21494] [client 20.111.8.41:8399] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aY2aW9c_9AdG3uAKpzvwPAAAAZg"]
[Thu Feb 12 17:16:12.326152 2026] [:error] [pid 21433:tid 21481] [client 20.111.8.41:8599] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aY2aXNc_9AdG3uAKpzvwPwAAAYs"]
[Thu Feb 12 17:16:12.868981 2026] [:error] [pid 21433:tid 21472] [client 20.111.8.41:8515] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aY2aXNc_9AdG3uAKpzvwQgAAAYI"]
[Thu Feb 12 17:16:13.405163 2026] [:error] [pid 21433:tid 21474] [client 20.111.8.41:8867] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trd.php"] [unique_id "aY2aXdc_9AdG3uAKpzvwRgAAAYQ"]
[Thu Feb 12 17:16:13.897558 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:32741] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trd.php"] [unique_id "aY2aXSaer9JPUXlMLuHCQwAAABQ"]
[Thu Feb 12 17:16:14.436648 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:12696] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trd.php"] [unique_id "aY2aXpgxKQsNF5X8gtSIugAAANc"]
[Thu Feb 12 17:16:14.910647 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:24951] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trd.php"] [unique_id "aY2aXgbL1v6OC5G-tE-ZyQAAAcY"]
[Thu Feb 12 17:16:15.478006 2026] [:error] [pid 21434:tid 21498] [client 20.111.8.41:7223] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aY2aXwbL1v6OC5G-tE-ZzQAAAcE"]
[Thu Feb 12 17:16:15.997639 2026] [:error] [pid 39777:tid 39795] [client 20.111.8.41:10661] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aY2aX1zexR6hGUkt5pPWWwAAAFA"]
[Thu Feb 12 17:16:16.903381 2026] [:error] [pid 21527:tid 21536] [client 20.111.8.41:8420] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aY2aYCaer9JPUXlMLuHCSgAAAAc"]
[Thu Feb 12 17:16:17.397127 2026] [:error] [pid 21431:tid 21438] [client 20.111.8.41:8423] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/past.php"] [unique_id "aY2aYZgxKQsNF5X8gtSIwgAAAMI"]
[Thu Feb 12 17:16:17.888710 2026] [:error] [pid 39777:tid 39799] [client 20.111.8.41:12284] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aY2aYVzexR6hGUkt5pPWYgAAAFQ"]
[Thu Feb 12 17:16:18.476388 2026] [:error] [pid 21527:tid 21535] [client 20.111.8.41:7367] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aY2aYiaer9JPUXlMLuHCUQAAAAY"]
[Thu Feb 12 17:16:18.969009 2026] [:error] [pid 39777:tid 39802] [client 20.111.8.41:9219] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aY2aYlzexR6hGUkt5pPWZQAAAFc"]
[Thu Feb 12 17:16:19.475102 2026] [:error] [pid 39777:tid 39789] [client 20.111.8.41:24667] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aY2aY1zexR6hGUkt5pPWaAAAAEo"]
[Thu Feb 12 17:16:20.133325 2026] [:error] [pid 21431:tid 21447] [client 20.111.8.41:10323] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aY2aZJgxKQsNF5X8gtSIyQAAAMs"]
[Thu Feb 12 17:16:20.719152 2026] [:error] [pid 21527:tid 21548] [client 20.111.8.41:8580] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aY2aZCaer9JPUXlMLuHCVwAAABM"]
[Thu Feb 12 17:16:21.248168 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:8543] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aY2aZSaer9JPUXlMLuHCWQAAAAI"]
[Thu Feb 12 17:16:21.762144 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:9491] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aY2aZSaer9JPUXlMLuHCWgAAAAk"]
[Thu Feb 12 17:16:22.367548 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:10642] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aY2aZiaer9JPUXlMLuHCXQAAAAg"]
[Thu Feb 12 17:16:22.876702 2026] [:error] [pid 21433:tid 21481] [client 20.111.8.41:9484] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aY2aZtc_9AdG3uAKpzvwTwAAAYs"]
[Thu Feb 12 17:16:23.425045 2026] [:error] [pid 21527:tid 21545] [client 20.111.8.41:8395] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aY2aZyaer9JPUXlMLuHCYwAAABA"]
[Thu Feb 12 17:16:23.955857 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:10344] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/admin.php"] [unique_id "aY2aZyaer9JPUXlMLuHCZQAAAAE"]
[Thu Feb 12 17:16:24.583693 2026] [:error] [pid 21434:tid 21519] [client 20.111.8.41:10343] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aY2aaAbL1v6OC5G-tE-Z1QAAAdY"]
[Thu Feb 12 17:16:25.226712 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:8573] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aY2aaSaer9JPUXlMLuHCcgAAAAE"]
[Thu Feb 12 17:16:25.861347 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:9862] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aY2aaZgxKQsNF5X8gtSI2AAAANc"]
[Thu Feb 12 17:16:26.359387 2026] [:error] [pid 21434:tid 21504] [client 20.111.8.41:8881] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aY2aagbL1v6OC5G-tE-Z1wAAAcc"]
[Thu Feb 12 17:16:26.937250 2026] [:error] [pid 21527:tid 21546] [client 20.111.8.41:25853] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aY2aaiaer9JPUXlMLuHCeAAAABE"]
[Thu Feb 12 17:16:27.577031 2026] [:error] [pid 21527:tid 21551] [client 20.111.8.41:10324] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aY2aayaer9JPUXlMLuHCeQAAABY"]
[Thu Feb 12 17:16:28.134244 2026] [:error] [pid 21431:tid 21438] [client 20.111.8.41:8626] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aY2abJgxKQsNF5X8gtSI3QAAAMI"]
[Thu Feb 12 17:16:28.673808 2026] [:error] [pid 21434:tid 21512] [client 20.111.8.41:25822] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aY2abAbL1v6OC5G-tE-Z3gAAAc8"]
[Thu Feb 12 17:16:29.255882 2026] [:error] [pid 21434:tid 21520] [client 20.111.8.41:24126] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aY2abQbL1v6OC5G-tE-Z4wAAAdc"]
[Thu Feb 12 17:16:29.945813 2026] [:error] [pid 21434:tid 21497] [client 20.111.8.41:14755] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aY2abQbL1v6OC5G-tE-Z6AAAAcA"]
[Thu Feb 12 17:16:30.516232 2026] [:error] [pid 39777:tid 39784] [client 20.111.8.41:1610] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aY2ablzexR6hGUkt5pPWdQAAAEU"]
[Thu Feb 12 17:16:31.204825 2026] [:error] [pid 39777:tid 39801] [client 20.111.8.41:14747] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aY2ab1zexR6hGUkt5pPWeQAAAFY"]
[Thu Feb 12 17:16:31.931332 2026] [:error] [pid 21433:tid 21480] [client 20.111.8.41:1067] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aY2ab9c_9AdG3uAKpzvwYAAAAYo"]
[Thu Feb 12 17:16:32.486358 2026] [:error] [pid 39777:tid 39800] [client 20.111.8.41:1040] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aY2acFzexR6hGUkt5pPWfAAAAFU"]
[Thu Feb 12 17:16:32.989746 2026] [:error] [pid 21433:tid 21470] [client 20.111.8.41:7387] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aY2acNc_9AdG3uAKpzvwYQAAAYA"]
[Thu Feb 12 17:16:33.519782 2026] [:error] [pid 21433:tid 21486] [client 20.111.8.41:8418] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "aY2acdc_9AdG3uAKpzvwZgAAAZA"]
[Thu Feb 12 17:16:34.084809 2026] [:error] [pid 21433:tid 21489] [client 20.111.8.41:7205] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aY2actc_9AdG3uAKpzvwaAAAAZM"]
[Thu Feb 12 17:16:34.701455 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:9482] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aY2aciaer9JPUXlMLuHChgAAAAk"]
[Thu Feb 12 17:16:35.350683 2026] [:error] [pid 21431:tid 21443] [client 20.111.8.41:8519] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aY2ac5gxKQsNF5X8gtSI5QAAAMc"]
[Thu Feb 12 17:16:35.927907 2026] [:error] [pid 21431:tid 21450] [client 20.111.8.41:7383] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aY2ac5gxKQsNF5X8gtSI5wAAAM4"]
[Thu Feb 12 17:16:36.418821 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:9865] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aY2adCaer9JPUXlMLuHCigAAAAI"]
[Thu Feb 12 17:16:36.928261 2026] [:error] [pid 39777:tid 39800] [client 20.111.8.41:10365] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aY2adFzexR6hGUkt5pPWiAAAAFU"]
[Thu Feb 12 17:16:37.570341 2026] [:error] [pid 21431:tid 21460] [client 20.111.8.41:9866] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aY2adZgxKQsNF5X8gtSI6wAAANg"]
[Thu Feb 12 17:16:38.147718 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:1829] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aY2adiaer9JPUXlMLuHCkgAAABQ"]
[Thu Feb 12 17:16:38.940851 2026] [:error] [pid 21527:tid 21553] [client 20.111.8.41:10331] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aY2adiaer9JPUXlMLuHClwAAABg"]
[Thu Feb 12 17:16:39.584402 2026] [:error] [pid 21433:tid 21489] [client 20.111.8.41:10350] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aY2ad9c_9AdG3uAKpzvweQAAAZM"]
[Thu Feb 12 17:16:40.306242 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/tcp.php
[Thu Feb 12 17:16:40.600942 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Feb 12 17:16:40.897011 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Feb 12 17:16:41.194773 2026] [:error] [pid 21527:tid 21553] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Thu Feb 12 17:16:41.501964 2026] [:error] [pid 21527:tid 21551] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Thu Feb 12 17:16:41.798947 2026] [:error] [pid 21527:tid 21547] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/ov.php
[Thu Feb 12 17:16:42.095675 2026] [:error] [pid 21527:tid 21534] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/past1.php
[Thu Feb 12 17:16:42.760058 2026] [:error] [pid 21527:tid 21529] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Feb 12 17:16:43.055986 2026] [:error] [pid 21527:tid 21542] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Feb 12 17:16:43.363317 2026] [:error] [pid 21527:tid 21544] [client 20.111.8.41:8387] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Feb 12 17:16:43.676276 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:8387] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yos.php"] [unique_id "aY2aeyaer9JPUXlMLuHCuQAAAAQ"]
[Thu Feb 12 17:16:44.282792 2026] [:error] [pid 21433:tid 21483] [client 20.111.8.41:10675] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yos.php"] [unique_id "aY2afNc_9AdG3uAKpzvwjgAAAY0"]
[Thu Feb 12 17:16:44.875140 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:9525] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yos.php"] [unique_id "aY2afAbL1v6OC5G-tE-aTgAAAck"]
[Thu Feb 12 17:16:45.451363 2026] [:error] [pid 21527:tid 21552] [client 20.111.8.41:10633] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yos.php"] [unique_id "aY2afSaer9JPUXlMLuHCvAAAABc"]
[Thu Feb 12 17:16:46.096424 2026] [:error] [pid 21434:tid 21519] [client 20.111.8.41:9881] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aY2afgbL1v6OC5G-tE-aWAAAAdY"]
[Thu Feb 12 17:16:46.652110 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:7624] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aY2afgbL1v6OC5G-tE-aWQAAAck"]
[Thu Feb 12 17:16:47.223194 2026] [:error] [pid 21527:tid 21535] [client 20.111.8.41:24075] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aY2afyaer9JPUXlMLuHCxQAAAAY"]
[Thu Feb 12 17:16:47.842840 2026] [:error] [pid 21433:tid 21479] [client 20.111.8.41:32739] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nope.php"] [unique_id "aY2af9c_9AdG3uAKpzvwkgAAAYk"]
[Thu Feb 12 17:16:48.361212 2026] [:error] [pid 39777:tid 39793] [client 20.111.8.41:9580] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aY2agFzexR6hGUkt5pPWlwAAAE4"]
[Thu Feb 12 17:16:48.862488 2026] [:error] [pid 21433:tid 21484] [client 20.111.8.41:9895] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aY2agNc_9AdG3uAKpzvwkwAAAY4"]
[Thu Feb 12 17:16:49.649798 2026] [:error] [pid 21434:tid 21505] [client 20.111.8.41:8884] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aY2agQbL1v6OC5G-tE-aZAAAAcg"]
[Thu Feb 12 17:16:50.243305 2026] [:error] [pid 21433:tid 21486] [client 20.111.8.41:24104] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aY2agtc_9AdG3uAKpzvwmgAAAZA"]
[Thu Feb 12 17:16:51.035201 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:24069] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "aY2agwbL1v6OC5G-tE-aaAAAAck"]
[Thu Feb 12 17:16:51.881752 2026] [:error] [pid 39777:tid 39788] [client 20.111.8.41:8403] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "aY2ag1zexR6hGUkt5pPWmgAAAEk"]
[Thu Feb 12 17:16:52.568713 2026] [:error] [pid 21434:tid 21500] [client 20.111.8.41:24699] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "aY2ahAbL1v6OC5G-tE-abgAAAcM"]
[Thu Feb 12 17:16:53.093446 2026] [:error] [pid 21433:tid 21482] [client 20.111.8.41:9533] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "aY2ahdc_9AdG3uAKpzvwowAAAYw"]
[Thu Feb 12 17:16:53.630699 2026] [:error] [pid 21433:tid 21489] [client 20.111.8.41:1085] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aY2ahdc_9AdG3uAKpzvwpAAAAZM"]
[Thu Feb 12 17:16:54.129249 2026] [:error] [pid 21431:tid 21445] [client 20.111.8.41:24692] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aY2ahpgxKQsNF5X8gtSI-gAAAMk"]
[Thu Feb 12 17:16:54.724428 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:8443] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aY2ahiaer9JPUXlMLuHC0gAAAAg"]
[Thu Feb 12 17:16:55.262520 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:24124] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aY2ahyaer9JPUXlMLuHC5QAAAAk"]
[Thu Feb 12 17:16:55.804836 2026] [:error] [pid 21431:tid 21452] [client 20.111.8.41:9545] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aY2ah5gxKQsNF5X8gtSJFgAAANA"]
[Thu Feb 12 17:16:56.395120 2026] [:error] [pid 21527:tid 21546] [client 20.111.8.41:1817] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aY2aiCaer9JPUXlMLuHDBgAAABE"]
[Thu Feb 12 17:16:56.962719 2026] [:error] [pid 21433:tid 21483] [client 20.111.8.41:9449] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aY2aiNc_9AdG3uAKpzvwqAAAAY0"]
[Thu Feb 12 17:16:57.654013 2026] [:error] [pid 21433:tid 21485] [client 20.111.8.41:1795] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aY2aidc_9AdG3uAKpzvwqQAAAY8"]
[Thu Feb 12 17:16:58.323645 2026] [:error] [pid 21433:tid 21491] [client 20.111.8.41:9571] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY2aitc_9AdG3uAKpzvwrAAAAZU"]
[Thu Feb 12 17:16:58.900607 2026] [:error] [pid 39777:tid 39780] [client 20.111.8.41:10363] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY2ailzexR6hGUkt5pPWrwAAAEE"]
[Thu Feb 12 17:16:59.401407 2026] [:error] [pid 21434:tid 21505] [client 20.111.8.41:12946] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY2aiwbL1v6OC5G-tE-auAAAAcg"]
[Thu Feb 12 17:16:59.987398 2026] [:error] [pid 21527:tid 21544] [client 20.111.8.41:21877] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY2aiyaer9JPUXlMLuHDFwAAAA8"]
[Thu Feb 12 17:17:00.500512 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:1822] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aY2ajAbL1v6OC5G-tE-avAAAAcY"]
[Thu Feb 12 17:17:01.072675 2026] [:error] [pid 21527:tid 21535] [client 20.111.8.41:1809] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aY2ajSaer9JPUXlMLuHDHQAAAAY"]
[Thu Feb 12 17:17:01.669723 2026] [:error] [pid 21431:tid 21442] [client 20.111.8.41:32729] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aY2ajZgxKQsNF5X8gtSJIwAAAMY"]
[Thu Feb 12 17:17:02.314274 2026] [:error] [pid 21434:tid 21515] [client 20.111.8.41:10335] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aY2ajgbL1v6OC5G-tE-awQAAAdI"]
[Thu Feb 12 17:17:03.019250 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:24678] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aY2ajwbL1v6OC5G-tE-awwAAAck"]
[Thu Feb 12 17:17:03.652021 2026] [:error] [pid 21431:tid 21444] [client 20.111.8.41:9489] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aY2aj5gxKQsNF5X8gtSJKgAAAMg"]
[Thu Feb 12 17:17:04.273969 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:12982] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aY2akFzexR6hGUkt5pPWuQAAAEc"]
[Thu Feb 12 17:17:04.992952 2026] [:error] [pid 21527:tid 21547] [client 20.111.8.41:1835] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aY2akCaer9JPUXlMLuHDJAAAABI"]
[Thu Feb 12 17:17:05.623284 2026] [:error] [pid 21431:tid 21448] [client 20.111.8.41:12984] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aY2akZgxKQsNF5X8gtSJMQAAAMw"]
[Thu Feb 12 17:17:06.314051 2026] [:error] [pid 21433:tid 21470] [client 20.111.8.41:9909] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aY2aktc_9AdG3uAKpzvwvQAAAYA"]
[Thu Feb 12 17:17:07.095375 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:7660] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aY2akyaer9JPUXlMLuHDKAAAAAg"]
[Thu Feb 12 17:17:07.776747 2026] [:error] [pid 21434:tid 21519] [client 20.111.8.41:25576] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aY2akwbL1v6OC5G-tE-ayAAAAdY"]
[Thu Feb 12 17:17:08.437668 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:8610] [client 20.111.8.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aY2alJgxKQsNF5X8gtSJNQAAANc"]
[Thu Feb 12 17:17:08.973033 2026] [:error] [pid 39777:tid 39800] [client 20.111.8.41:10674] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aY2alFzexR6hGUkt5pPWwgAAAFU"]
[Thu Feb 12 17:17:09.728492 2026] [:error] [pid 21431:tid 21453] [client 20.111.8.41:25546] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aY2alZgxKQsNF5X8gtSJOQAAANE"]
[Thu Feb 12 17:17:10.467691 2026] [:error] [pid 21527:tid 21552] [client 20.111.8.41:1070] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aY2aliaer9JPUXlMLuHDOAAAABc"]
[Thu Feb 12 17:17:11.165907 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:9599] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aY2alyaer9JPUXlMLuHDPAAAAAE"]
[Thu Feb 12 17:17:11.814476 2026] [:error] [pid 21433:tid 21485] [client 20.111.8.41:21837] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aY2al9c_9AdG3uAKpzvwxwAAAY8"]
[Thu Feb 12 17:17:12.521876 2026] [:error] [pid 21433:tid 21477] [client 20.111.8.41:10667] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aY2amNc_9AdG3uAKpzvwyQAAAYc"]
[Thu Feb 12 17:17:13.653294 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:21858] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hexx.php"] [unique_id "aY2amSaer9JPUXlMLuHDRQAAABQ"]
[Thu Feb 12 17:17:14.638846 2026] [:error] [pid 21527:tid 21536] [client 20.111.8.41:32762] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aY2amiaer9JPUXlMLuHDTAAAAAc"]
[Thu Feb 12 17:17:15.162996 2026] [:error] [pid 39777:tid 39783] [client 20.111.8.41:7644] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aY2am1zexR6hGUkt5pPWzAAAAEQ"]
[Thu Feb 12 17:17:15.866540 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:9480] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aY2am1zexR6hGUkt5pPWzwAAAEc"]
[Thu Feb 12 17:17:16.861715 2026] [:error] [pid 21433:tid 21482] [client 20.111.8.41:25803] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aY2anNc_9AdG3uAKpzvwzgAAAYw"]
[Thu Feb 12 17:17:17.509046 2026] [:error] [pid 21433:tid 21488] [client 20.111.8.41:24110] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aY2andc_9AdG3uAKpzvw0AAAAZI"]
[Thu Feb 12 17:17:18.104813 2026] [:error] [pid 21431:tid 21458] [client 20.111.8.41:1842] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aY2anpgxKQsNF5X8gtSJPgAAANY"]
[Thu Feb 12 17:17:18.718948 2026] [:error] [pid 21434:tid 21508] [client 20.111.8.41:21865] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aY2angbL1v6OC5G-tE-a4AAAAcs"]
[Thu Feb 12 17:17:19.415885 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:7561] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aY2anyaer9JPUXlMLuHDWAAAAAQ"]
[Thu Feb 12 17:17:20.019043 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:12972] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aY2aoCaer9JPUXlMLuHDXQAAABQ"]
[Thu Feb 12 17:17:20.721513 2026] [:error] [pid 39777:tid 39792] [client 20.111.8.41:7582] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aY2aoFzexR6hGUkt5pPW4AAAAE0"]
[Thu Feb 12 17:17:21.676787 2026] [:error] [pid 21431:tid 21448] [client 20.111.8.41:21780] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aY2aoZgxKQsNF5X8gtSJRgAAAMw"]
[Thu Feb 12 17:17:22.263763 2026] [:error] [pid 39777:tid 39800] [client 20.111.8.41:24098] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aY2aolzexR6hGUkt5pPW4gAAAFU"]
[Thu Feb 12 17:17:23.042830 2026] [:error] [pid 39777:tid 39794] [client 20.111.8.41:9557] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aY2ao1zexR6hGUkt5pPW5AAAAE8"]
[Thu Feb 12 17:17:23.743299 2026] [:error] [pid 21431:tid 21442] [client 20.111.8.41:25584] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aY2ao5gxKQsNF5X8gtSJSQAAAMY"]
[Thu Feb 12 17:17:24.286229 2026] [:error] [pid 21433:tid 21488] [client 20.111.8.41:24080] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aY2apNc_9AdG3uAKpzvw3wAAAZI"]
[Thu Feb 12 17:17:25.008836 2026] [:error] [pid 39777:tid 39779] [client 20.111.8.41:7627] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aY2apVzexR6hGUkt5pPW5gAAAEA"]
[Thu Feb 12 17:17:25.660767 2026] [:error] [pid 21527:tid 21551] [client 20.111.8.41:7678] [client 20.111.8.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aY2apSaer9JPUXlMLuHDdAAAABY"]
[Thu Feb 12 17:17:26.330156 2026] [:error] [pid 39777:tid 39784] [client 20.111.8.41:21808] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfile25.php"] [unique_id "aY2aplzexR6hGUkt5pPW7gAAAEU"]
[Thu Feb 12 17:17:26.906852 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:7634] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfile25.php"] [unique_id "aY2apgbL1v6OC5G-tE-a-wAAAcY"]
[Thu Feb 12 17:17:27.795919 2026] [:error] [pid 21433:tid 21486] [client 20.111.8.41:7658] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfile25.php"] [unique_id "aY2ap9c_9AdG3uAKpzvw5AAAAZA"]
[Thu Feb 12 17:17:28.343683 2026] [:error] [pid 21527:tid 21553] [client 20.111.8.41:24099] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfile25.php"] [unique_id "aY2aqCaer9JPUXlMLuHDegAAABg"]
[Thu Feb 12 17:17:29.161882 2026] [:error] [pid 39777:tid 39784] [client 20.111.8.41:21779] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aY2aqVzexR6hGUkt5pPXBQAAAEU"]
[Thu Feb 12 17:17:29.838840 2026] [:error] [pid 21431:tid 21445] [client 20.111.8.41:9559] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aY2aqZgxKQsNF5X8gtSJUwAAAMk"]
[Thu Feb 12 17:17:30.485044 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:24118] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aY2aqgbL1v6OC5G-tE-bBwAAAcY"]
[Thu Feb 12 17:17:31.199593 2026] [:error] [pid 21433:tid 21483] [client 20.111.8.41:1084] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aY2aq9c_9AdG3uAKpzvw6QAAAY0"]
[Thu Feb 12 17:17:32.114222 2026] [:error] [pid 21433:tid 21481] [client 20.111.8.41:9528] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aY2arNc_9AdG3uAKpzvw7QAAAYs"]
[Thu Feb 12 17:17:32.713803 2026] [:error] [pid 21527:tid 21541] [client 20.111.8.41:9586] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aY2arCaer9JPUXlMLuHDlAAAAAw"]
[Thu Feb 12 17:17:33.437662 2026] [:error] [pid 21431:tid 21458] [client 20.111.8.41:9886] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aY2arZgxKQsNF5X8gtSJVwAAANY"]
[Thu Feb 12 17:17:34.385805 2026] [:error] [pid 21431:tid 21439] [client 20.111.8.41:7615] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aY2arpgxKQsNF5X8gtSJWQAAAMM"]
[Thu Feb 12 17:17:35.109294 2026] [:error] [pid 21433:tid 21493] [client 20.111.8.41:7557] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aY2ar9c_9AdG3uAKpzvw9gAAAZc"]
[Thu Feb 12 17:17:36.446200 2026] [:error] [pid 21431:tid 21457] [client 20.111.8.41:1810] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aY2asJgxKQsNF5X8gtSJXQAAANU"]
[Thu Feb 12 17:17:37.627151 2026] [:error] [pid 21433:tid 21491] [client 20.111.8.41:8997] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aY2asdc_9AdG3uAKpzvw_wAAAZU"]
[Thu Feb 12 17:17:38.658618 2026] [:error] [pid 21433:tid 21472] [client 20.111.8.41:8980] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aY2astc_9AdG3uAKpzvxBAAAAYI"]
[Thu Feb 12 17:17:39.342062 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:10653] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aY2asyaer9JPUXlMLuHDwQAAAAQ"]
[Thu Feb 12 17:17:39.930888 2026] [:error] [pid 21434:tid 21518] [client 20.111.8.41:9905] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aY2aswbL1v6OC5G-tE-bLQAAAdU"]
[Thu Feb 12 17:17:40.898856 2026] [:error] [pid 21434:tid 21510] [client 20.111.8.41:1050] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aY2atAbL1v6OC5G-tE-bMwAAAc0"]
[Thu Feb 12 17:17:41.703115 2026] [:error] [pid 21434:tid 21504] [client 20.111.8.41:21853] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aY2atQbL1v6OC5G-tE-bNwAAAcc"]
[Thu Feb 12 17:17:42.367701 2026] [:error] [pid 21431:tid 21455] [client 20.111.8.41:24657] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aY2atpgxKQsNF5X8gtSJbgAAANM"]
[Thu Feb 12 17:17:43.196871 2026] [:error] [pid 21527:tid 21550] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/styll.php
[Thu Feb 12 17:17:43.446485 2026] [:error] [pid 21527:tid 21545] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/x7.php
[Thu Feb 12 17:17:43.713865 2026] [:error] [pid 21527:tid 21541] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/thebe.php
[Thu Feb 12 17:17:43.967587 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Thu Feb 12 17:17:44.476153 2026] [:error] [pid 21527:tid 21546] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Thu Feb 12 17:17:44.745121 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu Feb 12 17:17:44.985276 2026] [:error] [pid 21527:tid 21529] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Thu Feb 12 17:17:45.227094 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Thu Feb 12 17:17:45.485252 2026] [:error] [pid 21527:tid 21534] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi.php
[Thu Feb 12 17:17:45.824277 2026] [:error] [pid 21527:tid 21550] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Thu Feb 12 17:17:46.191971 2026] [:error] [pid 21527:tid 21545] [client 20.111.8.41:10624] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Thu Feb 12 17:17:46.428026 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:10624] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2auiaer9JPUXlMLuHD7gAAAAI"]
[Thu Feb 12 17:17:47.296559 2026] [:error] [pid 21433:tid 21486] [client 20.111.8.41:7614] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2au9c_9AdG3uAKpzvxFAAAAZA"]
[Thu Feb 12 17:17:48.201043 2026] [:error] [pid 21431:tid 21438] [client 20.111.8.41:8433] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2avJgxKQsNF5X8gtSJeQAAAMI"]
[Thu Feb 12 17:17:49.182285 2026] [:error] [pid 21431:tid 21456] [client 20.111.8.41:9012] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2avZgxKQsNF5X8gtSJgQAAANQ"]
[Thu Feb 12 17:17:50.007758 2026] [:error] [pid 39777:tid 39787] [client 20.111.8.41:9479] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aY2avlzexR6hGUkt5pPXiwAAAEg"]
[Thu Feb 12 17:17:50.633122 2026] [:error] [pid 39777:tid 39794] [client 20.111.8.41:1811] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aY2avlzexR6hGUkt5pPXjgAAAE8"]
[Thu Feb 12 17:17:51.278665 2026] [:error] [pid 39777:tid 39782] [client 20.111.8.41:9573] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aY2av1zexR6hGUkt5pPXkAAAAEM"]
[Thu Feb 12 17:17:52.121233 2026] [:error] [pid 21434:tid 21497] [client 20.111.8.41:25591] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aY2awAbL1v6OC5G-tE-bYAAAAcA"]
[Thu Feb 12 17:17:53.076766 2026] [:error] [pid 39777:tid 39788] [client 20.111.8.41:8462] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aY2awVzexR6hGUkt5pPXlAAAAEk"]
[Thu Feb 12 17:17:53.922420 2026] [:error] [pid 21433:tid 21488] [client 20.111.8.41:21864] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aY2awdc_9AdG3uAKpzvxKgAAAZI"]
[Thu Feb 12 17:17:54.826369 2026] [:error] [pid 21431:tid 21451] [client 20.111.8.41:9018] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aY2awpgxKQsNF5X8gtSJnQAAAM8"]
[Thu Feb 12 17:17:55.665030 2026] [:error] [pid 21431:tid 21457] [client 20.111.8.41:9017] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aY2aw5gxKQsNF5X8gtSJnwAAANU"]
[Thu Feb 12 17:17:56.544890 2026] [:error] [pid 21431:tid 21450] [client 20.111.8.41:19601] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2axJgxKQsNF5X8gtSJoQAAAM4"]
[Thu Feb 12 17:17:57.305145 2026] [:error] [pid 21527:tid 21544] [client 20.111.8.41:7670] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2axSaer9JPUXlMLuHD-gAAAA8"]
[Thu Feb 12 17:17:57.935601 2026] [:error] [pid 21434:tid 21508] [client 20.111.8.41:12939] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2axQbL1v6OC5G-tE-bZQAAAcs"]
[Thu Feb 12 17:17:58.937242 2026] [:error] [pid 21434:tid 21521] [client 20.111.8.41:7403] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2axgbL1v6OC5G-tE-baAAAAdg"]
[Thu Feb 12 17:17:59.604749 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:9011] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2axyaer9JPUXlMLuHEAwAAAAE"]
[Thu Feb 12 17:18:00.209939 2026] [:error] [pid 21527:tid 21539] [client 20.111.8.41:9911] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2ayCaer9JPUXlMLuHEBQAAAAo"]
[Thu Feb 12 17:18:00.841786 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:12952] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2ayJgxKQsNF5X8gtSJpgAAANc"]
[Thu Feb 12 17:18:01.475322 2026] [:error] [pid 21434:tid 21510] [client 20.111.8.41:8989] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aY2ayQbL1v6OC5G-tE-bcAAAAc0"]
[Thu Feb 12 17:18:02.095971 2026] [:error] [pid 21434:tid 21517] [client 20.111.8.41:9551] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aY2aygbL1v6OC5G-tE-bcwAAAdQ"]
[Thu Feb 12 17:18:02.737633 2026] [:error] [pid 21431:tid 21441] [client 20.111.8.41:8449] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aY2aypgxKQsNF5X8gtSJrAAAAMU"]
[Thu Feb 12 17:18:03.343716 2026] [:error] [pid 21527:tid 21550] [client 20.111.8.41:10639] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aY2ayyaer9JPUXlMLuHEEQAAABU"]
[Thu Feb 12 17:18:04.143657 2026] [:error] [pid 21431:tid 21440] [client 20.111.8.41:24095] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aY2azJgxKQsNF5X8gtSJsQAAAMQ"]
[Thu Feb 12 17:18:04.716677 2026] [:error] [pid 21431:tid 21444] [client 20.111.8.41:9230] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2azJgxKQsNF5X8gtSJtAAAAMg"]
[Thu Feb 12 17:18:05.565660 2026] [:error] [pid 21431:tid 21438] [client 20.111.8.41:19606] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2azZgxKQsNF5X8gtSJugAAAMI"]
[Thu Feb 12 17:18:06.405848 2026] [:error] [pid 21431:tid 21457] [client 20.111.8.41:7646] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2azpgxKQsNF5X8gtSJvgAAANU"]
[Thu Feb 12 17:18:07.040698 2026] [:error] [pid 21527:tid 21540] [client 20.111.8.41:8496] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aY2azyaer9JPUXlMLuHEFQAAAAs"]
[Thu Feb 12 17:18:07.700913 2026] [:error] [pid 39777:tid 39788] [client 20.111.8.41:19620] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "aY2az1zexR6hGUkt5pPXowAAAEk"]
[Thu Feb 12 17:18:08.351942 2026] [:error] [pid 21433:tid 21482] [client 20.111.8.41:25541] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "aY2a0Nc_9AdG3uAKpzvxPwAAAYw"]
[Thu Feb 12 17:18:09.045505 2026] [:error] [pid 39777:tid 39801] [client 20.111.8.41:1806] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "aY2a0VzexR6hGUkt5pPXqAAAAFY"]
[Thu Feb 12 17:18:09.737903 2026] [:error] [pid 39777:tid 39781] [client 20.111.8.41:7662] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "aY2a0VzexR6hGUkt5pPXqwAAAEI"]
[Thu Feb 12 17:18:11.361287 2026] [:error] [pid 21433:tid 21475] [client 20.111.8.41:24078] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aY2a09c_9AdG3uAKpzvxRQAAAYU"]
[Thu Feb 12 17:18:12.004141 2026] [:error] [pid 21433:tid 21481] [client 20.111.8.41:8484] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aY2a1Nc_9AdG3uAKpzvxSQAAAYs"]
[Thu Feb 12 17:18:12.805324 2026] [:error] [pid 21433:tid 21491] [client 20.111.8.41:9452] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aY2a1Nc_9AdG3uAKpzvxTQAAAZU"]
[Thu Feb 12 17:18:13.530826 2026] [:error] [pid 21431:tid 21450] [client 20.111.8.41:19587] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aY2a1ZgxKQsNF5X8gtSJzgAAAM4"]
[Thu Feb 12 17:18:14.206342 2026] [:error] [pid 21527:tid 21550] [client 20.111.8.41:8833] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aY2a1iaer9JPUXlMLuHEHQAAABU"]
[Thu Feb 12 17:18:14.833100 2026] [:error] [pid 21433:tid 21482] [client 20.111.8.41:12948] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aY2a1tc_9AdG3uAKpzvxVAAAAYw"]
[Thu Feb 12 17:18:15.525880 2026] [:error] [pid 21431:tid 21438] [client 20.111.8.41:7630] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aY2a15gxKQsNF5X8gtSJ1QAAAMI"]
[Thu Feb 12 17:18:16.215628 2026] [:error] [pid 21433:tid 21474] [client 20.111.8.41:25598] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aY2a2Nc_9AdG3uAKpzvxVwAAAYQ"]
[Thu Feb 12 17:18:16.880796 2026] [:error] [pid 21431:tid 21457] [client 20.111.8.41:1950] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aY2a2JgxKQsNF5X8gtSJ1gAAANU"]
[Thu Feb 12 17:18:17.771340 2026] [:error] [pid 21527:tid 21536] [client 20.111.8.41:21774] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aY2a2Saer9JPUXlMLuHEKAAAAAc"]
[Thu Feb 12 17:18:18.682268 2026] [:error] [pid 21527:tid 21552] [client 20.111.8.41:1826] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aY2a2iaer9JPUXlMLuHEKwAAABc"]
[Thu Feb 12 17:18:19.437628 2026] [:error] [pid 21431:tid 21443] [client 20.111.8.41:7558] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "aY2a25gxKQsNF5X8gtSJ2QAAAMc"]
[Thu Feb 12 17:18:20.560127 2026] [:error] [pid 21434:tid 21500] [client 20.111.8.41:8991] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aY2a3AbL1v6OC5G-tE-bmAAAAcM"]
[Thu Feb 12 17:18:21.319769 2026] [:error] [pid 21434:tid 21501] [client 20.111.8.41:8978] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aY2a3QbL1v6OC5G-tE-bnAAAAcQ"]
[Thu Feb 12 17:18:22.131430 2026] [:error] [pid 21431:tid 21442] [client 20.111.8.41:9562] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aY2a3pgxKQsNF5X8gtSJ4AAAAMY"]
[Thu Feb 12 17:18:22.819984 2026] [:error] [pid 21433:tid 21476] [client 20.111.8.41:25568] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aY2a3tc_9AdG3uAKpzvxXgAAAYY"]
[Thu Feb 12 17:18:23.569955 2026] [:error] [pid 39777:tid 39803] [client 20.111.8.41:19604] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY2a31zexR6hGUkt5pPXtwAAAFg"]
[Thu Feb 12 17:18:24.192055 2026] [:error] [pid 21527:tid 21546] [client 20.111.8.41:25542] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY2a4Caer9JPUXlMLuHELQAAABE"]
[Thu Feb 12 17:18:24.868448 2026] [:error] [pid 21433:tid 21475] [client 20.111.8.41:9546] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY2a4Nc_9AdG3uAKpzvxYwAAAYU"]
[Thu Feb 12 17:18:25.497456 2026] [:error] [pid 21431:tid 21436] [client 20.111.8.41:7593] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aY2a4ZgxKQsNF5X8gtSJ5AAAAMA"]
[Thu Feb 12 17:18:26.008528 2026] [:error] [pid 39777:tid 39790] [client 20.111.8.41:1962] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aY2a4lzexR6hGUkt5pPXuwAAAEs"]
[Thu Feb 12 17:18:26.593457 2026] [:error] [pid 21433:tid 21473] [client 20.111.8.41:12971] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aY2a4tc_9AdG3uAKpzvxbQAAAYM"]
[Thu Feb 12 17:18:27.284024 2026] [:error] [pid 39777:tid 39793] [client 20.111.8.41:9556] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aY2a41zexR6hGUkt5pPXvAAAAE4"]
[Thu Feb 12 17:18:28.068876 2026] [:error] [pid 39777:tid 39797] [client 20.111.8.41:7583] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "aY2a5FzexR6hGUkt5pPXvgAAAFI"]
[Thu Feb 12 17:18:28.707256 2026] [:error] [pid 39777:tid 39784] [client 20.111.8.41:1052] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aY2a5FzexR6hGUkt5pPXvwAAAEU"]
[Thu Feb 12 17:18:29.250076 2026] [:error] [pid 21431:tid 21443] [client 20.111.8.41:7668] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aY2a5ZgxKQsNF5X8gtSJ6QAAAMc"]
[Thu Feb 12 17:18:29.869547 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:1847] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aY2a5QbL1v6OC5G-tE-bsQAAAck"]
[Thu Feb 12 17:18:30.495086 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:1064] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aY2a5pgxKQsNF5X8gtSJ7QAAANc"]
[Thu Feb 12 17:18:31.441778 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:7635] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aY2a5wbL1v6OC5G-tE-btQAAAcY"]
[Thu Feb 12 17:18:32.157493 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:1061] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aY2a6Caer9JPUXlMLuHEMgAAAAQ"]
[Thu Feb 12 17:18:32.869850 2026] [:error] [pid 21433:tid 21492] [client 20.111.8.41:9010] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aY2a6Nc_9AdG3uAKpzvxfAAAAZY"]
[Thu Feb 12 17:18:33.725529 2026] [:error] [pid 21434:tid 21499] [client 20.111.8.41:7764] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aY2a6QbL1v6OC5G-tE-btwAAAcI"]
[Thu Feb 12 17:18:34.580248 2026] [:error] [pid 39777:tid 39799] [client 20.111.8.41:24065] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aY2a6lzexR6hGUkt5pPXyQAAAFQ"]
[Thu Feb 12 17:18:35.345408 2026] [:error] [pid 21433:tid 21486] [client 20.111.8.41:1060] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aY2a69c_9AdG3uAKpzvxgQAAAZA"]
[Thu Feb 12 17:18:36.250843 2026] [:error] [pid 21433:tid 21470] [client 20.111.8.41:7781] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aY2a7Nc_9AdG3uAKpzvxhAAAAYA"]
[Thu Feb 12 17:18:37.189257 2026] [:error] [pid 21527:tid 21545] [client 20.111.8.41:12966] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aY2a7Saer9JPUXlMLuHEQQAAABA"]
[Thu Feb 12 17:18:38.588671 2026] [:error] [pid 21433:tid 21484] [client 20.111.8.41:25544] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aY2a7tc_9AdG3uAKpzvxjgAAAY4"]
[Thu Feb 12 17:18:39.215107 2026] [:error] [pid 21434:tid 21517] [client 20.111.8.41:10661] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aY2a7wbL1v6OC5G-tE-bvgAAAdQ"]
[Thu Feb 12 17:18:40.060051 2026] [:error] [pid 39777:tid 39782] [client 20.111.8.41:7606] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aY2a8FzexR6hGUkt5pPX0gAAAEM"]
[Thu Feb 12 17:18:40.813730 2026] [:error] [pid 21434:tid 21503] [client 20.111.8.41:8843] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aY2a8AbL1v6OC5G-tE-bxAAAAcY"]
[Thu Feb 12 17:18:41.380928 2026] [:error] [pid 21434:tid 21515] [client 20.111.8.41:21843] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aY2a8QbL1v6OC5G-tE-bxgAAAdI"]
[Thu Feb 12 17:18:42.290673 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:25592] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aY2a8iaer9JPUXlMLuHETwAAAAQ"]
[Thu Feb 12 17:18:43.052851 2026] [:error] [pid 39777:tid 39794] [client 20.111.8.41:10170] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aY2a81zexR6hGUkt5pPX0wAAAE8"]
[Thu Feb 12 17:18:43.932679 2026] [:error] [pid 21527:tid 21536] [client 20.111.8.41:7803] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aY2a8yaer9JPUXlMLuHEUQAAAAc"]
[Thu Feb 12 17:18:44.840235 2026] [:error] [pid 21434:tid 21517] [client 20.111.8.41:8474] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aY2a9AbL1v6OC5G-tE-bzgAAAdQ"]
[Thu Feb 12 17:18:45.409599 2026] [:error] [pid 21527:tid 21550] [client 20.111.8.41:7674] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aY2a9Saer9JPUXlMLuHEVQAAABU"]
[Thu Feb 12 17:18:46.737891 2026] [:error] [pid 39777:tid 39781] [client 20.111.8.41:9593] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Feb 12 17:18:46.999436 2026] [:error] [pid 39777:tid 39796] [client 20.111.8.41:9593] [client 20.111.8.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aY2a9lzexR6hGUkt5pPX3QAAAFE"]
[Thu Feb 12 17:18:47.813512 2026] [:error] [pid 39777:tid 39789] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Thu Feb 12 17:18:48.141836 2026] [:error] [pid 39777:tid 39785] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/jane.php
[Thu Feb 12 17:18:48.510971 2026] [:error] [pid 39777:tid 39794] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Feb 12 17:18:48.791009 2026] [:error] [pid 39777:tid 39791] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Feb 12 17:18:49.177823 2026] [:error] [pid 39777:tid 39779] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Thu Feb 12 17:18:49.458982 2026] [:error] [pid 39777:tid 39788] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Feb 12 17:18:49.744973 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Thu Feb 12 17:18:50.026777 2026] [:error] [pid 39777:tid 39801] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Feb 12 17:18:50.400207 2026] [:error] [pid 39777:tid 39802] [client 20.111.8.41:10566] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Feb 12 17:18:50.760686 2026] [:error] [pid 39777:tid 39793] [client 20.111.8.41:10566] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aY2a-lzexR6hGUkt5pPX7wAAAE4"]
[Thu Feb 12 17:18:51.705099 2026] [:error] [pid 21431:tid 21436] [client 20.111.8.41:10604] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aY2a-5gxKQsNF5X8gtSJ_gAAAMA"]
[Thu Feb 12 17:18:52.489738 2026] [:error] [pid 21527:tid 21546] [client 20.111.8.41:25157] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aY2a_Caer9JPUXlMLuHEawAAABE"]
[Thu Feb 12 17:18:53.274526 2026] [:error] [pid 21434:tid 21516] [client 20.111.8.41:7672] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aY2a_QbL1v6OC5G-tE-b3wAAAdM"]
[Thu Feb 12 17:18:53.917848 2026] [:error] [pid 21431:tid 21456] [client 20.111.8.41:21860] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aY2a_ZgxKQsNF5X8gtSKAwAAANQ"]
[Thu Feb 12 17:18:54.722089 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:21849] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aY2a_lzexR6hGUkt5pPX-AAAAEc"]
[Thu Feb 12 17:18:55.404222 2026] [:error] [pid 21434:tid 21497] [client 20.111.8.41:8482] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aY2a_wbL1v6OC5G-tE-b4QAAAcA"]
[Thu Feb 12 17:18:56.197496 2026] [:error] [pid 39777:tid 39795] [client 20.111.8.41:25188] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aY2bAFzexR6hGUkt5pPX_AAAAFA"]
[Thu Feb 12 17:18:57.091640 2026] [:error] [pid 21433:tid 21471] [client 20.111.8.41:8982] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aY2bAdc_9AdG3uAKpzvxoAAAAYE"]
[Thu Feb 12 17:18:57.727342 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:8992] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aY2bAVzexR6hGUkt5pPYBQAAAEc"]
[Thu Feb 12 17:18:58.445750 2026] [:error] [pid 21431:tid 21451] [client 20.111.8.41:25154] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aY2bApgxKQsNF5X8gtSKDgAAAM8"]
[Thu Feb 12 17:18:59.060607 2026] [:error] [pid 39777:tid 39797] [client 20.111.8.41:1589] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aY2bA1zexR6hGUkt5pPYCQAAAFI"]
[Thu Feb 12 17:18:59.718391 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:9444] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aY2bAyaer9JPUXlMLuHEdAAAAAI"]
[Thu Feb 12 17:19:00.481663 2026] [:error] [pid 39777:tid 39795] [client 20.111.8.41:24379] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aY2bBFzexR6hGUkt5pPYDAAAAFA"]
[Thu Feb 12 17:19:01.084916 2026] [:error] [pid 21433:tid 21490] [client 20.111.8.41:23296] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aY2bBdc_9AdG3uAKpzvxpwAAAZQ"]
[Thu Feb 12 17:19:01.753782 2026] [:error] [pid 21431:tid 21459] [client 20.111.8.41:19595] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aY2bBZgxKQsNF5X8gtSKEwAAANc"]
[Thu Feb 12 17:19:02.615143 2026] [:error] [pid 21431:tid 21441] [client 20.111.8.41:19634] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aY2bBpgxKQsNF5X8gtSKFgAAAMU"]
[Thu Feb 12 17:19:03.262113 2026] [:error] [pid 21431:tid 21437] [client 20.111.8.41:19616] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aY2bB5gxKQsNF5X8gtSKGQAAAME"]
[Thu Feb 12 17:19:03.972241 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:24372] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aY2bB1zexR6hGUkt5pPYEwAAAEc"]
[Thu Feb 12 17:19:04.717592 2026] [:error] [pid 39777:tid 39801] [client 20.111.8.41:14562] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs18.php"] [unique_id "aY2bCFzexR6hGUkt5pPYGAAAAFY"]
[Thu Feb 12 17:19:05.517366 2026] [:error] [pid 21527:tid 21535] [client 20.111.8.41:25563] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aY2bCSaer9JPUXlMLuHEgwAAAAY"]
[Thu Feb 12 17:19:06.261503 2026] [:error] [pid 21431:tid 21448] [client 20.111.8.41:8505] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aY2bCpgxKQsNF5X8gtSKIQAAAMw"]
[Thu Feb 12 17:19:06.918028 2026] [:error] [pid 21431:tid 21450] [client 20.111.8.41:1167] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aY2bCpgxKQsNF5X8gtSKIwAAAM4"]
[Thu Feb 12 17:19:07.590443 2026] [:error] [pid 21434:tid 21509] [client 20.111.8.41:1053] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aY2bCwbL1v6OC5G-tE-b6wAAAcw"]
[Thu Feb 12 17:19:08.467374 2026] [:error] [pid 39777:tid 39790] [client 20.111.8.41:14540] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY2bDFzexR6hGUkt5pPYIAAAAEs"]
[Thu Feb 12 17:19:09.230520 2026] [:error] [pid 39777:tid 39800] [client 20.111.8.41:8983] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY2bDVzexR6hGUkt5pPYIwAAAFU"]
[Thu Feb 12 17:19:10.015607 2026] [:error] [pid 21434:tid 21511] [client 20.111.8.41:21835] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY2bDgbL1v6OC5G-tE-b7gAAAc4"]
[Thu Feb 12 17:19:10.796782 2026] [:error] [pid 39777:tid 39786] [client 20.111.8.41:8973] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aY2bDlzexR6hGUkt5pPYJwAAAEc"]
[Thu Feb 12 17:19:11.462492 2026] [:error] [pid 21433:tid 21486] [client 20.111.8.41:1544] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY2bD9c_9AdG3uAKpzvxrwAAAZA"]
[Thu Feb 12 17:19:12.853667 2026] [:error] [pid 39777:tid 39798] [client 20.111.8.41:9549] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY2bEFzexR6hGUkt5pPYKwAAAFM"]
[Thu Feb 12 17:19:13.944125 2026] [:error] [pid 39777:tid 39797] [client 20.111.8.41:25577] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY2bEVzexR6hGUkt5pPYLQAAAFI"]
[Thu Feb 12 17:19:14.692739 2026] [:error] [pid 39777:tid 39782] [client 20.111.8.41:25549] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY2bElzexR6hGUkt5pPYMwAAAEM"]
[Thu Feb 12 17:19:15.572004 2026] [:error] [pid 21431:tid 21439] [client 20.111.8.41:7416] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aY2bE5gxKQsNF5X8gtSKOgAAAMM"]
[Thu Feb 12 17:19:16.437102 2026] [:error] [pid 21527:tid 21553] [client 20.111.8.41:9463] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aY2bFCaer9JPUXlMLuHEogAAABg"]
[Thu Feb 12 17:19:18.070199 2026] [:error] [pid 39777:tid 39800] [client 20.111.8.41:9443] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aY2bFlzexR6hGUkt5pPYPQAAAFU"]
[Thu Feb 12 17:19:18.968890 2026] [:error] [pid 39777:tid 39791] [client 20.111.8.41:12020] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aY2bFlzexR6hGUkt5pPYQQAAAEw"]
[Thu Feb 12 17:19:19.820893 2026] [:error] [pid 21431:tid 21448] [client 20.111.8.41:8799] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aY2bF5gxKQsNF5X8gtSKPwAAAMw"]
[Thu Feb 12 17:19:20.533403 2026] [:error] [pid 21434:tid 21504] [client 20.111.8.41:9262] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aY2bGAbL1v6OC5G-tE-cDwAAAcc"]
[Thu Feb 12 17:19:21.166382 2026] [:error] [pid 21434:tid 21497] [client 20.111.8.41:23870] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aY2bGQbL1v6OC5G-tE-cFAAAAcA"]
[Thu Feb 12 17:19:21.799715 2026] [:error] [pid 21434:tid 21515] [client 20.111.8.41:17536] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aY2bGQbL1v6OC5G-tE-cFQAAAdI"]
[Thu Feb 12 17:19:22.429903 2026] [:error] [pid 21527:tid 21529] [client 20.111.8.41:7668] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY2bGiaer9JPUXlMLuHEwgAAAAA"]
[Thu Feb 12 17:19:23.147114 2026] [:error] [pid 21433:tid 21476] [client 20.111.8.41:9668] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY2bG9c_9AdG3uAKpzvxyQAAAYY"]
[Thu Feb 12 17:19:23.921860 2026] [:error] [pid 21527:tid 21530] [client 20.111.8.41:9114] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY2bGyaer9JPUXlMLuHExwAAAAE"]
[Thu Feb 12 17:19:24.616480 2026] [:error] [pid 21527:tid 21546] [client 20.111.8.41:19886] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY2bHCaer9JPUXlMLuHEygAAABE"]
[Thu Feb 12 17:19:25.529884 2026] [:error] [pid 39777:tid 39803] [client 20.111.8.41:12146] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aY2bHVzexR6hGUkt5pPYUAAAAFg"]
[Thu Feb 12 17:19:26.447116 2026] [:error] [pid 21434:tid 21511] [client 20.111.8.41:15304] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aY2bHgbL1v6OC5G-tE-cIQAAAc4"]
[Thu Feb 12 17:19:27.376594 2026] [:error] [pid 21433:tid 21488] [client 20.111.8.41:18564] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aY2bH9c_9AdG3uAKpzvxzgAAAZI"]
[Thu Feb 12 17:19:27.950065 2026] [:error] [pid 39777:tid 39788] [client 20.111.8.41:21591] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aY2bH1zexR6hGUkt5pPYWgAAAEk"]
[Thu Feb 12 17:19:28.533264 2026] [:error] [pid 21433:tid 21472] [client 20.111.8.41:23928] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aY2bINc_9AdG3uAKpzvx0gAAAYI"]
[Thu Feb 12 17:19:29.109829 2026] [:error] [pid 21433:tid 21485] [client 20.111.8.41:9808] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aY2bIdc_9AdG3uAKpzvx0wAAAY8"]
[Thu Feb 12 17:19:29.661303 2026] [:error] [pid 21431:tid 21449] [client 20.111.8.41:25602] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aY2bIZgxKQsNF5X8gtSKWgAAAM0"]
[Thu Feb 12 17:19:30.235335 2026] [:error] [pid 21527:tid 21531] [client 20.111.8.41:9813] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aY2bIiaer9JPUXlMLuHE4AAAAAI"]
[Thu Feb 12 17:19:30.785834 2026] [:error] [pid 21434:tid 21507] [client 20.111.8.41:24169] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aY2bIgbL1v6OC5G-tE-cNwAAAco"]
[Thu Feb 12 17:19:31.526624 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:25122] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aY2bIwbL1v6OC5G-tE-cOgAAAck"]
[Thu Feb 12 17:19:32.174973 2026] [:error] [pid 39777:tid 39780] [client 20.111.8.41:11025] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aY2bJFzexR6hGUkt5pPYaAAAAEE"]
[Thu Feb 12 17:19:32.969771 2026] [:error] [pid 21527:tid 21549] [client 20.111.8.41:15237] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aY2bJCaer9JPUXlMLuHE5wAAABQ"]
[Thu Feb 12 17:19:33.671476 2026] [:error] [pid 39777:tid 39781] [client 20.111.8.41:19150] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aY2bJVzexR6hGUkt5pPYbQAAAEI"]
[Thu Feb 12 17:19:34.368201 2026] [:error] [pid 21527:tid 21533] [client 20.111.8.41:11579] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aY2bJiaer9JPUXlMLuHE6gAAAAQ"]
[Thu Feb 12 17:19:35.035758 2026] [:error] [pid 21433:tid 21476] [client 20.111.8.41:18109] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aY2bJ9c_9AdG3uAKpzvx2QAAAYY"]
[Thu Feb 12 17:19:35.743831 2026] [:error] [pid 21434:tid 21502] [client 20.111.8.41:14797] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aY2bJwbL1v6OC5G-tE-cPwAAAcU"]
[Thu Feb 12 17:19:36.365373 2026] [:error] [pid 21527:tid 21538] [client 20.111.8.41:25938] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aY2bKCaer9JPUXlMLuHE8wAAAAk"]
[Thu Feb 12 17:19:37.026324 2026] [:error] [pid 21433:tid 21473] [client 20.111.8.41:12540] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aY2bKdc_9AdG3uAKpzvx2wAAAYM"]
[Thu Feb 12 17:19:37.729022 2026] [:error] [pid 21527:tid 21529] [client 20.111.8.41:24390] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aY2bKSaer9JPUXlMLuHE9wAAAAA"]
[Thu Feb 12 17:19:38.644797 2026] [:error] [pid 21527:tid 21542] [client 20.111.8.41:10080] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aY2bKiaer9JPUXlMLuHE-QAAAA0"]
[Thu Feb 12 17:19:39.320931 2026] [:error] [pid 21434:tid 21500] [client 20.111.8.41:8943] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aY2bKwbL1v6OC5G-tE-cRQAAAcM"]
[Thu Feb 12 17:19:40.088269 2026] [:error] [pid 21433:tid 21471] [client 20.111.8.41:12527] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aY2bLNc_9AdG3uAKpzvx3wAAAYE"]
[Thu Feb 12 17:19:40.795475 2026] [:error] [pid 21433:tid 21477] [client 20.111.8.41:14842] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aY2bLNc_9AdG3uAKpzvx4QAAAYc"]
[Thu Feb 12 17:19:41.774111 2026] [:error] [pid 21433:tid 21493] [client 20.111.8.41:1731] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aY2bLdc_9AdG3uAKpzvx5QAAAZc"]
[Thu Feb 12 17:19:42.353091 2026] [:error] [pid 21434:tid 21507] [client 20.111.8.41:19184] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aY2bLgbL1v6OC5G-tE-cTQAAAco"]
[Thu Feb 12 17:19:43.148150 2026] [:error] [pid 39777:tid 39794] [client 20.111.8.41:18152] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aY2bL1zexR6hGUkt5pPYgQAAAE8"]
[Thu Feb 12 17:19:43.730862 2026] [:error] [pid 21433:tid 21476] [client 20.111.8.41:13987] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aY2bL9c_9AdG3uAKpzvx6QAAAYY"]
[Thu Feb 12 17:19:44.734106 2026] [:error] [pid 21527:tid 21544] [client 20.111.8.41:10050] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aY2bMCaer9JPUXlMLuHFBgAAAA8"]
[Thu Feb 12 17:19:45.303532 2026] [:error] [pid 21434:tid 21506] [client 20.111.8.41:10099] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aY2bMQbL1v6OC5G-tE-cTwAAAck"]
[Thu Feb 12 17:19:46.040288 2026] [:error] [pid 21434:tid 21504] [client 20.111.8.41:14508] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aY2bMgbL1v6OC5G-tE-cUQAAAcc"]
[Thu Feb 12 17:19:46.661986 2026] [:error] [pid 21431:tid 21445] [client 20.111.8.41:15609] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aY2bMpgxKQsNF5X8gtSKZgAAAMk"]
[Thu Feb 12 17:19:47.248888 2026] [:error] [pid 21527:tid 21547] [client 20.111.8.41:14494] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aY2bMyaer9JPUXlMLuHFCQAAABI"]
[Thu Feb 12 17:19:47.780109 2026] [:error] [pid 21527:tid 21545] [client 20.111.8.41:1756] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aY2bMyaer9JPUXlMLuHFCgAAABA"]
[Thu Feb 12 17:19:49.002803 2026] [:error] [pid 21527:tid 21540] [client 20.111.8.41:19194] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aY2bNSaer9JPUXlMLuHFDgAAAAs"]
[Thu Feb 12 17:19:49.697727 2026] [:error] [pid 21527:tid 21537] [client 20.111.8.41:13956] [client 20.111.8.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aY2bNSaer9JPUXlMLuHFEgAAAAg"]
[Thu Feb 12 17:19:50.704192 2026] [:error] [pid 21434:tid 21518] [client 20.111.8.41:10843] File does not exist: /usr/local/apache/htdocs/suspended-page/admins.php
[Thu Feb 12 17:19:50.996780 2026] [:error] [pid 21434:tid 21505] [client 20.111.8.41:10843] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Feb 12 17:19:51.290619 2026] [:error] [pid 21434:tid 21511] [client 20.111.8.41:10843] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Thu Feb 12 17:19:51.585316 2026] [:error] [pid 21434:tid 21508] [client 20.111.8.41:10843] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Thu Feb 12 17:19:52.091634 2026] [:error] [pid 21434:tid 21507] [client 20.111.8.41:10843] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Thu Feb 12 17:19:52.371996 2026] [:error] [pid 21434:tid 21498] [client 20.111.8.41:10843] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Thu Feb 12 17:19:52.653173 2026] [:error] [pid 21434:tid 21515] [client 20.111.8.41:10843] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Thu Feb 12 17:19:52.930715 2026] [:error] [pid 21434:tid 21504] [client 20.111.8.41:10843] [client 20.111.8.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aY2bOAbL1v6OC5G-tE-cYwAAAcc"]
[Thu Feb 12 17:19:53.782817 2026] [:error] [pid 39777:tid 39795] [client 20.111.8.41:31537] File does not exist: /usr/local/apache/htdocs/suspended-page/nyan.php
[Thu Feb 12 17:19:54.111062 2026] [:error] [pid 39777:tid 39781] [client 20.111.8.41:31537] File does not exist: /usr/local/apache/htdocs/suspended-page/jsond.php
[Thu Feb 12 17:19:54.416184 2026] [:error] [pid 39777:tid 39779] [client 20.111.8.41:31537] [client 20.111.8.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-mail.php"] [unique_id "aY2bOlzexR6hGUkt5pPYoQAAAEA"]
[Thu Feb 12 20:14:14.957756 2026] [:error] [pid 63416:tid 63444] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Thu Feb 12 20:14:15.196921 2026] [:error] [pid 63416:tid 63434] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Feb 12 20:14:15.704812 2026] [:error] [pid 63416:tid 63425] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Thu Feb 12 20:14:15.950796 2026] [:error] [pid 63416:tid 63440] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Feb 12 20:14:16.394450 2026] [:error] [pid 63416:tid 63436] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Feb 12 20:14:16.897766 2026] [:error] [pid 63416:tid 63424] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Thu Feb 12 20:14:17.136737 2026] [:error] [pid 63416:tid 63433] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Thu Feb 12 20:14:17.615983 2026] [:error] [pid 63416:tid 63421] [client 20.203.142.107:27750] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Thu Feb 12 20:14:17.853028 2026] [:error] [pid 63416:tid 63444] [client 20.203.142.107:27750] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aY3EGb2wmecPaCHcM2-9CgAAAZc"]
[Thu Feb 12 20:14:19.511335 2026] [:error] [pid 65064:tid 65076] [client 20.203.142.107:21276] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aY3EGxOvRgscTcqsMBnlwwAAAMk"]
[Thu Feb 12 20:14:20.263855 2026] [:error] [pid 63417:tid 63452] [client 20.203.142.107:11878] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aY3EHP8gSb97qRMtXCLfUgAAAEM"]
[Thu Feb 12 20:14:21.070535 2026] [:error] [pid 65064:tid 65067] [client 20.203.142.107:21255] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aY3EHROvRgscTcqsMBnlygAAAMA"]
[Thu Feb 12 20:14:22.630771 2026] [:error] [pid 63417:tid 63457] [client 20.203.142.107:30918] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aY3EHv8gSb97qRMtXCLfVwAAAEg"]
[Thu Feb 12 20:14:23.875914 2026] [:error] [pid 63417:tid 63471] [client 20.203.142.107:21289] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aY3EH_8gSb97qRMtXCLfXgAAAFY"]
[Thu Feb 12 20:14:25.840061 2026] [:error] [pid 65064:tid 65073] [client 20.203.142.107:11891] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aY3EIROvRgscTcqsMBnl0gAAAMY"]
[Thu Feb 12 20:14:28.384850 2026] [:error] [pid 65064:tid 65071] [client 20.203.142.107:27758] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aY3EJBOvRgscTcqsMBnl3AAAAMQ"]
[Thu Feb 12 20:14:29.605228 2026] [:error] [pid 63417:tid 63463] [client 20.203.142.107:12551] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aY3EJf8gSb97qRMtXCLfbQAAAE4"]
[Thu Feb 12 20:14:31.478656 2026] [:error] [pid 63416:tid 63439] [client 20.203.142.107:5846] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aY3EJ72wmecPaCHcM2-9IQAAAZI"]
[Thu Feb 12 20:14:32.981047 2026] [:error] [pid 65064:tid 65071] [client 20.203.142.107:12565] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aY3EKBOvRgscTcqsMBnl-gAAAMQ"]
[Thu Feb 12 20:14:34.502000 2026] [:error] [pid 65064:tid 65081] [client 20.203.142.107:14568] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aY3EKhOvRgscTcqsMBnmBQAAAM4"]
[Thu Feb 12 20:14:35.771511 2026] [:error] [pid 63511:tid 63525] [client 20.203.142.107:18676] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aY3EK6QCQbD5BgeyIk0Q8AAAAAw"]
[Thu Feb 12 20:14:40.045538 2026] [:error] [pid 63511:tid 63535] [client 20.203.142.107:12553] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aY3EMKQCQbD5BgeyIk0Q-QAAABY"]
[Thu Feb 12 20:14:42.010472 2026] [:error] [pid 63418:tid 63492] [client 20.203.142.107:14572] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aY3EMtzjh-bbJnStPZLaoQAAAJA"]
[Thu Feb 12 20:14:43.604409 2026] [:error] [pid 63416:tid 63430] [client 20.203.142.107:21191] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aY3EM72wmecPaCHcM2-9OwAAAYk"]
[Thu Feb 12 20:14:48.066627 2026] [:error] [pid 63417:tid 63468] [client 20.203.142.107:21311] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aY3EOP8gSb97qRMtXCLfkwAAAFM"]
[Thu Feb 12 20:14:49.636629 2026] [:error] [pid 63511:tid 63537] [client 20.203.142.107:25379] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aY3EOaQCQbD5BgeyIk0RBwAAABg"]
[Thu Feb 12 20:14:51.019977 2026] [:error] [pid 65064:tid 65084] [client 20.203.142.107:20724] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aY3EOxOvRgscTcqsMBnmLQAAANE"]
[Thu Feb 12 20:14:52.093084 2026] [:error] [pid 63417:tid 63470] [client 20.203.142.107:17179] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aY3EPP8gSb97qRMtXCLflQAAAFU"]
[Thu Feb 12 20:14:52.939930 2026] [:error] [pid 65064:tid 65072] [client 20.203.142.107:24798] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aY3EPBOvRgscTcqsMBnmMQAAAMU"]
[Thu Feb 12 20:14:54.389682 2026] [:error] [pid 65064:tid 65083] [client 20.203.142.107:25382] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aY3EPhOvRgscTcqsMBnmNwAAANA"]
[Thu Feb 12 20:14:55.322765 2026] [:error] [pid 63418:tid 63489] [client 20.203.142.107:28689] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aY3EP9zjh-bbJnStPZLatwAAAI0"]
[Thu Feb 12 20:14:57.073311 2026] [:error] [pid 63417:tid 63449] [client 20.203.142.107:58324] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aY3EQf8gSb97qRMtXCLfsAAAAEA"]
[Thu Feb 12 20:14:58.364794 2026] [:error] [pid 63416:tid 63437] [client 20.203.142.107:50963] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aY3EQr2wmecPaCHcM2-9SwAAAZA"]
[Thu Feb 12 20:14:59.227890 2026] [:error] [pid 63416:tid 63435] [client 20.203.142.107:14655] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aY3EQ72wmecPaCHcM2-9TQAAAY4"]
[Thu Feb 12 20:15:00.397563 2026] [:error] [pid 63418:tid 63489] [client 20.203.142.107:5953] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aY3ERNzjh-bbJnStPZLaxwAAAI0"]
[Thu Feb 12 20:15:01.281306 2026] [:error] [pid 63418:tid 63488] [client 20.203.142.107:18743] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aY3ERdzjh-bbJnStPZLayQAAAIw"]
[Thu Feb 12 20:15:02.089306 2026] [:error] [pid 63417:tid 63463] [client 20.203.142.107:42899] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aY3ERv8gSb97qRMtXCLfxAAAAE4"]
[Thu Feb 12 20:15:02.818607 2026] [:error] [pid 63418:tid 63482] [client 20.203.142.107:12531] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aY3ERtzjh-bbJnStPZLazAAAAIY"]
[Thu Feb 12 20:15:03.431916 2026] [:error] [pid 63417:tid 63473] [client 20.203.142.107:24331] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aY3ER_8gSb97qRMtXCLfyAAAAFg"]
[Thu Feb 12 20:15:04.619410 2026] [:error] [pid 63511:tid 63528] [client 20.203.142.107:21812] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aY3ESKQCQbD5BgeyIk0RQgAAAA8"]
[Thu Feb 12 20:15:05.373715 2026] [:error] [pid 65064:tid 65081] [client 20.203.142.107:11597] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aY3ESROvRgscTcqsMBnmYwAAAM4"]
[Thu Feb 12 20:15:06.280957 2026] [:error] [pid 63417:tid 63461] [client 20.203.142.107:42964] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aY3ESv8gSb97qRMtXCLfygAAAEw"]
[Thu Feb 12 20:15:06.836807 2026] [:error] [pid 63418:tid 63485] [client 20.203.142.107:42956] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aY3EStzjh-bbJnStPZLa0gAAAIk"]
[Thu Feb 12 20:15:07.849886 2026] [:error] [pid 63511:tid 63519] [client 20.203.142.107:55717] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aY3ES6QCQbD5BgeyIk0RSQAAAAY"]
[Thu Feb 12 20:15:08.367066 2026] [:error] [pid 65064:tid 65084] [client 20.203.142.107:35204] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aY3ETBOvRgscTcqsMBnmbAAAANE"]
[Thu Feb 12 20:15:09.106080 2026] [:error] [pid 63417:tid 63469] [client 20.203.142.107:36174] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aY3ETf8gSb97qRMtXCLf0AAAAFQ"]
[Thu Feb 12 20:15:09.682541 2026] [:error] [pid 63416:tid 63440] [client 20.203.142.107:42971] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aY3ETb2wmecPaCHcM2-9WQAAAZM"]
[Thu Feb 12 20:15:10.856030 2026] [:error] [pid 63417:tid 63461] [client 20.203.142.107:42950] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aY3ETv8gSb97qRMtXCLf1wAAAEw"]
[Thu Feb 12 20:15:11.982663 2026] [:error] [pid 63511:tid 63520] [client 20.203.142.107:34081] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aY3ET6QCQbD5BgeyIk0RVgAAAAc"]
[Thu Feb 12 20:15:13.211369 2026] [:error] [pid 65064:tid 65073] [client 20.203.142.107:25841] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aY3EUROvRgscTcqsMBnmdQAAAMY"]
[Thu Feb 12 20:15:13.909433 2026] [:error] [pid 65064:tid 65068] [client 20.203.142.107:55683] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aY3EUROvRgscTcqsMBnmdwAAAME"]
[Thu Feb 12 20:15:14.563658 2026] [:error] [pid 63511:tid 63524] [client 20.203.142.107:30424] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aY3EUqQCQbD5BgeyIk0RYQAAAAs"]
[Thu Feb 12 20:15:15.163201 2026] [:error] [pid 63418:tid 63493] [client 20.203.142.107:10837] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aY3EU9zjh-bbJnStPZLa8gAAAJE"]
[Thu Feb 12 20:15:15.825526 2026] [:error] [pid 63416:tid 63429] [client 20.203.142.107:5163] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aY3EU72wmecPaCHcM2-9YgAAAYg"]
[Thu Feb 12 20:15:17.458787 2026] [:error] [pid 63418:tid 63485] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Thu Feb 12 20:15:17.697600 2026] [:error] [pid 63418:tid 63496] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/atx.php
[Thu Feb 12 20:15:19.081243 2026] [:error] [pid 63418:tid 63496] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Thu Feb 12 20:15:19.324105 2026] [:error] [pid 63418:tid 63477] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Thu Feb 12 20:15:19.566016 2026] [:error] [pid 63418:tid 63488] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Thu Feb 12 20:15:20.340250 2026] [:error] [pid 63418:tid 63498] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Feb 12 20:15:21.092384 2026] [:error] [pid 63418:tid 63496] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Feb 12 20:15:21.331854 2026] [:error] [pid 63418:tid 63486] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Feb 12 20:15:21.577703 2026] [:error] [pid 63418:tid 63487] [client 20.203.142.107:10852] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Feb 12 20:15:22.519463 2026] [:error] [pid 63418:tid 63482] [client 20.203.142.107:10852] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aY3EWtzjh-bbJnStPZLbEwAAAIY"]
[Thu Feb 12 20:15:24.574805 2026] [:error] [pid 63511:tid 63524] [client 20.203.142.107:35772] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aY3EXKQCQbD5BgeyIk0RfgAAAAs"]
[Thu Feb 12 20:15:25.720913 2026] [:error] [pid 63416:tid 63421] [client 20.203.142.107:56055] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aY3EXb2wmecPaCHcM2-9fAAAAYA"]
[Thu Feb 12 20:15:27.542385 2026] [:error] [pid 63511:tid 63516] [client 20.203.142.107:11088] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aY3EX6QCQbD5BgeyIk0RlwAAAAM"]
[Thu Feb 12 20:15:28.870249 2026] [:error] [pid 63511:tid 63520] [client 20.203.142.107:5137] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3EYKQCQbD5BgeyIk0RowAAAAc"]
[Thu Feb 12 20:15:29.871454 2026] [:error] [pid 63417:tid 63467] [client 20.203.142.107:42494] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3EYf8gSb97qRMtXCLf9AAAAFI"]
[Thu Feb 12 20:15:30.674431 2026] [:error] [pid 65064:tid 65067] [client 20.203.142.107:5377] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3EYhOvRgscTcqsMBnmjAAAAMA"]
[Thu Feb 12 20:15:31.478693 2026] [:error] [pid 63417:tid 63457] [client 20.203.142.107:41876] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3EY_8gSb97qRMtXCLf-QAAAEg"]
[Thu Feb 12 20:15:32.204192 2026] [:error] [pid 63417:tid 63466] [client 20.203.142.107:24850] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aY3EZP8gSb97qRMtXCLf-gAAAFE"]
[Thu Feb 12 20:15:32.934522 2026] [:error] [pid 63416:tid 63429] [client 20.203.142.107:22746] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aY3EZL2wmecPaCHcM2-9hwAAAYg"]
[Thu Feb 12 20:15:33.745441 2026] [:error] [pid 63418:tid 63489] [client 20.203.142.107:41869] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aY3EZdzjh-bbJnStPZLbIgAAAI0"]
[Thu Feb 12 20:15:34.371282 2026] [:error] [pid 63418:tid 63480] [client 20.203.142.107:10846] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aY3EZtzjh-bbJnStPZLbJAAAAIQ"]
[Thu Feb 12 20:15:35.033139 2026] [:error] [pid 63418:tid 63481] [client 20.203.142.107:10820] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aY3EZ9zjh-bbJnStPZLbJgAAAIU"]
[Thu Feb 12 20:15:35.740022 2026] [:error] [pid 65064:tid 65082] [client 20.203.142.107:35740] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aY3EZxOvRgscTcqsMBnmqQAAAM8"]
[Thu Feb 12 20:15:36.310583 2026] [:error] [pid 63417:tid 63468] [client 20.203.142.107:11294] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aY3EaP8gSb97qRMtXCLgAAAAAFM"]
[Thu Feb 12 20:15:36.925454 2026] [:error] [pid 63416:tid 63434] [client 20.203.142.107:17122] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cong.php"] [unique_id "aY3EaL2wmecPaCHcM2-9jwAAAY0"]
[Thu Feb 12 20:15:38.186354 2026] [:error] [pid 65064:tid 65080] [client 20.203.142.107:24841] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aY3EahOvRgscTcqsMBnmtwAAAM0"]
[Thu Feb 12 20:15:38.994838 2026] [:error] [pid 63416:tid 63427] [client 20.203.142.107:5171] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aY3Ear2wmecPaCHcM2-9lgAAAYY"]
[Thu Feb 12 20:15:39.677400 2026] [:error] [pid 65064:tid 65082] [client 20.203.142.107:5376] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aY3EaxOvRgscTcqsMBnmvQAAAM8"]
[Thu Feb 12 20:15:41.133881 2026] [:error] [pid 65064:tid 65091] [client 20.203.142.107:17141] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w.php"] [unique_id "aY3EbROvRgscTcqsMBnmxAAAANg"]
[Thu Feb 12 20:15:42.744851 2026] [:error] [pid 65064:tid 65076] [client 20.203.142.107:42427] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3EbhOvRgscTcqsMBnm0AAAAMk"]
[Thu Feb 12 20:15:45.053680 2026] [:error] [pid 65064:tid 65089] [client 20.203.142.107:55538] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3EcROvRgscTcqsMBnm3gAAANY"]
[Thu Feb 12 20:15:48.377964 2026] [:error] [pid 63511:tid 63525] [client 20.203.142.107:17147] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3EdKQCQbD5BgeyIk0RwgAAAAw"]
[Thu Feb 12 20:15:49.359722 2026] [:error] [pid 63418:tid 63490] [client 20.203.142.107:17638] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3Eddzjh-bbJnStPZLbNgAAAI4"]
[Thu Feb 12 20:15:50.912594 2026] [:error] [pid 63416:tid 63425] [client 20.203.142.107:10852] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY3Edr2wmecPaCHcM2-9rwAAAYQ"]
[Thu Feb 12 20:15:52.383614 2026] [:error] [pid 63417:tid 63452] [client 20.203.142.107:18153] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY3EeP8gSb97qRMtXCLgGgAAAEM"]
[Thu Feb 12 20:15:53.161234 2026] [:error] [pid 65064:tid 65086] [client 20.203.142.107:46606] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY3EeROvRgscTcqsMBnm9wAAANM"]
[Thu Feb 12 20:15:54.404848 2026] [:error] [pid 63418:tid 63490] [client 20.203.142.107:46176] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aY3Eetzjh-bbJnStPZLbQQAAAI4"]
[Thu Feb 12 20:15:55.801149 2026] [:error] [pid 65064:tid 65069] [client 20.203.142.107:5431] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aY3EexOvRgscTcqsMBnm_gAAAMI"]
[Thu Feb 12 20:15:58.219138 2026] [:error] [pid 63511:tid 63522] [client 20.203.142.107:53373] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aY3EfqQCQbD5BgeyIk0R3AAAAAk"]
[Thu Feb 12 20:15:59.598806 2026] [:error] [pid 63418:tid 63483] [client 20.203.142.107:18198] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aY3Ef9zjh-bbJnStPZLbTgAAAIc"]
[Thu Feb 12 20:16:00.707649 2026] [:error] [pid 63511:tid 63531] [client 20.203.142.107:46608] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aY3EgKQCQbD5BgeyIk0R4wAAABI"]
[Thu Feb 12 20:16:03.648184 2026] [:error] [pid 63511:tid 63533] [client 20.203.142.107:55646] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3Eg6QCQbD5BgeyIk0R8wAAABQ"]
[Thu Feb 12 20:16:05.261949 2026] [:error] [pid 65064:tid 65084] [client 20.203.142.107:41910] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3EhROvRgscTcqsMBnnFwAAANE"]
[Thu Feb 12 20:16:06.084693 2026] [:error] [pid 63418:tid 63483] [client 20.203.142.107:5503] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3Ehtzjh-bbJnStPZLbWgAAAIc"]
[Thu Feb 12 20:16:06.904382 2026] [:error] [pid 63417:tid 63464] [client 20.203.142.107:11317] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aY3Ehv8gSb97qRMtXCLgJQAAAE8"]
[Thu Feb 12 20:16:07.755514 2026] [:error] [pid 63511:tid 63516] [client 20.203.142.107:46631] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aY3Eh6QCQbD5BgeyIk0SAQAAAAM"]
[Thu Feb 12 20:16:08.661198 2026] [:error] [pid 65064:tid 65075] [client 20.203.142.107:41895] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aY3EiBOvRgscTcqsMBnnIgAAAMg"]
[Thu Feb 12 20:16:09.323245 2026] [:error] [pid 65064:tid 65085] [client 20.203.142.107:18236] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aY3EiROvRgscTcqsMBnnJQAAANI"]
[Thu Feb 12 20:16:10.267789 2026] [:error] [pid 63418:tid 63476] [client 20.203.142.107:47084] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aY3Eitzjh-bbJnStPZLbYgAAAIA"]
[Thu Feb 12 20:16:11.045494 2026] [:error] [pid 63418:tid 63495] [client 20.203.142.107:13095] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aY3Ei9zjh-bbJnStPZLbZQAAAJM"]
[Thu Feb 12 20:16:12.111246 2026] [:error] [pid 63418:tid 63492] [client 20.203.142.107:18179] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aY3EjNzjh-bbJnStPZLbawAAAJA"]
[Thu Feb 12 20:16:13.227702 2026] [:error] [pid 63416:tid 63441] [client 20.203.142.107:39368] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aY3Ejb2wmecPaCHcM2-9xwAAAZQ"]
[Thu Feb 12 20:16:14.233885 2026] [:error] [pid 63416:tid 63443] [client 20.203.142.107:20179] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aY3Ejr2wmecPaCHcM2-9yQAAAZY"]
[Thu Feb 12 20:16:16.115482 2026] [:error] [pid 63418:tid 63484] [client 20.203.142.107:13095] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aY3EkNzjh-bbJnStPZLbcQAAAIg"]
[Thu Feb 12 20:16:17.006688 2026] [:error] [pid 63417:tid 63456] [client 20.203.142.107:46154] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aY3Ekf8gSb97qRMtXCLgVwAAAEc"]
[Thu Feb 12 20:16:17.570870 2026] [:error] [pid 63417:tid 63471] [client 20.203.142.107:11306] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aY3Ekf8gSb97qRMtXCLgWQAAAFY"]
[Thu Feb 12 20:16:18.626734 2026] [:error] [pid 65064:tid 65079] [client 20.203.142.107:23863] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aY3EkhOvRgscTcqsMBnnjQAAAMw"]
[Thu Feb 12 20:16:19.732730 2026] [:error] [pid 65064:tid 65091] [client 20.203.142.107:55629] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aY3EkxOvRgscTcqsMBnnkAAAANg"]
[Thu Feb 12 20:16:20.632242 2026] [:error] [pid 63511:tid 63520] [client 20.203.142.107:30012] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aY3ElKQCQbD5BgeyIk0SIgAAAAc"]
[Thu Feb 12 20:16:21.930726 2026] [:error] [pid 63418:tid 63479] [client 20.203.142.107:11325] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Feb 12 20:16:22.172113 2026] [:error] [pid 63418:tid 63486] [client 20.203.142.107:11325] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Feb 12 20:16:22.412332 2026] [:error] [pid 63418:tid 63485] [client 20.203.142.107:11325] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Feb 12 20:16:23.008113 2026] [:error] [pid 63418:tid 63496] [client 20.203.142.107:11325] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Feb 12 20:16:23.287671 2026] [:error] [pid 63418:tid 63484] [client 20.203.142.107:11325] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Feb 12 20:16:23.529093 2026] [:error] [pid 63418:tid 63490] [client 20.203.142.107:11325] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Feb 12 20:16:24.972658 2026] [:error] [pid 63418:tid 63483] [client 20.203.142.107:11325] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aY3EmNzjh-bbJnStPZLbjAAAAIc"]
[Thu Feb 12 20:16:26.577789 2026] [:error] [pid 63416:tid 63439] [client 20.203.142.107:5443] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aY3Emr2wmecPaCHcM2-94QAAAZI"]
[Thu Feb 12 20:16:27.824100 2026] [:error] [pid 63418:tid 63491] [client 20.203.142.107:13068] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aY3Em9zjh-bbJnStPZLbkgAAAI8"]
[Thu Feb 12 20:16:29.410137 2026] [:error] [pid 63416:tid 63431] [client 20.203.142.107:5443] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aY3Enb2wmecPaCHcM2-96AAAAYo"]
[Thu Feb 12 20:16:31.169885 2026] [:error] [pid 63416:tid 63426] [client 20.203.142.107:46650] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aY3En72wmecPaCHcM2-96wAAAYU"]
[Thu Feb 12 20:16:33.084957 2026] [:error] [pid 63417:tid 63467] [client 20.203.142.107:51490] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aY3Eof8gSb97qRMtXCLgbgAAAFI"]
[Thu Feb 12 20:16:34.226225 2026] [:error] [pid 63511:tid 63517] [client 20.203.142.107:15629] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aY3EoqQCQbD5BgeyIk0SPQAAAAQ"]
[Thu Feb 12 20:16:35.436936 2026] [:error] [pid 65064:tid 65071] [client 20.203.142.107:26373] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aY3EoxOvRgscTcqsMBnnwwAAAMQ"]
[Thu Feb 12 20:16:36.251636 2026] [:error] [pid 63418:tid 63495] [client 20.203.142.107:46620] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aY3EpNzjh-bbJnStPZLboAAAAJM"]
[Thu Feb 12 20:16:36.987517 2026] [:error] [pid 63418:tid 63483] [client 20.203.142.107:15637] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aY3EpNzjh-bbJnStPZLboQAAAIc"]
[Thu Feb 12 20:16:37.844890 2026] [:error] [pid 65064:tid 65081] [client 20.203.142.107:52138] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aY3EpROvRgscTcqsMBnnygAAAM4"]
[Thu Feb 12 20:16:38.748664 2026] [:error] [pid 63418:tid 63496] [client 20.203.142.107:51599] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aY3Eptzjh-bbJnStPZLbowAAAJQ"]
[Thu Feb 12 20:16:40.071867 2026] [:error] [pid 63418:tid 63500] [client 20.203.142.107:56527] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3EqNzjh-bbJnStPZLbpQAAAJg"]
[Thu Feb 12 20:16:42.534883 2026] [:error] [pid 63418:tid 63493] [client 20.203.142.107:53358] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3Eqtzjh-bbJnStPZLbrAAAAJE"]
[Thu Feb 12 20:16:43.451131 2026] [:error] [pid 63417:tid 63459] [client 20.203.142.107:51616] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3Eq_8gSb97qRMtXCLgdwAAAEo"]
[Thu Feb 12 20:16:44.479088 2026] [:error] [pid 63511:tid 63520] [client 20.203.142.107:51623] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aY3ErKQCQbD5BgeyIk0SVQAAAAc"]
[Thu Feb 12 20:16:45.135362 2026] [:error] [pid 63418:tid 63488] [client 20.203.142.107:38388] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aY3Erdzjh-bbJnStPZLbswAAAIw"]
[Thu Feb 12 20:16:45.878338 2026] [:error] [pid 63418:tid 63500] [client 20.203.142.107:39899] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aY3Erdzjh-bbJnStPZLbtAAAAJg"]
[Thu Feb 12 20:16:47.207798 2026] [:error] [pid 63418:tid 63489] [client 20.203.142.107:41456] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aY3Er9zjh-bbJnStPZLbugAAAI0"]
[Thu Feb 12 20:16:47.762014 2026] [:error] [pid 63417:tid 63468] [client 20.203.142.107:27420] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aY3Er_8gSb97qRMtXCLgfwAAAFM"]
[Thu Feb 12 20:16:48.721859 2026] [:error] [pid 63511:tid 63532] [client 20.203.142.107:56526] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY3EsKQCQbD5BgeyIk0SWAAAABM"]
[Thu Feb 12 20:16:49.302083 2026] [:error] [pid 63418:tid 63478] [client 20.203.142.107:16128] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY3Esdzjh-bbJnStPZLbuwAAAII"]
[Thu Feb 12 20:16:50.012381 2026] [:error] [pid 63417:tid 63458] [client 20.203.142.107:18216] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY3Esv8gSb97qRMtXCLghAAAAEk"]
[Thu Feb 12 20:16:50.613370 2026] [:error] [pid 63416:tid 63443] [client 20.215.48.26:8331] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Thu Feb 12 20:16:50.732878 2026] [:error] [pid 65064:tid 65088] [client 20.203.142.107:18196] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aY3EshOvRgscTcqsMBnn4QAAANU"]
[Thu Feb 12 20:16:51.660259 2026] [:error] [pid 63418:tid 63476] [client 20.203.142.107:55638] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aY3Es9zjh-bbJnStPZLbwQAAAIA"]
[Thu Feb 12 20:16:52.663582 2026] [:error] [pid 65064:tid 65090] [client 20.203.142.107:18212] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aY3EtBOvRgscTcqsMBnn5gAAANc"]
[Thu Feb 12 20:16:53.316450 2026] [:error] [pid 63417:tid 63473] [client 20.203.142.107:18169] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aY3Etf8gSb97qRMtXCLghwAAAFg"]
[Thu Feb 12 20:16:54.093022 2026] [:error] [pid 65064:tid 65070] [client 20.203.142.107:35175] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aY3EthOvRgscTcqsMBnn7QAAAMM"]
[Thu Feb 12 20:16:55.397671 2026] [:error] [pid 63416:tid 63442] [client 20.203.142.107:39877] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY3Et72wmecPaCHcM2--CAAAAZU"]
[Thu Feb 12 20:16:56.342271 2026] [:error] [pid 63417:tid 63470] [client 20.203.142.107:28649] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY3EuP8gSb97qRMtXCLgkAAAAFU"]
[Thu Feb 12 20:16:56.864803 2026] [:error] [pid 63511:tid 63522] [client 20.203.142.107:26900] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY3EuKQCQbD5BgeyIk0SbgAAAAk"]
[Thu Feb 12 20:16:57.953999 2026] [:error] [pid 63418:tid 63487] [client 20.203.142.107:18173] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aY3Eudzjh-bbJnStPZLbxQAAAIs"]
[Thu Feb 12 20:16:58.969040 2026] [:error] [pid 65064:tid 65073] [client 20.203.142.107:51617] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aY3EuhOvRgscTcqsMBnn8wAAAMY"]
[Thu Feb 12 20:17:00.145496 2026] [:error] [pid 63416:tid 63439] [client 20.203.142.107:27455] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aY3EvL2wmecPaCHcM2--DwAAAZI"]
[Thu Feb 12 20:17:02.367760 2026] [:error] [pid 63511:tid 63529] [client 20.203.142.107:33388] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aY3EvqQCQbD5BgeyIk0SfgAAABA"]
[Thu Feb 12 20:17:03.095606 2026] [:error] [pid 63417:tid 63458] [client 20.203.142.107:26918] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aY3Ev_8gSb97qRMtXCLgogAAAEk"]
[Thu Feb 12 20:17:03.622471 2026] [:error] [pid 65064:tid 65082] [client 20.203.142.107:45637] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aY3EvxOvRgscTcqsMBnn9wAAAM8"]
[Thu Feb 12 20:17:04.395274 2026] [:error] [pid 63511:tid 63518] [client 20.203.142.107:33461] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aY3EwKQCQbD5BgeyIk0ShAAAAAU"]
[Thu Feb 12 20:17:05.058241 2026] [:error] [pid 63418:tid 63487] [client 20.203.142.107:52620] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aY3Ewdzjh-bbJnStPZLb0QAAAIs"]
[Thu Feb 12 20:17:05.695254 2026] [:error] [pid 63511:tid 63515] [client 20.203.142.107:45670] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aY3EwaQCQbD5BgeyIk0SiwAAAAI"]
[Thu Feb 12 20:17:06.329285 2026] [:error] [pid 63417:tid 63464] [client 20.203.142.107:56695] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aY3Ewv8gSb97qRMtXCLgqgAAAE8"]
[Thu Feb 12 20:17:07.200842 2026] [:error] [pid 63511:tid 63529] [client 20.203.142.107:26919] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aY3Ew6QCQbD5BgeyIk0SkAAAABA"]
[Thu Feb 12 20:17:07.802939 2026] [:error] [pid 63418:tid 63498] [client 20.203.142.107:33440] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aY3Ew9zjh-bbJnStPZLb0gAAAJY"]
[Thu Feb 12 20:17:08.785502 2026] [:error] [pid 63418:tid 63485] [client 20.203.142.107:52670] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aY3ExNzjh-bbJnStPZLb0wAAAIk"]
[Thu Feb 12 20:17:10.011622 2026] [:error] [pid 63416:tid 63423] [client 20.203.142.107:41381] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aY3Exr2wmecPaCHcM2--KAAAAYI"]
[Thu Feb 12 20:17:10.721879 2026] [:error] [pid 63511:tid 63531] [client 20.203.142.107:58432] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aY3ExqQCQbD5BgeyIk0SnAAAABI"]
[Thu Feb 12 20:17:11.542736 2026] [:error] [pid 63511:tid 63525] [client 20.203.142.107:15554] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aY3Ex6QCQbD5BgeyIk0SoAAAAAw"]
[Thu Feb 12 20:17:12.396617 2026] [:error] [pid 63418:tid 63482] [client 20.203.142.107:38313] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aY3EyNzjh-bbJnStPZLb3AAAAIY"]
[Thu Feb 12 20:17:14.016362 2026] [:error] [pid 65064:tid 65081] [client 20.203.142.107:36236] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aY3EyhOvRgscTcqsMBnoCQAAAM4"]
[Thu Feb 12 20:17:15.871761 2026] [:error] [pid 63416:tid 63445] [client 20.203.142.107:44316] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aY3Ey72wmecPaCHcM2--LwAAAZg"]
[Thu Feb 12 20:17:17.164819 2026] [:error] [pid 63416:tid 63421] [client 20.203.142.107:58454] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aY3Ezb2wmecPaCHcM2--MwAAAYA"]
[Thu Feb 12 20:17:18.577669 2026] [:error] [pid 63511:tid 63513] [client 20.203.142.107:28630] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aY3EzqQCQbD5BgeyIk0SqgAAAAA"]
[Thu Feb 12 20:17:19.969330 2026] [:error] [pid 63416:tid 63426] [client 20.203.142.107:35178] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aY3Ez72wmecPaCHcM2--OAAAAYU"]
[Thu Feb 12 20:17:22.461657 2026] [:error] [pid 63418:tid 63498] [client 20.203.142.107:58475] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aY3E0tzjh-bbJnStPZLb6AAAAJY"]
[Thu Feb 12 20:17:24.719128 2026] [:error] [pid 63418:tid 63476] [client 20.203.142.107:44297] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Thu Feb 12 20:17:24.954871 2026] [:error] [pid 63418:tid 63495] [client 20.203.142.107:44297] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aY3E1Nzjh-bbJnStPZLb7QAAAJM"]
[Thu Feb 12 20:17:25.963420 2026] [:error] [pid 63418:tid 63478] [client 20.203.142.107:58477] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aY3E1dzjh-bbJnStPZLb9AAAAII"]
[Thu Feb 12 20:17:27.672404 2026] [:error] [pid 63511:tid 63531] [client 20.203.142.107:33411] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aY3E16QCQbD5BgeyIk0S1AAAABI"]
[Thu Feb 12 20:17:28.888133 2026] [:error] [pid 63417:tid 63461] [client 20.203.142.107:38318] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aY3E2P8gSb97qRMtXCLg2gAAAEw"]
[Thu Feb 12 20:17:29.786430 2026] [:error] [pid 63417:tid 63452] [client 20.203.142.107:58468] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Thu Feb 12 20:17:30.311001 2026] [:error] [pid 63417:tid 63450] [client 20.203.142.107:58468] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aY3E2v8gSb97qRMtXCLg3wAAAEE"]
[Thu Feb 12 20:17:30.894138 2026] [:error] [pid 63417:tid 63462] [client 20.203.142.107:15580] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aY3E2v8gSb97qRMtXCLg4AAAAE0"]
[Thu Feb 12 20:17:31.726632 2026] [:error] [pid 63511:tid 63525] [client 20.203.142.107:38294] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aY3E26QCQbD5BgeyIk0S4wAAAAw"]
[Thu Feb 12 20:17:32.451394 2026] [:error] [pid 65064:tid 65076] [client 20.203.142.107:33398] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aY3E3BOvRgscTcqsMBnobAAAAMk"]
[Thu Feb 12 20:17:33.525981 2026] [:error] [pid 65064:tid 65080] [client 20.203.142.107:39816] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aY3E3ROvRgscTcqsMBnocQAAAM0"]
[Thu Feb 12 20:17:34.616167 2026] [:error] [pid 63511:tid 63525] [client 20.203.142.107:52388] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aY3E3qQCQbD5BgeyIk0S7gAAAAw"]
[Thu Feb 12 20:17:35.213913 2026] [:error] [pid 65064:tid 65070] [client 20.203.142.107:44303] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aY3E3xOvRgscTcqsMBnofQAAAMM"]
[Thu Feb 12 20:17:36.100139 2026] [:error] [pid 63511:tid 63514] [client 20.203.142.107:41358] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aY3E4KQCQbD5BgeyIk0S8gAAAAE"]
[Thu Feb 12 20:17:37.130256 2026] [:error] [pid 65064:tid 65073] [client 20.203.142.107:15608] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aY3E4ROvRgscTcqsMBnogQAAAMY"]
[Thu Feb 12 20:17:38.394339 2026] [:error] [pid 63418:tid 63490] [client 20.203.142.107:58464] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aY3E4tzjh-bbJnStPZLb_AAAAI4"]
[Thu Feb 12 20:17:39.294176 2026] [:error] [pid 63416:tid 63428] [client 20.203.142.107:22216] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aY3E472wmecPaCHcM2--fwAAAYc"]
[Thu Feb 12 20:17:39.959822 2026] [:error] [pid 63417:tid 63467] [client 20.203.142.107:39854] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aY3E4_8gSb97qRMtXCLg9AAAAFI"]
[Thu Feb 12 20:17:40.974014 2026] [:error] [pid 63511:tid 63520] [client 20.203.142.107:50983] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aY3E5KQCQbD5BgeyIk0TOwAAAAc"]
[Thu Feb 12 20:17:42.719737 2026] [:error] [pid 65064:tid 65085] [client 20.203.142.107:39862] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aY3E5hOvRgscTcqsMBnosAAAANI"]
[Thu Feb 12 20:17:48.969771 2026] [:error] [pid 63418:tid 63478] [client 20.203.142.107:39868] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aY3E7Nzjh-bbJnStPZLcDwAAAII"]
[Thu Feb 12 20:17:53.651012 2026] [:error] [pid 63417:tid 63453] [client 20.203.142.107:22230] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aY3E8f8gSb97qRMtXCLhCwAAAEQ"]
[Thu Feb 12 20:17:55.420886 2026] [:error] [pid 63418:tid 63478] [client 20.203.142.107:22844] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aY3E89zjh-bbJnStPZLcGAAAAII"]
[Thu Feb 12 20:17:57.827677 2026] [:error] [pid 63418:tid 63482] [client 20.203.142.107:22823] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aY3E9dzjh-bbJnStPZLcHQAAAIY"]
[Thu Feb 12 20:17:59.851078 2026] [:error] [pid 65064:tid 65076] [client 20.203.142.107:5573] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aY3E9xOvRgscTcqsMBno9gAAAMk"]
[Thu Feb 12 20:18:01.456486 2026] [:error] [pid 65064:tid 65086] [client 20.203.142.107:22223] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aY3E-ROvRgscTcqsMBnpAQAAANM"]
[Thu Feb 12 20:18:02.590215 2026] [:error] [pid 63417:tid 63465] [client 20.203.142.107:50951] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY3E-v8gSb97qRMtXCLhIQAAAFA"]
[Thu Feb 12 20:18:03.485086 2026] [:error] [pid 63511:tid 63518] [client 20.203.142.107:5594] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY3E-6QCQbD5BgeyIk0TfwAAAAU"]
[Thu Feb 12 20:18:04.363487 2026] [:error] [pid 65064:tid 65085] [client 20.203.142.107:12762] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY3E_BOvRgscTcqsMBnpCgAAANI"]
[Thu Feb 12 20:18:05.610083 2026] [:error] [pid 63416:tid 63437] [client 20.203.142.107:22803] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aY3E_b2wmecPaCHcM2--twAAAZA"]
[Thu Feb 12 20:18:06.538374 2026] [:error] [pid 65064:tid 65091] [client 20.203.142.107:5614] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aY3E_hOvRgscTcqsMBnpDgAAANg"]
[Thu Feb 12 20:18:07.308299 2026] [:error] [pid 65064:tid 65072] [client 20.203.142.107:11658] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aY3E_xOvRgscTcqsMBnpEAAAAMU"]
[Thu Feb 12 20:18:07.949775 2026] [:error] [pid 63418:tid 63493] [client 20.203.142.107:46608] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aY3E_9zjh-bbJnStPZLcNwAAAJE"]
[Thu Feb 12 20:18:08.853078 2026] [:error] [pid 63417:tid 63451] [client 20.203.142.107:11914] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aY3FAP8gSb97qRMtXCLhMAAAAEI"]
[Thu Feb 12 20:18:09.515257 2026] [:error] [pid 63511:tid 63525] [client 20.203.142.107:11921] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aY3FAaQCQbD5BgeyIk0TjwAAAAw"]
[Thu Feb 12 20:18:10.638712 2026] [:error] [pid 63418:tid 63496] [client 20.203.142.107:22794] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aY3FAtzjh-bbJnStPZLcRQAAAJQ"]
[Thu Feb 12 20:18:11.864895 2026] [:error] [pid 65064:tid 65086] [client 20.203.142.107:47119] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aY3FAxOvRgscTcqsMBnpGQAAANM"]
[Thu Feb 12 20:18:13.432808 2026] [:error] [pid 65064:tid 65076] [client 20.203.142.107:19145] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aY3FBROvRgscTcqsMBnpHwAAAMk"]
[Thu Feb 12 20:18:14.477063 2026] [:error] [pid 63417:tid 63470] [client 20.203.142.107:30500] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aY3FBv8gSb97qRMtXCLhOgAAAFU"]
[Thu Feb 12 20:18:16.096861 2026] [:error] [pid 65064:tid 65084] [client 20.203.142.107:16068] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aY3FCBOvRgscTcqsMBnpLQAAANE"]
[Thu Feb 12 20:18:17.668776 2026] [:error] [pid 63418:tid 63481] [client 20.203.142.107:46139] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aY3FCdzjh-bbJnStPZLcXAAAAIU"]
[Thu Feb 12 20:18:19.352400 2026] [:error] [pid 63511:tid 63533] [client 20.203.142.107:25895] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aY3FC6QCQbD5BgeyIk0TmwAAABQ"]
[Thu Feb 12 20:18:20.787956 2026] [:error] [pid 63511:tid 63517] [client 20.203.142.107:47155] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aY3FDKQCQbD5BgeyIk0ToAAAAAQ"]
[Thu Feb 12 20:18:21.902089 2026] [:error] [pid 63511:tid 63518] [client 20.203.142.107:24293] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY3FDaQCQbD5BgeyIk0TowAAAAU"]
[Thu Feb 12 20:18:23.107923 2026] [:error] [pid 63418:tid 63487] [client 20.203.142.107:11946] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY3FD9zjh-bbJnStPZLcZQAAAIs"]
[Thu Feb 12 20:18:23.962941 2026] [:error] [pid 63418:tid 63497] [client 20.203.142.107:25881] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY3FD9zjh-bbJnStPZLcaAAAAJU"]
[Thu Feb 12 20:18:24.703202 2026] [:error] [pid 63418:tid 63492] [client 20.203.142.107:19193] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aY3FENzjh-bbJnStPZLcbgAAAJA"]
[Thu Feb 12 20:18:25.702945 2026] [:error] [pid 65064:tid 65084] [client 20.203.142.107:47122] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY3FEROvRgscTcqsMBnpSAAAANE"]
[Thu Feb 12 20:18:27.381906 2026] [:error] [pid 63416:tid 63428] [client 20.203.142.107:48121] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY3FE72wmecPaCHcM2--1gAAAYc"]
[Thu Feb 12 20:18:28.866041 2026] [:error] [pid 65064:tid 65082] [client 20.203.142.107:11936] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY3FFBOvRgscTcqsMBnpUAAAAM8"]
[Thu Feb 12 20:18:29.593958 2026] [:error] [pid 63418:tid 63493] [client 20.203.142.107:30927] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aY3FFdzjh-bbJnStPZLceQAAAJE"]
[Thu Feb 12 20:18:31.638536 2026] [:error] [pid 63416:tid 63442] [client 20.203.142.107:19171] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Feb 12 20:18:31.878128 2026] [:error] [pid 63416:tid 63435] [client 20.203.142.107:19171] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Thu Feb 12 20:18:32.114162 2026] [:error] [pid 63416:tid 63444] [client 20.203.142.107:19171] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aY3FGL2wmecPaCHcM2--4wAAAZc"]
[Thu Feb 12 20:18:33.586874 2026] [:error] [pid 63511:tid 63529] [client 20.203.142.107:30498] [client 20.203.142.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aY3FGaQCQbD5BgeyIk0TxQAAABA"]
[Thu Feb 12 20:18:35.897995 2026] [:error] [pid 63511:tid 63535] [client 20.203.142.107:11944] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Feb 12 20:18:36.140658 2026] [:error] [pid 63511:tid 63534] [client 20.203.142.107:11944] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Feb 12 20:18:36.382205 2026] [:error] [pid 63511:tid 63519] [client 20.203.142.107:11944] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Thu Feb 12 20:18:36.663390 2026] [:error] [pid 63511:tid 63515] [client 20.203.142.107:11944] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Thu Feb 12 20:18:36.906502 2026] [:error] [pid 63511:tid 63537] [client 20.203.142.107:11944] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Thu Feb 12 20:18:37.147383 2026] [:error] [pid 63511:tid 63536] [client 20.203.142.107:11944] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Thu Feb 12 20:18:37.383906 2026] [:error] [pid 63511:tid 63526] [client 20.203.142.107:11944] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aY3FHaQCQbD5BgeyIk0T1gAAAA0"]
[Thu Feb 12 20:18:38.779234 2026] [:error] [pid 65064:tid 65084] [client 20.203.142.107:26310] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aY3FHhOvRgscTcqsMBnpXgAAANE"]
[Thu Feb 12 20:18:40.257868 2026] [:error] [pid 63417:tid 63458] [client 20.203.142.107:5595] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aY3FIP8gSb97qRMtXCLhYQAAAEk"]
[Thu Feb 12 20:18:42.073192 2026] [:error] [pid 63416:tid 63431] [client 20.203.142.107:19195] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aY3FIr2wmecPaCHcM2--9AAAAYo"]
[Thu Feb 12 20:18:46.967266 2026] [:error] [pid 63416:tid 63439] [client 20.203.142.107:46123] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aY3FJr2wmecPaCHcM2-_BwAAAZI"]
[Thu Feb 12 20:18:56.451193 2026] [:error] [pid 63417:tid 63457] [client 20.203.142.107:26326] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aY3FMP8gSb97qRMtXCLhkwAAAEg"]
[Thu Feb 12 20:19:16.765454 2026] [:error] [pid 63417:tid 63459] [client 20.203.142.107:30987] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/333.php"] [unique_id "aY3FRP8gSb97qRMtXCLhtAAAAEo"]
[Thu Feb 12 20:19:23.669631 2026] [:error] [pid 63417:tid 63455] [client 20.203.142.107:23763] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aY3FS_8gSb97qRMtXCLhyQAAAEY"]
[Thu Feb 12 20:19:31.857856 2026] [:error] [pid 65064:tid 65073] [client 20.203.142.107:30448] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aY3FUxOvRgscTcqsMBnp7QAAAMY"]
[Thu Feb 12 20:19:33.903683 2026] [:error] [pid 63417:tid 63469] [client 20.203.142.107:14267] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aY3FVf8gSb97qRMtXCLh0wAAAFQ"]
[Thu Feb 12 20:19:54.616240 2026] [:error] [pid 65064:tid 65077] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Thu Feb 12 20:19:54.887119 2026] [:error] [pid 65064:tid 65073] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Feb 12 20:19:55.129846 2026] [:error] [pid 65064:tid 65071] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Feb 12 20:19:55.530267 2026] [:error] [pid 65064:tid 65082] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Thu Feb 12 20:19:56.754679 2026] [:error] [pid 65064:tid 65082] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Thu Feb 12 20:19:56.995583 2026] [:error] [pid 65064:tid 65067] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/ave.php
[Thu Feb 12 20:19:57.392126 2026] [:error] [pid 65064:tid 65076] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Thu Feb 12 20:19:57.654828 2026] [:error] [pid 65064:tid 65078] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Thu Feb 12 20:19:57.895661 2026] [:error] [pid 65064:tid 65070] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Feb 12 20:19:58.250720 2026] [:error] [pid 65064:tid 65088] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Feb 12 20:19:58.490474 2026] [:error] [pid 65064:tid 65090] [client 20.203.142.107:53079] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Thu Feb 12 20:19:58.738735 2026] [:error] [pid 65064:tid 65080] [client 20.203.142.107:53079] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aY3FbhOvRgscTcqsMBnqRQAAAM0"]
[Thu Feb 12 20:20:00.046585 2026] [:error] [pid 63416:tid 63431] [client 20.203.142.107:30440] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aY3FcL2wmecPaCHcM2-_XAAAAYo"]
[Thu Feb 12 20:20:01.530845 2026] [:error] [pid 65064:tid 65071] [client 20.203.142.107:30459] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aY3FcROvRgscTcqsMBnqVAAAAMQ"]
[Thu Feb 12 20:20:04.040150 2026] [:error] [pid 65064:tid 65079] [client 20.203.142.107:58294] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aY3FdBOvRgscTcqsMBnqWQAAAMw"]
[Thu Feb 12 20:20:04.934628 2026] [:error] [pid 65064:tid 65073] [client 20.203.142.107:55721] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY3FdBOvRgscTcqsMBnqXAAAAMY"]
[Thu Feb 12 20:20:07.821634 2026] [:error] [pid 63511:tid 63534] [client 20.203.142.107:36187] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY3Fd6QCQbD5BgeyIk0UiAAAABU"]
[Thu Feb 12 20:20:09.266991 2026] [:error] [pid 63418:tid 63495] [client 20.203.142.107:11593] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY3Fedzjh-bbJnStPZLdEgAAAJM"]
[Thu Feb 12 20:20:09.953983 2026] [:error] [pid 63417:tid 63457] [client 20.203.142.107:45594] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY3Fef8gSb97qRMtXCLiCwAAAEg"]
[Thu Feb 12 20:20:10.958071 2026] [:error] [pid 65064:tid 65087] [client 20.203.142.107:47573] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aY3FehOvRgscTcqsMBnqagAAANQ"]
[Thu Feb 12 20:20:11.979583 2026] [:error] [pid 65064:tid 65086] [client 20.203.142.107:18724] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aY3FexOvRgscTcqsMBnqawAAANM"]
[Thu Feb 12 20:20:12.760126 2026] [:error] [pid 65064:tid 65072] [client 20.203.142.107:5211] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aY3FfBOvRgscTcqsMBnqbQAAAMU"]
[Thu Feb 12 20:20:13.502961 2026] [:error] [pid 65064:tid 65074] [client 20.203.142.107:47603] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aY3FfROvRgscTcqsMBnqcQAAAMc"]
[Thu Feb 12 20:20:14.109883 2026] [:error] [pid 63416:tid 63440] [client 20.203.142.107:27838] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aY3Ffr2wmecPaCHcM2-_cAAAAZM"]
[Thu Feb 12 20:20:15.011543 2026] [:error] [pid 63417:tid 63470] [client 20.203.142.107:16628] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aY3Ff_8gSb97qRMtXCLiEgAAAFU"]
[Thu Feb 12 20:20:15.821654 2026] [:error] [pid 65064:tid 65086] [client 20.203.142.107:5199] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aY3FfxOvRgscTcqsMBnqewAAANM"]
[Thu Feb 12 20:20:17.282328 2026] [:error] [pid 65064:tid 65070] [client 20.203.142.107:24776] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aY3FgROvRgscTcqsMBnqfwAAAMM"]
[Thu Feb 12 20:20:18.431288 2026] [:error] [pid 63418:tid 63481] [client 20.203.142.107:24776] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aY3Fgtzjh-bbJnStPZLdGgAAAIU"]
[Thu Feb 12 20:20:20.185175 2026] [:error] [pid 63511:tid 63524] [client 20.203.142.107:51429] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aY3FhKQCQbD5BgeyIk0UlwAAAAs"]
[Thu Feb 12 20:20:21.847907 2026] [:error] [pid 63418:tid 63485] [client 20.203.142.107:28707] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aY3Fhdzjh-bbJnStPZLdHQAAAIk"]
[Thu Feb 12 20:20:24.412855 2026] [:error] [pid 63418:tid 63499] [client 20.203.142.107:12830] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aY3FiNzjh-bbJnStPZLdIQAAAJc"]
[Thu Feb 12 20:20:25.773319 2026] [:error] [pid 65064:tid 65070] [client 20.203.142.107:12863] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aY3FiROvRgscTcqsMBnqlQAAAMM"]
[Thu Feb 12 20:20:26.594424 2026] [:error] [pid 63418:tid 63500] [client 20.203.142.107:47638] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aY3Fitzjh-bbJnStPZLdKAAAAJg"]
[Thu Feb 12 20:20:27.506074 2026] [:error] [pid 63417:tid 63468] [client 20.203.142.107:22239] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aY3Fi_8gSb97qRMtXCLiJAAAAFM"]
[Thu Feb 12 20:20:28.630105 2026] [:error] [pid 63511:tid 63517] [client 20.203.142.107:5726] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aY3FjKQCQbD5BgeyIk0UpQAAAAQ"]
[Thu Feb 12 20:20:29.271601 2026] [:error] [pid 63511:tid 63518] [client 20.203.142.107:25908] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aY3FjaQCQbD5BgeyIk0UpgAAAAU"]
[Thu Feb 12 20:20:29.820410 2026] [:error] [pid 63417:tid 63454] [client 20.203.142.107:16093] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aY3Fjf8gSb97qRMtXCLiKQAAAEU"]
[Thu Feb 12 20:20:30.639836 2026] [:error] [pid 63416:tid 63437] [client 20.203.142.107:15582] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aY3Fjr2wmecPaCHcM2-_fAAAAZA"]
[Thu Feb 12 20:20:32.259322 2026] [:error] [pid 63417:tid 63451] [client 20.203.142.107:36228] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aY3FkP8gSb97qRMtXCLiLgAAAEI"]
[Thu Feb 12 20:20:33.349081 2026] [:error] [pid 63418:tid 63494] [client 20.203.142.107:23831] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aY3Fkdzjh-bbJnStPZLdNQAAAJI"]
[Thu Feb 12 20:20:34.256773 2026] [:error] [pid 63417:tid 63461] [client 20.203.142.107:53312] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aY3Fkv8gSb97qRMtXCLiMgAAAEw"]
[Thu Feb 12 20:20:35.916813 2026] [:error] [pid 63418:tid 63498] [client 20.203.142.107:41426] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aY3Fk9zjh-bbJnStPZLdOAAAAJY"]
[Thu Feb 12 20:20:37.820997 2026] [:error] [pid 63511:tid 63534] [client 20.203.142.107:18141] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aY3FlaQCQbD5BgeyIk0UrwAAABU"]
[Thu Feb 12 20:20:39.619063 2026] [:error] [pid 63417:tid 63472] [client 20.203.142.107:51629] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aY3Fl_8gSb97qRMtXCLiNwAAAFc"]
[Thu Feb 12 20:20:41.668452 2026] [:error] [pid 63418:tid 63486] [client 20.203.142.107:19230] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aY3Fmdzjh-bbJnStPZLdQwAAAIo"]
[Thu Feb 12 20:20:42.869416 2026] [:error] [pid 63511:tid 63535] [client 20.203.142.107:26408] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aY3FmqQCQbD5BgeyIk0UtQAAABY"]
[Thu Feb 12 20:20:44.159977 2026] [:error] [pid 63511:tid 63524] [client 20.203.142.107:19744] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aY3FnKQCQbD5BgeyIk0UtgAAAAs"]
[Thu Feb 12 20:20:45.588310 2026] [:error] [pid 63417:tid 63468] [client 20.203.142.107:53166] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aY3Fnf8gSb97qRMtXCLiPgAAAFM"]
[Thu Feb 12 20:20:47.466464 2026] [:error] [pid 63418:tid 63499] [client 20.203.142.107:12129] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aY3Fn9zjh-bbJnStPZLdSwAAAJc"]
[Thu Feb 12 20:20:48.714172 2026] [:error] [pid 63416:tid 63427] [client 20.203.142.107:19740] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aY3FoL2wmecPaCHcM2-_mgAAAYY"]
[Thu Feb 12 20:20:49.414135 2026] [:error] [pid 65064:tid 65075] [client 20.203.142.107:5452] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aY3FoROvRgscTcqsMBnq4AAAAMg"]
[Thu Feb 12 20:20:50.295248 2026] [:error] [pid 63417:tid 63464] [client 20.203.142.107:6062] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aY3Fov8gSb97qRMtXCLiSAAAAE8"]
[Thu Feb 12 20:20:51.172091 2026] [:error] [pid 63417:tid 63450] [client 20.203.142.107:6037] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aY3Fo_8gSb97qRMtXCLiSwAAAEE"]
[Thu Feb 12 20:20:51.799799 2026] [:error] [pid 65064:tid 65089] [client 20.203.142.107:12131] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aY3FoxOvRgscTcqsMBnq6AAAANY"]
[Thu Feb 12 20:20:52.613589 2026] [:error] [pid 65064:tid 65087] [client 20.203.142.107:19240] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aY3FpBOvRgscTcqsMBnq7AAAANQ"]
[Thu Feb 12 20:20:53.304925 2026] [:error] [pid 63416:tid 63438] [client 20.203.142.107:37204] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aY3Fpb2wmecPaCHcM2-_nQAAAZE"]
[Thu Feb 12 20:20:54.255013 2026] [:error] [pid 65064:tid 65078] [client 20.203.142.107:37208] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aY3FphOvRgscTcqsMBnq9QAAAMs"]
[Thu Feb 12 20:20:55.023971 2026] [:error] [pid 63511:tid 63536] [client 20.203.142.107:11272] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aY3Fp6QCQbD5BgeyIk0U2AAAABc"]
[Thu Feb 12 20:20:55.871785 2026] [:error] [pid 63511:tid 63535] [client 20.203.142.107:29362] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aY3Fp6QCQbD5BgeyIk0U2wAAABY"]
[Thu Feb 12 20:20:57.054832 2026] [:error] [pid 63511:tid 63516] [client 20.203.142.107:26840] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aY3FqaQCQbD5BgeyIk0U3wAAAAM"]
[Thu Feb 12 20:20:59.668944 2026] [:error] [pid 65064:tid 65071] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Thu Feb 12 20:20:59.909002 2026] [:error] [pid 65064:tid 65072] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Feb 12 20:21:00.148825 2026] [:error] [pid 65064:tid 65086] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Thu Feb 12 20:21:00.389206 2026] [:error] [pid 65064:tid 65088] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Thu Feb 12 20:21:00.654197 2026] [:error] [pid 65064:tid 65078] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Thu Feb 12 20:21:00.894588 2026] [:error] [pid 65064:tid 65081] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Thu Feb 12 20:21:01.135652 2026] [:error] [pid 65064:tid 65091] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Thu Feb 12 20:21:01.383327 2026] [:error] [pid 65064:tid 65083] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Feb 12 20:21:01.653010 2026] [:error] [pid 65064:tid 65076] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Thu Feb 12 20:21:01.893961 2026] [:error] [pid 65064:tid 65070] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Thu Feb 12 20:21:02.136924 2026] [:error] [pid 65064:tid 65071] [client 20.203.142.107:51464] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Thu Feb 12 20:21:02.380344 2026] [:error] [pid 65064:tid 65084] [client 20.203.142.107:51464] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aY3FrhOvRgscTcqsMBnrFQAAANE"]
[Thu Feb 12 20:21:04.300819 2026] [:error] [pid 63418:tid 63477] [client 20.203.142.107:16628] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aY3FsNzjh-bbJnStPZLdYAAAAIE"]
[Thu Feb 12 20:21:06.227813 2026] [:error] [pid 63417:tid 63464] [client 20.203.142.107:31437] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aY3Fsv8gSb97qRMtXCLiXAAAAE8"]
[Thu Feb 12 20:21:07.284834 2026] [:error] [pid 63418:tid 63481] [client 20.203.142.107:19168] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aY3Fs9zjh-bbJnStPZLdaQAAAIU"]
[Thu Feb 12 20:21:08.163210 2026] [:error] [pid 65064:tid 65078] [client 20.203.142.107:47044] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aY3FtBOvRgscTcqsMBnrJQAAAMs"]
[Thu Feb 12 20:21:09.278765 2026] [:error] [pid 63511:tid 63528] [client 20.203.142.107:13115] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aY3FtaQCQbD5BgeyIk0U9AAAAA8"]
[Thu Feb 12 20:21:09.998423 2026] [:error] [pid 63416:tid 63440] [client 20.203.142.107:50986] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aY3Ftb2wmecPaCHcM2-_qwAAAZM"]
[Thu Feb 12 20:21:10.967917 2026] [:error] [pid 63511:tid 63516] [client 20.203.142.107:15059] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aY3FtqQCQbD5BgeyIk0U9gAAAAM"]
[Thu Feb 12 20:21:11.866088 2026] [:error] [pid 65064:tid 65074] [client 20.203.142.107:5402] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aY3FtxOvRgscTcqsMBnrKgAAAMc"]
[Thu Feb 12 20:21:12.661335 2026] [:error] [pid 65064:tid 65068] [client 20.203.142.107:31486] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aY3FuBOvRgscTcqsMBnrLAAAAME"]
[Thu Feb 12 20:21:13.481164 2026] [:error] [pid 65064:tid 65069] [client 20.203.142.107:5463] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aY3FuROvRgscTcqsMBnrLgAAAMI"]
[Thu Feb 12 20:21:14.119514 2026] [:error] [pid 63417:tid 63450] [client 20.203.142.107:50990] [client 20.203.142.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aY3Fuv8gSb97qRMtXCLiZwAAAEE"]
[Thu Feb 12 20:33:20.836929 2026] [:error] [pid 65064:tid 65090] [client 101.32.52.164:43192] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aY3IkBOvRgscTcqsMBnxigAAANc"]
[Thu Feb 12 20:55:22.062712 2026] [:error] [pid 46718:tid 46724] [client 104.28.163.222:38229] [client 104.28.163.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aY3NukdfX45LelQwruQUugAAAcM"]
[Thu Feb 12 23:15:36.386183 2026] [:error] [pid 65064:tid 65075] [client 182.42.111.213:60724] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aY3umBOvRgscTcqsMBkj1AAAAMg"]
[Thu Feb 12 23:51:57.779215 2026] [:error] [pid 63416:tid 63438] [client 51.120.78.0:43115] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Fri Feb 13 02:26:51.015072 2026] [:error] [pid 37510:tid 37530] [client 170.106.35.187:50280] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aY4ba8UrqDPNSf1wYBWq8wAAAY4"]
[Fri Feb 13 05:03:49.420480 2026] [:error] [pid 51243:tid 51252] [client 172.213.161.82:37320] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Fri Feb 13 09:50:33.925025 2026] [:error] [pid 49223:tid 49251] [client 40.89.152.156:37119] File does not exist: /usr/local/apache/htdocs/suspended-page/24.php
[Fri Feb 13 11:30:08.994636 2026] [:error] [pid 46821:tid 46842] [client 182.44.10.67:59110] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aY6awI6G1N5YSq0J0geV5wAAAVM"]
[Fri Feb 13 13:58:38.935939 2026] [:error] [pid 18097:tid 18099] [client 193.36.225.160:42023] [client 193.36.225.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.160, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aY69jnFzYiQ_BfaDDlbTIQAAAYA"]
[Fri Feb 13 13:58:38.940155 2026] [:error] [pid 18097:tid 18099] [client 193.36.225.160:42023] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 13 14:09:36.567100 2026] [:error] [pid 47143:tid 47226] [client 104.28.164.218:23606] [client 104.28.164.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aY7AIMhV30NbMarHJLsCKAAAAkw"]
[Fri Feb 13 17:47:45.224027 2026] [:error] [pid 47575:tid 47581] [client 175.6.217.4:46325] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aY7zQQIPBuXb07mA_mSqiwAAAsI"]
[Sat Feb 14 06:56:59.559568 2026] [:error] [pid 21195:tid 21247] [client 43.153.71.12:57814] [client 43.153.71.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aY-sO9_2sARdLQ6dpsVKywAAAFA"]
[Sat Feb 14 12:36:21.893708 2026] [:error] [pid 21784:tid 21795] [client 139.59.24.163:61937] [client 139.59.24.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "aY_7xa1lOIszF3YGN__KXwAAAUg"], referer: binance.com
[Sat Feb 14 12:36:28.585478 2026] [:error] [pid 8039:tid 8053] [client 139.59.24.163:64214] [client 139.59.24.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aY_7zHLa1ioCIZV3fA4aeAAAAwk"], referer: binance.com
[Sat Feb 14 12:45:03.464847 2026] [:error] [pid 28882:tid 28909] [client 223.244.35.77:41912] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aY_9z3FQSrm4EPBDLaxNaAAAAlg"]
[Sat Feb 14 12:46:29.364304 2026] [:error] [pid 7982:tid 8031] [client 43.153.123.4:38028] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aY_-JWLTp1DWAgIKqwSh2wAAAtQ"]
[Sun Feb 15 01:55:38.731929 2026] [:error] [pid 43945:tid 44102] [client 49.51.253.83:43436] [client 49.51.253.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZC3GgOG1NkcLbix8XX6YQAAAgM"]
[Sun Feb 15 05:48:13.603768 2026] [:error] [pid 25058:tid 25102] [client 43.153.67.21:60934] [client 43.153.67.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZDtnYg4NxVrOKZPnPEj7wAAAw8"]
[Sun Feb 15 07:40:58.687513 2026] [:error] [pid 53689:tid 53747] [client 182.44.12.37:33369] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZEICgdVuSk1xLp2CvBMtQAAA8E"]
[Sun Feb 15 18:54:20.111695 2026] [:error] [pid 31679:tid 31728] [client 167.86.118.77:64687] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/"] [unique_id "aZGl3Bz9Q_0Eh7M-Xr25EAAAAhM"], referer: binance.com
[Sun Feb 15 19:53:02.432658 2026] [:error] [pid 42659:tid 42676] [client 43.166.136.153:41388] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZGznuy3JGHOB-Rj_FaNeAAAAE8"]
[Sun Feb 15 23:11:36.117869 2026] [:error] [pid 35560:tid 35621] [client 43.135.185.59:34600] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZHiKAZSChHPc3occZ5hGQAAAwQ"]
[Mon Feb 16 02:52:30.807161 2026] [:error] [pid 19652:tid 19673] [client 114.96.103.33:53732] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZIV7jHg2T9K5fiyOL9odAAAABM"]
[Mon Feb 16 05:42:28.094286 2026] [:error] [pid 4349:tid 4435] [client 170.106.73.216:47616] [client 170.106.73.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZI9xMrbZYafUL_3QfzyGQAAAI0"]
[Mon Feb 16 06:57:08.418116 2026] [:error] [pid 37004:tid 37021] [client 207.180.241.56:64053] [client 207.180.241.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aZJPRFXWqA9gxE5oGmYzlwAAAQ8"], referer: binance.com
[Mon Feb 16 10:41:34.087127 2026] [:error] [pid 4455:tid 4460] [client 107.189.30.143:24374] [client 107.189.30.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.30.143, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aZKD3gNa-4dvQCL0rurl5AAAAMM"], referer: http://www.google.com.hk
[Mon Feb 16 10:41:34.092904 2026] [:error] [pid 4455:tid 4460] [client 107.189.30.143:24374] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: http://www.google.com.hk
[Mon Feb 16 14:51:42.668352 2026] [:error] [pid 4347:tid 4370] [client 104.28.235.60:14738] [client 104.28.235.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aZK-fjFcjv6pEAnSEidSLAAAAAI"]
[Mon Feb 16 15:11:09.384780 2026] [:error] [pid 37004:tid 37024] [client 180.110.203.108:42986] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZLDDVXWqA9gxE5oGmbdlgAAARI"]
[Mon Feb 16 17:58:17.811062 2026] [:error] [pid 26648:tid 26660] [client 43.157.95.131:56778] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZLqOTT55fUixS3gmygLKwAAAYc"]
[Tue Feb 17 05:29:32.732971 2026] [:error] [pid 32790:tid 32795] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 05:29:33.009164 2026] [:error] [pid 32790:tid 32812] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 05:29:33.269593 2026] [:error] [pid 32790:tid 32808] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 05:29:33.536387 2026] [:error] [pid 32790:tid 32801] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 05:29:33.791680 2026] [:error] [pid 32790:tid 32802] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 05:29:34.061483 2026] [:error] [pid 32790:tid 32794] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 05:29:34.317044 2026] [:error] [pid 32790:tid 32799] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 05:29:34.628572 2026] [:error] [pid 32790:tid 32804] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 05:29:34.967244 2026] [:error] [pid 32790:tid 32800] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 05:29:35.229545 2026] [:error] [pid 32790:tid 32813] [client 20.238.121.35:14546] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 05:29:35.479766 2026] [:error] [pid 32790:tid 32798] [client 20.238.121.35:14546] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOMP3s3HJP9ozPHsN7EeAAAAQQ"]
[Tue Feb 17 05:29:44.898138 2026] [:error] [pid 58659:tid 58666] [client 20.238.121.35:16006] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOMSMDX32iTEO4jt2_dbQAAAMU"]
[Tue Feb 17 05:29:46.537257 2026] [:error] [pid 58558:tid 58646] [client 20.238.121.35:48214] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOMSimIxlfUL2nViZykuAAAAJg"]
[Tue Feb 17 05:29:50.403433 2026] [:error] [pid 58659:tid 58674] [client 20.238.121.35:26830] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOMTsDX32iTEO4jt2_deQAAAM0"]
[Tue Feb 17 05:29:52.579709 2026] [:error] [pid 32790:tid 32794] [client 20.238.121.35:35684] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOMUHs3HJP9ozPHsN7EkQAAAQA"]
[Tue Feb 17 05:30:01.530946 2026] [:error] [pid 32790:tid 32817] [client 20.238.121.35:35215] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOMWXs3HJP9ozPHsN7EmgAAARc"]
[Tue Feb 17 05:30:08.953821 2026] [:error] [pid 58558:tid 58634] [client 20.238.121.35:17554] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOMYCmIxlfUL2nViZyk2wAAAIw"]
[Tue Feb 17 05:30:21.231204 2026] [:error] [pid 58659:tid 58669] [client 20.238.121.35:17578] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOMbcDX32iTEO4jt2_dtgAAAMg"]
[Tue Feb 17 05:30:23.661372 2026] [:error] [pid 58552:tid 58614] [client 20.238.121.35:22833] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOMbzBHVJP2Oz3yR5fYQQAAAFM"]
[Tue Feb 17 05:30:24.795423 2026] [:error] [pid 32790:tid 32808] [client 20.238.121.35:20229] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOMcHs3HJP9ozPHsN7E1wAAAQ4"]
[Tue Feb 17 05:30:25.952217 2026] [:error] [pid 32790:tid 32799] [client 20.238.121.35:47116] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOMcXs3HJP9ozPHsN7E3AAAAQU"]
[Tue Feb 17 05:30:28.107669 2026] [:error] [pid 58551:tid 58573] [client 20.238.121.35:47121] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOMdK1t8eWr-MgFsppaUwAAAA0"]
[Tue Feb 17 05:30:29.333626 2026] [:error] [pid 58552:tid 58614] [client 20.238.121.35:34152] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOMdTBHVJP2Oz3yR5fYTAAAAFM"]
[Tue Feb 17 05:30:30.751782 2026] [:error] [pid 58552:tid 58598] [client 20.238.121.35:22312] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOMdjBHVJP2Oz3yR5fYTQAAAEM"]
[Tue Feb 17 05:30:32.566130 2026] [:error] [pid 58558:tid 58641] [client 20.238.121.35:23612] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOMeCmIxlfUL2nViZyk_wAAAJM"]
[Tue Feb 17 05:30:33.328465 2026] [:error] [pid 58659:tid 58670] [client 20.238.121.35:32710] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOMecDX32iTEO4jt2_dwAAAAMk"]
[Tue Feb 17 05:30:33.999799 2026] [:error] [pid 58552:tid 58603] [client 20.238.121.35:32713] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZOMeTBHVJP2Oz3yR5fYVAAAAEg"]
[Tue Feb 17 05:30:34.962131 2026] [:error] [pid 58659:tid 58677] [client 20.238.121.35:34127] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZOMesDX32iTEO4jt2_dwwAAANA"]
[Tue Feb 17 05:30:38.501911 2026] [:error] [pid 58551:tid 58583] [client 20.238.121.35:22383] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Feb 17 05:30:38.785242 2026] [:error] [pid 58551:tid 58581] [client 20.238.121.35:22383] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Feb 17 05:30:39.053843 2026] [:error] [pid 58551:tid 58572] [client 20.238.121.35:22383] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Feb 17 05:30:39.336635 2026] [:error] [pid 58551:tid 58568] [client 20.238.121.35:22383] [client 20.238.121.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZOMf61t8eWr-MgFsppabAAAAAg"]
[Tue Feb 17 05:30:40.373321 2026] [:error] [pid 58558:tid 58646] [client 20.238.121.35:11819] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 06:55:44.757681 2026] [:error] [pid 58551:tid 58563] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 06:55:45.023152 2026] [:error] [pid 58551:tid 58580] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 06:55:45.335863 2026] [:error] [pid 58551:tid 58582] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 06:55:46.849752 2026] [:error] [pid 58551:tid 58582] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 06:55:47.113152 2026] [:error] [pid 58551:tid 58561] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 06:55:47.380600 2026] [:error] [pid 58551:tid 58560] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 06:55:47.747113 2026] [:error] [pid 58551:tid 58566] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 06:55:48.060866 2026] [:error] [pid 58551:tid 58562] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 06:55:48.334739 2026] [:error] [pid 58551:tid 58571] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 06:55:48.602564 2026] [:error] [pid 58551:tid 58565] [client 20.100.191.215:59267] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 06:55:49.035961 2026] [:error] [pid 58551:tid 58569] [client 20.100.191.215:59267] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOgda1t8eWr-MgFspp79wAAAAk"]
[Tue Feb 17 06:55:50.890358 2026] [:error] [pid 58552:tid 58619] [client 20.100.191.215:1153] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOgdjBHVJP2Oz3yR5f5cgAAAFg"]
[Tue Feb 17 06:55:53.561636 2026] [:error] [pid 58558:tid 58627] [client 20.100.191.215:1199] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOgeSmIxlfUL2nViZzJMAAAAIU"]
[Tue Feb 17 06:55:55.155140 2026] [:error] [pid 58551:tid 58569] [client 20.100.191.215:1115] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOge61t8eWr-MgFspp8AwAAAAk"]
[Tue Feb 17 06:55:57.374410 2026] [:error] [pid 58551:tid 58579] [client 20.100.191.215:59719] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOgfa1t8eWr-MgFspp8BQAAABM"]
[Tue Feb 17 06:55:59.797475 2026] [:error] [pid 58551:tid 58565] [client 20.100.191.215:61995] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOgf61t8eWr-MgFspp8DAAAAAU"]
[Tue Feb 17 06:56:01.842774 2026] [:error] [pid 58558:tid 58646] [client 20.100.191.215:59712] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOggSmIxlfUL2nViZzJQwAAAJg"]
[Tue Feb 17 06:56:06.209226 2026] [:error] [pid 58552:tid 58597] [client 20.100.191.215:17221] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOghjBHVJP2Oz3yR5f5kAAAAEI"]
[Tue Feb 17 06:56:07.775643 2026] [:error] [pid 58552:tid 58616] [client 20.100.191.215:59280] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOghzBHVJP2Oz3yR5f5lgAAAFU"]
[Tue Feb 17 06:56:09.302564 2026] [:error] [pid 58558:tid 58630] [client 20.100.191.215:59315] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOgiSmIxlfUL2nViZzJUQAAAIg"]
[Tue Feb 17 06:56:18.273715 2026] [:error] [pid 58552:tid 58595] [client 20.100.191.215:1110] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOgkjBHVJP2Oz3yR5f5pgAAAEA"]
[Tue Feb 17 06:56:27.913861 2026] [:error] [pid 58659:tid 58680] [client 20.100.191.215:58868] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOgm8DX32iTEO4jt28IKwAAANM"]
[Tue Feb 17 06:56:30.562866 2026] [:error] [pid 58551:tid 58580] [client 20.100.191.215:58864] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOgnq1t8eWr-MgFspp8SQAAABQ"]
[Tue Feb 17 06:56:42.197070 2026] [:error] [pid 32790:tid 32795] [client 20.100.191.215:53704] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOgqns3HJP9ozPHsN73-AAAAQE"]
[Tue Feb 17 06:56:46.967399 2026] [:error] [pid 58558:tid 58631] [client 20.100.191.215:39961] [client 20.100.191.215] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOgrimIxlfUL2nViZzJgQAAAIk"]
[Tue Feb 17 06:56:51.842539 2026] [:error] [pid 58558:tid 58624] [client 20.100.191.215:61120] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Feb 17 06:56:52.107415 2026] [:error] [pid 58558:tid 58631] [client 20.100.191.215:61120] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Feb 17 06:56:52.372835 2026] [:error] [pid 58558:tid 58645] [client 20.100.191.215:61120] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Feb 17 06:56:52.639388 2026] [:error] [pid 58558:tid 58644] [client 20.100.191.215:61120] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Feb 17 06:56:52.901021 2026] [:error] [pid 58558:tid 58646] [client 20.100.191.215:61120] [client 20.100.191.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZOgtCmIxlfUL2nViZzJkgAAAJg"]
[Tue Feb 17 06:56:54.138885 2026] [:error] [pid 32790:tid 32816] [client 20.100.191.215:39939] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 07:13:01.106558 2026] [:error] [pid 58659:tid 58661] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 07:13:01.382382 2026] [:error] [pid 58659:tid 58669] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 07:13:01.665625 2026] [:error] [pid 58659:tid 58667] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 07:13:03.103833 2026] [:error] [pid 58659:tid 58667] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 07:13:03.377514 2026] [:error] [pid 58659:tid 58681] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 07:13:03.679842 2026] [:error] [pid 58659:tid 58668] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 07:13:03.944754 2026] [:error] [pid 58659:tid 58673] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 07:13:04.220684 2026] [:error] [pid 58659:tid 58676] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 07:13:04.565476 2026] [:error] [pid 58659:tid 58663] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 07:13:04.831122 2026] [:error] [pid 58659:tid 58683] [client 20.238.121.35:31573] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 07:13:05.099352 2026] [:error] [pid 58659:tid 58684] [client 20.238.121.35:31573] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOkgcDX32iTEO4jt28PiAAAANc"]
[Tue Feb 17 07:13:07.766284 2026] [:error] [pid 58659:tid 58672] [client 20.238.121.35:5258] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOkg8DX32iTEO4jt28PiQAAAMs"]
[Tue Feb 17 07:13:09.525970 2026] [:error] [pid 58552:tid 58595] [client 20.238.121.35:28156] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOkhTBHVJP2Oz3yR5f_cgAAAEA"]
[Tue Feb 17 07:13:14.210276 2026] [:error] [pid 58552:tid 58619] [client 20.238.121.35:5304] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOkijBHVJP2Oz3yR5f_fQAAAFg"]
[Tue Feb 17 07:13:20.503855 2026] [:error] [pid 32790:tid 32811] [client 20.238.121.35:59963] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOkkHs3HJP9ozPHsN4BOAAAARE"]
[Tue Feb 17 07:13:21.905707 2026] [:error] [pid 58659:tid 58677] [client 20.238.121.35:59229] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOkkcDX32iTEO4jt28PnQAAANA"]
[Tue Feb 17 07:13:23.073127 2026] [:error] [pid 58551:tid 58578] [client 20.238.121.35:28128] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOkk61t8eWr-MgFspqCcQAAABI"]
[Tue Feb 17 07:13:25.782808 2026] [:error] [pid 58659:tid 58662] [client 20.238.121.35:24120] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOklcDX32iTEO4jt28PpwAAAME"]
[Tue Feb 17 07:13:34.759370 2026] [:error] [pid 58558:tid 58640] [client 20.238.121.35:59932] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOknimIxlfUL2nViZzQZwAAAJI"]
[Tue Feb 17 07:13:37.736009 2026] [:error] [pid 58552:tid 58606] [client 20.238.121.35:25635] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOkoTBHVJP2Oz3yR5f_oAAAAEs"]
[Tue Feb 17 07:13:38.711054 2026] [:error] [pid 58552:tid 58608] [client 20.238.121.35:43406] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOkojBHVJP2Oz3yR5f_pQAAAE0"]
[Tue Feb 17 07:13:40.417767 2026] [:error] [pid 58659:tid 58663] [client 20.238.121.35:43394] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOkpMDX32iTEO4jt28PvAAAAMI"]
[Tue Feb 17 07:13:43.154209 2026] [:error] [pid 58558:tid 58639] [client 20.238.121.35:58921] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOkpymIxlfUL2nViZzQdAAAAJE"]
[Tue Feb 17 07:13:44.577615 2026] [:error] [pid 58552:tid 58613] [client 20.238.121.35:58943] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOkqDBHVJP2Oz3yR5f_rgAAAFI"]
[Tue Feb 17 07:13:47.801510 2026] [:error] [pid 58558:tid 58630] [client 20.238.121.35:22424] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOkqymIxlfUL2nViZzQeQAAAIg"]
[Tue Feb 17 07:13:48.912050 2026] [:error] [pid 32790:tid 32805] [client 20.238.121.35:5449] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOkrHs3HJP9ozPHsN4BogAAAQs"]
[Tue Feb 17 07:13:50.988741 2026] [:error] [pid 58551:tid 58583] [client 20.238.121.35:5445] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOkrq1t8eWr-MgFspqCoQAAABc"]
[Tue Feb 17 07:13:54.987747 2026] [:error] [pid 58659:tid 58678] [client 20.238.121.35:5466] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOkssDX32iTEO4jt28P2gAAANE"]
[Tue Feb 17 07:14:01.709755 2026] [:error] [pid 58552:tid 58595] [client 20.238.121.35:62145] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aZOkuTBHVJP2Oz3yR5f_wAAAAEA"]
[Tue Feb 17 07:14:07.287823 2026] [:error] [pid 58659:tid 58675] [client 20.238.121.35:5473] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Feb 17 07:14:08.313732 2026] [:error] [pid 58659:tid 58675] [client 20.238.121.35:5473] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Feb 17 07:14:09.539431 2026] [:error] [pid 58659:tid 58675] [client 20.238.121.35:5473] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Feb 17 07:14:09.806307 2026] [:error] [pid 58659:tid 58673] [client 20.238.121.35:5473] [client 20.238.121.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZOkwcDX32iTEO4jt28P-QAAAMw"]
[Tue Feb 17 07:14:11.639995 2026] [:error] [pid 58551:tid 58576] [client 20.238.121.35:18453] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 08:05:48.580926 2026] [:error] [pid 58558:tid 58634] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 08:05:48.830092 2026] [:error] [pid 58558:tid 58636] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 08:05:49.070727 2026] [:error] [pid 58558:tid 58628] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 08:05:49.627528 2026] [:error] [pid 58558:tid 58637] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 08:05:49.884786 2026] [:error] [pid 58558:tid 58642] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 08:05:50.131267 2026] [:error] [pid 58558:tid 58643] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 08:05:50.376863 2026] [:error] [pid 58558:tid 58645] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 08:05:50.636115 2026] [:error] [pid 58558:tid 58632] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 08:05:50.877102 2026] [:error] [pid 58558:tid 58646] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 08:05:51.145385 2026] [:error] [pid 58558:tid 58639] [client 51.107.69.151:10620] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 08:05:51.403035 2026] [:error] [pid 58558:tid 58635] [client 51.107.69.151:10620] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOw3ymIxlfUL2nViZzqMAAAAI0"]
[Tue Feb 17 08:05:55.676310 2026] [:error] [pid 58551:tid 58565] [client 51.107.69.151:30747] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOw461t8eWr-MgFspqb5AAAAAU"]
[Tue Feb 17 08:05:58.682314 2026] [:error] [pid 32790:tid 32814] [client 51.107.69.151:41733] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZOw5ns3HJP9ozPHsN4kPwAAARQ"]
[Tue Feb 17 08:06:19.972425 2026] [:error] [pid 58659:tid 58676] [client 51.107.69.151:15517] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOw-8DX32iTEO4jt28sCQAAAM8"]
[Tue Feb 17 08:06:24.153421 2026] [:error] [pid 58552:tid 58609] [client 51.107.69.151:16717] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOxADBHVJP2Oz3yR5cYywAAAE4"]
[Tue Feb 17 08:06:30.766235 2026] [:error] [pid 58552:tid 58597] [client 51.107.69.151:52933] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZOxBjBHVJP2Oz3yR5cY1QAAAEI"]
[Tue Feb 17 08:06:48.458816 2026] [:error] [pid 58551:tid 58580] [client 51.107.69.151:21354] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aZOxGK1t8eWr-MgFspqcLAAAABQ"]
[Tue Feb 17 08:06:49.586484 2026] [:error] [pid 58558:tid 58624] [client 51.107.69.151:7287] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOxGSmIxlfUL2nViZzqkgAAAII"]
[Tue Feb 17 08:06:50.601597 2026] [:error] [pid 32790:tid 32803] [client 51.107.69.151:21312] [client 51.107.69.151] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ak.php/wp-admin/async-upload.php"] [unique_id "aZOxGns3HJP9ozPHsN4kowAAAQk"]
[Tue Feb 17 08:06:51.728369 2026] [:error] [pid 58558:tid 58645] [client 51.107.69.151:15502] File does not exist: /usr/local/apache/htdocs/suspended-page/ak.php
[Tue Feb 17 08:06:52.007178 2026] [:error] [pid 58558:tid 58623] [client 51.107.69.151:15502] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Feb 17 08:06:53.514117 2026] [:error] [pid 58558:tid 58623] [client 51.107.69.151:15502] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Feb 17 08:06:53.755860 2026] [:error] [pid 58558:tid 58637] [client 51.107.69.151:15502] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Feb 17 08:06:53.998409 2026] [:error] [pid 58558:tid 58631] [client 51.107.69.151:15502] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Feb 17 08:06:54.308493 2026] [:error] [pid 58558:tid 58627] [client 51.107.69.151:15502] [client 51.107.69.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZOxHimIxlfUL2nViZzqmwAAAIU"]
[Tue Feb 17 08:06:55.282803 2026] [:error] [pid 58659:tid 58674] [client 51.107.69.151:30817] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 08:11:06.706368 2026] [:error] [pid 58558:tid 58641] [client 20.188.56.166:39234] [client 20.188.56.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZOyGimIxlfUL2nViZzsgwAAAJM"]
[Tue Feb 17 08:11:13.820645 2026] [:error] [pid 58552:tid 58601] [client 20.188.56.166:28504] [client 20.188.56.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZOyITBHVJP2Oz3yR5cbIAAAAEY"]
[Tue Feb 17 08:11:15.331869 2026] [:error] [pid 58551:tid 58567] [client 20.188.56.166:41068] [client 20.188.56.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZOyI61t8eWr-MgFspqeGAAAAAc"]
[Tue Feb 17 08:11:17.736622 2026] [:error] [pid 58551:tid 58579] [client 20.188.56.166:30598] [client 20.188.56.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZOyJa1t8eWr-MgFspqeHgAAABM"]
[Tue Feb 17 09:46:23.974463 2026] [:error] [pid 58552:tid 58614] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Tue Feb 17 09:46:24.217811 2026] [:error] [pid 58552:tid 58599] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Feb 17 09:46:24.465756 2026] [:error] [pid 58552:tid 58605] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Tue Feb 17 09:46:24.712818 2026] [:error] [pid 58552:tid 58606] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Feb 17 09:46:24.962563 2026] [:error] [pid 58552:tid 58595] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/asax.php
[Tue Feb 17 09:46:25.233232 2026] [:error] [pid 58552:tid 58609] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Tue Feb 17 09:46:25.478878 2026] [:error] [pid 58552:tid 58611] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-k3w6g9s4h2.php
[Tue Feb 17 09:46:25.956971 2026] [:error] [pid 58552:tid 58619] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 17 09:46:26.519874 2026] [:error] [pid 58552:tid 58617] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Feb 17 09:46:26.761912 2026] [:error] [pid 58552:tid 58603] [client 68.221.64.54:4730] File does not exist: /usr/local/apache/htdocs/suspended-page/acfdr.php
[Tue Feb 17 09:46:27.014763 2026] [:error] [pid 58552:tid 58597] [client 68.221.64.54:4730] [client 68.221.64.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZPIczBHVJP2Oz3yR5dH_AAAAEI"]
[Tue Feb 17 09:46:29.100450 2026] [:error] [pid 32790:tid 32808] [client 68.221.64.54:60128] [client 68.221.64.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZPIdXs3HJP9ozPHsN5k3wAAAQ4"]
[Tue Feb 17 09:46:31.612756 2026] [:error] [pid 58659:tid 58662] [client 68.221.64.54:41588] [client 68.221.64.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZPId8DX32iTEO4jt29ijQAAAME"]
[Tue Feb 17 09:46:34.246917 2026] [:error] [pid 32790:tid 32813] [client 68.221.64.54:10902] [client 68.221.64.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aZPIens3HJP9ozPHsN5k8wAAARM"]
[Tue Feb 17 09:46:35.825352 2026] [:error] [pid 58558:tid 58635] [client 68.221.64.54:28431] [client 68.221.64.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZPIeymIxlfUL2nViZwZpAAAAI0"]
[Tue Feb 17 09:46:38.776766 2026] [:error] [pid 58558:tid 58644] [client 68.221.64.54:13034] [client 68.221.64.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZPIfimIxlfUL2nViZwZqgAAAJY"]
[Tue Feb 17 09:46:41.706942 2026] [:error] [pid 58551:tid 58583] [client 68.221.64.54:18797] [client 68.221.64.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZPIga1t8eWr-MgFsprI5wAAABc"]
[Tue Feb 17 09:48:50.868310 2026] [:error] [pid 58659:tid 58675] [client 68.221.64.54:4229] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Feb 17 11:58:53.530085 2026] [:error] [pid 58659:tid 58682] [client 170.106.65.93:36866] [client 170.106.65.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZPnfcDX32iTEO4jt2-jpgAAANU"]
[Tue Feb 17 14:27:31.474267 2026] [:error] [pid 32790:tid 32814] [client 43.156.109.53:51980] [client 43.156.109.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZQKU3s3HJP9ozPHsN4KMwAAARQ"]
[Tue Feb 17 15:56:51.636371 2026] [:error] [pid 58552:tid 58610] [client 60.188.57.0:55620] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZQfQzBHVJP2Oz3yR5fZoAAAAE8"]
[Tue Feb 17 17:44:21.046064 2026] [:error] [pid 58551:tid 58573] [client 49.51.180.2:42718] [client 49.51.180.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZQ4da1t8eWr-MgFspp0NQAAAA0"]
[Tue Feb 17 22:08:21.745004 2026] [:error] [pid 58558:tid 58634] [client 36.111.67.189:43910] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZR2VSmIxlfUL2nViZwUtgAAAIw"]
[Wed Feb 18 08:49:13.258577 2026] [:error] [pid 21961:tid 21976] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Feb 18 08:49:13.583283 2026] [:error] [pid 21961:tid 21963] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Feb 18 08:49:13.910145 2026] [:error] [pid 21961:tid 21985] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Feb 18 08:49:14.237406 2026] [:error] [pid 21961:tid 21971] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Feb 18 08:49:14.569541 2026] [:error] [pid 21961:tid 21964] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Feb 18 08:49:14.896287 2026] [:error] [pid 21961:tid 21965] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 18 08:49:15.221304 2026] [:error] [pid 21961:tid 21968] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 18 08:49:15.547564 2026] [:error] [pid 21961:tid 21982] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Feb 18 08:49:16.213435 2026] [:error] [pid 21961:tid 21979] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Feb 18 08:49:16.866899 2026] [:error] [pid 21961:tid 21985] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Feb 18 08:49:18.713998 2026] [:error] [pid 21961:tid 21985] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Feb 18 08:49:19.042035 2026] [:error] [pid 21961:tid 21967] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Feb 18 08:49:19.373836 2026] [:error] [pid 21961:tid 21982] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Feb 18 08:49:19.709081 2026] [:error] [pid 21961:tid 21978] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Feb 18 08:49:20.036122 2026] [:error] [pid 21961:tid 21976] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Feb 18 08:49:20.360897 2026] [:error] [pid 21961:tid 21970] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Feb 18 08:49:20.685886 2026] [:error] [pid 21961:tid 21977] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Feb 18 08:49:21.012099 2026] [:error] [pid 21961:tid 21975] [client 45.67.97.53:21935] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Feb 18 08:49:25.809776 2026] [:error] [pid 21961:tid 21986] [client 45.67.97.53:21935] [client 45.67.97.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aZUMlcUBDt_-H0ms3gWXbQAAANc"]
[Wed Feb 18 08:49:27.223825 2026] [:error] [pid 21849:tid 21924] [client 45.67.97.52:48505] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/kill.php"] [unique_id "aZUMl7x9a1XrfTYnuzKudwAAAIg"]
[Wed Feb 18 08:49:37.570248 2026] [:error] [pid 21849:tid 21940] [client 45.67.97.52:52529] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aZUMobx9a1XrfTYnuzKu8wAAAJg"]
[Wed Feb 18 08:49:38.227980 2026] [:error] [pid 21847:tid 21866] [client 45.67.97.52:59717] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aZUMovy9A5wy4LuXmJ0PwgAAAAg"]
[Wed Feb 18 08:49:40.873837 2026] [:error] [pid 5561:tid 5587] [client 45.67.97.53:22813] [client 45.67.97.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aZUMpEoQssCZYQ4NexYXnQAAAVc"]
[Wed Feb 18 08:49:52.786686 2026] [:error] [pid 21848:tid 21911] [client 45.67.97.54:44225] [client 45.67.97.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "aZUMsPbG91VRkVidT5dh5AAAAFY"]
[Wed Feb 18 08:49:55.032728 2026] [:error] [pid 21848:tid 21911] [client 45.67.97.52:53093] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/"] [unique_id "aZUMs_bG91VRkVidT5dh9gAAAFY"]
[Wed Feb 18 08:49:55.692735 2026] [:error] [pid 21849:tid 21939] [client 45.67.97.52:62937] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/"] [unique_id "aZUMs7x9a1XrfTYnuzKvXgAAAJc"]
[Wed Feb 18 08:49:56.339796 2026] [:error] [pid 21847:tid 21869] [client 45.67.97.53:52147] [client 45.67.97.53] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/"] [unique_id "aZUMtPy9A5wy4LuXmJ0QdQAAAAs"]
[Wed Feb 18 10:38:39.153273 2026] [:error] [pid 21961:tid 21967] [client 182.40.104.255:33686] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZUmL8UBDt_-H0ms3gW8HgAAAMQ"]
[Wed Feb 18 14:12:06.171203 2026] [:error] [pid 21847:tid 21875] [client 119.28.140.106:34022] [client 119.28.140.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZVYNvy9A5wy4LuXmJ2nRQAAABE"]
[Thu Feb 19 01:32:29.163389 2026] [:error] [pid 11607:tid 11616] [client 170.106.187.106:50058] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZX3rRw91ggRx3FA7BcnkwAAAkE"]
[Thu Feb 19 05:42:37.430939 2026] [:error] [pid 48901:tid 48911] [client 43.157.50.58:51794] [client 43.157.50.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZYyTcixYz-lHbN0WBLAcwAAAAE"]
[Thu Feb 19 08:28:02.526433 2026] [:error] [pid 48902:tid 48948] [client 49.51.50.147:50804] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZZZEmcJ-6aYRpRRFsV2-QAAAEo"]
[Thu Feb 19 13:52:07.491635 2026] [:error] [pid 15513:tid 15537] [client 104.28.153.120:29413] [client 104.28.153.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aZalB8GTRTE022JWg19YIgAAARY"]
[Thu Feb 19 14:26:36.133763 2026] [:error] [pid 48903:tid 48967] [client 43.159.128.247:39888] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZatHI6aTgKrpAR115ugHwAAAII"]
[Thu Feb 19 17:48:04.467902 2026] [:error] [pid 48903:tid 48987] [client 43.135.185.59:42444] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZbcVI6aTgKrpAR115vLlQAAAJY"]
[Thu Feb 19 23:10:11.262893 2026] [:error] [pid 48901:tid 48928] [client 43.166.245.120:37444] [client 43.166.245.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZcn08ixYz-lHbN0WBLqnAAAABI"]
[Fri Feb 20 05:30:51.787568 2026] [:error] [pid 64404:tid 64453] [client 106.53.161.136:49640] [client 106.53.161.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aZeBC8g5Wkqq1wjajcB9QAAAAE0"]
[Fri Feb 20 05:30:51.787920 2026] [:error] [pid 64405:tid 64472] [client 106.53.161.136:49642] [client 106.53.161.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/env/.env"] [unique_id "aZeBC9SgDnQB5OAbOuS0dwAAAIU"]
[Fri Feb 20 05:30:53.269991 2026] [:error] [pid 417:tid 441] [client 106.53.161.136:36008] [client 106.53.161.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aZeBDWZ8vv9H56paZ2DdMAAAARY"]
[Fri Feb 20 05:30:53.269995 2026] [:error] [pid 64405:tid 64489] [client 106.53.161.136:36010] [client 106.53.161.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/env/.env"] [unique_id "aZeBDdSgDnQB5OAbOuS0eQAAAJY"]
[Fri Feb 20 07:48:14.434368 2026] [:error] [pid 22200:tid 22220] [client 43.131.32.36:37674] [client 43.131.32.36] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZehPiR0iwS_xZvYegB-GgAAAZE"]
[Fri Feb 20 11:19:09.339420 2026] [:error] [pid 54520:tid 54541] [client 49.51.183.75:60392] [client 49.51.183.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZfSrWQaQX7QUBqXcyFECQAAAJM"]
[Fri Feb 20 12:11:11.044723 2026] [:error] [pid 54552:tid 54568] [client 14.215.163.132:43845] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZfe38e4t0F-_sbWepaWjgAAAM0"]
[Fri Feb 20 13:27:39.915676 2026] [:error] [pid 46012:tid 46028] [client 85.203.23.127:21935] [client 85.203.23.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZfwyzXz-GTvuxLwgUGP9wAAAU4"]
[Fri Feb 20 17:01:33.172269 2026] [:error] [pid 54520:tid 54525] [client 64.225.48.217:56132] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgi7WQaQX7QUBqXcyGznwAAAIM"], referer: https://duckduckgo.com/
[Fri Feb 20 17:01:33.178332 2026] [:error] [pid 54520:tid 54525] [client 64.225.48.217:56132] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://duckduckgo.com/
[Fri Feb 20 17:01:33.601011 2026] [:error] [pid 54460:tid 54482] [client 64.225.48.217:56369] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgi7coUiaZ-Z7V-F98yuAAAABE"]
[Fri Feb 20 17:01:33.604926 2026] [:error] [pid 54460:tid 54482] [client 64.225.48.217:56369] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 20 17:01:36.861828 2026] [:error] [pid 59127:tid 59139] [client 64.225.48.217:57225] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgi8HSltzl55Qz-09gJZQAAAQo"]
[Fri Feb 20 17:01:36.865893 2026] [:error] [pid 59127:tid 59139] [client 64.225.48.217:57225] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 20 17:01:37.274506 2026] [:error] [pid 54552:tid 54561] [client 64.225.48.217:57471] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgi8ce4t0F-_sbWepb4agAAAMY"]
[Fri Feb 20 17:01:37.280885 2026] [:error] [pid 54552:tid 54561] [client 64.225.48.217:57471] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 20 17:06:09.115648 2026] [:error] [pid 46012:tid 46023] [client 64.225.48.217:58721] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgkATXz-GTvuxLwgUH7jgAAAUk"], referer: https://www.google.com/
[Fri Feb 20 17:06:09.119371 2026] [:error] [pid 46012:tid 46023] [client 64.225.48.217:58721] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Fri Feb 20 17:06:09.538239 2026] [:error] [pid 54460:tid 54488] [client 64.225.48.217:58983] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgkAcoUiaZ-Z7V-F980hgAAABc"]
[Fri Feb 20 17:06:09.541516 2026] [:error] [pid 54460:tid 54488] [client 64.225.48.217:58983] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 20 17:06:12.061749 2026] [:error] [pid 46012:tid 46032] [client 64.225.48.217:59709] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgkBDXz-GTvuxLwgUH7oAAAAVI"], referer: https://www.facebook.com/
[Fri Feb 20 17:06:12.065920 2026] [:error] [pid 46012:tid 46032] [client 64.225.48.217:59709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.facebook.com/
[Fri Feb 20 17:06:12.477250 2026] [:error] [pid 54552:tid 54573] [client 64.225.48.217:59979] [client 64.225.48.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.48.217, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aZgkBMe4t0F-_sbWepb5yQAAANI"]
[Fri Feb 20 17:06:12.482083 2026] [:error] [pid 54552:tid 54573] [client 64.225.48.217:59979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 20 19:21:22.521034 2026] [:error] [pid 54461:tid 54514] [client 43.153.204.189:34182] [client 43.153.204.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZhDsi372fkN0w39NDOsNQAAAFY"]
[Sat Feb 21 00:49:54.061104 2026] [:error] [pid 54552:tid 54578] [client 43.153.10.83:51544] [client 43.153.10.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZiQsse4t0F-_sbWepZ6-wAAANc"]
[Sat Feb 21 06:04:54.186656 2026] [:error] [pid 40757:tid 40799] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 21 06:04:54.469780 2026] [:error] [pid 40757:tid 40812] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sat Feb 21 06:04:54.631627 2026] [:error] [pid 40757:tid 40808] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Feb 21 06:04:54.773590 2026] [:error] [pid 40757:tid 40796] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 21 06:04:55.269425 2026] [:error] [pid 40757:tid 40810] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sat Feb 21 06:04:55.438056 2026] [:error] [pid 40757:tid 40807] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sat Feb 21 06:04:55.765453 2026] [:error] [pid 40757:tid 40806] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sat Feb 21 06:04:55.923515 2026] [:error] [pid 40757:tid 40800] [client 20.197.25.32:52297] File does not exist: /usr/local/apache/htdocs/suspended-page/tx1.php
[Sat Feb 21 06:04:56.319840 2026] [:error] [pid 40757:tid 40818] [client 20.197.25.32:52297] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZjaiKg_MKVL7zhH7dw1dQAAAFc"]
[Sat Feb 21 06:04:57.145756 2026] [:error] [pid 40757:tid 40811] [client 20.197.25.32:38183] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZjaiag_MKVL7zhH7dw1dwAAAFA"]
[Sat Feb 21 06:04:58.928829 2026] [:error] [pid 22558:tid 22571] [client 20.197.25.32:60762] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZjaiirVaIb2gXsVbDow5gAAAQs"]
[Sat Feb 21 06:04:59.805680 2026] [:error] [pid 40871:tid 40875] [client 20.197.25.32:47673] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZjaizqDikjdiOZeJyXDxwAAAMI"]
[Sat Feb 21 06:05:00.186862 2026] [:error] [pid 40756:tid 40785] [client 20.197.25.32:6863] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZjajANlDP60sLYgqXLXeQAAABM"]
[Sat Feb 21 06:05:00.910377 2026] [:error] [pid 40758:tid 40841] [client 20.197.25.32:59807] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZjajEBAHxvBM3i9iKGmaQAAAJM"]
[Sat Feb 21 06:05:03.004430 2026] [:error] [pid 40756:tid 40769] [client 20.197.25.32:7009] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZjajwNlDP60sLYgqXLXfgAAAAM"]
[Sat Feb 21 06:05:05.261474 2026] [:error] [pid 40756:tid 40778] [client 20.197.25.32:48887] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZjakQNlDP60sLYgqXLXgwAAAAw"]
[Sat Feb 21 06:05:07.120777 2026] [:error] [pid 22558:tid 22571] [client 20.197.25.32:52056] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZjakyrVaIb2gXsVbDow9AAAAQs"]
[Sat Feb 21 06:05:09.323981 2026] [:error] [pid 40871:tid 40877] [client 20.197.25.32:48681] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZjalTqDikjdiOZeJyXD1QAAAMQ"]
[Sat Feb 21 06:05:10.672208 2026] [:error] [pid 22558:tid 22566] [client 20.197.25.32:59827] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZjalirVaIb2gXsVbDoxAAAAAQY"]
[Sat Feb 21 06:05:12.707253 2026] [:error] [pid 22558:tid 22570] [client 20.197.25.32:42008] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZjamCrVaIb2gXsVbDoxBgAAAQo"]
[Sat Feb 21 06:05:16.563253 2026] [:error] [pid 40871:tid 40891] [client 20.197.25.32:36753] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZjanDqDikjdiOZeJyXD4gAAANI"]
[Sat Feb 21 06:05:21.445789 2026] [:error] [pid 40757:tid 40795] [client 20.197.25.32:37965] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZjaoag_MKVL7zhH7dw1mgAAAEA"]
[Sat Feb 21 06:05:25.946675 2026] [:error] [pid 22558:tid 22564] [client 20.197.25.32:51488] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZjapSrVaIb2gXsVbDoxHwAAAQQ"]
[Sat Feb 21 06:05:27.869245 2026] [:error] [pid 40756:tid 40766] [client 20.197.25.32:53713] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZjapwNlDP60sLYgqXLXoAAAAAA"]
[Sat Feb 21 06:05:30.446746 2026] [:error] [pid 22558:tid 22569] [client 20.197.25.32:37021] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZjaqirVaIb2gXsVbDoxKgAAAQk"]
[Sat Feb 21 06:05:31.213874 2026] [:error] [pid 40871:tid 40881] [client 20.197.25.32:6508] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZjaqzqDikjdiOZeJyXD_AAAAMg"]
[Sat Feb 21 06:05:31.982840 2026] [:error] [pid 22558:tid 22573] [client 20.197.25.32:49970] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZjaqyrVaIb2gXsVbDoxLQAAAQ0"]
[Sat Feb 21 06:05:32.741835 2026] [:error] [pid 40756:tid 40771] [client 20.197.25.32:42780] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZjarANlDP60sLYgqXLXpgAAAAU"]
[Sat Feb 21 06:05:34.259669 2026] [:error] [pid 40758:tid 40838] [client 20.197.25.32:45394] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZjarkBAHxvBM3i9iKGmlAAAAJA"]
[Sat Feb 21 06:05:35.858654 2026] [:error] [pid 40757:tid 40804] [client 20.197.25.32:38658] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZjar6g_MKVL7zhH7dw1qwAAAEk"]
[Sat Feb 21 06:05:36.642447 2026] [:error] [pid 40758:tid 40845] [client 20.197.25.32:6507] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZjasEBAHxvBM3i9iKGmnQAAAJc"]
[Sat Feb 21 06:05:37.216037 2026] [:error] [pid 40871:tid 40891] [client 20.197.25.32:38421] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZjasTqDikjdiOZeJyXEAAAAANI"]
[Sat Feb 21 06:05:38.210459 2026] [:error] [pid 40757:tid 40796] [client 20.197.25.32:50897] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZjasqg_MKVL7zhH7dw1tAAAAEE"]
[Sat Feb 21 06:05:39.410051 2026] [:error] [pid 40757:tid 40796] [client 20.197.25.32:50931] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZjas6g_MKVL7zhH7dw1vAAAAEE"]
[Sat Feb 21 06:05:40.961644 2026] [:error] [pid 22558:tid 22562] [client 20.197.25.32:50168] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZjatCrVaIb2gXsVbDoxMgAAAQI"]
[Sat Feb 21 06:05:41.785063 2026] [:error] [pid 22558:tid 22580] [client 20.197.25.32:49940] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZjatSrVaIb2gXsVbDoxMwAAARQ"]
[Sat Feb 21 06:05:42.615882 2026] [:error] [pid 40871:tid 40884] [client 20.197.25.32:40385] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aZjatjqDikjdiOZeJyXEDQAAAMs"]
[Sat Feb 21 06:05:43.290278 2026] [:error] [pid 40871:tid 40892] [client 20.197.25.32:48337] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aZjatzqDikjdiOZeJyXEEAAAANM"]
[Sat Feb 21 06:05:44.336917 2026] [:error] [pid 22558:tid 22582] [client 20.197.25.32:50143] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aZjauCrVaIb2gXsVbDoxNAAAARY"]
[Sat Feb 21 06:05:44.995081 2026] [:error] [pid 40871:tid 40875] [client 20.197.25.32:37030] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aZjauDqDikjdiOZeJyXEFAAAAMI"]
[Sat Feb 21 06:05:45.793569 2026] [:error] [pid 40758:tid 40825] [client 20.197.25.32:48348] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aZjauUBAHxvBM3i9iKGmtQAAAIM"]
[Sat Feb 21 06:05:46.819447 2026] [:error] [pid 22558:tid 22563] [client 20.197.25.32:42797] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aZjauirVaIb2gXsVbDoxOQAAAQM"]
[Sat Feb 21 06:05:47.263845 2026] [:error] [pid 22558:tid 22577] [client 20.197.25.32:45439] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aZjauyrVaIb2gXsVbDoxOwAAARE"]
[Sat Feb 21 06:05:47.689901 2026] [:error] [pid 40871:tid 40877] [client 20.197.25.32:50174] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aZjauzqDikjdiOZeJyXEGwAAAMQ"]
[Sat Feb 21 06:05:48.165113 2026] [:error] [pid 40758:tid 40846] [client 20.197.25.32:6742] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aZjavEBAHxvBM3i9iKGmvAAAAJg"]
[Sat Feb 21 06:05:48.589129 2026] [:error] [pid 40758:tid 40825] [client 20.197.25.32:42769] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aZjavEBAHxvBM3i9iKGmwQAAAIM"]
[Sat Feb 21 06:05:49.258338 2026] [:error] [pid 40758:tid 40840] [client 20.197.25.32:6763] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aZjavUBAHxvBM3i9iKGmxAAAAJI"]
[Sat Feb 21 06:05:50.587237 2026] [:error] [pid 40871:tid 40892] [client 20.197.25.32:51237] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aZjavjqDikjdiOZeJyXEJgAAANM"]
[Sat Feb 21 06:05:51.472459 2026] [:error] [pid 40757:tid 40797] [client 20.197.25.32:6477] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aZjav6g_MKVL7zhH7dw10gAAAEI"]
[Sat Feb 21 06:05:52.794956 2026] [:error] [pid 22558:tid 22575] [client 20.197.25.32:6778] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aZjawCrVaIb2gXsVbDoxSAAAAQ8"]
[Sat Feb 21 06:05:54.123506 2026] [:error] [pid 22558:tid 22566] [client 20.197.25.32:42507] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "aZjawirVaIb2gXsVbDoxSwAAAQY"]
[Sat Feb 21 06:05:55.058616 2026] [:error] [pid 40871:tid 40897] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Sat Feb 21 06:05:55.201935 2026] [:error] [pid 40871:tid 40889] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/atx.php
[Sat Feb 21 06:05:55.625288 2026] [:error] [pid 40871:tid 40885] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Sat Feb 21 06:05:55.766977 2026] [:error] [pid 40871:tid 40876] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 21 06:05:56.239945 2026] [:error] [pid 40871:tid 40877] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Feb 21 06:05:56.382665 2026] [:error] [pid 40871:tid 40881] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Feb 21 06:05:56.587511 2026] [:error] [pid 40871:tid 40884] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Feb 21 06:05:56.748382 2026] [:error] [pid 40871:tid 40886] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 21 06:05:56.926721 2026] [:error] [pid 40871:tid 40875] [client 20.197.25.32:42793] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Feb 21 06:05:57.075014 2026] [:error] [pid 40871:tid 40887] [client 20.197.25.32:42793] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjaxTqDikjdiOZeJyXEOwAAAM4"]
[Sat Feb 21 06:05:57.887707 2026] [:error] [pid 40871:tid 40874] [client 20.197.25.32:41548] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjaxTqDikjdiOZeJyXEPwAAAME"]
[Sat Feb 21 06:05:59.652944 2026] [:error] [pid 40756:tid 40785] [client 20.197.25.32:42499] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjaxwNlDP60sLYgqXLXwgAAABM"]
[Sat Feb 21 06:06:00.929637 2026] [:error] [pid 22558:tid 22574] [client 20.197.25.32:50885] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjayCrVaIb2gXsVbDoxXgAAAQ4"]
[Sat Feb 21 06:06:01.406628 2026] [:error] [pid 40756:tid 40788] [client 20.197.25.32:6483] [client 20.197.25.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZjayQNlDP60sLYgqXLXxQAAABY"]
[Sat Feb 21 06:06:02.489368 2026] [:error] [pid 22558:tid 22563] [client 20.197.25.32:51215] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjayirVaIb2gXsVbDoxZgAAAQM"]
[Sat Feb 21 06:06:03.347195 2026] [:error] [pid 22558:tid 22574] [client 20.197.25.32:45377] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjayyrVaIb2gXsVbDoxaQAAAQ4"]
[Sat Feb 21 06:06:04.157389 2026] [:error] [pid 40757:tid 40796] [client 20.197.25.32:48635] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjazKg_MKVL7zhH7dw13QAAAEE"]
[Sat Feb 21 06:06:04.675191 2026] [:error] [pid 40757:tid 40809] [client 20.197.25.32:6220] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZjazKg_MKVL7zhH7dw13wAAAE4"]
[Sat Feb 21 06:06:05.311453 2026] [:error] [pid 22558:tid 22577] [client 20.197.25.32:48191] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aZjazSrVaIb2gXsVbDoxawAAARE"]
[Sat Feb 21 06:06:05.647394 2026] [:error] [pid 40758:tid 40833] [client 20.197.25.32:48373] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aZjazUBAHxvBM3i9iKGm3wAAAIs"]
[Sat Feb 21 06:06:06.381787 2026] [:error] [pid 40757:tid 40802] [client 20.197.25.32:41549] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aZjazqg_MKVL7zhH7dw15QAAAEc"]
[Sat Feb 21 06:06:06.722037 2026] [:error] [pid 40758:tid 40834] [client 20.197.25.32:38653] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aZjazkBAHxvBM3i9iKGm4gAAAIw"]
[Sat Feb 21 06:06:07.469788 2026] [:error] [pid 40871:tid 40890] [client 20.197.25.32:48368] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aZjazzqDikjdiOZeJyXETwAAANE"]
[Sat Feb 21 06:06:08.369163 2026] [:error] [pid 40756:tid 40776] [client 20.197.25.32:48631] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aZja0ANlDP60sLYgqXLXywAAAAo"]
[Sat Feb 21 06:06:08.680999 2026] [:error] [pid 22558:tid 22568] [client 20.197.25.32:40387] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aZja0CrVaIb2gXsVbDoxcQAAAQg"]
[Sat Feb 21 06:06:09.054804 2026] [:error] [pid 40758:tid 40837] [client 20.197.25.32:48152] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aZja0UBAHxvBM3i9iKGm5gAAAI8"]
[Sat Feb 21 06:06:09.481093 2026] [:error] [pid 40758:tid 40828] [client 20.197.25.32:42612] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZja0UBAHxvBM3i9iKGm5wAAAIY"]
[Sat Feb 21 06:06:10.185867 2026] [:error] [pid 40758:tid 40823] [client 20.197.25.32:49151] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZja0kBAHxvBM3i9iKGm6gAAAIE"]
[Sat Feb 21 06:06:10.995337 2026] [:error] [pid 40871:tid 40892] [client 20.197.25.32:42579] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZja0jqDikjdiOZeJyXEUgAAANM"]
[Sat Feb 21 06:06:11.599425 2026] [:error] [pid 22558:tid 22561] [client 20.197.25.32:6752] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZja0yrVaIb2gXsVbDoxcwAAAQE"]
[Sat Feb 21 06:06:11.962619 2026] [:error] [pid 40756:tid 40768] [client 20.197.25.32:6241] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aZja0wNlDP60sLYgqXLX0AAAAAI"]
[Sat Feb 21 06:06:12.330815 2026] [:error] [pid 40757:tid 40806] [client 20.197.25.32:48334] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aZja1Kg_MKVL7zhH7dw17AAAAEs"]
[Sat Feb 21 06:06:12.655017 2026] [:error] [pid 22558:tid 22571] [client 20.197.25.32:48581] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aZja1CrVaIb2gXsVbDoxeAAAAQs"]
[Sat Feb 21 06:06:13.031314 2026] [:error] [pid 40756:tid 40779] [client 20.197.25.32:42585] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aZja1QNlDP60sLYgqXLX0gAAAA0"]
[Sat Feb 21 06:06:13.389464 2026] [:error] [pid 22558:tid 22566] [client 20.197.25.32:38627] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aZja1SrVaIb2gXsVbDoxeQAAAQY"]
[Sat Feb 21 06:06:13.918422 2026] [:error] [pid 40756:tid 40770] [client 20.197.25.32:6760] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aZja1QNlDP60sLYgqXLX1QAAAAQ"]
[Sat Feb 21 06:06:14.714518 2026] [:error] [pid 40758:tid 40840] [client 20.197.25.32:49110] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aZja1kBAHxvBM3i9iKGm8gAAAJI"]
[Sat Feb 21 06:06:15.449858 2026] [:error] [pid 40871:tid 40891] [client 20.197.25.32:36060] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aZja1zqDikjdiOZeJyXEVgAAANI"]
[Sat Feb 21 06:06:15.810204 2026] [:error] [pid 40758:tid 40842] [client 20.197.25.32:41551] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZja10BAHxvBM3i9iKGm9AAAAJQ"]
[Sat Feb 21 06:06:16.254692 2026] [:error] [pid 40757:tid 40804] [client 20.197.25.32:39111] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZja2Kg_MKVL7zhH7dw17gAAAEk"]
[Sat Feb 21 06:06:16.626231 2026] [:error] [pid 22558:tid 22569] [client 20.197.25.32:41421] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZja2CrVaIb2gXsVbDoxgwAAAQk"]
[Sat Feb 21 06:06:17.283650 2026] [:error] [pid 40756:tid 40776] [client 20.197.25.32:41545] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZja2QNlDP60sLYgqXLX2AAAAAo"]
[Sat Feb 21 06:06:17.815336 2026] [:error] [pid 40756:tid 40774] [client 20.197.25.32:6239] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aZja2QNlDP60sLYgqXLX2gAAAAg"]
[Sat Feb 21 06:06:18.103125 2026] [:error] [pid 40756:tid 40772] [client 20.197.25.32:39068] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aZja2gNlDP60sLYgqXLX3AAAAAY"]
[Sat Feb 21 06:06:18.460417 2026] [:error] [pid 40871:tid 40876] [client 20.197.25.32:42610] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aZja2jqDikjdiOZeJyXEWQAAAMM"]
[Sat Feb 21 06:06:18.946707 2026] [:error] [pid 40871:tid 40883] [client 20.197.25.32:6230] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aZja2jqDikjdiOZeJyXEWwAAAMo"]
[Sat Feb 21 06:06:19.375565 2026] [:error] [pid 40757:tid 40814] [client 20.197.25.32:41414] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aZja26g_MKVL7zhH7dw18gAAAFM"]
[Sat Feb 21 06:06:20.274919 2026] [:error] [pid 40756:tid 40790] [client 20.197.25.32:42566] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aZja3ANlDP60sLYgqXLX5QAAABg"]
[Sat Feb 21 06:06:20.880456 2026] [:error] [pid 22558:tid 22572] [client 20.197.25.32:41859] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aZja3CrVaIb2gXsVbDoxiwAAAQw"]
[Sat Feb 21 06:06:21.373471 2026] [:error] [pid 40871:tid 40880] [client 20.197.25.32:41898] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aZja3TqDikjdiOZeJyXEYQAAAMc"]
[Sat Feb 21 06:06:21.971164 2026] [:error] [pid 22558:tid 22571] [client 20.197.25.32:6260] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZja3SrVaIb2gXsVbDoxjwAAAQs"]
[Sat Feb 21 06:06:23.295941 2026] [:error] [pid 40757:tid 40811] [client 20.197.25.32:38655] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZja36g_MKVL7zhH7dw1_wAAAFA"]
[Sat Feb 21 06:06:24.368802 2026] [:error] [pid 40871:tid 40884] [client 20.197.25.32:48141] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZja4DqDikjdiOZeJyXEbwAAAMs"]
[Sat Feb 21 06:06:24.945480 2026] [:error] [pid 22558:tid 22584] [client 20.197.25.32:39040] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZja4CrVaIb2gXsVbDoxpwAAARg"]
[Sat Feb 21 06:06:25.505565 2026] [:error] [pid 40758:tid 40827] [client 20.197.25.32:48621] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZja4UBAHxvBM3i9iKGm_wAAAIU"]
[Sat Feb 21 06:06:25.864698 2026] [:error] [pid 22558:tid 22572] [client 20.197.25.32:48623] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZja4SrVaIb2gXsVbDoxqgAAAQw"]
[Sat Feb 21 06:06:26.494948 2026] [:error] [pid 40758:tid 40834] [client 20.197.25.32:48179] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZja4kBAHxvBM3i9iKGnAgAAAIw"]
[Sat Feb 21 06:06:27.018919 2026] [:error] [pid 22558:tid 22574] [client 20.197.25.32:41868] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZja4yrVaIb2gXsVbDoxrAAAAQ4"]
[Sat Feb 21 06:06:27.884018 2026] [:error] [pid 22558:tid 22577] [client 20.197.25.32:41919] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZja4yrVaIb2gXsVbDoxsgAAARE"]
[Sat Feb 21 06:06:28.224342 2026] [:error] [pid 22558:tid 22562] [client 20.197.25.32:42569] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZja5CrVaIb2gXsVbDoxswAAAQI"]
[Sat Feb 21 06:06:28.508873 2026] [:error] [pid 22558:tid 22580] [client 20.197.25.32:39129] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZja5CrVaIb2gXsVbDoxtQAAARQ"]
[Sat Feb 21 06:06:29.031059 2026] [:error] [pid 22558:tid 22560] [client 20.197.25.32:41889] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZja5SrVaIb2gXsVbDoxuAAAAQA"]
[Sat Feb 21 06:06:29.355611 2026] [:error] [pid 40756:tid 40786] [client 20.197.25.32:48580] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZja5QNlDP60sLYgqXLX9QAAABQ"]
[Sat Feb 21 06:06:30.162853 2026] [:error] [pid 40871:tid 40877] [client 20.197.25.32:42571] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZja5jqDikjdiOZeJyXEegAAAMQ"]
[Sat Feb 21 06:06:30.952434 2026] [:error] [pid 22558:tid 22567] [client 20.197.25.32:38635] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZja5irVaIb2gXsVbDoxwAAAAQc"]
[Sat Feb 21 06:06:32.101386 2026] [:error] [pid 22558:tid 22583] [client 20.197.25.32:49134] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZja6CrVaIb2gXsVbDoxxgAAARc"]
[Sat Feb 21 06:06:32.814529 2026] [:error] [pid 40756:tid 40768] [client 20.197.25.32:49137] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZja6ANlDP60sLYgqXLX9wAAAAI"]
[Sat Feb 21 06:06:33.282280 2026] [:error] [pid 40757:tid 40814] [client 20.197.25.32:38821] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZja6ag_MKVL7zhH7dw2CwAAAFM"]
[Sat Feb 21 06:06:33.690207 2026] [:error] [pid 40757:tid 40808] [client 20.197.25.32:39074] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZja6ag_MKVL7zhH7dw2DAAAAE0"]
[Sat Feb 21 06:06:34.280895 2026] [:error] [pid 40758:tid 40838] [client 20.197.25.32:42284] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZja6kBAHxvBM3i9iKGnCgAAAJA"]
[Sat Feb 21 06:06:34.722006 2026] [:error] [pid 40871:tid 40892] [client 20.197.25.32:35976] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZja6jqDikjdiOZeJyXEigAAANM"]
[Sat Feb 21 06:06:35.442621 2026] [:error] [pid 40757:tid 40796] [client 20.197.25.32:37547] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZja66g_MKVL7zhH7dw2FQAAAEE"]
[Sat Feb 21 06:06:35.816444 2026] [:error] [pid 40871:tid 40889] [client 20.197.25.32:41893] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZja6zqDikjdiOZeJyXEjgAAANA"]
[Sat Feb 21 06:06:36.873858 2026] [:error] [pid 40871:tid 40874] [client 20.197.25.32:42303] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZja7DqDikjdiOZeJyXEjwAAAME"]
[Sat Feb 21 06:06:37.494771 2026] [:error] [pid 40757:tid 40805] [client 20.197.25.32:37522] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZja7ag_MKVL7zhH7dw2KAAAAEo"]
[Sat Feb 21 06:06:38.568835 2026] [:error] [pid 40758:tid 40837] [client 20.197.25.32:37532] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZja7kBAHxvBM3i9iKGnEgAAAI8"]
[Sat Feb 21 06:06:39.823314 2026] [:error] [pid 22558:tid 22583] [client 20.197.25.32:38830] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZja7yrVaIb2gXsVbDox2AAAARc"]
[Sat Feb 21 06:06:40.495103 2026] [:error] [pid 40756:tid 40782] [client 20.197.25.32:39043] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZja8ANlDP60sLYgqXLYAwAAABA"]
[Sat Feb 21 06:06:41.191954 2026] [:error] [pid 40756:tid 40783] [client 20.197.25.32:38799] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZja8QNlDP60sLYgqXLYCQAAABE"]
[Sat Feb 21 06:06:41.844161 2026] [:error] [pid 40756:tid 40790] [client 20.197.25.32:39089] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZja8QNlDP60sLYgqXLYEAAAABg"]
[Sat Feb 21 06:06:42.899771 2026] [:error] [pid 40871:tid 40885] [client 20.197.25.32:38805] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZja8jqDikjdiOZeJyXEmgAAAMw"]
[Sat Feb 21 06:06:43.732899 2026] [:error] [pid 40871:tid 40893] [client 20.197.25.32:51139] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aZja8zqDikjdiOZeJyXEnAAAANQ"]
[Sat Feb 21 06:06:44.201481 2026] [:error] [pid 40871:tid 40895] [client 20.197.25.32:42619] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aZja9DqDikjdiOZeJyXEnwAAANY"]
[Sat Feb 21 06:06:44.563786 2026] [:error] [pid 40756:tid 40782] [client 20.197.25.32:42599] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aZja9ANlDP60sLYgqXLYFgAAABA"]
[Sat Feb 21 06:06:45.285917 2026] [:error] [pid 40756:tid 40770] [client 20.197.25.32:6943] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aZja9QNlDP60sLYgqXLYGQAAAAQ"]
[Sat Feb 21 06:06:45.807462 2026] [:error] [pid 40757:tid 40819] [client 20.197.25.32:6951] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aZja9ag_MKVL7zhH7dw2NgAAAFg"]
[Sat Feb 21 06:06:46.189792 2026] [:error] [pid 40871:tid 40884] [client 20.197.25.32:41865] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aZja9jqDikjdiOZeJyXEoAAAAMs"]
[Sat Feb 21 06:06:46.670743 2026] [:error] [pid 40756:tid 40788] [client 20.197.25.32:39100] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aZja9gNlDP60sLYgqXLYHgAAABY"]
[Sat Feb 21 06:06:47.656145 2026] [:error] [pid 40757:tid 40813] [client 20.197.25.32:45929] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aZja96g_MKVL7zhH7dw2PAAAAFI"]
[Sat Feb 21 06:06:48.341349 2026] [:error] [pid 40758:tid 40846] [client 20.197.25.32:40327] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "aZja-EBAHxvBM3i9iKGnJQAAAJg"]
[Sat Feb 21 06:06:49.017402 2026] [:error] [pid 40758:tid 40827] [client 20.197.25.32:37565] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZja-UBAHxvBM3i9iKGnKQAAAIU"]
[Sat Feb 21 06:06:49.462892 2026] [:error] [pid 40757:tid 40804] [client 20.197.25.32:39061] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZja-ag_MKVL7zhH7dw2QQAAAEk"]
[Sat Feb 21 06:06:49.753534 2026] [:error] [pid 40871:tid 40890] [client 20.197.25.32:36011] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZja-TqDikjdiOZeJyXEpQAAANE"]
[Sat Feb 21 06:06:50.068342 2026] [:error] [pid 40756:tid 40779] [client 20.197.25.32:35830] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aZja-gNlDP60sLYgqXLYIwAAAA0"]
[Sat Feb 21 06:06:50.437479 2026] [:error] [pid 40756:tid 40784] [client 20.197.25.32:51142] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aZja-gNlDP60sLYgqXLYJwAAABI"]
[Sat Feb 21 06:06:50.856439 2026] [:error] [pid 40871:tid 40880] [client 20.197.25.32:35970] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aZja-jqDikjdiOZeJyXEpgAAAMc"]
[Sat Feb 21 06:06:51.812685 2026] [:error] [pid 40756:tid 40788] [client 20.197.25.32:45937] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aZja-wNlDP60sLYgqXLYKQAAABY"]
[Sat Feb 21 06:06:52.769768 2026] [:error] [pid 40756:tid 40780] [client 20.197.25.32:51183] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aZja_ANlDP60sLYgqXLYKgAAAA4"]
[Sat Feb 21 06:06:53.494605 2026] [:error] [pid 40757:tid 40805] [client 20.197.25.32:35823] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aZja_ag_MKVL7zhH7dw2RwAAAEo"]
[Sat Feb 21 06:06:53.901316 2026] [:error] [pid 40871:tid 40882] [client 20.197.25.32:6928] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "aZja_TqDikjdiOZeJyXEsAAAAMk"]
[Sat Feb 21 06:07:01.426131 2026] [:error] [pid 40756:tid 40779] [client 20.197.25.32:35989] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Sat Feb 21 06:07:01.725158 2026] [:error] [pid 40756:tid 40790] [client 20.197.25.32:35989] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Feb 21 06:07:02.030913 2026] [:error] [pid 40756:tid 40778] [client 20.197.25.32:35989] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Feb 21 06:07:02.197508 2026] [:error] [pid 40756:tid 40785] [client 20.197.25.32:35989] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Feb 21 06:07:02.340135 2026] [:error] [pid 40756:tid 40788] [client 20.197.25.32:35989] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Feb 21 06:07:02.516881 2026] [:error] [pid 40756:tid 40786] [client 20.197.25.32:35989] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Feb 21 06:07:03.235958 2026] [:error] [pid 40756:tid 40773] [client 20.197.25.32:35989] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aZjbBwNlDP60sLYgqXLYSgAAAAc"]
[Sat Feb 21 06:07:14.459952 2026] [:error] [pid 40758:tid 40825] [client 20.197.25.32:6934] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aZjbEkBAHxvBM3i9iKGnZAAAAIM"]
[Sat Feb 21 06:07:39.028806 2026] [:error] [pid 40871:tid 40892] [client 20.197.25.32:51889] [client 20.197.25.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZjbKzqDikjdiOZeJyXFJwAAANM"]
[Sat Feb 21 06:09:04.527831 2026] [:error] [pid 40871:tid 40895] [client 20.197.25.32:36241] [client 20.197.25.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aZjbgDqDikjdiOZeJyXFrgAAANY"]
[Sat Feb 21 06:10:15.901422 2026] [:error] [pid 40871:tid 40890] [client 20.197.25.32:38919] [client 20.197.25.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aZjbxzqDikjdiOZeJyXGLAAAANE"]
[Sat Feb 21 06:10:18.869400 2026] [:error] [pid 40756:tid 40781] [client 20.197.25.32:7160] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Sat Feb 21 06:10:19.309595 2026] [:error] [pid 40756:tid 40768] [client 20.197.25.32:7160] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sat Feb 21 06:10:19.596022 2026] [:error] [pid 40756:tid 40774] [client 20.197.25.32:7160] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Sat Feb 21 06:10:20.055700 2026] [:error] [pid 40756:tid 40789] [client 20.197.25.32:7160] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZjbzANlDP60sLYgqXLZbAAAABc"]
[Sat Feb 21 06:10:21.928247 2026] [:error] [pid 22558:tid 22581] [client 20.197.25.32:59780] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZjbzSrVaIb2gXsVbDozfQAAARU"]
[Sat Feb 21 06:10:23.650356 2026] [:error] [pid 40758:tid 40822] [client 20.197.25.32:40950] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZjbz0BAHxvBM3i9iKGoigAAAIA"]
[Sat Feb 21 06:10:25.359206 2026] [:error] [pid 40758:tid 40837] [client 20.197.25.32:49442] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZjb0UBAHxvBM3i9iKGojwAAAI8"]
[Sat Feb 21 06:10:25.974115 2026] [:error] [pid 40758:tid 40843] [client 20.197.25.32:40902] [client 20.197.25.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZjb0UBAHxvBM3i9iKGokAAAAJU"]
[Sat Feb 21 06:10:26.561859 2026] [:error] [pid 40871:tid 40891] [client 20.197.25.32:38958] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aZjb0jqDikjdiOZeJyXGQgAAANI"]
[Sat Feb 21 06:10:27.891566 2026] [:error] [pid 22558:tid 22579] [client 20.197.25.32:60709] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aZjb0yrVaIb2gXsVbDozjQAAARM"]
[Sat Feb 21 06:10:28.693211 2026] [:error] [pid 40757:tid 40806] [client 20.197.25.32:60679] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aZjb1Kg_MKVL7zhH7dw3hQAAAEs"]
[Sat Feb 21 06:10:29.677372 2026] [:error] [pid 40757:tid 40819] [client 20.197.25.32:45885] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZjb1ag_MKVL7zhH7dw3iQAAAFg"]
[Sat Feb 21 06:10:30.325086 2026] [:error] [pid 22558:tid 22564] [client 20.197.25.32:7119] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZjb1irVaIb2gXsVbDozkwAAAQQ"]
[Sat Feb 21 06:10:31.201203 2026] [:error] [pid 40756:tid 40788] [client 20.197.25.32:59814] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZjb1wNlDP60sLYgqXLZfAAAABY"]
[Sat Feb 21 06:10:31.561900 2026] [:error] [pid 40871:tid 40876] [client 20.197.25.32:7013] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZjb1zqDikjdiOZeJyXGUgAAAMM"]
[Sat Feb 21 06:10:32.007300 2026] [:error] [pid 40871:tid 40897] [client 20.197.25.32:6988] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aZjb2DqDikjdiOZeJyXGVAAAANg"]
[Sat Feb 21 06:10:32.426721 2026] [:error] [pid 40756:tid 40785] [client 20.197.25.32:39666] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aZjb2ANlDP60sLYgqXLZgQAAABM"]
[Sat Feb 21 06:10:33.313628 2026] [:error] [pid 22558:tid 22563] [client 20.197.25.32:59813] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aZjb2SrVaIb2gXsVbDozmgAAAQM"]
[Sat Feb 21 06:10:33.813822 2026] [:error] [pid 40756:tid 40783] [client 20.197.25.32:39638] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aZjb2QNlDP60sLYgqXLZhQAAABE"]
[Sat Feb 21 06:10:34.852434 2026] [:error] [pid 22558:tid 22567] [client 20.197.25.32:7022] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZjb2irVaIb2gXsVbDoznQAAAQc"]
[Sat Feb 21 06:10:35.773897 2026] [:error] [pid 22558:tid 22564] [client 20.197.25.32:39642] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZjb2yrVaIb2gXsVbDozoAAAAQQ"]
[Sat Feb 21 06:10:36.763583 2026] [:error] [pid 22558:tid 22570] [client 20.197.25.32:49191] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZjb3CrVaIb2gXsVbDozpAAAAQo"]
[Sat Feb 21 06:10:37.911047 2026] [:error] [pid 22558:tid 22577] [client 20.197.25.32:45864] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZjb3SrVaIb2gXsVbDozqAAAARE"]
[Sat Feb 21 06:10:38.875376 2026] [:error] [pid 40871:tid 40882] [client 20.197.25.32:45847] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZjb3jqDikjdiOZeJyXGXAAAAMk"]
[Sat Feb 21 06:10:40.270232 2026] [:error] [pid 40758:tid 40838] [client 20.197.25.32:40905] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZjb4EBAHxvBM3i9iKGoqQAAAJA"]
[Sat Feb 21 06:10:42.856756 2026] [:error] [pid 22558:tid 22574] [client 20.197.25.32:36477] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZjb4irVaIb2gXsVbDozugAAAQ4"]
[Sat Feb 21 06:10:43.990909 2026] [:error] [pid 22558:tid 22575] [client 20.197.25.32:36468] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZjb4yrVaIb2gXsVbDozvQAAAQ8"]
[Sat Feb 21 06:10:45.293904 2026] [:error] [pid 40756:tid 40777] [client 20.197.25.32:49461] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZjb5QNlDP60sLYgqXLZmQAAAAs"]
[Sat Feb 21 06:10:46.295242 2026] [:error] [pid 40758:tid 40839] [client 20.197.25.32:49179] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZjb5kBAHxvBM3i9iKGoswAAAJE"]
[Sat Feb 21 06:10:46.835740 2026] [:error] [pid 40871:tid 40889] [client 20.197.25.32:36430] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZjb5jqDikjdiOZeJyXGZgAAANA"]
[Sat Feb 21 06:10:48.103904 2026] [:error] [pid 40871:tid 40896] [client 20.197.25.32:49202] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZjb6DqDikjdiOZeJyXGZwAAANc"]
[Sat Feb 21 06:10:49.183277 2026] [:error] [pid 40756:tid 40772] [client 20.197.25.32:36448] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aZjb6QNlDP60sLYgqXLZnAAAAAY"]
[Sat Feb 21 06:10:50.661959 2026] [:error] [pid 22558:tid 22568] [client 20.197.25.32:42004] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aZjb6irVaIb2gXsVbDoz2wAAAQg"]
[Sat Feb 21 06:10:51.429776 2026] [:error] [pid 22558:tid 22567] [client 20.197.25.32:65332] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aZjb6yrVaIb2gXsVbDoz5AAAAQc"]
[Sat Feb 21 06:10:52.217705 2026] [:error] [pid 40758:tid 40836] [client 20.197.25.32:54241] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aZjb7EBAHxvBM3i9iKGouQAAAI4"]
[Sat Feb 21 06:10:52.547136 2026] [:error] [pid 40871:tid 40874] [client 20.197.25.32:6992] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aZjb7DqDikjdiOZeJyXGcAAAAME"]
[Sat Feb 21 06:10:53.050469 2026] [:error] [pid 40758:tid 40826] [client 20.197.25.32:48368] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aZjb7UBAHxvBM3i9iKGovQAAAIQ"]
[Sat Feb 21 06:10:54.328968 2026] [:error] [pid 40756:tid 40789] [client 20.197.25.32:39631] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aZjb7gNlDP60sLYgqXLZnwAAABc"]
[Sat Feb 21 06:10:55.341197 2026] [:error] [pid 22558:tid 22568] [client 20.197.25.32:38514] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aZjb7yrVaIb2gXsVbDoz8QAAAQg"]
[Sat Feb 21 06:10:55.904068 2026] [:error] [pid 22558:tid 22582] [client 20.197.25.32:59781] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aZjb7yrVaIb2gXsVbDoz9gAAARY"]
[Sat Feb 21 06:10:56.602684 2026] [:error] [pid 40758:tid 40823] [client 20.197.25.32:48646] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aZjb8EBAHxvBM3i9iKGoxwAAAIE"]
[Sat Feb 21 06:10:57.777008 2026] [:error] [pid 40871:tid 40881] [client 20.197.25.32:49877] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aZjb8TqDikjdiOZeJyXGiQAAAMg"]
[Sat Feb 21 06:10:58.854251 2026] [:error] [pid 40871:tid 40879] [client 20.197.25.32:54249] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "aZjb8jqDikjdiOZeJyXGjQAAAMY"]
[Sat Feb 21 06:10:59.295679 2026] [:error] [pid 40757:tid 40798] [client 20.197.25.32:54244] [client 20.197.25.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZjb86g_MKVL7zhH7dw3lgAAAEM"]
[Sat Feb 21 06:10:59.815200 2026] [:error] [pid 40757:tid 40799] [client 20.197.25.32:54247] [client 20.197.25.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aZjb86g_MKVL7zhH7dw3lwAAAEQ"]
[Sat Feb 21 06:11:00.325122 2026] [:error] [pid 40871:tid 40888] [client 20.197.25.32:40581] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aZjb9DqDikjdiOZeJyXGkwAAAM8"]
[Sat Feb 21 06:11:00.827634 2026] [:error] [pid 22558:tid 22563] [client 20.197.25.32:48845] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aZjb9CrVaIb2gXsVbDo0BgAAAQM"]
[Sat Feb 21 06:11:01.395333 2026] [:error] [pid 22558:tid 22562] [client 20.197.25.32:48189] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aZjb9SrVaIb2gXsVbDo0CgAAAQI"]
[Sat Feb 21 06:11:02.064984 2026] [:error] [pid 40756:tid 40784] [client 20.197.25.32:6424] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aZjb9gNlDP60sLYgqXLZqwAAABI"]
[Sat Feb 21 06:11:03.004338 2026] [:error] [pid 22558:tid 22567] [client 20.197.25.32:40837] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aZjb9yrVaIb2gXsVbDo0DgAAAQc"]
[Sat Feb 21 06:11:04.382251 2026] [:error] [pid 40871:tid 40887] [client 20.197.25.32:40861] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aZjb-DqDikjdiOZeJyXGnAAAAM4"]
[Sat Feb 21 06:11:05.116565 2026] [:error] [pid 40758:tid 40829] [client 20.197.25.32:56469] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aZjb-UBAHxvBM3i9iKGo1AAAAIc"]
[Sat Feb 21 06:11:05.849977 2026] [:error] [pid 40758:tid 40826] [client 20.197.25.32:48353] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "aZjb-UBAHxvBM3i9iKGo2QAAAIQ"]
[Sat Feb 21 06:11:06.708057 2026] [:error] [pid 40758:tid 40840] [client 20.197.25.32:46337] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZjb-kBAHxvBM3i9iKGo2wAAAJI"]
[Sat Feb 21 06:11:08.303053 2026] [:error] [pid 40871:tid 40883] [client 20.197.25.32:38858] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZjb_DqDikjdiOZeJyXGpgAAAMo"]
[Sat Feb 21 06:11:09.378667 2026] [:error] [pid 40871:tid 40878] [client 20.197.25.32:48672] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZjb_TqDikjdiOZeJyXGqQAAAMU"]
[Sat Feb 21 06:11:10.261578 2026] [:error] [pid 40871:tid 40893] [client 20.197.25.32:48154] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZjb_jqDikjdiOZeJyXGrAAAANQ"]
[Sat Feb 21 06:11:11.056031 2026] [:error] [pid 40756:tid 40783] [client 20.197.25.32:38901] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZjb_wNlDP60sLYgqXLZvwAAABE"]
[Sat Feb 21 06:11:11.568389 2026] [:error] [pid 40756:tid 40768] [client 20.197.25.32:47649] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZjb_wNlDP60sLYgqXLZwQAAAAI"]
[Sat Feb 21 06:11:12.386058 2026] [:error] [pid 40758:tid 40833] [client 20.197.25.32:36468] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZjcAEBAHxvBM3i9iKGo4AAAAIs"]
[Sat Feb 21 06:11:13.212010 2026] [:error] [pid 40758:tid 40840] [client 20.197.25.32:40876] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZjcAUBAHxvBM3i9iKGo5QAAAJI"]
[Sat Feb 21 06:11:13.790584 2026] [:error] [pid 22558:tid 22582] [client 20.197.25.32:37041] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZjcASrVaIb2gXsVbDo0IQAAARY"]
[Sat Feb 21 06:11:14.979612 2026] [:error] [pid 22558:tid 22575] [client 20.197.25.32:37040] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZjcAirVaIb2gXsVbDo0JQAAAQ8"]
[Sat Feb 21 06:11:16.057591 2026] [:error] [pid 22558:tid 22574] [client 20.197.25.32:38554] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZjcBCrVaIb2gXsVbDo0KgAAAQ4"]
[Sat Feb 21 06:11:17.000535 2026] [:error] [pid 40758:tid 40835] [client 20.197.25.32:37052] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZjcBEBAHxvBM3i9iKGo7gAAAI0"]
[Sat Feb 21 06:11:17.591779 2026] [:error] [pid 40757:tid 40817] [client 20.197.25.32:48668] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aZjcBag_MKVL7zhH7dw3uwAAAFY"]
[Sat Feb 21 06:11:18.274653 2026] [:error] [pid 22558:tid 22583] [client 20.197.25.32:6447] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aZjcBirVaIb2gXsVbDo0LgAAARc"]
[Sat Feb 21 06:11:18.645586 2026] [:error] [pid 40757:tid 40797] [client 20.197.25.32:38549] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aZjcBqg_MKVL7zhH7dw3vQAAAEI"]
[Sat Feb 21 06:11:19.586152 2026] [:error] [pid 40757:tid 40800] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sat Feb 21 06:11:19.737860 2026] [:error] [pid 40757:tid 40812] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Sat Feb 21 06:11:19.881421 2026] [:error] [pid 40757:tid 40808] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Sat Feb 21 06:11:20.032996 2026] [:error] [pid 40757:tid 40801] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sat Feb 21 06:11:20.221425 2026] [:error] [pid 40757:tid 40815] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Feb 21 06:11:20.372259 2026] [:error] [pid 40757:tid 40818] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Sat Feb 21 06:11:20.515506 2026] [:error] [pid 40757:tid 40817] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Sat Feb 21 06:11:20.911645 2026] [:error] [pid 40757:tid 40809] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/ave.php
[Sat Feb 21 06:11:21.053324 2026] [:error] [pid 40757:tid 40811] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Sat Feb 21 06:11:21.225648 2026] [:error] [pid 40757:tid 40806] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Sat Feb 21 06:11:21.369530 2026] [:error] [pid 40757:tid 40795] [client 20.197.25.32:45648] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sat Feb 21 06:11:21.517258 2026] [:error] [pid 40757:tid 40812] [client 20.197.25.32:45648] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aZjcCag_MKVL7zhH7dw31gAAAFE"]
[Sat Feb 21 06:11:23.336421 2026] [:error] [pid 22558:tid 22564] [client 20.197.25.32:38572] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aZjcCyrVaIb2gXsVbDo0PQAAAQQ"]
[Sat Feb 21 06:11:24.387453 2026] [:error] [pid 40757:tid 40795] [client 20.197.25.32:39568] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aZjcDKg_MKVL7zhH7dw34gAAAEA"]
[Sat Feb 21 06:11:25.833896 2026] [:error] [pid 40871:tid 40897] [client 20.197.25.32:50175] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "aZjcDTqDikjdiOZeJyXGygAAANg"]
[Sat Feb 21 06:11:27.283053 2026] [:error] [pid 40756:tid 40772] [client 20.197.25.32:45661] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aZjcDwNlDP60sLYgqXLZ5AAAAAY"]
[Sat Feb 21 06:11:29.538767 2026] [:error] [pid 40757:tid 40806] [client 20.197.25.32:52083] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aZjcEag_MKVL7zhH7dw36wAAAEs"]
[Sat Feb 21 06:11:30.368468 2026] [:error] [pid 40758:tid 40840] [client 20.197.25.32:41387] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aZjcEkBAHxvBM3i9iKGpCgAAAJI"]
[Sat Feb 21 06:11:31.128422 2026] [:error] [pid 40758:tid 40826] [client 20.197.25.32:40656] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "aZjcE0BAHxvBM3i9iKGpDAAAAIQ"]
[Sat Feb 21 06:11:32.684761 2026] [:error] [pid 40871:tid 40887] [client 20.197.25.32:41387] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aZjcFDqDikjdiOZeJyXG5QAAAM4"]
[Sat Feb 21 06:11:33.351109 2026] [:error] [pid 40756:tid 40779] [client 20.197.25.32:40683] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aZjcFQNlDP60sLYgqXLZ9AAAAA0"]
[Sat Feb 21 06:11:33.959488 2026] [:error] [pid 40871:tid 40878] [client 20.197.25.32:52054] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aZjcFTqDikjdiOZeJyXG6QAAAMU"]
[Sat Feb 21 06:11:34.589128 2026] [:error] [pid 40757:tid 40806] [client 20.197.25.32:7079] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aZjcFqg_MKVL7zhH7dw3-QAAAEs"]
[Sat Feb 21 06:11:35.128206 2026] [:error] [pid 40757:tid 40795] [client 20.197.25.32:45655] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZjcF6g_MKVL7zhH7dw3-wAAAEA"]
[Sat Feb 21 06:11:35.620665 2026] [:error] [pid 40871:tid 40893] [client 20.197.25.32:7040] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZjcFzqDikjdiOZeJyXG7AAAANQ"]
[Sat Feb 21 06:11:37.073398 2026] [:error] [pid 40758:tid 40843] [client 20.197.25.32:37779] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZjcGUBAHxvBM3i9iKGpFgAAAJU"]
[Sat Feb 21 06:11:38.391565 2026] [:error] [pid 40758:tid 40838] [client 20.197.25.32:50140] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZjcGkBAHxvBM3i9iKGpHQAAAJA"]
[Sat Feb 21 06:11:39.862704 2026] [:error] [pid 22558:tid 22574] [client 20.197.25.32:59762] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aZjcGyrVaIb2gXsVbDo0fgAAAQ4"]
[Sat Feb 21 06:11:40.266528 2026] [:error] [pid 40758:tid 40846] [client 20.197.25.32:36990] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aZjcHEBAHxvBM3i9iKGpKAAAAJg"]
[Sat Feb 21 06:11:40.826674 2026] [:error] [pid 40757:tid 40806] [client 20.197.25.32:37780] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aZjcHKg_MKVL7zhH7dw4AgAAAEs"]
[Sat Feb 21 06:11:42.603109 2026] [:error] [pid 40758:tid 40829] [client 20.197.25.32:36979] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "aZjcHkBAHxvBM3i9iKGpOQAAAIc"]
[Sat Feb 21 06:11:43.748838 2026] [:error] [pid 40871:tid 40882] [client 20.197.25.32:37440] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZjcHzqDikjdiOZeJyXG-QAAAMk"]
[Sat Feb 21 06:11:44.920244 2026] [:error] [pid 40757:tid 40801] [client 20.197.25.32:48617] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZjcIKg_MKVL7zhH7dw4DAAAAEY"]
[Sat Feb 21 06:11:46.096427 2026] [:error] [pid 40756:tid 40768] [client 20.197.25.32:52051] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZjcIgNlDP60sLYgqXLaEgAAAAI"]
[Sat Feb 21 06:11:46.770281 2026] [:error] [pid 40756:tid 40782] [client 20.197.25.32:47870] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZjcIgNlDP60sLYgqXLaFQAAABA"]
[Sat Feb 21 06:11:47.335545 2026] [:error] [pid 40756:tid 40788] [client 20.197.25.32:39379] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZjcIwNlDP60sLYgqXLaHAAAABY"]
[Sat Feb 21 06:11:48.105752 2026] [:error] [pid 40757:tid 40796] [client 20.197.25.32:6755] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZjcJKg_MKVL7zhH7dw4DwAAAEE"]
[Sat Feb 21 06:11:48.872173 2026] [:error] [pid 22558:tid 22584] [client 20.197.25.32:37767] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZjcJCrVaIb2gXsVbDo0iAAAARg"]
[Sat Feb 21 06:11:49.423945 2026] [:error] [pid 22558:tid 22562] [client 20.197.25.32:53750] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZjcJSrVaIb2gXsVbDo0jAAAAQI"]
[Sat Feb 21 06:11:49.963991 2026] [:error] [pid 40756:tid 40783] [client 20.197.25.32:39392] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZjcJQNlDP60sLYgqXLaIQAAABE"]
[Sat Feb 21 06:11:50.304695 2026] [:error] [pid 40756:tid 40767] [client 20.197.25.32:52077] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZjcJgNlDP60sLYgqXLaIwAAAAE"]
[Sat Feb 21 06:11:51.231991 2026] [:error] [pid 22558:tid 22580] [client 20.197.25.32:37485] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZjcJyrVaIb2gXsVbDo0kgAAARQ"]
[Sat Feb 21 06:11:51.789792 2026] [:error] [pid 40757:tid 40815] [client 20.197.25.32:52033] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZjcJ6g_MKVL7zhH7dw4GAAAAFQ"]
[Sat Feb 21 06:11:52.561180 2026] [:error] [pid 40757:tid 40801] [client 20.197.25.32:39150] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZjcKKg_MKVL7zhH7dw4GwAAAEY"]
[Sat Feb 21 06:11:53.973404 2026] [:error] [pid 40871:tid 40883] [client 20.197.25.32:37773] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZjcKTqDikjdiOZeJyXHCwAAAMo"]
[Sat Feb 21 06:11:57.009754 2026] [:error] [pid 40757:tid 40819] [client 20.197.25.32:48581] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZjcLag_MKVL7zhH7dw4KgAAAFg"]
[Sat Feb 21 06:11:59.440756 2026] [:error] [pid 40756:tid 40778] [client 20.197.25.32:47830] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZjcLwNlDP60sLYgqXLaUQAAAAw"]
[Sat Feb 21 06:12:02.039918 2026] [:error] [pid 40871:tid 40881] [client 20.197.25.32:49963] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZjcMjqDikjdiOZeJyXHNwAAAMg"]
[Sat Feb 21 06:12:03.510477 2026] [:error] [pid 40758:tid 40840] [client 20.197.25.32:40644] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZjcM0BAHxvBM3i9iKGpfgAAAJI"]
[Sat Feb 21 06:12:08.740275 2026] [:error] [pid 22558:tid 22569] [client 20.197.25.32:52068] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZjcOCrVaIb2gXsVbDo0wAAAAQk"]
[Sat Feb 21 06:12:09.505071 2026] [:error] [pid 40757:tid 40801] [client 20.197.25.32:49953] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZjcOag_MKVL7zhH7dw4RAAAAEY"]
[Sat Feb 21 06:12:11.045683 2026] [:error] [pid 22558:tid 22576] [client 20.197.25.32:6779] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZjcOyrVaIb2gXsVbDo0xgAAARA"]
[Sat Feb 21 06:12:11.694303 2026] [:error] [pid 22558:tid 22561] [client 20.197.25.32:39087] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZjcOyrVaIb2gXsVbDo0ywAAAQE"]
[Sat Feb 21 06:12:12.418418 2026] [:error] [pid 40871:tid 40878] [client 20.197.25.32:53727] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZjcPDqDikjdiOZeJyXHXQAAAMU"]
[Sat Feb 21 06:12:13.498305 2026] [:error] [pid 22558:tid 22576] [client 20.197.25.32:50994] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZjcPSrVaIb2gXsVbDo02AAAARA"]
[Sat Feb 21 06:12:14.494563 2026] [:error] [pid 40758:tid 40827] [client 20.197.25.32:51487] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aZjcPkBAHxvBM3i9iKGpnQAAAIU"]
[Sat Feb 21 06:12:15.760311 2026] [:error] [pid 40758:tid 40833] [client 20.197.25.32:37436] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aZjcP0BAHxvBM3i9iKGppgAAAIs"]
[Sat Feb 21 06:12:19.171805 2026] [:error] [pid 40757:tid 40810] [client 20.197.25.32:51891] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aZjcQ6g_MKVL7zhH7dw4VQAAAE8"]
[Sat Feb 21 06:12:20.653764 2026] [:error] [pid 40757:tid 40805] [client 20.197.25.32:41573] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aZjcRKg_MKVL7zhH7dw4XAAAAEo"]
[Sat Feb 21 06:12:21.553168 2026] [:error] [pid 40756:tid 40781] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sat Feb 21 06:12:21.698282 2026] [:error] [pid 40756:tid 40775] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Sat Feb 21 06:12:21.870110 2026] [:error] [pid 40756:tid 40777] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Sat Feb 21 06:12:22.035062 2026] [:error] [pid 40756:tid 40786] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sat Feb 21 06:12:22.177697 2026] [:error] [pid 40756:tid 40780] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Sat Feb 21 06:12:22.331455 2026] [:error] [pid 40756:tid 40767] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Sat Feb 21 06:12:22.493215 2026] [:error] [pid 40756:tid 40766] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Sat Feb 21 06:12:22.655244 2026] [:error] [pid 40756:tid 40783] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Sat Feb 21 06:12:22.814650 2026] [:error] [pid 40756:tid 40772] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Sat Feb 21 06:12:23.246565 2026] [:error] [pid 40756:tid 40779] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sat Feb 21 06:12:23.389360 2026] [:error] [pid 40756:tid 40767] [client 20.197.25.32:53719] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Sat Feb 21 06:12:23.533189 2026] [:error] [pid 40756:tid 40766] [client 20.197.25.32:53719] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZjcRwNlDP60sLYgqXLbDwAAAAA"]
[Sat Feb 21 06:12:24.393517 2026] [:error] [pid 22558:tid 22564] [client 20.197.25.32:42797] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZjcSCrVaIb2gXsVbDo0-wAAAQQ"]
[Sat Feb 21 06:12:25.169758 2026] [:error] [pid 22558:tid 22563] [client 20.197.25.32:48903] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZjcSSrVaIb2gXsVbDo0_wAAAQM"]
[Sat Feb 21 06:12:26.004914 2026] [:error] [pid 40871:tid 40892] [client 20.197.25.32:42791] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZjcSjqDikjdiOZeJyXHegAAANM"]
[Sat Feb 21 06:12:27.067564 2026] [:error] [pid 40757:tid 40808] [client 20.197.25.32:44804] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZjcS6g_MKVL7zhH7dw4eQAAAE0"]
[Sat Feb 21 06:12:28.072477 2026] [:error] [pid 40871:tid 40893] [client 20.197.25.32:41578] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZjcTDqDikjdiOZeJyXHhwAAANQ"]
[Sat Feb 21 06:12:29.383802 2026] [:error] [pid 22558:tid 22563] [client 20.197.25.32:37400] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZjcTSrVaIb2gXsVbDo1DAAAAQM"]
[Sat Feb 21 06:12:30.054535 2026] [:error] [pid 40757:tid 40819] [client 20.197.25.32:41834] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZjcTqg_MKVL7zhH7dw4hwAAAFg"]
[Sat Feb 21 06:12:31.570172 2026] [:error] [pid 22558:tid 22578] [client 20.197.25.32:35803] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZjcTyrVaIb2gXsVbDo1HAAAARI"]
[Sat Feb 21 06:12:32.974848 2026] [:error] [pid 22558:tid 22562] [client 20.197.25.32:38637] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZjcUCrVaIb2gXsVbDo1KwAAAQI"]
[Sat Feb 21 06:12:33.965804 2026] [:error] [pid 40757:tid 40807] [client 20.197.25.32:51461] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZjcUag_MKVL7zhH7dw4iwAAAEw"]
[Sat Feb 21 06:12:34.613378 2026] [:error] [pid 40756:tid 40786] [client 20.197.25.32:41567] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZjcUgNlDP60sLYgqXLbEgAAABQ"]
[Sat Feb 21 06:12:35.107853 2026] [:error] [pid 40756:tid 40777] [client 20.197.25.32:41415] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZjcUwNlDP60sLYgqXLbFgAAAAs"]
[Sat Feb 21 06:12:35.734052 2026] [:error] [pid 40756:tid 40770] [client 20.197.25.32:41575] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZjcUwNlDP60sLYgqXLbGAAAAAQ"]
[Sat Feb 21 06:12:36.177338 2026] [:error] [pid 40758:tid 40823] [client 20.197.25.32:41192] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZjcVEBAHxvBM3i9iKGp-AAAAIE"]
[Sat Feb 21 06:12:37.796665 2026] [:error] [pid 40756:tid 40789] [client 20.197.25.32:48936] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZjcVQNlDP60sLYgqXLbJQAAABc"]
[Sat Feb 21 06:12:38.981314 2026] [:error] [pid 40757:tid 40808] [client 20.197.25.32:42776] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZjcVqg_MKVL7zhH7dw4jgAAAE0"]
[Sat Feb 21 06:12:40.359468 2026] [:error] [pid 40758:tid 40844] [client 20.197.25.32:48093] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZjcWEBAHxvBM3i9iKGqFwAAAJY"]
[Sat Feb 21 06:12:43.202221 2026] [:error] [pid 40871:tid 40874] [client 20.197.25.32:42756] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZjcWzqDikjdiOZeJyXHpQAAAME"]
[Sat Feb 21 06:12:44.327606 2026] [:error] [pid 40871:tid 40878] [client 20.197.25.32:6932] [client 20.197.25.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZjcXDqDikjdiOZeJyXHqAAAAMU"]
[Sat Feb 21 07:16:09.542191 2026] [:error] [pid 40871:tid 40890] [client 43.154.140.188:32830] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZjrOTqDikjdiOZeJyXhZQAAANE"]
[Sat Feb 21 11:10:50.399781 2026] [:error] [pid 40871:tid 40895] [client 124.156.157.91:51334] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZkiOjqDikjdiOZeJyUrAQAAANY"]
[Sat Feb 21 12:50:26.824037 2026] [:error] [pid 40756:tid 40770] [client 114.80.36.40:54086] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZk5kgNlDP60sLYgqXJsxgAAAAQ"]
[Sat Feb 21 15:08:44.238544 2026] [:error] [pid 22558:tid 22584] [client 170.106.147.63:47992] [client 170.106.147.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZlZ_CrVaIb2gXsVbDrRtwAAARg"]
[Sat Feb 21 17:46:09.705777 2026] [:error] [pid 40758:tid 40833] [client 170.106.73.216:56686] [client 170.106.73.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZl-4UBAHxvBM3i9iKFmTAAAAIs"]
[Sat Feb 21 23:08:06.217314 2026] [:error] [pid 11941:tid 11959] [client 43.153.58.28:44004] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZnKVnTUkHs3EVWllKn2NQAAAZA"]
[Sun Feb 22 00:10:12.089344 2026] [:error] [pid 40756:tid 40766] [client 192.236.146.245:39222] [client 192.236.146.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aZnY5ANlDP60sLYgqXL7HwAAAAA"]
[Sun Feb 22 02:54:41.485001 2026] [:error] [pid 4789:tid 4797] [client 43.153.58.28:51462] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZn_ca9_231lp37V1xxvrAAAAQY"]
[Sun Feb 22 09:38:30.037914 2026] [:error] [pid 9587:tid 9616] [client 129.159.56.14:40940] [client 129.159.56.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aZpeFuhqt7NXCp-NupFFvQAAABQ"]
[Sun Feb 22 10:48:44.354804 2026] [:error] [pid 12501:tid 12515] [client 43.153.19.83:57474] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZpujJicztrbvinWGXNIsAAAAUw"]
[Sun Feb 22 22:33:47.513402 2026] [:error] [pid 2475:tid 2563] [client 43.166.251.233:35112] [client 43.166.251.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZsTyydme8TSKYpXujdSMQAAAJc"]
[Mon Feb 23 01:56:36.171898 2026] [:error] [pid 28558:tid 28566] [client 36.41.75.167:55311] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZtDVCdFHR5e1Gd10vePnwAAAMY"]
[Mon Feb 23 04:15:49.727403 2026] [:error] [pid 54379:tid 54388] [client 43.130.131.18:51786] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZtj9dEE6mAMJmUyCcRjAQAAAAA"]
[Mon Feb 23 08:39:37.040524 2026] [:error] [pid 25294:tid 25358] [client 182.43.70.143:48283] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZuhySRCFB3CqIo_jfZpgAAAAEw"]
[Mon Feb 23 09:27:23.069047 2026] [:error] [pid 39640:tid 39682] [client 4.232.88.81:33226] [client 4.232.88.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aZus-9sK--eVCgzvvuc1KAAAAow"]
[Mon Feb 23 09:27:24.261231 2026] [:error] [pid 39540:tid 39577] [client 4.232.88.81:32287] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Mon Feb 23 09:27:24.497920 2026] [:error] [pid 39540:tid 39591] [client 4.232.88.81:32287] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Feb 23 09:27:24.735936 2026] [:error] [pid 39540:tid 39571] [client 4.232.88.81:32287] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Mon Feb 23 09:27:25.215316 2026] [:error] [pid 39540:tid 39580] [client 4.232.88.81:32287] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Mon Feb 23 09:27:25.452880 2026] [:error] [pid 39540:tid 39572] [client 4.232.88.81:32287] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Mon Feb 23 09:27:25.701137 2026] [:error] [pid 39540:tid 39587] [client 4.232.88.81:32287] File does not exist: /usr/local/apache/htdocs/suspended-page/zqhfn.php
[Mon Feb 23 09:27:25.934562 2026] [:error] [pid 39540:tid 39588] [client 4.232.88.81:32287] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aZus_bsgm9aTWhlRScKE-AAAAdM"]
[Mon Feb 23 09:27:26.452030 2026] [:error] [pid 39540:tid 39570] [client 4.232.88.81:10390] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aZus_rsgm9aTWhlRScKE_QAAAcE"]
[Mon Feb 23 09:27:27.003127 2026] [:error] [pid 25380:tid 25400] [client 4.232.88.81:33165] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aZus_6Krc8yFQ8fy78o0CAAAANI"]
[Mon Feb 23 09:27:27.475740 2026] [:error] [pid 25380:tid 25396] [client 4.232.88.81:5276] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aZus_6Krc8yFQ8fy78o0DQAAAM4"]
[Mon Feb 23 09:27:27.940548 2026] [:error] [pid 39540:tid 39569] [client 4.232.88.81:6217] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aZus_7sgm9aTWhlRScKFAwAAAcA"]
[Mon Feb 23 09:27:28.438249 2026] [:error] [pid 39540:tid 39573] [client 4.232.88.81:31150] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aZutALsgm9aTWhlRScKFBwAAAcQ"]
[Mon Feb 23 09:27:29.988145 2026] [:error] [pid 39504:tid 39509] [client 4.232.88.81:31109] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZutAXLcHpOlI9gwwJrdBAAAAUM"]
[Mon Feb 23 09:27:30.459060 2026] [:error] [pid 25294:tid 25358] [client 4.232.88.81:31167] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZutAiRCFB3CqIo_jfZ1JQAAAEw"]
[Mon Feb 23 09:27:30.935618 2026] [:error] [pid 25294:tid 25374] [client 4.232.88.81:12310] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZutAiRCFB3CqIo_jfZ1JgAAAFU"]
[Mon Feb 23 09:27:31.574649 2026] [:error] [pid 29909:tid 29916] [client 4.232.88.81:17247] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aZutAz9oc2QzltksUk6r2gAAAQU"]
[Mon Feb 23 09:27:32.071459 2026] [:error] [pid 29909:tid 29930] [client 4.232.88.81:33195] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZutBD9oc2QzltksUk6r2wAAARM"]
[Mon Feb 23 09:27:33.576270 2026] [:error] [pid 29909:tid 29920] [client 4.232.88.81:25080] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZutBT9oc2QzltksUk6r4wAAAQk"]
[Mon Feb 23 09:27:34.045340 2026] [:error] [pid 39540:tid 39579] [client 4.232.88.81:32292] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZutBrsgm9aTWhlRScKFEwAAAco"]
[Mon Feb 23 09:27:34.517811 2026] [:error] [pid 39540:tid 39588] [client 4.232.88.81:17276] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZutBrsgm9aTWhlRScKFGAAAAdM"]
[Mon Feb 23 09:27:35.002535 2026] [:error] [pid 39540:tid 39572] [client 4.232.88.81:12984] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aZutB7sgm9aTWhlRScKFHwAAAcM"]
[Mon Feb 23 09:27:35.474890 2026] [:error] [pid 39540:tid 39570] [client 4.232.88.81:13649] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aZutB7sgm9aTWhlRScKFIwAAAcE"]
[Mon Feb 23 09:27:35.940816 2026] [:error] [pid 25294:tid 25345] [client 4.232.88.81:25027] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aZutByRCFB3CqIo_jfZ1LgAAAEY"]
[Mon Feb 23 09:27:36.407467 2026] [:error] [pid 25380:tid 25389] [client 4.232.88.81:14102] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aZutCKKrc8yFQ8fy78o0JwAAAMc"]
[Mon Feb 23 09:27:36.873655 2026] [:error] [pid 39540:tid 39578] [client 4.232.88.81:17274] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orouu.php"] [unique_id "aZutCLsgm9aTWhlRScKFKwAAAck"]
[Mon Feb 23 09:27:37.344384 2026] [:error] [pid 25294:tid 25360] [client 4.232.88.81:10398] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orouu.php"] [unique_id "aZutCSRCFB3CqIo_jfZ1MAAAAE0"]
[Mon Feb 23 09:27:37.809693 2026] [:error] [pid 39540:tid 39570] [client 4.232.88.81:6351] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orouu.php"] [unique_id "aZutCbsgm9aTWhlRScKFMQAAAcE"]
[Mon Feb 23 09:27:38.275919 2026] [:error] [pid 39640:tid 39688] [client 4.232.88.81:33204] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/orouu.php"] [unique_id "aZutCtsK--eVCgzvvuc1OQAAApI"]
[Mon Feb 23 09:27:38.785250 2026] [:error] [pid 39540:tid 39578] [client 4.232.88.81:12940] [client 4.232.88.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZutCrsgm9aTWhlRScKFNwAAAck"]
[Mon Feb 23 09:27:39.252060 2026] [:error] [pid 39540:tid 39574] [client 4.232.88.81:14335] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kalso.php"] [unique_id "aZutC7sgm9aTWhlRScKFPQAAAcU"]
[Mon Feb 23 09:27:39.716699 2026] [:error] [pid 39540:tid 39578] [client 4.232.88.81:14092] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kalso.php"] [unique_id "aZutC7sgm9aTWhlRScKFQgAAAck"]
[Mon Feb 23 09:27:40.184242 2026] [:error] [pid 39540:tid 39592] [client 4.232.88.81:10380] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kalso.php"] [unique_id "aZutDLsgm9aTWhlRScKFRwAAAdc"]
[Mon Feb 23 09:27:40.698835 2026] [:error] [pid 39540:tid 39576] [client 4.232.88.81:13667] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "aZutDLsgm9aTWhlRScKFSgAAAcc"]
[Mon Feb 23 09:27:41.235303 2026] [:error] [pid 39639:tid 39645] [client 4.232.88.81:31120] [client 4.232.88.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aZutDRpFkMoMi8uTUUMLVAAAAkI"]
[Mon Feb 23 09:27:41.772898 2026] [:error] [pid 39540:tid 39576] [client 4.232.88.81:32258] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aZutDbsgm9aTWhlRScKFUgAAAcc"]
[Mon Feb 23 09:27:42.277226 2026] [:error] [pid 39640:tid 39678] [client 4.232.88.81:6373] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aZutDtsK--eVCgzvvuc1QgAAAog"]
[Mon Feb 23 09:27:42.741537 2026] [:error] [pid 39504:tid 39526] [client 4.232.88.81:31129] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aZutDnLcHpOlI9gwwJrdCAAAAVQ"]
[Mon Feb 23 09:27:43.226981 2026] [:error] [pid 39504:tid 39516] [client 4.232.88.81:13683] [client 4.232.88.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aZutD3LcHpOlI9gwwJrdCgAAAUo"]
[Mon Feb 23 09:27:43.710273 2026] [:error] [pid 25293:tid 25310] [client 4.232.88.81:13652] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aZutD-L9XfBf66iHi_eMhAAAAAs"]
[Mon Feb 23 09:27:44.175143 2026] [:error] [pid 39540:tid 39577] [client 4.232.88.81:14138] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "aZutELsgm9aTWhlRScKFXgAAAcg"]
[Mon Feb 23 09:27:45.666088 2026] [:error] [pid 39504:tid 39523] [client 4.232.88.81:25050] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aZutEXLcHpOlI9gwwJrdDwAAAVE"]
[Mon Feb 23 09:27:46.177884 2026] [:error] [pid 25295:tid 25369] [client 4.232.88.81:12981] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aZutEo2Av4J1Jnqi7yKZ9QAAAJg"]
[Mon Feb 23 09:27:46.656015 2026] [:error] [pid 39639:tid 39667] [client 4.232.88.81:14095] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aZutEhpFkMoMi8uTUUMLWwAAAlg"]
[Mon Feb 23 09:27:47.146457 2026] [:error] [pid 39504:tid 39511] [client 4.232.88.81:31154] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aZutE3LcHpOlI9gwwJrdFAAAAUU"]
[Mon Feb 23 09:27:47.619022 2026] [:error] [pid 39504:tid 39525] [client 4.232.88.81:12470] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aZutE3LcHpOlI9gwwJrdFQAAAVM"]
[Mon Feb 23 09:27:48.084779 2026] [:error] [pid 39640:tid 39679] [client 4.232.88.81:13634] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aZutFNsK--eVCgzvvuc1TgAAAok"]
[Mon Feb 23 09:27:48.617955 2026] [:error] [pid 25294:tid 25362] [client 4.232.88.81:14249] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aZutFCRCFB3CqIo_jfZ1NAAAAE4"]
[Mon Feb 23 09:27:49.129711 2026] [:error] [pid 25380:tid 25403] [client 4.232.88.81:32294] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aZutFaKrc8yFQ8fy78o0MAAAANU"]
[Mon Feb 23 09:27:49.673924 2026] [:error] [pid 25380:tid 25390] [client 4.232.88.81:5827] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "aZutFaKrc8yFQ8fy78o0MQAAAMg"]
[Mon Feb 23 09:27:50.166837 2026] [:error] [pid 39640:tid 39692] [client 4.232.88.81:5877] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "aZutFtsK--eVCgzvvuc1TwAAApY"]
[Mon Feb 23 09:27:50.740173 2026] [:error] [pid 39639:tid 39658] [client 4.232.88.81:6229] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aZutFhpFkMoMi8uTUUMLYQAAAk8"]
[Mon Feb 23 09:27:51.233970 2026] [:error] [pid 39639:tid 39659] [client 4.232.88.81:12316] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aZutFxpFkMoMi8uTUUMLYgAAAlA"]
[Mon Feb 23 09:27:51.699345 2026] [:error] [pid 39540:tid 39588] [client 4.232.88.81:14277] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aZutF7sgm9aTWhlRScKFiQAAAdM"]
[Mon Feb 23 09:27:52.167258 2026] [:error] [pid 39538:tid 39565] [client 4.232.88.81:15285] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aZutGC4Zk8-cQOG3ZnodGQAAAZc"]
[Mon Feb 23 09:27:52.642786 2026] [:error] [pid 39540:tid 39571] [client 4.232.88.81:12963] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aZutGLsgm9aTWhlRScKFjgAAAcI"]
[Mon Feb 23 09:27:53.152815 2026] [:error] [pid 39540:tid 39569] [client 4.232.88.81:10407] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZutGbsgm9aTWhlRScKFjwAAAcA"]
[Mon Feb 23 09:27:53.756616 2026] [:error] [pid 39538:tid 39547] [client 4.232.88.81:10369] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZutGS4Zk8-cQOG3ZnodGwAAAYU"]
[Mon Feb 23 09:27:54.255259 2026] [:error] [pid 39538:tid 39543] [client 4.232.88.81:15249] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZutGi4Zk8-cQOG3ZnodHAAAAYE"]
[Mon Feb 23 09:27:54.749949 2026] [:error] [pid 39540:tid 39587] [client 4.232.88.81:32308] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aZutGrsgm9aTWhlRScKFlQAAAdI"]
[Mon Feb 23 09:27:55.217601 2026] [:error] [pid 39538:tid 39564] [client 4.232.88.81:5308] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZutGy4Zk8-cQOG3ZnodHgAAAZY"]
[Mon Feb 23 09:27:55.771780 2026] [:error] [pid 39639:tid 39651] [client 4.232.88.81:14264] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZutGxpFkMoMi8uTUUMLZAAAAkg"]
[Mon Feb 23 09:27:56.261925 2026] [:error] [pid 39640:tid 39690] [client 4.232.88.81:32192] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZutHNsK--eVCgzvvuc1WgAAApQ"]
[Mon Feb 23 09:27:56.931103 2026] [:error] [pid 39640:tid 39671] [client 4.232.88.81:13664] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aZutHNsK--eVCgzvvuc1WwAAAoE"]
[Mon Feb 23 09:27:57.531777 2026] [:error] [pid 39640:tid 39670] [client 4.232.88.81:32197] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aZutHdsK--eVCgzvvuc1XwAAAoA"]
[Mon Feb 23 09:27:58.004146 2026] [:error] [pid 39640:tid 39683] [client 4.232.88.81:9533] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aZutHtsK--eVCgzvvuc1YQAAAo0"]
[Mon Feb 23 09:27:58.506568 2026] [:error] [pid 39540:tid 39590] [client 4.232.88.81:2243] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aZutHrsgm9aTWhlRScKFpwAAAdU"]
[Mon Feb 23 09:27:59.016635 2026] [:error] [pid 39540:tid 39584] [client 4.232.88.81:14423] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aZutH7sgm9aTWhlRScKFqgAAAc8"]
[Mon Feb 23 09:28:00.495436 2026] [:error] [pid 25294:tid 25348] [client 4.232.88.81:14228] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "aZutICRCFB3CqIo_jfZ1PAAAAEc"]
[Mon Feb 23 09:28:00.982103 2026] [:error] [pid 25380:tid 25399] [client 4.232.88.81:14261] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZutIKKrc8yFQ8fy78o0QQAAANE"]
[Mon Feb 23 09:28:01.447274 2026] [:error] [pid 39639:tid 39655] [client 4.232.88.81:14452] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZutIRpFkMoMi8uTUUMLbAAAAkw"]
[Mon Feb 23 09:28:01.911832 2026] [:error] [pid 25380:tid 25394] [client 4.232.88.81:15043] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZutIaKrc8yFQ8fy78o0RwAAAMw"]
[Mon Feb 23 09:28:02.428444 2026] [:error] [pid 39540:tid 39578] [client 4.232.88.81:15101] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZutIrsgm9aTWhlRScKFsgAAAck"]
[Mon Feb 23 09:28:02.893473 2026] [:error] [pid 25380:tid 25399] [client 4.232.88.81:7354] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZutIqKrc8yFQ8fy78o0TQAAANE"]
[Mon Feb 23 09:28:03.365927 2026] [:error] [pid 25380:tid 25389] [client 4.232.88.81:9528] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZutI6Krc8yFQ8fy78o0UgAAAMc"]
[Mon Feb 23 09:28:03.885038 2026] [:error] [pid 25380:tid 25386] [client 4.232.88.81:11766] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/function/function.php"] [unique_id "aZutI6Krc8yFQ8fy78o0VQAAAMQ"]
[Mon Feb 23 09:28:04.442352 2026] [:error] [pid 25294:tid 25373] [client 4.232.88.81:5395] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aZutJCRCFB3CqIo_jfZ1QQAAAFQ"]
[Mon Feb 23 09:28:04.929528 2026] [:error] [pid 39538:tid 39566] [client 4.232.88.81:9494] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aZutJC4Zk8-cQOG3ZnodIwAAAZg"]
[Mon Feb 23 09:28:05.469245 2026] [:error] [pid 25380:tid 25390] [client 4.232.88.81:5384] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aZutJaKrc8yFQ8fy78o0WwAAAMg"]
[Mon Feb 23 09:28:06.009608 2026] [:error] [pid 39639:tid 39653] [client 4.232.88.81:7676] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "aZutJhpFkMoMi8uTUUMLcAAAAko"]
[Mon Feb 23 09:28:06.475968 2026] [:error] [pid 39640:tid 39673] [client 4.232.88.81:7554] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/index.php"] [unique_id "aZutJtsK--eVCgzvvuc1agAAAoM"]
[Mon Feb 23 09:28:06.942363 2026] [:error] [pid 39540:tid 39583] [client 4.232.88.81:4862] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/index.php"] [unique_id "aZutJrsgm9aTWhlRScKFvwAAAc4"]
[Mon Feb 23 09:28:07.602026 2026] [:error] [pid 39639:tid 39644] [client 4.232.88.81:9519] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "aZutJxpFkMoMi8uTUUMLcQAAAkE"]
[Mon Feb 23 09:28:08.084227 2026] [:error] [pid 39540:tid 39590] [client 4.232.88.81:6043] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aZutKLsgm9aTWhlRScKFxwAAAdU"]
[Mon Feb 23 09:28:08.644330 2026] [:error] [pid 25295:tid 25335] [client 4.232.88.81:16603] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aZutKI2Av4J1Jnqi7yKZ_gAAAIQ"]
[Mon Feb 23 09:28:09.243595 2026] [:error] [pid 25294:tid 25362] [client 4.232.88.81:6038] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aZutKSRCFB3CqIo_jfZ1RgAAAE4"]
[Mon Feb 23 09:28:09.757331 2026] [:error] [pid 29909:tid 29931] [client 4.232.88.81:17563] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aZutKT9oc2QzltksUk6r7QAAARQ"]
[Mon Feb 23 09:28:10.281460 2026] [:error] [pid 25380:tid 25395] [client 4.232.88.81:4957] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "aZutKqKrc8yFQ8fy78o0YwAAAM0"]
[Mon Feb 23 09:28:10.907013 2026] [:error] [pid 39540:tid 39583] [client 4.232.88.81:15078] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZutKrsgm9aTWhlRScKFzQAAAc4"]
[Mon Feb 23 09:28:11.412672 2026] [:error] [pid 39540:tid 39572] [client 4.232.88.81:10271] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aZutK7sgm9aTWhlRScKFzgAAAcM"]
[Mon Feb 23 09:28:11.931894 2026] [:error] [pid 25380:tid 25404] [client 4.232.88.81:9016] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/wp-login.php"] [unique_id "aZutK6Krc8yFQ8fy78o0aAAAANY"]
[Mon Feb 23 09:28:12.439969 2026] [:error] [pid 39540:tid 39589] [client 4.232.88.81:15683] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/wp-login.php"] [unique_id "aZutLLsgm9aTWhlRScKF1AAAAdQ"]
[Mon Feb 23 09:28:12.925640 2026] [:error] [pid 39540:tid 39571] [client 4.232.88.81:11929] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZutLLsgm9aTWhlRScKF1wAAAcI"]
[Mon Feb 23 09:28:13.395792 2026] [:error] [pid 39639:tid 39648] [client 4.232.88.81:15765] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZutLRpFkMoMi8uTUUMLcwAAAkU"]
[Mon Feb 23 09:28:13.947570 2026] [:error] [pid 39540:tid 39574] [client 4.232.88.81:12286] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZutLbsgm9aTWhlRScKF2QAAAcU"]
[Mon Feb 23 09:28:14.440054 2026] [:error] [pid 39540:tid 39579] [client 4.232.88.81:4800] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aZutLrsgm9aTWhlRScKF3AAAAco"]
[Mon Feb 23 09:28:14.935254 2026] [:error] [pid 39640:tid 39692] [client 4.232.88.81:5180] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aZutLtsK--eVCgzvvuc1dQAAApY"]
[Mon Feb 23 09:28:15.476994 2026] [:error] [pid 39540:tid 39590] [client 4.232.88.81:15774] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aZutL7sgm9aTWhlRScKF3wAAAdU"]
[Mon Feb 23 09:28:16.165146 2026] [:error] [pid 39640:tid 39676] [client 4.232.88.81:6053] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxzdc.php"] [unique_id "aZutMNsK--eVCgzvvuc1dgAAAoY"]
[Mon Feb 23 09:28:16.654691 2026] [:error] [pid 29909:tid 29928] [client 4.232.88.81:13730] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aZutMD9oc2QzltksUk6r9QAAARE"]
[Mon Feb 23 09:28:17.138342 2026] [:error] [pid 25294:tid 25351] [client 4.232.88.81:7279] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aZutMSRCFB3CqIo_jfZ1dAAAAEk"]
[Mon Feb 23 09:28:17.604305 2026] [:error] [pid 39639:tid 39659] [client 4.232.88.81:4948] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aZutMRpFkMoMi8uTUUMLjQAAAlA"]
[Mon Feb 23 09:28:18.069233 2026] [:error] [pid 39640:tid 39681] [client 4.232.88.81:8982] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "aZutMtsK--eVCgzvvuc1dwAAAos"]
[Mon Feb 23 09:28:18.547271 2026] [:error] [pid 25380:tid 25398] [client 4.232.88.81:9317] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "aZutMqKrc8yFQ8fy78o0mgAAANA"]
[Mon Feb 23 09:28:19.068448 2026] [:error] [pid 39540:tid 39572] [client 4.232.88.81:15324] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "aZutM7sgm9aTWhlRScKF5QAAAcM"]
[Mon Feb 23 09:28:19.547741 2026] [:error] [pid 39540:tid 39586] [client 4.232.88.81:15298] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/index.php"] [unique_id "aZutM7sgm9aTWhlRScKF5wAAAdE"]
[Mon Feb 23 09:28:20.018479 2026] [:error] [pid 25380:tid 25382] [client 4.232.88.81:9298] [client 4.232.88.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aZutNKKrc8yFQ8fy78o0pAAAAMA"]
[Mon Feb 23 09:28:20.553819 2026] [:error] [pid 39639:tid 39653] [client 4.232.88.81:14959] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZutNBpFkMoMi8uTUUMLkQAAAko"]
[Mon Feb 23 09:28:21.024099 2026] [:error] [pid 39640:tid 39694] [client 4.232.88.81:7948] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZutNdsK--eVCgzvvuc1eAAAApg"]
[Mon Feb 23 09:28:21.491646 2026] [:error] [pid 39540:tid 39586] [client 4.232.88.81:12062] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aZutNbsgm9aTWhlRScKF7gAAAdE"]
[Mon Feb 23 09:28:21.962436 2026] [:error] [pid 29909:tid 29923] [client 4.232.88.81:4771] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aZutNT9oc2QzltksUk6r9wAAAQw"]
[Mon Feb 23 09:28:22.428948 2026] [:error] [pid 29909:tid 29922] [client 4.232.88.81:2382] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aZutNj9oc2QzltksUk6r-AAAAQs"]
[Mon Feb 23 09:28:23.925083 2026] [:error] [pid 25380:tid 25383] [client 4.232.88.81:15310] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aZutN6Krc8yFQ8fy78o0qgAAAME"]
[Mon Feb 23 09:28:24.390444 2026] [:error] [pid 39640:tid 39685] [client 4.232.88.81:7244] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "aZutONsK--eVCgzvvuc1fgAAAo8"]
[Mon Feb 23 09:28:24.871303 2026] [:error] [pid 25294:tid 25375] [client 4.232.88.81:2711] [client 4.232.88.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "aZutOCRCFB3CqIo_jfZ1iQAAAFY"]
[Mon Feb 23 09:28:25.339802 2026] [:error] [pid 25380:tid 25386] [client 4.232.88.81:32722] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Mon Feb 23 09:28:25.577650 2026] [:error] [pid 25380:tid 25402] [client 4.232.88.81:32722] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Mon Feb 23 10:08:11.970923 2026] [:error] [pid 25380:tid 25394] [client 43.154.140.188:40038] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZu2i6Krc8yFQ8fy78pJeQAAAMw"]
[Mon Feb 23 13:03:45.059608 2026] [:error] [pid 39540:tid 39569] [client 104.28.203.58:38558] [client 104.28.203.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aZvfsbsgm9aTWhlRScIE3QAAAcA"]
[Mon Feb 23 15:12:33.324891 2026] [:error] [pid 39639:tid 39658] [client 60.188.57.0:36959] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZv94RpFkMoMi8uTUUNXywAAAk8"]
[Mon Feb 23 17:44:50.720744 2026] [:error] [pid 25294:tid 25366] [client 129.226.93.214:39788] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZwhkiRCFB3CqIo_jfbE3wAAAFA"]
[Mon Feb 23 22:52:53.949608 2026] [:error] [pid 25380:tid 25401] [client 170.106.35.187:40106] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZxpxaKrc8yFQ8fy78poFAAAANM"]
[Tue Feb 24 01:25:23.877220 2026] [:error] [pid 60063:tid 60074] [client 159.65.15.207:34860] [client 159.65.15.207] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aZyNg0_6t1uQomVVdUNU9gAAAQk"]
[Tue Feb 24 01:59:51.678707 2026] [:error] [pid 60063:tid 60081] [client 43.131.253.14:57706] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZyVl0_6t1uQomVVdUNndgAAARA"]
[Tue Feb 24 04:29:50.141857 2026] [:error] [pid 37540:tid 37605] [client 119.28.89.249:52208] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZy4viahRAUBJS8hpJVIcgAAAIM"]
[Tue Feb 24 05:23:17.196911 2026] [:error] [pid 37539:tid 37583] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Tue Feb 24 05:23:17.415402 2026] [:error] [pid 37539:tid 37592] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Feb 24 05:23:17.851876 2026] [:error] [pid 37539:tid 37595] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Tue Feb 24 05:23:18.059767 2026] [:error] [pid 37539:tid 37591] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Tue Feb 24 05:23:18.275652 2026] [:error] [pid 37539:tid 37580] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Feb 24 05:23:18.504184 2026] [:error] [pid 37539:tid 37587] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Feb 24 05:23:18.974619 2026] [:error] [pid 37539:tid 37575] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Tue Feb 24 05:23:19.603129 2026] [:error] [pid 37539:tid 37594] [client 20.104.114.39:19439] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Feb 24 05:23:19.819277 2026] [:error] [pid 37539:tid 37589] [client 20.104.114.39:19439] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aZzFR3Enr46jUQep9z_D4QAAAE4"]
[Tue Feb 24 05:23:21.595168 2026] [:error] [pid 37644:tid 37659] [client 20.104.114.39:19397] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aZzFSULaEhVDwBRydH015QAAAM0"]
[Tue Feb 24 05:23:23.472924 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:19447] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aZzFSyahRAUBJS8hpJVYyQAAAIc"]
[Tue Feb 24 05:23:25.238230 2026] [:error] [pid 11672:tid 11694] [client 20.104.114.39:19409] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aZzFTfa0fhnmfPYq92uU7gAAARQ"]
[Tue Feb 24 05:23:26.090862 2026] [:error] [pid 11672:tid 11681] [client 20.104.114.39:19420] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZzFTva0fhnmfPYq92uU8gAAAQc"]
[Tue Feb 24 05:23:26.999545 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:19443] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZzFTiahRAUBJS8hpJVY0gAAAI8"]
[Tue Feb 24 05:23:28.309315 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:19379] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZzFUELaEhVDwBRydH019AAAAMo"]
[Tue Feb 24 05:23:29.735406 2026] [:error] [pid 11672:tid 11685] [client 20.104.114.39:19410] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aZzFUfa0fhnmfPYq92uU-wAAAQs"]
[Tue Feb 24 05:23:31.268569 2026] [:error] [pid 37644:tid 37669] [client 20.104.114.39:19444] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZzFU0LaEhVDwBRydH01_QAAANc"]
[Tue Feb 24 05:23:33.148360 2026] [:error] [pid 37644:tid 37648] [client 20.104.114.39:19400] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZzFVULaEhVDwBRydH02BAAAAMI"]
[Tue Feb 24 05:23:33.997884 2026] [:error] [pid 11672:tid 11694] [client 20.104.114.39:19342] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZzFVfa0fhnmfPYq92uVAwAAARQ"]
[Tue Feb 24 05:23:35.813017 2026] [:error] [pid 37644:tid 37648] [client 20.104.114.39:19394] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aZzFV0LaEhVDwBRydH02DwAAAMI"]
[Tue Feb 24 05:23:37.265831 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:19449] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZzFWULaEhVDwBRydH02FgAAANg"]
[Tue Feb 24 05:23:38.536546 2026] [:error] [pid 11672:tid 11677] [client 20.104.114.39:19433] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZzFWva0fhnmfPYq92uVCQAAAQM"]
[Tue Feb 24 05:23:40.191282 2026] [:error] [pid 11672:tid 11689] [client 20.104.114.39:19411] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZzFXPa0fhnmfPYq92uVCwAAAQ8"]
[Tue Feb 24 05:23:41.616015 2026] [:error] [pid 37644:tid 37669] [client 20.104.114.39:19406] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aZzFXULaEhVDwBRydH02JQAAANc"]
[Tue Feb 24 05:23:42.664470 2026] [:error] [pid 37540:tid 37620] [client 20.104.114.39:19405] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZzFXiahRAUBJS8hpJVY3gAAAJI"]
[Tue Feb 24 05:23:43.756827 2026] [:error] [pid 11672:tid 11698] [client 20.104.114.39:19427] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZzFX_a0fhnmfPYq92uVDgAAARg"]
[Tue Feb 24 05:23:45.938854 2026] [:error] [pid 11672:tid 11695] [client 20.104.114.39:19432] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZzFYfa0fhnmfPYq92uVEgAAARU"]
[Tue Feb 24 05:23:47.030230 2026] [:error] [pid 37644:tid 37655] [client 20.104.114.39:19404] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aZzFY0LaEhVDwBRydH02LAAAAMk"]
[Tue Feb 24 05:23:48.095859 2026] [:error] [pid 37539:tid 37578] [client 20.104.114.39:19434] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZzFZHEnr46jUQep9z_D9gAAAEM"]
[Tue Feb 24 05:23:51.155989 2026] [:error] [pid 37644:tid 37658] [client 20.104.114.39:19339] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZzFZ0LaEhVDwBRydH02OwAAAMw"]
[Tue Feb 24 05:23:54.976188 2026] [:error] [pid 37539:tid 37587] [client 20.104.114.39:19446] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZzFanEnr46jUQep9z_D_AAAAEw"]
[Tue Feb 24 05:23:57.310107 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:19399] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aZzFbSahRAUBJS8hpJVY_QAAAIU"]
[Tue Feb 24 05:24:00.060370 2026] [:error] [pid 37540:tid 37606] [client 20.104.114.39:19429] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZzFcCahRAUBJS8hpJVZCwAAAIQ"]
[Tue Feb 24 05:24:02.551750 2026] [:error] [pid 37540:tid 37626] [client 20.104.114.39:19451] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZzFciahRAUBJS8hpJVZFAAAAJg"]
[Tue Feb 24 05:24:03.907020 2026] [:error] [pid 11672:tid 11680] [client 20.104.114.39:19393] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZzFc_a0fhnmfPYq92uVLAAAAQY"]
[Tue Feb 24 05:24:06.005404 2026] [:error] [pid 11672:tid 11687] [client 20.104.114.39:19398] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aZzFdva0fhnmfPYq92uVLgAAAQ0"]
[Tue Feb 24 05:24:07.139264 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:19423] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZzFd0LaEhVDwBRydH02bAAAANQ"]
[Tue Feb 24 05:24:09.781509 2026] [:error] [pid 37644:tid 37652] [client 20.104.114.39:19408] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZzFeULaEhVDwBRydH02dQAAAMY"]
[Tue Feb 24 05:24:12.174332 2026] [:error] [pid 37644:tid 37665] [client 20.104.114.39:19424] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZzFfELaEhVDwBRydH02fAAAANM"]
[Tue Feb 24 05:24:15.860365 2026] [:error] [pid 37644:tid 37657] [client 20.104.114.39:19419] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aZzFf0LaEhVDwBRydH02jgAAAMs"]
[Tue Feb 24 05:24:16.697286 2026] [:error] [pid 37538:tid 37560] [client 20.104.114.39:19329] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aZzFgCynTiHZ9J0Y2nZetgAAAAw"]
[Tue Feb 24 05:24:17.760678 2026] [:error] [pid 37539:tid 37575] [client 20.104.114.39:19345] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aZzFgXEnr46jUQep9z_EDAAAAEA"]
[Tue Feb 24 05:24:18.974576 2026] [:error] [pid 37538:tid 37568] [client 20.104.114.39:19353] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "aZzFgiynTiHZ9J0Y2nZevgAAABQ"]
[Tue Feb 24 05:24:21.435759 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/lsd.php
[Tue Feb 24 05:24:21.644913 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Feb 24 05:24:21.855053 2026] [:error] [pid 37540:tid 37621] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Tue Feb 24 05:24:22.074001 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Tue Feb 24 05:24:22.283080 2026] [:error] [pid 37540:tid 37624] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/atx.php
[Tue Feb 24 05:24:22.494185 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Tue Feb 24 05:24:22.811415 2026] [:error] [pid 37540:tid 37616] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Tue Feb 24 05:24:23.021315 2026] [:error] [pid 37540:tid 37613] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Tue Feb 24 05:24:23.230466 2026] [:error] [pid 37540:tid 37610] [client 20.104.114.39:19338] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Feb 24 05:24:23.904788 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:19338] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aZzFhyahRAUBJS8hpJVZNgAAAIc"]
[Tue Feb 24 05:24:24.914222 2026] [:error] [pid 11672:tid 11684] [client 20.104.114.39:19392] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aZzFiPa0fhnmfPYq92uVOQAAAQo"]
[Tue Feb 24 05:24:26.895237 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:19422] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aZzFiiahRAUBJS8hpJVZPAAAAIw"]
[Tue Feb 24 05:24:28.782802 2026] [:error] [pid 11672:tid 11690] [client 20.104.114.39:19354] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aZzFjPa0fhnmfPYq92uVRAAAARA"]
[Tue Feb 24 05:24:30.762317 2026] [:error] [pid 37539:tid 37583] [client 20.104.114.39:19348] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZzFjnEnr46jUQep9z_EFAAAAEg"]
[Tue Feb 24 05:24:33.890356 2026] [:error] [pid 37538:tid 37570] [client 20.104.114.39:19343] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZzFkSynTiHZ9J0Y2nZexwAAABY"]
[Tue Feb 24 05:24:35.228838 2026] [:error] [pid 37540:tid 37612] [client 20.104.114.39:19445] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZzFkyahRAUBJS8hpJVZSQAAAIo"]
[Tue Feb 24 05:24:37.190509 2026] [:error] [pid 37644:tid 37657] [client 20.104.114.39:19416] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aZzFlULaEhVDwBRydH02uQAAAMs"]
[Tue Feb 24 05:24:38.459788 2026] [:error] [pid 37644:tid 37664] [client 20.104.114.39:19428] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aZzFlkLaEhVDwBRydH02vgAAANI"]
[Tue Feb 24 05:24:39.830785 2026] [:error] [pid 37539:tid 37592] [client 20.104.114.39:19337] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aZzFl3Enr46jUQep9z_EGgAAAFE"]
[Tue Feb 24 05:24:40.799324 2026] [:error] [pid 11672:tid 11680] [client 20.104.114.39:19440] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aZzFmPa0fhnmfPYq92uVVwAAAQY"]
[Tue Feb 24 05:24:43.205686 2026] [:error] [pid 37539:tid 37593] [client 20.104.114.39:19407] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aZzFm3Enr46jUQep9z_EIQAAAFI"]
[Tue Feb 24 05:24:46.544662 2026] [:error] [pid 37644:tid 37663] [client 20.104.114.39:19435] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aZzFnkLaEhVDwBRydH02ywAAANE"]
[Tue Feb 24 05:24:48.898830 2026] [:error] [pid 37539:tid 37586] [client 20.104.114.39:19415] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aZzFoHEnr46jUQep9z_EJQAAAEs"]
[Tue Feb 24 05:24:51.273495 2026] [:error] [pid 37540:tid 37619] [client 20.104.114.39:19453] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aZzFoyahRAUBJS8hpJVZZgAAAJE"]
[Tue Feb 24 05:24:52.882854 2026] [:error] [pid 37644:tid 37661] [client 20.104.114.39:19403] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aZzFpELaEhVDwBRydH021gAAAM8"]
[Tue Feb 24 05:24:56.445831 2026] [:error] [pid 37644:tid 37647] [client 20.104.114.39:19437] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZzFqELaEhVDwBRydH025QAAAME"]
[Tue Feb 24 05:25:00.619457 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:19362] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZzFrCahRAUBJS8hpJVZbwAAAIc"]
[Tue Feb 24 05:25:02.762746 2026] [:error] [pid 37538:tid 37569] [client 20.104.114.39:19341] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZzFriynTiHZ9J0Y2nZe1QAAABU"]
[Tue Feb 24 05:25:06.595942 2026] [:error] [pid 37539:tid 37598] [client 20.104.114.39:19344] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aZzFsnEnr46jUQep9z_EMQAAAFc"]
[Tue Feb 24 05:25:10.073227 2026] [:error] [pid 37539:tid 37585] [client 20.104.114.39:19370] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZzFtnEnr46jUQep9z_EMgAAAEo"]
[Tue Feb 24 05:25:12.085878 2026] [:error] [pid 37538:tid 37563] [client 20.104.114.39:19418] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZzFuCynTiHZ9J0Y2nZe2wAAAA8"]
[Tue Feb 24 05:25:13.584011 2026] [:error] [pid 37538:tid 37560] [client 20.104.114.39:19352] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZzFuSynTiHZ9J0Y2nZe3gAAAAw"]
[Tue Feb 24 05:25:15.050832 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:19351] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZzFuyahRAUBJS8hpJVZegAAAJU"]
[Tue Feb 24 05:25:16.322684 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:19369] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZzFvCahRAUBJS8hpJVZfQAAAIk"]
[Tue Feb 24 05:25:17.519523 2026] [:error] [pid 11672:tid 11678] [client 20.104.114.39:19371] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZzFvfa0fhnmfPYq92uVgwAAAQQ"]
[Tue Feb 24 05:25:18.261861 2026] [:error] [pid 37538:tid 37553] [client 20.104.114.39:19414] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZzFviynTiHZ9J0Y2nZe4wAAAAU"]
[Tue Feb 24 05:25:19.956662 2026] [:error] [pid 37538:tid 37551] [client 20.104.114.39:19363] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "aZzFvyynTiHZ9J0Y2nZe5gAAAAM"]
[Tue Feb 24 05:25:21.824330 2026] [:error] [pid 37540:tid 37606] [client 20.104.114.39:19442] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aZzFwSahRAUBJS8hpJVZhwAAAIQ"]
[Tue Feb 24 05:25:24.006172 2026] [:error] [pid 37538:tid 37548] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue Feb 24 05:25:24.221400 2026] [:error] [pid 37538:tid 37563] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Feb 24 05:25:24.432288 2026] [:error] [pid 37538:tid 37552] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Feb 24 05:25:24.665448 2026] [:error] [pid 37538:tid 37560] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Feb 24 05:25:24.921529 2026] [:error] [pid 37538:tid 37570] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Feb 24 05:25:25.148735 2026] [:error] [pid 37538:tid 37567] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Feb 24 05:25:25.570735 2026] [:error] [pid 37538:tid 37549] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Feb 24 05:25:25.993206 2026] [:error] [pid 37538:tid 37554] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Feb 24 05:25:26.533417 2026] [:error] [pid 37538:tid 37572] [client 20.104.114.39:19454] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Tue Feb 24 05:25:27.197741 2026] [:error] [pid 37538:tid 37561] [client 20.104.114.39:19454] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZzFxyynTiHZ9J0Y2nZe-AAAAA0"]
[Tue Feb 24 05:25:28.862851 2026] [:error] [pid 37539:tid 37584] [client 20.104.114.39:19358] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZzFyHEnr46jUQep9z_ESgAAAEk"]
[Tue Feb 24 05:25:30.639582 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:19412] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZzFyiahRAUBJS8hpJVZlAAAAIE"]
[Tue Feb 24 05:25:32.267091 2026] [:error] [pid 11672:tid 11685] [client 20.104.114.39:19277] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aZzFzPa0fhnmfPYq92uVnwAAAQs"]
[Tue Feb 24 05:25:34.951154 2026] [:error] [pid 37644:tid 37652] [client 20.104.114.39:19436] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZzFzkLaEhVDwBRydH029AAAAMY"]
[Tue Feb 24 05:25:36.312985 2026] [:error] [pid 11672:tid 11690] [client 20.104.114.39:19270] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZzF0Pa0fhnmfPYq92uVqwAAARA"]
[Tue Feb 24 05:25:38.344088 2026] [:error] [pid 37644:tid 37658] [client 20.104.114.39:19360] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZzF0kLaEhVDwBRydH02-AAAAMw"]
[Tue Feb 24 05:25:41.957924 2026] [:error] [pid 37540:tid 37619] [client 20.104.114.39:19426] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aZzF1SahRAUBJS8hpJVZmgAAAJE"]
[Tue Feb 24 05:25:44.914955 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:19401] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZzF2ELaEhVDwBRydH02_wAAAMg"]
[Tue Feb 24 05:25:48.514233 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:19350] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZzF3CahRAUBJS8hpJVZqAAAAIM"]
[Tue Feb 24 05:25:50.944325 2026] [:error] [pid 37539:tid 37592] [client 20.104.114.39:19413] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZzF3nEnr46jUQep9z_EWQAAAFE"]
[Tue Feb 24 05:25:53.314504 2026] [:error] [pid 11672:tid 11680] [client 20.104.114.39:19288] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aZzF4fa0fhnmfPYq92uVugAAAQY"]
[Tue Feb 24 05:25:57.413052 2026] [:error] [pid 37538:tid 37566] [client 20.104.114.39:19396] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZzF5SynTiHZ9J0Y2nZfEAAAABI"]
[Tue Feb 24 05:25:59.542709 2026] [:error] [pid 37644:tid 37658] [client 20.104.114.39:19332] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZzF50LaEhVDwBRydH03AwAAAMw"]
[Tue Feb 24 05:26:00.999858 2026] [:error] [pid 11672:tid 11684] [client 20.104.114.39:19290] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZzF6Pa0fhnmfPYq92uVyAAAAQo"]
[Tue Feb 24 05:26:03.558278 2026] [:error] [pid 11672:tid 11697] [client 20.104.114.39:19455] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aZzF6_a0fhnmfPYq92uVzwAAARc"]
[Tue Feb 24 05:26:05.805931 2026] [:error] [pid 37540:tid 37623] [client 20.104.114.39:19361] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzF7SahRAUBJS8hpJVZvQAAAJU"]
[Tue Feb 24 05:26:07.490976 2026] [:error] [pid 37539:tid 37598] [client 20.104.114.39:19299] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzF73Enr46jUQep9z_EZQAAAFc"]
[Tue Feb 24 05:26:10.222385 2026] [:error] [pid 37539:tid 37585] [client 20.104.114.39:19302] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzF8nEnr46jUQep9z_EaQAAAEo"]
[Tue Feb 24 05:26:13.506028 2026] [:error] [pid 37644:tid 37659] [client 20.104.114.39:19365] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aZzF9ULaEhVDwBRydH03JQAAAM0"]
[Tue Feb 24 05:26:16.259886 2026] [:error] [pid 37644:tid 37664] [client 20.104.114.39:19268] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZzF-ELaEhVDwBRydH03MgAAANI"]
[Tue Feb 24 05:26:17.513451 2026] [:error] [pid 37644:tid 37651] [client 20.104.114.39:19275] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZzF-ULaEhVDwBRydH03NgAAAMU"]
[Tue Feb 24 05:26:19.307998 2026] [:error] [pid 37644:tid 37662] [client 20.104.114.39:19330] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZzF-0LaEhVDwBRydH03OgAAANA"]
[Tue Feb 24 05:26:22.365759 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:19389] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZzF_kLaEhVDwBRydH03PQAAANg"]
[Tue Feb 24 05:26:25.367255 2026] [:error] [pid 37538:tid 37567] [client 20.104.114.39:19386] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aZzGASynTiHZ9J0Y2nZfKwAAABM"]
[Tue Feb 24 05:26:28.322097 2026] [:error] [pid 37644:tid 37650] [client 20.104.114.39:19282] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Feb 24 05:26:28.634250 2026] [:error] [pid 37644:tid 37667] [client 20.104.114.39:19282] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Feb 24 05:26:29.071328 2026] [:error] [pid 37644:tid 37660] [client 20.104.114.39:19282] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Tue Feb 24 05:26:29.298482 2026] [:error] [pid 37644:tid 37651] [client 20.104.114.39:19282] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Tue Feb 24 05:26:29.723022 2026] [:error] [pid 37644:tid 37662] [client 20.104.114.39:19282] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Tue Feb 24 05:26:30.180373 2026] [:error] [pid 37644:tid 37663] [client 20.104.114.39:19282] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Feb 24 05:26:30.510990 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:19282] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aZzGBkLaEhVDwBRydH03WQAAANQ"]
[Tue Feb 24 05:26:31.773219 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:19385] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aZzGByahRAUBJS8hpJVZzgAAAIk"]
[Tue Feb 24 05:26:32.661874 2026] [:error] [pid 37540:tid 37612] [client 20.104.114.39:19287] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aZzGCCahRAUBJS8hpJVZzwAAAIo"]
[Tue Feb 24 05:26:33.816690 2026] [:error] [pid 37538:tid 37556] [client 20.104.114.39:19333] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aZzGCSynTiHZ9J0Y2nZfMwAAAAg"]
[Tue Feb 24 05:26:34.712362 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:19356] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aZzGCiahRAUBJS8hpJVZ0wAAAJQ"]
[Tue Feb 24 05:26:36.033610 2026] [:error] [pid 37540:tid 37610] [client 20.104.114.39:19438] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aZzGDCahRAUBJS8hpJVZ1QAAAIg"]
[Tue Feb 24 05:26:37.197494 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:19378] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aZzGDSahRAUBJS8hpJVZ2QAAAIY"]
[Tue Feb 24 05:26:38.512768 2026] [:error] [pid 11672:tid 11678] [client 20.104.114.39:19306] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aZzGDva0fhnmfPYq92uWAAAAAQQ"]
[Tue Feb 24 05:26:39.966844 2026] [:error] [pid 37538:tid 37566] [client 20.104.114.39:19295] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aZzGDyynTiHZ9J0Y2nZfNgAAABI"]
[Tue Feb 24 05:26:40.966625 2026] [:error] [pid 11672:tid 11679] [client 20.104.114.39:19382] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aZzGEPa0fhnmfPYq92uWEAAAAQU"]
[Tue Feb 24 05:26:42.252101 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:19314] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aZzGEiahRAUBJS8hpJVZ3wAAAJQ"]
[Tue Feb 24 05:26:44.907517 2026] [:error] [pid 37539:tid 37591] [client 20.104.114.39:19372] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aZzGFHEnr46jUQep9z_EiAAAAFA"]
[Tue Feb 24 05:26:46.693508 2026] [:error] [pid 11672:tid 11696] [client 20.104.114.39:19349] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZzGFva0fhnmfPYq92uWFAAAARY"]
[Tue Feb 24 05:26:49.095935 2026] [:error] [pid 37540:tid 37624] [client 20.104.114.39:19267] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZzGGSahRAUBJS8hpJVZ5gAAAJY"]
[Tue Feb 24 05:26:51.734667 2026] [:error] [pid 37538:tid 37554] [client 20.104.114.39:19318] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZzGGyynTiHZ9J0Y2nZfOwAAAAY"]
[Tue Feb 24 05:26:52.577383 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:19387] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aZzGHELaEhVDwBRydH03cgAAAMo"]
[Tue Feb 24 05:26:55.359150 2026] [:error] [pid 37538:tid 37564] [client 20.104.114.39:19266] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzGHyynTiHZ9J0Y2nZfPgAAABA"]
[Tue Feb 24 05:26:58.411554 2026] [:error] [pid 37644:tid 37669] [client 20.104.114.39:19289] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzGIkLaEhVDwBRydH03swAAANc"]
[Tue Feb 24 05:27:02.322349 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:19431] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzGJkLaEhVDwBRydH03vAAAANQ"]
[Tue Feb 24 05:27:03.720542 2026] [:error] [pid 37644:tid 37669] [client 20.104.114.39:19430] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZzGJ0LaEhVDwBRydH03wAAAANc"]
[Tue Feb 24 05:27:05.053315 2026] [:error] [pid 11672:tid 11686] [client 20.104.114.39:19373] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aZzGKfa0fhnmfPYq92uWQQAAAQw"]
[Tue Feb 24 05:27:08.354042 2026] [:error] [pid 37539:tid 37575] [client 20.104.114.39:19421] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aZzGLHEnr46jUQep9z_EwwAAAEA"]
[Tue Feb 24 05:27:10.869570 2026] [:error] [pid 37538:tid 37560] [client 20.104.114.39:19209] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aZzGLiynTiHZ9J0Y2nZfRQAAAAw"]
[Tue Feb 24 05:27:12.807245 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:19321] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aZzGMELaEhVDwBRydH03xwAAANQ"]
[Tue Feb 24 05:27:16.232074 2026] [:error] [pid 37644:tid 37661] [client 20.104.114.39:19357] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aZzGNELaEhVDwBRydH032wAAAM8"]
[Tue Feb 24 05:27:16.824733 2026] [:error] [pid 37644:tid 37657] [client 20.104.114.39:19334] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aZzGNELaEhVDwBRydH033gAAAMs"]
[Tue Feb 24 05:27:17.536525 2026] [:error] [pid 37644:tid 37652] [client 20.104.114.39:19283] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aZzGNULaEhVDwBRydH034QAAAMY"]
[Tue Feb 24 05:27:19.893165 2026] [:error] [pid 37539:tid 37585] [client 20.104.114.39:19366] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "aZzGN3Enr46jUQep9z_ExgAAAEo"]
[Tue Feb 24 05:27:21.930256 2026] [:error] [pid 11672:tid 11687] [client 20.104.114.39:19300] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZzGOfa0fhnmfPYq92uWWwAAAQ0"]
[Tue Feb 24 05:27:25.194337 2026] [:error] [pid 37644:tid 37667] [client 20.104.114.39:19303] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aZzGPULaEhVDwBRydH037AAAANU"]
[Tue Feb 24 05:27:29.313501 2026] [:error] [pid 37644:tid 37648] [client 20.104.114.39:19276] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aZzGQULaEhVDwBRydH037wAAAMI"]
[Tue Feb 24 05:27:30.659465 2026] [:error] [pid 37644:tid 37668] [client 20.104.114.39:19285] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aZzGQkLaEhVDwBRydH039QAAANY"]
[Tue Feb 24 05:27:34.986229 2026] [:error] [pid 37540:tid 37606] [client 20.104.114.39:19265] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aZzGRiahRAUBJS8hpJVaTwAAAIQ"]
[Tue Feb 24 05:27:36.572567 2026] [:error] [pid 11672:tid 11688] [client 20.104.114.39:19281] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aZzGSPa0fhnmfPYq92uWbAAAAQ4"]
[Tue Feb 24 05:27:38.915198 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:19226] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Tue Feb 24 05:27:40.296834 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:19226] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Feb 24 05:27:40.719492 2026] [:error] [pid 37540:tid 37617] [client 20.104.114.39:19226] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aZzGTCahRAUBJS8hpJVaVgAAAI8"]
[Tue Feb 24 05:27:41.943146 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:19425] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aZzGTULaEhVDwBRydH04FAAAANQ"]
[Tue Feb 24 05:27:43.253357 2026] [:error] [pid 37538:tid 37548] [client 20.104.114.39:19452] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aZzGTyynTiHZ9J0Y2nZfTAAAAAA"]
[Tue Feb 24 05:27:45.055882 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:19448] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "aZzGUSahRAUBJS8hpJVaYwAAAIE"]
[Tue Feb 24 05:27:46.952766 2026] [:error] [pid 37644:tid 37655] [client 20.104.114.39:19210] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZzGUkLaEhVDwBRydH04HgAAAMk"]
[Tue Feb 24 05:27:50.750515 2026] [:error] [pid 11672:tid 11687] [client 20.104.114.39:19411] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZzGVva0fhnmfPYq92uWgQAAAQ0"]
[Tue Feb 24 05:27:53.615095 2026] [:error] [pid 37540:tid 37619] [client 20.104.114.39:19316] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZzGWSahRAUBJS8hpJVaaAAAAJE"]
[Tue Feb 24 05:27:55.539100 2026] [:error] [pid 37540:tid 37602] [client 20.104.114.39:19397] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aZzGWyahRAUBJS8hpJVabQAAAIA"]
[Tue Feb 24 05:27:57.954430 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:19433] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZzGXSahRAUBJS8hpJVadwAAAI0"]
[Tue Feb 24 05:28:00.455163 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:19394] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZzGYCahRAUBJS8hpJVaewAAAIc"]
[Tue Feb 24 05:28:05.963119 2026] [:error] [pid 37539:tid 37576] [client 20.104.114.39:19325] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZzGZXEnr46jUQep9z_FGAAAAEE"]
[Tue Feb 24 05:28:06.975574 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:19427] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aZzGZkLaEhVDwBRydH04wQAAAMg"]
[Tue Feb 24 05:28:11.547797 2026] [:error] [pid 37644:tid 37647] [client 20.104.114.39:19447] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZzGa0LaEhVDwBRydH041QAAAME"]
[Tue Feb 24 05:28:15.150696 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:19308] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZzGb0LaEhVDwBRydH043QAAANQ"]
[Tue Feb 24 05:28:17.318024 2026] [:error] [pid 37538:tid 37569] [client 20.104.114.39:19148] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZzGcSynTiHZ9J0Y2nZfWQAAABU"]
[Tue Feb 24 05:28:21.485454 2026] [:error] [pid 11672:tid 11682] [client 20.104.114.39:19322] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aZzGdfa0fhnmfPYq92uWngAAAQg"]
[Tue Feb 24 05:28:23.368769 2026] [:error] [pid 37644:tid 37648] [client 20.104.114.39:19313] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZzGd0LaEhVDwBRydH05IQAAAMI"]
[Tue Feb 24 05:28:24.988726 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:19284] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aZzGeCahRAUBJS8hpJVajAAAAJQ"]
[Tue Feb 24 05:28:25.986923 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:19203] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aZzGeSahRAUBJS8hpJVajwAAAIM"]
[Tue Feb 24 05:28:26.680282 2026] [:error] [pid 37540:tid 37607] [client 20.104.114.39:19202] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aZzGeiahRAUBJS8hpJVakgAAAIU"]
[Tue Feb 24 05:28:27.564455 2026] [:error] [pid 11672:tid 11683] [client 20.104.114.39:19374] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZzGe_a0fhnmfPYq92uWowAAAQk"]
[Tue Feb 24 05:28:30.122697 2026] [:error] [pid 37538:tid 37549] [client 20.104.114.39:19224] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZzGfiynTiHZ9J0Y2nZfYQAAAAE"]
[Tue Feb 24 05:28:32.582492 2026] [:error] [pid 37644:tid 37661] [client 20.104.114.39:19384] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZzGgELaEhVDwBRydH05KAAAAM8"]
[Tue Feb 24 05:28:34.245479 2026] [:error] [pid 37538:tid 37557] [client 20.104.114.39:19417] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZzGgiynTiHZ9J0Y2nZfYwAAAAk"]
[Tue Feb 24 05:28:36.462757 2026] [:error] [pid 11672:tid 11689] [client 20.104.114.39:19390] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aZzGhPa0fhnmfPYq92uWqgAAAQ8"]
[Tue Feb 24 05:28:37.603928 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:19432] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aZzGhSahRAUBJS8hpJVaogAAAJQ"]
[Tue Feb 24 05:28:39.945704 2026] [:error] [pid 37644:tid 37652] [client 20.104.114.39:19423] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aZzGh0LaEhVDwBRydH05MQAAAMY"]
[Tue Feb 24 05:28:44.247779 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:19218] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Feb 24 05:28:44.629114 2026] [:error] [pid 37644:tid 37652] [client 20.104.114.39:19218] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Tue Feb 24 05:28:45.582183 2026] [:error] [pid 37644:tid 37667] [client 20.104.114.39:19218] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZzGjULaEhVDwBRydH05QwAAANU"]
[Tue Feb 24 05:28:46.535945 2026] [:error] [pid 37539:tid 37576] [client 20.104.114.39:19422] [client 20.104.114.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aZzGjnEnr46jUQep9z_FagAAAEE"]
[Tue Feb 24 05:28:48.039081 2026] [:error] [pid 37540:tid 37620] [client 20.104.114.39:19328] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Feb 24 05:28:48.265707 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:19328] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Feb 24 05:28:48.499346 2026] [:error] [pid 37540:tid 37621] [client 20.104.114.39:19328] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Tue Feb 24 05:28:48.719233 2026] [:error] [pid 37540:tid 37614] [client 20.104.114.39:19328] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Tue Feb 24 05:28:48.937633 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:19328] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZzGkCahRAUBJS8hpJVavgAAAIM"]
[Tue Feb 24 05:28:50.662421 2026] [:error] [pid 37644:tid 37655] [client 20.104.114.39:19329] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZzGkkLaEhVDwBRydH05SAAAAMk"]
[Tue Feb 24 05:28:52.304087 2026] [:error] [pid 11672:tid 11675] [client 20.104.114.39:19400] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZzGlPa0fhnmfPYq92uWvgAAAQE"]
[Tue Feb 24 05:28:53.437074 2026] [:error] [pid 11672:tid 11696] [client 20.104.114.39:19348] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "aZzGlfa0fhnmfPYq92uWwQAAARY"]
[Tue Feb 24 05:28:55.268191 2026] [:error] [pid 37644:tid 37647] [client 20.104.114.39:19451] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aZzGl0LaEhVDwBRydH05TAAAAME"]
[Tue Feb 24 05:28:57.170472 2026] [:error] [pid 11672:tid 11689] [client 20.104.114.39:19292] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aZzGmfa0fhnmfPYq92uWxQAAAQ8"]
[Tue Feb 24 05:28:58.587105 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:19208] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aZzGmkLaEhVDwBRydH05VAAAAMo"]
[Tue Feb 24 05:29:00.490284 2026] [:error] [pid 37540:tid 37611] [client 20.104.114.39:19399] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "aZzGnCahRAUBJS8hpJVaxwAAAIk"]
[Tue Feb 24 05:29:01.620640 2026] [:error] [pid 11672:tid 11681] [client 20.104.114.39:19368] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZzGnfa0fhnmfPYq92uWzwAAAQc"]
[Tue Feb 24 05:29:03.905585 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:19347] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZzGnyahRAUBJS8hpJVazQAAAJc"]
[Tue Feb 24 05:29:05.761057 2026] [:error] [pid 11672:tid 11677] [client 20.104.114.39:19364] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZzGofa0fhnmfPYq92uW1QAAAQM"]
[Tue Feb 24 05:29:06.879238 2026] [:error] [pid 37540:tid 37621] [client 20.104.114.39:19405] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "aZzGoiahRAUBJS8hpJVa1AAAAJM"]
[Tue Feb 24 05:29:08.094049 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:19441] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZzGpCahRAUBJS8hpJVa1gAAAIc"]
[Tue Feb 24 05:29:09.109822 2026] [:error] [pid 37538:tid 37568] [client 20.104.114.39:19408] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZzGpSynTiHZ9J0Y2nZfdQAAABQ"]
[Tue Feb 24 05:29:10.045657 2026] [:error] [pid 37540:tid 37618] [client 20.104.114.39:19393] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZzGpiahRAUBJS8hpJVa2gAAAJA"]
[Tue Feb 24 05:29:10.977282 2026] [:error] [pid 37644:tid 37668] [client 20.104.114.39:19450] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "aZzGpkLaEhVDwBRydH05WwAAANY"]
[Tue Feb 24 05:29:12.176691 2026] [:error] [pid 37644:tid 37661] [client 20.104.114.39:19353] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aZzGqELaEhVDwBRydH05XgAAAM8"]
[Tue Feb 24 05:29:13.289793 2026] [:error] [pid 37644:tid 37655] [client 20.104.114.39:19392] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aZzGqULaEhVDwBRydH05YQAAAMk"]
[Tue Feb 24 05:29:14.403881 2026] [:error] [pid 37539:tid 37586] [client 20.104.114.39:19410] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aZzGqnEnr46jUQep9z_FcAAAAEs"]
[Tue Feb 24 05:29:16.206749 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:19406] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "aZzGrELaEhVDwBRydH05YgAAAMg"]
[Tue Feb 24 05:29:20.033970 2026] [:error] [pid 11672:tid 11695] [client 20.104.114.39:19311] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aZzGsPa0fhnmfPYq92uW4AAAARU"]
[Tue Feb 24 05:29:20.836570 2026] [:error] [pid 37644:tid 37660] [client 20.104.114.39:19344] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aZzGsELaEhVDwBRydH05aQAAAM4"]
[Tue Feb 24 05:29:23.021202 2026] [:error] [pid 11672:tid 11682] [client 20.104.114.39:19420] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aZzGs_a0fhnmfPYq92uW5QAAAQg"]
[Tue Feb 24 05:29:23.925837 2026] [:error] [pid 11672:tid 11678] [client 20.104.114.39:19230] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "aZzGs_a0fhnmfPYq92uW6AAAAQQ"]
[Tue Feb 24 05:29:26.471808 2026] [:error] [pid 37644:tid 37651] [client 20.104.114.39:19274] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aZzGtkLaEhVDwBRydH05dgAAAMU"]
[Tue Feb 24 05:29:27.915890 2026] [:error] [pid 37644:tid 37666] [client 20.104.114.39:19335] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aZzGt0LaEhVDwBRydH05ewAAANQ"]
[Tue Feb 24 05:29:29.584003 2026] [:error] [pid 37644:tid 37664] [client 20.104.114.39:19404] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aZzGuULaEhVDwBRydH05fgAAANI"]
[Tue Feb 24 05:29:30.479415 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:19351] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "aZzGukLaEhVDwBRydH05ggAAAMg"]
[Tue Feb 24 05:29:32.924832 2026] [:error] [pid 37644:tid 37662] [client 20.104.114.39:19414] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aZzGvELaEhVDwBRydH05hQAAANA"]
[Tue Feb 24 05:29:33.679326 2026] [:error] [pid 37644:tid 37650] [client 20.104.114.39:19254] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aZzGvULaEhVDwBRydH05hwAAAMQ"]
[Tue Feb 24 05:29:34.906925 2026] [:error] [pid 37539:tid 37579] [client 20.104.114.39:19449] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aZzGvnEnr46jUQep9z_FhwAAAEQ"]
[Tue Feb 24 05:29:36.359559 2026] [:error] [pid 37540:tid 37603] [client 20.104.114.39:19343] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aZzGwCahRAUBJS8hpJVa-AAAAIE"]
[Tue Feb 24 05:29:38.202870 2026] [:error] [pid 37644:tid 37660] [client 20.104.114.39:19376] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aZzGwkLaEhVDwBRydH05jQAAAM4"]
[Tue Feb 24 05:29:39.639343 2026] [:error] [pid 11672:tid 11698] [client 20.104.114.39:19402] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aZzGw_a0fhnmfPYq92uXDAAAARg"]
[Tue Feb 24 05:29:42.133100 2026] [:error] [pid 11672:tid 11692] [client 20.104.114.39:19222] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aZzGxva0fhnmfPYq92uXDgAAARI"]
[Tue Feb 24 05:29:43.096303 2026] [:error] [pid 11672:tid 11695] [client 20.104.114.39:19454] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aZzGx_a0fhnmfPYq92uXEgAAARU"]
[Tue Feb 24 05:29:44.769227 2026] [:error] [pid 37538:tid 37571] [client 20.104.114.39:19443] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aZzGyCynTiHZ9J0Y2nZfigAAABc"]
[Tue Feb 24 05:29:45.999949 2026] [:error] [pid 37539:tid 37597] [client 20.104.114.39:19331] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "aZzGyXEnr46jUQep9z_FkwAAAFY"]
[Tue Feb 24 05:29:49.257870 2026] [:error] [pid 37539:tid 37597] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Tue Feb 24 05:29:49.474450 2026] [:error] [pid 37539:tid 37584] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/2clas.php
[Tue Feb 24 05:29:49.697935 2026] [:error] [pid 37539:tid 37594] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/ave.php
[Tue Feb 24 05:29:49.916667 2026] [:error] [pid 37539:tid 37576] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Tue Feb 24 05:29:50.137102 2026] [:error] [pid 37539:tid 37598] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/bibil.php
[Tue Feb 24 05:29:50.370162 2026] [:error] [pid 37539:tid 37579] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Feb 24 05:29:50.599993 2026] [:error] [pid 37539:tid 37590] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Tue Feb 24 05:29:50.825773 2026] [:error] [pid 37539:tid 37596] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/file7.php
[Tue Feb 24 05:29:51.056606 2026] [:error] [pid 37539:tid 37588] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Feb 24 05:29:51.510141 2026] [:error] [pid 37539:tid 37582] [client 20.104.114.39:19415] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Tue Feb 24 05:29:51.725115 2026] [:error] [pid 37539:tid 37577] [client 20.104.114.39:19415] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZzGz3Enr46jUQep9z_FtQAAAEI"]
[Tue Feb 24 05:29:52.913701 2026] [:error] [pid 37539:tid 37599] [client 20.104.114.39:19207] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZzG0HEnr46jUQep9z_FtgAAAFg"]
[Tue Feb 24 05:29:54.960708 2026] [:error] [pid 37539:tid 37585] [client 20.104.114.39:19291] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZzG0nEnr46jUQep9z_FuAAAAEo"]
[Tue Feb 24 05:29:56.725177 2026] [:error] [pid 37644:tid 37660] [client 20.104.114.39:19350] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aZzG1ELaEhVDwBRydH05pAAAAM4"]
[Tue Feb 24 05:29:57.550756 2026] [:error] [pid 37644:tid 37670] [client 20.104.114.39:19340] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZzG1ULaEhVDwBRydH05pQAAANg"]
[Tue Feb 24 05:29:59.465712 2026] [:error] [pid 11672:tid 11686] [client 20.104.114.39:19264] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZzG1_a0fhnmfPYq92uXRQAAAQw"]
[Tue Feb 24 05:30:02.673742 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:19342] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZzG2iahRAUBJS8hpJVbLAAAAI0"]
[Tue Feb 24 05:30:06.269659 2026] [:error] [pid 11672:tid 11677] [client 20.104.114.39:19409] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aZzG3va0fhnmfPYq92uXUAAAAQM"]
[Tue Feb 24 05:30:08.957370 2026] [:error] [pid 37539:tid 37593] [client 20.104.114.39:19429] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZzG4HEnr46jUQep9z_FxQAAAFI"]
[Tue Feb 24 05:30:12.108541 2026] [:error] [pid 37539:tid 37598] [client 20.104.114.39:19293] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZzG5HEnr46jUQep9z_FxwAAAFc"]
[Tue Feb 24 05:30:14.190820 2026] [:error] [pid 37644:tid 37664] [client 20.104.114.39:19341] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZzG5kLaEhVDwBRydH05qgAAANI"]
[Tue Feb 24 05:30:16.439646 2026] [:error] [pid 37644:tid 37665] [client 20.104.114.39:19363] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "aZzG6ELaEhVDwBRydH05sAAAANM"]
[Tue Feb 24 05:30:19.923139 2026] [:error] [pid 37644:tid 37665] [client 20.104.114.39:19234] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZzG60LaEhVDwBRydH05uwAAANM"]
[Tue Feb 24 05:30:21.522277 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:19391] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZzG7ULaEhVDwBRydH05vgAAAMg"]
[Tue Feb 24 05:30:25.031476 2026] [:error] [pid 37644:tid 37649] [client 20.104.114.39:19337] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZzG8ULaEhVDwBRydH05zQAAAMM"]
[Tue Feb 24 05:30:27.188027 2026] [:error] [pid 37644:tid 37663] [client 20.104.114.39:19446] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "aZzG80LaEhVDwBRydH050AAAANE"]
[Tue Feb 24 05:30:28.696903 2026] [:error] [pid 37539:tid 37578] [client 20.104.114.39:19201] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZzG9HEnr46jUQep9z_F0QAAAEM"]
[Tue Feb 24 05:30:30.128674 2026] [:error] [pid 37644:tid 37657] [client 20.104.114.39:19330] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZzG9kLaEhVDwBRydH054AAAAMs"]
[Tue Feb 24 05:30:33.085277 2026] [:error] [pid 37644:tid 37651] [client 20.104.114.39:19418] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZzG-ULaEhVDwBRydH055QAAAMU"]
[Tue Feb 24 05:30:34.277572 2026] [:error] [pid 37644:tid 37649] [client 20.104.114.39:19301] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "aZzG-kLaEhVDwBRydH056AAAAMM"]
[Tue Feb 24 05:30:36.537744 2026] [:error] [pid 37540:tid 37609] [client 20.104.114.39:19299] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZzG_CahRAUBJS8hpJVbRgAAAIc"]
[Tue Feb 24 05:30:38.401056 2026] [:error] [pid 37644:tid 37651] [client 20.104.114.39:19309] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZzG_kLaEhVDwBRydH059AAAAMU"]
[Tue Feb 24 05:30:40.134981 2026] [:error] [pid 11672:tid 11675] [client 20.104.114.39:19453] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZzHAPa0fhnmfPYq92uXgAAAAQE"]
[Tue Feb 24 05:30:42.687741 2026] [:error] [pid 37539:tid 37596] [client 20.104.114.39:19145] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "aZzHAnEnr46jUQep9z_F1gAAAFU"]
[Tue Feb 24 05:30:45.368638 2026] [:error] [pid 37644:tid 37663] [client 20.104.114.39:19271] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aZzHBULaEhVDwBRydH06BQAAANE"]
[Tue Feb 24 05:30:48.894492 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:19251] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "aZzHCCahRAUBJS8hpJVbVwAAAIM"]
[Tue Feb 24 05:30:51.884374 2026] [:error] [pid 11672:tid 11677] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Tue Feb 24 05:30:52.100647 2026] [:error] [pid 11672:tid 11679] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Tue Feb 24 05:30:52.332281 2026] [:error] [pid 11672:tid 11691] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Tue Feb 24 05:30:52.574559 2026] [:error] [pid 11672:tid 11689] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Tue Feb 24 05:30:52.789466 2026] [:error] [pid 11672:tid 11681] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Tue Feb 24 05:30:53.035255 2026] [:error] [pid 11672:tid 11696] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Tue Feb 24 05:30:53.597854 2026] [:error] [pid 11672:tid 11692] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Tue Feb 24 05:30:53.811090 2026] [:error] [pid 11672:tid 11676] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Tue Feb 24 05:30:54.023534 2026] [:error] [pid 11672:tid 11688] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Tue Feb 24 05:30:54.238142 2026] [:error] [pid 11672:tid 11680] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Tue Feb 24 05:30:54.456878 2026] [:error] [pid 11672:tid 11693] [client 20.104.114.39:19434] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Feb 24 05:30:54.666459 2026] [:error] [pid 11672:tid 11697] [client 20.104.114.39:19434] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aZzHDva0fhnmfPYq92uXpQAAARc"]
[Tue Feb 24 05:31:00.539083 2026] [:error] [pid 37540:tid 37605] [client 20.104.114.39:19439] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aZzHFCahRAUBJS8hpJVbYgAAAIM"]
[Tue Feb 24 05:31:03.452784 2026] [:error] [pid 37540:tid 37608] [client 20.104.114.39:19155] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aZzHFyahRAUBJS8hpJVbbAAAAIY"]
[Tue Feb 24 05:31:05.752318 2026] [:error] [pid 37539:tid 37579] [client 20.104.114.39:19205] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "aZzHGXEnr46jUQep9z_F6QAAAEQ"]
[Tue Feb 24 05:31:07.059377 2026] [:error] [pid 11672:tid 11690] [client 20.104.114.39:19438] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZzHG_a0fhnmfPYq92uXuQAAARA"]
[Tue Feb 24 05:31:09.479969 2026] [:error] [pid 37644:tid 37647] [client 20.104.114.39:19318] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZzHHULaEhVDwBRydH06KQAAAME"]
[Tue Feb 24 05:31:11.883097 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:19424] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZzHHyahRAUBJS8hpJVbcgAAAJQ"]
[Tue Feb 24 05:31:14.398719 2026] [:error] [pid 37538:tid 37563] [client 20.104.114.39:19383] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "aZzHIiynTiHZ9J0Y2nZfqAAAAA8"]
[Tue Feb 24 05:31:16.816254 2026] [:error] [pid 37644:tid 37654] [client 20.104.114.39:19375] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZzHJELaEhVDwBRydH06TQAAAMg"]
[Tue Feb 24 05:31:19.449696 2026] [:error] [pid 37540:tid 37615] [client 20.104.114.39:19332] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZzHJyahRAUBJS8hpJVbfAAAAI0"]
[Tue Feb 24 05:31:20.496901 2026] [:error] [pid 11672:tid 11679] [client 20.104.114.39:19419] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZzHKPa0fhnmfPYq92uXzgAAAQU"]
[Tue Feb 24 05:31:22.485110 2026] [:error] [pid 37538:tid 37570] [client 20.104.114.39:19386] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "aZzHKiynTiHZ9J0Y2nZfsQAAABY"]
[Tue Feb 24 05:31:23.975274 2026] [:error] [pid 37539:tid 37595] [client 20.104.114.39:19389] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZzHK3Enr46jUQep9z_F9AAAAFQ"]
[Tue Feb 24 05:31:25.622739 2026] [:error] [pid 37538:tid 37560] [client 20.104.114.39:19333] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZzHLSynTiHZ9J0Y2nZftwAAAAw"]
[Tue Feb 24 05:31:26.583908 2026] [:error] [pid 37538:tid 37561] [client 20.104.114.39:19339] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZzHLiynTiHZ9J0Y2nZfuQAAAA0"]
[Tue Feb 24 05:31:29.106657 2026] [:error] [pid 37644:tid 37667] [client 20.104.114.39:19346] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "aZzHMULaEhVDwBRydH06XQAAANU"]
[Tue Feb 24 05:31:29.802834 2026] [:error] [pid 37644:tid 37664] [client 20.104.114.39:19435] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZzHMULaEhVDwBRydH06XgAAANI"]
[Tue Feb 24 05:31:30.639875 2026] [:error] [pid 37644:tid 37656] [client 20.104.114.39:19239] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZzHMkLaEhVDwBRydH06YQAAAMo"]
[Tue Feb 24 05:31:32.192139 2026] [:error] [pid 37644:tid 37661] [client 20.104.114.39:19269] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZzHNELaEhVDwBRydH06ZAAAAM8"]
[Tue Feb 24 05:31:34.108649 2026] [:error] [pid 11672:tid 11679] [client 20.104.114.39:19327] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "aZzHNva0fhnmfPYq92uX2AAAAQU"]
[Tue Feb 24 05:31:35.273163 2026] [:error] [pid 37539:tid 37587] [client 20.104.114.39:19200] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZzHN3Enr46jUQep9z_F_QAAAEw"]
[Tue Feb 24 05:31:36.610647 2026] [:error] [pid 37540:tid 37625] [client 20.104.114.39:19421] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZzHOCahRAUBJS8hpJVbigAAAJc"]
[Tue Feb 24 05:31:37.953231 2026] [:error] [pid 37540:tid 37622] [client 20.104.114.39:19141] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZzHOSahRAUBJS8hpJVbjwAAAJQ"]
[Tue Feb 24 05:31:39.353877 2026] [:error] [pid 37538:tid 37571] [client 20.104.114.39:19297] [client 20.104.114.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aZzHOyynTiHZ9J0Y2nZfxgAAABc"]
[Tue Feb 24 07:43:44.389876 2026] [:error] [pid 37540:tid 37620] [client 43.131.243.61:46044] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZzmMCahRAUBJS8hpJWODAAAAJI"]
[Tue Feb 24 10:13:04.739918 2026] [:error] [pid 37644:tid 37655] [client 49.51.180.2:56456] [client 49.51.180.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZ0JMELaEhVDwBRydH2bfQAAAMk"]
[Tue Feb 24 13:13:11.115269 2026] [:error] [pid 34175:tid 34188] [client 43.164.197.224:44558] [client 43.164.197.224] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ0zZ3NLnkJcHQ-bNtVyxgAAAYs"]
[Tue Feb 24 18:34:00.890066 2026] [:error] [pid 34839:tid 34855] [client 43.135.133.194:41466] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ1-mGLpm0-tb2ey61HRsQAAAA4"]
[Tue Feb 24 19:29:41.780352 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Feb 24 19:29:42.009138 2026] [:error] [pid 34750:tid 34788] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Feb 24 19:29:42.237811 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Feb 24 19:29:42.469554 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Feb 24 19:29:42.714204 2026] [:error] [pid 34750:tid 34800] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Feb 24 19:29:42.945833 2026] [:error] [pid 34750:tid 34789] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Feb 24 19:29:43.173825 2026] [:error] [pid 34750:tid 34794] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Feb 24 19:29:43.402366 2026] [:error] [pid 34750:tid 34790] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Feb 24 19:29:43.867498 2026] [:error] [pid 34750:tid 34802] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Feb 24 19:29:44.357595 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Feb 24 19:29:44.590770 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Feb 24 19:29:44.819853 2026] [:error] [pid 34750:tid 34786] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Feb 24 19:29:45.048053 2026] [:error] [pid 34750:tid 34792] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Feb 24 19:29:45.283004 2026] [:error] [pid 34750:tid 34794] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Feb 24 19:29:45.511923 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Feb 24 19:29:45.741112 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Feb 24 19:29:45.988167 2026] [:error] [pid 34750:tid 34799] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Feb 24 19:29:46.223331 2026] [:error] [pid 34750:tid 34782] [client 45.132.224.2:42201] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Feb 24 19:29:49.479203 2026] [:error] [pid 34750:tid 34786] [client 45.132.224.2:42201] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aZ2LreaZ-Iv_wvbRkKIQ6AAAAUU"]
[Tue Feb 24 19:29:50.655271 2026] [:error] [pid 34839:tid 34846] [client 45.132.224.39:52165] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aZ2LrmLpm0-tb2ey61HoqwAAAAU"]
[Tue Feb 24 19:29:51.826682 2026] [:error] [pid 34750:tid 34791] [client 45.132.224.42:26163] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Feb 24 19:29:52.513028 2026] [:error] [pid 34750:tid 34782] [client 45.132.224.42:26163] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aZ2LsOaZ-Iv_wvbRkKIQ8gAAAUE"]
[Tue Feb 24 19:29:53.439227 2026] [:error] [pid 34750:tid 34786] [client 45.132.224.52:60437] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Feb 24 19:29:53.677433 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.52:60437] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aZ2LseaZ-Iv_wvbRkKIQ-wAAAUY"]
[Tue Feb 24 19:29:54.372458 2026] [:error] [pid 34750:tid 34792] [client 45.132.224.7:45371] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Feb 24 19:29:55.518119 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.7:45371] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aZ2Ls-aZ-Iv_wvbRkKIRDgAAAUY"]
[Tue Feb 24 19:29:56.209133 2026] [:error] [pid 37873:tid 37888] [client 45.132.224.43:63729] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aZ2LtE625ION6Syu4d41gwAAAM0"]
[Tue Feb 24 19:29:56.660522 2026] [:error] [pid 34750:tid 34783] [client 45.132.224.48:60517] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aZ2LtOaZ-Iv_wvbRkKIRGAAAAUI"]
[Tue Feb 24 19:29:57.155619 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.25:54153] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aZ2LteaZ-Iv_wvbRkKIRHQAAAVE"]
[Tue Feb 24 19:29:57.621203 2026] [:error] [pid 34749:tid 34757] [client 45.132.224.12:22103] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aZ2LtYDERuV6HM3T9KnIpwAAAEM"]
[Tue Feb 24 19:29:58.073775 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.40:37949] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aZ2LtuaZ-Iv_wvbRkKIRIwAAAVY"]
[Tue Feb 24 19:29:58.758484 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.52:60001] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aZ2LtuaZ-Iv_wvbRkKIRJgAAAVQ"]
[Tue Feb 24 19:29:59.217479 2026] [:error] [pid 34750:tid 34788] [client 45.132.224.49:26575] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Feb 24 19:29:59.678297 2026] [:error] [pid 34750:tid 34800] [client 45.132.224.49:26575] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aZ2Lt-aZ-Iv_wvbRkKIRKQAAAVM"]
[Tue Feb 24 19:30:00.594512 2026] [:error] [pid 34750:tid 34796] [client 45.132.224.23:41483] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aZ2LuOaZ-Iv_wvbRkKIRLgAAAU8"]
[Tue Feb 24 19:30:01.373760 2026] [:error] [pid 34749:tid 34776] [client 45.132.224.32:44535] [client 45.132.224.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aZ2LuYDERuV6HM3T9KnIqwAAAFY"]
[Tue Feb 24 19:30:04.304971 2026] [:error] [pid 34750:tid 34782] [client 45.132.224.25:35881] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Feb 24 19:30:04.543785 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.25:35881] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aZ2LvOaZ-Iv_wvbRkKIROAAAAUQ"]
[Tue Feb 24 19:30:05.031386 2026] [:error] [pid 34750:tid 34791] [client 45.132.224.34:42927] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Feb 24 19:30:05.724133 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.34:42927] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Feb 24 19:30:07.544097 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.34:42927] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aZ2Lv-aZ-Iv_wvbRkKIRSgAAAUY"]
[Tue Feb 24 19:30:08.004984 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.25:44261] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Feb 24 19:30:08.235841 2026] [:error] [pid 34750:tid 34805] [client 45.132.224.25:44261] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aZ2LwOaZ-Iv_wvbRkKIRTgAAAVg"]
[Tue Feb 24 19:30:08.696043 2026] [:error] [pid 34751:tid 34823] [client 45.132.224.44:38411] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Feb 24 19:30:09.155801 2026] [:error] [pid 34751:tid 34828] [client 45.132.224.44:38411] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aZ2Lwc7SW-lfeVKMPq8wvAAAAdQ"]
[Tue Feb 24 19:30:09.862555 2026] [:error] [pid 37095:tid 37120] [client 45.132.224.16:20557] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aZ2LwSX8qkGqxKHLt3uS6QAAAJc"]
[Tue Feb 24 19:30:10.556071 2026] [:error] [pid 34839:tid 34857] [client 45.132.224.30:50717] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue Feb 24 19:30:10.790009 2026] [:error] [pid 34839:tid 34846] [client 45.132.224.30:50717] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Feb 24 19:30:11.278427 2026] [:error] [pid 34839:tid 34861] [client 45.132.224.30:50717] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aZ2Lw2Lpm0-tb2ey61HoxAAAABQ"]
[Tue Feb 24 19:30:11.988184 2026] [:error] [pid 37873:tid 37894] [client 45.132.224.20:43949] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aZ2Lw0625ION6Syu4d41iQAAANM"]
[Tue Feb 24 19:30:12.677744 2026] [:error] [pid 34750:tid 34796] [client 45.132.224.4:59029] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aZ2LxOaZ-Iv_wvbRkKIRVAAAAU8"]
[Tue Feb 24 19:30:13.128267 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.5:49611] [client 45.132.224.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aZ2LxeaZ-Iv_wvbRkKIRVgAAAUY"]
[Tue Feb 24 19:30:13.581541 2026] [:error] [pid 34839:tid 34844] [client 45.132.224.34:34921] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZ2LxWLpm0-tb2ey61HoxwAAAAM"]
[Tue Feb 24 19:30:14.511090 2026] [:error] [pid 34839:tid 34856] [client 45.132.224.34:34647] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Feb 24 19:30:14.736697 2026] [:error] [pid 34839:tid 34863] [client 45.132.224.34:34647] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aZ2LxmLpm0-tb2ey61HozgAAABY"]
[Tue Feb 24 19:30:15.190882 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.10:48537] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aZ2Lx-aZ-Iv_wvbRkKIRWQAAAVE"]
[Tue Feb 24 19:30:15.644812 2026] [:error] [pid 34751:tid 34808] [client 45.132.224.20:56273] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZ2Lx87SW-lfeVKMPq8wxgAAAcA"]
[Tue Feb 24 19:30:17.228733 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.34:30073] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Feb 24 19:30:17.690529 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.34:30073] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Feb 24 19:30:18.603184 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.34:30073] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aZ2LyuaZ-Iv_wvbRkKIRZwAAAUM"]
[Tue Feb 24 19:30:19.770778 2026] [:error] [pid 34750:tid 34793] [client 45.132.224.34:21297] [client 45.132.224.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.34, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aZ2Ly-aZ-Iv_wvbRkKIRbAAAAUw"]
[Tue Feb 24 19:30:20.038934 2026] [:error] [pid 34750:tid 34791] [client 45.132.224.34:21297] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Feb 24 19:30:22.476982 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.34:21297] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Feb 24 19:30:22.708116 2026] [:error] [pid 34750:tid 34800] [client 45.132.224.34:21297] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Feb 24 19:30:23.846409 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.34:21297] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aZ2Lz-aZ-Iv_wvbRkKIRgQAAAUA"]
[Tue Feb 24 19:30:24.537224 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.26:56133] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Feb 24 19:30:24.764924 2026] [:error] [pid 34839:tid 34845] [client 45.132.224.26:56133] [client 45.132.224.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.26, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aZ2L0GLpm0-tb2ey61Ho3QAAAAQ"]
[Tue Feb 24 19:30:25.222605 2026] [:error] [pid 34839:tid 34865] [client 45.132.224.26:56133] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aZ2L0WLpm0-tb2ey61Ho4gAAABg"]
[Tue Feb 24 19:30:26.618473 2026] [:error] [pid 34750:tid 34790] [client 45.132.224.8:63351] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Feb 24 19:30:27.075276 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.8:63351] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Tue Feb 24 19:30:27.532176 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.8:63351] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aZ2L0-aZ-Iv_wvbRkKIRkQAAAVY"]
[Tue Feb 24 19:30:27.988057 2026] [:error] [pid 34839:tid 34857] [client 45.132.224.17:44413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Feb 24 19:30:28.674455 2026] [:error] [pid 34839:tid 34861] [client 45.132.224.17:44413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Tue Feb 24 19:30:29.131876 2026] [:error] [pid 34839:tid 34841] [client 45.132.224.17:44413] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue Feb 24 19:30:29.589299 2026] [:error] [pid 34839:tid 34845] [client 45.132.224.17:44413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Feb 24 19:30:29.816753 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.17:44413] [client 45.132.224.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aZ2L1WLpm0-tb2ey61Ho7AAAABE"]
[Tue Feb 24 19:30:30.276860 2026] [:error] [pid 34749:tid 34766] [client 45.132.224.47:61629] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Tue Feb 24 19:30:30.508096 2026] [:error] [pid 34749:tid 34756] [client 45.132.224.47:61629] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Feb 24 19:30:30.820706 2026] [:error] [pid 34749:tid 34760] [client 45.132.224.47:61629] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aZ2L1oDERuV6HM3T9KnI1AAAAEY"]
[Tue Feb 24 19:30:31.550128 2026] [:error] [pid 37873:tid 37876] [client 45.132.224.40:25509] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Feb 24 19:30:32.004300 2026] [:error] [pid 37873:tid 37887] [client 45.132.224.40:25509] [client 45.132.224.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.40, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aZ2L2E625ION6Syu4d41kgAAAMw"]
[Tue Feb 24 19:30:32.241498 2026] [:error] [pid 37873:tid 37893] [client 45.132.224.40:25509] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aZ2L2E625ION6Syu4d41kwAAANI"]
[Tue Feb 24 19:30:35.028446 2026] [:error] [pid 37873:tid 37876] [client 45.132.224.15:30669] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Tue Feb 24 19:30:36.418407 2026] [:error] [pid 37873:tid 37895] [client 45.132.224.15:30669] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Feb 24 19:30:36.652772 2026] [:error] [pid 37873:tid 37897] [client 45.132.224.15:30669] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aZ2L3E625ION6Syu4d41sgAAANY"]
[Tue Feb 24 19:30:37.118682 2026] [:error] [pid 34750:tid 34786] [client 45.132.224.49:44447] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Feb 24 19:30:37.814143 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.49:44447] [client 45.132.224.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.49, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aZ2L3eaZ-Iv_wvbRkKIRngAAAVY"]
[Tue Feb 24 19:30:38.046352 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.49:44447] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Feb 24 19:30:38.275882 2026] [:error] [pid 34750:tid 34794] [client 45.132.224.49:44447] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Feb 24 19:30:38.505931 2026] [:error] [pid 34750:tid 34797] [client 45.132.224.49:44447] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Tue Feb 24 19:30:38.732044 2026] [:error] [pid 34750:tid 34789] [client 45.132.224.49:44447] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aZ2L3uaZ-Iv_wvbRkKIRowAAAUg"]
[Tue Feb 24 19:30:39.194468 2026] [:error] [pid 37873:tid 37898] [client 45.132.224.2:28709] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Feb 24 19:30:39.419216 2026] [:error] [pid 37873:tid 37895] [client 45.132.224.2:28709] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aZ2L30625ION6Syu4d41ugAAANQ"]
[Tue Feb 24 19:30:40.171174 2026] [:error] [pid 37873:tid 37890] [client 45.132.224.27:52095] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Feb 24 19:30:41.444138 2026] [:error] [pid 37873:tid 37890] [client 45.132.224.27:52095] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aZ2L4U625ION6Syu4d41wgAAAM8"]
[Tue Feb 24 19:30:42.363336 2026] [:error] [pid 34839:tid 34862] [client 45.132.224.14:61133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Feb 24 19:30:42.588442 2026] [:error] [pid 34839:tid 34861] [client 45.132.224.14:61133] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aZ2L4mLpm0-tb2ey61HpAQAAABQ"]
[Tue Feb 24 19:30:43.041717 2026] [:error] [pid 37095:tid 37117] [client 45.132.224.33:32191] [client 45.132.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aZ2L4yX8qkGqxKHLt3uS9QAAAJQ"]
[Tue Feb 24 19:30:43.501035 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.27:36763] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue Feb 24 19:30:43.731967 2026] [:error] [pid 34750:tid 34792] [client 45.132.224.27:36763] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Tue Feb 24 19:30:44.648345 2026] [:error] [pid 34750:tid 34783] [client 45.132.224.27:36763] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aZ2L5OaZ-Iv_wvbRkKIRswAAAUI"]
[Tue Feb 24 19:30:45.335092 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.2:54771] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aZ2L5eaZ-Iv_wvbRkKIRuQAAAVY"]
[Tue Feb 24 19:30:46.488872 2026] [:error] [pid 34750:tid 34783] [client 45.132.224.6:28215] [client 45.132.224.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aZ2L5uaZ-Iv_wvbRkKIRwgAAAUI"]
[Tue Feb 24 19:30:46.941469 2026] [:error] [pid 34751:tid 34817] [client 45.132.224.45:25601] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Feb 24 19:30:47.406068 2026] [:error] [pid 34751:tid 34819] [client 45.132.224.45:25601] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Feb 24 19:30:47.631363 2026] [:error] [pid 34751:tid 34832] [client 45.132.224.45:25601] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aZ2L587SW-lfeVKMPq8w9QAAAdg"]
[Tue Feb 24 19:30:48.086880 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.22:53205] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Feb 24 19:30:48.546200 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.22:53205] [client 45.132.224.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "aZ2L6OaZ-Iv_wvbRkKIRzAAAAUQ"]
[Tue Feb 24 19:30:49.691468 2026] [:error] [pid 34751:tid 34827] [client 45.132.224.8:22459] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aZ2L6c7SW-lfeVKMPq8xAgAAAdM"]
[Tue Feb 24 19:30:50.389146 2026] [:error] [pid 34839:tid 34845] [client 45.132.224.15:50931] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Feb 24 19:30:51.075655 2026] [:error] [pid 34839:tid 34842] [client 45.132.224.15:50931] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Feb 24 19:30:51.534550 2026] [:error] [pid 34839:tid 34852] [client 45.132.224.15:50931] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Feb 24 19:30:51.761365 2026] [:error] [pid 34839:tid 34862] [client 45.132.224.15:50931] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aZ2L62Lpm0-tb2ey61HpEAAAABU"]
[Tue Feb 24 19:30:52.213693 2026] [:error] [pid 34750:tid 34793] [client 45.132.224.50:51719] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aZ2L7OaZ-Iv_wvbRkKIR1QAAAUw"]
[Tue Feb 24 19:30:52.665134 2026] [:error] [pid 34751:tid 34816] [client 45.132.224.16:50973] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aZ2L7M7SW-lfeVKMPq8xCgAAAcg"]
[Tue Feb 24 19:30:53.121457 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.2:37225] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aZ2L7WLpm0-tb2ey61HpEQAAAAY"]
[Tue Feb 24 19:30:53.585089 2026] [:error] [pid 34750:tid 34790] [client 45.132.224.46:56799] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Tue Feb 24 19:30:53.814941 2026] [:error] [pid 34750:tid 34802] [client 45.132.224.46:56799] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aZ2L7eaZ-Iv_wvbRkKIR3QAAAVU"]
[Tue Feb 24 19:30:54.266445 2026] [:error] [pid 34839:tid 34854] [client 45.132.224.52:47995] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aZ2L7mLpm0-tb2ey61HpFAAAAA0"]
[Tue Feb 24 19:30:54.732978 2026] [:error] [pid 37873:tid 37899] [client 45.132.224.6:60127] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Feb 24 19:30:55.186744 2026] [:error] [pid 37873:tid 37876] [client 45.132.224.6:60127] [client 45.132.224.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aZ2L70625ION6Syu4d41yAAAAME"]
[Tue Feb 24 19:30:55.638249 2026] [:error] [pid 34839:tid 34855] [client 45.132.224.43:30699] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aZ2L72Lpm0-tb2ey61HpGAAAAA4"]
[Tue Feb 24 19:30:56.094858 2026] [:error] [pid 34839:tid 34857] [client 45.132.224.27:58115] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aZ2L8GLpm0-tb2ey61HpGwAAABA"]
[Tue Feb 24 19:30:56.545510 2026] [:error] [pid 34750:tid 34793] [client 45.132.224.42:53147] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aZ2L8OaZ-Iv_wvbRkKIR4QAAAUw"]
[Tue Feb 24 19:30:57.233174 2026] [:error] [pid 34751:tid 34817] [client 45.132.224.16:58741] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aZ2L8c7SW-lfeVKMPq8xDwAAAck"]
[Tue Feb 24 19:30:58.146625 2026] [:error] [pid 34751:tid 34826] [client 45.132.224.42:36727] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aZ2L8s7SW-lfeVKMPq8xEgAAAdI"]
[Tue Feb 24 19:30:58.601686 2026] [:error] [pid 34751:tid 34818] [client 45.132.224.7:26355] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue Feb 24 19:30:59.290875 2026] [:error] [pid 34751:tid 34831] [client 45.132.224.7:26355] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue Feb 24 19:30:59.521144 2026] [:error] [pid 34751:tid 34815] [client 45.132.224.7:26355] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aZ2L887SW-lfeVKMPq8xGAAAAcc"]
[Tue Feb 24 19:31:00.210610 2026] [:error] [pid 34839:tid 34861] [client 45.132.224.30:27395] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Feb 24 19:31:00.441046 2026] [:error] [pid 34839:tid 34863] [client 45.132.224.30:27395] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Feb 24 19:31:02.957345 2026] [:error] [pid 34839:tid 34851] [client 45.132.224.30:27395] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aZ2L9mLpm0-tb2ey61HpNQAAAAo"]
[Tue Feb 24 19:31:04.098670 2026] [:error] [pid 34749:tid 34777] [client 45.132.224.50:64703] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aZ2L-IDERuV6HM3T9KnI5QAAAFc"]
[Tue Feb 24 19:31:04.548810 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.47:59145] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aZ2L-OaZ-Iv_wvbRkKIR7QAAAUM"]
[Tue Feb 24 19:31:05.917763 2026] [:error] [pid 37873:tid 37898] [client 45.132.224.20:60983] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZ2L-U625ION6Syu4d411AAAANc"]
[Tue Feb 24 19:31:06.840849 2026] [:error] [pid 34839:tid 34846] [client 45.132.224.41:28197] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Feb 24 19:31:07.070625 2026] [:error] [pid 34839:tid 34860] [client 45.132.224.41:28197] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Tue Feb 24 19:31:07.301152 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.41:28197] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Tue Feb 24 19:31:07.529522 2026] [:error] [pid 34839:tid 34851] [client 45.132.224.41:28197] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Tue Feb 24 19:31:08.674637 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.41:28197] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZ2L_GLpm0-tb2ey61HpSgAAAAY"]
[Tue Feb 24 19:31:09.129418 2026] [:error] [pid 34750:tid 34782] [client 45.132.224.42:32279] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aZ2L_eaZ-Iv_wvbRkKIR8AAAAUE"]
[Tue Feb 24 19:31:09.580665 2026] [:error] [pid 34750:tid 34802] [client 45.132.224.37:24837] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aZ2L_eaZ-Iv_wvbRkKIR8wAAAVU"]
[Tue Feb 24 19:31:10.031143 2026] [:error] [pid 34751:tid 34826] [client 45.132.224.7:42265] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aZ2L_s7SW-lfeVKMPq8xHwAAAdI"]
[Tue Feb 24 19:31:10.488981 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.39:60165] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aZ2L_uaZ-Iv_wvbRkKIR9QAAAVQ"]
[Tue Feb 24 19:31:10.939885 2026] [:error] [pid 34751:tid 34815] [client 45.132.224.48:48497] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aZ2L_s7SW-lfeVKMPq8xJQAAAcc"]
[Tue Feb 24 19:31:11.621767 2026] [:error] [pid 37873:tid 37885] [client 45.132.224.49:22923] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aZ2L_0625ION6Syu4d412gAAAMo"]
[Tue Feb 24 19:31:12.093426 2026] [:error] [pid 34839:tid 34859] [client 45.132.224.4:63233] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aZ2MAGLpm0-tb2ey61HpTAAAABI"]
[Tue Feb 24 19:31:12.547228 2026] [:error] [pid 34750:tid 34790] [client 45.132.224.38:41069] [client 45.132.224.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aZ2MAOaZ-Iv_wvbRkKIR_AAAAUk"]
[Tue Feb 24 19:31:12.997798 2026] [:error] [pid 34750:tid 34799] [client 45.132.224.8:47905] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aZ2MAOaZ-Iv_wvbRkKISAQAAAVI"]
[Tue Feb 24 19:31:13.930344 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.14:64041] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aZ2MAeaZ-Iv_wvbRkKISDAAAAUY"]
[Tue Feb 24 19:31:14.670462 2026] [:error] [pid 34750:tid 34803] [client 45.132.224.15:32769] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aZ2MAuaZ-Iv_wvbRkKISFwAAAVY"]
[Tue Feb 24 19:31:15.150035 2026] [:error] [pid 34750:tid 34802] [client 45.132.224.19:35681] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Feb 24 19:31:15.604906 2026] [:error] [pid 34750:tid 34793] [client 45.132.224.19:35681] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aZ2MA-aZ-Iv_wvbRkKISIwAAAUw"]
[Tue Feb 24 19:31:16.527990 2026] [:error] [pid 34839:tid 34855] [client 45.132.224.35:55777] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aZ2MBGLpm0-tb2ey61HpUAAAAA4"]
[Tue Feb 24 19:31:17.455463 2026] [:error] [pid 34750:tid 34791] [client 45.132.224.34:28817] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Feb 24 19:31:17.680771 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.34:28817] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aZ2MBeaZ-Iv_wvbRkKISOAAAAVE"]
[Tue Feb 24 19:31:18.379688 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.22:41289] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Feb 24 19:31:18.608731 2026] [:error] [pid 34750:tid 34789] [client 45.132.224.22:41289] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Tue Feb 24 19:31:18.838528 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.22:41289] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Feb 24 19:31:19.065934 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.22:41289] [client 45.132.224.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aZ2MB-aZ-Iv_wvbRkKISSAAAAVE"]
[Tue Feb 24 19:31:19.520767 2026] [:error] [pid 34750:tid 34802] [client 45.132.224.12:60449] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Feb 24 19:31:19.745441 2026] [:error] [pid 34750:tid 34789] [client 45.132.224.12:60449] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aZ2MB-aZ-Iv_wvbRkKISTgAAAUg"]
[Tue Feb 24 19:31:20.715711 2026] [:error] [pid 34839:tid 34862] [client 45.132.224.25:43455] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Feb 24 19:31:20.945871 2026] [:error] [pid 34839:tid 34865] [client 45.132.224.25:43455] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Feb 24 19:31:21.174704 2026] [:error] [pid 34839:tid 34843] [client 45.132.224.25:43455] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Tue Feb 24 19:31:22.327733 2026] [:error] [pid 34839:tid 34850] [client 45.132.224.25:43455] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Feb 24 19:31:22.559250 2026] [:error] [pid 34839:tid 34853] [client 45.132.224.25:43455] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Tue Feb 24 19:31:23.015725 2026] [:error] [pid 34839:tid 34854] [client 45.132.224.25:43455] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Tue Feb 24 19:31:23.712094 2026] [:error] [pid 34839:tid 34845] [client 45.132.224.25:43455] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Feb 24 19:31:23.937195 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.25:43455] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aZ2MC2Lpm0-tb2ey61HpdQAAABE"]
[Tue Feb 24 19:31:24.393490 2026] [:error] [pid 37873:tid 37886] [client 45.132.224.34:53511] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aZ2MDE625ION6Syu4d413gAAAMs"]
[Tue Feb 24 19:31:24.844333 2026] [:error] [pid 34839:tid 34862] [client 45.132.224.12:64081] [client 45.132.224.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.12, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aZ2MDGLpm0-tb2ey61HpeAAAABU"]
[Tue Feb 24 19:31:24.847880 2026] [:error] [pid 34839:tid 34862] [client 45.132.224.12:64081] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Feb 24 19:31:25.080181 2026] [:error] [pid 34839:tid 34861] [client 45.132.224.12:64081] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Tue Feb 24 19:31:25.307314 2026] [:error] [pid 34839:tid 34849] [client 45.132.224.12:64081] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aZ2MDWLpm0-tb2ey61HpewAAAAg"]
[Tue Feb 24 19:31:26.002158 2026] [:error] [pid 34839:tid 34859] [client 45.132.224.22:56245] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Feb 24 19:31:26.228348 2026] [:error] [pid 34839:tid 34864] [client 45.132.224.22:56245] [client 45.132.224.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aZ2MDmLpm0-tb2ey61HpgQAAABc"]
[Tue Feb 24 19:31:26.702723 2026] [:error] [pid 34839:tid 34855] [client 45.132.224.49:56667] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aZ2MDmLpm0-tb2ey61HpgwAAAA4"]
[Tue Feb 24 19:31:29.350023 2026] [:error] [pid 34839:tid 34859] [client 45.132.224.12:29839] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aZ2MEWLpm0-tb2ey61HpiwAAABI"]
[Tue Feb 24 19:31:29.806779 2026] [:error] [pid 34751:tid 34828] [client 45.132.224.46:27347] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aZ2MEc7SW-lfeVKMPq8xUQAAAdQ"]
[Tue Feb 24 19:31:31.012579 2026] [:error] [pid 34751:tid 34818] [client 45.132.224.52:26139] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Feb 24 19:31:31.471012 2026] [:error] [pid 34751:tid 34816] [client 45.132.224.52:26139] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aZ2ME87SW-lfeVKMPq8xWAAAAcg"]
[Tue Feb 24 19:31:32.406172 2026] [:error] [pid 34751:tid 34828] [client 45.132.224.26:42577] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Tue Feb 24 19:31:32.889983 2026] [:error] [pid 34751:tid 34826] [client 45.132.224.26:42577] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aZ2MFM7SW-lfeVKMPq8xYgAAAdI"]
[Tue Feb 24 19:31:33.377110 2026] [:error] [pid 34751:tid 34832] [client 45.132.224.34:58015] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "aZ2MFc7SW-lfeVKMPq8xZQAAAdg"]
[Tue Feb 24 19:31:34.077170 2026] [:error] [pid 34749:tid 34772] [client 45.132.224.44:49911] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue Feb 24 19:31:34.303359 2026] [:error] [pid 34749:tid 34766] [client 45.132.224.44:49911] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aZ2MFoDERuV6HM3T9KnI9wAAAEw"]
[Tue Feb 24 19:31:34.801897 2026] [:error] [pid 34751:tid 34824] [client 45.132.224.8:30019] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aZ2MFs7SW-lfeVKMPq8xaAAAAdA"]
[Tue Feb 24 19:31:35.726236 2026] [:error] [pid 34839:tid 34864] [client 45.132.224.33:34241] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Tue Feb 24 19:31:35.963463 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.33:34241] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Tue Feb 24 19:31:36.437195 2026] [:error] [pid 34839:tid 34855] [client 45.132.224.33:34241] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue Feb 24 19:31:36.897452 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.33:34241] [client 45.132.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aZ2MGGLpm0-tb2ey61HpowAAABE"]
[Tue Feb 24 19:31:37.349583 2026] [:error] [pid 34750:tid 34793] [client 45.132.224.46:24747] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aZ2MGeaZ-Iv_wvbRkKISbwAAAUw"]
[Tue Feb 24 19:31:38.504032 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.12:24721] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Feb 24 19:31:38.736626 2026] [:error] [pid 34750:tid 34790] [client 45.132.224.12:24721] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aZ2MGuaZ-Iv_wvbRkKISdQAAAUk"]
[Tue Feb 24 19:31:39.186785 2026] [:error] [pid 34839:tid 34861] [client 45.132.224.27:51935] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aZ2MG2Lpm0-tb2ey61HppgAAABQ"]
[Tue Feb 24 19:31:39.655020 2026] [:error] [pid 37873:tid 37890] [client 45.132.224.44:41155] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aZ2MG0625ION6Syu4d419AAAAM8"]
[Tue Feb 24 19:31:41.157621 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.12:45375] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Tue Feb 24 19:31:41.384359 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.12:45375] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aZ2MHeaZ-Iv_wvbRkKISfwAAAUQ"]
[Tue Feb 24 19:31:42.096810 2026] [:error] [pid 34839:tid 34865] [client 45.132.224.10:40591] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aZ2MHmLpm0-tb2ey61HprwAAABg"]
[Tue Feb 24 19:31:42.551007 2026] [:error] [pid 34839:tid 34842] [client 45.132.224.28:47253] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Feb 24 19:31:42.778916 2026] [:error] [pid 34839:tid 34850] [client 45.132.224.28:47253] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Feb 24 19:31:43.270575 2026] [:error] [pid 34839:tid 34849] [client 45.132.224.28:47253] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Tue Feb 24 19:31:44.190158 2026] [:error] [pid 34839:tid 34842] [client 45.132.224.28:47253] [client 45.132.224.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.28, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "aZ2MIGLpm0-tb2ey61HpvwAAAAE"]
[Tue Feb 24 19:31:44.656672 2026] [:error] [pid 34839:tid 34850] [client 45.132.224.28:47253] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Tue Feb 24 19:31:44.891552 2026] [:error] [pid 34839:tid 34849] [client 45.132.224.28:47253] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Tue Feb 24 19:31:45.131554 2026] [:error] [pid 34839:tid 34853] [client 45.132.224.28:47253] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Tue Feb 24 19:31:45.586192 2026] [:error] [pid 34839:tid 34845] [client 45.132.224.28:47253] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aZ2MIWLpm0-tb2ey61HpyQAAAAQ"]
[Tue Feb 24 19:31:46.042432 2026] [:error] [pid 34839:tid 34848] [client 45.132.224.2:27553] [client 45.132.224.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aZ2MImLpm0-tb2ey61HpzAAAAAc"]
[Tue Feb 24 19:31:46.742158 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Feb 24 19:31:46.971222 2026] [:error] [pid 34839:tid 34842] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Tue Feb 24 19:31:47.429767 2026] [:error] [pid 34839:tid 34848] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Tue Feb 24 19:31:47.886589 2026] [:error] [pid 34839:tid 34857] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Feb 24 19:31:48.583036 2026] [:error] [pid 34839:tid 34849] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Tue Feb 24 19:31:50.195177 2026] [:error] [pid 34839:tid 34865] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Feb 24 19:31:50.425199 2026] [:error] [pid 34839:tid 34852] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Tue Feb 24 19:31:51.576315 2026] [:error] [pid 34839:tid 34844] [client 45.132.224.2:27553] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Tue Feb 24 19:31:52.043721 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.2:27553] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aZ2MKGLpm0-tb2ey61Hp_AAAABE"]
[Tue Feb 24 19:31:52.974680 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.25:40929] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Feb 24 19:31:53.217667 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.25:40929] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aZ2MKeaZ-Iv_wvbRkKISpwAAAVQ"]
[Tue Feb 24 19:31:53.906469 2026] [:error] [pid 34839:tid 34854] [client 45.132.224.15:29087] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue Feb 24 19:31:54.134465 2026] [:error] [pid 34839:tid 34862] [client 45.132.224.15:29087] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aZ2MKmLpm0-tb2ey61HqAAAAABU"]
[Tue Feb 24 19:31:55.051417 2026] [:error] [pid 34750:tid 34799] [client 45.132.224.43:62591] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Tue Feb 24 19:31:55.519245 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.43:62591] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Tue Feb 24 19:31:55.982922 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.43:62591] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Tue Feb 24 19:31:56.223567 2026] [:error] [pid 34750:tid 34802] [client 45.132.224.43:62591] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Tue Feb 24 19:31:56.677225 2026] [:error] [pid 34750:tid 34792] [client 45.132.224.43:62591] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aZ2MLOaZ-Iv_wvbRkKISwwAAAUs"]
[Tue Feb 24 19:31:57.133379 2026] [:error] [pid 34751:tid 34818] [client 45.132.224.50:21285] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Tue Feb 24 19:31:57.369823 2026] [:error] [pid 34751:tid 34827] [client 45.132.224.50:21285] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue Feb 24 19:31:57.594421 2026] [:error] [pid 34751:tid 34816] [client 45.132.224.50:21285] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aZ2MLc7SW-lfeVKMPq8xqwAAAcg"]
[Tue Feb 24 19:31:58.283205 2026] [:error] [pid 34839:tid 34855] [client 45.132.224.4:32409] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aZ2MLmLpm0-tb2ey61HqDAAAAA4"]
[Tue Feb 24 19:31:58.983550 2026] [:error] [pid 37873:tid 37893] [client 45.132.224.2:34101] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Feb 24 19:31:59.695951 2026] [:error] [pid 37873:tid 37887] [client 45.132.224.2:34101] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Tue Feb 24 19:31:59.924041 2026] [:error] [pid 37873:tid 37884] [client 45.132.224.2:34101] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Tue Feb 24 19:32:00.151036 2026] [:error] [pid 37873:tid 37888] [client 45.132.224.2:34101] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aZ2MME625ION6Syu4d42IAAAAM0"]
[Tue Feb 24 19:32:00.625701 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.42:57111] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aZ2MMOaZ-Iv_wvbRkKISywAAAUQ"]
[Tue Feb 24 19:32:03.510214 2026] [:error] [pid 34839:tid 34849] [client 45.132.224.43:30051] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Tue Feb 24 19:32:03.966135 2026] [:error] [pid 34839:tid 34859] [client 45.132.224.43:30051] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aZ2MM2Lpm0-tb2ey61HqSgAAABI"]
[Tue Feb 24 19:32:04.648348 2026] [:error] [pid 37873:tid 37878] [client 45.132.224.21:57813] [client 45.132.224.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aZ2MNE625ION6Syu4d42KgAAAMM"]
[Tue Feb 24 19:32:05.341102 2026] [:error] [pid 34750:tid 34797] [client 45.132.224.2:44549] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Feb 24 19:32:05.572305 2026] [:error] [pid 34750:tid 34786] [client 45.132.224.2:44549] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Tue Feb 24 19:32:05.798249 2026] [:error] [pid 34750:tid 34789] [client 45.132.224.2:44549] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aZ2MNeaZ-Iv_wvbRkKIS7AAAAUg"]
[Tue Feb 24 19:32:06.493780 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.42:22385] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Tue Feb 24 19:32:06.722540 2026] [:error] [pid 34750:tid 34786] [client 45.132.224.42:22385] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Tue Feb 24 19:32:07.181869 2026] [:error] [pid 34750:tid 34805] [client 45.132.224.42:22385] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue Feb 24 19:32:07.864152 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.42:22385] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aZ2MN-aZ-Iv_wvbRkKIS-wAAAUA"]
[Tue Feb 24 19:32:08.331432 2026] [:error] [pid 37095:tid 37111] [client 45.132.224.25:46443] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Tue Feb 24 19:32:09.017834 2026] [:error] [pid 37095:tid 37121] [client 45.132.224.25:46443] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aZ2MOSX8qkGqxKHLt3uTEQAAAJg"]
[Tue Feb 24 19:32:09.703952 2026] [:error] [pid 34751:tid 34818] [client 45.132.224.48:33841] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Tue Feb 24 19:32:10.407694 2026] [:error] [pid 34751:tid 34817] [client 45.132.224.48:33841] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Tue Feb 24 19:32:10.641315 2026] [:error] [pid 34751:tid 34832] [client 45.132.224.48:33841] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Feb 24 19:32:11.127929 2026] [:error] [pid 34751:tid 34831] [client 45.132.224.48:33841] [client 45.132.224.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.48, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aZ2MO87SW-lfeVKMPq8x-QAAAdc"]
[Tue Feb 24 19:32:12.325344 2026] [:error] [pid 34751:tid 34809] [client 45.132.224.48:33841] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aZ2MPM7SW-lfeVKMPq8x_gAAAcE"]
[Tue Feb 24 19:32:12.781724 2026] [:error] [pid 34839:tid 34844] [client 45.132.224.21:58581] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Tue Feb 24 19:32:13.011013 2026] [:error] [pid 34839:tid 34861] [client 45.132.224.21:58581] [client 45.132.224.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aZ2MPWLpm0-tb2ey61HqiAAAABQ"]
[Tue Feb 24 19:32:13.465016 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.53:34205] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Tue Feb 24 19:32:13.933334 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.53:34205] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Tue Feb 24 19:32:14.450893 2026] [:error] [pid 34839:tid 34841] [client 45.132.224.53:34205] [client 45.132.224.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aZ2MPmLpm0-tb2ey61HqlAAAAAA"]
[Tue Feb 24 19:32:15.145965 2026] [:error] [pid 34751:tid 34810] [client 45.132.224.3:39409] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Tue Feb 24 19:32:15.377091 2026] [:error] [pid 34751:tid 34827] [client 45.132.224.3:39409] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Tue Feb 24 19:32:15.833365 2026] [:error] [pid 34751:tid 34820] [client 45.132.224.3:39409] [client 45.132.224.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aZ2MP87SW-lfeVKMPq8yCAAAAcw"]
[Tue Feb 24 19:32:16.514189 2026] [:error] [pid 34839:tid 34853] [client 45.132.224.18:24187] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aZ2MQGLpm0-tb2ey61HqlwAAAAw"]
[Tue Feb 24 19:32:16.971198 2026] [:error] [pid 37873:tid 37897] [client 45.132.224.34:38533] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Tue Feb 24 19:32:17.223437 2026] [:error] [pid 37873:tid 37883] [client 45.132.224.34:38533] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Tue Feb 24 19:32:17.676926 2026] [:error] [pid 37873:tid 37879] [client 45.132.224.34:38533] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aZ2MQU625ION6Syu4d42MwAAAMQ"]
[Tue Feb 24 19:32:18.131980 2026] [:error] [pid 34749:tid 34777] [client 45.132.224.38:27751] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue Feb 24 19:32:18.590114 2026] [:error] [pid 34749:tid 34770] [client 45.132.224.38:27751] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Tue Feb 24 19:32:18.818589 2026] [:error] [pid 34749:tid 34767] [client 45.132.224.38:27751] [client 45.132.224.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aZ2MQoDERuV6HM3T9KnJhQAAAE0"]
[Tue Feb 24 19:32:19.550764 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.49:27529] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "aZ2MQ2Lpm0-tb2ey61HqnwAAABE"]
[Tue Feb 24 19:32:20.016589 2026] [:error] [pid 37095:tid 37112] [client 45.132.224.9:61407] [client 45.132.224.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aZ2MRCX8qkGqxKHLt3uTEwAAAI8"]
[Tue Feb 24 19:32:20.473568 2026] [:error] [pid 37873:tid 37889] [client 45.132.224.44:34841] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aZ2MRE625ION6Syu4d42NgAAAM4"]
[Tue Feb 24 19:32:20.930795 2026] [:error] [pid 37873:tid 37882] [client 45.132.224.44:30013] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aZ2MRE625ION6Syu4d42OAAAAMc"]
[Tue Feb 24 19:32:21.388791 2026] [:error] [pid 34749:tid 34762] [client 45.132.224.4:35893] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aZ2MRYDERuV6HM3T9KnJhgAAAEg"]
[Tue Feb 24 19:32:21.845079 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.28:27889] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aZ2MReaZ-Iv_wvbRkKITCQAAAU4"]
[Tue Feb 24 19:32:22.755768 2026] [:error] [pid 37873:tid 37888] [client 45.132.224.23:22133] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aZ2MRk625ION6Syu4d42PAAAAM0"]
[Tue Feb 24 19:32:23.208150 2026] [:error] [pid 34749:tid 34772] [client 45.132.224.30:49713] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aZ2MR4DERuV6HM3T9KnJhwAAAFI"]
[Tue Feb 24 19:32:23.670516 2026] [:error] [pid 34749:tid 34758] [client 45.132.224.10:22981] [client 45.132.224.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aZ2MR4DERuV6HM3T9KnJiAAAAEQ"]
[Tue Feb 24 19:32:24.352372 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.38:58133] [client 45.132.224.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aZ2MSOaZ-Iv_wvbRkKITDgAAAUA"]
[Tue Feb 24 19:32:25.264164 2026] [:error] [pid 34750:tid 34792] [client 45.132.224.47:30085] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aZ2MSeaZ-Iv_wvbRkKITEQAAAUs"]
[Tue Feb 24 19:32:25.724029 2026] [:error] [pid 37873:tid 37875] [client 45.132.224.18:21463] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Tue Feb 24 19:32:26.701602 2026] [:error] [pid 37873:tid 37881] [client 45.132.224.18:21463] [client 45.132.224.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.18, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aZ2MSk625ION6Syu4d42QwAAAMY"]
[Tue Feb 24 19:32:28.079814 2026] [:error] [pid 37873:tid 37880] [client 45.132.224.18:21463] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aZ2MTE625ION6Syu4d42SQAAAMU"]
[Tue Feb 24 19:32:28.584980 2026] [:error] [pid 34750:tid 34805] [client 45.132.224.18:39585] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aZ2MTOaZ-Iv_wvbRkKITFwAAAVg"]
[Tue Feb 24 19:32:29.732181 2026] [:error] [pid 37095:tid 37104] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Tue Feb 24 19:32:29.963949 2026] [:error] [pid 37095:tid 37120] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Tue Feb 24 19:32:31.081760 2026] [:error] [pid 37095:tid 37097] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Tue Feb 24 19:32:31.309968 2026] [:error] [pid 37095:tid 37117] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Tue Feb 24 19:32:32.269315 2026] [:error] [pid 37095:tid 37121] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Tue Feb 24 19:32:32.499577 2026] [:error] [pid 37095:tid 37102] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Tue Feb 24 19:32:32.728429 2026] [:error] [pid 37095:tid 37115] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Tue Feb 24 19:32:32.970658 2026] [:error] [pid 37095:tid 37103] [client 45.132.224.24:32671] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Tue Feb 24 19:32:33.196148 2026] [:error] [pid 37095:tid 37109] [client 45.132.224.24:32671] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZ2MUSX8qkGqxKHLt3uTJwAAAIw"]
[Tue Feb 24 19:32:33.650023 2026] [:error] [pid 34750:tid 34788] [client 45.132.224.23:50371] [client 45.132.224.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aZ2MUeaZ-Iv_wvbRkKITJQAAAUc"]
[Tue Feb 24 19:32:34.101137 2026] [:error] [pid 34751:tid 34814] [client 45.132.224.7:32687] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aZ2MUs7SW-lfeVKMPq8yDwAAAcY"]
[Tue Feb 24 19:32:34.782902 2026] [:error] [pid 34751:tid 34824] [client 45.132.224.44:59677] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Tue Feb 24 19:32:35.014322 2026] [:error] [pid 34751:tid 34819] [client 45.132.224.44:59677] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Tue Feb 24 19:32:35.475068 2026] [:error] [pid 34751:tid 34812] [client 45.132.224.44:59677] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Tue Feb 24 19:32:35.933092 2026] [:error] [pid 34751:tid 34816] [client 45.132.224.44:59677] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aZ2MU87SW-lfeVKMPq8yGAAAAcg"]
[Tue Feb 24 19:32:36.384182 2026] [:error] [pid 34751:tid 34813] [client 45.132.224.20:40843] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aZ2MVM7SW-lfeVKMPq8yGQAAAcU"]
[Tue Feb 24 19:32:36.835724 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.16:64769] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aZ2MVOaZ-Iv_wvbRkKITLwAAAUY"]
[Tue Feb 24 19:32:38.224930 2026] [:error] [pid 34839:tid 34841] [client 45.132.224.11:57589] [client 45.132.224.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aZ2MVmLpm0-tb2ey61HqtwAAAAA"]
[Tue Feb 24 19:32:38.909056 2026] [:error] [pid 34839:tid 34857] [client 45.132.224.38:53507] [client 45.132.224.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aZ2MVmLpm0-tb2ey61HqugAAABA"]
[Tue Feb 24 19:32:39.826263 2026] [:error] [pid 34751:tid 34831] [client 45.132.224.27:39431] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aZ2MV87SW-lfeVKMPq8yIgAAAdc"]
[Tue Feb 24 19:32:42.817409 2026] [:error] [pid 34750:tid 34786] [client 45.132.224.42:39517] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aZ2MWuaZ-Iv_wvbRkKITSQAAAUU"]
[Tue Feb 24 19:32:43.287559 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.4:45039] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Tue Feb 24 19:32:43.740763 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.4:45039] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aZ2MW-aZ-Iv_wvbRkKITTQAAAVQ"]
[Tue Feb 24 19:32:44.656149 2026] [:error] [pid 37873:tid 37888] [client 45.132.224.28:22885] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Tue Feb 24 19:32:45.358692 2026] [:error] [pid 37873:tid 37887] [client 45.132.224.28:22885] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Feb 24 19:32:45.584435 2026] [:error] [pid 37873:tid 37876] [client 45.132.224.28:22885] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aZ2MXU625ION6Syu4d42UAAAAME"]
[Tue Feb 24 19:32:46.526518 2026] [:error] [pid 34839:tid 34848] [client 45.132.224.12:22423] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aZ2MXmLpm0-tb2ey61Hq2AAAAAc"]
[Tue Feb 24 19:32:47.922875 2026] [:error] [pid 34750:tid 34788] [client 45.132.224.45:27991] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aZ2MX-aZ-Iv_wvbRkKITYAAAAUc"]
[Tue Feb 24 19:32:49.576643 2026] [:error] [pid 34750:tid 34805] [client 45.132.224.46:34017] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aZ2MYeaZ-Iv_wvbRkKITagAAAVg"]
[Tue Feb 24 19:32:50.271494 2026] [:error] [pid 34749:tid 34777] [client 45.132.224.14:31157] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Feb 24 19:32:50.496438 2026] [:error] [pid 34749:tid 34759] [client 45.132.224.14:31157] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aZ2MYoDERuV6HM3T9KnJkQAAAEU"]
[Tue Feb 24 19:32:50.948211 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.2:50231] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aZ2MYuaZ-Iv_wvbRkKITbwAAAU4"]
[Tue Feb 24 19:32:52.588752 2026] [:error] [pid 37873:tid 37889] [client 45.132.224.51:50473] [client 45.132.224.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aZ2MZE625ION6Syu4d42WQAAAM4"]
[Tue Feb 24 19:32:53.044580 2026] [:error] [pid 34750:tid 34792] [client 45.132.224.13:46849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Feb 24 19:32:53.967788 2026] [:error] [pid 34750:tid 34805] [client 45.132.224.13:46849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Tue Feb 24 19:32:54.193560 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.13:46849] [client 45.132.224.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aZ2MZuaZ-Iv_wvbRkKITegAAAUQ"]
[Tue Feb 24 19:32:55.113886 2026] [:error] [pid 34839:tid 34850] [client 45.132.224.25:35109] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Tue Feb 24 19:32:55.570025 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.25:35109] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aZ2MZ2Lpm0-tb2ey61Hq7QAAAAY"]
[Tue Feb 24 19:32:56.028808 2026] [:error] [pid 34750:tid 34794] [client 45.132.224.31:33093] [client 45.132.224.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aZ2MaOaZ-Iv_wvbRkKITgAAAAU0"]
[Tue Feb 24 19:32:56.970735 2026] [:error] [pid 34750:tid 34790] [client 45.132.224.36:46633] [client 45.132.224.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aZ2MaOaZ-Iv_wvbRkKITiAAAAUk"]
[Tue Feb 24 19:32:58.123495 2026] [:error] [pid 34750:tid 34782] [client 45.132.224.15:51069] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "aZ2MauaZ-Iv_wvbRkKITjgAAAUE"]
[Tue Feb 24 19:32:58.595749 2026] [:error] [pid 34839:tid 34851] [client 45.132.224.51:53229] [client 45.132.224.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aZ2MamLpm0-tb2ey61Hq-QAAAAo"]
[Tue Feb 24 19:32:59.286455 2026] [:error] [pid 34751:tid 34818] [client 45.132.224.43:23697] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Tue Feb 24 19:33:00.590031 2026] [:error] [pid 34751:tid 34826] [client 45.132.224.43:23697] [client 45.132.224.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "aZ2MbM7SW-lfeVKMPq8yPwAAAdI"]
[Tue Feb 24 19:33:01.607865 2026] [:error] [pid 37873:tid 37895] [client 45.132.224.40:29399] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aZ2MbU625ION6Syu4d42YgAAANQ"]
[Tue Feb 24 19:33:02.089023 2026] [:error] [pid 34839:tid 34850] [client 45.132.224.27:35869] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aZ2MbmLpm0-tb2ey61Hq_QAAAAk"]
[Tue Feb 24 19:33:02.829935 2026] [:error] [pid 34750:tid 34796] [client 45.132.224.24:47437] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Tue Feb 24 19:33:03.092979 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.24:47437] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aZ2Mb-aZ-Iv_wvbRkKIToQAAAUM"]
[Tue Feb 24 19:33:03.774873 2026] [:error] [pid 34750:tid 34793] [client 45.132.224.51:58715] [client 45.132.224.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aZ2Mb-aZ-Iv_wvbRkKITpwAAAUw"]
[Tue Feb 24 19:33:05.373764 2026] [:error] [pid 34839:tid 34855] [client 45.132.224.28:44331] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aZ2McWLpm0-tb2ey61HrBgAAAA4"]
[Tue Feb 24 19:33:06.062464 2026] [:error] [pid 34751:tid 34813] [client 45.132.224.26:29375] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Tue Feb 24 19:33:06.293404 2026] [:error] [pid 34751:tid 34821] [client 45.132.224.26:29375] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aZ2Mcs7SW-lfeVKMPq8yRAAAAc0"]
[Tue Feb 24 19:33:07.205161 2026] [:error] [pid 34839:tid 34844] [client 45.132.224.24:53887] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aZ2Mc2Lpm0-tb2ey61HrDwAAAAM"]
[Tue Feb 24 19:33:08.754772 2026] [:error] [pid 34751:tid 34830] [client 45.132.224.4:44971] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "aZ2MdM7SW-lfeVKMPq8ySQAAAdY"]
[Tue Feb 24 19:33:09.441696 2026] [:error] [pid 34751:tid 34831] [client 45.132.224.15:31201] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aZ2Mdc7SW-lfeVKMPq8yTgAAAdc"]
[Tue Feb 24 19:33:09.914214 2026] [:error] [pid 34751:tid 34819] [client 45.132.224.5:29647] [client 45.132.224.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aZ2Mdc7SW-lfeVKMPq8yTwAAAcs"]
[Tue Feb 24 19:33:10.369458 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.34:36305] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aZ2MduaZ-Iv_wvbRkKITtAAAAUM"]
[Tue Feb 24 19:33:12.233823 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.40:39279] [client 45.132.224.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aZ2MeOaZ-Iv_wvbRkKITwQAAAVQ"]
[Tue Feb 24 19:33:13.387578 2026] [:error] [pid 34751:tid 34827] [client 45.132.224.50:38791] [client 45.132.224.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aZ2Mec7SW-lfeVKMPq8yVAAAAdM"]
[Tue Feb 24 19:33:14.328436 2026] [:error] [pid 34750:tid 34794] [client 45.132.224.12:33731] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Tue Feb 24 19:33:14.555390 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.12:33731] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aZ2MeuaZ-Iv_wvbRkKITzwAAAU4"]
[Tue Feb 24 19:33:15.712731 2026] [:error] [pid 37873:tid 37893] [client 45.132.224.42:58953] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aZ2Me0625ION6Syu4d42agAAANI"]
[Tue Feb 24 19:33:16.172997 2026] [:error] [pid 37873:tid 37886] [client 45.132.224.34:28361] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Tue Feb 24 19:33:17.544465 2026] [:error] [pid 37873:tid 37884] [client 45.132.224.34:28361] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aZ2MfU625ION6Syu4d42cQAAAMk"]
[Tue Feb 24 19:33:18.230245 2026] [:error] [pid 34839:tid 34865] [client 45.132.224.12:56851] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aZ2MfmLpm0-tb2ey61HrIAAAABg"]
[Tue Feb 24 19:33:18.911415 2026] [:error] [pid 37095:tid 37108] [client 45.132.224.8:54781] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aZ2MfiX8qkGqxKHLt3uTKgAAAIs"]
[Tue Feb 24 19:33:19.834872 2026] [:error] [pid 37095:tid 37113] [client 45.132.224.3:27123] [client 45.132.224.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aZ2MfyX8qkGqxKHLt3uTLwAAAJA"]
[Tue Feb 24 19:33:22.156349 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.28:43271] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aZ2MguaZ-Iv_wvbRkKIT6gAAAUM"]
[Tue Feb 24 19:33:22.608933 2026] [:error] [pid 34750:tid 34791] [client 45.132.224.42:29471] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aZ2MguaZ-Iv_wvbRkKIT7AAAAUo"]
[Tue Feb 24 19:33:23.760788 2026] [:error] [pid 37095:tid 37116] [client 45.132.224.6:25907] [client 45.132.224.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aZ2MgyX8qkGqxKHLt3uTPAAAAJM"]
[Tue Feb 24 19:33:24.215608 2026] [:error] [pid 34751:tid 34820] [client 45.132.224.45:20025] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aZ2MhM7SW-lfeVKMPq8yYgAAAcw"]
[Tue Feb 24 19:33:25.135106 2026] [:error] [pid 37873:tid 37880] [client 45.132.224.46:31739] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aZ2MhU625ION6Syu4d42lgAAAMU"]
[Tue Feb 24 19:33:25.585211 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.19:41683] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aZ2MheaZ-Iv_wvbRkKIT8QAAAVQ"]
[Tue Feb 24 19:33:26.117547 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.27:61911] [client 45.132.224.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.27, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aZ2MhuaZ-Iv_wvbRkKIT8wAAAU4"]
[Tue Feb 24 19:33:26.120946 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.27:61911] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Tue Feb 24 19:33:26.366436 2026] [:error] [pid 34750:tid 34794] [client 45.132.224.27:61911] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aZ2MhuaZ-Iv_wvbRkKIT9AAAAU0"]
[Tue Feb 24 19:33:27.284054 2026] [:error] [pid 34750:tid 34791] [client 45.132.224.7:50881] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Tue Feb 24 19:33:27.511615 2026] [:error] [pid 34750:tid 34789] [client 45.132.224.7:50881] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aZ2Mh-aZ-Iv_wvbRkKIT_AAAAUg"]
[Tue Feb 24 19:33:27.963265 2026] [:error] [pid 34750:tid 34797] [client 45.132.224.41:48343] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aZ2Mh-aZ-Iv_wvbRkKIT_QAAAVA"]
[Tue Feb 24 19:33:28.419961 2026] [:error] [pid 34750:tid 34785] [client 45.132.224.29:49839] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Tue Feb 24 19:33:30.062677 2026] [:error] [pid 34750:tid 34800] [client 45.132.224.29:49839] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aZ2MiuaZ-Iv_wvbRkKIUBwAAAVM"]
[Tue Feb 24 19:33:30.513462 2026] [:error] [pid 34750:tid 34790] [client 45.132.224.52:33361] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aZ2MiuaZ-Iv_wvbRkKIUCgAAAUk"]
[Tue Feb 24 19:33:31.478818 2026] [:error] [pid 34839:tid 34847] [client 45.132.224.26:63579] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aZ2Mi2Lpm0-tb2ey61HrTAAAAAY"]
[Tue Feb 24 19:33:31.930853 2026] [:error] [pid 34750:tid 34782] [client 45.132.224.34:54943] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aZ2Mi-aZ-Iv_wvbRkKIUEAAAAUE"]
[Tue Feb 24 19:33:32.396013 2026] [:error] [pid 34750:tid 34787] [client 45.132.224.22:52353] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Tue Feb 24 19:33:32.631590 2026] [:error] [pid 34750:tid 34788] [client 45.132.224.22:52353] [client 45.132.224.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.224.22, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aZ2MjOaZ-Iv_wvbRkKIUIAAAAUc"]
[Tue Feb 24 19:33:33.097259 2026] [:error] [pid 34750:tid 34781] [client 45.132.224.22:52353] [client 45.132.224.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aZ2MjeaZ-Iv_wvbRkKIUJQAAAUA"]
[Tue Feb 24 19:33:34.464518 2026] [:error] [pid 34750:tid 34800] [client 45.132.224.15:52741] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aZ2MjuaZ-Iv_wvbRkKIUMgAAAVM"]
[Tue Feb 24 19:33:34.917833 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.15:48879] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Feb 24 19:33:35.145637 2026] [:error] [pid 34750:tid 34795] [client 45.132.224.15:48879] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aZ2Mj-aZ-Iv_wvbRkKIUOAAAAU4"]
[Tue Feb 24 19:33:35.595267 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.12:61903] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aZ2Mj-aZ-Iv_wvbRkKIUOwAAAVE"]
[Tue Feb 24 19:33:36.049006 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.41:54725] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Tue Feb 24 19:33:36.751962 2026] [:error] [pid 34750:tid 34798] [client 45.132.224.41:54725] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aZ2MkOaZ-Iv_wvbRkKIURAAAAVE"]
[Tue Feb 24 19:33:38.324730 2026] [:error] [pid 34751:tid 34824] [client 45.132.224.35:41861] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aZ2Mks7SW-lfeVKMPq8yjgAAAdA"]
[Tue Feb 24 19:33:38.779368 2026] [:error] [pid 37873:tid 37892] [client 45.132.224.25:60465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Tue Feb 24 19:33:39.236423 2026] [:error] [pid 37873:tid 37897] [client 45.132.224.25:60465] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Feb 24 19:33:39.703986 2026] [:error] [pid 37873:tid 37888] [client 45.132.224.25:60465] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aZ2Mk0625ION6Syu4d42vQAAAM0"]
[Tue Feb 24 19:33:40.188364 2026] [:error] [pid 34751:tid 34819] [client 45.132.224.12:58081] [client 45.132.224.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "aZ2MlM7SW-lfeVKMPq8ykgAAAcs"]
[Tue Feb 24 19:33:40.870116 2026] [:error] [pid 34751:tid 34826] [client 45.132.224.2:33743] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/count.php"] [unique_id "aZ2MlM7SW-lfeVKMPq8ylAAAAdI"]
[Tue Feb 24 19:33:41.327560 2026] [:error] [pid 34839:tid 34864] [client 45.132.224.8:58757] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Tue Feb 24 19:33:42.742356 2026] [:error] [pid 34839:tid 34844] [client 45.132.224.8:58757] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aZ2MlmLpm0-tb2ey61HrYwAAAAM"]
[Tue Feb 24 19:33:43.675923 2026] [:error] [pid 34749:tid 34767] [client 45.132.224.37:62009] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rejuva.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rejuva.au"] [uri "/images/stories/themes.php"] [unique_id "aZ2Ml4DERuV6HM3T9KnJrwAAAE0"]
[Tue Feb 24 19:33:43.913853 2026] [:error] [pid 34749:tid 34757] [client 45.132.224.37:62009] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aZ2Ml4DERuV6HM3T9KnJsAAAAEM"]
[Tue Feb 24 19:33:44.840829 2026] [:error] [pid 37873:tid 37876] [client 45.132.224.6:56679] [client 45.132.224.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aZ2MmE625ION6Syu4d42wgAAAME"]
[Tue Feb 24 19:33:45.307853 2026] [:error] [pid 37873:tid 37899] [client 45.132.224.30:28233] [client 45.132.224.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aZ2MmU625ION6Syu4d42xgAAANg"]
[Tue Feb 24 19:33:47.381899 2026] [:error] [pid 34839:tid 34848] [client 45.132.224.3:61621] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Tue Feb 24 19:33:48.305439 2026] [:error] [pid 34839:tid 34843] [client 45.132.224.3:61621] [client 45.132.224.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aZ2MnGLpm0-tb2ey61HrbAAAAAI"]
[Tue Feb 24 19:33:50.359197 2026] [:error] [pid 37873:tid 37879] [client 45.132.224.14:52907] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aZ2Mnk625ION6Syu4d421wAAAMQ"]
[Tue Feb 24 19:33:51.047465 2026] [:error] [pid 37873:tid 37896] [client 45.132.224.15:40863] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aZ2Mn0625ION6Syu4d423AAAANU"]
[Tue Feb 24 19:33:51.505074 2026] [:error] [pid 37095:tid 37103] [client 45.132.224.44:43623] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Tue Feb 24 19:33:52.716146 2026] [:error] [pid 37095:tid 37117] [client 45.132.224.44:43623] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aZ2MoCX8qkGqxKHLt3uTeQAAAJQ"]
[Tue Feb 24 19:33:53.393697 2026] [:error] [pid 37873:tid 37882] [client 45.132.224.52:28623] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/colour.php"] [unique_id "aZ2MoU625ION6Syu4d42-gAAAMc"]
[Tue Feb 24 19:33:53.864228 2026] [:error] [pid 34750:tid 34797] [client 45.132.224.39:29417] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Feb 24 19:33:54.090275 2026] [:error] [pid 34750:tid 34788] [client 45.132.224.39:29417] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aZ2MouaZ-Iv_wvbRkKIUZwAAAUc"]
[Tue Feb 24 19:33:54.541122 2026] [:error] [pid 34751:tid 34827] [client 45.132.224.42:38549] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aZ2Mos7SW-lfeVKMPq8ynQAAAdM"]
[Tue Feb 24 19:33:55.457335 2026] [:error] [pid 34751:tid 34823] [client 45.132.224.4:34311] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aZ2Mo87SW-lfeVKMPq8yoAAAAc8"]
[Tue Feb 24 19:33:56.605216 2026] [:error] [pid 37873:tid 37885] [client 45.132.224.27:48081] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Tue Feb 24 19:33:56.832547 2026] [:error] [pid 37873:tid 37887] [client 45.132.224.27:48081] [client 45.132.224.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aZ2MpE625ION6Syu4d43QAAAAMw"]
[Tue Feb 24 19:33:57.283124 2026] [:error] [pid 34751:tid 34816] [client 45.132.224.17:31111] [client 45.132.224.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aZ2Mpc7SW-lfeVKMPq8yoQAAAcg"]
[Tue Feb 24 19:33:58.930963 2026] [:error] [pid 37873:tid 37889] [client 45.132.224.34:32901] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aZ2Mpk625ION6Syu4d43YAAAAM4"]
[Tue Feb 24 19:33:59.839079 2026] [:error] [pid 34750:tid 34791] [client 45.132.224.16:62387] [client 45.132.224.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aZ2Mp-aZ-Iv_wvbRkKIUbAAAAUo"]
[Tue Feb 24 19:34:00.306751 2026] [:error] [pid 34751:tid 34814] [client 45.132.224.14:46973] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Tue Feb 24 19:34:01.031895 2026] [:error] [pid 34751:tid 34820] [client 45.132.224.14:46973] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aZ2Mqc7SW-lfeVKMPq8ypwAAAcw"]
[Tue Feb 24 19:34:01.501317 2026] [:error] [pid 37095:tid 37113] [client 45.132.224.37:39379] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aZ2MqSX8qkGqxKHLt3uTkwAAAJA"]
[Tue Feb 24 19:34:02.323903 2026] [:error] [pid 37095:tid 37108] [client 45.132.224.48:57401] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aZ2MqiX8qkGqxKHLt3uTlQAAAIs"]
[Tue Feb 24 19:34:02.802860 2026] [:error] [pid 37873:tid 37881] [client 45.132.224.41:54773] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Tue Feb 24 19:34:03.285773 2026] [:error] [pid 37873:tid 37889] [client 45.132.224.41:54773] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aZ2Mq0625ION6Syu4d43awAAAM4"]
[Tue Feb 24 19:34:03.760422 2026] [:error] [pid 37873:tid 37898] [client 45.132.224.15:42289] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Tue Feb 24 19:34:05.408841 2026] [:error] [pid 37873:tid 37877] [client 45.132.224.15:42289] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aZ2MrU625ION6Syu4d43cwAAAMI"]
[Tue Feb 24 19:34:05.864259 2026] [:error] [pid 34750:tid 34789] [client 45.132.224.15:42573] [client 45.132.224.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aZ2MreaZ-Iv_wvbRkKIUcAAAAUg"]
[Tue Feb 24 19:34:06.558906 2026] [:error] [pid 37873:tid 37897] [client 45.132.224.8:51203] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aZ2Mrk625ION6Syu4d43eAAAANY"]
[Tue Feb 24 19:34:07.020065 2026] [:error] [pid 37873:tid 37892] [client 45.132.224.38:37507] [client 45.132.224.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aZ2Mr0625ION6Syu4d43egAAANE"]
[Tue Feb 24 19:34:07.953273 2026] [:error] [pid 37873:tid 37876] [client 45.132.224.20:37253] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aZ2Mr0625ION6Syu4d43fgAAAME"]
[Tue Feb 24 19:34:08.636909 2026] [:error] [pid 34751:tid 34827] [client 45.132.224.51:63357] [client 45.132.224.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aZ2MsM7SW-lfeVKMPq8yqgAAAdM"]
[Tue Feb 24 19:34:09.089865 2026] [:error] [pid 34750:tid 34797] [client 45.132.224.28:60767] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aZ2MseaZ-Iv_wvbRkKIUdAAAAVA"]
[Tue Feb 24 19:34:09.562117 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.29:40751] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aZ2MseaZ-Iv_wvbRkKIUdwAAAVQ"]
[Tue Feb 24 19:34:10.717819 2026] [:error] [pid 34750:tid 34783] [client 45.132.224.8:44913] [client 45.132.224.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aZ2MsuaZ-Iv_wvbRkKIUfgAAAUI"]
[Tue Feb 24 19:34:11.632647 2026] [:error] [pid 37095:tid 37097] [client 45.132.224.39:24371] [client 45.132.224.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aZ2MsyX8qkGqxKHLt3uTmwAAAIA"]
[Tue Feb 24 19:34:12.335357 2026] [:error] [pid 37873:tid 37875] [client 45.132.224.44:39525] [client 45.132.224.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aZ2MtE625ION6Syu4d43hQAAAMA"]
[Tue Feb 24 19:34:13.025906 2026] [:error] [pid 37095:tid 37114] [client 45.132.224.29:24005] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aZ2MtSX8qkGqxKHLt3uTnQAAAJE"]
[Tue Feb 24 19:34:13.941982 2026] [:error] [pid 34750:tid 34788] [client 45.132.224.33:63107] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Tue Feb 24 19:34:15.979753 2026] [:error] [pid 34750:tid 34792] [client 45.132.224.33:63107] [client 45.132.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aZ2Mt-aZ-Iv_wvbRkKIUigAAAUs"]
[Tue Feb 24 19:34:16.445969 2026] [:error] [pid 37873:tid 37888] [client 45.132.224.31:28677] [client 45.132.224.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aZ2MuE625ION6Syu4d43hwAAAM0"]
[Tue Feb 24 19:34:17.138562 2026] [:error] [pid 34750:tid 34783] [client 45.132.224.28:22447] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Tue Feb 24 19:34:17.384446 2026] [:error] [pid 34750:tid 34802] [client 45.132.224.28:22447] [client 45.132.224.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aZ2MueaZ-Iv_wvbRkKIUjwAAAVU"]
[Tue Feb 24 19:34:18.759084 2026] [:error] [pid 34751:tid 34827] [client 45.132.224.47:53489] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aZ2Mus7SW-lfeVKMPq8yugAAAdM"]
[Tue Feb 24 19:34:19.449310 2026] [:error] [pid 37095:tid 37121] [client 45.132.224.2:35153] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Tue Feb 24 19:34:19.689443 2026] [:error] [pid 37095:tid 37109] [client 45.132.224.2:35153] [client 45.132.224.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aZ2MuyX8qkGqxKHLt3uTowAAAIw"]
[Tue Feb 24 19:34:20.644879 2026] [:error] [pid 37095:tid 37098] [client 45.132.224.46:30759] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aZ2MvCX8qkGqxKHLt3uTpwAAAIE"]
[Tue Feb 24 19:34:21.100998 2026] [:error] [pid 34751:tid 34824] [client 45.132.224.46:31635] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Feb 24 19:34:21.326366 2026] [:error] [pid 34751:tid 34828] [client 45.132.224.46:31635] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aZ2Mvc7SW-lfeVKMPq8yxwAAAdQ"]
[Tue Feb 24 19:34:22.030246 2026] [:error] [pid 37873:tid 37882] [client 45.132.224.53:39313] [client 45.132.224.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aZ2Mvk625ION6Syu4d43jQAAAMc"]
[Tue Feb 24 19:34:24.380438 2026] [:error] [pid 37873:tid 37897] [client 45.132.224.25:48739] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Tue Feb 24 19:34:24.606360 2026] [:error] [pid 37873:tid 37883] [client 45.132.224.25:48739] [client 45.132.224.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aZ2MwE625ION6Syu4d43lAAAAMg"]
[Tue Feb 24 19:34:25.784733 2026] [:error] [pid 37873:tid 37886] [client 45.132.224.41:39141] [client 45.132.224.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aZ2MwU625ION6Syu4d43mwAAAMs"]
[Tue Feb 24 19:34:27.514785 2026] [:error] [pid 37873:tid 37882] [client 45.132.224.37:53331] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Tue Feb 24 19:34:27.743465 2026] [:error] [pid 37873:tid 37895] [client 45.132.224.37:53331] [client 45.132.224.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aZ2Mw0625ION6Syu4d43nwAAANQ"]
[Tue Feb 24 19:34:28.205943 2026] [:error] [pid 37873:tid 37881] [client 45.132.224.4:49475] [client 45.132.224.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aZ2MxE625ION6Syu4d43oAAAAMY"]
[Tue Feb 24 19:34:28.669180 2026] [:error] [pid 37873:tid 37899] [client 45.132.224.47:45733] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Tue Feb 24 19:34:29.130813 2026] [:error] [pid 37873:tid 37889] [client 45.132.224.47:45733] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aZ2MxU625ION6Syu4d43pAAAAM4"]
[Tue Feb 24 19:34:29.582682 2026] [:error] [pid 34751:tid 34830] [client 45.132.224.18:27469] [client 45.132.224.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aZ2Mxc7SW-lfeVKMPq8yzgAAAdY"]
[Tue Feb 24 19:34:31.530566 2026] [:error] [pid 34839:tid 34852] [client 45.132.224.48:44963] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aZ2Mx2Lpm0-tb2ey61HrfwAAAAs"]
[Tue Feb 24 19:34:31.979380 2026] [:error] [pid 37873:tid 37878] [client 45.132.224.17:50309] [client 45.132.224.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aZ2Mx0625ION6Syu4d43qQAAAMM"]
[Tue Feb 24 19:34:32.681252 2026] [:error] [pid 34751:tid 34824] [client 45.132.224.29:54567] [client 45.132.224.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/log.php"] [unique_id "aZ2MyM7SW-lfeVKMPq8y0AAAAdA"]
[Tue Feb 24 19:34:33.135083 2026] [:error] [pid 37873:tid 37893] [client 45.132.224.6:31689] [client 45.132.224.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aZ2MyU625ION6Syu4d43rAAAANI"]
[Tue Feb 24 19:34:33.588095 2026] [:error] [pid 34751:tid 34832] [client 45.132.224.5:25471] [client 45.132.224.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aZ2Myc7SW-lfeVKMPq8y0gAAAdg"]
[Tue Feb 24 19:34:34.049055 2026] [:error] [pid 34751:tid 34829] [client 45.132.224.32:35565] [client 45.132.224.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/aw.php"] [unique_id "aZ2Mys7SW-lfeVKMPq8y0wAAAdU"]
[Tue Feb 24 19:34:35.428533 2026] [:error] [pid 37873:tid 37883] [client 45.132.224.26:36475] [client 45.132.224.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aZ2My0625ION6Syu4d43sgAAAMg"]
[Tue Feb 24 19:34:35.880171 2026] [:error] [pid 34751:tid 34813] [client 45.132.224.20:34111] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/install.php"] [unique_id "aZ2My87SW-lfeVKMPq8y1gAAAcU"]
[Tue Feb 24 19:34:36.566648 2026] [:error] [pid 34751:tid 34823] [client 45.132.224.14:48041] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Tue Feb 24 19:34:36.795064 2026] [:error] [pid 34751:tid 34830] [client 45.132.224.14:48041] [client 45.132.224.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aZ2MzM7SW-lfeVKMPq8y2gAAAdY"]
[Tue Feb 24 19:34:37.255489 2026] [:error] [pid 34751:tid 34810] [client 45.132.224.32:47403] [client 45.132.224.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aZ2Mzc7SW-lfeVKMPq8y2wAAAcI"]
[Tue Feb 24 19:34:38.180246 2026] [:error] [pid 37873:tid 37882] [client 45.132.224.34:53315] [client 45.132.224.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/template-less.php"] [unique_id "aZ2Mzk625ION6Syu4d43uQAAAMc"]
[Tue Feb 24 19:34:38.635418 2026] [:error] [pid 34750:tid 34801] [client 45.132.224.48:40421] [client 45.132.224.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aZ2MzuaZ-Iv_wvbRkKIUlwAAAVQ"]
[Tue Feb 24 19:34:40.749119 2026] [:error] [pid 37873:tid 37896] [client 45.132.224.35:54243] [client 45.132.224.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aZ2M0E625ION6Syu4d43xAAAANU"]
[Tue Feb 24 19:34:41.199083 2026] [:error] [pid 37095:tid 37119] [client 45.132.224.24:61581] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aZ2M0SX8qkGqxKHLt3uTsgAAAJY"]
[Tue Feb 24 19:34:43.133707 2026] [:error] [pid 37873:tid 37885] [client 45.132.224.20:53019] [client 45.132.224.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aZ2M00625ION6Syu4d43ywAAAMo"]
[Tue Feb 24 19:34:43.831457 2026] [:error] [pid 37095:tid 37116] [client 45.132.224.9:37971] [client 45.132.224.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aZ2M0yX8qkGqxKHLt3uTtwAAAJM"]
[Tue Feb 24 19:34:44.519454 2026] [:error] [pid 37873:tid 37896] [client 45.132.224.45:38525] [client 45.132.224.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/load.php"] [unique_id "aZ2M1E625ION6Syu4d43zQAAANU"]
[Tue Feb 24 19:34:44.970521 2026] [:error] [pid 37095:tid 37120] [client 45.132.224.24:30401] [client 45.132.224.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aZ2M1CX8qkGqxKHLt3uTugAAAJc"]
[Tue Feb 24 19:34:45.424735 2026] [:error] [pid 37095:tid 37106] [client 45.132.224.7:57319] [client 45.132.224.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aZ2M1SX8qkGqxKHLt3uTuwAAAIk"]
[Tue Feb 24 19:34:46.583482 2026] [:error] [pid 37095:tid 37104] [client 45.132.224.6:55633] [client 45.132.224.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aZ2M1iX8qkGqxKHLt3uTwQAAAIc"]
[Tue Feb 24 19:34:47.039164 2026] [:error] [pid 34839:tid 34858] [client 45.132.224.49:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Tue Feb 24 19:34:47.290494 2026] [:error] [pid 34839:tid 34851] [client 45.132.224.49:61633] [client 45.132.224.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aZ2M12Lpm0-tb2ey61HriAAAAAo"]
[Tue Feb 24 19:34:48.216307 2026] [:error] [pid 34750:tid 34784] [client 45.132.224.19:41693] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Tue Feb 24 19:34:48.447420 2026] [:error] [pid 34750:tid 34805] [client 45.132.224.19:41693] [client 45.132.224.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aZ2M2OaZ-Iv_wvbRkKIUogAAAVg"]
[Tue Feb 24 19:34:48.908277 2026] [:error] [pid 34839:tid 34864] [client 45.132.224.52:44425] [client 45.132.224.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aZ2M2GLpm0-tb2ey61HriwAAABc"]
[Tue Feb 24 19:34:49.589037 2026] [:error] [pid 34749:tid 34759] [client 45.132.224.42:62847] [client 45.132.224.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aZ2M2YDERuV6HM3T9KnJ0AAAAEU"]
[Tue Feb 24 19:34:51.196791 2026] [:error] [pid 34839:tid 34860] [client 45.132.224.46:45083] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Tue Feb 24 19:34:52.144297 2026] [:error] [pid 34839:tid 34854] [client 45.132.224.46:45083] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aZ2M3GLpm0-tb2ey61HrmAAAAA0"]
[Tue Feb 24 19:34:52.824956 2026] [:error] [pid 37873:tid 37899] [client 45.132.224.46:60135] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aZ2M3E625ION6Syu4d433AAAANg"]
[Tue Feb 24 19:34:53.738980 2026] [:error] [pid 34751:tid 34822] [client 45.132.224.47:63631] [client 45.132.224.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aZ2M3c7SW-lfeVKMPq8y6AAAAc4"]
[Tue Feb 24 19:34:54.191661 2026] [:error] [pid 34751:tid 34819] [client 45.132.224.46:40013] [client 45.132.224.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aZ2M3s7SW-lfeVKMPq8y6QAAAcs"]
[Tue Feb 24 19:34:54.642648 2026] [:error] [pid 34751:tid 34824] [client 45.132.224.33:36163] [client 45.132.224.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aZ2M3s7SW-lfeVKMPq8y6gAAAdA"]
[Tue Feb 24 21:15:33.109569 2026] [:error] [pid 37884:tid 37894] [client 34.133.228.184:54604] [client 34.133.228.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.228.184, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aZ2kdf08KJo-7FmKlnBSUQAAA0Y"]
[Tue Feb 24 21:15:33.113300 2026] [:error] [pid 37884:tid 37894] [client 34.133.228.184:54604] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Feb 24 21:15:35.857753 2026] [:error] [pid 37884:tid 37903] [client 34.133.228.184:54604] [client 34.133.228.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aZ2kd_08KJo-7FmKlnBSZgAAA08"]
[Tue Feb 24 21:15:36.311427 2026] [:error] [pid 37918:tid 37936] [client 34.133.228.184:61285] [client 34.133.228.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aZ2keDB7WIlOit9GZHhBjwAAA4w"]
[Tue Feb 24 21:15:36.782423 2026] [:error] [pid 37918:tid 37929] [client 34.133.228.184:62228] [client 34.133.228.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aZ2keDB7WIlOit9GZHhBkgAAA4U"]
[Tue Feb 24 21:15:37.222606 2026] [:error] [pid 37918:tid 37948] [client 34.133.228.184:54160] [client 34.133.228.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aZ2keTB7WIlOit9GZHhBlAAAA5g"]
[Tue Feb 24 21:15:37.719918 2026] [:error] [pid 37784:tid 37808] [client 34.133.228.184:53002] [client 34.133.228.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aZ2keRhsjFGJ0bR81bdqmQAAApY"]
[Tue Feb 24 21:15:38.164381 2026] [:error] [pid 37884:tid 37890] [client 34.133.228.184:61916] [client 34.133.228.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aZ2kev08KJo-7FmKlnBSZwAAA0I"]
[Tue Feb 24 21:15:38.637415 2026] [:error] [pid 37884:tid 37898] [client 34.133.228.184:56950] [client 34.133.228.184] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aZ2kev08KJo-7FmKlnBSaQAAA0o"]
[Tue Feb 24 23:44:39.092887 2026] [:error] [pid 40456:tid 40495] [client 43.135.172.89:39040] [client 43.135.172.89] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ3HZ-P0ojUS1IXv0AXhuAAAAYg"]
[Wed Feb 25 01:58:18.556628 2026] [:error] [pid 18447:tid 18787] [client 43.130.74.193:59870] [client 43.130.74.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZ3mus-TpHVc8yBj5eayuQAAAhg"]
[Wed Feb 25 03:42:53.709405 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.149:28937] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Feb 25 03:42:53.974278 2026] [:error] [pid 20660:tid 20722] [client 98.159.43.149:28937] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Feb 25 03:42:54.083673 2026] [:error] [pid 20660:tid 20723] [client 98.159.43.149:28937] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aZ3_Pv6o0bjbSJXjrpHCkgAAAIE"]
[Wed Feb 25 03:42:54.288841 2026] [:error] [pid 20659:tid 20698] [client 98.159.43.132:38377] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Feb 25 03:42:54.450628 2026] [:error] [pid 20659:tid 20715] [client 98.159.43.132:38377] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aZ3_Pj_THK_HtK-Q44LAoQAAAFQ"]
[Wed Feb 25 03:42:54.730271 2026] [:error] [pid 20660:tid 20730] [client 98.159.43.106:46337] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Feb 25 03:42:55.036849 2026] [:error] [pid 20660:tid 20742] [client 98.159.43.106:46337] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Feb 25 03:42:55.181634 2026] [:error] [pid 20660:tid 20733] [client 98.159.43.106:46337] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 25 03:42:55.297539 2026] [:error] [pid 20660:tid 20729] [client 98.159.43.106:46337] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Feb 25 03:42:55.540029 2026] [:error] [pid 20660:tid 20726] [client 98.159.43.106:46337] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aZ3_P_6o0bjbSJXjrpHCmwAAAIQ"]
[Wed Feb 25 03:42:55.787642 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.133:26349] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Feb 25 03:42:55.906867 2026] [:error] [pid 20763:tid 20784] [client 98.159.43.133:26349] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Feb 25 03:42:57.286774 2026] [:error] [pid 20763:tid 20784] [client 98.159.43.133:26349] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aZ3_QU0w_zc13OX-xia5UAAAANM"]
[Wed Feb 25 03:42:57.582470 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.161:63057] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aZ3_Qeu8cohhPfsAIFmNmwAAABM"]
[Wed Feb 25 03:42:57.804021 2026] [:error] [pid 20763:tid 20773] [client 98.159.43.130:58623] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aZ3_QU0w_zc13OX-xia5UwAAAMg"]
[Wed Feb 25 03:42:58.142794 2026] [:error] [pid 20660:tid 20730] [client 98.159.43.150:37001] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aZ3_Qv6o0bjbSJXjrpHCpAAAAIg"]
[Wed Feb 25 03:42:58.499068 2026] [:error] [pid 20660:tid 20725] [client 98.159.43.113:59167] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aZ3_Qv6o0bjbSJXjrpHCqQAAAIM"]
[Wed Feb 25 03:42:58.951759 2026] [:error] [pid 20658:tid 20682] [client 98.159.43.110:47899] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Feb 25 03:42:59.307355 2026] [:error] [pid 20658:tid 20683] [client 98.159.43.110:47899] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Feb 25 03:42:59.412715 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.110:47899] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aZ3_Q-u8cohhPfsAIFmNowAAABU"]
[Wed Feb 25 03:42:59.612270 2026] [:error] [pid 20659:tid 20710] [client 98.159.43.105:44659] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aZ3_Qz_THK_HtK-Q44LApAAAAE8"]
[Wed Feb 25 03:42:59.984446 2026] [:error] [pid 20660:tid 20746] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Wed Feb 25 03:43:00.110707 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-2019.php
[Wed Feb 25 03:43:00.215970 2026] [:error] [pid 20660:tid 20723] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Feb 25 03:43:00.383474 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Wed Feb 25 03:43:00.539181 2026] [:error] [pid 20660:tid 20725] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Wed Feb 25 03:43:00.640551 2026] [:error] [pid 20660:tid 20728] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/mail.php
[Wed Feb 25 03:43:00.881589 2026] [:error] [pid 20660:tid 20745] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/lufix.php
[Wed Feb 25 03:43:01.085308 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Wed Feb 25 03:43:01.213732 2026] [:error] [pid 20660:tid 20742] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Wed Feb 25 03:43:01.346799 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Feb 25 03:43:01.455625 2026] [:error] [pid 20660:tid 20723] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/upfile.php
[Wed Feb 25 03:43:01.567714 2026] [:error] [pid 20660:tid 20734] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Feb 25 03:43:01.701830 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Feb 25 03:43:01.832965 2026] [:error] [pid 20660:tid 20729] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Wed Feb 25 03:43:01.961215 2026] [:error] [pid 20660:tid 20725] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/updates.php
[Wed Feb 25 03:43:02.135240 2026] [:error] [pid 20660:tid 20735] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Feb 25 03:43:02.243976 2026] [:error] [pid 20660:tid 20727] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Wed Feb 25 03:43:02.358019 2026] [:error] [pid 20660:tid 20733] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed Feb 25 03:43:02.463409 2026] [:error] [pid 20660:tid 20731] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Wed Feb 25 03:43:02.615985 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Feb 25 03:43:03.006858 2026] [:error] [pid 20660:tid 20742] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Wed Feb 25 03:43:03.125091 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Feb 25 03:43:03.272162 2026] [:error] [pid 20660:tid 20723] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Wed Feb 25 03:43:03.421289 2026] [:error] [pid 20660:tid 20730] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Feb 25 03:43:03.542968 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Feb 25 03:43:03.637494 2026] [:error] [pid 20660:tid 20726] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Wed Feb 25 03:43:03.751417 2026] [:error] [pid 20660:tid 20729] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Feb 25 03:43:03.854601 2026] [:error] [pid 20660:tid 20725] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Wed Feb 25 03:43:03.957236 2026] [:error] [pid 20660:tid 20740] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233.php
[Wed Feb 25 03:43:04.071856 2026] [:error] [pid 20660:tid 20741] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Wed Feb 25 03:43:04.176076 2026] [:error] [pid 20660:tid 20735] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Wed Feb 25 03:43:04.290825 2026] [:error] [pid 20660:tid 20745] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Wed Feb 25 03:43:04.480653 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Feb 25 03:43:04.607933 2026] [:error] [pid 20660:tid 20728] [client 98.159.43.132:21767] [client 98.159.43.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.132, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aZ3_SP6o0bjbSJXjrpHC7AAAAIY"]
[Wed Feb 25 03:43:04.611561 2026] [:error] [pid 20660:tid 20728] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Feb 25 03:43:04.813120 2026] [:error] [pid 20660:tid 20746] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Wed Feb 25 03:43:04.930329 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.132:21767] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Feb 25 03:43:05.038620 2026] [:error] [pid 20660:tid 20737] [client 98.159.43.132:21767] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/modules.php"] [unique_id "aZ3_Sf6o0bjbSJXjrpHC8QAAAI8"]
[Wed Feb 25 03:43:05.304894 2026] [:error] [pid 20763:tid 20776] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/olux.php
[Wed Feb 25 03:43:05.423808 2026] [:error] [pid 20763:tid 20785] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Feb 25 03:43:05.674282 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/uploader.php
[Wed Feb 25 03:43:05.819039 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Wed Feb 25 03:43:05.934004 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Wed Feb 25 03:43:06.050954 2026] [:error] [pid 20763:tid 20767] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Wed Feb 25 03:43:06.214507 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/wxo.php
[Wed Feb 25 03:43:06.337355 2026] [:error] [pid 20763:tid 20784] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/amigo.php
[Wed Feb 25 03:43:06.510186 2026] [:error] [pid 20763:tid 20776] [client 98.159.43.147:57035] File does not exist: /usr/local/apache/htdocs/suspended-page/yoi.php
[Wed Feb 25 03:43:06.732501 2026] [:error] [pid 20763:tid 20774] [client 98.159.43.147:57035] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aZ3_Sk0w_zc13OX-xia5egAAAMk"]
[Wed Feb 25 03:43:06.953044 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-contentt.php
[Wed Feb 25 03:43:07.135871 2026] [:error] [pid 20763:tid 20778] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/we1y8.php
[Wed Feb 25 03:43:07.812983 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Wed Feb 25 03:43:07.914111 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/post-data.php
[Wed Feb 25 03:43:08.033344 2026] [:error] [pid 20763:tid 20774] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/w0.php
[Wed Feb 25 03:43:08.132078 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/old-index.php
[Wed Feb 25 03:43:08.274075 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/wsanon.php
[Wed Feb 25 03:43:08.657239 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Wed Feb 25 03:43:08.801161 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/beence.php
[Wed Feb 25 03:43:08.919030 2026] [:error] [pid 20763:tid 20767] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/indosec.php
[Wed Feb 25 03:43:09.037765 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/archives.php
[Wed Feb 25 03:43:09.161015 2026] [:error] [pid 20763:tid 20786] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/po8sa.php
[Wed Feb 25 03:43:09.272431 2026] [:error] [pid 20763:tid 20776] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/thesmartestx.php
[Wed Feb 25 03:43:09.428222 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/zcanp.php
[Wed Feb 25 03:43:09.659835 2026] [:error] [pid 20763:tid 20789] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/pvt.php
[Wed Feb 25 03:43:09.771284 2026] [:error] [pid 20763:tid 20788] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Wed Feb 25 03:43:10.050702 2026] [:error] [pid 20763:tid 20783] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/crypted.php
[Wed Feb 25 03:43:10.153552 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/h0110w4y.php
[Wed Feb 25 03:43:10.284680 2026] [:error] [pid 20763:tid 20781] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/vesiw.php
[Wed Feb 25 03:43:10.425227 2026] [:error] [pid 20763:tid 20772] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Wed Feb 25 03:43:10.526515 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.110:20133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Wed Feb 25 03:43:10.645172 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.110:20133] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/lx.php"] [unique_id "aZ3_Tk0w_zc13OX-xia5pAAAANY"]
[Wed Feb 25 03:43:11.094329 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/lx.php
[Wed Feb 25 03:43:11.223788 2026] [:error] [pid 20658:tid 20670] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/tonant.php
[Wed Feb 25 03:43:11.390154 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/f0x.php
[Wed Feb 25 03:43:11.515276 2026] [:error] [pid 20658:tid 20691] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/config.bak.php
[Wed Feb 25 03:43:11.615914 2026] [:error] [pid 20658:tid 20674] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass403.php
[Wed Feb 25 03:43:11.738515 2026] [:error] [pid 20658:tid 20668] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Wed Feb 25 03:43:11.858179 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/allahnaber.php
[Wed Feb 25 03:43:11.965276 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/AK-74.php
[Wed Feb 25 03:43:12.101185 2026] [:error] [pid 20658:tid 20671] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa3.php
[Wed Feb 25 03:43:12.200737 2026] [:error] [pid 20658:tid 20682] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/alfaindex.php
[Wed Feb 25 03:43:12.321851 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Feb 25 03:43:12.446834 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/c99.php
[Wed Feb 25 03:43:12.551204 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Wed Feb 25 03:43:12.678153 2026] [:error] [pid 20658:tid 20677] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/cw.php
[Wed Feb 25 03:43:12.774903 2026] [:error] [pid 20658:tid 20689] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/date.php
[Wed Feb 25 03:43:12.880431 2026] [:error] [pid 20658:tid 20669] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/haxor.php
[Wed Feb 25 03:43:13.010773 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/icomsium.php
[Wed Feb 25 03:43:13.135403 2026] [:error] [pid 20658:tid 20676] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/ico.php
[Wed Feb 25 03:43:13.255380 2026] [:error] [pid 20658:tid 20670] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/leaf.php
[Wed Feb 25 03:43:13.390727 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Wed Feb 25 03:43:13.525307 2026] [:error] [pid 20658:tid 20674] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Wed Feb 25 03:43:13.627883 2026] [:error] [pid 20658:tid 20668] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Feb 25 03:43:13.740075 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/priv8.php
[Wed Feb 25 03:43:13.875320 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/pws.php
[Wed Feb 25 03:43:13.990847 2026] [:error] [pid 20658:tid 20671] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/r57.php
[Wed Feb 25 03:43:14.110460 2026] [:error] [pid 20658:tid 20682] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Feb 25 03:43:14.212360 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/snd.php
[Wed Feb 25 03:43:14.345709 2026] [:error] [pid 20658:tid 20672] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Feb 25 03:43:14.487068 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.105:30835] File does not exist: /usr/local/apache/htdocs/suspended-page/new-index.php
[Wed Feb 25 03:43:18.328709 2026] [:error] [pid 20658:tid 20672] [client 98.159.43.105:30835] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/F0x.php"] [unique_id "aZ3_Vuu8cohhPfsAIFmN8AAAAAU"]
[Wed Feb 25 03:43:18.675838 2026] [:error] [pid 20659:tid 20709] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-widget-archives.php
[Wed Feb 25 03:43:21.420700 2026] [:error] [pid 20659:tid 20714] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet-shell.php
[Wed Feb 25 03:43:21.525755 2026] [:error] [pid 20659:tid 20711] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/xleet.php
[Wed Feb 25 03:43:21.648696 2026] [:error] [pid 20659:tid 20699] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/xleetshell.php
[Wed Feb 25 03:43:21.983009 2026] [:error] [pid 20659:tid 20704] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/xlt.php
[Wed Feb 25 03:43:22.703862 2026] [:error] [pid 20659:tid 20715] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-apxupx.php
[Wed Feb 25 03:43:22.852758 2026] [:error] [pid 20659:tid 20707] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Wed Feb 25 03:43:23.025565 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Feb 25 03:43:23.142198 2026] [:error] [pid 20659:tid 20717] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Wed Feb 25 03:43:23.255472 2026] [:error] [pid 20659:tid 20705] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Wed Feb 25 03:43:23.362982 2026] [:error] [pid 20659:tid 20703] [client 98.159.43.113:63819] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-pano.php
[Wed Feb 25 03:43:23.681473 2026] [:error] [pid 20659:tid 20698] [client 98.159.43.113:63819] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aZ3_Wz_THK_HtK-Q44LA4gAAAEM"]
[Wed Feb 25 03:43:23.890688 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.107:51113] [client 98.159.43.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.43.107, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aZ3_W-u8cohhPfsAIFmN9QAAAA4"]
[Wed Feb 25 03:43:23.895798 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.107:51113] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed Feb 25 03:43:24.019190 2026] [:error] [pid 20658:tid 20676] [client 98.159.43.107:51113] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Wed Feb 25 03:43:24.302999 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.107:51113] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aZ3_XOu8cohhPfsAIFmN-AAAAAs"]
[Wed Feb 25 03:43:24.713284 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.123:56617] File does not exist: /usr/local/apache/htdocs/suspended-page/WSOEnigma.php
[Wed Feb 25 03:43:25.363891 2026] [:error] [pid 20763:tid 20783] [client 98.159.43.123:56617] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Feb 25 03:43:25.630101 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.123:56617] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Wed Feb 25 03:43:25.726724 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.123:56617] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZ3_XU0w_zc13OX-xia50AAAAMY"]
[Wed Feb 25 03:43:25.964816 2026] [:error] [pid 20659:tid 20708] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/gebase.php
[Wed Feb 25 03:43:26.079523 2026] [:error] [pid 20659:tid 20718] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Wed Feb 25 03:43:26.183198 2026] [:error] [pid 20659:tid 20713] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Wed Feb 25 03:43:26.805021 2026] [:error] [pid 20659:tid 20707] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Wed Feb 25 03:43:26.955634 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Feb 25 03:43:27.060666 2026] [:error] [pid 20659:tid 20703] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Feb 25 03:43:27.171376 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-add.php
[Wed Feb 25 03:43:27.652682 2026] [:error] [pid 20659:tid 20712] [client 98.159.43.145:63483] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Wed Feb 25 03:43:28.129401 2026] [:error] [pid 20659:tid 20718] [client 98.159.43.145:63483] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aZ3_YD_THK_HtK-Q44LA-AAAAFc"]
[Wed Feb 25 03:43:28.407779 2026] [:error] [pid 20659:tid 20709] [client 98.159.43.111:29111] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZ3_YD_THK_HtK-Q44LA-QAAAE4"]
[Wed Feb 25 03:43:28.737002 2026] [:error] [pid 20763:tid 20777] [client 98.159.43.146:53573] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aZ3_YE0w_zc13OX-xia52AAAAMw"]
[Wed Feb 25 03:43:29.041020 2026] [:error] [pid 20659:tid 20710] [client 98.159.43.134:43711] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aZ3_YT_THK_HtK-Q44LA-gAAAE8"]
[Wed Feb 25 03:43:29.250804 2026] [:error] [pid 20659:tid 20699] [client 98.159.43.119:40699] File does not exist: /usr/local/apache/htdocs/suspended-page/text.php
[Wed Feb 25 03:43:29.390321 2026] [:error] [pid 20659:tid 20719] [client 98.159.43.119:40699] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Wed Feb 25 03:43:29.629155 2026] [:error] [pid 20659:tid 20715] [client 98.159.43.119:40699] [client 98.159.43.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.119, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aZ3_YT_THK_HtK-Q44LA_wAAAFQ"]
[Wed Feb 25 03:43:30.369837 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.119:40699] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Wed Feb 25 03:43:30.580759 2026] [:error] [pid 20659:tid 20701] [client 98.159.43.119:40699] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Wed Feb 25 03:43:31.449214 2026] [:error] [pid 20659:tid 20699] [client 98.159.43.119:40699] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aZ3_Yz_THK_HtK-Q44LBEQAAAEQ"]
[Wed Feb 25 03:43:31.658667 2026] [:error] [pid 20660:tid 20729] [client 98.159.43.133:62487] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Feb 25 03:43:32.007576 2026] [:error] [pid 20660:tid 20741] [client 98.159.43.133:62487] [client 98.159.43.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.133, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aZ3_ZP6o0bjbSJXjrpHDQgAAAJM"]
[Wed Feb 25 03:43:32.158894 2026] [:error] [pid 20660:tid 20745] [client 98.159.43.133:62487] File does not exist: /usr/local/apache/htdocs/suspended-page/baxa1.php
[Wed Feb 25 03:43:32.401995 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.133:62487] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Wed Feb 25 03:43:32.534488 2026] [:error] [pid 20660:tid 20740] [client 98.159.43.133:62487] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Wed Feb 25 03:43:32.765268 2026] [:error] [pid 20660:tid 20732] [client 98.159.43.133:62487] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Feb 25 03:43:32.923032 2026] [:error] [pid 20660:tid 20727] [client 98.159.43.133:62487] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Wed Feb 25 03:43:33.037778 2026] [:error] [pid 20660:tid 20746] [client 98.159.43.133:62487] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aZ3_Zf6o0bjbSJXjrpHDSwAAAJg"]
[Wed Feb 25 03:43:34.273605 2026] [:error] [pid 20658:tid 20671] [client 98.159.43.138:47633] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aZ3_Zuu8cohhPfsAIFmOEgAAAAQ"]
[Wed Feb 25 03:43:34.544707 2026] [:error] [pid 20658:tid 20682] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen-667.php
[Wed Feb 25 03:43:34.651470 2026] [:error] [pid 20658:tid 20672] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Wed Feb 25 03:43:34.848772 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Wed Feb 25 03:43:34.974285 2026] [:error] [pid 20658:tid 20683] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Feb 25 03:43:35.198598 2026] [:error] [pid 20658:tid 20669] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/htdocs/suspended-page/yanz.php
[Wed Feb 25 03:43:35.731284 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/zmFM.php
[Wed Feb 25 03:43:36.819328 2026] [:error] [pid 20658:tid 20672] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny.php
[Wed Feb 25 03:43:36.921093 2026] [:error] [pid 20658:tid 20683] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Feb 25 03:43:37.041057 2026] [:error] [pid 20658:tid 20684] [client 98.159.43.113:43699] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Wed Feb 25 03:43:37.313903 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.113:43699] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aZ3_aeu8cohhPfsAIFmOLwAAAA4"]
[Wed Feb 25 03:43:37.972601 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.105:24367] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bak.php"] [unique_id "aZ3_aeu8cohhPfsAIFmONAAAAAs"]
[Wed Feb 25 03:43:38.280144 2026] [:error] [pid 20660:tid 20742] [client 98.159.43.156:64087] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Wed Feb 25 03:43:38.384713 2026] [:error] [pid 20660:tid 20740] [client 98.159.43.156:64087] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZ3_av6o0bjbSJXjrpHDVAAAAJI"]
[Wed Feb 25 03:43:38.840199 2026] [:error] [pid 20658:tid 20668] [client 98.159.43.122:52359] File does not exist: /usr/local/apache/htdocs/suspended-page/cron.php
[Wed Feb 25 03:43:39.083961 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.122:52359] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Feb 25 03:43:39.225207 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.122:52359] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aZ3_a-u8cohhPfsAIFmOOwAAABM"]
[Wed Feb 25 03:43:39.417043 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.152:64879] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aZ3_a_6o0bjbSJXjrpHDWAAAAI4"]
[Wed Feb 25 03:43:40.986452 2026] [:error] [pid 20660:tid 20733] [client 98.159.43.145:51379] [client 98.159.43.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.145, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aZ3_bP6o0bjbSJXjrpHDXAAAAIs"]
[Wed Feb 25 03:43:41.102150 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.145:51379] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Wed Feb 25 03:43:41.310126 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.145:51379] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/themes.php"] [unique_id "aZ3_bf6o0bjbSJXjrpHDYAAAAJU"]
[Wed Feb 25 03:43:41.512515 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.137:54797] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 25 03:43:41.791538 2026] [:error] [pid 20763:tid 20780] [client 98.159.43.137:54797] File does not exist: /usr/local/apache/htdocs/suspended-page/back.php
[Wed Feb 25 03:43:42.444200 2026] [:error] [pid 20763:tid 20789] [client 98.159.43.137:54797] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aZ3_bk0w_zc13OX-xia6EAAAANg"]
[Wed Feb 25 03:43:42.670096 2026] [:error] [pid 20660:tid 20731] [client 98.159.43.139:33855] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Feb 25 03:43:42.914092 2026] [:error] [pid 20660:tid 20727] [client 98.159.43.139:33855] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aZ3_bv6o0bjbSJXjrpHDYwAAAIU"]
[Wed Feb 25 03:43:43.260426 2026] [:error] [pid 20763:tid 20773] [client 98.159.43.160:43155] File does not exist: /usr/local/apache/htdocs/suspended-page/phpfm3.php
[Wed Feb 25 03:43:43.358915 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.160:43155] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aZ3_b00w_zc13OX-xia6EwAAAMY"]
[Wed Feb 25 03:43:43.864057 2026] [:error] [pid 20660:tid 20729] [client 98.159.43.130:56045] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Wed Feb 25 03:43:43.991197 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.130:56045] [client 98.159.43.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.130, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aZ3_b_6o0bjbSJXjrpHDawAAAI4"]
[Wed Feb 25 03:43:44.319515 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.130:56045] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aZ3_cP6o0bjbSJXjrpHDcAAAAJE"]
[Wed Feb 25 03:43:44.622932 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.106:20575] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZ3_cE0w_zc13OX-xia6FgAAANY"]
[Wed Feb 25 03:43:45.247245 2026] [:error] [pid 20763:tid 20777] [client 98.159.43.105:22879] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Wed Feb 25 03:43:45.664121 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.105:22879] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Wed Feb 25 03:43:45.893530 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.105:22879] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Wed Feb 25 03:43:46.010628 2026] [:error] [pid 20763:tid 20772] [client 98.159.43.105:22879] File does not exist: /usr/local/apache/htdocs/suspended-page/zip.php
[Wed Feb 25 03:43:46.221127 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.105:22879] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aZ3_ck0w_zc13OX-xia6JwAAAMU"]
[Wed Feb 25 03:43:46.730264 2026] [:error] [pid 20660:tid 20734] [client 98.159.43.155:46491] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aZ3_cv6o0bjbSJXjrpHDeQAAAIw"]
[Wed Feb 25 03:43:46.923734 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.145:39989] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "aZ3_cv6o0bjbSJXjrpHDegAAAJE"]
[Wed Feb 25 03:43:47.184908 2026] [:error] [pid 20660:tid 20723] [client 98.159.43.105:24955] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aZ3_c_6o0bjbSJXjrpHDfAAAAIE"]
[Wed Feb 25 03:43:47.473296 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.130:42661] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aZ3_cz_THK_HtK-Q44LBIQAAAEE"]
[Wed Feb 25 03:43:49.359086 2026] [:error] [pid 20763:tid 20783] [client 98.159.43.157:57949] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Wed Feb 25 03:43:49.495596 2026] [:error] [pid 20763:tid 20786] [client 98.159.43.157:57949] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aZ3_dU0w_zc13OX-xia6OQAAANU"]
[Wed Feb 25 03:43:49.948190 2026] [:error] [pid 20763:tid 20776] [client 98.159.43.131:41567] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Feb 25 03:43:50.071483 2026] [:error] [pid 20763:tid 20780] [client 98.159.43.131:41567] File does not exist: /usr/local/apache/htdocs/suspended-page/rcc.php
[Wed Feb 25 03:43:50.182520 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.131:41567] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aZ3_dk0w_zc13OX-xia6QAAAAME"]
[Wed Feb 25 03:43:50.515078 2026] [:error] [pid 20660:tid 20731] [client 98.159.43.105:39211] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Wed Feb 25 03:43:50.644094 2026] [:error] [pid 20660:tid 20745] [client 98.159.43.105:39211] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Wed Feb 25 03:43:50.746874 2026] [:error] [pid 20660:tid 20735] [client 98.159.43.105:39211] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aZ3_dv6o0bjbSJXjrpHDgQAAAI0"]
[Wed Feb 25 03:43:51.052101 2026] [:error] [pid 20660:tid 20724] [client 98.159.43.160:27227] File does not exist: /usr/local/apache/htdocs/suspended-page/history.php
[Wed Feb 25 03:43:51.207988 2026] [:error] [pid 20660:tid 20744] [client 98.159.43.160:27227] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aZ3_d_6o0bjbSJXjrpHDhQAAAJY"]
[Wed Feb 25 03:43:51.834968 2026] [:error] [pid 20659:tid 20701] [client 98.159.43.144:42303] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aZ3_dz_THK_HtK-Q44LBMwAAAEY"]
[Wed Feb 25 03:43:52.029919 2026] [:error] [pid 20660:tid 20728] [client 98.159.43.131:56957] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aZ3_eP6o0bjbSJXjrpHDhwAAAIY"]
[Wed Feb 25 03:43:52.480876 2026] [:error] [pid 20659:tid 20716] [client 98.159.43.107:44793] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aZ3_eD_THK_HtK-Q44LBNwAAAFU"]
[Wed Feb 25 03:43:52.750930 2026] [:error] [pid 20659:tid 20707] [client 98.159.43.162:34343] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 25 03:43:54.447895 2026] [:error] [pid 20659:tid 20706] [client 98.159.43.162:34343] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Wed Feb 25 03:43:54.579886 2026] [:error] [pid 20659:tid 20708] [client 98.159.43.162:34343] [client 98.159.43.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.162, incrementing brute counter"] [hostname "rejuva.au"] [uri "/cgi-bin/wp-login.php"] [unique_id "aZ3_ej_THK_HtK-Q44LBSAAAAE0"]
[Wed Feb 25 03:43:54.824423 2026] [:error] [pid 20659:tid 20707] [client 98.159.43.162:34343] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aZ3_ej_THK_HtK-Q44LBSwAAAEw"]
[Wed Feb 25 03:43:55.074089 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.155:48387] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aZ3_e00w_zc13OX-xia6QwAAAMA"]
[Wed Feb 25 03:43:55.290629 2026] [:error] [pid 20763:tid 20774] [client 98.159.43.163:20125] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Feb 25 03:43:55.399036 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.163:20125] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Wed Feb 25 03:43:55.904753 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.163:20125] File does not exist: /usr/local/apache/htdocs/suspended-page/login.php
[Wed Feb 25 03:43:56.279845 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.163:20125] [client 98.159.43.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.163, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZ3_fE0w_zc13OX-xia6UAAAAME"]
[Wed Feb 25 03:43:56.379009 2026] [:error] [pid 20763:tid 20785] [client 98.159.43.163:20125] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aZ3_fE0w_zc13OX-xia6UQAAANQ"]
[Wed Feb 25 03:43:56.656165 2026] [:error] [pid 20763:tid 20773] [client 98.159.43.133:37087] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aZ3_fE0w_zc13OX-xia6VAAAAMg"]
[Wed Feb 25 03:43:56.921342 2026] [:error] [pid 20763:tid 20774] [client 98.159.43.107:55453] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aZ3_fE0w_zc13OX-xia6VQAAAMk"]
[Wed Feb 25 03:43:58.071044 2026] [:error] [pid 20763:tid 20779] [client 98.159.43.121:49721] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Wed Feb 25 03:43:58.194118 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.121:49721] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aZ3_fk0w_zc13OX-xia6XgAAAME"]
[Wed Feb 25 03:43:58.604822 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.156:27627] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Wed Feb 25 03:43:59.245714 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.156:27627] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Wed Feb 25 03:43:59.613342 2026] [:error] [pid 20763:tid 20780] [client 98.159.43.156:27627] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Wed Feb 25 03:43:59.746966 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.156:27627] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aZ3_f00w_zc13OX-xia6bgAAAME"]
[Wed Feb 25 03:44:00.117022 2026] [:error] [pid 20658:tid 20683] [client 98.159.43.141:51645] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Wed Feb 25 03:44:00.382726 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.141:51645] [client 98.159.43.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aZ3_gOu8cohhPfsAIFmOXgAAABI"]
[Wed Feb 25 03:44:00.835054 2026] [:error] [pid 20660:tid 20730] [client 98.159.43.116:62243] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Feb 25 03:44:01.238944 2026] [:error] [pid 20660:tid 20731] [client 98.159.43.116:62243] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aZ3_gf6o0bjbSJXjrpHDoAAAAIk"]
[Wed Feb 25 03:44:01.730436 2026] [:error] [pid 20660:tid 20724] [client 98.159.43.119:47789] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aZ3_gf6o0bjbSJXjrpHDpgAAAII"]
[Wed Feb 25 03:44:02.262949 2026] [:error] [pid 20658:tid 20673] [client 98.159.43.140:56947] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aZ3_guu8cohhPfsAIFmOZgAAAAY"]
[Wed Feb 25 03:44:02.699562 2026] [:error] [pid 20659:tid 20700] [client 98.159.43.133:46189] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aZ3_gj_THK_HtK-Q44LBTgAAAEU"]
[Wed Feb 25 03:44:03.052252 2026] [:error] [pid 20658:tid 20668] [client 98.159.43.155:31491] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aZ3_g-u8cohhPfsAIFmOagAAAAE"]
[Wed Feb 25 03:44:03.508772 2026] [:error] [pid 20658:tid 20684] [client 98.159.43.106:60563] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZ3_g-u8cohhPfsAIFmObgAAABE"]
[Wed Feb 25 03:44:03.874199 2026] [:error] [pid 20763:tid 20777] [client 98.159.43.106:59467] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Feb 25 03:44:04.096852 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.106:59467] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aZ3_hE0w_zc13OX-xia6egAAAMU"]
[Wed Feb 25 03:44:04.547933 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.108:53003] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-post.php
[Wed Feb 25 03:44:04.651966 2026] [:error] [pid 20763:tid 20785] [client 98.159.43.108:53003] File does not exist: /usr/local/apache/htdocs/suspended-page/conf_upload.php
[Wed Feb 25 03:44:04.767913 2026] [:error] [pid 20763:tid 20784] [client 98.159.43.108:53003] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aZ3_hE0w_zc13OX-xia6gQAAANM"]
[Wed Feb 25 03:44:05.282890 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.154:43981] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aZ3_hU0w_zc13OX-xia6hwAAAMM"]
[Wed Feb 25 03:44:05.473242 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.156:33395] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Wed Feb 25 03:44:05.712564 2026] [:error] [pid 20763:tid 20789] [client 98.159.43.156:33395] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Wed Feb 25 03:44:05.958968 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.156:33395] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Feb 25 03:44:06.063306 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.156:33395] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aZ3_hk0w_zc13OX-xia6kwAAANE"]
[Wed Feb 25 03:44:06.479962 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.113:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Feb 25 03:44:06.855927 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.113:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Wed Feb 25 03:44:06.955171 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.113:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Feb 25 03:44:07.339156 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.113:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Wed Feb 25 03:44:07.453542 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.113:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Wed Feb 25 03:44:07.993567 2026] [:error] [pid 20658:tid 20677] [client 98.159.43.113:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/woh.php
[Wed Feb 25 03:44:08.158152 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.113:41177] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aZ3_iOu8cohhPfsAIFmOhQAAABc"]
[Wed Feb 25 03:44:08.410379 2026] [:error] [pid 20763:tid 20786] [client 98.159.43.120:25895] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aZ3_iE0w_zc13OX-xia6ngAAANU"]
[Wed Feb 25 03:44:08.707293 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.140:46393] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Feb 25 03:44:08.845404 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.140:46393] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Feb 25 03:44:08.985817 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.140:46393] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Feb 25 03:44:09.113891 2026] [:error] [pid 20763:tid 20780] [client 98.159.43.140:46393] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aZ3_iU0w_zc13OX-xia6pgAAAM8"]
[Wed Feb 25 03:44:09.344304 2026] [:error] [pid 20660:tid 20744] [client 98.159.43.121:36687] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aZ3_if6o0bjbSJXjrpHDuQAAAJY"]
[Wed Feb 25 03:44:09.615511 2026] [:error] [pid 20660:tid 20723] [client 98.159.43.151:45041] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Feb 25 03:44:09.762298 2026] [:error] [pid 20660:tid 20722] [client 98.159.43.151:45041] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aZ3_if6o0bjbSJXjrpHDvAAAAIA"]
[Wed Feb 25 03:44:10.146056 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.118:27949] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Wed Feb 25 03:44:10.260828 2026] [:error] [pid 20763:tid 20775] [client 98.159.43.118:27949] File does not exist: /usr/local/apache/htdocs/suspended-page/sck.php
[Wed Feb 25 03:44:10.387009 2026] [:error] [pid 20763:tid 20777] [client 98.159.43.118:27949] File does not exist: /usr/local/apache/htdocs/suspended-page/fm.php
[Wed Feb 25 03:44:10.642015 2026] [:error] [pid 20763:tid 20779] [client 98.159.43.118:27949] File does not exist: /usr/local/apache/htdocs/suspended-page/packed.php
[Wed Feb 25 03:44:10.739189 2026] [:error] [pid 20763:tid 20789] [client 98.159.43.118:27949] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 25 03:44:10.834316 2026] [:error] [pid 20763:tid 20784] [client 98.159.43.118:27949] [client 98.159.43.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aZ3_ik0w_zc13OX-xia6swAAANM"]
[Wed Feb 25 03:44:11.255703 2026] [:error] [pid 20763:tid 20781] [client 98.159.43.119:46895] [client 98.159.43.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.119, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aZ3_i00w_zc13OX-xia6tgAAANA"]
[Wed Feb 25 03:44:11.357518 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.119:46895] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Wed Feb 25 03:44:11.470121 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.119:46895] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aZ3_i00w_zc13OX-xia6uAAAANY"]
[Wed Feb 25 03:44:11.677691 2026] [:error] [pid 20660:tid 20735] [client 98.159.43.134:48329] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aZ3_i_6o0bjbSJXjrpHDwQAAAI0"]
[Wed Feb 25 03:44:12.163465 2026] [:error] [pid 20660:tid 20725] [client 98.159.43.108:37627] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 25 03:44:12.318785 2026] [:error] [pid 20660:tid 20737] [client 98.159.43.108:37627] File does not exist: /usr/local/apache/htdocs/suspended-page/load.php
[Wed Feb 25 03:44:12.420888 2026] [:error] [pid 20660:tid 20726] [client 98.159.43.108:37627] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aZ3_jP6o0bjbSJXjrpHDxwAAAIQ"]
[Wed Feb 25 03:44:12.699658 2026] [:error] [pid 20660:tid 20744] [client 98.159.43.155:48681] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Wed Feb 25 03:44:12.862443 2026] [:error] [pid 20660:tid 20738] [client 98.159.43.155:48681] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aZ3_jP6o0bjbSJXjrpHDywAAAJA"]
[Wed Feb 25 03:44:13.292951 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.123:47341] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Feb 25 03:44:13.414819 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.123:47341] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Wed Feb 25 03:44:13.547418 2026] [:error] [pid 20763:tid 20779] [client 98.159.43.123:47341] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/cloud.php
[Wed Feb 25 03:44:14.128820 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.123:47341] File does not exist: /usr/local/apache/htdocs/suspended-page/product.php
[Wed Feb 25 03:44:14.257241 2026] [:error] [pid 20763:tid 20781] [client 98.159.43.123:47341] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/class_api.php
[Wed Feb 25 03:44:14.504319 2026] [:error] [pid 20763:tid 20788] [client 98.159.43.123:47341] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aZ3_jk0w_zc13OX-xia6zAAAANc"]
[Wed Feb 25 03:44:14.845674 2026] [:error] [pid 20660:tid 20735] [client 98.159.43.135:55125] File does not exist: /usr/local/apache/htdocs/suspended-page/base.php
[Wed Feb 25 03:44:15.112841 2026] [:error] [pid 20660:tid 20724] [client 98.159.43.135:55125] File does not exist: /usr/local/apache/htdocs/suspended-page/zero.php
[Wed Feb 25 03:44:15.240836 2026] [:error] [pid 20660:tid 20725] [client 98.159.43.135:55125] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aZ3_j_6o0bjbSJXjrpHD1AAAAIM"]
[Wed Feb 25 03:44:15.631189 2026] [:error] [pid 20658:tid 20674] [client 98.159.43.144:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Feb 25 03:44:15.731464 2026] [:error] [pid 20658:tid 20670] [client 98.159.43.144:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Feb 25 03:44:15.844282 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.144:48749] [client 98.159.43.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.144, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aZ3_j-u8cohhPfsAIFmOkQAAABc"]
[Wed Feb 25 03:44:15.848221 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.144:48749] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Wed Feb 25 03:44:16.255963 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.144:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Wed Feb 25 03:44:16.366192 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.144:48749] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Feb 25 03:44:16.655733 2026] [:error] [pid 20658:tid 20673] [client 98.159.43.144:48749] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mah.php"] [unique_id "aZ3_kOu8cohhPfsAIFmOlwAAAAY"]
[Wed Feb 25 03:44:16.906360 2026] [:error] [pid 20763:tid 20776] [client 98.159.43.112:37059] [client 98.159.43.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.112, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aZ3_kE0w_zc13OX-xia6zwAAAMs"]
[Wed Feb 25 03:44:17.084606 2026] [:error] [pid 20763:tid 20789] [client 98.159.43.112:37059] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aZ3_kU0w_zc13OX-xia60gAAANg"]
[Wed Feb 25 03:44:18.229672 2026] [:error] [pid 20660:tid 20741] [client 98.159.43.163:48315] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Wed Feb 25 03:44:18.577125 2026] [:error] [pid 20660:tid 20724] [client 98.159.43.163:48315] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aZ3_kv6o0bjbSJXjrpHD5QAAAII"]
[Wed Feb 25 03:44:18.861477 2026] [:error] [pid 20763:tid 20785] [client 98.159.43.134:56929] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Feb 25 03:44:19.132809 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.134:56929] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aZ3_k00w_zc13OX-xia61wAAAME"]
[Wed Feb 25 03:44:19.457969 2026] [:error] [pid 20660:tid 20726] [client 98.159.43.136:44005] [client 98.159.43.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.136, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aZ3_k_6o0bjbSJXjrpHD6AAAAIQ"]
[Wed Feb 25 03:44:19.936757 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.136:44005] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Wed Feb 25 03:44:20.040070 2026] [:error] [pid 20660:tid 20727] [client 98.159.43.136:44005] File does not exist: /usr/local/apache/htdocs/suspended-page/bulk.php
[Wed Feb 25 03:44:20.172279 2026] [:error] [pid 20660:tid 20738] [client 98.159.43.136:44005] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Wed Feb 25 03:44:20.422635 2026] [:error] [pid 20660:tid 20728] [client 98.159.43.136:44005] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-logout.php
[Wed Feb 25 03:44:20.565709 2026] [:error] [pid 20660:tid 20730] [client 98.159.43.136:44005] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aZ3_lP6o0bjbSJXjrpHD8QAAAIg"]
[Wed Feb 25 03:44:20.865201 2026] [:error] [pid 20659:tid 20711] [client 98.159.43.123:34657] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/packed.php"] [unique_id "aZ3_lD_THK_HtK-Q44LBXgAAAFA"]
[Wed Feb 25 03:44:21.097082 2026] [:error] [pid 20658:tid 20677] [client 98.159.43.151:53121] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Feb 25 03:44:21.248574 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.151:53121] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Feb 25 03:44:21.608486 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.151:53121] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Wed Feb 25 03:44:21.746207 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.151:53121] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-simple.php
[Wed Feb 25 03:44:22.158613 2026] [:error] [pid 20658:tid 20671] [client 98.159.43.151:53121] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aZ3_luu8cohhPfsAIFmOqgAAAAQ"]
[Wed Feb 25 03:44:22.572469 2026] [:error] [pid 20659:tid 20695] [client 98.159.43.137:49219] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aZ3_lj_THK_HtK-Q44LBZQAAAEA"]
[Wed Feb 25 03:44:23.029439 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.134:21563] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aZ3_l-u8cohhPfsAIFmOrwAAABI"]
[Wed Feb 25 03:44:23.277169 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.142:52811] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Wed Feb 25 03:44:23.726334 2026] [:error] [pid 20659:tid 20719] [client 98.159.43.142:52811] [client 98.159.43.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.142, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aZ3_lz_THK_HtK-Q44LBbgAAAFg"]
[Wed Feb 25 03:44:23.832471 2026] [:error] [pid 20659:tid 20698] [client 98.159.43.142:52811] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aZ3_lz_THK_HtK-Q44LBbwAAAEM"]
[Wed Feb 25 03:44:24.467261 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.123:31199] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Wed Feb 25 03:44:24.594192 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.123:31199] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Wed Feb 25 03:44:24.823930 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.123:31199] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aZ3_mE0w_zc13OX-xia66QAAAME"]
[Wed Feb 25 03:44:25.397594 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.137:54955] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aZ3_mU0w_zc13OX-xia67AAAAMM"]
[Wed Feb 25 03:44:25.709723 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.139:54799] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Wed Feb 25 03:44:26.468774 2026] [:error] [pid 20658:tid 20675] [client 98.159.43.139:54799] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/moon.php
[Wed Feb 25 03:44:26.849464 2026] [:error] [pid 20658:tid 20667] [client 98.159.43.139:54799] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/dropdown.php
[Wed Feb 25 03:44:26.969713 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.139:54799] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aZ3_muu8cohhPfsAIFmOvAAAAAs"]
[Wed Feb 25 03:44:27.210954 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.144:30455] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Feb 25 03:44:27.323460 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.144:30455] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Wed Feb 25 03:44:27.581777 2026] [:error] [pid 20659:tid 20701] [client 98.159.43.144:30455] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/votes.php"] [unique_id "aZ3_mz_THK_HtK-Q44LBeQAAAEY"]
[Wed Feb 25 03:44:28.315683 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.157:58983] File does not exist: /usr/local/apache/htdocs/suspended-page/sk.php
[Wed Feb 25 03:44:28.614196 2026] [:error] [pid 20763:tid 20789] [client 98.159.43.157:58983] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/blurbs.php
[Wed Feb 25 03:44:28.909526 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.157:58983] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "aZ3_nE0w_zc13OX-xia7BAAAAMY"]
[Wed Feb 25 03:44:29.588665 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.106:55687] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aZ3_nf6o0bjbSJXjrpHD_AAAAI4"]
[Wed Feb 25 03:44:30.210247 2026] [:error] [pid 20660:tid 20723] [client 98.159.43.158:47859] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Wed Feb 25 03:44:30.633679 2026] [:error] [pid 20660:tid 20730] [client 98.159.43.158:47859] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Feb 25 03:44:30.842629 2026] [:error] [pid 20660:tid 20722] [client 98.159.43.158:47859] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Wed Feb 25 03:44:31.024223 2026] [:error] [pid 20660:tid 20742] [client 98.159.43.158:47859] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Wed Feb 25 03:44:31.169564 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.158:47859] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aZ3_n_6o0bjbSJXjrpHEBgAAAJE"]
[Wed Feb 25 03:44:31.378651 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.144:61685] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/doc.php
[Wed Feb 25 03:44:31.490786 2026] [:error] [pid 20763:tid 20779] [client 98.159.43.144:61685] File does not exist: /usr/local/apache/htdocs/suspended-page/fm1.php
[Wed Feb 25 03:44:31.871800 2026] [:error] [pid 20763:tid 20785] [client 98.159.43.144:61685] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Wed Feb 25 03:44:31.988800 2026] [:error] [pid 20763:tid 20775] [client 98.159.43.144:61685] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aZ3_n00w_zc13OX-xia7GQAAAMo"]
[Wed Feb 25 03:44:32.288491 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.149:26675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Wed Feb 25 03:44:32.462031 2026] [:error] [pid 20763:tid 20767] [client 98.159.43.149:26675] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Feb 25 03:44:32.731705 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.149:26675] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Wed Feb 25 03:44:32.998019 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.149:26675] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi01.php
[Wed Feb 25 03:44:33.366272 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.149:26675] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/item.php"] [unique_id "aZ3_oU0w_zc13OX-xia7KQAAANE"]
[Wed Feb 25 03:44:34.407388 2026] [:error] [pid 20659:tid 20702] [client 98.159.43.155:35073] [client 98.159.43.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.155, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aZ3_oj_THK_HtK-Q44LBjgAAAEc"]
[Wed Feb 25 03:44:34.504686 2026] [:error] [pid 20659:tid 20706] [client 98.159.43.155:35073] [client 98.159.43.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.155, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aZ3_oj_THK_HtK-Q44LBkAAAAEs"]
[Wed Feb 25 03:44:34.608250 2026] [:error] [pid 20659:tid 20716] [client 98.159.43.155:35073] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mani.php"] [unique_id "aZ3_oj_THK_HtK-Q44LBkQAAAFU"]
[Wed Feb 25 03:44:34.832528 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.109:46515] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Feb 25 03:44:35.886368 2026] [:error] [pid 20763:tid 20778] [client 98.159.43.109:46515] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aZ3_o00w_zc13OX-xia7PgAAAM0"]
[Wed Feb 25 03:44:36.100100 2026] [:error] [pid 20763:tid 20781] [client 98.159.43.120:25491] File does not exist: /usr/local/apache/htdocs/suspended-page/images.php
[Wed Feb 25 03:44:36.213900 2026] [:error] [pid 20763:tid 20784] [client 98.159.43.120:25491] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aespa.php
[Wed Feb 25 03:44:36.308194 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.120:25491] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aZ3_pE0w_zc13OX-xia7RAAAAMM"]
[Wed Feb 25 03:44:37.151814 2026] [:error] [pid 20763:tid 20779] [client 98.159.43.105:37133] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mariju.php
[Wed Feb 25 03:44:37.605216 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.105:37133] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/themes.php
[Wed Feb 25 03:44:37.816243 2026] [:error] [pid 20763:tid 20783] [client 98.159.43.105:37133] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aZ3_pU0w_zc13OX-xia7VAAAANI"]
[Wed Feb 25 03:44:38.034937 2026] [:error] [pid 20659:tid 20700] [client 98.159.43.108:59271] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aZ3_pj_THK_HtK-Q44LBlgAAAEU"]
[Wed Feb 25 03:44:38.353520 2026] [:error] [pid 20763:tid 20772] [client 98.159.43.141:36987] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Feb 25 03:44:38.756749 2026] [:error] [pid 20763:tid 20779] [client 98.159.43.141:36987] [client 98.159.43.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.141, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/wp-login.php"] [unique_id "aZ3_pk0w_zc13OX-xia7XwAAAM4"]
[Wed Feb 25 03:44:39.318353 2026] [:error] [pid 20763:tid 20788] [client 98.159.43.141:36987] [client 98.159.43.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aZ3_p00w_zc13OX-xia7ZwAAANc"]
[Wed Feb 25 03:44:39.622466 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.153:22655] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Feb 25 03:44:39.730737 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.153:22655] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aZ3_p-u8cohhPfsAIFmOxwAAAAw"]
[Wed Feb 25 03:44:40.076950 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.140:42547] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aZ3_qP6o0bjbSJXjrpHEEAAAAI4"]
[Wed Feb 25 03:44:40.492222 2026] [:error] [pid 20659:tid 20704] [client 98.159.43.142:27135] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aZ3_qD_THK_HtK-Q44LBnQAAAEk"]
[Wed Feb 25 03:44:41.579262 2026] [:error] [pid 20659:tid 20700] [client 98.159.43.155:21081] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/parx.php
[Wed Feb 25 03:44:41.802250 2026] [:error] [pid 20659:tid 20713] [client 98.159.43.155:21081] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aZ3_qT_THK_HtK-Q44LBqAAAAFI"]
[Wed Feb 25 03:44:42.233170 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.147:26369] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Wed Feb 25 03:44:42.376956 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.147:26369] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Feb 25 03:44:43.009669 2026] [:error] [pid 20658:tid 20671] [client 98.159.43.147:26369] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Wed Feb 25 03:44:43.181810 2026] [:error] [pid 20658:tid 20691] [client 98.159.43.147:26369] File does not exist: /usr/local/apache/htdocs/suspended-page/cloud.php
[Wed Feb 25 03:44:43.286021 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.147:26369] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Wed Feb 25 03:44:43.398814 2026] [:error] [pid 20658:tid 20667] [client 98.159.43.147:26369] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Feb 25 03:44:43.635140 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.147:26369] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Feb 25 03:44:44.050737 2026] [:error] [pid 20658:tid 20674] [client 98.159.43.147:26369] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/radio.php"] [unique_id "aZ3_rOu8cohhPfsAIFmO3wAAAAc"]
[Wed Feb 25 03:44:44.611851 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.129:50761] File does not exist: /usr/local/apache/htdocs/suspended-page/payout.php
[Wed Feb 25 03:44:44.756824 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.129:50761] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Feb 25 03:44:44.871277 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.129:50761] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Feb 25 03:44:44.993095 2026] [:error] [pid 20658:tid 20691] [client 98.159.43.129:50761] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Wed Feb 25 03:44:45.276513 2026] [:error] [pid 20658:tid 20668] [client 98.159.43.129:50761] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Wed Feb 25 03:44:45.386986 2026] [:error] [pid 20658:tid 20667] [client 98.159.43.129:50761] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Wed Feb 25 03:44:45.670039 2026] [:error] [pid 20658:tid 20673] [client 98.159.43.129:50761] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aZ3_reu8cohhPfsAIFmO7QAAAAY"]
[Wed Feb 25 03:44:46.575045 2026] [:error] [pid 20763:tid 20768] [client 98.159.43.137:42515] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aZ3_rk0w_zc13OX-xia7fQAAAMM"]
[Wed Feb 25 03:44:46.994943 2026] [:error] [pid 20763:tid 20788] [client 98.159.43.133:43805] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aZ3_rk0w_zc13OX-xia7fwAAANc"]
[Wed Feb 25 03:44:47.251261 2026] [:error] [pid 20659:tid 20702] [client 98.159.43.129:54241] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Feb 25 03:44:47.383083 2026] [:error] [pid 20659:tid 20710] [client 98.159.43.129:54241] File does not exist: /usr/local/apache/htdocs/suspended-page/fox.php
[Wed Feb 25 03:44:47.494903 2026] [:error] [pid 20659:tid 20706] [client 98.159.43.129:54241] File does not exist: /usr/local/apache/htdocs/suspended-page/google.php
[Wed Feb 25 03:44:47.828705 2026] [:error] [pid 20659:tid 20705] [client 98.159.43.129:54241] File does not exist: /usr/local/apache/htdocs/suspended-page/ovatools.php
[Wed Feb 25 03:44:47.945488 2026] [:error] [pid 20659:tid 20699] [client 98.159.43.129:54241] File does not exist: /usr/local/apache/htdocs/suspended-page/sidwso.php
[Wed Feb 25 03:44:48.060353 2026] [:error] [pid 20659:tid 20709] [client 98.159.43.129:54241] File does not exist: /usr/local/apache/htdocs/suspended-page/worksec.php
[Wed Feb 25 03:44:48.176071 2026] [:error] [pid 20659:tid 20717] [client 98.159.43.129:54241] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aZ3_sD_THK_HtK-Q44LBuAAAAFY"]
[Wed Feb 25 03:44:48.499002 2026] [:error] [pid 20763:tid 20771] [client 98.159.43.111:63237] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aZ3_sE0w_zc13OX-xia7iAAAAMY"]
[Wed Feb 25 03:44:49.038128 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.137:37815] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aZ3_sU0w_zc13OX-xia7jAAAANE"]
[Wed Feb 25 03:44:49.481421 2026] [:error] [pid 20659:tid 20719] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Wed Feb 25 03:44:49.619706 2026] [:error] [pid 20659:tid 20714] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Wed Feb 25 03:44:49.729644 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/style2.php
[Wed Feb 25 03:44:49.905012 2026] [:error] [pid 20659:tid 20711] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scripts.php
[Wed Feb 25 03:44:50.281596 2026] [:error] [pid 20659:tid 20704] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Feb 25 03:44:50.378384 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Wed Feb 25 03:44:50.485646 2026] [:error] [pid 20659:tid 20710] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/comfunctions.php
[Wed Feb 25 03:44:50.623089 2026] [:error] [pid 20659:tid 20716] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Wed Feb 25 03:44:50.735294 2026] [:error] [pid 20659:tid 20708] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Wed Feb 25 03:44:50.871384 2026] [:error] [pid 20659:tid 20698] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Wed Feb 25 03:44:51.052763 2026] [:error] [pid 20659:tid 20712] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/hinfofuns.php
[Wed Feb 25 03:44:51.180093 2026] [:error] [pid 20659:tid 20705] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/qfunctions.php
[Wed Feb 25 03:44:51.319167 2026] [:error] [pid 20659:tid 20699] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/qinfofuns.php
[Wed Feb 25 03:44:51.495016 2026] [:error] [pid 20659:tid 20717] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Wed Feb 25 03:44:51.605674 2026] [:error] [pid 20659:tid 20700] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Wed Feb 25 03:44:51.722929 2026] [:error] [pid 20659:tid 20701] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-ajax.php
[Wed Feb 25 03:44:51.865710 2026] [:error] [pid 20659:tid 20703] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Wed Feb 25 03:44:52.232335 2026] [:error] [pid 20659:tid 20707] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Feb 25 03:44:52.379751 2026] [:error] [pid 20659:tid 20714] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/my-sites.php
[Wed Feb 25 03:44:52.570493 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Wed Feb 25 03:44:52.717262 2026] [:error] [pid 20659:tid 20711] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/nav-menus.php
[Wed Feb 25 03:44:52.837112 2026] [:error] [pid 20659:tid 20715] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Wed Feb 25 03:44:53.021060 2026] [:error] [pid 20659:tid 20704] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Wed Feb 25 03:44:53.162132 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/revision.php
[Wed Feb 25 03:44:53.269261 2026] [:error] [pid 20659:tid 20713] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/widgets.php
[Wed Feb 25 03:44:53.393479 2026] [:error] [pid 20659:tid 20710] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Wed Feb 25 03:44:53.559906 2026] [:error] [pid 20659:tid 20716] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Feb 25 03:44:53.716551 2026] [:error] [pid 20659:tid 20708] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Wed Feb 25 03:44:53.827729 2026] [:error] [pid 20659:tid 20698] [client 98.159.43.131:31861] File does not exist: /usr/local/apache/htdocs/suspended-page/moded.php
[Wed Feb 25 03:44:53.929012 2026] [:error] [pid 20659:tid 20712] [client 98.159.43.131:31861] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aZ3_tT_THK_HtK-Q44LB3wAAAFE"]
[Wed Feb 25 03:44:54.229917 2026] [:error] [pid 20659:tid 20701] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/upgrade.php
[Wed Feb 25 03:44:54.340858 2026] [:error] [pid 20659:tid 20706] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/gh.php
[Wed Feb 25 03:44:54.438534 2026] [:error] [pid 20659:tid 20707] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/version.php
[Wed Feb 25 03:44:54.599814 2026] [:error] [pid 20659:tid 20695] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/head.php
[Wed Feb 25 03:44:54.692776 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/index1.php
[Wed Feb 25 03:44:54.851040 2026] [:error] [pid 20659:tid 20715] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/theme-insqbzk.php
[Wed Feb 25 03:44:54.973750 2026] [:error] [pid 20659:tid 20704] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/good.php
[Wed Feb 25 03:44:55.067955 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/main.php
[Wed Feb 25 03:44:55.294291 2026] [:error] [pid 20659:tid 20710] [client 98.159.43.145:39407] File does not exist: /usr/local/apache/htdocs/suspended-page/wsoyanz.php
[Wed Feb 25 03:44:55.469351 2026] [:error] [pid 20659:tid 20716] [client 98.159.43.145:39407] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "aZ3_tz_THK_HtK-Q44LB8AAAAFU"]
[Wed Feb 25 03:44:56.129164 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.132:39345] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa-rex.php
[Wed Feb 25 03:44:57.453220 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.132:39345] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wso112233.php"] [unique_id "aZ3_uU0w_zc13OX-xia7xQAAAMQ"]
[Wed Feb 25 03:44:57.792064 2026] [:error] [pid 20660:tid 20745] [client 98.159.43.129:49257] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/shell20211028.php"] [unique_id "aZ3_uf6o0bjbSJXjrpHELgAAAJc"]
[Wed Feb 25 03:44:58.295536 2026] [:error] [pid 20660:tid 20733] [client 98.159.43.148:52903] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/dropdown.php"] [unique_id "aZ3_uv6o0bjbSJXjrpHENgAAAIs"]
[Wed Feb 25 03:44:58.955869 2026] [:error] [pid 20763:tid 20765] [client 98.159.43.148:51499] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/repeater.php"] [unique_id "aZ3_uk0w_zc13OX-xia7yAAAAMA"]
[Wed Feb 25 03:44:59.522673 2026] [:error] [pid 20660:tid 20738] [client 98.159.43.110:59317] File does not exist: /usr/local/apache/htdocs/suspended-page/cache-compat.php
[Wed Feb 25 03:44:59.680648 2026] [:error] [pid 20660:tid 20746] [client 98.159.43.110:59317] File does not exist: /usr/local/apache/htdocs/suspended-page/ajax-actions.php
[Wed Feb 25 03:44:59.922784 2026] [:error] [pid 20660:tid 20730] [client 98.159.43.110:59317] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-consar.php
[Wed Feb 25 03:45:01.147308 2026] [:error] [pid 20660:tid 20727] [client 98.159.43.110:59317] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aZ3_vf6o0bjbSJXjrpHETAAAAIU"]
[Wed Feb 25 03:45:01.356270 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.161:41655] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aZ3_vU0w_zc13OX-xia70AAAAMQ"]
[Wed Feb 25 03:45:01.712690 2026] [:error] [pid 20659:tid 20717] [client 98.159.43.158:50931] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/options.php"] [unique_id "aZ3_vT_THK_HtK-Q44LB-wAAAFY"]
[Wed Feb 25 03:45:02.032206 2026] [:error] [pid 20660:tid 20738] [client 98.159.43.163:39225] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Wed Feb 25 03:45:02.325591 2026] [:error] [pid 20660:tid 20746] [client 98.159.43.163:39225] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aZ3_vv6o0bjbSJXjrpHEUAAAAJg"]
[Wed Feb 25 03:45:02.545631 2026] [:error] [pid 20660:tid 20739] [client 98.159.43.105:44125] [client 98.159.43.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aZ3_vv6o0bjbSJXjrpHEUQAAAJE"]
[Wed Feb 25 03:45:03.073006 2026] [:error] [pid 20659:tid 20699] [client 98.159.43.142:22957] [client 98.159.43.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.142, incrementing brute counter"] [hostname "rejuva.au"] [uri "/images/wp-login.php"] [unique_id "aZ3_vz_THK_HtK-Q44LCBQAAAEQ"]
[Wed Feb 25 03:45:03.244680 2026] [:error] [pid 20659:tid 20709] [client 98.159.43.142:22957] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Feb 25 03:45:03.604536 2026] [:error] [pid 20659:tid 20707] [client 98.159.43.142:22957] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aZ3_vz_THK_HtK-Q44LCCwAAAEw"]
[Wed Feb 25 03:45:03.933877 2026] [:error] [pid 20658:tid 20673] [client 98.159.43.135:65253] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads-config.php
[Wed Feb 25 03:45:04.468263 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.135:65253] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aZ3_wOu8cohhPfsAIFmO_gAAABc"]
[Wed Feb 25 03:45:04.726841 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.158:28741] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aZ3_wOu8cohhPfsAIFmPAAAAABU"]
[Wed Feb 25 03:45:05.017375 2026] [:error] [pid 20659:tid 20697] [client 98.159.43.141:62107] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/autoload_classmap.php
[Wed Feb 25 03:45:05.419782 2026] [:error] [pid 20659:tid 20710] [client 98.159.43.141:62107] [client 98.159.43.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.141, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aZ3_wT_THK_HtK-Q44LCEAAAAE8"]
[Wed Feb 25 03:45:05.548752 2026] [:error] [pid 20659:tid 20714] [client 98.159.43.141:62107] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Wed Feb 25 03:45:05.677143 2026] [:error] [pid 20659:tid 20696] [client 98.159.43.141:62107] [client 98.159.43.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aZ3_wT_THK_HtK-Q44LCEgAAAEE"]
[Wed Feb 25 03:45:05.896676 2026] [:error] [pid 20763:tid 20783] [client 98.159.43.137:24425] File does not exist: /usr/local/apache/htdocs/suspended-page/indeex.php
[Wed Feb 25 03:45:06.056316 2026] [:error] [pid 20763:tid 20787] [client 98.159.43.137:24425] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Feb 25 03:45:06.402226 2026] [:error] [pid 20763:tid 20769] [client 98.159.43.137:24425] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aZ3_wk0w_zc13OX-xia79wAAAMQ"]
[Wed Feb 25 03:45:06.693095 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Wed Feb 25 03:45:06.978676 2026] [:error] [pid 20658:tid 20675] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/credits.php
[Wed Feb 25 03:45:07.113840 2026] [:error] [pid 20658:tid 20682] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-comments.php
[Wed Feb 25 03:45:07.258129 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Wed Feb 25 03:45:08.721784 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Wed Feb 25 03:45:08.852013 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Wed Feb 25 03:45:08.983866 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/load-scripts.php
[Wed Feb 25 03:45:09.130528 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/load-styles.php
[Wed Feb 25 03:45:09.252700 2026] [:error] [pid 20658:tid 20675] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/options-discussion.php
[Wed Feb 25 03:45:09.399575 2026] [:error] [pid 20658:tid 20673] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/options-general.php
[Wed Feb 25 03:45:09.518728 2026] [:error] [pid 20658:tid 20667] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/options-permalink.php
[Wed Feb 25 03:45:09.638810 2026] [:error] [pid 20658:tid 20674] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/options-privacy.php
[Wed Feb 25 03:45:09.783422 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Wed Feb 25 03:45:09.899912 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Wed Feb 25 03:45:10.057747 2026] [:error] [pid 20658:tid 20676] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/post-new.php
[Wed Feb 25 03:45:10.169059 2026] [:error] [pid 20658:tid 20683] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Wed Feb 25 03:45:10.318664 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Wed Feb 25 03:45:10.455666 2026] [:error] [pid 20658:tid 20671] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/site-health.php
[Wed Feb 25 03:45:10.623054 2026] [:error] [pid 20658:tid 20691] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Wed Feb 25 03:45:10.780151 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Wed Feb 25 03:45:10.923103 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/user-edit.php
[Wed Feb 25 03:45:11.022076 2026] [:error] [pid 20658:tid 20675] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/user-new.php
[Wed Feb 25 03:45:11.185206 2026] [:error] [pid 20658:tid 20682] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Wed Feb 25 03:45:11.319123 2026] [:error] [pid 20658:tid 20667] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/bar.php
[Wed Feb 25 03:45:12.686267 2026] [:error] [pid 20658:tid 20667] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Wed Feb 25 03:45:12.809309 2026] [:error] [pid 20658:tid 20684] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Feb 25 03:45:12.949260 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Feb 25 03:45:13.077955 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Wed Feb 25 03:45:13.197312 2026] [:error] [pid 20658:tid 20672] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/km.php
[Wed Feb 25 03:45:13.315154 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/LA.php
[Wed Feb 25 03:45:13.512984 2026] [:error] [pid 20658:tid 20676] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Feb 25 03:45:13.619428 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ldd.php
[Wed Feb 25 03:45:13.780905 2026] [:error] [pid 20658:tid 20683] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/sgd.php
[Wed Feb 25 03:45:13.907435 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/wzy.php
[Wed Feb 25 03:45:14.298116 2026] [:error] [pid 20658:tid 20673] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Feb 25 03:45:14.659004 2026] [:error] [pid 20658:tid 20669] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Feb 25 03:45:15.243448 2026] [:error] [pid 20658:tid 20668] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Feb 25 03:45:15.348455 2026] [:error] [pid 20658:tid 20667] [client 98.159.43.116:45741] [client 98.159.43.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.116, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aZ3_y-u8cohhPfsAIFmPTQAAAAA"]
[Wed Feb 25 03:45:15.535831 2026] [:error] [pid 20658:tid 20684] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/Njima.php
[Wed Feb 25 03:45:15.938351 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.116:45741] [client 98.159.43.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.116, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.tmb/wp-login.php"] [unique_id "aZ3_y-u8cohhPfsAIFmPUgAAAAw"]
[Wed Feb 25 03:45:16.217140 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.116:45741] File does not exist: /usr/local/apache/htdocs/suspended-page/FroggBaba.php
[Wed Feb 25 03:45:16.367829 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.116:45741] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aZ3_zOu8cohhPfsAIFmPVQAAAA4"]
[Wed Feb 25 03:45:16.582552 2026] [:error] [pid 20659:tid 20718] [client 98.159.43.146:60091] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aZ3_zD_THK_HtK-Q44LCRAAAAFc"]
[Wed Feb 25 03:45:16.865304 2026] [:error] [pid 20660:tid 20743] [client 98.159.43.139:46089] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aZ3_zP6o0bjbSJXjrpHEiwAAAJU"]
[Wed Feb 25 03:45:17.115202 2026] [:error] [pid 20763:tid 20772] [client 98.159.43.131:63447] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Wed Feb 25 03:45:17.943738 2026] [:error] [pid 20763:tid 20770] [client 98.159.43.131:63447] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Wed Feb 25 03:45:18.156891 2026] [:error] [pid 20763:tid 20777] [client 98.159.43.131:63447] File does not exist: /usr/local/apache/htdocs/suspended-page/GA13.php
[Wed Feb 25 03:45:18.685533 2026] [:error] [pid 20763:tid 20776] [client 98.159.43.131:63447] [client 98.159.43.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.131, incrementing brute counter"] [hostname "rejuva.au"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aZ3_zk0w_zc13OX-xia8PQAAAMs"]
[Wed Feb 25 03:45:18.781141 2026] [:error] [pid 20763:tid 20767] [client 98.159.43.131:63447] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZ3_zk0w_zc13OX-xia8PgAAAMI"]
[Wed Feb 25 03:45:19.234169 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/crop.php
[Wed Feb 25 03:45:19.340891 2026] [:error] [pid 20658:tid 20674] [client 98.159.43.132:64515] [client 98.159.43.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.132, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aZ3_z-u8cohhPfsAIFmPXQAAAAc"]
[Wed Feb 25 03:45:19.740942 2026] [:error] [pid 20658:tid 20684] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/gali.php
[Wed Feb 25 03:45:20.112775 2026] [:error] [pid 20658:tid 20679] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Wed Feb 25 03:45:20.281066 2026] [:error] [pid 20658:tid 20676] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/dirs.php
[Wed Feb 25 03:45:20.421924 2026] [:error] [pid 20658:tid 20685] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/abouts.php
[Wed Feb 25 03:45:20.532209 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/malls.php
[Wed Feb 25 03:45:20.902262 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/liefs.php
[Wed Feb 25 03:45:21.070802 2026] [:error] [pid 20658:tid 20677] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/uc.php
[Wed Feb 25 03:45:21.175050 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/locks.php
[Wed Feb 25 03:45:21.349605 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.132:64515] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-dsdd.php
[Wed Feb 25 03:45:21.860521 2026] [:error] [pid 20658:tid 20691] [client 98.159.43.132:64515] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aZ3_0eu8cohhPfsAIFmPcAAAABg"]
[Wed Feb 25 03:45:22.092517 2026] [:error] [pid 20660:tid 20733] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Wed Feb 25 03:45:22.229526 2026] [:error] [pid 20660:tid 20731] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Wed Feb 25 03:45:22.349884 2026] [:error] [pid 20660:tid 20729] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Wed Feb 25 03:45:22.455353 2026] [:error] [pid 20660:tid 20734] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Feb 25 03:45:23.376429 2026] [:error] [pid 20660:tid 20734] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/stindex.php
[Wed Feb 25 03:45:23.528257 2026] [:error] [pid 20660:tid 20735] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Wed Feb 25 03:45:23.759773 2026] [:error] [pid 20660:tid 20737] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/exit.php
[Wed Feb 25 03:45:23.926179 2026] [:error] [pid 20660:tid 20745] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Feb 25 03:45:24.053411 2026] [:error] [pid 20660:tid 20727] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Wed Feb 25 03:45:24.164078 2026] [:error] [pid 20660:tid 20732] [client 98.159.43.112:44135] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Wed Feb 25 03:45:24.271359 2026] [:error] [pid 20660:tid 20736] [client 98.159.43.112:44135] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aZ3_1P6o0bjbSJXjrpHEpQAAAI4"]
[Wed Feb 25 03:45:24.562545 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Wed Feb 25 03:45:25.005053 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/shellv3.php
[Wed Feb 25 03:45:25.146112 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/sh.php
[Wed Feb 25 03:45:25.561419 2026] [:error] [pid 20658:tid 20691] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Feb 25 03:45:25.666375 2026] [:error] [pid 20658:tid 20683] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Feb 25 03:45:25.802710 2026] [:error] [pid 20658:tid 20684] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/delete3.php
[Wed Feb 25 03:45:26.317231 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/mm.php
[Wed Feb 25 03:45:26.661199 2026] [:error] [pid 20658:tid 20671] [client 98.159.43.138:63331] [client 98.159.43.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.138, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aZ3_1uu8cohhPfsAIFmPiwAAAAQ"]
[Wed Feb 25 03:45:26.825113 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Wed Feb 25 03:45:27.071088 2026] [:error] [pid 20658:tid 20682] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/mailer.php
[Wed Feb 25 03:45:27.187021 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/www.php
[Wed Feb 25 03:45:27.410630 2026] [:error] [pid 20658:tid 20678] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Feb 25 03:45:27.976445 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Feb 25 03:45:28.088891 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.138:63331] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Wed Feb 25 03:45:28.632412 2026] [autoindex:error] [pid 20658:tid 20676] [client 98.159.43.138:63331] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:22:37.673782 2026] [:error] [pid 5619:tid 5647] [client 43.154.140.188:35010] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ4WnZFUzdv-0L_F4fustQAAAgw"]
[Wed Feb 25 06:21:24.557485 2026] [:error] [pid 60498:tid 60524] [client 64.227.146.76:59201] [client 64.227.146.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.146.76, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aZ4kZCFCVhQ3ffus0uJ08gAAAtM"]
[Wed Feb 25 06:21:24.562461 2026] [:error] [pid 60498:tid 60524] [client 64.227.146.76:59201] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Feb 25 07:03:13.876111 2026] [:error] [pid 5619:tid 5652] [client 223.15.245.170:38173] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZ4uMZFUzdv-0L_F4fvemQAAAhE"]
[Wed Feb 25 11:00:49.137326 2026] [:error] [pid 60290:tid 60292] [client 162.62.231.139:59520] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ5l4TPwSUztcPyiofqX5gAAAQA"]
[Wed Feb 25 13:13:41.505235 2026] [:error] [pid 5556:tid 5602] [client 124.156.226.179:42290] [client 124.156.226.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZ6FBaOrYeaTyh7lGRWwBQAAAc8"]
[Wed Feb 25 18:20:04.498511 2026] [:error] [pid 5619:tid 5635] [client 104.28.160.82:24428] [client 104.28.160.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aZ7M1JFUzdv-0L_F4fs76AAAAgA"]
[Wed Feb 25 21:36:39.206540 2026] [:error] [pid 5556:tid 5610] [client 119.28.177.175:43472] [client 119.28.177.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ7656OrYeaTyh7lGRV4QAAAAdc"]
[Thu Feb 26 04:50:14.059616 2026] [:error] [pid 9702:tid 9724] [client 104.28.235.60:11274] [client 104.28.235.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aZ9ghpvL1wp7EOGdesw9DgAAANI"]
[Thu Feb 26 04:50:17.471685 2026] [:error] [pid 9589:tid 9671] [client 104.28.235.60:11278] [client 104.28.235.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/style.php"] [unique_id "aZ9giaBuBxYiI1p-njSzwQAAAJI"]
[Thu Feb 26 04:50:18.001700 2026] [:error] [pid 9702:tid 9720] [client 104.28.235.60:11285] [client 104.28.235.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/themes/style.php"] [unique_id "aZ9gipvL1wp7EOGdesw9GAAAAM4"]
[Thu Feb 26 04:50:38.778024 2026] [:error] [pid 6071:tid 6092] [client 104.28.161.70:48422] [client 104.28.161.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/style.php"] [unique_id "aZ9gnoQfAzdrpgft074-IgAAARI"]
[Thu Feb 26 08:29:14.526195 2026] [:error] [pid 55051:tid 55072] [client 180.110.203.108:52353] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZ-T2gmK1w2kZvh5eLGmNAAAAJI"]
[Thu Feb 26 09:22:34.787132 2026] [:error] [pid 55618:tid 55640] [client 101.33.55.204:45226] [client 101.33.55.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ-gWh61Vrh12f_8oWQJhwAAARM"]
[Thu Feb 26 11:42:19.048962 2026] [:error] [pid 54990:tid 55015] [client 43.130.26.3:43754] [client 43.130.26.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aZ_BG3tr2qmt_mBhH2zS7gAAABY"]
[Thu Feb 26 14:44:58.963151 2026] [:error] [pid 55051:tid 55067] [client 43.153.96.233:50534] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ_r6gmK1w2kZvh5eLHwjAAAAI0"]
[Thu Feb 26 14:58:56.305311 2026] [:error] [pid 3883:tid 3892] [client 182.44.12.37:46241] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aZ_vMOA33x90V6yYHaiR3QAAAUY"]
[Thu Feb 26 17:02:31.291200 2026] [:error] [pid 3883:tid 3889] [client 43.155.157.239:60346] [client 43.155.157.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaAMJ-A33x90V6yYHajm9gAAAUM"]
[Thu Feb 26 17:25:12.011331 2026] [:error] [pid 55618:tid 55631] [client 134.149.59.124:1103] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Thu Feb 26 18:49:06.049662 2026] [:error] [pid 25311:tid 25320] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Feb 26 18:49:06.171959 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Feb 26 18:49:06.333746 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Feb 26 18:49:06.730086 2026] [:error] [pid 25311:tid 25328] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Feb 26 18:49:06.848158 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Feb 26 18:49:06.939712 2026] [:error] [pid 25311:tid 25320] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Feb 26 18:49:07.056324 2026] [:error] [pid 25311:tid 25319] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Feb 26 18:49:07.275137 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Feb 26 18:49:07.630029 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Feb 26 18:49:07.968300 2026] [:error] [pid 25311:tid 25320] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Feb 26 18:49:08.160324 2026] [:error] [pid 25311:tid 25332] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Feb 26 18:49:08.296040 2026] [:error] [pid 25311:tid 25331] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Feb 26 18:49:08.426115 2026] [:error] [pid 25311:tid 25315] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Feb 26 18:49:08.536255 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Feb 26 18:49:08.662879 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Feb 26 18:49:08.868834 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Feb 26 18:49:09.088049 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Feb 26 18:49:09.252884 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.10:42313] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Feb 26 18:49:11.237409 2026] [:error] [pid 25311:tid 25331] [client 193.37.32.10:42313] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaAlJ9fdM__yZAgJFSt_tgAAAZE"]
[Thu Feb 26 18:49:11.863156 2026] [:error] [pid 20419:tid 20434] [client 193.37.32.37:38317] [client 193.37.32.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaAlJ-3DVDvMfTYYUBUU_QAAAcw"]
[Thu Feb 26 18:49:12.439426 2026] [:error] [pid 55051:tid 55068] [client 193.37.32.52:53465] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Feb 26 18:49:15.296293 2026] [:error] [pid 55051:tid 55071] [client 193.37.32.52:53465] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aaAlKwmK1w2kZvh5eLFfyQAAAJE"]
[Thu Feb 26 18:49:15.912322 2026] [:error] [pid 55051:tid 55074] [client 193.37.32.25:65315] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Feb 26 18:49:16.013818 2026] [:error] [pid 55051:tid 55065] [client 193.37.32.25:65315] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaAlLAmK1w2kZvh5eLFf2gAAAIs"]
[Thu Feb 26 18:49:16.362845 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.50:41585] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Feb 26 18:49:17.132608 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.50:41585] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaAlLeA33x90V6yYHahG-wAAAVU"]
[Thu Feb 26 18:49:17.482942 2026] [:error] [pid 25311:tid 25319] [client 193.37.32.32:25431] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaAlLdfdM__yZAgJFSt_3QAAAYU"]
[Thu Feb 26 18:49:17.720592 2026] [:error] [pid 55051:tid 55057] [client 193.37.32.23:32483] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaAlLQmK1w2kZvh5eLFf4wAAAIM"]
[Thu Feb 26 18:49:17.929928 2026] [:error] [pid 20419:tid 20441] [client 193.37.32.43:63567] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaAlLe3DVDvMfTYYUBUVKAAAAdM"]
[Thu Feb 26 18:49:18.354637 2026] [:error] [pid 25311:tid 25334] [client 193.37.32.16:64355] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaAlLtfdM__yZAgJFSt_6AAAAZQ"]
[Thu Feb 26 18:49:18.596109 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.44:22643] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaAlLtfdM__yZAgJFSt_8AAAAYI"]
[Thu Feb 26 18:49:19.061205 2026] [:error] [pid 55618:tid 55643] [client 193.37.32.41:25745] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaAlLx61Vrh12f_8oWTWdgAAARY"]
[Thu Feb 26 18:49:19.292162 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.4:48739] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Feb 26 18:49:19.529134 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.4:48739] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aaAlL9fdM__yZAgJFSuAIAAAAYg"]
[Thu Feb 26 18:49:20.206656 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.19:57165] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaAlMNfdM__yZAgJFSuAOAAAAY8"]
[Thu Feb 26 18:49:20.616604 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.32:32769] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaAlMNfdM__yZAgJFSuASgAAAYI"]
[Thu Feb 26 18:49:20.839222 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.14:44473] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Feb 26 18:49:21.006118 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.14:44473] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaAlMdfdM__yZAgJFSuAWgAAAYs"]
[Thu Feb 26 18:49:21.278078 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.16:43873] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Feb 26 18:49:21.674845 2026] [:error] [pid 3883:tid 3908] [client 193.37.32.16:43873] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Feb 26 18:49:22.107987 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.16:43873] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaAlMuA33x90V6yYHahHGwAAAU8"]
[Thu Feb 26 18:49:22.383409 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.39:36909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Feb 26 18:49:22.591218 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.39:36909] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaAlMuA33x90V6yYHahHHQAAAUY"]
[Thu Feb 26 18:49:22.867502 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.44:59369] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Feb 26 18:49:23.163527 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.44:59369] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaAlM-A33x90V6yYHahHJwAAAUo"]
[Thu Feb 26 18:49:23.511535 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.44:25757] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaAlM9fdM__yZAgJFSuAjgAAAYQ"]
[Thu Feb 26 18:49:23.895829 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.22:37337] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Feb 26 18:49:24.010076 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.22:37337] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Feb 26 18:49:24.298663 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.22:37337] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaAlNNfdM__yZAgJFSuApgAAAZY"]
[Thu Feb 26 18:49:24.689841 2026] [:error] [pid 55051:tid 55060] [client 193.37.32.7:62687] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaAlNAmK1w2kZvh5eLFgCgAAAIY"]
[Thu Feb 26 18:49:25.115335 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.26:65101] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaAlNeA33x90V6yYHahHVAAAAUo"]
[Thu Feb 26 18:49:25.389064 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.47:39295] [client 193.37.32.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaAlNR61Vrh12f_8oWTWmAAAAQA"]
[Thu Feb 26 18:49:25.675896 2026] [:error] [pid 55618:tid 55629] [client 193.37.32.7:31575] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaAlNR61Vrh12f_8oWTWnQAAAQg"]
[Thu Feb 26 18:49:26.135804 2026] [:error] [pid 55051:tid 55076] [client 193.37.32.20:46547] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Feb 26 18:49:26.226278 2026] [:error] [pid 55051:tid 55063] [client 193.37.32.20:46547] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaAlNgmK1w2kZvh5eLFgEwAAAIk"]
[Thu Feb 26 18:49:26.575253 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.46:54131] [client 193.37.32.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaAlNtfdM__yZAgJFSuA2gAAAY8"]
[Thu Feb 26 18:49:26.831858 2026] [:error] [pid 54991:tid 55022] [client 193.37.32.25:28433] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaAlNt4Zx-mJ8gbRB2jCCAAAAEI"]
[Thu Feb 26 18:49:27.310345 2026] [:error] [pid 25311:tid 25335] [client 193.37.32.130:33525] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Feb 26 18:49:27.558447 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.130:33525] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Feb 26 18:49:28.007810 2026] [:error] [pid 25311:tid 25335] [client 193.37.32.130:33525] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aaAlONfdM__yZAgJFSuBGwAAAZU"]
[Thu Feb 26 18:49:28.827866 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.11:28363] [client 193.37.32.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.11, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaAlONfdM__yZAgJFSuBPwAAAYs"]
[Thu Feb 26 18:49:28.987720 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.11:28363] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Feb 26 18:49:29.637733 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.11:28363] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Feb 26 18:49:29.783658 2026] [:error] [pid 25311:tid 25338] [client 193.37.32.11:28363] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Feb 26 18:49:30.431753 2026] [:error] [pid 25311:tid 25332] [client 193.37.32.11:28363] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaAlOtfdM__yZAgJFSuBgAAAAZI"]
[Thu Feb 26 18:49:30.821709 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.14:21893] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Feb 26 18:49:31.019056 2026] [:error] [pid 55618:tid 55627] [client 193.37.32.14:21893] [client 193.37.32.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.14, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaAlOx61Vrh12f_8oWTWsgAAAQY"]
[Thu Feb 26 18:49:31.360818 2026] [:error] [pid 55618:tid 55624] [client 193.37.32.14:21893] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aaAlOx61Vrh12f_8oWTWtwAAAQM"]
[Thu Feb 26 18:49:32.340092 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.44:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Feb 26 18:49:32.549596 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.44:39247] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Feb 26 18:49:32.868241 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.44:39247] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaAlPOA33x90V6yYHahHmgAAAUY"]
[Thu Feb 26 18:49:33.107313 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.15:52131] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Feb 26 18:49:33.821507 2026] [:error] [pid 55618:tid 55645] [client 193.37.32.15:52131] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Feb 26 18:49:34.098404 2026] [:error] [pid 55618:tid 55638] [client 193.37.32.15:52131] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Feb 26 18:49:34.354035 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.15:52131] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Feb 26 18:49:34.466891 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.15:52131] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaAlPh61Vrh12f_8oWTW1AAAAQA"]
[Thu Feb 26 18:49:34.655893 2026] [:error] [pid 54991:tid 55021] [client 193.37.32.4:47161] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Feb 26 18:49:34.842750 2026] [:error] [pid 54991:tid 55033] [client 193.37.32.4:47161] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Feb 26 18:49:35.074631 2026] [:error] [pid 54991:tid 55044] [client 193.37.32.4:47161] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaAlP94Zx-mJ8gbRB2jCJAAAAFg"]
[Thu Feb 26 18:49:35.517456 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.27:46909] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Feb 26 18:49:35.758747 2026] [:error] [pid 55618:tid 55629] [client 193.37.32.27:46909] [client 193.37.32.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.27, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaAlPx61Vrh12f_8oWTW2QAAAQg"]
[Thu Feb 26 18:49:35.891259 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.27:46909] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaAlPx61Vrh12f_8oWTW2gAAARU"]
[Thu Feb 26 18:49:37.519869 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.18:45229] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Feb 26 18:49:38.280758 2026] [:error] [pid 25311:tid 25324] [client 193.37.32.18:45229] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Feb 26 18:49:38.426430 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.18:45229] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaAlQtfdM__yZAgJFSuCFwAAAYI"]
[Thu Feb 26 18:49:38.862166 2026] [:error] [pid 20419:tid 20445] [client 193.37.32.50:47637] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Feb 26 18:49:39.219507 2026] [:error] [pid 20419:tid 20422] [client 193.37.32.50:47637] [client 193.37.32.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.50, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaAlQ-3DVDvMfTYYUBUVnQAAAcA"]
[Thu Feb 26 18:49:39.393431 2026] [:error] [pid 20419:tid 20436] [client 193.37.32.50:47637] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Feb 26 18:49:39.614739 2026] [:error] [pid 20419:tid 20425] [client 193.37.32.50:47637] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Feb 26 18:49:39.791416 2026] [:error] [pid 20419:tid 20427] [client 193.37.32.50:47637] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Feb 26 18:49:39.891889 2026] [:error] [pid 20419:tid 20430] [client 193.37.32.50:47637] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaAlQ-3DVDvMfTYYUBUVqQAAAcg"]
[Thu Feb 26 18:49:40.100538 2026] [:error] [pid 20419:tid 20446] [client 193.37.32.41:27639] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Feb 26 18:49:40.324047 2026] [:error] [pid 20419:tid 20432] [client 193.37.32.41:27639] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aaAlRO3DVDvMfTYYUBUVuAAAAco"]
[Thu Feb 26 18:49:40.709875 2026] [:error] [pid 20419:tid 20432] [client 193.37.32.19:60263] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Feb 26 18:49:40.863068 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.19:60263] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaAlRO3DVDvMfTYYUBUVygAAAcQ"]
[Thu Feb 26 18:49:41.410937 2026] [:error] [pid 3883:tid 3902] [client 193.37.32.44:39457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Feb 26 18:49:41.528889 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.44:39457] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaAlReA33x90V6yYHahHzwAAAUA"]
[Thu Feb 26 18:49:41.873151 2026] [:error] [pid 54991:tid 55034] [client 193.37.32.33:50091] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaAlRd4Zx-mJ8gbRB2jCNAAAAE4"]
[Thu Feb 26 18:49:42.114264 2026] [:error] [pid 20419:tid 20429] [client 193.37.32.40:50469] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Feb 26 18:49:42.306793 2026] [:error] [pid 20419:tid 20441] [client 193.37.32.40:50469] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Feb 26 18:49:42.806235 2026] [:error] [pid 20419:tid 20429] [client 193.37.32.40:50469] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaAlRu3DVDvMfTYYUBUV8gAAAcc"]
[Thu Feb 26 18:49:43.168143 2026] [:error] [pid 55618:tid 55631] [client 193.37.32.25:58969] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaAlRx61Vrh12f_8oWTXCQAAAQo"]
[Thu Feb 26 18:49:44.077007 2026] [:error] [pid 54990:tid 55017] [client 193.37.32.10:38663] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aaAlSHtr2qmt_mBhH2wJbQAAABg"]
[Thu Feb 26 18:49:44.348987 2026] [:error] [pid 20419:tid 20435] [client 193.37.32.27:20337] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Feb 26 18:49:44.732904 2026] [:error] [pid 20419:tid 20444] [client 193.37.32.27:20337] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Feb 26 18:49:44.844679 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.27:20337] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaAlSO3DVDvMfTYYUBUWHgAAAcQ"]
[Thu Feb 26 18:49:45.083756 2026] [:error] [pid 55051:tid 55064] [client 193.37.32.13:49431] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Feb 26 18:49:45.449673 2026] [:error] [pid 55051:tid 55065] [client 193.37.32.13:49431] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "aaAlSQmK1w2kZvh5eLFgjwAAAIs"]
[Thu Feb 26 18:49:46.026180 2026] [:error] [pid 55051:tid 55065] [client 193.37.32.34:63515] [client 193.37.32.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaAlSgmK1w2kZvh5eLFgnQAAAIs"]
[Thu Feb 26 18:49:46.778519 2026] [:error] [pid 55618:tid 55637] [client 193.37.32.11:60085] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Feb 26 18:49:47.910653 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.11:60085] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Feb 26 18:49:48.124105 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.11:60085] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Feb 26 18:49:48.267595 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.11:60085] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaAlTB61Vrh12f_8oWTXSgAAAQA"]
[Thu Feb 26 18:49:48.496219 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.45:59397] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaAlTO3DVDvMfTYYUBUWPgAAAcQ"]
[Thu Feb 26 18:49:48.754671 2026] [:error] [pid 55051:tid 55057] [client 193.37.32.34:39757] [client 193.37.32.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaAlTAmK1w2kZvh5eLFgygAAAIM"]
[Thu Feb 26 18:49:49.023638 2026] [:error] [pid 20419:tid 20433] [client 193.37.32.39:21995] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaAlTe3DVDvMfTYYUBUWSAAAAcs"]
[Thu Feb 26 18:49:49.208669 2026] [:error] [pid 55618:tid 55625] [client 193.37.32.11:26023] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Feb 26 18:49:49.390327 2026] [:error] [pid 55618:tid 55640] [client 193.37.32.11:26023] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaAlTR61Vrh12f_8oWTXWgAAARM"]
[Thu Feb 26 18:49:49.669498 2026] [:error] [pid 3883:tid 3891] [client 193.37.32.49:59193] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaAlTeA33x90V6yYHahIAQAAAUU"]
[Thu Feb 26 18:49:49.881949 2026] [:error] [pid 55618:tid 55627] [client 193.37.32.34:49723] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Feb 26 18:49:50.142681 2026] [:error] [pid 55618:tid 55631] [client 193.37.32.34:49723] [client 193.37.32.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaAlTh61Vrh12f_8oWTXbQAAAQo"]
[Thu Feb 26 18:49:50.357637 2026] [:error] [pid 55051:tid 55078] [client 193.37.32.12:41503] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaAlTgmK1w2kZvh5eLFg4gAAAJg"]
[Thu Feb 26 18:49:50.619720 2026] [:error] [pid 55122:tid 55137] [client 193.37.32.47:52945] [client 193.37.32.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaAlToLiR0OfjFxvcN8FlwAAAM0"]
[Thu Feb 26 18:49:50.850005 2026] [:error] [pid 54991:tid 55039] [client 193.37.32.130:26697] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaAlTt4Zx-mJ8gbRB2jCUAAAAFM"]
[Thu Feb 26 18:49:51.178338 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.7:54341] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaAlTx61Vrh12f_8oWTXhgAAAQ0"]
[Thu Feb 26 18:49:51.739879 2026] [:error] [pid 55618:tid 55627] [client 193.37.32.11:40949] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaAlTx61Vrh12f_8oWTXkQAAAQY"]
[Thu Feb 26 18:49:52.014668 2026] [:error] [pid 54991:tid 55034] [client 193.37.32.40:45617] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Feb 26 18:49:52.440705 2026] [:error] [pid 54991:tid 55042] [client 193.37.32.40:45617] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Feb 26 18:49:52.639690 2026] [:error] [pid 54991:tid 55027] [client 193.37.32.40:45617] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaAlUN4Zx-mJ8gbRB2jCYwAAAEc"]
[Thu Feb 26 18:49:53.017720 2026] [:error] [pid 54990:tid 55006] [client 193.37.32.4:57339] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Feb 26 18:49:53.186723 2026] [:error] [pid 54990:tid 55001] [client 193.37.32.4:57339] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Feb 26 18:49:53.885742 2026] [:error] [pid 54990:tid 55015] [client 193.37.32.4:57339] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaAlUXtr2qmt_mBhH2wJfQAAABY"]
[Thu Feb 26 18:49:54.452816 2026] [:error] [pid 20419:tid 20427] [client 193.37.32.31:24241] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaAlUu3DVDvMfTYYUBUWgQAAAcU"]
[Thu Feb 26 18:49:54.666595 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.51:30375] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaAlUu3DVDvMfTYYUBUWggAAAc8"]
[Thu Feb 26 18:49:55.318237 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.46:38903] [client 193.37.32.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaAlUwmK1w2kZvh5eLFhFgAAAIU"]
[Thu Feb 26 18:49:55.855615 2026] [:error] [pid 20419:tid 20422] [client 193.37.32.29:54781] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Feb 26 18:49:55.996749 2026] [:error] [pid 20419:tid 20444] [client 193.37.32.29:54781] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Feb 26 18:49:56.100075 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.29:54781] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Feb 26 18:49:56.239659 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.29:54781] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Feb 26 18:49:56.864890 2026] [:error] [pid 20419:tid 20433] [client 193.37.32.29:54781] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaAlVO3DVDvMfTYYUBUWqgAAAcs"]
[Thu Feb 26 18:49:57.265355 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.12:45725] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaAlVeA33x90V6yYHahINQAAAVU"]
[Thu Feb 26 18:49:57.474820 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.13:51083] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaAlVeA33x90V6yYHahIPAAAAUo"]
[Thu Feb 26 18:49:58.076513 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.32:37929] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaAlVuA33x90V6yYHahIUAAAAU4"]
[Thu Feb 26 18:49:58.340942 2026] [:error] [pid 3883:tid 3891] [client 193.37.32.22:30701] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaAlVuA33x90V6yYHahIZwAAAUU"]
[Thu Feb 26 18:49:58.602298 2026] [:error] [pid 3883:tid 3904] [client 193.37.32.45:21373] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaAlVuA33x90V6yYHahIdAAAAVI"]
[Thu Feb 26 18:49:58.943923 2026] [:error] [pid 55051:tid 55075] [client 193.37.32.49:22943] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaAlVgmK1w2kZvh5eLFhLgAAAJU"]
[Thu Feb 26 18:49:59.275558 2026] [:error] [pid 25311:tid 25324] [client 193.37.32.6:59263] [client 193.37.32.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaAlV9fdM__yZAgJFSuCmgAAAYo"]
[Thu Feb 26 18:49:59.561481 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.51:52929] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaAlV9fdM__yZAgJFSuCngAAAYM"]
[Thu Feb 26 18:49:59.882367 2026] [:error] [pid 55051:tid 55058] [client 193.37.32.15:34363] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaAlVwmK1w2kZvh5eLFhNQAAAIQ"]
[Thu Feb 26 18:50:00.550311 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.14:22789] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaAlWO3DVDvMfTYYUBUW1AAAAdU"]
[Thu Feb 26 18:50:01.139617 2026] [:error] [pid 20419:tid 20433] [client 193.37.32.13:44133] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaAlWe3DVDvMfTYYUBUW4gAAAcs"]
[Thu Feb 26 18:50:01.531717 2026] [:error] [pid 20419:tid 20436] [client 193.37.32.52:46509] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Feb 26 18:50:01.771768 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.52:46509] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaAlWe3DVDvMfTYYUBUW7wAAAdU"]
[Thu Feb 26 18:50:02.275527 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.11:45827] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaAlWtfdM__yZAgJFSuC2gAAAYQ"]
[Thu Feb 26 18:50:02.773387 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.24:30185] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Feb 26 18:50:02.891686 2026] [:error] [pid 3883:tid 3903] [client 193.37.32.24:30185] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaAlWuA33x90V6yYHahJCAAAAVE"]
[Thu Feb 26 18:50:03.313606 2026] [:error] [pid 3883:tid 3895] [client 193.37.32.36:62907] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Feb 26 18:50:03.414077 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.36:62907] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Feb 26 18:50:03.512912 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.36:62907] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Feb 26 18:50:03.677788 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.36:62907] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaAlW-A33x90V6yYHahJHAAAAUo"]
[Thu Feb 26 18:50:03.916194 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.21:41403] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Feb 26 18:50:04.019333 2026] [:error] [pid 25311:tid 25320] [client 193.37.32.21:41403] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaAlXNfdM__yZAgJFSuDBgAAAYY"]
[Thu Feb 26 18:50:04.707095 2026] [:error] [pid 3883:tid 3893] [client 193.37.32.9:26091] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Feb 26 18:50:04.808791 2026] [:error] [pid 3883:tid 3903] [client 193.37.32.9:26091] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Feb 26 18:50:04.971002 2026] [:error] [pid 3883:tid 3902] [client 193.37.32.9:26091] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Feb 26 18:50:05.602847 2026] [:error] [pid 3883:tid 3893] [client 193.37.32.9:26091] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Feb 26 18:50:05.722070 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.9:26091] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Feb 26 18:50:05.953404 2026] [:error] [pid 3883:tid 3890] [client 193.37.32.9:26091] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Feb 26 18:50:06.338704 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.9:26091] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Feb 26 18:50:06.472151 2026] [:error] [pid 3883:tid 3892] [client 193.37.32.9:26091] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaAlXuA33x90V6yYHahJeQAAAUY"]
[Thu Feb 26 18:50:06.694907 2026] [:error] [pid 25311:tid 25323] [client 193.37.32.42:55163] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaAlXtfdM__yZAgJFSuDNgAAAYk"]
[Thu Feb 26 18:50:07.019108 2026] [:error] [pid 20419:tid 20423] [client 193.37.32.52:59069] [client 193.37.32.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.52, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaAlX-3DVDvMfTYYUBUXQQAAAcE"]
[Thu Feb 26 18:50:07.022680 2026] [:error] [pid 20419:tid 20423] [client 193.37.32.52:59069] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Feb 26 18:50:07.165804 2026] [:error] [pid 20419:tid 20444] [client 193.37.32.52:59069] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Feb 26 18:50:07.304148 2026] [:error] [pid 20419:tid 20428] [client 193.37.32.52:59069] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaAlX-3DVDvMfTYYUBUXSQAAAcY"]
[Thu Feb 26 18:50:07.735401 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.13:61003] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Feb 26 18:50:07.911485 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.13:61003] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaAlX-A33x90V6yYHahJlAAAAUw"]
[Thu Feb 26 18:50:08.169495 2026] [:error] [pid 25311:tid 25320] [client 193.37.32.20:30685] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaAlYNfdM__yZAgJFSuDTgAAAYY"]
[Thu Feb 26 18:50:08.910978 2026] [:error] [pid 54991:tid 55036] [client 193.37.32.43:60811] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaAlYN4Zx-mJ8gbRB2jCrAAAAFA"]
[Thu Feb 26 18:50:09.171687 2026] [:error] [pid 54990:tid 55012] [client 193.37.32.41:28425] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aaAlYXtr2qmt_mBhH2wJmwAAABM"]
[Thu Feb 26 18:50:09.879198 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.17:52809] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Feb 26 18:50:10.222338 2026] [:error] [pid 55618:tid 55641] [client 193.37.32.17:52809] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaAlYh61Vrh12f_8oWTYAAAAARQ"]
[Thu Feb 26 18:50:10.704502 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.18:55511] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Feb 26 18:50:10.983276 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.18:55511] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aaAlYh61Vrh12f_8oWTYDQAAAQA"]
[Thu Feb 26 18:50:13.763780 2026] [:error] [pid 3883:tid 3893] [client 193.37.32.48:41077] [client 193.37.32.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaAlZeA33x90V6yYHahJzgAAAUc"]
[Thu Feb 26 18:50:14.184356 2026] [:error] [pid 55122:tid 55145] [client 193.37.32.52:65039] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Feb 26 18:50:14.318235 2026] [:error] [pid 55122:tid 55146] [client 193.37.32.52:65039] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaAlZoLiR0OfjFxvcN8GTAAAANY"]
[Thu Feb 26 18:50:14.627602 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.6:41183] [client 193.37.32.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaAlZgmK1w2kZvh5eLFhqQAAAIg"]
[Thu Feb 26 18:50:15.229946 2026] [:error] [pid 55051:tid 55058] [client 193.37.32.25:34361] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Feb 26 18:50:15.447438 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.25:34361] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Feb 26 18:50:15.803643 2026] [:error] [pid 55051:tid 55065] [client 193.37.32.25:34361] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Feb 26 18:50:16.071719 2026] [:error] [pid 55051:tid 55069] [client 193.37.32.25:34361] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaAlaAmK1w2kZvh5eLFhuwAAAI8"]
[Thu Feb 26 18:50:16.411159 2026] [:error] [pid 54991:tid 55044] [client 193.37.32.35:55067] [client 193.37.32.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaAlaN4Zx-mJ8gbRB2jC5wAAAFg"]
[Thu Feb 26 18:50:17.196024 2026] [:error] [pid 25311:tid 25320] [client 193.37.32.10:50807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Feb 26 18:50:17.336642 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.10:50807] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aaAladfdM__yZAgJFSuDtgAAAYg"]
[Thu Feb 26 18:50:17.565799 2026] [:error] [pid 55051:tid 55067] [client 193.37.32.16:38495] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaAlaQmK1w2kZvh5eLFhwQAAAI0"]
[Thu Feb 26 18:50:17.860274 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.45:30157] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaAlaR61Vrh12f_8oWTYNAAAARU"]
[Thu Feb 26 18:50:18.715856 2026] [:error] [pid 54991:tid 55030] [client 193.37.32.4:42547] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Feb 26 18:50:18.824477 2026] [:error] [pid 54991:tid 55025] [client 193.37.32.4:42547] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaAlat4Zx-mJ8gbRB2jC-gAAAEU"]
[Thu Feb 26 18:50:19.185407 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.51:41605] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaAla-A33x90V6yYHahKGwAAAU4"]
[Thu Feb 26 18:50:19.403598 2026] [:error] [pid 55051:tid 55066] [client 193.37.32.41:28811] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Feb 26 18:50:19.531696 2026] [:error] [pid 55051:tid 55073] [client 193.37.32.41:28811] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Feb 26 18:50:19.776834 2026] [:error] [pid 55051:tid 55065] [client 193.37.32.41:28811] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Feb 26 18:50:20.369942 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.41:28811] [client 193.37.32.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.41, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "aaAlbAmK1w2kZvh5eLFh6AAAAIU"]
[Thu Feb 26 18:50:20.612175 2026] [:error] [pid 55051:tid 55058] [client 193.37.32.41:28811] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Feb 26 18:50:20.734812 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.41:28811] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Feb 26 18:50:20.855211 2026] [:error] [pid 55051:tid 55061] [client 193.37.32.41:28811] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Feb 26 18:50:21.102402 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.41:28811] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaAlbQmK1w2kZvh5eLFh-AAAAIU"]
[Thu Feb 26 18:50:21.351497 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.16:38221] [client 193.37.32.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.16, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaAlbe3DVDvMfTYYUBUX3wAAAc8"]
[Thu Feb 26 18:50:22.084966 2026] [:error] [pid 20419:tid 20441] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Feb 26 18:50:22.204033 2026] [:error] [pid 20419:tid 20433] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Feb 26 18:50:22.464267 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Feb 26 18:50:22.849923 2026] [:error] [pid 20419:tid 20423] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Feb 26 18:50:23.256412 2026] [:error] [pid 20419:tid 20425] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Feb 26 18:50:24.269746 2026] [:error] [pid 20419:tid 20438] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Feb 26 18:50:24.398174 2026] [:error] [pid 20419:tid 20430] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Feb 26 18:50:25.173658 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.16:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Feb 26 18:50:25.417568 2026] [:error] [pid 20419:tid 20425] [client 193.37.32.16:38221] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaAlce3DVDvMfTYYUBUYEwAAAcM"]
[Thu Feb 26 18:50:25.870791 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.39:48561] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Feb 26 18:50:25.980439 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.39:48561] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaAlcR61Vrh12f_8oWTYjwAAAQ4"]
[Thu Feb 26 18:50:26.399685 2026] [:error] [pid 20419:tid 20439] [client 193.37.32.26:24625] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Feb 26 18:50:26.500531 2026] [:error] [pid 20419:tid 20444] [client 193.37.32.26:24625] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaAlcu3DVDvMfTYYUBUYHQAAAdY"]
[Thu Feb 26 18:50:27.130346 2026] [:error] [pid 55051:tid 55068] [client 193.37.32.36:46095] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Feb 26 18:50:27.402061 2026] [:error] [pid 55051:tid 55068] [client 193.37.32.36:46095] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Feb 26 18:50:27.695927 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.36:46095] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Feb 26 18:50:27.823786 2026] [:error] [pid 55051:tid 55065] [client 193.37.32.36:46095] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Thu Feb 26 18:50:28.165970 2026] [:error] [pid 55051:tid 55064] [client 193.37.32.36:46095] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaAldAmK1w2kZvh5eLFiUgAAAIo"]
[Thu Feb 26 18:50:28.450478 2026] [:error] [pid 20419:tid 20436] [client 193.37.32.43:61977] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Feb 26 18:50:28.578672 2026] [:error] [pid 20419:tid 20424] [client 193.37.32.43:61977] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Feb 26 18:50:28.710376 2026] [:error] [pid 20419:tid 20444] [client 193.37.32.43:61977] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaAldO3DVDvMfTYYUBUYKgAAAdY"]
[Thu Feb 26 18:50:29.136737 2026] [:error] [pid 55051:tid 55061] [client 193.37.32.31:44115] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaAldQmK1w2kZvh5eLFicgAAAIc"]
[Thu Feb 26 18:50:29.562313 2026] [:error] [pid 3883:tid 3906] [client 193.37.32.39:43065] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Feb 26 18:50:29.928864 2026] [:error] [pid 3883:tid 3902] [client 193.37.32.39:43065] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Thu Feb 26 18:50:30.046959 2026] [:error] [pid 3883:tid 3888] [client 193.37.32.39:43065] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Feb 26 18:50:30.177273 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.39:43065] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaAlduA33x90V6yYHahKxQAAAUA"]
[Thu Feb 26 18:50:30.430157 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.19:51695] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaAldu3DVDvMfTYYUBUYOwAAAdU"]
[Thu Feb 26 18:50:31.504418 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.45:29731] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Feb 26 18:50:31.817790 2026] [:error] [pid 3883:tid 3902] [client 193.37.32.45:29731] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaAld-A33x90V6yYHahK3gAAAVA"]
[Thu Feb 26 18:50:32.288523 2026] [:error] [pid 20419:tid 20433] [client 193.37.32.20:62883] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aaAleO3DVDvMfTYYUBUYSAAAAcs"]
[Thu Feb 26 18:50:32.789160 2026] [:error] [pid 54990:tid 55012] [client 193.37.32.35:21847] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Feb 26 18:50:32.912528 2026] [:error] [pid 54990:tid 54999] [client 193.37.32.35:21847] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Feb 26 18:50:33.038334 2026] [:error] [pid 54990:tid 55016] [client 193.37.32.35:21847] [client 193.37.32.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaAleXtr2qmt_mBhH2wKcAAAABc"]
[Thu Feb 26 18:50:33.513870 2026] [:error] [pid 20419:tid 20442] [client 193.37.32.8:44999] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Feb 26 18:50:33.685302 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.8:44999] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Thu Feb 26 18:50:33.936757 2026] [:error] [pid 20419:tid 20439] [client 193.37.32.8:44999] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Feb 26 18:50:34.285547 2026] [:error] [pid 20419:tid 20425] [client 193.37.32.8:44999] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaAleu3DVDvMfTYYUBUYYAAAAcM"]
[Thu Feb 26 18:50:34.576057 2026] [:error] [pid 54991:tid 55042] [client 193.37.32.41:34103] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Thu Feb 26 18:50:35.111529 2026] [:error] [pid 54991:tid 55027] [client 193.37.32.41:34103] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaAle94Zx-mJ8gbRB2jDcQAAAEc"]
[Thu Feb 26 18:50:35.806092 2026] [:error] [pid 55618:tid 55624] [client 193.37.32.37:63367] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Thu Feb 26 18:50:36.296164 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.37:63367] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Thu Feb 26 18:50:36.446705 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.37:63367] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Thu Feb 26 18:50:36.693794 2026] [:error] [pid 55618:tid 55643] [client 193.37.32.37:63367] [client 193.37.32.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.37, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaAlfB61Vrh12f_8oWTY0QAAARY"]
[Thu Feb 26 18:50:37.361325 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.37:63367] [client 193.37.32.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaAlfR61Vrh12f_8oWTY3AAAARU"]
[Thu Feb 26 18:50:37.665700 2026] [:error] [pid 3883:tid 3910] [client 193.37.32.45:35967] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Thu Feb 26 18:50:37.779116 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.45:35967] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaAlfeA33x90V6yYHahLRAAAAUw"]
[Thu Feb 26 18:50:38.083635 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.36:28361] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Thu Feb 26 18:50:38.357401 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.36:28361] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Feb 26 18:50:38.568205 2026] [:error] [pid 25311:tid 25315] [client 193.37.32.36:28361] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaAlftfdM__yZAgJFSuEZAAAAYE"]
[Thu Feb 26 18:50:38.906584 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.5:31061] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Thu Feb 26 18:50:39.059234 2026] [:error] [pid 25311:tid 25334] [client 193.37.32.5:31061] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Feb 26 18:50:39.347352 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.5:31061] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaAlf9fdM__yZAgJFSuEawAAAYs"]
[Thu Feb 26 18:50:39.807495 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.10:51019] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaAlfwmK1w2kZvh5eLFixQAAAIg"]
[Thu Feb 26 18:50:40.101958 2026] [:error] [pid 55122:tid 55140] [client 193.37.32.42:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Thu Feb 26 18:50:40.204642 2026] [:error] [pid 55122:tid 55147] [client 193.37.32.42:62537] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Thu Feb 26 18:50:40.509981 2026] [:error] [pid 55122:tid 55141] [client 193.37.32.42:62537] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaAlgILiR0OfjFxvcN8HAQAAANE"]
[Thu Feb 26 18:50:40.786517 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.38:39461] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Thu Feb 26 18:50:41.022888 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.38:39461] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Thu Feb 26 18:50:41.142967 2026] [:error] [pid 55618:tid 55632] [client 193.37.32.38:39461] [client 193.37.32.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaAlgR61Vrh12f_8oWTZFgAAAQs"]
[Thu Feb 26 18:50:41.698874 2026] [:error] [pid 55618:tid 55627] [client 193.37.32.12:39509] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "aaAlgR61Vrh12f_8oWTZIwAAAQY"]
[Thu Feb 26 18:50:41.997453 2026] [:error] [pid 55122:tid 55132] [client 193.37.32.35:29877] [client 193.37.32.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaAlgYLiR0OfjFxvcN8HGAAAAMg"]
[Thu Feb 26 18:50:42.370092 2026] [:error] [pid 55618:tid 55633] [client 193.37.32.15:40801] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaAlgh61Vrh12f_8oWTZPgAAAQw"]
[Thu Feb 26 18:50:42.656621 2026] [:error] [pid 55122:tid 55125] [client 193.37.32.50:37895] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaAlgoLiR0OfjFxvcN8HJgAAAME"]
[Thu Feb 26 18:50:42.916215 2026] [:error] [pid 20419:tid 20426] [client 193.37.32.34:29321] [client 193.37.32.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaAlgu3DVDvMfTYYUBUYdgAAAcQ"]
[Thu Feb 26 18:50:43.167863 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.129:28079] [client 193.37.32.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaAlgx61Vrh12f_8oWTZVQAAAQA"]
[Thu Feb 26 18:50:43.816297 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.27:54445] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaAlg9fdM__yZAgJFSuEjQAAAZM"]
[Thu Feb 26 18:50:44.077078 2026] [:error] [pid 3883:tid 3904] [client 193.37.32.13:62301] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaAlhOA33x90V6yYHahLsgAAAVI"]
[Thu Feb 26 18:50:44.347485 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.18:61321] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaAlhNfdM__yZAgJFSuEngAAAYM"]
[Thu Feb 26 18:50:44.756406 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.13:57521] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaAlhNfdM__yZAgJFSuEqQAAAYM"]
[Thu Feb 26 18:50:45.311028 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.21:42659] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaAlhdfdM__yZAgJFSuEvQAAAYI"]
[Thu Feb 26 18:50:45.586710 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.12:47561] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Thu Feb 26 18:50:46.316367 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.12:47561] [client 193.37.32.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.12, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaAlhtfdM__yZAgJFSuE5gAAAYQ"]
[Thu Feb 26 18:50:49.036607 2026] [:error] [pid 25311:tid 25334] [client 193.37.32.12:47561] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaAlidfdM__yZAgJFSuFDAAAAZQ"]
[Thu Feb 26 18:50:49.478408 2026] [:error] [pid 25311:tid 25331] [client 193.37.32.13:27911] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaAlidfdM__yZAgJFSuFEwAAAZE"]
[Thu Feb 26 18:50:50.248456 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Feb 26 18:50:50.393998 2026] [:error] [pid 55618:tid 55643] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Thu Feb 26 18:50:50.914687 2026] [:error] [pid 55618:tid 55622] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Thu Feb 26 18:50:51.041524 2026] [:error] [pid 55618:tid 55632] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Thu Feb 26 18:50:51.645656 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Thu Feb 26 18:50:51.752556 2026] [:error] [pid 55618:tid 55640] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Thu Feb 26 18:50:51.875243 2026] [:error] [pid 55618:tid 55621] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Feb 26 18:50:52.077041 2026] [:error] [pid 55618:tid 55622] [client 193.37.32.41:40449] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Thu Feb 26 18:50:52.223240 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.41:40449] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaAljB61Vrh12f_8oWTZrgAAARU"]
[Thu Feb 26 18:50:52.434171 2026] [:error] [pid 55051:tid 55054] [client 193.37.32.20:43233] [client 193.37.32.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaAljAmK1w2kZvh5eLFjAwAAAIA"]
[Thu Feb 26 18:50:52.683345 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.8:43877] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaAljOA33x90V6yYHahMIwAAAU4"]
[Thu Feb 26 18:50:53.144957 2026] [:error] [pid 55051:tid 55062] [client 193.37.32.4:42867] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Thu Feb 26 18:50:53.306276 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.4:42867] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Thu Feb 26 18:50:53.594323 2026] [:error] [pid 55051:tid 55063] [client 193.37.32.4:42867] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Thu Feb 26 18:50:53.834406 2026] [:error] [pid 55051:tid 55069] [client 193.37.32.4:42867] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaAljQmK1w2kZvh5eLFjJQAAAI8"]
[Thu Feb 26 18:50:55.213981 2026] [:error] [pid 3883:tid 3890] [client 193.37.32.23:59549] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaAlj-A33x90V6yYHahMYAAAAUQ"]
[Thu Feb 26 18:50:55.540784 2026] [:error] [pid 3883:tid 3890] [client 193.37.32.5:52823] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaAlj-A33x90V6yYHahMawAAAUQ"]
[Thu Feb 26 18:50:57.823155 2026] [:error] [pid 55618:tid 55636] [client 193.37.32.4:22391] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaAlkR61Vrh12f_8oWTZ1QAAAQ8"]
[Thu Feb 26 18:50:58.223021 2026] [:error] [pid 55051:tid 55069] [client 193.37.32.24:35285] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaAlkgmK1w2kZvh5eLFjlQAAAI8"]
[Thu Feb 26 18:50:58.793613 2026] [:error] [pid 20419:tid 20438] [client 193.37.32.25:60783] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaAlku3DVDvMfTYYUBUY0AAAAdA"]
[Thu Feb 26 18:51:00.600431 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.26:39469] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaAllB61Vrh12f_8oWTaAgAAARU"]
[Thu Feb 26 18:51:03.467327 2026] [:error] [pid 54990:tid 55003] [client 193.37.32.36:52503] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Thu Feb 26 18:51:03.708950 2026] [:error] [pid 54990:tid 55008] [client 193.37.32.36:52503] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aaAll3tr2qmt_mBhH2wK-AAAAA8"]
[Thu Feb 26 18:51:04.393490 2026] [:error] [pid 20419:tid 20432] [client 193.37.32.53:56141] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Thu Feb 26 18:51:04.856253 2026] [:error] [pid 20419:tid 20431] [client 193.37.32.53:56141] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Feb 26 18:51:04.979294 2026] [:error] [pid 20419:tid 20442] [client 193.37.32.53:56141] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaAlmO3DVDvMfTYYUBUY-gAAAdQ"]
[Thu Feb 26 18:51:05.480462 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.52:29441] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaAlmeA33x90V6yYHahNMwAAAUE"]
[Thu Feb 26 18:51:06.363510 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.130:53183] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaAlmuA33x90V6yYHahNYwAAAVU"]
[Thu Feb 26 18:51:07.591465 2026] [:error] [pid 54990:tid 54998] [client 193.37.32.18:23005] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaAlm3tr2qmt_mBhH2wLIgAAAAU"]
[Thu Feb 26 18:51:08.162989 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.24:54007] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Feb 26 18:51:08.332162 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.24:54007] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaAlnOA33x90V6yYHahNhAAAAU4"]
[Thu Feb 26 18:51:08.583025 2026] [:error] [pid 55051:tid 55078] [client 193.37.32.23:64795] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaAlnAmK1w2kZvh5eLFj7AAAAJg"]
[Thu Feb 26 18:51:09.790633 2026] [:error] [pid 55618:tid 55628] [client 193.37.32.39:65085] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaAlnR61Vrh12f_8oWTaNwAAAQc"]
[Thu Feb 26 18:51:10.020731 2026] [:error] [pid 54990:tid 55005] [client 193.37.32.28:32037] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Feb 26 18:51:10.657181 2026] [:error] [pid 54990:tid 55000] [client 193.37.32.28:32037] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Thu Feb 26 18:51:10.806123 2026] [:error] [pid 54990:tid 54997] [client 193.37.32.28:32037] [client 193.37.32.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaAlnntr2qmt_mBhH2wLPwAAAAQ"]
[Thu Feb 26 18:51:13.761987 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.21:42329] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Thu Feb 26 18:51:14.011978 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.21:42329] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaAloh61Vrh12f_8oWTadwAAAQU"]
[Thu Feb 26 18:51:14.242079 2026] [:error] [pid 54991:tid 55030] [client 193.37.32.48:22523] [client 193.37.32.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaAlot4Zx-mJ8gbRB2jENAAAAEo"]
[Thu Feb 26 18:51:14.785065 2026] [:error] [pid 55122:tid 55132] [client 193.37.32.53:27745] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaAlooLiR0OfjFxvcN8H5QAAAMg"]
[Thu Feb 26 18:51:15.834712 2026] [:error] [pid 54991:tid 55040] [client 193.37.32.51:53973] [client 193.37.32.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaAlo94Zx-mJ8gbRB2jEQAAAAFQ"]
[Thu Feb 26 18:51:16.091590 2026] [:error] [pid 55122:tid 55125] [client 193.37.32.53:46417] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaAlpILiR0OfjFxvcN8H8gAAAME"]
[Thu Feb 26 18:51:16.539509 2026] [:error] [pid 55051:tid 55064] [client 193.37.32.32:62033] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Thu Feb 26 18:51:17.266503 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.32:62033] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaAlpQmK1w2kZvh5eLFkMQAAAIU"]
[Thu Feb 26 18:51:17.878298 2026] [:error] [pid 55618:tid 55642] [client 193.37.32.9:39239] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaAlpR61Vrh12f_8oWTapQAAARU"]
[Thu Feb 26 18:51:18.086445 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.8:54383] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaAlph61Vrh12f_8oWTapwAAARc"]
[Thu Feb 26 18:51:18.507892 2026] [:error] [pid 54990:tid 54994] [client 193.37.32.17:35649] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Feb 26 18:51:19.006647 2026] [:error] [pid 54990:tid 55011] [client 193.37.32.17:35649] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaAlp3tr2qmt_mBhH2wLUgAAABI"]
[Thu Feb 26 18:51:19.360123 2026] [:error] [pid 54991:tid 55041] [client 193.37.32.42:62197] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaAlp94Zx-mJ8gbRB2jEUQAAAFU"]
[Thu Feb 26 18:51:20.365951 2026] [:error] [pid 55618:tid 55644] [client 193.37.32.32:51565] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaAlqB61Vrh12f_8oWTavAAAARc"]
[Thu Feb 26 18:51:20.771574 2026] [:error] [pid 55051:tid 55054] [client 193.37.32.7:34071] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Thu Feb 26 18:51:20.895696 2026] [:error] [pid 55051:tid 55071] [client 193.37.32.7:34071] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaAlqAmK1w2kZvh5eLFkZQAAAJE"]
[Thu Feb 26 18:51:21.341555 2026] [:error] [pid 3883:tid 3888] [client 193.37.32.21:53783] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaAlqeA33x90V6yYHahOmwAAAUI"]
[Thu Feb 26 18:51:21.934740 2026] [:error] [pid 55051:tid 55054] [client 193.37.32.37:53671] [client 193.37.32.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "aaAlqQmK1w2kZvh5eLFkdwAAAIA"]
[Thu Feb 26 18:51:22.385471 2026] [:error] [pid 20419:tid 20440] [client 193.37.32.9:53323] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaAlqu3DVDvMfTYYUBUZoAAAAdI"]
[Thu Feb 26 18:51:22.961402 2026] [:error] [pid 20419:tid 20427] [client 193.37.32.47:26485] [client 193.37.32.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aaAlqu3DVDvMfTYYUBUZqAAAAcU"]
[Thu Feb 26 18:51:23.181091 2026] [:error] [pid 55122:tid 55124] [client 193.37.32.24:64509] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaAlq4LiR0OfjFxvcN8IFQAAAMA"]
[Thu Feb 26 18:51:24.214153 2026] [:error] [pid 55051:tid 55058] [client 193.37.32.10:48551] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaAlrAmK1w2kZvh5eLFkjAAAAIQ"]
[Thu Feb 26 18:51:24.867669 2026] [:error] [pid 55122:tid 55138] [client 193.37.32.26:29339] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaAlrILiR0OfjFxvcN8IJwAAAM4"]
[Thu Feb 26 18:51:25.380563 2026] [:error] [pid 54991:tid 55025] [client 193.37.32.27:63735] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Feb 26 18:51:25.561431 2026] [:error] [pid 54991:tid 55032] [client 193.37.32.27:63735] [client 193.37.32.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaAlrd4Zx-mJ8gbRB2jEZgAAAEw"]
[Thu Feb 26 18:51:26.285163 2026] [:error] [pid 3883:tid 3886] [client 193.37.32.22:64259] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaAlruA33x90V6yYHahO5gAAAUA"]
[Thu Feb 26 18:51:26.561559 2026] [:error] [pid 3883:tid 3889] [client 193.37.32.25:44619] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Feb 26 18:51:27.572022 2026] [:error] [pid 3883:tid 3903] [client 193.37.32.25:44619] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaAlr-A33x90V6yYHahPEAAAAVE"]
[Thu Feb 26 18:51:27.962460 2026] [:error] [pid 25311:tid 25315] [client 193.37.32.13:36263] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaAlr9fdM__yZAgJFSuGHQAAAYE"]
[Thu Feb 26 18:51:28.333926 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.130:53877] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaAlsO3DVDvMfTYYUBUaKQAAAc8"]
[Thu Feb 26 18:51:28.885050 2026] [:error] [pid 54991:tid 55026] [client 193.37.32.33:21531] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaAlsN4Zx-mJ8gbRB2jEegAAAEY"]
[Thu Feb 26 18:51:30.368623 2026] [:error] [pid 55051:tid 55069] [client 193.37.32.38:26121] [client 193.37.32.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaAlsgmK1w2kZvh5eLFk2AAAAI8"]
[Thu Feb 26 18:51:30.609843 2026] [:error] [pid 20419:tid 20436] [client 193.37.32.18:59483] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaAlsu3DVDvMfTYYUBUaPQAAAc4"]
[Thu Feb 26 18:51:31.079851 2026] [:error] [pid 25311:tid 25331] [client 193.37.32.21:35301] [client 193.37.32.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php%20"] [unique_id "aaAls9fdM__yZAgJFSuGPAAAAZE"]
[Thu Feb 26 18:51:31.899434 2026] [:error] [pid 25311:tid 25323] [client 193.37.32.30:20537] [client 193.37.32.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaAls9fdM__yZAgJFSuGUQAAAYk"]
[Thu Feb 26 18:51:33.221740 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.14:33505] [client 193.37.32.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaAlteA33x90V6yYHahPTwAAAU4"]
[Thu Feb 26 18:51:34.831009 2026] [:error] [pid 20419:tid 20435] [client 193.37.32.4:30269] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaAltu3DVDvMfTYYUBUabAAAAc0"]
[Thu Feb 26 18:51:35.041236 2026] [:error] [pid 20419:tid 20427] [client 193.37.32.52:64667] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaAlt-3DVDvMfTYYUBUadwAAAcU"]
[Thu Feb 26 18:51:35.343833 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.18:42519] [client 193.37.32.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.18, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaAlt-A33x90V6yYHahPaQAAAUE"]
[Thu Feb 26 18:51:35.349713 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.18:42519] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Thu Feb 26 18:51:35.479298 2026] [:error] [pid 3883:tid 3893] [client 193.37.32.18:42519] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaAlt-A33x90V6yYHahPawAAAUc"]
[Thu Feb 26 18:51:37.549124 2026] [:error] [pid 20419:tid 20433] [client 193.37.32.48:20285] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Feb 26 18:51:37.665847 2026] [:error] [pid 20419:tid 20443] [client 193.37.32.48:20285] [client 193.37.32.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaAlue3DVDvMfTYYUBUawgAAAdU"]
[Thu Feb 26 18:51:38.930399 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.49:38953] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aaAluuA33x90V6yYHahPoQAAAU4"]
[Thu Feb 26 18:51:39.174465 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.26:31025] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Thu Feb 26 18:51:40.233756 2026] [:error] [pid 3883:tid 3897] [client 193.37.32.26:31025] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaAlvOA33x90V6yYHahPyQAAAUs"]
[Thu Feb 26 18:51:40.591091 2026] [:error] [pid 25311:tid 25326] [client 193.37.32.129:61919] [client 193.37.32.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaAlvNfdM__yZAgJFSuGsgAAAYw"]
[Thu Feb 26 18:51:41.238977 2026] [:error] [pid 25311:tid 25328] [client 193.37.32.19:64163] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaAlvdfdM__yZAgJFSuG0QAAAY4"]
[Thu Feb 26 18:51:41.733563 2026] [:error] [pid 55618:tid 55624] [client 193.37.32.129:46965] [client 193.37.32.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaAlvR61Vrh12f_8oWTbUwAAAQM"]
[Thu Feb 26 18:51:42.068718 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.12:50835] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Thu Feb 26 18:51:42.291319 2026] [:error] [pid 25311:tid 25326] [client 193.37.32.12:50835] [client 193.37.32.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.32.12, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaAlvtfdM__yZAgJFSuG7wAAAYw"]
[Thu Feb 26 18:51:42.578402 2026] [:error] [pid 25311:tid 25336] [client 193.37.32.12:50835] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaAlvtfdM__yZAgJFSuG-gAAAZY"]
[Thu Feb 26 18:51:43.771690 2026] [:error] [pid 25311:tid 25323] [client 193.37.32.52:64871] [client 193.37.32.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaAlv9fdM__yZAgJFSuHEgAAAYk"]
[Thu Feb 26 18:51:44.004438 2026] [:error] [pid 25311:tid 25327] [client 193.37.32.29:46169] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Feb 26 18:51:44.155730 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.29:46169] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaAlwNfdM__yZAgJFSuHHAAAAZM"]
[Thu Feb 26 18:51:44.500723 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.11:23561] [client 193.37.32.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaAlwNfdM__yZAgJFSuHIwAAAY8"]
[Thu Feb 26 18:51:44.775781 2026] [:error] [pid 55051:tid 55064] [client 193.37.32.25:60189] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Thu Feb 26 18:51:45.266702 2026] [:error] [pid 55051:tid 55061] [client 193.37.32.25:60189] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaAlwQmK1w2kZvh5eLFlTwAAAIc"]
[Thu Feb 26 18:51:45.848836 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.10:45129] [client 193.37.32.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaAlwR61Vrh12f_8oWTbZwAAAQ4"]
[Thu Feb 26 18:51:46.124438 2026] [:error] [pid 3883:tid 3909] [client 193.37.32.36:44771] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Feb 26 18:51:46.407251 2026] [:error] [pid 3883:tid 3895] [client 193.37.32.36:44771] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Feb 26 18:51:46.706081 2026] [:error] [pid 3883:tid 3895] [client 193.37.32.36:44771] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaAlwuA33x90V6yYHahQCgAAAUk"]
[Thu Feb 26 18:51:46.983071 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.21:21831] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaAlwgmK1w2kZvh5eLFlbQAAAIU"]
[Thu Feb 26 18:51:47.375997 2026] [:error] [pid 55051:tid 55064] [client 193.37.32.35:44143] [client 193.37.32.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/count.php"] [unique_id "aaAlwwmK1w2kZvh5eLFldgAAAIo"]
[Thu Feb 26 18:51:47.650983 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.33:39903] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Thu Feb 26 18:51:48.599690 2026] [:error] [pid 25311:tid 25329] [client 193.37.32.33:39903] [client 193.37.32.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaAlxNfdM__yZAgJFSuHXwAAAY8"]
[Thu Feb 26 18:51:49.080410 2026] [:error] [pid 55051:tid 55075] [client 193.37.32.18:49961] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rejuva.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rejuva.au"] [uri "/images/stories/themes.php"] [unique_id "aaAlxQmK1w2kZvh5eLFlnAAAAJU"]
[Thu Feb 26 18:51:49.219462 2026] [:error] [pid 55051:tid 55074] [client 193.37.32.18:49961] [client 193.37.32.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaAlxQmK1w2kZvh5eLFlngAAAJQ"]
[Thu Feb 26 18:51:49.876818 2026] [:error] [pid 25311:tid 25325] [client 193.37.32.32:43641] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaAlxdfdM__yZAgJFSuHgQAAAYs"]
[Thu Feb 26 18:51:50.142803 2026] [:error] [pid 55051:tid 55064] [client 193.37.32.15:33795] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaAlxgmK1w2kZvh5eLFlpwAAAIo"]
[Thu Feb 26 18:51:50.716129 2026] [:error] [pid 3883:tid 3896] [client 193.37.32.49:42861] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Feb 26 18:51:51.345445 2026] [:error] [pid 3883:tid 3905] [client 193.37.32.49:42861] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaAlx-A33x90V6yYHahQlAAAAVM"]
[Thu Feb 26 18:51:51.866402 2026] [:error] [pid 54990:tid 54997] [client 193.37.32.17:59585] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaAlx3tr2qmt_mBhH2wLigAAAAQ"]
[Thu Feb 26 18:51:52.360143 2026] [:error] [pid 55618:tid 55623] [client 193.37.32.31:26569] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaAlyB61Vrh12f_8oWTbmgAAAQI"]
[Thu Feb 26 18:51:52.640605 2026] [:error] [pid 55618:tid 55624] [client 193.37.32.7:56407] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Thu Feb 26 18:51:53.436334 2026] [:error] [pid 55618:tid 55622] [client 193.37.32.7:56407] [client 193.37.32.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaAlyR61Vrh12f_8oWTbrgAAAQE"]
[Thu Feb 26 18:51:53.811500 2026] [:error] [pid 55051:tid 55077] [client 193.37.32.5:52249] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/colour.php"] [unique_id "aaAlyQmK1w2kZvh5eLFl2QAAAJc"]
[Thu Feb 26 18:51:54.115966 2026] [:error] [pid 55051:tid 55054] [client 193.37.32.30:23173] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Feb 26 18:51:54.248671 2026] [:error] [pid 55051:tid 55059] [client 193.37.32.30:23173] [client 193.37.32.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaAlygmK1w2kZvh5eLFl3QAAAIU"]
[Thu Feb 26 18:51:54.561427 2026] [:error] [pid 55051:tid 55066] [client 193.37.32.9:32543] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaAlygmK1w2kZvh5eLFl4QAAAIw"]
[Thu Feb 26 18:51:55.159211 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.12:46643] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaAly-A33x90V6yYHahRCgAAAUg"]
[Thu Feb 26 18:51:56.041827 2026] [:error] [pid 3883:tid 3910] [client 193.37.32.47:58171] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Thu Feb 26 18:51:56.163777 2026] [:error] [pid 3883:tid 3888] [client 193.37.32.47:58171] [client 193.37.32.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaAlzOA33x90V6yYHahRGQAAAUI"]
[Thu Feb 26 18:51:56.547572 2026] [:error] [pid 3883:tid 3901] [client 193.37.32.44:36263] [client 193.37.32.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaAlzOA33x90V6yYHahRIQAAAU8"]
[Thu Feb 26 18:51:59.025769 2026] [:error] [pid 54990:tid 55006] [client 193.37.32.38:40409] [client 193.37.32.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaAlz3tr2qmt_mBhH2wLngAAAA0"]
[Thu Feb 26 18:51:59.613180 2026] [:error] [pid 55618:tid 55628] [client 193.37.32.12:32689] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaAlzx61Vrh12f_8oWTbxQAAAQc"]
[Thu Feb 26 18:51:59.929541 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.26:30113] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Thu Feb 26 18:52:00.399224 2026] [:error] [pid 3883:tid 3890] [client 193.37.32.26:30113] [client 193.37.32.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaAl0OA33x90V6yYHahRXgAAAUQ"]
[Thu Feb 26 18:52:00.648378 2026] [:error] [pid 55618:tid 55630] [client 193.37.32.40:22481] [client 193.37.32.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaAl0B61Vrh12f_8oWTbxwAAAQk"]
[Thu Feb 26 18:52:01.510984 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.49:59721] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaAl0eA33x90V6yYHahRcQAAAUE"]
[Thu Feb 26 18:52:04.866555 2026] [:error] [pid 54991:tid 55038] [client 193.37.32.45:31483] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Thu Feb 26 18:52:05.222272 2026] [:error] [pid 54991:tid 55030] [client 193.37.32.45:31483] [client 193.37.32.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaAl1d4Zx-mJ8gbRB2jFVAAAAEo"]
[Thu Feb 26 18:52:06.278745 2026] [:error] [pid 54991:tid 55042] [client 193.37.32.22:61237] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Thu Feb 26 18:52:06.559693 2026] [:error] [pid 54991:tid 55043] [client 193.37.32.22:61237] [client 193.37.32.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaAl1t4Zx-mJ8gbRB2jFbAAAAFc"]
[Thu Feb 26 18:52:06.869647 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.4:54217] [client 193.37.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaAl1tfdM__yZAgJFSuInwAAAYI"]
[Thu Feb 26 18:52:07.287684 2026] [:error] [pid 25311:tid 25330] [client 193.37.32.12:45791] [client 193.37.32.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaAl19fdM__yZAgJFSuIqAAAAZA"]
[Thu Feb 26 18:52:07.553773 2026] [:error] [pid 3883:tid 3897] [client 193.37.32.5:20405] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaAl1-A33x90V6yYHahRogAAAUs"]
[Thu Feb 26 18:52:08.067873 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.42:46365] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaAl2NfdM__yZAgJFSuIvgAAAYM"]
[Thu Feb 26 18:52:08.516262 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.46:61619] [client 193.37.32.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaAl2NfdM__yZAgJFSuIygAAAYM"]
[Thu Feb 26 18:52:08.740731 2026] [:error] [pid 55051:tid 55075] [client 193.37.32.39:49639] [client 193.37.32.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaAl2AmK1w2kZvh5eLFmUAAAAJU"]
[Thu Feb 26 18:52:09.015822 2026] [:error] [pid 3883:tid 3899] [client 193.37.32.50:50741] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaAl2eA33x90V6yYHahRvwAAAU0"]
[Thu Feb 26 18:52:09.701963 2026] [:error] [pid 25311:tid 25324] [client 193.37.32.32:23501] [client 193.37.32.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaAl2dfdM__yZAgJFSuI1wAAAYo"]
[Thu Feb 26 18:52:10.332932 2026] [:error] [pid 55618:tid 55640] [client 193.37.32.130:23975] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaAl2h61Vrh12f_8oWTcCQAAARM"]
[Thu Feb 26 18:52:11.364008 2026] [:error] [pid 55051:tid 55057] [client 193.37.32.41:38873] [client 193.37.32.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaAl2wmK1w2kZvh5eLFmaQAAAIM"]
[Thu Feb 26 18:52:11.797996 2026] [:error] [pid 55051:tid 55056] [client 193.37.32.23:32191] [client 193.37.32.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaAl2wmK1w2kZvh5eLFmcgAAAII"]
[Thu Feb 26 18:52:12.361689 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.31:45705] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Thu Feb 26 18:52:13.054476 2026] [:error] [pid 20419:tid 20424] [client 193.37.32.31:45705] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaAl3e3DVDvMfTYYUBUcXQAAAcI"]
[Thu Feb 26 18:52:13.346376 2026] [:error] [pid 54990:tid 54993] [client 193.37.32.36:32427] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaAl3Xtr2qmt_mBhH2wL3AAAAAA"]
[Thu Feb 26 18:52:13.876650 2026] [:error] [pid 55051:tid 55073] [client 193.37.32.42:64975] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Thu Feb 26 18:52:14.037550 2026] [:error] [pid 55051:tid 55078] [client 193.37.32.42:64975] [client 193.37.32.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaAl3gmK1w2kZvh5eLFmfQAAAJg"]
[Thu Feb 26 18:52:16.801526 2026] [:error] [pid 54990:tid 55010] [client 193.37.32.5:61419] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaAl4Htr2qmt_mBhH2wL9gAAABE"]
[Thu Feb 26 18:52:17.191779 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.15:54355] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Thu Feb 26 18:52:17.313647 2026] [:error] [pid 55618:tid 55630] [client 193.37.32.15:54355] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaAl4R61Vrh12f_8oWTcLwAAAQk"]
[Thu Feb 26 18:52:17.984902 2026] [:error] [pid 25311:tid 25322] [client 193.37.32.47:39317] [client 193.37.32.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaAl4dfdM__yZAgJFSuJGQAAAYg"]
[Thu Feb 26 18:52:18.227013 2026] [:error] [pid 55618:tid 55633] [client 193.37.32.49:22539] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Thu Feb 26 18:52:18.375791 2026] [:error] [pid 55618:tid 55634] [client 193.37.32.49:22539] [client 193.37.32.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaAl4h61Vrh12f_8oWTcOAAAAQ0"]
[Thu Feb 26 18:52:18.751794 2026] [:error] [pid 25311:tid 25333] [client 193.37.32.25:44567] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaAl4tfdM__yZAgJFSuJKgAAAZM"]
[Thu Feb 26 18:52:19.526189 2026] [:error] [pid 55618:tid 55622] [client 193.37.32.19:28389] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Thu Feb 26 18:52:19.648844 2026] [:error] [pid 55618:tid 55635] [client 193.37.32.19:28389] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaAl4x61Vrh12f_8oWTcSAAAAQ4"]
[Thu Feb 26 18:52:20.778441 2026] [:error] [pid 3883:tid 3898] [client 193.37.32.15:24877] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaAl5OA33x90V6yYHahSFQAAAUw"]
[Thu Feb 26 18:57:01.062638 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Thu Feb 26 18:57:01.286276 2026] [:error] [pid 3883:tid 3893] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/work.php
[Thu Feb 26 18:57:01.619472 2026] [:error] [pid 3883:tid 3908] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/C.php
[Thu Feb 26 18:57:01.904533 2026] [:error] [pid 3883:tid 3904] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/ze.php
[Thu Feb 26 18:57:02.135274 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Thu Feb 26 18:57:02.353805 2026] [:error] [pid 3883:tid 3904] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/sc.php
[Thu Feb 26 18:57:02.574672 2026] [:error] [pid 3883:tid 3898] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/pouhg.php
[Thu Feb 26 18:57:02.786932 2026] [:error] [pid 3883:tid 3897] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/vgtyu.php
[Thu Feb 26 18:57:03.008303 2026] [:error] [pid 3883:tid 3899] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Thu Feb 26 18:57:03.228016 2026] [:error] [pid 3883:tid 3901] [client 4.204.200.32:25255] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Thu Feb 26 18:57:03.599566 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25255] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x123.php"] [unique_id "aaAm_-A33x90V6yYHahhBgAAAVg"]
[Thu Feb 26 18:57:05.170227 2026] [:error] [pid 25311:tid 25316] [client 4.204.200.32:25313] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x123.php"] [unique_id "aaAnAdfdM__yZAgJFSuZDAAAAYI"]
[Thu Feb 26 18:57:06.817042 2026] [:error] [pid 3883:tid 3897] [client 4.204.200.32:25226] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x123.php"] [unique_id "aaAnAuA33x90V6yYHahhKAAAAUs"]
[Thu Feb 26 18:57:09.222438 2026] [:error] [pid 55051:tid 55056] [client 4.204.200.32:25282] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x123.php"] [unique_id "aaAnBQmK1w2kZvh5eLFx-AAAAII"]
[Thu Feb 26 18:57:09.815487 2026] [:error] [pid 20419:tid 20431] [client 4.204.200.32:25240] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aaAnBe3DVDvMfTYYUBUm-gAAAck"]
[Thu Feb 26 18:57:11.169471 2026] [:error] [pid 25311:tid 25317] [client 4.204.200.32:25246] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aaAnB9fdM__yZAgJFSuZtgAAAYM"]
[Thu Feb 26 18:57:12.288049 2026] [:error] [pid 25311:tid 25314] [client 4.204.200.32:25243] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aaAnCNfdM__yZAgJFSuZxwAAAYA"]
[Thu Feb 26 18:57:13.396785 2026] [:error] [pid 20419:tid 20435] [client 4.204.200.32:25223] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aaAnCe3DVDvMfTYYUBUnCgAAAc0"]
[Thu Feb 26 18:57:14.101570 2026] [:error] [pid 55618:tid 55643] [client 4.204.200.32:25293] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moshou.php"] [unique_id "aaAnCh61Vrh12f_8oWTmhgAAARY"]
[Thu Feb 26 18:57:16.980586 2026] [:error] [pid 20419:tid 20435] [client 4.204.200.32:25272] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moshou.php"] [unique_id "aaAnDO3DVDvMfTYYUBUnMAAAAc0"]
[Thu Feb 26 18:57:19.411565 2026] [:error] [pid 54990:tid 55010] [client 4.204.200.32:25304] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moshou.php"] [unique_id "aaAnD3tr2qmt_mBhH2wSOgAAABE"]
[Thu Feb 26 18:57:20.251443 2026] [:error] [pid 44444:tid 44451] [client 4.204.200.32:25340] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/moshou.php"] [unique_id "aaAnEG2sMNmj-yekUk21mwAAAgE"]
[Thu Feb 26 18:57:21.572446 2026] [:error] [pid 54990:tid 55014] [client 4.204.200.32:25244] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seetox.php"] [unique_id "aaAnEXtr2qmt_mBhH2wSQQAAABU"]
[Thu Feb 26 18:57:22.635614 2026] [:error] [pid 55051:tid 55064] [client 4.204.200.32:25318] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seetox.php"] [unique_id "aaAnEgmK1w2kZvh5eLFysgAAAIo"]
[Thu Feb 26 18:57:24.337933 2026] [:error] [pid 44444:tid 44452] [client 4.204.200.32:25311] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seetox.php"] [unique_id "aaAnFG2sMNmj-yekUk21ugAAAgI"]
[Thu Feb 26 18:57:25.570243 2026] [:error] [pid 44444:tid 44468] [client 4.204.200.32:25239] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seetox.php"] [unique_id "aaAnFW2sMNmj-yekUk21wgAAAhI"]
[Thu Feb 26 18:57:26.382073 2026] [:error] [pid 20419:tid 20431] [client 4.204.200.32:25298] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dom.php"] [unique_id "aaAnFu3DVDvMfTYYUBUnnQAAAck"]
[Thu Feb 26 18:57:27.172744 2026] [:error] [pid 20419:tid 20431] [client 4.204.200.32:25230] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dom.php"] [unique_id "aaAnF-3DVDvMfTYYUBUnrwAAAck"]
[Thu Feb 26 18:57:27.970249 2026] [:error] [pid 25311:tid 25328] [client 4.204.200.32:25252] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dom.php"] [unique_id "aaAnF9fdM__yZAgJFSuabgAAAY4"]
[Thu Feb 26 18:57:28.513771 2026] [:error] [pid 55122:tid 55134] [client 4.204.200.32:25280] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dom.php"] [unique_id "aaAnGILiR0OfjFxvcN8R0QAAAMo"]
[Thu Feb 26 18:57:30.099333 2026] [:error] [pid 54990:tid 55000] [client 4.204.200.32:25296] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws60.php"] [unique_id "aaAnGntr2qmt_mBhH2wS0AAAAAc"]
[Thu Feb 26 18:57:30.734735 2026] [:error] [pid 25311:tid 25317] [client 4.204.200.32:25334] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws60.php"] [unique_id "aaAnGtfdM__yZAgJFSuaiQAAAYM"]
[Thu Feb 26 18:57:31.890941 2026] [:error] [pid 3883:tid 3891] [client 4.204.200.32:25330] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws60.php"] [unique_id "aaAnG-A33x90V6yYHahigQAAAUU"]
[Thu Feb 26 18:57:32.830537 2026] [:error] [pid 20419:tid 20425] [client 4.204.200.32:25310] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws60.php"] [unique_id "aaAnHO3DVDvMfTYYUBUoCQAAAcM"]
[Thu Feb 26 18:57:33.670949 2026] [:error] [pid 55618:tid 55634] [client 4.204.200.32:25235] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samiri.php"] [unique_id "aaAnHR61Vrh12f_8oWTnKAAAAQ0"]
[Thu Feb 26 18:57:34.259335 2026] [:error] [pid 25311:tid 25336] [client 4.204.200.32:25326] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samiri.php"] [unique_id "aaAnHtfdM__yZAgJFSuarwAAAZY"]
[Thu Feb 26 18:57:34.839904 2026] [:error] [pid 55051:tid 55073] [client 4.204.200.32:25337] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samiri.php"] [unique_id "aaAnHgmK1w2kZvh5eLFzQQAAAJM"]
[Thu Feb 26 18:57:35.532518 2026] [:error] [pid 44444:tid 44464] [client 4.204.200.32:25253] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samiri.php"] [unique_id "aaAnH22sMNmj-yekUk22CwAAAg4"]
[Thu Feb 26 18:57:36.136663 2026] [:error] [pid 55051:tid 55078] [client 4.204.200.32:25247] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins.php"] [unique_id "aaAnIAmK1w2kZvh5eLFzVgAAAJg"]
[Thu Feb 26 18:57:37.147736 2026] [:error] [pid 3883:tid 3893] [client 4.204.200.32:25342] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins.php"] [unique_id "aaAnIeA33x90V6yYHahirgAAAUc"]
[Thu Feb 26 18:57:37.763895 2026] [:error] [pid 44444:tid 44471] [client 4.204.200.32:25300] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins.php"] [unique_id "aaAnIW2sMNmj-yekUk22JgAAAhU"]
[Thu Feb 26 18:57:38.442676 2026] [:error] [pid 44444:tid 44464] [client 4.204.200.32:25216] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins.php"] [unique_id "aaAnIm2sMNmj-yekUk22NQAAAg4"]
[Thu Feb 26 18:57:39.257062 2026] [:error] [pid 25311:tid 25317] [client 4.204.200.32:25275] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xoot.php"] [unique_id "aaAnI9fdM__yZAgJFSua3gAAAYM"]
[Thu Feb 26 18:57:39.841446 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25321] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xoot.php"] [unique_id "aaAnI-A33x90V6yYHahixgAAAVg"]
[Thu Feb 26 18:57:40.616544 2026] [:error] [pid 20419:tid 20438] [client 4.204.200.32:25271] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xoot.php"] [unique_id "aaAnJO3DVDvMfTYYUBUogQAAAdA"]
[Thu Feb 26 18:57:41.135402 2026] [:error] [pid 3883:tid 3893] [client 4.204.200.32:25273] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xoot.php"] [unique_id "aaAnJeA33x90V6yYHahi1AAAAUc"]
[Thu Feb 26 18:57:41.845053 2026] [:error] [pid 55051:tid 55075] [client 4.204.200.32:24670] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X57.php"] [unique_id "aaAnJQmK1w2kZvh5eLFziQAAAJU"]
[Thu Feb 26 18:57:42.468710 2026] [:error] [pid 44444:tid 44470] [client 4.204.200.32:25292] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X57.php"] [unique_id "aaAnJm2sMNmj-yekUk22XwAAAhQ"]
[Thu Feb 26 18:57:43.139185 2026] [:error] [pid 20419:tid 20443] [client 4.204.200.32:25219] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X57.php"] [unique_id "aaAnJ-3DVDvMfTYYUBUooQAAAdU"]
[Thu Feb 26 18:57:44.118225 2026] [:error] [pid 44444:tid 44467] [client 4.204.200.32:24702] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/X57.php"] [unique_id "aaAnKG2sMNmj-yekUk22cwAAAhE"]
[Thu Feb 26 18:57:45.160940 2026] [:error] [pid 55618:tid 55621] [client 4.204.200.32:25283] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaAnKR61Vrh12f_8oWTnxgAAAQA"]
[Thu Feb 26 18:57:45.874932 2026] [:error] [pid 3883:tid 3890] [client 4.204.200.32:25245] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaAnKeA33x90V6yYHahjGwAAAUQ"]
[Thu Feb 26 18:57:46.438761 2026] [:error] [pid 3883:tid 3886] [client 4.204.200.32:24676] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaAnKuA33x90V6yYHahjIQAAAUA"]
[Thu Feb 26 18:57:47.033479 2026] [:error] [pid 44444:tid 44469] [client 4.204.200.32:24671] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaAnK22sMNmj-yekUk22ogAAAhM"]
[Thu Feb 26 18:57:47.808016 2026] [:error] [pid 44444:tid 44454] [client 4.204.200.32:25231] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file59.php"] [unique_id "aaAnK22sMNmj-yekUk22uwAAAgQ"]
[Thu Feb 26 18:57:48.418843 2026] [:error] [pid 25311:tid 25334] [client 4.204.200.32:25238] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file59.php"] [unique_id "aaAnLNfdM__yZAgJFSubagAAAZQ"]
[Thu Feb 26 18:57:48.986010 2026] [:error] [pid 25311:tid 25326] [client 4.204.200.32:25291] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file59.php"] [unique_id "aaAnLNfdM__yZAgJFSubfAAAAYw"]
[Thu Feb 26 18:57:49.701408 2026] [:error] [pid 54990:tid 55014] [client 4.204.200.32:24578] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file59.php"] [unique_id "aaAnLXtr2qmt_mBhH2wTdgAAABU"]
[Thu Feb 26 18:57:50.734332 2026] [:error] [pid 54991:tid 55026] [client 4.204.200.32:25317] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaAnLt4Zx-mJ8gbRB2jNtQAAAEY"]
[Thu Feb 26 18:57:51.501839 2026] [:error] [pid 54991:tid 55029] [client 4.204.200.32:25268] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaAnL94Zx-mJ8gbRB2jNyAAAAEk"]
[Thu Feb 26 18:57:52.517008 2026] [:error] [pid 25311:tid 25324] [client 4.204.200.32:25343] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaAnMNfdM__yZAgJFSubrgAAAYo"]
[Thu Feb 26 18:57:53.262170 2026] [:error] [pid 55051:tid 55068] [client 4.204.200.32:25323] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaAnMQmK1w2kZvh5eLF0AAAAAI4"]
[Thu Feb 26 18:57:53.997816 2026] [:error] [pid 55618:tid 55629] [client 4.204.200.32:25324] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shas.php"] [unique_id "aaAnMR61Vrh12f_8oWToMwAAAQg"]
[Thu Feb 26 18:57:54.754896 2026] [:error] [pid 20419:tid 20428] [client 4.204.200.32:25320] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shas.php"] [unique_id "aaAnMu3DVDvMfTYYUBUo5QAAAcY"]
[Thu Feb 26 18:57:55.495516 2026] [:error] [pid 3883:tid 3904] [client 4.204.200.32:25287] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shas.php"] [unique_id "aaAnM-A33x90V6yYHahjgQAAAVI"]
[Thu Feb 26 18:57:56.253656 2026] [:error] [pid 44444:tid 44468] [client 4.204.200.32:25289] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shas.php"] [unique_id "aaAnNG2sMNmj-yekUk23MQAAAhI"]
[Thu Feb 26 18:57:58.050571 2026] [:error] [pid 3883:tid 3900] [client 4.204.200.32:25249] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aaAnNuA33x90V6yYHahjqwAAAU4"]
[Thu Feb 26 18:57:58.829983 2026] [:error] [pid 55051:tid 55066] [client 4.204.200.32:24656] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aaAnNgmK1w2kZvh5eLF0NAAAAIw"]
[Thu Feb 26 18:57:59.466318 2026] [:error] [pid 54991:tid 55039] [client 4.204.200.32:25329] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aaAnN94Zx-mJ8gbRB2jN_gAAAFM"]
[Thu Feb 26 18:58:00.209014 2026] [:error] [pid 44444:tid 44472] [client 4.204.200.32:25261] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aaAnOG2sMNmj-yekUk23ZgAAAhY"]
[Thu Feb 26 18:58:00.831931 2026] [:error] [pid 44444:tid 44452] [client 4.204.200.32:25303] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xda.php"] [unique_id "aaAnOG2sMNmj-yekUk23bwAAAgI"]
[Thu Feb 26 18:58:01.600296 2026] [:error] [pid 44444:tid 44457] [client 4.204.200.32:25305] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xda.php"] [unique_id "aaAnOW2sMNmj-yekUk23gQAAAgc"]
[Thu Feb 26 18:58:02.299493 2026] [:error] [pid 54991:tid 55026] [client 4.204.200.32:25274] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xda.php"] [unique_id "aaAnOt4Zx-mJ8gbRB2jOFwAAAEY"]
[Thu Feb 26 18:58:03.609580 2026] [:error] [pid 3883:tid 3900] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Thu Feb 26 18:58:03.826163 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/er.php
[Thu Feb 26 18:58:04.042217 2026] [:error] [pid 3883:tid 3902] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/fault.php
[Thu Feb 26 18:58:04.261515 2026] [:error] [pid 3883:tid 3895] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Thu Feb 26 18:58:04.685822 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Feb 26 18:58:04.903359 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/leuk.php
[Thu Feb 26 18:58:05.122603 2026] [:error] [pid 3883:tid 3891] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Thu Feb 26 18:58:05.347328 2026] [:error] [pid 3883:tid 3901] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/kolda.php
[Thu Feb 26 18:58:05.574169 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Thu Feb 26 18:58:05.913324 2026] [:error] [pid 3883:tid 3890] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/god.php
[Thu Feb 26 18:58:06.127827 2026] [:error] [pid 3883:tid 3890] [client 4.204.200.32:25269] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Thu Feb 26 18:58:06.338468 2026] [:error] [pid 3883:tid 3898] [client 4.204.200.32:25269] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kj.php"] [unique_id "aaAnPuA33x90V6yYHahkUgAAAUw"]
[Thu Feb 26 18:58:07.141802 2026] [:error] [pid 44444:tid 44461] [client 4.204.200.32:24643] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kj.php"] [unique_id "aaAnP22sMNmj-yekUk24DwAAAgs"]
[Thu Feb 26 18:58:08.067262 2026] [:error] [pid 20419:tid 20426] [client 4.204.200.32:25260] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kj.php"] [unique_id "aaAnQO3DVDvMfTYYUBUpVQAAAcQ"]
[Thu Feb 26 18:58:10.032100 2026] [:error] [pid 54990:tid 55017] [client 4.204.200.32:25266] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kj.php"] [unique_id "aaAnQntr2qmt_mBhH2wUHwAAABg"]
[Thu Feb 26 18:58:11.083402 2026] [:error] [pid 54990:tid 54998] [client 4.204.200.32:24657] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/un.php"] [unique_id "aaAnQ3tr2qmt_mBhH2wUJAAAAAU"]
[Thu Feb 26 18:58:12.063135 2026] [:error] [pid 3883:tid 3898] [client 4.204.200.32:25276] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/un.php"] [unique_id "aaAnROA33x90V6yYHahk7AAAAUw"]
[Thu Feb 26 18:58:12.764769 2026] [:error] [pid 3883:tid 3904] [client 4.204.200.32:25335] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/un.php"] [unique_id "aaAnROA33x90V6yYHahlGwAAAVI"]
[Thu Feb 26 18:58:13.902871 2026] [:error] [pid 3883:tid 3906] [client 4.204.200.32:25228] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/un.php"] [unique_id "aaAnReA33x90V6yYHahlRwAAAVQ"]
[Thu Feb 26 18:58:14.807541 2026] [:error] [pid 44444:tid 44471] [client 4.204.200.32:25301] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aaAnRm2sMNmj-yekUk24lAAAAhU"]
[Thu Feb 26 18:58:16.150751 2026] [:error] [pid 55122:tid 55138] [client 4.204.200.32:24675] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aaAnSILiR0OfjFxvcN8TNgAAAM4"]
[Thu Feb 26 18:58:17.657983 2026] [:error] [pid 25311:tid 25337] [client 4.204.200.32:24648] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aaAnSdfdM__yZAgJFSucTgAAAZc"]
[Thu Feb 26 18:58:18.141966 2026] [:error] [pid 25311:tid 25318] [client 4.204.200.32:25314] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aaAnStfdM__yZAgJFSucYAAAAYQ"]
[Thu Feb 26 18:58:18.965059 2026] [:error] [pid 55051:tid 55072] [client 4.204.200.32:24661] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms.php"] [unique_id "aaAnSgmK1w2kZvh5eLF0wwAAAJI"]
[Thu Feb 26 18:58:19.855122 2026] [:error] [pid 55051:tid 55071] [client 4.204.200.32:25217] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms.php"] [unique_id "aaAnSwmK1w2kZvh5eLF0zwAAAJE"]
[Thu Feb 26 18:58:20.537206 2026] [:error] [pid 3883:tid 3907] [client 4.204.200.32:25327] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms.php"] [unique_id "aaAnTOA33x90V6yYHahlpAAAAVU"]
[Thu Feb 26 18:58:21.139294 2026] [:error] [pid 20419:tid 20435] [client 4.204.200.32:24667] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms.php"] [unique_id "aaAnTe3DVDvMfTYYUBUptwAAAc0"]
[Thu Feb 26 18:58:21.799317 2026] [:error] [pid 54990:tid 55002] [client 4.204.200.32:24606] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login8.php"] [unique_id "aaAnTXtr2qmt_mBhH2wUfgAAAAk"]
[Thu Feb 26 18:58:22.286521 2026] [:error] [pid 55618:tid 55640] [client 4.204.200.32:25322] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login8.php"] [unique_id "aaAnTh61Vrh12f_8oWTo1QAAARM"]
[Thu Feb 26 18:58:22.985809 2026] [:error] [pid 3883:tid 3890] [client 4.204.200.32:25237] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login8.php"] [unique_id "aaAnTuA33x90V6yYHahlwwAAAUQ"]
[Thu Feb 26 18:58:23.491841 2026] [:error] [pid 25311:tid 25326] [client 4.204.200.32:24672] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/login8.php"] [unique_id "aaAnT9fdM__yZAgJFSuclQAAAYw"]
[Thu Feb 26 18:58:24.118583 2026] [:error] [pid 3883:tid 3905] [client 4.204.200.32:24634] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nnyvn.php"] [unique_id "aaAnUOA33x90V6yYHahl3gAAAVM"]
[Thu Feb 26 18:58:25.198776 2026] [:error] [pid 44444:tid 44454] [client 4.204.200.32:25288] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nnyvn.php"] [unique_id "aaAnUW2sMNmj-yekUk25GQAAAgQ"]
[Thu Feb 26 18:58:26.081473 2026] [:error] [pid 25311:tid 25329] [client 4.204.200.32:24596] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nnyvn.php"] [unique_id "aaAnUtfdM__yZAgJFSucrgAAAY8"]
[Thu Feb 26 18:58:27.070469 2026] [:error] [pid 54990:tid 54998] [client 4.204.200.32:25332] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nnyvn.php"] [unique_id "aaAnU3tr2qmt_mBhH2wUlgAAAAU"]
[Thu Feb 26 18:58:27.928502 2026] [:error] [pid 3883:tid 3895] [client 4.204.200.32:24658] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "aaAnU-A33x90V6yYHahmVAAAAUk"]
[Thu Feb 26 18:58:28.518541 2026] [:error] [pid 3883:tid 3897] [client 4.204.200.32:25307] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "aaAnVOA33x90V6yYHahmagAAAUs"]
[Thu Feb 26 18:58:29.181753 2026] [:error] [pid 44444:tid 44474] [client 4.204.200.32:25281] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "aaAnVW2sMNmj-yekUk25MQAAAhg"]
[Thu Feb 26 18:58:30.626056 2026] [:error] [pid 55051:tid 55073] [client 4.204.200.32:25270] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "aaAnVgmK1w2kZvh5eLF1EgAAAJM"]
[Thu Feb 26 18:58:32.041290 2026] [:error] [pid 55122:tid 55128] [client 4.204.200.32:24691] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lul.php"] [unique_id "aaAnWILiR0OfjFxvcN8T7gAAAMQ"]
[Thu Feb 26 18:58:33.468240 2026] [:error] [pid 3883:tid 3894] [client 4.204.200.32:25234] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lul.php"] [unique_id "aaAnWeA33x90V6yYHahm8AAAAUg"]
[Thu Feb 26 18:58:34.891386 2026] [:error] [pid 44444:tid 44452] [client 4.204.200.32:24613] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lul.php"] [unique_id "aaAnWm2sMNmj-yekUk25TQAAAgI"]
[Thu Feb 26 18:58:35.828952 2026] [:error] [pid 55051:tid 55063] [client 4.204.200.32:25336] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lul.php"] [unique_id "aaAnWwmK1w2kZvh5eLF1dAAAAIk"]
[Thu Feb 26 18:58:36.528592 2026] [:error] [pid 55051:tid 55077] [client 4.204.200.32:24654] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaAnXAmK1w2kZvh5eLF1jAAAAJc"]
[Thu Feb 26 18:58:37.234423 2026] [:error] [pid 44444:tid 44473] [client 4.204.200.32:24647] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaAnXW2sMNmj-yekUk25aQAAAhc"]
[Thu Feb 26 18:58:38.309135 2026] [:error] [pid 55051:tid 55076] [client 4.204.200.32:25312] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaAnXgmK1w2kZvh5eLF1tgAAAJY"]
[Thu Feb 26 18:58:39.282270 2026] [:error] [pid 55618:tid 55626] [client 4.204.200.32:25295] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaAnXx61Vrh12f_8oWTpKQAAAQU"]
[Thu Feb 26 18:58:40.368508 2026] [:error] [pid 55618:tid 55634] [client 4.204.200.32:24599] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaAnYB61Vrh12f_8oWTpNQAAAQ0"]
[Thu Feb 26 18:58:40.892470 2026] [:error] [pid 44444:tid 44450] [client 4.204.200.32:25254] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaAnYG2sMNmj-yekUk25ngAAAgA"]
[Thu Feb 26 18:58:41.481807 2026] [:error] [pid 54991:tid 55028] [client 4.204.200.32:25286] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaAnYd4Zx-mJ8gbRB2jPEQAAAEg"]
[Thu Feb 26 18:58:42.430420 2026] [:error] [pid 3883:tid 3892] [client 4.204.200.32:25299] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaAnYuA33x90V6yYHahnZAAAAUY"]
[Thu Feb 26 18:58:43.031691 2026] [:error] [pid 55618:tid 55624] [client 4.204.200.32:25257] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ya.php"] [unique_id "aaAnYx61Vrh12f_8oWTpTgAAAQM"]
[Thu Feb 26 18:58:44.158137 2026] [:error] [pid 54991:tid 55023] [client 4.204.200.32:24664] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ya.php"] [unique_id "aaAnZN4Zx-mJ8gbRB2jPJQAAAEM"]
[Thu Feb 26 18:58:45.223014 2026] [:error] [pid 55618:tid 55631] [client 4.204.200.32:24585] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ya.php"] [unique_id "aaAnZR61Vrh12f_8oWTpYwAAAQo"]
[Thu Feb 26 18:58:46.053134 2026] [:error] [pid 55051:tid 55067] [client 4.204.200.32:25308] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ya.php"] [unique_id "aaAnZgmK1w2kZvh5eLF2PwAAAI0"]
[Thu Feb 26 18:58:47.284360 2026] [:error] [pid 3883:tid 3909] [client 4.204.200.32:25333] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaAnZ-A33x90V6yYHahnzQAAAVc"]
[Thu Feb 26 18:58:48.670641 2026] [:error] [pid 3883:tid 3890] [client 4.204.200.32:25221] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaAnaOA33x90V6yYHahn-AAAAUQ"]
[Thu Feb 26 18:58:49.753456 2026] [:error] [pid 55122:tid 55129] [client 4.204.200.32:24689] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaAnaYLiR0OfjFxvcN8UrQAAAMU"]
[Thu Feb 26 18:58:50.917134 2026] [:error] [pid 55618:tid 55639] [client 4.204.200.32:25222] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaAnah61Vrh12f_8oWTpngAAARI"]
[Thu Feb 26 18:58:51.541943 2026] [:error] [pid 54990:tid 55011] [client 4.204.200.32:24694] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaAna3tr2qmt_mBhH2wVRQAAABI"]
[Thu Feb 26 18:58:52.326488 2026] [:error] [pid 54990:tid 54997] [client 4.204.200.32:24660] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaAnbHtr2qmt_mBhH2wVSQAAAAQ"]
[Thu Feb 26 18:58:53.231730 2026] [:error] [pid 55122:tid 55126] [client 4.204.200.32:25242] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaAnbYLiR0OfjFxvcN8U0wAAAMI"]
[Thu Feb 26 18:58:54.531572 2026] [:error] [pid 55122:tid 55128] [client 4.204.200.32:24650] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaAnboLiR0OfjFxvcN8U3QAAAMQ"]
[Thu Feb 26 18:58:55.402808 2026] [:error] [pid 3883:tid 3902] [client 4.204.200.32:24678] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-access.php"] [unique_id "aaAnb-A33x90V6yYHahoWwAAAVA"]
[Thu Feb 26 18:58:56.620972 2026] [:error] [pid 44444:tid 44473] [client 4.204.200.32:25284] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-access.php"] [unique_id "aaAncG2sMNmj-yekUk26JwAAAhc"]
[Thu Feb 26 18:58:57.481448 2026] [:error] [pid 54991:tid 55043] [client 4.204.200.32:25263] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-access.php"] [unique_id "aaAncd4Zx-mJ8gbRB2jPmQAAAFc"]
[Thu Feb 26 18:58:58.247915 2026] [:error] [pid 54990:tid 55014] [client 4.204.200.32:25315] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-access.php"] [unique_id "aaAncntr2qmt_mBhH2wVewAAABU"]
[Thu Feb 26 18:58:58.909860 2026] [:error] [pid 20419:tid 20435] [client 4.204.200.32:24665] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1vx.php"] [unique_id "aaAncu3DVDvMfTYYUBUq9AAAAc0"]
[Thu Feb 26 18:58:59.530677 2026] [:error] [pid 44444:tid 44473] [client 4.204.200.32:25248] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1vx.php"] [unique_id "aaAnc22sMNmj-yekUk26YwAAAhc"]
[Thu Feb 26 18:59:00.335844 2026] [:error] [pid 3883:tid 3910] [client 4.204.200.32:25256] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1vx.php"] [unique_id "aaAndOA33x90V6yYHaholgAAAVg"]
[Thu Feb 26 18:59:00.857944 2026] [:error] [pid 54990:tid 54996] [client 4.204.200.32:24652] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1vx.php"] [unique_id "aaAndHtr2qmt_mBhH2wVjAAAAAM"]
[Thu Feb 26 18:59:01.575791 2026] [:error] [pid 44444:tid 44456] [client 4.204.200.32:24690] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aaAndW2sMNmj-yekUk26fQAAAgY"]
[Thu Feb 26 18:59:02.262814 2026] [:error] [pid 44444:tid 44461] [client 4.204.200.32:25233] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aaAndm2sMNmj-yekUk26gQAAAgs"]
[Thu Feb 26 18:59:03.007948 2026] [:error] [pid 44444:tid 44460] [client 4.204.200.32:24685] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aaAnd22sMNmj-yekUk26hgAAAgo"]
[Thu Feb 26 18:59:03.651227 2026] [:error] [pid 54990:tid 55009] [client 4.204.200.32:24579] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aaAnd3tr2qmt_mBhH2wVrQAAABA"]
[Thu Feb 26 18:59:04.513663 2026] [:error] [pid 54990:tid 55007] [client 4.204.200.32:24693] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aaAneHtr2qmt_mBhH2wVwwAAAA4"]
[Thu Feb 26 18:59:05.275415 2026] [:error] [pid 55051:tid 55071] [client 4.204.200.32:25316] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aaAneQmK1w2kZvh5eLF2zQAAAJE"]
[Thu Feb 26 18:59:05.939902 2026] [:error] [pid 44444:tid 44472] [client 4.204.200.32:25338] [client 4.204.200.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aaAneW2sMNmj-yekUk26qAAAAhY"]
[Thu Feb 26 18:59:06.859033 2026] [:error] [pid 44444:tid 44464] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Feb 26 18:59:07.080703 2026] [:error] [pid 44444:tid 44466] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Thu Feb 26 18:59:07.376313 2026] [:error] [pid 44444:tid 44472] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Thu Feb 26 18:59:07.593602 2026] [:error] [pid 44444:tid 44461] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/fot.php
[Thu Feb 26 18:59:07.810059 2026] [:error] [pid 44444:tid 44464] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Thu Feb 26 18:59:08.019265 2026] [:error] [pid 44444:tid 44463] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Thu Feb 26 18:59:08.239414 2026] [:error] [pid 44444:tid 44452] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Thu Feb 26 18:59:08.452263 2026] [:error] [pid 44444:tid 44451] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/dev1s.php
[Thu Feb 26 18:59:08.665935 2026] [:error] [pid 44444:tid 44454] [client 4.204.200.32:25306] File does not exist: /usr/local/apache/htdocs/suspended-page/ffd.php
[Thu Feb 26 19:58:33.837077 2026] [:error] [pid 54990:tid 54998] [client 43.173.1.57:54514] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaA1aXtr2qmt_mBhH2wgjgAAAAU"]
[Thu Feb 26 21:37:06.986690 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:65465] File does not exist: /usr/local/apache/htdocs/suspended-page/mega.php
[Thu Feb 26 21:37:07.198726 2026] [:error] [pid 44444:tid 44464] [client 4.204.195.211:65465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Feb 26 21:37:07.413529 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:65465] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Thu Feb 26 21:37:07.648270 2026] [:error] [pid 44444:tid 44467] [client 4.204.195.211:65465] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Thu Feb 26 21:37:07.875252 2026] [:error] [pid 44444:tid 44463] [client 4.204.195.211:65465] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Thu Feb 26 21:37:08.943871 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:65465] File does not exist: /usr/local/apache/htdocs/suspended-page/samfa.php
[Thu Feb 26 21:37:09.153545 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:65465] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaBMhW2sMNmj-yekUk0sEAAAAhQ"]
[Thu Feb 26 21:37:09.590433 2026] [:error] [pid 3883:tid 3896] [client 4.204.195.211:65507] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaBMheA33x90V6yYHajuAAAAAUo"]
[Thu Feb 26 21:37:10.014859 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:64872] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaBMhu3DVDvMfTYYUBVaXgAAAc0"]
[Thu Feb 26 21:37:10.424956 2026] [:error] [pid 25311:tid 25320] [client 4.204.195.211:65472] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aaBMhtfdM__yZAgJFSvklQAAAYY"]
[Thu Feb 26 21:37:10.838705 2026] [:error] [pid 3883:tid 3898] [client 4.204.195.211:63375] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBMhuA33x90V6yYHajuBAAAAUw"]
[Thu Feb 26 21:37:11.256153 2026] [:error] [pid 54990:tid 55010] [client 4.204.195.211:63426] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBMh3tr2qmt_mBhH2wqwAAAABE"]
[Thu Feb 26 21:37:11.670708 2026] [:error] [pid 3883:tid 3897] [client 4.204.195.211:64890] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBMh-A33x90V6yYHajuBQAAAUs"]
[Thu Feb 26 21:37:12.087474 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:65469] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBMiG2sMNmj-yekUk0sFAAAAhg"]
[Thu Feb 26 21:37:12.499890 2026] [:error] [pid 20419:tid 20441] [client 4.204.195.211:65411] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaBMiO3DVDvMfTYYUBVaaAAAAdM"]
[Thu Feb 26 21:37:12.938057 2026] [:error] [pid 3883:tid 3900] [client 4.204.195.211:65491] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaBMiOA33x90V6yYHajuBwAAAU4"]
[Thu Feb 26 21:37:13.351915 2026] [:error] [pid 3883:tid 3901] [client 4.204.195.211:64808] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaBMieA33x90V6yYHajuCQAAAU8"]
[Thu Feb 26 21:37:13.772553 2026] [:error] [pid 54991:tid 55026] [client 4.204.195.211:64871] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaBMid4Zx-mJ8gbRB2js2gAAAEY"]
[Thu Feb 26 21:37:14.184767 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:64839] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaBMim2sMNmj-yekUk0sHQAAAhI"]
[Thu Feb 26 21:37:14.611166 2026] [:error] [pid 3883:tid 3891] [client 4.204.195.211:63458] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaBMiuA33x90V6yYHajuDAAAAUU"]
[Thu Feb 26 21:37:15.022697 2026] [:error] [pid 55051:tid 55064] [client 4.204.195.211:63480] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaBMiwmK1w2kZvh5eLG2gAAAAIo"]
[Thu Feb 26 21:37:15.436903 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:63366] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaBMi22sMNmj-yekUk0sIwAAAhg"]
[Thu Feb 26 21:37:15.850140 2026] [:error] [pid 3883:tid 3899] [client 4.204.195.211:64886] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez/index.php"] [unique_id "aaBMi-A33x90V6yYHajuDwAAAU0"]
[Thu Feb 26 21:37:16.262790 2026] [:error] [pid 25311:tid 25331] [client 4.204.195.211:63433] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez/index.php"] [unique_id "aaBMjNfdM__yZAgJFSvklwAAAZE"]
[Thu Feb 26 21:37:16.672560 2026] [:error] [pid 20419:tid 20422] [client 4.204.195.211:64831] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez/index.php"] [unique_id "aaBMjO3DVDvMfTYYUBVabgAAAcA"]
[Thu Feb 26 21:37:17.089730 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:63459] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/templates/beez/index.php"] [unique_id "aaBMjW2sMNmj-yekUk0sJgAAAhU"]
[Thu Feb 26 21:37:17.500894 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:62809] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aaBMjW2sMNmj-yekUk0sKAAAAgg"]
[Thu Feb 26 21:37:17.912948 2026] [:error] [pid 20419:tid 20423] [client 4.204.195.211:65420] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aaBMje3DVDvMfTYYUBVacAAAAcE"]
[Thu Feb 26 21:37:18.327625 2026] [:error] [pid 3883:tid 3889] [client 4.204.195.211:65453] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aaBMjuA33x90V6yYHajuEQAAAUM"]
[Thu Feb 26 21:37:18.741145 2026] [:error] [pid 44444:tid 44466] [client 4.204.195.211:64861] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "aaBMjm2sMNmj-yekUk0sLQAAAhA"]
[Thu Feb 26 21:37:19.160295 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:64783] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system.php"] [unique_id "aaBMj22sMNmj-yekUk0sLwAAAhg"]
[Thu Feb 26 21:37:19.574773 2026] [:error] [pid 20419:tid 20428] [client 4.204.195.211:63425] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system.php"] [unique_id "aaBMj-3DVDvMfTYYUBVacQAAAcY"]
[Thu Feb 26 21:37:20.014178 2026] [:error] [pid 55051:tid 55068] [client 4.204.195.211:63446] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system.php"] [unique_id "aaBMkAmK1w2kZvh5eLG2iQAAAI4"]
[Thu Feb 26 21:37:20.438756 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:65473] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system.php"] [unique_id "aaBMkG2sMNmj-yekUk0sNAAAAgc"]
[Thu Feb 26 21:37:20.852685 2026] [:error] [pid 54991:tid 55038] [client 4.204.195.211:64822] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aaBMkN4Zx-mJ8gbRB2js4QAAAFI"]
[Thu Feb 26 21:37:21.286792 2026] [:error] [pid 54991:tid 55036] [client 4.204.195.211:63384] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aaBMkd4Zx-mJ8gbRB2js4gAAAFA"]
[Thu Feb 26 21:37:21.702296 2026] [:error] [pid 54991:tid 55024] [client 4.204.195.211:64841] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aaBMkd4Zx-mJ8gbRB2js4wAAAEQ"]
[Thu Feb 26 21:37:22.129746 2026] [:error] [pid 54991:tid 55025] [client 4.204.195.211:62158] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aaBMkt4Zx-mJ8gbRB2js5gAAAEU"]
[Thu Feb 26 21:37:22.545454 2026] [:error] [pid 25311:tid 25328] [client 4.204.195.211:64857] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBMktfdM__yZAgJFSvkmgAAAY4"]
[Thu Feb 26 21:37:22.994704 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:64798] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBMkm2sMNmj-yekUk0sQQAAAhM"]
[Thu Feb 26 21:37:23.423004 2026] [:error] [pid 44444:tid 44467] [client 4.204.195.211:64850] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBMk22sMNmj-yekUk0sRgAAAhE"]
[Thu Feb 26 21:37:23.855528 2026] [:error] [pid 54991:tid 55043] [client 4.204.195.211:64780] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBMk94Zx-mJ8gbRB2js5wAAAFc"]
[Thu Feb 26 21:37:24.275200 2026] [:error] [pid 54991:tid 55040] [client 4.204.195.211:62182] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaBMlN4Zx-mJ8gbRB2js6wAAAFQ"]
[Thu Feb 26 21:37:24.692790 2026] [:error] [pid 20419:tid 20422] [client 4.204.195.211:64785] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaBMlO3DVDvMfTYYUBVadwAAAcA"]
[Thu Feb 26 21:37:25.164594 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:65439] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaBMlW2sMNmj-yekUk0sTAAAAgg"]
[Thu Feb 26 21:37:25.580246 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:65415] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aaBMlW2sMNmj-yekUk0sUAAAAhQ"]
[Thu Feb 26 21:37:26.010876 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:65416] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/pe9rsn.php"] [unique_id "aaBMlt4Zx-mJ8gbRB2js7AAAAEs"]
[Thu Feb 26 21:37:26.423871 2026] [:error] [pid 44444:tid 44462] [client 4.204.195.211:63452] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/pe9rsn.php"] [unique_id "aaBMlm2sMNmj-yekUk0sWQAAAgw"]
[Thu Feb 26 21:37:26.854487 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:65490] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/pe9rsn.php"] [unique_id "aaBMlm2sMNmj-yekUk0sXgAAAhI"]
[Thu Feb 26 21:37:27.276755 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:64775] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/pe9rsn.php"] [unique_id "aaBMl22sMNmj-yekUk0sYgAAAhM"]
[Thu Feb 26 21:37:27.697540 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:62741] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBMl22sMNmj-yekUk0sawAAAhY"]
[Thu Feb 26 21:37:28.110533 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:64774] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBMmG2sMNmj-yekUk0sbwAAAgg"]
[Thu Feb 26 21:37:28.526896 2026] [:error] [pid 44444:tid 44463] [client 4.204.195.211:63424] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBMmG2sMNmj-yekUk0sdQAAAg0"]
[Thu Feb 26 21:37:28.937934 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:63441] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBMmG2sMNmj-yekUk0sewAAAgg"]
[Thu Feb 26 21:37:29.396457 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:63454] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaBMmW2sMNmj-yekUk0sgwAAAhM"]
[Thu Feb 26 21:37:29.831426 2026] [:error] [pid 54991:tid 55022] [client 4.204.195.211:63468] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaBMmd4Zx-mJ8gbRB2js7wAAAEI"]
[Thu Feb 26 21:37:30.246980 2026] [:error] [pid 25311:tid 25326] [client 4.204.195.211:63467] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaBMmtfdM__yZAgJFSvkoAAAAYw"]
[Thu Feb 26 21:37:30.676442 2026] [:error] [pid 20419:tid 20444] [client 4.204.195.211:65418] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aaBMmu3DVDvMfTYYUBVafAAAAdY"]
[Thu Feb 26 21:37:31.094729 2026] [:error] [pid 55122:tid 55135] [client 4.204.195.211:63363] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/boots.php"] [unique_id "aaBMm4LiR0OfjFxvcN8xYQAAAMs"]
[Thu Feb 26 21:37:31.588806 2026] [:error] [pid 54990:tid 55003] [client 4.204.195.211:64894] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/boots.php"] [unique_id "aaBMm3tr2qmt_mBhH2wqxQAAAAo"]
[Thu Feb 26 21:37:31.999703 2026] [:error] [pid 55051:tid 55069] [client 4.204.195.211:64779] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/boots.php"] [unique_id "aaBMmwmK1w2kZvh5eLG2mQAAAI8"]
[Thu Feb 26 21:37:32.457244 2026] [:error] [pid 55618:tid 55626] [client 4.204.195.211:64794] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/boots.php"] [unique_id "aaBMnB61Vrh12f_8oWQOogAAAQU"]
[Thu Feb 26 21:37:32.875224 2026] [:error] [pid 54990:tid 55007] [client 4.204.195.211:62115] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logi.php"] [unique_id "aaBMnHtr2qmt_mBhH2wqxwAAAA4"]
[Thu Feb 26 21:37:33.312940 2026] [:error] [pid 3883:tid 3893] [client 4.204.195.211:63445] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logi.php"] [unique_id "aaBMneA33x90V6yYHajuGgAAAUc"]
[Thu Feb 26 21:37:33.727727 2026] [:error] [pid 3883:tid 3910] [client 4.204.195.211:64854] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logi.php"] [unique_id "aaBMneA33x90V6yYHajuHAAAAVg"]
[Thu Feb 26 21:37:34.144623 2026] [:error] [pid 3883:tid 3901] [client 4.204.195.211:63364] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logi.php"] [unique_id "aaBMnuA33x90V6yYHajuHgAAAU8"]
[Thu Feb 26 21:37:34.679432 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:64892] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaBMngmK1w2kZvh5eLG2ogAAAIU"]
[Thu Feb 26 21:37:35.091124 2026] [:error] [pid 55051:tid 55075] [client 4.204.195.211:65459] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaBMnwmK1w2kZvh5eLG2pAAAAJU"]
[Thu Feb 26 21:37:35.536294 2026] [:error] [pid 3883:tid 3891] [client 4.204.195.211:63360] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaBMn-A33x90V6yYHajuIAAAAUU"]
[Thu Feb 26 21:37:35.956003 2026] [:error] [pid 25311:tid 25334] [client 4.204.195.211:63477] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaBMn9fdM__yZAgJFSvkpAAAAZQ"]
[Thu Feb 26 21:37:36.384649 2026] [:error] [pid 25311:tid 25314] [client 4.204.195.211:63463] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaBMoNfdM__yZAgJFSvkqAAAAYA"]
[Thu Feb 26 21:37:36.846868 2026] [:error] [pid 20419:tid 20423] [client 4.204.195.211:63475] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaBMoO3DVDvMfTYYUBVajQAAAcE"]
[Thu Feb 26 21:37:37.264703 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:65441] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaBMoe3DVDvMfTYYUBVajgAAAc0"]
[Thu Feb 26 21:37:37.701431 2026] [:error] [pid 3883:tid 3889] [client 4.204.195.211:63430] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaBMoeA33x90V6yYHajuJwAAAUM"]
[Thu Feb 26 21:37:38.130984 2026] [:error] [pid 54991:tid 55029] [client 4.204.195.211:65442] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaBMot4Zx-mJ8gbRB2js-gAAAEk"]
[Thu Feb 26 21:37:38.552596 2026] [:error] [pid 3883:tid 3896] [client 4.204.195.211:63367] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaBMouA33x90V6yYHajuKQAAAUo"]
[Thu Feb 26 21:37:38.974935 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:65425] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaBMogmK1w2kZvh5eLG2sAAAAIQ"]
[Thu Feb 26 21:37:39.408959 2026] [:error] [pid 54990:tid 54996] [client 4.204.195.211:64856] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aaBMo3tr2qmt_mBhH2wqzAAAAAM"]
[Thu Feb 26 21:37:40.018685 2026] [:error] [pid 3883:tid 3886] [client 4.204.195.211:63447] [client 4.204.195.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaBMpOA33x90V6yYHajuLQAAAUA"]
[Thu Feb 26 21:37:40.454065 2026] [:error] [pid 54991:tid 55041] [client 4.204.195.211:64827] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBMpN4Zx-mJ8gbRB2js_gAAAFU"]
[Thu Feb 26 21:37:40.879665 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:64811] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBMpAmK1w2kZvh5eLG2tAAAAJg"]
[Thu Feb 26 21:37:41.307063 2026] [:error] [pid 55051:tid 55068] [client 4.204.195.211:65471] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBMpQmK1w2kZvh5eLG2tgAAAI4"]
[Thu Feb 26 21:37:41.737704 2026] [:error] [pid 54991:tid 55027] [client 4.204.195.211:65456] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBMpd4Zx-mJ8gbRB2jtAAAAAEc"]
[Thu Feb 26 21:37:42.153663 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:63368] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-monamon.php"] [unique_id "aaBMpm2sMNmj-yekUk0sjAAAAgU"]
[Thu Feb 26 21:37:42.566125 2026] [:error] [pid 54991:tid 55030] [client 4.204.195.211:62174] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-monamon.php"] [unique_id "aaBMpt4Zx-mJ8gbRB2jtAgAAAEo"]
[Thu Feb 26 21:37:42.991231 2026] [:error] [pid 20419:tid 20426] [client 4.204.195.211:64797] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-monamon.php"] [unique_id "aaBMpu3DVDvMfTYYUBVakQAAAcQ"]
[Thu Feb 26 21:37:43.409925 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:63369] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-monamon.php"] [unique_id "aaBMpwmK1w2kZvh5eLG2vwAAAJA"]
[Thu Feb 26 21:37:43.825942 2026] [:error] [pid 55051:tid 55063] [client 4.204.195.211:62164] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aaBMpwmK1w2kZvh5eLG2wQAAAIk"]
[Thu Feb 26 21:37:44.297532 2026] [:error] [pid 55122:tid 55128] [client 4.204.195.211:64888] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aaBMqILiR0OfjFxvcN8xaAAAAMQ"]
[Thu Feb 26 21:37:44.711217 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:65460] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aaBMqAmK1w2kZvh5eLG2xQAAAIw"]
[Thu Feb 26 21:37:45.188642 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:63373] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/assets/"] [unique_id "aaBMqW2sMNmj-yekUk0skAAAAhM"]
[Thu Feb 26 21:37:45.603175 2026] [:error] [pid 54991:tid 55025] [client 4.204.195.211:63417] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/"] [unique_id "aaBMqd4Zx-mJ8gbRB2jtBgAAAEU"]
[Thu Feb 26 21:37:46.025811 2026] [:error] [pid 55051:tid 55061] [client 4.204.195.211:64859] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/"] [unique_id "aaBMqgmK1w2kZvh5eLG2ygAAAIc"]
[Thu Feb 26 21:37:46.438147 2026] [:error] [pid 55051:tid 55072] [client 4.204.195.211:63436] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/"] [unique_id "aaBMqgmK1w2kZvh5eLG2zQAAAJI"]
[Thu Feb 26 21:37:46.855457 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:64881] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/"] [unique_id "aaBMqm2sMNmj-yekUk0slQAAAgo"]
[Thu Feb 26 21:37:47.334262 2026] [:error] [pid 20419:tid 20440] [client 4.204.195.211:64870] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBMq-3DVDvMfTYYUBValgAAAdI"]
[Thu Feb 26 21:37:47.746429 2026] [:error] [pid 55051:tid 55063] [client 4.204.195.211:65477] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBMqwmK1w2kZvh5eLG20AAAAIk"]
[Thu Feb 26 21:37:48.293827 2026] [:error] [pid 20419:tid 20434] [client 4.204.195.211:65464] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBMrO3DVDvMfTYYUBVamgAAAcw"]
[Thu Feb 26 21:37:48.711002 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:65500] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBMrG2sMNmj-yekUk0smgAAAg8"]
[Thu Feb 26 21:37:49.140989 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:65521] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaBMrW2sMNmj-yekUk0snQAAAgU"]
[Thu Feb 26 21:37:49.553723 2026] [:error] [pid 55051:tid 55061] [client 4.204.195.211:62790] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaBMrQmK1w2kZvh5eLG22QAAAIc"]
[Thu Feb 26 21:37:49.966220 2026] [:error] [pid 20419:tid 20439] [client 4.204.195.211:65436] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaBMre3DVDvMfTYYUBVangAAAdE"]
[Thu Feb 26 21:37:50.403667 2026] [:error] [pid 25311:tid 25329] [client 4.204.195.211:64876] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaBMrtfdM__yZAgJFSvkrgAAAY8"]
[Thu Feb 26 21:37:50.817257 2026] [:error] [pid 3883:tid 3890] [client 4.204.195.211:62757] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBMruA33x90V6yYHajuOAAAAUQ"]
[Thu Feb 26 21:37:51.233635 2026] [:error] [pid 55051:tid 55054] [client 4.204.195.211:63457] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBMrwmK1w2kZvh5eLG22wAAAIA"]
[Thu Feb 26 21:37:51.658733 2026] [:error] [pid 3883:tid 3889] [client 4.204.195.211:65409] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBMr-A33x90V6yYHajuOgAAAUM"]
[Thu Feb 26 21:37:52.079904 2026] [:error] [pid 20419:tid 20438] [client 4.204.195.211:65435] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBMsO3DVDvMfTYYUBVaoAAAAdA"]
[Thu Feb 26 21:37:52.583782 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:64818] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aaBMsO3DVDvMfTYYUBVaoQAAAc0"]
[Thu Feb 26 21:37:53.005844 2026] [:error] [pid 54991:tid 55042] [client 4.204.195.211:65463] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aaBMsd4Zx-mJ8gbRB2jtIAAAAFY"]
[Thu Feb 26 21:37:53.453452 2026] [:error] [pid 54991:tid 55043] [client 4.204.195.211:63361] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aaBMsd4Zx-mJ8gbRB2jtIwAAAFc"]
[Thu Feb 26 21:37:53.874883 2026] [:error] [pid 54991:tid 55026] [client 4.204.195.211:62823] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/log.php"] [unique_id "aaBMsd4Zx-mJ8gbRB2jtJwAAAEY"]
[Thu Feb 26 21:37:54.294709 2026] [:error] [pid 54991:tid 55022] [client 4.204.195.211:63415] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aaBMst4Zx-mJ8gbRB2jtKQAAAEI"]
[Thu Feb 26 21:37:54.755484 2026] [:error] [pid 54991:tid 55030] [client 4.204.195.211:63483] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aaBMst4Zx-mJ8gbRB2jtLQAAAEo"]
[Thu Feb 26 21:37:55.171569 2026] [:error] [pid 54991:tid 55025] [client 4.204.195.211:64846] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aaBMs94Zx-mJ8gbRB2jtMAAAAEU"]
[Thu Feb 26 21:37:55.581881 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:63460] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zsec.php"] [unique_id "aaBMswmK1w2kZvh5eLG23gAAAIM"]
[Thu Feb 26 21:37:56.002349 2026] [:error] [pid 20419:tid 20445] [client 4.204.195.211:63415] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaBMtO3DVDvMfTYYUBVaowAAAdc"]
[Thu Feb 26 21:37:56.450538 2026] [:error] [pid 54990:tid 55008] [client 4.204.195.211:64874] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaBMtHtr2qmt_mBhH2wq4gAAAA8"]
[Thu Feb 26 21:37:56.871035 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:63427] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaBMtAmK1w2kZvh5eLG24gAAAIU"]
[Thu Feb 26 21:37:57.290667 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:64778] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aaBMtW2sMNmj-yekUk0ssAAAAhQ"]
[Thu Feb 26 21:37:57.768449 2026] [:error] [pid 55051:tid 55069] [client 4.204.195.211:63485] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cong.php"] [unique_id "aaBMtQmK1w2kZvh5eLG24wAAAI8"]
[Thu Feb 26 21:37:58.180445 2026] [:error] [pid 44444:tid 44467] [client 4.204.195.211:63433] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cong.php"] [unique_id "aaBMtm2sMNmj-yekUk0stgAAAhE"]
[Thu Feb 26 21:37:58.613415 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:62160] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cong.php"] [unique_id "aaBMtt4Zx-mJ8gbRB2jtNQAAAEs"]
[Thu Feb 26 21:37:59.066926 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:62165] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cong.php"] [unique_id "aaBMt22sMNmj-yekUk0suwAAAhg"]
[Thu Feb 26 21:37:59.479700 2026] [:error] [pid 55122:tid 55133] [client 4.204.195.211:64842] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaBMt4LiR0OfjFxvcN8xagAAAMk"]
[Thu Feb 26 21:37:59.942452 2026] [:error] [pid 55051:tid 55060] [client 4.204.195.211:64816] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaBMtwmK1w2kZvh5eLG25wAAAIY"]
[Thu Feb 26 21:38:00.368045 2026] [:error] [pid 55618:tid 55637] [client 4.204.195.211:62148] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaBMuB61Vrh12f_8oWQOrwAAARA"]
[Thu Feb 26 21:38:00.854508 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:64895] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaBMuAmK1w2kZvh5eLG26gAAAIw"]
[Thu Feb 26 21:38:01.347387 2026] [:error] [pid 55051:tid 55077] [client 4.204.195.211:63407] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.wp/wso.php"] [unique_id "aaBMuQmK1w2kZvh5eLG26wAAAJc"]
[Thu Feb 26 21:38:01.782731 2026] [:error] [pid 55618:tid 55641] [client 4.204.195.211:64834] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.wp/wso.php"] [unique_id "aaBMuR61Vrh12f_8oWQOsQAAARQ"]
[Thu Feb 26 21:38:02.229558 2026] [:error] [pid 55051:tid 55072] [client 4.204.195.211:63482] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.wp/wso.php"] [unique_id "aaBMugmK1w2kZvh5eLG28QAAAJI"]
[Thu Feb 26 21:38:02.655560 2026] [:error] [pid 3883:tid 3897] [client 4.204.195.211:65451] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.wp/wso.php"] [unique_id "aaBMuuA33x90V6yYHajuQAAAAUs"]
[Thu Feb 26 21:38:03.113498 2026] [:error] [pid 3883:tid 3891] [client 4.204.195.211:65427] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaBMu-A33x90V6yYHajuQgAAAUU"]
[Thu Feb 26 21:38:03.545224 2026] [:error] [pid 55051:tid 55062] [client 4.204.195.211:63456] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaBMuwmK1w2kZvh5eLG29AAAAIg"]
[Thu Feb 26 21:38:03.984875 2026] [:error] [pid 55122:tid 55126] [client 4.204.195.211:64825] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaBMu4LiR0OfjFxvcN8xbgAAAMI"]
[Thu Feb 26 21:38:04.605801 2026] [:error] [pid 55618:tid 55624] [client 4.204.195.211:62171] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaBMvB61Vrh12f_8oWQOswAAAQM"]
[Thu Feb 26 21:38:05.024643 2026] [:error] [pid 55618:tid 55638] [client 4.204.195.211:65512] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aaBMvR61Vrh12f_8oWQOtAAAARE"]
[Thu Feb 26 21:38:05.576339 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:65428] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aaBMvW2sMNmj-yekUk0svwAAAhM"]
[Thu Feb 26 21:38:06.078618 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:63432] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aaBMvm2sMNmj-yekUk0swQAAAgU"]
[Thu Feb 26 21:38:06.525881 2026] [:error] [pid 55051:tid 55071] [client 4.204.195.211:65432] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aaBMvgmK1w2kZvh5eLG29gAAAJE"]
[Thu Feb 26 21:38:06.943841 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:64807] [client 4.204.195.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaBMvgmK1w2kZvh5eLG29wAAAIQ"]
[Thu Feb 26 21:38:07.634705 2026] [:error] [pid 20419:tid 20439] [client 4.204.195.211:64836] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "aaBMv-3DVDvMfTYYUBVarwAAAdE"]
[Thu Feb 26 21:38:08.092251 2026] [:error] [pid 25311:tid 25314] [client 4.204.195.211:63438] File does not exist: /usr/local/apache/htdocs/suspended-page/d2.php
[Thu Feb 26 21:38:09.522600 2026] [:error] [pid 25311:tid 25321] [client 4.204.195.211:63438] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Thu Feb 26 21:38:09.734214 2026] [:error] [pid 25311:tid 25333] [client 4.204.195.211:63438] File does not exist: /usr/local/apache/htdocs/suspended-page/admin1.php
[Thu Feb 26 21:38:10.735627 2026] [:error] [pid 25311:tid 25324] [client 4.204.195.211:63438] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/start.php"] [unique_id "aaBMwtfdM__yZAgJFSvkwgAAAYo"]
[Thu Feb 26 21:38:11.169770 2026] [:error] [pid 44444:tid 44462] [client 4.204.195.211:64800] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/start.php"] [unique_id "aaBMw22sMNmj-yekUk0szQAAAgw"]
[Thu Feb 26 21:38:11.635793 2026] [:error] [pid 20419:tid 20427] [client 4.204.195.211:63386] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/start.php"] [unique_id "aaBMw-3DVDvMfTYYUBVatgAAAcU"]
[Thu Feb 26 21:38:12.062448 2026] [:error] [pid 25311:tid 25335] [client 4.204.195.211:64814] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/start.php"] [unique_id "aaBMxNfdM__yZAgJFSvkwwAAAZU"]
[Thu Feb 26 21:38:12.516652 2026] [:error] [pid 55051:tid 55074] [client 4.204.195.211:63419] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/xaw.php"] [unique_id "aaBMxAmK1w2kZvh5eLG2-QAAAJQ"]
[Thu Feb 26 21:38:12.948436 2026] [:error] [pid 55122:tid 55127] [client 4.204.195.211:65445] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/xaw.php"] [unique_id "aaBMxILiR0OfjFxvcN8xdQAAAMM"]
[Thu Feb 26 21:38:13.373705 2026] [:error] [pid 3883:tid 3889] [client 4.204.195.211:64805] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/xaw.php"] [unique_id "aaBMxeA33x90V6yYHajuRwAAAUM"]
[Thu Feb 26 21:38:13.795746 2026] [:error] [pid 44444:tid 44467] [client 4.204.195.211:65440] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/xaw.php"] [unique_id "aaBMxW2sMNmj-yekUk0s0QAAAhE"]
[Thu Feb 26 21:38:14.211052 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:64796] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaBMxm2sMNmj-yekUk0s0gAAAhY"]
[Thu Feb 26 21:38:14.664601 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:64828] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaBMxgmK1w2kZvh5eLG2_AAAAJg"]
[Thu Feb 26 21:38:15.084579 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:64799] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaBMx22sMNmj-yekUk0s0wAAAgg"]
[Thu Feb 26 21:38:15.501452 2026] [:error] [pid 20419:tid 20446] [client 4.204.195.211:63469] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aaBMx-3DVDvMfTYYUBVauQAAAdg"]
[Thu Feb 26 21:38:15.974909 2026] [:error] [pid 20419:tid 20432] [client 4.204.195.211:62751] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wc49.php"] [unique_id "aaBMx-3DVDvMfTYYUBVauwAAAco"]
[Thu Feb 26 21:38:16.411054 2026] [:error] [pid 20419:tid 20442] [client 4.204.195.211:62825] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wc49.php"] [unique_id "aaBMyO3DVDvMfTYYUBVavAAAAdQ"]
[Thu Feb 26 21:38:16.819699 2026] [:error] [pid 44444:tid 44467] [client 4.204.195.211:63370] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wc49.php"] [unique_id "aaBMyG2sMNmj-yekUk0s4AAAAhE"]
[Thu Feb 26 21:38:17.234317 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:64791] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wc49.php"] [unique_id "aaBMyW2sMNmj-yekUk0s5AAAAhY"]
[Thu Feb 26 21:38:17.722255 2026] [:error] [pid 44444:tid 44464] [client 4.204.195.211:64886] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/TL.php"] [unique_id "aaBMyW2sMNmj-yekUk0s5QAAAg4"]
[Thu Feb 26 21:38:18.134453 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:65457] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/TL.php"] [unique_id "aaBMym2sMNmj-yekUk0s5wAAAgY"]
[Thu Feb 26 21:38:18.560166 2026] [:error] [pid 20419:tid 20423] [client 4.204.195.211:65433] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/TL.php"] [unique_id "aaBMyu3DVDvMfTYYUBVavgAAAcE"]
[Thu Feb 26 21:38:18.987207 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:62732] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/TL.php"] [unique_id "aaBMym2sMNmj-yekUk0s6QAAAhI"]
[Thu Feb 26 21:38:19.430520 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:65412] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaBMy22sMNmj-yekUk0s7gAAAg8"]
[Thu Feb 26 21:38:19.872605 2026] [:error] [pid 54990:tid 55005] [client 4.204.195.211:65452] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaBMy3tr2qmt_mBhH2wq6AAAAAw"]
[Thu Feb 26 21:38:20.298777 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:64770] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaBMzG2sMNmj-yekUk0s7wAAAgU"]
[Thu Feb 26 21:38:20.781930 2026] [:error] [pid 20419:tid 20422] [client 4.204.195.211:62169] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaBMzO3DVDvMfTYYUBVawQAAAcA"]
[Thu Feb 26 21:38:21.196650 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:63397] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fck.php"] [unique_id "aaBMzW2sMNmj-yekUk0s8gAAAhM"]
[Thu Feb 26 21:38:21.608673 2026] [:error] [pid 55122:tid 55125] [client 4.204.195.211:61628] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fck.php"] [unique_id "aaBMzYLiR0OfjFxvcN8xeAAAAME"]
[Thu Feb 26 21:38:22.028797 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:63387] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fck.php"] [unique_id "aaBMzm2sMNmj-yekUk0s9wAAAhQ"]
[Thu Feb 26 21:38:22.441807 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:65448] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fck.php"] [unique_id "aaBMzu3DVDvMfTYYUBVawwAAAcc"]
[Thu Feb 26 21:38:22.867963 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:63377] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "aaBMzm2sMNmj-yekUk0s_QAAAgo"]
[Thu Feb 26 21:38:23.285073 2026] [:error] [pid 20419:tid 20426] [client 4.204.195.211:65423] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "aaBMz-3DVDvMfTYYUBVaxAAAAcQ"]
[Thu Feb 26 21:38:23.721650 2026] [:error] [pid 55618:tid 55639] [client 4.204.195.211:65410] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "aaBMzx61Vrh12f_8oWQOuAAAARI"]
[Thu Feb 26 21:38:24.134970 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:64809] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "aaBM0G2sMNmj-yekUk0tAQAAAhU"]
[Thu Feb 26 21:38:24.547361 2026] [:error] [pid 3883:tid 3908] [client 4.204.195.211:62746] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aaBM0OA33x90V6yYHajuTQAAAVY"]
[Thu Feb 26 21:38:24.966857 2026] [:error] [pid 20419:tid 20424] [client 4.204.195.211:63434] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aaBM0O3DVDvMfTYYUBVazAAAAcI"]
[Thu Feb 26 21:38:25.387794 2026] [:error] [pid 44444:tid 44450] [client 4.204.195.211:65467] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aaBM0W2sMNmj-yekUk0tAwAAAgA"]
[Thu Feb 26 21:38:25.823712 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:63479] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aaBM0W2sMNmj-yekUk0tBQAAAg8"]
[Thu Feb 26 21:38:26.247380 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:62159] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw2.php"] [unique_id "aaBM0m2sMNmj-yekUk0tBgAAAhc"]
[Thu Feb 26 21:38:26.674679 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:62818] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw2.php"] [unique_id "aaBM0m2sMNmj-yekUk0tCAAAAgU"]
[Thu Feb 26 21:38:27.132825 2026] [:error] [pid 54990:tid 55009] [client 4.204.195.211:65522] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw2.php"] [unique_id "aaBM03tr2qmt_mBhH2wq6QAAABA"]
[Thu Feb 26 21:38:27.544149 2026] [:error] [pid 55122:tid 55129] [client 4.204.195.211:65501] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw2.php"] [unique_id "aaBM04LiR0OfjFxvcN8xewAAAMU"]
[Thu Feb 26 21:38:28.121264 2026] [:error] [pid 20419:tid 20444] [client 4.204.195.211:62745] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blackmini.php"] [unique_id "aaBM1O3DVDvMfTYYUBVa4AAAAdY"]
[Thu Feb 26 21:38:28.557191 2026] [:error] [pid 55051:tid 55073] [client 4.204.195.211:63444] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blackmini.php"] [unique_id "aaBM1AmK1w2kZvh5eLG3AQAAAJM"]
[Thu Feb 26 21:38:28.991330 2026] [:error] [pid 54991:tid 55032] [client 4.204.195.211:64771] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blackmini.php"] [unique_id "aaBM1N4Zx-mJ8gbRB2jtPAAAAEw"]
[Thu Feb 26 21:38:29.401456 2026] [:error] [pid 54991:tid 55041] [client 4.204.195.211:64773] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blackmini.php"] [unique_id "aaBM1d4Zx-mJ8gbRB2jtPQAAAFU"]
[Thu Feb 26 21:38:29.814305 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:62154] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aaBM1W2sMNmj-yekUk0tDwAAAhQ"]
[Thu Feb 26 21:38:30.230059 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:65520] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aaBM1gmK1w2kZvh5eLG3AgAAAIM"]
[Thu Feb 26 21:38:30.642656 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:63378] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aaBM1m2sMNmj-yekUk0tEwAAAhI"]
[Thu Feb 26 21:38:31.086694 2026] [:error] [pid 55051:tid 55062] [client 4.204.195.211:63461] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aaBM1wmK1w2kZvh5eLG3BgAAAIg"]
[Thu Feb 26 21:38:31.509177 2026] [:error] [pid 20419:tid 20424] [client 4.204.195.211:63442] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F19.php"] [unique_id "aaBM1-3DVDvMfTYYUBVa8wAAAcI"]
[Thu Feb 26 21:38:31.928587 2026] [:error] [pid 20419:tid 20437] [client 4.204.195.211:65446] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F19.php"] [unique_id "aaBM1-3DVDvMfTYYUBVa9gAAAc8"]
[Thu Feb 26 21:38:32.344337 2026] [:error] [pid 55051:tid 55071] [client 4.204.195.211:64820] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F19.php"] [unique_id "aaBM2AmK1w2kZvh5eLG3CQAAAJE"]
[Thu Feb 26 21:38:32.759579 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:63455] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F19.php"] [unique_id "aaBM2AmK1w2kZvh5eLG3CwAAAIw"]
[Thu Feb 26 21:38:33.191223 2026] [:error] [pid 55051:tid 55061] [client 4.204.195.211:65414] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F1.php"] [unique_id "aaBM2QmK1w2kZvh5eLG3DwAAAIc"]
[Thu Feb 26 21:38:33.606101 2026] [:error] [pid 3883:tid 3900] [client 4.204.195.211:62765] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F1.php"] [unique_id "aaBM2eA33x90V6yYHajuTgAAAU4"]
[Thu Feb 26 21:38:34.039256 2026] [:error] [pid 55122:tid 55126] [client 4.204.195.211:62803] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F1.php"] [unique_id "aaBM2oLiR0OfjFxvcN8xfAAAAMI"]
[Thu Feb 26 21:38:34.460636 2026] [:error] [pid 44444:tid 44463] [client 4.204.195.211:63439] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F1.php"] [unique_id "aaBM2m2sMNmj-yekUk0tFgAAAg0"]
[Thu Feb 26 21:38:34.877554 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:62124] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaBM2m2sMNmj-yekUk0tFwAAAhc"]
[Thu Feb 26 21:38:35.303092 2026] [:error] [pid 55618:tid 55644] [client 4.204.195.211:62089] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaBM2x61Vrh12f_8oWQOugAAARc"]
[Thu Feb 26 21:38:35.724475 2026] [:error] [pid 55618:tid 55623] [client 4.204.195.211:65494] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaBM2x61Vrh12f_8oWQOuwAAAQI"]
[Thu Feb 26 21:38:36.163148 2026] [:error] [pid 3883:tid 3894] [client 4.204.195.211:62165] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaBM3OA33x90V6yYHajuUgAAAUg"]
[Thu Feb 26 21:38:36.576390 2026] [:error] [pid 44444:tid 44461] [client 4.204.195.211:63453] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaBM3G2sMNmj-yekUk0tGQAAAgs"]
[Thu Feb 26 21:38:37.012572 2026] [:error] [pid 55618:tid 55642] [client 4.204.195.211:65470] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaBM3R61Vrh12f_8oWQOvwAAARU"]
[Thu Feb 26 21:38:37.430947 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:63461] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaBM3d4Zx-mJ8gbRB2jtQgAAAEs"]
[Thu Feb 26 21:38:37.854929 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:63435] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaBM3W2sMNmj-yekUk0tHAAAAgc"]
[Thu Feb 26 21:38:38.272186 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:62729] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4h.php"] [unique_id "aaBM3m2sMNmj-yekUk0tHQAAAgM"]
[Thu Feb 26 21:38:38.689070 2026] [:error] [pid 54991:tid 55035] [client 4.204.195.211:63416] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4h.php"] [unique_id "aaBM3t4Zx-mJ8gbRB2jtQwAAAE8"]
[Thu Feb 26 21:38:39.104270 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:63381] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4h.php"] [unique_id "aaBM322sMNmj-yekUk0tHwAAAhQ"]
[Thu Feb 26 21:38:39.519541 2026] [:error] [pid 3883:tid 3901] [client 4.204.195.211:64768] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4h.php"] [unique_id "aaBM3-A33x90V6yYHajuVAAAAU8"]
[Thu Feb 26 21:38:39.935284 2026] [:error] [pid 3883:tid 3902] [client 4.204.195.211:64802] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yussef.php"] [unique_id "aaBM3-A33x90V6yYHajuVQAAAVA"]
[Thu Feb 26 21:38:40.381496 2026] [:error] [pid 54991:tid 55044] [client 4.204.195.211:64821] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yussef.php"] [unique_id "aaBM4N4Zx-mJ8gbRB2jtSAAAAFg"]
[Thu Feb 26 21:38:40.798437 2026] [:error] [pid 54991:tid 55028] [client 4.204.195.211:62778] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yussef.php"] [unique_id "aaBM4N4Zx-mJ8gbRB2jtSQAAAEg"]
[Thu Feb 26 21:38:41.223069 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:64787] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yussef.php"] [unique_id "aaBM4W2sMNmj-yekUk0tJQAAAg8"]
[Thu Feb 26 21:38:41.641111 2026] [:error] [pid 44444:tid 44454] [client 4.204.195.211:62816] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aaBM4W2sMNmj-yekUk0tKAAAAgQ"]
[Thu Feb 26 21:38:42.069424 2026] [:error] [pid 3883:tid 3906] [client 4.204.195.211:63478] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aaBM4uA33x90V6yYHajuVgAAAVQ"]
[Thu Feb 26 21:38:42.506519 2026] [:error] [pid 3883:tid 3892] [client 4.204.195.211:64891] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aaBM4uA33x90V6yYHajuVwAAAUY"]
[Thu Feb 26 21:38:42.922111 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:62722] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aaBM4m2sMNmj-yekUk0tKgAAAgI"]
[Thu Feb 26 21:38:43.353702 2026] [:error] [pid 44444:tid 44464] [client 4.204.195.211:62792] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aaBM422sMNmj-yekUk0tLQAAAg4"]
[Thu Feb 26 21:38:43.771297 2026] [:error] [pid 25311:tid 25314] [client 4.204.195.211:62204] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aaBM49fdM__yZAgJFSvkygAAAYA"]
[Thu Feb 26 21:38:44.183579 2026] [:error] [pid 55122:tid 55148] [client 4.204.195.211:62802] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aaBM5ILiR0OfjFxvcN8xfQAAANg"]
[Thu Feb 26 21:38:44.600561 2026] [:error] [pid 55618:tid 55637] [client 4.204.195.211:65523] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aaBM5B61Vrh12f_8oWQOwAAAARA"]
[Thu Feb 26 21:38:45.014470 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:62091] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zu.php"] [unique_id "aaBM5W2sMNmj-yekUk0tMQAAAgo"]
[Thu Feb 26 21:38:45.423516 2026] [:error] [pid 54991:tid 55026] [client 4.204.195.211:65515] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zu.php"] [unique_id "aaBM5d4Zx-mJ8gbRB2jtVwAAAEY"]
[Thu Feb 26 21:38:45.833779 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:63472] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zu.php"] [unique_id "aaBM5QmK1w2kZvh5eLG3GgAAAIQ"]
[Thu Feb 26 21:38:46.247030 2026] [:error] [pid 54991:tid 55028] [client 4.204.195.211:64844] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zu.php"] [unique_id "aaBM5t4Zx-mJ8gbRB2jtXQAAAEg"]
[Thu Feb 26 21:38:46.668687 2026] [:error] [pid 25311:tid 25316] [client 4.204.195.211:65458] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aaBM5tfdM__yZAgJFSvkzAAAAYI"]
[Thu Feb 26 21:38:47.079614 2026] [:error] [pid 20419:tid 20428] [client 4.204.195.211:64867] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aaBM5-3DVDvMfTYYUBVbPAAAAcY"]
[Thu Feb 26 21:38:47.506585 2026] [:error] [pid 54991:tid 55042] [client 4.204.195.211:64855] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aaBM594Zx-mJ8gbRB2jtZwAAAFY"]
[Thu Feb 26 21:38:47.929965 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:62774] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aaBM5wmK1w2kZvh5eLG3IgAAAJg"]
[Thu Feb 26 21:38:48.347699 2026] [:error] [pid 55051:tid 55072] [client 4.204.195.211:62162] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "aaBM6AmK1w2kZvh5eLG3JAAAAJI"]
[Thu Feb 26 21:38:48.769114 2026] [:error] [pid 54991:tid 55027] [client 4.204.195.211:62730] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "aaBM6N4Zx-mJ8gbRB2jtcAAAAEc"]
[Thu Feb 26 21:38:49.198922 2026] [:error] [pid 3883:tid 3887] [client 4.204.195.211:63429] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "aaBM6eA33x90V6yYHajuWQAAAUE"]
[Thu Feb 26 21:38:49.639257 2026] [:error] [pid 44444:tid 44462] [client 4.204.195.211:64845] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "aaBM6W2sMNmj-yekUk0tOQAAAgw"]
[Thu Feb 26 21:38:50.054409 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:62727] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aaBM6m2sMNmj-yekUk0tOwAAAgg"]
[Thu Feb 26 21:38:50.465023 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:62102] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aaBM6m2sMNmj-yekUk0tPwAAAgY"]
[Thu Feb 26 21:38:50.887181 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:61688] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aaBM6m2sMNmj-yekUk0tQgAAAhU"]
[Thu Feb 26 21:38:51.301631 2026] [:error] [pid 20419:tid 20445] [client 4.204.195.211:65430] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aaBM6-3DVDvMfTYYUBVbPQAAAdc"]
[Thu Feb 26 21:38:51.732040 2026] [:error] [pid 20419:tid 20431] [client 4.204.195.211:64833] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaBM6-3DVDvMfTYYUBVbPgAAAck"]
[Thu Feb 26 21:38:52.144257 2026] [:error] [pid 20419:tid 20438] [client 4.204.195.211:62811] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaBM7O3DVDvMfTYYUBVbQQAAAdA"]
[Thu Feb 26 21:38:52.577200 2026] [:error] [pid 54991:tid 55025] [client 4.204.195.211:65504] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaBM7N4Zx-mJ8gbRB2jthwAAAEU"]
[Thu Feb 26 21:38:52.999579 2026] [:error] [pid 3883:tid 3896] [client 4.204.195.211:63421] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaBM7OA33x90V6yYHajuWwAAAUo"]
[Thu Feb 26 21:38:53.416408 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:62826] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seetox.php"] [unique_id "aaBM7W2sMNmj-yekUk0tSAAAAhc"]
[Thu Feb 26 21:38:53.835171 2026] [:error] [pid 44444:tid 44461] [client 4.204.195.211:64875] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seetox.php"] [unique_id "aaBM7W2sMNmj-yekUk0tSgAAAgs"]
[Thu Feb 26 21:38:54.246463 2026] [:error] [pid 44444:tid 44464] [client 4.204.195.211:63462] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seetox.php"] [unique_id "aaBM7m2sMNmj-yekUk0tTQAAAg4"]
[Thu Feb 26 21:38:54.660122 2026] [:error] [pid 55051:tid 55069] [client 4.204.195.211:65511] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seetox.php"] [unique_id "aaBM7gmK1w2kZvh5eLG3KgAAAI8"]
[Thu Feb 26 21:38:55.074971 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:62793] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aaBM722sMNmj-yekUk0tUwAAAg8"]
[Thu Feb 26 21:38:55.503855 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:64832] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aaBM7wmK1w2kZvh5eLG3KwAAAIw"]
[Thu Feb 26 21:38:55.922148 2026] [:error] [pid 25311:tid 25331] [client 4.204.195.211:63395] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aaBM79fdM__yZAgJFSvkzwAAAZE"]
[Thu Feb 26 21:38:56.333054 2026] [:error] [pid 25311:tid 25328] [client 4.204.195.211:63437] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aaBM8NfdM__yZAgJFSvk0AAAAY4"]
[Thu Feb 26 21:38:56.752259 2026] [:error] [pid 55051:tid 55061] [client 4.204.195.211:64789] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "aaBM8AmK1w2kZvh5eLG3MQAAAIc"]
[Thu Feb 26 21:38:57.164684 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:62812] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "aaBM8QmK1w2kZvh5eLG3MwAAAJg"]
[Thu Feb 26 21:38:57.584322 2026] [:error] [pid 55051:tid 55055] [client 4.204.195.211:62846] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "aaBM8QmK1w2kZvh5eLG3NQAAAIE"]
[Thu Feb 26 21:38:58.004461 2026] [:error] [pid 55122:tid 55137] [client 4.204.195.211:64884] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "aaBM8oLiR0OfjFxvcN8xgwAAAM0"]
[Thu Feb 26 21:38:58.417934 2026] [:error] [pid 44444:tid 44454] [client 4.204.195.211:63398] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xoot.php"] [unique_id "aaBM8m2sMNmj-yekUk0tXAAAAgQ"]
[Thu Feb 26 21:38:58.834768 2026] [:error] [pid 55051:tid 55067] [client 4.204.195.211:65485] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xoot.php"] [unique_id "aaBM8gmK1w2kZvh5eLG3RgAAAI0"]
[Thu Feb 26 21:38:59.246537 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:65508] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xoot.php"] [unique_id "aaBM8wmK1w2kZvh5eLG3UgAAAJA"]
[Thu Feb 26 21:38:59.666463 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:62775] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xoot.php"] [unique_id "aaBM8wmK1w2kZvh5eLG3VAAAAIU"]
[Thu Feb 26 21:39:00.088950 2026] [:error] [pid 55051:tid 55056] [client 4.204.195.211:63474] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaBM9AmK1w2kZvh5eLG3VQAAAII"]
[Thu Feb 26 21:39:00.499457 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:62101] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaBM9AmK1w2kZvh5eLG3WAAAAIM"]
[Thu Feb 26 21:39:00.927492 2026] [:error] [pid 3883:tid 3893] [client 4.204.195.211:60232] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaBM9OA33x90V6yYHajuYQAAAUc"]
[Thu Feb 26 21:39:01.343936 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:65516] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaBM9e3DVDvMfTYYUBVbUQAAAcc"]
[Thu Feb 26 21:39:01.771992 2026] [:error] [pid 54991:tid 55028] [client 4.204.195.211:64804] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "aaBM9d4Zx-mJ8gbRB2jttwAAAEg"]
[Thu Feb 26 21:39:02.187779 2026] [:error] [pid 54991:tid 55036] [client 4.204.195.211:62724] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "aaBM9t4Zx-mJ8gbRB2jtvgAAAFA"]
[Thu Feb 26 21:39:02.601243 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:65524] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "aaBM9gmK1w2kZvh5eLG3XwAAAIM"]
[Thu Feb 26 21:39:03.042705 2026] [:error] [pid 3883:tid 3900] [client 4.204.195.211:62094] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "aaBM9-A33x90V6yYHajuYwAAAU4"]
[Thu Feb 26 21:39:03.457436 2026] [:error] [pid 54991:tid 55025] [client 4.204.195.211:62180] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBM994Zx-mJ8gbRB2jtzAAAAEU"]
[Thu Feb 26 21:39:03.879676 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:64801] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBM922sMNmj-yekUk0tagAAAhg"]
[Thu Feb 26 21:39:04.295862 2026] [:error] [pid 44444:tid 44464] [client 4.204.195.211:63379] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBM-G2sMNmj-yekUk0tbAAAAg4"]
[Thu Feb 26 21:39:04.716909 2026] [:error] [pid 54991:tid 55044] [client 4.204.195.211:62739] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaBM-N4Zx-mJ8gbRB2jt1AAAAFg"]
[Thu Feb 26 21:39:05.149790 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:62819] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aaBM-QmK1w2kZvh5eLG3ZwAAAIU"]
[Thu Feb 26 21:39:05.563083 2026] [:error] [pid 3883:tid 3894] [client 4.204.195.211:63399] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aaBM-eA33x90V6yYHajuZQAAAUg"]
[Thu Feb 26 21:39:05.981884 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:62084] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aaBM-W2sMNmj-yekUk0tcgAAAgc"]
[Thu Feb 26 21:39:06.396147 2026] [:error] [pid 20419:tid 20442] [client 4.204.195.211:62832] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aaBM-u3DVDvMfTYYUBVbVAAAAdQ"]
[Thu Feb 26 21:39:06.810761 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:62838] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/er.php"] [unique_id "aaBM-m2sMNmj-yekUk0tcwAAAgY"]
[Thu Feb 26 21:39:07.237698 2026] [:error] [pid 55618:tid 55626] [client 4.204.195.211:65526] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/er.php"] [unique_id "aaBM-x61Vrh12f_8oWQOwgAAAQU"]
[Thu Feb 26 21:39:07.661538 2026] [:error] [pid 3883:tid 3903] [client 4.204.195.211:65479] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/er.php"] [unique_id "aaBM--A33x90V6yYHajuZgAAAVE"]
[Thu Feb 26 21:39:08.086601 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:63487] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/er.php"] [unique_id "aaBM_AmK1w2kZvh5eLG3awAAAIM"]
[Thu Feb 26 21:39:08.499808 2026] [:error] [pid 54990:tid 55017] [client 4.204.195.211:63374] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fault.php"] [unique_id "aaBM_Htr2qmt_mBhH2wq9gAAABg"]
[Thu Feb 26 21:39:08.913947 2026] [:error] [pid 55618:tid 55624] [client 4.204.195.211:62155] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fault.php"] [unique_id "aaBM_B61Vrh12f_8oWQOwwAAAQM"]
[Thu Feb 26 21:39:09.332244 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:64866] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fault.php"] [unique_id "aaBM_QmK1w2kZvh5eLG3bQAAAIQ"]
[Thu Feb 26 21:39:09.751099 2026] [:error] [pid 3883:tid 3902] [client 4.204.195.211:63388] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fault.php"] [unique_id "aaBM_eA33x90V6yYHajuaAAAAVA"]
[Thu Feb 26 21:39:10.265767 2026] [:error] [pid 55051:tid 55076] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Thu Feb 26 21:39:10.475149 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Thu Feb 26 21:39:10.684475 2026] [:error] [pid 55051:tid 55074] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/leuk.php
[Thu Feb 26 21:39:10.893087 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Thu Feb 26 21:39:11.103552 2026] [:error] [pid 55051:tid 55056] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/kolda.php
[Thu Feb 26 21:39:11.314596 2026] [:error] [pid 55051:tid 55073] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Thu Feb 26 21:39:11.524296 2026] [:error] [pid 55051:tid 55063] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Thu Feb 26 21:39:11.734264 2026] [:error] [pid 55051:tid 55076] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Thu Feb 26 21:39:11.941883 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/un.php
[Thu Feb 26 21:39:12.151660 2026] [:error] [pid 55051:tid 55074] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Thu Feb 26 21:39:12.360309 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:64823] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Thu Feb 26 21:39:12.565030 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:64823] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aaBNAAmK1w2kZvh5eLG3fAAAAIU"]
[Thu Feb 26 21:39:12.976065 2026] [:error] [pid 20419:tid 20439] [client 4.204.195.211:63385] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aaBNAO3DVDvMfTYYUBVbWAAAAdE"]
[Thu Feb 26 21:39:13.415022 2026] [:error] [pid 20419:tid 20437] [client 4.204.195.211:62150] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aaBNAe3DVDvMfTYYUBVbWQAAAc8"]
[Thu Feb 26 21:39:13.827316 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:62195] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aaBNAe3DVDvMfTYYUBVbWgAAAcc"]
[Thu Feb 26 21:39:14.246210 2026] [:error] [pid 20419:tid 20445] [client 4.204.195.211:63423] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaBNAu3DVDvMfTYYUBVbWwAAAdc"]
[Thu Feb 26 21:39:14.657585 2026] [:error] [pid 3883:tid 3896] [client 4.204.195.211:62795] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaBNAuA33x90V6yYHajubQAAAUo"]
[Thu Feb 26 21:39:15.073692 2026] [:error] [pid 3883:tid 3890] [client 4.204.195.211:63362] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaBNA-A33x90V6yYHajubgAAAUQ"]
[Thu Feb 26 21:39:15.545146 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:63372] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaBNAwmK1w2kZvh5eLG3fwAAAJA"]
[Thu Feb 26 21:39:15.958280 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:65499] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaBNAwmK1w2kZvh5eLG3gQAAAIQ"]
[Thu Feb 26 21:39:16.374660 2026] [:error] [pid 55051:tid 55056] [client 4.204.195.211:65426] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaBNBAmK1w2kZvh5eLG3ggAAAII"]
[Thu Feb 26 21:39:16.790187 2026] [:error] [pid 3883:tid 3907] [client 4.204.195.211:63376] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaBNBOA33x90V6yYHajucQAAAVU"]
[Thu Feb 26 21:39:17.199680 2026] [:error] [pid 3883:tid 3897] [client 4.204.195.211:62748] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aaBNBeA33x90V6yYHajucgAAAUs"]
[Thu Feb 26 21:39:17.635839 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:63464] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaBNBW2sMNmj-yekUk0tkwAAAgE"]
[Thu Feb 26 21:39:18.052091 2026] [:error] [pid 20419:tid 20431] [client 4.204.195.211:63409] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaBNBu3DVDvMfTYYUBVbXQAAAck"]
[Thu Feb 26 21:39:18.477431 2026] [:error] [pid 20419:tid 20436] [client 4.204.195.211:61637] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaBNBu3DVDvMfTYYUBVbXgAAAc4"]
[Thu Feb 26 21:39:18.900057 2026] [:error] [pid 3883:tid 3908] [client 4.204.195.211:64879] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aaBNBuA33x90V6yYHajudAAAAVY"]
[Thu Feb 26 21:39:19.318018 2026] [:error] [pid 44444:tid 44466] [client 4.204.195.211:62807] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaBNB22sMNmj-yekUk0tlwAAAhA"]
[Thu Feb 26 21:39:19.740638 2026] [:error] [pid 44444:tid 44450] [client 4.204.195.211:65421] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaBNB22sMNmj-yekUk0tmAAAAgA"]
[Thu Feb 26 21:39:20.159194 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:62780] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaBNCG2sMNmj-yekUk0tmwAAAhc"]
[Thu Feb 26 21:39:20.607509 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:65450] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aaBNCG2sMNmj-yekUk0tnAAAAgg"]
[Thu Feb 26 21:39:21.018674 2026] [:error] [pid 44444:tid 44454] [client 4.204.195.211:65526] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aaBNCW2sMNmj-yekUk0tngAAAgQ"]
[Thu Feb 26 21:39:21.437554 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:62108] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aaBNCW2sMNmj-yekUk0tnwAAAgI"]
[Thu Feb 26 21:39:21.851551 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:65502] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aaBNCW2sMNmj-yekUk0toAAAAgk"]
[Thu Feb 26 21:39:22.269979 2026] [:error] [pid 25311:tid 25321] [client 4.204.195.211:62771] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aaBNCtfdM__yZAgJFSvk4AAAAYc"]
[Thu Feb 26 21:39:22.708217 2026] [:error] [pid 3883:tid 3905] [client 4.204.195.211:65422] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aaBNCuA33x90V6yYHajueAAAAVM"]
[Thu Feb 26 21:39:23.119565 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:62156] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aaBNC-3DVDvMfTYYUBVbYAAAAc0"]
[Thu Feb 26 21:39:23.530222 2026] [:error] [pid 55051:tid 55068] [client 4.204.195.211:64883] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aaBNCwmK1w2kZvh5eLG3hgAAAI4"]
[Thu Feb 26 21:39:23.941478 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:62736] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1vx.php"] [unique_id "aaBNC22sMNmj-yekUk0towAAAgo"]
[Thu Feb 26 21:39:24.354951 2026] [:error] [pid 25311:tid 25330] [client 4.204.195.211:65506] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaBNDNfdM__yZAgJFSvk5QAAAZA"]
[Thu Feb 26 21:39:24.778049 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:63383] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaBNDG2sMNmj-yekUk0tpAAAAgE"]
[Thu Feb 26 21:39:25.190483 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:65486] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaBNDW2sMNmj-yekUk0tpwAAAgc"]
[Thu Feb 26 21:39:25.691699 2026] [:error] [pid 44444:tid 44462] [client 4.204.195.211:65444] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaBNDW2sMNmj-yekUk0tqwAAAgw"]
[Thu Feb 26 21:39:26.107294 2026] [:error] [pid 55618:tid 55638] [client 4.204.195.211:64838] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaBNDh61Vrh12f_8oWQOxQAAARE"]
[Thu Feb 26 21:39:26.561624 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:62127] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaBNDm2sMNmj-yekUk0tsQAAAgk"]
[Thu Feb 26 21:39:26.991724 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:62163] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaBNDm2sMNmj-yekUk0tswAAAhU"]
[Thu Feb 26 21:39:27.494153 2026] [:error] [pid 3883:tid 3892] [client 4.204.195.211:64777] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaBND-A33x90V6yYHajuegAAAUY"]
[Thu Feb 26 21:39:28.085811 2026] [:error] [pid 25311:tid 25335] [client 4.204.195.211:62728] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aaBNENfdM__yZAgJFSvk6QAAAZU"]
[Thu Feb 26 21:39:28.558226 2026] [:error] [pid 3883:tid 3887] [client 4.204.195.211:64777] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aaBNEOA33x90V6yYHajufQAAAUE"]
[Thu Feb 26 21:39:28.999475 2026] [:error] [pid 55051:tid 55064] [client 4.204.195.211:63450] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aaBNEAmK1w2kZvh5eLG3iwAAAIo"]
[Thu Feb 26 21:39:29.626540 2026] [:error] [pid 44444:tid 44450] [client 4.204.195.211:62157] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/06.php"] [unique_id "aaBNEW2sMNmj-yekUk0tvQAAAgA"]
[Thu Feb 26 21:39:30.158467 2026] [:error] [pid 54991:tid 55041] [client 4.204.195.211:62123] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaBNEt4Zx-mJ8gbRB2jt4gAAAFU"]
[Thu Feb 26 21:39:30.849083 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:62151] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaBNEm2sMNmj-yekUk0twQAAAgY"]
[Thu Feb 26 21:39:31.475356 2026] [:error] [pid 54991:tid 55030] [client 4.204.195.211:62140] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaBNE94Zx-mJ8gbRB2jt4wAAAEo"]
[Thu Feb 26 21:39:31.977024 2026] [:error] [pid 54991:tid 55029] [client 4.204.195.211:64863] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaBNE94Zx-mJ8gbRB2jt5AAAAEk"]
[Thu Feb 26 21:39:32.566470 2026] [:error] [pid 55051:tid 55069] [client 4.204.195.211:65413] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aaBNFAmK1w2kZvh5eLG3kQAAAI8"]
[Thu Feb 26 21:39:33.254034 2026] [:error] [pid 3883:tid 3898] [client 4.204.195.211:64873] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aaBNFeA33x90V6yYHajufwAAAUw"]
[Thu Feb 26 21:39:33.804689 2026] [:error] [pid 55122:tid 55128] [client 4.204.195.211:63484] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aaBNFYLiR0OfjFxvcN8xlgAAAMQ"]
[Thu Feb 26 21:39:34.647745 2026] [:error] [pid 54990:tid 55013] [client 4.204.195.211:63431] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fot.php"] [unique_id "aaBNFntr2qmt_mBhH2wq-wAAABQ"]
[Thu Feb 26 21:39:35.508825 2026] [:error] [pid 54991:tid 55023] [client 4.204.195.211:62820] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "aaBNF94Zx-mJ8gbRB2jt5gAAAEM"]
[Thu Feb 26 21:39:36.198881 2026] [:error] [pid 20419:tid 20440] [client 4.204.195.211:62186] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "aaBNGO3DVDvMfTYYUBVbZwAAAdI"]
[Thu Feb 26 21:39:36.867026 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:63451] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "aaBNGO3DVDvMfTYYUBVbaAAAAcc"]
[Thu Feb 26 21:39:37.666641 2026] [:error] [pid 20419:tid 20425] [client 4.204.195.211:65509] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "aaBNGe3DVDvMfTYYUBVbbgAAAcM"]
[Thu Feb 26 21:39:38.326288 2026] [:error] [pid 55122:tid 55125] [client 4.204.195.211:64865] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaBNGoLiR0OfjFxvcN8xlwAAAME"]
[Thu Feb 26 21:39:39.457945 2026] [:error] [pid 54991:tid 55027] [client 4.204.195.211:62767] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaBNG94Zx-mJ8gbRB2jt6wAAAEc"]
[Thu Feb 26 21:39:40.034518 2026] [:error] [pid 54991:tid 55038] [client 4.204.195.211:61608] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaBNHN4Zx-mJ8gbRB2jt7gAAAFI"]
[Thu Feb 26 21:39:41.166208 2026] [:error] [pid 44444:tid 44450] [client 4.204.195.211:62749] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaBNHW2sMNmj-yekUk0twwAAAgA"]
[Thu Feb 26 21:39:41.711042 2026] [:error] [pid 54991:tid 55033] [client 4.204.195.211:62090] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaBNHd4Zx-mJ8gbRB2jt_QAAAE0"]
[Thu Feb 26 21:39:42.388305 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:61652] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaBNHm2sMNmj-yekUk0txwAAAhQ"]
[Thu Feb 26 21:39:43.032303 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:62779] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaBNH22sMNmj-yekUk0tyAAAAgg"]
[Thu Feb 26 21:39:43.678130 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:63448] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaBNH22sMNmj-yekUk0tywAAAhU"]
[Thu Feb 26 21:39:44.432683 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:62087] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev1s.php"] [unique_id "aaBNIG2sMNmj-yekUk0tzwAAAhI"]
[Thu Feb 26 21:39:45.186019 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:65481] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev1s.php"] [unique_id "aaBNIW2sMNmj-yekUk0t0QAAAhc"]
[Thu Feb 26 21:39:45.783543 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:63443] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev1s.php"] [unique_id "aaBNIW2sMNmj-yekUk0t1AAAAgM"]
[Thu Feb 26 21:39:46.322033 2026] [:error] [pid 3883:tid 3893] [client 4.204.195.211:63471] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev1s.php"] [unique_id "aaBNIuA33x90V6yYHajugQAAAUc"]
[Thu Feb 26 21:39:47.029367 2026] [:error] [pid 54991:tid 55041] [client 4.204.195.211:58862] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffd.php"] [unique_id "aaBNI94Zx-mJ8gbRB2juHgAAAFU"]
[Thu Feb 26 21:39:47.911876 2026] [:error] [pid 55618:tid 55626] [client 4.204.195.211:65480] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffd.php"] [unique_id "aaBNIx61Vrh12f_8oWQO0QAAAQU"]
[Thu Feb 26 21:39:48.716448 2026] [:error] [pid 54990:tid 54999] [client 4.204.195.211:64855] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffd.php"] [unique_id "aaBNJHtr2qmt_mBhH2wrAQAAAAY"]
[Thu Feb 26 21:39:49.358490 2026] [:error] [pid 55618:tid 55628] [client 4.204.195.211:64781] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffd.php"] [unique_id "aaBNJR61Vrh12f_8oWQO0wAAAQc"]
[Thu Feb 26 21:39:49.923827 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:62777] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admiin.php"] [unique_id "aaBNJW2sMNmj-yekUk0t3wAAAhI"]
[Thu Feb 26 21:39:50.749665 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:63486] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admiin.php"] [unique_id "aaBNJm2sMNmj-yekUk0t4wAAAgE"]
[Thu Feb 26 21:39:51.421504 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:65447] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admiin.php"] [unique_id "aaBNJ22sMNmj-yekUk0t5gAAAhM"]
[Thu Feb 26 21:39:52.479665 2026] [:error] [pid 44444:tid 44454] [client 4.204.195.211:63420] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admiin.php"] [unique_id "aaBNKG2sMNmj-yekUk0t6gAAAgQ"]
[Thu Feb 26 21:39:53.081664 2026] [:error] [pid 3883:tid 3887] [client 4.204.195.211:62761] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aaBNKeA33x90V6yYHajuigAAAUE"]
[Thu Feb 26 21:39:54.010110 2026] [:error] [pid 55618:tid 55625] [client 4.204.195.211:62138] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aaBNKh61Vrh12f_8oWQO2AAAAQQ"]
[Thu Feb 26 21:39:54.802256 2026] [:error] [pid 54991:tid 55027] [client 4.204.195.211:63396] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aaBNKt4Zx-mJ8gbRB2juQAAAAEc"]
[Thu Feb 26 21:39:55.342904 2026] [:error] [pid 54991:tid 55042] [client 4.204.195.211:65495] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aaBNK94Zx-mJ8gbRB2juRQAAAFY"]
[Thu Feb 26 21:39:56.083737 2026] [:error] [pid 20419:tid 20438] [client 4.204.195.211:62200] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaBNLO3DVDvMfTYYUBVbcAAAAdA"]
[Thu Feb 26 21:39:56.828585 2026] [:error] [pid 55122:tid 55136] [client 4.204.195.211:62175] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaBNLILiR0OfjFxvcN8xmAAAAMw"]
[Thu Feb 26 21:39:57.322809 2026] [:error] [pid 55051:tid 55069] [client 4.204.195.211:62824] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaBNLQmK1w2kZvh5eLG3nwAAAI8"]
[Thu Feb 26 21:39:57.826671 2026] [:error] [pid 55122:tid 55133] [client 4.204.195.211:62742] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaBNLYLiR0OfjFxvcN8xmQAAAMk"]
[Thu Feb 26 21:39:58.322605 2026] [:error] [pid 55122:tid 55130] [client 4.204.195.211:62798] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNLoLiR0OfjFxvcN8xmgAAAMY"]
[Thu Feb 26 21:39:58.790208 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:61646] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNLm2sMNmj-yekUk0t9QAAAhg"]
[Thu Feb 26 21:39:59.248631 2026] [:error] [pid 20419:tid 20443] [client 4.204.195.211:63391] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNL-3DVDvMfTYYUBVbcQAAAdU"]
[Thu Feb 26 21:39:59.725988 2026] [:error] [pid 25311:tid 25317] [client 4.204.195.211:62206] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNL9fdM__yZAgJFSvk9AAAAYM"]
[Thu Feb 26 21:40:00.257166 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:64878] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaBNMG2sMNmj-yekUk0t9wAAAhQ"]
[Thu Feb 26 21:40:00.841959 2026] [:error] [pid 55051:tid 55077] [client 4.204.195.211:62191] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaBNMAmK1w2kZvh5eLG3qAAAAJc"]
[Thu Feb 26 21:40:01.314179 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:62187] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaBNMQmK1w2kZvh5eLG3qQAAAIQ"]
[Thu Feb 26 21:40:01.805459 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:62841] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaBNMW2sMNmj-yekUk0t-gAAAgk"]
[Thu Feb 26 21:40:02.279465 2026] [:error] [pid 55051:tid 55074] [client 4.204.195.211:63466] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaBNMgmK1w2kZvh5eLG3rAAAAJQ"]
[Thu Feb 26 21:40:02.773108 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:59625] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaBNMgmK1w2kZvh5eLG3rgAAAIU"]
[Thu Feb 26 21:40:03.297841 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:60234] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaBNM22sMNmj-yekUk0t_QAAAhY"]
[Thu Feb 26 21:40:03.774580 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:62752] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaBNM22sMNmj-yekUk0t_wAAAgI"]
[Thu Feb 26 21:40:04.252122 2026] [:error] [pid 55051:tid 55065] [client 4.204.195.211:64864] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaBNNAmK1w2kZvh5eLG3sgAAAIs"]
[Thu Feb 26 21:40:04.722759 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:62794] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaBNNG2sMNmj-yekUk0uBAAAAhI"]
[Thu Feb 26 21:40:05.274297 2026] [:error] [pid 44444:tid 44450] [client 4.204.195.211:62203] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaBNNW2sMNmj-yekUk0uCAAAAgA"]
[Thu Feb 26 21:40:05.762482 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:65489] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaBNNW2sMNmj-yekUk0uCwAAAhQ"]
[Thu Feb 26 21:40:06.239245 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:64786] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNNm2sMNmj-yekUk0uDQAAAgk"]
[Thu Feb 26 21:40:06.714843 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:61578] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNNgmK1w2kZvh5eLG3twAAAJA"]
[Thu Feb 26 21:40:07.267886 2026] [:error] [pid 55051:tid 55063] [client 4.204.195.211:65478] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNNwmK1w2kZvh5eLG3uAAAAIk"]
[Thu Feb 26 21:40:07.772813 2026] [:error] [pid 55618:tid 55629] [client 4.204.195.211:62758] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaBNNx61Vrh12f_8oWQO5gAAAQg"]
[Thu Feb 26 21:40:08.250055 2026] [:error] [pid 3883:tid 3891] [client 4.204.195.211:61594] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaBNOOA33x90V6yYHajukQAAAUU"]
[Thu Feb 26 21:40:08.719348 2026] [:error] [pid 20419:tid 20434] [client 4.204.195.211:65437] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaBNOO3DVDvMfTYYUBVbcwAAAcw"]
[Thu Feb 26 21:40:09.188527 2026] [:error] [pid 55051:tid 55065] [client 4.204.195.211:62785] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaBNOQmK1w2kZvh5eLG3ugAAAIs"]
[Thu Feb 26 21:40:09.655128 2026] [:error] [pid 25311:tid 25338] [client 4.204.195.211:63475] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaBNOdfdM__yZAgJFSvk-wAAAZg"]
[Thu Feb 26 21:40:10.223023 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:61575] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaBNOm2sMNmj-yekUk0uHgAAAhY"]
[Thu Feb 26 21:40:10.683938 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:63408] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaBNOm2sMNmj-yekUk0uIAAAAgo"]
[Thu Feb 26 21:40:11.183303 2026] [:error] [pid 54991:tid 55023] [client 4.204.195.211:63414] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaBNO94Zx-mJ8gbRB2jufwAAAEM"]
[Thu Feb 26 21:40:11.651506 2026] [:error] [pid 44444:tid 44454] [client 4.204.195.211:65424] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaBNO22sMNmj-yekUk0uJQAAAgQ"]
[Thu Feb 26 21:40:12.141828 2026] [:error] [pid 54991:tid 55021] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Thu Feb 26 21:40:12.367533 2026] [:error] [pid 54991:tid 55025] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Feb 26 21:40:12.686345 2026] [:error] [pid 54991:tid 55026] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/karak.php
[Thu Feb 26 21:40:12.911965 2026] [:error] [pid 54991:tid 55030] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Thu Feb 26 21:40:13.138334 2026] [:error] [pid 54991:tid 55029] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Thu Feb 26 21:40:13.364547 2026] [:error] [pid 54991:tid 55035] [client 4.204.195.211:63476] [client 4.204.195.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.204.195.211, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaBNPd4Zx-mJ8gbRB2jukgAAAE8"]
[Thu Feb 26 21:40:13.367783 2026] [:error] [pid 54991:tid 55035] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Feb 26 21:40:13.601063 2026] [:error] [pid 54991:tid 55034] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Thu Feb 26 21:40:13.823646 2026] [:error] [pid 54991:tid 55024] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Feb 26 21:40:14.031255 2026] [:error] [pid 54991:tid 55028] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Thu Feb 26 21:40:14.249070 2026] [:error] [pid 54991:tid 55036] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Feb 26 21:40:14.459215 2026] [:error] [pid 54991:tid 55042] [client 4.204.195.211:63476] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Feb 26 21:40:14.663644 2026] [:error] [pid 54991:tid 55032] [client 4.204.195.211:63476] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBNPt4Zx-mJ8gbRB2juoAAAAEw"]
[Thu Feb 26 21:40:15.075199 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:64851] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBNP22sMNmj-yekUk0uMAAAAhc"]
[Thu Feb 26 21:40:15.492808 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:61585] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBNPwmK1w2kZvh5eLG3xQAAAJg"]
[Thu Feb 26 21:40:15.921337 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:65462] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaBNP22sMNmj-yekUk0uMwAAAgI"]
[Thu Feb 26 21:40:16.440977 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:62133] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNQAmK1w2kZvh5eLG3xgAAAIw"]
[Thu Feb 26 21:40:16.866075 2026] [:error] [pid 54991:tid 55034] [client 4.204.195.211:61695] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNQN4Zx-mJ8gbRB2juqwAAAE4"]
[Thu Feb 26 21:40:17.306805 2026] [:error] [pid 55051:tid 55067] [client 4.204.195.211:62199] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNQQmK1w2kZvh5eLG3yAAAAI0"]
[Thu Feb 26 21:40:17.727532 2026] [:error] [pid 20419:tid 20433] [client 4.204.195.211:64772] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNQe3DVDvMfTYYUBVbdwAAAcs"]
[Thu Feb 26 21:40:18.146723 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:64792] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaBNQm2sMNmj-yekUk0uNwAAAgk"]
[Thu Feb 26 21:40:18.649972 2026] [:error] [pid 3883:tid 3910] [client 4.204.195.211:63382] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaBNQuA33x90V6yYHajukgAAAVg"]
[Thu Feb 26 21:40:19.064779 2026] [:error] [pid 44444:tid 44466] [client 4.204.195.211:63410] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaBNQ22sMNmj-yekUk0uOwAAAhA"]
[Thu Feb 26 21:40:19.490750 2026] [:error] [pid 55051:tid 55064] [client 4.204.195.211:62764] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaBNQwmK1w2kZvh5eLG30AAAAIo"]
[Thu Feb 26 21:40:19.905578 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:64826] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaBNQwmK1w2kZvh5eLG30gAAAIw"]
[Thu Feb 26 21:40:20.321419 2026] [:error] [pid 55051:tid 55077] [client 4.204.195.211:62796] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaBNRAmK1w2kZvh5eLG31QAAAJc"]
[Thu Feb 26 21:40:20.757640 2026] [:error] [pid 55122:tid 55143] [client 4.204.195.211:62086] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaBNRILiR0OfjFxvcN8xnQAAANM"]
[Thu Feb 26 21:40:21.179682 2026] [:error] [pid 55051:tid 55062] [client 4.204.195.211:62827] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaBNRQmK1w2kZvh5eLG32AAAAIg"]
[Thu Feb 26 21:40:21.644764 2026] [:error] [pid 55051:tid 55055] [client 4.204.195.211:59538] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBNRQmK1w2kZvh5eLG33AAAAIE"]
[Thu Feb 26 21:40:22.101627 2026] [:error] [pid 55051:tid 55054] [client 4.204.195.211:60266] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBNRgmK1w2kZvh5eLG33wAAAIA"]
[Thu Feb 26 21:40:22.533139 2026] [:error] [pid 20419:tid 20436] [client 4.204.195.211:65483] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBNRu3DVDvMfTYYUBVbegAAAc4"]
[Thu Feb 26 21:40:22.949470 2026] [:error] [pid 54990:tid 55006] [client 4.204.195.211:65474] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaBNRntr2qmt_mBhH2wrBgAAAA0"]
[Thu Feb 26 21:40:23.369029 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:64869] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaBNR22sMNmj-yekUk0uPwAAAgI"]
[Thu Feb 26 21:40:23.785733 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:61694] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaBNR22sMNmj-yekUk0uQAAAAgE"]
[Thu Feb 26 21:40:24.202927 2026] [:error] [pid 55051:tid 55077] [client 4.204.195.211:64840] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaBNSAmK1w2kZvh5eLG34QAAAJc"]
[Thu Feb 26 21:40:24.619277 2026] [:error] [pid 55122:tid 55142] [client 4.204.195.211:62760] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaBNSILiR0OfjFxvcN8xnwAAANI"]
[Thu Feb 26 21:40:25.052220 2026] [:error] [pid 54990:tid 55001] [client 4.204.195.211:62800] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aaBNSXtr2qmt_mBhH2wrCQAAAAg"]
[Thu Feb 26 21:40:25.475148 2026] [:error] [pid 20419:tid 20437] [client 4.204.195.211:60175] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aaBNSe3DVDvMfTYYUBVbewAAAc8"]
[Thu Feb 26 21:40:25.909222 2026] [:error] [pid 55122:tid 55140] [client 4.204.195.211:60257] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aaBNSYLiR0OfjFxvcN8xoQAAANA"]
[Thu Feb 26 21:40:26.366298 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:61672] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aaBNSm2sMNmj-yekUk0uQgAAAgo"]
[Thu Feb 26 21:40:26.790609 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:62111] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaBNSm2sMNmj-yekUk0uRAAAAgM"]
[Thu Feb 26 21:40:27.209841 2026] [:error] [pid 3883:tid 3888] [client 4.204.195.211:61634] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaBNS-A33x90V6yYHajulQAAAUI"]
[Thu Feb 26 21:40:27.722706 2026] [:error] [pid 20419:tid 20441] [client 4.204.195.211:62185] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaBNS-3DVDvMfTYYUBVbfgAAAdM"]
[Thu Feb 26 21:40:28.140471 2026] [:error] [pid 20419:tid 20428] [client 4.204.195.211:62773] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaBNTO3DVDvMfTYYUBVbfwAAAcY"]
[Thu Feb 26 21:40:28.571488 2026] [:error] [pid 25311:tid 25323] [client 4.204.195.211:63412] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaBNTNfdM__yZAgJFSvlBAAAAYk"]
[Thu Feb 26 21:40:29.018284 2026] [:error] [pid 3883:tid 3890] [client 4.204.195.211:62095] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaBNTeA33x90V6yYHajulgAAAUQ"]
[Thu Feb 26 21:40:29.432472 2026] [:error] [pid 3883:tid 3909] [client 4.204.195.211:62814] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaBNTeA33x90V6yYHajulwAAAVc"]
[Thu Feb 26 21:40:29.861095 2026] [:error] [pid 20419:tid 20443] [client 4.204.195.211:63465] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaBNTe3DVDvMfTYYUBVbgQAAAdU"]
[Thu Feb 26 21:40:30.282915 2026] [:error] [pid 20419:tid 20430] [client 4.204.195.211:62131] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aaBNTu3DVDvMfTYYUBVbggAAAcg"]
[Thu Feb 26 21:40:30.699637 2026] [:error] [pid 3883:tid 3894] [client 4.204.195.211:63389] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aaBNTuA33x90V6yYHajumQAAAUg"]
[Thu Feb 26 21:40:31.127801 2026] [:error] [pid 3883:tid 3907] [client 4.204.195.211:64806] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aaBNT-A33x90V6yYHajumgAAAVU"]
[Thu Feb 26 21:40:31.561377 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:62095] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aaBNT22sMNmj-yekUk0uVQAAAgo"]
[Thu Feb 26 21:40:32.002777 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:64824] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aaBNUG2sMNmj-yekUk0uWAAAAhU"]
[Thu Feb 26 21:40:32.421999 2026] [:error] [pid 55618:tid 55637] [client 4.204.195.211:64812] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aaBNUB61Vrh12f_8oWQO9QAAARA"]
[Thu Feb 26 21:40:32.834515 2026] [:error] [pid 55618:tid 55643] [client 4.204.195.211:62114] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aaBNUB61Vrh12f_8oWQO9gAAARY"]
[Thu Feb 26 21:40:33.271865 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:62183] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "aaBNUQmK1w2kZvh5eLG36AAAAJA"]
[Thu Feb 26 21:40:33.698110 2026] [:error] [pid 55051:tid 55073] [client 4.204.195.211:61676] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aaBNUQmK1w2kZvh5eLG36QAAAJM"]
[Thu Feb 26 21:40:34.158413 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:62797] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aaBNUgmK1w2kZvh5eLG36wAAAIM"]
[Thu Feb 26 21:40:34.572124 2026] [:error] [pid 3883:tid 3897] [client 4.204.195.211:61671] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aaBNUuA33x90V6yYHajunAAAAUs"]
[Thu Feb 26 21:40:34.985233 2026] [:error] [pid 25311:tid 25322] [client 4.204.195.211:61632] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aaBNUtfdM__yZAgJFSvlCwAAAYg"]
[Thu Feb 26 21:40:35.410336 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:61684] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aaBNUwmK1w2kZvh5eLG37AAAAIQ"]
[Thu Feb 26 21:40:35.824635 2026] [:error] [pid 3883:tid 3904] [client 4.204.195.211:62806] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aaBNU-A33x90V6yYHajuoAAAAVI"]
[Thu Feb 26 21:40:36.246938 2026] [:error] [pid 55122:tid 55134] [client 4.204.195.211:61654] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aaBNVILiR0OfjFxvcN8xpQAAAMo"]
[Thu Feb 26 21:40:36.661780 2026] [:error] [pid 20419:tid 20422] [client 4.204.195.211:61602] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "aaBNVO3DVDvMfTYYUBVbhwAAAcA"]
[Thu Feb 26 21:40:37.077860 2026] [:error] [pid 3883:tid 3903] [client 4.204.195.211:63481] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aaBNVeA33x90V6yYHajuowAAAVE"]
[Thu Feb 26 21:40:37.577950 2026] [:error] [pid 25311:tid 25315] [client 4.204.195.211:62825] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aaBNVdfdM__yZAgJFSvlDQAAAYE"]
[Thu Feb 26 21:40:37.995854 2026] [:error] [pid 20419:tid 20444] [client 4.204.195.211:62804] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aaBNVe3DVDvMfTYYUBVbigAAAdY"]
[Thu Feb 26 21:40:38.430531 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:64882] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aaBNVm2sMNmj-yekUk0uaQAAAgo"]
[Thu Feb 26 21:40:38.843098 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:65492] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aaBNVm2sMNmj-yekUk0ubQAAAhU"]
[Thu Feb 26 21:40:39.262234 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:62835] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aaBNV22sMNmj-yekUk0ucAAAAhc"]
[Thu Feb 26 21:40:39.693474 2026] [:error] [pid 55051:tid 55068] [client 4.204.195.211:65519] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aaBNVwmK1w2kZvh5eLG38QAAAI4"]
[Thu Feb 26 21:40:40.106556 2026] [:error] [pid 55051:tid 55065] [client 4.204.195.211:62837] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aaBNWAmK1w2kZvh5eLG39AAAAIs"]
[Thu Feb 26 21:40:40.595234 2026] [:error] [pid 44444:tid 44454] [client 4.204.195.211:61595] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aaBNWG2sMNmj-yekUk0udAAAAgQ"]
[Thu Feb 26 21:40:41.023003 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:64783] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aaBNWW2sMNmj-yekUk0udgAAAhM"]
[Thu Feb 26 21:40:41.440962 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:62096] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aaBNWW2sMNmj-yekUk0ueAAAAgY"]
[Thu Feb 26 21:40:41.861006 2026] [:error] [pid 55051:tid 55054] [client 4.204.195.211:62161] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lc.php"] [unique_id "aaBNWQmK1w2kZvh5eLG3-wAAAIA"]
[Thu Feb 26 21:40:42.280644 2026] [:error] [pid 25311:tid 25334] [client 4.204.195.211:62839] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aaBNWtfdM__yZAgJFSvlEwAAAZQ"]
[Thu Feb 26 21:40:42.703990 2026] [:error] [pid 3883:tid 3888] [client 4.204.195.211:64835] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aaBNWuA33x90V6yYHajuqAAAAUI"]
[Thu Feb 26 21:40:43.125108 2026] [:error] [pid 44444:tid 44473] [client 4.204.195.211:64793] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aaBNW22sMNmj-yekUk0ugAAAAhc"]
[Thu Feb 26 21:40:43.537372 2026] [:error] [pid 44444:tid 44454] [client 4.204.195.211:60181] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cbrfo.php"] [unique_id "aaBNW22sMNmj-yekUk0uhQAAAgQ"]
[Thu Feb 26 21:40:43.955861 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:63440] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aaBNW22sMNmj-yekUk0uiQAAAhI"]
[Thu Feb 26 21:40:44.365008 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:62112] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aaBNXG2sMNmj-yekUk0ujAAAAgc"]
[Thu Feb 26 21:40:44.783257 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:63413] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aaBNXO3DVDvMfTYYUBVblAAAAcc"]
[Thu Feb 26 21:40:45.198812 2026] [:error] [pid 20419:tid 20425] [client 4.204.195.211:62110] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inc.php"] [unique_id "aaBNXe3DVDvMfTYYUBVblgAAAcM"]
[Thu Feb 26 21:40:45.611858 2026] [:error] [pid 55618:tid 55631] [client 4.204.195.211:62744] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aaBNXR61Vrh12f_8oWQO_gAAAQo"]
[Thu Feb 26 21:40:46.036699 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:60255] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aaBNXm2sMNmj-yekUk0umwAAAgo"]
[Thu Feb 26 21:40:46.462404 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:61610] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aaBNXm2sMNmj-yekUk0ungAAAgI"]
[Thu Feb 26 21:40:46.885822 2026] [:error] [pid 44444:tid 44466] [client 4.204.195.211:63470] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aaBNXm2sMNmj-yekUk0uogAAAhA"]
[Thu Feb 26 21:40:47.308401 2026] [:error] [pid 44444:tid 44450] [client 4.204.195.211:62782] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aaBNX22sMNmj-yekUk0upQAAAgA"]
[Thu Feb 26 21:40:47.729440 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:64783] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aaBNX22sMNmj-yekUk0uqgAAAgU"]
[Thu Feb 26 21:40:48.151107 2026] [:error] [pid 44444:tid 44466] [client 4.204.195.211:63392] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aaBNYG2sMNmj-yekUk0usAAAAhA"]
[Thu Feb 26 21:40:48.562001 2026] [:error] [pid 44444:tid 44455] [client 4.204.195.211:62776] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/miansha.php"] [unique_id "aaBNYG2sMNmj-yekUk0utgAAAgU"]
[Thu Feb 26 21:40:48.985804 2026] [:error] [pid 55051:tid 55056] [client 4.204.195.211:61630] [client 4.204.195.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aaBNYAmK1w2kZvh5eLG4AAAAAII"]
[Thu Feb 26 21:40:49.395540 2026] [:error] [pid 54991:tid 55026] [client 4.204.195.211:63401] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaBNYd4Zx-mJ8gbRB2juzwAAAEY"]
[Thu Feb 26 21:40:49.808127 2026] [:error] [pid 55051:tid 55075] [client 4.204.195.211:62106] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaBNYQmK1w2kZvh5eLG4BAAAAJU"]
[Thu Feb 26 21:40:50.229891 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:61655] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaBNYgmK1w2kZvh5eLG4CQAAAIM"]
[Thu Feb 26 21:40:50.644971 2026] [:error] [pid 20419:tid 20430] [client 4.204.195.211:64877] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aaBNYu3DVDvMfTYYUBVboQAAAcg"]
[Thu Feb 26 21:40:51.074089 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:63365] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aaBNY22sMNmj-yekUk0uwQAAAhQ"]
[Thu Feb 26 21:40:51.483038 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:62188] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aaBNY-3DVDvMfTYYUBVbpQAAAcc"]
[Thu Feb 26 21:40:51.897600 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:62207] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aaBNY22sMNmj-yekUk0uyAAAAgo"]
[Thu Feb 26 21:40:52.310618 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:65517] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aaBNZG2sMNmj-yekUk0uzAAAAg8"]
[Thu Feb 26 21:40:52.731759 2026] [:error] [pid 44444:tid 44463] [client 4.204.195.211:63405] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aaBNZG2sMNmj-yekUk0u0wAAAg0"]
[Thu Feb 26 21:40:53.159262 2026] [:error] [pid 55051:tid 55061] [client 4.204.195.211:62772] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aaBNZQmK1w2kZvh5eLG4GwAAAIc"]
[Thu Feb 26 21:40:53.580185 2026] [:error] [pid 54991:tid 55030] [client 4.204.195.211:65516] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/muzu.php"] [unique_id "aaBNZd4Zx-mJ8gbRB2ju0AAAAEo"]
[Thu Feb 26 21:40:54.000943 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:60262] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aaBNZu3DVDvMfTYYUBVbqwAAAc0"]
[Thu Feb 26 21:40:54.453641 2026] [:error] [pid 25311:tid 25315] [client 4.204.195.211:62726] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aaBNZtfdM__yZAgJFSvlIAAAAYE"]
[Thu Feb 26 21:40:54.869846 2026] [:error] [pid 54991:tid 55044] [client 4.204.195.211:61664] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aaBNZt4Zx-mJ8gbRB2ju1AAAAFg"]
[Thu Feb 26 21:40:55.290918 2026] [:error] [pid 55051:tid 55077] [client 4.204.195.211:63390] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "aaBNZwmK1w2kZvh5eLG4IwAAAJc"]
[Thu Feb 26 21:40:55.706215 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:65493] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aaBNZwmK1w2kZvh5eLG4JAAAAJg"]
[Thu Feb 26 21:40:56.120639 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:63449] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aaBNaG2sMNmj-yekUk0u3QAAAhQ"]
[Thu Feb 26 21:40:56.533136 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:61635] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aaBNaG2sMNmj-yekUk0u4QAAAgM"]
[Thu Feb 26 21:40:56.951493 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:65449] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/styll.php"] [unique_id "aaBNaG2sMNmj-yekUk0u5QAAAgo"]
[Thu Feb 26 21:40:57.374911 2026] [:error] [pid 55051:tid 55070] [client 4.204.195.211:62145] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aaBNaQmK1w2kZvh5eLG4KQAAAJA"]
[Thu Feb 26 21:40:57.786808 2026] [:error] [pid 54991:tid 55032] [client 4.204.195.211:65432] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aaBNad4Zx-mJ8gbRB2ju3QAAAEw"]
[Thu Feb 26 21:40:58.199313 2026] [:error] [pid 20419:tid 20446] [client 4.204.195.211:61674] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aaBNau3DVDvMfTYYUBVbsAAAAdg"]
[Thu Feb 26 21:40:58.611859 2026] [:error] [pid 55618:tid 55642] [client 4.204.195.211:65455] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x7.php"] [unique_id "aaBNah61Vrh12f_8oWQPBgAAARU"]
[Thu Feb 26 21:40:59.023484 2026] [:error] [pid 55618:tid 55633] [client 4.204.195.211:62753] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aaBNax61Vrh12f_8oWQPCAAAAQw"]
[Thu Feb 26 21:40:59.470256 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:62756] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aaBNa-3DVDvMfTYYUBVbtgAAAcc"]
[Thu Feb 26 21:40:59.880742 2026] [:error] [pid 20419:tid 20428] [client 4.204.195.211:62205] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aaBNa-3DVDvMfTYYUBVbugAAAcY"]
[Thu Feb 26 21:41:00.294613 2026] [:error] [pid 20419:tid 20436] [client 4.204.195.211:62130] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/thebe.php"] [unique_id "aaBNbO3DVDvMfTYYUBVbvAAAAc4"]
[Thu Feb 26 21:41:00.705468 2026] [:error] [pid 20419:tid 20439] [client 4.204.195.211:62176] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aaBNbO3DVDvMfTYYUBVbvwAAAdE"]
[Thu Feb 26 21:41:01.117643 2026] [:error] [pid 25311:tid 25331] [client 4.204.195.211:64889] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aaBNbdfdM__yZAgJFSvlJgAAAZE"]
[Thu Feb 26 21:41:01.533242 2026] [:error] [pid 55051:tid 55061] [client 4.204.195.211:64830] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aaBNbQmK1w2kZvh5eLG4PwAAAIc"]
[Thu Feb 26 21:41:01.943586 2026] [:error] [pid 20419:tid 20446] [client 4.204.195.211:63428] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddd.php"] [unique_id "aaBNbe3DVDvMfTYYUBVbwAAAAdg"]
[Thu Feb 26 21:41:02.360089 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:64875] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aaBNbm2sMNmj-yekUk0u9QAAAgc"]
[Thu Feb 26 21:41:02.776919 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:62083] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aaBNbgmK1w2kZvh5eLG4SQAAAIM"]
[Thu Feb 26 21:41:03.189414 2026] [:error] [pid 54991:tid 55034] [client 4.204.195.211:62770] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aaBNb94Zx-mJ8gbRB2ju5QAAAE4"]
[Thu Feb 26 21:41:03.661956 2026] [:error] [pid 54991:tid 55021] [client 4.204.195.211:62755] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aaBNb94Zx-mJ8gbRB2ju5gAAAEE"]
[Thu Feb 26 21:41:04.080814 2026] [:error] [pid 54991:tid 55040] [client 4.204.195.211:64887] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNcN4Zx-mJ8gbRB2ju6gAAAFQ"]
[Thu Feb 26 21:41:04.494429 2026] [:error] [pid 3883:tid 3906] [client 4.204.195.211:65487] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNcOA33x90V6yYHajurAAAAVQ"]
[Thu Feb 26 21:41:04.906101 2026] [:error] [pid 54991:tid 55030] [client 4.204.195.211:62142] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNcN4Zx-mJ8gbRB2ju7wAAAEo"]
[Thu Feb 26 21:41:05.315016 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:61693] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaBNcd4Zx-mJ8gbRB2ju8QAAAEs"]
[Thu Feb 26 21:41:05.744183 2026] [:error] [pid 54991:tid 55023] [client 4.204.195.211:65434] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "aaBNcd4Zx-mJ8gbRB2ju9AAAAEM"]
[Thu Feb 26 21:41:06.156223 2026] [:error] [pid 54991:tid 55044] [client 4.204.195.211:60263] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "aaBNct4Zx-mJ8gbRB2ju9QAAAFg"]
[Thu Feb 26 21:41:06.571344 2026] [:error] [pid 44444:tid 44463] [client 4.204.195.211:64862] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "aaBNcm2sMNmj-yekUk0u-wAAAg0"]
[Thu Feb 26 21:41:06.992480 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:65482] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "aaBNcm2sMNmj-yekUk0u_wAAAgM"]
[Thu Feb 26 21:41:07.410598 2026] [:error] [pid 55051:tid 55056] [client 4.204.195.211:64795] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aaBNcwmK1w2kZvh5eLG4YwAAAII"]
[Thu Feb 26 21:41:07.828895 2026] [:error] [pid 55051:tid 55065] [client 4.204.195.211:62799] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aaBNcwmK1w2kZvh5eLG4ZQAAAIs"]
[Thu Feb 26 21:41:08.243888 2026] [:error] [pid 3883:tid 3895] [client 4.204.195.211:60213] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aaBNdOA33x90V6yYHajurwAAAUk"]
[Thu Feb 26 21:41:08.660265 2026] [:error] [pid 54991:tid 55042] [client 4.204.195.211:64880] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "aaBNdN4Zx-mJ8gbRB2ju-QAAAFY"]
[Thu Feb 26 21:41:09.076716 2026] [:error] [pid 3883:tid 3904] [client 4.204.195.211:64855] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBNdeA33x90V6yYHajuswAAAVI"]
[Thu Feb 26 21:41:09.495600 2026] [:error] [pid 54991:tid 55032] [client 4.204.195.211:62834] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBNdd4Zx-mJ8gbRB2ju_QAAAEw"]
[Thu Feb 26 21:41:09.923488 2026] [:error] [pid 55051:tid 55064] [client 4.204.195.211:64769] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBNdQmK1w2kZvh5eLG4cQAAAIo"]
[Thu Feb 26 21:41:10.339887 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:65526] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aaBNdu3DVDvMfTYYUBVbwgAAAcc"]
[Thu Feb 26 21:41:10.752967 2026] [:error] [pid 20419:tid 20425] [client 4.204.195.211:63418] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aaBNdu3DVDvMfTYYUBVbwwAAAcM"]
[Thu Feb 26 21:41:11.165251 2026] [:error] [pid 55051:tid 55073] [client 4.204.195.211:62141] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aaBNdwmK1w2kZvh5eLG4gwAAAJM"]
[Thu Feb 26 21:41:11.578247 2026] [:error] [pid 55051:tid 55057] [client 4.204.195.211:60219] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aaBNdwmK1w2kZvh5eLG4hgAAAIM"]
[Thu Feb 26 21:41:12.015605 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:60161] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/commentv.php"] [unique_id "aaBNeAmK1w2kZvh5eLG4hwAAAJg"]
[Thu Feb 26 21:41:12.434854 2026] [:error] [pid 55051:tid 55065] [client 4.204.195.211:62734] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBNeAmK1w2kZvh5eLG4jQAAAIs"]
[Thu Feb 26 21:41:12.852868 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:62833] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBNeO3DVDvMfTYYUBVbyAAAAc0"]
[Thu Feb 26 21:41:13.263988 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:60203] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBNeW2sMNmj-yekUk0vCQAAAgI"]
[Thu Feb 26 21:41:13.674605 2026] [:error] [pid 44444:tid 44466] [client 4.204.195.211:61633] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aaBNeW2sMNmj-yekUk0vCwAAAhA"]
[Thu Feb 26 21:41:14.513131 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:62202] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Feb 26 21:41:14.722749 2026] [:error] [pid 44444:tid 44463] [client 4.204.195.211:62202] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Feb 26 21:41:15.148766 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:62202] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Thu Feb 26 21:41:15.367738 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:62202] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Feb 26 21:41:15.786025 2026] [:error] [pid 44444:tid 44462] [client 4.204.195.211:62202] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Feb 26 21:41:16.216895 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:62202] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php
[Thu Feb 26 21:41:16.425582 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:62202] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aaBNfG2sMNmj-yekUk0vGwAAAgc"]
[Thu Feb 26 21:41:16.838145 2026] [:error] [pid 55051:tid 55077] [client 4.204.195.211:62184] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aaBNfAmK1w2kZvh5eLG4mQAAAJc"]
[Thu Feb 26 21:41:17.254969 2026] [:error] [pid 54991:tid 55020] [client 4.204.195.211:61587] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aaBNfd4Zx-mJ8gbRB2jvDwAAAEA"]
[Thu Feb 26 21:41:17.679818 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:62829] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "aaBNfd4Zx-mJ8gbRB2jvEAAAAEs"]
[Thu Feb 26 21:41:18.093428 2026] [:error] [pid 54991:tid 55039] [client 4.204.195.211:61644] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aaBNft4Zx-mJ8gbRB2jvFAAAAFM"]
[Thu Feb 26 21:41:18.506431 2026] [:error] [pid 54991:tid 55028] [client 4.204.195.211:62836] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aaBNft4Zx-mJ8gbRB2jvFwAAAEg"]
[Thu Feb 26 21:41:18.920833 2026] [:error] [pid 25311:tid 25320] [client 4.204.195.211:62181] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aaBNftfdM__yZAgJFSvlOQAAAYY"]
[Thu Feb 26 21:41:19.339095 2026] [:error] [pid 55051:tid 55074] [client 4.204.195.211:60229] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aaBNfwmK1w2kZvh5eLG4mwAAAJQ"]
[Thu Feb 26 21:41:19.753558 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:60233] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaBNfwmK1w2kZvh5eLG4nAAAAIQ"]
[Thu Feb 26 21:41:20.178771 2026] [:error] [pid 55051:tid 55067] [client 4.204.195.211:65465] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaBNgAmK1w2kZvh5eLG4nQAAAI0"]
[Thu Feb 26 21:41:20.590978 2026] [:error] [pid 25311:tid 25314] [client 4.204.195.211:61658] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaBNgNfdM__yZAgJFSvlOgAAAYA"]
[Thu Feb 26 21:41:21.008913 2026] [:error] [pid 3883:tid 3910] [client 4.204.195.211:64776] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaBNgeA33x90V6yYHajutQAAAVg"]
[Thu Feb 26 21:41:21.426347 2026] [:error] [pid 3883:tid 3903] [client 4.204.195.211:63402] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaBNgeA33x90V6yYHajutgAAAVE"]
[Thu Feb 26 21:41:21.835551 2026] [:error] [pid 20419:tid 20433] [client 4.204.195.211:61604] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaBNge3DVDvMfTYYUBVbzAAAAcs"]
[Thu Feb 26 21:41:22.244097 2026] [:error] [pid 25311:tid 25334] [client 4.204.195.211:62168] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaBNgtfdM__yZAgJFSvlPQAAAZQ"]
[Thu Feb 26 21:41:22.667166 2026] [:error] [pid 55051:tid 55055] [client 4.204.195.211:64858] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/"] [unique_id "aaBNggmK1w2kZvh5eLG4nwAAAIE"]
[Thu Feb 26 21:41:23.125702 2026] [:error] [pid 3883:tid 3888] [client 4.204.195.211:62815] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaBNg-A33x90V6yYHajuugAAAUI"]
[Thu Feb 26 21:41:23.543890 2026] [:error] [pid 54991:tid 55024] [client 4.204.195.211:61639] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaBNg94Zx-mJ8gbRB2jvHgAAAEQ"]
[Thu Feb 26 21:41:23.953651 2026] [:error] [pid 3883:tid 3909] [client 4.204.195.211:59621] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaBNg-A33x90V6yYHajuvQAAAVc"]
[Thu Feb 26 21:41:24.376124 2026] [:error] [pid 55051:tid 55056] [client 4.204.195.211:62105] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aaBNhAmK1w2kZvh5eLG4ogAAAII"]
[Thu Feb 26 21:41:24.789274 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:62137] [client 4.204.195.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaBNhG2sMNmj-yekUk0vIAAAAgk"]
[Thu Feb 26 21:41:25.202230 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:62809] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aaBNhW2sMNmj-yekUk0vIgAAAhM"]
[Thu Feb 26 21:41:25.621726 2026] [:error] [pid 25311:tid 25316] [client 4.204.195.211:62787] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aaBNhdfdM__yZAgJFSvlQAAAAYI"]
[Thu Feb 26 21:41:26.043402 2026] [:error] [pid 54991:tid 55030] [client 4.204.195.211:61625] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "aaBNht4Zx-mJ8gbRB2jvIwAAAEo"]
[Thu Feb 26 21:41:26.505983 2026] [:error] [pid 54991:tid 55026] [client 4.204.195.211:60246] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jane.php"] [unique_id "aaBNht4Zx-mJ8gbRB2jvJAAAAEY"]
[Thu Feb 26 21:41:26.919234 2026] [:error] [pid 25311:tid 25319] [client 4.204.195.211:61669] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jane.php"] [unique_id "aaBNhtfdM__yZAgJFSvlQwAAAYU"]
[Thu Feb 26 21:41:27.346566 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:62189] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jane.php"] [unique_id "aaBNh22sMNmj-yekUk0vJgAAAgM"]
[Thu Feb 26 21:41:27.764045 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:60223] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jane.php"] [unique_id "aaBNh94Zx-mJ8gbRB2jvJQAAAEs"]
[Thu Feb 26 21:41:28.178102 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:60211] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aaBNiG2sMNmj-yekUk0vKAAAAhY"]
[Thu Feb 26 21:41:28.648105 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:60192] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aaBNiG2sMNmj-yekUk0vKgAAAgo"]
[Thu Feb 26 21:41:29.062808 2026] [:error] [pid 54991:tid 55038] [client 4.204.195.211:65417] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aaBNid4Zx-mJ8gbRB2jvJgAAAFI"]
[Thu Feb 26 21:41:29.478282 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:64849] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "aaBNiW2sMNmj-yekUk0vLQAAAgY"]
[Thu Feb 26 21:41:29.890545 2026] [:error] [pid 54991:tid 55022] [client 4.204.195.211:65525] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBNid4Zx-mJ8gbRB2jvKQAAAEI"]
[Thu Feb 26 21:41:30.307685 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:65454] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBNim2sMNmj-yekUk0vNQAAAhM"]
[Thu Feb 26 21:41:30.728725 2026] [:error] [pid 54991:tid 55042] [client 4.204.195.211:62766] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBNit4Zx-mJ8gbRB2jvKwAAAFY"]
[Thu Feb 26 21:41:31.145046 2026] [:error] [pid 54991:tid 55037] [client 4.204.195.211:61581] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaBNi94Zx-mJ8gbRB2jvLAAAAFE"]
[Thu Feb 26 21:41:31.567192 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:60186] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBNi22sMNmj-yekUk0vPQAAAhg"]
[Thu Feb 26 21:41:31.980747 2026] [:error] [pid 54991:tid 55041] [client 4.204.195.211:59537] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBNi94Zx-mJ8gbRB2jvMAAAAFU"]
[Thu Feb 26 21:41:32.438930 2026] [:error] [pid 44444:tid 44464] [client 4.204.195.211:61570] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBNjG2sMNmj-yekUk0vQAAAAg4"]
[Thu Feb 26 21:41:32.851556 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:64860] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aaBNjG2sMNmj-yekUk0vQgAAAgE"]
[Thu Feb 26 21:41:33.271178 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:65456] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aaBNjW2sMNmj-yekUk0vRAAAAgg"]
[Thu Feb 26 21:41:33.761206 2026] [:error] [pid 3883:tid 3889] [client 4.204.195.211:61657] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aaBNjeA33x90V6yYHajuvgAAAUM"]
[Thu Feb 26 21:41:34.176736 2026] [:error] [pid 55051:tid 55074] [client 4.204.195.211:62092] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aaBNjgmK1w2kZvh5eLG4pgAAAJQ"]
[Thu Feb 26 21:41:34.595212 2026] [:error] [pid 54991:tid 55029] [client 4.204.195.211:62116] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxxx.php"] [unique_id "aaBNjt4Zx-mJ8gbRB2jvNgAAAEk"]
[Thu Feb 26 21:41:35.012492 2026] [:error] [pid 54991:tid 55021] [client 4.204.195.211:61657] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aaBNj94Zx-mJ8gbRB2jvOQAAAEE"]
[Thu Feb 26 21:41:35.430729 2026] [:error] [pid 55051:tid 55061] [client 4.204.195.211:64893] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aaBNjwmK1w2kZvh5eLG4qAAAAIc"]
[Thu Feb 26 21:41:35.857177 2026] [:error] [pid 54991:tid 55027] [client 4.204.195.211:61643] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aaBNj94Zx-mJ8gbRB2jvPQAAAEc"]
[Thu Feb 26 21:41:36.266078 2026] [:error] [pid 3883:tid 3898] [client 4.204.195.211:62143] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "aaBNkOA33x90V6yYHajuvwAAAUw"]
[Thu Feb 26 21:41:36.723308 2026] [:error] [pid 54991:tid 55037] [client 4.204.195.211:62126] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aaBNkN4Zx-mJ8gbRB2jvPgAAAFE"]
[Thu Feb 26 21:41:37.142123 2026] [:error] [pid 55051:tid 55063] [client 4.204.195.211:65497] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aaBNkQmK1w2kZvh5eLG4qgAAAIk"]
[Thu Feb 26 21:41:37.553120 2026] [:error] [pid 55051:tid 55072] [client 4.204.195.211:61638] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aaBNkQmK1w2kZvh5eLG4qwAAAJI"]
[Thu Feb 26 21:41:38.012628 2026] [:error] [pid 54991:tid 55021] [client 4.204.195.211:62720] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aaBNkt4Zx-mJ8gbRB2jvRwAAAEE"]
[Thu Feb 26 21:41:38.434656 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:61691] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aaBNkm2sMNmj-yekUk0vUgAAAgk"]
[Thu Feb 26 21:41:38.864109 2026] [:error] [pid 55051:tid 55055] [client 4.204.195.211:61648] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aaBNkgmK1w2kZvh5eLG4rAAAAIE"]
[Thu Feb 26 21:41:39.281721 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:64803] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aaBNk22sMNmj-yekUk0vVgAAAgY"]
[Thu Feb 26 21:41:39.696814 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:62088] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aaBNk22sMNmj-yekUk0vWQAAAhI"]
[Thu Feb 26 21:41:40.108557 2026] [:error] [pid 20419:tid 20422] [client 4.204.195.211:61670] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aaBNlO3DVDvMfTYYUBVb0wAAAcA"]
[Thu Feb 26 21:41:40.522351 2026] [:error] [pid 54991:tid 55026] [client 4.204.195.211:62097] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aaBNlN4Zx-mJ8gbRB2jvUQAAAEY"]
[Thu Feb 26 21:41:40.935683 2026] [:error] [pid 55051:tid 55078] [client 4.204.195.211:64853] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aaBNlAmK1w2kZvh5eLG4sAAAAJg"]
[Thu Feb 26 21:41:41.354112 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:64817] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aaBNlW2sMNmj-yekUk0vbQAAAhQ"]
[Thu Feb 26 21:41:41.770562 2026] [:error] [pid 44444:tid 44474] [client 4.204.195.211:62822] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaBNlW2sMNmj-yekUk0vcQAAAhg"]
[Thu Feb 26 21:41:42.189484 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:61640] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaBNlm2sMNmj-yekUk0vcgAAAg8"]
[Thu Feb 26 21:41:42.604228 2026] [:error] [pid 44444:tid 44459] [client 4.204.195.211:64868] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaBNlm2sMNmj-yekUk0vdAAAAgk"]
[Thu Feb 26 21:41:43.014592 2026] [:error] [pid 55051:tid 55054] [client 4.204.195.211:63445] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaBNlwmK1w2kZvh5eLG4tgAAAIA"]
[Thu Feb 26 21:41:43.427890 2026] [:error] [pid 55051:tid 55076] [client 4.204.195.211:61574] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aaBNlwmK1w2kZvh5eLG4twAAAJY"]
[Thu Feb 26 21:41:43.839743 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:62828] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aaBNl22sMNmj-yekUk0veQAAAgg"]
[Thu Feb 26 21:41:44.270721 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:64794] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aaBNmG2sMNmj-yekUk0vegAAAgY"]
[Thu Feb 26 21:41:44.683220 2026] [:error] [pid 44444:tid 44468] [client 4.204.195.211:62149] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aaBNmG2sMNmj-yekUk0vfAAAAhI"]
[Thu Feb 26 21:41:45.092330 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:63477] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaBNmW2sMNmj-yekUk0vfwAAAgE"]
[Thu Feb 26 21:41:45.503135 2026] [:error] [pid 54991:tid 55022] [client 4.204.195.211:65441] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaBNmd4Zx-mJ8gbRB2jvVgAAAEI"]
[Thu Feb 26 21:41:45.912200 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:60196] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaBNmW2sMNmj-yekUk0vgwAAAgc"]
[Thu Feb 26 21:41:46.425107 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:62120] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aaBNmm2sMNmj-yekUk0vhAAAAgg"]
[Thu Feb 26 21:41:46.841595 2026] [:error] [pid 20419:tid 20424] [client 4.204.195.211:60238] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaBNmu3DVDvMfTYYUBVb4AAAAcI"]
[Thu Feb 26 21:41:47.251859 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:61589] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaBNm22sMNmj-yekUk0vhwAAAhM"]
[Thu Feb 26 21:41:47.662791 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:65469] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaBNm22sMNmj-yekUk0viQAAAgo"]
[Thu Feb 26 21:41:48.072650 2026] [:error] [pid 44444:tid 44465] [client 4.204.195.211:62172] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaBNnG2sMNmj-yekUk0viwAAAg8"]
[Thu Feb 26 21:41:48.526181 2026] [:error] [pid 3883:tid 3910] [client 4.204.195.211:65431] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaBNnOA33x90V6yYHajuxQAAAVg"]
[Thu Feb 26 21:41:48.938079 2026] [:error] [pid 3883:tid 3903] [client 4.204.195.211:63360] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaBNnOA33x90V6yYHajuxgAAAVE"]
[Thu Feb 26 21:41:49.354027 2026] [:error] [pid 3883:tid 3900] [client 4.204.195.211:61582] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaBNneA33x90V6yYHajuxwAAAU4"]
[Thu Feb 26 21:41:49.767376 2026] [:error] [pid 55618:tid 55621] [client 4.204.195.211:60185] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaBNnR61Vrh12f_8oWQPJAAAAQA"]
[Thu Feb 26 21:41:50.178945 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:60172] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaBNnm2sMNmj-yekUk0vjwAAAhQ"]
[Thu Feb 26 21:41:50.591332 2026] [:error] [pid 54991:tid 55037] [client 4.204.195.211:59639] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaBNnt4Zx-mJ8gbRB2jvXwAAAFE"]
[Thu Feb 26 21:41:51.008528 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:61579] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaBNn94Zx-mJ8gbRB2jvYAAAAEs"]
[Thu Feb 26 21:41:51.439211 2026] [:error] [pid 54991:tid 55025] [client 4.204.195.211:60231] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaBNn94Zx-mJ8gbRB2jvYQAAAEU"]
[Thu Feb 26 21:41:51.856131 2026] [:error] [pid 20419:tid 20425] [client 4.204.195.211:64819] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaBNn-3DVDvMfTYYUBVb4wAAAcM"]
[Thu Feb 26 21:41:52.267033 2026] [:error] [pid 54991:tid 55022] [client 4.204.195.211:59639] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaBNoN4Zx-mJ8gbRB2jvZQAAAEI"]
[Thu Feb 26 21:41:52.680699 2026] [:error] [pid 20419:tid 20432] [client 4.204.195.211:63436] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaBNoO3DVDvMfTYYUBVb5AAAAco"]
[Thu Feb 26 21:41:53.096819 2026] [:error] [pid 54991:tid 55040] [client 4.204.195.211:60207] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaBNod4Zx-mJ8gbRB2jvZwAAAFQ"]
[Thu Feb 26 21:41:53.527587 2026] [:error] [pid 44444:tid 44461] [client 4.204.195.211:64870] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaBNoW2sMNmj-yekUk0vkwAAAgs"]
[Thu Feb 26 21:41:53.958871 2026] [:error] [pid 55051:tid 55060] [client 4.204.195.211:65477] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaBNoQmK1w2kZvh5eLG4vwAAAIY"]
[Thu Feb 26 21:41:54.395443 2026] [:error] [pid 54991:tid 55020] [client 4.204.195.211:65459] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaBNot4Zx-mJ8gbRB2jvaQAAAEA"]
[Thu Feb 26 21:41:54.825977 2026] [:error] [pid 44444:tid 44471] [client 4.204.195.211:62190] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaBNom2sMNmj-yekUk0vlgAAAhU"]
[Thu Feb 26 21:41:55.243040 2026] [:error] [pid 44444:tid 44450] [client 4.204.195.211:61645] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaBNo22sMNmj-yekUk0vlwAAAgA"]
[Thu Feb 26 21:41:55.710021 2026] [:error] [pid 44444:tid 44457] [client 4.204.195.211:62152] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaBNo22sMNmj-yekUk0vmQAAAgc"]
[Thu Feb 26 21:41:56.137924 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:59614] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaBNpAmK1w2kZvh5eLG4wwAAAIw"]
[Thu Feb 26 21:41:56.564636 2026] [:error] [pid 55051:tid 55058] [client 4.204.195.211:62738] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaBNpAmK1w2kZvh5eLG4xQAAAIQ"]
[Thu Feb 26 21:41:57.017040 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:59624] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaBNpd4Zx-mJ8gbRB2jvbgAAAEs"]
[Thu Feb 26 21:41:57.448588 2026] [:error] [pid 54991:tid 55032] [client 4.204.195.211:61660] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaBNpd4Zx-mJ8gbRB2jvcAAAAEw"]
[Thu Feb 26 21:41:57.888003 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:62830] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaBNpe3DVDvMfTYYUBVb5wAAAc0"]
[Thu Feb 26 21:41:58.306763 2026] [:error] [pid 54991:tid 55043] [client 4.204.195.211:62197] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aaBNpt4Zx-mJ8gbRB2jvcgAAAFc"]
[Thu Feb 26 21:41:58.752925 2026] [:error] [pid 55051:tid 55055] [client 4.204.195.211:64827] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aaBNpgmK1w2kZvh5eLG4ygAAAIE"]
[Thu Feb 26 21:41:59.167245 2026] [:error] [pid 55051:tid 55067] [client 4.204.195.211:63364] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aaBNpwmK1w2kZvh5eLG4ywAAAI0"]
[Thu Feb 26 21:41:59.597899 2026] [:error] [pid 55051:tid 55068] [client 4.204.195.211:61678] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aaBNpwmK1w2kZvh5eLG4zwAAAI4"]
[Thu Feb 26 21:42:00.030244 2026] [:error] [pid 44444:tid 44456] [client 4.204.195.211:62135] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aaBNqG2sMNmj-yekUk0vngAAAgY"]
[Thu Feb 26 21:42:00.450026 2026] [:error] [pid 44444:tid 44460] [client 4.204.195.211:63400] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aaBNqG2sMNmj-yekUk0voQAAAgo"]
[Thu Feb 26 21:42:00.953564 2026] [:error] [pid 44444:tid 44469] [client 4.204.195.211:63441] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aaBNqG2sMNmj-yekUk0vpAAAAhM"]
[Thu Feb 26 21:42:01.366857 2026] [:error] [pid 54991:tid 55039] [client 4.204.195.211:62182] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aaBNqd4Zx-mJ8gbRB2jveQAAAFM"]
[Thu Feb 26 21:42:01.782045 2026] [:error] [pid 54990:tid 55006] [client 4.204.195.211:62731] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aaBNqXtr2qmt_mBhH2wrFQAAAA0"]
[Thu Feb 26 21:42:02.202120 2026] [:error] [pid 20419:tid 20433] [client 4.204.195.211:60271] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aaBNqu3DVDvMfTYYUBVb6AAAAcs"]
[Thu Feb 26 21:42:02.708656 2026] [:error] [pid 25311:tid 25317] [client 4.204.195.211:64785] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aaBNqtfdM__yZAgJFSvlVwAAAYM"]
[Thu Feb 26 21:42:03.129517 2026] [:error] [pid 3883:tid 3889] [client 4.204.195.211:64808] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aaBNq-A33x90V6yYHajuzgAAAUM"]
[Thu Feb 26 21:42:03.544724 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:64842] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aaBNq22sMNmj-yekUk0vpwAAAgE"]
[Thu Feb 26 21:42:03.968587 2026] [:error] [pid 44444:tid 44467] [client 4.204.195.211:61690] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaBNq22sMNmj-yekUk0vqAAAAhE"]
[Thu Feb 26 21:42:04.393461 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:62754] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaBNrAmK1w2kZvh5eLG41QAAAIw"]
[Thu Feb 26 21:42:04.822882 2026] [:error] [pid 55051:tid 55074] [client 4.204.195.211:60187] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaBNrAmK1w2kZvh5eLG42gAAAJQ"]
[Thu Feb 26 21:42:05.260152 2026] [:error] [pid 55051:tid 55067] [client 4.204.195.211:60174] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaBNrQmK1w2kZvh5eLG43gAAAI0"]
[Thu Feb 26 21:42:05.672778 2026] [:error] [pid 20419:tid 20436] [client 4.204.195.211:65438] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aaBNre3DVDvMfTYYUBVb7QAAAc4"]
[Thu Feb 26 21:42:06.171560 2026] [:error] [pid 20419:tid 20443] [client 4.204.195.211:60166] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aaBNru3DVDvMfTYYUBVb7wAAAdU"]
[Thu Feb 26 21:42:06.592126 2026] [:error] [pid 54991:tid 55031] [client 4.204.195.211:64854] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aaBNrt4Zx-mJ8gbRB2jvfAAAAEs"]
[Thu Feb 26 21:42:07.020585 2026] [:error] [pid 20419:tid 20430] [client 4.204.195.211:65464] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aaBNr-3DVDvMfTYYUBVb8QAAAcg"]
[Thu Feb 26 21:42:07.435627 2026] [:error] [pid 44444:tid 44458] [client 4.204.195.211:62093] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaBNr22sMNmj-yekUk0vsgAAAgg"]
[Thu Feb 26 21:42:07.885314 2026] [:error] [pid 54991:tid 55029] [client 4.204.195.211:63425] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaBNr94Zx-mJ8gbRB2jvfgAAAEk"]
[Thu Feb 26 21:42:08.301463 2026] [:error] [pid 54991:tid 55021] [client 4.204.195.211:63458] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaBNsN4Zx-mJ8gbRB2jvfwAAAEE"]
[Thu Feb 26 21:42:08.719701 2026] [:error] [pid 44444:tid 44451] [client 4.204.195.211:65527] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaBNsG2sMNmj-yekUk0vtgAAAgE"]
[Thu Feb 26 21:42:09.204055 2026] [:error] [pid 54991:tid 55033] [client 4.204.195.211:61590] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aaBNsd4Zx-mJ8gbRB2jvhQAAAE0"]
[Thu Feb 26 21:42:09.618984 2026] [:error] [pid 54991:tid 55024] [client 4.204.195.211:64846] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aaBNsd4Zx-mJ8gbRB2jviwAAAEQ"]
[Thu Feb 26 21:42:10.060714 2026] [:error] [pid 44444:tid 44470] [client 4.204.195.211:63468] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aaBNsm2sMNmj-yekUk0vuAAAAhQ"]
[Thu Feb 26 21:42:10.500064 2026] [:error] [pid 54991:tid 55021] [client 4.204.195.211:63404] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admins.php"] [unique_id "aaBNst4Zx-mJ8gbRB2jvjgAAAEE"]
[Thu Feb 26 21:42:10.922634 2026] [:error] [pid 20419:tid 20429] [client 4.204.195.211:60261] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aaBNsu3DVDvMfTYYUBVb9QAAAcc"]
[Thu Feb 26 21:42:11.346562 2026] [:error] [pid 55618:tid 55624] [client 4.204.195.211:65471] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aaBNsx61Vrh12f_8oWQPKQAAAQM"]
[Thu Feb 26 21:42:11.794487 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:65428] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aaBNswmK1w2kZvh5eLG45gAAAIU"]
[Thu Feb 26 21:42:12.239148 2026] [:error] [pid 55051:tid 55066] [client 4.204.195.211:62783] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aaBNtAmK1w2kZvh5eLG46AAAAIw"]
[Thu Feb 26 21:42:12.665925 2026] [:error] [pid 55618:tid 55631] [client 4.204.195.211:63454] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaBNtB61Vrh12f_8oWQPKgAAAQo"]
[Thu Feb 26 21:42:13.100029 2026] [:error] [pid 44444:tid 44452] [client 4.204.195.211:64871] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaBNtW2sMNmj-yekUk0vuwAAAgI"]
[Thu Feb 26 21:42:13.526555 2026] [:error] [pid 3883:tid 3897] [client 4.204.195.211:64852] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaBNteA33x90V6yYHaju0QAAAUs"]
[Thu Feb 26 21:42:13.995158 2026] [:error] [pid 55618:tid 55632] [client 4.204.195.211:61581] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaBNtR61Vrh12f_8oWQPLgAAAQs"]
[Thu Feb 26 21:42:14.424405 2026] [:error] [pid 44444:tid 44472] [client 4.204.195.211:61641] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aaBNtm2sMNmj-yekUk0vvgAAAhY"]
[Thu Feb 26 21:42:14.882135 2026] [:error] [pid 44444:tid 44453] [client 4.204.195.211:63366] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aaBNtm2sMNmj-yekUk0vwwAAAgM"]
[Thu Feb 26 21:42:15.367244 2026] [:error] [pid 55051:tid 55071] [client 4.204.195.211:65463] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aaBNtwmK1w2kZvh5eLG47wAAAJE"]
[Thu Feb 26 21:42:15.826839 2026] [:error] [pid 55051:tid 55064] [client 4.204.195.211:63473] [client 4.204.195.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aaBNtwmK1w2kZvh5eLG48gAAAIo"]
[Thu Feb 26 21:42:16.286393 2026] [:error] [pid 55051:tid 55073] [client 4.204.195.211:65491] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Thu Feb 26 21:42:16.499873 2026] [:error] [pid 55051:tid 55054] [client 4.204.195.211:65491] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Thu Feb 26 21:42:16.709444 2026] [:error] [pid 55051:tid 55056] [client 4.204.195.211:65491] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Thu Feb 26 21:42:16.915867 2026] [:error] [pid 55051:tid 55059] [client 4.204.195.211:65491] [client 4.204.195.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaBNuAmK1w2kZvh5eLG4-QAAAIU"]
[Thu Feb 26 21:42:17.331834 2026] [:error] [pid 20419:tid 20428] [client 4.204.195.211:62811] File does not exist: /usr/local/apache/htdocs/suspended-page/jsond.php
[Thu Feb 26 21:42:17.542190 2026] [:error] [pid 20419:tid 20435] [client 4.204.195.211:62811] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Feb 26 21:45:01.514271 2026] [:error] [pid 44444:tid 44451] [client 117.33.163.216:59252] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaBOXW2sMNmj-yekUk0yEgAAAgE"]
[Thu Feb 26 22:01:38.485177 2026] [:error] [pid 44444:tid 44460] [client 157.245.196.99:64376] [client 157.245.196.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aaBSQm2sMNmj-yekUk09lAAAAgo"]
[Thu Feb 26 22:04:37.334110 2026] [:error] [pid 44444:tid 44468] [client 43.159.149.216:44060] [client 43.159.149.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaBS9W2sMNmj-yekUk1AJAAAAhI"]
[Thu Feb 26 22:09:18.831068 2026] [:error] [pid 44444:tid 44464] [client 54.215.238.21:52473] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaBUDm2sMNmj-yekUk1DTAAAAg4"], referer: https://www.bing.com/
[Thu Feb 26 22:09:18.835230 2026] [:error] [pid 44444:tid 44464] [client 54.215.238.21:52473] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.bing.com/
[Thu Feb 26 22:09:19.165401 2026] [:error] [pid 44444:tid 44470] [client 54.215.238.21:52501] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaBUD22sMNmj-yekUk1DTQAAAhQ"], referer: https://www.facebook.com/
[Thu Feb 26 22:09:19.169358 2026] [:error] [pid 44444:tid 44470] [client 54.215.238.21:52501] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.facebook.com/
[Thu Feb 26 22:39:22.456855 2026] [:error] [pid 54991:tid 55042] [client 2.58.56.91:51266] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Thu Feb 26 22:39:23.486805 2026] [:error] [pid 44444:tid 44463] [client 2.58.56.91:64217] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aaBbG22sMNmj-yekUk1XxwAAAg0"]
[Thu Feb 26 22:39:23.986923 2026] [:error] [pid 44444:tid 44461] [client 2.58.56.91:50362] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aaBbG22sMNmj-yekUk1XyQAAAgs"]
[Thu Feb 26 22:39:24.497348 2026] [:error] [pid 3883:tid 3887] [client 2.58.56.91:51939] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aaBbHOA33x90V6yYHaj6XgAAAUE"]
[Thu Feb 26 22:39:25.534148 2026] [:error] [pid 44444:tid 44473] [client 2.58.56.91:54629] [client 2.58.56.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "aaBbHW2sMNmj-yekUk1XzQAAAhc"]
[Thu Feb 26 22:39:26.059688 2026] [:error] [pid 25311:tid 25314] [client 2.58.56.91:50957] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Thu Feb 26 22:39:26.571490 2026] [:error] [pid 44444:tid 44455] [client 2.58.56.91:53279] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Fri Feb 27 00:26:15.446566 2026] [:error] [pid 20059:tid 20119] [client 138.199.35.10:49752] [client 138.199.35.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.35.10, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaB0J5ZBS5wIa_NsqsjNSAAAAdE"]
[Fri Feb 27 00:26:15.452222 2026] [:error] [pid 20059:tid 20119] [client 138.199.35.10:49752] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 00:26:17.211723 2026] [:error] [pid 20059:tid 20110] [client 138.199.35.10:49752] [client 138.199.35.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaB0KZZBS5wIa_NsqsjNXgAAAcg"]
[Fri Feb 27 00:26:17.519729 2026] [:error] [pid 18843:tid 18940] [client 138.199.35.10:49766] [client 138.199.35.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaB0KSuD2bhSYSowPs3jTQAAAQA"]
[Fri Feb 27 00:26:17.827340 2026] [:error] [pid 18818:tid 18897] [client 138.199.35.10:49780] [client 138.199.35.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaB0KRhPgqk2SeS_W82u_wAAAA0"]
[Fri Feb 27 00:26:18.134930 2026] [:error] [pid 18818:tid 18895] [client 138.199.35.10:49786] [client 138.199.35.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaB0KhhPgqk2SeS_W82vAAAAAAs"]
[Fri Feb 27 00:26:18.443243 2026] [:error] [pid 20059:tid 20111] [client 138.199.35.10:49788] [client 138.199.35.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaB0KpZBS5wIa_NsqsjNYQAAAck"]
[Fri Feb 27 00:26:18.753701 2026] [:error] [pid 18831:tid 18936] [client 138.199.35.10:49790] [client 138.199.35.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaB0Kv5KHTHUIuWRG2azfgAAAFc"]
[Fri Feb 27 00:26:19.062205 2026] [:error] [pid 18843:tid 18964] [client 138.199.35.10:49794] [client 138.199.35.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaB0KyuD2bhSYSowPs3jUwAAARg"]
[Fri Feb 27 01:07:15.500887 2026] [:error] [pid 18831:tid 18915] [client 43.130.3.122:56122] [client 43.130.3.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaB9w_5KHTHUIuWRG2bA3wAAAEI"]
[Fri Feb 27 01:33:58.447625 2026] [:error] [pid 19020:tid 19024] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/gaigu.php
[Fri Feb 27 01:33:58.655097 2026] [:error] [pid 19020:tid 19045] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Fri Feb 27 01:33:58.863243 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/yr.php
[Fri Feb 27 01:33:59.070539 2026] [:error] [pid 19020:tid 19032] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/god.php
[Fri Feb 27 01:33:59.285769 2026] [:error] [pid 19020:tid 19033] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Fri Feb 27 01:33:59.504789 2026] [:error] [pid 19020:tid 19023] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/work.php
[Fri Feb 27 01:33:59.815978 2026] [:error] [pid 19020:tid 19046] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/ze.php
[Fri Feb 27 01:34:00.038779 2026] [:error] [pid 19020:tid 19035] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/a1vx.php
[Fri Feb 27 01:34:00.249327 2026] [:error] [pid 19020:tid 19040] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri Feb 27 01:34:00.457801 2026] [:error] [pid 19020:tid 19045] [client 20.151.2.242:50488] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Fri Feb 27 01:34:00.665444 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:50488] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaCECLN3kp7wL6QzPnUhjwAAAVY"]
[Fri Feb 27 01:34:01.111830 2026] [:error] [pid 18831:tid 18927] [client 20.151.2.242:49730] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaCECf5KHTHUIuWRG2bJcgAAAE4"]
[Fri Feb 27 01:34:01.579004 2026] [:error] [pid 20059:tid 20111] [client 20.151.2.242:50508] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaCECZZBS5wIa_NsqsgGRwAAAck"]
[Fri Feb 27 01:34:02.007134 2026] [:error] [pid 20059:tid 20120] [client 20.151.2.242:49754] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "aaCECpZBS5wIa_NsqsgGSQAAAdI"]
[Fri Feb 27 01:34:02.442888 2026] [:error] [pid 18831:tid 18924] [client 20.151.2.242:49769] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-4doption1.php"] [unique_id "aaCECv5KHTHUIuWRG2bJeAAAAEs"]
[Fri Feb 27 01:34:02.936867 2026] [:error] [pid 20059:tid 20126] [client 20.151.2.242:50461] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-4doption1.php"] [unique_id "aaCECpZBS5wIa_NsqsgGSwAAAdg"]
[Fri Feb 27 01:34:03.364348 2026] [:error] [pid 18818:tid 18885] [client 20.151.2.242:50556] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-4doption1.php"] [unique_id "aaCECxhPgqk2SeS_W83AiwAAAAE"]
[Fri Feb 27 01:34:03.780782 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49767] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-4doption1.php"] [unique_id "aaCEC5ZBS5wIa_NsqsgGUAAAAcM"]
[Fri Feb 27 01:34:04.264939 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:50459] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaCEDJZBS5wIa_NsqsgGUwAAAcQ"]
[Fri Feb 27 01:34:04.695079 2026] [:error] [pid 19020:tid 19040] [client 20.151.2.242:50534] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaCEDLN3kp7wL6QzPnUhnwAAAVI"]
[Fri Feb 27 01:34:05.136594 2026] [:error] [pid 19020:tid 19030] [client 20.151.2.242:49780] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaCEDbN3kp7wL6QzPnUhoQAAAUg"]
[Fri Feb 27 01:34:05.572516 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:50514] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vxrl.php"] [unique_id "aaCEDZZBS5wIa_NsqsgGYAAAAcw"]
[Fri Feb 27 01:34:06.057081 2026] [:error] [pid 18843:tid 18959] [client 20.151.2.242:49672] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaCEDiuD2bhSYSowPs38vAAAARM"]
[Fri Feb 27 01:34:06.531964 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:50551] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaCEDrN3kp7wL6QzPnUhpAAAAVA"]
[Fri Feb 27 01:34:06.959767 2026] [:error] [pid 18843:tid 18961] [client 20.151.2.242:50448] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaCEDiuD2bhSYSowPs38wAAAARU"]
[Fri Feb 27 01:34:07.412579 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:50457] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaCED5ZBS5wIa_NsqsgGbAAAAcc"]
[Fri Feb 27 01:34:07.853877 2026] [:error] [pid 19020:tid 19025] [client 20.151.2.242:50482] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaCED7N3kp7wL6QzPnUhqAAAAUM"]
[Fri Feb 27 01:34:08.312932 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:50497] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaCEEJZBS5wIa_NsqsgGdQAAAdE"]
[Fri Feb 27 01:34:08.851728 2026] [:error] [pid 20059:tid 20110] [client 20.151.2.242:50555] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaCEEJZBS5wIa_NsqsgGfQAAAcg"]
[Fri Feb 27 01:34:09.312767 2026] [:error] [pid 20059:tid 20126] [client 20.151.2.242:49758] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/num.php"] [unique_id "aaCEEZZBS5wIa_NsqsgGgQAAAdg"]
[Fri Feb 27 01:34:10.027250 2026] [:error] [pid 20059:tid 20122] [client 20.151.2.242:50490] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aaCEEpZBS5wIa_NsqsgGjAAAAdQ"]
[Fri Feb 27 01:34:10.650379 2026] [:error] [pid 20059:tid 20126] [client 20.151.2.242:50542] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aaCEEpZBS5wIa_NsqsgGkQAAAdg"]
[Fri Feb 27 01:34:11.117060 2026] [:error] [pid 19020:tid 19040] [client 20.151.2.242:49733] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aaCEE7N3kp7wL6QzPnUhsQAAAVI"]
[Fri Feb 27 01:34:11.896533 2026] [:error] [pid 19020:tid 19026] [client 20.151.2.242:49735] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aaCEE7N3kp7wL6QzPnUhtAAAAUQ"]
[Fri Feb 27 01:34:12.415149 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:50504] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaCEFJZBS5wIa_NsqsgGogAAAdY"]
[Fri Feb 27 01:34:12.950289 2026] [:error] [pid 19020:tid 19033] [client 20.151.2.242:49150] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaCEFLN3kp7wL6QzPnUhuQAAAUs"]
[Fri Feb 27 01:34:13.414648 2026] [:error] [pid 19020:tid 19041] [client 20.151.2.242:50541] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaCEFbN3kp7wL6QzPnUhuwAAAVM"]
[Fri Feb 27 01:34:13.978978 2026] [:error] [pid 18831:tid 18929] [client 20.151.2.242:49790] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aaCEFf5KHTHUIuWRG2bJgAAAAFA"]
[Fri Feb 27 01:34:14.498462 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:50544] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaCEFpZBS5wIa_NsqsgGsAAAAcc"]
[Fri Feb 27 01:34:15.134360 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:50531] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaCEF5ZBS5wIa_NsqsgGswAAAcs"]
[Fri Feb 27 01:34:15.754763 2026] [:error] [pid 19020:tid 19030] [client 20.151.2.242:50553] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaCEF7N3kp7wL6QzPnUhwwAAAUg"]
[Fri Feb 27 01:34:16.561436 2026] [:error] [pid 18831:tid 18922] [client 20.151.2.242:50531] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aaCEGP5KHTHUIuWRG2bJgwAAAEk"]
[Fri Feb 27 01:34:17.326301 2026] [:error] [pid 18831:tid 18923] [client 20.151.2.242:50522] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaCEGf5KHTHUIuWRG2bJiAAAAEo"]
[Fri Feb 27 01:34:18.287613 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:50554] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaCEGpZBS5wIa_NsqsgGvAAAAcY"]
[Fri Feb 27 01:34:18.866764 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:50453] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaCEGpZBS5wIa_NsqsgGwQAAAdY"]
[Fri Feb 27 01:34:19.707827 2026] [:error] [pid 18818:tid 18892] [client 20.151.2.242:49766] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaCEGxhPgqk2SeS_W83AkQAAAAg"]
[Fri Feb 27 01:34:20.415638 2026] [:error] [pid 18818:tid 18897] [client 20.151.2.242:49739] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aaCEHBhPgqk2SeS_W83AkwAAAA0"]
[Fri Feb 27 01:34:20.942398 2026] [:error] [pid 18831:tid 18914] [client 20.151.2.242:50548] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aaCEHP5KHTHUIuWRG2bJkAAAAEE"]
[Fri Feb 27 01:34:21.536451 2026] [:error] [pid 18818:tid 18890] [client 20.151.2.242:49786] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aaCEHRhPgqk2SeS_W83AlQAAAAY"]
[Fri Feb 27 01:34:21.992502 2026] [:error] [pid 18843:tid 18944] [client 20.151.2.242:49681] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "aaCEHSuD2bhSYSowPs38zgAAAQQ"]
[Fri Feb 27 01:34:22.462714 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:46800] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aaCEHpZBS5wIa_NsqsgGzAAAAcA"]
[Fri Feb 27 01:34:23.047125 2026] [:error] [pid 20059:tid 20123] [client 20.151.2.242:49036] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aaCEH5ZBS5wIa_NsqsgG0QAAAdU"]
[Fri Feb 27 01:34:23.562257 2026] [:error] [pid 20059:tid 20126] [client 20.151.2.242:50532] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aaCEH5ZBS5wIa_NsqsgG0gAAAdg"]
[Fri Feb 27 01:34:23.995242 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:49664] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karak.php"] [unique_id "aaCEH5ZBS5wIa_NsqsgG1QAAAdA"]
[Fri Feb 27 01:34:24.482283 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:49059] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aaCEICuD2bhSYSowPs380AAAARE"]
[Fri Feb 27 01:34:24.967518 2026] [:error] [pid 18831:tid 18921] [client 20.151.2.242:49783] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aaCEIP5KHTHUIuWRG2bJkwAAAEg"]
[Fri Feb 27 01:34:25.394652 2026] [:error] [pid 18818:tid 18900] [client 20.151.2.242:50468] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aaCEIRhPgqk2SeS_W83AlgAAABA"]
[Fri Feb 27 01:34:25.933500 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:50512] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "aaCEIZZBS5wIa_NsqsgG3AAAAcA"]
[Fri Feb 27 01:34:26.416886 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:50433] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aaCEIpZBS5wIa_NsqsgG4AAAAdc"]
[Fri Feb 27 01:34:26.907341 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:49744] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aaCEIpZBS5wIa_NsqsgG5AAAAcQ"]
[Fri Feb 27 01:34:27.454429 2026] [:error] [pid 19020:tid 19046] [client 20.151.2.242:50552] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aaCEI7N3kp7wL6QzPnUhyAAAAVg"]
[Fri Feb 27 01:34:27.950167 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:50550] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "aaCEI5ZBS5wIa_NsqsgG7AAAAcY"]
[Fri Feb 27 01:34:28.408475 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:50437] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aaCEJJZBS5wIa_NsqsgG7gAAAdc"]
[Fri Feb 27 01:34:28.876194 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:50495] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aaCEJJZBS5wIa_NsqsgG8QAAAcs"]
[Fri Feb 27 01:34:29.417246 2026] [:error] [pid 20059:tid 20111] [client 20.151.2.242:49749] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aaCEJZZBS5wIa_NsqsgG9AAAAck"]
[Fri Feb 27 01:34:29.949245 2026] [:error] [pid 19020:tid 19043] [client 20.151.2.242:49676] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "aaCEJbN3kp7wL6QzPnUhywAAAVU"]
[Fri Feb 27 01:34:30.437428 2026] [:error] [pid 19020:tid 19035] [client 20.151.2.242:50505] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaCEJrN3kp7wL6QzPnUhzAAAAU0"]
[Fri Feb 27 01:34:30.966946 2026] [:error] [pid 19020:tid 19040] [client 20.151.2.242:50436] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaCEJrN3kp7wL6QzPnUhzwAAAVI"]
[Fri Feb 27 01:34:31.499458 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:49089] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaCEJ7N3kp7wL6QzPnUh0wAAAVY"]
[Fri Feb 27 01:34:32.078187 2026] [:error] [pid 19020:tid 19037] [client 20.151.2.242:49745] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaCEKLN3kp7wL6QzPnUh1QAAAU8"]
[Fri Feb 27 01:34:32.873042 2026] [:error] [pid 19020:tid 19043] [client 20.151.2.242:46769] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aaCEKLN3kp7wL6QzPnUh3QAAAVU"]
[Fri Feb 27 01:34:33.449315 2026] [:error] [pid 18843:tid 18952] [client 20.151.2.242:49138] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aaCEKSuD2bhSYSowPs382QAAAQw"]
[Fri Feb 27 01:34:34.060296 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:49764] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aaCEKpZBS5wIa_NsqsgG9gAAAdM"]
[Fri Feb 27 01:34:34.666483 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:49765] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "aaCEKiuD2bhSYSowPs383QAAARE"]
[Fri Feb 27 01:34:35.137763 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:50435] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaCEK7N3kp7wL6QzPnUh4wAAAVA"]
[Fri Feb 27 01:34:35.621966 2026] [:error] [pid 18843:tid 18953] [client 20.151.2.242:50545] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaCEKyuD2bhSYSowPs384AAAAQ0"]
[Fri Feb 27 01:34:36.207073 2026] [:error] [pid 18843:tid 18951] [client 20.151.2.242:49784] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaCELCuD2bhSYSowPs384QAAAQs"]
[Fri Feb 27 01:34:36.792336 2026] [:error] [pid 18843:tid 18946] [client 20.151.2.242:50558] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaCELCuD2bhSYSowPs384wAAAQY"]
[Fri Feb 27 01:34:37.530419 2026] [:error] [pid 18831:tid 18931] [client 20.151.2.242:49788] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aaCELf5KHTHUIuWRG2bJngAAAFI"]
[Fri Feb 27 01:34:37.988493 2026] [:error] [pid 18818:tid 18907] [client 20.151.2.242:50460] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aaCELRhPgqk2SeS_W83ArAAAABc"]
[Fri Feb 27 01:34:38.531817 2026] [:error] [pid 18831:tid 18929] [client 20.151.2.242:50540] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aaCELv5KHTHUIuWRG2bJpAAAAFA"]
[Fri Feb 27 01:34:39.013501 2026] [:error] [pid 19020:tid 19039] [client 20.151.2.242:49775] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat.php"] [unique_id "aaCEL7N3kp7wL6QzPnUh5AAAAVE"]
[Fri Feb 27 01:34:39.463796 2026] [:error] [pid 18831:tid 18930] [client 20.151.2.242:49770] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aaCEL_5KHTHUIuWRG2bJqQAAAFE"]
[Fri Feb 27 01:34:39.978098 2026] [:error] [pid 19020:tid 19031] [client 20.151.2.242:49706] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aaCEL7N3kp7wL6QzPnUh5wAAAUk"]
[Fri Feb 27 01:34:40.698357 2026] [:error] [pid 18843:tid 18940] [client 20.151.2.242:50475] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aaCEMCuD2bhSYSowPs386wAAAQA"]
[Fri Feb 27 01:34:41.221317 2026] [:error] [pid 18843:tid 18960] [client 20.151.2.242:49693] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tcp.php"] [unique_id "aaCEMSuD2bhSYSowPs387AAAARQ"]
[Fri Feb 27 01:34:41.645818 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:49670] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aaCEMSuD2bhSYSowPs387gAAARE"]
[Fri Feb 27 01:34:42.242153 2026] [:error] [pid 19020:tid 19043] [client 20.151.2.242:50492] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aaCEMrN3kp7wL6QzPnUh7AAAAVU"]
[Fri Feb 27 01:34:42.816102 2026] [:error] [pid 18818:tid 18893] [client 20.151.2.242:49736] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aaCEMhhPgqk2SeS_W83ArQAAAAk"]
[Fri Feb 27 01:34:43.438138 2026] [:error] [pid 18831:tid 18914] [client 20.151.2.242:50451] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ext.php"] [unique_id "aaCEM_5KHTHUIuWRG2bJsgAAAEE"]
[Fri Feb 27 01:34:43.982938 2026] [:error] [pid 18831:tid 18936] [client 20.151.2.242:50465] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaCEM_5KHTHUIuWRG2bJtAAAAFc"]
[Fri Feb 27 01:34:44.615045 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:49781] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaCENLN3kp7wL6QzPnUh9AAAAVY"]
[Fri Feb 27 01:34:45.047211 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:50515] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaCENbN3kp7wL6QzPnUh9gAAAVA"]
[Fri Feb 27 01:34:45.665160 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:49041] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aaCENZZBS5wIa_NsqsgG-wAAAcQ"]
[Fri Feb 27 01:34:46.207256 2026] [:error] [pid 18843:tid 18954] [client 20.151.2.242:50447] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaCENiuD2bhSYSowPs38-wAAAQ4"]
[Fri Feb 27 01:34:46.654240 2026] [:error] [pid 18818:tid 18907] [client 20.151.2.242:49052] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaCENhhPgqk2SeS_W83AtgAAABc"]
[Fri Feb 27 01:34:47.173725 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:50523] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaCEN5ZBS5wIa_NsqsgHAwAAAdA"]
[Fri Feb 27 01:34:47.606732 2026] [:error] [pid 19020:tid 19031] [client 20.151.2.242:46799] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "aaCEN7N3kp7wL6QzPnUh-AAAAUk"]
[Fri Feb 27 01:34:48.042821 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:49070] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaCEOJZBS5wIa_NsqsgHBwAAAdY"]
[Fri Feb 27 01:34:48.469770 2026] [:error] [pid 18843:tid 18948] [client 20.151.2.242:50502] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaCEOCuD2bhSYSowPs38_QAAAQg"]
[Fri Feb 27 01:34:48.901735 2026] [:error] [pid 18843:tid 18953] [client 20.151.2.242:49741] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaCEOCuD2bhSYSowPs39AAAAAQ0"]
[Fri Feb 27 01:34:49.336388 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:46803] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aaCEOSuD2bhSYSowPs39AgAAARE"]
[Fri Feb 27 01:34:49.786716 2026] [:error] [pid 18843:tid 18949] [client 20.151.2.242:49750] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaCEOSuD2bhSYSowPs39BgAAAQk"]
[Fri Feb 27 01:34:50.212904 2026] [:error] [pid 19020:tid 19028] [client 20.151.2.242:49729] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaCEOrN3kp7wL6QzPnUh-wAAAUY"]
[Fri Feb 27 01:34:50.637325 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:50533] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaCEOpZBS5wIa_NsqsgHDAAAAdc"]
[Fri Feb 27 01:34:51.101399 2026] [:error] [pid 18831:tid 18920] [client 20.151.2.242:50445] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ov.php"] [unique_id "aaCEO_5KHTHUIuWRG2bJugAAAEc"]
[Fri Feb 27 01:34:51.533258 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49787] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaCEO5ZBS5wIa_NsqsgHEwAAAcM"]
[Fri Feb 27 01:34:51.982920 2026] [:error] [pid 20059:tid 20117] [client 20.151.2.242:49680] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaCEO5ZBS5wIa_NsqsgHFwAAAc8"]
[Fri Feb 27 01:34:52.403782 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:50516] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaCEPJZBS5wIa_NsqsgHGgAAAdc"]
[Fri Feb 27 01:34:52.912794 2026] [:error] [pid 18818:tid 18889] [client 20.151.2.242:50526] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaCEPBhPgqk2SeS_W83AvgAAAAU"]
[Fri Feb 27 01:34:53.348848 2026] [:error] [pid 20059:tid 20103] [client 20.151.2.242:50464] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaCEPZZBS5wIa_NsqsgHHwAAAcE"]
[Fri Feb 27 01:34:53.799182 2026] [:error] [pid 18818:tid 18888] [client 20.151.2.242:49757] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaCEPRhPgqk2SeS_W83AwwAAAAQ"]
[Fri Feb 27 01:34:54.254813 2026] [:error] [pid 18831:tid 18921] [client 20.151.2.242:50442] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaCEPv5KHTHUIuWRG2bJvAAAAEg"]
[Fri Feb 27 01:34:54.730441 2026] [:error] [pid 20059:tid 20120] [client 20.151.2.242:49698] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "aaCEPpZBS5wIa_NsqsgHKQAAAdI"]
[Fri Feb 27 01:34:55.185540 2026] [:error] [pid 20059:tid 20103] [client 20.151.2.242:50498] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaCEP5ZBS5wIa_NsqsgHLQAAAcE"]
[Fri Feb 27 01:34:55.703673 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:49685] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaCEP5ZBS5wIa_NsqsgHMwAAAdY"]
[Fri Feb 27 01:34:56.129474 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:49665] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaCEQJZBS5wIa_NsqsgHNgAAAcQ"]
[Fri Feb 27 01:34:56.578462 2026] [:error] [pid 18831:tid 18919] [client 20.151.2.242:49759] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaCEQP5KHTHUIuWRG2bJvwAAAEY"]
[Fri Feb 27 01:34:57.014978 2026] [:error] [pid 19020:tid 19042] [client 20.151.2.242:49141] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaCEQbN3kp7wL6QzPnUiAQAAAVQ"]
[Fri Feb 27 01:34:57.484616 2026] [:error] [pid 18831:tid 18916] [client 20.151.2.242:50461] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaCEQf5KHTHUIuWRG2bJxgAAAEM"]
[Fri Feb 27 01:34:58.027129 2026] [:error] [pid 18843:tid 18948] [client 20.151.2.242:50520] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaCEQiuD2bhSYSowPs39CwAAAQg"]
[Fri Feb 27 01:34:58.531167 2026] [:error] [pid 19020:tid 19041] [client 20.151.2.242:50557] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.1.php"] [unique_id "aaCEQrN3kp7wL6QzPnUiAgAAAVM"]
[Fri Feb 27 01:34:59.030840 2026] [:error] [pid 18843:tid 18944] [client 20.151.2.242:50518] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aaCEQyuD2bhSYSowPs39DgAAAQQ"]
[Fri Feb 27 01:34:59.491247 2026] [:error] [pid 18818:tid 18899] [client 20.151.2.242:49668] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aaCEQxhPgqk2SeS_W83AxgAAAA8"]
[Fri Feb 27 01:34:59.922851 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49678] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/async.php"] [unique_id "aaCEQ5ZBS5wIa_NsqsgHPgAAAcM"]
[Fri Feb 27 01:35:00.448169 2026] [:error] [pid 18831:tid 18914] [client 20.151.2.242:49777] File does not exist: /usr/local/apache/htdocs/suspended-page/async.php
[Fri Feb 27 01:35:00.669448 2026] [:error] [pid 18831:tid 18935] [client 20.151.2.242:49777] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Fri Feb 27 01:35:00.894008 2026] [:error] [pid 18831:tid 18932] [client 20.151.2.242:49777] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 01:35:01.161150 2026] [:error] [pid 18831:tid 18916] [client 20.151.2.242:49777] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Feb 27 01:35:01.388488 2026] [:error] [pid 18831:tid 18934] [client 20.151.2.242:49777] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Fri Feb 27 01:35:01.607897 2026] [:error] [pid 18831:tid 18929] [client 20.151.2.242:49777] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 01:35:01.822702 2026] [:error] [pid 18831:tid 18926] [client 20.151.2.242:49777] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aaCERf5KHTHUIuWRG2bJ2gAAAE0"]
[Fri Feb 27 01:35:02.303938 2026] [:error] [pid 18818:tid 18889] [client 20.151.2.242:50546] File does not exist: /usr/local/apache/htdocs/suspended-page/lc.php
[Fri Feb 27 01:35:02.717257 2026] [:error] [pid 18818:tid 18906] [client 20.151.2.242:50546] File does not exist: /usr/local/apache/htdocs/suspended-page/cbrfo.php
[Fri Feb 27 01:35:02.936277 2026] [:error] [pid 18818:tid 18887] [client 20.151.2.242:50546] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Feb 27 01:35:03.146132 2026] [:error] [pid 18818:tid 18890] [client 20.151.2.242:50546] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Feb 27 01:35:04.474945 2026] [:error] [pid 18818:tid 18890] [client 20.151.2.242:50546] File does not exist: /usr/local/apache/htdocs/suspended-page/miansha.php
[Fri Feb 27 01:35:04.715900 2026] [:error] [pid 18818:tid 18900] [client 20.151.2.242:50546] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aaCESBhPgqk2SeS_W83A2AAAABA"]
[Fri Feb 27 01:35:05.235887 2026] [:error] [pid 18818:tid 18902] [client 20.151.2.242:49095] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c99.php"] [unique_id "aaCESRhPgqk2SeS_W83A2QAAABI"]
[Fri Feb 27 01:35:05.866712 2026] [:error] [pid 18843:tid 18956] [client 20.151.2.242:49776] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c99.php"] [unique_id "aaCESSuD2bhSYSowPs39GQAAARA"]
[Fri Feb 27 01:35:06.361143 2026] [:error] [pid 18843:tid 18945] [client 20.151.2.242:49101] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c99.php"] [unique_id "aaCESiuD2bhSYSowPs39GwAAAQU"]
[Fri Feb 27 01:35:07.027806 2026] [:error] [pid 18831:tid 18932] [client 20.151.2.242:50471] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c99.php"] [unique_id "aaCES_5KHTHUIuWRG2bJ4wAAAFM"]
[Fri Feb 27 01:35:07.543348 2026] [:error] [pid 18843:tid 18964] [client 20.151.2.242:49122] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aaCESyuD2bhSYSowPs39IQAAARg"]
[Fri Feb 27 01:35:08.093024 2026] [:error] [pid 18831:tid 18915] [client 20.151.2.242:50454] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aaCETP5KHTHUIuWRG2bJ5gAAAEI"]
[Fri Feb 27 01:35:08.571449 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:50511] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aaCETCuD2bhSYSowPs39KAAAARE"]
[Fri Feb 27 01:35:09.311388 2026] [:error] [pid 18843:tid 18943] [client 20.151.2.242:49713] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aaCETSuD2bhSYSowPs39KgAAAQM"]
[Fri Feb 27 01:35:09.763892 2026] [:error] [pid 18843:tid 18958] [client 20.151.2.242:50463] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aaCETSuD2bhSYSowPs39LQAAARI"]
[Fri Feb 27 01:35:10.196306 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:49137] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aaCETpZBS5wIa_NsqsgHTAAAAdA"]
[Fri Feb 27 01:35:10.638064 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:50510] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aaCETpZBS5wIa_NsqsgHTgAAAdM"]
[Fri Feb 27 01:35:11.081264 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:49070] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aaCET5ZBS5wIa_NsqsgHUQAAAdc"]
[Fri Feb 27 01:35:11.604044 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:49673] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaCET7N3kp7wL6QzPnUiEgAAAVY"]
[Fri Feb 27 01:35:12.102737 2026] [:error] [pid 18818:tid 18897] [client 20.151.2.242:50470] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaCEUBhPgqk2SeS_W83A5wAAAA0"]
[Fri Feb 27 01:35:12.526583 2026] [:error] [pid 19020:tid 19026] [client 20.151.2.242:50474] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaCEULN3kp7wL6QzPnUiFwAAAUQ"]
[Fri Feb 27 01:35:12.981957 2026] [:error] [pid 18843:tid 18956] [client 20.151.2.242:50543] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaCEUCuD2bhSYSowPs39OAAAARA"]
[Fri Feb 27 01:35:13.472005 2026] [:error] [pid 18831:tid 18926] [client 20.151.2.242:49771] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x12.php"] [unique_id "aaCEUf5KHTHUIuWRG2bJ6QAAAE0"]
[Fri Feb 27 01:35:13.947785 2026] [:error] [pid 18831:tid 18933] [client 20.151.2.242:50467] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x12.php"] [unique_id "aaCEUf5KHTHUIuWRG2bJ6wAAAFQ"]
[Fri Feb 27 01:35:14.492663 2026] [:error] [pid 20059:tid 20110] [client 20.151.2.242:50536] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x12.php"] [unique_id "aaCEUpZBS5wIa_NsqsgHVgAAAcg"]
[Fri Feb 27 01:35:14.904836 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:49683] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x12.php"] [unique_id "aaCEUpZBS5wIa_NsqsgHWQAAAcY"]
[Fri Feb 27 01:35:15.429237 2026] [:error] [pid 18843:tid 18946] [client 20.151.2.242:50501] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/41.php"] [unique_id "aaCEUyuD2bhSYSowPs39QQAAAQY"]
[Fri Feb 27 01:35:15.891048 2026] [:error] [pid 19020:tid 19037] [client 20.151.2.242:49734] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/41.php"] [unique_id "aaCEU7N3kp7wL6QzPnUiGgAAAU8"]
[Fri Feb 27 01:35:16.493888 2026] [:error] [pid 18818:tid 18892] [client 20.151.2.242:49092] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/41.php"] [unique_id "aaCEVBhPgqk2SeS_W83A8gAAAAg"]
[Fri Feb 27 01:35:16.949670 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:49114] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/41.php"] [unique_id "aaCEVJZBS5wIa_NsqsgHXQAAAcI"]
[Fri Feb 27 01:35:17.404191 2026] [:error] [pid 18818:tid 18888] [client 20.151.2.242:46796] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad2.php"] [unique_id "aaCEVRhPgqk2SeS_W83A-QAAAAQ"]
[Fri Feb 27 01:35:17.831654 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:46818] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad2.php"] [unique_id "aaCEVZZBS5wIa_NsqsgHYQAAAcQ"]
[Fri Feb 27 01:35:18.504319 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:49671] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad2.php"] [unique_id "aaCEVpZBS5wIa_NsqsgHZgAAAcw"]
[Fri Feb 27 01:35:18.980728 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:49772] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad2.php"] [unique_id "aaCEVpZBS5wIa_NsqsgHawAAAcY"]
[Fri Feb 27 01:35:19.465117 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:49669] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "aaCEV5ZBS5wIa_NsqsgHbQAAAcI"]
[Fri Feb 27 01:35:20.273875 2026] [:error] [pid 18831:tid 18924] [client 20.151.2.242:50440] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "aaCEWP5KHTHUIuWRG2bJ8AAAAEs"]
[Fri Feb 27 01:35:21.091786 2026] [:error] [pid 18818:tid 18891] [client 20.151.2.242:49674] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "aaCEWRhPgqk2SeS_W83BAgAAAAc"]
[Fri Feb 27 01:35:22.270311 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:49135] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "aaCEWpZBS5wIa_NsqsgHhAAAAdY"]
[Fri Feb 27 01:35:22.971224 2026] [:error] [pid 19020:tid 19026] [client 20.151.2.242:50547] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaCEWrN3kp7wL6QzPnUiJAAAAUQ"]
[Fri Feb 27 01:35:24.115384 2026] [:error] [pid 18843:tid 18956] [client 20.151.2.242:49746] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaCEXCuD2bhSYSowPs39RQAAARA"]
[Fri Feb 27 01:35:25.177173 2026] [:error] [pid 18818:tid 18905] [client 20.151.2.242:50496] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaCEXRhPgqk2SeS_W83BBgAAABU"]
[Fri Feb 27 01:35:26.355041 2026] [:error] [pid 20059:tid 20112] [client 20.151.2.242:49752] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaCEXpZBS5wIa_NsqsgHiQAAAco"]
[Fri Feb 27 01:35:27.084581 2026] [:error] [pid 19020:tid 19036] [client 20.151.2.242:50559] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6s2.php"] [unique_id "aaCEX7N3kp7wL6QzPnUiLAAAAU4"]
[Fri Feb 27 01:35:27.785983 2026] [:error] [pid 19020:tid 19045] [client 20.151.2.242:50491] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6s2.php"] [unique_id "aaCEX7N3kp7wL6QzPnUiMAAAAVc"]
[Fri Feb 27 01:35:28.763971 2026] [:error] [pid 18818:tid 18886] [client 20.151.2.242:49099] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6s2.php"] [unique_id "aaCEYBhPgqk2SeS_W83BCgAAAAI"]
[Fri Feb 27 01:35:29.793250 2026] [:error] [pid 18831:tid 18930] [client 20.151.2.242:49099] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6s2.php"] [unique_id "aaCEYf5KHTHUIuWRG2bJ-gAAAFE"]
[Fri Feb 27 01:35:30.691063 2026] [:error] [pid 18843:tid 18952] [client 20.151.2.242:49667] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aaCEYiuD2bhSYSowPs39TQAAAQw"]
[Fri Feb 27 01:35:31.153906 2026] [:error] [pid 18831:tid 18920] [client 20.151.2.242:49675] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aaCEY_5KHTHUIuWRG2bJ-wAAAEc"]
[Fri Feb 27 01:35:31.715710 2026] [:error] [pid 18818:tid 18896] [client 20.151.2.242:49700] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aaCEYxhPgqk2SeS_W83BFAAAAAw"]
[Fri Feb 27 01:35:32.209452 2026] [:error] [pid 18843:tid 18964] [client 20.151.2.242:49719] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "aaCEZCuD2bhSYSowPs39TwAAARg"]
[Fri Feb 27 01:35:32.678095 2026] [:error] [pid 19020:tid 19026] [client 20.151.2.242:50513] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaCEZLN3kp7wL6QzPnUiMgAAAUQ"]
[Fri Feb 27 01:35:33.157370 2026] [:error] [pid 18843:tid 18941] [client 20.151.2.242:49742] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaCEZSuD2bhSYSowPs39UgAAAQE"]
[Fri Feb 27 01:35:33.655936 2026] [:error] [pid 19020:tid 19025] [client 20.151.2.242:50507] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaCEZbN3kp7wL6QzPnUiNQAAAUM"]
[Fri Feb 27 01:35:34.188945 2026] [:error] [pid 19020:tid 19041] [client 20.151.2.242:49677] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaCEZrN3kp7wL6QzPnUiNwAAAVM"]
[Fri Feb 27 01:35:34.741284 2026] [:error] [pid 19020:tid 19023] [client 20.151.2.242:50466] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cc13.php"] [unique_id "aaCEZrN3kp7wL6QzPnUiOgAAAUE"]
[Fri Feb 27 01:35:35.272144 2026] [:error] [pid 18843:tid 18943] [client 20.151.2.242:49785] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cc13.php"] [unique_id "aaCEZyuD2bhSYSowPs39WAAAAQM"]
[Fri Feb 27 01:35:35.790918 2026] [:error] [pid 18843:tid 18945] [client 20.151.2.242:49062] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cc13.php"] [unique_id "aaCEZyuD2bhSYSowPs39WgAAAQU"]
[Fri Feb 27 01:35:36.268837 2026] [:error] [pid 19020:tid 19042] [client 20.151.2.242:49679] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/cc13.php"] [unique_id "aaCEaLN3kp7wL6QzPnUiQgAAAVQ"]
[Fri Feb 27 01:35:36.728693 2026] [:error] [pid 19020:tid 19027] [client 20.151.2.242:49760] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaCEaLN3kp7wL6QzPnUiRAAAAUU"]
[Fri Feb 27 01:35:37.259843 2026] [:error] [pid 19020:tid 19032] [client 20.151.2.242:49768] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaCEabN3kp7wL6QzPnUiSAAAAUo"]
[Fri Feb 27 01:35:37.752471 2026] [:error] [pid 18831:tid 18921] [client 20.151.2.242:50509] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaCEaf5KHTHUIuWRG2bJ_QAAAEg"]
[Fri Feb 27 01:35:38.266548 2026] [:error] [pid 19020:tid 19023] [client 20.151.2.242:49791] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "aaCEarN3kp7wL6QzPnUiSwAAAUE"]
[Fri Feb 27 01:35:38.793617 2026] [:error] [pid 20059:tid 20123] [client 20.151.2.242:50472] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mon.php"] [unique_id "aaCEapZBS5wIa_NsqsgHkQAAAdU"]
[Fri Feb 27 01:35:39.367679 2026] [:error] [pid 18831:tid 18928] [client 20.151.2.242:49773] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mon.php"] [unique_id "aaCEa_5KHTHUIuWRG2bJ_wAAAE8"]
[Fri Feb 27 01:35:39.897954 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:49053] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mon.php"] [unique_id "aaCEa5ZBS5wIa_NsqsgHkgAAAcA"]
[Fri Feb 27 01:35:40.402251 2026] [:error] [pid 18843:tid 18943] [client 20.151.2.242:49102] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mon.php"] [unique_id "aaCEbCuD2bhSYSowPs39ZQAAAQM"]
[Fri Feb 27 01:35:40.885283 2026] [:error] [pid 18843:tid 18956] [client 20.151.2.242:50481] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aaCEbCuD2bhSYSowPs39aQAAARA"]
[Fri Feb 27 01:35:41.316104 2026] [:error] [pid 18843:tid 18959] [client 20.151.2.242:50477] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aaCEbSuD2bhSYSowPs39awAAARM"]
[Fri Feb 27 01:35:41.753706 2026] [:error] [pid 19020:tid 19034] [client 20.151.2.242:50452] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aaCEbbN3kp7wL6QzPnUiWAAAAUw"]
[Fri Feb 27 01:35:42.245967 2026] [:error] [pid 18831:tid 18935] [client 20.151.2.242:49722] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aaCEbv5KHTHUIuWRG2bKAgAAAFY"]
[Fri Feb 27 01:35:42.823913 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:49716] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mah.php"] [unique_id "aaCEbiuD2bhSYSowPs39bgAAARE"]
[Fri Feb 27 01:35:43.245746 2026] [:error] [pid 18831:tid 18916] [client 20.151.2.242:49688] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/product.php"] [unique_id "aaCEb_5KHTHUIuWRG2bKBAAAAEM"]
[Fri Feb 27 01:35:43.670272 2026] [:error] [pid 18818:tid 18891] [client 20.151.2.242:49074] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aaCEbxhPgqk2SeS_W83BIgAAAAc"]
[Fri Feb 27 01:35:44.148721 2026] [:error] [pid 19020:tid 19036] [client 20.151.2.242:49096] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aaCEcLN3kp7wL6QzPnUiWwAAAU4"]
[Fri Feb 27 01:35:44.816818 2026] [:error] [pid 20059:tid 20112] [client 20.151.2.242:49037] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aaCEcJZBS5wIa_NsqsgHmgAAAco"]
[Fri Feb 27 01:35:45.407513 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:46810] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aaCEcZZBS5wIa_NsqsgHogAAAdY"]
[Fri Feb 27 01:35:46.072994 2026] [:error] [pid 18843:tid 18952] [client 20.151.2.242:50458] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aaCEciuD2bhSYSowPs39dgAAAQw"]
[Fri Feb 27 01:35:46.525212 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:49717] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aaCEcpZBS5wIa_NsqsgHpwAAAcA"]
[Fri Feb 27 01:35:47.058561 2026] [:error] [pid 18818:tid 18894] [client 20.151.2.242:49139] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-setting.php"] [unique_id "aaCEcxhPgqk2SeS_W83BLAAAAAo"]
[Fri Feb 27 01:35:47.530565 2026] [:error] [pid 18818:tid 18884] [client 20.151.2.242:49705] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaCEcxhPgqk2SeS_W83BLgAAAAA"]
[Fri Feb 27 01:35:47.987619 2026] [:error] [pid 18843:tid 18958] [client 20.151.2.242:50450] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaCEcyuD2bhSYSowPs39dwAAARI"]
[Fri Feb 27 01:35:48.709798 2026] [:error] [pid 18831:tid 18922] [client 20.151.2.242:49738] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaCEdP5KHTHUIuWRG2bKCgAAAEk"]
[Fri Feb 27 01:35:49.295739 2026] [:error] [pid 18818:tid 18885] [client 20.151.2.242:50517] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaCEdRhPgqk2SeS_W83BNAAAAAE"]
[Fri Feb 27 01:35:49.727623 2026] [:error] [pid 18843:tid 18949] [client 20.151.2.242:50479] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logs.php"] [unique_id "aaCEdSuD2bhSYSowPs39egAAAQk"]
[Fri Feb 27 01:35:50.258282 2026] [:error] [pid 19020:tid 19027] [client 20.151.2.242:49125] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logs.php"] [unique_id "aaCEdrN3kp7wL6QzPnUiYAAAAUU"]
[Fri Feb 27 01:35:50.676548 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:50449] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logs.php"] [unique_id "aaCEdiuD2bhSYSowPs39ewAAARE"]
[Fri Feb 27 01:35:51.099708 2026] [:error] [pid 18843:tid 18941] [client 20.151.2.242:49751] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/logs.php"] [unique_id "aaCEdyuD2bhSYSowPs39fAAAAQE"]
[Fri Feb 27 01:35:51.546003 2026] [:error] [pid 18843:tid 18948] [client 20.151.2.242:46739] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aaCEdyuD2bhSYSowPs39fQAAAQg"]
[Fri Feb 27 01:35:51.956191 2026] [:error] [pid 19020:tid 19035] [client 20.151.2.242:49144] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aaCEd7N3kp7wL6QzPnUiZAAAAU0"]
[Fri Feb 27 01:35:52.374854 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:49104] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aaCEeJZBS5wIa_NsqsgHvgAAAcI"]
[Fri Feb 27 01:35:52.856597 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49151] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aaCEeJZBS5wIa_NsqsgHwAAAAcM"]
[Fri Feb 27 01:35:53.338625 2026] [:error] [pid 18818:tid 18899] [client 20.151.2.242:49691] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/term.php"] [unique_id "aaCEeRhPgqk2SeS_W83BNwAAAA8"]
[Fri Feb 27 01:35:53.826694 2026] [:error] [pid 19020:tid 19039] [client 20.151.2.242:46808] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/term.php"] [unique_id "aaCEebN3kp7wL6QzPnUiaQAAAVE"]
[Fri Feb 27 01:35:54.340785 2026] [:error] [pid 18818:tid 18905] [client 20.151.2.242:49098] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/term.php"] [unique_id "aaCEehhPgqk2SeS_W83BOQAAABU"]
[Fri Feb 27 01:35:54.781414 2026] [:error] [pid 19020:tid 19045] [client 20.151.2.242:49093] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/term.php"] [unique_id "aaCEerN3kp7wL6QzPnUibgAAAVc"]
[Fri Feb 27 01:35:55.214086 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:50528] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaCEe5ZBS5wIa_NsqsgHxgAAAdA"]
[Fri Feb 27 01:35:55.686556 2026] [:error] [pid 18831:tid 18913] [client 20.151.2.242:50486] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaCEe_5KHTHUIuWRG2bKEAAAAEA"]
[Fri Feb 27 01:35:56.178887 2026] [:error] [pid 19020:tid 19042] [client 20.151.2.242:49131] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaCEfLN3kp7wL6QzPnUicAAAAVQ"]
[Fri Feb 27 01:35:56.606781 2026] [:error] [pid 18843:tid 18959] [client 20.151.2.242:49045] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaCEfCuD2bhSYSowPs39gwAAARM"]
[Fri Feb 27 01:35:57.170715 2026] [:error] [pid 18843:tid 18955] [client 20.151.2.242:49774] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webdb.php"] [unique_id "aaCEfSuD2bhSYSowPs39hgAAAQ8"]
[Fri Feb 27 01:35:57.594163 2026] [:error] [pid 18843:tid 18952] [client 20.151.2.242:49072] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webdb.php"] [unique_id "aaCEfSuD2bhSYSowPs39iQAAAQw"]
[Fri Feb 27 01:35:58.034802 2026] [:error] [pid 18843:tid 18960] [client 20.151.2.242:49687] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webdb.php"] [unique_id "aaCEfiuD2bhSYSowPs39iwAAARQ"]
[Fri Feb 27 01:35:58.467142 2026] [:error] [pid 18831:tid 18915] [client 20.151.2.242:50489] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webdb.php"] [unique_id "aaCEfv5KHTHUIuWRG2bKGQAAAEI"]
[Fri Feb 27 01:35:58.960877 2026] [:error] [pid 18831:tid 18936] [client 20.151.2.242:49115] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "aaCEfv5KHTHUIuWRG2bKGwAAAFc"]
[Fri Feb 27 01:35:59.513750 2026] [:error] [pid 18818:tid 18903] [client 20.151.2.242:46826] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "aaCEfxhPgqk2SeS_W83BPwAAABM"]
[Fri Feb 27 01:36:00.048927 2026] [:error] [pid 20059:tid 20122] [client 20.151.2.242:49143] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "aaCEgJZBS5wIa_NsqsgHygAAAdQ"]
[Fri Feb 27 01:36:00.473203 2026] [:error] [pid 18818:tid 18889] [client 20.151.2.242:49715] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "aaCEgBhPgqk2SeS_W83BRAAAAAU"]
[Fri Feb 27 01:36:01.050195 2026] [:error] [pid 18818:tid 18896] [client 20.151.2.242:50443] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aaCEgRhPgqk2SeS_W83BRgAAAAw"]
[Fri Feb 27 01:36:01.906332 2026] [:error] [pid 18831:tid 18927] [client 20.151.2.242:50476] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aaCEgf5KHTHUIuWRG2bKIwAAAE4"]
[Fri Feb 27 01:36:02.349196 2026] [:error] [pid 18843:tid 18953] [client 20.151.2.242:49147] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aaCEgiuD2bhSYSowPs39lAAAAQ0"]
[Fri Feb 27 01:36:02.785420 2026] [:error] [pid 18843:tid 18942] [client 20.151.2.242:49050] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aaCEgiuD2bhSYSowPs39lgAAAQI"]
[Fri Feb 27 01:36:03.232218 2026] [:error] [pid 18843:tid 18963] [client 20.151.2.242:49148] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaCEgyuD2bhSYSowPs39mQAAARc"]
[Fri Feb 27 01:36:03.653404 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:49142] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaCEg7N3kp7wL6QzPnUieQAAAVY"]
[Fri Feb 27 01:36:04.107525 2026] [:error] [pid 19020:tid 19024] [client 20.151.2.242:49066] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Feb 27 01:36:04.317851 2026] [:error] [pid 19020:tid 19046] [client 20.151.2.242:49066] File does not exist: /usr/local/apache/htdocs/suspended-page/mass.php
[Fri Feb 27 01:36:04.526546 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:49066] File does not exist: /usr/local/apache/htdocs/suspended-page/rindex.php
[Fri Feb 27 01:36:04.737813 2026] [:error] [pid 19020:tid 19030] [client 20.151.2.242:49066] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Fri Feb 27 01:36:04.947315 2026] [:error] [pid 19020:tid 19022] [client 20.151.2.242:49066] File does not exist: /usr/local/apache/htdocs/suspended-page/add.php
[Fri Feb 27 01:36:05.185580 2026] [:error] [pid 19020:tid 19028] [client 20.151.2.242:49066] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaCEhbN3kp7wL6QzPnUihAAAAUY"]
[Fri Feb 27 01:36:05.650465 2026] [:error] [pid 18831:tid 18915] [client 20.151.2.242:49060] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/include.php"] [unique_id "aaCEhf5KHTHUIuWRG2bKKQAAAEI"]
[Fri Feb 27 01:36:06.092751 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:49063] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-22.php
[Fri Feb 27 01:36:06.306520 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49063] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaCEhpZBS5wIa_NsqsgHzwAAAcM"]
[Fri Feb 27 01:36:06.942516 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:49692] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Fri Feb 27 01:36:07.168493 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:49692] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Fri Feb 27 01:36:07.586899 2026] [:error] [pid 20059:tid 20115] [client 20.151.2.242:49692] File does not exist: /usr/local/apache/htdocs/suspended-page/payment.php
[Fri Feb 27 01:36:07.808279 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:49692] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aaCEh5ZBS5wIa_NsqsgH3wAAAcc"]
[Fri Feb 27 01:36:08.232220 2026] [:error] [pid 19020:tid 19034] [client 20.151.2.242:50444] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aaCEiLN3kp7wL6QzPnUiiAAAAUw"]
[Fri Feb 27 01:36:08.659387 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:49091] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aaCEiLN3kp7wL6QzPnUiiwAAAVY"]
[Fri Feb 27 01:36:09.159062 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:46786] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-info.php"] [unique_id "aaCEiZZBS5wIa_NsqsgH4QAAAcI"]
[Fri Feb 27 01:36:09.595727 2026] [:error] [pid 18831:tid 18920] [client 20.151.2.242:40442] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaCEif5KHTHUIuWRG2bKLQAAAEc"]
[Fri Feb 27 01:36:10.045579 2026] [:error] [pid 18831:tid 18928] [client 20.151.2.242:49732] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaCEiv5KHTHUIuWRG2bKMQAAAE8"]
[Fri Feb 27 01:36:10.550695 2026] [:error] [pid 18831:tid 18916] [client 20.151.2.242:50506] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaCEiv5KHTHUIuWRG2bKOAAAAEM"]
[Fri Feb 27 01:36:11.029896 2026] [:error] [pid 18843:tid 18950] [client 20.151.2.242:49029] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aaCEiyuD2bhSYSowPs39pAAAAQo"]
[Fri Feb 27 01:36:11.445837 2026] [:error] [pid 18818:tid 18898] [client 20.151.2.242:49702] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kill.php"] [unique_id "aaCEixhPgqk2SeS_W83BWAAAAA4"]
[Fri Feb 27 01:36:11.875941 2026] [:error] [pid 18818:tid 18902] [client 20.151.2.242:50503] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kill.php"] [unique_id "aaCEixhPgqk2SeS_W83BWgAAABI"]
[Fri Feb 27 01:36:12.312812 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:49035] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kill.php"] [unique_id "aaCEjJZBS5wIa_NsqsgH5QAAAcs"]
[Fri Feb 27 01:36:12.737704 2026] [:error] [pid 19020:tid 19031] [client 20.151.2.242:49027] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kill.php"] [unique_id "aaCEjLN3kp7wL6QzPnUimwAAAUk"]
[Fri Feb 27 01:36:13.240967 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:49028] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/wp-login.php"] [unique_id "aaCEjbN3kp7wL6QzPnUingAAAVY"]
[Fri Feb 27 01:36:13.658816 2026] [:error] [pid 19020:tid 19037] [client 20.151.2.242:49699] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aaCEjbN3kp7wL6QzPnUipAAAAU8"]
[Fri Feb 27 01:36:14.100199 2026] [:error] [pid 18818:tid 18893] [client 20.151.2.242:49690] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aaCEjhhPgqk2SeS_W83BYgAAAAk"]
[Fri Feb 27 01:36:14.556217 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:49684] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aaCEjpZBS5wIa_NsqsgH6QAAAcA"]
[Fri Feb 27 01:36:14.986956 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:46836] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aaCEjpZBS5wIa_NsqsgH6gAAAcc"]
[Fri Feb 27 01:36:15.415872 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:49707] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/lsd.php"] [unique_id "aaCEj5ZBS5wIa_NsqsgH7QAAAdM"]
[Fri Feb 27 01:36:15.876836 2026] [:error] [pid 18843:tid 18963] [client 20.151.2.242:46763] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/lsd.php"] [unique_id "aaCEjyuD2bhSYSowPs39pwAAARc"]
[Fri Feb 27 01:36:16.363588 2026] [:error] [pid 18843:tid 18964] [client 20.151.2.242:49756] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/lsd.php"] [unique_id "aaCEkCuD2bhSYSowPs39qQAAARg"]
[Fri Feb 27 01:36:16.801051 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:49039] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/lsd.php"] [unique_id "aaCEkJZBS5wIa_NsqsgH8gAAAdE"]
[Fri Feb 27 01:36:17.218526 2026] [:error] [pid 18831:tid 18935] [client 20.151.2.242:49026] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/text.php"] [unique_id "aaCEkf5KHTHUIuWRG2bKRQAAAFY"]
[Fri Feb 27 01:36:17.714940 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:49132] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/text.php"] [unique_id "aaCEkZZBS5wIa_NsqsgH9QAAAdY"]
[Fri Feb 27 01:36:18.260935 2026] [:error] [pid 19020:tid 19031] [client 20.151.2.242:49083] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/text.php"] [unique_id "aaCEkrN3kp7wL6QzPnUirgAAAUk"]
[Fri Feb 27 01:36:18.939697 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:50480] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/text.php"] [unique_id "aaCEkpZBS5wIa_NsqsgH_wAAAcw"]
[Fri Feb 27 01:36:19.439980 2026] [:error] [pid 18843:tid 18960] [client 20.151.2.242:49127] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCEkyuD2bhSYSowPs39rAAAARQ"]
[Fri Feb 27 01:36:20.013401 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:49728] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCElJZBS5wIa_NsqsgIBwAAAdA"]
[Fri Feb 27 01:36:20.538455 2026] [:error] [pid 19020:tid 19039] [client 20.151.2.242:46772] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCElLN3kp7wL6QzPnUitQAAAVE"]
[Fri Feb 27 01:36:21.033478 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:49117] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCElZZBS5wIa_NsqsgIDQAAAdM"]
[Fri Feb 27 01:36:21.640885 2026] [:error] [pid 19020:tid 19036] [client 20.151.2.242:49073] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aaCElbN3kp7wL6QzPnUiuwAAAU4"]
[Fri Feb 27 01:36:22.423728 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:49720] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aaCElpZBS5wIa_NsqsgIIQAAAcw"]
[Fri Feb 27 01:36:22.954609 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:49094] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aaCElpZBS5wIa_NsqsgIKgAAAdE"]
[Fri Feb 27 01:36:23.543777 2026] [:error] [pid 18831:tid 18932] [client 20.151.2.242:49701] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aaCEl_5KHTHUIuWRG2bKUAAAAFM"]
[Fri Feb 27 01:36:24.288528 2026] [:error] [pid 18843:tid 18961] [client 20.151.2.242:49782] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaCEmCuD2bhSYSowPs39rwAAARU"]
[Fri Feb 27 01:36:25.066836 2026] [:error] [pid 18831:tid 18935] [client 20.151.2.242:49666] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaCEmf5KHTHUIuWRG2bKVQAAAFY"]
[Fri Feb 27 01:36:25.665475 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:49067] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaCEmZZBS5wIa_NsqsgIPwAAAdc"]
[Fri Feb 27 01:36:27.324342 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49704] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X57.php"] [unique_id "aaCEm5ZBS5wIa_NsqsgIRwAAAcM"]
[Fri Feb 27 01:36:28.347818 2026] [:error] [pid 19020:tid 19041] [client 20.151.2.242:49087] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaCEnLN3kp7wL6QzPnUizgAAAVM"]
[Fri Feb 27 01:36:31.101952 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:49710] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaCEn7N3kp7wL6QzPnUi1AAAAVY"]
[Fri Feb 27 01:36:31.726829 2026] [:error] [pid 18818:tid 18902] [client 20.151.2.242:49723] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaCEnxhPgqk2SeS_W83BaAAAABI"]
[Fri Feb 27 01:36:33.120155 2026] [:error] [pid 19020:tid 19026] [client 20.151.2.242:49731] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaCEobN3kp7wL6QzPnUi1gAAAUQ"]
[Fri Feb 27 01:36:34.272885 2026] [:error] [pid 20059:tid 20107] [client 20.151.2.242:49743] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aaCEopZBS5wIa_NsqsgIXQAAAcU"]
[Fri Feb 27 01:36:35.307862 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:49694] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aaCEo5ZBS5wIa_NsqsgIYwAAAdE"]
[Fri Feb 27 01:36:36.280476 2026] [:error] [pid 18831:tid 18913] [client 20.151.2.242:50539] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aaCEpP5KHTHUIuWRG2bKaAAAAEA"]
[Fri Feb 27 01:36:37.960778 2026] [:error] [pid 18831:tid 18934] [client 20.151.2.242:46816] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/123.php"] [unique_id "aaCEpf5KHTHUIuWRG2bKbQAAAFU"]
[Fri Feb 27 01:36:38.767439 2026] [:error] [pid 20059:tid 20117] [client 20.151.2.242:50455] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-discussion.php"] [unique_id "aaCEppZBS5wIa_NsqsgIdgAAAc8"]
[Fri Feb 27 01:36:39.446799 2026] [:error] [pid 20059:tid 20116] [client 20.151.2.242:49044] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-discussion.php"] [unique_id "aaCEp5ZBS5wIa_NsqsgIewAAAc4"]
[Fri Feb 27 01:36:39.980971 2026] [:error] [pid 19020:tid 19023] [client 20.151.2.242:49034] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-discussion.php"] [unique_id "aaCEp7N3kp7wL6QzPnUi3QAAAUE"]
[Fri Feb 27 01:36:40.526170 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:49120] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options-discussion.php"] [unique_id "aaCEqJZBS5wIa_NsqsgIgQAAAcs"]
[Fri Feb 27 01:36:41.097592 2026] [:error] [pid 19020:tid 19024] [client 20.151.2.242:46811] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aaCEqbN3kp7wL6QzPnUi4gAAAUI"]
[Fri Feb 27 01:36:41.801195 2026] [:error] [pid 20059:tid 20116] [client 20.151.2.242:50530] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aaCEqZZBS5wIa_NsqsgIjgAAAc4"]
[Fri Feb 27 01:36:42.238204 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:40420] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aaCEqpZBS5wIa_NsqsgIlAAAAcs"]
[Fri Feb 27 01:36:43.044694 2026] [:error] [pid 20059:tid 20111] [client 20.151.2.242:49697] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aaCEq5ZBS5wIa_NsqsgIoAAAAck"]
[Fri Feb 27 01:36:43.647061 2026] [:error] [pid 20059:tid 20116] [client 20.151.2.242:49118] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaCEq5ZBS5wIa_NsqsgIrgAAAc4"]
[Fri Feb 27 01:36:44.281407 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:49082] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaCErJZBS5wIa_NsqsgItwAAAdY"]
[Fri Feb 27 01:36:44.933237 2026] [:error] [pid 18843:tid 18962] [client 20.151.2.242:46817] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaCErCuD2bhSYSowPs39tQAAARY"]
[Fri Feb 27 01:36:45.423471 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:49711] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aaCErZZBS5wIa_NsqsgIxwAAAcQ"]
[Fri Feb 27 01:36:46.008980 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:50483] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaCErrN3kp7wL6QzPnUi5QAAAVA"]
[Fri Feb 27 01:36:46.590843 2026] [:error] [pid 18831:tid 18921] [client 20.151.2.242:49103] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaCErv5KHTHUIuWRG2bKcAAAAEg"]
[Fri Feb 27 01:36:47.087649 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:46773] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaCEr5ZBS5wIa_NsqsgI4QAAAcY"]
[Fri Feb 27 01:36:47.723530 2026] [:error] [pid 20059:tid 20112] [client 20.151.2.242:49121] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "aaCEr5ZBS5wIa_NsqsgI6AAAAco"]
[Fri Feb 27 01:36:48.153150 2026] [:error] [pid 19020:tid 19043] [client 20.151.2.242:49789] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "aaCEsLN3kp7wL6QzPnUi5gAAAVU"]
[Fri Feb 27 01:36:48.688781 2026] [:error] [pid 18843:tid 18961] [client 20.151.2.242:49778] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/credits.php"] [unique_id "aaCEsCuD2bhSYSowPs39vAAAARU"]
[Fri Feb 27 01:36:49.378822 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:50434] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/credits.php"] [unique_id "aaCEsZZBS5wIa_NsqsgI9wAAAcQ"]
[Fri Feb 27 01:36:50.130259 2026] [:error] [pid 18831:tid 18935] [client 20.151.2.242:46843] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/credits.php"] [unique_id "aaCEsv5KHTHUIuWRG2bKcwAAAFY"]
[Fri Feb 27 01:36:50.912058 2026] [:error] [pid 20059:tid 20111] [client 20.151.2.242:49146] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaCEspZBS5wIa_NsqsgJBQAAAck"]
[Fri Feb 27 01:36:51.511536 2026] [:error] [pid 18843:tid 18945] [client 20.151.2.242:40386] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaCEsyuD2bhSYSowPs39wAAAAQU"]
[Fri Feb 27 01:36:52.121759 2026] [:error] [pid 19020:tid 19022] [client 20.151.2.242:40389] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaCEtLN3kp7wL6QzPnUi6gAAAUA"]
[Fri Feb 27 01:36:52.634095 2026] [:error] [pid 18843:tid 18955] [client 20.151.2.242:49682] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaCEtCuD2bhSYSowPs39wwAAAQ8"]
[Fri Feb 27 01:36:53.639201 2026] [:error] [pid 19020:tid 19043] [client 20.151.2.242:49149] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaCEtbN3kp7wL6QzPnUi9gAAAVU"]
[Fri Feb 27 01:36:54.342582 2026] [:error] [pid 18818:tid 18897] [client 20.151.2.242:49145] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaCEthhPgqk2SeS_W83BdQAAAA0"]
[Fri Feb 27 01:36:55.118498 2026] [:error] [pid 19020:tid 19040] [client 20.151.2.242:49712] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaCEt7N3kp7wL6QzPnUi-gAAAVI"]
[Fri Feb 27 01:36:55.667253 2026] [:error] [pid 18818:tid 18908] [client 20.151.2.242:49130] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/R57.php"] [unique_id "aaCEtxhPgqk2SeS_W83BdwAAABg"]
[Fri Feb 27 01:36:56.232402 2026] [:error] [pid 18843:tid 18949] [client 20.151.2.242:50519] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "aaCEuCuD2bhSYSowPs39zAAAAQk"]
[Fri Feb 27 01:36:56.919918 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:49046] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "aaCEuJZBS5wIa_NsqsgJLQAAAdE"]
[Fri Feb 27 01:36:57.494626 2026] [:error] [pid 20059:tid 20120] [client 20.151.2.242:49747] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "aaCEuZZBS5wIa_NsqsgJMwAAAdI"]
[Fri Feb 27 01:36:58.086276 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:46787] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "aaCEurN3kp7wL6QzPnUjAgAAAVY"]
[Fri Feb 27 01:36:58.577543 2026] [:error] [pid 19020:tid 19026] [client 20.151.2.242:46736] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aaCEurN3kp7wL6QzPnUjBAAAAUQ"]
[Fri Feb 27 01:36:59.188850 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:49107] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aaCEu5ZBS5wIa_NsqsgJRAAAAdM"]
[Fri Feb 27 01:36:59.636427 2026] [:error] [pid 20059:tid 20112] [client 20.151.2.242:50537] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aaCEu5ZBS5wIa_NsqsgJSQAAAco"]
[Fri Feb 27 01:37:00.113718 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:49123] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aaCEvJZBS5wIa_NsqsgJTQAAAcY"]
[Fri Feb 27 01:37:00.588477 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:49108] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aaCEvJZBS5wIa_NsqsgJUwAAAcw"]
[Fri Feb 27 01:37:01.077267 2026] [:error] [pid 18818:tid 18898] [client 20.151.2.242:40362] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aaCEvRhPgqk2SeS_W83BeAAAAA4"]
[Fri Feb 27 01:37:01.753429 2026] [:error] [pid 18831:tid 18932] [client 20.151.2.242:49689] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aaCEvf5KHTHUIuWRG2bKfQAAAFM"]
[Fri Feb 27 01:37:02.250874 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:50478] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "aaCEvpZBS5wIa_NsqsgJZwAAAdY"]
[Fri Feb 27 01:37:02.835721 2026] [:error] [pid 18843:tid 18957] [client 20.151.2.242:49086] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaCEviuD2bhSYSowPs393wAAARE"]
[Fri Feb 27 01:37:03.336480 2026] [:error] [pid 18843:tid 18941] [client 20.151.2.242:50549] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aaCEvyuD2bhSYSowPs394gAAAQE"]
[Fri Feb 27 01:37:03.906681 2026] [:error] [pid 20059:tid 20117] [client 20.151.2.242:46831] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aaCEv5ZBS5wIa_NsqsgJfAAAAc8"]
[Fri Feb 27 01:37:04.828592 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:46751] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aaCEwJZBS5wIa_NsqsgJhQAAAcA"]
[Fri Feb 27 01:37:05.540308 2026] [:error] [pid 19020:tid 19032] [client 20.151.2.242:46727] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aaCEwbN3kp7wL6QzPnUjCwAAAUo"]
[Fri Feb 27 01:37:06.451679 2026] [:error] [pid 18818:tid 18893] [client 20.151.2.242:46807] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "aaCEwhhPgqk2SeS_W83BfQAAAAk"]
[Fri Feb 27 01:37:07.181703 2026] [:error] [pid 19020:tid 19046] [client 20.151.2.242:40403] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Feb 27 01:37:07.432084 2026] [:error] [pid 19020:tid 19034] [client 20.151.2.242:40403] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Fri Feb 27 01:37:07.671534 2026] [:error] [pid 19020:tid 19041] [client 20.151.2.242:40403] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Fri Feb 27 01:37:07.922240 2026] [:error] [pid 19020:tid 19042] [client 20.151.2.242:40403] File does not exist: /usr/local/apache/htdocs/suspended-page/cmdo.php
[Fri Feb 27 01:37:08.182764 2026] [:error] [pid 19020:tid 19031] [client 20.151.2.242:40403] File does not exist: /usr/local/apache/htdocs/suspended-page/lkui.php
[Fri Feb 27 01:37:09.164949 2026] [:error] [pid 19020:tid 19035] [client 20.151.2.242:40403] File does not exist: /usr/local/apache/htdocs/suspended-page/ws72.php
[Fri Feb 27 01:37:09.640486 2026] [:error] [pid 19020:tid 19023] [client 20.151.2.242:40403] File does not exist: /usr/local/apache/htdocs/suspended-page/root.php
[Fri Feb 27 01:37:09.871363 2026] [:error] [pid 19020:tid 19030] [client 20.151.2.242:40403] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaCExbN3kp7wL6QzPnUjHwAAAUg"]
[Fri Feb 27 01:37:10.369922 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:49740] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaCExpZBS5wIa_NsqsgJnwAAAdY"]
[Fri Feb 27 01:37:10.848813 2026] [:error] [pid 19020:tid 19046] [client 20.151.2.242:50487] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaCExrN3kp7wL6QzPnUjIQAAAVg"]
[Fri Feb 27 01:37:11.316753 2026] [:error] [pid 20059:tid 20117] [client 20.151.2.242:49119] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaCEx5ZBS5wIa_NsqsgJowAAAc8"]
[Fri Feb 27 01:37:11.823654 2026] [:error] [pid 19020:tid 19034] [client 20.151.2.242:46755] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/item.php"] [unique_id "aaCEx7N3kp7wL6QzPnUjJAAAAUw"]
[Fri Feb 27 01:37:12.353020 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:49055] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/item.php"] [unique_id "aaCEyJZBS5wIa_NsqsgJqQAAAcI"]
[Fri Feb 27 01:37:12.853735 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:49054] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/item.php"] [unique_id "aaCEyJZBS5wIa_NsqsgJrgAAAcA"]
[Fri Feb 27 01:37:13.449673 2026] [:error] [pid 19020:tid 19026] [client 20.151.2.242:49686] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/item.php"] [unique_id "aaCEybN3kp7wL6QzPnUjKAAAAUQ"]
[Fri Feb 27 01:37:13.872422 2026] [:error] [pid 20059:tid 20126] [client 20.151.2.242:46781] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "aaCEyZZBS5wIa_NsqsgJtAAAAdg"]
[Fri Feb 27 01:37:14.321886 2026] [:error] [pid 18831:tid 18923] [client 20.151.2.242:49109] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "aaCEyv5KHTHUIuWRG2bKgwAAAEo"]
[Fri Feb 27 01:37:14.868568 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:46815] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "aaCEyrN3kp7wL6QzPnUjLgAAAVA"]
[Fri Feb 27 01:37:15.452317 2026] [:error] [pid 18818:tid 18885] [client 20.151.2.242:50446] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "aaCEyxhPgqk2SeS_W83BhAAAAAE"]
[Fri Feb 27 01:37:15.968209 2026] [:error] [pid 18818:tid 18905] [client 20.151.2.242:50524] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cache.php"] [unique_id "aaCEyxhPgqk2SeS_W83BiAAAABU"]
[Fri Feb 27 01:37:16.497925 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49030] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cache.php"] [unique_id "aaCEzJZBS5wIa_NsqsgJwAAAAcM"]
[Fri Feb 27 01:37:16.946584 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:46822] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cache.php"] [unique_id "aaCEzJZBS5wIa_NsqsgJxQAAAdE"]
[Fri Feb 27 01:37:17.406473 2026] [:error] [pid 20059:tid 20120] [client 20.151.2.242:49755] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cache.php"] [unique_id "aaCEzZZBS5wIa_NsqsgJyAAAAdI"]
[Fri Feb 27 01:37:17.871082 2026] [:error] [pid 18818:tid 18894] [client 20.151.2.242:46777] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "aaCEzRhPgqk2SeS_W83BjQAAAAo"]
[Fri Feb 27 01:37:18.325913 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:49068] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "aaCEzpZBS5wIa_NsqsgJywAAAdY"]
[Fri Feb 27 01:37:18.749259 2026] [:error] [pid 18843:tid 18948] [client 20.151.2.242:46795] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "aaCEziuD2bhSYSowPs3-HgAAAQg"]
[Fri Feb 27 01:37:19.293359 2026] [:error] [pid 18843:tid 18941] [client 20.151.2.242:46770] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "aaCEzyuD2bhSYSowPs3-IwAAAQE"]
[Fri Feb 27 01:37:19.751998 2026] [:error] [pid 20059:tid 20115] [client 20.151.2.242:50521] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aaCEz5ZBS5wIa_NsqsgJ0AAAAc0"]
[Fri Feb 27 01:37:20.181863 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:49762] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aaCE0JZBS5wIa_NsqsgJ0wAAAcM"]
[Fri Feb 27 01:37:20.612161 2026] [:error] [pid 20059:tid 20107] [client 20.151.2.242:50526] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aaCE0JZBS5wIa_NsqsgJ1gAAAcU"]
[Fri Feb 27 01:37:21.037016 2026] [:error] [pid 18843:tid 18956] [client 20.151.2.242:49064] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aaCE0SuD2bhSYSowPs3-LAAAARA"]
[Fri Feb 27 01:37:21.481759 2026] [:error] [pid 19020:tid 19041] [client 20.151.2.242:49080] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media-upload.php"] [unique_id "aaCE0bN3kp7wL6QzPnUjNQAAAVM"]
[Fri Feb 27 01:37:21.961062 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:50500] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media-upload.php"] [unique_id "aaCE0ZZBS5wIa_NsqsgJ4QAAAdM"]
[Fri Feb 27 01:37:22.440065 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:46756] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media-upload.php"] [unique_id "aaCE0pZBS5wIa_NsqsgJ5AAAAcc"]
[Fri Feb 27 01:37:22.865403 2026] [:error] [pid 20059:tid 20122] [client 20.151.2.242:49061] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media-upload.php"] [unique_id "aaCE0pZBS5wIa_NsqsgJ5gAAAdQ"]
[Fri Feb 27 01:37:23.306756 2026] [:error] [pid 18831:tid 18918] [client 20.151.2.242:46789] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaCE0_5KHTHUIuWRG2bKiAAAAEU"]
[Fri Feb 27 01:37:23.754939 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:49061] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaCE05ZBS5wIa_NsqsgJ7QAAAcY"]
[Fri Feb 27 01:37:24.199037 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:46790] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaCE1JZBS5wIa_NsqsgJ7wAAAdM"]
[Fri Feb 27 01:37:24.632044 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:49078] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaCE1JZBS5wIa_NsqsgJ8QAAAcc"]
[Fri Feb 27 01:37:25.069115 2026] [:error] [pid 20059:tid 20115] [client 20.151.2.242:49105] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaCE1ZZBS5wIa_NsqsgJ9AAAAc0"]
[Fri Feb 27 01:37:25.504058 2026] [:error] [pid 18843:tid 18960] [client 20.151.2.242:50432] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaCE1SuD2bhSYSowPs3-OAAAARQ"]
[Fri Feb 27 01:37:25.929378 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:46729] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaCE1ZZBS5wIa_NsqsgJ-AAAAcw"]
[Fri Feb 27 01:37:26.385824 2026] [:error] [pid 20059:tid 20123] [client 20.151.2.242:46793] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaCE1pZBS5wIa_NsqsgJ_AAAAdU"]
[Fri Feb 27 01:37:26.814913 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:49078] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aaCE1pZBS5wIa_NsqsgJ_wAAAcY"]
[Fri Feb 27 01:37:27.243583 2026] [:error] [pid 20059:tid 20103] [client 20.151.2.242:19680] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aaCE15ZBS5wIa_NsqsgKAgAAAcE"]
[Fri Feb 27 01:37:27.701441 2026] [:error] [pid 19020:tid 19044] [client 20.151.2.242:40401] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aaCE17N3kp7wL6QzPnUjOgAAAVY"]
[Fri Feb 27 01:37:28.289816 2026] [:error] [pid 18843:tid 18964] [client 20.151.2.242:50439] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aaCE2CuD2bhSYSowPs3-PgAAARg"]
[Fri Feb 27 01:37:28.743472 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:46829] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaCE2LN3kp7wL6QzPnUjOwAAAVA"]
[Fri Feb 27 01:37:29.190773 2026] [:error] [pid 19020:tid 19036] [client 20.151.2.242:50462] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaCE2bN3kp7wL6QzPnUjPgAAAU4"]
[Fri Feb 27 01:37:29.635533 2026] [:error] [pid 18843:tid 18956] [client 20.151.2.242:46728] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaCE2SuD2bhSYSowPs3-PwAAARA"]
[Fri Feb 27 01:37:30.128207 2026] [:error] [pid 19020:tid 19027] [client 20.151.2.242:49718] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaCE2rN3kp7wL6QzPnUjQwAAAUU"]
[Fri Feb 27 01:37:30.559440 2026] [:error] [pid 18818:tid 18903] [client 20.151.2.242:40441] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaCE2hhPgqk2SeS_W83BkAAAABM"]
[Fri Feb 27 01:37:31.100341 2026] [:error] [pid 18831:tid 18922] [client 20.151.2.242:46821] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaCE2_5KHTHUIuWRG2bKiQAAAEk"]
[Fri Feb 27 01:37:31.616024 2026] [:error] [pid 19020:tid 19041] [client 20.151.2.242:49079] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaCE27N3kp7wL6QzPnUjRQAAAVM"]
[Fri Feb 27 01:37:32.170623 2026] [:error] [pid 20059:tid 20110] [client 20.151.2.242:40417] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaCE3JZBS5wIa_NsqsgKFgAAAcg"]
[Fri Feb 27 01:37:32.652372 2026] [:error] [pid 18843:tid 18958] [client 20.151.2.242:46726] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/widgets.php"] [unique_id "aaCE3CuD2bhSYSowPs3-QAAAARI"]
[Fri Feb 27 01:37:33.092967 2026] [:error] [pid 20059:tid 20115] [client 20.151.2.242:49043] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/widgets.php"] [unique_id "aaCE3ZZBS5wIa_NsqsgKGwAAAc0"]
[Fri Feb 27 01:37:33.574963 2026] [:error] [pid 18818:tid 18899] [client 20.151.2.242:49748] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/widgets.php"] [unique_id "aaCE3RhPgqk2SeS_W83BkgAAAA8"]
[Fri Feb 27 01:37:34.008352 2026] [:error] [pid 19020:tid 19023] [client 20.151.2.242:46731] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/widgets.php"] [unique_id "aaCE3rN3kp7wL6QzPnUjSQAAAUE"]
[Fri Feb 27 01:37:34.489961 2026] [:error] [pid 20059:tid 20116] [client 20.151.2.242:49761] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaCE3pZBS5wIa_NsqsgKIAAAAc4"]
[Fri Feb 27 01:37:35.001211 2026] [:error] [pid 19020:tid 19034] [client 20.151.2.242:46805] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaCE3rN3kp7wL6QzPnUjTgAAAUw"]
[Fri Feb 27 01:37:35.467779 2026] [:error] [pid 18831:tid 18917] [client 20.151.2.242:49753] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaCE3_5KHTHUIuWRG2bKjwAAAEQ"]
[Fri Feb 27 01:37:35.916181 2026] [:error] [pid 20059:tid 20110] [client 20.151.2.242:50485] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaCE35ZBS5wIa_NsqsgKJQAAAcg"]
[Fri Feb 27 01:37:36.519950 2026] [:error] [pid 20059:tid 20112] [client 20.151.2.242:46833] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/freedoms.php"] [unique_id "aaCE4JZBS5wIa_NsqsgKKAAAAco"]
[Fri Feb 27 01:37:37.682894 2026] [:error] [pid 19020:tid 19039] [client 20.151.2.242:50499] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/freedoms.php"] [unique_id "aaCE4bN3kp7wL6QzPnUjUgAAAVE"]
[Fri Feb 27 01:37:38.224158 2026] [:error] [pid 19020:tid 19043] [client 20.151.2.242:46741] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/freedoms.php"] [unique_id "aaCE4rN3kp7wL6QzPnUjVQAAAVU"]
[Fri Feb 27 01:37:38.851050 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:49779] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/freedoms.php"] [unique_id "aaCE4pZBS5wIa_NsqsgKLwAAAdA"]
[Fri Feb 27 01:37:39.515455 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:40439] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaCE45ZBS5wIa_NsqsgKMAAAAcs"]
[Fri Feb 27 01:37:40.088343 2026] [:error] [pid 18831:tid 18935] [client 20.151.2.242:46802] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaCE5P5KHTHUIuWRG2bKkQAAAFY"]
[Fri Feb 27 01:37:40.777566 2026] [:error] [pid 18843:tid 18940] [client 20.151.2.242:19653] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaCE5CuD2bhSYSowPs3-RAAAAQA"]
[Fri Feb 27 01:37:41.215556 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:49703] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaCE5ZZBS5wIa_NsqsgKOAAAAcY"]
[Fri Feb 27 01:37:41.761340 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:49136] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaCE5ZZBS5wIa_NsqsgKOgAAAcA"]
[Fri Feb 27 01:37:42.219903 2026] [:error] [pid 20059:tid 20107] [client 20.151.2.242:46782] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaCE5pZBS5wIa_NsqsgKOwAAAcU"]
[Fri Feb 27 01:37:42.635955 2026] [:error] [pid 18831:tid 18931] [client 20.151.2.242:49071] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaCE5v5KHTHUIuWRG2bKkgAAAFI"]
[Fri Feb 27 01:37:43.372643 2026] [:error] [pid 18818:tid 18885] [client 20.151.2.242:46838] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aaCE5xhPgqk2SeS_W83BlAAAAAE"]
[Fri Feb 27 01:37:43.875002 2026] [:error] [pid 18818:tid 18905] [client 20.151.2.242:46827] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaCE5xhPgqk2SeS_W83BlwAAABU"]
[Fri Feb 27 01:37:44.316900 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:46792] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaCE6JZBS5wIa_NsqsgKQAAAAdA"]
[Fri Feb 27 01:37:44.849766 2026] [:error] [pid 18818:tid 18894] [client 20.151.2.242:49721] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaCE6BhPgqk2SeS_W83BmgAAAAo"]
[Fri Feb 27 01:37:45.324656 2026] [:error] [pid 18831:tid 18923] [client 20.151.2.242:49051] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/setup-config.php"] [unique_id "aaCE6f5KHTHUIuWRG2bKlAAAAEo"]
[Fri Feb 27 01:37:45.959552 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:46844] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaCE6ZZBS5wIa_NsqsgKSQAAAcY"]
[Fri Feb 27 01:37:46.524059 2026] [:error] [pid 18831:tid 18916] [client 20.151.2.242:40390] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaCE6v5KHTHUIuWRG2bKlQAAAEM"]
[Fri Feb 27 01:37:46.995069 2026] [:error] [pid 20059:tid 20118] [client 20.151.2.242:50535] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaCE6pZBS5wIa_NsqsgKTwAAAdA"]
[Fri Feb 27 01:37:47.692212 2026] [:error] [pid 18843:tid 18944] [client 20.151.2.242:49076] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaCE6yuD2bhSYSowPs3-SQAAAQQ"]
[Fri Feb 27 01:37:48.171804 2026] [:error] [pid 18843:tid 18955] [client 20.151.2.242:49116] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/71.php"] [unique_id "aaCE7CuD2bhSYSowPs3-SgAAAQ8"]
[Fri Feb 27 01:37:48.643767 2026] [:error] [pid 19020:tid 19043] [client 20.151.2.242:49128] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/71.php"] [unique_id "aaCE7LN3kp7wL6QzPnUjaAAAAVU"]
[Fri Feb 27 01:37:49.171062 2026] [:error] [pid 19020:tid 19034] [client 20.151.2.242:49025] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/71.php"] [unique_id "aaCE7bN3kp7wL6QzPnUjdgAAAUw"]
[Fri Feb 27 01:37:49.636957 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:49024] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/71.php"] [unique_id "aaCE7ZZBS5wIa_NsqsgKXgAAAcI"]
[Fri Feb 27 01:37:50.171317 2026] [:error] [pid 18843:tid 18956] [client 20.151.2.242:46841] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aaCE7iuD2bhSYSowPs3-TAAAARA"]
[Fri Feb 27 01:37:50.654179 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:46813] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aaCE7pZBS5wIa_NsqsgKXwAAAdc"]
[Fri Feb 27 01:37:51.157559 2026] [:error] [pid 20059:tid 20123] [client 20.151.2.242:46788] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aaCE75ZBS5wIa_NsqsgKYQAAAdU"]
[Fri Feb 27 01:37:51.607584 2026] [:error] [pid 20059:tid 20111] [client 20.151.2.242:46784] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "aaCE75ZBS5wIa_NsqsgKYwAAAck"]
[Fri Feb 27 01:37:52.112743 2026] [:error] [pid 18831:tid 18926] [client 20.151.2.242:49105] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aaCE8P5KHTHUIuWRG2bKmQAAAE0"]
[Fri Feb 27 01:37:52.554174 2026] [:error] [pid 18843:tid 18958] [client 20.151.2.242:46768] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aaCE8CuD2bhSYSowPs3-TwAAARI"]
[Fri Feb 27 01:37:52.981417 2026] [:error] [pid 18818:tid 18903] [client 20.151.2.242:49042] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aaCE8BhPgqk2SeS_W83BvQAAABM"]
[Fri Feb 27 01:37:53.448328 2026] [:error] [pid 18843:tid 18954] [client 20.151.2.242:40328] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "aaCE8SuD2bhSYSowPs3-UAAAAQ4"]
[Fri Feb 27 01:37:53.924046 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:40330] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaCE8ZZBS5wIa_NsqsgKaQAAAcQ"]
[Fri Feb 27 01:37:54.610552 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:49737] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaCE8rN3kp7wL6QzPnUjhAAAAVA"]
[Fri Feb 27 01:37:55.072139 2026] [:error] [pid 20059:tid 20102] [client 20.151.2.242:40419] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaCE85ZBS5wIa_NsqsgKawAAAcA"]
[Fri Feb 27 01:37:55.579925 2026] [:error] [pid 18831:tid 18928] [client 20.151.2.242:46809] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaCE8_5KHTHUIuWRG2bKngAAAE8"]
[Fri Feb 27 01:37:56.028216 2026] [:error] [pid 20059:tid 20103] [client 20.151.2.242:49056] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aaCE9JZBS5wIa_NsqsgKcQAAAcE"]
[Fri Feb 27 01:37:56.491634 2026] [:error] [pid 18843:tid 18943] [client 20.151.2.242:40387] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aaCE9CuD2bhSYSowPs3-UgAAAQM"]
[Fri Feb 27 01:37:56.913849 2026] [:error] [pid 19020:tid 19040] [client 20.151.2.242:46722] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aaCE9LN3kp7wL6QzPnUjhwAAAVI"]
[Fri Feb 27 01:37:57.423252 2026] [:error] [pid 20059:tid 20108] [client 20.151.2.242:46767] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-header.php"] [unique_id "aaCE9ZZBS5wIa_NsqsgKewAAAcY"]
[Fri Feb 27 01:37:57.938409 2026] [:error] [pid 20059:tid 20126] [client 20.151.2.242:40429] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aaCE9ZZBS5wIa_NsqsgKfgAAAdg"]
[Fri Feb 27 01:37:58.383911 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:46824] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aaCE9pZBS5wIa_NsqsgKgAAAAcI"]
[Fri Feb 27 01:37:58.808583 2026] [:error] [pid 20059:tid 20120] [client 20.151.2.242:40400] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aaCE9pZBS5wIa_NsqsgKggAAAdI"]
[Fri Feb 27 01:37:59.264669 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:46733] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aaCE95ZBS5wIa_NsqsgKhAAAAdE"]
[Fri Feb 27 01:37:59.706816 2026] [:error] [pid 18843:tid 18959] [client 20.151.2.242:46754] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaCE9yuD2bhSYSowPs3-VQAAARM"]
[Fri Feb 27 01:38:00.139656 2026] [:error] [pid 18843:tid 18941] [client 20.151.2.242:40444] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaCE-CuD2bhSYSowPs3-VgAAAQE"]
[Fri Feb 27 01:38:00.559693 2026] [:error] [pid 18831:tid 18935] [client 20.151.2.242:46820] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaCE-P5KHTHUIuWRG2bKogAAAFY"]
[Fri Feb 27 01:38:01.000672 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:49695] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aaCE-JZBS5wIa_NsqsgKiAAAAcc"]
[Fri Feb 27 01:38:01.558120 2026] [:error] [pid 20059:tid 20107] [client 20.151.2.242:40349] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin.php"] [unique_id "aaCE-ZZBS5wIa_NsqsgKiwAAAcU"]
[Fri Feb 27 01:38:01.984994 2026] [:error] [pid 19020:tid 19025] [client 20.151.2.242:46730] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin.php"] [unique_id "aaCE-bN3kp7wL6QzPnUjkAAAAUM"]
[Fri Feb 27 01:38:02.476648 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:46720] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin.php"] [unique_id "aaCE-pZBS5wIa_NsqsgKkgAAAdE"]
[Fri Feb 27 01:38:03.041603 2026] [:error] [pid 20059:tid 20110] [client 20.151.2.242:46748] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin.php"] [unique_id "aaCE-5ZBS5wIa_NsqsgKlwAAAcg"]
[Fri Feb 27 01:38:03.604369 2026] [:error] [pid 20059:tid 20121] [client 20.151.2.242:40424] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaCE-5ZBS5wIa_NsqsgKmwAAAdM"]
[Fri Feb 27 01:38:04.115703 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:49708] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaCE_JZBS5wIa_NsqsgKoQAAAdE"]
[Fri Feb 27 01:38:04.555487 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:19657] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaCE_LN3kp7wL6QzPnUjkgAAAVA"]
[Fri Feb 27 01:38:05.007138 2026] [:error] [pid 18831:tid 18915] [client 20.151.2.242:49709] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aaCE_f5KHTHUIuWRG2bKpgAAAEI"]
[Fri Feb 27 01:38:05.474652 2026] [:error] [pid 19020:tid 19028] [client 20.151.2.242:40322] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aaCE_bN3kp7wL6QzPnUjlQAAAUY"]
[Fri Feb 27 01:38:05.932438 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:49032] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aaCE_ZZBS5wIa_NsqsgKpwAAAcs"]
[Fri Feb 27 01:38:06.410038 2026] [:error] [pid 18831:tid 18926] [client 20.151.2.242:46804] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aaCE_v5KHTHUIuWRG2bKqAAAAE0"]
[Fri Feb 27 01:38:06.843920 2026] [:error] [pid 20059:tid 20117] [client 20.151.2.242:50527] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "aaCE_pZBS5wIa_NsqsgKrAAAAc8"]
[Fri Feb 27 01:38:07.278504 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:50538] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeng.php"] [unique_id "aaCE_5ZBS5wIa_NsqsgKrwAAAdE"]
[Fri Feb 27 01:38:07.720587 2026] [:error] [pid 20059:tid 20124] [client 20.151.2.242:50494] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeng.php"] [unique_id "aaCE_5ZBS5wIa_NsqsgKswAAAdY"]
[Fri Feb 27 01:38:08.156800 2026] [:error] [pid 18843:tid 18951] [client 20.151.2.242:40440] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeng.php"] [unique_id "aaCFACuD2bhSYSowPs3-WwAAAQs"]
[Fri Feb 27 01:38:08.772759 2026] [:error] [pid 18831:tid 18918] [client 20.151.2.242:46785] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeng.php"] [unique_id "aaCFAP5KHTHUIuWRG2bKqgAAAEU"]
[Fri Feb 27 01:38:09.382947 2026] [:error] [pid 20059:tid 20106] [client 20.151.2.242:49763] [client 20.151.2.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.2.242, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aaCFAZZBS5wIa_NsqsgKtQAAAcQ"]
[Fri Feb 27 01:38:09.604471 2026] [:error] [pid 20059:tid 20104] [client 20.151.2.242:49763] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbex.php
[Fri Feb 27 01:38:10.150534 2026] [:error] [pid 20059:tid 20103] [client 20.151.2.242:49763] [client 20.151.2.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aaCFApZBS5wIa_NsqsgKugAAAcE"]
[Fri Feb 27 01:38:11.446520 2026] [:error] [pid 20059:tid 20107] [client 20.151.2.242:40425] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Fri Feb 27 01:38:11.665443 2026] [:error] [pid 20059:tid 20111] [client 20.151.2.242:40425] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Fri Feb 27 01:38:11.880190 2026] [:error] [pid 20059:tid 20125] [client 20.151.2.242:40425] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 01:38:12.106091 2026] [:error] [pid 20059:tid 20109] [client 20.151.2.242:40425] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Feb 27 01:38:12.608271 2026] [:error] [pid 20059:tid 20105] [client 20.151.2.242:40425] File does not exist: /usr/local/apache/htdocs/suspended-page/my.php
[Fri Feb 27 01:38:12.825721 2026] [:error] [pid 20059:tid 20103] [client 20.151.2.242:40425] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Fri Feb 27 01:38:13.124884 2026] [:error] [pid 20059:tid 20126] [client 20.151.2.242:40425] File does not exist: /usr/local/apache/htdocs/suspended-page/ws66.php
[Fri Feb 27 01:38:13.401765 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:40425] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php7"] [unique_id "aaCFBZZBS5wIa_NsqsgKygAAAdE"]
[Fri Feb 27 01:38:13.976370 2026] [:error] [pid 20059:tid 20114] [client 20.151.2.242:40447] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php7"] [unique_id "aaCFBZZBS5wIa_NsqsgKzAAAAcw"]
[Fri Feb 27 01:38:14.535656 2026] [:error] [pid 18831:tid 18914] [client 20.151.2.242:46845] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php7"] [unique_id "aaCFBv5KHTHUIuWRG2bKrwAAAEE"]
[Fri Feb 27 01:38:15.053167 2026] [:error] [pid 19020:tid 19038] [client 20.151.2.242:46733] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php7"] [unique_id "aaCFB7N3kp7wL6QzPnUjnQAAAVA"]
[Fri Feb 27 01:38:15.587338 2026] [:error] [pid 19020:tid 19046] [client 20.151.2.242:40398] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/user-new.php"] [unique_id "aaCFB7N3kp7wL6QzPnUjnwAAAVg"]
[Fri Feb 27 01:38:16.025950 2026] [:error] [pid 20059:tid 20113] [client 20.151.2.242:50459] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/user-new.php"] [unique_id "aaCFCJZBS5wIa_NsqsgK0gAAAcs"]
[Fri Feb 27 01:38:16.582787 2026] [:error] [pid 20059:tid 20116] [client 20.151.2.242:40412] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/user-new.php"] [unique_id "aaCFCJZBS5wIa_NsqsgK1QAAAc4"]
[Fri Feb 27 01:38:17.024997 2026] [:error] [pid 20059:tid 20119] [client 20.151.2.242:40385] [client 20.151.2.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/user-new.php"] [unique_id "aaCFCZZBS5wIa_NsqsgK2AAAAdE"]
[Fri Feb 27 01:39:08.278633 2026] [:error] [pid 18831:tid 18926] [client 34.170.214.78:51207] [client 34.170.214.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.214.78, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaCFPP5KHTHUIuWRG2bK2AAAAE0"]
[Fri Feb 27 01:39:08.281800 2026] [:error] [pid 18831:tid 18926] [client 34.170.214.78:51207] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 01:39:10.768285 2026] [:error] [pid 18831:tid 18930] [client 34.170.214.78:51207] [client 34.170.214.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaCFPv5KHTHUIuWRG2bK6QAAAFE"]
[Fri Feb 27 01:39:11.162322 2026] [:error] [pid 18818:tid 18894] [client 34.170.214.78:64437] [client 34.170.214.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaCFPxhPgqk2SeS_W83B4wAAAAo"]
[Fri Feb 27 01:39:11.591706 2026] [:error] [pid 19020:tid 19045] [client 34.170.214.78:54546] [client 34.170.214.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaCFP7N3kp7wL6QzPnUj8AAAAVc"]
[Fri Feb 27 01:39:11.993317 2026] [:error] [pid 20059:tid 20104] [client 34.170.214.78:53020] [client 34.170.214.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaCFP5ZBS5wIa_NsqsgLkAAAAcI"]
[Fri Feb 27 01:39:12.397431 2026] [:error] [pid 18831:tid 18918] [client 34.170.214.78:52345] [client 34.170.214.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaCFQP5KHTHUIuWRG2bK8AAAAEU"]
[Fri Feb 27 01:39:12.821256 2026] [:error] [pid 18831:tid 18921] [client 34.170.214.78:53817] [client 34.170.214.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaCFQP5KHTHUIuWRG2bK9AAAAEg"]
[Fri Feb 27 01:39:13.229443 2026] [:error] [pid 20059:tid 20110] [client 34.170.214.78:57859] [client 34.170.214.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaCFQZZBS5wIa_NsqsgLlAAAAcg"]
[Fri Feb 27 01:44:43.451598 2026] [:error] [pid 18831:tid 18931] [client 4.205.37.160:23850] File does not exist: /usr/local/apache/htdocs/suspended-page/class3.php
[Fri Feb 27 01:44:43.660277 2026] [:error] [pid 18831:tid 18923] [client 4.205.37.160:23850] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 02:37:42.435016 2026] [:error] [pid 18831:tid 18920] [client 20.43.27.35:60073] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 02:37:42.669772 2026] [:error] [pid 18831:tid 18928] [client 20.43.27.35:60073] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 02:37:43.136634 2026] [:error] [pid 18831:tid 18927] [client 20.43.27.35:60073] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 27 02:37:43.362579 2026] [:error] [pid 18831:tid 18930] [client 20.43.27.35:60073] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 02:37:43.834511 2026] [:error] [pid 18831:tid 18914] [client 20.43.27.35:60073] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 27 02:37:44.072294 2026] [:error] [pid 18831:tid 18926] [client 20.43.27.35:60073] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 02:37:44.307605 2026] [:error] [pid 18831:tid 18935] [client 20.43.27.35:60073] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Feb 27 02:37:44.774067 2026] [:error] [pid 18831:tid 18922] [client 20.43.27.35:60073] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaCS-P5KHTHUIuWRG2bcXgAAAEk"]
[Fri Feb 27 02:37:45.961016 2026] [:error] [pid 20059:tid 20108] [client 20.43.27.35:60083] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaCS-ZZBS5wIa_Nsqsg_vAAAAcY"]
[Fri Feb 27 02:37:47.004639 2026] [:error] [pid 20059:tid 20103] [client 20.43.27.35:60147] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaCS-5ZBS5wIa_Nsqsg_vgAAAcE"]
[Fri Feb 27 02:37:48.043003 2026] [:error] [pid 20059:tid 20126] [client 20.43.27.35:60156] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaCS_JZBS5wIa_Nsqsg_wgAAAdg"]
[Fri Feb 27 03:42:06.319456 2026] [:error] [pid 19020:tid 19042] [client 43.153.87.54:35116] [client 43.153.87.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaCiDrN3kp7wL6QzPnV4DQAAAVQ"]
[Fri Feb 27 04:35:10.271152 2026] [:error] [pid 3974:tid 4055] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 04:35:10.512510 2026] [:error] [pid 3974:tid 4059] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 04:35:10.752959 2026] [:error] [pid 3974:tid 4060] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 04:35:10.990041 2026] [:error] [pid 3974:tid 4061] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 04:35:11.226874 2026] [:error] [pid 3974:tid 4042] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 04:35:11.480678 2026] [:error] [pid 3974:tid 4043] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 04:35:12.010405 2026] [:error] [pid 3974:tid 4049] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 27 04:35:12.279713 2026] [:error] [pid 3974:tid 4046] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Feb 27 04:35:12.530499 2026] [:error] [pid 3974:tid 4044] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 04:35:12.782513 2026] [:error] [pid 3974:tid 4033] [client 20.43.27.35:18919] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 04:35:13.031415 2026] [:error] [pid 3974:tid 4056] [client 20.43.27.35:18919] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCugXp-fQtdOYjkuFvZ0QAAAFM"]
[Fri Feb 27 04:35:14.042131 2026] [:error] [pid 42658:tid 42675] [client 20.43.27.35:18888] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCugozcoYl3nRbu1jZJJAAAAg8"]
[Fri Feb 27 04:35:15.058755 2026] [:error] [pid 5365:tid 5384] [client 20.43.27.35:19149] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCug5YAa8J3tYxdG3wLcgAAARE"]
[Fri Feb 27 04:35:16.072329 2026] [:error] [pid 42435:tid 42446] [client 20.43.27.35:19150] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaCuhB5hHLnaukp_y998swAAAYY"]
[Fri Feb 27 04:40:24.996882 2026] [:error] [pid 42658:tid 42666] [client 106.227.49.113:42267] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaCvuIzcoYl3nRbu1jZRNwAAAgY"]
[Fri Feb 27 06:53:08.126544 2026] [:error] [pid 4081:tid 4104] [client 20.43.27.35:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 06:53:08.335684 2026] [:error] [pid 4081:tid 4093] [client 20.43.27.35:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 06:53:08.754705 2026] [:error] [pid 4081:tid 4102] [client 20.43.27.35:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 27 06:53:08.969687 2026] [:error] [pid 4081:tid 4083] [client 20.43.27.35:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 06:53:09.390241 2026] [:error] [pid 4081:tid 4087] [client 20.43.27.35:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 27 06:53:09.601153 2026] [:error] [pid 4081:tid 4100] [client 20.43.27.35:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 06:53:09.813953 2026] [:error] [pid 4081:tid 4092] [client 20.43.27.35:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Feb 27 06:53:10.229309 2026] [:error] [pid 4081:tid 4088] [client 20.43.27.35:64735] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaDO1g55mnr35z8h7t3vOAAAAMU"]
[Fri Feb 27 06:53:11.080710 2026] [:error] [pid 5365:tid 5370] [client 20.43.27.35:65035] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaDO15YAa8J3tYxdG3xrdgAAAQM"]
[Fri Feb 27 06:53:11.952489 2026] [:error] [pid 21329:tid 21395] [client 20.43.27.35:65083] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaDO15vQWnde-MjcQ1FuKQAAAUw"]
[Fri Feb 27 06:53:12.874307 2026] [:error] [pid 21329:tid 21404] [client 20.43.27.35:64717] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaDO2JvQWnde-MjcQ1FuKwAAAVU"]
[Fri Feb 27 07:10:58.339623 2026] [:error] [pid 42563:tid 42594] [client 49.51.141.76:56428] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaDTAnKL5BclZy73IRHovAAAAdg"]
[Fri Feb 27 08:17:20.303175 2026] [:error] [pid 54102:tid 54165] [client 20.220.165.49:31814] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 08:45:44.707858 2026] [:error] [pid 54231:tid 54247] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 08:45:44.919588 2026] [:error] [pid 54231:tid 54245] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 08:45:45.129225 2026] [:error] [pid 54231:tid 54251] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 08:45:45.338254 2026] [:error] [pid 54231:tid 54258] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 08:45:45.549521 2026] [:error] [pid 54231:tid 54254] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 08:45:45.765109 2026] [:error] [pid 54231:tid 54246] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 08:45:46.188047 2026] [:error] [pid 54231:tid 54243] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 27 08:45:46.397382 2026] [:error] [pid 54231:tid 54242] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Feb 27 08:45:46.608331 2026] [:error] [pid 54231:tid 54234] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 08:45:46.818548 2026] [:error] [pid 54231:tid 54241] [client 20.43.27.35:18546] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 08:45:47.026986 2026] [:error] [pid 54231:tid 54249] [client 20.43.27.35:18546] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaDpO-Tvb5AeyJCdY7AfbAAAAE8"]
[Fri Feb 27 08:45:47.870303 2026] [:error] [pid 54231:tid 54245] [client 20.43.27.35:18758] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaDpO-Tvb5AeyJCdY7AfbgAAAEs"]
[Fri Feb 27 08:45:48.733331 2026] [:error] [pid 56075:tid 56082] [client 20.43.27.35:18559] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaDpPMKBhrfI6KNv9RgTUwAAAAU"]
[Fri Feb 27 08:45:49.599176 2026] [:error] [pid 62998:tid 63015] [client 20.43.27.35:18771] [client 20.43.27.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaDpPVQeueXZDUmoLom0TAAAAQ0"]
[Fri Feb 27 09:42:36.121075 2026] [:error] [pid 62998:tid 63006] [client 43.167.245.18:57380] [client 43.167.245.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaD2jFQeueXZDUmoLonqqAAAAQQ"]
[Fri Feb 27 10:56:45.908688 2026] [:error] [pid 56075:tid 56088] [client 125.94.144.102:49769] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaEH7cKBhrfI6KNv9RhkzgAAAAs"]
[Fri Feb 27 11:36:16.961191 2026] [:error] [pid 49306:tid 49318] [client 141.98.11.181:62056] [client 141.98.11.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.98.11.181, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaERMPnSUDZue59Px9ugMgAAAUo"]
[Fri Feb 27 11:36:16.965135 2026] [:error] [pid 49306:tid 49318] [client 141.98.11.181:62056] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Feb 27 11:36:19.497160 2026] [:error] [pid 49306:tid 49330] [client 141.98.11.181:62056] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaERM_nSUDZue59Px9ugRwAAAVY"]
[Fri Feb 27 11:36:20.057183 2026] [:error] [pid 62998:tid 63005] [client 141.98.11.181:52408] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaERNFQeueXZDUmoLomclwAAAQM"]
[Fri Feb 27 11:36:20.607967 2026] [:error] [pid 62998:tid 63004] [client 141.98.11.181:57427] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaERNFQeueXZDUmoLomcmwAAAQI"]
[Fri Feb 27 11:36:21.162596 2026] [:error] [pid 62998:tid 63022] [client 141.98.11.181:61477] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaERNVQeueXZDUmoLomcpgAAARQ"]
[Fri Feb 27 13:18:57.083797 2026] [:error] [pid 52073:tid 52089] [client 43.130.32.245:48678] [client 43.130.32.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaEpQYa650YPyxXVeRbv9AAAAY0"]
[Fri Feb 27 14:38:14.678227 2026] [:error] [pid 56075:tid 56088] [client 4.204.192.31:61349] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 15:24:18.094798 2026] [:error] [pid 52073:tid 52099] [client 134.149.59.124:7897] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 15:55:29.530613 2026] [:error] [pid 49306:tid 49322] [client 43.166.224.244:34340] [client 43.166.224.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaFN8fnSUDZue59Px9tuFgAAAU4"]
[Fri Feb 27 16:31:47.029183 2026] [:error] [pid 52073:tid 52089] [client 20.104.81.240:2357] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 16:31:47.243338 2026] [:error] [pid 52073:tid 52083] [client 20.104.81.240:2357] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 16:31:47.676144 2026] [:error] [pid 52073:tid 52092] [client 20.104.81.240:2357] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Feb 27 16:31:47.888083 2026] [:error] [pid 52073:tid 52086] [client 20.104.81.240:2357] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 16:31:48.320897 2026] [:error] [pid 52073:tid 52077] [client 20.104.81.240:2357] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Fri Feb 27 16:31:48.539193 2026] [:error] [pid 52073:tid 52094] [client 20.104.81.240:2357] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Feb 27 16:31:48.755199 2026] [:error] [pid 52073:tid 52083] [client 20.104.81.240:2357] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Feb 27 16:31:49.214855 2026] [:error] [pid 52073:tid 52093] [client 20.104.81.240:2357] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaFWdYa650YPyxXVeRZzDwAAAZE"]
[Fri Feb 27 16:31:50.088774 2026] [:error] [pid 52073:tid 52094] [client 20.104.81.240:2367] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaFWdoa650YPyxXVeRZzEwAAAZI"]
[Fri Feb 27 16:31:50.992258 2026] [:error] [pid 62998:tid 63023] [client 20.104.81.240:2325] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaFWdlQeueXZDUmoLonwwwAAARU"]
[Fri Feb 27 16:31:51.840974 2026] [:error] [pid 52073:tid 52087] [client 20.104.81.240:2329] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaFWd4a650YPyxXVeRZzFwAAAYs"]
[Fri Feb 27 17:27:53.916471 2026] [:error] [pid 52073:tid 52085] [client 4.204.192.31:26506] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 18:02:20.824010 2026] [:error] [pid 54103:tid 54190] [client 114.96.103.33:46204] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaFrrOvG4MPCmE0B2sCCwAAAANM"]
[Fri Feb 27 18:27:35.732864 2026] [:error] [pid 62998:tid 63006] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 18:27:35.942166 2026] [:error] [pid 62998:tid 63025] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 18:27:36.151180 2026] [:error] [pid 62998:tid 63026] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 18:27:36.359220 2026] [:error] [pid 62998:tid 63024] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 18:27:36.569097 2026] [:error] [pid 62998:tid 63017] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 18:27:36.778662 2026] [:error] [pid 62998:tid 63005] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 18:27:37.198980 2026] [:error] [pid 62998:tid 63012] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Feb 27 18:27:37.408783 2026] [:error] [pid 62998:tid 63007] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Fri Feb 27 18:27:37.618657 2026] [:error] [pid 62998:tid 63013] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 18:27:37.827575 2026] [:error] [pid 62998:tid 63015] [client 20.104.81.240:2532] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 18:27:39.366290 2026] [:error] [pid 62998:tid 63022] [client 20.104.81.240:2532] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaFxm1QeueXZDUmoLokM1wAAARQ"]
[Fri Feb 27 18:27:40.191209 2026] [:error] [pid 54101:tid 54132] [client 20.104.81.240:2501] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaFxnFY5qgRktcYTGFst2gAAAdg"]
[Fri Feb 27 18:27:41.068671 2026] [:error] [pid 54101:tid 54123] [client 20.104.81.240:2546] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaFxnVY5qgRktcYTGFst3QAAAc8"]
[Fri Feb 27 18:27:41.900943 2026] [:error] [pid 56075:tid 56092] [client 20.104.81.240:2530] [client 20.104.81.240] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaFxncKBhrfI6KNv9RhRuQAAAA4"]
[Fri Feb 27 19:26:29.289254 2026] [:error] [pid 62998:tid 63025] [client 43.157.156.190:50362] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaF_ZVQeueXZDUmoLoke1wAAARc"]
[Fri Feb 27 21:02:19.430163 2026] [:error] [pid 52073:tid 52100] [client 4.204.192.31:6087] File does not exist: /usr/local/apache/htdocs/suspended-page/asc.php
[Fri Feb 27 21:28:36.774841 2026] [:error] [pid 52073:tid 52078] [client 91.224.92.164:37751] [client 91.224.92.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aaGcBIa650YPyxXVeRZVNwAAAYI"]
[Fri Feb 27 21:28:38.362902 2026] [:error] [pid 54101:tid 54126] [client 91.224.92.164:51130] [client 91.224.92.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aaGcBlY5qgRktcYTGFtAWgAAAdI"]
[Fri Feb 27 21:29:19.918106 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Fri Feb 27 21:29:20.170623 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Fri Feb 27 21:29:20.425031 2026] [:error] [pid 52073:tid 52078] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Fri Feb 27 21:29:20.713208 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Fri Feb 27 21:29:20.954713 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Fri Feb 27 21:29:21.205736 2026] [:error] [pid 52073:tid 52093] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Feb 27 21:29:21.461091 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Feb 27 21:29:21.732127 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 21:29:22.278942 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Fri Feb 27 21:29:22.766541 2026] [:error] [pid 52073:tid 52078] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Fri Feb 27 21:29:23.007066 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Fri Feb 27 21:29:23.259641 2026] [:error] [pid 52073:tid 52088] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Feb 27 21:29:23.504949 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Feb 27 21:29:23.772031 2026] [:error] [pid 52073:tid 52076] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Feb 27 21:29:24.022106 2026] [:error] [pid 52073:tid 52098] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Fri Feb 27 21:29:24.285664 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Fri Feb 27 21:29:24.529580 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Feb 27 21:29:24.790661 2026] [:error] [pid 52073:tid 52099] [client 45.131.195.109:24795] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Fri Feb 27 21:29:28.368816 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.109:24795] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaGcOIa650YPyxXVeRZXzwAAAZM"]
[Fri Feb 27 21:29:29.675933 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.73:61755] [client 45.131.195.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaGcOYa650YPyxXVeRZX8gAAAYs"]
[Fri Feb 27 21:29:31.147222 2026] [:error] [pid 62998:tid 63019] [client 45.131.195.80:24261] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Feb 27 21:29:31.968889 2026] [:error] [pid 62998:tid 63001] [client 45.131.195.80:24261] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aaGcO1QeueXZDUmoLolMJwAAAQA"]
[Fri Feb 27 21:29:33.038950 2026] [:error] [pid 62998:tid 63002] [client 45.131.195.58:39111] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Fri Feb 27 21:29:33.604314 2026] [:error] [pid 62998:tid 63013] [client 45.131.195.58:39111] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaGcPVQeueXZDUmoLolMMAAAAQs"]
[Fri Feb 27 21:29:34.347825 2026] [:error] [pid 62998:tid 63024] [client 45.131.195.79:40795] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Fri Feb 27 21:29:35.610733 2026] [:error] [pid 62998:tid 63011] [client 45.131.195.79:40795] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaGcP1QeueXZDUmoLolMPQAAAQk"]
[Fri Feb 27 21:29:36.336025 2026] [:error] [pid 62998:tid 63024] [client 209.87.169.174:29865] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaGcQFQeueXZDUmoLolMQQAAARY"]
[Fri Feb 27 21:29:36.865491 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.96:51017] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaGcQIa650YPyxXVeRZYVQAAAZQ"]
[Fri Feb 27 21:29:37.429702 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.75:64985] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaGcQYa650YPyxXVeRZYYgAAAYM"]
[Fri Feb 27 21:29:37.938953 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.76:62481] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaGcQYa650YPyxXVeRZYcQAAAZI"]
[Fri Feb 27 21:29:38.397019 2026] [:error] [pid 56075:tid 56083] [client 45.131.195.60:59773] [client 45.131.195.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaGcQsKBhrfI6KNv9RjSAQAAAAY"]
[Fri Feb 27 21:29:39.188460 2026] [:error] [pid 52073:tid 52084] [client 45.131.195.52:53881] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaGcQ4a650YPyxXVeRZYggAAAYg"]
[Fri Feb 27 21:29:39.678682 2026] [:error] [pid 54231:tid 54252] [client 45.131.195.99:63503] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Fri Feb 27 21:29:40.173144 2026] [:error] [pid 54231:tid 54243] [client 45.131.195.99:63503] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aaGcROTvb5AeyJCdY7ASPwAAAEk"]
[Fri Feb 27 21:29:41.260521 2026] [:error] [pid 62998:tid 63002] [client 45.131.195.84:30609] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaGcRVQeueXZDUmoLolMUwAAAQE"]
[Fri Feb 27 21:29:42.027714 2026] [:error] [pid 54103:tid 54188] [client 45.131.195.109:39475] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaGcRuvG4MPCmE0B2sCnTgAAANE"]
[Fri Feb 27 21:29:42.520215 2026] [:error] [pid 54101:tid 54115] [client 45.131.195.82:50165] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Fri Feb 27 21:29:42.751535 2026] [:error] [pid 54101:tid 54128] [client 45.131.195.82:50165] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaGcRlY5qgRktcYTGFtBoQAAAdQ"]
[Fri Feb 27 21:29:43.263587 2026] [:error] [pid 54231:tid 54257] [client 209.87.169.174:53285] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Fri Feb 27 21:29:44.019667 2026] [:error] [pid 54231:tid 54241] [client 209.87.169.174:53285] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Feb 27 21:29:44.816850 2026] [:error] [pid 54231:tid 54253] [client 209.87.169.174:53285] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaGcSOTvb5AeyJCdY7ASfgAAAFM"]
[Fri Feb 27 21:29:45.310290 2026] [:error] [pid 54101:tid 54116] [client 45.131.195.76:64183] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Fri Feb 27 21:29:45.576662 2026] [:error] [pid 54101:tid 54127] [client 45.131.195.76:64183] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaGcSVY5qgRktcYTGFtB1AAAAdM"]
[Fri Feb 27 21:29:46.128681 2026] [:error] [pid 62998:tid 63008] [client 45.131.195.71:50293] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri Feb 27 21:29:46.646397 2026] [:error] [pid 62998:tid 63017] [client 45.131.195.71:50293] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaGcSlQeueXZDUmoLolMrgAAAQ8"]
[Fri Feb 27 21:29:47.439547 2026] [:error] [pid 52073:tid 52097] [client 45.131.195.99:25321] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaGcS4a650YPyxXVeRZY_AAAAZU"]
[Fri Feb 27 21:29:48.235985 2026] [:error] [pid 54231:tid 54254] [client 45.131.195.109:42259] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Fri Feb 27 21:29:48.519887 2026] [:error] [pid 54231:tid 54246] [client 45.131.195.109:42259] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Fri Feb 27 21:29:49.059947 2026] [:error] [pid 54231:tid 54235] [client 45.131.195.109:42259] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaGcTeTvb5AeyJCdY7ASqwAAAEE"]
[Fri Feb 27 21:29:49.823323 2026] [:error] [pid 62998:tid 63021] [client 45.131.195.53:35089] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaGcTVQeueXZDUmoLolM3AAAARM"]
[Fri Feb 27 21:29:50.595532 2026] [:error] [pid 54101:tid 54130] [client 45.131.195.111:32889] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaGcTlY5qgRktcYTGFtB6gAAAdY"]
[Fri Feb 27 21:29:51.140905 2026] [:error] [pid 52073:tid 52079] [client 45.131.195.79:59609] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaGcT4a650YPyxXVeRZZSAAAAYM"]
[Fri Feb 27 21:29:51.686314 2026] [:error] [pid 49306:tid 49323] [client 45.131.195.69:53263] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaGcT_nSUDZue59Px9sb6wAAAU8"]
[Fri Feb 27 21:29:55.293718 2026] [:error] [pid 62998:tid 63009] [client 45.131.195.71:36011] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Fri Feb 27 21:29:55.531323 2026] [:error] [pid 62998:tid 63016] [client 45.131.195.71:36011] [client 45.131.195.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaGcU1QeueXZDUmoLolNKgAAAQ4"]
[Fri Feb 27 21:29:56.041551 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.111:39693] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaGcVMKBhrfI6KNv9RjS7wAAAAA"]
[Fri Feb 27 21:29:56.541425 2026] [:error] [pid 56075:tid 56087] [client 45.131.195.81:32971] [client 45.131.195.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaGcVMKBhrfI6KNv9RjS9QAAAAo"]
[Fri Feb 27 21:29:57.612154 2026] [:error] [pid 49306:tid 49315] [client 45.131.195.76:55703] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Fri Feb 27 21:29:58.173143 2026] [:error] [pid 49306:tid 49325] [client 45.131.195.76:55703] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Feb 27 21:29:59.229888 2026] [:error] [pid 49306:tid 49317] [client 45.131.195.76:55703] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aaGcV_nSUDZue59Px9scMQAAAUk"]
[Fri Feb 27 21:30:00.491647 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.95:54515] [client 45.131.195.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.95, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaGcWPnSUDZue59Px9scOwAAAVY"]
[Fri Feb 27 21:30:00.991269 2026] [:error] [pid 49306:tid 49309] [client 45.131.195.95:54515] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Fri Feb 27 21:30:03.225543 2026] [:error] [pid 49306:tid 49320] [client 45.131.195.95:54515] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Fri Feb 27 21:30:03.594458 2026] [:error] [pid 49306:tid 49326] [client 45.131.195.95:54515] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Fri Feb 27 21:30:05.632460 2026] [:error] [pid 49306:tid 49314] [client 45.131.195.95:54515] [client 45.131.195.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaGcXfnSUDZue59Px9scXQAAAUY"]
[Fri Feb 27 21:30:07.302764 2026] [:error] [pid 56075:tid 56095] [client 209.87.169.174:23599] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Fri Feb 27 21:30:07.570932 2026] [:error] [pid 56075:tid 56094] [client 209.87.169.174:23599] [client 209.87.169.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.174, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaGcX8KBhrfI6KNv9RjTagAAABA"]
[Fri Feb 27 21:30:08.094470 2026] [:error] [pid 56075:tid 56079] [client 209.87.169.174:23599] [client 209.87.169.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aaGcYMKBhrfI6KNv9RjTdwAAAAI"]
[Fri Feb 27 21:30:09.663361 2026] [:error] [pid 49306:tid 49312] [client 45.131.195.99:54283] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 21:30:10.139073 2026] [:error] [pid 49306:tid 49328] [client 45.131.195.99:54283] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Fri Feb 27 21:30:10.675070 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.99:54283] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaGcYvnSUDZue59Px9scxgAAAVY"]
[Fri Feb 27 21:30:11.123284 2026] [:error] [pid 54102:tid 54154] [client 45.131.195.65:20295] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Fri Feb 27 21:30:11.981091 2026] [:error] [pid 54102:tid 54169] [client 45.131.195.65:20295] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Fri Feb 27 21:30:15.565279 2026] [:error] [pid 54102:tid 54150] [client 45.131.195.65:20295] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Fri Feb 27 21:30:16.154901 2026] [:error] [pid 54102:tid 54146] [client 45.131.195.65:20295] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Feb 27 21:30:16.445796 2026] [:error] [pid 54102:tid 54165] [client 45.131.195.65:20295] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaGcaHi74D4fiYUm_GdwiwAAAJU"]
[Fri Feb 27 21:30:16.995839 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.70:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Fri Feb 27 21:30:17.326497 2026] [:error] [pid 52073:tid 52093] [client 45.131.195.70:54003] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Fri Feb 27 21:30:17.544365 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.70:54003] [client 45.131.195.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaGcaYa650YPyxXVeRZbdAAAAY8"]
[Fri Feb 27 21:30:18.323242 2026] [:error] [pid 49306:tid 49320] [client 45.131.195.96:42017] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Fri Feb 27 21:30:18.780673 2026] [:error] [pid 49306:tid 49312] [client 45.131.195.96:42017] [client 45.131.195.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.96, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaGcavnSUDZue59Px9sc9wAAAUQ"]
[Fri Feb 27 21:30:19.080757 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.96:42017] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaGca_nSUDZue59Px9sc-QAAAVY"]
[Fri Feb 27 21:30:22.601423 2026] [:error] [pid 52073:tid 52093] [client 45.131.195.82:33767] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Fri Feb 27 21:30:24.534312 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.82:33767] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri Feb 27 21:30:24.879525 2026] [:error] [pid 52073:tid 52080] [client 45.131.195.82:33767] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaGccIa650YPyxXVeRZcKgAAAYQ"]
[Fri Feb 27 21:30:25.542727 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.85:25313] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Fri Feb 27 21:30:26.339452 2026] [:error] [pid 52073:tid 52080] [client 45.131.195.85:25313] [client 45.131.195.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.85, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaGccoa650YPyxXVeRZcSgAAAYQ"]
[Fri Feb 27 21:30:26.646344 2026] [:error] [pid 52073:tid 52081] [client 45.131.195.85:25313] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Fri Feb 27 21:30:26.908936 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.85:25313] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Fri Feb 27 21:30:27.177770 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.85:25313] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Fri Feb 27 21:30:27.409155 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.85:25313] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaGcc4a650YPyxXVeRZcXwAAAZA"]
[Fri Feb 27 21:30:27.992627 2026] [:error] [pid 54101:tid 54120] [client 45.131.195.80:61485] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Feb 27 21:30:28.300451 2026] [:error] [pid 54101:tid 54128] [client 45.131.195.80:61485] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aaGcdFY5qgRktcYTGFtDRwAAAdQ"]
[Fri Feb 27 21:30:29.197865 2026] [:error] [pid 62998:tid 63001] [client 45.131.195.58:33971] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri Feb 27 21:30:29.473010 2026] [:error] [pid 62998:tid 63004] [client 45.131.195.58:33971] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaGcdVQeueXZDUmoLolOqwAAAQI"]
[Fri Feb 27 21:30:30.579769 2026] [:error] [pid 54102:tid 54162] [client 45.131.195.110:20485] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Fri Feb 27 21:30:30.902774 2026] [:error] [pid 54102:tid 54156] [client 45.131.195.110:20485] [client 45.131.195.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaGcdni74D4fiYUm_Gdw3wAAAIw"]
[Fri Feb 27 21:30:31.424075 2026] [:error] [pid 49306:tid 49310] [client 45.131.195.76:63129] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaGcd_nSUDZue59Px9sdUQAAAUI"]
[Fri Feb 27 21:30:32.059579 2026] [:error] [pid 49306:tid 49315] [client 45.131.195.63:24097] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Feb 27 21:30:32.363635 2026] [:error] [pid 49306:tid 49323] [client 45.131.195.63:24097] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Fri Feb 27 21:30:33.384175 2026] [:error] [pid 49306:tid 49321] [client 45.131.195.63:24097] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaGcefnSUDZue59Px9sdZQAAAU0"]
[Fri Feb 27 21:30:34.133572 2026] [:error] [pid 52073:tid 52087] [client 45.131.195.56:34505] [client 45.131.195.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaGceoa650YPyxXVeRZcoAAAAYs"]
[Fri Feb 27 21:30:36.547448 2026] [:error] [pid 62998:tid 63002] [client 45.131.195.86:30761] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aaGcfFQeueXZDUmoLolPGAAAAQE"]
[Fri Feb 27 21:30:37.023490 2026] [:error] [pid 62998:tid 63014] [client 45.131.195.72:35691] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Fri Feb 27 21:30:37.549915 2026] [:error] [pid 62998:tid 63001] [client 45.131.195.72:35691] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Fri Feb 27 21:30:37.769774 2026] [:error] [pid 62998:tid 63006] [client 45.131.195.72:35691] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaGcfVQeueXZDUmoLolPHwAAAQQ"]
[Fri Feb 27 21:30:38.228292 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.91:45527] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Fri Feb 27 21:30:38.721844 2026] [:error] [pid 52073:tid 52098] [client 45.131.195.91:45527] [client 45.131.195.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "aaGcfoa650YPyxXVeRZdCwAAAZY"]
[Fri Feb 27 21:30:40.030447 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.84:26901] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaGcgIa650YPyxXVeRZdPQAAAZM"]
[Fri Feb 27 21:30:40.884529 2026] [:error] [pid 62998:tid 63001] [client 45.131.195.96:41773] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Feb 27 21:30:41.616704 2026] [:error] [pid 62998:tid 63008] [client 45.131.195.96:41773] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Fri Feb 27 21:30:42.130822 2026] [:error] [pid 62998:tid 63001] [client 45.131.195.96:41773] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Feb 27 21:30:42.362422 2026] [:error] [pid 62998:tid 63009] [client 45.131.195.96:41773] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaGcglQeueXZDUmoLolPVwAAAQc"]
[Fri Feb 27 21:30:42.846405 2026] [:error] [pid 54101:tid 54111] [client 45.131.195.56:61683] [client 45.131.195.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaGcglY5qgRktcYTGFtD9QAAAcM"]
[Fri Feb 27 21:30:43.345326 2026] [:error] [pid 54102:tid 54168] [client 45.131.195.114:22217] [client 45.131.195.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaGcg3i74D4fiYUm_GdxNAAAAJc"]
[Fri Feb 27 21:30:43.889708 2026] [:error] [pid 54103:tid 54191] [client 45.131.195.249:47363] [client 45.131.195.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaGcg-vG4MPCmE0B2sCpBwAAANQ"]
[Fri Feb 27 21:30:44.436335 2026] [:error] [pid 49306:tid 49310] [client 45.131.195.63:33083] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Fri Feb 27 21:30:44.705602 2026] [:error] [pid 49306:tid 49329] [client 45.131.195.63:33083] [client 45.131.195.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaGchPnSUDZue59Px9sdxQAAAVU"]
[Fri Feb 27 21:30:45.170091 2026] [:error] [pid 54103:tid 54190] [client 45.131.195.99:45419] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaGchevG4MPCmE0B2sCpDwAAANM"]
[Fri Feb 27 21:30:45.624269 2026] [:error] [pid 52073:tid 52086] [client 45.131.195.104:21905] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Fri Feb 27 21:30:46.127277 2026] [:error] [pid 52073:tid 52085] [client 45.131.195.104:21905] [client 45.131.195.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaGchoa650YPyxXVeRZdnQAAAYk"]
[Fri Feb 27 21:30:46.607824 2026] [:error] [pid 52073:tid 52096] [client 45.131.195.105:31885] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaGchoa650YPyxXVeRZdsgAAAZQ"]
[Fri Feb 27 21:30:47.063227 2026] [:error] [pid 54231:tid 54244] [client 45.131.195.96:23655] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaGch-Tvb5AeyJCdY7AVFgAAAEo"]
[Fri Feb 27 21:30:47.575757 2026] [:error] [pid 62998:tid 63016] [client 45.131.195.70:31335] [client 45.131.195.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaGch1QeueXZDUmoLolPlwAAAQ4"]
[Fri Feb 27 21:30:48.296899 2026] [:error] [pid 62998:tid 63026] [client 45.131.195.59:32647] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaGciFQeueXZDUmoLolPsgAAARg"]
[Fri Feb 27 21:30:49.250758 2026] [:error] [pid 54101:tid 54130] [client 45.131.195.65:52317] [client 45.131.195.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaGciVY5qgRktcYTGFtEJAAAAdY"]
[Fri Feb 27 21:30:49.855290 2026] [:error] [pid 54102:tid 54159] [client 45.131.195.59:52355] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Fri Feb 27 21:30:50.630957 2026] [:error] [pid 54102:tid 54162] [client 45.131.195.59:52355] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Fri Feb 27 21:30:50.886681 2026] [:error] [pid 54102:tid 54145] [client 45.131.195.59:52355] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaGcini74D4fiYUm_GdxfQAAAIE"]
[Fri Feb 27 21:30:51.661500 2026] [:error] [pid 54102:tid 54152] [client 45.131.195.52:43523] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Fri Feb 27 21:30:51.934975 2026] [:error] [pid 54102:tid 54159] [client 45.131.195.52:43523] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Fri Feb 27 21:30:53.237188 2026] [:error] [pid 54102:tid 54164] [client 45.131.195.52:43523] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaGcjXi74D4fiYUm_GdxqgAAAJQ"]
[Fri Feb 27 21:30:55.667129 2026] [:error] [pid 49306:tid 49329] [client 45.131.195.55:37303] [client 45.131.195.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaGcj_nSUDZue59Px9seOQAAAVU"]
[Fri Feb 27 21:30:56.123817 2026] [:error] [pid 62998:tid 63022] [client 45.131.195.95:51727] [client 45.131.195.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaGckFQeueXZDUmoLolQGQAAARQ"]
[Fri Feb 27 21:30:57.511523 2026] [:error] [pid 56075:tid 56079] [client 45.131.195.70:27349] [client 45.131.195.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaGckcKBhrfI6KNv9RjWgAAAAAI"]
[Fri Feb 27 21:30:58.588437 2026] [:error] [pid 54231:tid 54235] [client 45.131.195.109:64349] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Fri Feb 27 21:30:58.849526 2026] [:error] [pid 54231:tid 54242] [client 45.131.195.109:64349] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Fri Feb 27 21:30:59.105480 2026] [:error] [pid 54231:tid 54258] [client 45.131.195.109:64349] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Fri Feb 27 21:30:59.342884 2026] [:error] [pid 54231:tid 54238] [client 45.131.195.109:64349] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Fri Feb 27 21:31:00.546783 2026] [:error] [pid 54231:tid 54253] [client 45.131.195.109:64349] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaGclOTvb5AeyJCdY7AVpgAAAFM"]
[Fri Feb 27 21:31:01.295857 2026] [:error] [pid 62998:tid 63026] [client 45.131.195.248:42577] [client 45.131.195.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaGclVQeueXZDUmoLolQeAAAARg"]
[Fri Feb 27 21:31:01.776402 2026] [:error] [pid 54231:tid 54257] [client 45.131.195.84:45241] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaGcleTvb5AeyJCdY7AVsgAAAFc"]
[Fri Feb 27 21:31:02.427284 2026] [:error] [pid 49306:tid 49312] [client 45.131.195.81:58887] [client 45.131.195.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaGclvnSUDZue59Px9se7wAAAUQ"]
[Fri Feb 27 21:31:03.014711 2026] [:error] [pid 49306:tid 49312] [client 45.131.195.53:20471] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaGcl_nSUDZue59Px9sfBAAAAUQ"]
[Fri Feb 27 21:31:03.529569 2026] [:error] [pid 54102:tid 54163] [client 45.131.195.67:40879] [client 45.131.195.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaGcl3i74D4fiYUm_Gdx-gAAAJM"]
[Fri Feb 27 21:31:04.316053 2026] [:error] [pid 54101:tid 54127] [client 45.131.195.85:32873] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaGcmFY5qgRktcYTGFtEWAAAAdM"]
[Fri Feb 27 21:31:04.862940 2026] [:error] [pid 54231:tid 54234] [client 45.131.195.105:49857] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaGcmOTvb5AeyJCdY7AVzwAAAEA"]
[Fri Feb 27 21:31:05.383381 2026] [:error] [pid 54103:tid 54179] [client 45.131.195.89:25509] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaGcmevG4MPCmE0B2sCp-QAAAMg"]
[Fri Feb 27 21:31:05.805523 2026] [:error] [pid 54102:tid 54166] [client 45.131.195.80:22179] [client 45.131.195.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaGcmXi74D4fiYUm_GdyHwAAAJY"]
[Fri Feb 27 21:31:06.943711 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.75:26915] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaGcmoa650YPyxXVeRZfzQAAAYE"]
[Fri Feb 27 21:31:07.686067 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.75:35571] [client 45.131.195.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaGcm4a650YPyxXVeRZf1QAAAYc"]
[Fri Feb 27 21:31:08.148241 2026] [:error] [pid 54231:tid 54249] [client 45.131.195.57:44811] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Fri Feb 27 21:31:08.593480 2026] [:error] [pid 54231:tid 54258] [client 45.131.195.57:44811] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaGcnOTvb5AeyJCdY7AWGgAAAFg"]
[Fri Feb 27 21:31:09.700738 2026] [:error] [pid 52073:tid 52084] [client 45.131.195.70:22407] [client 45.131.195.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaGcnYa650YPyxXVeRZgIgAAAYg"]
[Fri Feb 27 21:31:10.680181 2026] [:error] [pid 52073:tid 52092] [client 45.131.195.76:23623] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Fri Feb 27 21:31:10.939237 2026] [:error] [pid 52073:tid 52090] [client 45.131.195.76:23623] [client 45.131.195.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaGcnoa650YPyxXVeRZgaAAAAY4"]
[Fri Feb 27 21:31:11.676985 2026] [:error] [pid 49306:tid 49322] [client 45.131.195.114:37785] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Fri Feb 27 21:31:11.918839 2026] [:error] [pid 49306:tid 49318] [client 45.131.195.114:37785] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Fri Feb 27 21:31:12.190023 2026] [:error] [pid 49306:tid 49327] [client 45.131.195.114:37785] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Fri Feb 27 21:31:12.442736 2026] [:error] [pid 49306:tid 49311] [client 45.131.195.114:37785] [client 45.131.195.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaGcoPnSUDZue59Px9sflQAAAUM"]
[Fri Feb 27 21:31:12.908180 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.91:48591] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Feb 27 21:31:13.147096 2026] [:error] [pid 49306:tid 49317] [client 45.131.195.91:48591] [client 45.131.195.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaGcofnSUDZue59Px9sfmgAAAUk"]
[Fri Feb 27 21:31:14.239828 2026] [:error] [pid 56075:tid 56090] [client 45.131.195.58:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Feb 27 21:31:14.476365 2026] [:error] [pid 56075:tid 56092] [client 45.131.195.58:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Fri Feb 27 21:31:14.721208 2026] [:error] [pid 56075:tid 56085] [client 45.131.195.58:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Fri Feb 27 21:31:15.932230 2026] [:error] [pid 56075:tid 56086] [client 45.131.195.58:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Feb 27 21:31:16.246659 2026] [:error] [pid 56075:tid 56098] [client 45.131.195.58:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Fri Feb 27 21:31:16.790512 2026] [:error] [pid 56075:tid 56102] [client 45.131.195.58:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Fri Feb 27 21:31:17.847691 2026] [:error] [pid 56075:tid 56085] [client 45.131.195.58:45663] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Feb 27 21:31:18.080187 2026] [:error] [pid 56075:tid 56079] [client 45.131.195.58:45663] [client 45.131.195.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaGcpsKBhrfI6KNv9RjX8AAAAAI"]
[Fri Feb 27 21:31:18.523432 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.74:31441] [client 45.131.195.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaGcpoa650YPyxXVeRZhxgAAAYc"]
[Fri Feb 27 21:31:18.959064 2026] [:error] [pid 62998:tid 63007] [client 45.131.195.84:29073] [client 45.131.195.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.84, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaGcplQeueXZDUmoLolRIgAAAQU"]
[Fri Feb 27 21:31:18.961287 2026] [:error] [pid 62998:tid 63007] [client 45.131.195.84:29073] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Feb 27 21:31:19.183209 2026] [:error] [pid 62998:tid 63006] [client 45.131.195.84:29073] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Fri Feb 27 21:31:19.425059 2026] [:error] [pid 62998:tid 63015] [client 45.131.195.84:29073] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaGcp1QeueXZDUmoLolRLAAAAQ0"]
[Fri Feb 27 21:31:20.260898 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.72:27549] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Feb 27 21:31:20.517621 2026] [:error] [pid 52073:tid 52091] [client 45.131.195.72:27549] [client 45.131.195.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaGcqIa650YPyxXVeRZiOAAAAY8"]
[Fri Feb 27 21:31:20.990704 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.82:31549] [client 45.131.195.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaGcqIa650YPyxXVeRZiVgAAAZM"]
[Fri Feb 27 21:31:22.611370 2026] [:error] [pid 54101:tid 54121] [client 45.131.195.56:35029] [client 45.131.195.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaGcqlY5qgRktcYTGFtFEAAAAc0"]
[Fri Feb 27 21:31:23.084053 2026] [:error] [pid 62998:tid 63018] [client 45.131.195.84:36143] [client 45.131.195.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aaGcq1QeueXZDUmoLolRRAAAARA"]
[Fri Feb 27 21:31:24.464331 2026] [:error] [pid 54103:tid 54178] [client 45.131.195.94:27433] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Fri Feb 27 21:31:25.004487 2026] [:error] [pid 54103:tid 54187] [client 45.131.195.94:27433] [client 45.131.195.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaGcrevG4MPCmE0B2sCqhwAAANA"]
[Fri Feb 27 21:31:26.101975 2026] [:error] [pid 49306:tid 49308] [client 45.131.195.61:44555] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Fri Feb 27 21:31:26.655657 2026] [:error] [pid 49306:tid 49317] [client 45.131.195.61:44555] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aaGcrvnSUDZue59Px9sgIQAAAUk"]
[Fri Feb 27 21:31:27.110228 2026] [:error] [pid 54231:tid 54241] [client 45.131.195.85:27997] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaGcr-Tvb5AeyJCdY7AWswAAAEc"]
[Fri Feb 27 21:31:27.945212 2026] [:error] [pid 62998:tid 63026] [client 45.131.195.249:23605] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Fri Feb 27 21:31:28.255896 2026] [:error] [pid 62998:tid 63023] [client 45.131.195.249:23605] [client 45.131.195.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaGcsFQeueXZDUmoLolReQAAARU"]
[Fri Feb 27 21:31:28.713832 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.69:39253] [client 45.131.195.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaGcsIa650YPyxXVeRZjoAAAAYc"]
[Fri Feb 27 21:31:29.847516 2026] [:error] [pid 52073:tid 52098] [client 45.131.195.94:30711] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Fri Feb 27 21:31:30.076065 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.94:30711] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Fri Feb 27 21:31:30.571484 2026] [:error] [pid 52073:tid 52076] [client 45.131.195.94:30711] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Fri Feb 27 21:31:31.140746 2026] [:error] [pid 52073:tid 52085] [client 45.131.195.94:30711] [client 45.131.195.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaGcs4a650YPyxXVeRZkGQAAAYk"]
[Fri Feb 27 21:31:31.604728 2026] [:error] [pid 49306:tid 49316] [client 45.131.195.94:23111] [client 45.131.195.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaGcs_nSUDZue59Px9sgjQAAAUg"]
[Fri Feb 27 21:31:32.804318 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.86:59073] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Feb 27 21:31:33.038295 2026] [:error] [pid 52073:tid 52099] [client 45.131.195.86:59073] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aaGctYa650YPyxXVeRZkSgAAAZc"]
[Fri Feb 27 21:31:33.829180 2026] [:error] [pid 52073:tid 52095] [client 45.131.195.54:25699] [client 45.131.195.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaGctYa650YPyxXVeRZkYwAAAZM"]
[Fri Feb 27 21:31:34.293408 2026] [:error] [pid 52073:tid 52078] [client 45.131.195.104:24567] [client 45.131.195.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaGctoa650YPyxXVeRZkdgAAAYI"]
[Fri Feb 27 21:31:35.824114 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.111:20449] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Fri Feb 27 21:31:36.087779 2026] [:error] [pid 52073:tid 52083] [client 45.131.195.111:20449] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaGcuIa650YPyxXVeRZkxgAAAYc"]
[Fri Feb 27 21:31:36.984757 2026] [:error] [pid 56075:tid 56102] [client 45.131.195.79:29033] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaGcuMKBhrfI6KNv9RjZRQAAABg"]
[Fri Feb 27 21:31:37.463877 2026] [:error] [pid 54103:tid 54174] [client 45.131.195.54:48133] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Feb 27 21:31:49.011059 2026] [:error] [pid 54103:tid 54174] [client 45.131.195.54:48133] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Fri Feb 27 21:32:40.653688 2026] [:error] [pid 62998:tid 63019] [client 170.106.11.141:60176] [client 170.106.11.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaGc-FQeueXZDUmoLolUigAAARE"]
[Fri Feb 27 21:49:50.966129 2026] [:error] [pid 49306:tid 49310] [client 20.220.8.221:11655] File does not exist: /usr/local/apache/htdocs/suspended-page/f.php
[Fri Feb 27 21:49:51.175730 2026] [:error] [pid 49306:tid 49311] [client 20.220.8.221:11655] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Fri Feb 27 21:49:51.591974 2026] [:error] [pid 49306:tid 49317] [client 20.220.8.221:11655] [client 20.220.8.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaGg__nSUDZue59Px9tCFQAAAUk"]
[Fri Feb 27 21:49:52.854134 2026] [:error] [pid 49306:tid 49330] [client 20.220.8.221:11702] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Feb 27 21:49:53.277107 2026] [:error] [pid 49306:tid 49312] [client 20.220.8.221:11702] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Fri Feb 27 21:49:53.915333 2026] [:error] [pid 49306:tid 49326] [client 20.220.8.221:11702] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaGhAfnSUDZue59Px9tCMgAAAVI"]
[Fri Feb 27 21:49:54.744665 2026] [:error] [pid 56075:tid 56101] [client 20.220.8.221:11667] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaGhAsKBhrfI6KNv9RgO9QAAABc"]
[Fri Feb 27 21:49:55.568606 2026] [:error] [pid 49306:tid 49319] [client 20.220.8.221:11693] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaGhA_nSUDZue59Px9tCQwAAAUs"]
[Fri Feb 27 21:49:56.399812 2026] [:error] [pid 49306:tid 49326] [client 20.220.8.221:11686] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaGhBPnSUDZue59Px9tCRwAAAVI"]
[Sat Feb 28 00:23:57.403145 2026] [:error] [pid 15099:tid 15136] [client 43.153.48.240:45844] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaHFHenvP2vtPjYDq_gesAAAAMM"]
[Sat Feb 28 01:18:04.441424 2026] [:error] [pid 38620:tid 38622] [client 36.41.75.167:52694] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaHRzAP6I7SRqrhh7Rr-TwAAAUA"]
[Sat Feb 28 01:18:56.312610 2026] [:error] [pid 38620:tid 38624] [client 20.220.221.45:15328] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaHSAAP6I7SRqrhh7Rr_TwAAAUI"]
[Sat Feb 28 01:18:56.726498 2026] [:error] [pid 38620:tid 38622] [client 20.220.221.45:15342] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaHSAAP6I7SRqrhh7Rr_VQAAAUA"]
[Sat Feb 28 01:18:57.137467 2026] [:error] [pid 15099:tid 15143] [client 20.220.221.45:15289] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaHSAenvP2vtPjYDq_g0OQAAAMo"]
[Sat Feb 28 01:18:57.670512 2026] [:error] [pid 15100:tid 15181] [client 20.220.221.45:15340] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaHSAUOEbzcINan_ctLAMAAAAFU"]
[Sat Feb 28 01:29:29.212158 2026] [:error] [pid 38620:tid 38646] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Sat Feb 28 01:29:29.426809 2026] [:error] [pid 38620:tid 38632] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sat Feb 28 01:29:29.670854 2026] [:error] [pid 38620:tid 38628] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Sat Feb 28 01:29:29.889095 2026] [:error] [pid 38620:tid 38640] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/X57.php
[Sat Feb 28 01:29:30.103645 2026] [:error] [pid 38620:tid 38646] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/wpver.php
[Sat Feb 28 01:29:30.538612 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sat Feb 28 01:29:30.757829 2026] [:error] [pid 38620:tid 38645] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sat Feb 28 01:29:30.972953 2026] [:error] [pid 38620:tid 38632] [client 20.220.221.45:30612] File does not exist: /usr/local/apache/htdocs/suspended-page/wqqs.php
[Sat Feb 28 01:29:32.834084 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30612] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-318.php"] [unique_id "aaHUfAP6I7SRqrhh7RoPwgAAAU8"]
[Sat Feb 28 01:29:34.510352 2026] [:error] [pid 15240:tid 15246] [client 20.220.221.45:30660] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-318.php"] [unique_id "aaHUfi1iKL_41Rk9A9N8FAAAAAQ"]
[Sat Feb 28 01:29:36.448628 2026] [:error] [pid 38620:tid 38625] [client 20.220.221.45:30597] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-318.php"] [unique_id "aaHUgAP6I7SRqrhh7RoP1QAAAUM"]
[Sat Feb 28 01:29:39.500806 2026] [:error] [pid 38586:tid 38603] [client 20.220.221.45:30602] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-318.php"] [unique_id "aaHUg7_i6nvKNhjFW7VJYgAAAQ4"]
[Sat Feb 28 01:29:42.660352 2026] [:error] [pid 38586:tid 38594] [client 20.220.221.45:30672] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHUhr_i6nvKNhjFW7VJfAAAAQU"]
[Sat Feb 28 01:29:46.130447 2026] [:error] [pid 15240:tid 15254] [client 20.220.221.45:30598] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHUii1iKL_41Rk9A9N8KwAAAAw"]
[Sat Feb 28 01:29:49.589610 2026] [:error] [pid 15100:tid 15176] [client 20.220.221.45:30703] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHUjUOEbzcINan_ctLFbAAAAFA"]
[Sat Feb 28 01:29:53.187720 2026] [:error] [pid 38620:tid 38646] [client 20.220.221.45:30677] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/sallu.php"] [unique_id "aaHUkQP6I7SRqrhh7RoQGQAAAVg"]
[Sat Feb 28 01:29:57.114565 2026] [:error] [pid 15098:tid 15106] [client 20.220.221.45:30706] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aaHUlckFqny8dQQbmTkm4gAAAIE"]
[Sat Feb 28 01:29:58.989846 2026] [:error] [pid 38586:tid 38598] [client 20.220.221.45:30676] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aaHUlr_i6nvKNhjFW7VJ6QAAAQk"]
[Sat Feb 28 01:30:01.385298 2026] [:error] [pid 38586:tid 38609] [client 20.220.221.45:30628] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aaHUmb_i6nvKNhjFW7VJ_QAAARQ"]
[Sat Feb 28 01:30:04.351290 2026] [:error] [pid 15100:tid 15176] [client 20.220.221.45:30659] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dom.php"] [unique_id "aaHUnEOEbzcINan_ctLFiwAAAFA"]
[Sat Feb 28 01:30:06.278174 2026] [:error] [pid 38620:tid 38631] [client 20.220.221.45:30643] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rxzx.php"] [unique_id "aaHUngP6I7SRqrhh7RoQNQAAAUk"]
[Sat Feb 28 01:30:08.155064 2026] [:error] [pid 15240:tid 15262] [client 20.220.221.45:30702] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rxzx.php"] [unique_id "aaHUoC1iKL_41Rk9A9N8dAAAABQ"]
[Sat Feb 28 01:30:12.234834 2026] [:error] [pid 38620:tid 38638] [client 20.220.221.45:30699] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rxzx.php"] [unique_id "aaHUpAP6I7SRqrhh7RoQZQAAAVA"]
[Sat Feb 28 01:30:15.288125 2026] [:error] [pid 38586:tid 38613] [client 20.220.221.45:30657] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rxzx.php"] [unique_id "aaHUp7_i6nvKNhjFW7VKMQAAARg"]
[Sat Feb 28 01:30:15.870670 2026] [:error] [pid 15100:tid 15175] [client 20.220.221.45:30667] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaHUp0OEbzcINan_ctLFqQAAAE8"]
[Sat Feb 28 01:30:17.975115 2026] [:error] [pid 38586:tid 38602] [client 20.220.221.45:30607] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaHUqb_i6nvKNhjFW7VKNwAAAQ0"]
[Sat Feb 28 01:30:21.204196 2026] [:error] [pid 38620:tid 38639] [client 20.220.221.45:30691] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaHUrQP6I7SRqrhh7RoQuAAAAVE"]
[Sat Feb 28 01:30:26.075034 2026] [:error] [pid 38620:tid 38640] [client 20.220.221.45:30712] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaHUsgP6I7SRqrhh7RoQzwAAAVI"]
[Sat Feb 28 01:30:32.092856 2026] [:error] [pid 15100:tid 15175] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/moon3.php
[Sat Feb 28 01:30:32.303169 2026] [:error] [pid 15100:tid 15165] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/thui.php
[Sat Feb 28 01:30:32.514178 2026] [:error] [pid 15100:tid 15170] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/ebahvhhh.php
[Sat Feb 28 01:30:32.796496 2026] [:error] [pid 15100:tid 15161] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/snq.php
[Sat Feb 28 01:30:33.017439 2026] [:error] [pid 15100:tid 15172] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/mcs.php
[Sat Feb 28 01:30:33.539272 2026] [:error] [pid 15100:tid 15172] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sat Feb 28 01:30:33.983343 2026] [:error] [pid 15100:tid 15167] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sat Feb 28 01:30:34.409824 2026] [:error] [pid 15100:tid 15173] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Sat Feb 28 01:30:34.639168 2026] [:error] [pid 15100:tid 15163] [client 20.220.221.45:30593] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sat Feb 28 01:30:34.861888 2026] [:error] [pid 15100:tid 15177] [client 20.220.221.45:30593] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmpls.php"] [unique_id "aaHUukOEbzcINan_ctLF2QAAAFE"]
[Sat Feb 28 01:30:36.268135 2026] [:error] [pid 15100:tid 15176] [client 20.220.221.45:30684] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmpls.php"] [unique_id "aaHUvEOEbzcINan_ctLF2wAAAFA"]
[Sat Feb 28 01:30:39.563033 2026] [:error] [pid 38586:tid 38595] [client 20.220.221.45:30662] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmpls.php"] [unique_id "aaHUv7_i6nvKNhjFW7VKtAAAAQY"]
[Sat Feb 28 01:30:43.362564 2026] [:error] [pid 15099:tid 15157] [client 20.220.221.45:30669] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmpls.php"] [unique_id "aaHUw-nvP2vtPjYDq_g49wAAANg"]
[Sat Feb 28 01:30:45.891113 2026] [:error] [pid 15240:tid 15252] [client 20.220.221.45:30682] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsg-management/php.php"] [unique_id "aaHUxS1iKL_41Rk9A9N82gAAAAo"]
[Sat Feb 28 01:30:48.122770 2026] [:error] [pid 38620:tid 38622] [client 20.220.221.45:30690] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsg-management/php.php"] [unique_id "aaHUyAP6I7SRqrhh7RoRUQAAAUA"]
[Sat Feb 28 01:30:52.141030 2026] [:error] [pid 15099:tid 15153] [client 20.220.221.45:30605] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsg-management/php.php"] [unique_id "aaHUzOnvP2vtPjYDq_g4_QAAANQ"]
[Sat Feb 28 01:30:55.400313 2026] [:error] [pid 38586:tid 38601] [client 20.220.221.45:30711] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsg-management/php.php"] [unique_id "aaHUz7_i6nvKNhjFW7VK9wAAAQw"]
[Sat Feb 28 01:30:58.657380 2026] [:error] [pid 15099:tid 15147] [client 20.220.221.45:30685] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pouhg.php"] [unique_id "aaHU0unvP2vtPjYDq_g5EAAAAM4"]
[Sat Feb 28 01:31:02.429963 2026] [:error] [pid 38620:tid 38638] [client 20.220.221.45:30683] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pouhg.php"] [unique_id "aaHU1gP6I7SRqrhh7RoRvAAAAVA"]
[Sat Feb 28 01:31:10.892068 2026] [:error] [pid 15240:tid 15261] [client 20.220.221.45:30709] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pouhg.php"] [unique_id "aaHU3i1iKL_41Rk9A9N9TwAAABM"]
[Sat Feb 28 01:31:16.133359 2026] [:error] [pid 38620:tid 38644] [client 20.220.221.45:30688] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aaHU5AP6I7SRqrhh7RoSFgAAAVY"]
[Sat Feb 28 01:31:19.806537 2026] [:error] [pid 15240:tid 15264] [client 20.220.221.45:30651] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aaHU5y1iKL_41Rk9A9N9hAAAABY"]
[Sat Feb 28 01:31:20.738350 2026] [:error] [pid 15099:tid 15143] [client 20.220.221.45:30707] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aaHU6OnvP2vtPjYDq_g5NAAAAMo"]
[Sat Feb 28 01:31:22.649986 2026] [:error] [pid 38586:tid 38592] [client 20.220.221.45:30540] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aaHU6r_i6nvKNhjFW7VLaAAAAQM"]
[Sat Feb 28 01:31:25.312838 2026] [:error] [pid 38620:tid 38630] [client 20.220.221.45:30713] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaHU7QP6I7SRqrhh7RoSbgAAAUg"]
[Sat Feb 28 01:31:27.734126 2026] [:error] [pid 15240:tid 15261] [client 20.220.221.45:30626] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaHU7y1iKL_41Rk9A9N9swAAABM"]
[Sat Feb 28 01:31:28.945645 2026] [:error] [pid 38620:tid 38628] [client 20.220.221.45:30616] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaHU8AP6I7SRqrhh7RoSlwAAAUY"]
[Sat Feb 28 01:31:31.428861 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30647] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaHU8wP6I7SRqrhh7RoSqQAAAU8"]
[Sat Feb 28 01:31:35.187984 2026] [:error] [pid 38586:tid 38613] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/ws59.php
[Sat Feb 28 01:31:35.400991 2026] [:error] [pid 38586:tid 38589] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sat Feb 28 01:31:35.625786 2026] [:error] [pid 38586:tid 38596] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/mamzi.php
[Sat Feb 28 01:31:35.842782 2026] [:error] [pid 38586:tid 38605] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Feb 28 01:31:36.061681 2026] [:error] [pid 38586:tid 38592] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/ae.php
[Sat Feb 28 01:31:36.271703 2026] [:error] [pid 38586:tid 38604] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/06.php
[Sat Feb 28 01:31:36.494984 2026] [:error] [pid 38586:tid 38595] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Sat Feb 28 01:31:36.709150 2026] [:error] [pid 38586:tid 38591] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Sat Feb 28 01:31:37.510810 2026] [:error] [pid 38586:tid 38613] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/bb.php
[Sat Feb 28 01:31:37.740820 2026] [:error] [pid 38586:tid 38589] [client 20.220.221.45:30664] File does not exist: /usr/local/apache/htdocs/suspended-page/dsd.php
[Sat Feb 28 01:31:37.963211 2026] [:error] [pid 38586:tid 38608] [client 20.220.221.45:30664] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/guk.php"] [unique_id "aaHU-b_i6nvKNhjFW7VL3wAAARM"]
[Sat Feb 28 01:31:39.868063 2026] [:error] [pid 38586:tid 38607] [client 20.220.221.45:30539] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/guk.php"] [unique_id "aaHU-7_i6nvKNhjFW7VL6AAAARI"]
[Sat Feb 28 01:31:41.893297 2026] [:error] [pid 38586:tid 38603] [client 20.220.221.45:30603] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/guk.php"] [unique_id "aaHU_b_i6nvKNhjFW7VL7gAAAQ4"]
[Sat Feb 28 01:31:44.060279 2026] [:error] [pid 38620:tid 38629] [client 20.220.221.45:30609] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/guk.php"] [unique_id "aaHVAAP6I7SRqrhh7RoS2QAAAUc"]
[Sat Feb 28 01:31:45.633638 2026] [:error] [pid 38620:tid 38646] [client 20.220.221.45:30536] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aaHVAQP6I7SRqrhh7RoS2wAAAVg"]
[Sat Feb 28 01:31:46.850924 2026] [:error] [pid 15099:tid 15146] [client 20.220.221.45:30663] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aaHVAunvP2vtPjYDq_g5VgAAAM0"]
[Sat Feb 28 01:31:47.958088 2026] [:error] [pid 15099:tid 15137] [client 20.220.221.45:30615] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aaHVA-nvP2vtPjYDq_g5WgAAAMQ"]
[Sat Feb 28 01:31:49.511913 2026] [:error] [pid 15240:tid 15259] [client 20.220.221.45:30716] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aaHVBS1iKL_41Rk9A9N-DQAAABE"]
[Sat Feb 28 01:31:51.232923 2026] [:error] [pid 15100:tid 15164] [client 20.220.221.45:30599] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaHVB0OEbzcINan_ctLGuAAAAEQ"]
[Sat Feb 28 01:31:53.605917 2026] [:error] [pid 15100:tid 15174] [client 20.220.221.45:30695] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaHVCUOEbzcINan_ctLGwQAAAE4"]
[Sat Feb 28 01:31:55.945090 2026] [:error] [pid 38586:tid 38591] [client 20.220.221.45:30592] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaHVC7_i6nvKNhjFW7VMEgAAAQI"]
[Sat Feb 28 01:31:58.178333 2026] [:error] [pid 15100:tid 15175] [client 20.220.221.45:30533] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ze.php"] [unique_id "aaHVDkOEbzcINan_ctLGzQAAAE8"]
[Sat Feb 28 01:32:01.826274 2026] [:error] [pid 15240:tid 15266] [client 20.220.221.45:30608] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file52.php"] [unique_id "aaHVES1iKL_41Rk9A9N-PgAAABg"]
[Sat Feb 28 01:32:03.997644 2026] [:error] [pid 38620:tid 38629] [client 20.220.221.45:30553] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file52.php"] [unique_id "aaHVEwP6I7SRqrhh7RoS5AAAAUc"]
[Sat Feb 28 01:32:05.316066 2026] [:error] [pid 15100:tid 15165] [client 20.220.221.45:30666] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file52.php"] [unique_id "aaHVFUOEbzcINan_ctLG5AAAAEU"]
[Sat Feb 28 01:32:07.554612 2026] [:error] [pid 15240:tid 15254] [client 20.220.221.45:30697] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file52.php"] [unique_id "aaHVFy1iKL_41Rk9A9N-dgAAAAw"]
[Sat Feb 28 01:32:09.531042 2026] [:error] [pid 15098:tid 15128] [client 20.220.221.45:30654] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tax.php"] [unique_id "aaHVGckFqny8dQQbmTkngAAAAJY"]
[Sat Feb 28 01:32:14.524158 2026] [:error] [pid 38620:tid 38634] [client 20.220.221.45:30604] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tax.php"] [unique_id "aaHVHgP6I7SRqrhh7RoTHwAAAUw"]
[Sat Feb 28 01:32:18.286251 2026] [:error] [pid 38620:tid 38644] [client 20.220.221.45:30594] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tax.php"] [unique_id "aaHVIgP6I7SRqrhh7RoTJgAAAVY"]
[Sat Feb 28 01:32:18.941199 2026] [:error] [pid 15100:tid 15180] [client 20.220.221.45:30610] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tax.php"] [unique_id "aaHVIkOEbzcINan_ctLHBwAAAFQ"]
[Sat Feb 28 01:32:20.071201 2026] [:error] [pid 15240:tid 15249] [client 20.220.221.45:30641] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaHVJC1iKL_41Rk9A9N-uwAAAAc"]
[Sat Feb 28 01:32:23.892168 2026] [:error] [pid 15240:tid 15245] [client 20.220.221.45:30665] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaHVJy1iKL_41Rk9A9N-zAAAAAM"]
[Sat Feb 28 01:32:26.726582 2026] [:error] [pid 38620:tid 38627] [client 20.220.221.45:30704] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaHVKgP6I7SRqrhh7RoTVgAAAUU"]
[Sat Feb 28 01:32:27.957205 2026] [:error] [pid 38586:tid 38605] [client 20.220.221.45:30633] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaHVK7_i6nvKNhjFW7VMXwAAARA"]
[Sat Feb 28 01:32:29.275729 2026] [:error] [pid 38586:tid 38605] [client 20.220.221.45:30710] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aaHVLb_i6nvKNhjFW7VMaQAAARA"]
[Sat Feb 28 01:32:30.658458 2026] [:error] [pid 38586:tid 38604] [client 20.220.221.45:30552] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aaHVLr_i6nvKNhjFW7VMbQAAAQ8"]
[Sat Feb 28 01:32:32.214845 2026] [:error] [pid 15100:tid 15179] [client 20.220.221.45:30548] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aaHVMEOEbzcINan_ctLHGQAAAFM"]
[Sat Feb 28 01:32:34.495213 2026] [:error] [pid 38620:tid 38630] [client 20.220.221.45:30694] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ty.php"] [unique_id "aaHVMgP6I7SRqrhh7RoTcgAAAUg"]
[Sat Feb 28 01:32:37.508872 2026] [:error] [pid 38620:tid 38622] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/brc.php
[Sat Feb 28 01:32:37.721683 2026] [:error] [pid 38620:tid 38644] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Sat Feb 28 01:32:37.931450 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Sat Feb 28 01:32:38.373935 2026] [:error] [pid 38620:tid 38622] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Sat Feb 28 01:32:39.446815 2026] [:error] [pid 38620:tid 38626] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/gool.php
[Sat Feb 28 01:32:40.143060 2026] [:error] [pid 38620:tid 38629] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/a1vx.php
[Sat Feb 28 01:32:40.354168 2026] [:error] [pid 38620:tid 38623] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/mans.php
[Sat Feb 28 01:32:40.563560 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/rum.php
[Sat Feb 28 01:32:40.777190 2026] [:error] [pid 38620:tid 38631] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Sat Feb 28 01:32:40.987529 2026] [:error] [pid 38620:tid 38638] [client 20.220.221.45:30714] File does not exist: /usr/local/apache/htdocs/suspended-page/wio.php
[Sat Feb 28 01:32:41.193825 2026] [:error] [pid 38620:tid 38646] [client 20.220.221.45:30714] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aaHVOQP6I7SRqrhh7RoTqAAAAVg"]
[Sat Feb 28 01:32:43.143872 2026] [:error] [pid 38620:tid 38635] [client 20.220.221.45:30700] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aaHVOwP6I7SRqrhh7RoTsQAAAU0"]
[Sat Feb 28 01:32:45.569931 2026] [:error] [pid 38620:tid 38633] [client 20.220.221.45:30634] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aaHVPQP6I7SRqrhh7RoTvAAAAUs"]
[Sat Feb 28 01:32:48.861435 2026] [:error] [pid 15240:tid 15263] [client 20.220.221.45:30625] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "aaHVQC1iKL_41Rk9A9N_VQAAABU"]
[Sat Feb 28 01:32:53.426424 2026] [:error] [pid 15100:tid 15168] [client 20.220.221.45:30534] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaHVRUOEbzcINan_ctLHMQAAAEg"]
[Sat Feb 28 01:32:59.360038 2026] [:error] [pid 38620:tid 38636] [client 20.220.221.45:30613] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaHVSwP6I7SRqrhh7RoUSAAAAU4"]
[Sat Feb 28 01:33:01.974095 2026] [:error] [pid 38620:tid 38641] [client 20.220.221.45:30642] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaHVTQP6I7SRqrhh7RoUUAAAAVM"]
[Sat Feb 28 01:33:04.524883 2026] [:error] [pid 15240:tid 15247] [client 20.220.221.45:30718] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaHVUC1iKL_41Rk9A9N_hgAAAAU"]
[Sat Feb 28 01:33:06.063935 2026] [:error] [pid 38620:tid 38641] [client 20.220.221.45:30601] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws62.php"] [unique_id "aaHVUgP6I7SRqrhh7RoUdgAAAVM"]
[Sat Feb 28 01:33:09.219983 2026] [:error] [pid 15098:tid 15125] [client 20.220.221.45:30708] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws62.php"] [unique_id "aaHVVckFqny8dQQbmTknwgAAAJM"]
[Sat Feb 28 01:33:11.557071 2026] [:error] [pid 15099:tid 15138] [client 20.220.221.45:30632] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws62.php"] [unique_id "aaHVV-nvP2vtPjYDq_g5xQAAAMU"]
[Sat Feb 28 01:33:13.686062 2026] [:error] [pid 15098:tid 15112] [client 20.220.221.45:30624] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws62.php"] [unique_id "aaHVWckFqny8dQQbmTknxgAAAIY"]
[Sat Feb 28 01:33:15.808133 2026] [:error] [pid 38586:tid 38596] [client 20.220.221.45:30689] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaHVW7_i6nvKNhjFW7VNNgAAAQc"]
[Sat Feb 28 01:33:17.887353 2026] [:error] [pid 38620:tid 38640] [client 20.220.221.45:30692] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaHVXQP6I7SRqrhh7RoUlgAAAVI"]
[Sat Feb 28 01:33:19.556541 2026] [:error] [pid 38620:tid 38646] [client 20.220.221.45:30644] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaHVXwP6I7SRqrhh7RoUpQAAAVg"]
[Sat Feb 28 01:33:22.431586 2026] [:error] [pid 38620:tid 38632] [client 20.220.221.45:30680] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "aaHVYgP6I7SRqrhh7RoUwwAAAUo"]
[Sat Feb 28 01:33:26.751632 2026] [:error] [pid 15098:tid 15119] [client 20.220.221.45:30600] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aaHVZskFqny8dQQbmTkn1wAAAI0"]
[Sat Feb 28 01:33:30.668766 2026] [:error] [pid 15099:tid 15144] [client 20.220.221.45:30686] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aaHVaunvP2vtPjYDq_g52AAAAMs"]
[Sat Feb 28 01:33:35.560754 2026] [:error] [pid 38620:tid 38632] [client 20.220.221.45:30545] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aaHVbwP6I7SRqrhh7RoU_QAAAUo"]
[Sat Feb 28 01:33:39.973003 2026] [:error] [pid 38620:tid 38622] [client 20.220.221.45:30611] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/co.php"] [unique_id "aaHVcwP6I7SRqrhh7RoVFgAAAUA"]
[Sat Feb 28 01:33:42.974186 2026] [:error] [pid 38586:tid 38595] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Sat Feb 28 01:33:43.212293 2026] [:error] [pid 38586:tid 38602] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/cxc.php
[Sat Feb 28 01:33:43.421764 2026] [:error] [pid 38586:tid 38605] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/gjm.php
[Sat Feb 28 01:33:43.654234 2026] [:error] [pid 38586:tid 38609] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/ex.php
[Sat Feb 28 01:33:43.903862 2026] [:error] [pid 38586:tid 38596] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/post.php
[Sat Feb 28 01:33:44.117456 2026] [:error] [pid 38586:tid 38604] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Sat Feb 28 01:33:44.329757 2026] [:error] [pid 38586:tid 38592] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/jq.php
[Sat Feb 28 01:33:45.147837 2026] [:error] [pid 38586:tid 38598] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/x7.php
[Sat Feb 28 01:33:45.358423 2026] [:error] [pid 38586:tid 38605] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/bes.php
[Sat Feb 28 01:33:45.569302 2026] [:error] [pid 38586:tid 38603] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/sadd.php
[Sat Feb 28 01:33:45.779358 2026] [:error] [pid 38586:tid 38606] [client 20.220.221.45:30668] File does not exist: /usr/local/apache/htdocs/suspended-page/vgtyu.php
[Sat Feb 28 01:33:45.985194 2026] [:error] [pid 38586:tid 38609] [client 20.220.221.45:30668] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaHVeb_i6nvKNhjFW7VNvgAAARQ"]
[Sat Feb 28 01:33:48.458137 2026] [:error] [pid 38620:tid 38634] [client 20.220.221.45:30693] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaHVfAP6I7SRqrhh7RoVTQAAAUw"]
[Sat Feb 28 01:33:50.931284 2026] [:error] [pid 15240:tid 15254] [client 20.220.221.45:30636] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaHVfi1iKL_41Rk9A9N_0gAAAAw"]
[Sat Feb 28 01:33:52.579554 2026] [:error] [pid 15240:tid 15245] [client 20.220.221.45:30673] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aaHVgC1iKL_41Rk9A9N_1gAAAAM"]
[Sat Feb 28 01:33:54.864222 2026] [:error] [pid 15100:tid 15173] [client 20.220.221.45:30547] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aaHVgkOEbzcINan_ctLHlQAAAE0"]
[Sat Feb 28 01:33:56.569409 2026] [:error] [pid 38620:tid 38634] [client 20.220.221.45:30679] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aaHVhAP6I7SRqrhh7RoVhQAAAUw"]
[Sat Feb 28 01:34:00.422262 2026] [:error] [pid 15240:tid 15253] [client 20.220.221.45:30719] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aaHViC1iKL_41Rk9A9N_-gAAAAs"]
[Sat Feb 28 01:34:02.349678 2026] [:error] [pid 15240:tid 15242] [client 20.220.221.45:30562] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aaHVii1iKL_41Rk9A9N__QAAAAA"]
[Sat Feb 28 01:34:08.371967 2026] [:error] [pid 38586:tid 38611] [client 20.220.221.45:30587] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c4.php"] [unique_id "aaHVkL_i6nvKNhjFW7VOPwAAARY"]
[Sat Feb 28 01:34:11.396986 2026] [:error] [pid 38586:tid 38610] [client 20.220.221.45:30637] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c4.php"] [unique_id "aaHVk7_i6nvKNhjFW7VOSgAAARU"]
[Sat Feb 28 01:34:13.443024 2026] [:error] [pid 38586:tid 38612] [client 20.220.221.45:30717] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c4.php"] [unique_id "aaHVlb_i6nvKNhjFW7VOVAAAARc"]
[Sat Feb 28 01:34:23.458406 2026] [:error] [pid 15099:tid 15157] [client 20.220.221.45:30656] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eauu.php"] [unique_id "aaHVn-nvP2vtPjYDq_g6FAAAANg"]
[Sat Feb 28 01:34:26.580223 2026] [:error] [pid 38586:tid 38609] [client 20.220.221.45:30597] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eauu.php"] [unique_id "aaHVor_i6nvKNhjFW7VOnwAAARQ"]
[Sat Feb 28 01:34:30.641443 2026] [:error] [pid 15098:tid 15122] [client 20.220.221.45:30612] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eauu.php"] [unique_id "aaHVpskFqny8dQQbmTkoOAAAAJA"]
[Sat Feb 28 01:34:33.857532 2026] [:error] [pid 15098:tid 15107] [client 20.220.221.45:30658] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eauu.php"] [unique_id "aaHVqckFqny8dQQbmTkoOwAAAII"]
[Sat Feb 28 01:34:40.296342 2026] [:error] [pid 38586:tid 38611] [client 20.220.221.45:30503] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fasx.php"] [unique_id "aaHVsL_i6nvKNhjFW7VO0QAAARY"]
[Sat Feb 28 01:34:41.954147 2026] [:error] [pid 38620:tid 38626] [client 20.220.221.45:30681] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fasx.php"] [unique_id "aaHVsQP6I7SRqrhh7RoWNQAAAUQ"]
[Sat Feb 28 01:34:45.431980 2026] [:error] [pid 38586:tid 38610] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/fasx.php
[Sat Feb 28 01:34:46.030716 2026] [:error] [pid 38586:tid 38613] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/opts.php
[Sat Feb 28 01:34:46.242617 2026] [:error] [pid 38586:tid 38591] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/nzv.php
[Sat Feb 28 01:34:46.453637 2026] [:error] [pid 38586:tid 38597] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sat Feb 28 01:34:47.203348 2026] [:error] [pid 38586:tid 38605] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Sat Feb 28 01:34:47.432408 2026] [:error] [pid 38586:tid 38612] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/nhr.php
[Sat Feb 28 01:34:47.645185 2026] [:error] [pid 38586:tid 38594] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sat Feb 28 01:34:47.861976 2026] [:error] [pid 38586:tid 38606] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/ws79.php
[Sat Feb 28 01:34:48.086973 2026] [:error] [pid 38586:tid 38601] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/1061.php
[Sat Feb 28 01:34:48.346902 2026] [:error] [pid 38586:tid 38590] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/zwq13.php
[Sat Feb 28 01:34:48.577976 2026] [:error] [pid 38586:tid 38598] [client 20.220.221.45:30659] File does not exist: /usr/local/apache/htdocs/suspended-page/hello.php
[Sat Feb 28 01:34:48.784496 2026] [:error] [pid 38586:tid 38610] [client 20.220.221.45:30659] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aaHVuL_i6nvKNhjFW7VO_AAAARU"]
[Sat Feb 28 01:34:51.236791 2026] [:error] [pid 38586:tid 38598] [client 20.220.221.45:30691] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aaHVu7_i6nvKNhjFW7VPCgAAAQk"]
[Sat Feb 28 01:34:54.653707 2026] [:error] [pid 15100:tid 15162] [client 20.220.221.45:30675] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aaHVvkOEbzcINan_ctLH7QAAAEI"]
[Sat Feb 28 01:34:58.484016 2026] [:error] [pid 38620:tid 38627] [client 20.220.221.45:30635] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/05.php"] [unique_id "aaHVwgP6I7SRqrhh7RoWtQAAAUU"]
[Sat Feb 28 01:35:02.784761 2026] [:error] [pid 38586:tid 38595] [client 20.220.221.45:30622] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxin.php"] [unique_id "aaHVxr_i6nvKNhjFW7VPSAAAAQY"]
[Sat Feb 28 01:35:07.385742 2026] [:error] [pid 38586:tid 38598] [client 20.220.221.45:30607] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxin.php"] [unique_id "aaHVy7_i6nvKNhjFW7VPZAAAAQk"]
[Sat Feb 28 01:35:11.246606 2026] [:error] [pid 15098:tid 15113] [client 20.220.221.45:30661] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxin.php"] [unique_id "aaHVz8kFqny8dQQbmTkoZgAAAIc"]
[Sat Feb 28 01:35:16.844947 2026] [:error] [pid 15099:tid 15153] [client 20.220.221.45:30657] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaHV1OnvP2vtPjYDq_g6XQAAANQ"]
[Sat Feb 28 01:35:18.894410 2026] [:error] [pid 15100:tid 15174] [client 20.220.221.45:30678] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaHV1kOEbzcINan_ctLIGQAAAE4"]
[Sat Feb 28 01:35:23.957161 2026] [:error] [pid 15240:tid 15263] [client 20.220.221.45:30662] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaHV2y1iKL_41Rk9A9OAxQAAABU"]
[Sat Feb 28 01:35:27.971751 2026] [:error] [pid 15098:tid 15115] [client 20.220.221.45:30677] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aaHV38kFqny8dQQbmTkonwAAAIk"]
[Sat Feb 28 01:35:30.028938 2026] [:error] [pid 38586:tid 38590] [client 20.220.221.45:30687] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aaHV4r_i6nvKNhjFW7VP2QAAAQE"]
[Sat Feb 28 01:35:37.006993 2026] [:error] [pid 15098:tid 15116] [client 20.220.221.45:30648] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aaHV6ckFqny8dQQbmTkozAAAAIo"]
[Sat Feb 28 01:35:38.635531 2026] [:error] [pid 15099:tid 15157] [client 20.220.221.45:30683] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aaHV6unvP2vtPjYDq_g6bQAAANg"]
[Sat Feb 28 01:35:40.670725 2026] [:error] [pid 38620:tid 38644] [client 20.220.221.45:30598] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aaHV7AP6I7SRqrhh7RoXDAAAAVY"]
[Sat Feb 28 01:35:42.008426 2026] [:error] [pid 38586:tid 38607] [client 20.220.221.45:30535] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaHV7r_i6nvKNhjFW7VP-gAAARI"]
[Sat Feb 28 01:35:43.814052 2026] [:error] [pid 15098:tid 15113] [client 20.220.221.45:30715] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaHV78kFqny8dQQbmTko2wAAAIc"]
[Sat Feb 28 01:35:45.184189 2026] [:error] [pid 15099:tid 15150] [client 20.220.221.45:30581] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaHV8envP2vtPjYDq_g6cwAAANE"]
[Sat Feb 28 01:35:47.930988 2026] [:error] [pid 15098:tid 15105] [client 20.220.221.45:30626] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaHV88kFqny8dQQbmTko6gAAAIA"]
[Sat Feb 28 01:35:51.235109 2026] [:error] [pid 38586:tid 38608] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/iko.php
[Sat Feb 28 01:35:51.450543 2026] [:error] [pid 38586:tid 38590] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/xmy.php
[Sat Feb 28 01:35:51.664719 2026] [:error] [pid 38586:tid 38600] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/fun.php
[Sat Feb 28 01:35:51.881640 2026] [:error] [pid 38586:tid 38589] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/end.php
[Sat Feb 28 01:35:52.097034 2026] [:error] [pid 38586:tid 38608] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Sat Feb 28 01:35:52.527363 2026] [:error] [pid 38586:tid 38606] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/error1.php
[Sat Feb 28 01:35:52.742709 2026] [:error] [pid 38586:tid 38612] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/thui.php
[Sat Feb 28 01:35:52.966923 2026] [:error] [pid 38586:tid 38601] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Sat Feb 28 01:35:53.460067 2026] [:error] [pid 38586:tid 38610] [client 20.220.221.45:30698] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sat Feb 28 01:35:53.684208 2026] [:error] [pid 38586:tid 38590] [client 20.220.221.45:30698] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaHV-b_i6nvKNhjFW7VQdwAAAQE"]
[Sat Feb 28 01:35:56.516585 2026] [:error] [pid 15240:tid 15264] [client 20.220.221.45:30530] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaHV_C1iKL_41Rk9A9OBEQAAABY"]
[Sat Feb 28 01:35:58.384977 2026] [:error] [pid 15100:tid 15179] [client 20.220.221.45:30711] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaHV_kOEbzcINan_ctLIWQAAAFM"]
[Sat Feb 28 01:36:01.453994 2026] [:error] [pid 38586:tid 38602] [client 20.220.221.45:30659] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aaHWAb_i6nvKNhjFW7VQjAAAAQ0"]
[Sat Feb 28 01:36:03.476763 2026] [:error] [pid 15240:tid 15250] [client 20.220.221.45:30618] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rpk.php"] [unique_id "aaHWAy1iKL_41Rk9A9OBIgAAAAg"]
[Sat Feb 28 01:36:06.497421 2026] [:error] [pid 15240:tid 15256] [client 20.220.221.45:30664] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rpk.php"] [unique_id "aaHWBi1iKL_41Rk9A9OBJgAAAA4"]
[Sat Feb 28 01:36:09.703715 2026] [:error] [pid 38620:tid 38623] [client 20.220.221.45:30564] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rpk.php"] [unique_id "aaHWCQP6I7SRqrhh7RoXaQAAAUE"]
[Sat Feb 28 01:36:14.035260 2026] [:error] [pid 38620:tid 38622] [client 20.220.221.45:30666] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rpk.php"] [unique_id "aaHWDgP6I7SRqrhh7RoXfwAAAUA"]
[Sat Feb 28 01:36:18.941966 2026] [:error] [pid 38586:tid 38609] [client 20.220.221.45:30709] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaHWEr_i6nvKNhjFW7VQuQAAARQ"]
[Sat Feb 28 01:36:22.390007 2026] [:error] [pid 38620:tid 38625] [client 20.220.221.45:30713] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaHWFgP6I7SRqrhh7RoXpAAAAUM"]
[Sat Feb 28 01:36:25.359658 2026] [:error] [pid 38586:tid 38589] [client 20.220.221.45:30696] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaHWGb_i6nvKNhjFW7VQxQAAAQA"]
[Sat Feb 28 01:36:27.475756 2026] [:error] [pid 15100:tid 15168] [client 20.220.221.45:30672] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aaHWG0OEbzcINan_ctLIhQAAAEg"]
[Sat Feb 28 01:36:29.728931 2026] [:error] [pid 38586:tid 38607] [client 20.220.221.45:30561] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaHWHb_i6nvKNhjFW7VQyAAAARI"]
[Sat Feb 28 01:36:32.028845 2026] [:error] [pid 38586:tid 38598] [client 20.220.221.45:30614] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaHWIL_i6nvKNhjFW7VQ0QAAAQk"]
[Sat Feb 28 01:36:33.185010 2026] [:error] [pid 38586:tid 38601] [client 20.220.221.45:30565] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaHWIb_i6nvKNhjFW7VQ4AAAAQw"]
[Sat Feb 28 01:36:34.744949 2026] [:error] [pid 15240:tid 15255] [client 20.220.221.45:30606] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aaHWIi1iKL_41Rk9A9OBTQAAAA0"]
[Sat Feb 28 01:36:36.716584 2026] [:error] [pid 38586:tid 38608] [client 20.220.221.45:30701] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aaHWJL_i6nvKNhjFW7VQ6AAAARM"]
[Sat Feb 28 01:36:40.123285 2026] [:error] [pid 38620:tid 38641] [client 20.220.221.45:30682] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aaHWKAP6I7SRqrhh7RoX4QAAAVM"]
[Sat Feb 28 01:36:40.961192 2026] [:error] [pid 38620:tid 38639] [client 20.220.221.45:30628] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aaHWKAP6I7SRqrhh7RoX8wAAAVE"]
[Sat Feb 28 01:36:41.486884 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30595] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e.php"] [unique_id "aaHWKQP6I7SRqrhh7RoX_AAAAU8"]
[Sat Feb 28 01:36:42.509893 2026] [:error] [pid 38586:tid 38596] [client 20.220.221.45:30596] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaHWKr_i6nvKNhjFW7VRAwAAAQc"]
[Sat Feb 28 01:36:44.225365 2026] [:error] [pid 15099:tid 15144] [client 20.220.221.45:30640] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaHWLOnvP2vtPjYDq_g6xwAAAMs"]
[Sat Feb 28 01:36:48.876205 2026] [:error] [pid 38586:tid 38602] [client 20.220.221.45:30674] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaHWML_i6nvKNhjFW7VRLAAAAQ0"]
[Sat Feb 28 01:36:49.490761 2026] [:error] [pid 38620:tid 38634] [client 20.220.221.45:30610] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "aaHWMQP6I7SRqrhh7RoYPwAAAUw"]
[Sat Feb 28 01:36:51.744838 2026] [:error] [pid 38620:tid 38629] [client 20.220.221.45:30555] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "aaHWMwP6I7SRqrhh7RoYSQAAAUc"]
[Sat Feb 28 01:36:55.918533 2026] [:error] [pid 38620:tid 38627] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/X7x.php
[Sat Feb 28 01:36:56.128663 2026] [:error] [pid 38620:tid 38644] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Sat Feb 28 01:36:56.377872 2026] [:error] [pid 38620:tid 38638] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/get.php
[Sat Feb 28 01:36:56.601374 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Sat Feb 28 01:36:56.822002 2026] [:error] [pid 38620:tid 38636] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Sat Feb 28 01:36:57.031672 2026] [:error] [pid 38620:tid 38641] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sat Feb 28 01:36:59.697924 2026] [:error] [pid 38620:tid 38633] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/raw.php
[Sat Feb 28 01:36:59.910164 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sat Feb 28 01:37:00.122905 2026] [:error] [pid 38620:tid 38631] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/rtx.php
[Sat Feb 28 01:37:00.360873 2026] [:error] [pid 38620:tid 38630] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Sat Feb 28 01:37:00.570745 2026] [:error] [pid 38620:tid 38629] [client 20.220.221.45:30684] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 01:37:00.777431 2026] [:error] [pid 38620:tid 38643] [client 20.220.221.45:30684] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaHWPAP6I7SRqrhh7RoYegAAAVU"]
[Sat Feb 28 01:37:07.004147 2026] [:error] [pid 15100:tid 15167] [client 20.220.221.45:30608] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaHWQ0OEbzcINan_ctLI4AAAAEc"]
[Sat Feb 28 01:37:09.873066 2026] [:error] [pid 38620:tid 38644] [client 20.220.221.45:30653] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaHWRQP6I7SRqrhh7RoYpwAAAVY"]
[Sat Feb 28 01:37:11.619710 2026] [:error] [pid 38586:tid 38597] [client 20.220.221.45:30599] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "aaHWR7_i6nvKNhjFW7VRgwAAAQg"]
[Sat Feb 28 01:37:13.936514 2026] [:error] [pid 15098:tid 15121] [client 20.220.221.45:30646] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aaHWSckFqny8dQQbmTkpRwAAAI8"]
[Sat Feb 28 01:37:16.180201 2026] [:error] [pid 38620:tid 38630] [client 20.220.221.45:30663] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aaHWTAP6I7SRqrhh7RoYtAAAAUg"]
[Sat Feb 28 01:37:18.035450 2026] [:error] [pid 15099:tid 15157] [client 20.220.221.45:30699] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aaHWTunvP2vtPjYDq_g67AAAANg"]
[Sat Feb 28 01:37:22.483453 2026] [:error] [pid 15240:tid 15243] [client 20.220.221.45:30710] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "aaHWUi1iKL_41Rk9A9OBvAAAAAE"]
[Sat Feb 28 01:37:25.384286 2026] [:error] [pid 38620:tid 38636] [client 20.220.221.45:30615] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaHWVQP6I7SRqrhh7RoY0wAAAU4"]
[Sat Feb 28 01:37:28.521022 2026] [:error] [pid 38586:tid 38605] [client 20.220.221.45:30601] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaHWWL_i6nvKNhjFW7VRoQAAARA"]
[Sat Feb 28 01:37:30.792143 2026] [:error] [pid 38586:tid 38589] [client 20.220.221.45:30469] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaHWWr_i6nvKNhjFW7VRqQAAAQA"]
[Sat Feb 28 01:37:34.923073 2026] [:error] [pid 15099:tid 15142] [client 20.220.221.45:30594] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaHWXunvP2vtPjYDq_g7FQAAAMk"]
[Sat Feb 28 01:37:38.158669 2026] [:error] [pid 38620:tid 38635] [client 20.220.221.45:30702] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "aaHWYgP6I7SRqrhh7RoZAQAAAU0"]
[Sat Feb 28 01:37:39.796124 2026] [:error] [pid 38586:tid 38602] [client 20.220.221.45:30600] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "aaHWY7_i6nvKNhjFW7VRzQAAAQ0"]
[Sat Feb 28 01:37:42.035747 2026] [:error] [pid 38586:tid 38599] [client 20.220.221.45:30686] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "aaHWZr_i6nvKNhjFW7VR0wAAAQo"]
[Sat Feb 28 01:37:44.555276 2026] [:error] [pid 15099:tid 15137] [client 20.220.221.45:30542] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "aaHWaOnvP2vtPjYDq_g7IgAAAMQ"]
[Sat Feb 28 01:37:47.051338 2026] [:error] [pid 15098:tid 15129] [client 20.220.221.45:30603] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aaHWa8kFqny8dQQbmTkpgwAAAJc"]
[Sat Feb 28 01:37:49.197058 2026] [:error] [pid 15098:tid 15117] [client 20.220.221.45:30667] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aaHWbckFqny8dQQbmTkpiAAAAIs"]
[Sat Feb 28 01:37:51.959193 2026] [:error] [pid 38586:tid 38596] [client 20.220.221.45:30472] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aaHWb7_i6nvKNhjFW7VR6wAAAQc"]
[Sat Feb 28 01:37:55.528164 2026] [:error] [pid 38586:tid 38600] [client 20.220.221.45:30616] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aaHWc7_i6nvKNhjFW7VR_wAAAQs"]
[Sat Feb 28 01:38:00.333359 2026] [:error] [pid 38620:tid 38633] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Sat Feb 28 01:38:00.542449 2026] [:error] [pid 38620:tid 38643] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sat Feb 28 01:38:01.542241 2026] [:error] [pid 38620:tid 38623] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sat Feb 28 01:38:01.837454 2026] [:error] [pid 38620:tid 38646] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/ocxla.php
[Sat Feb 28 01:38:02.048555 2026] [:error] [pid 38620:tid 38645] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/god.php
[Sat Feb 28 01:38:02.265336 2026] [:error] [pid 38620:tid 38632] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Sat Feb 28 01:38:02.498671 2026] [:error] [pid 38620:tid 38622] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/zz.php
[Sat Feb 28 01:38:02.707628 2026] [:error] [pid 38620:tid 38642] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Sat Feb 28 01:38:03.617250 2026] [:error] [pid 38620:tid 38636] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/sdsa.php
[Sat Feb 28 01:38:04.693594 2026] [:error] [pid 38620:tid 38636] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Feb 28 01:38:04.903226 2026] [:error] [pid 38620:tid 38634] [client 20.220.221.45:30676] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sat Feb 28 01:38:05.109106 2026] [:error] [pid 38620:tid 38637] [client 20.220.221.45:30676] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aaHWfQP6I7SRqrhh7RoZXQAAAU8"]
[Sat Feb 28 01:38:06.659899 2026] [:error] [pid 38620:tid 38640] [client 20.220.221.45:30693] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aaHWfgP6I7SRqrhh7RoZYQAAAVI"]
[Sat Feb 28 01:38:10.147045 2026] [:error] [pid 15240:tid 15258] [client 20.220.221.45:30654] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aaHWgi1iKL_41Rk9A9OCGgAAABA"]
[Sat Feb 28 01:38:11.714475 2026] [:error] [pid 38586:tid 38591] [client 20.220.221.45:30605] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/un.php"] [unique_id "aaHWg7_i6nvKNhjFW7VSQwAAAQI"]
[Sat Feb 28 01:38:14.300968 2026] [:error] [pid 38586:tid 38603] [client 20.220.221.45:30611] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.kb.php"] [unique_id "aaHWhr_i6nvKNhjFW7VSUQAAAQ4"]
[Sat Feb 28 01:38:17.065373 2026] [:error] [pid 15099:tid 15156] [client 20.220.221.45:30707] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.kb.php"] [unique_id "aaHWienvP2vtPjYDq_g7VQAAANc"]
[Sat Feb 28 01:38:18.519616 2026] [:error] [pid 38620:tid 38644] [client 20.220.221.45:30633] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.kb.php"] [unique_id "aaHWigP6I7SRqrhh7RoZtgAAAVY"]
[Sat Feb 28 01:38:19.781307 2026] [:error] [pid 15098:tid 15115] [client 20.220.221.45:30638] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.kb.php"] [unique_id "aaHWi8kFqny8dQQbmTkpngAAAIk"]
[Sat Feb 28 01:38:21.295476 2026] [:error] [pid 15099:tid 15148] [client 20.220.221.45:30592] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aaHWjenvP2vtPjYDq_g7YAAAAM8"]
[Sat Feb 28 01:38:22.635122 2026] [:error] [pid 15240:tid 15246] [client 20.220.221.45:30670] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aaHWji1iKL_41Rk9A9OCKQAAAAQ"]
[Sat Feb 28 01:38:24.992720 2026] [:error] [pid 38620:tid 38625] [client 20.220.221.45:30688] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aaHWkAP6I7SRqrhh7RoZzgAAAUM"]
[Sat Feb 28 01:38:27.246733 2026] [:error] [pid 15099:tid 15134] [client 20.220.221.45:30619] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aaHWk-nvP2vtPjYDq_g7ZQAAAME"]
[Sat Feb 28 03:11:38.899414 2026] [:error] [pid 20709:tid 20731] [client 20.220.8.221:11720] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaHsak5CnHafo7s0kbTgTgAAAdQ"]
[Sat Feb 28 03:11:39.739822 2026] [:error] [pid 38586:tid 38613] [client 20.220.8.221:11761] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaHsa7_i6nvKNhjFW7WZTgAAARg"]
[Sat Feb 28 03:11:40.566107 2026] [:error] [pid 15099:tid 15150] [client 20.220.8.221:11712] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaHsbOnvP2vtPjYDq_hUFQAAANE"]
[Sat Feb 28 03:11:41.387342 2026] [:error] [pid 38620:tid 38638] [client 20.220.8.221:11759] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaHsbQP6I7SRqrhh7RpxTQAAAVA"]
[Sat Feb 28 03:12:18.955771 2026] [:error] [pid 38620:tid 38629] [client 146.190.160.27:54048] [client 146.190.160.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.160.27, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaHskgP6I7SRqrhh7RpxkAAAAUc"]
[Sat Feb 28 03:12:18.959226 2026] [:error] [pid 38620:tid 38629] [client 146.190.160.27:54048] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat Feb 28 03:12:21.837670 2026] [:error] [pid 38620:tid 38632] [client 146.190.160.27:54048] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaHslQP6I7SRqrhh7RpxpAAAAUo"]
[Sat Feb 28 03:12:22.308924 2026] [:error] [pid 19669:tid 19692] [client 146.190.160.27:61805] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaHslky98E5mX0pQrMpG8QAAAZQ"]
[Sat Feb 28 03:12:22.805009 2026] [:error] [pid 38586:tid 38612] [client 146.190.160.27:62756] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaHslr_i6nvKNhjFW7WZxQAAARc"]
[Sat Feb 28 03:12:25.127246 2026] [:error] [pid 38620:tid 38644] [client 146.190.160.27:64994] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaHsmQP6I7SRqrhh7RpxswAAAVY"]
[Sat Feb 28 03:12:25.590504 2026] [:error] [pid 38586:tid 38595] [client 146.190.160.27:51269] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaHsmb_i6nvKNhjFW7WZ2wAAAQY"]
[Sat Feb 28 03:12:26.051616 2026] [:error] [pid 38586:tid 38591] [client 146.190.160.27:52176] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaHsmr_i6nvKNhjFW7WZ4QAAAQI"]
[Sat Feb 28 03:12:26.569147 2026] [:error] [pid 19669:tid 19672] [client 146.190.160.27:53085] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaHsmky98E5mX0pQrMpHCgAAAYA"]
[Sat Feb 28 04:17:15.833483 2026] [:error] [pid 39292:tid 39312] [client 20.220.212.70:57442] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 28 04:17:16.041431 2026] [:error] [pid 39292:tid 39308] [client 20.220.212.70:57442] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 04:17:16.459763 2026] [:error] [pid 39292:tid 39317] [client 20.220.212.70:57442] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Feb 28 04:17:16.670937 2026] [:error] [pid 39292:tid 39295] [client 20.220.212.70:57442] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 04:17:17.088215 2026] [:error] [pid 39292:tid 39315] [client 20.220.212.70:57442] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat Feb 28 04:17:17.297360 2026] [:error] [pid 39292:tid 39301] [client 20.220.212.70:57442] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 28 04:17:17.516885 2026] [:error] [pid 39292:tid 39299] [client 20.220.212.70:57442] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Feb 28 04:17:17.931639 2026] [:error] [pid 39292:tid 39294] [client 20.220.212.70:57442] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaH7zaIAO5fN7BxyqcHoKAAAAMA"]
[Sat Feb 28 04:17:18.940462 2026] [:error] [pid 39183:tid 39215] [client 20.220.212.70:16187] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaH7zhCf4HvhVePw3LZDSAAAABc"]
[Sat Feb 28 04:17:20.013460 2026] [:error] [pid 39184:tid 39235] [client 20.220.212.70:59979] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaH70FtZF9Zd_U7easAI-wAAAFA"]
[Sat Feb 28 04:17:21.040200 2026] [:error] [pid 39184:tid 39223] [client 20.220.212.70:57432] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaH70VtZF9Zd_U7easAJAgAAAEQ"]
[Sat Feb 28 04:57:40.513854 2026] [:error] [pid 39185:tid 39265] [client 43.132.214.228:53452] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaIFRBVE-FfM89u7BQYlrwAAAJM"]
[Sat Feb 28 06:09:28.732738 2026] [:error] [pid 39292:tid 39299] [client 20.220.212.70:62620] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaIWGKIAO5fN7BxyqcFUOgAAAMU"]
[Sat Feb 28 06:09:29.604697 2026] [:error] [pid 22194:tid 22200] [client 20.220.212.70:60057] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaIWGX6mbajs3bzQGyv0OAAAAUQ"]
[Sat Feb 28 06:09:30.448305 2026] [:error] [pid 22194:tid 22206] [client 20.220.212.70:62598] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaIWGn6mbajs3bzQGyv0QAAAAUo"]
[Sat Feb 28 06:09:31.285967 2026] [:error] [pid 39185:tid 39264] [client 20.220.212.70:62622] [client 20.220.212.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaIWGxVE-FfM89u7BQZHvgAAAJI"]
[Sat Feb 28 06:56:22.984326 2026] [:error] [pid 22194:tid 22220] [client 91.224.92.164:57575] [client 91.224.92.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aaIhFn6mbajs3bzQGysPdgAAAVg"]
[Sat Feb 28 06:56:24.895225 2026] [:error] [pid 39184:tid 39241] [client 91.224.92.164:54199] [client 91.224.92.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aaIhGFtZF9Zd_U7easBCJwAAAFY"]
[Sat Feb 28 07:35:16.398161 2026] [:error] [pid 22194:tid 22203] [client 182.42.105.85:57884] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaIqNH6mbajs3bzQGysvTQAAAUc"]
[Sat Feb 28 10:13:22.958000 2026] [:error] [pid 52460:tid 52487] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sat Feb 28 10:13:23.171273 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sat Feb 28 10:13:23.617754 2026] [:error] [pid 52460:tid 52467] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sat Feb 28 10:13:23.827359 2026] [:error] [pid 52460:tid 52482] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sat Feb 28 10:13:24.041766 2026] [:error] [pid 52460:tid 52469] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 10:13:24.350211 2026] [:error] [pid 52460:tid 52485] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sat Feb 28 10:13:24.569249 2026] [:error] [pid 52460:tid 52477] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sat Feb 28 10:13:25.008531 2026] [:error] [pid 52460:tid 52480] [client 20.220.232.101:29571] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sat Feb 28 10:13:25.214784 2026] [:error] [pid 52460:tid 52472] [client 20.220.232.101:29571] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaJPRbLWOogAgHGh62SEygAAAYk"]
[Sat Feb 28 10:13:26.197820 2026] [:error] [pid 22194:tid 22196] [client 20.220.232.101:29664] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaJPRn6mbajs3bzQGysLVQAAAUA"]
[Sat Feb 28 10:13:26.975879 2026] [:error] [pid 39185:tid 39249] [client 20.220.232.101:29639] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaJPRhVE-FfM89u7BQYicgAAAIM"]
[Sat Feb 28 10:13:27.700533 2026] [:error] [pid 39185:tid 39262] [client 20.220.232.101:29684] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaJPRxVE-FfM89u7BQYifwAAAJA"]
[Sat Feb 28 10:13:28.302485 2026] [:error] [pid 39185:tid 39258] [client 20.220.232.101:29657] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaJPSBVE-FfM89u7BQYiiwAAAIw"]
[Sat Feb 28 10:13:29.003615 2026] [:error] [pid 39185:tid 39258] [client 20.220.232.101:29651] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaJPSRVE-FfM89u7BQYimgAAAIw"]
[Sat Feb 28 10:13:29.642719 2026] [:error] [pid 39185:tid 39250] [client 20.220.232.101:29673] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaJPSRVE-FfM89u7BQYipAAAAIQ"]
[Sat Feb 28 10:13:30.431737 2026] [:error] [pid 39185:tid 39264] [client 20.220.232.101:29690] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaJPShVE-FfM89u7BQYisAAAAJI"]
[Sat Feb 28 10:13:30.997536 2026] [:error] [pid 22194:tid 22203] [client 20.220.232.101:29640] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaJPSn6mbajs3bzQGysLWAAAAUc"]
[Sat Feb 28 10:13:31.758356 2026] [:error] [pid 22194:tid 22220] [client 20.220.232.101:29675] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaJPS36mbajs3bzQGysLWQAAAVg"]
[Sat Feb 28 10:13:32.370751 2026] [:error] [pid 39183:tid 39207] [client 20.220.232.101:29573] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaJPTBCf4HvhVePw3LbJkwAAAA8"]
[Sat Feb 28 10:13:33.039350 2026] [:error] [pid 52460:tid 52486] [client 20.220.232.101:29674] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaJPTbLWOogAgHGh62SE1QAAAZc"]
[Sat Feb 28 10:13:33.899005 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29676] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaJPTbLWOogAgHGh62SE2gAAAYM"]
[Sat Feb 28 10:13:34.788664 2026] [:error] [pid 39185:tid 39270] [client 20.220.232.101:29653] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaJPThVE-FfM89u7BQYi5wAAAJg"]
[Sat Feb 28 10:13:35.381627 2026] [:error] [pid 39185:tid 39247] [client 20.220.232.101:29669] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaJPTxVE-FfM89u7BQYi8QAAAIE"]
[Sat Feb 28 10:13:36.208261 2026] [:error] [pid 11791:tid 11807] [client 20.220.232.101:29641] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaJPUGuX5e1Q32gqxH25IwAAAQ4"]
[Sat Feb 28 10:13:37.008012 2026] [:error] [pid 39185:tid 39259] [client 20.220.232.101:29686] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaJPURVE-FfM89u7BQYjAwAAAI0"]
[Sat Feb 28 10:13:37.720115 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29589] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaJPURVE-FfM89u7BQYjCwAAAIY"]
[Sat Feb 28 10:13:38.476549 2026] [:error] [pid 39185:tid 39260] [client 20.220.232.101:29648] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaJPUhVE-FfM89u7BQYjEgAAAI4"]
[Sat Feb 28 10:13:39.254035 2026] [:error] [pid 11791:tid 11793] [client 20.220.232.101:29659] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaJPU2uX5e1Q32gqxH25KwAAAQA"]
[Sat Feb 28 10:13:40.277154 2026] [:error] [pid 52460:tid 52477] [client 20.220.232.101:29612] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaJPVLLWOogAgHGh62SE5wAAAY4"]
[Sat Feb 28 10:13:41.563813 2026] [:error] [pid 11791:tid 11817] [client 20.220.232.101:29683] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaJPVWuX5e1Q32gqxH25NgAAARg"]
[Sat Feb 28 10:13:42.267217 2026] [:error] [pid 52460:tid 52473] [client 20.220.232.101:29575] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaJPVrLWOogAgHGh62SE9AAAAYo"]
[Sat Feb 28 10:13:43.901181 2026] [:error] [pid 39185:tid 39262] [client 20.220.232.101:29582] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaJPVxVE-FfM89u7BQYjMQAAAJA"]
[Sat Feb 28 10:13:45.558646 2026] [:error] [pid 39183:tid 39199] [client 20.220.232.101:29580] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaJPWRCf4HvhVePw3LbJmQAAAAc"]
[Sat Feb 28 10:13:47.301018 2026] [:error] [pid 39183:tid 39216] [client 20.220.232.101:29569] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaJPWxCf4HvhVePw3LbJmgAAABg"]
[Sat Feb 28 10:13:48.088985 2026] [:error] [pid 52460:tid 52464] [client 20.220.232.101:29682] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaJPXLLWOogAgHGh62SFRwAAAYE"]
[Sat Feb 28 10:13:48.539679 2026] [:error] [pid 39185:tid 39251] [client 20.220.232.101:29588] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaJPXBVE-FfM89u7BQYjXQAAAIU"]
[Sat Feb 28 10:13:49.177673 2026] [:error] [pid 39185:tid 39261] [client 20.220.232.101:29632] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaJPXRVE-FfM89u7BQYjYgAAAI8"]
[Sat Feb 28 10:13:49.671874 2026] [:error] [pid 11791:tid 11801] [client 20.220.232.101:29689] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaJPXWuX5e1Q32gqxH25QwAAAQg"]
[Sat Feb 28 10:13:50.481277 2026] [:error] [pid 52460:tid 52476] [client 20.220.232.101:29647] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaJPXrLWOogAgHGh62SFUAAAAY0"]
[Sat Feb 28 10:13:51.167040 2026] [:error] [pid 52460:tid 52464] [client 20.220.232.101:29671] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaJPX7LWOogAgHGh62SFWQAAAYE"]
[Sat Feb 28 10:13:51.668557 2026] [:error] [pid 52460:tid 52481] [client 20.220.232.101:29685] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaJPX7LWOogAgHGh62SFXQAAAZI"]
[Sat Feb 28 10:13:52.276833 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29688] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaJPYLLWOogAgHGh62SFYwAAAYM"]
[Sat Feb 28 10:13:52.759663 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29633] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaJPYBVE-FfM89u7BQYjbAAAAIY"]
[Sat Feb 28 10:13:53.198525 2026] [:error] [pid 39184:tid 39219] [client 20.220.232.101:29661] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaJPYVtZF9Zd_U7easCzVAAAAEA"]
[Sat Feb 28 10:13:53.963364 2026] [:error] [pid 11791:tid 11798] [client 20.220.232.101:29586] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaJPYWuX5e1Q32gqxH25TwAAAQU"]
[Sat Feb 28 10:13:54.652585 2026] [:error] [pid 39292:tid 39317] [client 20.220.232.101:29679] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaJPYqIAO5fN7BxyqcGQqAAAANc"]
[Sat Feb 28 10:13:55.933083 2026] [:error] [pid 52460:tid 52481] [client 20.220.232.101:29650] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaJPY7LWOogAgHGh62SFagAAAZI"]
[Sat Feb 28 10:13:56.794585 2026] [:error] [pid 22194:tid 22216] [client 20.220.232.101:29607] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaJPZH6mbajs3bzQGysLbQAAAVQ"]
[Sat Feb 28 10:13:57.475171 2026] [:error] [pid 39185:tid 39270] [client 20.220.232.101:29621] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaJPZRVE-FfM89u7BQYjfgAAAJg"]
[Sat Feb 28 10:13:58.206764 2026] [:error] [pid 11791:tid 11815] [client 20.220.232.101:29670] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaJPZmuX5e1Q32gqxH25VAAAARY"]
[Sat Feb 28 10:13:59.257031 2026] [:error] [pid 39292:tid 39314] [client 20.220.232.101:29537] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaJPZ6IAO5fN7BxyqcGQrwAAANQ"]
[Sat Feb 28 10:13:59.761904 2026] [:error] [pid 52460:tid 52465] [client 20.220.232.101:29572] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaJPZ7LWOogAgHGh62SFcAAAAYI"]
[Sat Feb 28 10:14:00.350061 2026] [:error] [pid 39183:tid 39214] [client 20.220.232.101:29576] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaJPaBCf4HvhVePw3LbJogAAABY"]
[Sat Feb 28 10:14:01.176342 2026] [:error] [pid 39183:tid 39209] [client 20.220.232.101:29672] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaJPaRCf4HvhVePw3LbJpwAAABE"]
[Sat Feb 28 10:14:01.755287 2026] [:error] [pid 39292:tid 39304] [client 20.220.232.101:29634] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaJPaaIAO5fN7BxyqcGQsQAAAMo"]
[Sat Feb 28 10:14:02.640896 2026] [:error] [pid 39183:tid 39203] [client 20.220.232.101:29516] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaJPahCf4HvhVePw3LbJqgAAAAs"]
[Sat Feb 28 10:14:03.314297 2026] [:error] [pid 52460:tid 52481] [client 20.220.232.101:29601] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaJPa7LWOogAgHGh62SFdgAAAZI"]
[Sat Feb 28 10:14:04.057999 2026] [:error] [pid 39292:tid 39299] [client 20.220.232.101:29587] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaJPbKIAO5fN7BxyqcGQtAAAAMU"]
[Sat Feb 28 10:14:04.694729 2026] [:error] [pid 11791:tid 11803] [client 20.220.232.101:29577] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaJPbGuX5e1Q32gqxH25ZgAAAQo"]
[Sat Feb 28 10:14:05.479927 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29600] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaJPbbLWOogAgHGh62SFegAAAYM"]
[Sat Feb 28 10:14:06.189620 2026] [:error] [pid 52460:tid 52470] [client 20.220.232.101:29667] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaJPbrLWOogAgHGh62SFfQAAAYc"]
[Sat Feb 28 10:14:07.059831 2026] [:error] [pid 11791:tid 11816] [client 20.220.232.101:29649] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaJPb2uX5e1Q32gqxH25awAAARc"]
[Sat Feb 28 10:14:07.581646 2026] [:error] [pid 39185:tid 39250] [client 20.220.232.101:29592] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaJPbxVE-FfM89u7BQYjngAAAIQ"]
[Sat Feb 28 10:14:08.098429 2026] [:error] [pid 39185:tid 39269] [client 20.220.232.101:29693] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaJPcBVE-FfM89u7BQYjogAAAJc"]
[Sat Feb 28 10:14:08.697595 2026] [:error] [pid 39185:tid 39261] [client 20.220.232.101:29595] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaJPcBVE-FfM89u7BQYjpQAAAI8"]
[Sat Feb 28 10:14:09.161469 2026] [:error] [pid 39184:tid 39224] [client 20.220.232.101:29655] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaJPcVtZF9Zd_U7easCzXwAAAEU"]
[Sat Feb 28 10:14:09.619331 2026] [:error] [pid 11791:tid 11805] [client 20.220.232.101:29692] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaJPcWuX5e1Q32gqxH25bgAAAQw"]
[Sat Feb 28 10:14:10.282639 2026] [:error] [pid 39183:tid 39213] [client 20.220.232.101:29691] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaJPchCf4HvhVePw3LbJsQAAABU"]
[Sat Feb 28 10:14:10.858902 2026] [:error] [pid 39184:tid 39238] [client 20.220.232.101:29514] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaJPcltZF9Zd_U7easCzYAAAAFM"]
[Sat Feb 28 10:14:11.482782 2026] [:error] [pid 39183:tid 39208] [client 20.220.232.101:29625] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaJPcxCf4HvhVePw3LbJsgAAABA"]
[Sat Feb 28 10:14:12.172537 2026] [:error] [pid 39184:tid 39221] [client 20.220.232.101:29606] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaJPdFtZF9Zd_U7easCzZAAAAEI"]
[Sat Feb 28 10:14:12.901695 2026] [:error] [pid 39292:tid 39316] [client 20.220.232.101:29616] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaJPdKIAO5fN7BxyqcGQwQAAANY"]
[Sat Feb 28 10:14:13.449401 2026] [:error] [pid 52460:tid 52468] [client 20.220.232.101:29583] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaJPdbLWOogAgHGh62SFiAAAAYU"]
[Sat Feb 28 10:14:14.036895 2026] [:error] [pid 39185:tid 39249] [client 20.220.232.101:29631] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaJPdhVE-FfM89u7BQYjsQAAAIM"]
[Sat Feb 28 10:14:14.617974 2026] [:error] [pid 39185:tid 39260] [client 20.220.232.101:29574] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaJPdhVE-FfM89u7BQYjtgAAAI4"]
[Sat Feb 28 10:14:15.359206 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29644] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaJPdxVE-FfM89u7BQYjvgAAAIY"]
[Sat Feb 28 10:14:17.072625 2026] [:error] [pid 22194:tid 22209] [client 20.220.232.101:29511] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaJPeX6mbajs3bzQGysLegAAAU0"]
[Sat Feb 28 10:14:18.489664 2026] [:error] [pid 22194:tid 22204] [client 20.220.232.101:29677] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaJPen6mbajs3bzQGysLfgAAAUg"]
[Sat Feb 28 10:14:19.651945 2026] [:error] [pid 11791:tid 11811] [client 20.220.232.101:29504] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaJPe2uX5e1Q32gqxH25dgAAARI"]
[Sat Feb 28 10:14:20.239605 2026] [:error] [pid 39292:tid 39301] [client 20.220.232.101:29680] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaJPfKIAO5fN7BxyqcGQyAAAAMc"]
[Sat Feb 28 10:14:20.986930 2026] [:error] [pid 22194:tid 22217] [client 20.220.232.101:29584] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaJPfH6mbajs3bzQGysLggAAAVU"]
[Sat Feb 28 10:14:21.781230 2026] [:error] [pid 39185:tid 39247] [client 20.220.232.101:29535] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaJPfRVE-FfM89u7BQYj7gAAAIE"]
[Sat Feb 28 10:14:22.257606 2026] [:error] [pid 39185:tid 39269] [client 20.220.232.101:29517] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaJPfhVE-FfM89u7BQYj8gAAAJc"]
[Sat Feb 28 10:14:22.743570 2026] [:error] [pid 39292:tid 39297] [client 20.220.232.101:29695] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaJPfqIAO5fN7BxyqcGQyQAAAMM"]
[Sat Feb 28 10:14:23.533121 2026] [:error] [pid 39185:tid 39261] [client 20.220.232.101:29668] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaJPfxVE-FfM89u7BQYj9wAAAI8"]
[Sat Feb 28 10:14:24.936994 2026] [:error] [pid 11791:tid 11817] [client 20.220.232.101:29508] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaJPgGuX5e1Q32gqxH25ggAAARg"]
[Sat Feb 28 10:14:25.993998 2026] [:error] [pid 39184:tid 39235] [client 20.220.232.101:29642] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sat Feb 28 10:14:26.202214 2026] [:error] [pid 39184:tid 39241] [client 20.220.232.101:29642] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sat Feb 28 10:14:26.430155 2026] [:error] [pid 39184:tid 39243] [client 20.220.232.101:29642] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sat Feb 28 10:14:26.636979 2026] [:error] [pid 39184:tid 39224] [client 20.220.232.101:29642] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat Feb 28 10:14:26.851481 2026] [:error] [pid 39184:tid 39229] [client 20.220.232.101:29642] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sat Feb 28 10:14:27.097178 2026] [:error] [pid 39184:tid 39222] [client 20.220.232.101:29642] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Feb 28 10:14:27.306199 2026] [:error] [pid 39184:tid 39219] [client 20.220.232.101:29642] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaJPg1tZF9Zd_U7easCzcQAAAEA"]
[Sat Feb 28 10:14:28.133793 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29638] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sat Feb 28 10:14:28.341194 2026] [:error] [pid 52460:tid 52474] [client 20.220.232.101:29638] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Feb 28 10:14:28.569019 2026] [:error] [pid 52460:tid 52480] [client 20.220.232.101:29638] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sat Feb 28 10:14:28.778062 2026] [:error] [pid 52460:tid 52484] [client 20.220.232.101:29638] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 10:14:28.990742 2026] [:error] [pid 52460:tid 52472] [client 20.220.232.101:29638] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sat Feb 28 10:14:29.197318 2026] [:error] [pid 52460:tid 52465] [client 20.220.232.101:29638] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaJPhbLWOogAgHGh62SFoAAAAYI"]
[Sat Feb 28 10:14:29.774815 2026] [:error] [pid 39183:tid 39213] [client 20.220.232.101:29598] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaJPhRCf4HvhVePw3LbJwQAAABU"]
[Sat Feb 28 10:14:30.323769 2026] [:error] [pid 39183:tid 39199] [client 20.220.232.101:29579] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaJPhhCf4HvhVePw3LbJwwAAAAc"]
[Sat Feb 28 10:14:31.060538 2026] [:error] [pid 22194:tid 22208] [client 20.220.232.101:29611] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaJPh36mbajs3bzQGysLhwAAAUw"]
[Sat Feb 28 10:14:31.889904 2026] [:error] [pid 39185:tid 39257] [client 20.220.232.101:29519] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aaJPhxVE-FfM89u7BQYkDwAAAIs"]
[Sat Feb 28 10:14:32.460949 2026] [:error] [pid 39185:tid 39249] [client 20.220.232.101:29643] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aaJPiBVE-FfM89u7BQYkEgAAAIM"]
[Sat Feb 28 10:14:32.931660 2026] [:error] [pid 52460:tid 52471] [client 20.220.232.101:29630] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aaJPiLLWOogAgHGh62SFqQAAAYg"]
[Sat Feb 28 10:14:33.557087 2026] [:error] [pid 39185:tid 39262] [client 20.220.232.101:29594] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aaJPiRVE-FfM89u7BQYkFAAAAJA"]
[Sat Feb 28 10:14:34.298531 2026] [:error] [pid 52460:tid 52465] [client 20.220.232.101:29635] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaJPirLWOogAgHGh62SFrQAAAYI"]
[Sat Feb 28 10:14:35.230964 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29507] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaJPixVE-FfM89u7BQYkGwAAAIY"]
[Sat Feb 28 10:14:35.845431 2026] [:error] [pid 39185:tid 39270] [client 20.220.232.101:29646] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaJPixVE-FfM89u7BQYkIgAAAJg"]
[Sat Feb 28 10:14:36.314069 2026] [:error] [pid 39183:tid 39210] [client 20.220.232.101:29554] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/index.php"] [unique_id "aaJPjBCf4HvhVePw3LbJxgAAABI"]
[Sat Feb 28 10:14:37.106729 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29604] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaJPjRVE-FfM89u7BQYkKgAAAIY"]
[Sat Feb 28 10:14:38.065565 2026] [:error] [pid 11791:tid 11796] [client 20.220.232.101:29512] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaJPjmuX5e1Q32gqxH25jgAAAQM"]
[Sat Feb 28 10:14:39.197300 2026] [:error] [pid 22194:tid 22198] [client 20.220.232.101:29663] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaJPj36mbajs3bzQGysLkQAAAUI"]
[Sat Feb 28 10:14:40.235333 2026] [:error] [pid 52460:tid 52473] [client 20.220.232.101:29623] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaJPkLLWOogAgHGh62SFwQAAAYo"]
[Sat Feb 28 10:14:40.853385 2026] [:error] [pid 52460:tid 52482] [client 20.220.232.101:29654] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJPkLLWOogAgHGh62SFwwAAAZM"]
[Sat Feb 28 10:14:41.713000 2026] [:error] [pid 52460:tid 52487] [client 20.220.232.101:29547] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJPkbLWOogAgHGh62SFzAAAAZg"]
[Sat Feb 28 10:14:42.300852 2026] [:error] [pid 52460:tid 52483] [client 20.220.232.101:29532] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJPkrLWOogAgHGh62SF0gAAAZQ"]
[Sat Feb 28 10:14:42.904961 2026] [:error] [pid 39183:tid 39198] [client 20.220.232.101:29665] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/maint.php"] [unique_id "aaJPkhCf4HvhVePw3LbJywAAAAY"]
[Sat Feb 28 10:14:43.466907 2026] [:error] [pid 39292:tid 39312] [client 20.220.232.101:29603] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaJPk6IAO5fN7BxyqcGQ3AAAANI"]
[Sat Feb 28 10:14:43.931770 2026] [:error] [pid 22194:tid 22211] [client 20.220.232.101:29613] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaJPk36mbajs3bzQGysLlgAAAU8"]
[Sat Feb 28 10:14:44.487818 2026] [:error] [pid 11791:tid 11802] [client 20.220.232.101:29552] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaJPlGuX5e1Q32gqxH25lgAAAQk"]
[Sat Feb 28 10:14:45.159922 2026] [:error] [pid 22194:tid 22201] [client 20.220.232.101:29662] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaJPlX6mbajs3bzQGysLmAAAAUU"]
[Sat Feb 28 10:14:45.904143 2026] [:error] [pid 22194:tid 22209] [client 20.220.232.101:29513] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaJPlX6mbajs3bzQGysLmgAAAU0"]
[Sat Feb 28 10:14:46.425540 2026] [:error] [pid 39184:tid 39222] [client 20.220.232.101:29660] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaJPlltZF9Zd_U7easCzfAAAAEM"]
[Sat Feb 28 10:14:46.987206 2026] [:error] [pid 11791:tid 11803] [client 20.220.232.101:29520] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaJPlmuX5e1Q32gqxH25mgAAAQo"]
[Sat Feb 28 10:14:47.578947 2026] [:error] [pid 52460:tid 52487] [client 20.220.232.101:29566] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaJPl7LWOogAgHGh62SF1wAAAZg"]
[Sat Feb 28 10:14:48.041235 2026] [:error] [pid 52460:tid 52482] [client 20.220.232.101:29678] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaJPmLLWOogAgHGh62SF2wAAAZM"]
[Sat Feb 28 10:14:48.562710 2026] [:error] [pid 52460:tid 52468] [client 20.220.232.101:29687] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaJPmLLWOogAgHGh62SF3gAAAYU"]
[Sat Feb 28 10:14:49.284759 2026] [:error] [pid 39292:tid 39311] [client 20.220.232.101:29658] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaJPmaIAO5fN7BxyqcGQ6gAAANE"]
[Sat Feb 28 10:14:49.787652 2026] [:error] [pid 39292:tid 39294] [client 20.220.232.101:29527] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaJPmaIAO5fN7BxyqcGQ7QAAAMA"]
[Sat Feb 28 10:14:50.403468 2026] [:error] [pid 39292:tid 39315] [client 20.220.232.101:29596] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaJPmqIAO5fN7BxyqcGQ8gAAANU"]
[Sat Feb 28 10:14:50.923802 2026] [:error] [pid 39185:tid 39260] [client 20.220.232.101:29464] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaJPmhVE-FfM89u7BQYkQgAAAI4"]
[Sat Feb 28 10:14:51.553747 2026] [:error] [pid 39185:tid 39266] [client 20.220.232.101:29626] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaJPmxVE-FfM89u7BQYkRwAAAJQ"]
[Sat Feb 28 10:14:52.167097 2026] [:error] [pid 11791:tid 11812] [client 20.220.232.101:29614] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaJPnGuX5e1Q32gqxH25oQAAARM"]
[Sat Feb 28 10:14:53.028845 2026] [:error] [pid 39185:tid 39253] [client 20.220.232.101:29540] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaJPnRVE-FfM89u7BQYkVQAAAIc"]
[Sat Feb 28 10:14:53.712133 2026] [:error] [pid 39292:tid 39300] [client 20.220.232.101:29459] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaJPnaIAO5fN7BxyqcGRBQAAAMY"]
[Sat Feb 28 10:14:54.349746 2026] [:error] [pid 22194:tid 22220] [client 20.220.232.101:29593] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaJPnn6mbajs3bzQGysLpQAAAVg"]
[Sat Feb 28 10:14:55.209267 2026] [:error] [pid 22194:tid 22208] [client 20.220.232.101:29581] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaJPn36mbajs3bzQGysLpgAAAUw"]
[Sat Feb 28 10:14:55.799315 2026] [:error] [pid 52460:tid 52476] [client 20.220.232.101:29627] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaJPn7LWOogAgHGh62SF9QAAAY0"]
[Sat Feb 28 10:14:56.623448 2026] [:error] [pid 39185:tid 39247] [client 20.220.232.101:29523] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaJPoBVE-FfM89u7BQYkZQAAAIE"]
[Sat Feb 28 10:14:57.732276 2026] [:error] [pid 52460:tid 52475] [client 20.220.232.101:29652] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaJPobLWOogAgHGh62SF9wAAAYw"]
[Sat Feb 28 10:14:58.453033 2026] [:error] [pid 52460:tid 52478] [client 20.220.232.101:29463] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaJPorLWOogAgHGh62SF_AAAAY8"]
[Sat Feb 28 10:14:59.138336 2026] [:error] [pid 52460:tid 52465] [client 20.220.232.101:29515] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaJPo7LWOogAgHGh62SGAAAAAYI"]
[Sat Feb 28 10:14:59.732876 2026] [:error] [pid 39185:tid 39269] [client 20.220.232.101:29530] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaJPoxVE-FfM89u7BQYkbgAAAJc"]
[Sat Feb 28 10:15:00.430242 2026] [:error] [pid 39292:tid 39296] [client 20.220.232.101:29483] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaJPpKIAO5fN7BxyqcGRDQAAAMI"]
[Sat Feb 28 10:15:01.635041 2026] [:error] [pid 39185:tid 39259] [client 20.220.232.101:29550] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaJPpRVE-FfM89u7BQYkdwAAAI0"]
[Sat Feb 28 10:15:02.995758 2026] [:error] [pid 11791:tid 11808] [client 20.220.232.101:29551] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJPpmuX5e1Q32gqxH25rwAAAQ8"]
[Sat Feb 28 10:15:04.102486 2026] [:error] [pid 52460:tid 52483] [client 20.220.232.101:29590] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJPqLLWOogAgHGh62SGBgAAAZQ"]
[Sat Feb 28 10:15:04.647157 2026] [:error] [pid 11791:tid 11812] [client 20.220.232.101:29666] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJPqGuX5e1Q32gqxH25sAAAARM"]
[Sat Feb 28 10:15:05.443580 2026] [:error] [pid 39185:tid 39262] [client 20.220.232.101:29541] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaJPqRVE-FfM89u7BQYkiAAAAJA"]
[Sat Feb 28 10:15:05.935239 2026] [:error] [pid 39185:tid 39263] [client 20.220.232.101:29656] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaJPqRVE-FfM89u7BQYkjAAAAJE"]
[Sat Feb 28 10:15:06.437512 2026] [:error] [pid 39183:tid 39213] [client 20.220.232.101:29597] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaJPqhCf4HvhVePw3LbJ3wAAABU"]
[Sat Feb 28 10:15:07.037549 2026] [:error] [pid 11791:tid 11810] [client 20.220.232.101:29564] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaJPq2uX5e1Q32gqxH25uAAAARE"]
[Sat Feb 28 10:15:07.680777 2026] [:error] [pid 39183:tid 39209] [client 20.220.232.101:29449] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaJPqxCf4HvhVePw3LbJ4QAAABE"]
[Sat Feb 28 10:15:08.346502 2026] [:error] [pid 39184:tid 39224] [client 20.220.232.101:29510] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaJPrFtZF9Zd_U7easCznQAAAEU"]
[Sat Feb 28 10:15:09.477337 2026] [:error] [pid 39184:tid 39240] [client 20.220.232.101:29518] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaJPrVtZF9Zd_U7easCzpwAAAFU"]
[Sat Feb 28 10:15:10.456166 2026] [:error] [pid 39184:tid 39238] [client 20.220.232.101:29521] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaJPrltZF9Zd_U7easCzqQAAAFM"]
[Sat Feb 28 10:15:11.044749 2026] [:error] [pid 22194:tid 22198] [client 20.220.232.101:29645] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaJPr36mbajs3bzQGysLsAAAAUI"]
[Sat Feb 28 10:15:11.617489 2026] [:error] [pid 52460:tid 52471] [client 20.220.232.101:29591] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaJPr7LWOogAgHGh62SGDAAAAYg"]
[Sat Feb 28 10:15:12.362153 2026] [:error] [pid 52460:tid 52463] [client 20.220.232.101:29506] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaJPsLLWOogAgHGh62SGDwAAAYA"]
[Sat Feb 28 10:15:13.055594 2026] [:error] [pid 39184:tid 39241] [client 20.220.232.101:29457] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaJPsVtZF9Zd_U7easCzsAAAAFY"]
[Sat Feb 28 10:15:13.701016 2026] [:error] [pid 39184:tid 39240] [client 20.220.232.101:29555] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaJPsVtZF9Zd_U7easCzsgAAAFU"]
[Sat Feb 28 10:15:14.354471 2026] [:error] [pid 39185:tid 39261] [client 20.220.232.101:29548] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaJPshVE-FfM89u7BQYkrAAAAI8"]
[Sat Feb 28 10:15:14.930283 2026] [:error] [pid 39185:tid 39269] [client 20.220.232.101:29602] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaJPshVE-FfM89u7BQYkrwAAAJc"]
[Sat Feb 28 10:15:15.453944 2026] [:error] [pid 39185:tid 39247] [client 20.220.232.101:29681] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaJPsxVE-FfM89u7BQYksQAAAIE"]
[Sat Feb 28 10:15:16.154086 2026] [:error] [pid 52460:tid 52477] [client 20.220.232.101:29536] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaJPtLLWOogAgHGh62SGFAAAAY4"]
[Sat Feb 28 10:15:16.745027 2026] [:error] [pid 22194:tid 22207] [client 20.220.232.101:29522] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaJPtH6mbajs3bzQGysLuwAAAUs"]
[Sat Feb 28 10:15:17.333891 2026] [:error] [pid 11791:tid 11793] [client 20.220.232.101:29542] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaJPtWuX5e1Q32gqxH25wAAAAQA"]
[Sat Feb 28 10:15:17.968247 2026] [:error] [pid 11791:tid 11816] [client 20.220.232.101:29610] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaJPtWuX5e1Q32gqxH25wQAAARc"]
[Sat Feb 28 10:15:18.473357 2026] [:error] [pid 11791:tid 11806] [client 20.220.232.101:29578] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaJPtmuX5e1Q32gqxH25xwAAAQ0"]
[Sat Feb 28 10:15:19.257742 2026] [:error] [pid 22194:tid 22212] [client 20.220.232.101:29526] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaJPt36mbajs3bzQGysLwwAAAVA"]
[Sat Feb 28 10:15:20.452683 2026] [:error] [pid 52460:tid 52479] [client 20.220.232.101:29570] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaJPuLLWOogAgHGh62SGHwAAAZA"]
[Sat Feb 28 10:15:21.241545 2026] [:error] [pid 11791:tid 11807] [client 20.220.232.101:29637] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaJPuWuX5e1Q32gqxH25zQAAAQ4"]
[Sat Feb 28 10:15:22.739733 2026] [:error] [pid 39183:tid 39199] [client 20.220.232.101:29620] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaJPuhCf4HvhVePw3LbKAQAAAAc"]
[Sat Feb 28 10:15:23.620544 2026] [:error] [pid 39184:tid 39222] [client 20.220.232.101:29618] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaJPu1tZF9Zd_U7easCzuwAAAEM"]
[Sat Feb 28 10:15:24.184548 2026] [:error] [pid 11791:tid 11805] [client 20.220.232.101:29485] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaJPvGuX5e1Q32gqxH251QAAAQw"]
[Sat Feb 28 10:15:25.452642 2026] [:error] [pid 52460:tid 52463] [client 20.220.232.101:29388] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaJPvbLWOogAgHGh62SGMgAAAYA"]
[Sat Feb 28 10:15:26.159228 2026] [:error] [pid 39185:tid 39249] [client 20.220.232.101:29525] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaJPvhVE-FfM89u7BQYkyQAAAIM"]
[Sat Feb 28 10:15:26.830881 2026] [:error] [pid 39185:tid 39253] [client 20.220.232.101:29622] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaJPvhVE-FfM89u7BQYk0gAAAIc"]
[Sat Feb 28 10:15:27.522763 2026] [:error] [pid 11791:tid 11797] [client 20.220.232.101:29505] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaJPv2uX5e1Q32gqxH254gAAAQQ"]
[Sat Feb 28 10:15:28.248261 2026] [:error] [pid 39292:tid 39301] [client 20.220.232.101:29468] File does not exist: /usr/local/apache/htdocs/suspended-page/sx.php
[Sat Feb 28 10:15:28.670449 2026] [:error] [pid 39292:tid 39299] [client 20.220.232.101:29468] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sat Feb 28 10:15:28.905231 2026] [:error] [pid 39292:tid 39304] [client 20.220.232.101:29468] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat Feb 28 10:15:29.113262 2026] [:error] [pid 39292:tid 39313] [client 20.220.232.101:29468] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sat Feb 28 10:15:29.337608 2026] [:error] [pid 39292:tid 39309] [client 20.220.232.101:29468] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sat Feb 28 10:15:30.271747 2026] [:error] [pid 39292:tid 39314] [client 20.220.232.101:29468] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Sat Feb 28 10:15:30.477307 2026] [:error] [pid 39292:tid 39310] [client 20.220.232.101:29468] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaJPwqIAO5fN7BxyqcGRPwAAANA"]
[Sat Feb 28 10:15:31.696000 2026] [:error] [pid 52460:tid 52475] [client 20.220.232.101:29534] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/index.php"] [unique_id "aaJPw7LWOogAgHGh62SGWgAAAYw"]
[Sat Feb 28 10:15:32.996124 2026] [:error] [pid 39183:tid 39211] [client 20.220.232.101:29529] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/index.php"] [unique_id "aaJPxBCf4HvhVePw3LbKEAAAABM"]
[Sat Feb 28 10:15:34.138275 2026] [:error] [pid 22194:tid 22219] [client 20.220.232.101:29568] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/index.php"] [unique_id "aaJPxn6mbajs3bzQGysL0wAAAVc"]
[Sat Feb 28 10:15:35.658697 2026] [:error] [pid 39185:tid 39265] [client 20.220.232.101:29528] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aaJPxxVE-FfM89u7BQYk7wAAAJM"]
[Sat Feb 28 10:15:36.754573 2026] [:error] [pid 39292:tid 39311] [client 20.220.232.101:29605] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJPyKIAO5fN7BxyqcGRRgAAANE"]
[Sat Feb 28 10:15:37.521227 2026] [:error] [pid 39184:tid 39235] [client 20.220.232.101:29441] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJPyVtZF9Zd_U7easCzwAAAAFA"]
[Sat Feb 28 10:15:38.197085 2026] [:error] [pid 11791:tid 11796] [client 20.220.232.101:29567] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJPymuX5e1Q32gqxH26CgAAAQM"]
[Sat Feb 28 10:15:38.815647 2026] [:error] [pid 39292:tid 39305] [client 20.220.232.101:29466] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "aaJPyqIAO5fN7BxyqcGRUAAAAMs"]
[Sat Feb 28 10:15:39.508900 2026] [:error] [pid 11791:tid 11812] [client 20.220.232.101:29601] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJPy2uX5e1Q32gqxH26FgAAARM"]
[Sat Feb 28 10:15:40.214111 2026] [:error] [pid 11791:tid 11808] [client 20.220.232.101:29531] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJPzGuX5e1Q32gqxH26HQAAAQ8"]
[Sat Feb 28 10:15:40.849721 2026] [:error] [pid 22194:tid 22210] [client 20.220.232.101:29489] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJPzH6mbajs3bzQGysL2gAAAU4"]
[Sat Feb 28 10:15:41.706839 2026] [:error] [pid 52460:tid 52485] [client 20.220.232.101:29533] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "aaJPzbLWOogAgHGh62SGaAAAAZY"]
[Sat Feb 28 10:15:42.451966 2026] [:error] [pid 52460:tid 52463] [client 20.220.232.101:29475] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJPzrLWOogAgHGh62SGbQAAAYA"]
[Sat Feb 28 10:15:43.273235 2026] [:error] [pid 52460:tid 52468] [client 20.220.232.101:29462] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJPz7LWOogAgHGh62SGdwAAAYU"]
[Sat Feb 28 10:15:43.829922 2026] [:error] [pid 11791:tid 11803] [client 20.220.232.101:29543] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJPz2uX5e1Q32gqxH26KAAAAQo"]
[Sat Feb 28 10:15:44.319561 2026] [:error] [pid 11791:tid 11814] [client 20.220.232.101:29439] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "aaJP0GuX5e1Q32gqxH26KgAAARU"]
[Sat Feb 28 10:15:45.046625 2026] [:error] [pid 22194:tid 22212] [client 20.220.232.101:29500] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaJP0X6mbajs3bzQGysL4AAAAVA"]
[Sat Feb 28 10:15:46.140168 2026] [:error] [pid 52460:tid 52474] [client 20.220.232.101:29608] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aaJP0rLWOogAgHGh62SGhAAAAYs"]
[Sat Feb 28 10:15:46.968598 2026] [:error] [pid 22194:tid 22219] [client 20.220.232.101:29539] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aaJP0n6mbajs3bzQGysL4gAAAVc"]
[Sat Feb 28 10:15:47.631657 2026] [:error] [pid 22194:tid 22200] [client 20.220.232.101:29628] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aaJP036mbajs3bzQGysL5QAAAUQ"]
[Sat Feb 28 10:15:48.079451 2026] [:error] [pid 39184:tid 39229] [client 20.220.232.101:29447] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/index/function.php"] [unique_id "aaJP1FtZF9Zd_U7easCzyQAAAEo"]
[Sat Feb 28 10:15:48.909817 2026] [:error] [pid 39185:tid 39254] [client 20.220.232.101:29472] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJP1BVE-FfM89u7BQYlDgAAAIg"]
[Sat Feb 28 10:15:49.547744 2026] [:error] [pid 39183:tid 39212] [client 20.220.232.101:29559] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJP1RCf4HvhVePw3LbKHAAAABQ"]
[Sat Feb 28 10:15:50.250254 2026] [:error] [pid 39184:tid 39224] [client 20.220.232.101:29549] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJP1ltZF9Zd_U7easCz1QAAAEU"]
[Sat Feb 28 10:15:50.827011 2026] [:error] [pid 22194:tid 22214] [client 20.220.232.101:29482] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "aaJP1n6mbajs3bzQGysL8wAAAVI"]
[Sat Feb 28 10:15:51.534006 2026] [:error] [pid 39185:tid 39253] [client 20.220.232.101:29467] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aaJP1xVE-FfM89u7BQYlFwAAAIc"]
[Sat Feb 28 10:15:52.173482 2026] [:error] [pid 52460:tid 52484] [client 20.220.232.101:29427] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aaJP2LLWOogAgHGh62SGjwAAAZU"]
[Sat Feb 28 10:15:52.763010 2026] [:error] [pid 39185:tid 39256] [client 20.220.232.101:29424] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aaJP2BVE-FfM89u7BQYlHAAAAIo"]
[Sat Feb 28 10:15:53.409540 2026] [:error] [pid 22194:tid 22206] [client 20.220.232.101:29563] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aaJP2X6mbajs3bzQGysL-AAAAUo"]
[Sat Feb 28 10:15:54.381160 2026] [:error] [pid 39185:tid 39262] [client 20.220.232.101:29448] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ww1.php"] [unique_id "aaJP2hVE-FfM89u7BQYlIwAAAJA"]
[Sat Feb 28 10:15:54.888929 2026] [:error] [pid 22194:tid 22198] [client 20.220.232.101:29538] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aaJP2n6mbajs3bzQGysL-wAAAUI"]
[Sat Feb 28 10:15:55.371437 2026] [:error] [pid 39184:tid 39228] [client 20.220.232.101:29474] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aaJP21tZF9Zd_U7easCz3gAAAEk"]
[Sat Feb 28 10:15:56.281487 2026] [:error] [pid 39185:tid 39251] [client 20.220.232.101:29494] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aaJP3BVE-FfM89u7BQYlJwAAAIU"]
[Sat Feb 28 10:15:57.079473 2026] [:error] [pid 39292:tid 39311] [client 20.220.232.101:29619] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about/function.php"] [unique_id "aaJP3aIAO5fN7BxyqcGRXgAAANE"]
[Sat Feb 28 10:15:57.591939 2026] [:error] [pid 39183:tid 39213] [client 20.220.232.101:29385] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aaJP3RCf4HvhVePw3LbKMAAAABU"]
[Sat Feb 28 10:15:58.140492 2026] [:error] [pid 39184:tid 39223] [client 20.220.232.101:29524] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aaJP3ltZF9Zd_U7easCz6QAAAEQ"]
[Sat Feb 28 10:15:58.627657 2026] [:error] [pid 39183:tid 39208] [client 20.220.232.101:29599] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aaJP3hCf4HvhVePw3LbKMgAAABA"]
[Sat Feb 28 10:15:59.285034 2026] [:error] [pid 39185:tid 39258] [client 20.220.232.101:29469] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin/function.php"] [unique_id "aaJP3xVE-FfM89u7BQYlLgAAAIw"]
[Sat Feb 28 10:15:59.964501 2026] [:error] [pid 52460:tid 52485] [client 20.220.232.101:29497] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaJP37LWOogAgHGh62SGnwAAAZY"]
[Sat Feb 28 10:16:00.605080 2026] [:error] [pid 39185:tid 39270] [client 20.220.232.101:29377] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaJP4BVE-FfM89u7BQYlMQAAAJg"]
[Sat Feb 28 10:16:01.472039 2026] [:error] [pid 39292:tid 39310] [client 20.220.232.101:29565] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaJP4aIAO5fN7BxyqcGRZQAAANA"]
[Sat Feb 28 10:16:02.278160 2026] [:error] [pid 22194:tid 22199] [client 20.220.232.101:29478] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaJP4n6mbajs3bzQGysMBgAAAUM"]
[Sat Feb 28 10:16:02.869153 2026] [:error] [pid 22194:tid 22198] [client 20.220.232.101:29545] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaJP4n6mbajs3bzQGysMCgAAAUI"]
[Sat Feb 28 10:16:03.377483 2026] [:error] [pid 22194:tid 22211] [client 20.220.232.101:29491] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaJP436mbajs3bzQGysMDgAAAU8"]
[Sat Feb 28 10:16:03.897020 2026] [:error] [pid 52460:tid 52474] [client 20.220.232.101:29490] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaJP47LWOogAgHGh62SGsgAAAYs"]
[Sat Feb 28 10:16:04.551441 2026] [:error] [pid 52460:tid 52463] [client 20.220.232.101:29556] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaJP5LLWOogAgHGh62SGtgAAAYA"]
[Sat Feb 28 10:16:05.246092 2026] [:error] [pid 11791:tid 11804] [client 20.220.232.101:29395] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaJP5WuX5e1Q32gqxH26RwAAAQs"]
[Sat Feb 28 10:16:05.691869 2026] [:error] [pid 39185:tid 39258] [client 20.220.232.101:29399] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaJP5RVE-FfM89u7BQYlOwAAAIw"]
[Sat Feb 28 10:16:06.328575 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29492] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaJP5rLWOogAgHGh62SGvgAAAYM"]
[Sat Feb 28 10:16:07.015513 2026] [:error] [pid 52460:tid 52486] [client 20.220.232.101:29458] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaJP57LWOogAgHGh62SGwgAAAZc"]
[Sat Feb 28 10:16:07.647730 2026] [:error] [pid 52460:tid 52473] [client 20.220.232.101:29585] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaJP57LWOogAgHGh62SGxQAAAYo"]
[Sat Feb 28 10:16:08.394645 2026] [:error] [pid 39185:tid 39266] [client 20.220.232.101:29317] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaJP6BVE-FfM89u7BQYlRgAAAJQ"]
[Sat Feb 28 10:16:08.979906 2026] [:error] [pid 39184:tid 39228] [client 20.220.232.101:29380] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaJP6FtZF9Zd_U7easCz7QAAAEk"]
[Sat Feb 28 10:16:09.884181 2026] [:error] [pid 39185:tid 39269] [client 20.220.232.101:29406] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaJP6RVE-FfM89u7BQYlTwAAAJc"]
[Sat Feb 28 10:16:10.504976 2026] [:error] [pid 22194:tid 22213] [client 20.220.232.101:29440] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaJP6n6mbajs3bzQGysMEgAAAVE"]
[Sat Feb 28 10:16:11.150784 2026] [:error] [pid 39185:tid 39253] [client 20.220.232.101:29476] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaJP6xVE-FfM89u7BQYlVgAAAIc"]
[Sat Feb 28 10:16:11.948031 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29484] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaJP67LWOogAgHGh62SGzAAAAYM"]
[Sat Feb 28 10:16:12.438590 2026] [:error] [pid 52460:tid 52486] [client 20.220.232.101:29624] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaJP7LLWOogAgHGh62SG0gAAAZc"]
[Sat Feb 28 10:16:12.973162 2026] [:error] [pid 22194:tid 22215] [client 20.220.232.101:29445] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaJP7H6mbajs3bzQGysMFgAAAVM"]
[Sat Feb 28 10:16:13.660804 2026] [:error] [pid 11791:tid 11793] [client 20.220.232.101:29390] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaJP7WuX5e1Q32gqxH26UQAAAQA"]
[Sat Feb 28 10:16:14.145452 2026] [:error] [pid 52460:tid 52463] [client 20.220.232.101:29677] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaJP7rLWOogAgHGh62SG1gAAAYA"]
[Sat Feb 28 10:16:14.728474 2026] [:error] [pid 52460:tid 52484] [client 20.220.232.101:29557] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaJP7rLWOogAgHGh62SG2QAAAZU"]
[Sat Feb 28 10:16:15.289826 2026] [:error] [pid 39184:tid 39225] [client 20.220.232.101:29615] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaJP71tZF9Zd_U7easCz8QAAAEY"]
[Sat Feb 28 10:16:16.019703 2026] [:error] [pid 11791:tid 11795] [client 20.220.232.101:29454] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaJP8GuX5e1Q32gqxH26WAAAAQI"]
[Sat Feb 28 10:16:16.750176 2026] [:error] [pid 39184:tid 39233] [client 20.220.232.101:29461] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaJP8FtZF9Zd_U7easCz-QAAAE4"]
[Sat Feb 28 10:16:17.328476 2026] [:error] [pid 52460:tid 52472] [client 20.220.232.101:29442] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaJP8bLWOogAgHGh62SG3wAAAYk"]
[Sat Feb 28 10:16:18.018145 2026] [:error] [pid 52460:tid 52468] [client 20.220.232.101:29327] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaJP8rLWOogAgHGh62SG4gAAAYU"]
[Sat Feb 28 10:16:18.770968 2026] [:error] [pid 52460:tid 52479] [client 20.220.232.101:29444] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaJP8rLWOogAgHGh62SG4wAAAZA"]
[Sat Feb 28 10:16:19.429030 2026] [:error] [pid 39292:tid 39307] [client 20.220.232.101:29382] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaJP86IAO5fN7BxyqcGRbQAAAM0"]
[Sat Feb 28 10:16:20.356238 2026] [:error] [pid 52460:tid 52485] [client 20.220.232.101:29379] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaJP9LLWOogAgHGh62SG6AAAAZY"]
[Sat Feb 28 10:16:21.113681 2026] [:error] [pid 39185:tid 39254] [client 20.220.232.101:29502] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaJP9RVE-FfM89u7BQYlcQAAAIg"]
[Sat Feb 28 10:16:21.709930 2026] [:error] [pid 52460:tid 52475] [client 20.220.232.101:29558] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaJP9bLWOogAgHGh62SG7wAAAYw"]
[Sat Feb 28 10:16:22.621970 2026] [:error] [pid 52460:tid 52469] [client 20.220.232.101:29562] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaJP9rLWOogAgHGh62SG9gAAAYY"]
[Sat Feb 28 10:16:23.958187 2026] [:error] [pid 11791:tid 11798] [client 20.220.232.101:29546] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaJP92uX5e1Q32gqxH26aAAAAQU"]
[Sat Feb 28 10:16:25.820954 2026] [:error] [pid 39183:tid 39199] [client 20.220.232.101:29481] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaJP-RCf4HvhVePw3LbKRAAAAAc"]
[Sat Feb 28 10:16:26.843342 2026] [:error] [pid 52460:tid 52467] [client 20.220.232.101:29443] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaJP-rLWOogAgHGh62SHDwAAAYQ"]
[Sat Feb 28 10:16:27.357720 2026] [:error] [pid 39185:tid 39267] [client 20.220.232.101:29413] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaJP-xVE-FfM89u7BQYliAAAAJU"]
[Sat Feb 28 10:16:27.890058 2026] [:error] [pid 39185:tid 39269] [client 20.220.232.101:29509] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaJP-xVE-FfM89u7BQYliwAAAJc"]
[Sat Feb 28 10:16:28.437667 2026] [:error] [pid 11791:tid 11810] [client 20.220.232.101:29496] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaJP_GuX5e1Q32gqxH26hQAAARE"]
[Sat Feb 28 10:16:29.037123 2026] [:error] [pid 11791:tid 11800] [client 20.220.232.101:29405] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaJP_WuX5e1Q32gqxH26iQAAAQc"]
[Sat Feb 28 10:16:29.597620 2026] [:error] [pid 39292:tid 39316] [client 20.220.232.101:29450] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaJP_aIAO5fN7BxyqcGRkgAAANY"]
[Sat Feb 28 10:16:30.935070 2026] [:error] [pid 39292:tid 39299] [client 20.220.232.101:29629] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Feb 28 10:16:31.144080 2026] [:error] [pid 39292:tid 39309] [client 20.220.232.101:29629] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Sat Feb 28 10:16:31.375222 2026] [:error] [pid 39292:tid 39296] [client 20.220.232.101:29629] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaJP_6IAO5fN7BxyqcGRpAAAAMI"]
[Sat Feb 28 10:16:32.076556 2026] [:error] [pid 39185:tid 39261] [client 20.220.232.101:29561] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaJQABVE-FfM89u7BQYlmQAAAI8"]
[Sat Feb 28 10:16:32.529090 2026] [:error] [pid 11791:tid 11795] [client 20.220.232.101:29407] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sat Feb 28 10:16:32.738717 2026] [:error] [pid 11791:tid 11796] [client 20.220.232.101:29407] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sat Feb 28 10:16:32.949316 2026] [:error] [pid 11791:tid 11805] [client 20.220.232.101:29407] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o1.php
[Sat Feb 28 10:16:34.589275 2026] [:error] [pid 11791:tid 11805] [client 20.220.232.101:29407] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Sat Feb 28 10:16:34.799875 2026] [:error] [pid 11791:tid 11801] [client 20.220.232.101:29407] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sat Feb 28 10:16:35.009587 2026] [:error] [pid 11791:tid 11802] [client 20.220.232.101:29407] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sat Feb 28 10:16:35.216662 2026] [:error] [pid 11791:tid 11793] [client 20.220.232.101:29407] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aaJQA2uX5e1Q32gqxH26ogAAAQA"]
[Sat Feb 28 10:16:35.720329 2026] [:error] [pid 11791:tid 11817] [client 20.220.232.101:29378] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aaJQA2uX5e1Q32gqxH26pAAAARg"]
[Sat Feb 28 10:16:36.292505 2026] [:error] [pid 11791:tid 11794] [client 20.220.232.101:29337] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aaJQBGuX5e1Q32gqxH26qAAAAQE"]
[Sat Feb 28 10:16:36.926203 2026] [:error] [pid 11791:tid 11803] [client 20.220.232.101:29408] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we2.php"] [unique_id "aaJQBGuX5e1Q32gqxH26rQAAAQo"]
[Sat Feb 28 10:16:37.800321 2026] [:error] [pid 11791:tid 11795] [client 20.220.232.101:29488] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaJQBWuX5e1Q32gqxH26sgAAAQI"]
[Sat Feb 28 10:16:38.846525 2026] [:error] [pid 52460:tid 52472] [client 20.220.232.101:29331] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaJQBrLWOogAgHGh62SHHwAAAYk"]
[Sat Feb 28 10:16:39.940357 2026] [:error] [pid 11791:tid 11808] [client 20.220.232.101:29498] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaJQB2uX5e1Q32gqxH26vgAAAQ8"]
[Sat Feb 28 10:16:41.152340 2026] [:error] [pid 11791:tid 11815] [client 20.220.232.101:29397] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaJQCWuX5e1Q32gqxH26xAAAARY"]
[Sat Feb 28 10:16:41.949697 2026] [:error] [pid 22194:tid 22202] [client 20.220.232.101:29419] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/333.php"] [unique_id "aaJQCX6mbajs3bzQGysMKwAAAUY"]
[Sat Feb 28 10:16:43.320851 2026] [:error] [pid 11791:tid 11798] [client 20.220.232.101:29425] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/333.php"] [unique_id "aaJQC2uX5e1Q32gqxH26yQAAAQU"]
[Sat Feb 28 10:16:44.405492 2026] [:error] [pid 11791:tid 11815] [client 20.220.232.101:29553] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/333.php"] [unique_id "aaJQDGuX5e1Q32gqxH260AAAARY"]
[Sat Feb 28 10:16:45.386635 2026] [:error] [pid 22194:tid 22207] [client 20.220.232.101:29451] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/333.php"] [unique_id "aaJQDX6mbajs3bzQGysMQQAAAUs"]
[Sat Feb 28 10:16:46.518802 2026] [:error] [pid 22194:tid 22200] [client 20.220.232.101:29501] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaJQDn6mbajs3bzQGysMRAAAAUQ"]
[Sat Feb 28 10:16:47.550670 2026] [:error] [pid 39185:tid 39264] [client 20.220.232.101:29560] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaJQDxVE-FfM89u7BQYlsQAAAJI"]
[Sat Feb 28 10:16:48.628163 2026] [:error] [pid 39185:tid 39251] [client 20.220.232.101:29417] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaJQEBVE-FfM89u7BQYlvAAAAIU"]
[Sat Feb 28 10:16:49.520565 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29694] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaJQERVE-FfM89u7BQYlxQAAAIY"]
[Sat Feb 28 10:16:50.211101 2026] [:error] [pid 39185:tid 39251] [client 20.220.232.101:29606] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaJQEhVE-FfM89u7BQYlzAAAAIU"]
[Sat Feb 28 10:16:50.817886 2026] [:error] [pid 39185:tid 39265] [client 20.220.232.101:29411] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaJQEhVE-FfM89u7BQYl2gAAAJM"]
[Sat Feb 28 10:16:51.480989 2026] [:error] [pid 39184:tid 39229] [client 20.220.232.101:29456] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaJQE1tZF9Zd_U7easC0EwAAAEo"]
[Sat Feb 28 10:16:52.404578 2026] [:error] [pid 22194:tid 22212] [client 20.220.232.101:29431] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaJQFH6mbajs3bzQGysMSQAAAVA"]
[Sat Feb 28 10:16:53.472264 2026] [:error] [pid 52460:tid 52464] [client 20.220.232.101:29480] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaJQFbLWOogAgHGh62SHLQAAAYE"]
[Sat Feb 28 10:16:54.361878 2026] [:error] [pid 52460:tid 52469] [client 20.220.232.101:29401] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaJQFrLWOogAgHGh62SHMwAAAYY"]
[Sat Feb 28 10:16:55.381100 2026] [:error] [pid 52460:tid 52477] [client 20.220.232.101:29351] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaJQF7LWOogAgHGh62SHOAAAAY4"]
[Sat Feb 28 10:16:56.174193 2026] [:error] [pid 52460:tid 52483] [client 20.220.232.101:29316] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaJQGLLWOogAgHGh62SHOwAAAZQ"]
[Sat Feb 28 10:16:56.909159 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29617] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aaJQGBVE-FfM89u7BQYl8wAAAIY"]
[Sat Feb 28 10:16:57.734852 2026] [:error] [pid 39185:tid 39270] [client 20.220.232.101:29428] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aaJQGRVE-FfM89u7BQYl-wAAAJg"]
[Sat Feb 28 10:16:59.143044 2026] [:error] [pid 39185:tid 39261] [client 20.220.232.101:29332] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aaJQGxVE-FfM89u7BQYmBwAAAI8"]
[Sat Feb 28 10:17:00.309352 2026] [:error] [pid 52460:tid 52473] [client 20.220.232.101:29452] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xx.php"] [unique_id "aaJQHLLWOogAgHGh62SHQgAAAYo"]
[Sat Feb 28 10:17:01.056137 2026] [:error] [pid 39292:tid 39306] [client 20.220.232.101:29412] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aaJQHaIAO5fN7BxyqcGRzAAAAMw"]
[Sat Feb 28 10:17:02.194555 2026] [:error] [pid 39185:tid 39270] [client 20.220.232.101:29499] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aaJQHhVE-FfM89u7BQYmHAAAAJg"]
[Sat Feb 28 10:17:03.026982 2026] [:error] [pid 52460:tid 52478] [client 20.220.232.101:29349] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aaJQH7LWOogAgHGh62SHUAAAAY8"]
[Sat Feb 28 10:17:04.438706 2026] [:error] [pid 39292:tid 39303] [client 20.220.232.101:29495] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass4.php"] [unique_id "aaJQIKIAO5fN7BxyqcGRzgAAAMk"]
[Sat Feb 28 10:17:06.062619 2026] [:error] [pid 22194:tid 22217] [client 20.220.232.101:29383] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaJQIn6mbajs3bzQGysMUgAAAVU"]
[Sat Feb 28 10:17:06.792158 2026] [:error] [pid 11791:tid 11814] [client 20.220.232.101:29387] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaJQImuX5e1Q32gqxH267AAAARU"]
[Sat Feb 28 10:17:07.204797 2026] [:error] [pid 11791:tid 11816] [client 20.220.232.101:29389] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaJQI2uX5e1Q32gqxH267QAAARc"]
[Sat Feb 28 10:17:07.787602 2026] [:error] [pid 39185:tid 39267] [client 20.220.232.101:29471] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaJQIxVE-FfM89u7BQYmJwAAAJU"]
[Sat Feb 28 10:17:08.679523 2026] [:error] [pid 39185:tid 39256] [client 20.220.232.101:29446] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaJQJBVE-FfM89u7BQYmLAAAAIo"]
[Sat Feb 28 10:17:09.743357 2026] [:error] [pid 52460:tid 52472] [client 20.220.232.101:29465] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaJQJbLWOogAgHGh62SHZQAAAYk"]
[Sat Feb 28 10:17:10.442426 2026] [:error] [pid 11791:tid 11811] [client 20.220.232.101:29432] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaJQJmuX5e1Q32gqxH27EQAAARI"]
[Sat Feb 28 10:17:11.320964 2026] [:error] [pid 39185:tid 39258] [client 20.220.232.101:29343] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaJQJxVE-FfM89u7BQYmOAAAAIw"]
[Sat Feb 28 10:17:11.915019 2026] [:error] [pid 39185:tid 39257] [client 20.220.232.101:29544] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaJQJxVE-FfM89u7BQYmPAAAAIs"]
[Sat Feb 28 10:17:12.733468 2026] [:error] [pid 39185:tid 39268] [client 20.220.232.101:29453] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaJQKBVE-FfM89u7BQYmQQAAAJY"]
[Sat Feb 28 10:17:13.417680 2026] [:error] [pid 52460:tid 52480] [client 20.220.232.101:29410] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaJQKbLWOogAgHGh62SHbwAAAZE"]
[Sat Feb 28 10:17:14.199965 2026] [:error] [pid 39292:tid 39305] [client 20.220.232.101:29334] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaJQKqIAO5fN7BxyqcGR1gAAAMs"]
[Sat Feb 28 10:17:14.908640 2026] [:error] [pid 39185:tid 39260] [client 20.220.232.101:29473] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaJQKhVE-FfM89u7BQYmTQAAAI4"]
[Sat Feb 28 10:17:15.973313 2026] [:error] [pid 11791:tid 11798] [client 20.220.232.101:29487] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaJQK2uX5e1Q32gqxH27HwAAAQU"]
[Sat Feb 28 10:17:16.565266 2026] [:error] [pid 39185:tid 39256] [client 20.220.232.101:29514] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaJQLBVE-FfM89u7BQYmUwAAAIo"]
[Sat Feb 28 10:17:18.107146 2026] [:error] [pid 39292:tid 39311] [client 20.220.232.101:29297] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaJQLqIAO5fN7BxyqcGR2gAAANE"]
[Sat Feb 28 10:17:19.022636 2026] [:error] [pid 39184:tid 39230] [client 20.220.232.101:29609] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaJQL1tZF9Zd_U7easC0JAAAAEs"]
[Sat Feb 28 10:17:19.831498 2026] [:error] [pid 39183:tid 39195] [client 20.220.232.101:29402] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaJQLxCf4HvhVePw3LbKXAAAAAM"]
[Sat Feb 28 10:17:20.586463 2026] [:error] [pid 39185:tid 39253] [client 20.220.232.101:29409] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaJQMBVE-FfM89u7BQYmbgAAAIc"]
[Sat Feb 28 10:17:22.188177 2026] [:error] [pid 39185:tid 39259] [client 20.220.232.101:29421] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaJQMhVE-FfM89u7BQYmdQAAAI0"]
[Sat Feb 28 10:17:23.204889 2026] [:error] [pid 11791:tid 11795] [client 20.220.232.101:29345] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaJQM2uX5e1Q32gqxH27JQAAAQI"]
[Sat Feb 28 10:17:24.202575 2026] [:error] [pid 39185:tid 39256] [client 20.220.232.101:29372] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaJQNBVE-FfM89u7BQYmegAAAIo"]
[Sat Feb 28 10:17:24.816740 2026] [:error] [pid 39184:tid 39235] [client 20.220.232.101:29460] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaJQNFtZF9Zd_U7easC0JwAAAFA"]
[Sat Feb 28 10:17:25.472349 2026] [:error] [pid 39185:tid 39260] [client 20.220.232.101:29493] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaJQNRVE-FfM89u7BQYmfgAAAI4"]
[Sat Feb 28 10:17:26.193523 2026] [:error] [pid 52460:tid 52468] [client 20.220.232.101:29381] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaJQNrLWOogAgHGh62SHhAAAAYU"]
[Sat Feb 28 10:17:27.081415 2026] [:error] [pid 39185:tid 39267] [client 20.220.232.101:29416] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaJQNxVE-FfM89u7BQYmiAAAAJU"]
[Sat Feb 28 10:17:28.652720 2026] [:error] [pid 39185:tid 39246] [client 20.220.232.101:29336] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaJQOBVE-FfM89u7BQYmiwAAAIA"]
[Sat Feb 28 10:17:29.429310 2026] [:error] [pid 39185:tid 39251] [client 20.220.232.101:29420] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaJQORVE-FfM89u7BQYmjgAAAIU"]
[Sat Feb 28 10:17:29.969039 2026] [:error] [pid 22194:tid 22200] [client 20.220.232.101:29361] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaJQOX6mbajs3bzQGysMXwAAAUQ"]
[Sat Feb 28 10:17:30.561936 2026] [:error] [pid 39185:tid 39250] [client 20.220.232.101:29384] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaJQOhVE-FfM89u7BQYmlgAAAIQ"]
[Sat Feb 28 10:17:31.234517 2026] [:error] [pid 52460:tid 52472] [client 20.220.232.101:29356] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaJQO7LWOogAgHGh62SHlgAAAYk"]
[Sat Feb 28 10:17:32.393115 2026] [:error] [pid 52460:tid 52465] [client 20.220.232.101:29486] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaJQPLLWOogAgHGh62SHmQAAAYI"]
[Sat Feb 28 10:17:34.557561 2026] [:error] [pid 39183:tid 39213] [client 20.220.232.101:29342] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaJQPhCf4HvhVePw3LbKZQAAABU"]
[Sat Feb 28 10:17:36.218586 2026] [:error] [pid 11791:tid 11817] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Sat Feb 28 10:17:36.730503 2026] [:error] [pid 11791:tid 11802] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Sat Feb 28 10:17:37.411196 2026] [:error] [pid 11791:tid 11814] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat Feb 28 10:17:37.619843 2026] [:error] [pid 11791:tid 11793] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Sat Feb 28 10:17:37.898829 2026] [:error] [pid 11791:tid 11798] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Sat Feb 28 10:17:38.178376 2026] [:error] [pid 11791:tid 11810] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Sat Feb 28 10:17:38.401505 2026] [:error] [pid 11791:tid 11799] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Sat Feb 28 10:17:38.617687 2026] [:error] [pid 11791:tid 11809] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Sat Feb 28 10:17:38.826750 2026] [:error] [pid 11791:tid 11800] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Sat Feb 28 10:17:39.034737 2026] [:error] [pid 11791:tid 11806] [client 20.220.232.101:29330] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Sat Feb 28 10:17:39.239464 2026] [:error] [pid 11791:tid 11805] [client 20.220.232.101:29330] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaJQQ2uX5e1Q32gqxH27SgAAAQw"]
[Sat Feb 28 10:17:39.843024 2026] [:error] [pid 52460:tid 52485] [client 20.220.232.101:29571] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaJQQ7LWOogAgHGh62SHoQAAAZY"]
[Sat Feb 28 10:17:40.398522 2026] [:error] [pid 52460:tid 52464] [client 20.220.232.101:29438] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaJQRLLWOogAgHGh62SHowAAAYE"]
[Sat Feb 28 10:17:41.663362 2026] [:error] [pid 39185:tid 39263] [client 20.220.232.101:29403] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaJQRRVE-FfM89u7BQYmywAAAJE"]
[Sat Feb 28 10:17:42.883800 2026] [:error] [pid 39292:tid 39298] [client 20.220.232.101:29322] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaJQRqIAO5fN7BxyqcGR-gAAAMQ"]
[Sat Feb 28 10:17:43.637937 2026] [:error] [pid 39185:tid 39265] [client 20.220.232.101:29422] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaJQRxVE-FfM89u7BQYm5QAAAJM"]
[Sat Feb 28 10:17:44.622077 2026] [:error] [pid 39185:tid 39267] [client 20.220.232.101:29339] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaJQSBVE-FfM89u7BQYm-wAAAJU"]
[Sat Feb 28 10:17:45.547871 2026] [:error] [pid 39185:tid 39252] [client 20.220.232.101:29312] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaJQSRVE-FfM89u7BQYnDwAAAIY"]
[Sat Feb 28 10:17:46.394914 2026] [:error] [pid 39185:tid 39259] [client 20.220.232.101:29690] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaJQShVE-FfM89u7BQYnHwAAAI0"]
[Sat Feb 28 10:17:46.996677 2026] [:error] [pid 39185:tid 39263] [client 20.220.232.101:29320] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaJQShVE-FfM89u7BQYnKwAAAJE"]
[Sat Feb 28 10:17:47.566438 2026] [:error] [pid 39185:tid 39270] [client 20.220.232.101:29329] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaJQSxVE-FfM89u7BQYnNgAAAJg"]
[Sat Feb 28 10:17:48.219298 2026] [:error] [pid 11791:tid 11793] [client 20.220.232.101:29353] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaJQTGuX5e1Q32gqxH27YwAAAQA"]
[Sat Feb 28 10:17:49.285907 2026] [:error] [pid 11791:tid 11803] [client 20.220.232.101:29393] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaJQTWuX5e1Q32gqxH27ZQAAAQo"]
[Sat Feb 28 10:17:50.264929 2026] [:error] [pid 11791:tid 11794] [client 20.220.232.101:29433] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaJQTmuX5e1Q32gqxH27aQAAAQE"]
[Sat Feb 28 10:17:51.321138 2026] [:error] [pid 39184:tid 39231] [client 20.220.232.101:29418] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaJQT1tZF9Zd_U7easC0OAAAAEw"]
[Sat Feb 28 10:17:52.129345 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29325] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaJQULLWOogAgHGh62SHsAAAAYM"]
[Sat Feb 28 10:17:53.151480 2026] [:error] [pid 39184:tid 39220] [client 20.220.232.101:29683] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaJQUVtZF9Zd_U7easC0OgAAAEE"]
[Sat Feb 28 10:17:54.072729 2026] [:error] [pid 52460:tid 52486] [client 20.220.232.101:29455] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaJQUrLWOogAgHGh62SHtgAAAZc"]
[Sat Feb 28 10:17:55.087986 2026] [:error] [pid 22194:tid 22215] [client 20.220.232.101:29653] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaJQU36mbajs3bzQGysMjgAAAVM"]
[Sat Feb 28 10:17:56.304519 2026] [:error] [pid 52460:tid 52468] [client 20.220.232.101:29430] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaJQVLLWOogAgHGh62SHwAAAAYU"]
[Sat Feb 28 10:17:56.853971 2026] [:error] [pid 39292:tid 39300] [client 20.220.232.101:29347] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaJQVKIAO5fN7BxyqcGSBgAAAMY"]
[Sat Feb 28 10:17:57.529682 2026] [:error] [pid 39185:tid 39264] [client 20.220.232.101:29648] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaJQVRVE-FfM89u7BQYn8QAAAJI"]
[Sat Feb 28 10:17:58.343615 2026] [:error] [pid 52460:tid 52470] [client 20.220.232.101:29434] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaJQVrLWOogAgHGh62SHxgAAAYc"]
[Sat Feb 28 10:17:58.970322 2026] [:error] [pid 39185:tid 39261] [client 20.220.232.101:29569] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaJQVhVE-FfM89u7BQYoDgAAAI8"]
[Sat Feb 28 10:17:59.693569 2026] [:error] [pid 52460:tid 52487] [client 20.220.232.101:29271] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaJQV7LWOogAgHGh62SHzgAAAZg"]
[Sat Feb 28 10:18:00.782455 2026] [:error] [pid 52460:tid 52470] [client 20.220.232.101:29324] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaJQWLLWOogAgHGh62SH2QAAAYc"]
[Sat Feb 28 10:18:01.471220 2026] [:error] [pid 39183:tid 39209] [client 20.220.232.101:29367] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaJQWRCf4HvhVePw3LbKaAAAABE"]
[Sat Feb 28 10:18:01.979648 2026] [:error] [pid 39183:tid 39195] [client 20.220.232.101:29470] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaJQWRCf4HvhVePw3LbKaQAAAAM"]
[Sat Feb 28 10:18:02.875733 2026] [:error] [pid 39184:tid 39223] [client 20.220.232.101:29580] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaJQWltZF9Zd_U7easC0PgAAAEQ"]
[Sat Feb 28 10:18:03.507734 2026] [:error] [pid 52460:tid 52482] [client 20.220.232.101:29575] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaJQW7LWOogAgHGh62SH7gAAAZM"]
[Sat Feb 28 10:18:04.200379 2026] [:error] [pid 39185:tid 39249] [client 20.220.232.101:29675] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaJQXBVE-FfM89u7BQYoTQAAAIM"]
[Sat Feb 28 10:18:05.671331 2026] [:error] [pid 39184:tid 39224] [client 20.220.232.101:29314] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaJQXVtZF9Zd_U7easC0RQAAAEU"]
[Sat Feb 28 10:18:06.645923 2026] [:error] [pid 39292:tid 39300] [client 20.220.232.101:29429] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wtz.php"] [unique_id "aaJQXqIAO5fN7BxyqcGSNAAAAMY"]
[Sat Feb 28 10:18:07.400002 2026] [:error] [pid 52460:tid 52478] [client 20.220.232.101:29404] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wtz.php"] [unique_id "aaJQX7LWOogAgHGh62SH9wAAAY8"]
[Sat Feb 28 10:18:07.952159 2026] [:error] [pid 39185:tid 39259] [client 20.220.232.101:29286] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wtz.php"] [unique_id "aaJQXxVE-FfM89u7BQYogwAAAI0"]
[Sat Feb 28 10:18:08.452928 2026] [:error] [pid 11791:tid 11817] [client 20.220.232.101:29414] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wtz.php"] [unique_id "aaJQYGuX5e1Q32gqxH27lQAAARg"]
[Sat Feb 28 10:18:09.222151 2026] [:error] [pid 39184:tid 39220] [client 20.220.232.101:29477] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aaJQYVtZF9Zd_U7easC0TQAAAEE"]
[Sat Feb 28 10:18:10.266190 2026] [:error] [pid 52460:tid 52466] [client 20.220.232.101:29588] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aaJQYrLWOogAgHGh62SIBQAAAYM"]
[Sat Feb 28 10:18:11.505256 2026] [:error] [pid 52460:tid 52484] [client 20.220.232.101:29313] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aaJQY7LWOogAgHGh62SIDwAAAZU"]
[Sat Feb 28 10:18:12.681579 2026] [:error] [pid 39183:tid 39207] [client 20.220.232.101:29278] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/galex.php"] [unique_id "aaJQZBCf4HvhVePw3LbKcQAAAA8"]
[Sat Feb 28 10:18:13.520022 2026] [:error] [pid 52460:tid 52471] [client 20.220.232.101:29354] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aaJQZbLWOogAgHGh62SIHAAAAYg"]
[Sat Feb 28 10:18:14.259618 2026] [:error] [pid 39184:tid 39230] [client 20.220.232.101:29292] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aaJQZltZF9Zd_U7easC0VAAAAEs"]
[Sat Feb 28 10:18:15.785479 2026] [:error] [pid 52460:tid 52475] [client 20.220.232.101:29394] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aaJQZ7LWOogAgHGh62SILAAAAYw"]
[Sat Feb 28 10:18:16.389008 2026] [:error] [pid 39185:tid 39264] [client 20.220.232.101:29600] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xb.php"] [unique_id "aaJQaBVE-FfM89u7BQYoywAAAJI"]
[Sat Feb 28 10:18:17.092428 2026] [:error] [pid 39185:tid 39246] [client 20.220.232.101:29479] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aaJQaRVE-FfM89u7BQYozwAAAIA"]
[Sat Feb 28 10:18:17.786806 2026] [:error] [pid 52460:tid 52477] [client 20.220.232.101:29573] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aaJQabLWOogAgHGh62SIOQAAAY4"]
[Sat Feb 28 10:18:18.230781 2026] [:error] [pid 39185:tid 39266] [client 20.220.232.101:29540] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aaJQahVE-FfM89u7BQYo0wAAAJQ"]
[Sat Feb 28 10:18:18.763840 2026] [:error] [pid 39184:tid 39219] [client 20.220.232.101:29692] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ova.php"] [unique_id "aaJQaltZF9Zd_U7easC0XAAAAEA"]
[Sat Feb 28 10:18:19.405735 2026] [:error] [pid 39185:tid 39267] [client 20.220.232.101:29661] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaJQaxVE-FfM89u7BQYo3wAAAJU"]
[Sat Feb 28 10:18:20.153401 2026] [:error] [pid 11791:tid 11809] [client 20.220.232.101:29655] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaJQbGuX5e1Q32gqxH27rgAAARA"]
[Sat Feb 28 10:18:20.908577 2026] [:error] [pid 39185:tid 39263] [client 20.220.232.101:29664] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaJQbBVE-FfM89u7BQYo7QAAAJE"]
[Sat Feb 28 10:18:21.643875 2026] [:error] [pid 11791:tid 11796] [client 20.220.232.101:29693] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaJQbWuX5e1Q32gqxH27swAAAQM"]
[Sat Feb 28 10:18:22.419577 2026] [:error] [pid 39185:tid 39263] [client 20.220.232.101:29689] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aaJQbhVE-FfM89u7BQYo-wAAAJE"]
[Sat Feb 28 10:18:23.010719 2026] [:error] [pid 39185:tid 39249] [client 20.220.232.101:29281] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aaJQbxVE-FfM89u7BQYo_QAAAIM"]
[Sat Feb 28 10:18:23.835016 2026] [:error] [pid 52460:tid 52464] [client 20.220.232.101:29649] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aaJQb7LWOogAgHGh62SIXQAAAYE"]
[Sat Feb 28 10:18:24.271279 2026] [:error] [pid 39185:tid 39251] [client 20.220.232.101:29375] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aaJQcBVE-FfM89u7BQYpAgAAAIU"]
[Sat Feb 28 10:31:59.738160 2026] [:error] [pid 52460:tid 52483] [client 43.165.65.75:51516] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaJTn7LWOogAgHGh62SUggAAAZQ"]
[Sat Feb 28 11:02:32.215430 2026] [:error] [pid 39185:tid 39263] [client 45.153.34.31:39256] [client 45.153.34.31] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aaJayBVE-FfM89u7BQZdPwAAAJE"]
[Sat Feb 28 11:30:19.478893 2026] [:error] [pid 39185:tid 39262] [client 52.169.119.118:13059] [client 52.169.119.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaJhSxVE-FfM89u7BQZ1lAAAAJA"]
[Sat Feb 28 11:30:19.979880 2026] [:error] [pid 52460:tid 52470] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Sat Feb 28 11:30:20.485563 2026] [:error] [pid 52460:tid 52463] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sat Feb 28 11:30:20.739002 2026] [:error] [pid 52460:tid 52471] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Sat Feb 28 11:30:20.991308 2026] [:error] [pid 52460:tid 52465] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Sat Feb 28 11:30:21.245301 2026] [:error] [pid 52460:tid 52469] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Sat Feb 28 11:30:21.497962 2026] [:error] [pid 52460:tid 52472] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Sat Feb 28 11:30:21.750951 2026] [:error] [pid 52460:tid 52474] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Sat Feb 28 11:30:23.349805 2026] [:error] [pid 52460:tid 52474] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Sat Feb 28 11:30:23.604016 2026] [:error] [pid 52460:tid 52483] [client 52.169.119.118:11330] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Sat Feb 28 11:30:23.853030 2026] [:error] [pid 52460:tid 52480] [client 52.169.119.118:11330] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as1337.php"] [unique_id "aaJhT7LWOogAgHGh62TU5wAAAZE"]
[Sat Feb 28 11:30:24.350625 2026] [:error] [pid 39292:tid 39317] [client 52.169.119.118:14826] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as1337.php"] [unique_id "aaJhUKIAO5fN7BxyqcGwNQAAANc"]
[Sat Feb 28 11:30:24.860897 2026] [:error] [pid 39185:tid 39254] [client 52.169.119.118:13098] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as1337.php"] [unique_id "aaJhUBVE-FfM89u7BQZ1pgAAAIg"]
[Sat Feb 28 11:30:25.398308 2026] [:error] [pid 52460:tid 52479] [client 52.169.119.118:15941] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as1337.php"] [unique_id "aaJhUbLWOogAgHGh62TU7AAAAZA"]
[Sat Feb 28 11:30:25.920175 2026] [:error] [pid 39185:tid 39261] [client 52.169.119.118:13107] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaJhURVE-FfM89u7BQZ1qgAAAI8"]
[Sat Feb 28 11:30:26.415831 2026] [:error] [pid 39292:tid 39294] [client 52.169.119.118:10687] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaJhUqIAO5fN7BxyqcGwNgAAAMA"]
[Sat Feb 28 11:30:26.930556 2026] [:error] [pid 39292:tid 39298] [client 52.169.119.118:6584] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaJhUqIAO5fN7BxyqcGwOAAAAMQ"]
[Sat Feb 28 11:30:27.481072 2026] [:error] [pid 39185:tid 39248] [client 52.169.119.118:12232] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaJhUxVE-FfM89u7BQZ1sgAAAII"]
[Sat Feb 28 11:30:28.019169 2026] [:error] [pid 39185:tid 39261] [client 52.169.119.118:13086] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaJhVBVE-FfM89u7BQZ1tgAAAI8"]
[Sat Feb 28 11:30:28.521456 2026] [:error] [pid 39185:tid 39262] [client 52.169.119.118:15758] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaJhVBVE-FfM89u7BQZ1uQAAAJA"]
[Sat Feb 28 11:30:29.022714 2026] [:error] [pid 39292:tid 39312] [client 52.169.119.118:10672] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaJhVaIAO5fN7BxyqcGwOgAAANI"]
[Sat Feb 28 11:30:29.530249 2026] [:error] [pid 39184:tid 39238] [client 52.169.119.118:6567] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaJhVVtZF9Zd_U7easDFzgAAAFM"]
[Sat Feb 28 11:30:30.037230 2026] [:error] [pid 11791:tid 11815] [client 52.169.119.118:8671] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaJhVmuX5e1Q32gqxH3qJwAAARY"]
[Sat Feb 28 11:30:30.539249 2026] [:error] [pid 11791:tid 11813] [client 52.169.119.118:10631] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaJhVmuX5e1Q32gqxH3qKgAAARQ"]
[Sat Feb 28 11:30:31.038271 2026] [:error] [pid 39292:tid 39295] [client 52.169.119.118:10673] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaJhV6IAO5fN7BxyqcGwPgAAAME"]
[Sat Feb 28 11:30:31.543624 2026] [:error] [pid 52460:tid 52472] [client 52.169.119.118:6566] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaJhV7LWOogAgHGh62TU7wAAAYk"]
[Sat Feb 28 11:30:32.042237 2026] [:error] [pid 52460:tid 52468] [client 52.169.119.118:14372] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaJhWLLWOogAgHGh62TU8QAAAYU"]
[Sat Feb 28 11:30:32.550468 2026] [:error] [pid 52460:tid 52481] [client 52.169.119.118:4842] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaJhWLLWOogAgHGh62TU8wAAAZI"]
[Sat Feb 28 11:30:33.061683 2026] [:error] [pid 39185:tid 39267] [client 52.169.119.118:15759] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaJhWRVE-FfM89u7BQZ1zQAAAJU"]
[Sat Feb 28 11:30:33.570537 2026] [:error] [pid 52460:tid 52480] [client 52.169.119.118:14844] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zeal.php"] [unique_id "aaJhWbLWOogAgHGh62TU9gAAAZE"]
[Sat Feb 28 11:30:34.068228 2026] [:error] [pid 39183:tid 39195] [client 52.169.119.118:15763] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aaJhWhCf4HvhVePw3LbYjgAAAAM"]
[Sat Feb 28 11:30:34.565381 2026] [:error] [pid 52460:tid 52479] [client 52.169.119.118:6572] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aaJhWrLWOogAgHGh62TU-QAAAZA"]
[Sat Feb 28 11:30:35.081039 2026] [:error] [pid 52460:tid 52472] [client 52.169.119.118:11379] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aaJhW7LWOogAgHGh62TU_wAAAYk"]
[Sat Feb 28 11:30:35.604511 2026] [:error] [pid 52460:tid 52473] [client 52.169.119.118:4863] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asf.php"] [unique_id "aaJhW7LWOogAgHGh62TVAwAAAYo"]
[Sat Feb 28 11:30:36.119963 2026] [:error] [pid 52460:tid 52483] [client 52.169.119.118:15641] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php"] [unique_id "aaJhXLLWOogAgHGh62TVBgAAAZQ"]
[Sat Feb 28 11:30:36.651578 2026] [:error] [pid 39292:tid 39310] [client 52.169.119.118:14797] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php"] [unique_id "aaJhXKIAO5fN7BxyqcGwQAAAANA"]
[Sat Feb 28 11:30:37.175601 2026] [:error] [pid 39292:tid 39317] [client 52.169.119.118:12233] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php"] [unique_id "aaJhXaIAO5fN7BxyqcGwRAAAANc"]
[Sat Feb 28 11:30:37.675890 2026] [:error] [pid 22194:tid 22199] [client 52.169.119.118:4848] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php"] [unique_id "aaJhXX6mbajs3bzQGyskzwAAAUM"]
[Sat Feb 28 12:03:45.685150 2026] [:error] [pid 22194:tid 22198] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/yo.php
[Sat Feb 28 12:03:45.893295 2026] [:error] [pid 22194:tid 22217] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sat Feb 28 12:03:46.101321 2026] [:error] [pid 22194:tid 22214] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Sat Feb 28 12:03:46.310095 2026] [:error] [pid 22194:tid 22199] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/ba.php
[Sat Feb 28 12:03:46.519490 2026] [:error] [pid 22194:tid 22196] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/ym.php
[Sat Feb 28 12:03:46.727564 2026] [:error] [pid 22194:tid 22203] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Sat Feb 28 12:03:46.935010 2026] [:error] [pid 22194:tid 22208] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/e.php
[Sat Feb 28 12:03:47.143062 2026] [:error] [pid 22194:tid 22209] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Feb 28 12:03:47.351470 2026] [:error] [pid 22194:tid 22207] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Sat Feb 28 12:03:47.559335 2026] [:error] [pid 22194:tid 22206] [client 20.151.113.230:20420] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Sat Feb 28 12:03:47.765132 2026] [:error] [pid 22194:tid 22204] [client 20.151.113.230:20420] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaJpI36mbajs3bzQGysvFAAAAUg"]
[Sat Feb 28 12:03:48.176608 2026] [:error] [pid 52460:tid 52464] [client 20.151.113.230:20360] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaJpJLLWOogAgHGh62T5AgAAAYE"]
[Sat Feb 28 12:03:48.586802 2026] [:error] [pid 52460:tid 52463] [client 20.151.113.230:20435] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaJpJLLWOogAgHGh62T5AwAAAYA"]
[Sat Feb 28 12:03:49.001954 2026] [:error] [pid 39292:tid 39301] [client 20.151.113.230:20455] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd67.php"] [unique_id "aaJpJaIAO5fN7BxyqcG84AAAAMc"]
[Sat Feb 28 12:03:49.412519 2026] [:error] [pid 39292:tid 39295] [client 20.151.113.230:20356] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaJpJaIAO5fN7BxyqcG84QAAAME"]
[Sat Feb 28 12:03:49.825350 2026] [:error] [pid 11791:tid 11813] [client 20.151.113.230:20436] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaJpJWuX5e1Q32gqxH35tgAAARQ"]
[Sat Feb 28 12:03:50.239212 2026] [:error] [pid 11791:tid 11802] [client 20.151.113.230:20463] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaJpJmuX5e1Q32gqxH35uAAAAQk"]
[Sat Feb 28 12:03:50.649574 2026] [:error] [pid 39185:tid 39266] [client 20.151.113.230:20366] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aaJpJhVE-FfM89u7BQaOogAAAJQ"]
[Sat Feb 28 12:03:51.058686 2026] [:error] [pid 52460:tid 52468] [client 20.151.113.230:20418] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aaJpJ7LWOogAgHGh62T5DwAAAYU"]
[Sat Feb 28 12:03:51.471815 2026] [:error] [pid 52460:tid 52464] [client 20.151.113.230:20468] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aaJpJ7LWOogAgHGh62T5EQAAAYE"]
[Sat Feb 28 12:03:51.881594 2026] [:error] [pid 52460:tid 52471] [client 20.151.113.230:20372] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aaJpJ7LWOogAgHGh62T5FQAAAYg"]
[Sat Feb 28 12:03:52.298099 2026] [:error] [pid 52460:tid 52479] [client 20.151.113.230:20368] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aaJpKLLWOogAgHGh62T5GAAAAZA"]
[Sat Feb 28 12:03:52.708859 2026] [:error] [pid 52460:tid 52475] [client 20.151.113.230:20369] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaJpKLLWOogAgHGh62T5GQAAAYw"]
[Sat Feb 28 12:03:53.120491 2026] [:error] [pid 39185:tid 39259] [client 20.151.113.230:20460] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaJpKRVE-FfM89u7BQaOqgAAAI0"]
[Sat Feb 28 12:03:53.530615 2026] [:error] [pid 39185:tid 39270] [client 20.151.113.230:20430] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaJpKRVE-FfM89u7BQaOrAAAAJg"]
[Sat Feb 28 12:03:53.947516 2026] [:error] [pid 39185:tid 39246] [client 20.151.113.230:20437] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "aaJpKRVE-FfM89u7BQaOsAAAAIA"]
[Sat Feb 28 12:03:54.360015 2026] [:error] [pid 52460:tid 52466] [client 20.151.113.230:20421] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mails.php"] [unique_id "aaJpKrLWOogAgHGh62T5IQAAAYM"]
[Sat Feb 28 12:03:54.772171 2026] [:error] [pid 39185:tid 39265] [client 20.151.113.230:20370] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mails.php"] [unique_id "aaJpKhVE-FfM89u7BQaOsgAAAJM"]
[Sat Feb 28 12:03:55.183985 2026] [:error] [pid 11791:tid 11804] [client 20.151.113.230:20461] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mails.php"] [unique_id "aaJpK2uX5e1Q32gqxH35vAAAAQs"]
[Sat Feb 28 12:03:55.597190 2026] [:error] [pid 52460:tid 52467] [client 20.151.113.230:20473] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mails.php"] [unique_id "aaJpK7LWOogAgHGh62T5JQAAAYQ"]
[Sat Feb 28 12:03:56.009649 2026] [:error] [pid 52460:tid 52479] [client 20.151.113.230:20464] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aaJpLLLWOogAgHGh62T5KAAAAZA"]
[Sat Feb 28 12:03:56.419188 2026] [:error] [pid 39185:tid 39262] [client 20.151.113.230:20472] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aaJpLBVE-FfM89u7BQaOtwAAAJA"]
[Sat Feb 28 12:03:56.830492 2026] [:error] [pid 52460:tid 52474] [client 20.151.113.230:20456] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aaJpLLLWOogAgHGh62T5LAAAAYs"]
[Sat Feb 28 12:03:57.241544 2026] [:error] [pid 39292:tid 39296] [client 20.151.113.230:20450] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "aaJpLaIAO5fN7BxyqcG84wAAAMI"]
[Sat Feb 28 12:03:57.651998 2026] [:error] [pid 52460:tid 52484] [client 20.151.113.230:20303] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aaJpLbLWOogAgHGh62T5MgAAAZU"]
[Sat Feb 28 12:03:58.063469 2026] [:error] [pid 52460:tid 52467] [client 20.151.113.230:20475] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aaJpLrLWOogAgHGh62T5MwAAAYQ"]
[Sat Feb 28 12:03:58.478951 2026] [:error] [pid 52460:tid 52486] [client 20.151.113.230:20359] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aaJpLrLWOogAgHGh62T5NAAAAZc"]
[Sat Feb 28 12:03:58.889285 2026] [:error] [pid 39185:tid 39246] [client 20.151.113.230:20474] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3.php"] [unique_id "aaJpLhVE-FfM89u7BQaOvAAAAIA"]
[Sat Feb 28 12:03:59.301801 2026] [:error] [pid 11791:tid 11817] [client 20.151.113.230:20405] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/key.php"] [unique_id "aaJpL2uX5e1Q32gqxH35vgAAARg"]
[Sat Feb 28 12:03:59.713555 2026] [:error] [pid 52460:tid 52471] [client 20.151.113.230:20377] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/key.php"] [unique_id "aaJpL7LWOogAgHGh62T5NwAAAYg"]
[Sat Feb 28 12:04:00.134088 2026] [:error] [pid 39185:tid 39251] [client 20.151.113.230:20477] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/key.php"] [unique_id "aaJpMBVE-FfM89u7BQaOwQAAAIU"]
[Sat Feb 28 12:04:00.546349 2026] [:error] [pid 52460:tid 52473] [client 20.151.113.230:20441] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/key.php"] [unique_id "aaJpMLLWOogAgHGh62T5OQAAAYo"]
[Sat Feb 28 12:04:00.963642 2026] [:error] [pid 52460:tid 52475] [client 20.151.113.230:20453] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/667.php"] [unique_id "aaJpMLLWOogAgHGh62T5OwAAAYw"]
[Sat Feb 28 12:04:01.382426 2026] [:error] [pid 52460:tid 52484] [client 20.151.113.230:20365] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/667.php"] [unique_id "aaJpMbLWOogAgHGh62T5PQAAAZU"]
[Sat Feb 28 12:04:01.792866 2026] [:error] [pid 52460:tid 52486] [client 20.151.113.230:20427] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/667.php"] [unique_id "aaJpMbLWOogAgHGh62T5QQAAAZc"]
[Sat Feb 28 12:04:02.201724 2026] [:error] [pid 52460:tid 52464] [client 20.151.113.230:20424] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/667.php"] [unique_id "aaJpMrLWOogAgHGh62T5QgAAAYE"]
[Sat Feb 28 12:04:02.612670 2026] [:error] [pid 39184:tid 39222] [client 20.151.113.230:20382] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctfbe.php"] [unique_id "aaJpMltZF9Zd_U7easDM6AAAAEM"]
[Sat Feb 28 12:04:03.024436 2026] [:error] [pid 39184:tid 39243] [client 20.151.113.230:20354] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctfbe.php"] [unique_id "aaJpM1tZF9Zd_U7easDM6QAAAFg"]
[Sat Feb 28 12:04:03.436471 2026] [:error] [pid 11791:tid 11815] [client 20.151.113.230:20471] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctfbe.php"] [unique_id "aaJpM2uX5e1Q32gqxH35wQAAARY"]
[Sat Feb 28 12:04:03.847543 2026] [:error] [pid 52460:tid 52476] [client 20.151.113.230:20363] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctfbe.php"] [unique_id "aaJpM7LWOogAgHGh62T5RgAAAY0"]
[Sat Feb 28 12:04:04.260484 2026] [:error] [pid 39185:tid 39268] [client 20.151.113.230:20470] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hkweu.php"] [unique_id "aaJpNBVE-FfM89u7BQaOywAAAJY"]
[Sat Feb 28 12:04:04.673328 2026] [:error] [pid 52460:tid 52470] [client 20.151.113.230:20465] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hkweu.php"] [unique_id "aaJpNLLWOogAgHGh62T5SAAAAYc"]
[Sat Feb 28 12:04:05.086211 2026] [:error] [pid 52460:tid 52477] [client 20.151.113.230:20445] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hkweu.php"] [unique_id "aaJpNbLWOogAgHGh62T5SQAAAY4"]
[Sat Feb 28 12:04:05.506781 2026] [:error] [pid 52460:tid 52482] [client 20.151.113.230:20362] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hkweu.php"] [unique_id "aaJpNbLWOogAgHGh62T5TQAAAZM"]
[Sat Feb 28 12:04:05.915843 2026] [:error] [pid 52460:tid 52467] [client 20.151.113.230:20389] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qdlte.php"] [unique_id "aaJpNbLWOogAgHGh62T5TgAAAYQ"]
[Sat Feb 28 12:04:06.327186 2026] [:error] [pid 39185:tid 39264] [client 20.151.113.230:20478] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qdlte.php"] [unique_id "aaJpNhVE-FfM89u7BQaOzwAAAJI"]
[Sat Feb 28 12:04:06.761264 2026] [:error] [pid 11791:tid 11808] [client 20.151.113.230:20353] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qdlte.php"] [unique_id "aaJpNmuX5e1Q32gqxH35xQAAAQ8"]
[Sat Feb 28 12:04:07.172438 2026] [:error] [pid 39184:tid 39225] [client 20.151.113.230:20466] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qdlte.php"] [unique_id "aaJpN1tZF9Zd_U7easDM7wAAAEY"]
[Sat Feb 28 12:04:07.586119 2026] [:error] [pid 52460:tid 52473] [client 20.151.113.230:20410] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f7.php"] [unique_id "aaJpN7LWOogAgHGh62T5VAAAAYo"]
[Sat Feb 28 12:04:07.998645 2026] [:error] [pid 52460:tid 52484] [client 20.151.113.230:20417] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f7.php"] [unique_id "aaJpN7LWOogAgHGh62T5WAAAAZU"]
[Sat Feb 28 12:04:08.408933 2026] [:error] [pid 39292:tid 39317] [client 20.151.113.230:20361] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f7.php"] [unique_id "aaJpOKIAO5fN7BxyqcG85QAAANc"]
[Sat Feb 28 12:04:08.820602 2026] [:error] [pid 39292:tid 39311] [client 20.151.113.230:20378] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f7.php"] [unique_id "aaJpOKIAO5fN7BxyqcG86AAAANE"]
[Sat Feb 28 12:04:09.230923 2026] [:error] [pid 52460:tid 52469] [client 20.151.113.230:20438] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaJpObLWOogAgHGh62T5YAAAAYY"]
[Sat Feb 28 12:04:09.648784 2026] [:error] [pid 39185:tid 39267] [client 20.151.113.230:20385] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaJpORVE-FfM89u7BQaO0wAAAJU"]
[Sat Feb 28 12:04:10.060938 2026] [:error] [pid 39292:tid 39308] [client 20.151.113.230:20457] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaJpOqIAO5fN7BxyqcG87wAAAM4"]
[Sat Feb 28 12:04:10.474124 2026] [:error] [pid 52460:tid 52473] [client 20.151.113.230:20400] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "aaJpOrLWOogAgHGh62T5YwAAAYo"]
[Sat Feb 28 12:04:10.889718 2026] [:error] [pid 39185:tid 39256] [client 20.151.113.230:20395] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp7.php"] [unique_id "aaJpOhVE-FfM89u7BQaO1QAAAIo"]
[Sat Feb 28 12:04:11.318887 2026] [:error] [pid 52460:tid 52470] [client 20.151.113.230:20425] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp7.php"] [unique_id "aaJpO7LWOogAgHGh62T5ZwAAAYc"]
[Sat Feb 28 12:04:11.730295 2026] [:error] [pid 52460:tid 52485] [client 20.151.113.230:20379] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp7.php"] [unique_id "aaJpO7LWOogAgHGh62T5aQAAAZY"]
[Sat Feb 28 12:04:12.142479 2026] [:error] [pid 52460:tid 52475] [client 20.151.113.230:20302] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp7.php"] [unique_id "aaJpPLLWOogAgHGh62T5bgAAAYw"]
[Sat Feb 28 12:04:12.558741 2026] [:error] [pid 11791:tid 11803] [client 20.151.113.230:20355] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/C1.php"] [unique_id "aaJpPGuX5e1Q32gqxH35zwAAAQo"]
[Sat Feb 28 12:04:12.969887 2026] [:error] [pid 39185:tid 39249] [client 20.151.113.230:20371] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/C1.php"] [unique_id "aaJpPBVE-FfM89u7BQaO1wAAAIM"]
[Sat Feb 28 12:04:13.384803 2026] [:error] [pid 52460:tid 52480] [client 20.151.113.230:20391] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/C1.php"] [unique_id "aaJpPbLWOogAgHGh62T5cAAAAZE"]
[Sat Feb 28 12:04:13.796753 2026] [:error] [pid 52460:tid 52479] [client 20.151.113.230:20294] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/C1.php"] [unique_id "aaJpPbLWOogAgHGh62T5cwAAAZA"]
[Sat Feb 28 12:04:14.210774 2026] [:error] [pid 52460:tid 52485] [client 20.151.113.230:20434] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clcdu.php"] [unique_id "aaJpPrLWOogAgHGh62T5dQAAAZY"]
[Sat Feb 28 12:04:14.619262 2026] [:error] [pid 52460:tid 52476] [client 20.151.113.230:20393] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clcdu.php"] [unique_id "aaJpPrLWOogAgHGh62T5dwAAAY0"]
[Sat Feb 28 12:04:15.032671 2026] [:error] [pid 11791:tid 11799] [client 20.151.113.230:20469] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clcdu.php"] [unique_id "aaJpP2uX5e1Q32gqxH352gAAAQY"]
[Sat Feb 28 12:04:15.444672 2026] [:error] [pid 52460:tid 52463] [client 20.151.113.230:20429] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clcdu.php"] [unique_id "aaJpP7LWOogAgHGh62T5egAAAYA"]
[Sat Feb 28 12:04:15.854612 2026] [:error] [pid 52460:tid 52483] [client 20.151.113.230:20387] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffbsq.php"] [unique_id "aaJpP7LWOogAgHGh62T5fQAAAZQ"]
[Sat Feb 28 12:04:16.264121 2026] [:error] [pid 39185:tid 39257] [client 20.151.113.230:20297] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffbsq.php"] [unique_id "aaJpQBVE-FfM89u7BQaO2wAAAIs"]
[Sat Feb 28 12:04:16.674409 2026] [:error] [pid 39183:tid 39213] [client 20.151.113.230:20376] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffbsq.php"] [unique_id "aaJpQBCf4HvhVePw3LbfIAAAABU"]
[Sat Feb 28 12:04:17.085736 2026] [:error] [pid 39185:tid 39265] [client 20.151.113.230:20426] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ffbsq.php"] [unique_id "aaJpQRVE-FfM89u7BQaO3wAAAJM"]
[Sat Feb 28 12:04:17.502848 2026] [:error] [pid 52460:tid 52476] [client 20.151.113.230:20434] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "aaJpQbLWOogAgHGh62T5hAAAAY0"]
[Sat Feb 28 12:04:17.914870 2026] [:error] [pid 39183:tid 39211] [client 20.151.113.230:20308] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "aaJpQRCf4HvhVePw3LbfIQAAABM"]
[Sat Feb 28 12:04:18.323842 2026] [:error] [pid 39292:tid 39312] [client 20.151.113.230:20315] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "aaJpQqIAO5fN7BxyqcG8-gAAANI"]
[Sat Feb 28 12:04:18.737862 2026] [:error] [pid 39185:tid 39270] [client 20.151.113.230:20352] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "aaJpQhVE-FfM89u7BQaO5AAAAJg"]
[Sat Feb 28 12:04:19.152381 2026] [:error] [pid 52460:tid 52463] [client 20.151.113.230:20364] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaJpQ7LWOogAgHGh62T5ngAAAYA"]
[Sat Feb 28 12:04:19.567886 2026] [:error] [pid 39292:tid 39304] [client 20.151.113.230:20459] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaJpQ6IAO5fN7BxyqcG8_QAAAMo"]
[Sat Feb 28 12:04:19.980770 2026] [:error] [pid 52460:tid 52486] [client 20.151.113.230:20290] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaJpQ7LWOogAgHGh62T5oAAAAZc"]
[Sat Feb 28 12:04:20.394216 2026] [:error] [pid 52460:tid 52469] [client 20.151.113.230:20462] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaJpRLLWOogAgHGh62T5pAAAAYY"]
[Sat Feb 28 12:04:20.804608 2026] [:error] [pid 52460:tid 52470] [client 20.151.113.230:20373] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaJpRLLWOogAgHGh62T5qQAAAYc"]
[Sat Feb 28 12:04:21.214292 2026] [:error] [pid 52460:tid 52487] [client 20.151.113.230:20384] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaJpRbLWOogAgHGh62T5qwAAAZg"]
[Sat Feb 28 12:04:21.624008 2026] [:error] [pid 11791:tid 11798] [client 20.151.113.230:20399] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaJpRWuX5e1Q32gqxH353wAAAQU"]
[Sat Feb 28 12:04:22.037168 2026] [:error] [pid 39185:tid 39249] [client 20.151.113.230:20431] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aaJpRhVE-FfM89u7BQaO6gAAAIM"]
[Sat Feb 28 12:04:22.448683 2026] [:error] [pid 52460:tid 52484] [client 20.151.113.230:20358] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kma.php"] [unique_id "aaJpRrLWOogAgHGh62T5sQAAAZU"]
[Sat Feb 28 12:04:22.860187 2026] [:error] [pid 52460:tid 52467] [client 20.151.113.230:20428] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kma.php"] [unique_id "aaJpRrLWOogAgHGh62T5tgAAAYQ"]
[Sat Feb 28 12:04:23.270821 2026] [:error] [pid 39184:tid 39242] [client 20.151.113.230:20403] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kma.php"] [unique_id "aaJpR1tZF9Zd_U7easDM-wAAAFc"]
[Sat Feb 28 12:04:23.682519 2026] [:error] [pid 52460:tid 52483] [client 20.151.113.230:20432] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kma.php"] [unique_id "aaJpR7LWOogAgHGh62T5vAAAAZQ"]
[Sat Feb 28 12:04:24.095872 2026] [:error] [pid 39185:tid 39269] [client 20.151.113.230:20446] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aaJpSBVE-FfM89u7BQaO8QAAAJc"]
[Sat Feb 28 12:04:24.508205 2026] [:error] [pid 39184:tid 39243] [client 20.151.113.230:20397] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aaJpSFtZF9Zd_U7easDM_gAAAFg"]
[Sat Feb 28 12:04:24.920792 2026] [:error] [pid 52460:tid 52467] [client 20.151.113.230:20325] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aaJpSLLWOogAgHGh62T5vgAAAYQ"]
[Sat Feb 28 12:04:25.332881 2026] [:error] [pid 52460:tid 52478] [client 20.151.113.230:20349] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpls.php"] [unique_id "aaJpSbLWOogAgHGh62T5wQAAAY8"]
[Sat Feb 28 12:04:25.750943 2026] [:error] [pid 52460:tid 52482] [client 20.151.113.230:20312] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova-wso.php"] [unique_id "aaJpSbLWOogAgHGh62T5wgAAAZM"]
[Sat Feb 28 12:04:26.161346 2026] [:error] [pid 52460:tid 52483] [client 20.151.113.230:20320] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova-wso.php"] [unique_id "aaJpSrLWOogAgHGh62T5xwAAAZQ"]
[Sat Feb 28 12:04:26.592693 2026] [:error] [pid 52460:tid 52480] [client 20.151.113.230:20408] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova-wso.php"] [unique_id "aaJpSrLWOogAgHGh62T5ygAAAZE"]
[Sat Feb 28 12:04:27.004129 2026] [:error] [pid 52460:tid 52477] [client 20.151.113.230:20350] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova-wso.php"] [unique_id "aaJpS7LWOogAgHGh62T5zAAAAY4"]
[Sat Feb 28 12:04:27.426208 2026] [:error] [pid 22194:tid 22205] [client 20.151.113.230:20440] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaJpS36mbajs3bzQGysvFQAAAUk"]
[Sat Feb 28 12:04:27.840085 2026] [:error] [pid 52460:tid 52482] [client 20.151.113.230:20291] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaJpS7LWOogAgHGh62T50gAAAZM"]
[Sat Feb 28 12:04:28.250207 2026] [:error] [pid 11791:tid 11799] [client 20.151.113.230:20423] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaJpTGuX5e1Q32gqxH356gAAAQY"]
[Sat Feb 28 12:04:28.662229 2026] [:error] [pid 11791:tid 11812] [client 20.151.113.230:20289] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjq.php"] [unique_id "aaJpTGuX5e1Q32gqxH357QAAARM"]
[Sat Feb 28 12:04:29.075238 2026] [:error] [pid 39185:tid 39256] [client 20.151.113.230:20402] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php7"] [unique_id "aaJpTRVE-FfM89u7BQaO-gAAAIo"]
[Sat Feb 28 12:04:29.483096 2026] [:error] [pid 11791:tid 11813] [client 20.151.113.230:20398] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php7"] [unique_id "aaJpTWuX5e1Q32gqxH357wAAARQ"]
[Sat Feb 28 12:04:29.901903 2026] [:error] [pid 52460:tid 52485] [client 20.151.113.230:20409] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php7"] [unique_id "aaJpTbLWOogAgHGh62T52QAAAZY"]
[Sat Feb 28 12:04:30.319220 2026] [:error] [pid 52460:tid 52475] [client 20.151.113.230:20380] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php7"] [unique_id "aaJpTrLWOogAgHGh62T52gAAAYw"]
[Sat Feb 28 12:04:30.731226 2026] [:error] [pid 52460:tid 52483] [client 20.151.113.230:20412] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaJpTrLWOogAgHGh62T53QAAAZQ"]
[Sat Feb 28 12:04:31.145890 2026] [:error] [pid 52460:tid 52470] [client 20.151.113.230:20305] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaJpT7LWOogAgHGh62T54AAAAYc"]
[Sat Feb 28 12:04:31.558768 2026] [:error] [pid 39185:tid 39268] [client 20.151.113.230:20407] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaJpTxVE-FfM89u7BQaO_gAAAJY"]
[Sat Feb 28 12:04:31.977958 2026] [:error] [pid 52460:tid 52467] [client 20.151.113.230:20442] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "aaJpT7LWOogAgHGh62T55gAAAYQ"]
[Sat Feb 28 12:04:32.387955 2026] [:error] [pid 22194:tid 22200] [client 20.151.113.230:20329] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php7"] [unique_id "aaJpUH6mbajs3bzQGysvFwAAAUQ"]
[Sat Feb 28 12:04:32.800755 2026] [:error] [pid 39185:tid 39269] [client 20.151.113.230:20367] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php7"] [unique_id "aaJpUBVE-FfM89u7BQaPAAAAAJc"]
[Sat Feb 28 12:04:33.209641 2026] [:error] [pid 39184:tid 39219] [client 20.151.113.230:20452] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php7"] [unique_id "aaJpUVtZF9Zd_U7easDNBgAAAEA"]
[Sat Feb 28 12:04:33.618075 2026] [:error] [pid 22194:tid 22197] [client 20.151.113.230:20301] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php7"] [unique_id "aaJpUX6mbajs3bzQGysvGAAAAUE"]
[Sat Feb 28 12:04:34.032747 2026] [:error] [pid 39185:tid 39270] [client 20.151.113.230:20299] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55.php"] [unique_id "aaJpUhVE-FfM89u7BQaPBAAAAJg"]
[Sat Feb 28 12:04:34.445356 2026] [:error] [pid 39185:tid 39258] [client 20.151.113.230:20254] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55.php"] [unique_id "aaJpUhVE-FfM89u7BQaPBgAAAIw"]
[Sat Feb 28 12:04:34.856309 2026] [:error] [pid 39292:tid 39310] [client 20.151.113.230:20344] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55.php"] [unique_id "aaJpUqIAO5fN7BxyqcG8_wAAANA"]
[Sat Feb 28 12:04:35.265702 2026] [:error] [pid 39292:tid 39299] [client 20.151.113.230:20316] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55.php"] [unique_id "aaJpU6IAO5fN7BxyqcG9AQAAAMU"]
[Sat Feb 28 12:04:35.677691 2026] [:error] [pid 39185:tid 39246] [client 20.151.113.230:20443] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc.php"] [unique_id "aaJpUxVE-FfM89u7BQaPDQAAAIA"]
[Sat Feb 28 12:04:36.091938 2026] [:error] [pid 52460:tid 52479] [client 20.151.113.230:20392] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc.php"] [unique_id "aaJpVLLWOogAgHGh62T57gAAAZA"]
[Sat Feb 28 12:04:36.502015 2026] [:error] [pid 52460:tid 52473] [client 20.151.113.230:20348] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc.php"] [unique_id "aaJpVLLWOogAgHGh62T58QAAAYo"]
[Sat Feb 28 12:04:36.912086 2026] [:error] [pid 22194:tid 22201] [client 20.151.113.230:20313] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc.php"] [unique_id "aaJpVH6mbajs3bzQGysvGwAAAUU"]
[Sat Feb 28 12:04:37.324134 2026] [:error] [pid 52460:tid 52484] [client 20.151.113.230:20331] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaJpVbLWOogAgHGh62T59QAAAZU"]
[Sat Feb 28 12:04:37.741235 2026] [:error] [pid 52460:tid 52469] [client 20.151.113.230:20375] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaJpVbLWOogAgHGh62T5-AAAAYY"]
[Sat Feb 28 12:04:38.154079 2026] [:error] [pid 39185:tid 39253] [client 20.151.113.230:20234] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaJpVhVE-FfM89u7BQaPEQAAAIc"]
[Sat Feb 28 12:04:38.567788 2026] [:error] [pid 52460:tid 52482] [client 20.151.113.230:20444] [client 20.151.113.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/re.php"] [unique_id "aaJpVrLWOogAgHGh62T5_QAAAZM"]
[Sat Feb 28 13:29:19.772126 2026] [:error] [pid 39183:tid 39208] [client 43.159.145.149:38828] [client 43.159.145.149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaJ9LxCf4HvhVePw3LbsQQAAABA"]
[Sat Feb 28 13:43:19.297528 2026] [:error] [pid 39185:tid 39266] [client 223.244.35.77:54933] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaKAdxVE-FfM89u7BQbmfQAAAJQ"]
[Sat Feb 28 14:43:52.759589 2026] [:error] [pid 11791:tid 11803] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sat Feb 28 14:43:52.967623 2026] [:error] [pid 11791:tid 11811] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 14:43:53.384875 2026] [:error] [pid 11791:tid 11806] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/ws77.php
[Sat Feb 28 14:43:53.592790 2026] [:error] [pid 11791:tid 11815] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sat Feb 28 14:43:53.801561 2026] [:error] [pid 11791:tid 11814] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Sat Feb 28 14:43:54.011932 2026] [:error] [pid 11791:tid 11796] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Feb 28 14:43:54.220622 2026] [:error] [pid 11791:tid 11807] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Feb 28 14:43:54.428980 2026] [:error] [pid 11791:tid 11816] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sat Feb 28 14:43:54.638424 2026] [:error] [pid 11791:tid 11802] [client 4.205.9.11:4911] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Sat Feb 28 14:43:54.844976 2026] [:error] [pid 11791:tid 11798] [client 4.205.9.11:4911] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaKOqmuX5e1Q32gqxH1L8AAAAQU"]
[Sat Feb 28 14:43:55.258030 2026] [:error] [pid 52460:tid 52465] [client 4.205.9.11:4895] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaKOq7LWOogAgHGh62R09gAAAYI"]
[Sat Feb 28 14:43:55.680164 2026] [:error] [pid 11791:tid 11815] [client 4.205.9.11:4884] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaKOq2uX5e1Q32gqxH1L-QAAARY"]
[Sat Feb 28 14:43:56.095020 2026] [:error] [pid 11791:tid 11813] [client 4.205.9.11:4910] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaKOrGuX5e1Q32gqxH1MAQAAARQ"]
[Sat Feb 28 14:43:56.505903 2026] [:error] [pid 52460:tid 52478] [client 4.205.9.11:5061] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaKOrLLWOogAgHGh62R0_QAAAY8"]
[Sat Feb 28 14:43:56.914324 2026] [:error] [pid 52460:tid 52483] [client 4.205.9.11:4866] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaKOrLLWOogAgHGh62R1AgAAAZQ"]
[Sat Feb 28 14:43:57.324230 2026] [:error] [pid 39185:tid 39262] [client 4.205.9.11:5066] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaKOrRVE-FfM89u7BQYndgAAAJA"]
[Sat Feb 28 14:43:57.738410 2026] [:error] [pid 11791:tid 11807] [client 4.205.9.11:4922] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaKOrWuX5e1Q32gqxH1MDQAAAQ4"]
[Sat Feb 28 14:43:58.157783 2026] [:error] [pid 22194:tid 22197] [client 4.205.9.11:4919] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaKOrn6mbajs3bzQGytaxQAAAUE"]
[Sat Feb 28 14:43:58.567994 2026] [:error] [pid 52460:tid 52485] [client 4.205.9.11:4865] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaKOrrLWOogAgHGh62R1EQAAAZY"]
[Sat Feb 28 14:43:58.981650 2026] [:error] [pid 52460:tid 52477] [client 4.205.9.11:4923] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaKOrrLWOogAgHGh62R1GAAAAY4"]
[Sat Feb 28 14:43:59.394629 2026] [:error] [pid 11791:tid 11815] [client 4.205.9.11:5075] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaKOr2uX5e1Q32gqxH1MHAAAARY"]
[Sat Feb 28 14:43:59.805160 2026] [:error] [pid 39292:tid 39296] [client 4.205.9.11:5086] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaKOr6IAO5fN7BxyqcHyFAAAAMI"]
[Sat Feb 28 14:44:00.216495 2026] [:error] [pid 39185:tid 39267] [client 4.205.9.11:5106] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaKOsBVE-FfM89u7BQYngAAAAJU"]
[Sat Feb 28 14:44:00.631656 2026] [:error] [pid 11791:tid 11798] [client 4.205.9.11:4873] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaKOsGuX5e1Q32gqxH1MJwAAAQU"]
[Sat Feb 28 14:44:01.046579 2026] [:error] [pid 39185:tid 39261] [client 4.205.9.11:4902] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaKOsRVE-FfM89u7BQYnhAAAAI8"]
[Sat Feb 28 14:44:01.460733 2026] [:error] [pid 39292:tid 39310] [client 4.205.9.11:4927] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaKOsaIAO5fN7BxyqcHyGwAAANA"]
[Sat Feb 28 14:44:01.886147 2026] [:error] [pid 39185:tid 39249] [client 4.205.9.11:4908] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaKOsRVE-FfM89u7BQYnigAAAIM"]
[Sat Feb 28 14:44:02.304568 2026] [:error] [pid 39185:tid 39248] [client 4.205.9.11:4900] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaKOshVE-FfM89u7BQYnjAAAAII"]
[Sat Feb 28 14:44:02.731512 2026] [:error] [pid 52460:tid 52474] [client 4.205.9.11:4916] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaKOsrLWOogAgHGh62R1KQAAAYs"]
[Sat Feb 28 14:44:03.153337 2026] [:error] [pid 39292:tid 39294] [client 4.205.9.11:5062] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaKOs6IAO5fN7BxyqcHyHQAAAMA"]
[Sat Feb 28 14:44:03.564249 2026] [:error] [pid 39185:tid 39247] [client 4.205.9.11:4905] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaKOsxVE-FfM89u7BQYnmAAAAIE"]
[Sat Feb 28 14:44:03.983018 2026] [:error] [pid 39185:tid 39250] [client 4.205.9.11:4871] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaKOsxVE-FfM89u7BQYnngAAAIQ"]
[Sat Feb 28 14:44:04.740696 2026] [:error] [pid 22194:tid 22202] [client 4.205.9.11:4874] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaKOtH6mbajs3bzQGytaywAAAUY"]
[Sat Feb 28 14:44:05.160043 2026] [:error] [pid 11791:tid 11805] [client 4.205.9.11:4880] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaKOtWuX5e1Q32gqxH1MSQAAAQw"]
[Sat Feb 28 14:44:05.573224 2026] [:error] [pid 39292:tid 39308] [client 4.205.9.11:5065] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaKOtaIAO5fN7BxyqcHyIwAAAM4"]
[Sat Feb 28 14:44:05.990511 2026] [:error] [pid 39185:tid 39266] [client 4.205.9.11:5090] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaKOtRVE-FfM89u7BQYnsQAAAJQ"]
[Sat Feb 28 14:44:06.409029 2026] [:error] [pid 22194:tid 22196] [client 4.205.9.11:4926] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaKOtn6mbajs3bzQGyta0AAAAUA"]
[Sat Feb 28 14:44:06.837552 2026] [:error] [pid 52460:tid 52477] [client 4.205.9.11:4920] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaKOtrLWOogAgHGh62R1PgAAAY4"]
[Sat Feb 28 14:44:07.255168 2026] [:error] [pid 52460:tid 52467] [client 4.205.9.11:4882] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaKOt7LWOogAgHGh62R1RQAAAYQ"]
[Sat Feb 28 14:44:07.685132 2026] [:error] [pid 52460:tid 52475] [client 4.205.9.11:4868] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaKOt7LWOogAgHGh62R1SwAAAYw"]
[Sat Feb 28 14:44:08.114934 2026] [:error] [pid 39185:tid 39247] [client 4.205.9.11:4899] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaKOuBVE-FfM89u7BQYnxAAAAIE"]
[Sat Feb 28 14:44:08.535097 2026] [:error] [pid 39185:tid 39249] [client 4.205.9.11:5068] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaKOuBVE-FfM89u7BQYnywAAAIM"]
[Sat Feb 28 14:44:08.976623 2026] [:error] [pid 11791:tid 11809] [client 4.205.9.11:4916] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaKOuGuX5e1Q32gqxH1MZwAAARA"]
[Sat Feb 28 14:44:09.391603 2026] [:error] [pid 39185:tid 39270] [client 4.205.9.11:4898] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaKOuRVE-FfM89u7BQYn3AAAAJg"]
[Sat Feb 28 14:44:09.804465 2026] [:error] [pid 39185:tid 39259] [client 4.205.9.11:4918] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaKOuRVE-FfM89u7BQYn5wAAAI0"]
[Sat Feb 28 14:44:10.217556 2026] [:error] [pid 52460:tid 52474] [client 4.205.9.11:4894] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaKOurLWOogAgHGh62R1VAAAAYs"]
[Sat Feb 28 14:44:10.629543 2026] [:error] [pid 39185:tid 39257] [client 4.205.9.11:4867] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaKOuhVE-FfM89u7BQYn8gAAAIs"]
[Sat Feb 28 14:44:11.052873 2026] [:error] [pid 39185:tid 39267] [client 4.205.9.11:4915] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaKOuxVE-FfM89u7BQYn-AAAAJU"]
[Sat Feb 28 14:44:11.467024 2026] [:error] [pid 39185:tid 39246] [client 4.205.9.11:5076] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaKOuxVE-FfM89u7BQYn_QAAAIA"]
[Sat Feb 28 14:44:11.882884 2026] [:error] [pid 39292:tid 39318] [client 4.205.9.11:5108] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaKOu6IAO5fN7BxyqcHyLAAAANg"]
[Sat Feb 28 14:44:12.294461 2026] [:error] [pid 22194:tid 22206] [client 4.205.9.11:4996] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaKOvH6mbajs3bzQGyta1QAAAUo"]
[Sat Feb 28 14:44:12.710990 2026] [:error] [pid 39185:tid 39264] [client 4.205.9.11:5095] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaKOvBVE-FfM89u7BQYoFgAAAJI"]
[Sat Feb 28 14:44:13.127889 2026] [:error] [pid 39185:tid 39257] [client 4.205.9.11:5116] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaKOvRVE-FfM89u7BQYoGgAAAIs"]
[Sat Feb 28 14:44:13.541480 2026] [:error] [pid 52460:tid 52467] [client 4.205.9.11:5071] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaKOvbLWOogAgHGh62R1ZgAAAYQ"]
[Sat Feb 28 14:44:13.951489 2026] [:error] [pid 39292:tid 39304] [client 4.205.9.11:4876] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaKOvaIAO5fN7BxyqcHyOgAAAMo"]
[Sat Feb 28 14:44:14.366586 2026] [:error] [pid 39185:tid 39251] [client 4.205.9.11:5058] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaKOvhVE-FfM89u7BQYoJwAAAIU"]
[Sat Feb 28 14:44:14.777293 2026] [:error] [pid 39292:tid 39299] [client 4.205.9.11:5007] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaKOvqIAO5fN7BxyqcHyPQAAAMU"]
[Sat Feb 28 14:44:15.186438 2026] [:error] [pid 39183:tid 39193] [client 4.205.9.11:5013] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaKOvxCf4HvhVePw3Lb5YgAAAAE"]
[Sat Feb 28 14:44:15.596990 2026] [:error] [pid 39185:tid 39257] [client 4.205.9.11:5074] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaKOvxVE-FfM89u7BQYoQQAAAIs"]
[Sat Feb 28 14:44:16.008796 2026] [:error] [pid 11791:tid 11808] [client 4.205.9.11:5114] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaKOwGuX5e1Q32gqxH1MoQAAAQ8"]
[Sat Feb 28 14:44:16.428595 2026] [:error] [pid 52460:tid 52478] [client 4.205.9.11:5092] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaKOwLLWOogAgHGh62R1agAAAY8"]
[Sat Feb 28 14:44:16.855197 2026] [:error] [pid 39184:tid 39239] [client 4.205.9.11:4892] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaKOwFtZF9Zd_U7easDvxAAAAFQ"]
[Sat Feb 28 14:44:17.265164 2026] [:error] [pid 52460:tid 52484] [client 4.205.9.11:4897] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaKOwbLWOogAgHGh62R1bgAAAZU"]
[Sat Feb 28 14:44:17.675909 2026] [:error] [pid 39183:tid 39200] [client 4.205.9.11:4872] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaKOwRCf4HvhVePw3Lb5ZQAAAAg"]
[Sat Feb 28 14:44:18.092126 2026] [:error] [pid 52460:tid 52482] [client 4.205.9.11:5060] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaKOwrLWOogAgHGh62R1dAAAAZM"]
[Sat Feb 28 14:44:18.506473 2026] [:error] [pid 39292:tid 39294] [client 4.205.9.11:4872] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaKOwqIAO5fN7BxyqcHyQwAAAMA"]
[Sat Feb 28 14:44:18.920247 2026] [:error] [pid 39183:tid 39213] [client 4.205.9.11:4870] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaKOwhCf4HvhVePw3Lb5aQAAABU"]
[Sat Feb 28 14:44:19.335893 2026] [:error] [pid 52460:tid 52470] [client 4.205.9.11:4869] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaKOw7LWOogAgHGh62R1dgAAAYc"]
[Sat Feb 28 14:44:19.766665 2026] [:error] [pid 52460:tid 52464] [client 4.205.9.11:4896] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaKOw7LWOogAgHGh62R1egAAAYE"]
[Sat Feb 28 14:44:20.180689 2026] [:error] [pid 52460:tid 52485] [client 4.205.9.11:5010] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaKOxLLWOogAgHGh62R1fwAAAZY"]
[Sat Feb 28 14:44:20.595829 2026] [:error] [pid 52460:tid 52471] [client 4.205.9.11:5077] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaKOxLLWOogAgHGh62R1gwAAAYg"]
[Sat Feb 28 14:44:21.009468 2026] [:error] [pid 39185:tid 39250] [client 4.205.9.11:5006] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaKOxRVE-FfM89u7BQYoUAAAAIQ"]
[Sat Feb 28 14:44:21.424365 2026] [:error] [pid 39292:tid 39312] [client 4.205.9.11:5069] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaKOxaIAO5fN7BxyqcHySAAAANI"]
[Sat Feb 28 14:44:21.843061 2026] [:error] [pid 52460:tid 52469] [client 4.205.9.11:5027] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaKOxbLWOogAgHGh62R1iwAAAYY"]
[Sat Feb 28 14:44:22.265716 2026] [:error] [pid 52460:tid 52486] [client 4.205.9.11:5101] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaKOxrLWOogAgHGh62R1jgAAAZc"]
[Sat Feb 28 14:44:22.681039 2026] [:error] [pid 39185:tid 39259] [client 4.205.9.11:4921] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaKOxhVE-FfM89u7BQYoVQAAAI0"]
[Sat Feb 28 14:44:23.115387 2026] [:error] [pid 52460:tid 52463] [client 4.205.9.11:4917] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaKOx7LWOogAgHGh62R1kQAAAYA"]
[Sat Feb 28 14:44:23.545597 2026] [:error] [pid 52460:tid 52485] [client 4.205.9.11:5100] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaKOx7LWOogAgHGh62R1kwAAAZY"]
[Sat Feb 28 14:44:23.975949 2026] [:error] [pid 39184:tid 39233] [client 4.205.9.11:5096] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaKOx1tZF9Zd_U7easDvygAAAE4"]
[Sat Feb 28 14:44:24.396567 2026] [:error] [pid 39185:tid 39250] [client 4.205.9.11:4912] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaKOyBVE-FfM89u7BQYoYwAAAIQ"]
[Sat Feb 28 14:44:24.819055 2026] [:error] [pid 52460:tid 52477] [client 4.205.9.11:5057] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaKOyLLWOogAgHGh62R1lgAAAY4"]
[Sat Feb 28 14:44:25.235468 2026] [:error] [pid 11791:tid 11800] [client 4.205.9.11:5073] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaKOyWuX5e1Q32gqxH1MywAAAQc"]
[Sat Feb 28 14:44:25.650456 2026] [:error] [pid 11791:tid 11805] [client 4.205.9.11:5119] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaKOyWuX5e1Q32gqxH1M0gAAAQw"]
[Sat Feb 28 14:44:26.074524 2026] [:error] [pid 39185:tid 39253] [client 4.205.9.11:4901] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaKOyhVE-FfM89u7BQYoaAAAAIc"]
[Sat Feb 28 14:44:26.485386 2026] [:error] [pid 39185:tid 39264] [client 4.205.9.11:4878] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaKOyhVE-FfM89u7BQYoagAAAJI"]
[Sat Feb 28 14:44:26.898457 2026] [:error] [pid 22194:tid 22206] [client 4.205.9.11:5117] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaKOyn6mbajs3bzQGyta9AAAAUo"]
[Sat Feb 28 14:44:27.315490 2026] [:error] [pid 52460:tid 52477] [client 4.205.9.11:4904] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaKOy7LWOogAgHGh62R1ogAAAY4"]
[Sat Feb 28 14:44:27.728166 2026] [:error] [pid 52460:tid 52469] [client 4.205.9.11:4913] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaKOy7LWOogAgHGh62R1pwAAAYY"]
[Sat Feb 28 14:44:28.147114 2026] [:error] [pid 52460:tid 52467] [client 4.205.9.11:5078] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaKOzLLWOogAgHGh62R1rQAAAYQ"]
[Sat Feb 28 14:44:28.564207 2026] [:error] [pid 39183:tid 39208] [client 4.205.9.11:5081] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aaKOzBCf4HvhVePw3Lb5awAAABA"]
[Sat Feb 28 14:44:28.979103 2026] [:error] [pid 39184:tid 39236] [client 4.205.9.11:5089] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aaKOzFtZF9Zd_U7easDvzAAAAFE"]
[Sat Feb 28 14:44:29.395401 2026] [:error] [pid 52460:tid 52487] [client 4.205.9.11:5015] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aaKOzbLWOogAgHGh62R1sAAAAZg"]
[Sat Feb 28 14:44:29.823903 2026] [:error] [pid 11791:tid 11817] [client 4.205.9.11:5005] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aaKOzWuX5e1Q32gqxH1M2gAAARg"]
[Sat Feb 28 14:44:30.243802 2026] [:error] [pid 11791:tid 11815] [client 4.205.9.11:5009] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/62ix02bk.php"] [unique_id "aaKOzmuX5e1Q32gqxH1M2wAAARY"]
[Sat Feb 28 14:44:30.653814 2026] [:error] [pid 52460:tid 52483] [client 4.205.9.11:5064] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/62ix02bk.php"] [unique_id "aaKOzrLWOogAgHGh62R1twAAAZQ"]
[Sat Feb 28 14:44:31.067489 2026] [:error] [pid 39183:tid 39192] [client 4.205.9.11:4907] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/62ix02bk.php"] [unique_id "aaKOzxCf4HvhVePw3Lb5cgAAAAA"]
[Sat Feb 28 14:44:31.492220 2026] [:error] [pid 39183:tid 39194] [client 4.205.9.11:5070] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/62ix02bk.php"] [unique_id "aaKOzxCf4HvhVePw3Lb5dQAAAAI"]
[Sat Feb 28 14:44:31.919076 2026] [:error] [pid 39183:tid 39193] [client 4.205.9.11:4924] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdf.php"] [unique_id "aaKOzxCf4HvhVePw3Lb5dwAAAAE"]
[Sat Feb 28 14:44:32.335930 2026] [:error] [pid 39185:tid 39265] [client 4.205.9.11:4864] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdf.php"] [unique_id "aaKO0BVE-FfM89u7BQYodQAAAJM"]
[Sat Feb 28 14:44:32.752743 2026] [:error] [pid 39185:tid 39256] [client 4.205.9.11:4893] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdf.php"] [unique_id "aaKO0BVE-FfM89u7BQYodgAAAIo"]
[Sat Feb 28 14:44:33.173302 2026] [:error] [pid 11791:tid 11802] [client 4.205.9.11:4889] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdf.php"] [unique_id "aaKO0WuX5e1Q32gqxH1M4QAAAQk"]
[Sat Feb 28 14:44:33.589456 2026] [:error] [pid 39185:tid 39263] [client 4.205.9.11:4887] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6ijmjpa.php"] [unique_id "aaKO0RVE-FfM89u7BQYofAAAAJE"]
[Sat Feb 28 14:44:34.003972 2026] [:error] [pid 11791:tid 11806] [client 4.205.9.11:5084] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6ijmjpa.php"] [unique_id "aaKO0muX5e1Q32gqxH1M5QAAAQ0"]
[Sat Feb 28 14:44:34.418539 2026] [:error] [pid 11791:tid 11804] [client 4.205.9.11:5105] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6ijmjpa.php"] [unique_id "aaKO0muX5e1Q32gqxH1M5gAAAQs"]
[Sat Feb 28 14:44:34.833270 2026] [:error] [pid 39183:tid 39214] [client 4.205.9.11:5079] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6ijmjpa.php"] [unique_id "aaKO0hCf4HvhVePw3Lb5egAAABY"]
[Sat Feb 28 14:44:35.249140 2026] [:error] [pid 39184:tid 39220] [client 4.205.9.11:5094] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaKO01tZF9Zd_U7easDv0QAAAEE"]
[Sat Feb 28 14:44:35.675894 2026] [:error] [pid 39184:tid 39229] [client 4.205.9.11:5085] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaKO01tZF9Zd_U7easDv0gAAAEo"]
[Sat Feb 28 14:44:36.095433 2026] [:error] [pid 11791:tid 11815] [client 4.205.9.11:5025] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaKO1GuX5e1Q32gqxH1M6AAAARY"]
[Sat Feb 28 14:44:36.512356 2026] [:error] [pid 11791:tid 11796] [client 4.205.9.11:5111] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_jVML8V37.php"] [unique_id "aaKO1GuX5e1Q32gqxH1M6wAAAQM"]
[Sat Feb 28 14:44:36.943160 2026] [:error] [pid 11791:tid 11798] [client 4.205.9.11:4885] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4wj632p1.php"] [unique_id "aaKO1GuX5e1Q32gqxH1M7wAAAQU"]
[Sat Feb 28 14:44:37.357511 2026] [:error] [pid 11791:tid 11809] [client 4.205.9.11:4992] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4wj632p1.php"] [unique_id "aaKO1WuX5e1Q32gqxH1M8QAAARA"]
[Sat Feb 28 14:44:37.779441 2026] [:error] [pid 52460:tid 52478] [client 4.205.9.11:5024] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4wj632p1.php"] [unique_id "aaKO1bLWOogAgHGh62R1wQAAAY8"]
[Sat Feb 28 14:44:38.197803 2026] [:error] [pid 11791:tid 11806] [client 4.205.9.11:5097] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4wj632p1.php"] [unique_id "aaKO1muX5e1Q32gqxH1M9gAAAQ0"]
[Sat Feb 28 14:44:38.615849 2026] [:error] [pid 39183:tid 39211] [client 4.205.9.11:4914] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aaKO1hCf4HvhVePw3Lb5fwAAABM"]
[Sat Feb 28 14:44:39.031205 2026] [:error] [pid 39185:tid 39257] [client 4.205.9.11:5002] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aaKO1xVE-FfM89u7BQYojwAAAIs"]
[Sat Feb 28 14:44:39.448413 2026] [:error] [pid 52460:tid 52482] [client 4.205.9.11:5112] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aaKO17LWOogAgHGh62R1xQAAAZM"]
[Sat Feb 28 14:44:39.863982 2026] [:error] [pid 39183:tid 39215] [client 4.205.9.11:5023] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aaKO1xCf4HvhVePw3Lb5gAAAABc"]
[Sat Feb 28 14:44:40.278846 2026] [:error] [pid 39292:tid 39294] [client 4.205.9.11:5099] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e31hmf9b.php"] [unique_id "aaKO2KIAO5fN7BxyqcHyUgAAAMA"]
[Sat Feb 28 14:44:40.691107 2026] [:error] [pid 39185:tid 39260] [client 4.205.9.11:5107] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e31hmf9b.php"] [unique_id "aaKO2BVE-FfM89u7BQYolwAAAI4"]
[Sat Feb 28 14:44:41.103205 2026] [:error] [pid 39185:tid 39248] [client 4.205.9.11:5088] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e31hmf9b.php"] [unique_id "aaKO2RVE-FfM89u7BQYomgAAAII"]
[Sat Feb 28 14:44:41.521250 2026] [:error] [pid 39292:tid 39295] [client 4.205.9.11:5059] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e31hmf9b.php"] [unique_id "aaKO2aIAO5fN7BxyqcHyVAAAAME"]
[Sat Feb 28 16:51:13.333074 2026] [:error] [pid 39184:tid 39223] [client 172.98.33.134:53625] [client 172.98.33.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.134, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaKsgVtZF9Zd_U7easAuBQAAAEQ"]
[Sat Feb 28 16:51:13.336620 2026] [:error] [pid 39184:tid 39223] [client 172.98.33.134:53625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Feb 28 17:01:00.055311 2026] [:error] [pid 39183:tid 39193] [client 45.153.34.31:41236] [client 45.153.34.31] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aaKuzBCf4HvhVePw3LYrWwAAAAE"]
[Sat Feb 28 17:08:05.068907 2026] [:error] [pid 39183:tid 39193] [client 43.157.175.122:46760] [client 43.157.175.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaKwdRCf4HvhVePw3LYvNwAAAAE"]
[Sat Feb 28 17:34:01.293319 2026] [:error] [pid 39292:tid 39314] [client 204.76.203.25:55516] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aaK2iaIAO5fN7BxyqcEsVQAAANQ"]
[Sat Feb 28 17:50:14.736978 2026] [:error] [pid 39185:tid 39253] [client 40.85.218.222:38789] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Feb 28 17:50:14.955609 2026] [:error] [pid 39185:tid 39247] [client 40.85.218.222:38789] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 17:50:15.386906 2026] [:error] [pid 39185:tid 39250] [client 40.85.218.222:38789] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Feb 28 17:50:15.635888 2026] [:error] [pid 39185:tid 39252] [client 40.85.218.222:38789] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 17:50:16.140435 2026] [:error] [pid 39185:tid 39262] [client 40.85.218.222:38789] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat Feb 28 17:50:16.367726 2026] [:error] [pid 39185:tid 39265] [client 40.85.218.222:38789] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat Feb 28 17:50:16.582447 2026] [:error] [pid 39185:tid 39266] [client 40.85.218.222:38789] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Feb 28 17:50:17.011081 2026] [:error] [pid 39185:tid 39248] [client 40.85.218.222:38789] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaK6WRVE-FfM89u7BQZ1QAAAAII"]
[Sat Feb 28 17:50:17.945321 2026] [:error] [pid 39183:tid 39210] [client 40.85.218.222:34006] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaK6WRCf4HvhVePw3LZd3wAAABI"]
[Sat Feb 28 17:50:18.914435 2026] [:error] [pid 49763:tid 49767] [client 40.85.218.222:33979] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaK6WrTHSOG_yf2PpqEvPAAAAcE"]
[Sat Feb 28 17:50:19.908131 2026] [:error] [pid 52460:tid 52479] [client 40.85.218.222:38831] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "aaK6W7LWOogAgHGh62TGFwAAAZA"]
[Sat Feb 28 19:16:55.136954 2026] [:error] [pid 39292:tid 39302] [client 162.62.132.25:52960] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaLOp6IAO5fN7BxyqcFTzQAAAMg"]
[Sat Feb 28 20:30:23.687712 2026] [:error] [pid 11791:tid 11801] [client 120.71.59.24:51766] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaLf32uX5e1Q32gqxH24sQAAAQg"]
[Sat Feb 28 21:40:04.204836 2026] [:error] [pid 49763:tid 49773] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Feb 28 21:40:04.417474 2026] [:error] [pid 49763:tid 49782] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Feb 28 21:40:04.635001 2026] [:error] [pid 49763:tid 49785] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sat Feb 28 21:40:04.849986 2026] [:error] [pid 49763:tid 49777] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat Feb 28 21:40:05.063106 2026] [:error] [pid 49763:tid 49779] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Feb 28 21:40:05.275560 2026] [:error] [pid 49763:tid 49781] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat Feb 28 21:40:05.701245 2026] [:error] [pid 49763:tid 49782] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sat Feb 28 21:40:05.913890 2026] [:error] [pid 49763:tid 49777] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Sat Feb 28 21:40:06.128817 2026] [:error] [pid 49763:tid 49784] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sat Feb 28 21:40:06.346230 2026] [:error] [pid 49763:tid 49776] [client 40.85.218.222:44638] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sat Feb 28 21:40:06.555751 2026] [:error] [pid 49763:tid 49786] [client 40.85.218.222:44638] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaLwNrTHSOG_yf2PpqGK9wAAAdQ"]
[Sat Feb 28 21:40:07.405024 2026] [:error] [pid 49763:tid 49790] [client 40.85.218.222:44637] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaLwN7THSOG_yf2PpqGK_AAAAdg"]
[Sat Feb 28 21:40:08.298962 2026] [:error] [pid 39184:tid 39219] [client 40.85.218.222:6345] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaLwOFtZF9Zd_U7easDNXwAAAEA"]
[Sat Feb 28 21:40:09.173548 2026] [:error] [pid 11791:tid 11814] [client 40.85.218.222:44610] [client 40.85.218.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "aaLwOWuX5e1Q32gqxH3MLQAAARU"]
[Sat Feb 28 22:13:27.526712 2026] [:error] [pid 49763:tid 49787] [client 43.166.128.187:34744] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaL4B7THSOG_yf2PpqG38wAAAdU"]
[Sat Feb 28 22:13:48.291712 2026] [:error] [pid 39185:tid 39255] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/plugins.php
[Sat Feb 28 22:13:48.607548 2026] [:error] [pid 39185:tid 39258] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/erty.php
[Sat Feb 28 22:13:49.042097 2026] [:error] [pid 39185:tid 39263] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/ws77.php
[Sat Feb 28 22:13:49.264503 2026] [:error] [pid 39185:tid 39262] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sat Feb 28 22:13:49.504874 2026] [:error] [pid 39185:tid 39251] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/lp6.php
[Sat Feb 28 22:13:49.720283 2026] [:error] [pid 39185:tid 39256] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Feb 28 22:13:49.935921 2026] [:error] [pid 39185:tid 39248] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Feb 28 22:13:50.148880 2026] [:error] [pid 39185:tid 39267] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sat Feb 28 22:13:50.366724 2026] [:error] [pid 39185:tid 39253] [client 4.205.9.11:8210] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Sat Feb 28 22:13:50.592961 2026] [:error] [pid 39185:tid 39268] [client 4.205.9.11:8210] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaL4HhVE-FfM89u7BQavlwAAAJY"]
[Sat Feb 28 22:13:51.122344 2026] [:error] [pid 39183:tid 39207] [client 4.205.9.11:58253] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaL4HxCf4HvhVePw3LZ_HAAAAA8"]
[Sat Feb 28 22:13:51.700936 2026] [:error] [pid 39183:tid 39197] [client 4.205.9.11:38816] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaL4HxCf4HvhVePw3LZ_HwAAAAU"]
[Sat Feb 28 22:13:52.356737 2026] [:error] [pid 39292:tid 39315] [client 4.205.9.11:8242] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aaL4IKIAO5fN7BxyqcGS4QAAANU"]
[Sat Feb 28 22:13:52.935234 2026] [:error] [pid 11791:tid 11805] [client 4.205.9.11:63427] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaL4IGuX5e1Q32gqxH3V5gAAAQw"]
[Sat Feb 28 22:13:53.676192 2026] [:error] [pid 49763:tid 49771] [client 4.205.9.11:8938] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaL4IbTHSOG_yf2PpqG4ewAAAcU"]
[Sat Feb 28 22:13:54.629577 2026] [:error] [pid 49763:tid 49785] [client 4.205.9.11:8921] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaL4IrTHSOG_yf2PpqG4hwAAAdM"]
[Sat Feb 28 22:13:55.265604 2026] [:error] [pid 39184:tid 39228] [client 4.205.9.11:8899] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aaL4I1tZF9Zd_U7easDgwAAAAEk"]
[Sat Feb 28 22:13:55.914739 2026] [:error] [pid 49763:tid 49767] [client 4.205.9.11:42623] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaL4I7THSOG_yf2PpqG4lwAAAcE"]
[Sat Feb 28 22:13:56.428353 2026] [:error] [pid 49763:tid 49778] [client 4.205.9.11:58853] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaL4JLTHSOG_yf2PpqG4nAAAAcw"]
[Sat Feb 28 22:13:57.085185 2026] [:error] [pid 49763:tid 49777] [client 4.205.9.11:63397] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaL4JbTHSOG_yf2PpqG4owAAAcs"]
[Sat Feb 28 22:13:57.529055 2026] [:error] [pid 52460:tid 52478] [client 4.205.9.11:58853] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cxxuv.php"] [unique_id "aaL4JbLWOogAgHGh62SyOQAAAY8"]
[Sat Feb 28 22:13:58.156083 2026] [:error] [pid 49763:tid 49769] [client 4.205.9.11:8194] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaL4JrTHSOG_yf2PpqG4pwAAAcM"]
[Sat Feb 28 22:13:58.644555 2026] [:error] [pid 52460:tid 52476] [client 4.205.9.11:63375] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaL4JrLWOogAgHGh62SyQwAAAY0"]
[Sat Feb 28 22:13:59.249734 2026] [:error] [pid 39183:tid 39214] [client 4.205.9.11:48213] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaL4JxCf4HvhVePw3LZ_JQAAABY"]
[Sat Feb 28 22:13:59.795933 2026] [:error] [pid 52460:tid 52485] [client 4.205.9.11:63403] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aaL4J7LWOogAgHGh62SySgAAAZY"]
[Sat Feb 28 22:14:00.446016 2026] [:error] [pid 39183:tid 39210] [client 4.205.9.11:58774] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaL4KBCf4HvhVePw3LZ_KgAAABI"]
[Sat Feb 28 22:14:01.123460 2026] [:error] [pid 39292:tid 39295] [client 4.205.9.11:53569] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaL4KaIAO5fN7BxyqcGTCAAAAME"]
[Sat Feb 28 22:14:01.751483 2026] [:error] [pid 39183:tid 39216] [client 4.205.9.11:58767] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaL4KRCf4HvhVePw3LZ_NAAAABg"]
[Sat Feb 28 22:14:02.389139 2026] [:error] [pid 39184:tid 39240] [client 4.205.9.11:58768] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gi.php"] [unique_id "aaL4KltZF9Zd_U7easDgxgAAAFU"]
[Sat Feb 28 22:14:02.943678 2026] [:error] [pid 49763:tid 49774] [client 4.205.9.11:63423] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaL4KrTHSOG_yf2PpqG4tQAAAcg"]
[Sat Feb 28 22:14:03.746695 2026] [:error] [pid 22194:tid 22215] [client 4.205.9.11:53626] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaL4K36mbajs3bzQGyuyAQAAAVM"]
[Sat Feb 28 22:14:04.334096 2026] [:error] [pid 39183:tid 39205] [client 4.205.9.11:53588] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaL4LBCf4HvhVePw3LZ_PwAAAA0"]
[Sat Feb 28 22:14:05.211579 2026] [:error] [pid 39183:tid 39193] [client 4.205.9.11:56280] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e0v9e95c.php"] [unique_id "aaL4LRCf4HvhVePw3LZ_QwAAAAE"]
[Sat Feb 28 22:14:05.949484 2026] [:error] [pid 39292:tid 39300] [client 4.205.9.11:8539] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaL4LaIAO5fN7BxyqcGTFAAAAMY"]
[Sat Feb 28 22:14:06.629855 2026] [:error] [pid 39185:tid 39255] [client 4.205.9.11:48240] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaL4LhVE-FfM89u7BQavngAAAIk"]
[Sat Feb 28 22:14:07.402928 2026] [:error] [pid 52460:tid 52477] [client 4.205.9.11:58782] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaL4L7LWOogAgHGh62SybwAAAY4"]
[Sat Feb 28 22:14:07.946581 2026] [:error] [pid 39183:tid 39197] [client 4.205.9.11:57081] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2gz1dxix.php"] [unique_id "aaL4LxCf4HvhVePw3LZ_VgAAAAU"]
[Sat Feb 28 22:14:08.500354 2026] [:error] [pid 39183:tid 39214] [client 4.205.9.11:56256] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaL4MBCf4HvhVePw3LZ_WQAAABY"]
[Sat Feb 28 22:14:09.281642 2026] [:error] [pid 39183:tid 39194] [client 4.205.9.11:56257] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaL4MRCf4HvhVePw3LZ_YgAAAAI"]
[Sat Feb 28 22:14:09.789686 2026] [:error] [pid 49763:tid 49781] [client 4.205.9.11:8565] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaL4MbTHSOG_yf2PpqG4vwAAAc8"]
[Sat Feb 28 22:14:10.592923 2026] [:error] [pid 11791:tid 11797] [client 4.205.9.11:38377] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aaL4MmuX5e1Q32gqxH3V_AAAAQQ"]
[Sat Feb 28 22:14:11.402186 2026] [:error] [pid 39183:tid 39212] [client 4.205.9.11:54329] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaL4MxCf4HvhVePw3LZ_dAAAABQ"]
[Sat Feb 28 22:14:11.964789 2026] [:error] [pid 52460:tid 52476] [client 4.205.9.11:58775] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaL4M7LWOogAgHGh62SygAAAAY0"]
[Sat Feb 28 22:14:12.947620 2026] [:error] [pid 49763:tid 49786] [client 4.205.9.11:8544] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaL4NLTHSOG_yf2PpqG4wgAAAdQ"]
[Sat Feb 28 22:14:13.611254 2026] [:error] [pid 39292:tid 39309] [client 4.205.9.11:8525] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aaL4NaIAO5fN7BxyqcGTHQAAAM8"]
[Sat Feb 28 22:14:14.249852 2026] [:error] [pid 39183:tid 39211] [client 4.205.9.11:44575] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaL4NhCf4HvhVePw3LZ_hQAAABM"]
[Sat Feb 28 22:14:14.995266 2026] [:error] [pid 39183:tid 39195] [client 4.205.9.11:54320] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaL4NhCf4HvhVePw3LZ_kAAAAAM"]
[Sat Feb 28 22:14:15.580649 2026] [:error] [pid 52460:tid 52473] [client 4.205.9.11:9062] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaL4N7LWOogAgHGh62SyjwAAAYo"]
[Sat Feb 28 22:14:16.403288 2026] [:error] [pid 52460:tid 52485] [client 4.205.9.11:54275] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bak.php"] [unique_id "aaL4OLLWOogAgHGh62SymAAAAZY"]
[Sat Feb 28 22:14:17.530413 2026] [:error] [pid 52460:tid 52469] [client 4.205.9.11:44584] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaL4ObLWOogAgHGh62SypAAAAYY"]
[Sat Feb 28 22:14:18.483758 2026] [:error] [pid 39183:tid 39213] [client 4.205.9.11:54292] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaL4OhCf4HvhVePw3LZ_qQAAABU"]
[Sat Feb 28 22:14:18.959737 2026] [:error] [pid 39183:tid 39208] [client 4.205.9.11:8463] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaL4OhCf4HvhVePw3LZ_rgAAABA"]
[Sat Feb 28 22:14:19.584294 2026] [:error] [pid 39292:tid 39313] [client 4.205.9.11:44572] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaL4O6IAO5fN7BxyqcGTLQAAANM"]
[Sat Feb 28 22:14:20.204605 2026] [:error] [pid 52460:tid 52486] [client 4.205.9.11:53565] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaL4PLLWOogAgHGh62SyqQAAAZc"]
[Sat Feb 28 22:14:20.944508 2026] [:error] [pid 52460:tid 52473] [client 4.205.9.11:9060] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaL4PLLWOogAgHGh62SyrgAAAYo"]
[Sat Feb 28 22:14:21.448648 2026] [:error] [pid 52460:tid 52481] [client 4.205.9.11:56231] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaL4PbLWOogAgHGh62SysgAAAZI"]
[Sat Feb 28 22:14:22.028436 2026] [:error] [pid 39184:tid 39226] [client 4.205.9.11:50176] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-f.php"] [unique_id "aaL4PltZF9Zd_U7easDg2QAAAEc"]
[Sat Feb 28 22:14:22.534946 2026] [:error] [pid 39184:tid 39243] [client 4.205.9.11:9025] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaL4PltZF9Zd_U7easDg3gAAAFg"]
[Sat Feb 28 22:14:23.026950 2026] [:error] [pid 39185:tid 39266] [client 4.205.9.11:38881] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaL4PxVE-FfM89u7BQavrQAAAJQ"]
[Sat Feb 28 22:14:23.656814 2026] [:error] [pid 39292:tid 39299] [client 4.205.9.11:46356] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaL4P6IAO5fN7BxyqcGTOwAAAMU"]
[Sat Feb 28 22:14:24.344110 2026] [:error] [pid 39184:tid 39233] [client 4.205.9.11:50237] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aaL4QFtZF9Zd_U7easDg5AAAAE4"]
[Sat Feb 28 22:14:24.859303 2026] [:error] [pid 49763:tid 49789] [client 4.205.9.11:53519] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaL4QLTHSOG_yf2PpqG40gAAAdc"]
[Sat Feb 28 22:14:25.488816 2026] [:error] [pid 52460:tid 52483] [client 4.205.9.11:38881] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaL4QbLWOogAgHGh62SywgAAAZQ"]
[Sat Feb 28 22:14:25.983310 2026] [:error] [pid 52460:tid 52487] [client 4.205.9.11:53537] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaL4QbLWOogAgHGh62SyxAAAAZg"]
[Sat Feb 28 22:14:26.747643 2026] [:error] [pid 52460:tid 52463] [client 4.205.9.11:50198] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "aaL4QrLWOogAgHGh62SyywAAAYA"]
[Sat Feb 28 22:14:27.323113 2026] [:error] [pid 49763:tid 49784] [client 4.205.9.11:50218] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaL4Q7THSOG_yf2PpqG42AAAAdI"]
[Sat Feb 28 22:14:27.780085 2026] [:error] [pid 39183:tid 39214] [client 4.205.9.11:53523] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaL4QxCf4HvhVePw3LZ_5gAAABY"]
[Sat Feb 28 22:14:29.216618 2026] [:error] [pid 39184:tid 39237] [client 4.205.9.11:44577] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaL4RVtZF9Zd_U7easDg9QAAAFI"]
[Sat Feb 28 22:14:29.986982 2026] [:error] [pid 52460:tid 52475] [client 4.205.9.11:8464] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaL4RbLWOogAgHGh62Sy1gAAAYw"]
[Sat Feb 28 22:14:30.994566 2026] [:error] [pid 11791:tid 11816] [client 4.205.9.11:50202] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaL4RmuX5e1Q32gqxH3WEwAAARc"]
[Sat Feb 28 22:14:32.260329 2026] [:error] [pid 49763:tid 49777] [client 4.205.9.11:8474] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaL4SLTHSOG_yf2PpqG46QAAAcs"]
[Sat Feb 28 22:14:34.108058 2026] [:error] [pid 49763:tid 49769] [client 4.205.9.11:50196] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaL4SrTHSOG_yf2PpqG4_wAAAcM"]
[Sat Feb 28 22:14:35.019150 2026] [:error] [pid 49763:tid 49784] [client 4.205.9.11:46370] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0bb45ctt.php"] [unique_id "aaL4S7THSOG_yf2PpqG5DAAAAdI"]
[Sat Feb 28 22:14:35.698104 2026] [:error] [pid 49763:tid 49785] [client 4.205.9.11:48967] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaL4S7THSOG_yf2PpqG5FAAAAdM"]
[Sat Feb 28 22:14:37.366155 2026] [:error] [pid 49763:tid 49769] [client 4.205.9.11:46394] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaL4TbTHSOG_yf2PpqG5LAAAAcM"]
[Sat Feb 28 22:14:38.707690 2026] [:error] [pid 49763:tid 49774] [client 4.205.9.11:50203] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaL4TrTHSOG_yf2PpqG5OQAAAcg"]
[Sat Feb 28 22:14:39.413975 2026] [:error] [pid 52460:tid 52466] [client 4.205.9.11:52350] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aaL4T7LWOogAgHGh62Sy9QAAAYM"]
[Sat Feb 28 22:14:40.086514 2026] [:error] [pid 49763:tid 49789] [client 4.205.9.11:38911] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaL4ULTHSOG_yf2PpqG5QgAAAdc"]
[Sat Feb 28 22:14:41.060542 2026] [:error] [pid 49763:tid 49770] [client 4.205.9.11:8502] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaL4UbTHSOG_yf2PpqG5TgAAAcQ"]
[Sat Feb 28 22:14:41.668238 2026] [:error] [pid 39184:tid 39221] [client 4.205.9.11:48985] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaL4UVtZF9Zd_U7easDhAwAAAEI"]
[Sat Feb 28 22:14:42.729619 2026] [:error] [pid 39292:tid 39309] [client 4.205.9.11:50200] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aaL4UqIAO5fN7BxyqcGTQwAAAM8"]
[Sat Feb 28 22:14:43.562140 2026] [:error] [pid 52460:tid 52478] [client 4.205.9.11:8489] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaL4U7LWOogAgHGh62SzBAAAAY8"]
[Sat Feb 28 22:14:44.447977 2026] [:error] [pid 39292:tid 39301] [client 4.205.9.11:46396] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaL4VKIAO5fN7BxyqcGTRAAAAMc"]
[Sat Feb 28 22:14:45.069739 2026] [:error] [pid 39184:tid 39222] [client 4.205.9.11:38853] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaL4VVtZF9Zd_U7easDhEwAAAEM"]
[Sat Feb 28 22:14:45.544739 2026] [:error] [pid 11791:tid 11793] [client 4.205.9.11:56203] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aaL4VWuX5e1Q32gqxH3WHwAAAQA"]
[Sat Feb 28 22:14:46.374333 2026] [:error] [pid 11791:tid 11794] [client 4.205.9.11:8479] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaL4VmuX5e1Q32gqxH3WIgAAAQE"]
[Sat Feb 28 22:14:47.181602 2026] [:error] [pid 39185:tid 39250] [client 4.205.9.11:52315] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaL4VxVE-FfM89u7BQavtAAAAIQ"]
[Sat Feb 28 22:14:47.864036 2026] [:error] [pid 39184:tid 39240] [client 4.205.9.11:52315] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaL4V1tZF9Zd_U7easDhGwAAAFU"]
[Sat Feb 28 22:14:48.492263 2026] [:error] [pid 39183:tid 39215] [client 4.205.9.11:50217] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aaL4WBCf4HvhVePw3LaADQAAABc"]
[Sat Feb 28 22:14:49.379840 2026] [:error] [pid 39183:tid 39206] [client 4.205.9.11:56208] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aaL4WRCf4HvhVePw3LaAEQAAAA4"]
[Sat Feb 28 22:14:49.955580 2026] [:error] [pid 39183:tid 39211] [client 4.205.9.11:50231] [client 4.205.9.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aaL4WRCf4HvhVePw3LaAFAAAABM"]
[Sat Feb 28 22:14:50.559472 2026] [:error] [pid 39184:tid 39241] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Sat Feb 28 22:14:50.770038 2026] [:error] [pid 39184:tid 39239] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/62ix02bk.php
[Sat Feb 28 22:14:51.006027 2026] [:error] [pid 39184:tid 39242] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/wdf.php
[Sat Feb 28 22:14:51.226030 2026] [:error] [pid 39184:tid 39233] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/f6ijmjpa.php
[Sat Feb 28 22:14:51.438088 2026] [:error] [pid 39184:tid 39235] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_jVML8V37.php
[Sat Feb 28 22:14:51.656997 2026] [:error] [pid 39184:tid 39227] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/4wj632p1.php
[Sat Feb 28 22:14:51.870279 2026] [:error] [pid 39184:tid 39224] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Sat Feb 28 22:14:52.079696 2026] [:error] [pid 39184:tid 39234] [client 4.205.9.11:52289] File does not exist: /usr/local/apache/htdocs/suspended-page/e31hmf9b.php
[Sat Feb 28 22:42:51.488278 2026] [:error] [pid 39183:tid 39202] [client 20.151.205.221:27939] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaL-6xCf4HvhVePw3LahaQAAAAo"]
[Sat Feb 28 22:42:52.327386 2026] [:error] [pid 52460:tid 52470] [client 20.151.205.221:27795] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaL-7LLWOogAgHGh62TGnwAAAYc"]
[Sat Feb 28 22:42:53.148242 2026] [:error] [pid 39183:tid 39195] [client 20.151.205.221:27916] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaL-7RCf4HvhVePw3LahcwAAAAM"]
[Sat Feb 28 22:42:53.970592 2026] [:error] [pid 39183:tid 39210] [client 20.151.205.221:27962] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaL-7RCf4HvhVePw3LaheAAAABI"]
[Sun Mar 01 00:14:27.946512 2026] [:error] [pid 22194:tid 22211] [client 13.71.191.191:62405] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Mar 01 00:14:28.163321 2026] [:error] [pid 22194:tid 22215] [client 13.71.191.191:62405] File does not exist: /usr/local/apache/htdocs/suspended-page/combined.php
[Sun Mar 01 00:14:28.826849 2026] [:error] [pid 22194:tid 22220] [client 13.71.191.191:62405] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/index.php"] [unique_id "aaMUZH6mbajs3bzQGyvHRAAAAVg"]
[Sun Mar 01 00:14:35.328626 2026] [:error] [pid 39183:tid 39194] [client 13.71.191.191:62352] File does not exist: /usr/local/apache/htdocs/suspended-page/wf.php
[Sun Mar 01 00:14:35.543923 2026] [:error] [pid 39183:tid 39195] [client 13.71.191.191:62352] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/termps.php"] [unique_id "aaMUaxCf4HvhVePw3LYaqQAAAAM"]
[Sun Mar 01 00:14:48.016997 2026] [:error] [pid 49763:tid 49771] [client 13.71.191.191:61155] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/capabilities1.php"] [unique_id "aaMUeLTHSOG_yf2PpqFD-wAAAcU"]
[Sun Mar 01 00:14:50.811701 2026] [:error] [pid 39183:tid 39194] [client 13.71.191.191:62443] File does not exist: /usr/local/apache/htdocs/suspended-page/vcard.php
[Sun Mar 01 00:14:51.164161 2026] [:error] [pid 39183:tid 39194] [client 13.71.191.191:62443] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "aaMUexCf4HvhVePw3LYa1AAAAAI"]
[Sun Mar 01 00:14:53.950464 2026] [:error] [pid 49763:tid 49776] [client 13.71.191.191:61124] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "aaMUfbTHSOG_yf2PpqFEKQAAAco"]
[Sun Mar 01 00:14:54.556821 2026] [:error] [pid 39183:tid 39208] [client 13.71.191.191:61152] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "aaMUfhCf4HvhVePw3LYa2wAAABA"]
[Sun Mar 01 00:14:55.196460 2026] [:error] [pid 39183:tid 39207] [client 13.71.191.191:61138] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "aaMUfxCf4HvhVePw3LYa3gAAAA8"]
[Sun Mar 01 00:14:56.608157 2026] [:error] [pid 11791:tid 11793] [client 13.71.191.191:62376] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/preferences/admin-ajax.php"] [unique_id "aaMUgGuX5e1Q32gqxH302gAAAQA"]
[Sun Mar 01 00:14:57.581845 2026] [:error] [pid 39183:tid 39213] [client 13.71.191.191:62398] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "aaMUgRCf4HvhVePw3LYa5wAAABU"]
[Sun Mar 01 00:14:58.658914 2026] [:error] [pid 39184:tid 39236] [client 13.71.191.191:62406] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "aaMUgltZF9Zd_U7easAXNAAAAFE"]
[Sun Mar 01 00:14:59.611242 2026] [:error] [pid 49763:tid 49775] [client 13.71.191.191:62358] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "aaMUg7THSOG_yf2PpqFEUAAAAck"]
[Sun Mar 01 00:15:00.213888 2026] [:error] [pid 39183:tid 39205] [client 13.71.191.191:62450] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "aaMUhBCf4HvhVePw3LYa8QAAAA0"]
[Sun Mar 01 00:15:00.711489 2026] [:error] [pid 49763:tid 49778] [client 13.71.191.191:62432] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/cache.cleaner.php"] [unique_id "aaMUhLTHSOG_yf2PpqFEXgAAAcw"]
[Sun Mar 01 00:15:01.691024 2026] [:error] [pid 52460:tid 52486] [client 13.71.191.191:61128] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/cache.cleaner.php"] [unique_id "aaMUhbLWOogAgHGh62QKMwAAAZc"]
[Sun Mar 01 00:15:02.527726 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:62383] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/cache.cleaner.php"] [unique_id "aaMUhrTHSOG_yf2PpqFEcgAAAcg"]
[Sun Mar 01 00:15:03.079091 2026] [:error] [pid 49763:tid 49766] [client 13.71.191.191:61141] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/cache.cleaner.php"] [unique_id "aaMUh7THSOG_yf2PpqFEewAAAcA"]
[Sun Mar 01 00:15:03.572915 2026] [:error] [pid 49763:tid 49784] [client 13.71.191.191:28020] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/ourLB.php"] [unique_id "aaMUh7THSOG_yf2PpqFEgAAAAdI"]
[Sun Mar 01 00:15:04.142992 2026] [:error] [pid 49763:tid 49788] [client 13.71.191.191:62344] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb2434353s/index.php"] [unique_id "aaMUiLTHSOG_yf2PpqFEhgAAAdY"]
[Sun Mar 01 00:15:04.610914 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:61151] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb2434353s/index.php"] [unique_id "aaMUiLTHSOG_yf2PpqFEjAAAAc8"]
[Sun Mar 01 00:15:05.216352 2026] [:error] [pid 39183:tid 39210] [client 13.71.191.191:61165] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb2434353s/index.php"] [unique_id "aaMUiRCf4HvhVePw3LYa-wAAABI"]
[Sun Mar 01 00:15:05.752064 2026] [:error] [pid 22194:tid 22206] [client 13.71.191.191:27968] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb2434353s/index.php"] [unique_id "aaMUiX6mbajs3bzQGyvHWAAAAUo"]
[Sun Mar 01 00:15:06.376439 2026] [:error] [pid 39183:tid 39213] [client 13.71.191.191:28001] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/bolster-theme/include/lang_upload.php"] [unique_id "aaMUihCf4HvhVePw3LYbAgAAABU"]
[Sun Mar 01 00:15:06.858720 2026] [:error] [pid 49763:tid 49778] [client 13.71.191.191:62444] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/bolster-theme/include/lang_upload.php"] [unique_id "aaMUirTHSOG_yf2PpqFEmQAAAcw"]
[Sun Mar 01 00:15:07.398524 2026] [:error] [pid 22194:tid 22203] [client 13.71.191.191:61120] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/bolster-theme/include/lang_upload.php"] [unique_id "aaMUi36mbajs3bzQGyvHWQAAAUc"]
[Sun Mar 01 00:15:07.943947 2026] [:error] [pid 22194:tid 22198] [client 13.71.191.191:27998] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/bolster-theme/include/lang_upload.php"] [unique_id "aaMUi36mbajs3bzQGyvHWgAAAUI"]
[Sun Mar 01 00:15:08.411057 2026] [:error] [pid 49763:tid 49777] [client 13.71.191.191:61153] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sundax.Php"] [unique_id "aaMUjLTHSOG_yf2PpqFEnQAAAcs"]
[Sun Mar 01 00:15:08.900934 2026] [:error] [pid 49763:tid 49775] [client 13.71.191.191:62408] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sundax.Php"] [unique_id "aaMUjLTHSOG_yf2PpqFEoQAAAck"]
[Sun Mar 01 00:15:09.637440 2026] [:error] [pid 39183:tid 39214] [client 13.71.191.191:61090] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sundax.Php"] [unique_id "aaMUjRCf4HvhVePw3LYbFwAAABY"]
[Sun Mar 01 00:15:10.309347 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:28028] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sundax.Php"] [unique_id "aaMUjrTHSOG_yf2PpqFEsQAAAc8"]
[Sun Mar 01 00:15:10.910717 2026] [:error] [pid 39184:tid 39239] [client 13.71.191.191:28003] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/pages.php"] [unique_id "aaMUjltZF9Zd_U7easAXSQAAAFQ"]
[Sun Mar 01 00:15:11.807713 2026] [:error] [pid 39183:tid 39210] [client 13.71.191.191:61160] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/pages.php"] [unique_id "aaMUjxCf4HvhVePw3LYbJAAAABI"]
[Sun Mar 01 00:15:12.833267 2026] [:error] [pid 52460:tid 52463] [client 13.71.191.191:62449] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/pages.php"] [unique_id "aaMUkLLWOogAgHGh62QKSwAAAYA"]
[Sun Mar 01 00:15:13.697738 2026] [:error] [pid 39183:tid 39201] [client 13.71.191.191:28019] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/pages.php"] [unique_id "aaMUkRCf4HvhVePw3LYbKgAAAAk"]
[Sun Mar 01 00:15:14.373291 2026] [:error] [pid 39292:tid 39306] [client 13.71.191.191:27988] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/item.php"] [unique_id "aaMUkqIAO5fN7BxyqcG5iQAAAMw"]
[Sun Mar 01 00:15:14.963198 2026] [:error] [pid 52460:tid 52474] [client 13.71.191.191:61143] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/item.php"] [unique_id "aaMUkrLWOogAgHGh62QKUwAAAYs"]
[Sun Mar 01 00:15:15.711767 2026] [:error] [pid 39292:tid 39301] [client 13.71.191.191:59772] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/item.php"] [unique_id "aaMUk6IAO5fN7BxyqcG5igAAAMc"]
[Sun Mar 01 00:15:16.519870 2026] [:error] [pid 39292:tid 39297] [client 13.71.191.191:61130] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/item.php"] [unique_id "aaMUlKIAO5fN7BxyqcG5jQAAAMM"]
[Sun Mar 01 00:15:17.224043 2026] [:error] [pid 39184:tid 39223] [client 13.71.191.191:62340] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "aaMUlVtZF9Zd_U7easAXVwAAAEQ"]
[Sun Mar 01 00:15:17.895263 2026] [:error] [pid 49763:tid 49767] [client 13.71.191.191:62382] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "aaMUlbTHSOG_yf2PpqFE5QAAAcE"]
[Sun Mar 01 00:15:18.582153 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:59770] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "aaMUlrTHSOG_yf2PpqFE6wAAAcI"]
[Sun Mar 01 00:15:19.250760 2026] [:error] [pid 39183:tid 39213] [client 13.71.191.191:62371] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "aaMUlxCf4HvhVePw3LYbOgAAABU"]
[Sun Mar 01 00:15:19.842405 2026] [:error] [pid 52460:tid 52481] [client 13.71.191.191:62380] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qpglkpgm.php"] [unique_id "aaMUl7LWOogAgHGh62QKZgAAAZI"]
[Sun Mar 01 00:15:21.016358 2026] [:error] [pid 52460:tid 52478] [client 13.71.191.191:28023] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qpglkpgm.php"] [unique_id "aaMUmbLWOogAgHGh62QKbQAAAY8"]
[Sun Mar 01 00:15:21.829484 2026] [:error] [pid 49763:tid 49788] [client 13.71.191.191:62457] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qpglkpgm.php"] [unique_id "aaMUmbTHSOG_yf2PpqFFBAAAAdY"]
[Sun Mar 01 00:15:22.732089 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:61142] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qpglkpgm.php"] [unique_id "aaMUmrTHSOG_yf2PpqFFDQAAAcg"]
[Sun Mar 01 00:15:24.793260 2026] [:error] [pid 39183:tid 39210] [client 13.71.191.191:61066] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMUnBCf4HvhVePw3LYbQgAAABI"]
[Sun Mar 01 00:15:25.442513 2026] [:error] [pid 49763:tid 49766] [client 13.71.191.191:27990] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMUnbTHSOG_yf2PpqFFKQAAAcA"]
[Sun Mar 01 00:15:26.283844 2026] [:error] [pid 39183:tid 39203] [client 13.71.191.191:27969] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMUnhCf4HvhVePw3LYbRAAAAAs"]
[Sun Mar 01 00:15:27.268986 2026] [:error] [pid 39292:tid 39297] [client 13.71.191.191:62463] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMUn6IAO5fN7BxyqcG5oAAAAMM"]
[Sun Mar 01 00:15:27.781941 2026] [:error] [pid 39183:tid 39193] [client 13.71.191.191:62424] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maint/jp.php"] [unique_id "aaMUnxCf4HvhVePw3LYbTQAAAAE"]
[Sun Mar 01 00:15:28.360109 2026] [:error] [pid 49763:tid 49766] [client 13.71.191.191:28010] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maint/jp.php"] [unique_id "aaMUoLTHSOG_yf2PpqFFPQAAAcA"]
[Sun Mar 01 00:15:30.046467 2026] [:error] [pid 52460:tid 52484] [client 13.71.191.191:62363] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maint/jp.php"] [unique_id "aaMUorLWOogAgHGh62QKhgAAAZU"]
[Sun Mar 01 00:15:30.669230 2026] [:error] [pid 52460:tid 52482] [client 13.71.191.191:62462] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maint/jp.php"] [unique_id "aaMUorLWOogAgHGh62QKigAAAZM"]
[Sun Mar 01 00:15:31.367742 2026] [:error] [pid 49763:tid 49783] [client 13.71.191.191:62366] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/rafosul.php"] [unique_id "aaMUo7THSOG_yf2PpqFFUwAAAdE"]
[Sun Mar 01 00:15:32.052768 2026] [:error] [pid 49763:tid 49772] [client 13.71.191.191:62361] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/rafosul.php"] [unique_id "aaMUpLTHSOG_yf2PpqFFVgAAAcY"]
[Sun Mar 01 00:15:32.656686 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:62403] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/rafosul.php"] [unique_id "aaMUpLTHSOG_yf2PpqFFXgAAAc8"]
[Sun Mar 01 00:15:33.514413 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:62442] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/rafosul.php"] [unique_id "aaMUpbTHSOG_yf2PpqFFbAAAAcg"]
[Sun Mar 01 00:15:34.239498 2026] [:error] [pid 49763:tid 49783] [client 13.71.191.191:27974] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/commands/webix.php"] [unique_id "aaMUprTHSOG_yf2PpqFFcwAAAdE"]
[Sun Mar 01 00:15:35.010944 2026] [:error] [pid 49763:tid 49790] [client 13.71.191.191:62455] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php/shell.php/text.php"] [unique_id "aaMUp7THSOG_yf2PpqFFfgAAAdg"]
[Sun Mar 01 00:15:35.927305 2026] [:error] [pid 11791:tid 11805] [client 13.71.191.191:61158] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php/shell.php/text.php"] [unique_id "aaMUp2uX5e1Q32gqxH30_AAAAQw"]
[Sun Mar 01 00:15:37.326249 2026] [:error] [pid 11791:tid 11812] [client 13.71.191.191:62374] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php/shell.php/text.php"] [unique_id "aaMUqWuX5e1Q32gqxH30_QAAARM"]
[Sun Mar 01 00:15:38.357582 2026] [:error] [pid 49763:tid 49783] [client 13.71.191.191:28024] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php/shell.php/text.php"] [unique_id "aaMUqrTHSOG_yf2PpqFFmQAAAdE"]
[Sun Mar 01 00:15:39.376604 2026] [:error] [pid 22194:tid 22205] [client 13.71.191.191:28025] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/fm.php"] [unique_id "aaMUq36mbajs3bzQGyvHZQAAAUk"]
[Sun Mar 01 00:15:41.677674 2026] [:error] [pid 52460:tid 52468] [client 13.71.191.191:62435] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/fm.php"] [unique_id "aaMUrbLWOogAgHGh62QKqgAAAYU"]
[Sun Mar 01 00:15:42.552842 2026] [:error] [pid 52460:tid 52485] [client 13.71.191.191:62440] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/fm.php"] [unique_id "aaMUrrLWOogAgHGh62QKswAAAZY"]
[Sun Mar 01 00:15:43.508980 2026] [:error] [pid 39185:tid 39250] [client 13.71.191.191:28012] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/fm.php"] [unique_id "aaMUrxVE-FfM89u7BQbGjQAAAIQ"]
[Sun Mar 01 00:15:45.418182 2026] [:error] [pid 39292:tid 39315] [client 13.71.191.191:27972] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/gmxwbau/hzwttmff.php"] [unique_id "aaMUsaIAO5fN7BxyqcG5tgAAANU"]
[Sun Mar 01 00:15:47.361875 2026] [:error] [pid 39183:tid 39202] [client 13.71.191.191:62378] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/gmxwbau/hzwttmff.php"] [unique_id "aaMUsxCf4HvhVePw3LYbgwAAAAo"]
[Sun Mar 01 00:15:48.566752 2026] [:error] [pid 39183:tid 39199] [client 13.71.191.191:62420] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/gmxwbau/hzwttmff.php"] [unique_id "aaMUtBCf4HvhVePw3LYbjAAAAAc"]
[Sun Mar 01 00:15:49.520294 2026] [:error] [pid 39183:tid 39192] [client 13.71.191.191:59704] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/gmxwbau/hzwttmff.php"] [unique_id "aaMUtRCf4HvhVePw3LYbkgAAAAA"]
[Sun Mar 01 00:15:51.265467 2026] [:error] [pid 52460:tid 52483] [client 13.71.191.191:62425] File does not exist: /usr/local/apache/htdocs/suspended-page/WSO-Enigma.php
[Sun Mar 01 00:15:51.765660 2026] [:error] [pid 52460:tid 52480] [client 13.71.191.191:62425] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/gif.php"] [unique_id "aaMUt7LWOogAgHGh62QKzQAAAZE"]
[Sun Mar 01 00:15:52.484163 2026] [:error] [pid 39184:tid 39220] [client 13.71.191.191:61168] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/block/moon.php"] [unique_id "aaMUuFtZF9Zd_U7easAXgwAAAEE"]
[Sun Mar 01 00:15:53.748500 2026] [:error] [pid 39183:tid 39201] [client 13.71.191.191:62413] File does not exist: /usr/local/apache/htdocs/suspended-page/fnyeltio.php
[Sun Mar 01 00:15:53.963127 2026] [:error] [pid 39183:tid 39209] [client 13.71.191.191:62413] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/class.engine.php"] [unique_id "aaMUuRCf4HvhVePw3LYbowAAABE"]
[Sun Mar 01 00:15:54.497280 2026] [:error] [pid 39183:tid 39198] [client 13.71.191.191:27996] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/format-library/admin.php"] [unique_id "aaMUuhCf4HvhVePw3LYbpgAAAAY"]
[Sun Mar 01 00:15:55.128789 2026] [:error] [pid 39183:tid 39199] [client 13.71.191.191:27979] File does not exist: /usr/local/apache/htdocs/suspended-page/affiliate_manager.php
[Sun Mar 01 00:15:55.582514 2026] [:error] [pid 39183:tid 39200] [client 13.71.191.191:27979] File does not exist: /usr/local/apache/htdocs/suspended-page/duck.php
[Sun Mar 01 00:15:55.800193 2026] [:error] [pid 39183:tid 39213] [client 13.71.191.191:27979] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Sun Mar 01 00:15:56.273629 2026] [:error] [pid 39183:tid 39198] [client 13.71.191.191:27979] File does not exist: /usr/local/apache/htdocs/suspended-page/pu.php
[Sun Mar 01 00:15:56.529901 2026] [:error] [pid 39183:tid 39196] [client 13.71.191.191:27979] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/js/foter.php"] [unique_id "aaMUvBCf4HvhVePw3LYbtwAAAAQ"]
[Sun Mar 01 00:15:57.057537 2026] [:error] [pid 49763:tid 49786] [client 13.71.191.191:62438] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/js/foter.php"] [unique_id "aaMUvbTHSOG_yf2PpqFF1QAAAdQ"]
[Sun Mar 01 00:15:57.756688 2026] [:error] [pid 52460:tid 52477] [client 13.71.191.191:61180] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/js/foter.php"] [unique_id "aaMUvbLWOogAgHGh62QK3AAAAY4"]
[Sun Mar 01 00:15:58.464927 2026] [:error] [pid 52460:tid 52467] [client 13.71.191.191:61154] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/contao/js/foter.php"] [unique_id "aaMUvrLWOogAgHGh62QK4QAAAYQ"]
[Sun Mar 01 00:15:59.244168 2026] [:error] [pid 49763:tid 49777] [client 13.71.191.191:62431] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/editor/tinyfilemanager.php"] [unique_id "aaMUv7THSOG_yf2PpqFF5QAAAcs"]
[Sun Mar 01 00:15:59.945620 2026] [:error] [pid 49763:tid 49775] [client 13.71.191.191:62389] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/404.php"] [unique_id "aaMUv7THSOG_yf2PpqFF6AAAAck"]
[Sun Mar 01 00:16:00.882664 2026] [:error] [pid 39292:tid 39305] [client 13.71.191.191:61163] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/wp-2018.php"] [unique_id "aaMUwKIAO5fN7BxyqcG52AAAAMs"]
[Sun Mar 01 00:16:01.817992 2026] [:error] [pid 49763:tid 49787] [client 13.71.191.191:28007] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/wp-2018.php"] [unique_id "aaMUwbTHSOG_yf2PpqFF8wAAAdU"]
[Sun Mar 01 00:16:02.473133 2026] [:error] [pid 49763:tid 49769] [client 13.71.191.191:61100] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/wp-2018.php"] [unique_id "aaMUwrTHSOG_yf2PpqFGCAAAAcM"]
[Sun Mar 01 00:16:03.202473 2026] [:error] [pid 49763:tid 49767] [client 13.71.191.191:62411] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/wp-2018.php"] [unique_id "aaMUw7THSOG_yf2PpqFGDAAAAcE"]
[Sun Mar 01 00:16:04.279162 2026] [:error] [pid 49763:tid 49770] [client 13.71.191.191:62459] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/aioseoextensions/file.php"] [unique_id "aaMUxLTHSOG_yf2PpqFGFgAAAcQ"]
[Sun Mar 01 00:16:05.284785 2026] [:error] [pid 49763:tid 49773] [client 13.71.191.191:62355] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/aioseoextensions/file.php"] [unique_id "aaMUxbTHSOG_yf2PpqFGIgAAAcc"]
[Sun Mar 01 00:16:13.318871 2026] [:error] [pid 39183:tid 39216] [client 13.71.191.191:27970] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/aioseoextensions/file.php"] [unique_id "aaMUzRCf4HvhVePw3LYb1QAAABg"]
[Sun Mar 01 00:16:15.194242 2026] [:error] [pid 49763:tid 49784] [client 13.71.191.191:27980] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/aioseoextensions/file.php"] [unique_id "aaMUz7THSOG_yf2PpqFGlQAAAdI"]
[Sun Mar 01 00:16:16.490132 2026] [:error] [pid 52460:tid 52470] [client 13.71.191.191:62351] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wordpress3cll/up.php"] [unique_id "aaMU0LLWOogAgHGh62QLBwAAAYc"]
[Sun Mar 01 00:16:18.331584 2026] [:error] [pid 49763:tid 49766] [client 13.71.191.191:61171] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wordpress3cll/up.php"] [unique_id "aaMU0rTHSOG_yf2PpqFGsQAAAcA"]
[Sun Mar 01 00:16:19.244527 2026] [:error] [pid 39183:tid 39214] [client 13.71.191.191:62390] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wordpress3cll/up.php"] [unique_id "aaMU0xCf4HvhVePw3LYb-AAAABY"]
[Sun Mar 01 00:16:21.569705 2026] [:error] [pid 39183:tid 39202] [client 13.71.191.191:27994] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wordpress3cll/up.php"] [unique_id "aaMU1RCf4HvhVePw3LYcCgAAAAo"]
[Sun Mar 01 00:16:24.558595 2026] [:error] [pid 39183:tid 39212] [client 13.71.191.191:62447] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/news_event/1.php7"] [unique_id "aaMU2BCf4HvhVePw3LYcHwAAABQ"]
[Sun Mar 01 00:16:25.381184 2026] [:error] [pid 22194:tid 22214] [client 13.71.191.191:62388] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/news_event/1.php7"] [unique_id "aaMU2X6mbajs3bzQGyvHbgAAAVI"]
[Sun Mar 01 00:16:26.256044 2026] [:error] [pid 39183:tid 39194] [client 13.71.191.191:27971] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/news_event/1.php7"] [unique_id "aaMU2hCf4HvhVePw3LYcKwAAAAI"]
[Sun Mar 01 00:16:27.359806 2026] [:error] [pid 39292:tid 39317] [client 13.71.191.191:61067] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/news_event/1.php7"] [unique_id "aaMU26IAO5fN7BxyqcG55wAAANc"]
[Sun Mar 01 00:16:27.893673 2026] [:error] [pid 52460:tid 52473] [client 13.71.191.191:61136] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer-4.2.3-en.php"] [unique_id "aaMU27LWOogAgHGh62QLEgAAAYo"]
[Sun Mar 01 00:16:28.404327 2026] [:error] [pid 52460:tid 52470] [client 13.71.191.191:61105] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer-4.2.3-en.php"] [unique_id "aaMU3LLWOogAgHGh62QLFQAAAYc"]
[Sun Mar 01 00:16:28.926646 2026] [:error] [pid 49763:tid 49782] [client 13.71.191.191:27993] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer-4.2.3-en.php"] [unique_id "aaMU3LTHSOG_yf2PpqFG9QAAAdA"]
[Sun Mar 01 00:16:29.434809 2026] [:error] [pid 52460:tid 52483] [client 13.71.191.191:62454] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer-4.2.3-en.php"] [unique_id "aaMU3bLWOogAgHGh62QLGQAAAZQ"]
[Sun Mar 01 00:16:30.022615 2026] [:error] [pid 39183:tid 39195] [client 13.71.191.191:62461] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blocks/tinyfilemanager.php"] [unique_id "aaMU3hCf4HvhVePw3LYcQAAAAAM"]
[Sun Mar 01 00:16:30.726683 2026] [:error] [pid 39183:tid 39207] [client 13.71.191.191:61076] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blocks/tinyfilemanager.php"] [unique_id "aaMU3hCf4HvhVePw3LYcRwAAAA8"]
[Sun Mar 01 00:16:31.336109 2026] [:error] [pid 39183:tid 39200] [client 13.71.191.191:61176] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blocks/tinyfilemanager.php"] [unique_id "aaMU3xCf4HvhVePw3LYcSwAAAAg"]
[Sun Mar 01 00:16:32.051306 2026] [:error] [pid 39183:tid 39199] [client 13.71.191.191:62350] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blocks/tinyfilemanager.php"] [unique_id "aaMU4BCf4HvhVePw3LYcUwAAAAc"]
[Sun Mar 01 00:16:32.568974 2026] [:error] [pid 49763:tid 49783] [client 13.71.191.191:28017] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aaMU4LTHSOG_yf2PpqFHCgAAAdE"]
[Sun Mar 01 00:16:33.083124 2026] [:error] [pid 49763:tid 49776] [client 13.71.191.191:27989] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aaMU4bTHSOG_yf2PpqFHEAAAAco"]
[Sun Mar 01 00:16:33.999785 2026] [:error] [pid 49763:tid 49787] [client 13.71.191.191:27985] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aaMU4bTHSOG_yf2PpqFHFgAAAdU"]
[Sun Mar 01 00:16:34.681310 2026] [:error] [pid 49763:tid 49773] [client 13.71.191.191:61149] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "aaMU4rTHSOG_yf2PpqFHIgAAAcc"]
[Sun Mar 01 00:16:35.310038 2026] [:error] [pid 49763:tid 49777] [client 13.71.191.191:62401] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-simplepie.php"] [unique_id "aaMU47THSOG_yf2PpqFHKwAAAcs"]
[Sun Mar 01 00:16:35.896869 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:59726] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wpsml-sys.php"] [unique_id "aaMU47THSOG_yf2PpqFHOAAAAcI"]
[Sun Mar 01 00:16:36.701736 2026] [:error] [pid 49763:tid 49771] [client 13.71.191.191:62386] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wpsml-sys.php"] [unique_id "aaMU5LTHSOG_yf2PpqFHQAAAAcU"]
[Sun Mar 01 00:16:38.586546 2026] [:error] [pid 39184:tid 39226] [client 13.71.191.191:62460] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wpsml-sys.php"] [unique_id "aaMU5ltZF9Zd_U7easAX6QAAAEc"]
[Sun Mar 01 00:16:40.643863 2026] [:error] [pid 39184:tid 39221] [client 13.71.191.191:58960] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wpsml-sys.php"] [unique_id "aaMU6FtZF9Zd_U7easAX7AAAAEI"]
[Sun Mar 01 00:16:42.353229 2026] [:error] [pid 39183:tid 39204] [client 13.71.191.191:27982] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/myflash/"] [unique_id "aaMU6hCf4HvhVePw3LYcdAAAAAw"]
[Sun Mar 01 00:16:44.093341 2026] [:error] [pid 11791:tid 11793] [client 13.71.191.191:27997] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/myflash/"] [unique_id "aaMU7GuX5e1Q32gqxH31JwAAAQA"]
[Sun Mar 01 00:16:45.243918 2026] [:error] [pid 39184:tid 39230] [client 13.71.191.191:62456] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/myflash/"] [unique_id "aaMU7VtZF9Zd_U7easAX9wAAAEs"]
[Sun Mar 01 00:16:47.141979 2026] [:error] [pid 39184:tid 39243] [client 13.71.191.191:61139] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/myflash/"] [unique_id "aaMU71tZF9Zd_U7easAX-wAAAFg"]
[Sun Mar 01 00:16:49.253724 2026] [:error] [pid 39183:tid 39206] [client 13.71.191.191:61094] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/rd.php"] [unique_id "aaMU8RCf4HvhVePw3LYcpgAAAA4"]
[Sun Mar 01 00:16:50.538205 2026] [:error] [pid 39183:tid 39195] [client 13.71.191.191:28009] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/rd.php"] [unique_id "aaMU8hCf4HvhVePw3LYcuQAAAAM"]
[Sun Mar 01 00:16:51.670466 2026] [:error] [pid 52460:tid 52480] [client 13.71.191.191:61133] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/rd.php"] [unique_id "aaMU87LWOogAgHGh62QLSAAAAZE"]
[Sun Mar 01 00:16:52.407051 2026] [:error] [pid 39183:tid 39200] [client 13.71.191.191:61159] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/rd.php"] [unique_id "aaMU9BCf4HvhVePw3LYc0AAAAAg"]
[Sun Mar 01 00:16:53.451493 2026] [:error] [pid 49763:tid 49770] [client 13.71.191.191:59683] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oload_classmap.php"] [unique_id "aaMU9bTHSOG_yf2PpqFHhgAAAcQ"]
[Sun Mar 01 00:16:54.218120 2026] [:error] [pid 39292:tid 39298] [client 13.71.191.191:62346] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oload_classmap.php"] [unique_id "aaMU9qIAO5fN7BxyqcG59QAAAMQ"]
[Sun Mar 01 00:16:54.715508 2026] [:error] [pid 39183:tid 39210] [client 13.71.191.191:61122] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oload_classmap.php"] [unique_id "aaMU9hCf4HvhVePw3LYc5gAAABI"]
[Sun Mar 01 00:16:55.295719 2026] [:error] [pid 39184:tid 39225] [client 13.71.191.191:62429] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oload_classmap.php"] [unique_id "aaMU91tZF9Zd_U7easAYHgAAAEY"]
[Sun Mar 01 00:16:55.882263 2026] [:error] [pid 39292:tid 39317] [client 13.71.191.191:62423] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/spin.php"] [unique_id "aaMU96IAO5fN7BxyqcG5-QAAANc"]
[Sun Mar 01 00:16:56.685701 2026] [:error] [pid 39292:tid 39310] [client 13.71.191.191:61112] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize//parx.php"] [unique_id "aaMU-KIAO5fN7BxyqcG5_wAAANA"]
[Sun Mar 01 00:16:57.753431 2026] [:error] [pid 49763:tid 49789] [client 13.71.191.191:62417] File does not exist: /usr/local/apache/htdocs/suspended-page/transaction_history.php
[Sun Mar 01 00:16:58.438730 2026] [:error] [pid 49763:tid 49766] [client 13.71.191.191:62417] File does not exist: /usr/local/apache/htdocs/suspended-page/dqbayyrz.php
[Sun Mar 01 00:16:58.657833 2026] [:error] [pid 49763:tid 49775] [client 13.71.191.191:62417] [client 13.71.191.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/input.php"] [unique_id "aaMU-rTHSOG_yf2PpqFHmwAAAck"]
[Sun Mar 01 00:17:00.684045 2026] [:error] [pid 39183:tid 39209] [client 13.71.191.191:61084] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "aaMU_BCf4HvhVePw3LYdBwAAABE"]
[Sun Mar 01 00:17:01.374283 2026] [:error] [pid 49763:tid 49790] [client 13.71.191.191:61145] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "aaMU_bTHSOG_yf2PpqFHogAAAdg"]
[Sun Mar 01 00:17:02.011377 2026] [:error] [pid 52460:tid 52486] [client 13.71.191.191:62367] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "aaMU_rLWOogAgHGh62QLiQAAAZc"]
[Sun Mar 01 00:17:02.767283 2026] [:error] [pid 39184:tid 39231] [client 13.71.191.191:61137] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "aaMU_ltZF9Zd_U7easAYdQAAAEw"]
[Sun Mar 01 00:17:03.530326 2026] [:error] [pid 39184:tid 39232] [client 13.71.191.191:28026] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aaMU_1tZF9Zd_U7easAYhQAAAE0"]
[Sun Mar 01 00:17:04.402635 2026] [:error] [pid 39184:tid 39224] [client 13.71.191.191:61166] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aaMVAFtZF9Zd_U7easAYjwAAAEU"]
[Sun Mar 01 00:17:05.131448 2026] [:error] [pid 49763:tid 49782] [client 13.71.191.191:61059] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aaMVAbTHSOG_yf2PpqFHqAAAAdA"]
[Sun Mar 01 00:17:05.915724 2026] [:error] [pid 52460:tid 52474] [client 13.71.191.191:61169] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aaMVAbLWOogAgHGh62QLlgAAAYs"]
[Sun Mar 01 00:17:06.708655 2026] [:error] [pid 39184:tid 39242] [client 13.71.191.191:61058] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaMVAltZF9Zd_U7easAYpgAAAFc"]
[Sun Mar 01 00:17:07.552061 2026] [:error] [pid 49763:tid 49788] [client 13.71.191.191:59658] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaMVA7THSOG_yf2PpqFHswAAAdY"]
[Sun Mar 01 00:17:08.358786 2026] [:error] [pid 39292:tid 39313] [client 13.71.191.191:59757] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaMVBKIAO5fN7BxyqcG6EwAAANM"]
[Sun Mar 01 00:17:08.913207 2026] [:error] [pid 52460:tid 52470] [client 13.71.191.191:27973] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aaMVBLLWOogAgHGh62QLowAAAYc"]
[Sun Mar 01 00:17:09.551712 2026] [:error] [pid 52460:tid 52479] [client 13.71.191.191:62441] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/shell.php"] [unique_id "aaMVBbLWOogAgHGh62QLpwAAAZA"]
[Sun Mar 01 00:17:10.035806 2026] [:error] [pid 52460:tid 52474] [client 13.71.191.191:59670] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/shell.php"] [unique_id "aaMVBrLWOogAgHGh62QLqgAAAYs"]
[Sun Mar 01 00:17:10.860560 2026] [:error] [pid 49763:tid 49766] [client 13.71.191.191:28016] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/shell.php"] [unique_id "aaMVBrTHSOG_yf2PpqFHvwAAAcA"]
[Sun Mar 01 00:17:12.016091 2026] [:error] [pid 39292:tid 39311] [client 13.71.191.191:61167] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/shell.php"] [unique_id "aaMVCKIAO5fN7BxyqcG6GQAAANE"]
[Sun Mar 01 00:17:14.509668 2026] [:error] [pid 52460:tid 52482] [client 13.71.191.191:28000] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mrbmppbo.php"] [unique_id "aaMVCrLWOogAgHGh62QLtwAAAZM"]
[Sun Mar 01 00:17:15.473673 2026] [:error] [pid 39185:tid 39252] [client 13.71.191.191:62338] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mrbmppbo.php"] [unique_id "aaMVCxVE-FfM89u7BQbG0gAAAIY"]
[Sun Mar 01 00:17:17.028815 2026] [:error] [pid 52460:tid 52470] [client 13.71.191.191:27996] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mrbmppbo.php"] [unique_id "aaMVDbLWOogAgHGh62QLxQAAAYc"]
[Sun Mar 01 00:17:18.355082 2026] [:error] [pid 39184:tid 39240] [client 13.71.191.191:59745] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mrbmppbo.php"] [unique_id "aaMVDltZF9Zd_U7easAZOQAAAFU"]
[Sun Mar 01 00:17:21.256645 2026] [:error] [pid 52460:tid 52485] [client 13.71.191.191:59680] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/mfw-activity-logger/csv-uploads/TitaniumEx.php"] [unique_id "aaMVEbLWOogAgHGh62QL0wAAAZY"]
[Sun Mar 01 00:17:23.630160 2026] [:error] [pid 49763:tid 49786] [client 13.71.191.191:58313] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/mfw-activity-logger/csv-uploads/TitaniumEx.php"] [unique_id "aaMVE7THSOG_yf2PpqFH4AAAAdQ"]
[Sun Mar 01 00:17:25.326089 2026] [:error] [pid 49763:tid 49767] [client 13.71.191.191:62396] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/mfw-activity-logger/csv-uploads/TitaniumEx.php"] [unique_id "aaMVFbTHSOG_yf2PpqFH6wAAAcE"]
[Sun Mar 01 00:17:26.842101 2026] [:error] [pid 52460:tid 52482] [client 13.71.191.191:62356] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/mfw-activity-logger/csv-uploads/TitaniumEx.php"] [unique_id "aaMVFrLWOogAgHGh62QL8gAAAZM"]
[Sun Mar 01 00:17:27.578816 2026] [:error] [pid 52460:tid 52483] [client 13.71.191.191:59651] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaMVF7LWOogAgHGh62QL-AAAAZQ"]
[Sun Mar 01 00:17:28.254220 2026] [:error] [pid 52460:tid 52486] [client 13.71.191.191:62343] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaMVGLLWOogAgHGh62QL-gAAAZc"]
[Sun Mar 01 00:17:28.917430 2026] [:error] [pid 52460:tid 52467] [client 13.71.191.191:61140] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaMVGLLWOogAgHGh62QMAAAAAYQ"]
[Sun Mar 01 00:17:29.552342 2026] [:error] [pid 39184:tid 39235] [client 13.71.191.191:59743] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaMVGVtZF9Zd_U7easAZcQAAAFA"]
[Sun Mar 01 00:17:30.330866 2026] [:error] [pid 39183:tid 39212] [client 13.71.191.191:62348] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db/phpmyadmin3/index.php"] [unique_id "aaMVGhCf4HvhVePw3LYdFgAAABQ"]
[Sun Mar 01 00:17:30.901158 2026] [:error] [pid 39183:tid 39201] [client 13.71.191.191:62359] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db/phpmyadmin3/index.php"] [unique_id "aaMVGhCf4HvhVePw3LYdHAAAAAk"]
[Sun Mar 01 00:17:31.538564 2026] [:error] [pid 49763:tid 49782] [client 13.71.191.191:59762] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db/phpmyadmin3/index.php"] [unique_id "aaMVG7THSOG_yf2PpqFH9wAAAdA"]
[Sun Mar 01 00:17:32.072637 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:62433] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db/phpmyadmin3/index.php"] [unique_id "aaMVHLTHSOG_yf2PpqFH-QAAAcg"]
[Sun Mar 01 00:17:32.593234 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:27999] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaMVHLTHSOG_yf2PpqFH_gAAAcI"]
[Sun Mar 01 00:17:33.187987 2026] [:error] [pid 52460:tid 52475] [client 13.71.191.191:62395] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaMVHbLWOogAgHGh62QMEQAAAYw"]
[Sun Mar 01 00:17:33.815921 2026] [:error] [pid 52460:tid 52476] [client 13.71.191.191:62387] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaMVHbLWOogAgHGh62QMFAAAAY0"]
[Sun Mar 01 00:17:34.450954 2026] [:error] [pid 39184:tid 39223] [client 13.71.191.191:62445] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaMVHltZF9Zd_U7easAZggAAAEQ"]
[Sun Mar 01 00:17:35.152626 2026] [:error] [pid 39292:tid 39296] [client 13.71.191.191:59766] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aaMVH6IAO5fN7BxyqcG6UAAAAMI"]
[Sun Mar 01 00:17:35.813510 2026] [:error] [pid 52460:tid 52466] [client 13.71.191.191:61125] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aaMVH7LWOogAgHGh62QMGwAAAYM"]
[Sun Mar 01 00:17:36.473273 2026] [:error] [pid 52460:tid 52469] [client 13.71.191.191:62364] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aaMVILLWOogAgHGh62QMIQAAAYY"]
[Sun Mar 01 00:17:37.064790 2026] [:error] [pid 52460:tid 52487] [client 13.71.191.191:59666] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/content.php"] [unique_id "aaMVIbLWOogAgHGh62QMKgAAAZg"]
[Sun Mar 01 00:17:37.896692 2026] [:error] [pid 49763:tid 49771] [client 13.71.191.191:62360] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/three-column-screen-layout/db.php"] [unique_id "aaMVIbTHSOG_yf2PpqFIFQAAAcU"]
[Sun Mar 01 00:17:38.732417 2026] [:error] [pid 49763:tid 49788] [client 13.71.191.191:61170] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/three-column-screen-layout/db.php"] [unique_id "aaMVIrTHSOG_yf2PpqFIHgAAAdY"]
[Sun Mar 01 00:17:39.345060 2026] [:error] [pid 39184:tid 39229] [client 13.71.191.191:62384] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/three-column-screen-layout/db.php"] [unique_id "aaMVI1tZF9Zd_U7easAZmgAAAEo"]
[Sun Mar 01 00:17:40.304845 2026] [:error] [pid 52460:tid 52479] [client 13.71.191.191:62392] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/three-column-screen-layout/db.php"] [unique_id "aaMVJLLWOogAgHGh62QMUQAAAZA"]
[Sun Mar 01 00:17:42.775402 2026] [:error] [pid 52460:tid 52478] [client 13.71.191.191:62379] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMVJrLWOogAgHGh62QMaQAAAY8"]
[Sun Mar 01 00:17:43.512328 2026] [:error] [pid 39184:tid 39219] [client 13.71.191.191:62369] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMVJ1tZF9Zd_U7easAZogAAAEA"]
[Sun Mar 01 00:17:44.190178 2026] [:error] [pid 39184:tid 39229] [client 13.71.191.191:28011] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMVKFtZF9Zd_U7easAZpQAAAEo"]
[Sun Mar 01 00:17:45.159210 2026] [:error] [pid 49763:tid 49776] [client 13.71.191.191:62399] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms.php"] [unique_id "aaMVKbTHSOG_yf2PpqFIMAAAAco"]
[Sun Mar 01 00:17:47.000321 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:61181] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aaMVKrTHSOG_yf2PpqFINgAAAcI"]
[Sun Mar 01 00:17:47.995020 2026] [:error] [pid 52460:tid 52482] [client 13.71.191.191:59734] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aaMVK7LWOogAgHGh62QMmAAAAZM"]
[Sun Mar 01 00:17:48.919174 2026] [:error] [pid 52460:tid 52466] [client 13.71.191.191:61110] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aaMVLLLWOogAgHGh62QMowAAAYM"]
[Sun Mar 01 00:17:49.575755 2026] [:error] [pid 39183:tid 39215] [client 13.71.191.191:61106] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aaMVLRCf4HvhVePw3LYdOwAAABc"]
[Sun Mar 01 00:17:50.217783 2026] [:error] [pid 52460:tid 52482] [client 13.71.191.191:61107] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/duck.php"] [unique_id "aaMVLrLWOogAgHGh62QMrQAAAZM"]
[Sun Mar 01 00:17:50.868413 2026] [:error] [pid 22194:tid 22201] [client 13.71.191.191:62451] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/duck.php"] [unique_id "aaMVLn6mbajs3bzQGyvHjQAAAUU"]
[Sun Mar 01 00:17:51.446461 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:59684] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/duck.php"] [unique_id "aaMVL7THSOG_yf2PpqFIQwAAAcI"]
[Sun Mar 01 00:17:52.696283 2026] [:error] [pid 39183:tid 39210] [client 13.71.191.191:62434] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/duck.php"] [unique_id "aaMVMBCf4HvhVePw3LYdQwAAABI"]
[Sun Mar 01 00:17:53.608502 2026] [:error] [pid 39183:tid 39206] [client 13.71.191.191:59659] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/contact.php"] [unique_id "aaMVMRCf4HvhVePw3LYdSAAAAA4"]
[Sun Mar 01 00:17:54.328170 2026] [:error] [pid 52460:tid 52482] [client 13.71.191.191:61183] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/contact.php"] [unique_id "aaMVMrLWOogAgHGh62QMvgAAAZM"]
[Sun Mar 01 00:17:54.871023 2026] [:error] [pid 39184:tid 39243] [client 13.71.191.191:58886] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/contact.php"] [unique_id "aaMVMltZF9Zd_U7easAZ9AAAAFg"]
[Sun Mar 01 00:17:55.448683 2026] [:error] [pid 39183:tid 39216] [client 13.71.191.191:61086] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/contact.php"] [unique_id "aaMVMxCf4HvhVePw3LYdSwAAABg"]
[Sun Mar 01 00:17:55.998987 2026] [:error] [pid 39292:tid 39303] [client 13.71.191.191:59007] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dqbayyrz.php"] [unique_id "aaMVM6IAO5fN7BxyqcG6aAAAAMk"]
[Sun Mar 01 00:17:56.599658 2026] [:error] [pid 39184:tid 39240] [client 13.71.191.191:61148] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dqbayyrz.php"] [unique_id "aaMVNFtZF9Zd_U7easAZ_AAAAFU"]
[Sun Mar 01 00:17:57.295902 2026] [:error] [pid 39184:tid 39243] [client 13.71.191.191:62364] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dqbayyrz.php"] [unique_id "aaMVNVtZF9Zd_U7easAaAwAAAFg"]
[Sun Mar 01 00:17:57.898619 2026] [:error] [pid 22194:tid 22220] [client 13.71.191.191:58952] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dqbayyrz.php"] [unique_id "aaMVNX6mbajs3bzQGyvHkgAAAVg"]
[Sun Mar 01 00:22:52.153837 2026] [:error] [pid 53600:tid 53621] [client 43.157.67.70:46146] [client 43.157.67.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaMWXA2UMRAYWtDB23Sa7QAAARI"]
[Sun Mar 01 01:01:16.792915 2026] [:error] [pid 31190:tid 31214] [client 20.63.83.162:64711] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaMfXBfvwGOholYpM1FjMAAAAMg"]
[Sun Mar 01 01:01:17.613373 2026] [:error] [pid 30798:tid 30903] [client 20.63.83.162:64740] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaMfXcBkD73gO8wTonZSEQAAAIQ"]
[Sun Mar 01 01:01:18.438823 2026] [:error] [pid 30798:tid 30923] [client 20.63.83.162:11949] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaMfXsBkD73gO8wTonZSJwAAAJc"]
[Sun Mar 01 01:01:19.273548 2026] [:error] [pid 30798:tid 30912] [client 20.63.83.162:64742] [client 20.63.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaMfX8BkD73gO8wTonZSNgAAAI0"]
[Sun Mar 01 01:52:19.457826 2026] [:error] [pid 7644:tid 7648] [client 20.220.144.87:65444] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaMrU_qeDUGmVAHX7VCjvAAAAUI"]
[Sun Mar 01 01:52:20.881484 2026] [:error] [pid 11920:tid 11930] [client 20.220.144.87:64884] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaMrVCzLNJUKxvBorrDOjgAAAYY"]
[Sun Mar 01 01:52:22.305971 2026] [:error] [pid 11920:tid 11947] [client 20.220.144.87:65485] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaMrVizLNJUKxvBorrDOkwAAAZc"]
[Sun Mar 01 01:52:23.724959 2026] [:error] [pid 30798:tid 30910] [client 20.220.144.87:64218] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaMrV8BkD73gO8wTonaH4QAAAIs"]
[Sun Mar 01 02:22:03.284719 2026] [:error] [pid 7644:tid 7658] [client 20.151.205.221:28493] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaMyS_qeDUGmVAHX7VCsnAAAAUw"]
[Sun Mar 01 02:22:04.103969 2026] [:error] [pid 53600:tid 53617] [client 20.151.205.221:28513] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaMyTA2UMRAYWtDB23T1MwAAAQ4"]
[Sun Mar 01 02:22:04.925600 2026] [:error] [pid 31190:tid 31229] [client 20.151.205.221:27979] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaMyTBfvwGOholYpM1GjdAAAANc"]
[Sun Mar 01 02:22:05.743147 2026] [:error] [pid 30795:tid 30816] [client 20.151.205.221:28495] [client 20.151.205.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aaMyTWuI44IL94Zgti_LUgAAAAg"]
[Sun Mar 01 03:04:10.061110 2026] [:error] [pid 53600:tid 53625] [client 1.15.52.154:53272] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaM8Kg2UMRAYWtDB23QDIAAAARY"]
[Sun Mar 01 03:32:09.134950 2026] [:error] [pid 30798:tid 30905] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Sun Mar 01 03:32:09.346090 2026] [:error] [pid 30798:tid 30922] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sun Mar 01 03:32:09.554710 2026] [:error] [pid 30798:tid 30899] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sun Mar 01 03:32:09.763237 2026] [:error] [pid 30798:tid 30900] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Mar 01 03:32:09.973312 2026] [:error] [pid 30798:tid 30904] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Sun Mar 01 03:32:10.182570 2026] [:error] [pid 30798:tid 30924] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 03:32:10.604783 2026] [:error] [pid 30798:tid 30913] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sun Mar 01 03:32:10.814901 2026] [:error] [pid 30798:tid 30922] [client 20.63.83.113:18591] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Mar 01 03:32:11.228705 2026] [:error] [pid 30798:tid 30900] [client 20.63.83.113:18591] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aaNCu8BkD73gO8wTonbxIwAAAIE"]
[Sun Mar 01 03:32:11.640763 2026] [:error] [pid 11920:tid 11946] [client 20.63.83.113:60715] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aaNCuyzLNJUKxvBorrBJBQAAAZY"]
[Sun Mar 01 03:32:12.051006 2026] [:error] [pid 31190:tid 31207] [client 20.63.83.113:56431] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aaNCvBfvwGOholYpM1HS5AAAAME"]
[Sun Mar 01 03:32:12.460180 2026] [:error] [pid 31190:tid 31228] [client 20.63.83.113:53040] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aaNCvBfvwGOholYpM1HS6wAAANY"]
[Sun Mar 01 03:32:12.869141 2026] [:error] [pid 31190:tid 31215] [client 20.63.83.113:44351] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynz.PhP7"] [unique_id "aaNCvBfvwGOholYpM1HS8AAAAMk"]
[Sun Mar 01 03:32:13.280206 2026] [:error] [pid 11920:tid 11939] [client 20.63.83.113:33478] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynz.PhP7"] [unique_id "aaNCvSzLNJUKxvBorrBJCgAAAY8"]
[Sun Mar 01 03:32:13.692302 2026] [:error] [pid 11920:tid 11945] [client 20.63.83.113:56414] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynz.PhP7"] [unique_id "aaNCvSzLNJUKxvBorrBJDQAAAZU"]
[Sun Mar 01 03:32:14.108580 2026] [:error] [pid 11920:tid 11941] [client 20.63.83.113:60719] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynz.PhP7"] [unique_id "aaNCvizLNJUKxvBorrBJEAAAAZE"]
[Sun Mar 01 03:32:14.530727 2026] [:error] [pid 11920:tid 11946] [client 20.63.83.113:60673] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aaNCvizLNJUKxvBorrBJFQAAAZY"]
[Sun Mar 01 03:32:14.954949 2026] [:error] [pid 30798:tid 30913] [client 20.63.83.113:59238] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aaNCvsBkD73gO8wTonbxLAAAAI4"]
[Sun Mar 01 03:32:15.365599 2026] [:error] [pid 30798:tid 30903] [client 20.63.83.113:33972] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aaNCv8BkD73gO8wTonbxLgAAAIQ"]
[Sun Mar 01 03:32:15.773907 2026] [:error] [pid 30795:tid 30832] [client 20.63.83.113:53039] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "aaNCv2uI44IL94Zgti_ZcQAAABg"]
[Sun Mar 01 03:32:16.182273 2026] [:error] [pid 11920:tid 11931] [client 20.63.83.113:42070] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packed.php"] [unique_id "aaNCwCzLNJUKxvBorrBJHgAAAYc"]
[Sun Mar 01 03:32:16.590967 2026] [:error] [pid 30798:tid 30907] [client 20.63.83.113:53010] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packed.php"] [unique_id "aaNCwMBkD73gO8wTonbxMwAAAIg"]
[Sun Mar 01 03:32:17.002533 2026] [:error] [pid 30798:tid 30923] [client 20.63.83.113:44289] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packed.php"] [unique_id "aaNCwcBkD73gO8wTonbxNgAAAJc"]
[Sun Mar 01 03:32:17.417593 2026] [:error] [pid 11920:tid 11929] [client 20.63.83.113:64859] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packed.php"] [unique_id "aaNCwSzLNJUKxvBorrBJKAAAAYU"]
[Sun Mar 01 03:32:17.830845 2026] [:error] [pid 11920:tid 11930] [client 20.63.83.113:53010] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aaNCwSzLNJUKxvBorrBJLgAAAYY"]
[Sun Mar 01 03:32:18.239488 2026] [:error] [pid 11920:tid 11935] [client 20.63.83.113:33956] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aaNCwizLNJUKxvBorrBJLwAAAYs"]
[Sun Mar 01 03:32:18.647730 2026] [:error] [pid 30798:tid 30913] [client 20.63.83.113:30896] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aaNCwsBkD73gO8wTonbxOwAAAI4"]
[Sun Mar 01 03:32:19.072135 2026] [:error] [pid 30798:tid 30902] [client 20.63.83.113:53031] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "aaNCw8BkD73gO8wTonbxPwAAAIM"]
[Sun Mar 01 03:32:19.484890 2026] [:error] [pid 53600:tid 53605] [client 20.63.83.113:60699] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaNCww2UMRAYWtDB23QPmQAAAQI"]
[Sun Mar 01 03:32:19.894082 2026] [:error] [pid 31190:tid 31215] [client 20.63.83.113:33939] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaNCwxfvwGOholYpM1HTCgAAAMk"]
[Sun Mar 01 03:32:20.311804 2026] [:error] [pid 30798:tid 30904] [client 20.63.83.113:31508] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaNCxMBkD73gO8wTonbxQwAAAIU"]
[Sun Mar 01 03:32:20.725340 2026] [:error] [pid 31190:tid 31212] [client 20.63.83.113:33936] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aaNCxBfvwGOholYpM1HTDQAAAMY"]
[Sun Mar 01 03:32:21.141989 2026] [:error] [pid 11920:tid 11931] [client 20.63.83.113:59201] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aaNCxSzLNJUKxvBorrBJRwAAAYc"]
[Sun Mar 01 03:32:21.558341 2026] [:error] [pid 7644:tid 7669] [client 20.63.83.113:64886] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aaNCxfqeDUGmVAHX7VC_-AAAAVc"]
[Sun Mar 01 03:32:21.971248 2026] [:error] [pid 11920:tid 11926] [client 20.63.83.113:59204] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aaNCxSzLNJUKxvBorrBJUAAAAYI"]
[Sun Mar 01 03:32:22.380095 2026] [:error] [pid 11920:tid 11929] [client 20.63.83.113:53032] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aaNCxizLNJUKxvBorrBJUwAAAYU"]
[Sun Mar 01 03:32:22.792910 2026] [:error] [pid 31190:tid 31215] [client 20.63.83.113:44314] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aaNCxhfvwGOholYpM1HTGAAAAMk"]
[Sun Mar 01 03:32:23.215984 2026] [:error] [pid 31190:tid 31224] [client 20.63.83.113:44339] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aaNCxxfvwGOholYpM1HTGgAAANI"]
[Sun Mar 01 03:32:23.625452 2026] [:error] [pid 31190:tid 31222] [client 20.63.83.113:44327] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aaNCxxfvwGOholYpM1HTHgAAANA"]
[Sun Mar 01 03:32:24.047300 2026] [:error] [pid 11920:tid 11943] [client 20.63.83.113:42081] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass.php"] [unique_id "aaNCyCzLNJUKxvBorrBJZQAAAZM"]
[Sun Mar 01 03:32:24.472214 2026] [:error] [pid 30797:tid 30889] [client 20.63.83.113:1670] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aaNCyPQmcmSQL-3rvLAbPwAAAFI"]
[Sun Mar 01 03:32:24.889159 2026] [:error] [pid 30798:tid 30913] [client 20.63.83.113:48321] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aaNCyMBkD73gO8wTonbxSAAAAI4"]
[Sun Mar 01 03:32:25.308230 2026] [:error] [pid 11920:tid 11941] [client 20.63.83.113:56398] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aaNCySzLNJUKxvBorrBJcgAAAZE"]
[Sun Mar 01 03:32:25.718849 2026] [:error] [pid 30798:tid 30903] [client 20.63.83.113:53053] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "aaNCycBkD73gO8wTonbxSgAAAIQ"]
[Sun Mar 01 03:56:12.830303 2026] [:error] [pid 14637:tid 14653] [client 159.89.80.217:63463] [client 159.89.80.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.80.217, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaNIXKQVOOrpA69ImxnMsQAAAQs"]
[Sun Mar 01 03:56:12.834168 2026] [:error] [pid 14637:tid 14653] [client 159.89.80.217:63463] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 01 03:56:13.278660 2026] [:error] [pid 10288:tid 10386] [client 159.89.80.217:63727] [client 159.89.80.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.80.217, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaNIXRppLTIhFPGINgcJhAAAABQ"], referer: https://www.google.com/
[Sun Mar 01 03:56:13.283692 2026] [:error] [pid 10288:tid 10386] [client 159.89.80.217:63727] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/
[Sun Mar 01 03:56:17.853349 2026] [:error] [pid 10297:tid 10421] [client 159.89.80.217:64548] [client 159.89.80.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.80.217, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aaNIYX5a9rbvPss2V0MvFgAAAIA"], referer: https://www.google.com/search?q=wordpress
[Sun Mar 01 03:56:17.859030 2026] [:error] [pid 10297:tid 10421] [client 159.89.80.217:64548] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.google.com/search?q=wordpress
[Sun Mar 01 03:56:18.277938 2026] [:error] [pid 10508:tid 10527] [client 159.89.80.217:64784] [client 159.89.80.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.80.217, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aaNIYvnZ4Ocsz9vZs1NnVgAAAM8"], referer: https://www.facebook.com/
[Sun Mar 01 03:56:18.281897 2026] [:error] [pid 10508:tid 10527] [client 159.89.80.217:64784] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.facebook.com/
[Sun Mar 01 04:41:10.243432 2026] [:error] [pid 21159:tid 21237] [client 43.153.113.127:43796] [client 43.153.113.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaNS5uLi3ouy1NZIkgoMAwAAAJA"]
[Sun Mar 01 08:00:27.036667 2026] [:error] [pid 21156:tid 21179] [client 85.203.15.150:49809] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Mar 01 09:34:12.750021 2026] [:error] [pid 34286:tid 34312] [client 182.42.105.85:39755] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaOXlHPFxpCIhHW6XmmYegAAApg"]
[Sun Mar 01 11:20:40.811225 2026] [:error] [pid 34785:tid 34802] [client 43.157.46.118:56820] [client 43.157.46.118] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaOwiIC4dBNEGEcJx-OAvAAAAw8"]
[Sun Mar 01 13:31:55.993344 2026] [:error] [pid 42619:tid 42645] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/signon.php
[Sun Mar 01 13:31:56.314525 2026] [:error] [pid 42619:tid 42638] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Sun Mar 01 13:31:56.525821 2026] [:error] [pid 42619:tid 42629] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Mar 01 13:31:56.746715 2026] [:error] [pid 42619:tid 42634] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Sun Mar 01 13:31:56.954769 2026] [:error] [pid 42619:tid 42642] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Mar 01 13:31:57.163621 2026] [:error] [pid 42619:tid 42629] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xmlmp.php
[Sun Mar 01 13:31:57.385139 2026] [:error] [pid 42619:tid 42625] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Sun Mar 01 13:31:57.605185 2026] [:error] [pid 42619:tid 42643] [client 20.104.206.150:18413] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configssss.php
[Sun Mar 01 13:31:57.811207 2026] [:error] [pid 42619:tid 42638] [client 20.104.206.150:18413] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss1.php"] [unique_id "aaPPTR_zUXcYaZE4AOdghwAAAVE"]
[Sun Mar 01 13:31:58.448743 2026] [:error] [pid 37032:tid 37057] [client 20.104.206.150:18310] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss1.php"] [unique_id "aaPPTuu0U4o7eSImsVTzHwAAAZc"]
[Sun Mar 01 13:31:59.468767 2026] [:error] [pid 40750:tid 40766] [client 20.104.206.150:18310] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss1.php"] [unique_id "aaPPTwfBuk03yQKDyqvBDAAAAc0"]
[Sun Mar 01 13:32:00.579805 2026] [:error] [pid 42619:tid 42645] [client 20.104.206.150:18429] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss1.php"] [unique_id "aaPPUB_zUXcYaZE4AOdgmAAAAVg"]
[Sun Mar 01 13:32:01.450236 2026] [:error] [pid 42619:tid 42627] [client 20.104.206.150:18304] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ngif.php"] [unique_id "aaPPUR_zUXcYaZE4AOdgpgAAAUY"]
[Sun Mar 01 13:32:02.359535 2026] [:error] [pid 37032:tid 37054] [client 20.104.206.150:18311] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ngif.php"] [unique_id "aaPPUuu0U4o7eSImsVTzLgAAAZQ"]
[Sun Mar 01 13:32:02.873383 2026] [:error] [pid 37032:tid 37051] [client 20.104.206.150:18305] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ngif.php"] [unique_id "aaPPUuu0U4o7eSImsVTzMgAAAZE"]
[Sun Mar 01 13:32:03.808787 2026] [:error] [pid 37032:tid 37043] [client 20.104.206.150:18430] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ngif.php"] [unique_id "aaPPU-u0U4o7eSImsVTzOQAAAYk"]
[Sun Mar 01 13:32:04.588148 2026] [:error] [pid 37032:tid 37042] [client 20.104.206.150:18313] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss.php"] [unique_id "aaPPVOu0U4o7eSImsVTzRAAAAYg"]
[Sun Mar 01 13:32:05.800966 2026] [:error] [pid 41967:tid 41969] [client 20.104.206.150:18312] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss.php"] [unique_id "aaPPVYO1bqY181I02eFuVQAAAIA"]
[Sun Mar 01 13:32:06.455472 2026] [:error] [pid 42619:tid 42628] [client 20.104.206.150:18428] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss.php"] [unique_id "aaPPVh_zUXcYaZE4AOdgwAAAAUc"]
[Sun Mar 01 13:32:07.062446 2026] [:error] [pid 42619:tid 42627] [client 20.104.206.150:18414] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-configss.php"] [unique_id "aaPPVx_zUXcYaZE4AOdgxQAAAUY"]
[Sun Mar 01 13:32:07.671192 2026] [:error] [pid 41780:tid 41783] [client 20.104.206.150:18391] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "aaPPV8ONkVoocLIqzy3_0wAAA8A"]
[Sun Mar 01 13:32:08.347614 2026] [:error] [pid 41342:tid 41366] [client 20.104.206.150:18385] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "aaPPWI4iJ6RAS5CatDk7PQAAAhU"]
[Sun Mar 01 13:32:08.928306 2026] [:error] [pid 37032:tid 37050] [client 20.104.206.150:18376] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "aaPPWOu0U4o7eSImsVTzZwAAAZA"]
[Sun Mar 01 13:32:09.435454 2026] [:error] [pid 42619:tid 42628] [client 20.104.206.150:18407] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "aaPPWR_zUXcYaZE4AOdgywAAAUc"]
[Sun Mar 01 13:32:10.085028 2026] [:error] [pid 41780:tid 41793] [client 20.104.206.150:18408] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.phpa"] [unique_id "aaPPWsONkVoocLIqzy3_2QAAA8o"]
[Sun Mar 01 13:32:10.733894 2026] [:error] [pid 37032:tid 37054] [client 20.104.206.150:18370] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.phpa"] [unique_id "aaPPWuu0U4o7eSImsVTzcwAAAZQ"]
[Sun Mar 01 13:32:11.270799 2026] [:error] [pid 37032:tid 37039] [client 20.104.206.150:18339] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.phpa"] [unique_id "aaPPW-u0U4o7eSImsVTzdwAAAYU"]
[Sun Mar 01 13:32:11.709415 2026] [:error] [pid 37032:tid 37035] [client 20.104.206.150:18397] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.phpa"] [unique_id "aaPPW-u0U4o7eSImsVTzfwAAAYE"]
[Sun Mar 01 13:32:12.224083 2026] [:error] [pid 42619:tid 42637] [client 20.104.206.150:18400] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/defaults.php"] [unique_id "aaPPXB_zUXcYaZE4AOdg1AAAAVA"]
[Sun Mar 01 13:32:12.707687 2026] [:error] [pid 37032:tid 37047] [client 20.104.206.150:18316] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/defaults.php"] [unique_id "aaPPXOu0U4o7eSImsVTzhwAAAY0"]
[Sun Mar 01 13:32:13.371886 2026] [:error] [pid 37032:tid 37035] [client 20.104.206.150:18357] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/defaults.php"] [unique_id "aaPPXeu0U4o7eSImsVTzjwAAAYE"]
[Sun Mar 01 13:32:13.817031 2026] [:error] [pid 37032:tid 37054] [client 20.104.206.150:18427] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/defaults.php"] [unique_id "aaPPXeu0U4o7eSImsVTzkgAAAZQ"]
[Sun Mar 01 13:32:14.291484 2026] [:error] [pid 37032:tid 37038] [client 20.104.206.150:18260] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/im.php"] [unique_id "aaPPXuu0U4o7eSImsVTzlQAAAYQ"]
[Sun Mar 01 13:32:14.866569 2026] [:error] [pid 41780:tid 41792] [client 20.104.206.150:18378] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/im.php"] [unique_id "aaPPXsONkVoocLIqzy3_5AAAA8k"]
[Sun Mar 01 13:32:15.320700 2026] [:error] [pid 41780:tid 41798] [client 20.104.206.150:18320] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/im.php"] [unique_id "aaPPX8ONkVoocLIqzy3_6QAAA88"]
[Sun Mar 01 13:32:15.825820 2026] [:error] [pid 41780:tid 41790] [client 20.104.206.150:18345] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/im.php"] [unique_id "aaPPX8ONkVoocLIqzy3_7AAAA8c"]
[Sun Mar 01 13:32:16.611493 2026] [:error] [pid 42619:tid 42628] [client 20.104.206.150:18420] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments-post.php"] [unique_id "aaPPYB_zUXcYaZE4AOdg4gAAAUc"]
[Sun Mar 01 13:32:17.324070 2026] [:error] [pid 42619:tid 42624] [client 20.104.206.150:18394] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments-post.php"] [unique_id "aaPPYR_zUXcYaZE4AOdg6AAAAUM"]
[Sun Mar 01 13:32:18.325338 2026] [:error] [pid 41342:tid 41366] [client 20.104.206.150:18422] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments-post.php"] [unique_id "aaPPYo4iJ6RAS5CatDk7XAAAAhU"]
[Sun Mar 01 13:32:18.861457 2026] [:error] [pid 37032:tid 37038] [client 20.104.206.150:18426] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-comments-post.php"] [unique_id "aaPPYuu0U4o7eSImsVTztQAAAYQ"]
[Sun Mar 01 13:32:19.608827 2026] [:error] [pid 37032:tid 37036] [client 20.104.206.150:18334] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache-compat.php"] [unique_id "aaPPY-u0U4o7eSImsVTzuQAAAYI"]
[Sun Mar 01 13:32:20.451329 2026] [:error] [pid 37032:tid 37036] [client 20.104.206.150:18405] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache-compat.php"] [unique_id "aaPPZOu0U4o7eSImsVTzxAAAAYI"]
[Sun Mar 01 13:32:20.937759 2026] [:error] [pid 41780:tid 41793] [client 20.104.206.150:18430] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache-compat.php"] [unique_id "aaPPZMONkVoocLIqzy3_9wAAA8o"]
[Sun Mar 01 13:32:21.444179 2026] [:error] [pid 41967:tid 41982] [client 20.104.206.150:18356] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache-compat.php"] [unique_id "aaPPZYO1bqY181I02eFujAAAAI0"]
[Sun Mar 01 13:32:21.933925 2026] [:error] [pid 37032:tid 37057] [client 20.104.206.150:18384] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaPPZeu0U4o7eSImsVTzygAAAZc"]
[Sun Mar 01 13:32:22.646241 2026] [:error] [pid 37032:tid 37038] [client 20.104.206.150:18317] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaPPZuu0U4o7eSImsVTz0AAAAYQ"]
[Sun Mar 01 13:32:23.346925 2026] [:error] [pid 37032:tid 37036] [client 20.104.206.150:18248] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaPPZ-u0U4o7eSImsVTz2gAAAYI"]
[Sun Mar 01 13:32:23.874427 2026] [:error] [pid 42619:tid 42632] [client 20.104.206.150:18331] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fw.php"] [unique_id "aaPPZx_zUXcYaZE4AOdhCQAAAUs"]
[Sun Mar 01 13:32:24.433772 2026] [:error] [pid 41967:tid 41975] [client 20.104.206.150:18329] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaPPaIO1bqY181I02eFumwAAAIY"]
[Sun Mar 01 13:32:25.002523 2026] [:error] [pid 37032:tid 37042] [client 20.104.206.150:18326] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaPPaeu0U4o7eSImsVTz4gAAAYg"]
[Sun Mar 01 13:32:25.462336 2026] [:error] [pid 42619:tid 42622] [client 20.104.206.150:18404] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaPPaR_zUXcYaZE4AOdhGAAAAUE"]
[Sun Mar 01 13:32:25.988598 2026] [:error] [pid 37032:tid 37040] [client 20.104.206.150:18340] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/berlin.php"] [unique_id "aaPPaeu0U4o7eSImsVTz6wAAAYY"]
[Sun Mar 01 13:32:26.422342 2026] [:error] [pid 42619:tid 42642] [client 20.104.206.150:18368] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aaPPah_zUXcYaZE4AOdhHgAAAVU"]
[Sun Mar 01 13:32:26.888755 2026] [:error] [pid 41780:tid 41786] [client 20.104.206.150:18392] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aaPPasONkVoocLIqzy3_-QAAA8M"]
[Sun Mar 01 13:32:27.494865 2026] [:error] [pid 40750:tid 40775] [client 20.104.206.150:18409] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aaPPawfBuk03yQKDyqvBLwAAAdY"]
[Sun Mar 01 13:32:27.911646 2026] [:error] [pid 42619:tid 42635] [client 20.104.206.150:18315] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abe.php"] [unique_id "aaPPax_zUXcYaZE4AOdhKAAAAU4"]
[Sun Mar 01 13:32:28.391213 2026] [:error] [pid 37032:tid 37039] [client 20.104.206.150:18328] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aaPPbOu0U4o7eSImsVTz-AAAAYU"]
[Sun Mar 01 13:32:28.870027 2026] [:error] [pid 41967:tid 41974] [client 20.104.206.150:18416] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aaPPbIO1bqY181I02eFuogAAAIU"]
[Sun Mar 01 13:32:29.325751 2026] [:error] [pid 37032:tid 37040] [client 20.104.206.150:18375] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aaPPbeu0U4o7eSImsVTz-gAAAYY"]
[Sun Mar 01 13:32:29.796008 2026] [:error] [pid 37032:tid 37047] [client 20.104.206.150:18379] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/otuz1.php"] [unique_id "aaPPbeu0U4o7eSImsVTz_QAAAY0"]
[Sun Mar 01 13:32:30.307859 2026] [:error] [pid 37032:tid 37052] [client 20.104.206.150:18396] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aaPPbuu0U4o7eSImsVT0AgAAAZI"]
[Sun Mar 01 13:32:30.762528 2026] [:error] [pid 37032:tid 37038] [client 20.104.206.150:18350] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aaPPbuu0U4o7eSImsVT0BwAAAYQ"]
[Sun Mar 01 13:32:31.398533 2026] [:error] [pid 37032:tid 37040] [client 20.104.206.150:18319] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aaPPb-u0U4o7eSImsVT0DAAAAYY"]
[Sun Mar 01 13:32:31.853620 2026] [:error] [pid 42619:tid 42641] [client 20.104.206.150:18259] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-files.php"] [unique_id "aaPPbx_zUXcYaZE4AOdhNQAAAVQ"]
[Sun Mar 01 13:32:32.311696 2026] [:error] [pid 42619:tid 42645] [client 20.104.206.150:18241] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "aaPPcB_zUXcYaZE4AOdhOQAAAVg"]
[Sun Mar 01 13:32:32.860820 2026] [:error] [pid 37032:tid 37044] [client 20.104.206.150:18346] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "aaPPcOu0U4o7eSImsVT0FgAAAYo"]
[Sun Mar 01 13:32:33.915727 2026] [:error] [pid 42619:tid 42632] [client 20.104.206.150:18373] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "aaPPcR_zUXcYaZE4AOdhQwAAAUs"]
[Sun Mar 01 13:32:35.023300 2026] [:error] [pid 42619:tid 42632] [client 20.104.206.150:18355] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "aaPPcx_zUXcYaZE4AOdhSwAAAUs"]
[Sun Mar 01 13:32:35.940775 2026] [:error] [pid 42619:tid 42637] [client 20.104.206.150:18323] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aaPPcx_zUXcYaZE4AOdhUAAAAVA"]
[Sun Mar 01 13:32:36.702521 2026] [:error] [pid 42619:tid 42629] [client 20.104.206.150:18411] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aaPPdB_zUXcYaZE4AOdhVAAAAUg"]
[Sun Mar 01 13:32:37.458772 2026] [:error] [pid 38034:tid 38052] [client 20.104.206.150:18322] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aaPPdQxtfZjwlJok9K9ClAAAAQ4"]
[Sun Mar 01 13:32:38.169539 2026] [:error] [pid 42619:tid 42629] [client 20.104.206.150:18425] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/he.php"] [unique_id "aaPPdh_zUXcYaZE4AOdhYwAAAUg"]
[Sun Mar 01 13:32:39.004714 2026] [:error] [pid 37032:tid 37044] [client 20.104.206.150:18382] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aaPPd-u0U4o7eSImsVT0PQAAAYo"]
[Sun Mar 01 13:32:40.067895 2026] [:error] [pid 41967:tid 41986] [client 20.104.206.150:18377] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aaPPeIO1bqY181I02eFu7QAAAJE"]
[Sun Mar 01 13:32:40.715845 2026] [:error] [pid 38034:tid 38052] [client 20.104.206.150:18245] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aaPPeAxtfZjwlJok9K9CmQAAAQ4"]
[Sun Mar 01 13:32:41.367008 2026] [:error] [pid 42619:tid 42632] [client 20.104.206.150:18419] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cache.php"] [unique_id "aaPPeR_zUXcYaZE4AOdhcgAAAUs"]
[Sun Mar 01 13:32:42.088775 2026] [:error] [pid 37032:tid 37039] [client 20.104.206.150:18380] [client 20.104.206.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aaPPeuu0U4o7eSImsVT0TwAAAYU"]
[Sun Mar 01 13:32:42.824039 2026] [:error] [pid 42619:tid 42622] [client 20.104.206.150:18410] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "aaPPeh_zUXcYaZE4AOdhfQAAAUE"]
[Sun Mar 01 13:32:43.455475 2026] [:error] [pid 41967:tid 41980] [client 20.104.206.150:18390] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "aaPPe4O1bqY181I02eFu8gAAAIs"]
[Sun Mar 01 13:32:44.110031 2026] [:error] [pid 38034:tid 38038] [client 20.104.206.150:18330] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "aaPPfAxtfZjwlJok9K9CogAAAQI"]
[Sun Mar 01 13:32:44.787485 2026] [:error] [pid 38034:tid 38038] [client 20.104.206.150:18264] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog.php"] [unique_id "aaPPfAxtfZjwlJok9K9CpAAAAQI"]
[Sun Mar 01 13:32:45.548740 2026] [:error] [pid 37032:tid 37047] [client 20.104.206.150:18415] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog.php"] [unique_id "aaPPfeu0U4o7eSImsVT0ZwAAAY0"]
[Sun Mar 01 13:32:46.345296 2026] [:error] [pid 37032:tid 37052] [client 20.104.206.150:18423] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog.php"] [unique_id "aaPPfuu0U4o7eSImsVT0cQAAAZI"]
[Sun Mar 01 13:32:47.207000 2026] [:error] [pid 37032:tid 37056] [client 20.104.206.150:18335] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog.php"] [unique_id "aaPPf-u0U4o7eSImsVT0fAAAAZY"]
[Sun Mar 01 13:32:48.517572 2026] [:error] [pid 41342:tid 41353] [client 20.104.206.150:18324] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php7"] [unique_id "aaPPgI4iJ6RAS5CatDk7dAAAAgg"]
[Sun Mar 01 13:32:49.176074 2026] [:error] [pid 38034:tid 38052] [client 20.104.206.150:18351] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php7"] [unique_id "aaPPgQxtfZjwlJok9K9CvgAAAQ4"]
[Sun Mar 01 13:32:49.706492 2026] [:error] [pid 41780:tid 41799] [client 20.104.206.150:18314] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php7"] [unique_id "aaPPgcONkVoocLIqzy0AHgAAA9A"]
[Sun Mar 01 13:32:50.201589 2026] [:error] [pid 37032:tid 37052] [client 20.104.206.150:18381] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfanew.php7"] [unique_id "aaPPguu0U4o7eSImsVT0kQAAAZI"]
[Sun Mar 01 13:32:50.666270 2026] [:error] [pid 37032:tid 37056] [client 20.104.206.150:18361] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aaPPguu0U4o7eSImsVT0mAAAAZY"]
[Sun Mar 01 13:32:51.099061 2026] [:error] [pid 41967:tid 41976] [client 20.104.206.150:18266] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aaPPg4O1bqY181I02eFu-QAAAIc"]
[Sun Mar 01 13:32:51.541705 2026] [:error] [pid 41967:tid 41974] [client 20.104.206.150:18386] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aaPPg4O1bqY181I02eFu-gAAAIU"]
[Sun Mar 01 13:32:52.136171 2026] [:error] [pid 38034:tid 38052] [client 20.104.206.150:18332] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lufix.php"] [unique_id "aaPPhAxtfZjwlJok9K9CywAAAQ4"]
[Sun Mar 01 13:32:52.634046 2026] [:error] [pid 37032:tid 37056] [client 20.104.206.150:18337] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax-actions.php"] [unique_id "aaPPhOu0U4o7eSImsVT0qAAAAZY"]
[Sun Mar 01 13:32:53.192684 2026] [:error] [pid 37032:tid 37052] [client 20.104.206.150:18333] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax-actions.php"] [unique_id "aaPPheu0U4o7eSImsVT0sAAAAZI"]
[Sun Mar 01 13:32:53.737097 2026] [:error] [pid 37032:tid 37056] [client 20.104.206.150:18302] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax-actions.php"] [unique_id "aaPPheu0U4o7eSImsVT0uQAAAZY"]
[Sun Mar 01 13:32:54.197741 2026] [:error] [pid 41967:tid 41986] [client 20.104.206.150:18254] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax-actions.php"] [unique_id "aaPPhoO1bqY181I02eFu_wAAAJE"]
[Sun Mar 01 13:32:54.822986 2026] [:error] [pid 41967:tid 41975] [client 20.104.206.150:18327] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaPPhoO1bqY181I02eFvCQAAAIY"]
[Sun Mar 01 13:32:55.375182 2026] [:error] [pid 41780:tid 41784] [client 20.104.206.150:18240] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaPPh8ONkVoocLIqzy0AJAAAA8E"]
[Sun Mar 01 13:32:56.121182 2026] [:error] [pid 37032:tid 37038] [client 20.104.206.150:18306] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaPPiOu0U4o7eSImsVT0zAAAAYQ"]
[Sun Mar 01 13:32:56.847008 2026] [:error] [pid 41967:tid 41987] [client 20.104.206.150:18318] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaPPiIO1bqY181I02eFvFAAAAJI"]
[Sun Mar 01 13:32:57.650645 2026] [:error] [pid 41967:tid 41975] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Mar 01 13:32:57.857858 2026] [:error] [pid 41967:tid 41971] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Mar 01 13:32:58.065367 2026] [:error] [pid 41967:tid 41984] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/browse.php
[Sun Mar 01 13:32:58.272980 2026] [:error] [pid 41967:tid 41976] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Mar 01 13:32:58.480826 2026] [:error] [pid 41967:tid 41986] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/contact.php
[Sun Mar 01 13:32:58.687202 2026] [:error] [pid 41967:tid 41971] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/minik.php
[Sun Mar 01 13:32:58.901756 2026] [:error] [pid 41967:tid 41984] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Sun Mar 01 13:32:59.108555 2026] [:error] [pid 41967:tid 41975] [client 20.104.206.150:18270] File does not exist: /usr/local/apache/htdocs/suspended-page/upgrade.php
[Sun Mar 01 13:45:01.994538 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Mar 01 13:45:02.447560 2026] [:error] [pid 37032:tid 37053] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 01 13:45:02.889814 2026] [:error] [pid 37032:tid 37045] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Mar 01 13:45:03.325805 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Mar 01 13:45:03.891183 2026] [:error] [pid 37032:tid 37050] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Mar 01 13:45:04.309120 2026] [:error] [pid 37032:tid 37055] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Mar 01 13:45:04.744921 2026] [:error] [pid 37032:tid 37056] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 01 13:45:05.197103 2026] [:error] [pid 37032:tid 37046] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 13:45:06.350731 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Mar 01 13:45:07.187689 2026] [:error] [pid 37032:tid 37045] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Mar 01 13:45:07.816943 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Mar 01 13:45:08.237734 2026] [:error] [pid 37032:tid 37049] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 01 13:45:08.663222 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Mar 01 13:45:09.106819 2026] [:error] [pid 37032:tid 37056] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 01 13:45:09.845494 2026] [:error] [pid 37032:tid 37058] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Mar 01 13:45:10.276489 2026] [:error] [pid 37032:tid 37054] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Mar 01 13:45:10.755861 2026] [:error] [pid 37032:tid 37055] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Mar 01 13:45:11.194364 2026] [:error] [pid 37032:tid 37037] [client 45.67.97.2:47531] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Mar 01 13:45:18.838873 2026] [:error] [pid 37032:tid 37045] [client 45.67.97.2:47531] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaPSbuu0U4o7eSImsVT8TwAAAYs"]
[Sun Mar 01 13:45:22.382679 2026] [:error] [pid 41780:tid 41800] [client 45.67.97.19:24697] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaPScsONkVoocLIqzy0B2wAAA9E"]
[Sun Mar 01 13:45:26.070706 2026] [:error] [pid 38034:tid 38049] [client 45.67.97.2:23651] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Mar 01 13:45:28.597265 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.2:32571] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aaPSeOu0U4o7eSImsVT8lgAAAY4"]
[Sun Mar 01 13:45:30.684382 2026] [:error] [pid 41780:tid 41795] [client 45.67.97.195:57449] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 13:45:31.168748 2026] [:error] [pid 41780:tid 41803] [client 45.67.97.195:57449] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaPSe8ONkVoocLIqzy0B5wAAA9Q"]
[Sun Mar 01 13:45:33.365264 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.195:57741] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Mar 01 13:45:36.931025 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.195:57741] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaPSgAxtfZjwlJok9K9S6QAAARA"]
[Sun Mar 01 13:45:38.486859 2026] [:error] [pid 38241:tid 38247] [client 45.67.97.20:31787] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaPSgvKRPk6YnJBxw_z7vAAAAMM"]
[Sun Mar 01 13:45:39.505837 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.2:25901] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaPSg_KRPk6YnJBxw_z7wAAAAMI"]
[Sun Mar 01 13:45:40.498983 2026] [:error] [pid 44644:tid 44666] [client 45.67.97.2:56553] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaPShJ3RJaXMcw3y9V9H7QAAABM"]
[Sun Mar 01 13:45:41.344777 2026] [:error] [pid 38241:tid 38256] [client 45.67.97.195:45831] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaPShfKRPk6YnJBxw_z70QAAAMw"]
[Sun Mar 01 13:45:42.232758 2026] [:error] [pid 38241:tid 38256] [client 45.67.97.195:42909] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaPShvKRPk6YnJBxw_z72QAAAMw"]
[Sun Mar 01 13:45:45.064184 2026] [:error] [pid 41342:tid 41358] [client 45.67.97.20:54551] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaPSiY4iJ6RAS5CatDk9bQAAAg0"]
[Sun Mar 01 13:45:47.394687 2026] [:error] [pid 37032:tid 37043] [client 45.67.97.19:49331] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Mar 01 13:45:48.248938 2026] [:error] [pid 37032:tid 37037] [client 45.67.97.19:49331] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aaPSjOu0U4o7eSImsVT86wAAAYM"]
[Sun Mar 01 13:45:50.277697 2026] [:error] [pid 37032:tid 37037] [client 45.67.97.19:33181] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaPSjuu0U4o7eSImsVT8-gAAAYM"]
[Sun Mar 01 13:45:51.302378 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.195:47325] [client 45.67.97.195] ModSecurity: collection_store: Failed to exclusivly lock DBM file "/tmp/ip": Resource deadlock avoided [hostname "rejuva.au"] [uri "/index.html"] [unique_id "aaPSjwxtfZjwlJok9K9TRwAAARA"]
[Sun Mar 01 13:45:51.691853 2026] [:error] [pid 38034:tid 38037] [client 45.67.97.195:47325] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaPSjwxtfZjwlJok9K9TSgAAAQE"]
[Sun Mar 01 13:45:52.804538 2026] [:error] [pid 41967:tid 41988] [client 45.67.97.2:34249] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Mar 01 13:45:53.969332 2026] [:error] [pid 41967:tid 41988] [client 45.67.97.2:34249] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaPSkYO1bqY181I02eFzDwAAAJM"]
[Sun Mar 01 13:45:55.897514 2026] [:error] [pid 41967:tid 41987] [client 45.67.97.19:26241] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Mar 01 13:46:00.064902 2026] [:error] [pid 41967:tid 41989] [client 45.67.97.19:26241] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Mar 01 13:46:05.307817 2026] [:error] [pid 41967:tid 41992] [client 45.67.97.19:26241] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaPSnYO1bqY181I02eFzHgAAAJc"]
[Sun Mar 01 13:46:07.259563 2026] [:error] [pid 37032:tid 37038] [client 45.67.97.20:20333] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Sun Mar 01 13:46:07.717144 2026] [:error] [pid 37032:tid 37045] [client 45.67.97.20:20333] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaPSn-u0U4o7eSImsVT9JgAAAYs"]
[Sun Mar 01 13:46:08.931884 2026] [:error] [pid 38034:tid 38037] [client 45.67.97.20:26909] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Mar 01 13:46:09.995345 2026] [:error] [pid 38034:tid 38060] [client 45.67.97.20:26909] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaPSoQxtfZjwlJok9K9TfAAAARY"]
[Sun Mar 01 13:46:11.310895 2026] [:error] [pid 38034:tid 38061] [client 45.67.97.19:24951] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaPSowxtfZjwlJok9K9TgwAAARc"]
[Sun Mar 01 13:46:13.650223 2026] [:error] [pid 44644:tid 44663] [client 45.67.97.19:29791] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Mar 01 13:46:14.119265 2026] [:error] [pid 44644:tid 44663] [client 45.67.97.19:29791] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Mar 01 13:46:14.980038 2026] [:error] [pid 44644:tid 44663] [client 45.67.97.19:29791] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaPSpp3RJaXMcw3y9V9IawAAABA"]
[Sun Mar 01 13:46:16.625050 2026] [:error] [pid 41780:tid 41783] [client 45.67.97.195:35003] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaPSqMONkVoocLIqzy0CBQAAA8A"]
[Sun Mar 01 13:46:17.984186 2026] [:error] [pid 38241:tid 38264] [client 45.67.97.195:36789] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaPSqfKRPk6YnJBxw_z8qAAAANQ"]
[Sun Mar 01 13:46:18.896038 2026] [:error] [pid 44644:tid 44658] [client 45.67.97.19:32151] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaPSqp3RJaXMcw3y9V9IfQAAAAs"]
[Sun Mar 01 13:46:19.740232 2026] [:error] [pid 38034:tid 38043] [client 45.67.97.19:30165] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaPSqwxtfZjwlJok9K9TsQAAAQU"]
[Sun Mar 01 13:46:21.472144 2026] [:error] [pid 38241:tid 38250] [client 45.67.97.195:27133] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 01 13:46:21.969905 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.195:27133] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aaPSrfKRPk6YnJBxw_z8tAAAAMQ"]
[Sun Mar 01 13:46:23.399947 2026] [:error] [pid 40750:tid 40766] [client 45.67.97.2:24581] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aaPSrwfBuk03yQKDyqvCLgAAAc0"]
[Sun Mar 01 13:46:24.626440 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.19:29143] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaPSsOu0U4o7eSImsVT9NgAAAY4"]
[Sun Mar 01 13:46:26.695251 2026] [:error] [pid 38034:tid 38061] [client 45.67.97.195:34253] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Mar 01 13:46:27.536773 2026] [:error] [pid 38034:tid 38043] [client 45.67.97.195:34253] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Mar 01 13:46:29.495245 2026] [:error] [pid 38034:tid 38061] [client 45.67.97.195:34253] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aaPStQxtfZjwlJok9K9T_AAAARc"]
[Sun Mar 01 13:46:36.156249 2026] [:error] [pid 37032:tid 37040] [client 45.67.97.195:35251] [client 45.67.97.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.195, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaPSvOu0U4o7eSImsVT9TAAAAYY"]
[Sun Mar 01 13:46:37.512405 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.195:35251] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Sun Mar 01 13:46:45.392546 2026] [:error] [pid 37032:tid 37045] [client 45.67.97.195:35251] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Mar 01 13:46:46.575959 2026] [:error] [pid 37032:tid 37056] [client 45.67.97.195:35251] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Mar 01 13:46:55.845059 2026] [:error] [pid 37032:tid 37057] [client 45.67.97.195:35251] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaPSz-u0U4o7eSImsVT9dwAAAZc"]
[Sun Mar 01 13:47:00.061354 2026] [:error] [pid 41780:tid 41796] [client 45.67.97.20:36527] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Mar 01 13:47:01.550735 2026] [:error] [pid 41780:tid 41799] [client 45.67.97.20:36527] [client 45.67.97.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.20, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaPS1cONkVoocLIqzy0CfAAAA9A"]
[Sun Mar 01 13:47:05.656832 2026] [:error] [pid 41780:tid 41790] [client 45.67.97.20:36527] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aaPS2cONkVoocLIqzy0CfwAAA8c"]
[Sun Mar 01 13:47:14.152436 2026] [:error] [pid 38034:tid 38060] [client 45.67.97.20:47193] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 01 13:47:17.783052 2026] [:error] [pid 38034:tid 38049] [client 45.67.97.20:47193] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Sun Mar 01 13:47:20.496545 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.20:47193] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaPS6AxtfZjwlJok9K9VXQAAARA"]
[Sun Mar 01 13:47:23.017967 2026] [:error] [pid 42619:tid 42638] [client 45.67.97.19:39231] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Mar 01 13:47:27.704941 2026] [:error] [pid 42619:tid 42625] [client 45.67.97.19:39231] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Mar 01 13:47:30.920981 2026] [:error] [pid 42619:tid 42634] [client 45.67.97.19:39231] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Mar 01 13:47:33.754653 2026] [:error] [pid 42619:tid 42630] [client 45.67.97.19:39231] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Mar 01 13:47:35.206243 2026] [:error] [pid 42619:tid 42626] [client 45.67.97.19:39231] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaPS9x_zUXcYaZE4AOdodQAAAUU"]
[Sun Mar 01 13:47:36.929129 2026] [:error] [pid 37032:tid 37053] [client 45.67.97.195:24061] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Mar 01 13:47:37.367588 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.195:24061] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Mar 01 13:47:37.804452 2026] [:error] [pid 37032:tid 37058] [client 45.67.97.195:24061] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaPS-eu0U4o7eSImsVT95wAAAZg"]
[Sun Mar 01 13:47:39.089192 2026] [:error] [pid 41342:tid 41366] [client 45.67.97.195:63967] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Mar 01 13:47:40.173981 2026] [:error] [pid 41342:tid 41363] [client 45.67.97.195:63967] [client 45.67.97.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.195, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aaPS_I4iJ6RAS5CatDk95wAAAhI"]
[Sun Mar 01 13:47:40.631049 2026] [:error] [pid 41342:tid 41368] [client 45.67.97.195:63967] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaPS_I4iJ6RAS5CatDk96AAAAhc"]
[Sun Mar 01 13:48:03.402952 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.19:64015] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Mar 01 13:48:11.808309 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.19:64015] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Mar 01 13:48:13.328716 2026] [:error] [pid 44644:tid 44657] [client 45.67.97.19:64015] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaPTHZ3RJaXMcw3y9V9J4wAAAAo"]
[Sun Mar 01 13:48:15.704161 2026] [:error] [pid 38034:tid 38059] [client 45.67.97.2:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Mar 01 13:48:20.206179 2026] [:error] [pid 38034:tid 38051] [client 45.67.97.2:31525] [client 45.67.97.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaPTJAxtfZjwlJok9K9WcwAAAQ0"]
[Sun Mar 01 13:48:22.031773 2026] [:error] [pid 38034:tid 38059] [client 45.67.97.2:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Mar 01 13:48:23.610024 2026] [:error] [pid 38034:tid 38061] [client 45.67.97.2:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Mar 01 13:48:25.084285 2026] [:error] [pid 38034:tid 38049] [client 45.67.97.2:31525] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Mar 01 13:48:26.368181 2026] [:error] [pid 38034:tid 38060] [client 45.67.97.2:31525] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aaPTKgxtfZjwlJok9K9WkwAAARY"]
[Sun Mar 01 13:48:28.853884 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.20:34165] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Mar 01 13:48:31.798296 2026] [:error] [pid 38034:tid 38060] [client 45.67.97.195:40287] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aaPTLwxtfZjwlJok9K9WrAAAARY"]
[Sun Mar 01 13:48:33.148335 2026] [:error] [pid 38241:tid 38261] [client 45.67.97.19:34299] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Mar 01 13:48:33.566748 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.19:34299] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaPTMfKRPk6YnJBxw_z-YwAAANI"]
[Sun Mar 01 13:48:35.347589 2026] [:error] [pid 44644:tid 44658] [client 45.67.97.19:44493] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Mar 01 13:48:36.560226 2026] [:error] [pid 44644:tid 44666] [client 45.67.97.19:44863] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaPTNJ3RJaXMcw3y9V9KQQAAABM"]
[Sun Mar 01 13:48:37.455624 2026] [:error] [pid 41967:tid 41984] [client 45.67.97.20:53725] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaPTNYO1bqY181I02eFz0gAAAI8"]
[Sun Mar 01 13:48:38.385513 2026] [:error] [pid 38034:tid 38061] [client 45.67.97.195:62629] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Mar 01 13:48:39.601805 2026] [:error] [pid 38034:tid 38059] [client 45.67.97.20:60831] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Mar 01 13:48:42.997467 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.195:59763] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaPTOvKRPk6YnJBxw_z-gAAAAMQ"]
[Sun Mar 01 13:48:47.563155 2026] [:error] [pid 38034:tid 38059] [client 45.67.97.19:44145] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaPTPwxtfZjwlJok9K9XKQAAARU"]
[Sun Mar 01 13:48:51.454471 2026] [:error] [pid 37032:tid 37046] [client 45.67.97.195:65535] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aaPTQ-u0U4o7eSImsVT-gQAAAYw"]
[Sun Mar 01 13:48:52.504316 2026] [:error] [pid 38034:tid 38044] [client 45.67.97.2:39239] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Sun Mar 01 13:48:53.363767 2026] [:error] [pid 38034:tid 38060] [client 45.67.97.2:39239] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Mar 01 13:48:53.832497 2026] [:error] [pid 38034:tid 38045] [client 45.67.97.2:39239] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaPTRQxtfZjwlJok9K9XUgAAAQc"]
[Sun Mar 01 13:48:55.861222 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:46427] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Mar 01 13:48:58.691444 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:46427] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "aaPTSvKRPk6YnJBxw_z-0wAAANI"]
[Sun Mar 01 13:49:02.418918 2026] [:error] [pid 38241:tid 38250] [client 45.67.97.20:29801] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaPTTvKRPk6YnJBxw_z-3wAAAMY"]
[Sun Mar 01 13:49:05.235015 2026] [:error] [pid 41780:tid 41794] [client 45.67.97.2:63499] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 01 13:49:06.522440 2026] [:error] [pid 41780:tid 41806] [client 45.67.97.2:63499] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Mar 01 13:49:07.440832 2026] [:error] [pid 41780:tid 41805] [client 45.67.97.2:63499] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Mar 01 13:49:07.858734 2026] [:error] [pid 41780:tid 41795] [client 45.67.97.2:63499] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaPTU8ONkVoocLIqzy0C9AAAA8w"]
[Sun Mar 01 13:49:08.883641 2026] [:error] [pid 38241:tid 38250] [client 45.67.97.195:21055] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aaPTVPKRPk6YnJBxw_z_AAAAAMY"]
[Sun Mar 01 13:49:09.913128 2026] [:error] [pid 44644:tid 44663] [client 45.67.97.19:63123] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaPTVZ3RJaXMcw3y9V9KugAAABA"]
[Sun Mar 01 13:49:10.812674 2026] [:error] [pid 38034:tid 38060] [client 45.67.97.20:24771] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaPTVgxtfZjwlJok9K9X2QAAARY"]
[Sun Mar 01 13:49:11.811598 2026] [:error] [pid 42619:tid 42627] [client 45.67.97.195:42229] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Mar 01 13:49:12.298652 2026] [:error] [pid 42619:tid 42644] [client 45.67.97.195:42229] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaPTWB_zUXcYaZE4AOdo5QAAAVc"]
[Sun Mar 01 13:49:13.155833 2026] [:error] [pid 40750:tid 40777] [client 45.67.97.19:33835] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaPTWQfBuk03yQKDyqvC0AAAAdg"]
[Sun Mar 01 13:49:14.110651 2026] [:error] [pid 41342:tid 41367] [client 45.67.97.2:38327] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Mar 01 13:49:15.134742 2026] [:error] [pid 41342:tid 41349] [client 45.67.97.2:38327] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aaPTW44iJ6RAS5CatDk-QgAAAgQ"]
[Sun Mar 01 13:49:16.099286 2026] [:error] [pid 38034:tid 38059] [client 45.67.97.19:27803] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaPTXAxtfZjwlJok9K9YAAAAARU"]
[Sun Mar 01 13:49:18.082450 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.195:51223] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaPTXvKRPk6YnJBxw_z_IAAAAMQ"]
[Sun Mar 01 13:49:20.069594 2026] [:error] [pid 38034:tid 38040] [client 45.67.97.2:41131] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaPTYAxtfZjwlJok9K9YFAAAAQQ"]
[Sun Mar 01 13:49:22.617220 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.19:44357] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaPTYvKRPk6YnJBxw_z_NwAAAMk"]
[Sun Mar 01 13:49:25.042446 2026] [:error] [pid 44644:tid 44659] [client 45.67.97.195:54333] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaPTZZ3RJaXMcw3y9V9K-gAAAAw"]
[Sun Mar 01 13:49:26.300770 2026] [:error] [pid 44644:tid 44648] [client 45.67.97.19:57879] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Mar 01 13:49:28.382888 2026] [:error] [pid 44644:tid 44663] [client 45.67.97.19:57879] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Mar 01 13:49:29.201352 2026] [:error] [pid 44644:tid 44657] [client 45.67.97.19:57879] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaPTaZ3RJaXMcw3y9V9LDAAAAAo"]
[Sun Mar 01 13:49:30.721319 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.195:60773] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Sun Mar 01 13:49:31.191399 2026] [:error] [pid 37032:tid 37054] [client 45.67.97.195:60773] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Mar 01 13:49:33.358593 2026] [:error] [pid 37032:tid 37047] [client 45.67.97.195:60773] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aaPTbeu0U4o7eSImsVT-0gAAAY0"]
[Sun Mar 01 13:49:35.910404 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.19:20635] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaPTbwxtfZjwlJok9K9YVwAAARA"]
[Sun Mar 01 13:49:36.982363 2026] [:error] [pid 41780:tid 41802] [client 45.67.97.20:65065] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaPTcMONkVoocLIqzy0DCQAAA9M"]
[Sun Mar 01 13:49:40.492939 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.19:45131] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaPTdPKRPk6YnJBxw_z_igAAAMk"]
[Sun Mar 01 13:49:43.408491 2026] [:error] [pid 38034:tid 38060] [client 45.67.97.195:35335] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Mar 01 13:49:44.300737 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.195:35335] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Mar 01 13:49:45.125161 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.195:35335] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Mar 01 13:49:47.456023 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.19:49143] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Mar 01 13:49:50.634439 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.19:49143] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaPTfgxtfZjwlJok9K9YpAAAARA"]
[Sun Mar 01 13:49:51.766899 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.19:55347] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaPTf_KRPk6YnJBxw_z_1wAAAMQ"]
[Sun Mar 01 13:49:53.036450 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.195:39207] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaPTgZ3RJaXMcw3y9V9LRgAAABI"]
[Sun Mar 01 13:49:53.908278 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.19:35163] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaPTgQxtfZjwlJok9K9YsAAAARA"]
[Sun Mar 01 13:49:55.556489 2026] [:error] [pid 38034:tid 38048] [client 45.67.97.2:28001] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaPTgwxtfZjwlJok9K9YuAAAAQo"]
[Sun Mar 01 13:49:58.961450 2026] [:error] [pid 38034:tid 38039] [client 45.67.97.2:45717] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaPThgxtfZjwlJok9K9YxwAAAQM"]
[Sun Mar 01 13:50:04.967816 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.2:30339] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaPTjPKRPk6YnJBxw_z_9wAAAMk"]
[Sun Mar 01 13:50:06.380947 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.2:61359] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaPTjgxtfZjwlJok9K9Y8AAAARA"]
[Sun Mar 01 13:50:07.736157 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.20:64799] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaPTjwxtfZjwlJok9K9Y-wAAARA"]
[Sun Mar 01 13:50:10.016727 2026] [:error] [pid 41780:tid 41805] [client 45.67.97.19:62227] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaPTksONkVoocLIqzy0DEwAAA9Y"]
[Sun Mar 01 13:50:15.044406 2026] [:error] [pid 38241:tid 38250] [client 45.67.97.19:47925] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaPTl_KRPk6YnJBxw_wADwAAAMY"]
[Sun Mar 01 13:50:19.292473 2026] [:error] [pid 42619:tid 42624] [client 45.67.97.19:26835] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaPTmx_zUXcYaZE4AOdpYwAAAUM"]
[Sun Mar 01 13:50:21.111120 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:28057] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Mar 01 13:50:21.973568 2026] [:error] [pid 38241:tid 38261] [client 45.67.97.195:28057] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaPTnfKRPk6YnJBxw_wALgAAANE"]
[Sun Mar 01 13:50:24.397396 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.195:50685] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aaPToJ3RJaXMcw3y9V9L6AAAAA0"]
[Sun Mar 01 13:50:26.287356 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.19:47895] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Mar 01 13:50:26.700853 2026] [:error] [pid 44644:tid 44657] [client 45.67.97.19:47895] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaPTop3RJaXMcw3y9V9L8QAAAAo"]
[Sun Mar 01 13:50:28.984997 2026] [:error] [pid 42619:tid 42640] [client 45.67.97.195:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Mar 01 13:50:30.030654 2026] [:error] [pid 42619:tid 42633] [client 45.67.97.195:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Mar 01 13:50:30.861038 2026] [:error] [pid 42619:tid 42642] [client 45.67.97.195:22695] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Mar 01 13:50:31.827297 2026] [:error] [pid 42619:tid 42622] [client 45.67.97.195:22695] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaPTpx_zUXcYaZE4AOdphgAAAUE"]
[Sun Mar 01 13:50:33.261131 2026] [:error] [pid 37032:tid 37047] [client 45.67.97.195:43255] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Sun Mar 01 13:50:33.707706 2026] [:error] [pid 37032:tid 37046] [client 45.67.97.195:43255] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aaPTqeu0U4o7eSImsVT_TgAAAYw"]
[Sun Mar 01 13:50:38.875352 2026] [:error] [pid 38241:tid 38266] [client 45.67.97.19:25055] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 13:50:40.396916 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.19:25055] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Mar 01 13:50:43.850208 2026] [:error] [pid 38241:tid 38250] [client 45.67.97.20:49091] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Mar 01 13:50:46.191248 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.20:49091] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Sun Mar 01 13:50:46.614997 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.20:49091] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Mar 01 13:50:48.540926 2026] [:error] [pid 38034:tid 38048] [client 45.67.97.2:33351] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Sun Mar 01 13:50:50.064059 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.2:33351] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Mar 01 13:50:50.601965 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.2:33351] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaPTugxtfZjwlJok9K9ZoAAAAQk"]
[Sun Mar 01 13:50:51.736672 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.2:45201] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaPTu_KRPk6YnJBxw_wAwwAAAMI"]
[Sun Mar 01 13:50:52.594705 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.195:56703] [client 45.67.97.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.195, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaPTvPKRPk6YnJBxw_wAxgAAAMk"]
[Sun Mar 01 13:50:52.598866 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.195:56703] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 01 13:50:53.155138 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:56703] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Mar 01 13:50:53.597017 2026] [:error] [pid 38241:tid 38266] [client 45.67.97.195:56703] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaPTvfKRPk6YnJBxw_wA0AAAANY"]
[Sun Mar 01 13:50:55.373779 2026] [:error] [pid 37032:tid 37038] [client 45.67.97.19:58621] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Mar 01 13:50:55.909548 2026] [:error] [pid 37032:tid 37050] [client 45.67.97.19:58621] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaPTv-u0U4o7eSImsVT_kQAAAZA"]
[Sun Mar 01 13:50:56.861295 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.20:63423] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaPTwPKRPk6YnJBxw_wA4wAAAMk"]
[Sun Mar 01 13:50:59.654074 2026] [:error] [pid 38241:tid 38266] [client 45.67.97.19:25699] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaPTw_KRPk6YnJBxw_wA9gAAANY"]
[Sun Mar 01 13:51:00.565785 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:34535] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aaPTxPKRPk6YnJBxw_wA-wAAANI"]
[Sun Mar 01 13:51:02.759881 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.19:36599] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Mar 01 13:51:03.642885 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.19:36599] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaPTx-u0U4o7eSImsVT_uwAAAYA"]
[Sun Mar 01 13:51:06.034647 2026] [:error] [pid 38034:tid 38059] [client 45.67.97.19:37673] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Mar 01 13:51:08.379716 2026] [:error] [pid 37032:tid 37056] [client 45.67.97.2:44183] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aaPTzOu0U4o7eSImsVT_xQAAAZY"]
[Sun Mar 01 13:51:09.251020 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:34653] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "aaPTzfKRPk6YnJBxw_wBFwAAANI"]
[Sun Mar 01 13:51:10.728434 2026] [:error] [pid 42619:tid 42643] [client 45.67.97.195:60439] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Mar 01 13:51:11.191013 2026] [:error] [pid 42619:tid 42624] [client 45.67.97.195:60439] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaPTzx_zUXcYaZE4AOdpxwAAAUM"]
[Sun Mar 01 13:51:12.170012 2026] [:error] [pid 37032:tid 37044] [client 45.67.97.2:47991] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaPT0Ou0U4o7eSImsVT_0QAAAYo"]
[Sun Mar 01 13:51:14.048087 2026] [:error] [pid 37032:tid 37057] [client 45.67.97.2:44057] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Mar 01 13:51:14.558657 2026] [:error] [pid 37032:tid 37046] [client 45.67.97.2:44057] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Mar 01 13:51:15.464800 2026] [:error] [pid 37032:tid 37044] [client 45.67.97.2:44057] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 01 13:51:16.330674 2026] [:error] [pid 37032:tid 37047] [client 45.67.97.2:44057] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aaPT1Ou0U4o7eSImsVT_5gAAAY0"]
[Sun Mar 01 13:51:17.240214 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.19:28107] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaPT1fKRPk6YnJBxw_wBSAAAAMk"]
[Sun Mar 01 13:51:19.361304 2026] [:error] [pid 37032:tid 37035] [client 45.67.97.2:33943] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Mar 01 13:51:20.020044 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.2:33943] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aaPT2Ou0U4o7eSImsVT_8QAAAY4"]
[Sun Mar 01 13:51:21.005868 2026] [:error] [pid 38034:tid 38050] [client 45.67.97.2:23271] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaPT2QxtfZjwlJok9K9aVAAAAQw"]
[Sun Mar 01 13:51:22.013457 2026] [:error] [pid 41967:tid 41980] [client 45.67.97.20:40175] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaPT2oO1bqY181I02eF0aAAAAIs"]
[Sun Mar 01 13:51:24.898405 2026] [:error] [pid 38034:tid 38062] [client 45.67.97.195:44639] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Sun Mar 01 13:51:25.320574 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.195:44639] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaPT3QxtfZjwlJok9K9aYwAAAQk"]
[Sun Mar 01 13:51:26.763165 2026] [:error] [pid 37032:tid 37044] [client 45.67.97.195:23229] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaPT3uu0U4o7eSImsVQABAAAAYo"]
[Sun Mar 01 13:51:27.646039 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:41147] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Mar 01 13:51:28.081477 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:41147] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Mar 01 13:51:28.957133 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:41147] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Mar 01 13:51:30.743367 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:41147] [client 45.67.97.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.195, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "aaPT4vKRPk6YnJBxw_wBkAAAANI"]
[Sun Mar 01 13:51:31.676231 2026] [:error] [pid 38241:tid 38261] [client 45.67.97.195:41147] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Mar 01 13:51:32.743173 2026] [:error] [pid 42619:tid 42633] [client 45.67.97.20:64571] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Sun Mar 01 13:51:33.200838 2026] [:error] [pid 42619:tid 42634] [client 45.67.97.20:64571] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Mar 01 13:51:34.134841 2026] [:error] [pid 42619:tid 42639] [client 45.67.97.20:64571] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aaPT5h_zUXcYaZE4AOdp-QAAAVI"]
[Sun Mar 01 13:51:34.997976 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.195:28385] [client 45.67.97.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.195, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaPT5vKRPk6YnJBxw_wBsgAAAMQ"]
[Sun Mar 01 13:51:37.504461 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Mar 01 13:51:37.926448 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Mar 01 13:51:38.816009 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sun Mar 01 13:51:39.789328 2026] [:error] [pid 38241:tid 38252] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 01 13:51:41.089204 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Mar 01 13:51:44.213880 2026] [:error] [pid 38241:tid 38261] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Mar 01 13:51:44.633610 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Sun Mar 01 13:51:46.877773 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.195:28385] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Mar 01 13:51:47.787205 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:28385] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aaPT8_KRPk6YnJBxw_wCIwAAAMI"]
[Sun Mar 01 13:51:49.739891 2026] [:error] [pid 38241:tid 38252] [client 45.67.97.195:43939] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Mar 01 13:51:50.188044 2026] [:error] [pid 38241:tid 38252] [client 45.67.97.195:43939] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaPT9vKRPk6YnJBxw_wCOAAAAMg"]
[Sun Mar 01 13:51:51.603401 2026] [:error] [pid 37032:tid 37044] [client 45.67.97.2:57931] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Mar 01 13:51:52.017559 2026] [:error] [pid 37032:tid 37051] [client 45.67.97.2:57931] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaPT-Ou0U4o7eSImsVQAQwAAAZE"]
[Sun Mar 01 13:51:53.773770 2026] [:error] [pid 38034:tid 38052] [client 45.67.97.19:30443] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sun Mar 01 13:51:54.824937 2026] [:error] [pid 38034:tid 38062] [client 45.67.97.19:30443] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Mar 01 13:51:56.014749 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.19:30443] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Mar 01 13:51:56.440147 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.19:30443] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sun Mar 01 13:51:57.280619 2026] [:error] [pid 38034:tid 38052] [client 45.67.97.19:30443] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaPT_QxtfZjwlJok9K9a5QAAAQ4"]
[Sun Mar 01 13:51:58.328182 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:20693] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Sun Mar 01 13:51:58.834830 2026] [:error] [pid 38241:tid 38246] [client 45.67.97.195:20693] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Mar 01 13:51:59.400077 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:20693] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaPT__KRPk6YnJBxw_wCfgAAANI"]
[Sun Mar 01 13:52:02.563854 2026] [:error] [pid 44644:tid 44661] [client 45.67.97.19:32165] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaPUAp3RJaXMcw3y9V9NWwAAAA4"]
[Sun Mar 01 13:52:03.852800 2026] [:error] [pid 37032:tid 37047] [client 45.67.97.19:50165] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Mar 01 13:52:05.149456 2026] [:error] [pid 37032:tid 37057] [client 45.67.97.19:50165] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Mar 01 13:52:05.583963 2026] [:error] [pid 37032:tid 37056] [client 45.67.97.19:50165] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Mar 01 13:52:06.906629 2026] [:error] [pid 37032:tid 37056] [client 45.67.97.19:50165] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaPUBuu0U4o7eSImsVQAWgAAAZY"]
[Sun Mar 01 13:52:08.227379 2026] [:error] [pid 38034:tid 38046] [client 45.67.97.2:42953] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaPUCAxtfZjwlJok9K9bFwAAAQg"]
[Sun Mar 01 13:52:13.055759 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.19:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Sun Mar 01 13:52:14.083575 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.19:38927] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaPUDvKRPk6YnJBxw_wC3gAAAMk"]
[Sun Mar 01 13:52:15.370720 2026] [:error] [pid 40750:tid 40767] [client 45.67.97.195:43517] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aaPUDwfBuk03yQKDyqvDIwAAAc4"]
[Sun Mar 01 13:52:16.898116 2026] [:error] [pid 42619:tid 42629] [client 45.67.97.195:21419] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 01 13:52:17.334137 2026] [:error] [pid 42619:tid 42622] [client 45.67.97.195:21419] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Mar 01 13:52:17.989759 2026] [:error] [pid 42619:tid 42625] [client 45.67.97.195:21419] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaPUER_zUXcYaZE4AOdqNAAAAUQ"]
[Sun Mar 01 13:52:20.031203 2026] [:error] [pid 44644:tid 44658] [client 45.67.97.20:53579] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Mar 01 13:52:20.716833 2026] [:error] [pid 44644:tid 44659] [client 45.67.97.20:53579] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Sun Mar 01 13:52:22.163245 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.20:53579] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Mar 01 13:52:23.769742 2026] [:error] [pid 44644:tid 44650] [client 45.67.97.20:53579] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaPUF53RJaXMcw3y9V9NjgAAAAM"]
[Sun Mar 01 13:52:24.642925 2026] [:error] [pid 38034:tid 38046] [client 45.67.97.19:23901] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Mar 01 13:52:25.929179 2026] [:error] [pid 38034:tid 38048] [client 45.67.97.19:23901] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaPUGQxtfZjwlJok9K9bgwAAAQo"]
[Sun Mar 01 13:52:27.272038 2026] [:error] [pid 38034:tid 38046] [client 45.67.97.19:29835] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Sun Mar 01 13:52:28.792173 2026] [:error] [pid 38034:tid 38046] [client 45.67.97.19:29835] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Sun Mar 01 13:52:29.263965 2026] [:error] [pid 38034:tid 38048] [client 45.67.97.19:29835] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Mar 01 13:52:30.126800 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.19:29835] [client 45.67.97.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.19, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaPUHgxtfZjwlJok9K9bmwAAARA"]
[Sun Mar 01 13:52:32.539527 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.19:29835] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaPUIAxtfZjwlJok9K9bpAAAAQA"]
[Sun Mar 01 13:52:33.403483 2026] [:error] [pid 37032:tid 37036] [client 45.67.97.2:40409] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Sun Mar 01 13:52:33.843315 2026] [:error] [pid 37032:tid 37035] [client 45.67.97.2:40409] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaPUIeu0U4o7eSImsVQAfwAAAYE"]
[Sun Mar 01 13:52:34.884105 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.2:30229] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Mar 01 13:52:35.964959 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.2:30229] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Sun Mar 01 13:52:37.073188 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.2:30229] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaPUJfKRPk6YnJBxw_wDdgAAAMQ"]
[Sun Mar 01 13:52:39.139683 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.2:55035] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Mar 01 13:52:39.721454 2026] [:error] [pid 38034:tid 38048] [client 45.67.97.2:55035] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Mar 01 13:52:40.892413 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.2:55035] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaPUKAxtfZjwlJok9K9b5AAAAQk"]
[Sun Mar 01 13:52:43.149496 2026] [:error] [pid 44644:tid 44659] [client 45.67.97.2:26507] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaPUK53RJaXMcw3y9V9NrgAAAAw"]
[Sun Mar 01 13:52:45.982316 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.195:53685] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Sun Mar 01 13:52:47.889511 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.195:53685] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Mar 01 13:52:50.646812 2026] [:error] [pid 38034:tid 38048] [client 45.67.97.195:53685] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaPUMgxtfZjwlJok9K9cKgAAAQo"]
[Sun Mar 01 13:52:52.556030 2026] [:error] [pid 41967:tid 41992] [client 45.67.97.2:45101] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Sun Mar 01 13:52:53.490910 2026] [:error] [pid 41967:tid 41978] [client 45.67.97.2:45101] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Sun Mar 01 13:52:53.937876 2026] [:error] [pid 41967:tid 41975] [client 45.67.97.2:45101] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaPUNYO1bqY181I02eF0rgAAAIY"]
[Sun Mar 01 13:52:56.404891 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.19:49351] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "aaPUOAxtfZjwlJok9K9cTwAAAQk"]
[Sun Mar 01 13:52:58.048024 2026] [:error] [pid 42619:tid 42621] [client 45.67.97.2:30587] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaPUOh_zUXcYaZE4AOdqYgAAAUA"]
[Sun Mar 01 13:52:59.077197 2026] [:error] [pid 38034:tid 38046] [client 45.67.97.20:63715] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaPUOwxtfZjwlJok9K9cWgAAAQg"]
[Sun Mar 01 13:53:00.368018 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.2:33337] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaPUPPKRPk6YnJBxw_wDqgAAAMQ"]
[Sun Mar 01 13:53:01.679256 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.195:58171] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaPUPfKRPk6YnJBxw_wDtAAAANI"]
[Sun Mar 01 13:53:03.361006 2026] [:error] [pid 38034:tid 38062] [client 45.67.97.195:55037] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaPUPwxtfZjwlJok9K9cbgAAARg"]
[Sun Mar 01 13:53:06.330038 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.20:29883] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaPUQp3RJaXMcw3y9V9N-AAAAA0"]
[Sun Mar 01 13:53:07.186850 2026] [:error] [pid 38241:tid 38254] [client 45.67.97.2:56245] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaPUQ_KRPk6YnJBxw_wD2QAAAMo"]
[Sun Mar 01 13:53:08.040263 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.195:27583] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaPURJ3RJaXMcw3y9V9N-QAAAAU"]
[Sun Mar 01 13:53:09.313434 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.195:21099] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaPURZ3RJaXMcw3y9V9OAQAAAAU"]
[Sun Mar 01 13:53:11.179684 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.20:24039] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aaPURwxtfZjwlJok9K9csQAAARI"]
[Sun Mar 01 13:53:13.007256 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.20:36699] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Mar 01 13:53:15.372546 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.2:40265] [client 45.67.97.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaPUS53RJaXMcw3y9V9OMgAAAA0"]
[Sun Mar 01 13:53:18.431993 2026] [:error] [pid 44644:tid 44658] [client 45.67.97.2:40265] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaPUTp3RJaXMcw3y9V9ORQAAAAs"]
[Sun Mar 01 13:53:21.083001 2026] [:error] [pid 38241:tid 38255] [client 45.67.97.2:38913] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaPUUfKRPk6YnJBxw_wEHQAAAMs"]
[Sun Mar 01 13:53:24.620528 2026] [:error] [pid 44644:tid 44650] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Mar 01 13:53:25.046564 2026] [:error] [pid 44644:tid 44667] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Sun Mar 01 13:53:26.748929 2026] [:error] [pid 44644:tid 44649] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Mar 01 13:53:27.181743 2026] [:error] [pid 44644:tid 44650] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Sun Mar 01 13:53:29.511035 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Sun Mar 01 13:53:29.928836 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Mar 01 13:53:30.357478 2026] [:error] [pid 44644:tid 44659] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Sun Mar 01 13:53:30.784802 2026] [:error] [pid 44644:tid 44656] [client 45.67.97.2:53041] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Sun Mar 01 13:53:31.208436 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.2:53041] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaPUW53RJaXMcw3y9V9OsAAAAA0"]
[Sun Mar 01 13:53:32.089081 2026] [:error] [pid 44644:tid 44649] [client 45.67.97.20:59889] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaPUXJ3RJaXMcw3y9V9OsgAAAAI"]
[Sun Mar 01 13:53:32.950714 2026] [:error] [pid 38034:tid 38062] [client 45.67.97.19:46539] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaPUXAxtfZjwlJok9K9dMAAAARg"]
[Sun Mar 01 13:53:34.239522 2026] [:error] [pid 38241:tid 38262] [client 45.67.97.20:47457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Sun Mar 01 13:53:34.682079 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.20:47457] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sun Mar 01 13:53:35.548434 2026] [:error] [pid 38241:tid 38255] [client 45.67.97.20:47457] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Mar 01 13:53:37.085801 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.20:35361] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaPUYfKRPk6YnJBxw_wEdQAAAMQ"]
[Sun Mar 01 13:53:37.973212 2026] [:error] [pid 44644:tid 44658] [client 45.67.97.2:32373] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaPUYZ3RJaXMcw3y9V9O6wAAAAs"]
[Sun Mar 01 13:53:38.865467 2026] [:error] [pid 37032:tid 37054] [client 45.67.97.2:35319] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaPUYuu0U4o7eSImsVQA5QAAAZQ"]
[Sun Mar 01 13:53:41.566462 2026] [:error] [pid 38241:tid 38254] [client 45.67.97.19:25653] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaPUZfKRPk6YnJBxw_wEmgAAAMo"]
[Sun Mar 01 13:53:42.851922 2026] [:error] [pid 37032:tid 37051] [client 45.67.97.2:62401] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaPUZuu0U4o7eSImsVQA8AAAAZE"]
[Sun Mar 01 13:53:44.551346 2026] [:error] [pid 38241:tid 38254] [client 45.67.97.195:47699] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaPUaPKRPk6YnJBxw_wEqwAAAMo"]
[Sun Mar 01 13:53:51.476348 2026] [:error] [pid 38241:tid 38255] [client 45.67.97.195:26153] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aaPUb_KRPk6YnJBxw_wEwAAAAMs"]
[Sun Mar 01 13:53:52.337536 2026] [:error] [pid 44644:tid 44657] [client 45.67.97.20:43881] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Sun Mar 01 13:53:53.239882 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.20:43881] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aaPUcZ3RJaXMcw3y9V9PSQAAAAU"]
[Sun Mar 01 13:53:55.133135 2026] [:error] [pid 40750:tid 40755] [client 45.67.97.20:59571] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Mar 01 13:53:57.259756 2026] [:error] [pid 40750:tid 40765] [client 45.67.97.20:59571] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Mar 01 13:53:57.780191 2026] [:error] [pid 40750:tid 40776] [client 45.67.97.20:59571] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaPUdQfBuk03yQKDyqvDOAAAAdc"]
[Sun Mar 01 13:53:59.619434 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.19:27575] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaPUdwxtfZjwlJok9K9d6wAAARI"]
[Sun Mar 01 13:54:06.982055 2026] [:error] [pid 42619:tid 42626] [client 45.67.97.195:39059] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaPUfh_zUXcYaZE4AOdqwAAAAUU"]
[Sun Mar 01 13:54:18.810358 2026] [:error] [pid 38241:tid 38255] [client 45.67.97.19:51571] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaPUivKRPk6YnJBxw_wFCwAAAMs"]
[Sun Mar 01 13:54:21.129834 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.19:52837] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Mar 01 13:54:21.543265 2026] [:error] [pid 44644:tid 44655] [client 45.67.97.19:52837] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaPUjZ3RJaXMcw3y9V9P3AAAAAg"]
[Sun Mar 01 13:54:22.439405 2026] [:error] [pid 42619:tid 42632] [client 45.67.97.19:55945] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaPUjh_zUXcYaZE4AOdqyQAAAUs"]
[Sun Mar 01 13:54:25.687037 2026] [:error] [pid 41967:tid 41980] [client 45.67.97.20:40109] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaPUkYO1bqY181I02eF0-QAAAIs"]
[Sun Mar 01 13:54:26.911492 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.195:27655] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Mar 01 13:54:29.183854 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.195:27655] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Mar 01 13:54:29.666448 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.195:27655] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaPUlQxtfZjwlJok9K9eawAAAQA"]
[Sun Mar 01 13:54:31.541037 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.20:44007] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Mar 01 13:54:32.465257 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.20:44007] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaPUmJ3RJaXMcw3y9V9QPwAAABI"]
[Sun Mar 01 13:54:33.334704 2026] [:error] [pid 44644:tid 44655] [client 45.67.97.19:25761] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaPUmZ3RJaXMcw3y9V9QRgAAAAg"]
[Sun Mar 01 13:54:38.778354 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.2:33717] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaPUngxtfZjwlJok9K9elgAAARI"]
[Sun Mar 01 13:54:42.302436 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.2:65127] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "aaPUogxtfZjwlJok9K9esQAAAQA"]
[Sun Mar 01 13:54:44.352892 2026] [:error] [pid 38034:tid 38058] [client 45.67.97.20:58559] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaPUpAxtfZjwlJok9K9evAAAARQ"]
[Sun Mar 01 13:54:46.850948 2026] [:error] [pid 44644:tid 44656] [client 45.67.97.20:29239] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Sun Mar 01 13:54:49.092887 2026] [:error] [pid 44644:tid 44661] [client 45.67.97.20:29239] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "aaPUqZ3RJaXMcw3y9V9QugAAAA4"]
[Sun Mar 01 13:54:51.079027 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.20:40619] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aaPUqwxtfZjwlJok9K9e1AAAAQk"]
[Sun Mar 01 13:54:52.033476 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.20:61603] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaPUrPKRPk6YnJBxw_wFcAAAAMQ"]
[Sun Mar 01 13:54:53.337477 2026] [:error] [pid 37032:tid 37039] [client 45.67.97.2:39907] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Mar 01 13:54:54.494207 2026] [:error] [pid 37032:tid 37039] [client 45.67.97.2:39907] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaPUruu0U4o7eSImsVQBQwAAAYU"]
[Sun Mar 01 13:54:54.494964 2026] [:error] [pid 44644:tid 44669] [client 43.159.143.139:33044] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaPUrp3RJaXMcw3y9V9Q0AAAABY"]
[Sun Mar 01 13:54:55.768982 2026] [:error] [pid 44644:tid 44667] [client 45.67.97.20:36843] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaPUr53RJaXMcw3y9V9Q2AAAABQ"]
[Sun Mar 01 13:55:02.755601 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.19:33177] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaPUtgxtfZjwlJok9K9fCAAAAQk"]
[Sun Mar 01 13:55:06.860313 2026] [:error] [pid 38241:tid 38248] [client 45.67.97.195:32465] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sun Mar 01 13:55:07.295575 2026] [:error] [pid 38241:tid 38260] [client 45.67.97.195:32465] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaPUu_KRPk6YnJBxw_wFwwAAANA"]
[Sun Mar 01 13:55:10.294050 2026] [:error] [pid 44644:tid 44655] [client 45.67.97.20:26803] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaPUvp3RJaXMcw3y9V9Q_wAAAAg"]
[Sun Mar 01 13:55:11.603054 2026] [:error] [pid 44644:tid 44667] [client 45.67.97.195:57735] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "aaPUv53RJaXMcw3y9V9RCQAAABQ"]
[Sun Mar 01 13:55:13.016252 2026] [:error] [pid 37032:tid 37056] [client 45.67.97.19:27541] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaPUweu0U4o7eSImsVQBegAAAZY"]
[Sun Mar 01 13:55:13.899797 2026] [:error] [pid 44644:tid 44661] [client 45.67.97.19:42859] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aaPUwZ3RJaXMcw3y9V9RGwAAAA4"]
[Sun Mar 01 13:55:14.865589 2026] [:error] [pid 37032:tid 37042] [client 45.67.97.2:30293] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aaPUwuu0U4o7eSImsVQBgwAAAYg"]
[Sun Mar 01 13:55:19.865936 2026] [:error] [pid 44644:tid 44662] [client 45.67.97.2:44367] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaPUx53RJaXMcw3y9V9ROwAAAA8"]
[Sun Mar 01 13:55:22.095180 2026] [:error] [pid 42619:tid 42621] [client 45.67.97.2:65107] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aaPUyh_zUXcYaZE4AOdrBQAAAUA"]
[Sun Mar 01 13:55:23.868608 2026] [:error] [pid 44644:tid 44667] [client 45.67.97.19:61901] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sun Mar 01 13:55:24.410010 2026] [:error] [pid 44644:tid 44667] [client 45.67.97.19:61901] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaPUzJ3RJaXMcw3y9V9RXgAAABQ"]
[Sun Mar 01 13:55:26.565581 2026] [:error] [pid 40750:tid 40753] [client 45.67.97.20:37879] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaPUzgfBuk03yQKDyqvDTQAAAcA"]
[Sun Mar 01 13:55:27.400310 2026] [:error] [pid 38241:tid 38244] [client 45.67.97.20:36173] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Sun Mar 01 13:55:30.065087 2026] [:error] [pid 38241:tid 38255] [client 45.67.97.20:36173] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaPU0vKRPk6YnJBxw_wGGwAAAMs"]
[Sun Mar 01 13:55:31.381371 2026] [:error] [pid 37032:tid 37051] [client 45.67.97.195:50279] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaPU0-u0U4o7eSImsVQBpQAAAZE"]
[Sun Mar 01 13:55:32.662210 2026] [:error] [pid 44644:tid 44658] [client 45.67.97.2:58441] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaPU1J3RJaXMcw3y9V9RfwAAAAs"]
[Sun Mar 01 13:55:35.086753 2026] [:error] [pid 38241:tid 38257] [client 45.67.97.195:43191] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaPU1_KRPk6YnJBxw_wGLwAAAM0"]
[Sun Mar 01 13:55:45.678846 2026] [:error] [pid 38241:tid 38260] [client 45.67.97.19:24451] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaPU4fKRPk6YnJBxw_wGQwAAANA"]
[Sun Mar 01 13:55:46.590498 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.2:20721] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaPU4p3RJaXMcw3y9V9RnwAAAAU"]
[Sun Mar 01 13:55:48.827632 2026] [:error] [pid 40750:tid 40767] [client 45.67.97.20:46125] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaPU5AfBuk03yQKDyqvDWQAAAc4"]
[Sun Mar 01 13:55:49.741947 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.19:59169] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaPU5QxtfZjwlJok9K9fuwAAARA"]
[Sun Mar 01 13:55:51.445940 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.2:58335] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaPU5wxtfZjwlJok9K9fyQAAAQk"]
[Sun Mar 01 13:55:52.302342 2026] [:error] [pid 44644:tid 44669] [client 45.67.97.19:45603] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aaPU6J3RJaXMcw3y9V9RqAAAABY"]
[Sun Mar 01 13:55:53.166406 2026] [:error] [pid 37032:tid 37057] [client 45.67.97.2:57067] [client 45.67.97.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaPU6eu0U4o7eSImsVQB5gAAAZc"]
[Sun Mar 01 13:55:53.170107 2026] [:error] [pid 37032:tid 37057] [client 45.67.97.2:57067] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Mar 01 13:55:53.590241 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.2:57067] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaPU6eu0U4o7eSImsVQB6QAAAYA"]
[Sun Mar 01 13:55:55.293105 2026] [:error] [pid 38241:tid 38268] [client 45.67.97.2:53209] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Mar 01 13:55:55.881736 2026] [:error] [pid 38241:tid 38257] [client 45.67.97.2:53209] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaPU6_KRPk6YnJBxw_wGZAAAAM0"]
[Sun Mar 01 13:55:56.854476 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.2:28119] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aaPU7AxtfZjwlJok9K9f4wAAARA"]
[Sun Mar 01 13:55:57.839415 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.19:48701] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Sun Mar 01 13:56:01.612072 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.19:48701] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaPU8QxtfZjwlJok9K9gBwAAAQk"]
[Sun Mar 01 13:56:02.509856 2026] [:error] [pid 44644:tid 44655] [client 45.67.97.20:39701] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaPU8p3RJaXMcw3y9V9RwwAAAAg"]
[Sun Mar 01 13:56:04.231694 2026] [:error] [pid 42619:tid 42636] [client 45.67.97.195:28829] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaPU9B_zUXcYaZE4AOdrLQAAAU8"]
[Sun Mar 01 13:56:05.111433 2026] [:error] [pid 42619:tid 42624] [client 45.67.97.2:35493] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aaPU9R_zUXcYaZE4AOdrLwAAAUM"]
[Sun Mar 01 13:56:06.072437 2026] [:error] [pid 38034:tid 38038] [client 45.67.97.2:36055] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sun Mar 01 13:56:06.630930 2026] [:error] [pid 38034:tid 38058] [client 45.67.97.2:36055] [client 45.67.97.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.2, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaPU9gxtfZjwlJok9K9gGwAAARQ"]
[Sun Mar 01 13:56:07.581909 2026] [:error] [pid 38034:tid 38038] [client 45.67.97.2:36055] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaPU9wxtfZjwlJok9K9gIAAAAQI"]
[Sun Mar 01 13:56:10.490287 2026] [:error] [pid 38034:tid 38038] [client 45.67.97.2:32847] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaPU-gxtfZjwlJok9K9gLQAAAQI"]
[Sun Mar 01 13:56:11.437004 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.20:39015] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Mar 01 13:56:11.858010 2026] [:error] [pid 38034:tid 38038] [client 45.67.97.20:39015] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaPU-wxtfZjwlJok9K9gOAAAAQI"]
[Sun Mar 01 13:56:12.714399 2026] [:error] [pid 44644:tid 44669] [client 45.67.97.195:54913] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaPU_J3RJaXMcw3y9V9R4AAAABY"]
[Sun Mar 01 13:56:13.613182 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.20:31953] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sun Mar 01 13:56:15.073142 2026] [:error] [pid 38034:tid 38038] [client 45.67.97.20:31953] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaPU_wxtfZjwlJok9K9gUgAAAQI"]
[Sun Mar 01 13:56:17.809514 2026] [:error] [pid 38241:tid 38268] [client 45.67.97.195:41043] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaPVAfKRPk6YnJBxw_wGvgAAANg"]
[Sun Mar 01 13:56:18.702405 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.19:20339] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sun Mar 01 13:56:19.572450 2026] [:error] [pid 44644:tid 44657] [client 45.67.97.19:20339] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Mar 01 13:56:20.546480 2026] [:error] [pid 44644:tid 44668] [client 45.67.97.19:20339] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaPVBJ3RJaXMcw3y9V9SBQAAABU"]
[Sun Mar 01 13:56:21.518475 2026] [:error] [pid 37032:tid 37054] [client 45.67.97.19:45267] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "aaPVBeu0U4o7eSImsVQCQgAAAZQ"]
[Sun Mar 01 13:56:23.000604 2026] [:error] [pid 38241:tid 38260] [client 45.67.97.19:61891] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/count.php"] [unique_id "aaPVBvKRPk6YnJBxw_wG2wAAANA"]
[Sun Mar 01 13:56:24.860040 2026] [:error] [pid 41342:tid 41363] [client 45.67.97.20:34743] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Sun Mar 01 13:56:33.861798 2026] [:error] [pid 41342:tid 41364] [client 45.67.97.20:34743] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaPVEY4iJ6RAS5CatDk_KgAAAhM"]
[Sun Mar 01 13:56:36.107266 2026] [:error] [pid 44644:tid 44668] [client 45.67.97.20:38405] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rejuva.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rejuva.au"] [uri "/images/stories/themes.php"] [unique_id "aaPVFJ3RJaXMcw3y9V9SUgAAABU"]
[Sun Mar 01 13:56:36.528638 2026] [:error] [pid 44644:tid 44671] [client 45.67.97.20:38405] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaPVFJ3RJaXMcw3y9V9SVgAAABg"]
[Sun Mar 01 13:56:38.321767 2026] [:error] [pid 44644:tid 44655] [client 45.67.97.20:46675] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaPVFp3RJaXMcw3y9V9SaQAAAAg"]
[Sun Mar 01 13:56:39.389260 2026] [:error] [pid 44644:tid 44655] [client 45.67.97.195:61855] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaPVF53RJaXMcw3y9V9SbQAAAAg"]
[Sun Mar 01 13:56:41.115937 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.195:55221] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun Mar 01 13:56:42.857695 2026] [:error] [pid 44644:tid 44660] [client 45.67.97.195:55221] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaPVGp3RJaXMcw3y9V9SjAAAAA0"]
[Sun Mar 01 13:56:44.583036 2026] [:error] [pid 38241:tid 38265] [client 45.67.97.19:27951] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaPVHPKRPk6YnJBxw_wHHgAAANU"]
[Sun Mar 01 13:56:45.854028 2026] [:error] [pid 38241:tid 38255] [client 45.67.97.20:27731] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaPVHfKRPk6YnJBxw_wHJgAAAMs"]
[Sun Mar 01 13:56:46.836756 2026] [:error] [pid 44644:tid 44671] [client 45.67.97.195:38069] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Sun Mar 01 13:56:49.768679 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.195:38069] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaPVIZ3RJaXMcw3y9V9SuAAAAAU"]
[Sun Mar 01 13:56:51.113224 2026] [:error] [pid 41780:tid 41804] [client 45.67.97.2:63265] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/colour.php"] [unique_id "aaPVI8ONkVoocLIqzy0EOAAAA9U"]
[Sun Mar 01 13:56:52.007840 2026] [:error] [pid 38241:tid 38259] [client 45.67.97.20:40547] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Mar 01 13:56:52.444308 2026] [:error] [pid 38241:tid 38258] [client 45.67.97.20:40547] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaPVJPKRPk6YnJBxw_wHOgAAAM4"]
[Sun Mar 01 13:56:53.549598 2026] [:error] [pid 37032:tid 37034] [client 45.67.97.2:50281] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aaPVJeu0U4o7eSImsVQCcgAAAYA"]
[Sun Mar 01 13:57:00.096118 2026] [:error] [pid 42619:tid 42621] [client 45.67.97.19:39899] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaPVLB_zUXcYaZE4AOdraQAAAUA"]
[Sun Mar 01 13:57:03.751107 2026] [:error] [pid 37032:tid 37039] [client 45.67.97.20:22447] File does not exist: /usr/local/apache/htdocs/suspended-page/entrepreneuse.php
[Sun Mar 01 13:57:04.362538 2026] [:error] [pid 37032:tid 37054] [client 45.67.97.20:22447] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaPVMOu0U4o7eSImsVQCpgAAAZQ"]
[Sun Mar 01 13:57:05.366559 2026] [:error] [pid 42619:tid 42626] [client 45.67.97.20:47923] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaPVMR_zUXcYaZE4AOdrbQAAAUU"]
[Sun Mar 01 13:57:08.672113 2026] [:error] [pid 37032:tid 37042] [client 45.67.97.19:54351] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaPVNOu0U4o7eSImsVQCzAAAAYg"]
[Sun Mar 01 13:57:10.434855 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.19:58365] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaPVNgxtfZjwlJok9K9g8gAAARA"]
[Sun Mar 01 13:57:11.307068 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.2:23781] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Sun Mar 01 13:57:12.578047 2026] [:error] [pid 38034:tid 38055] [client 45.67.97.2:23781] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaPVOAxtfZjwlJok9K9hBQAAARE"]
[Sun Mar 01 13:57:13.563618 2026] [:error] [pid 44644:tid 44671] [client 45.67.97.2:51169] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaPVOZ3RJaXMcw3y9V9S4QAAABg"]
[Sun Mar 01 13:57:14.897155 2026] [:error] [pid 44644:tid 44656] [client 45.67.97.20:25001] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaPVOp3RJaXMcw3y9V9S8gAAAAk"]
[Sun Mar 01 13:57:15.744738 2026] [:error] [pid 37032:tid 37054] [client 45.67.97.19:37899] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Sun Mar 01 13:57:16.641827 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.19:37899] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaPVPOu0U4o7eSImsVQC0gAAAY4"]
[Sun Mar 01 13:57:17.529439 2026] [:error] [pid 38034:tid 38054] [client 45.67.97.20:37735] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Sun Mar 01 13:57:18.385111 2026] [:error] [pid 38034:tid 38053] [client 45.67.97.20:37735] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaPVPgxtfZjwlJok9K9hJQAAAQ8"]
[Sun Mar 01 13:57:19.223687 2026] [:error] [pid 42619:tid 42641] [client 45.67.97.2:41551] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaPVPx_zUXcYaZE4AOdrhwAAAVQ"]
[Sun Mar 01 13:57:20.560081 2026] [:error] [pid 44644:tid 44668] [client 45.67.97.2:61309] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaPVQJ3RJaXMcw3y9V9TAAAAABU"]
[Sun Mar 01 13:57:21.446346 2026] [:error] [pid 42619:tid 42639] [client 45.67.97.20:44301] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aaPVQR_zUXcYaZE4AOdrkAAAAVI"]
[Sun Mar 01 13:57:23.167963 2026] [:error] [pid 44644:tid 44671] [client 45.67.97.20:40649] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaPVQ53RJaXMcw3y9V9TFQAAABg"]
[Sun Mar 01 13:57:24.494189 2026] [:error] [pid 41780:tid 41802] [client 45.67.97.20:56029] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaPVRMONkVoocLIqzy0ERQAAA9M"]
[Sun Mar 01 13:57:25.360119 2026] [:error] [pid 37032:tid 37057] [client 45.67.97.195:22061] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaPVReu0U4o7eSImsVQC3AAAAZc"]
[Sun Mar 01 13:57:26.313374 2026] [:error] [pid 38241:tid 38255] [client 45.67.97.195:39809] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaPVRvKRPk6YnJBxw_wHhwAAAMs"]
[Sun Mar 01 13:57:28.548328 2026] [:error] [pid 37032:tid 37048] [client 45.67.97.19:27507] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaPVSOu0U4o7eSImsVQC5wAAAY4"]
[Sun Mar 01 13:57:30.256957 2026] [:error] [pid 38241:tid 38268] [client 45.67.97.2:52273] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaPVSvKRPk6YnJBxw_wHmgAAANg"]
[Sun Mar 01 13:57:31.603882 2026] [:error] [pid 38034:tid 38053] [client 45.67.97.20:44119] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaPVSwxtfZjwlJok9K9hTQAAAQ8"]
[Sun Mar 01 13:57:32.923001 2026] [:error] [pid 38034:tid 38038] [client 45.67.97.19:32861] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaPVTAxtfZjwlJok9K9hWAAAAQI"]
[Sun Mar 01 13:57:34.645615 2026] [:error] [pid 38241:tid 38268] [client 45.67.97.19:49281] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sun Mar 01 13:57:36.539641 2026] [:error] [pid 38241:tid 38268] [client 45.67.97.19:49281] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aaPVUPKRPk6YnJBxw_wHwAAAANg"]
[Sun Mar 01 13:57:39.072215 2026] [:error] [pid 44644:tid 44668] [client 45.67.97.195:31121] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaPVU53RJaXMcw3y9V9TNAAAABU"]
[Sun Mar 01 13:57:42.122707 2026] [:error] [pid 37032:tid 37039] [client 45.67.97.20:22267] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Sun Mar 01 13:57:42.567775 2026] [:error] [pid 37032:tid 37051] [client 45.67.97.20:22267] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaPVVuu0U4o7eSImsVQC-wAAAZE"]
[Sun Mar 01 13:57:45.528721 2026] [:error] [pid 38034:tid 38053] [client 45.67.97.195:34297] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaPVWQxtfZjwlJok9K9hlwAAAQ8"]
[Sun Mar 01 13:57:49.374650 2026] [:error] [pid 42619:tid 42629] [client 45.67.97.195:43839] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Sun Mar 01 13:57:50.808154 2026] [:error] [pid 42619:tid 42642] [client 45.67.97.195:43839] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaPVXh_zUXcYaZE4AOdrowAAAVU"]
[Sun Mar 01 13:57:53.816799 2026] [:error] [pid 42619:tid 42643] [client 45.67.97.2:45545] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaPVYR_zUXcYaZE4AOdrrAAAAVY"]
[Sun Mar 01 13:57:55.427322 2026] [:error] [pid 38034:tid 38038] [client 45.67.97.20:26817] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Mar 01 13:57:56.609133 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.20:26817] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaPVZAxtfZjwlJok9K9hvAAAARI"]
[Sun Mar 01 13:58:00.281796 2026] [:error] [pid 41780:tid 41798] [client 45.67.97.19:21773] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaPVaMONkVoocLIqzy0ETgAAA88"]
[Sun Mar 01 13:58:04.030057 2026] [:error] [pid 44644:tid 44655] [client 45.67.97.19:26201] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sun Mar 01 13:58:04.662062 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.19:26201] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaPVbJ3RJaXMcw3y9V9TmAAAABI"]
[Sun Mar 01 13:58:07.069696 2026] [:error] [pid 42619:tid 42640] [client 45.67.97.20:48813] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaPVbx_zUXcYaZE4AOdruQAAAVM"]
[Sun Mar 01 13:58:07.934154 2026] [:error] [pid 41967:tid 41982] [client 45.67.97.195:54191] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sun Mar 01 13:58:08.349616 2026] [:error] [pid 41967:tid 41991] [client 45.67.97.195:54191] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaPVcIO1bqY181I02eF1ngAAAJY"]
[Sun Mar 01 13:58:10.818626 2026] [:error] [pid 38241:tid 38257] [client 45.67.97.2:54519] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaPVcvKRPk6YnJBxw_wIAgAAAM0"]
[Sun Mar 01 13:58:11.693109 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.19:21703] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sun Mar 01 13:58:13.199518 2026] [:error] [pid 38034:tid 38047] [client 45.67.97.2:25639] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaPVdQxtfZjwlJok9K9h5gAAAQk"]
[Sun Mar 01 13:58:14.108108 2026] [:error] [pid 41967:tid 41976] [client 45.67.97.19:24161] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaPVdoO1bqY181I02eF1pAAAAIc"]
[Sun Mar 01 13:58:17.581362 2026] [:error] [pid 41342:tid 41365] [client 45.67.97.2:37579] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaPVeY4iJ6RAS5CatDk_UwAAAhQ"]
[Sun Mar 01 13:58:18.486815 2026] [:error] [pid 44644:tid 44668] [client 45.67.97.195:25055] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaPVep3RJaXMcw3y9V9TpwAAABU"]
[Sun Mar 01 13:58:20.120272 2026] [:error] [pid 41967:tid 41972] [client 45.67.97.195:51715] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/log.php"] [unique_id "aaPVfIO1bqY181I02eF1rAAAAIM"]
[Sun Mar 01 13:58:22.083349 2026] [:error] [pid 38034:tid 38037] [client 45.67.97.19:43543] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaPVfgxtfZjwlJok9K9h9gAAAQE"]
[Sun Mar 01 13:58:24.458896 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.19:27705] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaPVgAxtfZjwlJok9K9iCQAAAQA"]
[Sun Mar 01 13:58:25.641203 2026] [:error] [pid 44644:tid 44667] [client 45.67.97.19:23143] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/aw.php"] [unique_id "aaPVgZ3RJaXMcw3y9V9TsQAAABQ"]
[Sun Mar 01 13:58:29.867020 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.195:49937] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaPVhQxtfZjwlJok9K9iIAAAAQA"]
[Sun Mar 01 13:58:30.910984 2026] [:error] [pid 41967:tid 41970] [client 45.67.97.20:29123] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/install.php"] [unique_id "aaPVhoO1bqY181I02eF1sQAAAIE"]
[Sun Mar 01 13:58:32.479367 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.20:42637] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Sun Mar 01 13:58:34.027190 2026] [:error] [pid 38241:tid 38267] [client 45.67.97.195:36977] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaPVivKRPk6YnJBxw_wIMwAAANc"]
[Sun Mar 01 13:58:35.754850 2026] [:error] [pid 37032:tid 37046] [client 45.67.97.2:52793] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaPVi-u0U4o7eSImsVQDZwAAAYw"]
[Sun Mar 01 13:58:38.105983 2026] [:error] [pid 38034:tid 38043] [client 45.67.97.19:37817] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/template-less.php"] [unique_id "aaPVjgxtfZjwlJok9K9iRgAAAQU"]
[Sun Mar 01 13:58:40.183091 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.20:49733] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaPVkAxtfZjwlJok9K9iSwAAARI"]
[Sun Mar 01 13:58:45.223180 2026] [:error] [pid 37032:tid 37035] [client 45.67.97.20:54453] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aaPVleu0U4o7eSImsVQDgAAAAYE"]
[Sun Mar 01 13:58:47.122330 2026] [:error] [pid 38034:tid 38056] [client 45.67.97.2:51007] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaPVlwxtfZjwlJok9K9iYgAAARI"]
[Sun Mar 01 13:58:50.424624 2026] [:error] [pid 44644:tid 44651] [client 45.67.97.2:21103] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aaPVmp3RJaXMcw3y9V9T_QAAAAQ"]
[Sun Mar 01 13:58:52.754539 2026] [:error] [pid 42619:tid 42621] [client 45.67.97.195:24723] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaPVnB_zUXcYaZE4AOdr2AAAAUA"]
[Sun Mar 01 13:58:55.287429 2026] [:error] [pid 37032:tid 37051] [client 45.67.97.19:39159] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/load.php"] [unique_id "aaPVn-u0U4o7eSImsVQDlAAAAZE"]
[Sun Mar 01 13:58:58.342169 2026] [:error] [pid 44644:tid 44671] [client 45.67.97.19:41339] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaPVop3RJaXMcw3y9V9UJgAAABg"]
[Sun Mar 01 13:58:59.190490 2026] [:error] [pid 38034:tid 38037] [client 45.67.97.19:57137] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaPVowxtfZjwlJok9K9idwAAAQE"]
[Sun Mar 01 13:59:01.409457 2026] [:error] [pid 38034:tid 38053] [client 45.67.97.195:62315] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaPVpQxtfZjwlJok9K9ihQAAAQ8"]
[Sun Mar 01 13:59:02.685487 2026] [:error] [pid 38034:tid 38053] [client 45.67.97.20:46719] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Sun Mar 01 13:59:03.718404 2026] [:error] [pid 38034:tid 38043] [client 45.67.97.20:46719] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaPVpwxtfZjwlJok9K9ijgAAAQU"]
[Sun Mar 01 13:59:06.123402 2026] [:error] [pid 38241:tid 38256] [client 45.67.97.20:30307] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Sun Mar 01 13:59:07.636061 2026] [:error] [pid 38241:tid 38256] [client 45.67.97.20:30307] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaPVq_KRPk6YnJBxw_wIegAAAMw"]
[Sun Mar 01 13:59:08.509643 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.19:64865] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaPVrJ3RJaXMcw3y9V9UUQAAAAU"]
[Sun Mar 01 13:59:09.893017 2026] [:error] [pid 44644:tid 44665] [client 45.67.97.195:58591] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaPVrZ3RJaXMcw3y9V9UXAAAABI"]
[Sun Mar 01 13:59:13.588968 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.195:22491] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun Mar 01 13:59:15.626964 2026] [:error] [pid 44644:tid 44652] [client 45.67.97.195:22491] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aaPVs53RJaXMcw3y9V9UkwAAAAU"]
[Sun Mar 01 13:59:16.966928 2026] [:error] [pid 42619:tid 42634] [client 45.67.97.20:59641] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaPVtB_zUXcYaZE4AOdr4gAAAU0"]
[Sun Mar 01 13:59:18.879185 2026] [:error] [pid 38034:tid 38051] [client 45.67.97.195:54527] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaPVtgxtfZjwlJok9K9i0AAAAQ0"]
[Sun Mar 01 13:59:19.712882 2026] [:error] [pid 42619:tid 42644] [client 45.67.97.2:60129] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaPVtx_zUXcYaZE4AOdr5gAAAVc"]
[Sun Mar 01 13:59:20.728275 2026] [:error] [pid 44644:tid 44668] [client 45.67.97.19:57021] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaPVuJ3RJaXMcw3y9V9UpwAAABU"]
[Sun Mar 01 14:29:33.337052 2026] [:error] [pid 38034:tid 38043] [client 62.60.131.218:50403] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaPczQxtfZjwlJok9K9__wAAAQU"]
[Sun Mar 01 16:14:30.704794 2026] [:error] [pid 41967:tid 41975] [client 13.74.146.113:1076] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaP1ZoO1bqY181I02eGV7AAAAIY"]
[Sun Mar 01 16:14:31.220272 2026] [:error] [pid 38034:tid 38040] [client 13.74.146.113:16662] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaP1ZwxtfZjwlJok9K_WzAAAAQQ"]
[Sun Mar 01 16:14:31.735168 2026] [:error] [pid 33822:tid 33847] [client 13.74.146.113:8767] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaP1Z26W3ygu1YVssubLfQAAApc"]
[Sun Mar 01 17:06:59.799281 2026] [:error] [pid 7165:tid 7169] [client 43.157.156.190:53396] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaQBsxRjCrA8qWBjgG9opwAAAkI"]
[Sun Mar 01 17:55:50.614818 2026] [:error] [pid 40750:tid 40774] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Sun Mar 01 17:55:50.831241 2026] [:error] [pid 40750:tid 40770] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Mar 01 17:55:51.328667 2026] [:error] [pid 40750:tid 40759] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Sun Mar 01 17:55:51.759369 2026] [:error] [pid 40750:tid 40754] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Sun Mar 01 17:55:52.083799 2026] [:error] [pid 40750:tid 40771] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 17:55:52.295775 2026] [:error] [pid 40750:tid 40766] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Sun Mar 01 17:55:52.653047 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Sun Mar 01 17:55:53.080598 2026] [:error] [pid 40750:tid 40769] [client 20.220.232.101:36364] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Sun Mar 01 17:55:53.297737 2026] [:error] [pid 40750:tid 40757] [client 20.220.232.101:36364] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaQNKQfBuk03yQKDyqtL6QAAAcQ"]
[Sun Mar 01 17:55:53.977220 2026] [:error] [pid 7165:tid 7189] [client 20.220.232.101:36395] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaQNKRRjCrA8qWBjgG-VcAAAAlY"]
[Sun Mar 01 17:55:54.527850 2026] [:error] [pid 7133:tid 7155] [client 20.220.232.101:36388] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaQNKvCtubh8pR64qB_3iQAAAFQ"]
[Sun Mar 01 17:55:55.186635 2026] [:error] [pid 41780:tid 41792] [client 20.220.232.101:36396] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx1.php"] [unique_id "aaQNK8ONkVoocLIqzy0dTAAAA8k"]
[Sun Mar 01 17:55:55.674251 2026] [:error] [pid 40750:tid 40759] [client 20.220.232.101:36173] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaQNKwfBuk03yQKDyqtL8QAAAcY"]
[Sun Mar 01 17:55:56.460995 2026] [:error] [pid 33822:tid 33843] [client 20.220.232.101:36394] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaQNLG6W3ygu1YVssubp7AAAApM"]
[Sun Mar 01 17:55:57.048485 2026] [:error] [pid 37032:tid 37054] [client 20.220.232.101:36363] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaQNLeu0U4o7eSImsVRkhQAAAZQ"]
[Sun Mar 01 17:55:57.519249 2026] [:error] [pid 38241:tid 38255] [client 20.220.232.101:36377] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xv.php"] [unique_id "aaQNLfKRPk6YnJBxw_ynnQAAAMs"]
[Sun Mar 01 17:55:58.016145 2026] [:error] [pid 7165:tid 7172] [client 20.220.232.101:36176] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaQNLhRjCrA8qWBjgG-VeQAAAkU"]
[Sun Mar 01 17:55:58.628059 2026] [:error] [pid 38034:tid 38036] [client 20.220.232.101:36179] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaQNLgxtfZjwlJok9K_t0QAAAQA"]
[Sun Mar 01 17:55:59.328406 2026] [:error] [pid 40750:tid 40754] [client 20.220.232.101:36374] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaQNLwfBuk03yQKDyqtMBQAAAcE"]
[Sun Mar 01 17:55:59.963589 2026] [:error] [pid 40750:tid 40777] [client 20.220.232.101:36360] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x56.php"] [unique_id "aaQNLwfBuk03yQKDyqtMCwAAAdg"]
[Sun Mar 01 17:56:00.932980 2026] [:error] [pid 33822:tid 33827] [client 20.220.232.101:36182] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaQNMG6W3ygu1YVssubp-AAAAoM"]
[Sun Mar 01 17:56:01.913108 2026] [:error] [pid 38241:tid 38256] [client 20.220.232.101:36376] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaQNMfKRPk6YnJBxw_ynpgAAAMw"]
[Sun Mar 01 17:56:02.839987 2026] [:error] [pid 40750:tid 40757] [client 20.220.232.101:36378] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaQNMgfBuk03yQKDyqtMGwAAAcQ"]
[Sun Mar 01 17:56:04.045697 2026] [:error] [pid 40750:tid 40757] [client 20.220.232.101:36384] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htaccess.php"] [unique_id "aaQNNAfBuk03yQKDyqtMLAAAAcQ"]
[Sun Mar 01 17:56:04.621811 2026] [:error] [pid 40750:tid 40771] [client 20.220.232.101:36355] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaQNNAfBuk03yQKDyqtMMwAAAdI"]
[Sun Mar 01 17:56:05.250689 2026] [:error] [pid 38241:tid 38253] [client 20.220.232.101:36393] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaQNNfKRPk6YnJBxw_yntQAAAMk"]
[Sun Mar 01 17:56:05.906824 2026] [:error] [pid 38241:tid 38248] [client 20.220.232.101:36382] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaQNNfKRPk6YnJBxw_ynvQAAAMQ"]
[Sun Mar 01 17:56:06.818186 2026] [:error] [pid 40750:tid 40765] [client 20.220.232.101:36372] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaQNNgfBuk03yQKDyqtMPQAAAcw"]
[Sun Mar 01 17:56:07.472904 2026] [:error] [pid 40750:tid 40753] [client 20.220.232.101:36390] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaQNNwfBuk03yQKDyqtMQQAAAcA"]
[Sun Mar 01 17:56:07.981736 2026] [:error] [pid 40750:tid 40759] [client 20.220.232.101:36403] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaQNNwfBuk03yQKDyqtMRAAAAcY"]
[Sun Mar 01 17:56:08.640065 2026] [:error] [pid 38241:tid 38261] [client 20.220.232.101:36367] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaQNOPKRPk6YnJBxw_yn3wAAANE"]
[Sun Mar 01 17:56:09.225689 2026] [:error] [pid 7165:tid 7177] [client 20.220.232.101:36386] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x50.php"] [unique_id "aaQNORRjCrA8qWBjgG-VkQAAAko"]
[Sun Mar 01 17:56:09.774364 2026] [:error] [pid 7165:tid 7171] [client 20.220.232.101:36353] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaQNORRjCrA8qWBjgG-VmQAAAkQ"]
[Sun Mar 01 17:56:10.256881 2026] [:error] [pid 33822:tid 33836] [client 20.220.232.101:36358] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaQNOm6W3ygu1YVssubp-wAAAow"]
[Sun Mar 01 17:56:10.862775 2026] [:error] [pid 7165:tid 7181] [client 20.220.232.101:36385] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaQNOhRjCrA8qWBjgG-VoQAAAk4"]
[Sun Mar 01 17:56:11.645960 2026] [:error] [pid 40750:tid 40757] [client 20.220.232.101:36164] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fv.php"] [unique_id "aaQNOwfBuk03yQKDyqtMUQAAAcQ"]
[Sun Mar 01 17:56:12.263558 2026] [:error] [pid 41342:tid 41347] [client 20.220.232.101:36352] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaQNPI4iJ6RAS5CatDlTewAAAgI"]
[Sun Mar 01 17:56:12.780313 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36410] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaQNPAfBuk03yQKDyqtMWgAAAcI"]
[Sun Mar 01 17:56:13.442275 2026] [:error] [pid 7133:tid 7151] [client 20.220.232.101:36161] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaQNPfCtubh8pR64qB_3ugAAAFA"]
[Sun Mar 01 17:56:13.911874 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36409] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaQNPQfBuk03yQKDyqtMagAAAco"]
[Sun Mar 01 17:56:14.474967 2026] [:error] [pid 7133:tid 7136] [client 20.220.232.101:36171] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaQNPvCtubh8pR64qB_3vAAAAEE"]
[Sun Mar 01 17:56:15.023909 2026] [:error] [pid 40750:tid 40773] [client 20.220.232.101:36185] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaQNPwfBuk03yQKDyqtMeAAAAdQ"]
[Sun Mar 01 17:56:15.524631 2026] [:error] [pid 41342:tid 41351] [client 20.220.232.101:36162] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaQNP44iJ6RAS5CatDlTfQAAAgY"]
[Sun Mar 01 17:56:16.198303 2026] [:error] [pid 38034:tid 38048] [client 20.220.232.101:36415] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lsd.php"] [unique_id "aaQNQAxtfZjwlJok9K_t2QAAAQo"]
[Sun Mar 01 17:56:16.852907 2026] [:error] [pid 38034:tid 38039] [client 20.220.232.101:36362] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaQNQAxtfZjwlJok9K_t3QAAAQM"]
[Sun Mar 01 17:56:17.463824 2026] [:error] [pid 38241:tid 38267] [client 20.220.232.101:36165] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaQNQfKRPk6YnJBxw_yoFQAAANc"]
[Sun Mar 01 17:56:17.959657 2026] [:error] [pid 33822:tid 33839] [client 20.220.232.101:36172] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaQNQW6W3ygu1YVssubqAgAAAo8"]
[Sun Mar 01 17:56:18.641889 2026] [:error] [pid 7165:tid 7174] [client 20.220.232.101:36413] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaQNQhRjCrA8qWBjgG-VyQAAAkc"]
[Sun Mar 01 17:56:19.334381 2026] [:error] [pid 40750:tid 40766] [client 20.220.232.101:36166] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaQNQwfBuk03yQKDyqtMiwAAAc0"]
[Sun Mar 01 17:56:19.813605 2026] [:error] [pid 40750:tid 40753] [client 20.220.232.101:36206] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaQNQwfBuk03yQKDyqtMkgAAAcA"]
[Sun Mar 01 17:56:20.506882 2026] [:error] [pid 38241:tid 38253] [client 20.220.232.101:36181] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaQNRPKRPk6YnJBxw_yoGQAAAMk"]
[Sun Mar 01 17:56:21.063692 2026] [:error] [pid 7133:tid 7137] [client 20.220.232.101:36412] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaQNRfCtubh8pR64qB_3xgAAAEI"]
[Sun Mar 01 17:56:21.584851 2026] [:error] [pid 40750:tid 40753] [client 20.220.232.101:36398] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaQNRQfBuk03yQKDyqtMoQAAAcA"]
[Sun Mar 01 17:56:22.210640 2026] [:error] [pid 38034:tid 38062] [client 20.220.232.101:36219] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaQNRgxtfZjwlJok9K_t6QAAARg"]
[Sun Mar 01 17:56:22.810698 2026] [:error] [pid 38241:tid 38249] [client 20.220.232.101:36379] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaQNRvKRPk6YnJBxw_yoJAAAAMU"]
[Sun Mar 01 17:56:23.347498 2026] [:error] [pid 7165:tid 7170] [client 20.220.232.101:36202] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaQNRxRjCrA8qWBjgG-V8gAAAkM"]
[Sun Mar 01 17:56:24.269357 2026] [:error] [pid 7133:tid 7142] [client 20.220.232.101:36399] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaQNSPCtubh8pR64qB_3zQAAAEc"]
[Sun Mar 01 17:56:24.770920 2026] [:error] [pid 38241:tid 38254] [client 20.220.232.101:36397] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaQNSPKRPk6YnJBxw_yoLQAAAMo"]
[Sun Mar 01 17:56:25.225458 2026] [:error] [pid 7165:tid 7183] [client 20.220.232.101:36356] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaQNSRRjCrA8qWBjgG-V_AAAAlA"]
[Sun Mar 01 17:56:25.670879 2026] [:error] [pid 7165:tid 7179] [client 20.220.232.101:36163] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atx.php"] [unique_id "aaQNSRRjCrA8qWBjgG-WAgAAAkw"]
[Sun Mar 01 17:56:26.216449 2026] [:error] [pid 38241:tid 38260] [client 20.220.232.101:36389] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaQNSvKRPk6YnJBxw_yoMAAAANA"]
[Sun Mar 01 17:56:26.756836 2026] [:error] [pid 40750:tid 40769] [client 20.220.232.101:36183] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaQNSgfBuk03yQKDyqtMugAAAdA"]
[Sun Mar 01 17:56:27.289253 2026] [:error] [pid 38241:tid 38248] [client 20.220.232.101:36401] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaQNS_KRPk6YnJBxw_yoOQAAAMQ"]
[Sun Mar 01 17:56:27.919574 2026] [:error] [pid 40750:tid 40775] [client 20.220.232.101:36186] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaQNSwfBuk03yQKDyqtMxAAAAdY"]
[Sun Mar 01 17:56:28.592604 2026] [:error] [pid 7165:tid 7183] [client 20.220.232.101:36169] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQNTBRjCrA8qWBjgG-WDAAAAlA"]
[Sun Mar 01 17:56:29.139277 2026] [:error] [pid 7165:tid 7189] [client 20.220.232.101:36829] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQNTRRjCrA8qWBjgG-WEgAAAlY"]
[Sun Mar 01 17:56:29.680904 2026] [:error] [pid 38241:tid 38268] [client 20.220.232.101:36168] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQNTfKRPk6YnJBxw_yoWwAAANg"]
[Sun Mar 01 17:56:30.560313 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36407] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQNTgfBuk03yQKDyqtMzwAAAcc"]
[Sun Mar 01 17:56:31.050263 2026] [:error] [pid 38241:tid 38260] [client 20.220.232.101:36807] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaQNT_KRPk6YnJBxw_yoYwAAANA"]
[Sun Mar 01 17:56:31.592237 2026] [:error] [pid 38241:tid 38263] [client 20.220.232.101:36354] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaQNT_KRPk6YnJBxw_yoaQAAANM"]
[Sun Mar 01 17:56:32.075041 2026] [:error] [pid 38241:tid 38255] [client 20.220.232.101:36375] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaQNUPKRPk6YnJBxw_yobwAAAMs"]
[Sun Mar 01 17:56:32.733744 2026] [:error] [pid 40750:tid 40770] [client 20.220.232.101:36160] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/m.php"] [unique_id "aaQNUAfBuk03yQKDyqtM4gAAAdE"]
[Sun Mar 01 17:56:33.403887 2026] [:error] [pid 7165:tid 7180] [client 20.220.232.101:36194] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaQNURRjCrA8qWBjgG-WIAAAAk0"]
[Sun Mar 01 17:56:33.834982 2026] [:error] [pid 40750:tid 40777] [client 20.220.232.101:36174] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaQNUQfBuk03yQKDyqtM6wAAAdg"]
[Sun Mar 01 17:56:34.634425 2026] [:error] [pid 37032:tid 37041] [client 20.220.232.101:36823] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaQNUuu0U4o7eSImsVRknwAAAYc"]
[Sun Mar 01 17:56:35.308788 2026] [:error] [pid 38241:tid 38261] [client 20.220.232.101:36201] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aaQNU_KRPk6YnJBxw_yoiAAAANE"]
[Sun Mar 01 17:56:35.948557 2026] [:error] [pid 33822:tid 33829] [client 20.220.232.101:36366] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaQNU26W3ygu1YVssubqDAAAAoU"]
[Sun Mar 01 17:56:36.546010 2026] [:error] [pid 38241:tid 38249] [client 20.220.232.101:36413] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaQNVPKRPk6YnJBxw_yongAAAMU"]
[Sun Mar 01 17:56:37.027484 2026] [:error] [pid 7165:tid 7174] [client 20.220.232.101:36806] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaQNVRRjCrA8qWBjgG-WLgAAAkc"]
[Sun Mar 01 17:56:37.700780 2026] [:error] [pid 7165:tid 7170] [client 20.220.232.101:36373] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "aaQNVRRjCrA8qWBjgG-WNAAAAkM"]
[Sun Mar 01 17:56:38.248528 2026] [:error] [pid 40750:tid 40766] [client 20.220.232.101:36414] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaQNVgfBuk03yQKDyqtM-wAAAc0"]
[Sun Mar 01 17:56:38.792837 2026] [:error] [pid 40750:tid 40758] [client 20.220.232.101:36402] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaQNVgfBuk03yQKDyqtNAQAAAcU"]
[Sun Mar 01 17:56:39.499515 2026] [:error] [pid 40750:tid 40777] [client 20.220.232.101:36220] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaQNVwfBuk03yQKDyqtNCQAAAdg"]
[Sun Mar 01 17:56:40.480808 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36404] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aaQNWAfBuk03yQKDyqtNEgAAAco"]
[Sun Mar 01 17:56:40.964575 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36819] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaQNWAfBuk03yQKDyqtNGgAAAcI"]
[Sun Mar 01 17:56:41.506309 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36189] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaQNWQfBuk03yQKDyqtNJAAAAcc"]
[Sun Mar 01 17:56:42.104568 2026] [:error] [pid 38034:tid 38040] [client 20.220.232.101:36190] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaQNWgxtfZjwlJok9K_t_AAAAQQ"]
[Sun Mar 01 17:56:42.787629 2026] [:error] [pid 7133:tid 7136] [client 20.220.232.101:36218] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaQNWvCtubh8pR64qB_34AAAAEE"]
[Sun Mar 01 17:56:43.388911 2026] [:error] [pid 40750:tid 40777] [client 20.220.232.101:36808] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaQNWwfBuk03yQKDyqtNMgAAAdg"]
[Sun Mar 01 17:56:43.970850 2026] [:error] [pid 40750:tid 40773] [client 20.220.232.101:36381] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaQNWwfBuk03yQKDyqtNOAAAAdQ"]
[Sun Mar 01 17:56:44.440540 2026] [:error] [pid 33822:tid 33837] [client 20.220.232.101:36170] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaQNXG6W3ygu1YVssubqDgAAAo0"]
[Sun Mar 01 17:56:45.131243 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36167] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaQNXQfBuk03yQKDyqtNRwAAAco"]
[Sun Mar 01 17:56:45.701480 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36406] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaQNXQfBuk03yQKDyqtNSwAAAcs"]
[Sun Mar 01 17:56:46.273058 2026] [:error] [pid 38241:tid 38257] [client 20.220.232.101:36748] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaQNXvKRPk6YnJBxw_yorwAAAM0"]
[Sun Mar 01 17:56:47.082487 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36213] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaQNXwfBuk03yQKDyqtNYAAAAcI"]
[Sun Mar 01 17:56:47.663656 2026] [:error] [pid 38034:tid 38036] [client 20.220.232.101:36178] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaQNXwxtfZjwlJok9K_uBAAAAQA"]
[Sun Mar 01 17:56:48.126469 2026] [:error] [pid 33822:tid 33831] [client 20.220.232.101:36804] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaQNYG6W3ygu1YVssubqEgAAAoc"]
[Sun Mar 01 17:56:48.605672 2026] [:error] [pid 38034:tid 38051] [client 20.220.232.101:36815] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaQNYAxtfZjwlJok9K_uBwAAAQ0"]
[Sun Mar 01 17:56:49.378404 2026] [:error] [pid 40750:tid 40761] [client 20.220.232.101:36369] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaQNYQfBuk03yQKDyqtNgAAAAcg"]
[Sun Mar 01 17:56:50.068966 2026] [:error] [pid 40750:tid 40775] [client 20.220.232.101:36826] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaQNYgfBuk03yQKDyqtNjAAAAdY"]
[Sun Mar 01 17:56:50.792179 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36197] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaQNYgfBuk03yQKDyqtNlgAAAcc"]
[Sun Mar 01 17:56:51.346719 2026] [:error] [pid 40750:tid 40759] [client 20.220.232.101:36204] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaQNYwfBuk03yQKDyqtNngAAAcY"]
[Sun Mar 01 17:56:51.959986 2026] [:error] [pid 38241:tid 38267] [client 20.220.232.101:36812] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaQNY_KRPk6YnJBxw_yotAAAANc"]
[Sun Mar 01 17:56:52.499717 2026] [:error] [pid 40750:tid 40753] [client 20.220.232.101:36821] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css.php"] [unique_id "aaQNZAfBuk03yQKDyqtNrQAAAcA"]
[Sun Mar 01 17:56:53.200988 2026] [:error] [pid 7165:tid 7167] [client 20.220.232.101:36175] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Mar 01 17:56:53.411600 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36175] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaQNZRRjCrA8qWBjgG-WTAAAAlc"]
[Sun Mar 01 17:56:54.789219 2026] [:error] [pid 40750:tid 40754] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun Mar 01 17:56:54.997193 2026] [:error] [pid 40750:tid 40768] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sun Mar 01 17:56:55.203628 2026] [:error] [pid 40750:tid 40769] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Mar 01 17:56:55.413310 2026] [:error] [pid 40750:tid 40761] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 17:56:55.655469 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Sun Mar 01 17:56:55.869093 2026] [:error] [pid 40750:tid 40768] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Mar 01 17:56:56.080917 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Mar 01 17:56:56.593529 2026] [:error] [pid 40750:tid 40757] [client 20.220.232.101:36831] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 01 17:56:57.019716 2026] [:error] [pid 40750:tid 40766] [client 20.220.232.101:36831] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaQNaQfBuk03yQKDyqtN5AAAAc0"]
[Sun Mar 01 17:56:57.494117 2026] [:error] [pid 38241:tid 38266] [client 20.220.232.101:36211] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaQNafKRPk6YnJBxw_yoyAAAANY"]
[Sun Mar 01 17:56:58.041884 2026] [:error] [pid 38241:tid 38263] [client 20.220.232.101:36405] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaQNavKRPk6YnJBxw_yoyQAAANM"]
[Sun Mar 01 17:56:58.569117 2026] [:error] [pid 7133:tid 7143] [client 20.220.232.101:36207] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aaQNavCtubh8pR64qB_3-gAAAEg"]
[Sun Mar 01 17:56:59.152759 2026] [:error] [pid 37032:tid 37049] [client 20.220.232.101:36177] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaQNa-u0U4o7eSImsVRkoQAAAY8"]
[Sun Mar 01 17:56:59.696834 2026] [:error] [pid 33822:tid 33845] [client 20.220.232.101:36380] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaQNa26W3ygu1YVssubqJwAAApU"]
[Sun Mar 01 17:57:00.191949 2026] [:error] [pid 37032:tid 37047] [client 20.220.232.101:36216] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaQNbOu0U4o7eSImsVRkogAAAY0"]
[Sun Mar 01 17:57:00.720893 2026] [:error] [pid 38034:tid 38050] [client 20.220.232.101:36199] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aaQNbAxtfZjwlJok9K_uEgAAAQw"]
[Sun Mar 01 17:57:01.265989 2026] [:error] [pid 7165:tid 7181] [client 20.220.232.101:36820] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaQNbRRjCrA8qWBjgG-WYAAAAk4"]
[Sun Mar 01 17:57:02.628226 2026] [:error] [pid 40750:tid 40754] [client 20.220.232.101:36814] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaQNbgfBuk03yQKDyqtODAAAAcE"]
[Sun Mar 01 17:57:03.072196 2026] [:error] [pid 40750:tid 40771] [client 20.220.232.101:36824] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaQNbwfBuk03yQKDyqtOFAAAAdI"]
[Sun Mar 01 17:57:03.730192 2026] [:error] [pid 38034:tid 38047] [client 20.220.232.101:36370] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "aaQNbwxtfZjwlJok9K_uEwAAAQk"]
[Sun Mar 01 17:57:04.217434 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36391] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaQNcAfBuk03yQKDyqtOHgAAAcI"]
[Sun Mar 01 17:57:04.701973 2026] [:error] [pid 40750:tid 40766] [client 20.220.232.101:36862] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaQNcAfBuk03yQKDyqtOIwAAAc0"]
[Sun Mar 01 17:57:05.432635 2026] [:error] [pid 40750:tid 40753] [client 20.220.232.101:36801] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaQNcQfBuk03yQKDyqtOMAAAAcA"]
[Sun Mar 01 17:57:06.044567 2026] [:error] [pid 40750:tid 40774] [client 20.220.232.101:36863] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaQNcgfBuk03yQKDyqtONgAAAdU"]
[Sun Mar 01 17:57:06.587297 2026] [:error] [pid 40750:tid 40761] [client 20.220.232.101:36187] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaQNcgfBuk03yQKDyqtOPQAAAcg"]
[Sun Mar 01 17:57:07.629705 2026] [:error] [pid 38034:tid 38055] [client 20.220.232.101:36217] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaQNcwxtfZjwlJok9K_uFAAAARE"]
[Sun Mar 01 17:57:08.234613 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36368] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaQNdAfBuk03yQKDyqtOUQAAAcs"]
[Sun Mar 01 17:57:08.889806 2026] [:error] [pid 40750:tid 40774] [client 20.220.232.101:36825] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aaQNdAfBuk03yQKDyqtOVwAAAdU"]
[Sun Mar 01 17:57:09.462773 2026] [:error] [pid 7165:tid 7191] [client 20.220.232.101:36223] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNdRRjCrA8qWBjgG-WbwAAAlg"]
[Sun Mar 01 17:57:10.129232 2026] [:error] [pid 40750:tid 40770] [client 20.220.232.101:36371] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNdgfBuk03yQKDyqtOagAAAdE"]
[Sun Mar 01 17:57:10.997595 2026] [:error] [pid 7165:tid 7170] [client 20.220.232.101:36404] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNdhRjCrA8qWBjgG-WcgAAAkM"]
[Sun Mar 01 17:57:11.593095 2026] [:error] [pid 40750:tid 40762] [client 20.220.232.101:36205] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNdwfBuk03yQKDyqtOggAAAck"]
[Sun Mar 01 17:57:12.623944 2026] [:error] [pid 40750:tid 40761] [client 20.220.232.101:36764] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaQNeAfBuk03yQKDyqtOjQAAAcg"]
[Sun Mar 01 17:57:13.273817 2026] [:error] [pid 7165:tid 7172] [client 20.220.232.101:36856] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaQNeRRjCrA8qWBjgG-WdgAAAkU"]
[Sun Mar 01 17:57:13.768256 2026] [:error] [pid 7165:tid 7188] [client 20.220.232.101:36860] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaQNeRRjCrA8qWBjgG-WfQAAAlU"]
[Sun Mar 01 17:57:14.255674 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36766] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aaQNehRjCrA8qWBjgG-WgwAAAlc"]
[Sun Mar 01 17:57:14.731757 2026] [:error] [pid 7165:tid 7167] [client 20.220.232.101:36830] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaQNehRjCrA8qWBjgG-WjQAAAkA"]
[Sun Mar 01 17:57:15.790654 2026] [:error] [pid 7133:tid 7156] [client 20.220.232.101:36392] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaQNe_Ctubh8pR64qB_4EgAAAFU"]
[Sun Mar 01 17:57:16.444546 2026] [:error] [pid 7165:tid 7179] [client 20.220.232.101:36222] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaQNfBRjCrA8qWBjgG-WrwAAAkw"]
[Sun Mar 01 17:57:16.945687 2026] [:error] [pid 40750:tid 40770] [client 20.220.232.101:36803] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaQNfAfBuk03yQKDyqtOngAAAdE"]
[Sun Mar 01 17:57:17.544580 2026] [:error] [pid 37032:tid 37051] [client 20.220.232.101:36833] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaQNfeu0U4o7eSImsVRkowAAAZE"]
[Sun Mar 01 17:57:18.132661 2026] [:error] [pid 40750:tid 40756] [client 20.220.232.101:36857] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaQNfgfBuk03yQKDyqtOrQAAAcM"]
[Sun Mar 01 17:57:18.677614 2026] [:error] [pid 7165:tid 7177] [client 20.220.232.101:36210] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaQNfhRjCrA8qWBjgG-WwgAAAko"]
[Sun Mar 01 17:57:19.255197 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36184] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aaQNfxRjCrA8qWBjgG-WyQAAAlc"]
[Sun Mar 01 17:57:19.683637 2026] [:error] [pid 33822:tid 33828] [client 20.220.232.101:36359] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaQNf26W3ygu1YVssubqkgAAAoQ"]
[Sun Mar 01 17:57:20.200158 2026] [:error] [pid 44644:tid 44655] [client 20.220.232.101:36822] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaQNgJ3RJaXMcw3y9V_IcQAAAAg"]
[Sun Mar 01 17:57:20.760764 2026] [:error] [pid 33822:tid 33836] [client 20.220.232.101:36192] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaQNgG6W3ygu1YVssubqoQAAAow"]
[Sun Mar 01 17:57:21.241820 2026] [:error] [pid 33822:tid 33830] [client 20.220.232.101:36805] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aaQNgW6W3ygu1YVssubqpQAAAoY"]
[Sun Mar 01 17:57:21.727758 2026] [:error] [pid 40750:tid 40777] [client 20.220.232.101:36836] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaQNgQfBuk03yQKDyqtOwQAAAdg"]
[Sun Mar 01 17:57:22.374345 2026] [:error] [pid 38241:tid 38262] [client 20.220.232.101:36191] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaQNgvKRPk6YnJBxw_yo4QAAANI"]
[Sun Mar 01 17:57:22.954548 2026] [:error] [pid 38241:tid 38257] [client 20.220.232.101:36818] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaQNgvKRPk6YnJBxw_yo5AAAAM0"]
[Sun Mar 01 17:57:23.444954 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36203] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/manager.php"] [unique_id "aaQNgwfBuk03yQKDyqtO1AAAAcs"]
[Sun Mar 01 17:57:24.034349 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36848] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaQNhAfBuk03yQKDyqtO2QAAAcc"]
[Sun Mar 01 17:57:24.703726 2026] [:error] [pid 7165:tid 7171] [client 20.220.232.101:36777] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaQNhBRjCrA8qWBjgG-W3gAAAkQ"]
[Sun Mar 01 17:57:25.191083 2026] [:error] [pid 38241:tid 38251] [client 20.220.232.101:36827] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaQNhfKRPk6YnJBxw_yo8gAAAMc"]
[Sun Mar 01 17:57:25.764630 2026] [:error] [pid 37032:tid 37035] [client 20.220.232.101:36195] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaQNheu0U4o7eSImsVRkpQAAAYE"]
[Sun Mar 01 17:57:26.278505 2026] [:error] [pid 37032:tid 37040] [client 20.220.232.101:36672] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaQNhuu0U4o7eSImsVRkpgAAAYY"]
[Sun Mar 01 17:57:26.796110 2026] [:error] [pid 37032:tid 37043] [client 20.220.232.101:36847] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaQNhuu0U4o7eSImsVRkqAAAAYk"]
[Sun Mar 01 17:57:27.549910 2026] [:error] [pid 40750:tid 40767] [client 20.220.232.101:36813] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaQNhwfBuk03yQKDyqtO8gAAAc4"]
[Sun Mar 01 17:57:28.033250 2026] [:error] [pid 7133:tid 7151] [client 20.220.232.101:36834] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aaQNiPCtubh8pR64qB_4KAAAAFA"]
[Sun Mar 01 17:57:28.614248 2026] [:error] [pid 38241:tid 38252] [client 20.220.232.101:36180] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaQNiPKRPk6YnJBxw_ypAwAAAMg"]
[Sun Mar 01 17:57:29.103551 2026] [:error] [pid 38241:tid 38265] [client 20.220.232.101:36782] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaQNifKRPk6YnJBxw_ypCQAAANU"]
[Sun Mar 01 17:57:29.570722 2026] [:error] [pid 7133:tid 7153] [client 20.220.232.101:36411] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaQNifCtubh8pR64qB_4LQAAAFI"]
[Sun Mar 01 17:57:30.075327 2026] [:error] [pid 38241:tid 38254] [client 20.220.232.101:36200] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/404.php"] [unique_id "aaQNivKRPk6YnJBxw_ypEgAAAMo"]
[Sun Mar 01 17:57:30.537232 2026] [:error] [pid 38241:tid 38251] [client 20.220.232.101:36742] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaQNivKRPk6YnJBxw_ypGgAAAMc"]
[Sun Mar 01 17:57:31.069476 2026] [:error] [pid 7165:tid 7177] [client 20.220.232.101:36736] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaQNixRjCrA8qWBjgG-W9QAAAko"]
[Sun Mar 01 17:57:31.624379 2026] [:error] [pid 40750:tid 40771] [client 20.220.232.101:36858] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaQNiwfBuk03yQKDyqtPEwAAAdI"]
[Sun Mar 01 17:57:32.248920 2026] [:error] [pid 7133:tid 7142] [client 20.220.232.101:36802] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail.php"] [unique_id "aaQNjPCtubh8pR64qB_4MQAAAEc"]
[Sun Mar 01 17:57:32.700581 2026] [:error] [pid 38241:tid 38252] [client 20.220.232.101:36842] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaQNjPKRPk6YnJBxw_ypIQAAAMg"]
[Sun Mar 01 17:57:33.330074 2026] [:error] [pid 40750:tid 40756] [client 20.220.232.101:36214] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaQNjQfBuk03yQKDyqtPFwAAAcM"]
[Sun Mar 01 17:57:33.771432 2026] [:error] [pid 40750:tid 40765] [client 20.220.232.101:36682] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaQNjQfBuk03yQKDyqtPHAAAAcw"]
[Sun Mar 01 17:57:34.444664 2026] [:error] [pid 7165:tid 7181] [client 20.220.232.101:36749] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "aaQNjhRjCrA8qWBjgG-XBAAAAk4"]
[Sun Mar 01 17:57:34.912069 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36193] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aaQNjgfBuk03yQKDyqtPKgAAAcs"]
[Sun Mar 01 17:57:35.429260 2026] [:error] [pid 33822:tid 33824] [client 20.220.232.101:36753] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aaQNj26W3ygu1YVssubqsAAAAoA"]
[Sun Mar 01 17:57:36.007449 2026] [:error] [pid 38241:tid 38252] [client 20.220.232.101:36361] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aaQNkPKRPk6YnJBxw_ypLAAAAMg"]
[Sun Mar 01 17:57:36.614252 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36809] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sx.php"] [unique_id "aaQNkBRjCrA8qWBjgG-XEgAAAlc"]
[Sun Mar 01 17:57:37.304512 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36680] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaQNkQfBuk03yQKDyqtPOAAAAcc"]
[Sun Mar 01 17:57:37.868151 2026] [:error] [pid 40750:tid 40774] [client 20.220.232.101:36215] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaQNkQfBuk03yQKDyqtPPgAAAdU"]
[Sun Mar 01 17:57:38.359216 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36365] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaQNkgfBuk03yQKDyqtPRwAAAcc"]
[Sun Mar 01 17:57:38.807212 2026] [:error] [pid 40750:tid 40772] [client 20.220.232.101:36840] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "aaQNkgfBuk03yQKDyqtPTwAAAdM"]
[Sun Mar 01 17:57:39.387459 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36855] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNkxRjCrA8qWBjgG-XIwAAAkk"]
[Sun Mar 01 17:57:40.122549 2026] [:error] [pid 7165:tid 7179] [client 20.220.232.101:36843] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNlBRjCrA8qWBjgG-XKQAAAkw"]
[Sun Mar 01 17:57:40.854259 2026] [:error] [pid 33822:tid 33840] [client 20.220.232.101:36838] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNlG6W3ygu1YVssubqsgAAApA"]
[Sun Mar 01 17:57:41.696269 2026] [:error] [pid 33822:tid 33844] [client 20.220.232.101:36209] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa.php"] [unique_id "aaQNlW6W3ygu1YVssubqtQAAApQ"]
[Sun Mar 01 17:57:42.500704 2026] [:error] [pid 7165:tid 7191] [client 20.220.232.101:36854] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaQNlhRjCrA8qWBjgG-XMgAAAlg"]
[Sun Mar 01 17:57:42.965677 2026] [:error] [pid 33822:tid 33832] [client 20.220.232.101:36408] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaQNlm6W3ygu1YVssubquAAAAog"]
[Sun Mar 01 17:57:43.507551 2026] [:error] [pid 33822:tid 33848] [client 20.220.232.101:36198] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaQNl26W3ygu1YVssubquQAAApg"]
[Sun Mar 01 17:57:44.029338 2026] [:error] [pid 33822:tid 33839] [client 20.220.232.101:36771] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaQNmG6W3ygu1YVssubqvgAAAo8"]
[Sun Mar 01 17:57:44.706446 2026] [:error] [pid 33822:tid 33825] [client 20.220.232.101:36754] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aaQNmG6W3ygu1YVssubqwgAAAoE"]
[Sun Mar 01 17:57:45.222159 2026] [:error] [pid 7133:tid 7154] [client 20.220.232.101:36816] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aaQNmfCtubh8pR64qB_4SQAAAFM"]
[Sun Mar 01 17:57:45.722715 2026] [:error] [pid 33822:tid 33836] [client 20.220.232.101:36832] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aaQNmW6W3ygu1YVssubqxgAAAow"]
[Sun Mar 01 17:57:46.286823 2026] [:error] [pid 38241:tid 38258] [client 20.220.232.101:36758] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byp.php"] [unique_id "aaQNmvKRPk6YnJBxw_ypRwAAAM4"]
[Sun Mar 01 17:57:46.857328 2026] [:error] [pid 38241:tid 38254] [client 20.220.232.101:36790] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaQNmvKRPk6YnJBxw_ypTQAAAMo"]
[Sun Mar 01 17:57:47.392208 2026] [:error] [pid 40750:tid 40758] [client 20.220.232.101:36221] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaQNmwfBuk03yQKDyqtPggAAAcU"]
[Sun Mar 01 17:57:47.855137 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36845] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaQNmwfBuk03yQKDyqtPhgAAAco"]
[Sun Mar 01 17:57:48.421302 2026] [:error] [pid 40750:tid 40762] [client 20.220.232.101:36849] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaQNnAfBuk03yQKDyqtPjgAAAck"]
[Sun Mar 01 17:57:48.963665 2026] [:error] [pid 40750:tid 40770] [client 20.220.232.101:36800] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aaQNnAfBuk03yQKDyqtPlgAAAdE"]
[Sun Mar 01 17:57:49.423872 2026] [:error] [pid 40750:tid 40762] [client 20.220.232.101:36686] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aaQNnQfBuk03yQKDyqtPnAAAAck"]
[Sun Mar 01 17:57:49.966601 2026] [:error] [pid 38241:tid 38258] [client 20.220.232.101:36841] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aaQNnfKRPk6YnJBxw_ypUwAAAM4"]
[Sun Mar 01 17:57:50.703722 2026] [:error] [pid 38241:tid 38256] [client 20.220.232.101:36852] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/index.php"] [unique_id "aaQNnvKRPk6YnJBxw_ypVgAAAMw"]
[Sun Mar 01 17:57:51.203737 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36780] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaQNnxRjCrA8qWBjgG-XQwAAAlc"]
[Sun Mar 01 17:57:51.962754 2026] [:error] [pid 7165:tid 7184] [client 20.220.232.101:36788] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaQNnxRjCrA8qWBjgG-XSQAAAlE"]
[Sun Mar 01 17:57:52.832662 2026] [:error] [pid 7165:tid 7171] [client 20.220.232.101:36846] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaQNoBRjCrA8qWBjgG-XUAAAAkQ"]
[Sun Mar 01 17:57:53.488718 2026] [:error] [pid 40750:tid 40765] [client 20.220.232.101:36752] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "aaQNoQfBuk03yQKDyqtPvAAAAcw"]
[Sun Mar 01 17:57:54.249490 2026] [:error] [pid 38034:tid 38036] [client 20.220.232.101:36762] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aaQNogxtfZjwlJok9K_uKAAAAQA"]
[Sun Mar 01 17:57:55.170755 2026] [:error] [pid 7133:tid 7135] [client 20.220.232.101:36196] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aaQNo_Ctubh8pR64qB_4VwAAAEA"]
[Sun Mar 01 17:57:55.766125 2026] [:error] [pid 38241:tid 38263] [client 20.220.232.101:36785] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "aaQNo_KRPk6YnJBxw_ypZAAAANM"]
[Sun Mar 01 17:57:56.843766 2026] [:error] [pid 33822:tid 33824] [client 20.220.232.101:36188] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Sun Mar 01 17:57:57.129743 2026] [:error] [pid 33822:tid 33830] [client 20.220.232.101:36188] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaQNpW6W3ygu1YVssubq1gAAAoY"]
[Sun Mar 01 17:57:58.042007 2026] [:error] [pid 33822:tid 33828] [client 20.220.232.101:36755] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aaQNpm6W3ygu1YVssubq2gAAAoQ"]
[Sun Mar 01 17:57:59.769479 2026] [:error] [pid 7165:tid 7168] [client 20.220.232.101:36817] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aaQNpxRjCrA8qWBjgG-XcQAAAkE"]
[Sun Mar 01 17:58:01.068457 2026] [:error] [pid 7165:tid 7169] [client 20.220.232.101:36859] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aaQNqRRjCrA8qWBjgG-XfwAAAkI"]
[Sun Mar 01 17:58:01.824155 2026] [:error] [pid 7165:tid 7181] [client 20.220.232.101:36837] File does not exist: /usr/local/apache/htdocs/suspended-page/ww1.php
[Sun Mar 01 17:58:02.468182 2026] [:error] [pid 7165:tid 7172] [client 20.220.232.101:36837] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaQNqhRjCrA8qWBjgG-XkgAAAkU"]
[Sun Mar 01 17:58:03.378167 2026] [:error] [pid 7133:tid 7149] [client 20.220.232.101:36775] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaQNq_Ctubh8pR64qB_4YgAAAE4"]
[Sun Mar 01 17:58:04.184710 2026] [:error] [pid 7165:tid 7178] [client 20.220.232.101:36383] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaQNrBRjCrA8qWBjgG-XmQAAAks"]
[Sun Mar 01 17:58:04.901310 2026] [:error] [pid 7165:tid 7181] [client 20.220.232.101:36400] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aaQNrBRjCrA8qWBjgG-XogAAAk4"]
[Sun Mar 01 17:58:05.573159 2026] [:error] [pid 7165:tid 7188] [client 20.220.232.101:36676] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaQNrRRjCrA8qWBjgG-XqwAAAlU"]
[Sun Mar 01 17:58:06.727498 2026] [:error] [pid 7165:tid 7184] [client 20.220.232.101:36796] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaQNrhRjCrA8qWBjgG-XvAAAAlE"]
[Sun Mar 01 17:58:07.913876 2026] [:error] [pid 38034:tid 38039] [client 20.220.232.101:36784] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaQNrwxtfZjwlJok9K_uPQAAAQM"]
[Sun Mar 01 17:58:09.092616 2026] [:error] [pid 40750:tid 40772] [client 20.220.232.101:36835] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "aaQNsQfBuk03yQKDyqtQBgAAAdM"]
[Sun Mar 01 17:58:10.403547 2026] [:error] [pid 40750:tid 40756] [client 20.220.232.101:36781] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaQNsgfBuk03yQKDyqtQFQAAAcM"]
[Sun Mar 01 17:58:11.686086 2026] [:error] [pid 7165:tid 7170] [client 20.220.232.101:36675] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaQNsxRjCrA8qWBjgG-X0wAAAkM"]
[Sun Mar 01 17:58:12.664042 2026] [:error] [pid 40750:tid 40776] [client 20.220.232.101:36703] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaQNtAfBuk03yQKDyqtQLQAAAdc"]
[Sun Mar 01 17:58:13.697721 2026] [:error] [pid 38241:tid 38248] [client 20.220.232.101:36751] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaQNtfKRPk6YnJBxw_ypggAAAMQ"]
[Sun Mar 01 17:58:14.517811 2026] [:error] [pid 7133:tid 7137] [client 20.220.232.101:36738] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaQNtvCtubh8pR64qB_4cQAAAEI"]
[Sun Mar 01 17:58:15.215959 2026] [:error] [pid 7133:tid 7159] [client 20.220.232.101:36761] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaQNt_Ctubh8pR64qB_4eQAAAFg"]
[Sun Mar 01 17:58:15.896789 2026] [:error] [pid 40750:tid 40777] [client 20.220.232.101:36630] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaQNtwfBuk03yQKDyqtQQgAAAdg"]
[Sun Mar 01 17:58:16.376194 2026] [:error] [pid 40750:tid 40773] [client 20.220.232.101:36685] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "aaQNuAfBuk03yQKDyqtQSQAAAdQ"]
[Sun Mar 01 17:58:17.650102 2026] [:error] [pid 7165:tid 7177] [client 20.220.232.101:36773] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaQNuRRjCrA8qWBjgG-X2QAAAko"]
[Sun Mar 01 17:58:18.436185 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36770] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaQNugfBuk03yQKDyqtQUwAAAcs"]
[Sun Mar 01 17:58:18.980513 2026] [:error] [pid 37032:tid 37052] [client 20.220.232.101:36763] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaQNuuu0U4o7eSImsVRktAAAAZI"]
[Sun Mar 01 17:58:19.648774 2026] [:error] [pid 7133:tid 7144] [client 20.220.232.101:36195] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aaQNu_Ctubh8pR64qB_4iAAAAEk"]
[Sun Mar 01 17:58:20.264931 2026] [:error] [pid 38241:tid 38251] [client 20.220.232.101:36202] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaQNvPKRPk6YnJBxw_ypmQAAAMc"]
[Sun Mar 01 17:58:21.001243 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36725] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaQNvAfBuk03yQKDyqtQYQAAAcs"]
[Sun Mar 01 17:58:21.694600 2026] [:error] [pid 40750:tid 40761] [client 20.220.232.101:36737] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaQNvQfBuk03yQKDyqtQawAAAcg"]
[Sun Mar 01 17:58:22.873837 2026] [:error] [pid 38241:tid 38248] [client 20.220.232.101:36212] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "aaQNvvKRPk6YnJBxw_ypmwAAAMQ"]
[Sun Mar 01 17:58:23.870222 2026] [:error] [pid 40750:tid 40758] [client 20.220.232.101:36724] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaQNvwfBuk03yQKDyqtQhwAAAcU"]
[Sun Mar 01 17:58:24.502818 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36702] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaQNwAfBuk03yQKDyqtQkAAAAcs"]
[Sun Mar 01 17:58:25.027465 2026] [:error] [pid 38241:tid 38256] [client 20.220.232.101:36789] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaQNwfKRPk6YnJBxw_ypoQAAAMw"]
[Sun Mar 01 17:58:25.768553 2026] [:error] [pid 7165:tid 7184] [client 20.220.232.101:36787] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaQNwRRjCrA8qWBjgG-X3wAAAlE"]
[Sun Mar 01 17:58:26.415760 2026] [:error] [pid 44644:tid 44653] [client 20.220.232.101:36678] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aaQNwp3RJaXMcw3y9V_IeQAAAAY"]
[Sun Mar 01 17:58:26.981734 2026] [:error] [pid 38241:tid 38265] [client 20.220.232.101:36699] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaQNwvKRPk6YnJBxw_yppwAAANU"]
[Sun Mar 01 17:58:27.667176 2026] [:error] [pid 7165:tid 7170] [client 20.220.232.101:36693] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaQNwxRjCrA8qWBjgG-X7wAAAkM"]
[Sun Mar 01 17:58:28.467156 2026] [:error] [pid 38241:tid 38260] [client 20.220.232.101:36810] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaQNxPKRPk6YnJBxw_ypqQAAANA"]
[Sun Mar 01 17:58:29.289315 2026] [:error] [pid 38241:tid 38267] [client 20.220.232.101:36828] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaQNxfKRPk6YnJBxw_yprgAAANc"]
[Sun Mar 01 17:58:29.800190 2026] [:error] [pid 38241:tid 38258] [client 20.220.232.101:36759] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaQNxfKRPk6YnJBxw_ypsgAAAM4"]
[Sun Mar 01 17:58:30.368670 2026] [:error] [pid 38241:tid 38252] [client 20.220.232.101:36612] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaQNxvKRPk6YnJBxw_yptwAAAMg"]
[Sun Mar 01 17:58:31.168451 2026] [:error] [pid 38034:tid 38056] [client 20.220.232.101:36839] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaQNxwxtfZjwlJok9K_uSwAAARI"]
[Sun Mar 01 17:58:32.188880 2026] [:error] [pid 38241:tid 38255] [client 20.220.232.101:36776] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaQNyPKRPk6YnJBxw_ypwQAAAMs"]
[Sun Mar 01 17:58:33.976941 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36853] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaQNyRRjCrA8qWBjgG-YEgAAAkk"]
[Sun Mar 01 17:58:34.716618 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36609] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaQNygfBuk03yQKDyqtQpwAAAcc"]
[Sun Mar 01 17:58:35.440698 2026] [:error] [pid 38241:tid 38247] [client 20.220.232.101:36691] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaQNy_KRPk6YnJBxw_ypzgAAAMM"]
[Sun Mar 01 17:58:36.235647 2026] [:error] [pid 40750:tid 40775] [client 20.220.232.101:36793] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aaQNzAfBuk03yQKDyqtQsAAAAdY"]
[Sun Mar 01 17:58:37.012937 2026] [:error] [pid 7165:tid 7175] [client 20.220.232.101:36746] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaQNzRRjCrA8qWBjgG-YGQAAAkg"]
[Sun Mar 01 17:58:37.523246 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36697] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaQNzRRjCrA8qWBjgG-YHwAAAkk"]
[Sun Mar 01 17:58:38.480569 2026] [:error] [pid 40750:tid 40769] [client 20.220.232.101:36851] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaQNzgfBuk03yQKDyqtQvwAAAdA"]
[Sun Mar 01 17:58:39.196115 2026] [:error] [pid 38241:tid 38246] [client 20.220.232.101:36650] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "aaQNz_KRPk6YnJBxw_yp2QAAAMI"]
[Sun Mar 01 17:58:39.706771 2026] [:error] [pid 38034:tid 38051] [client 20.220.232.101:36750] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaQNzwxtfZjwlJok9K_uUgAAAQ0"]
[Sun Mar 01 17:58:40.292218 2026] [:error] [pid 38241:tid 38258] [client 20.220.232.101:36681] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaQN0PKRPk6YnJBxw_yp5AAAAM4"]
[Sun Mar 01 17:58:41.187974 2026] [:error] [pid 38241:tid 38244] [client 20.220.232.101:36768] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaQN0fKRPk6YnJBxw_yp6QAAAMA"]
[Sun Mar 01 17:58:42.017329 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36212] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aaQN0gfBuk03yQKDyqtQzAAAAco"]
[Sun Mar 01 17:58:42.612555 2026] [:error] [pid 38241:tid 38267] [client 20.220.232.101:36767] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aaQN0vKRPk6YnJBxw_yp8wAAANc"]
[Sun Mar 01 17:58:43.307319 2026] [:error] [pid 44644:tid 44650] [client 20.220.232.101:36709] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aaQN053RJaXMcw3y9V_IfAAAAAM"]
[Sun Mar 01 17:58:43.825794 2026] [:error] [pid 33822:tid 33826] [client 20.220.232.101:36798] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aaQN026W3ygu1YVssubq_QAAAoI"]
[Sun Mar 01 17:58:44.343361 2026] [:error] [pid 40750:tid 40759] [client 20.220.232.101:36743] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/log.php"] [unique_id "aaQN1AfBuk03yQKDyqtQ1gAAAcY"]
[Sun Mar 01 17:58:44.982135 2026] [:error] [pid 7133:tid 7142] [client 20.220.232.101:36651] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaQN1PCtubh8pR64qB_4rwAAAEc"]
[Sun Mar 01 17:58:45.885562 2026] [:error] [pid 7133:tid 7150] [client 20.220.232.101:36611] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaQN1fCtubh8pR64qB_4swAAAE8"]
[Sun Mar 01 17:58:46.889097 2026] [:error] [pid 7165:tid 7191] [client 20.220.232.101:36700] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaQN1hRjCrA8qWBjgG-YKAAAAlg"]
[Sun Mar 01 17:58:47.488155 2026] [:error] [pid 38241:tid 38258] [client 20.220.232.101:36850] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaQN1_KRPk6YnJBxw_yp-QAAAM4"]
[Sun Mar 01 17:58:48.111842 2026] [:error] [pid 40750:tid 40772] [client 20.220.232.101:36792] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless5.php"] [unique_id "aaQN2AfBuk03yQKDyqtQ4wAAAdM"]
[Sun Mar 01 17:58:48.591108 2026] [:error] [pid 7165:tid 7182] [client 20.220.232.101:36760] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless5.php"] [unique_id "aaQN2BRjCrA8qWBjgG-YKwAAAk8"]
[Sun Mar 01 17:58:49.535838 2026] [:error] [pid 7165:tid 7174] [client 20.220.232.101:36741] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless5.php"] [unique_id "aaQN2RRjCrA8qWBjgG-YMQAAAkc"]
[Sun Mar 01 17:58:50.050334 2026] [:error] [pid 7165:tid 7180] [client 20.220.232.101:36774] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless5.php"] [unique_id "aaQN2hRjCrA8qWBjgG-YNQAAAk0"]
[Sun Mar 01 17:58:50.662452 2026] [:error] [pid 7165:tid 7186] [client 20.220.232.101:36733] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaQN2hRjCrA8qWBjgG-YOgAAAlM"]
[Sun Mar 01 17:58:51.133034 2026] [:error] [pid 33822:tid 33834] [client 20.220.232.101:36713] [client 20.220.232.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaQN226W3ygu1YVssubrAQAAAoo"]
[Sun Mar 01 17:58:52.243740 2026] [:error] [pid 7133:tid 7143] [client 20.220.232.101:36778] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaQN3PCtubh8pR64qB_4vQAAAEg"]
[Sun Mar 01 17:58:53.433613 2026] [:error] [pid 38241:tid 38259] [client 20.220.232.101:36694] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaQN3fKRPk6YnJBxw_yqDQAAAM8"]
[Sun Mar 01 17:58:53.939145 2026] [:error] [pid 7133:tid 7147] [client 20.220.232.101:36711] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaQN3fCtubh8pR64qB_4vgAAAEw"]
[Sun Mar 01 17:58:54.643243 2026] [:error] [pid 40750:tid 40775] [client 20.220.232.101:36698] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaQN3gfBuk03yQKDyqtQ9gAAAdY"]
[Sun Mar 01 17:58:55.413167 2026] [:error] [pid 7165:tid 7168] [client 20.220.232.101:36641] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aaQN3xRjCrA8qWBjgG-YRwAAAkE"]
[Sun Mar 01 17:58:55.849041 2026] [:error] [pid 40750:tid 40770] [client 20.220.232.101:36671] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aaQN3wfBuk03yQKDyqtQ_gAAAdE"]
[Sun Mar 01 17:58:56.449793 2026] [:error] [pid 40750:tid 40776] [client 20.220.232.101:36677] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aaQN4AfBuk03yQKDyqtRAgAAAdc"]
[Sun Mar 01 17:58:57.583556 2026] [:error] [pid 7165:tid 7180] [client 20.220.232.101:36707] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aaQN4RRjCrA8qWBjgG-YTgAAAk0"]
[Sun Mar 01 17:58:58.358009 2026] [:error] [pid 33822:tid 33836] [client 20.220.232.101:36657] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aaQN4m6W3ygu1YVssubrBgAAAow"]
[Sun Mar 01 17:58:59.298961 2026] [:error] [pid 33822:tid 33831] [client 20.220.232.101:36663] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aaQN426W3ygu1YVssubrBwAAAoc"]
[Sun Mar 01 17:59:00.282283 2026] [:error] [pid 40750:tid 40768] [client 20.220.232.101:36723] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aaQN5AfBuk03yQKDyqtRIAAAAc8"]
[Sun Mar 01 17:59:00.884909 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36695] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "aaQN5BRjCrA8qWBjgG-YaQAAAkk"]
[Sun Mar 01 17:59:01.846189 2026] [:error] [pid 7133:tid 7157] [client 20.220.232.101:36633] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/juuuu.php"] [unique_id "aaQN5fCtubh8pR64qB_4xwAAAFY"]
[Sun Mar 01 17:59:03.720865 2026] [:error] [pid 7165:tid 7184] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/juuuu.php
[Sun Mar 01 17:59:03.937461 2026] [:error] [pid 7165:tid 7171] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sun Mar 01 17:59:04.150642 2026] [:error] [pid 7165:tid 7182] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sun Mar 01 17:59:04.364651 2026] [:error] [pid 7165:tid 7167] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/we2.php
[Sun Mar 01 17:59:04.578802 2026] [:error] [pid 7165:tid 7186] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/04.php
[Sun Mar 01 17:59:04.794631 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun Mar 01 17:59:05.271707 2026] [:error] [pid 7165:tid 7183] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/520.php
[Sun Mar 01 17:59:05.484604 2026] [:error] [pid 7165:tid 7186] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Sun Mar 01 17:59:05.699350 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Mar 01 17:59:05.912869 2026] [:error] [pid 7165:tid 7174] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sun Mar 01 17:59:06.126609 2026] [:error] [pid 7165:tid 7172] [client 20.220.232.101:36706] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass4.php
[Sun Mar 01 17:59:06.335771 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36706] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaQN6hRjCrA8qWBjgG-YpwAAAlc"]
[Sun Mar 01 17:59:06.937048 2026] [:error] [pid 33822:tid 33827] [client 20.220.232.101:36726] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaQN6m6W3ygu1YVssubrFAAAAoM"]
[Sun Mar 01 17:59:07.438499 2026] [:error] [pid 7165:tid 7177] [client 20.220.232.101:36687] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaQN6xRjCrA8qWBjgG-YqgAAAko"]
[Sun Mar 01 17:59:07.883230 2026] [:error] [pid 38241:tid 38260] [client 20.220.232.101:36769] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2clas.php"] [unique_id "aaQN6_KRPk6YnJBxw_yqJgAAANA"]
[Sun Mar 01 17:59:08.798980 2026] [:error] [pid 38241:tid 38249] [client 20.220.232.101:36756] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaQN7PKRPk6YnJBxw_yqKwAAAMU"]
[Sun Mar 01 17:59:09.294668 2026] [:error] [pid 7165:tid 7183] [client 20.220.232.101:36629] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaQN7RRjCrA8qWBjgG-Y0QAAAlA"]
[Sun Mar 01 17:59:09.889614 2026] [:error] [pid 7165:tid 7186] [client 20.220.232.101:36765] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaQN7RRjCrA8qWBjgG-Y2AAAAlM"]
[Sun Mar 01 17:59:10.491769 2026] [:error] [pid 7165:tid 7184] [client 20.220.232.101:36739] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ave.php"] [unique_id "aaQN7hRjCrA8qWBjgG-Y5wAAAlE"]
[Sun Mar 01 17:59:11.437337 2026] [:error] [pid 7165:tid 7189] [client 20.220.232.101:36625] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaQN7xRjCrA8qWBjgG-Y9QAAAlY"]
[Sun Mar 01 17:59:11.952088 2026] [:error] [pid 40750:tid 40758] [client 20.220.232.101:36615] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaQN7wfBuk03yQKDyqtRXwAAAcU"]
[Sun Mar 01 17:59:12.418037 2026] [:error] [pid 40750:tid 40777] [client 20.220.232.101:36387] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaQN8AfBuk03yQKDyqtRYgAAAdg"]
[Sun Mar 01 17:59:12.990681 2026] [:error] [pid 38241:tid 38260] [client 20.220.232.101:36710] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wrt.php"] [unique_id "aaQN8PKRPk6YnJBxw_yqNgAAANA"]
[Sun Mar 01 17:59:13.634182 2026] [:error] [pid 38241:tid 38261] [client 20.220.232.101:36731] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaQN8fKRPk6YnJBxw_yqOgAAANE"]
[Sun Mar 01 17:59:14.207156 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36720] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaQN8hRjCrA8qWBjgG-Y-wAAAkk"]
[Sun Mar 01 17:59:14.752264 2026] [:error] [pid 41342:tid 41355] [client 20.220.232.101:36721] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaQN8o4iJ6RAS5CatDlThAAAAgo"]
[Sun Mar 01 17:59:15.252772 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36658] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bibil.php"] [unique_id "aaQN8xRjCrA8qWBjgG-Y_gAAAlc"]
[Sun Mar 01 17:59:15.861209 2026] [:error] [pid 7165:tid 7186] [client 20.220.232.101:36689] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaQN8xRjCrA8qWBjgG-ZBAAAAlM"]
[Sun Mar 01 17:59:16.434654 2026] [:error] [pid 41780:tid 41784] [client 20.220.232.101:36673] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaQN9MONkVoocLIqzy0dZwAAA8E"]
[Sun Mar 01 17:59:17.175658 2026] [:error] [pid 7165:tid 7178] [client 20.220.232.101:36786] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaQN9RRjCrA8qWBjgG-ZDwAAAks"]
[Sun Mar 01 17:59:17.954098 2026] [:error] [pid 38241:tid 38253] [client 20.220.232.101:36732] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaQN9fKRPk6YnJBxw_yqUAAAAMk"]
[Sun Mar 01 17:59:18.500114 2026] [:error] [pid 7165:tid 7177] [client 20.220.232.101:36681] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaQN9hRjCrA8qWBjgG-ZFgAAAko"]
[Sun Mar 01 17:59:19.346095 2026] [:error] [pid 38241:tid 38267] [client 20.220.232.101:36652] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaQN9_KRPk6YnJBxw_yqWQAAANc"]
[Sun Mar 01 17:59:20.367647 2026] [:error] [pid 7165:tid 7176] [client 20.220.232.101:36610] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaQN-BRjCrA8qWBjgG-ZHQAAAkk"]
[Sun Mar 01 17:59:21.047219 2026] [:error] [pid 33822:tid 33844] [client 20.220.232.101:36614] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files.php"] [unique_id "aaQN-W6W3ygu1YVssubrkQAAApQ"]
[Sun Mar 01 17:59:21.722345 2026] [:error] [pid 33822:tid 33831] [client 20.220.232.101:36722] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaQN-W6W3ygu1YVssubrlwAAAoc"]
[Sun Mar 01 17:59:22.281434 2026] [:error] [pid 7165:tid 7189] [client 20.220.232.101:36705] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaQN-hRjCrA8qWBjgG-ZKAAAAlY"]
[Sun Mar 01 17:59:22.812084 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36653] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaQN-gfBuk03yQKDyqtRdQAAAco"]
[Sun Mar 01 17:59:23.744636 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36651] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaQN-wfBuk03yQKDyqtRfwAAAcI"]
[Sun Mar 01 17:59:24.290821 2026] [:error] [pid 40750:tid 40768] [client 20.220.232.101:36779] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaQN_AfBuk03yQKDyqtRigAAAc8"]
[Sun Mar 01 17:59:24.828986 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36638] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaQN_AfBuk03yQKDyqtRlAAAAcI"]
[Sun Mar 01 17:59:25.436163 2026] [:error] [pid 7165:tid 7189] [client 20.220.232.101:36628] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaQN_RRjCrA8qWBjgG-ZOAAAAlY"]
[Sun Mar 01 17:59:26.050113 2026] [:error] [pid 7133:tid 7141] [client 20.220.232.101:36726] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aaQN_vCtubh8pR64qB_45QAAAEY"]
[Sun Mar 01 17:59:26.729260 2026] [:error] [pid 33822:tid 33831] [client 20.220.232.101:36654] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaQN_m6W3ygu1YVssubroAAAAoc"]
[Sun Mar 01 17:59:27.242462 2026] [:error] [pid 40750:tid 40762] [client 20.220.232.101:36683] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaQN_wfBuk03yQKDyqtRpAAAAck"]
[Sun Mar 01 17:59:27.773167 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36626] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaQN_xRjCrA8qWBjgG-ZQAAAAlc"]
[Sun Mar 01 17:59:28.280292 2026] [:error] [pid 7165:tid 7178] [client 20.220.232.101:36618] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aaQOABRjCrA8qWBjgG-ZQwAAAks"]
[Sun Mar 01 17:59:28.773355 2026] [:error] [pid 37032:tid 37050] [client 20.220.232.101:36684] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aaQOAOu0U4o7eSImsVRkywAAAZA"]
[Sun Mar 01 17:59:29.303146 2026] [:error] [pid 7165:tid 7191] [client 20.220.232.101:36719] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aaQOARRjCrA8qWBjgG-ZTAAAAlg"]
[Sun Mar 01 17:59:29.729879 2026] [:error] [pid 44644:tid 44648] [client 20.220.232.101:36551] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aaQOAZ3RJaXMcw3y9V_IhwAAAAE"]
[Sun Mar 01 17:59:30.487281 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36660] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nox.php"] [unique_id "aaQOAgfBuk03yQKDyqtRqAAAAco"]
[Sun Mar 01 17:59:30.942886 2026] [:error] [pid 40750:tid 40772] [client 20.220.232.101:36680] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaQOAgfBuk03yQKDyqtRrQAAAdM"]
[Sun Mar 01 17:59:31.749690 2026] [:error] [pid 38241:tid 38248] [client 20.220.232.101:36632] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaQOA_KRPk6YnJBxw_yqhQAAAMQ"]
[Sun Mar 01 17:59:32.225956 2026] [:error] [pid 38034:tid 38045] [client 20.220.232.101:36552] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaQOBAxtfZjwlJok9K_udwAAAQc"]
[Sun Mar 01 17:59:32.842341 2026] [:error] [pid 7133:tid 7148] [client 20.220.232.101:36791] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaQOBPCtubh8pR64qB_49AAAAE0"]
[Sun Mar 01 17:59:33.499245 2026] [:error] [pid 7133:tid 7157] [client 20.220.232.101:36357] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaQOBfCtubh8pR64qB_4-AAAAFY"]
[Sun Mar 01 17:59:34.226820 2026] [:error] [pid 38241:tid 38263] [client 20.220.232.101:36783] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaQOBvKRPk6YnJBxw_yqjwAAANM"]
[Sun Mar 01 17:59:34.799352 2026] [:error] [pid 38034:tid 38061] [client 20.220.232.101:36634] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaQOBgxtfZjwlJok9K_uegAAARc"]
[Sun Mar 01 17:59:35.422927 2026] [:error] [pid 40750:tid 40767] [client 20.220.232.101:36642] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaQOBwfBuk03yQKDyqtRwAAAAc4"]
[Sun Mar 01 17:59:36.014147 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36622] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aaQOCAfBuk03yQKDyqtRwgAAAcc"]
[Sun Mar 01 17:59:36.563036 2026] [:error] [pid 7165:tid 7190] [client 20.220.232.101:36728] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aaQOCBRjCrA8qWBjgG-ZWAAAAlc"]
[Sun Mar 01 17:59:37.038106 2026] [:error] [pid 7165:tid 7183] [client 20.220.232.101:36717] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aaQOCRRjCrA8qWBjgG-ZWwAAAlA"]
[Sun Mar 01 17:59:37.534435 2026] [:error] [pid 40750:tid 40775] [client 20.220.232.101:36545] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class9.php"] [unique_id "aaQOCQfBuk03yQKDyqtRygAAAdY"]
[Sun Mar 01 17:59:38.092115 2026] [:error] [pid 40750:tid 40758] [client 20.220.232.101:36631] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaQOCgfBuk03yQKDyqtRzQAAAcU"]
[Sun Mar 01 17:59:38.679417 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36696] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaQOCgfBuk03yQKDyqtR0gAAAcc"]
[Sun Mar 01 17:59:39.381145 2026] [:error] [pid 44644:tid 44669] [client 20.220.232.101:36716] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaQOC53RJaXMcw3y9V_IigAAABY"]
[Sun Mar 01 17:59:39.942776 2026] [:error] [pid 38241:tid 38255] [client 20.220.232.101:36701] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaQOC_KRPk6YnJBxw_yqnQAAAMs"]
[Sun Mar 01 17:59:40.467829 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36740] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aaQODAfBuk03yQKDyqtR4AAAAcs"]
[Sun Mar 01 17:59:41.115658 2026] [:error] [pid 40750:tid 40771] [client 20.220.232.101:36744] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aaQODQfBuk03yQKDyqtR6AAAAdI"]
[Sun Mar 01 17:59:41.573020 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36844] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aaQODQfBuk03yQKDyqtR7QAAAco"]
[Sun Mar 01 17:59:42.081897 2026] [:error] [pid 38034:tid 38039] [client 20.220.232.101:36795] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless11.php"] [unique_id "aaQODgxtfZjwlJok9K_ugQAAAQM"]
[Sun Mar 01 17:59:42.654841 2026] [:error] [pid 40750:tid 40770] [client 20.220.232.101:36735] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaQODgfBuk03yQKDyqtR9QAAAdE"]
[Sun Mar 01 17:59:43.082122 2026] [:error] [pid 33822:tid 33830] [client 20.220.232.101:36643] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaQOD26W3ygu1YVssubrrAAAAoY"]
[Sun Mar 01 17:59:43.507648 2026] [:error] [pid 40750:tid 40768] [client 20.220.232.101:36645] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaQODwfBuk03yQKDyqtR-wAAAc8"]
[Sun Mar 01 17:59:44.028823 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36208] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaQOEAfBuk03yQKDyqtSAgAAAcs"]
[Sun Mar 01 17:59:44.651202 2026] [:error] [pid 38241:tid 38251] [client 20.220.232.101:36647] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aaQOEPKRPk6YnJBxw_yqqAAAAMc"]
[Sun Mar 01 17:59:45.155517 2026] [:error] [pid 37032:tid 37056] [client 20.220.232.101:36575] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aaQOEeu0U4o7eSImsVRk0AAAAZY"]
[Sun Mar 01 17:59:45.595732 2026] [:error] [pid 37032:tid 37044] [client 20.220.232.101:36659] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aaQOEeu0U4o7eSImsVRk0gAAAYo"]
[Sun Mar 01 17:59:46.028845 2026] [:error] [pid 7133:tid 7158] [client 20.220.232.101:36561] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ton.php"] [unique_id "aaQOEvCtubh8pR64qB_5BwAAAFc"]
[Sun Mar 01 17:59:46.605543 2026] [:error] [pid 7133:tid 7141] [client 20.220.232.101:36692] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQOEvCtubh8pR64qB_5CgAAAEY"]
[Sun Mar 01 17:59:47.036976 2026] [:error] [pid 7133:tid 7157] [client 20.220.232.101:36745] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQOE_Ctubh8pR64qB_5CwAAAFY"]
[Sun Mar 01 17:59:47.486878 2026] [:error] [pid 7133:tid 7155] [client 20.220.232.101:36640] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQOE_Ctubh8pR64qB_5DQAAAFQ"]
[Sun Mar 01 17:59:48.026449 2026] [:error] [pid 38034:tid 38038] [client 20.220.232.101:36704] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/403.php"] [unique_id "aaQOFAxtfZjwlJok9K_uigAAAQI"]
[Sun Mar 01 17:59:48.484935 2026] [:error] [pid 40750:tid 40767] [client 20.220.232.101:36613] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaQOFAfBuk03yQKDyqtSEgAAAc4"]
[Sun Mar 01 17:59:48.945429 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36797] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaQOFAfBuk03yQKDyqtSFAAAAcc"]
[Sun Mar 01 17:59:49.389205 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36635] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaQOFQfBuk03yQKDyqtSGQAAAco"]
[Sun Mar 01 17:59:49.886246 2026] [:error] [pid 40750:tid 40771] [client 20.220.232.101:36715] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaQOFQfBuk03yQKDyqtSHQAAAdI"]
[Sun Mar 01 17:59:50.356498 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36646] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaQOFgfBuk03yQKDyqtSIAAAAcI"]
[Sun Mar 01 17:59:50.793141 2026] [:error] [pid 38241:tid 38257] [client 20.220.232.101:36555] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaQOFvKRPk6YnJBxw_yqswAAAM0"]
[Sun Mar 01 17:59:51.250820 2026] [:error] [pid 7165:tid 7177] [client 20.220.232.101:36799] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaQOFxRjCrA8qWBjgG-ZaQAAAko"]
[Sun Mar 01 17:59:51.776655 2026] [:error] [pid 7165:tid 7185] [client 20.220.232.101:36679] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaQOFxRjCrA8qWBjgG-ZbwAAAlI"]
[Sun Mar 01 17:59:52.261139 2026] [:error] [pid 40750:tid 40757] [client 20.220.232.101:36665] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaQOGAfBuk03yQKDyqtSKwAAAcQ"]
[Sun Mar 01 17:59:52.697082 2026] [:error] [pid 40750:tid 40767] [client 20.220.232.101:36639] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaQOGAfBuk03yQKDyqtSLgAAAc4"]
[Sun Mar 01 17:59:53.226034 2026] [:error] [pid 40750:tid 40766] [client 20.220.232.101:36549] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaQOGQfBuk03yQKDyqtSNQAAAc0"]
[Sun Mar 01 17:59:53.724861 2026] [:error] [pid 40750:tid 40760] [client 20.220.232.101:36571] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new4.php"] [unique_id "aaQOGQfBuk03yQKDyqtSOAAAAcc"]
[Sun Mar 01 17:59:54.178217 2026] [:error] [pid 40750:tid 40765] [client 20.220.232.101:36624] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaQOGgfBuk03yQKDyqtSPAAAAcw"]
[Sun Mar 01 17:59:54.619697 2026] [:error] [pid 38241:tid 38251] [client 20.220.232.101:36690] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaQOGvKRPk6YnJBxw_yquQAAAMc"]
[Sun Mar 01 17:59:55.094856 2026] [:error] [pid 38034:tid 38054] [client 20.220.232.101:36674] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaQOGwxtfZjwlJok9K_ukAAAARA"]
[Sun Mar 01 17:59:55.613122 2026] [:error] [pid 33822:tid 33825] [client 20.220.232.101:36582] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pop.php"] [unique_id "aaQOG26W3ygu1YVssubrtwAAAoE"]
[Sun Mar 01 17:59:56.172034 2026] [:error] [pid 38241:tid 38267] [client 20.220.232.101:36562] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaQOHPKRPk6YnJBxw_yqvgAAANc"]
[Sun Mar 01 17:59:56.797251 2026] [:error] [pid 40750:tid 40771] [client 20.220.232.101:36712] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaQOHAfBuk03yQKDyqtSRgAAAdI"]
[Sun Mar 01 17:59:57.276135 2026] [:error] [pid 7133:tid 7153] [client 20.220.232.101:36522] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaQOHfCtubh8pR64qB_5HAAAAFI"]
[Sun Mar 01 17:59:57.734766 2026] [:error] [pid 7133:tid 7154] [client 20.220.232.101:36616] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/az.php"] [unique_id "aaQOHfCtubh8pR64qB_5HQAAAFM"]
[Sun Mar 01 17:59:58.222586 2026] [:error] [pid 41342:tid 41369] [client 20.220.232.101:36729] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaQOHo4iJ6RAS5CatDlTiwAAAhg"]
[Sun Mar 01 17:59:58.834689 2026] [:error] [pid 7165:tid 7182] [client 20.220.232.101:36546] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaQOHhRjCrA8qWBjgG-ZeAAAAk8"]
[Sun Mar 01 17:59:59.322081 2026] [:error] [pid 40750:tid 40764] [client 20.220.232.101:36666] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaQOHwfBuk03yQKDyqtSTAAAAcs"]
[Sun Mar 01 17:59:59.737994 2026] [:error] [pid 40750:tid 40774] [client 20.220.232.101:36364] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xaz.php"] [unique_id "aaQOHwfBuk03yQKDyqtSUAAAAdU"]
[Sun Mar 01 18:00:00.262549 2026] [:error] [pid 40750:tid 40763] [client 20.220.232.101:36655] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaQOIAfBuk03yQKDyqtSUgAAAco"]
[Sun Mar 01 18:00:00.838267 2026] [:error] [pid 40750:tid 40766] [client 20.220.232.101:36544] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaQOIAfBuk03yQKDyqtSXwAAAc0"]
[Sun Mar 01 18:00:01.348420 2026] [:error] [pid 7133:tid 7147] [client 20.220.232.101:36621] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaQOIfCtubh8pR64qB_5IgAAAEw"]
[Sun Mar 01 18:00:01.921174 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36688] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/up4.php"] [unique_id "aaQOIQfBuk03yQKDyqtSdgAAAcI"]
[Sun Mar 01 18:00:02.378941 2026] [:error] [pid 40750:tid 40776] [client 20.220.232.101:36492] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaQOIgfBuk03yQKDyqtSfAAAAdc"]
[Sun Mar 01 18:00:02.805988 2026] [:error] [pid 40750:tid 40755] [client 20.220.232.101:36648] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaQOIgfBuk03yQKDyqtShAAAAcI"]
[Sun Mar 01 18:00:03.236111 2026] [:error] [pid 7133:tid 7143] [client 20.220.232.101:36583] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaQOI_Ctubh8pR64qB_5JwAAAEg"]
[Sun Mar 01 18:00:03.651237 2026] [:error] [pid 38241:tid 38263] [client 20.220.232.101:36636] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1aa.php"] [unique_id "aaQOI_KRPk6YnJBxw_yqyAAAANM"]
[Sun Mar 01 18:00:04.084592 2026] [:error] [pid 38034:tid 38057] [client 20.220.232.101:36377] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaQOJAxtfZjwlJok9K_ukQAAARM"]
[Sun Mar 01 18:00:04.622264 2026] [:error] [pid 38241:tid 38259] [client 20.220.232.101:36586] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaQOJPKRPk6YnJBxw_yq0QAAAM8"]
[Sun Mar 01 18:00:05.098664 2026] [:error] [pid 38034:tid 38039] [client 20.220.232.101:36548] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaQOJQxtfZjwlJok9K_ukgAAAQM"]
[Sun Mar 01 18:00:05.575164 2026] [:error] [pid 38241:tid 38244] [client 20.220.232.101:36547] [client 20.220.232.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/elp.php"] [unique_id "aaQOJfKRPk6YnJBxw_yq2gAAAMA"]
[Sun Mar 01 18:00:06.013594 2026] [:error] [pid 7165:tid 7187] [client 20.220.232.101:36556] File does not exist: /usr/local/apache/htdocs/suspended-page/wtz.php
[Sun Mar 01 18:00:06.227345 2026] [:error] [pid 7165:tid 7178] [client 20.220.232.101:36556] File does not exist: /usr/local/apache/htdocs/suspended-page/galex.php
[Sun Mar 01 18:00:06.444718 2026] [:error] [pid 7165:tid 7181] [client 20.220.232.101:36556] File does not exist: /usr/local/apache/htdocs/suspended-page/xb.php
[Sun Mar 01 18:00:06.657876 2026] [:error] [pid 7165:tid 7169] [client 20.220.232.101:36556] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Sun Mar 01 18:00:06.871047 2026] [:error] [pid 7165:tid 7180] [client 20.220.232.101:36556] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sun Mar 01 18:00:07.083588 2026] [:error] [pid 7165:tid 7173] [client 20.220.232.101:36556] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Mar 01 19:16:14.986874 2026] [:error] [pid 40750:tid 40760] [client 43.133.187.11:43944] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaQf_gfBuk03yQKDyquzBgAAAcc"]
[Sun Mar 01 21:15:04.753459 2026] [:error] [pid 38241:tid 38264] [client 20.63.80.2:12233] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaQ72PKRPk6YnJBxw_wR5gAAANQ"]
[Sun Mar 01 21:15:05.597721 2026] [:error] [pid 38241:tid 38249] [client 20.63.80.2:12269] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaQ72fKRPk6YnJBxw_wR6wAAAMU"]
[Sun Mar 01 21:15:06.424441 2026] [:error] [pid 33822:tid 33848] [client 20.63.80.2:12243] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaQ72m6W3ygu1YVssuYfBQAAApg"]
[Sun Mar 01 21:15:07.249879 2026] [:error] [pid 40750:tid 40769] [client 20.63.80.2:11599] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaQ72wfBuk03yQKDyqs5SQAAAdA"]
[Sun Mar 01 21:50:14.387053 2026] [:error] [pid 7133:tid 7153] [client 122.51.236.174:45824] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaREFvCtubh8pR64qB9RNgAAAFI"]
[Sun Mar 01 21:58:18.074833 2026] [:error] [pid 7165:tid 7181] [client 40.85.219.62:40660] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRF-hRjCrA8qWBjgG9gMAAAAk4"]
[Sun Mar 01 21:58:18.916015 2026] [:error] [pid 33822:tid 33845] [client 40.85.219.62:40354] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRF-m6W3ygu1YVssuYo3QAAApU"]
[Sun Mar 01 21:58:19.767002 2026] [:error] [pid 7165:tid 7169] [client 40.85.219.62:40662] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRF-xRjCrA8qWBjgG9gSwAAAkI"]
[Sun Mar 01 21:58:20.591697 2026] [:error] [pid 7165:tid 7170] [client 40.85.219.62:40203] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRF_BRjCrA8qWBjgG9gTgAAAkM"]
[Sun Mar 01 22:05:27.299773 2026] [:error] [pid 44644:tid 44661] [client 43.165.189.110:55696] [client 43.165.189.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaRHp53RJaXMcw3y9V_ibAAAAA4"]
[Sun Mar 01 22:56:19.640348 2026] [:error] [pid 38241:tid 38263] [client 185.193.157.189:46178] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaRTk_KRPk6YnJBxw_xBggAAANM"]
[Sun Mar 01 22:56:19.644043 2026] [:error] [pid 38241:tid 38263] [client 185.193.157.189:46178] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Mar 01 22:56:21.319865 2026] [:error] [pid 38241:tid 38261] [client 185.193.157.189:46178] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaRTlfKRPk6YnJBxw_xBjQAAANE"]
[Sun Mar 01 22:56:21.614570 2026] [:error] [pid 40750:tid 40763] [client 185.193.157.189:46182] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaRTlQfBuk03yQKDyquH_gAAAco"]
[Sun Mar 01 22:56:21.910607 2026] [:error] [pid 7165:tid 7172] [client 185.193.157.189:46192] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aaRTlRRjCrA8qWBjgG-Y5AAAAkU"]
[Sun Mar 01 22:56:22.205541 2026] [:error] [pid 38241:tid 38258] [client 185.193.157.189:46196] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aaRTlvKRPk6YnJBxw_xBkQAAAM4"]
[Sun Mar 01 22:56:22.499714 2026] [:error] [pid 38034:tid 38050] [client 185.193.157.189:46200] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaRTlgxtfZjwlJok9K8pVQAAAQw"]
[Sun Mar 01 22:56:22.798085 2026] [:error] [pid 38241:tid 38254] [client 185.193.157.189:46208] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaRTlvKRPk6YnJBxw_xBlAAAAMo"]
[Sun Mar 01 22:56:23.093847 2026] [:error] [pid 38034:tid 38047] [client 185.193.157.189:46218] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aaRTlwxtfZjwlJok9K8pVwAAAQk"]
[Sun Mar 01 23:23:47.499700 2026] [:error] [pid 33822:tid 33841] [client 52.138.3.9:27529] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/jga.php"] [unique_id "aaRaA26W3ygu1YVssuZAtgAAApE"]
[Sun Mar 01 23:23:48.150330 2026] [:error] [pid 38241:tid 38268] [client 52.138.3.9:27520] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/widgets/widget-cache.php"] [unique_id "aaRaBPKRPk6YnJBxw_xOeQAAANg"]
[Sun Mar 01 23:23:48.646403 2026] [:error] [pid 33822:tid 33834] [client 52.138.3.9:27591] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/class-wp-json-ajax.php"] [unique_id "aaRaBG6W3ygu1YVssuZAuQAAAoo"]
[Sun Mar 01 23:23:49.652561 2026] [:error] [pid 7165:tid 7174] [client 52.138.3.9:27538] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/select_file2.php"] [unique_id "aaRaBRRjCrA8qWBjgG-zUwAAAkc"]
[Sun Mar 01 23:23:50.420875 2026] [:error] [pid 7165:tid 7183] [client 52.138.3.9:27612] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/select_file2.php"] [unique_id "aaRaBhRjCrA8qWBjgG-zWQAAAlA"]
[Sun Mar 01 23:23:50.841054 2026] [:error] [pid 38241:tid 38265] [client 52.138.3.9:27594] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/select_file2.php"] [unique_id "aaRaBvKRPk6YnJBxw_xOgQAAANU"]
[Sun Mar 01 23:23:51.265551 2026] [:error] [pid 40750:tid 40769] [client 52.138.3.9:27607] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/select_file2.php"] [unique_id "aaRaBwfBuk03yQKDyquaWAAAAdA"]
[Sun Mar 01 23:23:51.699370 2026] [:error] [pid 41780:tid 41789] [client 52.138.3.9:27635] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/detmash.php"] [unique_id "aaRaB8ONkVoocLIqzy02rgAAA8Y"]
[Sun Mar 01 23:23:52.371485 2026] [:error] [pid 7133:tid 7159] [client 52.138.3.9:27550] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/detmash.php"] [unique_id "aaRaCPCtubh8pR64qB90TAAAAFg"]
[Sun Mar 01 23:23:52.802279 2026] [:error] [pid 33822:tid 33825] [client 52.138.3.9:27525] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/detmash.php"] [unique_id "aaRaCG6W3ygu1YVssuZAvgAAAoE"]
[Sun Mar 01 23:23:53.240415 2026] [:error] [pid 7165:tid 7178] [client 52.138.3.9:27634] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/detmash.php"] [unique_id "aaRaCRRjCrA8qWBjgG-zZgAAAks"]
[Sun Mar 01 23:23:53.743068 2026] [:error] [pid 7165:tid 7183] [client 52.138.3.9:27588] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/8.php"] [unique_id "aaRaCRRjCrA8qWBjgG-zagAAAlA"]
[Sun Mar 01 23:23:54.184283 2026] [:error] [pid 38034:tid 38062] [client 52.138.3.9:27608] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/8.php"] [unique_id "aaRaCgxtfZjwlJok9K8vtwAAARg"]
[Sun Mar 01 23:23:54.629575 2026] [:error] [pid 40750:tid 40760] [client 52.138.3.9:27631] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/8.php"] [unique_id "aaRaCgfBuk03yQKDyquaXgAAAcc"]
[Sun Mar 01 23:23:55.122872 2026] [:error] [pid 44644:tid 44648] [client 52.138.3.9:27533] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/8.php"] [unique_id "aaRaC53RJaXMcw3y9V_rPQAAAAE"]
[Sun Mar 01 23:23:55.551136 2026] [:error] [pid 40750:tid 40774] [client 52.138.3.9:27643] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/sh.php"] [unique_id "aaRaCwfBuk03yQKDyquaYgAAAdU"]
[Sun Mar 01 23:23:55.977135 2026] [:error] [pid 40750:tid 40764] [client 52.138.3.9:27645] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/sh.php"] [unique_id "aaRaCwfBuk03yQKDyquaZgAAAcs"]
[Sun Mar 01 23:23:56.910361 2026] [:error] [pid 40750:tid 40759] [client 52.138.3.9:27535] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/sh.php"] [unique_id "aaRaDAfBuk03yQKDyquabwAAAcY"]
[Sun Mar 01 23:23:57.399137 2026] [:error] [pid 40750:tid 40765] [client 52.138.3.9:27642] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/sh.php"] [unique_id "aaRaDQfBuk03yQKDyquadQAAAcw"]
[Sun Mar 01 23:23:57.832032 2026] [:error] [pid 40750:tid 40771] [client 52.138.3.9:27601] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/start.php"] [unique_id "aaRaDQfBuk03yQKDyquaewAAAdI"]
[Sun Mar 01 23:23:58.312917 2026] [:error] [pid 33822:tid 33844] [client 52.138.3.9:27637] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/start.php"] [unique_id "aaRaDm6W3ygu1YVssuZAxQAAApQ"]
[Sun Mar 01 23:23:58.804490 2026] [:error] [pid 33822:tid 33829] [client 52.138.3.9:27536] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/start.php"] [unique_id "aaRaDm6W3ygu1YVssuZAxwAAAoU"]
[Sun Mar 01 23:23:59.312215 2026] [:error] [pid 40750:tid 40766] [client 52.138.3.9:27604] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/start.php"] [unique_id "aaRaDwfBuk03yQKDyquaigAAAc0"]
[Sun Mar 01 23:23:59.769462 2026] [:error] [pid 7133:tid 7152] [client 52.138.3.9:27527] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/incl.php"] [unique_id "aaRaD_Ctubh8pR64qB90awAAAFE"]
[Sun Mar 01 23:24:00.878619 2026] [:error] [pid 7133:tid 7150] [client 52.138.3.9:27596] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/sitemaps/providers.php"] [unique_id "aaRaEPCtubh8pR64qB90cQAAAE8"]
[Sun Mar 01 23:24:01.410142 2026] [:error] [pid 7133:tid 7153] [client 52.138.3.9:27528] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/403.php"] [unique_id "aaRaEfCtubh8pR64qB90cwAAAFI"]
[Sun Mar 01 23:24:01.842379 2026] [:error] [pid 38241:tid 38258] [client 52.138.3.9:27559] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/403.php"] [unique_id "aaRaEfKRPk6YnJBxw_xOhwAAAM4"]
[Sun Mar 01 23:24:02.334488 2026] [:error] [pid 38241:tid 38261] [client 52.138.3.9:27632] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/403.php"] [unique_id "aaRaEvKRPk6YnJBxw_xOiQAAANE"]
[Sun Mar 01 23:24:02.973327 2026] [:error] [pid 7165:tid 7174] [client 52.138.3.9:27532] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/403.php"] [unique_id "aaRaEhRjCrA8qWBjgG-zdAAAAkc"]
[Sun Mar 01 23:24:03.445272 2026] [:error] [pid 7165:tid 7171] [client 52.138.3.9:27568] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image.php"] [unique_id "aaRaExRjCrA8qWBjgG-zdwAAAkQ"]
[Sun Mar 01 23:24:04.020279 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:27613] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image.php"] [unique_id "aaRaFBRjCrA8qWBjgG-zfQAAAkA"]
[Sun Mar 01 23:24:04.627666 2026] [:error] [pid 7165:tid 7184] [client 52.138.3.9:27640] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image.php"] [unique_id "aaRaFBRjCrA8qWBjgG-zgQAAAlE"]
[Sun Mar 01 23:24:05.137126 2026] [:error] [pid 41342:tid 41355] [client 52.138.3.9:27526] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image.php"] [unique_id "aaRaFY4iJ6RAS5CatDlnkwAAAgo"]
[Sun Mar 01 23:24:05.654287 2026] [:error] [pid 7165:tid 7181] [client 52.138.3.9:27524] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image2.php"] [unique_id "aaRaFRRjCrA8qWBjgG-ziAAAAk4"]
[Sun Mar 01 23:24:06.449542 2026] [:error] [pid 7165:tid 7172] [client 52.138.3.9:27647] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image2.php"] [unique_id "aaRaFhRjCrA8qWBjgG-zjwAAAkU"]
[Sun Mar 01 23:24:06.997095 2026] [:error] [pid 33822:tid 33828] [client 52.138.3.9:27548] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image2.php"] [unique_id "aaRaFm6W3ygu1YVssuZAzAAAAoQ"]
[Sun Mar 01 23:24:07.619315 2026] [:error] [pid 7165:tid 7189] [client 52.138.3.9:27457] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/image2.php"] [unique_id "aaRaFxRjCrA8qWBjgG-zlQAAAlY"]
[Sun Mar 01 23:24:08.263793 2026] [:error] [pid 37032:tid 37034] [client 52.138.3.9:27522] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/ws.php"] [unique_id "aaRaGOu0U4o7eSImsVSTTAAAAYA"]
[Sun Mar 01 23:24:08.819342 2026] [:error] [pid 37032:tid 37039] [client 52.138.3.9:27469] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/ws.php"] [unique_id "aaRaGOu0U4o7eSImsVSTTQAAAYU"]
[Sun Mar 01 23:24:09.729461 2026] [:error] [pid 38241:tid 38252] [client 52.138.3.9:27615] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/ws.php"] [unique_id "aaRaGfKRPk6YnJBxw_xOlwAAAMg"]
[Sun Mar 01 23:24:10.390873 2026] [:error] [pid 44644:tid 44660] [client 52.138.3.9:27461] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/ws.php"] [unique_id "aaRaGp3RJaXMcw3y9V_rSQAAAA0"]
[Sun Mar 01 23:24:11.123836 2026] [:error] [pid 38034:tid 38049] [client 52.138.3.9:27617] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/mandals.php"] [unique_id "aaRaGwxtfZjwlJok9K8vxAAAAQs"]
[Sun Mar 01 23:24:11.990882 2026] [:error] [pid 44644:tid 44648] [client 52.138.3.9:27628] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/mandals.php"] [unique_id "aaRaG53RJaXMcw3y9V_rUAAAAAE"]
[Sun Mar 01 23:24:12.497843 2026] [:error] [pid 37032:tid 37053] [client 52.138.3.9:27614] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/mandals.php"] [unique_id "aaRaHOu0U4o7eSImsVSTVAAAAZM"]
[Sun Mar 01 23:24:13.305865 2026] [:error] [pid 38034:tid 38038] [client 52.138.3.9:27459] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/mandals.php"] [unique_id "aaRaHQxtfZjwlJok9K8vzAAAAQI"]
[Sun Mar 01 23:24:13.995489 2026] [:error] [pid 7133:tid 7156] [client 52.138.3.9:27592] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/ws27.php"] [unique_id "aaRaHfCtubh8pR64qB90iAAAAFU"]
[Sun Mar 01 23:24:14.605488 2026] [:error] [pid 7133:tid 7158] [client 52.138.3.9:27595] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/ws27.php"] [unique_id "aaRaHvCtubh8pR64qB90jgAAAFc"]
[Sun Mar 01 23:24:15.491679 2026] [:error] [pid 38241:tid 38252] [client 52.138.3.9:27598] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/ws27.php"] [unique_id "aaRaH_KRPk6YnJBxw_xOqAAAAMg"]
[Sun Mar 01 23:24:16.265881 2026] [:error] [pid 37032:tid 37051] [client 52.138.3.9:27557] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/ws27.php"] [unique_id "aaRaIOu0U4o7eSImsVSTWgAAAZE"]
[Sun Mar 01 23:24:17.167721 2026] [:error] [pid 41780:tid 41800] [client 52.138.3.9:27537] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/class-wp-duotone.php"] [unique_id "aaRaIcONkVoocLIqzy02ugAAA9E"]
[Sun Mar 01 23:24:18.220437 2026] [:error] [pid 7133:tid 7157] [client 52.138.3.9:27530] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/d.be.brow.php"] [unique_id "aaRaIvCtubh8pR64qB90nwAAAFY"]
[Sun Mar 01 23:24:18.723545 2026] [:error] [pid 44644:tid 44659] [client 52.138.3.9:27567] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/d.be.brow.php"] [unique_id "aaRaIp3RJaXMcw3y9V_rWQAAAAw"]
[Sun Mar 01 23:24:19.352992 2026] [:error] [pid 41780:tid 41792] [client 52.138.3.9:27603] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/d.be.brow.php"] [unique_id "aaRaI8ONkVoocLIqzy02wAAAA8k"]
[Sun Mar 01 23:24:20.092102 2026] [:error] [pid 7133:tid 7136] [client 52.138.3.9:27618] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/d.be.brow.php"] [unique_id "aaRaJPCtubh8pR64qB90qgAAAEE"]
[Sun Mar 01 23:24:20.630105 2026] [:error] [pid 7133:tid 7149] [client 52.138.3.9:27546] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/submitticket.php"] [unique_id "aaRaJPCtubh8pR64qB90sQAAAE4"]
[Sun Mar 01 23:24:21.104001 2026] [:error] [pid 7165:tid 7179] [client 52.138.3.9:27641] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/submitticket.php"] [unique_id "aaRaJRRjCrA8qWBjgG-znQAAAkw"]
[Sun Mar 01 23:24:22.480745 2026] [:error] [pid 38034:tid 38053] [client 52.138.3.9:27541] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/submitticket.php"] [unique_id "aaRaJgxtfZjwlJok9K8v3wAAAQ8"]
[Sun Mar 01 23:24:23.085667 2026] [:error] [pid 33822:tid 33841] [client 52.138.3.9:27602] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/submitticket.php"] [unique_id "aaRaJ26W3ygu1YVssuZA1gAAApE"]
[Sun Mar 01 23:24:23.567335 2026] [:error] [pid 41342:tid 41353] [client 52.138.3.9:27570] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/add_evento.php"] [unique_id "aaRaJ44iJ6RAS5CatDlnrAAAAgg"]
[Sun Mar 01 23:24:24.167811 2026] [:error] [pid 38034:tid 38048] [client 52.138.3.9:27540] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/add_evento.php"] [unique_id "aaRaKAxtfZjwlJok9K8v5wAAAQo"]
[Sun Mar 01 23:24:24.785138 2026] [:error] [pid 38034:tid 38062] [client 52.138.3.9:27565] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/add_evento.php"] [unique_id "aaRaKAxtfZjwlJok9K8v6wAAARg"]
[Sun Mar 01 23:24:25.239164 2026] [:error] [pid 38034:tid 38037] [client 52.138.3.9:27479] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/files/add_evento.php"] [unique_id "aaRaKQxtfZjwlJok9K8v7wAAAQE"]
[Sun Mar 01 23:24:25.699441 2026] [:error] [pid 33822:tid 33844] [client 52.138.3.9:27476] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/goods.php"] [unique_id "aaRaKW6W3ygu1YVssuZA2AAAApQ"]
[Sun Mar 01 23:24:26.235885 2026] [:error] [pid 38034:tid 38045] [client 52.138.3.9:27644] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/goods.php"] [unique_id "aaRaKgxtfZjwlJok9K8v9QAAAQc"]
[Sun Mar 01 23:24:26.906741 2026] [:error] [pid 33822:tid 33826] [client 52.138.3.9:27489] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/goods.php"] [unique_id "aaRaKm6W3ygu1YVssuZA2wAAAoI"]
[Sun Mar 01 23:24:27.476280 2026] [:error] [pid 33822:tid 33827] [client 52.138.3.9:27470] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/goods.php"] [unique_id "aaRaK26W3ygu1YVssuZA3QAAAoM"]
[Sun Mar 01 23:24:27.936222 2026] [:error] [pid 38241:tid 38249] [client 52.138.3.9:27523] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/goods.php"] [unique_id "aaRaK_KRPk6YnJBxw_xOvwAAAMU"]
[Sun Mar 01 23:24:28.393402 2026] [:error] [pid 7165:tid 7183] [client 52.138.3.9:27486] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/goods.php"] [unique_id "aaRaLBRjCrA8qWBjgG-zowAAAlA"]
[Sun Mar 01 23:24:29.035026 2026] [:error] [pid 33822:tid 33848] [client 52.138.3.9:27639] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/goods.php"] [unique_id "aaRaLW6W3ygu1YVssuZA5QAAApg"]
[Sun Mar 01 23:24:29.745236 2026] [:error] [pid 38034:tid 38036] [client 52.138.3.9:27638] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/goods.php"] [unique_id "aaRaLQxtfZjwlJok9K8v_AAAAQA"]
[Sun Mar 01 23:24:30.304511 2026] [:error] [pid 38241:tid 38265] [client 52.138.3.9:27589] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/searchforma.php"] [unique_id "aaRaLvKRPk6YnJBxw_xOxAAAANU"]
[Sun Mar 01 23:24:30.867707 2026] [:error] [pid 37032:tid 37040] [client 52.138.3.9:27466] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/searchforma.php"] [unique_id "aaRaLuu0U4o7eSImsVSTgQAAAYY"]
[Sun Mar 01 23:24:37.645165 2026] [:error] [pid 38241:tid 38262] [client 52.138.3.9:27554] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/searchforma.php"] [unique_id "aaRaNfKRPk6YnJBxw_xO2wAAANI"]
[Sun Mar 01 23:24:42.586239 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:27625] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/searchforma.php"] [unique_id "aaRaOhRjCrA8qWBjgG-zuwAAAkA"]
[Sun Mar 01 23:24:43.256528 2026] [:error] [pid 7165:tid 7176] [client 52.138.3.9:27582] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/222.php"] [unique_id "aaRaOxRjCrA8qWBjgG-zwwAAAkk"]
[Sun Mar 01 23:24:44.131731 2026] [:error] [pid 41780:tid 41803] [client 52.138.3.9:27562] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/222.php"] [unique_id "aaRaPMONkVoocLIqzy020QAAA9Q"]
[Sun Mar 01 23:24:45.603072 2026] [:error] [pid 7165:tid 7181] [client 52.138.3.9:27534] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/222.php"] [unique_id "aaRaPRRjCrA8qWBjgG-zzQAAAk4"]
[Sun Mar 01 23:24:46.498014 2026] [:error] [pid 38241:tid 38245] [client 52.138.3.9:27512] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/222.php"] [unique_id "aaRaPvKRPk6YnJBxw_xO6wAAAME"]
[Sun Mar 01 23:25:54.794348 2026] [:error] [pid 33822:tid 33834] [client 52.138.3.9:27623] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/wp-settings2.php"] [unique_id "aaRagm6W3ygu1YVssuZBfgAAAoo"]
[Sun Mar 01 23:25:56.145802 2026] [:error] [pid 7165:tid 7180] [client 52.138.3.9:27545] [client 52.138.3.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.138.3.9, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aaRahBRjCrA8qWBjgG-2SgAAAk0"]
[Sun Mar 01 23:25:57.907502 2026] [:error] [pid 7165:tid 7174] [client 52.138.3.9:27545] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaRahRRjCrA8qWBjgG-2YAAAAkc"]
[Sun Mar 01 23:25:58.450654 2026] [:error] [pid 44644:tid 44655] [client 52.138.3.9:27578] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaRahp3RJaXMcw3y9V_rcwAAAAg"]
[Sun Mar 01 23:25:58.909888 2026] [:error] [pid 38241:tid 38265] [client 52.138.3.9:27392] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaRahvKRPk6YnJBxw_xPFgAAANU"]
[Sun Mar 01 23:25:59.340726 2026] [:error] [pid 7133:tid 7151] [client 52.138.3.9:27477] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aaRah_Ctubh8pR64qB91OwAAAFA"]
[Sun Mar 01 23:25:59.806753 2026] [:error] [pid 7165:tid 7179] [client 52.138.3.9:27583] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yereongu.php"] [unique_id "aaRahxRjCrA8qWBjgG-2fQAAAkw"]
[Sun Mar 01 23:26:00.273192 2026] [:error] [pid 38034:tid 38044] [client 52.138.3.9:27555] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yereongu.php"] [unique_id "aaRaiAxtfZjwlJok9K8whwAAAQY"]
[Sun Mar 01 23:26:00.718968 2026] [:error] [pid 7133:tid 7153] [client 52.138.3.9:27571] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yereongu.php"] [unique_id "aaRaiPCtubh8pR64qB91PAAAAFI"]
[Sun Mar 01 23:26:01.145193 2026] [:error] [pid 33822:tid 33830] [client 52.138.3.9:27552] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yereongu.php"] [unique_id "aaRaiW6W3ygu1YVssuZBgwAAAoY"]
[Sun Mar 01 23:26:01.576538 2026] [:error] [pid 38241:tid 38253] [client 52.138.3.9:27539] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/widgets/leuk.php"] [unique_id "aaRaifKRPk6YnJBxw_xPFwAAAMk"]
[Sun Mar 01 23:26:02.069080 2026] [:error] [pid 44644:tid 44660] [client 52.138.3.9:27549] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/widgets/leuk.php"] [unique_id "aaRaip3RJaXMcw3y9V_rdwAAAA0"]
[Sun Mar 01 23:26:02.509604 2026] [:error] [pid 7133:tid 7136] [client 52.138.3.9:27624] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/widgets/leuk.php"] [unique_id "aaRaivCtubh8pR64qB91QQAAAEE"]
[Sun Mar 01 23:26:02.936515 2026] [:error] [pid 7133:tid 7145] [client 52.138.3.9:27513] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/widgets/leuk.php"] [unique_id "aaRaivCtubh8pR64qB91RAAAAEo"]
[Sun Mar 01 23:26:03.927105 2026] [:error] [pid 41780:tid 41796] [client 52.138.3.9:27560] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/chris.php"] [unique_id "aaRai8ONkVoocLIqzy024gAAA80"]
[Sun Mar 01 23:26:04.600447 2026] [:error] [pid 40750:tid 40770] [client 52.138.3.9:27531] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/chris.php"] [unique_id "aaRajAfBuk03yQKDyqubgQAAAdE"]
[Sun Mar 01 23:26:05.079373 2026] [:error] [pid 38241:tid 38264] [client 52.138.3.9:27544] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/chris.php"] [unique_id "aaRajfKRPk6YnJBxw_xPHAAAANQ"]
[Sun Mar 01 23:26:05.616644 2026] [:error] [pid 7133:tid 7142] [client 52.138.3.9:27626] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/chris.php"] [unique_id "aaRajfCtubh8pR64qB91RwAAAEc"]
[Sun Mar 01 23:26:06.041272 2026] [:error] [pid 33822:tid 33825] [client 52.138.3.9:27471] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/xx.php"] [unique_id "aaRajm6W3ygu1YVssuZBiAAAAoE"]
[Sun Mar 01 23:26:06.489470 2026] [:error] [pid 33822:tid 33829] [client 52.138.3.9:27521] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/sql.php"] [unique_id "aaRajm6W3ygu1YVssuZBjAAAAoU"]
[Sun Mar 01 23:26:07.203975 2026] [:error] [pid 41780:tid 41798] [client 52.138.3.9:27622] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/sql.php"] [unique_id "aaRaj8ONkVoocLIqzy025QAAA88"]
[Sun Mar 01 23:26:07.684744 2026] [:error] [pid 38034:tid 38043] [client 52.138.3.9:27646] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/sql.php"] [unique_id "aaRajwxtfZjwlJok9K8wnQAAAQU"]
[Sun Mar 01 23:26:08.110880 2026] [:error] [pid 37032:tid 37046] [client 52.138.3.9:27599] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/wp.php"] [unique_id "aaRakOu0U4o7eSImsVSTzgAAAYw"]
[Sun Mar 01 23:26:08.605024 2026] [:error] [pid 37032:tid 37058] [client 52.138.3.9:27629] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/wp.php"] [unique_id "aaRakOu0U4o7eSImsVST1QAAAZg"]
[Sun Mar 01 23:26:09.026418 2026] [:error] [pid 33822:tid 33831] [client 52.138.3.9:27610] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/wp.php"] [unique_id "aaRakW6W3ygu1YVssuZBkAAAAoc"]
[Sun Mar 01 23:26:09.554761 2026] [:error] [pid 33822:tid 33847] [client 52.138.3.9:27473] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uploads/wp.php"] [unique_id "aaRakW6W3ygu1YVssuZBkwAAApc"]
[Sun Mar 01 23:26:09.980297 2026] [:error] [pid 40750:tid 40753] [client 52.138.3.9:27509] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/cores.php"] [unique_id "aaRakQfBuk03yQKDyqublQAAAcA"]
[Sun Mar 01 23:26:10.433807 2026] [:error] [pid 41342:tid 41356] [client 52.138.3.9:27561] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/cores.php"] [unique_id "aaRako4iJ6RAS5CatDln1gAAAgs"]
[Sun Mar 01 23:26:11.025445 2026] [:error] [pid 7165:tid 7175] [client 52.138.3.9:27464] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/cores.php"] [unique_id "aaRakxRjCrA8qWBjgG-21wAAAkg"]
[Sun Mar 01 23:26:11.513698 2026] [:error] [pid 40750:tid 40771] [client 52.138.3.9:27503] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/cores.php"] [unique_id "aaRakwfBuk03yQKDyqubmgAAAdI"]
[Sun Mar 01 23:26:12.025188 2026] [:error] [pid 44644:tid 44664] [client 52.138.3.9:27558] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/widgets/ws62.php"] [unique_id "aaRalJ3RJaXMcw3y9V_rhQAAABE"]
[Sun Mar 01 23:26:12.536519 2026] [:error] [pid 38241:tid 38268] [client 52.138.3.9:27516] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/worksec.php"] [unique_id "aaRalPKRPk6YnJBxw_xPNQAAANg"]
[Sun Mar 01 23:26:13.207964 2026] [:error] [pid 40750:tid 40754] [client 52.138.3.9:27574] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/worksec.php"] [unique_id "aaRalQfBuk03yQKDyqubqQAAAcE"]
[Sun Mar 01 23:26:13.784705 2026] [:error] [pid 7133:tid 7148] [client 52.138.3.9:27456] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/worksec.php"] [unique_id "aaRalfCtubh8pR64qB91VAAAAE0"]
[Sun Mar 01 23:26:14.318839 2026] [:error] [pid 7133:tid 7139] [client 52.138.3.9:27643] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/upgrade/worksec.php"] [unique_id "aaRalvCtubh8pR64qB91VwAAAEQ"]
[Sun Mar 01 23:26:14.738218 2026] [:error] [pid 40750:tid 40777] [client 52.138.3.9:27503] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/pomo/feeds.php"] [unique_id "aaRalgfBuk03yQKDyqubtQAAAdg"]
[Sun Mar 01 23:26:15.166047 2026] [:error] [pid 7133:tid 7157] [client 52.138.3.9:27465] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/wp-good.php"] [unique_id "aaRal_Ctubh8pR64qB91WwAAAFY"]
[Sun Mar 01 23:26:15.705005 2026] [:error] [pid 41342:tid 41355] [client 52.138.3.9:27580] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/wp-good.php"] [unique_id "aaRal44iJ6RAS5CatDln1wAAAgo"]
[Sun Mar 01 23:26:16.466222 2026] [:error] [pid 40750:tid 40771] [client 52.138.3.9:27475] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/wp-good.php"] [unique_id "aaRamAfBuk03yQKDyqubzAAAAdI"]
[Sun Mar 01 23:26:16.950559 2026] [:error] [pid 7165:tid 7189] [client 52.138.3.9:27543] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/images/signup_pad_classic.php"] [unique_id "aaRamBRjCrA8qWBjgG-2_wAAAlY"]
[Sun Mar 01 23:26:17.444896 2026] [:error] [pid 38241:tid 38259] [client 52.138.3.9:27627] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/v2.php"] [unique_id "aaRamfKRPk6YnJBxw_xPTgAAAM8"]
[Sun Mar 01 23:26:17.927975 2026] [:error] [pid 38241:tid 38249] [client 52.138.3.9:27633] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/v2.php"] [unique_id "aaRamfKRPk6YnJBxw_xPUwAAAMU"]
[Sun Mar 01 23:26:18.357052 2026] [:error] [pid 33822:tid 33844] [client 52.138.3.9:27496] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/v2.php"] [unique_id "aaRamm6W3ygu1YVssuZBmgAAApQ"]
[Sun Mar 01 23:26:18.903984 2026] [:error] [pid 7133:tid 7144] [client 52.138.3.9:27553] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/class-ge.php"] [unique_id "aaRamvCtubh8pR64qB91ZgAAAEk"]
[Sun Mar 01 23:26:19.519529 2026] [:error] [pid 37032:tid 37057] [client 52.138.3.9:27421] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/class-ge.php"] [unique_id "aaRam-u0U4o7eSImsVST2wAAAZc"]
[Sun Mar 01 23:26:20.076748 2026] [:error] [pid 33822:tid 33835] [client 52.138.3.9:27481] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/class-ge.php"] [unique_id "aaRanG6W3ygu1YVssuZBnwAAAos"]
[Sun Mar 01 23:26:20.501037 2026] [:error] [pid 38241:tid 38257] [client 52.138.3.9:27573] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/class-ge.php"] [unique_id "aaRanPKRPk6YnJBxw_xPVwAAAM0"]
[Sun Mar 01 23:26:20.928250 2026] [:error] [pid 7165:tid 7172] [client 52.138.3.9:27566] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/class-wp-https.php"] [unique_id "aaRanBRjCrA8qWBjgG-3HQAAAkU"]
[Sun Mar 01 23:26:21.388018 2026] [:error] [pid 7165:tid 7169] [client 52.138.3.9:27600] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/fonts/rawwp.php"] [unique_id "aaRanRRjCrA8qWBjgG-3JgAAAkI"]
[Sun Mar 01 23:26:21.859531 2026] [:error] [pid 40750:tid 40773] [client 52.138.3.9:27413] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/about.php"] [unique_id "aaRanQfBuk03yQKDyqub3gAAAdQ"]
[Sun Mar 01 23:26:22.564077 2026] [:error] [pid 38241:tid 38265] [client 52.138.3.9:27426] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/about.php"] [unique_id "aaRanvKRPk6YnJBxw_xPWgAAANU"]
[Sun Mar 01 23:26:23.111545 2026] [:error] [pid 38241:tid 38258] [client 52.138.3.9:27510] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/about.php"] [unique_id "aaRan_KRPk6YnJBxw_xPXAAAAM4"]
[Sun Mar 01 23:26:23.566182 2026] [:error] [pid 38241:tid 38249] [client 52.138.3.9:27403] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/class-mail.php"] [unique_id "aaRan_KRPk6YnJBxw_xPYAAAAMU"]
[Sun Mar 01 23:26:24.071295 2026] [:error] [pid 7165:tid 7186] [client 52.138.3.9:27609] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/uhuybro.php"] [unique_id "aaRaoBRjCrA8qWBjgG-3OAAAAlM"]
[Sun Mar 01 23:26:24.557943 2026] [:error] [pid 44644:tid 44662] [client 52.138.3.9:27492] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/uhuybro.php"] [unique_id "aaRaoJ3RJaXMcw3y9V_riQAAAA8"]
[Sun Mar 01 23:26:25.082306 2026] [:error] [pid 7165:tid 7180] [client 52.138.3.9:27579] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/uhuybro.php"] [unique_id "aaRaoRRjCrA8qWBjgG-3PwAAAk0"]
[Sun Mar 01 23:26:25.662251 2026] [:error] [pid 37032:tid 37046] [client 52.138.3.9:27400] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/uhuybro.php"] [unique_id "aaRaoeu0U4o7eSImsVST4QAAAYw"]
[Sun Mar 01 23:26:26.080265 2026] [:error] [pid 7165:tid 7182] [client 52.138.3.9:27499] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/footers.php"] [unique_id "aaRaohRjCrA8qWBjgG-3QwAAAk8"]
[Sun Mar 01 23:26:26.529400 2026] [:error] [pid 44644:tid 44665] [client 52.138.3.9:27478] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/footers.php"] [unique_id "aaRaop3RJaXMcw3y9V_rjwAAABI"]
[Sun Mar 01 23:26:26.952134 2026] [:error] [pid 40750:tid 40776] [client 52.138.3.9:27394] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/footers.php"] [unique_id "aaRaogfBuk03yQKDyqub8AAAAdc"]
[Sun Mar 01 23:26:27.425112 2026] [:error] [pid 40750:tid 40756] [client 52.138.3.9:27640] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/footers.php"] [unique_id "aaRaowfBuk03yQKDyqub9AAAAcM"]
[Sun Mar 01 23:26:27.842139 2026] [:error] [pid 37032:tid 37045] [client 52.138.3.9:27424] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/icedknnv.php"] [unique_id "aaRao-u0U4o7eSImsVST5AAAAYs"]
[Sun Mar 01 23:26:28.259332 2026] [:error] [pid 38034:tid 38037] [client 52.138.3.9:27504] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/icedknnv.php"] [unique_id "aaRapAxtfZjwlJok9K8wpAAAAQE"]
[Sun Mar 01 23:26:28.680855 2026] [:error] [pid 41780:tid 41786] [client 52.138.3.9:27586] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/icedknnv.php"] [unique_id "aaRapMONkVoocLIqzy028QAAA8M"]
[Sun Mar 01 23:26:29.213887 2026] [:error] [pid 7165:tid 7175] [client 52.138.3.9:27619] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/icedknnv.php"] [unique_id "aaRapRRjCrA8qWBjgG-3TQAAAkg"]
[Sun Mar 01 23:26:29.643471 2026] [:error] [pid 41780:tid 41805] [client 52.138.3.9:27564] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/post_genprdt.php"] [unique_id "aaRapcONkVoocLIqzy028wAAA9Y"]
[Sun Mar 01 23:26:30.073613 2026] [:error] [pid 41342:tid 41353] [client 52.138.3.9:27488] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/post_genprdt.php"] [unique_id "aaRapo4iJ6RAS5CatDln2wAAAgg"]
[Sun Mar 01 23:26:30.532516 2026] [:error] [pid 41780:tid 41798] [client 52.138.3.9:27405] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/post_genprdt.php"] [unique_id "aaRapsONkVoocLIqzy029wAAA88"]
[Sun Mar 01 23:26:31.009153 2026] [:error] [pid 7165:tid 7189] [client 52.138.3.9:27636] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/images/post_genprdt.php"] [unique_id "aaRapxRjCrA8qWBjgG-3WAAAAlY"]
[Sun Mar 01 23:26:31.859084 2026] [:error] [pid 37032:tid 37058] [client 52.138.3.9:27616] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/5.php"] [unique_id "aaRap-u0U4o7eSImsVST5gAAAZg"]
[Sun Mar 01 23:26:32.279640 2026] [:error] [pid 38241:tid 38253] [client 52.138.3.9:27519] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/5.php"] [unique_id "aaRaqPKRPk6YnJBxw_xPjwAAAMk"]
[Sun Mar 01 23:26:32.695116 2026] [:error] [pid 38034:tid 38039] [client 52.138.3.9:27440] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/5.php"] [unique_id "aaRaqAxtfZjwlJok9K8wrwAAAQM"]
[Sun Mar 01 23:26:33.118062 2026] [:error] [pid 7165:tid 7184] [client 52.138.3.9:27556] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/maint/5.php"] [unique_id "aaRaqRRjCrA8qWBjgG-3XwAAAlE"]
[Sun Mar 01 23:26:33.535169 2026] [:error] [pid 38241:tid 38255] [client 52.138.3.9:27463] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/by.php"] [unique_id "aaRaqfKRPk6YnJBxw_xPmQAAAMs"]
[Sun Mar 01 23:26:34.012997 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:27547] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/by.php"] [unique_id "aaRaqhRjCrA8qWBjgG-3YwAAAkA"]
[Sun Mar 01 23:26:34.459082 2026] [:error] [pid 7165:tid 7174] [client 52.138.3.9:27581] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/by.php"] [unique_id "aaRaqhRjCrA8qWBjgG-3agAAAkc"]
[Sun Mar 01 23:26:34.935443 2026] [:error] [pid 38241:tid 38262] [client 52.138.3.9:27460] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/by.php"] [unique_id "aaRaqvKRPk6YnJBxw_xPqQAAANI"]
[Sun Mar 01 23:26:35.358900 2026] [:error] [pid 7165:tid 7186] [client 52.138.3.9:27468] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/user-ajax.php"] [unique_id "aaRaqxRjCrA8qWBjgG-3bAAAAlM"]
[Sun Mar 01 23:26:35.776438 2026] [:error] [pid 38241:tid 38246] [client 52.138.3.9:27542] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/user-ajax.php"] [unique_id "aaRaq_KRPk6YnJBxw_xPrgAAAMI"]
[Sun Mar 01 23:26:36.221579 2026] [:error] [pid 7165:tid 7180] [client 52.138.3.9:27575] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/user-ajax.php"] [unique_id "aaRarBRjCrA8qWBjgG-3cgAAAk0"]
[Sun Mar 01 23:26:36.660595 2026] [:error] [pid 7165:tid 7188] [client 52.138.3.9:27511] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/includes/user-ajax.php"] [unique_id "aaRarBRjCrA8qWBjgG-3dQAAAlU"]
[Sun Mar 01 23:26:37.074131 2026] [:error] [pid 33822:tid 33829] [client 52.138.3.9:27500] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/images/chati.php"] [unique_id "aaRarW6W3ygu1YVssuZBrAAAAoU"]
[Sun Mar 01 23:26:37.504282 2026] [:error] [pid 44644:tid 44659] [client 52.138.3.9:27482] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/images/chati.php"] [unique_id "aaRarZ3RJaXMcw3y9V_rlgAAAAw"]
[Sun Mar 01 23:26:37.917730 2026] [:error] [pid 7165:tid 7177] [client 52.138.3.9:27518] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/images/chati.php"] [unique_id "aaRarRRjCrA8qWBjgG-3gAAAAko"]
[Sun Mar 01 23:26:38.470991 2026] [:error] [pid 38241:tid 38257] [client 52.138.3.9:27402] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/images/chati.php"] [unique_id "aaRarvKRPk6YnJBxw_xPvgAAAM0"]
[Sun Mar 01 23:26:38.987490 2026] [:error] [pid 37032:tid 37047] [client 52.138.3.9:27458] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaRaruu0U4o7eSImsVST6gAAAY0"]
[Sun Mar 01 23:26:39.485040 2026] [:error] [pid 38241:tid 38252] [client 52.138.3.9:26689] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaRar_KRPk6YnJBxw_xPwgAAAMg"]
[Sun Mar 01 23:26:40.054312 2026] [:error] [pid 38241:tid 38258] [client 52.138.3.9:27410] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaRasPKRPk6YnJBxw_xPyAAAAM4"]
[Sun Mar 01 23:26:40.520774 2026] [:error] [pid 7165:tid 7189] [client 52.138.3.9:26698] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aaRasBRjCrA8qWBjgG-3jQAAAlY"]
[Sun Mar 01 23:26:41.030163 2026] [:error] [pid 41342:tid 41369] [client 52.138.3.9:27434] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaRasY4iJ6RAS5CatDln8AAAAhg"]
[Sun Mar 01 23:26:41.470271 2026] [:error] [pid 41780:tid 41794] [client 52.138.3.9:27590] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaRascONkVoocLIqzy03AgAAA8s"]
[Sun Mar 01 23:26:41.892595 2026] [:error] [pid 38241:tid 38250] [client 52.138.3.9:26690] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaRasfKRPk6YnJBxw_xP1AAAAMY"]
[Sun Mar 01 23:26:42.375311 2026] [:error] [pid 41342:tid 41353] [client 52.138.3.9:27485] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gtc.php"] [unique_id "aaRaso4iJ6RAS5CatDln8QAAAgg"]
[Sun Mar 01 23:26:42.798461 2026] [:error] [pid 38241:tid 38258] [client 52.138.3.9:27563] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRasvKRPk6YnJBxw_xP2QAAAM4"]
[Sun Mar 01 23:26:43.456706 2026] [:error] [pid 38241:tid 38262] [client 52.138.3.9:27467] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRas_KRPk6YnJBxw_xP4gAAANI"]
[Sun Mar 01 23:26:43.902520 2026] [:error] [pid 7165:tid 7187] [client 52.138.3.9:27551] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRasxRjCrA8qWBjgG-3lgAAAlQ"]
[Sun Mar 01 23:26:44.396337 2026] [:error] [pid 40750:tid 40768] [client 52.138.3.9:27611] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRatAfBuk03yQKDyqucDQAAAc8"]
[Sun Mar 01 23:26:44.815497 2026] [:error] [pid 40750:tid 40755] [client 52.138.3.9:27480] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaRatAfBuk03yQKDyqucDgAAAcI"]
[Sun Mar 01 23:26:45.302628 2026] [:error] [pid 41780:tid 41807] [client 52.138.3.9:27630] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaRatcONkVoocLIqzy03BAAAA9g"]
[Sun Mar 01 23:26:45.866401 2026] [:error] [pid 7165:tid 7185] [client 52.138.3.9:27505] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaRatRRjCrA8qWBjgG-3-gAAAlI"]
[Sun Mar 01 23:26:46.285942 2026] [:error] [pid 38241:tid 38259] [client 52.138.3.9:27493] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aaRatvKRPk6YnJBxw_xP6QAAAM8"]
[Sun Mar 01 23:26:46.750176 2026] [:error] [pid 7165:tid 7185] [client 52.138.3.9:27439] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aaRathRjCrA8qWBjgG-4LAAAAlI"]
[Sun Mar 01 23:26:47.185685 2026] [:error] [pid 7165:tid 7170] [client 52.138.3.9:27593] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aaRatxRjCrA8qWBjgG-4MwAAAkM"]
[Sun Mar 01 23:26:47.724343 2026] [:error] [pid 7165:tid 7183] [client 52.138.3.9:27569] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aaRatxRjCrA8qWBjgG-4OwAAAlA"]
[Sun Mar 01 23:26:48.147202 2026] [:error] [pid 7165:tid 7182] [client 52.138.3.9:27576] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aaRauBRjCrA8qWBjgG-4UwAAAk8"]
[Sun Mar 01 23:26:48.609936 2026] [:error] [pid 7165:tid 7168] [client 52.138.3.9:26739] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aaRauBRjCrA8qWBjgG-4WwAAAkE"]
[Sun Mar 01 23:26:49.054459 2026] [:error] [pid 7133:tid 7149] [client 52.138.3.9:27517] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aaRaufCtubh8pR64qB91xAAAAE4"]
[Sun Mar 01 23:26:49.476642 2026] [:error] [pid 40750:tid 40762] [client 52.138.3.9:27432] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aaRauQfBuk03yQKDyqucFQAAAck"]
[Sun Mar 01 23:26:49.925340 2026] [:error] [pid 40750:tid 40771] [client 52.138.3.9:27404] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmrlpc.php"] [unique_id "aaRauQfBuk03yQKDyqucGQAAAdI"]
[Sun Mar 01 23:26:50.474033 2026] [:error] [pid 7133:tid 7148] [client 52.138.3.9:27572] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aaRauvCtubh8pR64qB91xQAAAE0"]
[Sun Mar 01 23:26:50.947328 2026] [:error] [pid 44644:tid 44660] [client 52.138.3.9:27399] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aaRaup3RJaXMcw3y9V_rmAAAAA0"]
[Sun Mar 01 23:26:51.381946 2026] [:error] [pid 40750:tid 40770] [client 52.138.3.9:27577] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aaRauwfBuk03yQKDyqucHQAAAdE"]
[Sun Mar 01 23:26:51.855358 2026] [:error] [pid 40750:tid 40755] [client 52.138.3.9:27501] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/123.php"] [unique_id "aaRauwfBuk03yQKDyqucIAAAAcI"]
[Sun Mar 01 23:26:52.340886 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:27442] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaRavBRjCrA8qWBjgG-4bwAAAkA"]
[Sun Mar 01 23:26:52.799888 2026] [:error] [pid 7165:tid 7185] [client 52.138.3.9:27397] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaRavBRjCrA8qWBjgG-4cwAAAlI"]
[Sun Mar 01 23:26:53.226604 2026] [:error] [pid 7165:tid 7182] [client 52.138.3.9:27606] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaRavRRjCrA8qWBjgG-4eAAAAk8"]
[Sun Mar 01 23:26:53.675862 2026] [:error] [pid 7165:tid 7188] [client 52.138.3.9:26711] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z60.php"] [unique_id "aaRavRRjCrA8qWBjgG-4fAAAAlU"]
[Sun Mar 01 23:26:54.101299 2026] [:error] [pid 7133:tid 7136] [client 52.138.3.9:27419] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaRavvCtubh8pR64qB910AAAAEE"]
[Sun Mar 01 23:26:54.553527 2026] [:error] [pid 7165:tid 7170] [client 52.138.3.9:26704] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaRavhRjCrA8qWBjgG-4gQAAAkM"]
[Sun Mar 01 23:26:55.002032 2026] [:error] [pid 44644:tid 44666] [client 52.138.3.9:27515] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaRav53RJaXMcw3y9V_rmQAAABM"]
[Sun Mar 01 23:26:55.675559 2026] [:error] [pid 40750:tid 40758] [client 52.138.3.9:27401] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class.php"] [unique_id "aaRavwfBuk03yQKDyqucJQAAAcU"]
[Sun Mar 01 23:26:56.445130 2026] [:error] [pid 7133:tid 7155] [client 52.138.3.9:27395] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaRawPCtubh8pR64qB912QAAAFQ"]
[Sun Mar 01 23:26:56.898528 2026] [:error] [pid 40750:tid 40762] [client 52.138.3.9:27474] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file.php"] [unique_id "aaRawAfBuk03yQKDyqucKAAAAck"]
[Sun Mar 01 23:26:57.634605 2026] [:error] [pid 38034:tid 38061] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 01 23:26:57.899091 2026] [:error] [pid 38034:tid 38054] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Sun Mar 01 23:26:58.107130 2026] [:error] [pid 38034:tid 38051] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun Mar 01 23:26:58.327820 2026] [:error] [pid 38034:tid 38053] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun Mar 01 23:26:58.543322 2026] [:error] [pid 38034:tid 38046] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 01 23:26:59.009574 2026] [:error] [pid 38034:tid 38045] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/gg.php
[Sun Mar 01 23:26:59.218544 2026] [:error] [pid 38034:tid 38038] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Mar 01 23:26:59.436028 2026] [:error] [pid 38034:tid 38047] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Mar 01 23:26:59.644173 2026] [:error] [pid 38034:tid 38057] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/wrt.php
[Sun Mar 01 23:26:59.890850 2026] [:error] [pid 38034:tid 38044] [client 52.138.3.9:27621] File does not exist: /usr/local/apache/htdocs/suspended-page/ha.php
[Sun Mar 01 23:27:00.096602 2026] [:error] [pid 38034:tid 38050] [client 52.138.3.9:27621] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaRaxAxtfZjwlJok9K8w1QAAAQw"]
[Sun Mar 01 23:27:00.557490 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:27490] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaRaxBRjCrA8qWBjgG-4rAAAAkA"]
[Sun Mar 01 23:27:01.025387 2026] [:error] [pid 7165:tid 7189] [client 52.138.3.9:27484] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaRaxRRjCrA8qWBjgG-4tQAAAlY"]
[Sun Mar 01 23:27:01.588527 2026] [:error] [pid 33822:tid 33838] [client 52.138.3.9:27415] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vx.php"] [unique_id "aaRaxW6W3ygu1YVssuZBugAAAo4"]
[Sun Mar 01 23:27:02.087580 2026] [:error] [pid 7165:tid 7181] [client 52.138.3.9:27429] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaRaxhRjCrA8qWBjgG-4ugAAAk4"]
[Sun Mar 01 23:27:02.507462 2026] [:error] [pid 37032:tid 37052] [client 52.138.3.9:27450] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaRaxuu0U4o7eSImsVST-wAAAZI"]
[Sun Mar 01 23:27:02.930469 2026] [:error] [pid 7165:tid 7191] [client 52.138.3.9:27483] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaRaxhRjCrA8qWBjgG-4wQAAAlg"]
[Sun Mar 01 23:27:03.442086 2026] [:error] [pid 7165:tid 7168] [client 52.138.3.9:26732] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/item.php"] [unique_id "aaRaxxRjCrA8qWBjgG-4yQAAAkE"]
[Sun Mar 01 23:27:03.858975 2026] [:error] [pid 7165:tid 7184] [client 52.138.3.9:27495] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaRaxxRjCrA8qWBjgG-40gAAAlE"]
[Sun Mar 01 23:27:04.365931 2026] [:error] [pid 33822:tid 33843] [client 52.138.3.9:26714] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaRayG6W3ygu1YVssuZBvwAAApM"]
[Sun Mar 01 23:27:04.834752 2026] [:error] [pid 7165:tid 7191] [client 52.138.3.9:27407] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaRayBRjCrA8qWBjgG-44QAAAlg"]
[Sun Mar 01 23:27:05.332060 2026] [:error] [pid 40750:tid 40764] [client 52.138.3.9:27587] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/radio.php"] [unique_id "aaRayQfBuk03yQKDyqucQwAAAcs"]
[Sun Mar 01 23:27:05.765066 2026] [:error] [pid 40750:tid 40769] [client 52.138.3.9:27455] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRayQfBuk03yQKDyqucRgAAAdA"]
[Sun Mar 01 23:27:06.240064 2026] [:error] [pid 41780:tid 41798] [client 52.138.3.9:26691] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRaysONkVoocLIqzy03CgAAA88"]
[Sun Mar 01 23:27:06.824839 2026] [:error] [pid 37032:tid 37053] [client 52.138.3.9:27428] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRayuu0U4o7eSImsVST_wAAAZM"]
[Sun Mar 01 23:27:07.263406 2026] [:error] [pid 37032:tid 37050] [client 52.138.3.9:27438] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRay-u0U4o7eSImsVSUAQAAAZA"]
[Sun Mar 01 23:27:07.810089 2026] [:error] [pid 40750:tid 40754] [client 52.138.3.9:27508] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaRaywfBuk03yQKDyqucUQAAAcE"]
[Sun Mar 01 23:27:08.256196 2026] [:error] [pid 40750:tid 40776] [client 52.138.3.9:27412] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaRazAfBuk03yQKDyqucUgAAAdc"]
[Sun Mar 01 23:27:08.692375 2026] [:error] [pid 33822:tid 33832] [client 52.138.3.9:27449] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaRazG6W3ygu1YVssuZByQAAAog"]
[Sun Mar 01 23:27:09.189855 2026] [:error] [pid 33822:tid 33834] [client 52.138.3.9:27396] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aaRazW6W3ygu1YVssuZBzAAAAoo"]
[Sun Mar 01 23:27:09.613068 2026] [:error] [pid 7133:tid 7158] [client 52.138.3.9:27452] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaRazfCtubh8pR64qB914gAAAFc"]
[Sun Mar 01 23:27:10.114632 2026] [:error] [pid 44644:tid 44661] [client 52.138.3.9:26748] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaRazp3RJaXMcw3y9V_rowAAAA4"]
[Sun Mar 01 23:27:10.556210 2026] [:error] [pid 7165:tid 7180] [client 52.138.3.9:26706] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaRazhRjCrA8qWBjgG-4-wAAAk0"]
[Sun Mar 01 23:27:10.976855 2026] [:error] [pid 7165:tid 7182] [client 52.138.3.9:27430] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/la.php"] [unique_id "aaRazhRjCrA8qWBjgG-5AgAAAk8"]
[Sun Mar 01 23:27:11.416915 2026] [:error] [pid 7165:tid 7172] [client 52.138.3.9:27436] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaRazxRjCrA8qWBjgG-5CAAAAkU"]
[Sun Mar 01 23:27:11.845869 2026] [:error] [pid 41342:tid 41351] [client 52.138.3.9:27417] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaRaz44iJ6RAS5CatDln9gAAAgY"]
[Sun Mar 01 23:27:12.357803 2026] [:error] [pid 41342:tid 41346] [client 52.138.3.9:27408] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaRa0I4iJ6RAS5CatDln-QAAAgE"]
[Sun Mar 01 23:27:12.829048 2026] [:error] [pid 38241:tid 38264] [client 52.138.3.9:26719] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccou.php"] [unique_id "aaRa0PKRPk6YnJBxw_xQIgAAANQ"]
[Sun Mar 01 23:27:13.272084 2026] [:error] [pid 38241:tid 38251] [client 52.138.3.9:27435] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaRa0fKRPk6YnJBxw_xQJQAAAMc"]
[Sun Mar 01 23:27:13.797859 2026] [:error] [pid 38241:tid 38260] [client 52.138.3.9:26718] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaRa0fKRPk6YnJBxw_xQKAAAANA"]
[Sun Mar 01 23:27:14.252414 2026] [:error] [pid 7133:tid 7149] [client 52.138.3.9:27507] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaRa0vCtubh8pR64qB915gAAAE4"]
[Sun Mar 01 23:27:14.704424 2026] [:error] [pid 44644:tid 44670] [client 52.138.3.9:26716] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/readme.php"] [unique_id "aaRa0p3RJaXMcw3y9V_rpwAAABc"]
[Sun Mar 01 23:27:15.280542 2026] [:error] [pid 37032:tid 37038] [client 52.138.3.9:26747] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaRa0-u0U4o7eSImsVSUBQAAAYQ"]
[Sun Mar 01 23:27:15.713564 2026] [:error] [pid 7133:tid 7140] [client 52.138.3.9:27444] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaRa0_Ctubh8pR64qB917gAAAEU"]
[Sun Mar 01 23:27:16.195733 2026] [:error] [pid 37032:tid 37045] [client 52.138.3.9:26717] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaRa1Ou0U4o7eSImsVSUBgAAAYs"]
[Sun Mar 01 23:27:16.678891 2026] [:error] [pid 40750:tid 40760] [client 52.138.3.9:27427] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file7.php"] [unique_id "aaRa1AfBuk03yQKDyqucZgAAAcc"]
[Sun Mar 01 23:27:17.190465 2026] [:error] [pid 33822:tid 33826] [client 52.138.3.9:27620] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaRa1W6W3ygu1YVssuZB5gAAAoI"]
[Sun Mar 01 23:27:17.651899 2026] [:error] [pid 38241:tid 38261] [client 52.138.3.9:26700] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaRa1fKRPk6YnJBxw_xQMwAAANE"]
[Sun Mar 01 23:27:18.067217 2026] [:error] [pid 40750:tid 40759] [client 52.138.3.9:27498] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaRa1gfBuk03yQKDyqucZwAAAcY"]
[Sun Mar 01 23:27:18.506062 2026] [:error] [pid 40750:tid 40755] [client 52.138.3.9:26743] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/x.php"] [unique_id "aaRa1gfBuk03yQKDyqucawAAAcI"]
[Sun Mar 01 23:27:18.987654 2026] [:error] [pid 7165:tid 7181] [client 52.138.3.9:27406] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaRa1hRjCrA8qWBjgG-5HgAAAk4"]
[Sun Mar 01 23:27:19.426737 2026] [:error] [pid 37032:tid 37042] [client 52.138.3.9:27454] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaRa1-u0U4o7eSImsVSUBwAAAYg"]
[Sun Mar 01 23:27:19.864825 2026] [:error] [pid 40750:tid 40771] [client 52.138.3.9:27347] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaRa1wfBuk03yQKDyqucdwAAAdI"]
[Sun Mar 01 23:27:20.631038 2026] [:error] [pid 40750:tid 40776] [client 52.138.3.9:27422] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lv.php"] [unique_id "aaRa2AfBuk03yQKDyqucewAAAdc"]
[Sun Mar 01 23:27:21.057324 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:26721] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaRa2RRjCrA8qWBjgG-5LQAAAkA"]
[Sun Mar 01 23:27:21.473766 2026] [:error] [pid 40750:tid 40764] [client 52.138.3.9:27502] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaRa2QfBuk03yQKDyqucfgAAAcs"]
[Sun Mar 01 23:27:21.889232 2026] [:error] [pid 7165:tid 7169] [client 52.138.3.9:27487] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaRa2RRjCrA8qWBjgG-5PQAAAkI"]
[Sun Mar 01 23:27:22.330218 2026] [:error] [pid 7165:tid 7185] [client 52.138.3.9:27447] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aaRa2hRjCrA8qWBjgG-5QwAAAlI"]
[Sun Mar 01 23:27:22.760844 2026] [:error] [pid 40750:tid 40772] [client 52.138.3.9:26697] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaRa2gfBuk03yQKDyqucgAAAAdM"]
[Sun Mar 01 23:27:23.212263 2026] [:error] [pid 40750:tid 40758] [client 52.138.3.9:26730] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaRa2wfBuk03yQKDyqucgwAAAcU"]
[Sun Mar 01 23:27:23.688735 2026] [:error] [pid 7165:tid 7180] [client 52.138.3.9:26712] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaRa2xRjCrA8qWBjgG-5UQAAAk0"]
[Sun Mar 01 23:27:24.131248 2026] [:error] [pid 7165:tid 7169] [client 52.138.3.9:26702] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "aaRa3BRjCrA8qWBjgG-5VwAAAkI"]
[Sun Mar 01 23:27:24.759285 2026] [:error] [pid 38034:tid 38045] [client 52.138.3.9:26735] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaRa3AxtfZjwlJok9K8w4wAAAQc"]
[Sun Mar 01 23:27:25.203712 2026] [:error] [pid 38034:tid 38047] [client 52.138.3.9:26742] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaRa3QxtfZjwlJok9K8w5AAAAQk"]
[Sun Mar 01 23:27:25.683822 2026] [:error] [pid 7165:tid 7175] [client 52.138.3.9:26692] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaRa3RRjCrA8qWBjgG-5ZwAAAkg"]
[Sun Mar 01 23:27:26.237217 2026] [:error] [pid 38034:tid 38050] [client 52.138.3.9:27443] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaRa3gxtfZjwlJok9K8w5gAAAQw"]
[Sun Mar 01 23:27:26.724699 2026] [:error] [pid 40750:tid 40768] [client 52.138.3.9:26696] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/click.php"] [unique_id "aaRa3gfBuk03yQKDyquckwAAAc8"]
[Sun Mar 01 23:27:27.175634 2026] [:error] [pid 38241:tid 38265] [client 52.138.3.9:27497] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRa3_KRPk6YnJBxw_xQSAAAANU"]
[Sun Mar 01 23:27:27.667112 2026] [:error] [pid 7165:tid 7181] [client 52.138.3.9:27398] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRa3xRjCrA8qWBjgG-5dwAAAk4"]
[Sun Mar 01 23:27:28.139350 2026] [:error] [pid 7165:tid 7169] [client 52.138.3.9:27612] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRa4BRjCrA8qWBjgG-5fgAAAkI"]
[Sun Mar 01 23:27:28.587257 2026] [:error] [pid 40750:tid 40754] [client 52.138.3.9:27409] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php"] [unique_id "aaRa4AfBuk03yQKDyquclAAAAcE"]
[Sun Mar 01 23:27:29.028709 2026] [:error] [pid 38241:tid 38260] [client 52.138.3.9:27494] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaRa4fKRPk6YnJBxw_xQSQAAANA"]
[Sun Mar 01 23:27:29.448370 2026] [:error] [pid 38034:tid 38040] [client 52.138.3.9:27414] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaRa4QxtfZjwlJok9K8w7QAAAQQ"]
[Sun Mar 01 23:27:29.894602 2026] [:error] [pid 40750:tid 40754] [client 52.138.3.9:27491] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaRa4QfBuk03yQKDyqucpAAAAcE"]
[Sun Mar 01 23:27:30.312892 2026] [:error] [pid 38241:tid 38247] [client 52.138.3.9:27350] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-trackback.php"] [unique_id "aaRa4vKRPk6YnJBxw_xQTgAAAMM"]
[Sun Mar 01 23:27:31.089338 2026] [:error] [pid 7165:tid 7174] [client 52.138.3.9:26694] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaRa4xRjCrA8qWBjgG-5jwAAAkc"]
[Sun Mar 01 23:27:32.085429 2026] [:error] [pid 7133:tid 7143] [client 52.138.3.9:26707] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaRa5PCtubh8pR64qB92BwAAAEg"]
[Sun Mar 01 23:27:33.176896 2026] [:error] [pid 40750:tid 40761] [client 52.138.3.9:27437] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaRa5QfBuk03yQKDyqucvgAAAcg"]
[Sun Mar 01 23:27:33.979739 2026] [:error] [pid 41342:tid 41365] [client 52.138.3.9:27451] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsd.php"] [unique_id "aaRa5Y4iJ6RAS5CatDloAwAAAhQ"]
[Sun Mar 01 23:27:34.470949 2026] [:error] [pid 7165:tid 7190] [client 52.138.3.9:26701] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRa5hRjCrA8qWBjgG-5mwAAAlc"]
[Sun Mar 01 23:27:35.087086 2026] [:error] [pid 7165:tid 7174] [client 52.138.3.9:27370] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRa5xRjCrA8qWBjgG-5ngAAAkc"]
[Sun Mar 01 23:27:35.500178 2026] [:error] [pid 33822:tid 33831] [client 52.138.3.9:26715] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRa526W3ygu1YVssuZB9AAAAoc"]
[Sun Mar 01 23:27:35.919148 2026] [:error] [pid 41342:tid 41358] [client 52.138.3.9:27393] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0x.php"] [unique_id "aaRa544iJ6RAS5CatDloBQAAAg0"]
[Sun Mar 01 23:27:36.395146 2026] [:error] [pid 38241:tid 38251] [client 52.138.3.9:27445] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaRa6PKRPk6YnJBxw_xQYQAAAMc"]
[Sun Mar 01 23:27:36.836593 2026] [:error] [pid 7133:tid 7148] [client 52.138.3.9:27329] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaRa6PCtubh8pR64qB92DQAAAE0"]
[Sun Mar 01 23:27:37.401573 2026] [:error] [pid 7133:tid 7152] [client 52.138.3.9:26738] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaRa6fCtubh8pR64qB92DgAAAFE"]
[Sun Mar 01 23:27:37.843643 2026] [:error] [pid 40750:tid 40755] [client 52.138.3.9:27359] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lock360.php"] [unique_id "aaRa6QfBuk03yQKDyquc0wAAAcI"]
[Sun Mar 01 23:27:38.497263 2026] [:error] [pid 38241:tid 38258] [client 52.138.3.9:27423] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaRa6vKRPk6YnJBxw_xQaQAAAM4"]
[Sun Mar 01 23:27:39.061921 2026] [:error] [pid 7165:tid 7185] [client 52.138.3.9:26710] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaRa6xRjCrA8qWBjgG-5pgAAAlI"]
[Sun Mar 01 23:27:39.818554 2026] [:error] [pid 33822:tid 33847] [client 52.138.3.9:27338] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaRa626W3ygu1YVssuZB9wAAApc"]
[Sun Mar 01 23:27:40.292008 2026] [:error] [pid 33822:tid 33836] [client 52.138.3.9:27411] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/04.php"] [unique_id "aaRa7G6W3ygu1YVssuZB-AAAAow"]
[Sun Mar 01 23:27:40.727079 2026] [:error] [pid 33822:tid 33832] [client 52.138.3.9:26725] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaRa7G6W3ygu1YVssuZB-gAAAog"]
[Sun Mar 01 23:27:41.225956 2026] [:error] [pid 7165:tid 7175] [client 52.138.3.9:27340] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaRa7RRjCrA8qWBjgG-5twAAAkg"]
[Sun Mar 01 23:27:41.780684 2026] [:error] [pid 7165:tid 7168] [client 52.138.3.9:27307] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaRa7RRjCrA8qWBjgG-5vgAAAkE"]
[Sun Mar 01 23:27:42.261313 2026] [:error] [pid 7133:tid 7154] [client 52.138.3.9:27351] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file9.php"] [unique_id "aaRa7vCtubh8pR64qB92EgAAAFM"]
[Sun Mar 01 23:27:42.705967 2026] [:error] [pid 38034:tid 38061] [client 52.138.3.9:26744] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaRa7gxtfZjwlJok9K8w8gAAARc"]
[Sun Mar 01 23:27:43.147087 2026] [:error] [pid 40750:tid 40774] [client 52.138.3.9:27264] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaRa7wfBuk03yQKDyquc5QAAAdU"]
[Sun Mar 01 23:27:43.769755 2026] [:error] [pid 40750:tid 40771] [client 52.138.3.9:27348] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaRa7wfBuk03yQKDyquc6gAAAdI"]
[Sun Mar 01 23:27:44.335172 2026] [:error] [pid 40750:tid 40777] [client 52.138.3.9:27462] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aaRa8AfBuk03yQKDyquc8gAAAdg"]
[Sun Mar 01 23:27:44.813943 2026] [:error] [pid 41342:tid 41351] [client 52.138.3.9:27446] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaRa8I4iJ6RAS5CatDloCAAAAgY"]
[Sun Mar 01 23:27:45.242983 2026] [:error] [pid 40750:tid 40766] [client 52.138.3.9:27441] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaRa8QfBuk03yQKDyquc9QAAAc0"]
[Sun Mar 01 23:27:45.686675 2026] [:error] [pid 40750:tid 40757] [client 52.138.3.9:27330] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaRa8QfBuk03yQKDyquc-AAAAcQ"]
[Sun Mar 01 23:27:46.109752 2026] [:error] [pid 7165:tid 7181] [client 52.138.3.9:27433] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ac.php"] [unique_id "aaRa8hRjCrA8qWBjgG-53AAAAk4"]
[Sun Mar 01 23:27:46.545348 2026] [:error] [pid 7165:tid 7173] [client 52.138.3.9:27605] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaRa8hRjCrA8qWBjgG-54AAAAkY"]
[Sun Mar 01 23:27:46.987497 2026] [:error] [pid 7165:tid 7170] [client 52.138.3.9:26734] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaRa8hRjCrA8qWBjgG-55gAAAkM"]
[Sun Mar 01 23:27:47.582209 2026] [:error] [pid 40750:tid 40753] [client 52.138.3.9:26699] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaRa8wfBuk03yQKDyqudAAAAAcA"]
[Sun Mar 01 23:27:48.217706 2026] [:error] [pid 40750:tid 40775] [client 52.138.3.9:26726] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aaRa9AfBuk03yQKDyqudBQAAAdY"]
[Sun Mar 01 23:27:48.661273 2026] [:error] [pid 40750:tid 40755] [client 52.138.3.9:27433] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aaRa9AfBuk03yQKDyqudBwAAAcI"]
[Sun Mar 01 23:28:18.443872 2026] [:error] [pid 38241:tid 38252] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Sun Mar 01 23:28:18.654012 2026] [:error] [pid 38241:tid 38257] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Sun Mar 01 23:28:19.161549 2026] [:error] [pid 38241:tid 38253] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun Mar 01 23:28:19.371361 2026] [:error] [pid 38241:tid 38251] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/zfile.php
[Sun Mar 01 23:28:19.582704 2026] [:error] [pid 38241:tid 38261] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Sun Mar 01 23:28:20.290754 2026] [:error] [pid 38241:tid 38245] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/321.php
[Sun Mar 01 23:28:20.522906 2026] [:error] [pid 38241:tid 38263] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sun Mar 01 23:28:20.826689 2026] [:error] [pid 38241:tid 38254] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/ant.php
[Sun Mar 01 23:28:21.038903 2026] [:error] [pid 38241:tid 38248] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Mar 01 23:28:21.626193 2026] [:error] [pid 38241:tid 38249] [client 52.138.3.9:27334] File does not exist: /usr/local/apache/htdocs/suspended-page/num.php
[Sun Mar 01 23:28:22.147386 2026] [:error] [pid 38241:tid 38244] [client 52.138.3.9:27334] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/al.php"] [unique_id "aaRbFvKRPk6YnJBxw_xQtwAAAMA"]
[Sun Mar 01 23:28:22.745275 2026] [:error] [pid 40750:tid 40755] [client 52.138.3.9:27395] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/al.php"] [unique_id "aaRbFgfBuk03yQKDyqudcAAAAcI"]
[Sun Mar 01 23:28:23.664305 2026] [:error] [pid 40750:tid 40754] [client 52.138.3.9:27617] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/al.php"] [unique_id "aaRbFwfBuk03yQKDyqudcgAAAcE"]
[Sun Mar 01 23:28:24.179620 2026] [:error] [pid 40750:tid 40774] [client 52.138.3.9:27597] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/al.php"] [unique_id "aaRbGAfBuk03yQKDyquddgAAAdU"]
[Sun Mar 01 23:28:24.721483 2026] [:error] [pid 7165:tid 7183] [client 52.138.3.9:27448] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aaRbGBRjCrA8qWBjgG-6bwAAAlA"]
[Sun Mar 01 23:28:25.149275 2026] [:error] [pid 40750:tid 40772] [client 52.138.3.9:27535] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aaRbGQfBuk03yQKDyqudfQAAAdM"]
[Sun Mar 01 23:28:25.644085 2026] [:error] [pid 44644:tid 44647] [client 52.138.3.9:27537] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aaRbGZ3RJaXMcw3y9V_r6QAAAAA"]
[Sun Mar 01 23:28:26.240075 2026] [:error] [pid 44644:tid 44651] [client 52.138.3.9:27520] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/buy.php"] [unique_id "aaRbGp3RJaXMcw3y9V_r7AAAAAQ"]
[Sun Mar 01 23:28:26.711150 2026] [:error] [pid 7133:tid 7136] [client 52.138.3.9:27342] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aaRbGvCtubh8pR64qB92UQAAAEE"]
[Sun Mar 01 23:28:27.144281 2026] [:error] [pid 38241:tid 38252] [client 52.138.3.9:27337] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aaRbG_KRPk6YnJBxw_xQvwAAAMg"]
[Sun Mar 01 23:28:27.569002 2026] [:error] [pid 44644:tid 44671] [client 52.138.3.9:27527] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aaRbG53RJaXMcw3y9V_r7gAAABg"]
[Sun Mar 01 23:28:28.025597 2026] [:error] [pid 38241:tid 38255] [client 52.138.3.9:27613] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a.php"] [unique_id "aaRbHPKRPk6YnJBxw_xQxAAAAMs"]
[Sun Mar 01 23:28:28.445500 2026] [:error] [pid 38241:tid 38254] [client 52.138.3.9:27632] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aaRbHPKRPk6YnJBxw_xQxwAAAMo"]
[Sun Mar 01 23:28:28.967865 2026] [:error] [pid 41780:tid 41793] [client 52.138.3.9:27548] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aaRbHMONkVoocLIqzy03MwAAA8o"]
[Sun Mar 01 23:28:29.388462 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:27592] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aaRbHRRjCrA8qWBjgG-6ggAAAkA"]
[Sun Mar 01 23:28:29.822959 2026] [:error] [pid 7165:tid 7175] [client 52.138.3.9:26688] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aaRbHRRjCrA8qWBjgG-6hgAAAkg"]
[Sun Mar 01 23:28:30.312496 2026] [:error] [pid 40750:tid 40767] [client 52.138.3.9:27407] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bak.php"] [unique_id "aaRbHgfBuk03yQKDyqudggAAAc4"]
[Sun Mar 01 23:28:30.874852 2026] [:error] [pid 40750:tid 40759] [client 52.138.3.9:27538] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bak.php"] [unique_id "aaRbHgfBuk03yQKDyqudhwAAAcY"]
[Sun Mar 01 23:28:31.421343 2026] [:error] [pid 40750:tid 40770] [client 52.138.3.9:27453] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bak.php"] [unique_id "aaRbHwfBuk03yQKDyqudjgAAAdE"]
[Sun Mar 01 23:28:32.105297 2026] [:error] [pid 40750:tid 40765] [client 52.138.3.9:26703] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bak.php"] [unique_id "aaRbIAfBuk03yQKDyqudkwAAAcw"]
[Sun Mar 01 23:28:32.641836 2026] [:error] [pid 40750:tid 40758] [client 52.138.3.9:27536] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nc4.php"] [unique_id "aaRbIAfBuk03yQKDyqudmQAAAcU"]
[Sun Mar 01 23:28:33.225772 2026] [:error] [pid 33822:tid 33840] [client 52.138.3.9:27523] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nc4.php"] [unique_id "aaRbIW6W3ygu1YVssuZCEwAAApA"]
[Sun Mar 01 23:28:33.697819 2026] [:error] [pid 38241:tid 38247] [client 52.138.3.9:26749] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nc4.php"] [unique_id "aaRbIfKRPk6YnJBxw_xQ0gAAAMM"]
[Sun Mar 01 23:28:34.119628 2026] [:error] [pid 38241:tid 38261] [client 52.138.3.9:27631] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nc4.php"] [unique_id "aaRbIvKRPk6YnJBxw_xQ1gAAANE"]
[Sun Mar 01 23:28:34.541600 2026] [:error] [pid 33822:tid 33835] [client 52.138.3.9:27647] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaRbIm6W3ygu1YVssuZCFwAAAos"]
[Sun Mar 01 23:28:35.084771 2026] [:error] [pid 38034:tid 38051] [client 52.138.3.9:27372] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaRbIwxtfZjwlJok9K8xGwAAAQ0"]
[Sun Mar 01 23:28:35.549466 2026] [:error] [pid 38241:tid 38244] [client 52.138.3.9:27416] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaRbI_KRPk6YnJBxw_xQ4AAAAMA"]
[Sun Mar 01 23:28:35.962066 2026] [:error] [pid 33822:tid 33844] [client 52.138.3.9:27529] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ar.php"] [unique_id "aaRbI26W3ygu1YVssuZCGgAAApQ"]
[Sun Mar 01 23:28:36.506632 2026] [:error] [pid 38034:tid 38045] [client 52.138.3.9:27634] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaRbJAxtfZjwlJok9K8xHQAAAQc"]
[Sun Mar 01 23:28:36.927204 2026] [:error] [pid 7165:tid 7186] [client 52.138.3.9:27367] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaRbJBRjCrA8qWBjgG-6lgAAAlM"]
[Sun Mar 01 23:28:37.388963 2026] [:error] [pid 44644:tid 44647] [client 52.138.3.9:27546] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaRbJZ3RJaXMcw3y9V_r-wAAAAA"]
[Sun Mar 01 23:28:37.837555 2026] [:error] [pid 40750:tid 40766] [client 52.138.3.9:27476] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/0.php"] [unique_id "aaRbJQfBuk03yQKDyqudrgAAAc0"]
[Sun Mar 01 23:28:38.535009 2026] [:error] [pid 40750:tid 40775] [client 52.138.3.9:27273] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aaRbJgfBuk03yQKDyqudsQAAAdY"]
[Sun Mar 01 23:28:38.963740 2026] [:error] [pid 40750:tid 40770] [client 52.138.3.9:27559] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aaRbJgfBuk03yQKDyqudtAAAAdE"]
[Sun Mar 01 23:28:39.545575 2026] [:error] [pid 40750:tid 40773] [client 52.138.3.9:27526] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aaRbJwfBuk03yQKDyqudugAAAdQ"]
[Sun Mar 01 23:28:39.976679 2026] [:error] [pid 7165:tid 7169] [client 52.138.3.9:27637] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/doc.php"] [unique_id "aaRbJxRjCrA8qWBjgG-6qgAAAkI"]
[Sun Mar 01 23:28:40.402553 2026] [:error] [pid 7165:tid 7170] [client 52.138.3.9:26705] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/about.php"] [unique_id "aaRbKBRjCrA8qWBjgG-6rwAAAkM"]
[Sun Mar 01 23:28:40.822484 2026] [:error] [pid 7165:tid 7178] [client 52.138.3.9:26741] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/about.php"] [unique_id "aaRbKBRjCrA8qWBjgG-6tAAAAks"]
[Sun Mar 01 23:28:41.382543 2026] [:error] [pid 40750:tid 40769] [client 52.138.3.9:27589] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/about.php"] [unique_id "aaRbKQfBuk03yQKDyqudxwAAAdA"]
[Sun Mar 01 23:28:41.926742 2026] [:error] [pid 40750:tid 40763] [client 52.138.3.9:27601] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/about.php"] [unique_id "aaRbKQfBuk03yQKDyqudywAAAco"]
[Sun Mar 01 23:28:42.501654 2026] [:error] [pid 33822:tid 33832] [client 52.138.3.9:27296] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aaRbKm6W3ygu1YVssuZCHgAAAog"]
[Sun Mar 01 23:28:43.001886 2026] [:error] [pid 33822:tid 33840] [client 52.138.3.9:27291] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aaRbK26W3ygu1YVssuZCIwAAApA"]
[Sun Mar 01 23:28:43.479477 2026] [:error] [pid 7133:tid 7138] [client 52.138.3.9:27568] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aaRbK_Ctubh8pR64qB92YQAAAEM"]
[Sun Mar 01 23:28:43.914674 2026] [:error] [pid 33822:tid 33843] [client 52.138.3.9:27344] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aaRbK26W3ygu1YVssuZCJwAAApM"]
[Sun Mar 01 23:28:44.341907 2026] [:error] [pid 7133:tid 7142] [client 52.138.3.9:27641] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b.php"] [unique_id "aaRbLPCtubh8pR64qB92aAAAAEc"]
[Sun Mar 01 23:28:44.802833 2026] [:error] [pid 7165:tid 7182] [client 52.138.3.9:27635] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b.php"] [unique_id "aaRbLBRjCrA8qWBjgG-6zwAAAk8"]
[Sun Mar 01 23:28:45.269277 2026] [:error] [pid 7165:tid 7191] [client 52.138.3.9:27639] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b.php"] [unique_id "aaRbLRRjCrA8qWBjgG-60wAAAlg"]
[Sun Mar 01 23:28:45.782405 2026] [:error] [pid 7165:tid 7181] [client 52.138.3.9:27354] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b.php"] [unique_id "aaRbLRRjCrA8qWBjgG-62QAAAk4"]
[Sun Mar 01 23:28:46.211404 2026] [:error] [pid 38241:tid 38268] [client 52.138.3.9:27645] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaRbLvKRPk6YnJBxw_xQ8QAAANg"]
[Sun Mar 01 23:28:46.699300 2026] [:error] [pid 38241:tid 38264] [client 52.138.3.9:27532] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaRbLvKRPk6YnJBxw_xQ9wAAANQ"]
[Sun Mar 01 23:28:47.150880 2026] [:error] [pid 38241:tid 38251] [client 52.138.3.9:27586] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaRbL_KRPk6YnJBxw_xQ_gAAAMc"]
[Sun Mar 01 23:28:47.577857 2026] [:error] [pid 38241:tid 38257] [client 52.138.3.9:26745] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfa-rex.php7"] [unique_id "aaRbL_KRPk6YnJBxw_xRAQAAAM0"]
[Sun Mar 01 23:28:48.152646 2026] [:error] [pid 40750:tid 40769] [client 52.138.3.9:27533] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aaRbMAfBuk03yQKDyqud1wAAAdA"]
[Sun Mar 01 23:28:48.591972 2026] [:error] [pid 7165:tid 7172] [client 52.138.3.9:27431] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aaRbMBRjCrA8qWBjgG-66QAAAkU"]
[Sun Mar 01 23:28:49.074135 2026] [:error] [pid 7165:tid 7178] [client 52.138.3.9:26695] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aaRbMRRjCrA8qWBjgG-67AAAAks"]
[Sun Mar 01 23:28:49.506713 2026] [:error] [pid 40750:tid 40760] [client 52.138.3.9:27602] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/atomlib.php"] [unique_id "aaRbMQfBuk03yQKDyqud3QAAAcc"]
[Sun Mar 01 23:28:50.116076 2026] [:error] [pid 7165:tid 7167] [client 52.138.3.9:27491] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaRbMhRjCrA8qWBjgG-68AAAAkA"]
[Sun Mar 01 23:28:50.798463 2026] [:error] [pid 44644:tid 44671] [client 52.138.3.9:27285] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaRbMp3RJaXMcw3y9V_r_wAAABg"]
[Sun Mar 01 23:28:51.281675 2026] [:error] [pid 7133:tid 7138] [client 52.138.3.9:27530] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaRbM_Ctubh8pR64qB92cwAAAEM"]
[Sun Mar 01 23:28:51.704718 2026] [:error] [pid 40750:tid 40764] [client 52.138.3.9:27489] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/520.php"] [unique_id "aaRbMwfBuk03yQKDyqud5AAAAcs"]
[Sun Mar 01 23:28:52.216243 2026] [:error] [pid 40750:tid 40772] [client 52.138.3.9:27336] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaRbNAfBuk03yQKDyqud6QAAAdM"]
[Sun Mar 01 23:28:52.645281 2026] [:error] [pid 40750:tid 40762] [client 52.138.3.9:26737] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaRbNAfBuk03yQKDyqud7wAAAck"]
[Sun Mar 01 23:28:53.067201 2026] [:error] [pid 40750:tid 40775] [client 52.138.3.9:27596] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaRbNQfBuk03yQKDyqud9wAAAdY"]
[Sun Mar 01 23:28:53.495065 2026] [:error] [pid 40750:tid 40772] [client 52.138.3.9:27584] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/security.php"] [unique_id "aaRbNQfBuk03yQKDyqud_AAAAdM"]
[Sun Mar 01 23:28:53.937100 2026] [:error] [pid 40750:tid 40762] [client 52.138.3.9:27562] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aaRbNQfBuk03yQKDyqueAAAAAck"]
[Sun Mar 01 23:28:54.476804 2026] [:error] [pid 7133:tid 7158] [client 52.138.3.9:27540] [client 52.138.3.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aaRbNvCtubh8pR64qB92dgAAAFc"]
[Sun Mar 01 23:28:54.943352 2026] [:error] [pid 40750:tid 40762] [client 52.138.3.9:27525] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaRbNgfBuk03yQKDyqueEgAAAck"]
[Sun Mar 01 23:28:55.401098 2026] [:error] [pid 41342:tid 41359] [client 52.138.3.9:26728] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaRbN44iJ6RAS5CatDloJAAAAg4"]
[Sun Mar 01 23:28:55.832977 2026] [:error] [pid 37032:tid 37058] [client 52.138.3.9:26729] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaRbN-u0U4o7eSImsVSUPQAAAZg"]
[Sun Mar 01 23:28:56.310724 2026] [:error] [pid 38034:tid 38058] [client 52.138.3.9:27638] [client 52.138.3.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aaRbOAxtfZjwlJok9K8xIwAAARQ"]
[Mon Mar 02 00:10:38.835611 2026] [:error] [pid 7165:tid 7184] [client 43.130.3.120:41672] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaRk_hRjCrA8qWBjgG_gogAAAlE"]
[Mon Mar 02 00:12:49.807225 2026] [:error] [pid 40750:tid 40760] [client 20.63.80.2:11915] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaRlgQfBuk03yQKDyqu6UAAAAcc"]
[Mon Mar 02 00:12:50.650244 2026] [:error] [pid 33822:tid 33827] [client 20.63.80.2:11910] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaRlgm6W3ygu1YVssuZNQgAAAoM"]
[Mon Mar 02 00:12:51.477892 2026] [:error] [pid 7165:tid 7167] [client 20.63.80.2:11953] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaRlgxRjCrA8qWBjgG_iHwAAAkA"]
[Mon Mar 02 00:12:52.302719 2026] [:error] [pid 38241:tid 38245] [client 20.63.80.2:11950] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-corn-sample.php"] [unique_id "aaRlhPKRPk6YnJBxw_xk4gAAAME"]
[Mon Mar 02 01:03:31.018688 2026] [:error] [pid 53181:tid 53514] [client 20.220.162.180:57047] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRxY4r_0T1SazTrJOAoHAAAAQA"]
[Mon Mar 02 01:03:31.842092 2026] [:error] [pid 26940:tid 26962] [client 20.220.162.180:57046] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRxYxrUg-j5GLDtRFl7MwAAAFI"]
[Mon Mar 02 01:03:32.674295 2026] [:error] [pid 53585:tid 53609] [client 20.220.162.180:57031] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRxZHbCvYsvu6kKhM19HwAAABU"]
[Mon Mar 02 01:03:33.524790 2026] [:error] [pid 53182:tid 53544] [client 20.220.162.180:57609] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aaRxZfv073cA6eM1YCS2hgAAAME"]
[Mon Mar 02 02:53:23.779553 2026] [:error] [pid 26940:tid 26966] [client 165.227.209.178:52757] [client 165.227.209.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.209.178, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaSLIxrUg-j5GLDtRFkStgAAAFY"]
[Mon Mar 02 02:53:23.785254 2026] [:error] [pid 26940:tid 26966] [client 165.227.209.178:52757] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 02 02:53:24.231732 2026] [:error] [pid 53181:tid 53535] [client 165.227.209.178:53104] [client 165.227.209.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.209.178, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aaSLJIr_0T1SazTrJOBijgAAARQ"], referer: https://www.bing.com/
[Mon Mar 02 02:53:24.235630 2026] [:error] [pid 53181:tid 53535] [client 165.227.209.178:53104] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.bing.com/
[Mon Mar 02 02:53:27.719799 2026] [:error] [pid 53181:tid 53536] [client 165.227.209.178:54199] [client 165.227.209.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.209.178, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aaSLJ4r_0T1SazTrJOBiogAAARU"]
[Mon Mar 02 02:53:27.725702 2026] [:error] [pid 53181:tid 53536] [client 165.227.209.178:54199] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 02 02:53:28.158213 2026] [:error] [pid 53182:tid 53561] [client 165.227.209.178:54514] [client 165.227.209.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.209.178, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "aaSLKPv073cA6eM1YCQA8gAAANE"]
[Mon Mar 02 02:53:28.162195 2026] [:error] [pid 53182:tid 53561] [client 165.227.209.178:54514] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 02 03:15:25.433722 2026] [:error] [pid 26940:tid 26960] [client 124.156.225.181:43538] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaSQTRrUg-j5GLDtRFkqGAAAAFA"]
[Mon Mar 02 04:41:53.004658 2026] [:error] [pid 28908:tid 28919] [client 134.149.59.124:5573] [client 134.149.59.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaSkkYqJmC8ih_lQQnDIaQAAAMk"]
[Mon Mar 02 04:41:53.507505 2026] [:error] [pid 31257:tid 31269] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/cah.php
[Mon Mar 02 04:41:54.013672 2026] [:error] [pid 31257:tid 31283] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Mar 02 04:41:54.266547 2026] [:error] [pid 31257:tid 31270] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/muzu.php
[Mon Mar 02 04:41:54.518924 2026] [:error] [pid 31257:tid 31271] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon Mar 02 04:41:54.772515 2026] [:error] [pid 31257:tid 31272] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/wpo.php
[Mon Mar 02 04:41:55.025359 2026] [:error] [pid 31257:tid 31274] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Mon Mar 02 04:41:55.278638 2026] [:error] [pid 31257:tid 31283] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Mon Mar 02 04:41:55.531938 2026] [:error] [pid 31257:tid 31270] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/011i.php
[Mon Mar 02 04:41:55.787927 2026] [:error] [pid 31257:tid 31271] [client 134.149.59.124:2998] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Mon Mar 02 04:41:56.043588 2026] [:error] [pid 31257:tid 31273] [client 134.149.59.124:2998] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as1337.php"] [unique_id "aaSklP-JFLfishX45N_uLwAAAQo"]
[Mon Mar 02 04:41:56.555659 2026] [:error] [pid 28795:tid 28875] [client 134.149.59.124:1516] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as1337.php"] [unique_id "aaSklLROd53wZBkdI_f1aQAAAIw"]
[Mon Mar 02 04:41:57.065896 2026] [:error] [pid 31257:tid 31264] [client 134.149.59.124:7813] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as1337.php"] [unique_id "aaSklf-JFLfishX45N_uMwAAAQE"]
[Mon Mar 02 04:41:57.576873 2026] [:error] [pid 28908:tid 28923] [client 134.149.59.124:4745] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaSklYqJmC8ih_lQQnDIgwAAAM0"]
[Mon Mar 02 04:41:58.088695 2026] [:error] [pid 28794:tid 28851] [client 134.149.59.124:1534] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaSklqVy2qpaelbUob3xawAAAE8"]
[Mon Mar 02 04:41:58.657259 2026] [:error] [pid 28908:tid 28919] [client 134.149.59.124:1187] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaSkloqJmC8ih_lQQnDIigAAAMk"]
[Mon Mar 02 04:41:59.245938 2026] [:error] [pid 28793:tid 28813] [client 134.149.59.124:14644] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "aaSklw2_fxBANaHo1f7y4AAAAAY"]
[Mon Mar 02 04:41:59.752286 2026] [:error] [pid 28908:tid 28929] [client 134.149.59.124:16285] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaSkl4qJmC8ih_lQQnDIkgAAANM"]
[Mon Mar 02 04:42:00.251066 2026] [:error] [pid 28793:tid 28816] [client 134.149.59.124:3788] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaSkmA2_fxBANaHo1f7y5gAAAAk"]
[Mon Mar 02 04:42:00.762407 2026] [:error] [pid 28793:tid 28825] [client 134.149.59.124:11600] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaSkmA2_fxBANaHo1f7y6wAAABI"]
[Mon Mar 02 04:42:01.273570 2026] [:error] [pid 28795:tid 28864] [client 134.149.59.124:2284] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf-shell.php"] [unique_id "aaSkmbROd53wZBkdI_f1bwAAAIE"]
[Mon Mar 02 04:42:01.788631 2026] [:error] [pid 31257:tid 31269] [client 134.149.59.124:3240] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaSkmf-JFLfishX45N_uQQAAAQY"]
[Mon Mar 02 04:42:02.309644 2026] [:error] [pid 28795:tid 28886] [client 134.149.59.124:6906] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaSkmrROd53wZBkdI_f1cQAAAJc"]
[Mon Mar 02 04:42:02.810538 2026] [:error] [pid 28794:tid 28839] [client 134.149.59.124:9434] [client 134.149.59.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core.php"] [unique_id "aaSkmqVy2qpaelbUob3xdQAAAEM"]
[Mon Mar 02 05:31:48.445038 2026] [:error] [pid 28793:tid 28828] [client 141.98.11.181:54609] [client 141.98.11.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.98.11.181, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aaSwRA2_fxBANaHo1f4BMwAAABU"]
[Mon Mar 02 05:31:48.448801 2026] [:error] [pid 28793:tid 28828] [client 141.98.11.181:54609] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 02 05:31:50.970660 2026] [:error] [pid 28793:tid 28827] [client 141.98.11.181:54609] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aaSwRg2_fxBANaHo1f4BPwAAABQ"]
[Mon Mar 02 05:31:51.529449 2026] [:error] [pid 28908:tid 28925] [client 141.98.11.181:50862] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aaSwR4qJmC8ih_lQQnDtdwAAAM8"]
[Mon Mar 02 05:31:52.083926 2026] [:error] [pid 31257:tid 31286] [client 141.98.11.181:63559] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aaSwSP-JFLfishX45N8mNQAAARc"]
[Mon Mar 02 05:31:52.639460 2026] [:error] [pid 28794:tid 28841] [client 141.98.11.181:62022] [client 141.98.11.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aaSwSKVy2qpaelbUob0FWAAAAEU"]
[Mon Mar 02 05:38:14.279130 2026] [:error] [pid 31257:tid 31274] [client 43.156.156.96:45820] [client 43.156.156.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaSxxv-JFLfishX45N8uSgAAAQs"]
[Mon Mar 02 08:44:23.486497 2026] [:error] [pid 28794:tid 28857] [client 43.167.232.38:40310] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaTdZ6Vy2qpaelbUob1Z3gAAAFU"]
[Mon Mar 02 11:01:35.693357 2026] [:error] [pid 21575:tid 21590] [client 43.130.12.43:41752] [client 43.130.12.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaT9jyrocdArcJqFfInDrAAAAUs"]
[Mon Mar 02 16:02:05.688860 2026] [:error] [pid 59600:tid 59619] [client 43.157.53.115:56070] [client 43.157.53.115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaVD_YQ5lE4yocV9IBex1gAAAAo"]
[Mon Mar 02 17:18:37.164950 2026] [:error] [pid 59734:tid 59746] [client 106.119.167.146:48590] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaVV7ZeWQx7ZQG9NybHkdQAAAUo"]
[Mon Mar 02 21:03:17.303489 2026] [:error] [pid 59734:tid 59746] [client 124.156.226.179:33850] [client 124.156.226.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaWKlZeWQx7ZQG9NybEmeAAAAUo"]
[Mon Mar 02 23:53:36.498708 2026] [:error] [pid 28847:tid 28852] [client 170.106.143.6:38974] [client 170.106.143.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaWygJ9xbBq8VfeqVDbDdQAAAMM"]
[Tue Mar 03 00:07:07.695248 2026] [:error] [pid 59734:tid 59738] [client 106.54.62.156:36094] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaW1q5eWQx7ZQG9NybFaOQAAAUI"]
[Tue Mar 03 05:06:49.773360 2026] [:error] [pid 26186:tid 26212] [client 43.135.130.202:34118] [client 43.135.130.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaX76fbZCNtk8wDak9dpggAAAVg"]
[Tue Mar 03 07:12:52.097309 2026] [:error] [pid 36785:tid 36867] [client 49.51.183.84:45290] [client 49.51.183.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaYZdHhJejauENG9qTiecQAAAJE"]
[Tue Mar 03 10:20:40.703174 2026] [:error] [pid 14042:tid 14062] [client 43.133.66.51:57990] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaZFeGeHGCmSEiIBcK6noQAAAZI"]
[Tue Mar 03 12:21:46.633289 2026] [:error] [pid 36897:tid 36904] [client 43.157.95.131:57150] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaZh2iZC69_8eM0UoutNtwAAAMI"]
[Tue Mar 03 12:45:32.764069 2026] [:error] [pid 36784:tid 36826] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Mar 03 12:45:32.878485 2026] [:error] [pid 36784:tid 36835] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Mar 03 12:45:33.003331 2026] [:error] [pid 36784:tid 36824] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Mar 03 12:45:33.121399 2026] [:error] [pid 36784:tid 36823] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Mar 03 12:45:33.243889 2026] [:error] [pid 36784:tid 36845] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Mar 03 12:45:33.360027 2026] [:error] [pid 36784:tid 36843] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Mar 03 12:45:33.481501 2026] [:error] [pid 36784:tid 36839] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Mar 03 12:45:33.607461 2026] [:error] [pid 36784:tid 36842] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Mar 03 12:45:33.848940 2026] [:error] [pid 36784:tid 36836] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Mar 03 12:45:34.137552 2026] [:error] [pid 36784:tid 36833] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Mar 03 12:45:34.299939 2026] [:error] [pid 36784:tid 36824] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Mar 03 12:45:34.423607 2026] [:error] [pid 36784:tid 36825] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 03 12:45:34.534779 2026] [:error] [pid 36784:tid 36827] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Mar 03 12:45:34.648740 2026] [:error] [pid 36784:tid 36838] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Mar 03 12:45:34.761352 2026] [:error] [pid 36784:tid 36842] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Mar 03 12:45:34.873423 2026] [:error] [pid 36784:tid 36831] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Mar 03 12:45:34.986338 2026] [:error] [pid 36784:tid 36836] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Mar 03 12:45:35.102275 2026] [:error] [pid 36784:tid 36837] [client 45.133.5.157:43729] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Mar 03 12:45:38.450199 2026] [:error] [pid 36784:tid 36839] [client 45.133.5.157:43729] [client 45.133.5.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaZncnNeKOSGbW9kDgQf9AAAAFA"]
[Tue Mar 03 12:45:40.454220 2026] [:error] [pid 36897:tid 36919] [client 45.133.5.99:39909] [client 45.133.5.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaZndCZC69_8eM0UouteLwAAANE"]
[Tue Mar 03 12:45:41.100739 2026] [:error] [pid 36783:tid 36800] [client 45.133.5.70:44447] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Mar 03 12:45:41.547910 2026] [:error] [pid 36783:tid 36802] [client 45.133.5.70:44447] [client 45.133.5.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aaZndT4tNYh5NtLaTXc-ngAAAAg"]
[Tue Mar 03 12:45:42.054002 2026] [:error] [pid 36784:tid 36834] [client 45.133.5.78:58889] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Mar 03 12:45:42.164935 2026] [:error] [pid 36784:tid 36846] [client 45.133.5.78:58889] [client 45.133.5.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aaZndnNeKOSGbW9kDgQf_wAAAFc"]
[Tue Mar 03 12:45:42.510473 2026] [:error] [pid 36784:tid 36832] [client 45.133.5.78:30959] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Mar 03 12:45:43.116309 2026] [:error] [pid 36784:tid 36843] [client 45.133.5.78:30959] [client 45.133.5.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaZnd3NeKOSGbW9kDgQgCwAAAFQ"]
[Tue Mar 03 12:45:43.524425 2026] [:error] [pid 36783:tid 36794] [client 45.133.5.94:36931] [client 45.133.5.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaZndz4tNYh5NtLaTXc-oQAAAAA"]
[Tue Mar 03 12:45:43.743901 2026] [:error] [pid 36783:tid 36815] [client 45.133.5.56:30743] [client 45.133.5.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaZndz4tNYh5NtLaTXc-owAAABU"]
[Tue Mar 03 12:45:44.037662 2026] [:error] [pid 36785:tid 36854] [client 45.133.5.79:57439] [client 45.133.5.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaZneHhJejauENG9qTjmYAAAAIQ"]
[Tue Mar 03 12:45:44.265009 2026] [:error] [pid 36897:tid 36904] [client 45.133.5.93:40899] [client 45.133.5.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaZneCZC69_8eM0UouteOAAAAMI"]
[Tue Mar 03 12:45:44.486741 2026] [:error] [pid 36897:tid 36910] [client 45.133.5.81:52763] [client 45.133.5.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaZneCZC69_8eM0UouteOQAAAMg"]
[Tue Mar 03 12:45:44.864651 2026] [:error] [pid 36897:tid 36902] [client 45.133.5.72:53753] [client 45.133.5.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaZneCZC69_8eM0UoutePAAAAMA"]
[Tue Mar 03 12:45:45.084221 2026] [:error] [pid 26186:tid 26198] [client 45.133.5.79:64205] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Mar 03 12:45:45.310943 2026] [:error] [pid 26186:tid 26201] [client 45.133.5.79:64205] [client 45.133.5.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aaZnefbZCNtk8wDak9eC7AAAAU0"]
[Tue Mar 03 12:45:46.895624 2026] [:error] [pid 36784:tid 36840] [client 45.133.5.85:22371] [client 45.133.5.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaZnenNeKOSGbW9kDgQgEgAAAFE"]
[Tue Mar 03 12:45:47.259803 2026] [:error] [pid 26186:tid 26212] [client 45.133.5.70:53845] [client 45.133.5.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaZne_bZCNtk8wDak9eC9gAAAVg"]
[Tue Mar 03 12:45:47.496841 2026] [:error] [pid 62485:tid 62500] [client 45.133.5.77:47569] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Mar 03 12:45:47.605003 2026] [:error] [pid 62485:tid 62503] [client 45.133.5.77:47569] [client 45.133.5.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaZne_9R7DZ1ENjPMXQ5MQAAAc4"]
[Tue Mar 03 12:45:47.873795 2026] [:error] [pid 62485:tid 62495] [client 45.133.5.85:36207] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Mar 03 12:45:48.215336 2026] [:error] [pid 62485:tid 62489] [client 45.133.5.85:36207] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Mar 03 12:45:48.552735 2026] [:error] [pid 62485:tid 62501] [client 45.133.5.85:36207] [client 45.133.5.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaZnfP9R7DZ1ENjPMXQ5PAAAAcw"]
[Tue Mar 03 12:45:48.781481 2026] [:error] [pid 14042:tid 14051] [client 45.133.5.64:27709] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Mar 03 12:45:48.893748 2026] [:error] [pid 14042:tid 14057] [client 45.133.5.64:27709] [client 45.133.5.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaZnfGeHGCmSEiIBcK4S4AAAAY0"]
[Tue Mar 03 12:45:49.150741 2026] [:error] [pid 36783:tid 36806] [client 45.133.5.59:24763] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Mar 03 12:45:49.395520 2026] [:error] [pid 36783:tid 36801] [client 45.133.5.59:24763] [client 45.133.5.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aaZnfT4tNYh5NtLaTXc-rwAAAAc"]
[Tue Mar 03 12:45:49.751439 2026] [:error] [pid 36784:tid 36841] [client 45.133.5.67:62245] [client 45.133.5.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aaZnfXNeKOSGbW9kDgQgKAAAAFI"]
[Tue Mar 03 12:45:50.177963 2026] [:error] [pid 36784:tid 36824] [client 45.133.5.71:24735] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue Mar 03 12:45:50.291579 2026] [:error] [pid 36784:tid 36833] [client 45.133.5.71:24735] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Mar 03 12:45:50.520962 2026] [:error] [pid 36784:tid 36845] [client 45.133.5.71:24735] [client 45.133.5.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaZnfnNeKOSGbW9kDgQgZAAAAFY"]
[Tue Mar 03 12:45:50.865336 2026] [:error] [pid 36897:tid 36902] [client 45.133.5.157:40013] [client 45.133.5.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaZnfiZC69_8eM0UouteQwAAAMA"]
[Tue Mar 03 17:25:28.141284 2026] [:error] [pid 36784:tid 36828] [client 43.173.1.57:43774] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaapCHNeKOSGbW9kDgSNyQAAAEU"]
[Tue Mar 03 18:48:05.578083 2026] [:error] [pid 36897:tid 36904] [client 106.54.62.156:56734] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaa8ZSZC69_8eM0UousleAAAAMI"]
[Tue Mar 03 19:01:40.909544 2026] [:error] [pid 36897:tid 36911] [client 20.63.60.204:48316] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Mar 03 19:01:41.340687 2026] [:error] [pid 36897:tid 36917] [client 20.63.60.204:48316] [client 20.63.60.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.60.204, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "aaa_lSZC69_8eM0UoussOQAAAM8"]
[Tue Mar 03 19:01:41.560411 2026] [:error] [pid 36897:tid 36924] [client 20.63.60.204:48316] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Tue Mar 03 19:01:42.485125 2026] [:error] [pid 36897:tid 36907] [client 20.63.60.204:48316] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Tue Mar 03 19:01:43.160665 2026] [:error] [pid 36897:tid 36911] [client 20.63.60.204:48316] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Mar 03 19:01:43.370767 2026] [:error] [pid 36897:tid 36904] [client 20.63.60.204:48316] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaa_lyZC69_8eM0UoussRAAAAMI"]
[Tue Mar 03 19:01:44.218484 2026] [:error] [pid 36897:tid 36924] [client 20.63.60.204:21599] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaa_mCZC69_8eM0UoussVQAAANY"]
[Tue Mar 03 19:01:45.095742 2026] [:error] [pid 62485:tid 62509] [client 20.63.60.204:48268] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaa_mf9R7DZ1ENjPMXRnIAAAAdQ"]
[Tue Mar 03 19:01:45.938110 2026] [:error] [pid 36897:tid 36911] [client 20.63.60.204:28133] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "aaa_mSZC69_8eM0UoussbwAAAMk"]
[Tue Mar 03 20:10:08.426026 2026] [:error] [pid 36784:tid 36831] [client 43.134.186.61:57500] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aabPoHNeKOSGbW9kDgTEIQAAAEg"]
[Tue Mar 03 21:28:43.353491 2026] [:error] [pid 36897:tid 36922] [client 20.63.60.204:20218] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 03 21:28:43.777641 2026] [:error] [pid 36897:tid 36923] [client 20.63.60.204:20218] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Mar 03 21:28:43.988645 2026] [:error] [pid 36897:tid 36915] [client 20.63.60.204:20218] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Mar 03 21:28:44.200336 2026] [:error] [pid 36897:tid 36924] [client 20.63.60.204:20218] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Mar 03 21:28:44.416119 2026] [:error] [pid 36897:tid 36916] [client 20.63.60.204:20218] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue Mar 03 21:28:44.848616 2026] [:error] [pid 36897:tid 36909] [client 20.63.60.204:20218] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Mar 03 21:28:45.275039 2026] [:error] [pid 36897:tid 36921] [client 20.63.60.204:20218] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conf.php
[Tue Mar 03 21:28:45.694445 2026] [:error] [pid 36897:tid 36919] [client 20.63.60.204:20218] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aabiDSZC69_8eM0UouuGEQAAANE"]
[Tue Mar 03 21:28:46.533571 2026] [:error] [pid 36783:tid 36810] [client 20.63.60.204:20183] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aabiDj4tNYh5NtLaTXfFtwAAABA"]
[Tue Mar 03 21:28:47.370945 2026] [:error] [pid 36783:tid 36809] [client 20.63.60.204:18293] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aabiDz4tNYh5NtLaTXfFuQAAAA8"]
[Tue Mar 03 21:28:48.209531 2026] [:error] [pid 36784:tid 36843] [client 20.63.60.204:20176] [client 20.63.60.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aabiEHNeKOSGbW9kDgTdXgAAAFQ"]
[Tue Mar 03 22:11:33.804002 2026] [:error] [pid 36784:tid 36847] [client 178.16.53.90:59486] [client 178.16.53.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aabsFXNeKOSGbW9kDgTsJQAAAFg"]
[Tue Mar 03 23:16:03.465235 2026] [:error] [pid 36783:tid 36799] [client 20.151.116.226:54176] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aab7Mz4tNYh5NtLaTXfg6AAAAAU"]
[Tue Mar 03 23:16:04.295650 2026] [:error] [pid 36783:tid 36797] [client 20.151.116.226:58075] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aab7ND4tNYh5NtLaTXfg6wAAAAM"]
[Tue Mar 03 23:16:05.138913 2026] [:error] [pid 36897:tid 36913] [client 20.151.116.226:58059] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aab7NSZC69_8eM0UouvEaQAAAMs"]
[Tue Mar 03 23:16:05.987366 2026] [:error] [pid 36897:tid 36918] [client 20.151.116.226:60816] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "aab7NSZC69_8eM0UouvEcQAAANA"]
[Wed Mar 04 01:00:05.543774 2026] [:error] [pid 48807:tid 48832] [client 43.135.133.194:53616] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aacTlQ9v35BN-51vqYZqpAAAARc"]
[Wed Mar 04 01:29:23.355878 2026] [:error] [pid 48807:tid 48810] [client 110.166.71.39:39590] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aacacw9v35BN-51vqYZ-FwAAAQE"]
[Wed Mar 04 02:35:40.076055 2026] [:error] [pid 48807:tid 48815] [client 20.151.116.226:52846] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aacp_A9v35BN-51vqYaidAAAAQY"]
[Wed Mar 04 02:35:40.904722 2026] [:error] [pid 27359:tid 27363] [client 20.151.116.226:43510] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aacp_F607jzBiSmoFjIrZwAAAMI"]
[Wed Mar 04 02:35:41.753398 2026] [:error] [pid 27359:tid 27374] [client 20.151.116.226:62157] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aacp_V607jzBiSmoFjIragAAAM0"]
[Wed Mar 04 02:35:42.583399 2026] [:error] [pid 48406:tid 48681] [client 20.151.116.226:62158] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aacp_jStn8zJHlZMxFgnKAAAAFM"]
[Wed Mar 04 03:10:16.072686 2026] [:error] [pid 48407:tid 48693] [client 20.116.16.88:65424] [client 20.116.16.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aacyGD7Td6SiHn8fwfn4BAAAAIM"]
[Wed Mar 04 03:10:16.493510 2026] [:error] [pid 48407:tid 48701] [client 20.116.16.88:65436] [client 20.116.16.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aacyGD7Td6SiHn8fwfn4BgAAAIs"]
[Wed Mar 04 03:10:16.914781 2026] [:error] [pid 48807:tid 48812] [client 20.116.16.88:65481] [client 20.116.16.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aacyGA9v35BN-51vqYa0TQAAAQM"]
[Wed Mar 04 03:10:17.328779 2026] [:error] [pid 48407:tid 48705] [client 20.116.16.88:65421] [client 20.116.16.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aacyGT7Td6SiHn8fwfn4CAAAAI4"]
[Wed Mar 04 05:11:37.732209 2026] [:error] [pid 18555:tid 18619] [client 137.116.32.109:42838] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Mar 04 05:11:37.936294 2026] [:error] [pid 18555:tid 18623] [client 137.116.32.109:42838] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configss.php
[Wed Mar 04 05:11:38.141705 2026] [:error] [pid 18555:tid 18632] [client 137.116.32.109:42838] File does not exist: /usr/local/apache/htdocs/suspended-page/ba.php
[Wed Mar 04 05:11:38.344801 2026] [:error] [pid 18555:tid 18625] [client 137.116.32.109:42838] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed Mar 04 05:11:38.548008 2026] [:error] [pid 18555:tid 18620] [client 137.116.32.109:42838] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mails.php
[Wed Mar 04 05:11:38.750877 2026] [:error] [pid 18555:tid 18631] [client 137.116.32.109:42838] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Mar 04 05:11:38.953897 2026] [:error] [pid 18555:tid 18639] [client 137.116.32.109:42838] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Wed Mar 04 05:55:58.799124 2026] [:error] [pid 18554:tid 18609] [client 20.151.116.226:43232] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aadY7p0fKmKeTIK7QS2ePQAAAFE"]
[Wed Mar 04 05:55:59.642337 2026] [:error] [pid 18555:tid 18640] [client 20.151.116.226:59590] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aadY7zQeUDANiOsQ3GdyHQAAAJU"]
[Wed Mar 04 05:56:00.474510 2026] [:error] [pid 54487:tid 54506] [client 20.151.116.226:43207] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aadY8PN8030QMpFXddsqhwAAARE"]
[Wed Mar 04 05:56:01.304121 2026] [:error] [pid 54487:tid 54494] [client 20.151.116.226:52863] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "aadY8fN8030QMpFXddsqiQAAAQU"]
[Wed Mar 04 06:24:50.569986 2026] [:error] [pid 18681:tid 18698] [client 43.163.206.70:33316] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aadfsqE_TuZYUBveWkWjRgAAAM8"]
[Wed Mar 04 08:36:37.178148 2026] [:error] [pid 18681:tid 18693] [client 43.166.136.24:56186] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aad-laE_TuZYUBveWkXNqAAAAMo"]
[Wed Mar 04 10:11:37.480182 2026] [:error] [pid 54487:tid 54492] [client 52.252.56.196:42180] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Mar 04 10:11:37.971569 2026] [:error] [pid 54487:tid 54498] [client 52.252.56.196:42180] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Wed Mar 04 10:11:38.291738 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:42180] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Wed Mar 04 10:11:38.507196 2026] [:error] [pid 54487:tid 54495] [client 52.252.56.196:42180] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 04 10:11:38.718177 2026] [:error] [pid 54487:tid 54494] [client 52.252.56.196:42180] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Wed Mar 04 10:11:39.550441 2026] [:error] [pid 54487:tid 54505] [client 52.252.56.196:42180] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Wed Mar 04 10:11:39.996920 2026] [:error] [pid 54487:tid 54489] [client 52.252.56.196:42180] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aaeU2_N8030QMpFXddvorQAAAQA"]
[Wed Mar 04 10:11:41.736095 2026] [:error] [pid 18554:tid 18598] [client 52.252.56.196:61715] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aaeU3Z0fKmKeTIK7QS1HugAAAEY"]
[Wed Mar 04 10:11:42.796252 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:16271] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aaeU3vN8030QMpFXddvouQAAAQQ"]
[Wed Mar 04 10:11:44.265152 2026] [:error] [pid 54487:tid 54506] [client 52.252.56.196:42191] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aaeU4PN8030QMpFXddvoxQAAARE"]
[Wed Mar 04 10:11:45.786295 2026] [:error] [pid 54487:tid 54491] [client 52.252.56.196:21496] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aaeU4fN8030QMpFXddvo0AAAAQI"]
[Wed Mar 04 10:11:48.641439 2026] [:error] [pid 18555:tid 18626] [client 52.252.56.196:21460] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aaeU5DQeUDANiOsQ3GevGgAAAIc"]
[Wed Mar 04 10:11:49.933407 2026] [:error] [pid 54487:tid 54511] [client 52.252.56.196:42204] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aaeU5fN8030QMpFXddvo5QAAARY"]
[Wed Mar 04 10:11:51.211035 2026] [:error] [pid 18555:tid 18632] [client 52.252.56.196:20211] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "aaeU5zQeUDANiOsQ3GevHAAAAI0"]
[Wed Mar 04 10:11:53.070728 2026] [:error] [pid 18554:tid 18599] [client 52.252.56.196:17651] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aaeU6Z0fKmKeTIK7QS1H2AAAAEc"]
[Wed Mar 04 10:11:53.804092 2026] [:error] [pid 18553:tid 18578] [client 52.252.56.196:17640] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aaeU6Wbax1neh8d0AHa32gAAAA4"]
[Wed Mar 04 10:11:54.473361 2026] [:error] [pid 54487:tid 54501] [client 52.252.56.196:42198] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aaeU6vN8030QMpFXddvo6QAAAQw"]
[Wed Mar 04 10:11:55.199084 2026] [:error] [pid 18555:tid 18627] [client 52.252.56.196:21502] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "aaeU6zQeUDANiOsQ3GevIgAAAIg"]
[Wed Mar 04 10:11:55.819154 2026] [:error] [pid 54487:tid 54492] [client 52.252.56.196:17591] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aaeU6_N8030QMpFXddvo7AAAAQM"]
[Wed Mar 04 10:11:56.716896 2026] [:error] [pid 18554:tid 18608] [client 52.252.56.196:36598] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aaeU7J0fKmKeTIK7QS1H5QAAAFA"]
[Wed Mar 04 10:11:57.790615 2026] [:error] [pid 54487:tid 54508] [client 52.252.56.196:20220] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aaeU7fN8030QMpFXddvo8QAAARM"]
[Wed Mar 04 10:11:59.178673 2026] [:error] [pid 54487:tid 54505] [client 52.252.56.196:16269] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "aaeU7_N8030QMpFXddvo9gAAARA"]
[Wed Mar 04 10:11:59.932617 2026] [:error] [pid 54487:tid 54491] [client 52.252.56.196:20186] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aaeU7_N8030QMpFXddvo-wAAAQI"]
[Wed Mar 04 10:12:00.746502 2026] [:error] [pid 18555:tid 18624] [client 52.252.56.196:21489] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aaeU8DQeUDANiOsQ3GevJAAAAIU"]
[Wed Mar 04 10:12:01.274728 2026] [:error] [pid 18554:tid 18608] [client 52.252.56.196:61744] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aaeU8Z0fKmKeTIK7QS1H8QAAAFA"]
[Wed Mar 04 10:12:02.095486 2026] [:error] [pid 18554:tid 18600] [client 52.252.56.196:17611] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "aaeU8p0fKmKeTIK7QS1H9AAAAEg"]
[Wed Mar 04 10:12:02.707143 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:17546] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aaeU8p0fKmKeTIK7QS1H9QAAAFI"]
[Wed Mar 04 10:12:03.433142 2026] [:error] [pid 54487:tid 54503] [client 52.252.56.196:18874] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aaeU8_N8030QMpFXddvpBAAAAQ4"]
[Wed Mar 04 10:12:04.305219 2026] [:error] [pid 54487:tid 54501] [client 52.252.56.196:11349] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aaeU9PN8030QMpFXddvpCgAAAQw"]
[Wed Mar 04 10:12:06.836728 2026] [:error] [pid 54487:tid 54504] [client 52.252.56.196:36574] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "aaeU9vN8030QMpFXddvpFwAAAQ8"]
[Wed Mar 04 10:12:07.880005 2026] [:error] [pid 54487:tid 54495] [client 52.252.56.196:42233] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aaeU9_N8030QMpFXddvpHgAAAQY"]
[Wed Mar 04 10:12:09.068786 2026] [:error] [pid 18553:tid 18587] [client 52.252.56.196:42239] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aaeU-Wbax1neh8d0AHa34AAAABc"]
[Wed Mar 04 10:12:09.921892 2026] [:error] [pid 54487:tid 54500] [client 52.252.56.196:42230] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aaeU-fN8030QMpFXddvpJgAAAQs"]
[Wed Mar 04 10:12:10.787666 2026] [:error] [pid 54487:tid 54508] [client 52.252.56.196:42177] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "aaeU-vN8030QMpFXddvpKQAAARM"]
[Wed Mar 04 10:12:11.499162 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:16302] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aaeU-50fKmKeTIK7QS1ICAAAAFI"]
[Wed Mar 04 10:12:12.119457 2026] [:error] [pid 18553:tid 18565] [client 52.252.56.196:11390] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aaeU_Gbax1neh8d0AHa35QAAAAE"]
[Wed Mar 04 10:12:12.695797 2026] [:error] [pid 18554:tid 18593] [client 52.252.56.196:17595] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aaeU_J0fKmKeTIK7QS1ICgAAAEE"]
[Wed Mar 04 10:12:13.903717 2026] [:error] [pid 18555:tid 18621] [client 52.252.56.196:20215] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "aaeU_TQeUDANiOsQ3GevKwAAAII"]
[Wed Mar 04 10:12:16.386548 2026] [:error] [pid 18681:tid 18690] [client 52.252.56.196:11359] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aaeVAKE_TuZYUBveWkXzEgAAAMc"]
[Wed Mar 04 10:12:17.189242 2026] [:error] [pid 18554:tid 18595] [client 52.252.56.196:22895] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aaeVAZ0fKmKeTIK7QS1IGwAAAEM"]
[Wed Mar 04 10:12:19.786400 2026] [:error] [pid 54487:tid 54502] [client 52.252.56.196:17609] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aaeVA_N8030QMpFXddvpOQAAAQ0"]
[Wed Mar 04 10:12:44.063673 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/lsd.php
[Wed Mar 04 10:12:44.412713 2026] [:error] [pid 54487:tid 54499] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Mar 04 10:12:44.636616 2026] [:error] [pid 54487:tid 54496] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/wsd.php
[Wed Mar 04 10:12:44.846677 2026] [:error] [pid 54487:tid 54497] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Wed Mar 04 10:12:45.058137 2026] [:error] [pid 54487:tid 54503] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/atx.php
[Wed Mar 04 10:12:45.289035 2026] [:error] [pid 54487:tid 54494] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/m.php
[Wed Mar 04 10:12:45.556603 2026] [:error] [pid 54487:tid 54505] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Mar 04 10:12:46.213712 2026] [:error] [pid 54487:tid 54502] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Wed Mar 04 10:12:46.488233 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:61768] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Mar 04 10:12:46.726652 2026] [:error] [pid 54487:tid 54513] [client 52.252.56.196:61768] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aaeVHvN8030QMpFXddvpuQAAARg"]
[Wed Mar 04 10:12:48.001642 2026] [:error] [pid 54487:tid 54490] [client 52.252.56.196:17594] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aaeVIPN8030QMpFXddvpvQAAAQE"]
[Wed Mar 04 10:12:48.813938 2026] [:error] [pid 18681:tid 18701] [client 52.252.56.196:17558] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aaeVIKE_TuZYUBveWkXzLgAAANI"]
[Wed Mar 04 10:12:49.646234 2026] [:error] [pid 18681:tid 18686] [client 52.252.56.196:20170] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "aaeVIaE_TuZYUBveWkXzMQAAAMM"]
[Wed Mar 04 10:12:50.275519 2026] [:error] [pid 18554:tid 18602] [client 52.252.56.196:21485] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaeVIp0fKmKeTIK7QS1IfgAAAEo"]
[Wed Mar 04 10:12:51.130852 2026] [:error] [pid 18681:tid 18699] [client 52.252.56.196:17538] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaeVI6E_TuZYUBveWkXzMgAAANA"]
[Wed Mar 04 10:12:51.816886 2026] [:error] [pid 54487:tid 54492] [client 52.252.56.196:61722] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaeVI_N8030QMpFXddvpxwAAAQM"]
[Wed Mar 04 10:12:52.602244 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:16273] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aaeVJJ0fKmKeTIK7QS1IgwAAAFI"]
[Wed Mar 04 10:12:53.173748 2026] [:error] [pid 54487:tid 54497] [client 52.252.56.196:16262] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaeVJfN8030QMpFXddvpzgAAAQg"]
[Wed Mar 04 10:12:53.799146 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:17550] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/admin.php"] [unique_id "aaeVJZ0fKmKeTIK7QS1IhgAAAFY"]
[Wed Mar 04 10:12:54.352977 2026] [:error] [pid 18554:tid 18593] [client 52.252.56.196:17541] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/admin.php"] [unique_id "aaeVJp0fKmKeTIK7QS1IjQAAAEE"]
[Wed Mar 04 10:12:54.984030 2026] [:error] [pid 18554:tid 18607] [client 52.252.56.196:17663] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/admin.php"] [unique_id "aaeVJp0fKmKeTIK7QS1IkgAAAE8"]
[Wed Mar 04 10:12:55.624634 2026] [:error] [pid 18681:tid 18695] [client 52.252.56.196:21480] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/admin.php"] [unique_id "aaeVJ6E_TuZYUBveWkXzNgAAAMw"]
[Wed Mar 04 10:12:56.290283 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:36587] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core3.php"] [unique_id "aaeVKJ0fKmKeTIK7QS1IlgAAAFY"]
[Wed Mar 04 10:12:56.929080 2026] [:error] [pid 54487:tid 54506] [client 52.252.56.196:22870] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core3.php"] [unique_id "aaeVKPN8030QMpFXddvp1gAAARE"]
[Wed Mar 04 10:12:57.487483 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:61809] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core3.php"] [unique_id "aaeVKZ0fKmKeTIK7QS1InAAAAFI"]
[Wed Mar 04 10:12:58.240594 2026] [:error] [pid 18554:tid 18608] [client 52.252.56.196:11374] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core3.php"] [unique_id "aaeVKp0fKmKeTIK7QS1IoAAAAFA"]
[Wed Mar 04 10:12:59.504697 2026] [:error] [pid 18553:tid 18576] [client 52.252.56.196:61747] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RxR.php"] [unique_id "aaeVK2bax1neh8d0AHa4AAAAAAw"]
[Wed Mar 04 10:13:00.094110 2026] [:error] [pid 18555:tid 18627] [client 52.252.56.196:61803] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RxR.php"] [unique_id "aaeVLDQeUDANiOsQ3GevUAAAAIg"]
[Wed Mar 04 10:13:01.042331 2026] [:error] [pid 54487:tid 54496] [client 52.252.56.196:36600] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RxR.php"] [unique_id "aaeVLfN8030QMpFXddvp3gAAAQc"]
[Wed Mar 04 10:13:02.160662 2026] [:error] [pid 54487:tid 54501] [client 52.252.56.196:18858] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RxR.php"] [unique_id "aaeVLvN8030QMpFXddvp5gAAAQw"]
[Wed Mar 04 10:13:03.175801 2026] [:error] [pid 18554:tid 18593] [client 52.252.56.196:21484] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-etc/quti.php"] [unique_id "aaeVL50fKmKeTIK7QS1IsAAAAEE"]
[Wed Mar 04 10:13:04.876410 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:16307] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-etc/quti.php"] [unique_id "aaeVMPN8030QMpFXddvp7wAAARI"]
[Wed Mar 04 10:13:06.351202 2026] [:error] [pid 18681:tid 18707] [client 52.252.56.196:42192] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-etc/quti.php"] [unique_id "aaeVMqE_TuZYUBveWkXzRAAAANg"]
[Wed Mar 04 10:13:07.417812 2026] [:error] [pid 18681:tid 18694] [client 52.252.56.196:17556] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-etc/quti.php"] [unique_id "aaeVM6E_TuZYUBveWkXzRgAAAMs"]
[Wed Mar 04 10:13:08.687459 2026] [:error] [pid 18681:tid 18685] [client 52.252.56.196:36597] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/skin.php"] [unique_id "aaeVNKE_TuZYUBveWkXzUAAAAMI"]
[Wed Mar 04 10:13:09.656140 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:36551] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/skin.php"] [unique_id "aaeVNZ0fKmKeTIK7QS1IxgAAAEU"]
[Wed Mar 04 10:13:10.701306 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:21448] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/skin.php"] [unique_id "aaeVNp0fKmKeTIK7QS1I1AAAAEU"]
[Wed Mar 04 10:13:11.819031 2026] [:error] [pid 54487:tid 54489] [client 52.252.56.196:61792] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/skin.php"] [unique_id "aaeVN_N8030QMpFXddvp_AAAAQA"]
[Wed Mar 04 10:13:12.647284 2026] [:error] [pid 18554:tid 18612] [client 52.252.56.196:20196] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Gel.php"] [unique_id "aaeVOJ0fKmKeTIK7QS1I3AAAAFQ"]
[Wed Mar 04 10:13:13.467817 2026] [:error] [pid 54487:tid 54505] [client 52.252.56.196:11339] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Gel.php"] [unique_id "aaeVOfN8030QMpFXddvp_wAAARA"]
[Wed Mar 04 10:13:14.015493 2026] [:error] [pid 54487:tid 54508] [client 52.252.56.196:18819] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Gel.php"] [unique_id "aaeVOvN8030QMpFXddvqAgAAARM"]
[Wed Mar 04 10:13:15.211709 2026] [:error] [pid 18554:tid 18615] [client 52.252.56.196:15717] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Gel.php"] [unique_id "aaeVO50fKmKeTIK7QS1I4QAAAFc"]
[Wed Mar 04 10:13:17.126797 2026] [:error] [pid 54487:tid 54492] [client 52.252.56.196:36578] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pent.php"] [unique_id "aaeVPfN8030QMpFXddvqDAAAAQM"]
[Wed Mar 04 10:13:18.350336 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:42194] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pent.php"] [unique_id "aaeVPvN8030QMpFXddvqFQAAAQQ"]
[Wed Mar 04 10:13:18.990950 2026] [:error] [pid 54487:tid 54491] [client 52.252.56.196:22872] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pent.php"] [unique_id "aaeVPvN8030QMpFXddvqGwAAAQI"]
[Wed Mar 04 10:13:20.645218 2026] [:error] [pid 18554:tid 18592] [client 52.252.56.196:16277] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pent.php"] [unique_id "aaeVQJ0fKmKeTIK7QS1I5AAAAEA"]
[Wed Mar 04 10:13:21.487064 2026] [:error] [pid 18555:tid 18621] [client 52.252.56.196:61761] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/dz1.php"] [unique_id "aaeVQTQeUDANiOsQ3GevYwAAAII"]
[Wed Mar 04 10:13:22.154904 2026] [:error] [pid 18681:tid 18698] [client 52.252.56.196:21462] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/dz1.php"] [unique_id "aaeVQqE_TuZYUBveWkXzXwAAAM8"]
[Wed Mar 04 10:13:22.714931 2026] [:error] [pid 54487:tid 54508] [client 52.252.56.196:11357] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/dz1.php"] [unique_id "aaeVQvN8030QMpFXddvqJAAAARM"]
[Wed Mar 04 10:13:23.551029 2026] [:error] [pid 18554:tid 18595] [client 52.252.56.196:61817] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system/logs/dz1.php"] [unique_id "aaeVQ50fKmKeTIK7QS1I6QAAAEM"]
[Wed Mar 04 10:13:24.128962 2026] [:error] [pid 18554:tid 18612] [client 52.252.56.196:17562] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aaeVRJ0fKmKeTIK7QS1I6wAAAFQ"]
[Wed Mar 04 10:13:25.176228 2026] [:error] [pid 18554:tid 18601] [client 52.252.56.196:16261] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aaeVRZ0fKmKeTIK7QS1I8AAAAEk"]
[Wed Mar 04 10:13:25.991740 2026] [:error] [pid 54487:tid 54492] [client 52.252.56.196:17570] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aaeVRfN8030QMpFXddvqKwAAAQM"]
[Wed Mar 04 10:13:26.603895 2026] [:error] [pid 54487:tid 54513] [client 52.252.56.196:42186] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aaeVRvN8030QMpFXddvqLgAAARg"]
[Wed Mar 04 10:13:27.221105 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:17650] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aaeVR_N8030QMpFXddvqMQAAARI"]
[Wed Mar 04 10:13:28.366085 2026] [:error] [pid 54487:tid 54492] [client 52.252.56.196:61797] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aaeVSPN8030QMpFXddvqTwAAAQM"]
[Wed Mar 04 10:13:29.288290 2026] [:error] [pid 18555:tid 18627] [client 52.252.56.196:20221] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aaeVSTQeUDANiOsQ3GevawAAAIg"]
[Wed Mar 04 10:13:30.504519 2026] [:error] [pid 54487:tid 54489] [client 52.252.56.196:17608] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aaeVSvN8030QMpFXddvqWwAAAQA"]
[Wed Mar 04 10:13:31.581687 2026] [:error] [pid 54487:tid 54513] [client 52.252.56.196:11662] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aaeVS_N8030QMpFXddvqYQAAARg"]
[Wed Mar 04 10:13:32.168959 2026] [:error] [pid 18681:tid 18703] [client 52.252.56.196:16270] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aaeVTKE_TuZYUBveWkXzigAAANQ"]
[Wed Mar 04 10:13:32.913677 2026] [:error] [pid 18554:tid 18606] [client 52.252.56.196:17632] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aaeVTJ0fKmKeTIK7QS1JDAAAAE4"]
[Wed Mar 04 10:13:33.532722 2026] [:error] [pid 54487:tid 54504] [client 52.252.56.196:36595] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nagiosql/admin/logbook.php"] [unique_id "aaeVTfN8030QMpFXddvqawAAAQ8"]
[Wed Mar 04 10:13:34.019406 2026] [:error] [pid 54487:tid 54500] [client 52.252.56.196:42223] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aaeVTvN8030QMpFXddvqcAAAAQs"]
[Wed Mar 04 10:13:34.683068 2026] [:error] [pid 54487:tid 54504] [client 52.252.56.196:22860] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aaeVTvN8030QMpFXddvqdwAAAQ8"]
[Wed Mar 04 10:13:35.276131 2026] [:error] [pid 54487:tid 54499] [client 52.252.56.196:18293] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aaeVT_N8030QMpFXddvqewAAAQo"]
[Wed Mar 04 10:13:36.530045 2026] [:error] [pid 54487:tid 54489] [client 52.252.56.196:11389] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfacgiapi/admin.php"] [unique_id "aaeVUPN8030QMpFXddvqggAAAQA"]
[Wed Mar 04 10:13:37.058655 2026] [:error] [pid 54487:tid 54497] [client 52.252.56.196:15732] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/php-compat/chosen.php"] [unique_id "aaeVUfN8030QMpFXddvqiAAAAQg"]
[Wed Mar 04 10:13:37.666787 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:36545] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aaeVUZ0fKmKeTIK7QS1JEwAAAEU"]
[Wed Mar 04 10:13:38.348933 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:61739] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aaeVUp0fKmKeTIK7QS1JFwAAAFY"]
[Wed Mar 04 10:13:39.037722 2026] [:error] [pid 18681:tid 18687] [client 52.252.56.196:16290] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aaeVU6E_TuZYUBveWkXziwAAAMQ"]
[Wed Mar 04 10:13:41.020538 2026] [:error] [pid 54487:tid 54499] [client 52.252.56.196:22856] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/admin.php"] [unique_id "aaeVVfN8030QMpFXddvqkAAAAQo"]
[Wed Mar 04 10:13:41.965068 2026] [:error] [pid 18555:tid 18625] [client 52.252.56.196:22885] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aaeVVTQeUDANiOsQ3GeveAAAAIY"]
[Wed Mar 04 10:13:42.450737 2026] [:error] [pid 18554:tid 18596] [client 52.252.56.196:18834] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aaeVVp0fKmKeTIK7QS1JIQAAAEQ"]
[Wed Mar 04 10:13:43.279905 2026] [:error] [pid 54487:tid 54500] [client 52.252.56.196:22902] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aaeVV_N8030QMpFXddvqlAAAAQs"]
[Wed Mar 04 10:13:43.873543 2026] [:error] [pid 18553:tid 18564] [client 52.252.56.196:17557] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kZETIbO4Lt7.php"] [unique_id "aaeVV2bax1neh8d0AHa4GQAAAAA"]
[Wed Mar 04 10:13:44.449405 2026] [:error] [pid 54487:tid 54498] [client 52.252.56.196:61813] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso112233a.php"] [unique_id "aaeVWPN8030QMpFXddvqmQAAAQk"]
[Wed Mar 04 10:13:45.348871 2026] [:error] [pid 18681:tid 18687] [client 52.252.56.196:17605] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso112233a.php"] [unique_id "aaeVWaE_TuZYUBveWkXzmQAAAMQ"]
[Wed Mar 04 10:13:45.936895 2026] [:error] [pid 18681:tid 18699] [client 52.252.56.196:17627] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wso112233a.php"] [unique_id "aaeVWaE_TuZYUBveWkXzmwAAANA"]
[Wed Mar 04 10:13:46.516183 2026] [:error] [pid 54487:tid 54510] [client 52.252.56.196:61745] File does not exist: /usr/local/apache/htdocs/suspended-page/wso112233a.php
[Wed Mar 04 10:13:46.777846 2026] [:error] [pid 54487:tid 54511] [client 52.252.56.196:61745] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer-4.3.1-mysql-sk.php
[Wed Mar 04 10:13:47.309100 2026] [:error] [pid 54487:tid 54512] [client 52.252.56.196:61745] File does not exist: /usr/local/apache/htdocs/suspended-page/asdf.php
[Wed Mar 04 10:13:47.714181 2026] [:error] [pid 54487:tid 54509] [client 52.252.56.196:61745] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/aaa.php"] [unique_id "aaeVW_N8030QMpFXddvqqQAAARQ"]
[Wed Mar 04 10:13:48.689166 2026] [:error] [pid 54487:tid 54511] [client 52.252.56.196:21456] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/oQGWC1HLhE5.php"] [unique_id "aaeVXPN8030QMpFXddvqrgAAARY"]
[Wed Mar 04 10:13:49.389140 2026] [:error] [pid 54487:tid 54512] [client 52.252.56.196:61752] File does not exist: /usr/local/apache/htdocs/suspended-page/bar.php
[Wed Mar 04 10:13:49.593489 2026] [:error] [pid 54487:tid 54490] [client 52.252.56.196:61752] File does not exist: /usr/local/apache/htdocs/suspended-page/eee.php
[Wed Mar 04 10:13:51.255277 2026] [:error] [pid 54487:tid 54490] [client 52.252.56.196:61752] File does not exist: /usr/local/apache/htdocs/suspended-page/enviar-recibo.php
[Wed Mar 04 10:13:51.594286 2026] [:error] [pid 54487:tid 54510] [client 52.252.56.196:61752] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style.php"] [unique_id "aaeVX_N8030QMpFXddvqtwAAARU"]
[Wed Mar 04 10:49:29.646289 2026] [:error] [pid 18553:tid 18573] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/input.php
[Wed Mar 04 10:49:29.853854 2026] [:error] [pid 18553:tid 18570] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 04 10:49:30.065837 2026] [:error] [pid 18553:tid 18579] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko-new.php
[Wed Mar 04 10:49:30.335193 2026] [:error] [pid 18553:tid 18571] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Mar 04 10:49:30.554330 2026] [:error] [pid 18553:tid 18586] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Wed Mar 04 10:49:30.779295 2026] [:error] [pid 18553:tid 18572] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Wed Mar 04 10:49:31.002967 2026] [:error] [pid 18553:tid 18582] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Wed Mar 04 10:49:31.223450 2026] [:error] [pid 18553:tid 18583] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Wed Mar 04 10:49:31.440998 2026] [:error] [pid 18553:tid 18568] [client 13.82.150.179:10769] File does not exist: /usr/local/apache/htdocs/suspended-page/headers.php
[Wed Mar 04 10:49:31.879206 2026] [:error] [pid 18553:tid 18584] [client 13.82.150.179:10769] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aaedu2bax1neh8d0AHa9kwAAABQ"]
[Wed Mar 04 10:49:32.360391 2026] [:error] [pid 54487:tid 54509] [client 13.82.150.179:10698] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aaedvPN8030QMpFXddsOHQAAARQ"]
[Wed Mar 04 10:49:32.938750 2026] [:error] [pid 54487:tid 54493] [client 13.82.150.179:10774] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ee.php"] [unique_id "aaedvPN8030QMpFXddsOIAAAAQQ"]
[Wed Mar 04 10:49:33.446135 2026] [:error] [pid 54487:tid 54494] [client 13.82.150.179:10715] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ee.php"] [unique_id "aaedvfN8030QMpFXddsOJAAAAQU"]
[Wed Mar 04 10:49:33.967596 2026] [:error] [pid 54487:tid 54493] [client 13.82.150.179:10773] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ee.php"] [unique_id "aaedvfN8030QMpFXddsOKgAAAQQ"]
[Wed Mar 04 10:49:34.502340 2026] [:error] [pid 54487:tid 54502] [client 13.82.150.179:10800] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ee.php"] [unique_id "aaedvvN8030QMpFXddsOLgAAAQ0"]
[Wed Mar 04 10:49:35.018573 2026] [:error] [pid 18554:tid 18602] [client 13.82.150.179:10796] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaedv50fKmKeTIK7QS1gVgAAAEo"]
[Wed Mar 04 10:49:35.552669 2026] [:error] [pid 18555:tid 18639] [client 13.82.150.179:10812] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "aaedvzQeUDANiOsQ3Ge3wgAAAJQ"]
[Wed Mar 04 10:49:36.108628 2026] [:error] [pid 18554:tid 18603] [client 13.82.150.179:10786] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaedwJ0fKmKeTIK7QS1gWQAAAEs"]
[Wed Mar 04 10:49:36.577851 2026] [:error] [pid 54487:tid 54512] [client 13.82.150.179:10779] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaedwPN8030QMpFXddsOOgAAARc"]
[Wed Mar 04 10:49:37.036487 2026] [:error] [pid 54487:tid 54495] [client 13.82.150.179:10717] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaedwfN8030QMpFXddsOPgAAAQY"]
[Wed Mar 04 10:49:37.512061 2026] [:error] [pid 54487:tid 54511] [client 13.82.150.179:10775] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/main.php"] [unique_id "aaedwfN8030QMpFXddsOPwAAARY"]
[Wed Mar 04 10:49:38.043176 2026] [:error] [pid 54487:tid 54497] [client 13.82.150.179:5112] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aaedwvN8030QMpFXddsOQwAAAQg"]
[Wed Mar 04 10:49:38.577821 2026] [:error] [pid 18554:tid 18592] [client 13.82.150.179:10752] [client 13.82.150.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aaedwp0fKmKeTIK7QS1gYAAAAEA"]
[Wed Mar 04 11:35:04.029164 2026] [:error] [pid 18554:tid 18597] [client 43.164.197.177:43110] [client 43.164.197.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aaeoaJ0fKmKeTIK7QS19tgAAAEU"]
[Wed Mar 04 13:01:34.275876 2026] [:error] [pid 18554:tid 18595] [client 43.228.157.73:51535] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aae8rp0fKmKeTIK7QS3LDAAAAEM"]
[Wed Mar 04 13:01:34.841941 2026] [:error] [pid 18553:tid 18578] [client 43.228.157.73:51734] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aae8rmbax1neh8d0AHbOYQAAAA4"]
[Wed Mar 04 13:01:35.405175 2026] [:error] [pid 18553:tid 18566] [client 43.228.157.73:51943] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aae8r2bax1neh8d0AHbOhAAAAAI"]
[Wed Mar 04 13:01:35.974888 2026] [:error] [pid 45947:tid 46030] [client 43.228.157.73:52150] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aae8r0QXEtszYKy6sasUfQAAAUI"]
[Wed Mar 04 13:01:36.565236 2026] [:error] [pid 18681:tid 18693] [client 43.228.157.73:52351] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aae8sKE_TuZYUBveWkUpCgAAAMo"]
[Wed Mar 04 13:28:58.493166 2026] [:error] [pid 18554:tid 18602] [client 43.138.68.113:36264] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aafDGp0fKmKeTIK7QS3b0QAAAEo"]
[Wed Mar 04 13:41:00.855824 2026] [:error] [pid 18554:tid 18596] [client 43.135.183.82:45710] [client 43.135.183.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aafF7J0fKmKeTIK7QS3imgAAAEQ"]
[Wed Mar 04 16:32:55.554933 2026] [:error] [pid 51359:tid 51487] [client 43.166.136.153:43090] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aafuN_eZtYUOh-itqcqh6gAAAJg"]
[Wed Mar 04 22:58:42.547314 2026] [:error] [pid 61723:tid 61752] [client 167.71.195.210:65404] [client 167.71.195.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.195.210, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aahIoj-cYcKSTgnaHK6BuAAAAI8"]
[Wed Mar 04 22:58:42.552257 2026] [:error] [pid 61723:tid 61752] [client 167.71.195.210:65404] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 04 23:16:52.770374 2026] [:error] [pid 60622:tid 60700] [client 43.159.143.187:37214] [client 43.159.143.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aahM5BjlaiZh5Vup4nCU2QAAAEk"]
[Thu Mar 05 02:47:08.846796 2026] [:error] [pid 26969:tid 27041] [client 182.44.12.37:35236] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aah-LJlCO2K-E0MVfPPqIAAAAAE"]
[Thu Mar 05 07:58:10.864723 2026] [:error] [pid 62435:tid 62459] [client 43.166.250.187:40102] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aajHEiMZJMDfZh_-8sXS1AAAAMk"]
[Thu Mar 05 13:09:11.328165 2026] [:error] [pid 62435:tid 62457] [client 43.131.23.154:44478] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aakP9yMZJMDfZh_-8sUzkgAAAMc"]
[Thu Mar 05 15:13:41.899361 2026] [:error] [pid 62173:tid 62263] [client 43.166.245.120:40134] [client 43.166.245.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaktJWj_GWbFb-1ncGlf7AAAAAs"]
[Thu Mar 05 18:03:50.341074 2026] [:error] [pid 62435:tid 62461] [client 43.158.91.71:49350] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aalVBiMZJMDfZh_-8sVowwAAAMs"]
[Thu Mar 05 22:40:26.994098 2026] [:error] [pid 8151:tid 8226] [client 157.15.40.88:50567] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "aamV2pO3dLEidct1HvCoswAAAYc"]
[Thu Mar 05 22:40:27.260153 2026] [:error] [pid 41459:tid 41494] [client 157.15.40.88:50643] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/txets.php"] [unique_id "aamV2-dFBZEnZ3pzxrWEEQAAAVQ"]
[Thu Mar 05 22:40:27.513586 2026] [:error] [pid 8151:tid 8232] [client 157.15.40.88:50721] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/txets.php"] [unique_id "aamV25O3dLEidct1HvCo0wAAAYw"]
[Thu Mar 05 22:40:27.775353 2026] [:error] [pid 8151:tid 8226] [client 157.15.40.88:50801] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "aamV25O3dLEidct1HvCpBQAAAYc"]
[Thu Mar 05 22:40:30.454466 2026] [:error] [pid 62176:tid 62301] [client 157.15.40.88:51654] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/schallfuns.php"] [unique_id "aamV3iNfTPJryi30JPkKGAAAAFE"]
[Thu Mar 05 22:40:30.737094 2026] [:error] [pid 62435:tid 62455] [client 157.15.40.88:51720] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/postnews.php"] [unique_id "aamV3iMZJMDfZh_-8sWTUAAAAMU"]
[Thu Mar 05 22:40:31.017215 2026] [:error] [pid 62173:tid 62264] [client 157.15.40.88:51780] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/postnews.php"] [unique_id "aamV32j_GWbFb-1ncGmBRQAAAAw"]
[Thu Mar 05 22:40:31.273984 2026] [:error] [pid 62176:tid 62289] [client 157.15.40.88:51858] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/postnews.php"] [unique_id "aamV3yNfTPJryi30JPkKPwAAAEU"]
[Thu Mar 05 22:40:31.569607 2026] [:error] [pid 62173:tid 62268] [client 157.15.40.88:51926] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/postnews.php"] [unique_id "aamV32j_GWbFb-1ncGmBSwAAAA8"]
[Thu Mar 05 22:54:05.258845 2026] [:error] [pid 8151:tid 8237] [client 205.185.122.204:14367] [client 205.185.122.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.122.204, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aamZDZO3dLEidct1HvCy6QAAAZE"]
[Thu Mar 05 22:54:05.263054 2026] [:error] [pid 8151:tid 8237] [client 205.185.122.204:14367] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 06 00:45:04.007187 2026] [:error] [pid 47657:tid 47903] [client 103.77.107.222:52609] [client 103.77.107.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "aamzEC76-uV01o_084mE-wAAAAM"]
[Fri Mar 06 00:45:04.255492 2026] [:error] [pid 27687:tid 27710] [client 103.77.107.222:52739] [client 103.77.107.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aamzEEI2IG23EwU7sL8BjQAAAIk"]
[Fri Mar 06 04:00:33.557593 2026] [:error] [pid 36261:tid 36435] [client 43.156.168.214:56254] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aang4Ym9_KjbGBdg7LwFkQAAAJc"]
[Fri Mar 06 06:25:37.924617 2026] [:error] [pid 8945:tid 8976] [client 43.166.242.189:42182] [client 43.166.242.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaoC4QttiLGNg13nMzLscgAAAMk"]
[Fri Mar 06 10:22:15.289566 2026] [:error] [pid 8656:tid 8825] [client 49.235.136.28:37674] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aao6V5PxTG9Ff1TtP6OoCQAAAI8"]
[Fri Mar 06 17:29:59.657602 2026] [:error] [pid 59237:tid 59253] [client 43.159.138.217:32986] [client 43.159.138.217] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaqel-qfMSBs0nxOTxHIZwAAA4s"]
[Fri Mar 06 23:10:55.485558 2026] [:error] [pid 8656:tid 8817] [client 62.60.131.218:62693] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aaruf5PxTG9Ff1TtP6PK6AAAAIc"]
[Fri Mar 06 23:35:37.303943 2026] [:error] [pid 59237:tid 59261] [client 111.172.249.49:51262] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aar0SeqfMSBs0nxOTxGq9wAAA5M"]
[Fri Mar 06 23:50:26.279782 2026] [:error] [pid 16140:tid 16156] [client 104.28.214.122:30055] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aar3wpZVpEeGhAeSpv0ukAAAAQ4"]
[Fri Mar 06 23:50:46.072009 2026] [:error] [pid 59239:tid 59292] [client 104.28.166.128:57265] [client 104.28.166.128] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/style.php"] [unique_id "aar31rG1EpnE909fvGfTKQAAA9c"]
[Sat Mar 07 01:31:40.276431 2026] [:error] [pid 6913:tid 6999] [client 49.51.203.164:40206] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aasPfOyYBOeAwrF78TL2iwAAAAQ"]
[Sat Mar 07 04:28:08.256552 2026] [:error] [pid 4311:tid 4421] [client 144.172.115.113:59160] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aas42HbyS653WMGf2vXhVQAAAEI"], referer: https://www.hulu.com
[Sat Mar 07 04:28:10.435339 2026] [:error] [pid 4315:tid 4465] [client 144.172.115.113:59651] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aas42tDEK9AXzxu9OSgXigAAAJE"], referer: https://www.nbc.com
[Sat Mar 07 04:28:14.945083 2026] [:error] [pid 4609:tid 4638] [client 144.172.115.113:60205] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aas43uP7JMxUbw4Fd1YISwAAAMo"], referer: https://www.dropbox.com
[Sat Mar 07 04:28:17.516638 2026] [:error] [pid 52484:tid 52503] [client 144.172.115.113:60757] [client 144.172.115.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aas44fE9AnX6zUICFeSrjQAAAQA"], referer: https://news.google.com
[Sat Mar 07 05:51:36.260944 2026] [:error] [pid 4311:tid 4422] [client 124.156.225.181:54414] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aatMaHbyS653WMGf2vXwlQAAAEM"]
[Sat Mar 07 08:28:17.478287 2026] [:error] [pid 4315:tid 4466] [client 62.60.131.218:62263] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aatxIdDEK9AXzxu9OShb5QAAAJI"]
[Sat Mar 07 10:54:20.395156 2026] [:error] [pid 4609:tid 4630] [client 170.106.179.68:40990] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aauTXOP7JMxUbw4Fd1a8TwAAAMI"]
[Sat Mar 07 14:37:32.438460 2026] [:error] [pid 37998:tid 38063] [client 34.24.47.138:62350] [client 34.24.47.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/system/js/core.js"] [unique_id "aavHrMl3xHpv0STGaSbBDgAAAVM"]
[Sat Mar 07 17:01:17.633641 2026] [:error] [pid 52484:tid 52516] [client 193.32.126.227:61871] [client 193.32.126.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.32.126.227, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aavpXfE9AnX6zUICFeR8AwAAAQ0"]
[Sat Mar 07 17:01:17.638804 2026] [:error] [pid 52484:tid 52516] [client 193.32.126.227:61871] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat Mar 07 17:01:38.683261 2026] [:error] [pid 37998:tid 38043] [client 89.163.146.197:63622] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: www.google.com
[Sat Mar 07 17:01:50.431800 2026] [:error] [pid 52484:tid 52519] [client 89.163.146.197:50319] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php, referer: www.google.com
[Sat Mar 07 18:44:42.807825 2026] [:error] [pid 54127:tid 54160] [client 182.42.111.213:43080] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aawBmkuQzHmVv_Y3VjdQfwAAAtI"]
[Sun Mar 08 06:03:11.885125 2026] [:error] [pid 22787:tid 22839] [client 34.75.229.58:57420] [client 34.75.229.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aaygn0F9MGMhk9pT4z7fGQAAA0s"]
[Sun Mar 08 06:49:15.364690 2026] [:error] [pid 22790:tid 22896] [client 43.166.250.187:47200] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aayraxXbGDWrzD_dTOctPwAAA84"]
[Sun Mar 08 10:38:41.942560 2026] [:error] [pid 22790:tid 22904] [client 43.166.244.66:57730] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aazhMRXbGDWrzD_dTOfrNQAAA9Y"]
[Sun Mar 08 22:13:25.743169 2026] [:error] [pid 22788:tid 22863] [client 45.8.19.122:34469] [client 45.8.19.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.19.122, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aa2EBUhwluk21OG9mSdQIgAAA4g"]
[Sun Mar 08 22:13:25.746803 2026] [:error] [pid 22788:tid 22863] [client 45.8.19.122:34469] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 09 03:43:15.656913 2026] [:error] [pid 17485:tid 17511] [client 106.227.49.113:53749] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa3RU9QOL_kxQEc1PTAWCgAAARc"]
[Mon Mar 09 04:47:36.058273 2026] [:error] [pid 17485:tid 17503] [client 49.51.50.147:34750] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa3gaNQOL_kxQEc1PTBIcAAAAQ8"]
[Mon Mar 09 09:56:43.939060 2026] [:error] [pid 17485:tid 17492] [client 182.44.12.37:43027] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aa4o29QOL_kxQEc1PTA86gAAAQQ"]
[Mon Mar 09 10:31:38.869447 2026] [:error] [pid 6074:tid 6098] [client 119.28.177.175:41036] [client 119.28.177.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa4xChgvXHMVGYw_ElxfswAAAMc"]
[Mon Mar 09 13:31:16.521859 2026] [:error] [pid 5783:tid 5894] [client 43.157.172.39:42052] [client 43.157.172.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aa5bJAdiZJ1FQPtsTNRrbwAAAEA"]
[Mon Mar 09 23:18:11.686005 2026] [:error] [pid 5779:tid 5860] [client 43.130.9.111:47240] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aa7kswaHbHwtklaurgVe_wAAAAU"]
[Tue Mar 10 05:23:22.432563 2026] [:error] [pid 7904:tid 8013] [client 62.60.131.218:58708] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa86StqdH-GCmASfJqHe3wAAABU"]
[Tue Mar 10 05:40:49.341846 2026] [:error] [pid 7904:tid 7997] [client 62.60.131.218:51126] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa8-YdqdH-GCmASfJqHgUgAAAAU"]
[Tue Mar 10 06:11:37.332250 2026] [:error] [pid 7912:tid 8086] [client 104.28.159.135:24913] [client 104.28.159.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aa9FmSV7wJYuQ3GZEAV6KAAAAJY"]
[Tue Mar 10 06:15:07.632814 2026] [:error] [pid 50817:tid 50844] [client 93.123.109.124:57490] [client 93.123.109.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/favicon.ico"] [unique_id "aa9Ga2luG8ANLCjMDY_0AAAAAVM"]
[Tue Mar 10 09:48:06.029699 2026] [:error] [pid 31977:tid 32128] [client 119.28.140.106:58862] [client 119.28.140.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aa94Vi_lkX6-Mo89SmEUrwAAAFc"]
[Tue Mar 10 11:26:35.360099 2026] [:error] [pid 42666:tid 42683] [client 182.44.67.97:39024] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aa-Pa40d5emjo-Hs705RiwAAAQ8"]
[Tue Mar 10 12:57:17.903496 2026] [:error] [pid 42730:tid 42747] [client 62.60.131.218:50892] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa-krchla5zfkJ-81FBrQwAAAc8"]
[Tue Mar 10 17:03:03.257736 2026] [:error] [pid 21318:tid 21374] [client 43.133.66.51:50356] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa_eRxTTkPqKydpYiIKIVgAAAIA"]
[Tue Mar 10 17:08:45.131182 2026] [:error] [pid 21400:tid 21410] [client 139.59.32.166:56707] [client 139.59.32.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "aa_fnTCFYMzi4orNuEHmYQAAAMg"], referer: binance.com
[Tue Mar 10 17:08:57.717857 2026] [:error] [pid 63829:tid 63845] [client 139.59.32.166:59386] [client 139.59.32.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "aa_fqSf36W4aDbSUXc0BWwAAAQ4"], referer: binance.com
[Tue Mar 10 17:58:03.428908 2026] [:error] [pid 51262:tid 51337] [client 36.111.67.189:34085] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aa_rK1BYhPgYWqLCS4dFxgAAAEw"]
2026/03/10 19:38:39 [error] 14438#14438: *72569 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 35.95.103.199, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "www.rejuva.au"
2026/03/10 21:12:33 [error] 3846#3846: *142014 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 66.249.69.39, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/10 21:12:34 [error] 3823#3823: *142025 openat() "/usr/local/apache/htdocs/suspended-page/favicon.ico" failed (2: No such file or directory), client: 66.249.69.39, server: rejuva.au, request: "GET /favicon.ico HTTP/1.1", host: "rejuva.au"
2026/03/10 22:09:54 [error] 3846#3846: *184295 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 34.223.90.158, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/10 22:19:16 [error] 3823#3823: *191572 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 66.249.69.37, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/11 00:24:14 [error] 6417#6417: *280416 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 74.7.230.37, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "www.rejuva.au"
2026/03/11 02:07:25 [error] 6415#6415: *354584 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 51.68.111.218, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/11 05:52:26 [error] 3470#3470: *510473 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/v3/payment_gateways" failed (2: No such file or directory), client: 79.127.155.174, server: rejuva.au, request: "GET /wp-json/wc/v3/payment_gateways HTTP/1.1", host: "rejuva.au"
2026/03/11 05:52:26 [error] 3467#3467: *510479 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/v2/payment_gateways" failed (2: No such file or directory), client: 79.127.155.174, server: rejuva.au, request: "GET /wp-json/wc/v2/payment_gateways HTTP/1.1", host: "rejuva.au"
2026/03/11 05:52:27 [error] 3469#3469: *510487 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/store/v1/cart" failed (2: No such file or directory), client: 79.127.155.174, server: rejuva.au, request: "GET /wp-json/wc/store/v1/cart HTTP/1.1", host: "rejuva.au"
2026/03/11 05:52:28 [error] 3466#3466: *510494 openat() "/usr/local/apache/htdocs/suspended-page/wp-json/wc/store/v1/payment_methods" failed (2: No such file or directory), client: 79.127.155.174, server: rejuva.au, request: "GET /wp-json/wc/store/v1/payment_methods HTTP/1.1", host: "rejuva.au"
2026/03/11 06:32:08 [error] 3461#3461: *532556 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 74.7.175.147, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/11 07:48:36 [error] 3470#3470: *581601 openat() "/usr/local/apache/htdocs/suspended-page/wp-login.php" failed (2: No such file or directory), client: 209.87.169.110, server: rejuva.au, request: "GET /wp-login.php HTTP/1.1", host: "rejuva.au"
2026/03/11 16:19:56 [error] 53948#53948: *886988 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 51.68.111.215, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:47 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-content/plugins/hellopress/wp_filemanager.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-content/plugins/hellopress/wp_filemanager.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:47 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/nw.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /nw.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:47 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws81.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws81.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:47 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/vx.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /vx.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:48 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/public/wp-blog.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /public/wp-blog.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:48 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/s.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /s.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:48 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/bolt.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /bolt.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:48 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp5.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp5.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:49 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/inputs.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /inputs.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:49 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/155.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /155.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:49 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws80.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws80.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:49 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/t.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /t.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:49 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/bgymj.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /bgymj.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:50 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ms.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ms.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:50 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ms-edit.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ms-edit.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:50 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws49.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws49.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:50 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ioxi-o.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ioxi-o.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:51 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/hots.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /hots.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:51 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/666.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /666.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:51 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/hplfuns.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /hplfuns.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:51 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wen.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wen.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:52 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/gifclass.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /gifclass.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:52 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ccs.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ccs.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:52 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/a4.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /a4.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:52 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/bnm.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /bnm.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:52 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/sid3.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /sid3.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:53 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/tool.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /tool.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:53 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/222.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /222.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:53 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws77.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws77.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:53 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/edit.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /edit.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:54 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-the.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-the.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:54 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-blog.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-blog.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:54 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-act.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-act.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:55 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/1.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /1.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:55 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/tfm.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /tfm.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:55 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/file.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /file.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:56 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/tfm.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET //tfm.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:56 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/abc.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /abc.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:56 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/gettest.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /gettest.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:56 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/amp.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /amp.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:57 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/kj.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /kj.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:57 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/xxw.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /xxw.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:57 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/term.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /term.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:57 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws60.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws60.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:58 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/gfd.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /gfd.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:58 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/admin-footer.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /admin-footer.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:58 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/166.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /166.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:58 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/jga.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /jga.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:59 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-p2r3q9c8k4.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:59 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-admin/css/bolt.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-admin/css/bolt.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:59 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/myfile.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /myfile.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:59 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/sa.php7" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /sa.php7 HTTP/1.1", host: "rejuva.au"
2026/03/11 17:54:59 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws75.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws75.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:00 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-access.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-access.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:00 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/init.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /init.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:00 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/public/ws49.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /public/ws49.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:00 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/66.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /66.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:01 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/b.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /b.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:01 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp9.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp9.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:01 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/grsiuk.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /grsiuk.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:01 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-content/radio.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-content/radio.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:01 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/motu.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /motu.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:02 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/fs.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /fs.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:02 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ajax.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ajax.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:02 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/tx78.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /tx78.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:02 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/jp.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /jp.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:03 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-blogs.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-blogs.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:03 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/edit-tags.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /edit-tags.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:03 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-png.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-png.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:03 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wpc2.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wpc2.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:03 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/intall.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /intall.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:04 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/cu.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /cu.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:04 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/callback.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /callback.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:04 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/byypas.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /byypas.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:04 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/abrand.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /abrand.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:04 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/camara.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /camara.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:05 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/assacc.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /assacc.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:05 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws83.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws83.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:05 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-good.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-good.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:05 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/の.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /%E3%81%AE.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:06 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/xtsr.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /xtsr.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:06 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/zz8.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /zz8.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:06 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/mh.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /mh.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:07 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/a5.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /a5.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:07 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ai.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ai.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:07 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/amwxl.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /amwxl.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:07 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/awdld.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /awdld.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:07 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/bkyac.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /bkyac.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:08 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/krntz.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /krntz.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:08 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/vhwwnrnmqc.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /vhwwnrnmqc.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:08 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/xenium4.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /xenium4.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:08 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/vaza.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /vaza.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:09 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/8573.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /8573.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:09 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/rip.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /rip.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:09 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/drhunthq.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /drhunthq.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:09 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/sbhu.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /sbhu.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:10 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/inege.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /inege.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:10 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/ws84.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /ws84.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:10 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/c4.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /c4.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:10 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/lclnqiii.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /lclnqiii.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:10 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/goat.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /goat.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:11 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-tot.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-tot.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:11 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/wp-tap.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /wp-tap.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:12 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/vrhiw.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /vrhiw.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:12 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/qqjki.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /qqjki.php HTTP/1.1", host: "rejuva.au"
2026/03/11 17:55:12 [error] 53948#53948: *959455 openat() "/usr/local/apache/htdocs/suspended-page/koiy.php" failed (2: No such file or directory), client: 20.110.201.154, server: rejuva.au, request: "GET /koiy.php HTTP/1.1", host: "rejuva.au"
2026/03/11 20:48:24 [error] 53947#53947: *1089219 "/usr/local/apache/htdocs/suspended-page/wp-admin/css/index.html" is not found (2: No such file or directory), client: 20.2.141.62, server: rejuva.au, request: "GET /wp-admin/css/ HTTP/1.1", host: "rejuva.au", referrer: "binance.com"
2026/03/11 20:48:26 [error] 53944#53944: *1089246 "/usr/local/apache/htdocs/suspended-page/.well-known/index.html" is not found (2: No such file or directory), client: 20.2.141.62, server: rejuva.au, request: "GET /.well-known/ HTTP/1.1", host: "rejuva.au", referrer: "binance.com"
2026/03/11 20:48:30 [error] 53948#53948: *1089312 "/usr/local/apache/htdocs/suspended-page/sites/default/files/index.html" is not found (2: No such file or directory), client: 20.2.141.62, server: rejuva.au, request: "GET /sites/default/files/ HTTP/1.1", host: "rejuva.au", referrer: "binance.com"
2026/03/11 20:48:34 [error] 53948#53948: *1089368 "/usr/local/apache/htdocs/suspended-page/admin/controller/extension/extension/index.html" is not found (2: No such file or directory), client: 20.2.141.62, server: rejuva.au, request: "GET /admin/controller/extension/extension/ HTTP/1.1", host: "rejuva.au", referrer: "binance.com"
2026/03/11 20:48:38 [error] 53944#53944: *1089422 "/usr/local/apache/htdocs/suspended-page/uploads/index.html" is not found (2: No such file or directory), client: 20.2.141.62, server: rejuva.au, request: "GET /uploads/ HTTP/1.1", host: "rejuva.au", referrer: "binance.com"
2026/03/11 20:48:40 [error] 53947#53947: *1089448 "/usr/local/apache/htdocs/suspended-page/images/index.html" is not found (2: No such file or directory), client: 20.2.141.62, server: rejuva.au, request: "GET /images/ HTTP/1.1", host: "rejuva.au", referrer: "binance.com"
2026/03/11 20:48:43 [error] 53948#53948: *1089477 "/usr/local/apache/htdocs/suspended-page/files/index.html" is not found (2: No such file or directory), client: 20.2.141.62, server: rejuva.au, request: "GET /files/ HTTP/1.1", host: "rejuva.au", referrer: "binance.com"
2026/03/12 01:10:26 [error] 53451#53451: *1276967 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 185.12.250.58, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/12 03:48:30 [error] 58918#58918: *1377186 openat() "/usr/local/apache/htdocs/suspended-page/favicon.ico" failed (2: No such file or directory), client: 178.62.89.72, server: rejuva.au, request: "GET /favicon.ico HTTP/1.1", host: "rejuva.au", referrer: "http://rejuva.au/"
2026/03/12 03:48:37 [error] 58920#58920: *1377257 openat() "/usr/local/apache/htdocs/suspended-page/favicon.ico" failed (2: No such file or directory), client: 178.62.89.72, server: rejuva.au, request: "GET /favicon.ico HTTP/1.1", host: "rejuva.au", referrer: "https://rejuva.au/"
2026/03/12 06:09:08 [error] 58915#58915: *1439968 openat() "/usr/local/apache/htdocs/suspended-page/robots.txt" failed (2: No such file or directory), client: 66.249.69.36, server: rejuva.au, request: "GET /robots.txt HTTP/1.1", host: "rejuva.au"
2026/03/12 06:09:08 [error] 58915#58915: *1439968 openat() "/usr/local/apache/htdocs/suspended-page/gambling/Slot ตารางราคาพูลเสมอ.html" failed (2: No such file or directory), client: 66.249.69.36, server: rejuva.au, request: "GET /gambling/Slot%20%E0%B8%95%E0%B8%B2%E0%B8%A3%E0%B8%B2%E0%B8%87%E0%B8%A3%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%9E%E0%B8%B9%E0%B8%A5%E0%B9%80%E0%B8%AA%E0%B8%A1%E0%B8%AD.html HTTP/1.1", host: "rejuva.au"
[Thu Mar 12 17:03:38.428124 2026] [:error] [pid 22063:tid 22066] [client 95.154.200.55:42744] [client 95.154.200.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "abKBaq0RUhS-MJyHWLQE5AAAAgE"]
[Thu Mar 12 17:03:39.414146 2026] [:error] [pid 51455:tid 51474] [client 95.154.200.55:42748] [client 95.154.200.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "abKBa5E0YyNxdg6PL_AMvQAAAA4"]
[Thu Mar 12 17:03:40.386155 2026] [:error] [pid 11986:tid 12018] [client 95.154.200.55:42756] [client 95.154.200.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/tools.js"] [unique_id "abKBbDKqY2w-DVCrxTDhgAAAAcA"]
[Thu Mar 12 17:03:41.358601 2026] [:error] [pid 51455:tid 51484] [client 95.154.200.55:42762] [client 95.154.200.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/translate_inline.js"] [unique_id "abKBbZE0YyNxdg6PL_AMwAAAABg"]
[Thu Mar 12 17:03:42.342818 2026] [:error] [pid 51455:tid 51477] [client 95.154.200.55:42778] [client 95.154.200.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skin/adminhtml/default/default/boxes.css"] [unique_id "abKBbpE0YyNxdg6PL_AMxAAAABE"]
[Thu Mar 12 17:03:43.328747 2026] [:error] [pid 51455:tid 51478] [client 95.154.200.55:33642] [client 95.154.200.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/prototype/validation.js"] [unique_id "abKBb5E0YyNxdg6PL_AMyQAAABI"]
[Thu Mar 12 17:03:44.873144 2026] [:error] [pid 11986:tid 12031] [client 95.154.200.55:33658] [client 95.154.200.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RELEASE_NOTES.txt"] [unique_id "abKBcDKqY2w-DVCrxTDhgQAAAc0"]
[Thu Mar 12 18:25:35.758263 2026] [:error] [pid 11985:tid 12002] [client 103.65.236.149:53798] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "abKUn3cAcNujsOssVDcVBwAAAYs"]
[Thu Mar 12 18:25:35.978495 2026] [:error] [pid 51455:tid 51472] [client 103.65.236.149:53814] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "abKUn5E0YyNxdg6PL_AvUQAAAAw"]
[Thu Mar 12 20:08:57.270562 2026] [:error] [pid 20531:tid 20626] [client 43.166.131.228:54880] [client 43.166.131.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abKs2fvw-RvNQd9b3a-sIgAAA8o"]
[Thu Mar 12 21:21:11.001608 2026] [:error] [pid 11953:tid 11966] [client 49.234.192.248:56096] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abK9xpudzqsnq3bvtDZLEQAAAUs"]
[Fri Mar 13 01:29:36.655956 2026] [:error] [pid 56003:tid 56024] [client 43.153.85.46:59562] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abL4ABQtM0oeMdFWe6VmVQAAANM"]
[Fri Mar 13 04:15:08.869253 2026] [:error] [pid 62036:tid 62067] [client 43.154.140.188:33344] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abMezLce6g9kILuh_R68CgAAANg"]
[Fri Mar 13 07:44:46.005663 2026] [:error] [pid 55077:tid 55087] [client 101.32.15.141:53992] [client 101.32.15.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abNP7t9Ul5ym4M-PlQIWFQAAAUg"]
[Fri Mar 13 09:50:28.597164 2026] [:error] [pid 55077:tid 55102] [client 45.131.195.241:34845] [client 45.131.195.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.241, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abNtZN9Ul5ym4M-PlQJV9wAAAVc"]
[Fri Mar 13 09:50:28.602955 2026] [:error] [pid 55077:tid 55102] [client 45.131.195.241:34845] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 13 10:18:04.032441 2026] [:error] [pid 62036:tid 62067] [client 43.159.141.150:56314] [client 43.159.141.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abNz3Lce6g9kILuh_R5RvAAAANg"]
[Fri Mar 13 13:30:29.403776 2026] [:error] [pid 9309:tid 9336] [client 43.131.32.36:51154] [client 43.131.32.36] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abOg9ao1KEMMghNWAN-rtgAAAg0"]
[Fri Mar 13 17:58:39.620661 2026] [:error] [pid 61928:tid 61986] [client 185.167.96.92:61526] [client 185.167.96.92] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "abPfzwod66AHekJJZiqUwgAAAEk"]
[Fri Mar 13 20:28:46.046941 2026] [:error] [pid 61927:tid 61963] [client 104.28.166.127:26513] [client 104.28.166.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "abQC_rLkK584eBa2J7UEmwAAABE"]
[Fri Mar 13 21:01:46.672545 2026] [:error] [pid 9111:tid 9132] [client 43.165.70.220:46012] [client 43.165.70.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abQKuk-M156SLpD2BrtS3AAAAYY"]
[Fri Mar 13 22:54:08.240698 2026] [:error] [pid 60497:tid 60554] [client 182.42.111.213:37947] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abQlEBjNYgapWlkb4ljJLgAAA5Y"]
[Sat Mar 14 04:21:32.844223 2026] [:error] [pid 3913:tid 3975] [client 43.163.206.70:43638] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abRxzB9qvQd4GQHUp6_u0AAAAFI"]
[Sat Mar 14 05:05:07.024992 2026] [:error] [pid 3913:tid 3981] [client 185.241.208.62:65280] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/speculative8.php"] [unique_id "abR8Ax9qvQd4GQHUp6_4aQAAAFg"]
[Sat Mar 14 05:05:07.578065 2026] [:error] [pid 3914:tid 3985] [client 185.241.208.62:50609] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abR8A_H_HeUqa_sn9-ACyAAAAIE"]
[Sat Mar 14 05:05:08.736097 2026] [:error] [pid 4018:tid 4046] [client 185.241.208.62:62672] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Mar 14 05:05:09.288191 2026] [:error] [pid 3912:tid 3951] [client 185.241.208.62:60283] File does not exist: /usr/local/apache/htdocs/suspended-page/file17.php
[Sat Mar 14 05:05:09.929205 2026] [:error] [pid 35801:tid 35824] [client 185.241.208.62:51247] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sat Mar 14 05:05:10.565356 2026] [:error] [pid 35801:tid 35804] [client 185.241.208.62:54056] File does not exist: /usr/local/apache/htdocs/suspended-page/file88.php
[Sat Mar 14 05:05:11.114299 2026] [:error] [pid 3914:tid 4008] [client 185.241.208.62:57439] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sat Mar 14 05:05:11.705828 2026] [:error] [pid 4018:tid 4042] [client 185.241.208.62:56069] File does not exist: /usr/local/apache/htdocs/suspended-page/bu4.php
[Sat Mar 14 05:05:12.249839 2026] [:error] [pid 3914:tid 3990] [client 185.241.208.62:49283] File does not exist: /usr/local/apache/htdocs/suspended-page/bu5.php
[Sat Mar 14 05:05:12.806904 2026] [:error] [pid 4018:tid 4035] [client 185.241.208.62:52881] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Sat Mar 14 05:05:13.978826 2026] [:error] [pid 35801:tid 35811] [client 185.241.208.62:55654] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-excerpt/index.php"] [unique_id "abR8CW8tVFelXGsqbU-eNgAAAQc"]
[Sat Mar 14 05:05:15.199621 2026] [:error] [pid 35801:tid 35805] [client 185.241.208.62:50262] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "abR8C28tVFelXGsqbU-ePAAAAQE"]
[Sat Mar 14 05:05:15.834030 2026] [:error] [pid 3914:tid 3989] [client 185.241.208.62:52337] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "abR8C_H_HeUqa_sn9-AC0QAAAIU"]
[Sat Mar 14 05:05:16.377526 2026] [:error] [pid 4018:tid 4040] [client 185.241.208.62:56557] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/index.php"] [unique_id "abR8DAEk1fxdMMkDDaLMlgAAAM8"]
[Sat Mar 14 05:05:17.037584 2026] [:error] [pid 3914:tid 4000] [client 185.241.208.62:51466] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/zwso.php"] [unique_id "abR8DfH_HeUqa_sn9-AC1QAAAJA"]
[Sat Mar 14 05:05:17.589052 2026] [:error] [pid 4018:tid 4045] [client 185.241.208.62:61818] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "abR8DQEk1fxdMMkDDaLMmQAAANQ"]
[Sat Mar 14 05:05:18.168161 2026] [:error] [pid 4018:tid 4025] [client 185.241.208.62:56111] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "abR8DgEk1fxdMMkDDaLMmwAAAMA"]
[Sat Mar 14 05:05:18.746218 2026] [:error] [pid 4018:tid 4036] [client 185.241.208.62:54148] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/index.php"] [unique_id "abR8DgEk1fxdMMkDDaLMngAAAMs"]
[Sat Mar 14 05:05:19.842664 2026] [:error] [pid 3914:tid 3995] [client 185.241.208.62:61745] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/speculative8.php"] [unique_id "abR8D_H_HeUqa_sn9-AC2AAAAIs"]
[Sat Mar 14 05:05:20.924131 2026] [:error] [pid 3913:tid 3970] [client 185.241.208.62:56064] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abR8EB9qvQd4GQHUp6_4dQAAAE0"]
[Sat Mar 14 05:05:22.004102 2026] [:error] [pid 4018:tid 4030] [client 185.241.208.62:64531] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/nav.php"] [unique_id "abR8EgEk1fxdMMkDDaLMogAAAMU"]
[Sat Mar 14 05:05:23.067106 2026] [:error] [pid 35801:tid 35806] [client 185.241.208.62:50721] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "abR8E28tVFelXGsqbU-eRAAAAQI"]
[Sat Mar 14 05:05:24.141466 2026] [:error] [pid 35801:tid 35815] [client 185.241.208.62:50114] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file17.php"] [unique_id "abR8FG8tVFelXGsqbU-eRwAAAQs"]
[Sat Mar 14 05:05:25.226457 2026] [:error] [pid 3913:tid 3973] [client 185.241.208.62:59728] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "abR8FR9qvQd4GQHUp6_4ewAAAFA"]
[Sat Mar 14 05:05:26.338747 2026] [:error] [pid 35801:tid 35822] [client 185.241.208.62:60166] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file88.php"] [unique_id "abR8Fm8tVFelXGsqbU-eTQAAARI"]
[Sat Mar 14 05:05:27.441338 2026] [:error] [pid 3912:tid 3934] [client 185.241.208.62:59068] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/NewFile.php"] [unique_id "abR8F8XFZBK-jpdCvTHC4AAAAAc"]
[Sat Mar 14 05:05:28.540294 2026] [:error] [pid 3913:tid 3959] [client 185.241.208.62:63035] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bu4.php"] [unique_id "abR8GB9qvQd4GQHUp6_4fwAAAEI"]
[Sat Mar 14 05:05:29.616886 2026] [:error] [pid 3913:tid 3961] [client 185.241.208.62:49400] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bu5.php"] [unique_id "abR8GR9qvQd4GQHUp6_4gAAAAEQ"]
[Sat Mar 14 05:05:30.758400 2026] [:error] [pid 35801:tid 35804] [client 185.241.208.62:64565] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blurbs.php"] [unique_id "abR8Gm8tVFelXGsqbU-eVwAAAQA"]
[Sat Mar 14 05:05:31.822804 2026] [:error] [pid 35801:tid 35810] [client 185.241.208.62:60867] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-excerpt/alfa-rex.PHP"] [unique_id "abR8G28tVFelXGsqbU-eXAAAAQY"]
[Sat Mar 14 05:05:32.899304 2026] [:error] [pid 35801:tid 35815] [client 185.241.208.62:56539] [client 185.241.208.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-excerpt/index.php"] [unique_id "abR8HG8tVFelXGsqbU-eYgAAAQs"]
[Sat Mar 14 05:05:33.985486 2026] [:error] [pid 35801:tid 35825] [client 185.241.208.62:60686] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "abR8HW8tVFelXGsqbU-eZwAAARU"]
[Sat Mar 14 05:05:35.093232 2026] [:error] [pid 3912:tid 3947] [client 185.241.208.62:53164] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "abR8H8XFZBK-jpdCvTHC5AAAABQ"]
[Sat Mar 14 05:05:36.180067 2026] [:error] [pid 4018:tid 4048] [client 185.241.208.62:56446] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "abR8IAEk1fxdMMkDDaLMsQAAANc"]
[Sat Mar 14 05:05:37.242977 2026] [:error] [pid 3914:tid 4008] [client 185.241.208.62:50307] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/index.php"] [unique_id "abR8IfH_HeUqa_sn9-AC4AAAAJg"]
[Sat Mar 14 05:05:38.332057 2026] [:error] [pid 3913:tid 3960] [client 185.241.208.62:56512] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/zwso.php"] [unique_id "abR8Ih9qvQd4GQHUp6_4hAAAAEM"]
[Sat Mar 14 05:05:39.424302 2026] [:error] [pid 3914:tid 3990] [client 185.241.208.62:60152] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "abR8I_H_HeUqa_sn9-AC4QAAAIY"]
[Sat Mar 14 05:05:40.483083 2026] [:error] [pid 3914:tid 3995] [client 185.241.208.62:56186] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "abR8JPH_HeUqa_sn9-AC4gAAAIs"]
[Sat Mar 14 05:05:41.619221 2026] [:error] [pid 35801:tid 35825] [client 185.241.208.62:61761] [client 185.241.208.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/index.php"] [unique_id "abR8JW8tVFelXGsqbU-ebwAAARU"]
[Sat Mar 14 05:34:22.394065 2026] [:error] [pid 3914:tid 4000] [client 36.41.75.167:44870] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abSC3vH_HeUqa_sn9-AJSQAAAJA"]
[Sat Mar 14 06:48:45.479111 2026] [:error] [pid 57226:tid 57253] [client 68.221.131.20:37081] [client 68.221.131.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abSUTWxFlXQvNewjeI8zFAAAAVc"]
[Sat Mar 14 06:48:47.204054 2026] [:error] [pid 3914:tid 4008] [client 68.221.131.20:37110] [client 68.221.131.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abSUT_H_HeUqa_sn9-AUPgAAAJg"]
[Sat Mar 14 06:48:48.821285 2026] [:error] [pid 3912:tid 3944] [client 68.221.131.20:37094] [client 68.221.131.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abSUUMXFZBK-jpdCvTHQSwAAABE"]
[Sat Mar 14 06:48:51.011527 2026] [:error] [pid 4018:tid 4046] [client 68.221.131.20:33598] [client 68.221.131.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "abSUUwEk1fxdMMkDDaLhUwAAANU"]
[Sat Mar 14 07:57:53.515122 2026] [:error] [pid 35801:tid 35827] [client 185.137.164.21:27363] [client 185.137.164.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/HEAD"] [unique_id "abSkgW8tVFelXGsqbU_MUwAAARc"]
[Sat Mar 14 12:55:07.239091 2026] [:error] [pid 13360:tid 13365] [client 43.156.204.134:46912] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abTqK_oSWtMry3M5X6vx0gAAAoE"]
[Sat Mar 14 18:54:46.487679 2026] [:error] [pid 58680:tid 58685] [client 101.32.52.164:46790] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abU-dpesvz6ml-XzsmUxigAAAUM"]
[Sun Mar 15 07:46:29.125760 2026] [:error] [pid 38540:tid 38600] [client 182.42.104.32:45822] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abXzVV8bnHsJ1dE90bL9KQAAAE4"]
[Sun Mar 15 10:42:30.963648 2026] [:error] [pid 38540:tid 38606] [client 212.30.33.74:60917] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Mar 15 10:42:31.374797 2026] [:error] [pid 38540:tid 38591] [client 212.30.33.74:60917] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 15 10:42:31.779341 2026] [:error] [pid 38540:tid 38600] [client 212.30.33.74:60917] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "abYcl18bnHsJ1dE90bIb5AAAAE4"]
[Sun Mar 15 10:42:32.589724 2026] [:error] [pid 38541:tid 38629] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 15 10:42:32.991659 2026] [:error] [pid 38541:tid 38627] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sun Mar 15 10:42:33.398896 2026] [:error] [pid 38541:tid 38626] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 15 10:42:33.802936 2026] [:error] [pid 38541:tid 38621] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sun Mar 15 10:42:34.206355 2026] [:error] [pid 38541:tid 38614] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 15 10:42:34.609465 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun Mar 15 10:42:35.027204 2026] [:error] [pid 38541:tid 38636] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Mar 15 10:42:35.430767 2026] [:error] [pid 38541:tid 38635] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Sun Mar 15 10:42:35.831393 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Sun Mar 15 10:42:36.233948 2026] [:error] [pid 38541:tid 38635] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Mar 15 10:42:36.643249 2026] [:error] [pid 38541:tid 38632] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sun Mar 15 10:42:37.063058 2026] [:error] [pid 38541:tid 38625] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Sun Mar 15 10:42:37.527862 2026] [:error] [pid 38541:tid 38623] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Mar 15 10:42:37.932043 2026] [:error] [pid 38541:tid 38630] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 15 10:42:38.338628 2026] [:error] [pid 38541:tid 38628] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Sun Mar 15 10:42:38.744320 2026] [:error] [pid 38541:tid 38621] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sun Mar 15 10:42:39.156324 2026] [:error] [pid 38541:tid 38623] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun Mar 15 10:42:39.563017 2026] [:error] [pid 38541:tid 38616] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Mar 15 10:42:39.965482 2026] [:error] [pid 38541:tid 38617] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/warm.PhP
[Sun Mar 15 10:42:40.368283 2026] [:error] [pid 38541:tid 38636] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Sun Mar 15 10:42:40.771764 2026] [:error] [pid 38541:tid 38626] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Sun Mar 15 10:42:41.174249 2026] [:error] [pid 38541:tid 38621] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Sun Mar 15 10:42:41.581162 2026] [:error] [pid 38541:tid 38619] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Sun Mar 15 10:42:41.989002 2026] [:error] [pid 38541:tid 38618] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Sun Mar 15 10:42:42.391655 2026] [:error] [pid 38541:tid 38622] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Mar 15 10:42:42.791263 2026] [:error] [pid 38541:tid 38627] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sun Mar 15 10:42:43.199211 2026] [:error] [pid 38541:tid 38613] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Mar 15 10:42:43.603470 2026] [:error] [pid 38541:tid 38621] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Sun Mar 15 10:42:44.004157 2026] [:error] [pid 38541:tid 38631] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Mar 15 10:42:44.406734 2026] [:error] [pid 38541:tid 38630] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sun Mar 15 10:42:44.809826 2026] [:error] [pid 38541:tid 38614] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Mar 15 10:42:45.217800 2026] [:error] [pid 38541:tid 38621] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Sun Mar 15 10:42:45.626712 2026] [:error] [pid 38541:tid 38620] [client 212.30.33.213:55365] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Mar 15 10:42:46.047712 2026] [:error] [pid 38541:tid 38627] [client 212.30.33.213:55365] [client 212.30.33.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "abYcpnuOpex8jIO0jt4ytwAAAI4"]
[Sun Mar 15 10:42:46.857877 2026] [:error] [pid 38540:tid 38600] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Sun Mar 15 10:42:47.263744 2026] [:error] [pid 38540:tid 38610] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Sun Mar 15 10:42:47.668706 2026] [:error] [pid 38540:tid 38596] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Sun Mar 15 10:42:48.078715 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Sun Mar 15 10:42:48.488503 2026] [:error] [pid 38540:tid 38590] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Sun Mar 15 10:42:48.894518 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Mar 15 10:42:49.298960 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Sun Mar 15 10:42:49.700490 2026] [:error] [pid 38540:tid 38591] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Sun Mar 15 10:42:50.108051 2026] [:error] [pid 38540:tid 38600] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 15 10:42:50.514272 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Sun Mar 15 10:42:50.915940 2026] [:error] [pid 38540:tid 38603] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 15 10:42:51.322472 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Sun Mar 15 10:42:51.729244 2026] [:error] [pid 38540:tid 38603] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Sun Mar 15 10:42:52.134540 2026] [:error] [pid 38540:tid 38598] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Sun Mar 15 10:42:52.539051 2026] [:error] [pid 38540:tid 38603] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun Mar 15 10:42:52.943859 2026] [:error] [pid 38540:tid 38598] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/exit.php
[Sun Mar 15 10:42:53.356804 2026] [:error] [pid 38540:tid 38591] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Sun Mar 15 10:42:53.763458 2026] [:error] [pid 38540:tid 38593] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun Mar 15 10:42:54.165051 2026] [:error] [pid 38540:tid 38591] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Sun Mar 15 10:42:54.575233 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Mar 15 10:42:54.994481 2026] [:error] [pid 38540:tid 38597] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Sun Mar 15 10:42:55.803050 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Sun Mar 15 10:42:56.207078 2026] [:error] [pid 38540:tid 38593] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Sun Mar 15 10:42:56.608924 2026] [:error] [pid 38540:tid 38607] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Sun Mar 15 10:42:57.019741 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Sun Mar 15 10:42:57.433616 2026] [:error] [pid 38540:tid 38596] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Sun Mar 15 10:42:57.838699 2026] [:error] [pid 38540:tid 38609] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Sun Mar 15 10:42:58.250018 2026] [:error] [pid 38540:tid 38593] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Sun Mar 15 10:42:59.084291 2026] [:error] [pid 38540:tid 38591] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Mar 15 10:42:59.893915 2026] [:error] [pid 38540:tid 38597] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Sun Mar 15 10:43:00.311335 2026] [:error] [pid 38540:tid 38599] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Sun Mar 15 10:43:00.816189 2026] [:error] [pid 38540:tid 38591] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Mar 15 10:43:01.231760 2026] [:error] [pid 38540:tid 38586] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Sun Mar 15 10:43:01.641982 2026] [:error] [pid 38540:tid 38610] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Sun Mar 15 10:43:02.049487 2026] [:error] [pid 38540:tid 38599] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Sun Mar 15 10:43:02.456971 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Sun Mar 15 10:43:02.876250 2026] [:error] [pid 38540:tid 38596] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Sun Mar 15 10:43:03.279976 2026] [:error] [pid 38540:tid 38587] [client 212.30.33.190:39661] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Mar 15 10:43:03.685513 2026] [:error] [pid 38540:tid 38586] [client 212.30.33.190:39661] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "abYct18bnHsJ1dE90bIdFgAAAEA"]
[Sun Mar 15 10:43:04.498829 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Sun Mar 15 10:43:04.909174 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Sun Mar 15 10:43:05.319889 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Sun Mar 15 10:43:05.727797 2026] [:error] [pid 50986:tid 51002] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun Mar 15 10:43:06.142366 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Mar 15 10:43:06.547283 2026] [:error] [pid 50986:tid 51010] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Sun Mar 15 10:43:06.952588 2026] [:error] [pid 50986:tid 51005] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Sun Mar 15 10:43:07.357004 2026] [:error] [pid 50986:tid 51009] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Sun Mar 15 10:43:08.177677 2026] [:error] [pid 50986:tid 51001] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Sun Mar 15 10:43:09.003129 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Sun Mar 15 10:43:09.406767 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun Mar 15 10:43:09.820966 2026] [:error] [pid 50986:tid 51002] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Sun Mar 15 10:43:10.224756 2026] [:error] [pid 50986:tid 50992] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Mar 15 10:43:10.628051 2026] [:error] [pid 50986:tid 50991] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Sun Mar 15 10:43:11.034178 2026] [:error] [pid 50986:tid 50993] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Mar 15 10:43:11.439371 2026] [:error] [pid 50986:tid 51009] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Sun Mar 15 10:43:11.850846 2026] [:error] [pid 50986:tid 50996] [client 212.30.33.103:41691] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Sun Mar 15 10:43:12.689660 2026] [:error] [pid 50986:tid 50996] [client 212.30.33.103:41691] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "abYcwCknK4c779bcQqHkOgAAAUc"]
[Sun Mar 15 10:43:13.519578 2026] [:error] [pid 38541:tid 38619] [client 212.30.33.96:20243] [client 212.30.33.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "abYcwXuOpex8jIO0jt4zxwAAAIY"]
[Sun Mar 15 10:43:16.817869 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.54:36221] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "abYcxPpTEqkVJ0rBEWvFewAAAA4"]
[Sun Mar 15 10:43:18.037647 2026] [:error] [pid 42570:tid 42582] [client 212.30.33.51:37151] [client 212.30.33.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "abYcxsIUXZJLmk_gYCOX1wAAAYk"]
[Sun Mar 15 10:43:19.642384 2026] [:error] [pid 42570:tid 42588] [client 212.30.33.88:39117] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "abYcx8IUXZJLmk_gYCOX6gAAAY8"]
[Sun Mar 15 10:43:22.913762 2026] [:error] [pid 38645:tid 38667] [client 212.30.33.101:32135] [client 212.30.33.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "abYcyhFPHtsDUuVrWDasNwAAANQ"]
[Sun Mar 15 10:43:24.540438 2026] [:error] [pid 38541:tid 38619] [client 212.30.33.76:41061] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Sun Mar 15 10:43:24.944288 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.76:41061] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "abYczHuOpex8jIO0jt40ZgAAAJU"]
[Sun Mar 15 10:43:26.179610 2026] [:error] [pid 38645:tid 38671] [client 212.30.33.79:57247] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "abYczhFPHtsDUuVrWDasSAAAANg"]
[Sun Mar 15 10:43:27.842908 2026] [:error] [pid 50986:tid 51007] [client 212.30.33.79:48805] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "abYczyknK4c779bcQqHlBwAAAVI"]
[Sun Mar 15 10:43:29.499182 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.190:63781] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "abYc0SknK4c779bcQqHlPAAAAVY"]
[Sun Mar 15 10:43:30.311139 2026] [:error] [pid 50986:tid 50994] [client 212.30.33.98:63083] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "abYc0iknK4c779bcQqHlVAAAAUY"]
[Sun Mar 15 10:43:31.576399 2026] [:error] [pid 42570:tid 42584] [client 212.30.33.80:38813] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "abYc08IUXZJLmk_gYCOYmQAAAYs"]
[Sun Mar 15 10:43:33.199472 2026] [:error] [pid 9995:tid 10008] [client 212.30.33.228:42615] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "abYc1Qa8xkcaSmgTbwgw9QAAAQo"]
[Sun Mar 15 10:43:34.010804 2026] [:error] [pid 38536:tid 38553] [client 212.30.33.67:35939] [client 212.30.33.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "abYc1vpTEqkVJ0rBEWvFvAAAAAA"]
[Sun Mar 15 10:43:34.834464 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.82:61583] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "abYc1vpTEqkVJ0rBEWvFwgAAAAw"]
[Sun Mar 15 10:43:36.494618 2026] [:error] [pid 38645:tid 38669] [client 212.30.33.93:26191] [client 212.30.33.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "abYc2BFPHtsDUuVrWDasuQAAANY"]
[Sun Mar 15 10:43:37.300508 2026] [:error] [pid 38536:tid 38559] [client 212.30.33.82:24851] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "abYc2fpTEqkVJ0rBEWvF5AAAAAY"]
[Sun Mar 15 10:43:38.116678 2026] [:error] [pid 50986:tid 50990] [client 212.30.33.88:64073] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "abYc2iknK4c779bcQqHlswAAAUI"]
[Sun Mar 15 10:43:38.914897 2026] [:error] [pid 42570:tid 42581] [client 212.30.33.85:44573] [client 212.30.33.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "abYc2sIUXZJLmk_gYCOY8QAAAYg"]
[Sun Mar 15 10:43:39.710763 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.62:54329] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "abYc2yknK4c779bcQqHlzQAAAVY"]
[Sun Mar 15 10:43:40.935355 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.61:26785] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "abYc3CknK4c779bcQqHl2wAAAVY"]
[Sun Mar 15 10:43:41.759251 2026] [:error] [pid 42570:tid 42588] [client 212.30.33.82:22853] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "abYc3cIUXZJLmk_gYCOZHgAAAY8"]
[Sun Mar 15 10:43:42.559408 2026] [:error] [pid 38536:tid 38577] [client 212.30.33.74:51435] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "abYc3vpTEqkVJ0rBEWvGAwAAABg"]
[Sun Mar 15 10:43:43.777623 2026] [:error] [pid 38536:tid 38560] [client 212.30.33.94:33075] [client 212.30.33.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "abYc3_pTEqkVJ0rBEWvGDgAAAAc"]
[Sun Mar 15 10:43:45.382073 2026] [:error] [pid 9995:tid 9998] [client 212.30.33.74:21345] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "abYc4Qa8xkcaSmgTbwgxTAAAAQA"]
[Sun Mar 15 10:43:46.182695 2026] [:error] [pid 9995:tid 10016] [client 212.30.33.166:43191] [client 212.30.33.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "abYc4ga8xkcaSmgTbwgxUgAAARI"]
[Sun Mar 15 10:43:49.413034 2026] [:error] [pid 38645:tid 38663] [client 212.30.33.59:64263] [client 212.30.33.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "abYc5RFPHtsDUuVrWDatRwAAANA"]
[Sun Mar 15 10:43:52.666616 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.67:55571] [client 212.30.33.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/colour.php"] [unique_id "abYc6BFPHtsDUuVrWDatlgAAAMk"]
[Sun Mar 15 10:43:53.470029 2026] [:error] [pid 38645:tid 38659] [client 212.30.33.63:30001] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "abYc6RFPHtsDUuVrWDatrgAAAMw"]
[Sun Mar 15 10:43:54.271457 2026] [:error] [pid 38645:tid 38654] [client 212.30.33.83:24337] [client 212.30.33.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "abYc6hFPHtsDUuVrWDat0AAAAMc"]
[Sun Mar 15 10:43:55.112653 2026] [:error] [pid 9995:tid 10016] [client 212.30.33.79:58657] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Sun Mar 15 10:43:57.253958 2026] [:error] [pid 9995:tid 10015] [client 212.30.33.79:58657] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "abYc7Qa8xkcaSmgTbwgxewAAARE"]
[Sun Mar 15 10:43:58.899506 2026] [:error] [pid 38536:tid 38565] [client 212.30.33.62:28335] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "abYc7vpTEqkVJ0rBEWvGgwAAAAw"]
[Sun Mar 15 10:44:00.576544 2026] [:error] [pid 38645:tid 38649] [client 212.30.33.68:47865] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "abYc8BFPHtsDUuVrWDauIgAAAMI"]
[Sun Mar 15 10:44:01.815508 2026] [:error] [pid 9995:tid 10012] [client 212.30.33.55:43029] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "abYc8Qa8xkcaSmgTbwgxlwAAAQ4"]
[Sun Mar 15 10:44:02.619698 2026] [:error] [pid 38536:tid 38553] [client 212.30.33.99:27097] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Sun Mar 15 10:44:04.251828 2026] [:error] [pid 38536:tid 38555] [client 212.30.33.99:27097] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "abYc9PpTEqkVJ0rBEWvGpAAAAAI"]
[Sun Mar 15 10:44:05.062097 2026] [:error] [pid 42570:tid 42582] [client 212.30.33.68:57321] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "abYc9cIUXZJLmk_gYCOZ-AAAAYk"]
[Sun Mar 15 10:44:06.703850 2026] [:error] [pid 38541:tid 38631] [client 212.30.33.51:30343] [client 212.30.33.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "abYc9nuOpex8jIO0jt417wAAAJI"]
[Sun Mar 15 10:44:07.508407 2026] [:error] [pid 42570:tid 42590] [client 212.30.33.52:48721] [client 212.30.33.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "abYc98IUXZJLmk_gYCOaGgAAAZE"]
[Sun Mar 15 10:44:09.582721 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.63:35167] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun Mar 15 10:44:11.298210 2026] [:error] [pid 38536:tid 38566] [client 212.30.33.63:35167] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "abYc-_pTEqkVJ0rBEWvG8QAAAA0"]
[Sun Mar 15 10:44:12.105280 2026] [:error] [pid 38541:tid 38623] [client 212.30.33.92:54429] [client 212.30.33.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "abYc_HuOpex8jIO0jt42KAAAAIo"]
[Sun Mar 15 10:44:13.733827 2026] [:error] [pid 38541:tid 38618] [client 212.30.33.81:28383] [client 212.30.33.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "abYc_XuOpex8jIO0jt42QgAAAIU"]
[Sun Mar 15 10:44:14.546673 2026] [:error] [pid 38645:tid 38671] [client 212.30.33.97:42167] [client 212.30.33.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "abYc_hFPHtsDUuVrWDauyQAAANg"]
[Sun Mar 15 10:44:17.024804 2026] [:error] [pid 38541:tid 38616] [client 212.30.33.98:34109] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "abYdAXuOpex8jIO0jt42ggAAAIM"]
[Sun Mar 15 10:44:18.271373 2026] [:error] [pid 42570:tid 42576] [client 212.30.33.56:56729] [client 212.30.33.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "abYdAsIUXZJLmk_gYCOahwAAAYM"]
[Sun Mar 15 10:44:19.872912 2026] [:error] [pid 42570:tid 42597] [client 212.30.33.65:34539] [client 212.30.33.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "abYdA8IUXZJLmk_gYCOanAAAAZg"]
[Sun Mar 15 10:44:20.684754 2026] [:error] [pid 50986:tid 50991] [client 212.30.33.78:31279] [client 212.30.33.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "abYdBCknK4c779bcQqHn7QAAAUM"]
[Sun Mar 15 10:44:21.501295 2026] [:error] [pid 50986:tid 50990] [client 212.30.33.53:28157] [client 212.30.33.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "abYdBSknK4c779bcQqHoAgAAAUI"]
[Sun Mar 15 10:44:22.332852 2026] [:error] [pid 38645:tid 38667] [client 212.30.33.190:22769] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "abYdBhFPHtsDUuVrWDavGQAAANQ"]
[Sun Mar 15 10:44:23.959629 2026] [:error] [pid 9995:tid 10007] [client 212.30.33.78:57677] [client 212.30.33.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "abYdBwa8xkcaSmgTbwgyHgAAAQk"]
[Sun Mar 15 10:44:25.611971 2026] [:error] [pid 38541:tid 38637] [client 212.30.33.72:38533] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Sun Mar 15 10:44:27.692218 2026] [:error] [pid 38541:tid 38626] [client 212.30.33.72:38533] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "abYdC3uOpex8jIO0jt427wAAAI0"]
[Sun Mar 15 10:44:30.541759 2026] [:error] [pid 38540:tid 38594] [client 212.30.33.57:31173] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "abYdDl8bnHsJ1dE90bIgkAAAAEg"]
[Sun Mar 15 10:44:31.390973 2026] [:error] [pid 38645:tid 38667] [client 212.30.33.179:41429] [client 212.30.33.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "abYdDxFPHtsDUuVrWDaveAAAANQ"]
[Sun Mar 15 10:44:32.609310 2026] [:error] [pid 50986:tid 50991] [client 212.30.33.190:37913] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "abYdECknK4c779bcQqHo6AAAAUM"]
[Sun Mar 15 10:44:34.639204 2026] [:error] [pid 38645:tid 38657] [client 212.30.33.58:38797] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Sun Mar 15 10:44:35.443589 2026] [:error] [pid 38645:tid 38670] [client 212.30.33.58:38797] [client 212.30.33.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bk/index.php"] [unique_id "abYdExFPHtsDUuVrWDavpgAAANc"]
[Sun Mar 15 10:44:36.678682 2026] [:error] [pid 9995:tid 10007] [client 212.30.33.75:39333] [client 212.30.33.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "abYdFAa8xkcaSmgTbwgyvgAAAQk"]
[Sun Mar 15 10:44:37.902706 2026] [:error] [pid 38540:tid 38600] [client 212.30.33.225:37791] [client 212.30.33.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "abYdFV8bnHsJ1dE90bIg0gAAAE4"]
[Sun Mar 15 10:44:39.151255 2026] [:error] [pid 50986:tid 50998] [client 212.30.33.65:64009] [client 212.30.33.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "abYdFyknK4c779bcQqHpSAAAAUk"]
[Sun Mar 15 10:44:40.769287 2026] [:error] [pid 9995:tid 10007] [client 212.30.33.179:50733] [client 212.30.33.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "abYdGAa8xkcaSmgTbwgy8QAAAQk"]
[Sun Mar 15 10:44:41.575441 2026] [:error] [pid 38645:tid 38668] [client 212.30.33.229:42321] [client 212.30.33.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "abYdGRFPHtsDUuVrWDav8QAAANU"]
[Sun Mar 15 10:44:44.032714 2026] [:error] [pid 38540:tid 38603] [client 212.30.33.79:29541] [client 212.30.33.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "abYdHF8bnHsJ1dE90bIhHAAAAFE"]
[Sun Mar 15 10:44:46.454988 2026] [:error] [pid 38541:tid 38628] [client 212.30.33.90:53283] [client 212.30.33.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "abYdHnuOpex8jIO0jt43uQAAAI8"]
[Sun Mar 15 10:44:47.258414 2026] [:error] [pid 38540:tid 38589] [client 212.30.33.86:58821] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Sun Mar 15 10:44:49.302308 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.86:58821] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Sun Mar 15 10:44:50.549696 2026] [:error] [pid 38540:tid 38609] [client 212.30.33.86:58821] [client 212.30.33.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "abYdIl8bnHsJ1dE90bIhYQAAAFc"]
[Sun Mar 15 10:44:51.354803 2026] [:error] [pid 9995:tid 10004] [client 212.30.33.62:61811] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ln/wp-login.php"] [unique_id "abYdIwa8xkcaSmgTbwgzRwAAAQY"]
[Sun Mar 15 10:44:52.585207 2026] [:error] [pid 50986:tid 50989] [client 212.30.33.78:57727] [client 212.30.33.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "abYdJCknK4c779bcQqHp-AAAAUE"]
[Sun Mar 15 10:44:53.417575 2026] [:error] [pid 38540:tid 38600] [client 212.30.33.100:20579] [client 212.30.33.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "abYdJV8bnHsJ1dE90bIheAAAAE4"]
[Sun Mar 15 10:44:54.638351 2026] [:error] [pid 38541:tid 38630] [client 212.30.33.85:38917] [client 212.30.33.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.85, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "abYdJnuOpex8jIO0jt44KwAAAJE"]
[Sun Mar 15 10:44:55.060557 2026] [:error] [pid 38541:tid 38620] [client 212.30.33.85:38917] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Sun Mar 15 10:44:57.525019 2026] [:error] [pid 38541:tid 38616] [client 212.30.33.85:38917] [client 212.30.33.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "abYdKXuOpex8jIO0jt44YQAAAIM"]
[Sun Mar 15 10:44:58.752380 2026] [:error] [pid 9995:tid 10012] [client 212.30.33.97:40953] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Sun Mar 15 10:44:59.163399 2026] [:error] [pid 9995:tid 10014] [client 212.30.33.97:40953] [client 212.30.33.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "abYdKwa8xkcaSmgTbwgzlwAAARA"]
[Sun Mar 15 10:45:00.817987 2026] [:error] [pid 42570:tid 42578] [client 212.30.33.73:30399] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky.php"] [unique_id "abYdLMIUXZJLmk_gYCOcIgAAAYU"]
[Sun Mar 15 10:45:01.654669 2026] [:error] [pid 50986:tid 51003] [client 212.30.33.55:29571] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "abYdLSknK4c779bcQqHqcgAAAU4"]
[Sun Mar 15 10:45:02.512635 2026] [:error] [pid 50986:tid 50999] [client 212.30.33.71:46191] [client 212.30.33.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "abYdLiknK4c779bcQqHqfwAAAUo"]
[Sun Mar 15 10:45:03.332734 2026] [:error] [pid 38541:tid 38624] [client 212.30.33.57:42503] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Sun Mar 15 10:45:04.976636 2026] [:error] [pid 38541:tid 38616] [client 212.30.33.57:42503] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "abYdMHuOpex8jIO0jt444AAAAIM"]
[Sun Mar 15 10:45:05.793431 2026] [:error] [pid 38541:tid 38625] [client 212.30.33.51:49087] [client 212.30.33.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "abYdMXuOpex8jIO0jt44_gAAAIw"]
[Sun Mar 15 10:45:07.020892 2026] [:error] [pid 38540:tid 38595] [client 212.30.33.69:60745] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Sun Mar 15 10:45:07.433853 2026] [:error] [pid 38540:tid 38598] [client 212.30.33.69:60745] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "abYdM18bnHsJ1dE90bIiFgAAAEw"]
[Sun Mar 15 10:45:09.061015 2026] [:error] [pid 42570:tid 42576] [client 212.30.33.54:20969] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "abYdNcIUXZJLmk_gYCOcWwAAAYM"]
[Sun Mar 15 10:45:10.275411 2026] [:error] [pid 9995:tid 10014] [client 212.30.33.229:30473] [client 212.30.33.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "abYdNga8xkcaSmgTbwgz6gAAARA"]
[Sun Mar 15 10:45:11.080693 2026] [:error] [pid 9995:tid 10019] [client 212.30.33.98:52579] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Sun Mar 15 10:45:11.481353 2026] [:error] [pid 9995:tid 10007] [client 212.30.33.98:52579] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "abYdNwa8xkcaSmgTbwgz7wAAAQk"]
[Sun Mar 15 10:45:12.708828 2026] [:error] [pid 38645:tid 38649] [client 212.30.33.190:46525] [client 212.30.33.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.190, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abYdOBFPHtsDUuVrWDaxMQAAAMI"]
[Sun Mar 15 10:45:12.719300 2026] [:error] [pid 38645:tid 38649] [client 212.30.33.190:46525] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 15 10:45:13.123664 2026] [:error] [pid 38645:tid 38654] [client 212.30.33.190:46525] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "abYdORFPHtsDUuVrWDaxOgAAAMc"]
[Sun Mar 15 10:45:14.741477 2026] [:error] [pid 38536:tid 38566] [client 212.30.33.190:65487] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "abYdOvpTEqkVJ0rBEWvJZgAAAA0"]
[Sun Mar 15 10:45:16.367706 2026] [:error] [pid 50986:tid 51004] [client 212.30.33.77:53435] [client 212.30.33.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.77, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "abYdPCknK4c779bcQqHrPQAAAU8"]
[Sun Mar 15 10:45:17.611678 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.77:53435] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "abYdPSknK4c779bcQqHrUQAAAUg"]
[Sun Mar 15 10:45:18.423527 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.166:65441] [client 212.30.33.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "abYdPiknK4c779bcQqHrXQAAAUg"]
[Sun Mar 15 10:45:19.231086 2026] [:error] [pid 38540:tid 38586] [client 212.30.33.213:63135] [client 212.30.33.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "abYdP18bnHsJ1dE90bIidwAAAEA"]
[Sun Mar 15 10:45:20.034025 2026] [:error] [pid 38540:tid 38608] [client 212.30.33.67:45329] [client 212.30.33.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.67, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "abYdQF8bnHsJ1dE90bIiggAAAFY"]
[Sun Mar 15 10:45:21.680033 2026] [:error] [pid 38540:tid 38586] [client 212.30.33.67:45329] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Sun Mar 15 10:45:22.498978 2026] [:error] [pid 38540:tid 38601] [client 212.30.33.67:45329] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sun Mar 15 10:45:22.905795 2026] [:error] [pid 38540:tid 38587] [client 212.30.33.67:45329] [client 212.30.33.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "abYdQl8bnHsJ1dE90bIiwAAAAEE"]
[Sun Mar 15 10:45:23.716627 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.90:36857] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Sun Mar 15 10:45:24.525935 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.90:36857] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 15 10:45:25.345694 2026] [:error] [pid 38645:tid 38653] [client 212.30.33.90:36857] [client 212.30.33.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "abYdRRFPHtsDUuVrWDax0QAAAMY"]
[Sun Mar 15 10:45:26.148852 2026] [:error] [pid 9995:tid 10020] [client 212.30.33.63:22699] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Sun Mar 15 10:45:26.964601 2026] [:error] [pid 9995:tid 10008] [client 212.30.33.63:22699] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abYdRga8xkcaSmgTbwg0TAAAAQo"]
[Sun Mar 15 10:45:28.198139 2026] [:error] [pid 42570:tid 42580] [client 212.30.33.58:52167] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Sun Mar 15 10:45:28.608970 2026] [:error] [pid 42570:tid 42583] [client 212.30.33.58:52167] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Sun Mar 15 10:45:29.017944 2026] [:error] [pid 42570:tid 42579] [client 212.30.33.58:52167] [client 212.30.33.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "abYdScIUXZJLmk_gYCOdYwAAAYY"]
[Sun Mar 15 10:45:29.843922 2026] [:error] [pid 9995:tid 10006] [client 212.30.33.70:56719] [client 212.30.33.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "abYdSQa8xkcaSmgTbwg0fQAAAQg"]
[Sun Mar 15 10:45:30.682290 2026] [:error] [pid 50986:tid 51001] [client 212.30.33.68:35419] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "abYdSiknK4c779bcQqHsKAAAAUw"]
[Sun Mar 15 10:45:31.887313 2026] [:error] [pid 38541:tid 38622] [client 212.30.33.82:25569] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "abYdS3uOpex8jIO0jt46HAAAAIk"]
[Sun Mar 15 10:45:32.697994 2026] [:error] [pid 38541:tid 38630] [client 212.30.33.70:38939] [client 212.30.33.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "abYdTHuOpex8jIO0jt46LgAAAJE"]
[Sun Mar 15 10:45:35.554025 2026] [:error] [pid 50986:tid 51010] [client 212.30.33.54:31243] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Mar 15 10:45:35.955309 2026] [:error] [pid 50986:tid 51001] [client 212.30.33.54:31243] [client 212.30.33.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.54, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "abYdTyknK4c779bcQqHspQAAAUw"]
[Sun Mar 15 10:45:36.362308 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.54:31243] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Sun Mar 15 10:45:36.761485 2026] [:error] [pid 50986:tid 51004] [client 212.30.33.54:31243] [client 212.30.33.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.54, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "abYdUCknK4c779bcQqHsrgAAAU8"]
[Sun Mar 15 10:45:37.169416 2026] [:error] [pid 50986:tid 51001] [client 212.30.33.54:31243] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "abYdUSknK4c779bcQqHssQAAAUw"]
[Sun Mar 15 10:45:37.993245 2026] [:error] [pid 38645:tid 38668] [client 212.30.33.98:59509] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Sun Mar 15 10:45:38.415763 2026] [:error] [pid 38645:tid 38669] [client 212.30.33.98:59509] [client 212.30.33.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.98, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "abYdUhFPHtsDUuVrWDaySgAAANY"]
[Sun Mar 15 10:45:38.424517 2026] [:error] [pid 38645:tid 38669] [client 212.30.33.98:59509] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Sun Mar 15 10:45:39.712056 2026] [:error] [pid 38645:tid 38657] [client 212.30.33.98:59509] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Sun Mar 15 10:45:40.123917 2026] [:error] [pid 38645:tid 38660] [client 212.30.33.98:59509] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "abYdVBFPHtsDUuVrWDayZQAAAM0"]
[Sun Mar 15 10:45:40.927416 2026] [:error] [pid 38536:tid 38566] [client 212.30.33.83:27629] [client 212.30.33.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID/wp-conflg.php"] [unique_id "abYdVPpTEqkVJ0rBEWvKbQAAAA0"]
[Sun Mar 15 10:45:42.140629 2026] [:error] [pid 38541:tid 38619] [client 212.30.33.83:61381] [client 212.30.33.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID/wp-work.php"] [unique_id "abYdVnuOpex8jIO0jt46sQAAAIY"]
[Sun Mar 15 10:45:43.382159 2026] [:error] [pid 42570:tid 42597] [client 212.30.33.61:46083] [client 212.30.33.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.61, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "abYdV8IUXZJLmk_gYCOeJAAAAZg"]
[Sun Mar 15 10:45:44.629470 2026] [:error] [pid 42570:tid 42592] [client 212.30.33.61:46083] [client 212.30.33.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.61, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "abYdWMIUXZJLmk_gYCOeNQAAAZM"]
[Sun Mar 15 10:45:45.043210 2026] [:error] [pid 42570:tid 42576] [client 212.30.33.61:46083] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iRSzrsOUEP.php
[Sun Mar 15 10:45:45.857317 2026] [:error] [pid 42570:tid 42589] [client 212.30.33.61:46083] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "abYdWcIUXZJLmk_gYCOeQQAAAZA"]
[Sun Mar 15 10:45:46.656775 2026] [:error] [pid 38645:tid 38648] [client 212.30.33.74:47625] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "abYdWhFPHtsDUuVrWDaypAAAAME"]
[Sun Mar 15 10:45:49.134782 2026] [:error] [pid 38645:tid 38649] [client 212.30.33.78:47213] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sun Mar 15 10:45:49.948396 2026] [:error] [pid 38645:tid 38662] [client 212.30.33.78:47213] [client 212.30.33.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "abYdXRFPHtsDUuVrWDaywgAAAM8"]
[Sun Mar 15 10:45:50.754056 2026] [:error] [pid 42570:tid 42583] [client 212.30.33.228:22431] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "abYdXsIUXZJLmk_gYCOedQAAAYo"]
[Sun Mar 15 10:45:51.956664 2026] [:error] [pid 42570:tid 42591] [client 212.30.33.67:48145] [client 212.30.33.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl.php"] [unique_id "abYdX8IUXZJLmk_gYCOehgAAAZI"]
[Sun Mar 15 10:45:53.983684 2026] [:error] [pid 42570:tid 42583] [client 212.30.33.61:34373] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "abYdYcIUXZJLmk_gYCOetgAAAYo"]
[Sun Mar 15 10:45:55.198986 2026] [:error] [pid 50986:tid 51002] [client 212.30.33.74:56065] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Sun Mar 15 10:45:55.606620 2026] [:error] [pid 50986:tid 51012] [client 212.30.33.74:56065] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "abYdYyknK4c779bcQqHtkQAAAVc"]
[Sun Mar 15 10:45:56.443402 2026] [:error] [pid 50986:tid 50999] [client 212.30.33.68:63413] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "abYdZCknK4c779bcQqHtlwAAAUo"]
[Sun Mar 15 10:45:58.063806 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.80:58865] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "abYdZvpTEqkVJ0rBEWvLEQAAAA4"]
[Sun Mar 15 10:45:58.864599 2026] [:error] [pid 38540:tid 38603] [client 212.30.33.91:58063] [client 212.30.33.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "abYdZl8bnHsJ1dE90bIkMwAAAFE"]
[Sun Mar 15 10:46:00.062720 2026] [:error] [pid 38540:tid 38596] [client 212.30.33.77:26265] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "abYdaF8bnHsJ1dE90bIkSgAAAEo"]
[Sun Mar 15 10:46:01.281644 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.88:56047] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "abYdaXuOpex8jIO0jt474AAAAJU"]
[Sun Mar 15 10:46:02.944648 2026] [:error] [pid 38645:tid 38651] [client 212.30.33.88:28379] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "abYdahFPHtsDUuVrWDazNAAAAMQ"]
[Sun Mar 15 10:46:04.609006 2026] [:error] [pid 50986:tid 51006] [client 212.30.33.103:31923] [client 212.30.33.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.30.33.103, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "abYdbCknK4c779bcQqHuBQAAAVE"]
[Sun Mar 15 10:46:05.877405 2026] [:error] [pid 50986:tid 51010] [client 212.30.33.103:31923] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Mar 15 10:46:07.108757 2026] [:error] [pid 50986:tid 50993] [client 212.30.33.103:31923] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "abYdbyknK4c779bcQqHuNgAAAUU"]
[Sun Mar 15 10:46:08.328219 2026] [:error] [pid 38536:tid 38555] [client 212.30.33.62:61079] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Mar 15 10:46:08.735539 2026] [:error] [pid 38536:tid 38556] [client 212.30.33.62:61079] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Sun Mar 15 10:46:09.141487 2026] [:error] [pid 38536:tid 38573] [client 212.30.33.62:61079] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Sun Mar 15 10:46:09.541744 2026] [:error] [pid 38536:tid 38553] [client 212.30.33.62:61079] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "abYdcfpTEqkVJ0rBEWvLvQAAAAA"]
[Sun Mar 15 10:46:10.784862 2026] [:error] [pid 42570:tid 42576] [client 212.30.33.78:41103] [client 212.30.33.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "abYdcsIUXZJLmk_gYCOf5QAAAYM"]
[Sun Mar 15 10:46:11.593990 2026] [:error] [pid 50986:tid 51005] [client 212.30.33.82:48611] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Mar 15 10:46:11.999978 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.82:48611] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Sun Mar 15 10:46:12.410946 2026] [:error] [pid 50986:tid 51006] [client 212.30.33.82:48611] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Sun Mar 15 10:46:13.630571 2026] [:error] [pid 50986:tid 51011] [client 212.30.33.82:48611] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abYddSknK4c779bcQqHvCwAAAVY"]
[Sun Mar 15 10:46:14.442357 2026] [:error] [pid 42570:tid 42594] [client 212.30.33.99:45645] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Sun Mar 15 10:46:15.256375 2026] [:error] [pid 42570:tid 42584] [client 212.30.33.99:45645] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Sun Mar 15 10:46:15.666055 2026] [:error] [pid 42570:tid 42589] [client 212.30.33.99:45645] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Sun Mar 15 10:46:16.474689 2026] [:error] [pid 42570:tid 42590] [client 212.30.33.99:45645] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "abYdeMIUXZJLmk_gYCOgfAAAAZE"]
[Sun Mar 15 10:46:17.275383 2026] [:error] [pid 38541:tid 38629] [client 212.30.33.72:51515] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "abYdeXuOpex8jIO0jt48ZAAAAJA"]
[Sun Mar 15 10:46:18.091627 2026] [:error] [pid 38536:tid 38574] [client 212.30.33.94:59035] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Sun Mar 15 10:46:22.973824 2026] [:error] [pid 38536:tid 38572] [client 212.30.33.94:59035] [client 212.30.33.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "abYdfvpTEqkVJ0rBEWvMEQAAABM"]
[Sun Mar 15 10:46:24.654969 2026] [:error] [pid 38645:tid 38671] [client 212.30.33.77:47023] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Sun Mar 15 10:46:25.878221 2026] [:error] [pid 38645:tid 38666] [client 212.30.33.77:47023] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "abYdgRFPHtsDUuVrWDaz9AAAANM"]
[Sun Mar 15 10:46:26.682342 2026] [:error] [pid 50986:tid 51005] [client 212.30.33.69:37303] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "abYdgiknK4c779bcQqHwlgAAAVA"]
[Sun Mar 15 10:46:33.335555 2026] [:error] [pid 42570:tid 42586] [client 212.30.33.92:60585] [client 212.30.33.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "abYdicIUXZJLmk_gYCOhgAAAAY0"]
[Sun Mar 15 10:46:34.153584 2026] [:error] [pid 9995:tid 10002] [client 212.30.33.72:38033] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "abYdiga8xkcaSmgTbwg3GAAAAQQ"]
[Sun Mar 15 10:46:34.955669 2026] [:error] [pid 38645:tid 38661] [client 212.30.33.99:38387] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "abYdihFPHtsDUuVrWDa0OwAAAM4"]
[Sun Mar 15 10:46:36.573424 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.87:35375] [client 212.30.33.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "abYdjHuOpex8jIO0jt489gAAAJU"]
[Sun Mar 15 10:46:37.440369 2026] [:error] [pid 38536:tid 38557] [client 212.30.33.60:34187] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Sun Mar 15 10:46:37.851305 2026] [:error] [pid 38536:tid 38566] [client 212.30.33.60:34187] [client 212.30.33.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "abYdjfpTEqkVJ0rBEWvMuQAAAA0"]
[Sun Mar 15 10:46:38.652204 2026] [:error] [pid 42570:tid 42583] [client 212.30.33.96:52319] [client 212.30.33.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID/about.php"] [unique_id "abYdjsIUXZJLmk_gYCOhrwAAAYo"]
[Sun Mar 15 10:46:40.288397 2026] [:error] [pid 38645:tid 38664] [client 212.30.33.66:36941] [client 212.30.33.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "abYdkBFPHtsDUuVrWDa0kQAAANE"]
[Sun Mar 15 10:46:41.084507 2026] [:error] [pid 42570:tid 42586] [client 212.30.33.225:44737] [client 212.30.33.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/fix.php"] [unique_id "abYdkcIUXZJLmk_gYCOh_AAAAY0"]
[Sun Mar 15 10:46:46.011476 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.69:41299] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sun Mar 15 10:46:47.232112 2026] [:error] [pid 38536:tid 38569] [client 212.30.33.69:41299] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "abYdl_pTEqkVJ0rBEWvNGgAAABA"]
[Sun Mar 15 10:46:48.062912 2026] [:error] [pid 38541:tid 38635] [client 212.30.33.91:44607] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Sun Mar 15 10:46:49.718430 2026] [:error] [pid 38541:tid 38619] [client 212.30.33.91:44607] [client 212.30.33.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "abYdmXuOpex8jIO0jt49dQAAAIY"]
[Sun Mar 15 10:46:50.542976 2026] [:error] [pid 38645:tid 38651] [client 212.30.33.103:47437] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "abYdmhFPHtsDUuVrWDa1EgAAAMQ"]
[Sun Mar 15 10:46:51.371941 2026] [:error] [pid 38541:tid 38622] [client 212.30.33.97:43553] [client 212.30.33.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "abYdm3uOpex8jIO0jt49iAAAAIk"]
[Sun Mar 15 10:46:52.177250 2026] [:error] [pid 38645:tid 38665] [client 212.30.33.73:54275] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "abYdnBFPHtsDUuVrWDa1IAAAANI"]
[Sun Mar 15 10:46:52.995373 2026] [:error] [pid 42570:tid 42582] [client 212.30.33.228:57495] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/min.php"] [unique_id "abYdnMIUXZJLmk_gYCOiwAAAAYk"]
[Sun Mar 15 10:46:53.811250 2026] [:error] [pid 38536:tid 38560] [client 212.30.33.77:47031] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "abYdnfpTEqkVJ0rBEWvNVgAAAAc"]
[Sun Mar 15 10:46:54.626657 2026] [:error] [pid 38645:tid 38658] [client 212.30.33.77:34573] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "abYdnhFPHtsDUuVrWDa1RQAAAMs"]
[Sun Mar 15 10:46:55.453917 2026] [:error] [pid 38645:tid 38650] [client 212.30.33.90:21587] [client 212.30.33.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "abYdnxFPHtsDUuVrWDa1VwAAAMM"]
[Sun Mar 15 10:46:57.885829 2026] [:error] [pid 42570:tid 42597] [client 212.30.33.76:21859] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "abYdocIUXZJLmk_gYCOjCAAAAZg"]
[Sun Mar 15 10:46:59.114620 2026] [:error] [pid 38541:tid 38625] [client 212.30.33.190:40667] [client 212.30.33.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "abYdo3uOpex8jIO0jt497QAAAIw"]
[Sun Mar 15 10:47:01.577850 2026] [:error] [pid 38540:tid 38597] [client 212.30.33.75:22819] [client 212.30.33.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "abYdpV8bnHsJ1dE90bInGQAAAEs"]
[Sun Mar 15 10:47:03.664135 2026] [:error] [pid 38645:tid 38660] [client 212.30.33.101:33183] [client 212.30.33.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "abYdpxFPHtsDUuVrWDa1ywAAAM0"]
[Sun Mar 15 10:47:04.473801 2026] [:error] [pid 42570:tid 42580] [client 212.30.33.66:53415] [client 212.30.33.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "abYdqMIUXZJLmk_gYCOjXwAAAYc"]
[Sun Mar 15 10:47:08.511348 2026] [:error] [pid 38645:tid 38671] [client 212.30.33.74:44459] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "abYdrBFPHtsDUuVrWDa16QAAANg"]
[Sun Mar 15 10:47:09.313571 2026] [:error] [pid 38645:tid 38670] [client 212.30.33.54:37209] [client 212.30.33.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "abYdrRFPHtsDUuVrWDa17wAAANc"]
[Sun Mar 15 10:47:10.532128 2026] [:error] [pid 38541:tid 38613] [client 212.30.33.103:30751] [client 212.30.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "abYdrnuOpex8jIO0jt4-gwAAAIA"]
[Sun Mar 15 10:47:11.332016 2026] [:error] [pid 38540:tid 38602] [client 212.30.33.86:48915] File does not exist: /usr/local/apache/htdocs/suspended-page/firewall.php
[Sun Mar 15 10:47:13.349160 2026] [:error] [pid 38540:tid 38593] [client 212.30.33.86:48915] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Sun Mar 15 10:47:14.551752 2026] [:error] [pid 38540:tid 38610] [client 212.30.33.86:48915] [client 212.30.33.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "abYdsl8bnHsJ1dE90bIn4AAAAFg"]
[Sun Mar 15 10:47:15.366453 2026] [:error] [pid 38541:tid 38630] [client 212.30.33.87:35547] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Sun Mar 15 10:47:15.774674 2026] [:error] [pid 38541:tid 38623] [client 212.30.33.87:35547] [client 212.30.33.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "abYds3uOpex8jIO0jt4-zAAAAIo"]
[Sun Mar 15 10:47:21.282588 2026] [:error] [pid 38645:tid 38657] [client 212.30.33.70:34825] [client 212.30.33.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "abYduRFPHtsDUuVrWDa2gAAAAMo"]
[Sun Mar 15 10:47:22.508178 2026] [:error] [pid 42570:tid 42584] [client 212.30.33.78:48679] [client 212.30.33.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "abYdusIUXZJLmk_gYCOkQgAAAYs"]
[Sun Mar 15 10:47:24.166738 2026] [:error] [pid 38536:tid 38571] [client 212.30.33.92:61101] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Sun Mar 15 10:47:24.987502 2026] [:error] [pid 38536:tid 38575] [client 212.30.33.92:61101] [client 212.30.33.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "abYdvPpTEqkVJ0rBEWvOmwAAABY"]
[Sun Mar 15 10:47:30.552077 2026] [:error] [pid 9995:tid 10003] [client 212.30.33.69:39171] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "abYdwga8xkcaSmgTbwg5rQAAAQU"]
[Sun Mar 15 10:47:34.898621 2026] [:error] [pid 42570:tid 42596] [client 212.30.33.228:52335] File does not exist: /usr/local/apache/htdocs/suspended-page/xl.php
[Sun Mar 15 10:47:35.302147 2026] [:error] [pid 42570:tid 42592] [client 212.30.33.228:52335] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "abYdx8IUXZJLmk_gYCOlJwAAAZM"]
[Sun Mar 15 10:47:36.130287 2026] [:error] [pid 38540:tid 38594] [client 212.30.33.92:24765] [client 212.30.33.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "abYdyF8bnHsJ1dE90bIo4AAAAEg"]
[Sun Mar 15 10:47:37.336476 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.95:55959] [client 212.30.33.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "abYdyRFPHtsDUuVrWDa3HgAAAMk"]
[Sun Mar 15 10:47:38.142980 2026] [:error] [pid 42570:tid 42584] [client 212.30.33.92:58003] [client 212.30.33.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "abYdysIUXZJLmk_gYCOlSwAAAYs"]
[Sun Mar 15 10:47:38.952930 2026] [:error] [pid 38645:tid 38671] [client 212.30.33.78:39185] [client 212.30.33.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "abYdyhFPHtsDUuVrWDa3NgAAANg"]
[Sun Mar 15 10:47:40.613399 2026] [:error] [pid 38536:tid 38556] [client 212.30.33.61:35409] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "abYdzPpTEqkVJ0rBEWvPOQAAAAM"]
[Sun Mar 15 10:47:42.247621 2026] [:error] [pid 9995:tid 10002] [client 212.30.33.69:46207] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-smtp-bar.php"] [unique_id "abYdzga8xkcaSmgTbwg6JgAAAQQ"]
[Sun Mar 15 10:47:43.471523 2026] [:error] [pid 42570:tid 42574] [client 212.30.33.76:34801] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "abYdz8IUXZJLmk_gYCOloAAAAYE"]
[Sun Mar 15 10:47:44.287336 2026] [:error] [pid 38536:tid 38576] [client 212.30.33.85:33133] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Sun Mar 15 10:47:44.705285 2026] [:error] [pid 38536:tid 38558] [client 212.30.33.85:33133] [client 212.30.33.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "abYd0PpTEqkVJ0rBEWvPXwAAAAU"]
[Sun Mar 15 10:47:46.370952 2026] [:error] [pid 38645:tid 38657] [client 212.30.33.75:43179] [client 212.30.33.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "abYd0hFPHtsDUuVrWDa3ogAAAMo"]
[Sun Mar 15 10:47:47.197578 2026] [:error] [pid 38540:tid 38588] [client 212.30.33.76:61125] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "abYd018bnHsJ1dE90bIpawAAAEI"]
[Sun Mar 15 10:47:48.921716 2026] [:error] [pid 38540:tid 38598] [client 212.30.33.76:23793] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "abYd1F8bnHsJ1dE90bIpfwAAAEw"]
[Sun Mar 15 10:47:51.793743 2026] [:error] [pid 50986:tid 50991] [client 212.30.33.228:35621] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "abYd1yknK4c779bcQqH1NgAAAUM"]
[Sun Mar 15 10:47:53.025798 2026] [:error] [pid 38645:tid 38655] [client 212.30.33.63:48973] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "abYd2RFPHtsDUuVrWDa37gAAAMg"]
[Sun Mar 15 10:47:54.241743 2026] [:error] [pid 38540:tid 38587] [client 212.30.33.88:53939] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "abYd2l8bnHsJ1dE90bIpqwAAAEE"]
[Sun Mar 15 10:47:55.055685 2026] [:error] [pid 50986:tid 50998] [client 212.30.33.77:63193] [client 212.30.33.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID/shell.php"] [unique_id "abYd2yknK4c779bcQqH1WwAAAUk"]
[Sun Mar 15 10:47:55.856694 2026] [:error] [pid 50986:tid 51002] [client 212.30.33.98:45409] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "abYd2yknK4c779bcQqH1bgAAAU0"]
[Sun Mar 15 10:47:57.125201 2026] [:error] [pid 50986:tid 51010] [client 212.30.33.228:40881] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID/db.php"] [unique_id "abYd3SknK4c779bcQqH1hAAAAVU"]
[Sun Mar 15 10:47:57.940842 2026] [:error] [pid 38645:tid 38648] [client 212.30.33.69:50141] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/simi.php"] [unique_id "abYd3RFPHtsDUuVrWDa4JgAAAME"]
[Sun Mar 15 10:47:58.746293 2026] [:error] [pid 42570:tid 42576] [client 212.30.33.80:20857] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "abYd3sIUXZJLmk_gYCOmhAAAAYM"]
[Sun Mar 15 10:47:59.555147 2026] [:error] [pid 9995:tid 9999] [client 212.30.33.55:27385] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Sun Mar 15 10:47:59.982609 2026] [:error] [pid 9995:tid 10014] [client 212.30.33.55:27385] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "abYd3wa8xkcaSmgTbwg65wAAARA"]
[Sun Mar 15 10:48:00.788654 2026] [:error] [pid 38541:tid 38616] [client 212.30.33.86:33597] [client 212.30.33.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "abYd4HuOpex8jIO0jt5A5AAAAIM"]
[Sun Mar 15 10:48:01.588112 2026] [:error] [pid 50986:tid 50998] [client 212.30.33.63:56557] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "abYd4SknK4c779bcQqH1wQAAAUk"]
[Sun Mar 15 10:48:03.640538 2026] [:error] [pid 38536:tid 38561] [client 212.30.33.213:33083] [client 212.30.33.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/template-wploader.php"] [unique_id "abYd4_pTEqkVJ0rBEWvQOwAAAAg"]
[Sun Mar 15 10:48:04.845382 2026] [:error] [pid 38536:tid 38558] [client 212.30.33.71:34661] [client 212.30.33.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "abYd5PpTEqkVJ0rBEWvQTwAAAAU"]
[Sun Mar 15 10:48:06.894251 2026] [:error] [pid 38645:tid 38659] [client 212.30.33.228:53883] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/template-less.php"] [unique_id "abYd5hFPHtsDUuVrWDa4ngAAAMw"]
[Sun Mar 15 10:48:08.540284 2026] [:error] [pid 42570:tid 42589] [client 212.30.33.85:22217] [client 212.30.33.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "abYd6MIUXZJLmk_gYCOncQAAAZA"]
[Sun Mar 15 10:48:09.338943 2026] [:error] [pid 50986:tid 50988] [client 212.30.33.58:57663] [client 212.30.33.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "abYd6SknK4c779bcQqH2GAAAAUA"]
[Sun Mar 15 10:48:10.579431 2026] [:error] [pid 42570:tid 42578] [client 212.30.33.179:37063] [client 212.30.33.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "abYd6sIUXZJLmk_gYCOnnwAAAYU"]
[Sun Mar 15 10:48:11.811465 2026] [:error] [pid 9995:tid 10014] [client 212.30.33.86:51171] [client 212.30.33.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "abYd6wa8xkcaSmgTbwg7cgAAARA"]
[Sun Mar 15 10:48:12.624434 2026] [:error] [pid 42570:tid 42596] [client 212.30.33.74:56253] [client 212.30.33.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "abYd7MIUXZJLmk_gYCOn4wAAAZc"]
[Sun Mar 15 10:48:14.670316 2026] [:error] [pid 42570:tid 42581] [client 212.30.33.56:28527] [client 212.30.33.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "abYd7sIUXZJLmk_gYCOoPwAAAYg"]
[Sun Mar 15 10:48:15.473788 2026] [:error] [pid 38541:tid 38634] [client 212.30.33.76:29569] [client 212.30.33.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "abYd73uOpex8jIO0jt5BawAAAJU"]
[Sun Mar 15 10:48:16.284015 2026] [:error] [pid 38536:tid 38564] [client 212.30.33.86:38125] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sun Mar 15 10:48:17.085997 2026] [:error] [pid 38536:tid 38566] [client 212.30.33.86:38125] [client 212.30.33.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "abYd8fpTEqkVJ0rBEWvQ7wAAAA0"]
[Sun Mar 15 10:48:18.294905 2026] [:error] [pid 38645:tid 38654] [client 212.30.33.73:37767] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/system.php"] [unique_id "abYd8hFPHtsDUuVrWDa5JgAAAMc"]
[Sun Mar 15 10:48:19.934838 2026] [:error] [pid 38540:tid 38599] [client 212.30.33.59:63715] [client 212.30.33.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "abYd818bnHsJ1dE90bIrGwAAAE0"]
[Sun Mar 15 10:48:21.174708 2026] [:error] [pid 38536:tid 38576] [client 212.30.33.81:50489] [client 212.30.33.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "abYd9fpTEqkVJ0rBEWvRKAAAABc"]
[Sun Mar 15 10:48:21.974247 2026] [:error] [pid 42570:tid 42573] [client 212.30.33.60:47911] [client 212.30.33.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID/chosen.php"] [unique_id "abYd9cIUXZJLmk_gYCOorAAAAYA"]
[Sun Mar 15 10:48:23.993012 2026] [:error] [pid 38541:tid 38632] [client 212.30.33.213:62747] [client 212.30.33.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec.php"] [unique_id "abYd93uOpex8jIO0jt5CCAAAAJM"]
[Sun Mar 15 10:48:24.821945 2026] [:error] [pid 38645:tid 38647] [client 212.30.33.71:55061] [client 212.30.33.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "abYd-BFPHtsDUuVrWDa5jgAAAMA"]
[Sun Mar 15 10:48:25.637147 2026] [:error] [pid 9995:tid 10002] [client 212.30.33.179:55661] [client 212.30.33.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "abYd-Qa8xkcaSmgTbwg7_QAAAQQ"]
[Sun Mar 15 10:48:26.465886 2026] [:error] [pid 9995:tid 10016] [client 212.30.33.61:31131] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "abYd-ga8xkcaSmgTbwg8EAAAARI"]
[Sun Mar 15 10:48:27.316100 2026] [:error] [pid 50986:tid 51007] [client 212.30.33.225:38107] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun Mar 15 10:48:28.138910 2026] [:error] [pid 50986:tid 51010] [client 212.30.33.225:38107] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Sun Mar 15 10:48:33.054426 2026] [:error] [pid 50986:tid 51004] [client 212.30.33.225:38107] [client 212.30.33.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "abYeASknK4c779bcQqH3DAAAAU8"]
[Sun Mar 15 10:48:34.281405 2026] [:error] [pid 38540:tid 38593] [client 212.30.33.66:23835] [client 212.30.33.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "abYeAl8bnHsJ1dE90bIrzAAAAEc"]
[Sun Mar 15 10:48:53.259080 2026] [autoindex:error] [pid 38541:tid 38637] [client 212.30.33.60:52741] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 14:05:15.615879 2026] [:error] [pid 45801:tid 45816] [client 43.140.247.223:57616] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abZMG4aKHL9CTKoVzTD1NQAAAc0"]
[Sun Mar 15 16:13:19.773840 2026] [:error] [pid 42570:tid 42574] [client 104.234.53.88:54125] [client 104.234.53.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.88, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abZqH8IUXZJLmk_gYCPtUQAAAYE"]
[Sun Mar 15 16:13:19.779031 2026] [:error] [pid 42570:tid 42574] [client 104.234.53.88:54125] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Mar 15 21:04:45.463835 2026] [:error] [pid 38536:tid 38566] [client 36.111.67.189:46249] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abaubfpTEqkVJ0rBEWsPvAAAAA0"]
[Mon Mar 16 03:34:03.282193 2026] [:error] [pid 62427:tid 62448] [client 60.188.57.0:44850] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abcJq8UPP8fzo6XzJCX1JQAAAAc"]
[Mon Mar 16 03:35:53.664189 2026] [:error] [pid 62529:tid 62548] [client 43.156.204.134:57520] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abcKGT84-luOVYZKK0MjCgAAAMs"]
[Mon Mar 16 07:02:25.975404 2026] [:error] [pid 62429:tid 62517] [client 203.188.168.25:26239] [client 203.188.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.25, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abc6gVewIPukhLCowEHc5wAAAJU"]
[Mon Mar 16 07:02:25.979648 2026] [:error] [pid 62429:tid 62517] [client 203.188.168.25:26239] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Mon Mar 16 08:26:49.678573 2026] [:error] [pid 62429:tid 62505] [client 103.65.237.124:56805] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "abdOSVewIPukhLCowEH6tgAAAIk"]
[Mon Mar 16 09:43:44.536515 2026] [:error] [pid 62429:tid 62515] [client 43.130.39.254:44628] [client 43.130.39.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abdgUFewIPukhLCowEEZ6AAAAJM"]
[Mon Mar 16 11:05:11.971251 2026] [:error] [pid 62025:tid 62066] [client 173.239.236.163:46981] [client 173.239.236.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abdzZ-imBfLmKh7zLXMB6QAAAEc"]
[Mon Mar 16 11:05:12.440667 2026] [:error] [pid 62025:tid 62059] [client 173.239.236.110:53023] [client 173.239.236.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.239.236.110, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "abdzaOimBfLmKh7zLXMB_AAAAEA"]
[Mon Mar 16 11:05:12.445045 2026] [:error] [pid 62025:tid 62059] [client 173.239.236.110:53023] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon Mar 16 11:05:13.508548 2026] [:error] [pid 62025:tid 62077] [client 173.239.236.110:53023] [client 173.239.236.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "abdzaeimBfLmKh7zLXMCGQAAAFI"]
[Mon Mar 16 11:05:13.729251 2026] [:error] [pid 62510:tid 62531] [client 173.239.236.107:27089] [client 173.239.236.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "abdzaSE33_T9aKpoDdjpwwAAARI"]
[Mon Mar 16 11:05:13.997788 2026] [:error] [pid 62026:tid 62096] [client 173.239.236.21:59295] [client 173.239.236.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "abdzae8oW52PUIYI2O4LggAAAIo"]
[Mon Mar 16 11:05:14.233719 2026] [:error] [pid 62510:tid 62531] [client 173.239.236.18:53971] [client 173.239.236.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "abdzaiE33_T9aKpoDdjp0wAAARI"]
[Mon Mar 16 11:58:07.897661 2026] [:error] [pid 62119:tid 62137] [client 43.157.170.13:36322] [client 43.157.170.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abd_zz-Co-Fir-PyAwfWfAAAAM8"]
[Mon Mar 16 14:59:23.151433 2026] [:error] [pid 62510:tid 62523] [client 43.159.144.16:38870] [client 43.159.144.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abeqSyE33_T9aKpoDdg_NwAAAQo"]
[Mon Mar 16 17:10:46.950199 2026] [:error] [pid 36198:tid 36201] [client 49.51.33.159:36392] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abfJFulL1GNckmsdWlP3hgAAAQA"]
[Mon Mar 16 19:54:33.931548 2026] [:error] [pid 39154:tid 39170] [client 64.89.163.113:51376] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abfveRgq1_qjm7J1LqsiTgAAAU0"]
[Mon Mar 16 19:54:34.456369 2026] [:error] [pid 1871:tid 1874] [client 64.89.163.113:65501] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abfvejinTnZ8uiUPekE6gwAAAYE"]
[Mon Mar 16 19:54:35.057751 2026] [:error] [pid 35929:tid 35952] [client 64.89.163.113:51351] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abfve9W47dGpmA63hwSKxQAAANU"]
[Mon Mar 16 19:54:35.596141 2026] [:error] [pid 36198:tid 36224] [client 64.89.163.113:61771] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abfve-lL1GNckmsdWlM0AwAAARc"]
[Mon Mar 16 19:54:36.209870 2026] [:error] [pid 1871:tid 1873] [client 64.89.163.113:54327] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abfvfDinTnZ8uiUPekE6vAAAAYA"]
[Tue Mar 17 00:18:56.677157 2026] [:error] [pid 36198:tid 36217] [client 43.130.31.17:50654] [client 43.130.31.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abgtcOlL1GNckmsdWlOBnwAAARA"]
[Tue Mar 17 05:23:14.415464 2026] [:error] [pid 45916:tid 45968] [client 43.156.109.53:59666] [client 43.156.109.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abh0wriS53PnClk_C9DorwAAAEY"]
[Tue Mar 17 07:19:17.676746 2026] [:error] [pid 45916:tid 45972] [client 49.51.252.146:47570] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abiP9biS53PnClk_C9AGVQAAAEo"]
[Tue Mar 17 07:56:13.673394 2026] [:error] [pid 45917:tid 46002] [client 185.223.152.140:20679] [client 185.223.152.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.140, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abiYnRMMhmeqL5fT_hex_QAAAI0"]
[Tue Mar 17 07:56:13.684773 2026] [:error] [pid 45917:tid 46002] [client 185.223.152.140:20679] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Mar 17 10:18:50.054124 2026] [:error] [pid 15011:tid 15062] [client 43.159.149.216:36564] [client 43.159.149.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abi6CsNtgHlAHiPlDyobwAAAAc0"]
[Tue Mar 17 11:47:57.663843 2026] [:error] [pid 46020:tid 46041] [client 49.233.45.47:34914] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abjO7X-nCcd9BdzGdLdcAQAAANM"]
[Tue Mar 17 12:13:50.951362 2026] [:error] [pid 22541:tid 22550] [client 43.153.27.244:53212] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abjU_qS6JNY1-CTsTA9_WgAAAQQ"]
[Tue Mar 17 14:58:58.655445 2026] [:error] [pid 45916:tid 45964] [client 43.157.191.20:53892] [client 43.157.191.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abj7sriS53PnClk_C9AXfAAAAEI"]
[Tue Mar 17 18:19:46.374853 2026] [:error] [pid 14817:tid 14846] [client 175.6.217.4:54333] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abkqwuBWVgTpR3dKOgYe6AAAAVQ"]
[Tue Mar 17 18:30:30.755556 2026] [:error] [pid 22541:tid 22548] [client 34.26.157.139:65168] [client 34.26.157.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.157.139, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "abktRqS6JNY1-CTsTA_79QAAAQI"]
[Tue Mar 17 18:30:30.759131 2026] [:error] [pid 22541:tid 22548] [client 34.26.157.139:65168] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 17 18:30:33.501873 2026] [:error] [pid 22541:tid 22556] [client 34.26.157.139:65168] [client 34.26.157.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "abktSaS6JNY1-CTsTA_8CwAAAQo"]
[Tue Mar 17 18:30:34.056668 2026] [:error] [pid 14929:tid 14953] [client 34.26.157.139:58447] [client 34.26.157.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "abktSvTUDuLSLjNnyavXHgAAAZE"]
[Tue Mar 17 18:30:34.669446 2026] [:error] [pid 45916:tid 45975] [client 34.26.157.139:50889] [client 34.26.157.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "abktSriS53PnClk_C9B1YgAAAE0"]
[Tue Mar 17 18:30:35.279658 2026] [:error] [pid 15013:tid 15083] [client 34.26.157.139:57548] [client 34.26.157.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "abktS1Zc-p7DonmJmm0vIQAAAgY"]
[Tue Mar 17 18:30:35.819539 2026] [:error] [pid 45916:tid 45974] [client 34.26.157.139:55758] [client 34.26.157.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "abktS7iS53PnClk_C9B1ZQAAAEw"]
[Tue Mar 17 18:30:36.325700 2026] [:error] [pid 45916:tid 45962] [client 34.26.157.139:57033] [client 34.26.157.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "abktTLiS53PnClk_C9B1ZwAAAEA"]
[Tue Mar 17 18:30:36.892065 2026] [:error] [pid 45915:tid 45950] [client 34.26.157.139:65002] [client 34.26.157.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "abktTJh7U84ydzcrcndXegAAABU"]
[Tue Mar 17 19:42:32.853766 2026] [:error] [pid 15011:tid 15072] [client 43.130.67.6:57238] [client 43.130.67.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abk-KMNtgHlAHiPlDypPCwAAAdc"]
[Tue Mar 17 21:36:08.235152 2026] [:error] [pid 15162:tid 15178] [client 43.165.189.206:54064] [client 43.165.189.206] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ablYyLkCW4399PnBfYQHsAAAAks"]
[Wed Mar 18 00:50:17.019759 2026] [:error] [pid 63412:tid 63438] [client 129.80.234.214:56969] [client 129.80.234.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.80.234.214, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abmGSTKUzzFOGoXRLQ-ubQAAANY"]
[Wed Mar 18 00:50:17.023757 2026] [:error] [pid 63412:tid 63438] [client 129.80.234.214:56969] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 18 00:50:17.448579 2026] [:error] [pid 63412:tid 63439] [client 129.80.234.214:57564] [client 129.80.234.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.80.234.214, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abmGSTKUzzFOGoXRLQ-ucQAAANc"], referer: https://www.facebook.com/
[Wed Mar 18 00:50:17.452337 2026] [:error] [pid 63412:tid 63439] [client 129.80.234.214:57564] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://www.facebook.com/
[Wed Mar 18 00:50:20.514484 2026] [:error] [pid 63412:tid 63434] [client 129.80.234.214:59389] [client 129.80.234.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.80.234.214, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "abmGTDKUzzFOGoXRLQ-udgAAANI"], referer: https://wordpress.org/
[Wed Mar 18 00:50:20.518327 2026] [:error] [pid 63412:tid 63434] [client 129.80.234.214:59389] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://wordpress.org/
[Wed Mar 18 00:50:20.932270 2026] [:error] [pid 63612:tid 63629] [client 129.80.234.214:59989] [client 129.80.234.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.80.234.214, incrementing brute counter"] [hostname "www.rejuva.au"] [uri "/wp-login.php"] [unique_id "abmGTO7vPBSR8vo387MXdAAAAY8"]
[Wed Mar 18 00:50:20.935783 2026] [:error] [pid 63612:tid 63629] [client 129.80.234.214:59989] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 18 00:51:31.714655 2026] [:error] [pid 63612:tid 63626] [client 129.80.234.214:56178] [client 129.80.234.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.80.234.214, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abmGk-7vPBSR8vo387MYUQAAAYw"], referer: https://duckduckgo.com/
[Wed Mar 18 00:51:31.717787 2026] [:error] [pid 63612:tid 63626] [client 129.80.234.214:56178] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php, referer: https://duckduckgo.com/
[Wed Mar 18 00:51:32.153160 2026] [:error] [pid 63412:tid 63430] [client 129.80.234.214:56724] [client 129.80.234.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.80.234.214, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abmGlDKUzzFOGoXRLQ-u4wAAAM4"]
[Wed Mar 18 00:51:32.156760 2026] [:error] [pid 63412:tid 63430] [client 129.80.234.214:56724] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 18 01:19:36.962993 2026] [:error] [pid 40715:tid 40942] [client 192.144.148.122:58830] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abmNKGcms0rUPgdkLiEEMQAAAAQ"]
[Wed Mar 18 05:21:32.353760 2026] [:error] [pid 44965:tid 45023] [client 43.165.65.75:44006] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abnF3KNZys-oG-hM22h2aAAAAE0"]
[Wed Mar 18 06:37:52.649559 2026] [:error] [pid 44966:tid 45057] [client 193.19.109.36:60291] [client 193.19.109.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.36, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "abnXwLHml2_01Zq4-13FCwAAAJQ"]
[Wed Mar 18 06:37:52.653835 2026] [:error] [pid 44966:tid 45057] [client 193.19.109.36:60291] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 18 07:18:38.527871 2026] [:error] [pid 44966:tid 45044] [client 170.106.73.216:48262] [client 170.106.73.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abnhTrHml2_01Zq4-13PugAAAIc"]
[Wed Mar 18 07:20:42.845766 2026] [:error] [pid 44964:tid 44997] [client 182.42.111.213:54947] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abnhysvMufm4ayzOOhBfLgAAABM"]
[Wed Mar 18 08:13:18.636315 2026] [:error] [pid 13716:tid 13726] [client 20.2.90.103:39538] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "abnuHmWKzQVHkZkUHaRUBgAAAUg"]
[Wed Mar 18 08:21:31.526587 2026] [:error] [pid 44966:tid 45042] [client 20.116.1.191:21040] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Mar 18 08:21:32.004476 2026] [:error] [pid 44966:tid 45061] [client 20.116.1.191:21040] [client 20.116.1.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.1.191, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abnwDLHml2_01Zq4-13zeQAAAJg"]
[Wed Mar 18 08:21:32.239105 2026] [:error] [pid 44966:tid 45043] [client 20.116.1.191:21040] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Wed Mar 18 08:21:33.235317 2026] [:error] [pid 44966:tid 45050] [client 20.116.1.191:21040] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Wed Mar 18 08:21:34.056803 2026] [:error] [pid 44966:tid 45040] [client 20.116.1.191:21040] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Wed Mar 18 08:21:34.357671 2026] [:error] [pid 44966:tid 45047] [client 20.116.1.191:21040] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abnwDrHml2_01Zq4-13zgwAAAIo"]
[Wed Mar 18 08:21:35.932400 2026] [:error] [pid 44965:tid 45017] [client 20.116.1.191:20756] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abnwD6NZys-oG-hM22icZQAAAEc"]
[Wed Mar 18 08:21:37.897043 2026] [:error] [pid 13716:tid 13736] [client 20.116.1.191:21044] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abnwEWWKzQVHkZkUHaRbRgAAAVI"]
[Wed Mar 18 08:21:39.686279 2026] [:error] [pid 14861:tid 14870] [client 20.116.1.191:20740] [client 20.116.1.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "abnwEyW0PeWaIC54JJbfoAAAAYQ"]
[Wed Mar 18 10:26:12.595361 2026] [:error] [pid 42872:tid 42965] [client 43.153.122.30:58380] [client 43.153.122.30] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aboNRDchM8PQMaMEWJl6QAAAAdc"]
[Wed Mar 18 13:51:56.835811 2026] [:error] [pid 31232:tid 31250] [client 203.2.64.59:55424] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abo9fGX6HV7dqh3BQD3mBwAAAE8"]
[Wed Mar 18 20:08:12.583810 2026] [:error] [pid 42871:tid 42935] [client 20.220.57.95:61827] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 18 20:08:12.794610 2026] [:error] [pid 42871:tid 42918] [client 20.220.57.95:61827] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 18 20:08:13.216835 2026] [:error] [pid 42871:tid 42930] [client 20.220.57.95:61827] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Wed Mar 18 20:08:13.505251 2026] [:error] [pid 42871:tid 42921] [client 20.220.57.95:61827] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Mar 18 20:08:14.176473 2026] [:error] [pid 42871:tid 42928] [client 20.220.57.95:61827] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Mar 18 20:08:14.387627 2026] [:error] [pid 42871:tid 42933] [client 20.220.57.95:61827] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Mar 18 20:08:14.598406 2026] [:error] [pid 42871:tid 42914] [client 20.220.57.95:61827] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Wed Mar 18 20:08:15.115570 2026] [:error] [pid 42871:tid 42932] [client 20.220.57.95:61827] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "abqVr2PUS0lM1M9nUaJeMwAAAJI"]
[Wed Mar 18 20:08:20.466054 2026] [:error] [pid 42871:tid 42931] [client 20.220.57.95:61870] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "abqVtGPUS0lM1M9nUaJeNQAAAJE"]
[Wed Mar 18 20:08:22.480412 2026] [:error] [pid 20667:tid 20674] [client 20.220.57.95:53158] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "abqVtpgyfQyvBhzza_19qAAAAYU"]
[Wed Mar 18 20:08:28.835695 2026] [:error] [pid 42872:tid 42950] [client 20.220.57.95:61881] [client 20.220.57.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "abqVvDchM8PQMaMEWJnAQgAAAck"]
[Wed Mar 18 20:12:26.230430 2026] [:error] [pid 53755:tid 53772] [client 43.157.22.57:41588] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abqWqqqw5ZSRshmIhWkrhAAAAU8"]
[Wed Mar 18 22:10:21.031026 2026] [:error] [pid 31232:tid 31255] [client 43.130.139.136:38312] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abqyTWX6HV7dqh3BQD0fgwAAAFQ"]
[Thu Mar 19 03:17:15.837794 2026] [:error] [pid 19431:tid 19508] [client 1.15.52.154:35658] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abr6OzioVgnJ_ZdBjcuonAAAAFY"]
[Thu Mar 19 03:27:09.300591 2026] [:error] [pid 20666:tid 20767] [client 101.33.55.204:55234] [client 101.33.55.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abr8jcpXR_Vm__sAFVMymAAAAJU"]
[Thu Mar 19 05:25:17.351132 2026] [:error] [pid 3278:tid 3300] [client 34.74.21.34:55736] [client 34.74.21.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "absYPQC2T_lM6ZgvfcQE7QAAARM"]
[Thu Mar 19 06:31:07.745821 2026] [:error] [pid 23988:tid 24000] [client 31.171.130.31:51221] [client 31.171.130.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.31, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "absnq2nlkSPXj2matr0cogAAAMk"]
[Thu Mar 19 06:31:07.751145 2026] [:error] [pid 23988:tid 24000] [client 31.171.130.31:51221] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Thu Mar 19 08:52:59.443310 2026] [:error] [pid 31205:tid 31229] [client 170.106.152.218:58576] [client 170.106.152.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abtI61u5gZKGrGz5P1ExtQAAAUw"]
[Thu Mar 19 08:56:01.873311 2026] [:error] [pid 3278:tid 3297] [client 91.99.186.247:36480] [client 91.99.186.247] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "abtJoQC2T_lM6ZgvfcRFeAAAARA"]
[Thu Mar 19 10:00:50.320787 2026] [:error] [pid 31313:tid 31366] [client 209.87.169.224:50055] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Thu Mar 19 10:00:50.951744 2026] [:error] [pid 31447:tid 31470] [client 209.87.169.241:39175] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Mar 19 10:00:51.610515 2026] [:error] [pid 31447:tid 31479] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Mar 19 10:00:51.875357 2026] [:error] [pid 31447:tid 31477] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Mar 19 10:00:52.132754 2026] [:error] [pid 31447:tid 31477] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Mar 19 10:00:52.384179 2026] [:error] [pid 31447:tid 31463] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Mar 19 10:00:52.689636 2026] [:error] [pid 31447:tid 31479] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Mar 19 10:00:52.995439 2026] [:error] [pid 31447:tid 31469] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Mar 19 10:00:53.473602 2026] [:error] [pid 31447:tid 31463] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Mar 19 10:00:54.019617 2026] [:error] [pid 31447:tid 31479] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Mar 19 10:00:54.284028 2026] [:error] [pid 31447:tid 31479] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Mar 19 10:00:54.605841 2026] [:error] [pid 31447:tid 31479] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Mar 19 10:00:54.896587 2026] [:error] [pid 31447:tid 31479] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Mar 19 10:00:55.178333 2026] [:error] [pid 31447:tid 31469] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Mar 19 10:00:55.417523 2026] [:error] [pid 31447:tid 31469] [client 45.131.195.237:25981] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Mar 19 10:00:55.938085 2026] [:error] [pid 25179:tid 25205] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Mar 19 10:00:56.175109 2026] [:error] [pid 25179:tid 25181] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Mar 19 10:00:56.409745 2026] [:error] [pid 25179:tid 25186] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Mar 19 10:00:56.653101 2026] [:error] [pid 25179:tid 25185] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Mar 19 10:00:56.909680 2026] [:error] [pid 25179:tid 25192] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Mar 19 10:00:57.147333 2026] [:error] [pid 25179:tid 25185] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Mar 19 10:00:57.404691 2026] [:error] [pid 25179:tid 25205] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Mar 19 10:00:57.659010 2026] [:error] [pid 25179:tid 25181] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Mar 19 10:00:58.126726 2026] [:error] [pid 25179:tid 25199] [client 209.87.169.39:63109] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Mar 19 10:00:58.395474 2026] [:error] [pid 25179:tid 25198] [client 209.87.169.39:63109] [client 209.87.169.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "abtY2mFzmTtmuBLc_LZT1AAAA5E"]
[Thu Mar 19 10:00:58.907418 2026] [:error] [pid 25044:tid 25070] [client 209.87.169.238:28489] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Mar 19 10:00:59.142656 2026] [:error] [pid 25044:tid 25062] [client 209.87.169.238:28489] [client 209.87.169.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "abtY29UUDKsY7wMywpo1NwAAAs4"]
[Thu Mar 19 10:00:59.674099 2026] [:error] [pid 23988:tid 24015] [client 209.87.169.40:57303] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Mar 19 10:00:59.952458 2026] [:error] [pid 23988:tid 24015] [client 209.87.169.40:57303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Mar 19 10:01:00.279710 2026] [:error] [pid 23988:tid 24015] [client 209.87.169.40:57303] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Mar 19 10:01:00.588753 2026] [:error] [pid 23988:tid 24004] [client 209.87.169.40:57303] [client 209.87.169.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "abtY3GnlkSPXj2matr0whgAAAM0"]
[Thu Mar 19 10:01:01.138012 2026] [:error] [pid 31735:tid 31741] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Mar 19 10:01:01.376076 2026] [:error] [pid 31735:tid 31746] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Mar 19 10:01:01.607456 2026] [:error] [pid 31735:tid 31761] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Mar 19 10:01:01.909253 2026] [:error] [pid 31735:tid 31741] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Mar 19 10:01:03.895546 2026] [:error] [pid 31735:tid 31741] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Mar 19 10:01:04.151587 2026] [:error] [pid 31735:tid 31741] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Mar 19 10:01:04.407250 2026] [:error] [pid 31735:tid 31739] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Mar 19 10:01:04.685697 2026] [:error] [pid 31735:tid 31761] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Mar 19 10:01:04.945192 2026] [:error] [pid 31735:tid 31746] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Mar 19 10:01:05.214000 2026] [:error] [pid 31735:tid 31739] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Mar 19 10:01:05.490075 2026] [:error] [pid 31735:tid 31746] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Mar 19 10:01:05.763670 2026] [:error] [pid 31735:tid 31739] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Mar 19 10:01:06.551551 2026] [:error] [pid 31735:tid 31739] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Mar 19 10:01:06.802662 2026] [:error] [pid 31735:tid 31746] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Mar 19 10:01:07.097447 2026] [:error] [pid 31735:tid 31739] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Mar 19 10:01:07.335584 2026] [:error] [pid 31735:tid 31761] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Mar 19 10:01:11.996357 2026] [:error] [pid 31735:tid 31761] [client 209.87.169.58:35457] [client 209.87.169.58] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "34.162.144.22_4c2edd129f586dfe7c6bd02bf47226f4af937d28"): Internal error (specific information not available) [hostname "rejuva.au"] [uri "/index.html"] [unique_id "abtY43-gyQbRQWJYccxGugAAApY"]
[Thu Mar 19 10:01:12.013614 2026] [:error] [pid 31735:tid 31761] [client 209.87.169.58:35457] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Mar 19 10:01:14.814987 2026] [:error] [pid 31735:tid 31746] [client 209.87.169.57:54375] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Mar 19 10:01:16.173146 2026] [:error] [pid 24971:tid 24996] [client 209.87.169.210:59287] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Mar 19 10:01:17.004834 2026] [:error] [pid 31205:tid 31237] [client 209.87.169.61:62283] [client 209.87.169.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Marvins.php"] [unique_id "abtY7Vu5gZKGrGz5P1FSSwAAAVQ"]
[Thu Mar 19 10:01:17.958051 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.50:33789] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Mar 19 10:01:18.214928 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.50:33789] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Mar 19 10:01:18.489476 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.50:33789] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Mar 19 10:01:19.053188 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.50:33789] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Mar 19 10:01:19.305723 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.50:33789] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Mar 19 10:01:19.577176 2026] [:error] [pid 24925:tid 24932] [client 209.87.169.50:33789] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Mar 19 10:01:23.616210 2026] [:error] [pid 25135:tid 25152] [client 209.87.169.28:62797] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Mar 19 10:01:31.373540 2026] [:error] [pid 31205:tid 31234] [client 209.87.169.210:29835] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Mar 19 10:01:41.812318 2026] [:error] [pid 24971:tid 24978] [client 209.87.169.35:64473] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Mar 19 11:50:20.687407 2026] [:error] [pid 23882:tid 23904] [client 101.32.208.70:44322] [client 101.32.208.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abtyfLWnClbtbN12M79okwAAAAI"]
[Thu Mar 19 12:54:13.765874 2026] [:error] [pid 25269:tid 25285] [client 154.16.49.101:6697] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abuBdcU9ntriqNcU-b7DcgAAA80"]
[Thu Mar 19 12:54:14.260762 2026] [:error] [pid 24925:tid 24945] [client 154.16.49.101:6884] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abuBdvUZEHbnUgjEbWNmwQAAAZA"]
[Thu Mar 19 12:54:14.755518 2026] [:error] [pid 25135:tid 25141] [client 154.16.49.101:7072] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feed/"] [unique_id "abuBdqKtE0dzgMctjFXtfAAAA0Q"]
[Thu Mar 19 13:57:28.962989 2026] [:error] [pid 11110:tid 11133] [client 49.51.141.76:35768] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abuQSASNPqGfikw7k8IvpwAAABI"]
[Thu Mar 19 15:52:47.221517 2026] [:error] [pid 48106:tid 48126] [client 106.54.62.156:43248] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aburT8VZaUGvkz29lZHm9AAAAMw"]
[Thu Mar 19 21:29:52.958740 2026] [:error] [pid 11016:tid 11078] [client 129.226.174.80:37626] [client 129.226.174.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abv6UBPK94J9G19C6uVYNQAAAQU"]
[Thu Mar 19 23:02:20.400704 2026] [:error] [pid 11015:tid 11061] [client 182.42.111.156:56884] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abwP_PPcMwFQZAVfzLSdUAAAAI8"]
[Fri Mar 20 01:14:28.269870 2026] [:error] [pid 46126:tid 46216] [client 209.97.171.56:59508] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "abwu9KQ44YePbsZz3j7MHgAAAQM"]
[Fri Mar 20 01:14:28.589055 2026] [:error] [pid 46264:tid 46292] [client 209.97.171.56:61482] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "abwu9Ip3TruHFmWOt5HWLQAAAAk"]
[Fri Mar 20 02:20:35.217472 2026] [:error] [pid 11258:tid 11276] [client 43.166.129.247:50066] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abw-c5PHb95f6xzHJOczFQAAANA"]
[Fri Mar 20 04:52:44.640938 2026] [:error] [pid 58126:tid 58185] [client 43.130.111.40:42186] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abxiHKKAmdXQSS0Y5KBLKwAAAE0"]
[Fri Mar 20 05:33:34.172446 2026] [:error] [pid 58230:tid 58254] [client 49.235.136.28:53684] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abxrrveBObYxbmHTzfrIKQAAANU"]
[Fri Mar 20 12:08:59.426088 2026] [:error] [pid 49081:tid 49115] [client 119.28.177.175:41618] [client 119.28.177.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "abzIWxo1LBAUhfhYPR1dkgAAAQA"]
[Fri Mar 20 12:11:24.124124 2026] [:error] [pid 49170:tid 49174] [client 106.54.62.156:60144] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "abzI7M-c8ctLVDCqUJX1iQAAAAA"]
[Fri Mar 20 20:13:31.141894 2026] [:error] [pid 49080:tid 49102] [client 216.24.212.20:32285] [client 216.24.212.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.20, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "ab0564k5CHi4V0A3ttgF6AAAAFA"]
[Fri Mar 20 20:13:31.145398 2026] [:error] [pid 49080:tid 49102] [client 216.24.212.20:32285] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri Mar 20 21:01:56.334848 2026] [:error] [pid 49080:tid 49104] [client 136.117.207.67:55368] [client 136.117.207.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.207.67, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "ab1FRIk5CHi4V0A3ttgQoQAAAFI"]
[Fri Mar 20 21:01:56.338972 2026] [:error] [pid 49080:tid 49104] [client 136.117.207.67:55368] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Mar 20 21:01:58.445255 2026] [:error] [pid 49080:tid 49102] [client 136.117.207.67:55368] [client 136.117.207.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ab1FRok5CHi4V0A3ttgQrAAAAFA"]
[Fri Mar 20 21:01:58.847285 2026] [:error] [pid 49082:tid 49145] [client 136.117.207.67:59843] [client 136.117.207.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ab1FRqpllYJI1LUIdL_KogAAAUM"]
[Fri Mar 20 21:01:59.295598 2026] [:error] [pid 49082:tid 49143] [client 136.117.207.67:60069] [client 136.117.207.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "ab1FR6pllYJI1LUIdL_KpgAAAUE"]
[Fri Mar 20 21:01:59.709005 2026] [:error] [pid 49082:tid 49162] [client 136.117.207.67:63908] [client 136.117.207.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "ab1FR6pllYJI1LUIdL_KpwAAAVQ"]
[Fri Mar 20 21:02:00.067288 2026] [:error] [pid 49170:tid 49184] [client 136.117.207.67:59117] [client 136.117.207.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "ab1FSM-c8ctLVDCqUJWNEgAAAAo"]
[Fri Mar 20 21:02:00.487074 2026] [:error] [pid 49170:tid 49178] [client 136.117.207.67:51747] [client 136.117.207.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "ab1FSM-c8ctLVDCqUJWNFQAAAAQ"]
[Fri Mar 20 21:02:00.965226 2026] [:error] [pid 38305:tid 38332] [client 136.117.207.67:58964] [client 136.117.207.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "ab1FSHguiB3cZkKG6iI7pAAAAdQ"]
[Fri Mar 20 22:38:56.686381 2026] [:error] [pid 38378:tid 38390] [client 43.166.255.102:36872] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ab1cAFKb3npPsu9Iib2KLgAAAgg"]
[Sat Mar 21 06:51:04.754818 2026] [:error] [pid 49170:tid 49185] [client 43.153.86.78:43330] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ab3PWL1KUC-QISS0eWorRwAAAQ0"]
[Sat Mar 21 16:24:04.912551 2026] [:error] [pid 43052:tid 43078] [client 49.233.45.47:45838] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ab5VpF5fjm-AiInC1hK4cgAAA5g"]
[Sat Mar 21 19:15:46.354977 2026] [:error] [pid 43052:tid 43056] [client 43.135.133.194:36032] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ab594l5fjm-AiInC1hIFAgAAA4I"]
[Sat Mar 21 21:15:47.132630 2026] [:error] [pid 49170:tid 49188] [client 170.106.163.48:34364] [client 170.106.163.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ab6aA71KUC-QISS0eWoLUAAAARA"]
[Sun Mar 22 01:34:25.854683 2026] [:error] [pid 40782:tid 41039] [client 104.28.214.122:34672] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "ab7WoeaE0aGWZHNA90t-vAAAAIY"]
[Sun Mar 22 02:41:09.203486 2026] [:error] [pid 23666:tid 23675] [client 43.166.1.243:47298] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ab7mRcMCSeYGBmLsLigetAAAAQc"]
[Sun Mar 22 06:22:57.020965 2026] [:error] [pid 51362:tid 51411] [client 182.42.105.144:46463] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ab8aQcOwPm3DXzTDjUe4WgAAAEo"]
[Sun Mar 22 06:47:37.599144 2026] [:error] [pid 51361:tid 51385] [client 43.153.49.151:35316] [client 43.153.49.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ab8gCRXYUsdvKC9YWpU6RgAAAA4"]
[Sun Mar 22 07:33:41.363388 2026] [:error] [pid 40039:tid 40062] [client 54.169.201.79:63711] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "ab8q1R3aDgUJfBYishk8owAAARU"]
[Sun Mar 22 07:33:41.537018 2026] [:error] [pid 51361:tid 51391] [client 54.169.201.79:64512] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ab8q1RXYUsdvKC9YWpVEPQAAABM"]
[Sun Mar 22 07:33:41.710150 2026] [:error] [pid 40039:tid 40044] [client 54.169.201.79:53933] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/media/system/js/core.js"] [unique_id "ab8q1R3aDgUJfBYishk8pQAAAQM"]
[Sun Mar 22 09:45:38.563051 2026] [:error] [pid 51363:tid 51446] [client 43.130.78.203:51150] [client 43.130.78.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ab9Jwlwa9x6OCTRkhl2YyAAAAJA"]
[Sun Mar 22 13:11:29.867411 2026] [:error] [pid 40039:tid 40063] [client 106.54.62.156:41322] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ab96AR3aDgUJfBYishkh6QAAARY"]
[Sun Mar 22 20:26:12.311800 2026] [:error] [pid 30166:tid 30183] [client 106.119.167.146:49362] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ab_f5Lm4_26jKMD0zy3uHAAAAUg"]
[Sun Mar 22 21:22:41.406463 2026] [:error] [pid 51363:tid 51450] [client 20.119.51.14:23759] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Mar 22 21:22:41.615749 2026] [:error] [pid 51363:tid 51429] [client 20.119.51.14:23759] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun Mar 22 21:22:42.035427 2026] [:error] [pid 51363:tid 51453] [client 20.119.51.14:23759] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sun Mar 22 21:22:42.250539 2026] [:error] [pid 51363:tid 51428] [client 20.119.51.14:23759] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Mar 22 21:22:42.668461 2026] [:error] [pid 51363:tid 51434] [client 20.119.51.14:23759] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sun Mar 22 21:22:42.876576 2026] [:error] [pid 51363:tid 51452] [client 20.119.51.14:23759] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun Mar 22 21:22:43.085123 2026] [:error] [pid 51363:tid 51437] [client 20.119.51.14:23759] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sun Mar 22 21:22:43.501424 2026] [:error] [pid 51363:tid 51436] [client 20.119.51.14:23759] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ab_tI1wa9x6OCTRkhl3GPgAAAIc"]
[Sun Mar 22 21:22:44.432491 2026] [:error] [pid 51362:tid 51407] [client 20.119.51.14:24598] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ab_tJMOwPm3DXzTDjUfaogAAAEY"]
[Sun Mar 22 21:22:45.271594 2026] [:error] [pid 30166:tid 30200] [client 20.119.51.14:48866] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ab_tJbm4_26jKMD0zy0YBQAAAVc"]
[Sun Mar 22 21:22:46.103530 2026] [:error] [pid 51361:tid 51376] [client 20.119.51.14:48873] [client 20.119.51.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ab_tJhXYUsdvKC9YWpUIywAAAAU"]
[Mon Mar 23 02:12:41.060199 2026] [:error] [pid 20587:tid 20652] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Mon Mar 23 02:12:41.268767 2026] [:error] [pid 20587:tid 20659] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Mar 23 02:12:41.685354 2026] [:error] [pid 20587:tid 20665] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Mon Mar 23 02:12:41.893006 2026] [:error] [pid 20587:tid 20655] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Mon Mar 23 02:12:42.115046 2026] [:error] [pid 20587:tid 20661] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 23 02:12:42.324379 2026] [:error] [pid 20587:tid 20646] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Mon Mar 23 02:12:42.541100 2026] [:error] [pid 20587:tid 20664] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/fwe.php
[Mon Mar 23 02:12:42.959649 2026] [:error] [pid 20587:tid 20650] [client 20.220.223.1:31730] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Mon Mar 23 02:12:43.168051 2026] [:error] [pid 20587:tid 20647] [client 20.220.223.1:31730] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acAxG4Byf8r3QAk4VXPzYgAAAIQ"]
[Mon Mar 23 02:12:43.627989 2026] [:error] [pid 20856:tid 20940] [client 20.220.223.1:31709] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acAxG8xFtXFVNE-X2-KfvQAAANU"]
[Mon Mar 23 02:12:44.046809 2026] [:error] [pid 20856:tid 20939] [client 20.220.223.1:31623] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acAxHMxFtXFVNE-X2-KfvgAAANQ"]
[Mon Mar 23 02:12:44.482996 2026] [:error] [pid 20584:tid 20639] [client 20.220.223.1:31626] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acAxHCWzr-bD_t6AP_TPLwAAAFc"]
[Mon Mar 23 02:12:44.912937 2026] [:error] [pid 20856:tid 20926] [client 20.220.223.1:31632] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acAxHMxFtXFVNE-X2-KfwwAAAMc"]
[Mon Mar 23 02:12:45.326925 2026] [:error] [pid 20587:tid 20644] [client 20.220.223.1:31721] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acAxHYByf8r3QAk4VXPzZwAAAIE"]
[Mon Mar 23 02:12:45.738168 2026] [:error] [pid 20584:tid 20617] [client 20.220.223.1:31628] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acAxHSWzr-bD_t6AP_TPMgAAAEE"]
[Mon Mar 23 02:12:46.181295 2026] [:error] [pid 20584:tid 20623] [client 20.220.223.1:31742] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acAxHiWzr-bD_t6AP_TPNAAAAEc"]
[Mon Mar 23 02:12:46.694948 2026] [:error] [pid 20574:tid 20596] [client 20.220.223.1:31741] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acAxHtdMXEnEZrwyzJkOxAAAAAc"]
[Mon Mar 23 02:12:47.172161 2026] [:error] [pid 20587:tid 20646] [client 20.220.223.1:31716] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acAxH4Byf8r3QAk4VXPzawAAAIM"]
[Mon Mar 23 02:12:47.630496 2026] [:error] [pid 27776:tid 27849] [client 20.220.223.1:31694] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acAxH43Eaq7IZ5L-4XVcxwAAAQM"]
[Mon Mar 23 02:12:48.054007 2026] [:error] [pid 20574:tid 20597] [client 20.220.223.1:31625] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acAxINdMXEnEZrwyzJkOxwAAAAg"]
[Mon Mar 23 02:12:48.466465 2026] [:error] [pid 20856:tid 20943] [client 20.220.223.1:31685] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acAxIMxFtXFVNE-X2-KfxwAAANg"]
[Mon Mar 23 02:12:48.877502 2026] [:error] [pid 20856:tid 20922] [client 20.220.223.1:31619] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acAxIMxFtXFVNE-X2-KfyAAAAMM"]
[Mon Mar 23 02:12:49.294196 2026] [:error] [pid 20574:tid 20610] [client 20.220.223.1:31617] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acAxIddMXEnEZrwyzJkOywAAABU"]
[Mon Mar 23 02:12:49.730293 2026] [:error] [pid 20856:tid 20930] [client 20.220.223.1:31698] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acAxIcxFtXFVNE-X2-KfzAAAAMs"]
[Mon Mar 23 02:12:50.156083 2026] [:error] [pid 20587:tid 20645] [client 20.220.223.1:31740] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acAxIoByf8r3QAk4VXPzbgAAAII"]
[Mon Mar 23 02:12:50.570177 2026] [:error] [pid 20584:tid 20622] [client 20.220.223.1:31733] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acAxIiWzr-bD_t6AP_TPOAAAAEY"]
[Mon Mar 23 02:12:50.998020 2026] [:error] [pid 20587:tid 20643] [client 20.220.223.1:31566] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acAxIoByf8r3QAk4VXPzbwAAAIA"]
[Mon Mar 23 02:12:51.421994 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31700] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acAxI8xFtXFVNE-X2-Kf0AAAANE"]
[Mon Mar 23 02:12:51.873480 2026] [:error] [pid 20584:tid 20618] [client 20.220.223.1:31711] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acAxIyWzr-bD_t6AP_TPOgAAAEI"]
[Mon Mar 23 02:12:52.284617 2026] [:error] [pid 20587:tid 20654] [client 20.220.223.1:31641] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acAxJIByf8r3QAk4VXPzcgAAAIs"]
[Mon Mar 23 02:12:52.696764 2026] [:error] [pid 20856:tid 20920] [client 20.220.223.1:31714] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acAxJMxFtXFVNE-X2-Kf0wAAAME"]
[Mon Mar 23 02:12:53.163805 2026] [:error] [pid 20587:tid 20656] [client 20.220.223.1:31629] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acAxJYByf8r3QAk4VXPzdAAAAI0"]
[Mon Mar 23 02:12:53.572699 2026] [:error] [pid 20587:tid 20660] [client 20.220.223.1:31618] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acAxJYByf8r3QAk4VXPzdgAAAJE"]
[Mon Mar 23 02:12:54.001966 2026] [:error] [pid 20574:tid 20593] [client 20.220.223.1:31620] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acAxJtdMXEnEZrwyzJkOzgAAAAQ"]
[Mon Mar 23 02:12:54.457357 2026] [:error] [pid 20574:tid 20589] [client 20.220.223.1:31565] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acAxJtdMXEnEZrwyzJkO0AAAAAA"]
[Mon Mar 23 02:12:54.867935 2026] [:error] [pid 20587:tid 20661] [client 20.220.223.1:31707] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acAxJoByf8r3QAk4VXPzeQAAAJI"]
[Mon Mar 23 02:12:55.292494 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:31693] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acAxJ43Eaq7IZ5L-4XVcywAAAQ0"]
[Mon Mar 23 02:12:55.705407 2026] [:error] [pid 20574:tid 20594] [client 20.220.223.1:31621] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acAxJ9dMXEnEZrwyzJkO0wAAAAU"]
[Mon Mar 23 02:12:56.115450 2026] [:error] [pid 20856:tid 20942] [client 20.220.223.1:31678] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acAxKMxFtXFVNE-X2-Kf2gAAANc"]
[Mon Mar 23 02:12:56.527629 2026] [:error] [pid 20574:tid 20603] [client 20.220.223.1:31710] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acAxKNdMXEnEZrwyzJkO1QAAAA4"]
[Mon Mar 23 02:12:56.949060 2026] [:error] [pid 20856:tid 20941] [client 20.220.223.1:31695] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acAxKMxFtXFVNE-X2-Kf2wAAANY"]
[Mon Mar 23 02:12:57.360209 2026] [:error] [pid 20856:tid 20939] [client 20.220.223.1:31719] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acAxKcxFtXFVNE-X2-Kf3QAAANQ"]
[Mon Mar 23 02:12:57.828174 2026] [:error] [pid 20574:tid 20610] [client 20.220.223.1:31560] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acAxKddMXEnEZrwyzJkO2QAAABU"]
[Mon Mar 23 02:12:58.312437 2026] [:error] [pid 20856:tid 20924] [client 20.220.223.1:31728] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acAxKsxFtXFVNE-X2-Kf3wAAAMU"]
[Mon Mar 23 02:12:58.723244 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31736] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acAxKo3Eaq7IZ5L-4XVczgAAARI"]
[Mon Mar 23 02:12:59.139558 2026] [:error] [pid 27776:tid 27862] [client 20.220.223.1:31722] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acAxK43Eaq7IZ5L-4XVc0AAAAQ8"]
[Mon Mar 23 02:12:59.551762 2026] [:error] [pid 20856:tid 20943] [client 20.220.223.1:31718] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acAxK8xFtXFVNE-X2-Kf4QAAANg"]
[Mon Mar 23 02:13:00.032691 2026] [:error] [pid 20574:tid 20592] [client 20.220.223.1:31638] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acAxLNdMXEnEZrwyzJkO3wAAAAM"]
[Mon Mar 23 02:13:00.460304 2026] [:error] [pid 20574:tid 20595] [client 20.220.223.1:31647] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acAxLNdMXEnEZrwyzJkO4QAAAAY"]
[Mon Mar 23 02:13:00.877045 2026] [:error] [pid 20584:tid 20619] [client 20.220.223.1:31705] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acAxLCWzr-bD_t6AP_TPQgAAAEM"]
[Mon Mar 23 02:13:01.313876 2026] [:error] [pid 20574:tid 20609] [client 20.220.223.1:31682] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acAxLddMXEnEZrwyzJkO5QAAABQ"]
[Mon Mar 23 02:13:01.802575 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:31667] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acAxLcxFtXFVNE-X2-Kf5AAAAM8"]
[Mon Mar 23 02:13:02.216039 2026] [:error] [pid 20587:tid 20656] [client 20.220.223.1:31662] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acAxLoByf8r3QAk4VXPzgAAAAI0"]
[Mon Mar 23 02:13:02.654637 2026] [:error] [pid 20587:tid 20648] [client 20.220.223.1:31680] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acAxLoByf8r3QAk4VXPzhAAAAIU"]
[Mon Mar 23 02:13:03.079512 2026] [:error] [pid 20587:tid 20664] [client 20.220.223.1:31602] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acAxL4Byf8r3QAk4VXPziAAAAJU"]
[Mon Mar 23 02:13:03.519285 2026] [:error] [pid 27776:tid 27861] [client 20.220.223.1:31731] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acAxL43Eaq7IZ5L-4XVc1AAAAQ4"]
[Mon Mar 23 02:13:03.971930 2026] [:error] [pid 20584:tid 20626] [client 20.220.223.1:31631] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acAxLyWzr-bD_t6AP_TPRwAAAEo"]
[Mon Mar 23 02:13:04.401549 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31671] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acAxMMxFtXFVNE-X2-Kf5wAAAMo"]
[Mon Mar 23 02:13:04.828135 2026] [:error] [pid 20584:tid 20640] [client 20.220.223.1:31653] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acAxMCWzr-bD_t6AP_TPSwAAAFg"]
[Mon Mar 23 02:13:05.241211 2026] [:error] [pid 20574:tid 20611] [client 20.220.223.1:31715] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acAxMddMXEnEZrwyzJkO6AAAABY"]
[Mon Mar 23 02:13:05.683442 2026] [:error] [pid 20584:tid 20617] [client 20.220.223.1:31656] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acAxMSWzr-bD_t6AP_TPTAAAAEE"]
[Mon Mar 23 02:13:06.125657 2026] [:error] [pid 20574:tid 20600] [client 20.220.223.1:31734] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acAxMtdMXEnEZrwyzJkO6gAAAAs"]
[Mon Mar 23 02:13:06.563990 2026] [:error] [pid 27776:tid 27855] [client 20.220.223.1:31686] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acAxMo3Eaq7IZ5L-4XVc2AAAAQk"]
[Mon Mar 23 02:13:07.004084 2026] [:error] [pid 27776:tid 27868] [client 20.220.223.1:31654] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acAxM43Eaq7IZ5L-4XVc2gAAARU"]
[Mon Mar 23 02:13:07.416720 2026] [:error] [pid 20856:tid 20938] [client 20.220.223.1:31665] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acAxM8xFtXFVNE-X2-Kf7QAAANM"]
[Mon Mar 23 02:13:07.840671 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31738] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acAxM43Eaq7IZ5L-4XVc3wAAAQY"]
[Mon Mar 23 02:13:08.320172 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:31658] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acAxNMxFtXFVNE-X2-Kf7wAAAM8"]
[Mon Mar 23 02:13:08.735069 2026] [:error] [pid 27776:tid 27872] [client 20.220.223.1:31724] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acAxNI3Eaq7IZ5L-4XVc4wAAARg"]
[Mon Mar 23 02:13:09.170463 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31650] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acAxNcxFtXFVNE-X2-Kf8gAAAMo"]
[Mon Mar 23 02:13:09.587409 2026] [:error] [pid 20856:tid 20941] [client 20.220.223.1:31677] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acAxNcxFtXFVNE-X2-Kf9AAAANY"]
[Mon Mar 23 02:13:10.004026 2026] [:error] [pid 20587:tid 20655] [client 20.220.223.1:31735] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acAxNoByf8r3QAk4VXPzjgAAAIw"]
[Mon Mar 23 02:13:10.438522 2026] [:error] [pid 20574:tid 20603] [client 20.220.223.1:31699] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acAxNtdMXEnEZrwyzJkO7AAAAA4"]
[Mon Mar 23 02:13:10.855723 2026] [:error] [pid 20584:tid 20627] [client 20.220.223.1:31558] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acAxNiWzr-bD_t6AP_TPUAAAAEs"]
[Mon Mar 23 02:13:11.267670 2026] [:error] [pid 20856:tid 20919] [client 20.220.223.1:31743] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acAxN8xFtXFVNE-X2-Kf-gAAAMA"]
[Mon Mar 23 02:13:11.698161 2026] [:error] [pid 20574:tid 20590] [client 20.220.223.1:31635] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acAxN9dMXEnEZrwyzJkO8AAAAAE"]
[Mon Mar 23 02:13:12.129221 2026] [:error] [pid 20574:tid 20608] [client 20.220.223.1:31663] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acAxONdMXEnEZrwyzJkO8QAAABM"]
[Mon Mar 23 02:13:12.600881 2026] [:error] [pid 20574:tid 20602] [client 20.220.223.1:31674] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acAxONdMXEnEZrwyzJkO9AAAAA0"]
[Mon Mar 23 02:13:13.013801 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31684] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acAxOcxFtXFVNE-X2-KgAQAAAMo"]
[Mon Mar 23 02:13:13.501840 2026] [:error] [pid 20584:tid 20623] [client 20.220.223.1:31649] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acAxOSWzr-bD_t6AP_TPVwAAAEc"]
[Mon Mar 23 02:13:13.953209 2026] [:error] [pid 20574:tid 20604] [client 20.220.223.1:31676] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acAxOddMXEnEZrwyzJkO9gAAAA8"]
[Mon Mar 23 02:13:14.381778 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31652] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acAxOo3Eaq7IZ5L-4XVc5QAAARI"]
[Mon Mar 23 02:13:14.833135 2026] [:error] [pid 20856:tid 20926] [client 20.220.223.1:31601] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acAxOsxFtXFVNE-X2-KgAgAAAMc"]
[Mon Mar 23 02:13:15.277573 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31655] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acAxO43Eaq7IZ5L-4XVc6AAAAQY"]
[Mon Mar 23 02:13:15.865680 2026] [:error] [pid 20856:tid 20925] [client 20.220.223.1:31739] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acAxO8xFtXFVNE-X2-KgBQAAAMY"]
[Mon Mar 23 02:13:16.349827 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:31600] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acAxPMxFtXFVNE-X2-KgCAAAAM0"]
[Mon Mar 23 02:13:16.793481 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:31639] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acAxPMxFtXFVNE-X2-KgCwAAAMw"]
[Mon Mar 23 02:13:17.420217 2026] [:error] [pid 20856:tid 20920] [client 20.220.223.1:31664] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acAxPcxFtXFVNE-X2-KgDgAAAME"]
[Mon Mar 23 02:13:17.860460 2026] [:error] [pid 27776:tid 27858] [client 20.220.223.1:31578] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acAxPY3Eaq7IZ5L-4XVc7wAAAQs"]
[Mon Mar 23 02:13:18.471995 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31717] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acAxPo3Eaq7IZ5L-4XVc8wAAARI"]
[Mon Mar 23 02:13:18.884196 2026] [:error] [pid 20574:tid 20591] [client 20.220.223.1:31624] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acAxPtdMXEnEZrwyzJkO_AAAAAI"]
[Mon Mar 23 02:13:19.303808 2026] [:error] [pid 20856:tid 20942] [client 20.220.223.1:31580] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acAxP8xFtXFVNE-X2-KgFQAAANc"]
[Mon Mar 23 02:13:19.717484 2026] [:error] [pid 20574:tid 20605] [client 20.220.223.1:31638] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acAxP9dMXEnEZrwyzJkO_QAAABA"]
[Mon Mar 23 02:13:20.155455 2026] [:error] [pid 20856:tid 20921] [client 20.220.223.1:31702] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acAxQMxFtXFVNE-X2-KgFwAAAMI"]
[Mon Mar 23 02:13:20.570446 2026] [:error] [pid 20574:tid 20601] [client 20.220.223.1:31552] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acAxQNdMXEnEZrwyzJkPAQAAAAw"]
[Mon Mar 23 02:13:21.002645 2026] [:error] [pid 27776:tid 27871] [client 20.220.223.1:31564] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acAxQY3Eaq7IZ5L-4XVc9wAAARc"]
[Mon Mar 23 02:13:21.423279 2026] [:error] [pid 20574:tid 20593] [client 20.220.223.1:31568] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acAxQddMXEnEZrwyzJkPBAAAAAQ"]
[Mon Mar 23 02:13:21.848276 2026] [:error] [pid 20856:tid 20943] [client 20.220.223.1:31651] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acAxQcxFtXFVNE-X2-KgGwAAANg"]
[Mon Mar 23 02:13:22.265933 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:31713] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acAxQsxFtXFVNE-X2-KgHgAAAM0"]
[Mon Mar 23 02:13:22.764147 2026] [:error] [pid 20587:tid 20650] [client 20.220.223.1:31640] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acAxQoByf8r3QAk4VXPzlgAAAIc"]
[Mon Mar 23 02:13:23.185252 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31562] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acAxQ8xFtXFVNE-X2-KgIwAAAMo"]
[Mon Mar 23 02:13:23.631786 2026] [:error] [pid 20856:tid 20941] [client 20.220.223.1:31646] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxQ8xFtXFVNE-X2-KgJAAAANY"]
[Mon Mar 23 02:13:24.063641 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31637] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxRI3Eaq7IZ5L-4XVc_wAAAQY"]
[Mon Mar 23 02:13:24.491855 2026] [:error] [pid 20856:tid 20924] [client 20.220.223.1:31633] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxRMxFtXFVNE-X2-KgJwAAAMU"]
[Mon Mar 23 02:13:24.904881 2026] [:error] [pid 27776:tid 27854] [client 20.220.223.1:31584] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxRI3Eaq7IZ5L-4XVdBQAAAQg"]
[Mon Mar 23 02:13:25.334758 2026] [:error] [pid 27776:tid 27850] [client 20.220.223.1:31599] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxRY3Eaq7IZ5L-4XVdCQAAAQQ"]
[Mon Mar 23 02:13:25.748957 2026] [:error] [pid 27776:tid 27868] [client 20.220.223.1:31579] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxRY3Eaq7IZ5L-4XVdCgAAARU"]
[Mon Mar 23 02:13:26.167722 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31570] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxRsxFtXFVNE-X2-KgLAAAAM4"]
[Mon Mar 23 02:13:26.614925 2026] [:error] [pid 20574:tid 20603] [client 20.220.223.1:31720] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxRtdMXEnEZrwyzJkPCAAAAA4"]
[Mon Mar 23 02:13:27.061527 2026] [:error] [pid 27776:tid 27871] [client 20.220.223.1:31697] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acAxR43Eaq7IZ5L-4XVdDAAAARc"]
[Mon Mar 23 02:13:27.511471 2026] [:error] [pid 27776:tid 27859] [client 20.220.223.1:31572] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxR43Eaq7IZ5L-4XVdEAAAAQw"]
[Mon Mar 23 02:13:27.934213 2026] [:error] [pid 20587:tid 20645] [client 20.220.223.1:31627] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxR4Byf8r3QAk4VXPzmgAAAII"]
[Mon Mar 23 02:13:28.344742 2026] [:error] [pid 20584:tid 20618] [client 20.220.223.1:31644] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxSCWzr-bD_t6AP_TPcAAAAEI"]
[Mon Mar 23 02:13:28.757607 2026] [:error] [pid 20574:tid 20605] [client 20.220.223.1:31725] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acAxSNdMXEnEZrwyzJkPCwAAABA"]
[Mon Mar 23 02:13:29.215126 2026] [:error] [pid 20587:tid 20660] [client 20.220.223.1:31657] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acAxSYByf8r3QAk4VXPznQAAAJE"]
[Mon Mar 23 02:13:29.646191 2026] [:error] [pid 20856:tid 20923] [client 20.220.223.1:31529] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acAxScxFtXFVNE-X2-KgLwAAAMQ"]
[Mon Mar 23 02:13:30.065671 2026] [:error] [pid 20856:tid 20935] [client 20.220.223.1:31581] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acAxSsxFtXFVNE-X2-KgMQAAANA"]
[Mon Mar 23 02:13:30.478798 2026] [:error] [pid 20856:tid 20939] [client 20.220.223.1:31605] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acAxSsxFtXFVNE-X2-KgNAAAANQ"]
[Mon Mar 23 02:13:30.927417 2026] [:error] [pid 20587:tid 20646] [client 20.220.223.1:31512] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxSoByf8r3QAk4VXPzoAAAAIM"]
[Mon Mar 23 02:13:31.374221 2026] [:error] [pid 20584:tid 20626] [client 20.220.223.1:31703] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxSyWzr-bD_t6AP_TPdAAAAEo"]
[Mon Mar 23 02:13:31.898491 2026] [:error] [pid 20587:tid 20661] [client 20.220.223.1:31555] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxS4Byf8r3QAk4VXPzowAAAJI"]
[Mon Mar 23 02:13:32.317960 2026] [:error] [pid 20584:tid 20624] [client 20.220.223.1:31661] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxTCWzr-bD_t6AP_TPdwAAAEg"]
[Mon Mar 23 02:13:32.869606 2026] [:error] [pid 20587:tid 20647] [client 20.220.223.1:31582] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acAxTIByf8r3QAk4VXPzpQAAAIQ"]
[Mon Mar 23 02:13:33.365555 2026] [:error] [pid 20584:tid 20634] [client 20.220.223.1:31604] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acAxTSWzr-bD_t6AP_TPfAAAAFI"]
[Mon Mar 23 02:13:33.801458 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31588] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acAxTY3Eaq7IZ5L-4XVdGgAAAQY"]
[Mon Mar 23 02:13:34.227016 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:31591] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acAxTsxFtXFVNE-X2-KgNwAAAM0"]
[Mon Mar 23 02:13:34.641540 2026] [:error] [pid 20856:tid 20941] [client 20.220.223.1:31571] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "acAxTsxFtXFVNE-X2-KgOQAAANY"]
[Mon Mar 23 02:13:35.224086 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31616] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "acAxT43Eaq7IZ5L-4XVdGwAAAQc"]
[Mon Mar 23 02:13:35.669757 2026] [:error] [pid 20856:tid 20926] [client 20.220.223.1:31642] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "acAxT8xFtXFVNE-X2-KgPAAAAMc"]
[Mon Mar 23 02:13:36.120080 2026] [:error] [pid 20584:tid 20618] [client 20.220.223.1:31669] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "acAxUCWzr-bD_t6AP_TPfwAAAEI"]
[Mon Mar 23 02:13:36.582382 2026] [:error] [pid 27776:tid 27855] [client 20.220.223.1:31509] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxUI3Eaq7IZ5L-4XVdHwAAAQk"]
[Mon Mar 23 02:13:36.995672 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31648] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxUI3Eaq7IZ5L-4XVdIAAAAQI"]
[Mon Mar 23 02:13:37.566882 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:31576] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxUY3Eaq7IZ5L-4XVdIwAAAQ0"]
[Mon Mar 23 02:13:38.055488 2026] [:error] [pid 27776:tid 27849] [client 20.220.223.1:31610] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acAxUo3Eaq7IZ5L-4XVdJgAAAQM"]
[Mon Mar 23 02:13:38.469755 2026] [:error] [pid 20856:tid 20940] [client 20.220.223.1:31704] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acAxUsxFtXFVNE-X2-KgQQAAANU"]
[Mon Mar 23 02:13:38.881762 2026] [:error] [pid 20584:tid 20635] [client 20.220.223.1:31492] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acAxUiWzr-bD_t6AP_TPhgAAAFM"]
[Mon Mar 23 02:13:39.303283 2026] [:error] [pid 20584:tid 20627] [client 20.220.223.1:31737] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acAxUyWzr-bD_t6AP_TPhwAAAEs"]
[Mon Mar 23 02:13:39.718297 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31726] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acAxU8xFtXFVNE-X2-KgRQAAAMo"]
[Mon Mar 23 02:13:40.130730 2026] [:error] [pid 20856:tid 20926] [client 20.220.223.1:31453] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "acAxVMxFtXFVNE-X2-KgSQAAAMc"]
[Mon Mar 23 02:13:40.571549 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31622] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "acAxVI3Eaq7IZ5L-4XVdLAAAAQY"]
[Mon Mar 23 02:13:41.033597 2026] [:error] [pid 27776:tid 27855] [client 20.220.223.1:31706] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "acAxVY3Eaq7IZ5L-4XVdLwAAAQk"]
[Mon Mar 23 02:13:41.448850 2026] [:error] [pid 20856:tid 20925] [client 20.220.223.1:31583] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "acAxVcxFtXFVNE-X2-KgSwAAAMY"]
[Mon Mar 23 02:13:41.895555 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31518] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "acAxVcxFtXFVNE-X2-KgTQAAAM4"]
[Mon Mar 23 02:13:42.327891 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31569] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 23 02:13:42.788508 2026] [:error] [pid 20856:tid 20930] [client 20.220.223.1:31569] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Mar 23 02:13:42.998185 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31569] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Mon Mar 23 02:13:43.208620 2026] [:error] [pid 20856:tid 20921] [client 20.220.223.1:31569] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Mon Mar 23 02:13:43.416015 2026] [:error] [pid 20856:tid 20942] [client 20.220.223.1:31569] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 23 02:13:43.622769 2026] [:error] [pid 20856:tid 20937] [client 20.220.223.1:31569] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Mar 23 02:13:43.845834 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31569] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Mon Mar 23 02:13:44.679969 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31569] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acAxWMxFtXFVNE-X2-KgbAAAANE"]
[Mon Mar 23 02:13:45.172032 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31727] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acAxWY3Eaq7IZ5L-4XVdNwAAARE"]
[Mon Mar 23 02:13:45.601026 2026] [:error] [pid 20574:tid 20612] [client 20.220.223.1:31643] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acAxWddMXEnEZrwyzJkPFwAAABc"]
[Mon Mar 23 02:13:46.037902 2026] [:error] [pid 20856:tid 20943] [client 20.220.223.1:31672] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acAxWsxFtXFVNE-X2-KgcQAAANg"]
[Mon Mar 23 02:13:46.505248 2026] [:error] [pid 20574:tid 20607] [client 20.220.223.1:31729] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acAxWtdMXEnEZrwyzJkPGQAAABI"]
[Mon Mar 23 02:13:46.950928 2026] [:error] [pid 27776:tid 27871] [client 20.220.223.1:31720] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acAxWo3Eaq7IZ5L-4XVdPwAAARc"]
[Mon Mar 23 02:13:47.401537 2026] [:error] [pid 20584:tid 20640] [client 20.220.223.1:31659] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acAxWyWzr-bD_t6AP_TPkQAAAFg"]
[Mon Mar 23 02:13:47.833586 2026] [:error] [pid 20574:tid 20610] [client 20.220.223.1:31608] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acAxW9dMXEnEZrwyzJkPGwAAABU"]
[Mon Mar 23 02:13:48.262454 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31636] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acAxXI3Eaq7IZ5L-4XVdQwAAARE"]
[Mon Mar 23 02:13:48.691710 2026] [:error] [pid 20856:tid 20919] [client 20.220.223.1:31679] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acAxXMxFtXFVNE-X2-KgeQAAAMA"]
[Mon Mar 23 02:13:49.137726 2026] [:error] [pid 27776:tid 27847] [client 20.220.223.1:31499] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acAxXY3Eaq7IZ5L-4XVdRwAAAQE"]
[Mon Mar 23 02:13:49.561941 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31520] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acAxXY3Eaq7IZ5L-4XVdSQAAARY"]
[Mon Mar 23 02:13:49.986459 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:31573] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acAxXY3Eaq7IZ5L-4XVdTgAAARM"]
[Mon Mar 23 02:13:50.398132 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:31590] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acAxXo3Eaq7IZ5L-4XVdUwAAAQ0"]
[Mon Mar 23 02:13:50.930047 2026] [:error] [pid 27776:tid 27846] [client 20.220.223.1:31595] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acAxXo3Eaq7IZ5L-4XVdVwAAAQA"]
[Mon Mar 23 02:13:51.391834 2026] [:error] [pid 20574:tid 20605] [client 20.220.223.1:31559] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acAxX9dMXEnEZrwyzJkPIAAAABA"]
[Mon Mar 23 02:13:51.808168 2026] [:error] [pid 20856:tid 20930] [client 20.220.223.1:31574] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxX8xFtXFVNE-X2-KggAAAAMs"]
[Mon Mar 23 02:13:52.254576 2026] [:error] [pid 20856:tid 20923] [client 20.220.223.1:31553] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxYMxFtXFVNE-X2-KgggAAAMQ"]
[Mon Mar 23 02:13:52.673869 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31679] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxYMxFtXFVNE-X2-KghAAAANE"]
[Mon Mar 23 02:13:53.091592 2026] [:error] [pid 20587:tid 20658] [client 20.220.223.1:31681] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acAxYYByf8r3QAk4VXPzsAAAAI8"]
[Mon Mar 23 02:13:53.505781 2026] [:error] [pid 20584:tid 20629] [client 20.220.223.1:31543] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acAxYSWzr-bD_t6AP_TPlQAAAE0"]
[Mon Mar 23 02:13:53.954439 2026] [:error] [pid 20856:tid 20920] [client 20.220.223.1:31585] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acAxYcxFtXFVNE-X2-KgiAAAAME"]
[Mon Mar 23 02:13:54.385716 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31505] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acAxYsxFtXFVNE-X2-KgigAAAM4"]
[Mon Mar 23 02:13:54.836736 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31603] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acAxYo3Eaq7IZ5L-4XVdZwAAARY"]
[Mon Mar 23 02:13:55.266988 2026] [:error] [pid 27776:tid 27861] [client 20.220.223.1:31593] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acAxY43Eaq7IZ5L-4XVdaQAAAQ4"]
[Mon Mar 23 02:13:55.694664 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31689] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acAxY43Eaq7IZ5L-4XVdbQAAAQI"]
[Mon Mar 23 02:13:56.125557 2026] [:error] [pid 20584:tid 20635] [client 20.220.223.1:31614] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acAxZCWzr-bD_t6AP_TPlgAAAFM"]
[Mon Mar 23 02:13:56.585288 2026] [:error] [pid 20574:tid 20598] [client 20.220.223.1:31540] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acAxZNdMXEnEZrwyzJkPIwAAAAk"]
[Mon Mar 23 02:13:57.034907 2026] [:error] [pid 20574:tid 20610] [client 20.220.223.1:31613] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acAxZddMXEnEZrwyzJkPJwAAABU"]
[Mon Mar 23 02:13:57.465605 2026] [:error] [pid 20574:tid 20606] [client 20.220.223.1:31530] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acAxZddMXEnEZrwyzJkPKgAAABE"]
[Mon Mar 23 02:13:57.911501 2026] [:error] [pid 20587:tid 20653] [client 20.220.223.1:31708] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acAxZYByf8r3QAk4VXPztwAAAIo"]
[Mon Mar 23 02:13:58.346760 2026] [:error] [pid 20574:tid 20600] [client 20.220.223.1:31675] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acAxZtdMXEnEZrwyzJkPLAAAAAs"]
[Mon Mar 23 02:13:58.822977 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:31732] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acAxZsxFtXFVNE-X2-KgkgAAAM8"]
[Mon Mar 23 02:13:59.266508 2026] [:error] [pid 20856:tid 20919] [client 20.220.223.1:31587] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acAxZ8xFtXFVNE-X2-KglAAAAMA"]
[Mon Mar 23 02:13:59.678055 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31525] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acAxZ8xFtXFVNE-X2-KglgAAAM4"]
[Mon Mar 23 02:14:00.093596 2026] [:error] [pid 20574:tid 20590] [client 20.220.223.1:31688] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acAxaNdMXEnEZrwyzJkPLgAAAAE"]
[Mon Mar 23 02:14:00.530647 2026] [:error] [pid 20587:tid 20663] [client 20.220.223.1:31544] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acAxaIByf8r3QAk4VXPzvwAAAJQ"]
[Mon Mar 23 02:14:00.946276 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:31502] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acAxaMxFtXFVNE-X2-KgmQAAAM0"]
[Mon Mar 23 02:14:01.401332 2026] [:error] [pid 20856:tid 20923] [client 20.220.223.1:31701] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acAxacxFtXFVNE-X2-KgmwAAAMQ"]
[Mon Mar 23 02:14:01.817967 2026] [:error] [pid 20587:tid 20648] [client 20.220.223.1:31488] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acAxaYByf8r3QAk4VXPzwAAAAIU"]
[Mon Mar 23 02:14:02.258366 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31494] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acAxasxFtXFVNE-X2-KgnQAAANE"]
[Mon Mar 23 02:14:02.670888 2026] [:error] [pid 20574:tid 20602] [client 20.220.223.1:31548] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acAxatdMXEnEZrwyzJkPNAAAAA0"]
[Mon Mar 23 02:14:03.092989 2026] [:error] [pid 20587:tid 20644] [client 20.220.223.1:31690] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acAxa4Byf8r3QAk4VXPzwwAAAIE"]
[Mon Mar 23 02:14:03.516455 2026] [:error] [pid 27776:tid 27855] [client 20.220.223.1:31510] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acAxa43Eaq7IZ5L-4XVdfAAAAQk"]
[Mon Mar 23 02:14:03.946250 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31660] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acAxa43Eaq7IZ5L-4XVdfgAAARI"]
[Mon Mar 23 02:14:04.358543 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31511] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acAxbI3Eaq7IZ5L-4XVdgAAAAQc"]
[Mon Mar 23 02:14:04.774951 2026] [:error] [pid 20856:tid 20924] [client 20.220.223.1:31524] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acAxbMxFtXFVNE-X2-KgpwAAAMU"]
[Mon Mar 23 02:14:05.223338 2026] [:error] [pid 20856:tid 20926] [client 20.220.223.1:31491] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acAxbcxFtXFVNE-X2-KgqAAAAMc"]
[Mon Mar 23 02:14:05.705629 2026] [:error] [pid 20856:tid 20928] [client 20.220.223.1:31514] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acAxbcxFtXFVNE-X2-KgqgAAAMk"]
[Mon Mar 23 02:14:06.129191 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31557] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acAxbsxFtXFVNE-X2-KgqwAAANE"]
[Mon Mar 23 02:14:06.551637 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:31533] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acAxbsxFtXFVNE-X2-KgrQAAAMw"]
[Mon Mar 23 02:14:06.983026 2026] [:error] [pid 20856:tid 20925] [client 20.220.223.1:31489] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acAxbsxFtXFVNE-X2-KgrwAAAMY"]
[Mon Mar 23 02:14:07.409590 2026] [:error] [pid 20587:tid 20651] [client 20.220.223.1:31493] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acAxb4Byf8r3QAk4VXPzyAAAAIg"]
[Mon Mar 23 02:14:07.823494 2026] [:error] [pid 20587:tid 20666] [client 20.220.223.1:31513] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acAxb4Byf8r3QAk4VXPzyQAAAJc"]
[Mon Mar 23 02:14:08.233735 2026] [:error] [pid 20856:tid 20923] [client 20.220.223.1:31561] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acAxcMxFtXFVNE-X2-KgtAAAAMQ"]
[Mon Mar 23 02:14:08.653500 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31517] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acAxcMxFtXFVNE-X2-KgtgAAANE"]
[Mon Mar 23 02:14:09.087861 2026] [:error] [pid 20574:tid 20599] [client 20.220.223.1:31577] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acAxcddMXEnEZrwyzJkPOAAAAAo"]
[Mon Mar 23 02:14:09.516301 2026] [:error] [pid 20856:tid 20920] [client 20.220.223.1:31673] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acAxccxFtXFVNE-X2-KguwAAAME"]
[Mon Mar 23 02:14:09.968023 2026] [:error] [pid 20856:tid 20924] [client 20.220.223.1:31515] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acAxccxFtXFVNE-X2-KgvAAAAMU"]
[Mon Mar 23 02:14:10.397043 2026] [:error] [pid 20574:tid 20603] [client 20.220.223.1:31594] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acAxctdMXEnEZrwyzJkPOgAAAA4"]
[Mon Mar 23 02:14:10.854433 2026] [:error] [pid 20856:tid 20939] [client 20.220.223.1:31431] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acAxcsxFtXFVNE-X2-KgwAAAANQ"]
[Mon Mar 23 02:14:11.331079 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:31490] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acAxc8xFtXFVNE-X2-KgwwAAAMw"]
[Mon Mar 23 02:14:11.793319 2026] [:error] [pid 20856:tid 20928] [client 20.220.223.1:31586] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acAxc8xFtXFVNE-X2-KgxAAAAMk"]
[Mon Mar 23 02:14:12.265154 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31501] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acAxdMxFtXFVNE-X2-KgxwAAAMo"]
[Mon Mar 23 02:14:12.680117 2026] [:error] [pid 20574:tid 20604] [client 20.220.223.1:31526] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acAxdNdMXEnEZrwyzJkPQAAAAA8"]
[Mon Mar 23 02:14:13.120383 2026] [:error] [pid 20574:tid 20601] [client 20.220.223.1:31433] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acAxdddMXEnEZrwyzJkPQwAAAAw"]
[Mon Mar 23 02:14:13.533370 2026] [:error] [pid 27776:tid 27862] [client 20.220.223.1:31542] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acAxdY3Eaq7IZ5L-4XVdkQAAAQ8"]
[Mon Mar 23 02:14:13.961416 2026] [:error] [pid 27776:tid 27849] [client 20.220.223.1:31495] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acAxdY3Eaq7IZ5L-4XVdlAAAAQM"]
[Mon Mar 23 02:14:14.448422 2026] [:error] [pid 20856:tid 20942] [client 20.220.223.1:31545] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "acAxdsxFtXFVNE-X2-KgzAAAANc"]
[Mon Mar 23 02:14:14.862590 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:31645] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "acAxdo3Eaq7IZ5L-4XVdlgAAAQ0"]
[Mon Mar 23 02:14:15.287103 2026] [:error] [pid 20856:tid 20928] [client 20.220.223.1:31634] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "acAxd8xFtXFVNE-X2-KgzgAAAMk"]
[Mon Mar 23 02:14:15.700270 2026] [:error] [pid 27776:tid 27872] [client 20.220.223.1:31454] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "acAxd43Eaq7IZ5L-4XVdmgAAARg"]
[Mon Mar 23 02:14:16.117706 2026] [:error] [pid 20574:tid 20591] [client 20.220.223.1:31519] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "acAxeNdMXEnEZrwyzJkPSAAAAAI"]
[Mon Mar 23 02:14:16.546360 2026] [:error] [pid 20587:tid 20665] [client 20.220.223.1:31506] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "acAxeIByf8r3QAk4VXPzzwAAAJY"]
[Mon Mar 23 02:14:16.986686 2026] [:error] [pid 20587:tid 20653] [client 20.220.223.1:31712] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "acAxeIByf8r3QAk4VXPz0QAAAIo"]
[Mon Mar 23 02:14:17.441038 2026] [:error] [pid 20856:tid 20941] [client 20.220.223.1:31470] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "acAxecxFtXFVNE-X2-Kg0gAAANY"]
[Mon Mar 23 02:14:17.875659 2026] [:error] [pid 20584:tid 20639] [client 20.220.223.1:31435] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "acAxeSWzr-bD_t6AP_TPnQAAAFc"]
[Mon Mar 23 02:14:18.312113 2026] [:error] [pid 20584:tid 20620] [client 20.220.223.1:31424] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acAxeiWzr-bD_t6AP_TPnwAAAEQ"]
[Mon Mar 23 02:14:18.723930 2026] [:error] [pid 20584:tid 20625] [client 20.220.223.1:31439] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acAxeiWzr-bD_t6AP_TPoAAAAEk"]
[Mon Mar 23 02:14:19.137481 2026] [:error] [pid 20574:tid 20604] [client 20.220.223.1:31551] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acAxe9dMXEnEZrwyzJkPSwAAAA8"]
[Mon Mar 23 02:14:19.591103 2026] [:error] [pid 20574:tid 20610] [client 20.220.223.1:31503] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acAxe9dMXEnEZrwyzJkPTAAAABU"]
[Mon Mar 23 02:14:20.005019 2026] [:error] [pid 20574:tid 20609] [client 20.220.223.1:31432] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acAxfNdMXEnEZrwyzJkPTQAAABQ"]
[Mon Mar 23 02:14:20.435777 2026] [:error] [pid 20574:tid 20608] [client 20.220.223.1:31443] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acAxfNdMXEnEZrwyzJkPUAAAABM"]
[Mon Mar 23 02:14:20.974658 2026] [:error] [pid 20574:tid 20590] [client 20.220.223.1:31450] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acAxfNdMXEnEZrwyzJkPUgAAAAE"]
[Mon Mar 23 02:14:21.423442 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:31535] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acAxfY3Eaq7IZ5L-4XVdpAAAAQ0"]
[Mon Mar 23 02:14:21.856617 2026] [:error] [pid 20584:tid 20631] [client 20.220.223.1:31567] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "acAxfSWzr-bD_t6AP_TPpwAAAE8"]
[Mon Mar 23 02:14:22.328025 2026] [:error] [pid 20574:tid 20598] [client 20.220.223.1:31498] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "acAxftdMXEnEZrwyzJkPVQAAAAk"]
[Mon Mar 23 02:14:22.743441 2026] [:error] [pid 27776:tid 27858] [client 20.220.223.1:31630] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "acAxfo3Eaq7IZ5L-4XVdpQAAAQs"]
[Mon Mar 23 02:14:23.166750 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31477] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "acAxf43Eaq7IZ5L-4XVdpwAAAQI"]
[Mon Mar 23 02:14:23.641690 2026] [:error] [pid 27776:tid 27854] [client 20.220.223.1:31448] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "acAxf43Eaq7IZ5L-4XVdqQAAAQg"]
[Mon Mar 23 02:14:24.076270 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31497] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acAxgI3Eaq7IZ5L-4XVdqwAAARI"]
[Mon Mar 23 02:14:24.518944 2026] [:error] [pid 20856:tid 20940] [client 20.220.223.1:31469] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acAxgMxFtXFVNE-X2-Kg2wAAANU"]
[Mon Mar 23 02:14:24.939590 2026] [:error] [pid 20856:tid 20938] [client 20.220.223.1:31528] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acAxgMxFtXFVNE-X2-Kg3AAAANM"]
[Mon Mar 23 02:14:25.387032 2026] [:error] [pid 20574:tid 20604] [client 20.220.223.1:31607] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acAxgddMXEnEZrwyzJkPVgAAAA8"]
[Mon Mar 23 02:14:25.948707 2026] [:error] [pid 27776:tid 27858] [client 20.220.223.1:31425] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acAxgY3Eaq7IZ5L-4XVdsQAAAQs"]
[Mon Mar 23 02:14:26.413957 2026] [:error] [pid 27776:tid 27854] [client 20.220.223.1:31589] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "acAxgo3Eaq7IZ5L-4XVdswAAAQg"]
[Mon Mar 23 02:14:26.856673 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31537] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "acAxgo3Eaq7IZ5L-4XVdtgAAARI"]
[Mon Mar 23 02:14:27.268362 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:31427] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "acAxg43Eaq7IZ5L-4XVdtwAAARM"]
[Mon Mar 23 02:14:27.739028 2026] [:error] [pid 27776:tid 27857] [client 20.220.223.1:31612] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "acAxg43Eaq7IZ5L-4XVduQAAAQo"]
[Mon Mar 23 02:14:28.161535 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31556] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acAxhI3Eaq7IZ5L-4XVdvAAAARY"]
[Mon Mar 23 02:14:28.576594 2026] [:error] [pid 20574:tid 20609] [client 20.220.223.1:31508] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acAxhNdMXEnEZrwyzJkPWQAAABQ"]
[Mon Mar 23 02:14:28.993933 2026] [:error] [pid 27776:tid 27854] [client 20.220.223.1:31596] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acAxhI3Eaq7IZ5L-4XVdwAAAAQg"]
[Mon Mar 23 02:14:29.408267 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31615] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acAxhY3Eaq7IZ5L-4XVdxQAAAQc"]
[Mon Mar 23 02:14:30.069988 2026] [:error] [pid 27776:tid 27857] [client 20.220.223.1:31396] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "acAxho3Eaq7IZ5L-4XVdyAAAAQo"]
[Mon Mar 23 02:14:30.488249 2026] [:error] [pid 20574:tid 20590] [client 20.220.223.1:31609] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "acAxhtdMXEnEZrwyzJkPXAAAAAE"]
[Mon Mar 23 02:14:30.906335 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31440] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "acAxho3Eaq7IZ5L-4XVdzwAAAQI"]
[Mon Mar 23 02:14:31.410525 2026] [:error] [pid 20856:tid 20937] [client 20.220.223.1:31441] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/function.php"] [unique_id "acAxh8xFtXFVNE-X2-Kg3wAAANI"]
[Mon Mar 23 02:14:31.837456 2026] [:error] [pid 20856:tid 20919] [client 20.220.223.1:31539] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acAxh8xFtXFVNE-X2-Kg4AAAAMA"]
[Mon Mar 23 02:14:32.277423 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:31506] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acAxiMxFtXFVNE-X2-Kg5AAAAM8"]
[Mon Mar 23 02:14:32.775805 2026] [:error] [pid 27776:tid 27872] [client 20.220.223.1:31455] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acAxiI3Eaq7IZ5L-4XVd0wAAARg"]
[Mon Mar 23 02:14:33.206544 2026] [:error] [pid 20574:tid 20603] [client 20.220.223.1:31507] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acAxiddMXEnEZrwyzJkPXwAAAA4"]
[Mon Mar 23 02:14:33.629612 2026] [:error] [pid 20574:tid 20591] [client 20.220.223.1:31468] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "acAxiddMXEnEZrwyzJkPYAAAAAI"]
[Mon Mar 23 02:14:34.158983 2026] [:error] [pid 20856:tid 20922] [client 20.220.223.1:31465] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "acAxisxFtXFVNE-X2-Kg5gAAAMM"]
[Mon Mar 23 02:14:34.662341 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31466] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "acAxisxFtXFVNE-X2-Kg6QAAAM4"]
[Mon Mar 23 02:14:35.135998 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31523] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/colors/blue/index.php"] [unique_id "acAxi43Eaq7IZ5L-4XVd2gAAAQI"]
[Mon Mar 23 02:14:35.615589 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31527] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "acAxi43Eaq7IZ5L-4XVd2wAAARE"]
[Mon Mar 23 02:14:36.033056 2026] [:error] [pid 20587:tid 20663] [client 20.220.223.1:31446] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "acAxjIByf8r3QAk4VXPz1gAAAJQ"]
[Mon Mar 23 02:14:36.606559 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31687] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "acAxjI3Eaq7IZ5L-4XVd3QAAAQY"]
[Mon Mar 23 02:14:37.028656 2026] [:error] [pid 20574:tid 20604] [client 20.220.223.1:31484] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/security.php"] [unique_id "acAxjddMXEnEZrwyzJkPZAAAAA8"]
[Mon Mar 23 02:14:37.447909 2026] [:error] [pid 20587:tid 20660] [client 20.220.223.1:31563] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "acAxjYByf8r3QAk4VXPz1wAAAJE"]
[Mon Mar 23 02:14:37.881095 2026] [:error] [pid 20584:tid 20627] [client 20.220.223.1:31554] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "acAxjSWzr-bD_t6AP_TPrgAAAEs"]
[Mon Mar 23 02:14:38.306851 2026] [:error] [pid 20574:tid 20613] [client 20.220.223.1:31366] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "acAxjtdMXEnEZrwyzJkPZwAAABg"]
[Mon Mar 23 02:14:38.737537 2026] [:error] [pid 20584:tid 20617] [client 20.220.223.1:31459] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/about.php"] [unique_id "acAxjiWzr-bD_t6AP_TPsAAAAEE"]
[Mon Mar 23 02:14:39.164146 2026] [:error] [pid 20584:tid 20633] [client 20.220.223.1:31500] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "acAxjyWzr-bD_t6AP_TPsQAAAFE"]
[Mon Mar 23 02:14:39.633346 2026] [:error] [pid 20584:tid 20632] [client 20.220.223.1:31611] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "acAxjyWzr-bD_t6AP_TPsgAAAFA"]
[Mon Mar 23 02:14:40.144584 2026] [:error] [pid 20584:tid 20628] [client 20.220.223.1:31460] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "acAxkCWzr-bD_t6AP_TPtQAAAEw"]
[Mon Mar 23 02:14:40.669559 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:31536] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "acAxkI3Eaq7IZ5L-4XVd4QAAARM"]
[Mon Mar 23 02:14:41.116002 2026] [:error] [pid 20587:tid 20654] [client 20.220.223.1:31449] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acAxkYByf8r3QAk4VXPz2wAAAIs"]
[Mon Mar 23 02:14:41.654620 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31597] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acAxkY3Eaq7IZ5L-4XVd5QAAARE"]
[Mon Mar 23 02:14:42.110278 2026] [:error] [pid 20584:tid 20630] [client 20.220.223.1:31363] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acAxkiWzr-bD_t6AP_TPtwAAAE4"]
[Mon Mar 23 02:14:42.641791 2026] [:error] [pid 20584:tid 20626] [client 20.220.223.1:31442] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acAxkiWzr-bD_t6AP_TPuQAAAEo"]
[Mon Mar 23 02:14:43.099697 2026] [:error] [pid 20584:tid 20622] [client 20.220.223.1:31668] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acAxkyWzr-bD_t6AP_TPugAAAEY"]
[Mon Mar 23 02:14:43.601484 2026] [:error] [pid 20584:tid 20623] [client 20.220.223.1:31462] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acAxkyWzr-bD_t6AP_TPvAAAAEc"]
[Mon Mar 23 02:14:45.596927 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:31670] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Mon Mar 23 02:14:47.876462 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:31670] File does not exist: /usr/local/apache/htdocs/suspended-page/bless5.php
[Mon Mar 23 02:14:48.083094 2026] [:error] [pid 20856:tid 20941] [client 20.220.223.1:31670] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "acAxmMxFtXFVNE-X2-KhCwAAANY"]
[Mon Mar 23 02:14:48.797918 2026] [:error] [pid 20587:tid 20667] [client 20.220.223.1:31505] [client 20.220.223.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "acAxmIByf8r3QAk4VXPz4gAAAJg"]
[Mon Mar 23 02:14:49.249586 2026] [:error] [pid 27776:tid 27851] [client 20.220.223.1:31379] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Mar 23 02:14:49.457868 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:31379] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Mar 23 02:14:49.662767 2026] [:error] [pid 27776:tid 27847] [client 20.220.223.1:31379] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acAxmY3Eaq7IZ5L-4XVd7QAAAQE"]
[Mon Mar 23 02:14:50.111960 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31496] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acAxmo3Eaq7IZ5L-4XVd7wAAAQI"]
[Mon Mar 23 02:14:50.532698 2026] [:error] [pid 27776:tid 27854] [client 20.220.223.1:31476] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acAxmo3Eaq7IZ5L-4XVd8QAAAQg"]
[Mon Mar 23 02:14:51.072470 2026] [:error] [pid 27776:tid 27849] [client 20.220.223.1:31606] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acAxm43Eaq7IZ5L-4XVd8gAAAQM"]
[Mon Mar 23 02:14:51.499220 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31487] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acAxm43Eaq7IZ5L-4XVd9gAAAQY"]
[Mon Mar 23 02:14:51.960127 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31692] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acAxm43Eaq7IZ5L-4XVd-AAAARY"]
[Mon Mar 23 02:14:52.436829 2026] [:error] [pid 20856:tid 20925] [client 20.220.223.1:31429] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acAxnMxFtXFVNE-X2-KhEwAAAMY"]
[Mon Mar 23 02:14:52.893191 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:31466] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acAxnI3Eaq7IZ5L-4XVd-wAAARM"]
[Mon Mar 23 02:14:53.447153 2026] [:error] [pid 20574:tid 20611] [client 20.220.223.1:31666] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acAxnddMXEnEZrwyzJkPbgAAABY"]
[Mon Mar 23 02:14:53.871599 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31516] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acAxnY3Eaq7IZ5L-4XVd_gAAAQI"]
[Mon Mar 23 02:14:54.288314 2026] [:error] [pid 27776:tid 27846] [client 20.220.223.1:31541] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acAxno3Eaq7IZ5L-4XVeAAAAAQA"]
[Mon Mar 23 02:14:54.972509 2026] [:error] [pid 27776:tid 27863] [client 20.220.223.1:31538] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acAxno3Eaq7IZ5L-4XVeAwAAARA"]
[Mon Mar 23 02:14:55.532250 2026] [:error] [pid 20584:tid 20638] [client 20.220.223.1:31467] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acAxnyWzr-bD_t6AP_TPwwAAAFY"]
[Mon Mar 23 02:14:56.097956 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:31411] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acAxoMxFtXFVNE-X2-KhGwAAAM8"]
[Mon Mar 23 02:14:56.804351 2026] [:error] [pid 20856:tid 20926] [client 20.220.223.1:31598] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acAxoMxFtXFVNE-X2-KhHAAAAMc"]
[Mon Mar 23 02:14:57.727513 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:31534] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acAxocxFtXFVNE-X2-KhIQAAAMw"]
[Mon Mar 23 02:14:58.272388 2026] [:error] [pid 27776:tid 27858] [client 20.220.223.1:31461] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acAxoo3Eaq7IZ5L-4XVeCwAAAQs"]
[Mon Mar 23 02:14:58.956752 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31437] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acAxoo3Eaq7IZ5L-4XVeDQAAARE"]
[Mon Mar 23 02:14:59.562877 2026] [:error] [pid 20574:tid 20612] [client 20.220.223.1:31445] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acAxo9dMXEnEZrwyzJkPcAAAABc"]
[Mon Mar 23 02:15:00.085472 2026] [:error] [pid 20856:tid 20924] [client 20.220.223.1:31385] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acAxpMxFtXFVNE-X2-KhIwAAAMU"]
[Mon Mar 23 02:15:00.732747 2026] [:error] [pid 20856:tid 20920] [client 20.220.223.1:31452] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acAxpMxFtXFVNE-X2-KhJAAAAME"]
[Mon Mar 23 02:15:01.362592 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31372] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acAxpY3Eaq7IZ5L-4XVeFwAAAQI"]
[Mon Mar 23 02:15:02.058954 2026] [:error] [pid 20856:tid 20939] [client 20.220.223.1:31371] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acAxpsxFtXFVNE-X2-KhJgAAANQ"]
[Mon Mar 23 02:15:02.504144 2026] [:error] [pid 20587:tid 20666] [client 20.220.223.1:31434] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acAxpoByf8r3QAk4VXPz8gAAAJc"]
[Mon Mar 23 02:15:03.026431 2026] [:error] [pid 20584:tid 20636] [client 20.220.223.1:31414] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acAxpyWzr-bD_t6AP_TPzQAAAFQ"]
[Mon Mar 23 02:15:03.506766 2026] [:error] [pid 20587:tid 20648] [client 20.220.223.1:31474] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acAxp4Byf8r3QAk4VXPz9gAAAIU"]
[Mon Mar 23 02:15:03.968130 2026] [:error] [pid 20584:tid 20624] [client 20.220.223.1:31547] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acAxpyWzr-bD_t6AP_TPzwAAAEg"]
[Mon Mar 23 02:15:04.575625 2026] [:error] [pid 20574:tid 20597] [client 20.220.223.1:31463] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acAxqNdMXEnEZrwyzJkPdwAAAAg"]
[Mon Mar 23 02:15:05.063557 2026] [:error] [pid 20587:tid 20654] [client 20.220.223.1:31392] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acAxqYByf8r3QAk4VXPz9wAAAIs"]
[Mon Mar 23 02:15:05.868123 2026] [:error] [pid 20587:tid 20661] [client 20.220.223.1:31401] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acAxqYByf8r3QAk4VXPz-QAAAJI"]
[Mon Mar 23 02:15:06.780120 2026] [:error] [pid 20574:tid 20601] [client 20.220.223.1:31485] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acAxqtdMXEnEZrwyzJkPgAAAAAw"]
[Mon Mar 23 02:15:07.449801 2026] [:error] [pid 20587:tid 20645] [client 20.220.223.1:31531] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acAxq4Byf8r3QAk4VXPz_QAAAII"]
[Mon Mar 23 02:15:07.978419 2026] [:error] [pid 20584:tid 20616] [client 20.220.223.1:31472] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acAxqyWzr-bD_t6AP_TP0wAAAEA"]
[Mon Mar 23 02:15:08.472431 2026] [:error] [pid 20587:tid 20648] [client 20.220.223.1:31370] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acAxrIByf8r3QAk4VXP0BAAAAIU"]
[Mon Mar 23 02:15:08.913537 2026] [:error] [pid 20856:tid 20923] [client 20.220.223.1:31378] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acAxrMxFtXFVNE-X2-KhJwAAAMQ"]
[Mon Mar 23 02:15:09.503257 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31384] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acAxrY3Eaq7IZ5L-4XVeHwAAAQI"]
[Mon Mar 23 02:15:10.014387 2026] [:error] [pid 27776:tid 27859] [client 20.220.223.1:31309] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acAxro3Eaq7IZ5L-4XVeIQAAAQw"]
[Mon Mar 23 02:15:10.598707 2026] [:error] [pid 20574:tid 20595] [client 20.220.223.1:31451] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acAxrtdMXEnEZrwyzJkPggAAAAY"]
[Mon Mar 23 02:15:11.023953 2026] [:error] [pid 27776:tid 27857] [client 20.220.223.1:31549] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acAxr43Eaq7IZ5L-4XVeJAAAAQo"]
[Mon Mar 23 02:15:11.605121 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31386] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acAxr43Eaq7IZ5L-4XVeJQAAAQc"]
[Mon Mar 23 02:15:12.034046 2026] [:error] [pid 20584:tid 20640] [client 20.220.223.1:31389] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acAxsCWzr-bD_t6AP_TP1gAAAFg"]
[Mon Mar 23 02:15:12.445433 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:31422] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acAxsI3Eaq7IZ5L-4XVeKgAAARM"]
[Mon Mar 23 02:15:12.945185 2026] [:error] [pid 20856:tid 20925] [client 20.220.223.1:31683] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acAxsMxFtXFVNE-X2-KhLQAAAMY"]
[Mon Mar 23 02:15:13.365858 2026] [:error] [pid 20574:tid 20602] [client 20.220.223.1:31381] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acAxsddMXEnEZrwyzJkPhQAAAA0"]
[Mon Mar 23 02:15:13.780883 2026] [:error] [pid 27776:tid 27861] [client 20.220.223.1:31464] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acAxsY3Eaq7IZ5L-4XVeKwAAAQ4"]
[Mon Mar 23 02:15:14.318682 2026] [:error] [pid 27776:tid 27858] [client 20.220.223.1:31311] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acAxso3Eaq7IZ5L-4XVeLAAAAQs"]
[Mon Mar 23 02:15:14.866572 2026] [:error] [pid 20856:tid 20929] [client 20.220.223.1:31691] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acAxssxFtXFVNE-X2-KhLwAAAMo"]
[Mon Mar 23 02:15:15.450455 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31373] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acAxs8xFtXFVNE-X2-KhMAAAAM4"]
[Mon Mar 23 02:15:15.936779 2026] [:error] [pid 20584:tid 20633] [client 20.220.223.1:31360] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acAxsyWzr-bD_t6AP_TP2AAAAFE"]
[Mon Mar 23 02:15:16.418249 2026] [:error] [pid 20856:tid 20942] [client 20.220.223.1:31400] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acAxtMxFtXFVNE-X2-KhNAAAANc"]
[Mon Mar 23 02:15:16.884413 2026] [:error] [pid 20587:tid 20659] [client 20.220.223.1:31486] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acAxtIByf8r3QAk4VXP0DAAAAJA"]
[Mon Mar 23 02:15:17.408359 2026] [:error] [pid 20856:tid 20927] [client 20.220.223.1:31395] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acAxtcxFtXFVNE-X2-KhOAAAAMg"]
[Mon Mar 23 02:15:17.839103 2026] [:error] [pid 27776:tid 27855] [client 20.220.223.1:31592] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acAxtY3Eaq7IZ5L-4XVeMwAAAQk"]
[Mon Mar 23 02:15:18.461780 2026] [:error] [pid 27776:tid 27854] [client 20.220.223.1:31362] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acAxto3Eaq7IZ5L-4XVeNQAAAQg"]
[Mon Mar 23 02:15:19.224998 2026] [:error] [pid 20856:tid 20931] [client 20.220.223.1:31473] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acAxt8xFtXFVNE-X2-KhPQAAAMw"]
[Mon Mar 23 02:15:19.640669 2026] [:error] [pid 20574:tid 20605] [client 20.220.223.1:31482] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acAxt9dMXEnEZrwyzJkPiAAAABA"]
[Mon Mar 23 02:15:20.168785 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31457] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acAxuI3Eaq7IZ5L-4XVeOgAAARE"]
[Mon Mar 23 02:15:20.631692 2026] [:error] [pid 20587:tid 20645] [client 20.220.223.1:31336] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acAxuIByf8r3QAk4VXP0EAAAAII"]
[Mon Mar 23 02:15:21.266683 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31387] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acAxuY3Eaq7IZ5L-4XVeQAAAARY"]
[Mon Mar 23 02:15:22.304070 2026] [:error] [pid 20584:tid 20624] [client 20.220.223.1:31483] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acAxuiWzr-bD_t6AP_TP2wAAAEg"]
[Mon Mar 23 02:15:22.888897 2026] [:error] [pid 27776:tid 27871] [client 20.220.223.1:31383] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acAxuo3Eaq7IZ5L-4XVeRQAAARc"]
[Mon Mar 23 02:15:23.694109 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31409] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acAxu43Eaq7IZ5L-4XVeRwAAAQc"]
[Mon Mar 23 02:15:24.218917 2026] [:error] [pid 27776:tid 27851] [client 20.220.223.1:31368] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acAxvI3Eaq7IZ5L-4XVeSgAAAQU"]
[Mon Mar 23 02:15:24.793625 2026] [:error] [pid 27776:tid 27872] [client 20.220.223.1:31532] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acAxvI3Eaq7IZ5L-4XVeSwAAARg"]
[Mon Mar 23 02:15:25.260064 2026] [:error] [pid 20574:tid 20595] [client 20.220.223.1:31345] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acAxvddMXEnEZrwyzJkPjgAAAAY"]
[Mon Mar 23 02:15:25.766553 2026] [:error] [pid 20856:tid 20920] [client 20.220.223.1:31406] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acAxvcxFtXFVNE-X2-KhTgAAAME"]
[Mon Mar 23 02:15:26.463305 2026] [:error] [pid 20584:tid 20638] [client 20.220.223.1:31394] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acAxviWzr-bD_t6AP_TP3QAAAFY"]
[Mon Mar 23 02:15:27.244476 2026] [:error] [pid 20856:tid 20923] [client 20.220.223.1:31475] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acAxv8xFtXFVNE-X2-KhUQAAAMQ"]
[Mon Mar 23 02:15:27.850458 2026] [:error] [pid 20856:tid 20927] [client 20.220.223.1:31315] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acAxv8xFtXFVNE-X2-KhUwAAAMg"]
[Mon Mar 23 02:15:28.516165 2026] [:error] [pid 20856:tid 20932] [client 20.220.223.1:31479] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acAxwMxFtXFVNE-X2-KhVQAAAM0"]
[Mon Mar 23 02:15:29.179199 2026] [:error] [pid 20584:tid 20631] [client 20.220.223.1:31456] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acAxwSWzr-bD_t6AP_TP4AAAAE8"]
[Mon Mar 23 02:15:29.695062 2026] [:error] [pid 20584:tid 20621] [client 20.220.223.1:31382] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acAxwSWzr-bD_t6AP_TP4QAAAEU"]
[Mon Mar 23 02:15:30.428210 2026] [:error] [pid 20584:tid 20622] [client 20.220.223.1:31306] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acAxwiWzr-bD_t6AP_TP4gAAAEY"]
[Mon Mar 23 02:15:31.014202 2026] [:error] [pid 20587:tid 20660] [client 20.220.223.1:31236] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acAxw4Byf8r3QAk4VXP0FwAAAJE"]
[Mon Mar 23 02:15:31.521063 2026] [:error] [pid 20587:tid 20665] [client 20.220.223.1:31504] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acAxw4Byf8r3QAk4VXP0GgAAAJY"]
[Mon Mar 23 02:15:32.128173 2026] [:error] [pid 20856:tid 20939] [client 20.220.223.1:31524] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acAxxMxFtXFVNE-X2-KhYAAAANQ"]
[Mon Mar 23 02:15:32.814570 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31575] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acAxxI3Eaq7IZ5L-4XVeUgAAARI"]
[Mon Mar 23 02:15:33.381631 2026] [:error] [pid 27776:tid 27849] [client 20.220.223.1:31393] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acAxxY3Eaq7IZ5L-4XVeVAAAAQM"]
[Mon Mar 23 02:15:33.840963 2026] [:error] [pid 20584:tid 20623] [client 20.220.223.1:31438] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acAxxSWzr-bD_t6AP_TP5gAAAEc"]
[Mon Mar 23 02:15:34.378496 2026] [:error] [pid 20587:tid 20644] [client 20.220.223.1:31426] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acAxxoByf8r3QAk4VXP0HQAAAIE"]
[Mon Mar 23 02:15:34.808892 2026] [:error] [pid 20584:tid 20632] [client 20.220.223.1:31374] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acAxxiWzr-bD_t6AP_TP6wAAAFA"]
[Mon Mar 23 02:15:35.385200 2026] [:error] [pid 20584:tid 20624] [client 20.220.223.1:31421] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acAxxyWzr-bD_t6AP_TP7AAAAEg"]
[Mon Mar 23 02:15:35.946672 2026] [:error] [pid 27776:tid 27868] [client 20.220.223.1:31587] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acAxx43Eaq7IZ5L-4XVeWQAAARU"]
[Mon Mar 23 02:15:36.495013 2026] [:error] [pid 27776:tid 27857] [client 20.220.223.1:31423] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acAxyI3Eaq7IZ5L-4XVeWgAAAQo"]
[Mon Mar 23 02:15:36.963743 2026] [:error] [pid 20587:tid 20643] [client 20.220.223.1:31478] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "acAxyIByf8r3QAk4VXP0HgAAAIA"]
[Mon Mar 23 02:15:37.467446 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31367] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "acAxyY3Eaq7IZ5L-4XVeXwAAAQc"]
[Mon Mar 23 02:15:37.892908 2026] [:error] [pid 20587:tid 20649] [client 20.220.223.1:31550] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "acAxyYByf8r3QAk4VXP0HwAAAIY"]
[Mon Mar 23 02:15:38.415491 2026] [:error] [pid 20856:tid 20926] [client 20.220.223.1:31388] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "acAxysxFtXFVNE-X2-KhbQAAAMc"]
[Mon Mar 23 02:15:38.929936 2026] [:error] [pid 20574:tid 20609] [client 20.220.223.1:31312] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "acAxytdMXEnEZrwyzJkPkwAAABQ"]
[Mon Mar 23 02:15:39.346370 2026] [:error] [pid 20574:tid 20605] [client 20.220.223.1:31376] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "acAxy9dMXEnEZrwyzJkPlAAAABA"]
[Mon Mar 23 02:15:39.758931 2026] [:error] [pid 20574:tid 20604] [client 20.220.223.1:31407] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "acAxy9dMXEnEZrwyzJkPlgAAAA8"]
[Mon Mar 23 02:15:40.253536 2026] [:error] [pid 20574:tid 20592] [client 20.220.223.1:31351] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "acAxzNdMXEnEZrwyzJkPmAAAAAM"]
[Mon Mar 23 02:15:40.814815 2026] [:error] [pid 20574:tid 20603] [client 20.220.223.1:31481] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "acAxzNdMXEnEZrwyzJkPmwAAAA4"]
[Mon Mar 23 02:15:41.229416 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31296] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "acAxzY3Eaq7IZ5L-4XVeZAAAARY"]
[Mon Mar 23 02:15:41.705276 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31480] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "acAxzY3Eaq7IZ5L-4XVeZwAAARE"]
[Mon Mar 23 02:15:42.145879 2026] [:error] [pid 20574:tid 20590] [client 20.220.223.1:31301] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "acAxztdMXEnEZrwyzJkPnAAAAAE"]
[Mon Mar 23 02:15:42.718947 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31402] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "acAxzsxFtXFVNE-X2-KhcAAAANE"]
[Mon Mar 23 02:15:43.140795 2026] [:error] [pid 20574:tid 20597] [client 20.220.223.1:31458] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "acAxz9dMXEnEZrwyzJkPngAAAAg"]
[Mon Mar 23 02:15:43.692100 2026] [:error] [pid 20574:tid 20598] [client 20.220.223.1:31375] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "acAxz9dMXEnEZrwyzJkPnwAAAAk"]
[Mon Mar 23 02:15:44.123996 2026] [:error] [pid 27776:tid 27849] [client 20.220.223.1:31390] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class9.php"] [unique_id "acAx0I3Eaq7IZ5L-4XVeaQAAAQM"]
[Mon Mar 23 02:15:44.612047 2026] [:error] [pid 27776:tid 27863] [client 20.220.223.1:31546] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "acAx0I3Eaq7IZ5L-4XVeagAAARA"]
[Mon Mar 23 02:15:45.177326 2026] [:error] [pid 27776:tid 27860] [client 20.220.223.1:31346] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "acAx0Y3Eaq7IZ5L-4XVebAAAAQ0"]
[Mon Mar 23 02:15:45.607938 2026] [:error] [pid 20574:tid 20605] [client 20.220.223.1:31380] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "acAx0ddMXEnEZrwyzJkPowAAABA"]
[Mon Mar 23 02:15:46.020926 2026] [:error] [pid 20584:tid 20622] [client 20.220.223.1:31377] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "acAx0iWzr-bD_t6AP_TP8AAAAEY"]
[Mon Mar 23 02:15:46.487874 2026] [:error] [pid 27776:tid 27866] [client 20.220.223.1:31420] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "acAx0o3Eaq7IZ5L-4XVebwAAARM"]
[Mon Mar 23 02:15:46.913079 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31314] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "acAx0sxFtXFVNE-X2-KhdQAAAM4"]
[Mon Mar 23 02:15:47.351266 2026] [:error] [pid 20587:tid 20660] [client 20.220.223.1:31614] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "acAx04Byf8r3QAk4VXP0JAAAAJE"]
[Mon Mar 23 02:15:47.859747 2026] [:error] [pid 20574:tid 20601] [client 20.220.223.1:31304] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless11.php"] [unique_id "acAx09dMXEnEZrwyzJkPpgAAAAw"]
[Mon Mar 23 02:15:48.311592 2026] [:error] [pid 27776:tid 27858] [client 20.220.223.1:31302] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "acAx1I3Eaq7IZ5L-4XVecgAAAQs"]
[Mon Mar 23 02:15:48.901207 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31471] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "acAx1I3Eaq7IZ5L-4XVedAAAAQc"]
[Mon Mar 23 02:15:49.557770 2026] [:error] [pid 27776:tid 27859] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Mon Mar 23 02:15:49.799557 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/ton.php
[Mon Mar 23 02:15:50.007479 2026] [:error] [pid 27776:tid 27849] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/403.php
[Mon Mar 23 02:15:50.220767 2026] [:error] [pid 27776:tid 27855] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/file9.php
[Mon Mar 23 02:15:50.432027 2026] [:error] [pid 27776:tid 27851] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/ac.php
[Mon Mar 23 02:15:50.656199 2026] [:error] [pid 27776:tid 27872] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Mon Mar 23 02:15:50.875535 2026] [:error] [pid 27776:tid 27852] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/pop.php
[Mon Mar 23 02:15:51.084059 2026] [:error] [pid 27776:tid 27862] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/az.php
[Mon Mar 23 02:15:51.294155 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/xaz.php
[Mon Mar 23 02:15:51.503483 2026] [:error] [pid 27776:tid 27868] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/up4.php
[Mon Mar 23 02:15:51.963998 2026] [:error] [pid 27776:tid 27853] [client 20.220.223.1:31361] File does not exist: /usr/local/apache/htdocs/suspended-page/1aa.php
[Mon Mar 23 02:15:52.340592 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31361] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acAx2I3Eaq7IZ5L-4XVehgAAARI"]
[Mon Mar 23 02:15:53.060484 2026] [:error] [pid 20856:tid 20936] [client 20.220.223.1:31317] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acAx2cxFtXFVNE-X2-KhfAAAANE"]
[Mon Mar 23 02:15:53.492061 2026] [:error] [pid 27776:tid 27864] [client 20.220.223.1:31398] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acAx2Y3Eaq7IZ5L-4XVejAAAARE"]
[Mon Mar 23 02:15:54.014009 2026] [:error] [pid 20584:tid 20619] [client 20.220.223.1:31412] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acAx2iWzr-bD_t6AP_TP9gAAAEM"]
[Mon Mar 23 02:15:54.426589 2026] [:error] [pid 20856:tid 20930] [client 20.220.223.1:31364] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acAx2sxFtXFVNE-X2-KhgAAAAMs"]
[Mon Mar 23 02:15:54.978972 2026] [:error] [pid 20574:tid 20612] [client 20.220.223.1:31300] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acAx2tdMXEnEZrwyzJkPsAAAABc"]
[Mon Mar 23 02:15:55.409000 2026] [:error] [pid 20584:tid 20630] [client 20.220.223.1:31256] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acAx2yWzr-bD_t6AP_TP-gAAAE4"]
[Mon Mar 23 02:15:55.868523 2026] [:error] [pid 20574:tid 20594] [client 20.220.223.1:31238] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acAx29dMXEnEZrwyzJkPswAAAAU"]
[Mon Mar 23 02:15:56.306052 2026] [:error] [pid 20574:tid 20595] [client 20.220.223.1:31696] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acAx3NdMXEnEZrwyzJkPtAAAAAY"]
[Mon Mar 23 02:15:56.723455 2026] [:error] [pid 20587:tid 20662] [client 20.220.223.1:31416] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acAx3IByf8r3QAk4VXP0JQAAAJM"]
[Mon Mar 23 02:15:57.196213 2026] [:error] [pid 20574:tid 20590] [client 20.220.223.1:31322] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acAx3ddMXEnEZrwyzJkPtgAAAAE"]
[Mon Mar 23 02:15:57.992617 2026] [:error] [pid 20856:tid 20919] [client 20.220.223.1:31428] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acAx3cxFtXFVNE-X2-KhhQAAAMA"]
[Mon Mar 23 02:15:58.470610 2026] [:error] [pid 20584:tid 20629] [client 20.220.223.1:31297] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acAx3iWzr-bD_t6AP_TP_gAAAE0"]
[Mon Mar 23 02:15:59.094473 2026] [:error] [pid 20856:tid 20934] [client 20.220.223.1:31268] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acAx38xFtXFVNE-X2-KhiwAAAM8"]
[Mon Mar 23 02:15:59.562283 2026] [:error] [pid 20856:tid 20933] [client 20.220.223.1:31316] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acAx38xFtXFVNE-X2-KhjgAAAM4"]
[Mon Mar 23 02:16:00.216831 2026] [:error] [pid 20587:tid 20650] [client 20.220.223.1:31313] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acAx4IByf8r3QAk4VXP0KwAAAIc"]
[Mon Mar 23 02:16:04.690289 2026] [:error] [pid 20856:tid 20943] [client 20.220.223.1:31333] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acAx5MxFtXFVNE-X2-KhugAAANg"]
[Mon Mar 23 02:16:05.640786 2026] [:error] [pid 27776:tid 27867] [client 20.220.223.1:31410] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acAx5Y3Eaq7IZ5L-4XVelwAAARQ"]
[Mon Mar 23 02:16:06.507322 2026] [:error] [pid 27776:tid 27861] [client 20.220.223.1:31325] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acAx5o3Eaq7IZ5L-4XVemgAAAQ4"]
[Mon Mar 23 02:16:07.131424 2026] [:error] [pid 27776:tid 27859] [client 20.220.223.1:31417] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acAx543Eaq7IZ5L-4XVengAAAQw"]
[Mon Mar 23 02:16:07.720160 2026] [:error] [pid 20574:tid 20611] [client 20.220.223.1:31399] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acAx59dMXEnEZrwyzJkPugAAABY"]
[Mon Mar 23 02:16:08.363337 2026] [:error] [pid 27776:tid 27851] [client 20.220.223.1:31356] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acAx6I3Eaq7IZ5L-4XVeoAAAAQU"]
[Mon Mar 23 02:16:09.124186 2026] [:error] [pid 27776:tid 27870] [client 20.220.223.1:31243] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acAx6Y3Eaq7IZ5L-4XVepAAAARY"]
[Mon Mar 23 02:16:09.595497 2026] [:error] [pid 27776:tid 27858] [client 20.220.223.1:31415] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acAx6Y3Eaq7IZ5L-4XVeqQAAAQs"]
[Mon Mar 23 02:16:10.183718 2026] [:error] [pid 27776:tid 27865] [client 20.220.223.1:31447] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acAx6o3Eaq7IZ5L-4XVerAAAARI"]
[Mon Mar 23 02:16:11.130208 2026] [:error] [pid 27776:tid 27867] [client 20.220.223.1:31337] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acAx643Eaq7IZ5L-4XVesgAAARQ"]
[Mon Mar 23 02:16:11.839804 2026] [:error] [pid 27776:tid 27848] [client 20.220.223.1:31444] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acAx643Eaq7IZ5L-4XVeuAAAAQI"]
[Mon Mar 23 02:16:12.513840 2026] [:error] [pid 20587:tid 20647] [client 20.220.223.1:31340] [client 20.220.223.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acAx7IByf8r3QAk4VXP0MQAAAIQ"]
[Mon Mar 23 04:47:03.980856 2026] [:error] [pid 57265:tid 57289] [client 43.166.247.82:47388] [client 43.166.247.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acBVR2NLjPJJkhuqCsiWKwAAARY"]
[Mon Mar 23 10:09:19.988468 2026] [:error] [pid 14573:tid 14597] [client 119.96.24.54:45288] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acCgz--oSmHn3q4_J1EW0gAAAVY"]
[Mon Mar 23 14:51:54.075460 2026] [:error] [pid 35165:tid 35178] [client 43.166.128.86:47906] [client 43.166.128.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acDjCs6udpN6Esk7JKtx1gAAAYo"]
[Mon Mar 23 16:59:51.298447 2026] [:error] [pid 14573:tid 14582] [client 170.106.35.137:53326] [client 170.106.35.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acEBB--oSmHn3q4_J1GbvwAAAUc"]
[Mon Mar 23 18:32:59.924588 2026] [:error] [pid 35165:tid 35183] [client 20.85.212.10:59019] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 23 18:33:00.152824 2026] [:error] [pid 35165:tid 35191] [client 20.85.212.10:59019] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 23 18:33:00.608886 2026] [:error] [pid 35165:tid 35173] [client 20.85.212.10:59019] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 23 18:33:00.837072 2026] [:error] [pid 35165:tid 35188] [client 20.85.212.10:59019] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 23 18:33:01.296090 2026] [:error] [pid 35165:tid 35171] [client 20.85.212.10:59019] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Mar 23 18:33:01.525375 2026] [:error] [pid 35165:tid 35192] [client 20.85.212.10:59019] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Mar 23 18:33:01.752609 2026] [:error] [pid 35165:tid 35177] [client 20.85.212.10:59019] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Mar 23 18:33:02.204207 2026] [:error] [pid 35165:tid 35191] [client 20.85.212.10:59019] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEW3s6udpN6Esk7JKu6UwAAAZc"]
[Mon Mar 23 18:33:03.088695 2026] [:error] [pid 23439:tid 23463] [client 20.85.212.10:19605] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEW36Zv8XIzUKdgaMeRwgAAAA4"]
[Mon Mar 23 18:33:03.943880 2026] [:error] [pid 23441:tid 23516] [client 20.85.212.10:63460] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEW3xq7S-oOqSXZEr7eCwAAAI0"]
[Mon Mar 23 18:33:04.809678 2026] [:error] [pid 57265:tid 57276] [client 20.85.212.10:59062] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEW4GNLjPJJkhuqCshCJwAAAQk"]
[Mon Mar 23 20:02:57.824803 2026] [:error] [pid 14573:tid 14590] [client 20.85.212.10:15339] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Mar 23 20:02:58.035979 2026] [:error] [pid 14573:tid 14587] [client 20.85.212.10:15339] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Mar 23 20:02:58.458080 2026] [:error] [pid 14573:tid 14589] [client 20.85.212.10:15339] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon Mar 23 20:02:58.671467 2026] [:error] [pid 14573:tid 14576] [client 20.85.212.10:15339] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Mar 23 20:02:59.097725 2026] [:error] [pid 14573:tid 14580] [client 20.85.212.10:15339] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon Mar 23 20:02:59.311282 2026] [:error] [pid 14573:tid 14585] [client 20.85.212.10:15339] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Mar 23 20:02:59.526996 2026] [:error] [pid 14573:tid 14593] [client 20.85.212.10:15339] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon Mar 23 20:02:59.945734 2026] [:error] [pid 14573:tid 14595] [client 20.85.212.10:15339] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEr8--oSmHn3q4_J1HvnAAAAVQ"]
[Mon Mar 23 20:03:00.820437 2026] [:error] [pid 23440:tid 23476] [client 20.85.212.10:15310] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEr9D49_8n8h_ttcUpBrQAAAEA"]
[Mon Mar 23 20:03:01.702859 2026] [:error] [pid 57265:tid 57276] [client 20.85.212.10:15240] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEr9WNLjPJJkhuqCsh2PAAAAQk"]
[Mon Mar 23 20:03:02.606370 2026] [:error] [pid 14573:tid 14584] [client 20.85.212.10:15235] [client 20.85.212.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "acEr9u-oSmHn3q4_J1HvowAAAUk"]
[Mon Mar 23 21:21:12.218390 2026] [:error] [pid 38176:tid 38200] [client 40.85.246.124:20360] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acE-SEtG4qlh1gvNjuI7PQAAAA0"]
[Mon Mar 23 21:21:12.639421 2026] [:error] [pid 52341:tid 52366] [client 40.85.246.124:20423] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acE-SKPKTBDR2u47Gb3TogAAAVc"]
[Mon Mar 23 21:21:13.052647 2026] [:error] [pid 52341:tid 52364] [client 40.85.246.124:20455] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acE-SaPKTBDR2u47Gb3TpQAAAVU"]
[Mon Mar 23 21:21:13.463646 2026] [:error] [pid 52341:tid 52361] [client 40.85.246.124:20477] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acE-SaPKTBDR2u47Gb3TrwAAAVI"]
[Tue Mar 24 00:27:20.173090 2026] [:error] [pid 56237:tid 56323] [client 43.130.40.120:57820] [client 43.130.40.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acFp6AymO0MnzQb90MMMbgAAAII"]
[Tue Mar 24 02:04:27.308016 2026] [:error] [pid 56435:tid 56524] [client 20.220.216.188:19332] File does not exist: /usr/local/apache/htdocs/suspended-page/class-t.api.php
[Tue Mar 24 02:04:27.517430 2026] [:error] [pid 56435:tid 56516] [client 20.220.216.188:19332] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Mar 24 02:04:27.936579 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19332] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Tue Mar 24 02:04:28.151714 2026] [:error] [pid 56435:tid 56517] [client 20.220.216.188:19332] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "acGArMrwr-l5A-s9ryCZkAAAARA"]
[Tue Mar 24 02:04:28.576142 2026] [:error] [pid 56236:tid 56304] [client 20.220.216.188:19424] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "acGArHapFgYp0uZ8twAwCwAAAEs"]
[Tue Mar 24 02:04:29.020674 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:19427] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "acGArcrwr-l5A-s9ryCZlAAAARg"]
[Tue Mar 24 02:04:29.446498 2026] [:error] [pid 56237:tid 56328] [client 20.220.216.188:19447] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "acGArQymO0MnzQb90MM35wAAAIc"]
[Tue Mar 24 02:04:29.862155 2026] [:error] [pid 56435:tid 56519] [client 20.220.216.188:19413] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "acGArcrwr-l5A-s9ryCZlQAAARI"]
[Tue Mar 24 02:04:30.307176 2026] [:error] [pid 56238:tid 56348] [client 20.220.216.188:19342] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "acGArlSqceFAZRgPDq61jQAAAMA"]
[Tue Mar 24 02:04:30.719707 2026] [:error] [pid 56238:tid 56360] [client 20.220.216.188:19348] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "acGArlSqceFAZRgPDq61kAAAAMw"]
[Tue Mar 24 02:04:31.137766 2026] [:error] [pid 56435:tid 56502] [client 20.220.216.188:19415] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "acGAr8rwr-l5A-s9ryCZlwAAAQM"]
[Tue Mar 24 02:04:31.571826 2026] [:error] [pid 56435:tid 56507] [client 20.220.216.188:19425] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "acGAr8rwr-l5A-s9ryCZmAAAAQc"]
[Tue Mar 24 02:04:31.996179 2026] [:error] [pid 56435:tid 56524] [client 20.220.216.188:19453] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "acGAr8rwr-l5A-s9ryCZmgAAARc"]
[Tue Mar 24 02:04:32.450660 2026] [:error] [pid 31798:tid 31815] [client 20.220.216.188:19426] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "acGAsHdtW_1bksndFbZGSQAAAA8"]
[Tue Mar 24 02:04:32.878497 2026] [:error] [pid 56238:tid 56358] [client 20.220.216.188:19435] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.php"] [unique_id "acGAsFSqceFAZRgPDq61kwAAAMo"]
[Tue Mar 24 02:04:33.316414 2026] [:error] [pid 56238:tid 56368] [client 20.220.216.188:19411] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "acGAsVSqceFAZRgPDq61lQAAANQ"]
[Tue Mar 24 02:04:33.746834 2026] [:error] [pid 56238:tid 56366] [client 20.220.216.188:19278] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "acGAsVSqceFAZRgPDq61lgAAANI"]
[Tue Mar 24 02:04:34.204064 2026] [:error] [pid 56237:tid 56321] [client 20.220.216.188:19432] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "acGAsgymO0MnzQb90MM37wAAAIA"]
[Tue Mar 24 02:04:34.629215 2026] [:error] [pid 56435:tid 56504] [client 20.220.216.188:19448] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fwe.php"] [unique_id "acGAssrwr-l5A-s9ryCZoQAAAQU"]
[Tue Mar 24 02:04:35.058718 2026] [:error] [pid 56238:tid 56371] [client 20.220.216.188:19353] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "acGAs1SqceFAZRgPDq61mwAAANc"]
[Tue Mar 24 02:04:35.471196 2026] [:error] [pid 31798:tid 31809] [client 20.220.216.188:19418] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "acGAs3dtW_1bksndFbZGVQAAAAk"]
[Tue Mar 24 02:04:35.886886 2026] [:error] [pid 56236:tid 56300] [client 20.220.216.188:19347] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "acGAs3apFgYp0uZ8twAwDQAAAEc"]
[Tue Mar 24 02:04:36.326823 2026] [:error] [pid 56236:tid 56309] [client 20.220.216.188:19434] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/m.php"] [unique_id "acGAtHapFgYp0uZ8twAwEQAAAFA"]
[Tue Mar 24 02:04:36.754467 2026] [:error] [pid 56236:tid 56295] [client 20.220.216.188:19407] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "acGAtHapFgYp0uZ8twAwEwAAAEI"]
[Tue Mar 24 02:04:37.172158 2026] [:error] [pid 56435:tid 56505] [client 20.220.216.188:19436] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "acGAtcrwr-l5A-s9ryCZqQAAAQY"]
[Tue Mar 24 02:04:37.596379 2026] [:error] [pid 31798:tid 31823] [client 20.220.216.188:19371] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "acGAtXdtW_1bksndFbZGWgAAABc"]
[Tue Mar 24 02:04:38.046002 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19455] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "acGAtndtW_1bksndFbZGYgAAAAg"]
[Tue Mar 24 02:04:38.489654 2026] [:error] [pid 56237:tid 56322] [client 20.220.216.188:19397] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acGAtgymO0MnzQb90MM38gAAAIE"]
[Tue Mar 24 02:04:38.908435 2026] [:error] [pid 56238:tid 56354] [client 20.220.216.188:19298] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acGAtlSqceFAZRgPDq61oAAAAMY"]
[Tue Mar 24 02:04:39.356613 2026] [:error] [pid 56237:tid 56338] [client 20.220.216.188:19333] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acGAtwymO0MnzQb90MM39gAAAJE"]
[Tue Mar 24 02:04:39.772467 2026] [:error] [pid 56237:tid 56330] [client 20.220.216.188:19440] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx1.php"] [unique_id "acGAtwymO0MnzQb90MM3-gAAAIk"]
[Tue Mar 24 02:04:40.185802 2026] [:error] [pid 56238:tid 56366] [client 20.220.216.188:19362] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acGAuFSqceFAZRgPDq61ogAAANI"]
[Tue Mar 24 02:04:40.598057 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19439] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acGAuHdtW_1bksndFbZGcAAAAAI"]
[Tue Mar 24 02:04:41.011136 2026] [:error] [pid 56237:tid 56343] [client 20.220.216.188:19443] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acGAuQymO0MnzQb90MM3_gAAAJY"]
[Tue Mar 24 02:04:41.419967 2026] [:error] [pid 56238:tid 56369] [client 20.220.216.188:19400] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xv.php"] [unique_id "acGAuVSqceFAZRgPDq61pQAAANU"]
[Tue Mar 24 02:04:41.831837 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19408] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acGAucrwr-l5A-s9ryCZrAAAARQ"]
[Tue Mar 24 02:04:42.243552 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19330] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acGAusrwr-l5A-s9ryCZrwAAARU"]
[Tue Mar 24 02:04:42.689588 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:19442] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acGAundtW_1bksndFbZGewAAAAw"]
[Tue Mar 24 02:04:43.129926 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19433] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x56.php"] [unique_id "acGAu3dtW_1bksndFbZGfgAAABE"]
[Tue Mar 24 02:04:43.556545 2026] [:error] [pid 31798:tid 31806] [client 20.220.216.188:19401] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acGAu3dtW_1bksndFbZGggAAAAY"]
[Tue Mar 24 02:04:43.981361 2026] [:error] [pid 56237:tid 56329] [client 20.220.216.188:19282] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acGAuwymO0MnzQb90MM4AQAAAIg"]
[Tue Mar 24 02:04:44.399647 2026] [:error] [pid 31798:tid 31809] [client 20.220.216.188:19430] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acGAvHdtW_1bksndFbZGhQAAAAk"]
[Tue Mar 24 02:04:44.814675 2026] [:error] [pid 56435:tid 56509] [client 20.220.216.188:19451] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htaccess.php"] [unique_id "acGAvMrwr-l5A-s9ryCZtQAAAQk"]
[Tue Mar 24 02:04:45.228207 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:19341] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acGAvXdtW_1bksndFbZGigAAAAw"]
[Tue Mar 24 02:04:45.677937 2026] [:error] [pid 56435:tid 56505] [client 20.220.216.188:19396] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acGAvcrwr-l5A-s9ryCZuQAAAQY"]
[Tue Mar 24 02:04:46.091304 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19360] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acGAvndtW_1bksndFbZGjQAAAAg"]
[Tue Mar 24 02:04:46.506811 2026] [:error] [pid 31798:tid 31806] [client 20.220.216.188:19270] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/readme.php"] [unique_id "acGAvndtW_1bksndFbZGkAAAAAY"]
[Tue Mar 24 02:04:46.927610 2026] [:error] [pid 56237:tid 56322] [client 20.220.216.188:19404] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acGAvgymO0MnzQb90MM4BAAAAIE"]
[Tue Mar 24 02:04:47.341535 2026] [:error] [pid 56236:tid 56308] [client 20.220.216.188:19363] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acGAv3apFgYp0uZ8twAwGwAAAE8"]
[Tue Mar 24 02:04:47.759321 2026] [:error] [pid 56238:tid 56358] [client 20.220.216.188:19416] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acGAv1SqceFAZRgPDq61rgAAAMo"]
[Tue Mar 24 02:04:48.172176 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:19395] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x50.php"] [unique_id "acGAwHdtW_1bksndFbZGmgAAAAw"]
[Tue Mar 24 02:04:48.610711 2026] [:error] [pid 56236:tid 56297] [client 20.220.216.188:19402] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acGAwHapFgYp0uZ8twAwHgAAAEQ"]
[Tue Mar 24 02:04:49.027841 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19338] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acGAwXdtW_1bksndFbZGngAAABg"]
[Tue Mar 24 02:04:49.438065 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19346] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acGAwcrwr-l5A-s9ryCZuwAAARU"]
[Tue Mar 24 02:04:49.860717 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19452] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fv.php"] [unique_id "acGAwXdtW_1bksndFbZGoQAAAAs"]
[Tue Mar 24 02:04:50.273082 2026] [:error] [pid 31798:tid 31803] [client 20.220.216.188:19302] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acGAwndtW_1bksndFbZGogAAAAM"]
[Tue Mar 24 02:04:50.692646 2026] [:error] [pid 31798:tid 31823] [client 20.220.216.188:19431] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acGAwndtW_1bksndFbZGpAAAABc"]
[Tue Mar 24 02:04:51.108485 2026] [:error] [pid 56237:tid 56328] [client 20.220.216.188:19429] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acGAwwymO0MnzQb90MM4BgAAAIc"]
[Tue Mar 24 02:04:51.522354 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19352] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "acGAw3dtW_1bksndFbZGrAAAAAo"]
[Tue Mar 24 02:04:51.934745 2026] [:error] [pid 31798:tid 31809] [client 20.220.216.188:19344] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acGAw3dtW_1bksndFbZGrwAAAAk"]
[Tue Mar 24 02:04:52.348152 2026] [:error] [pid 31798:tid 31803] [client 20.220.216.188:19361] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acGAxHdtW_1bksndFbZGsgAAAAM"]
[Tue Mar 24 02:04:52.760671 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19329] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acGAxHdtW_1bksndFbZGtgAAABg"]
[Tue Mar 24 02:04:53.172910 2026] [:error] [pid 31798:tid 31819] [client 20.220.216.188:19417] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lsd.php"] [unique_id "acGAxXdtW_1bksndFbZGuQAAABM"]
[Tue Mar 24 02:04:53.582452 2026] [:error] [pid 56435:tid 56519] [client 20.220.216.188:19337] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acGAxcrwr-l5A-s9ryCZwgAAARI"]
[Tue Mar 24 02:04:54.047158 2026] [:error] [pid 56238:tid 56369] [client 20.220.216.188:19405] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acGAxlSqceFAZRgPDq61swAAANU"]
[Tue Mar 24 02:04:54.509671 2026] [:error] [pid 31798:tid 31818] [client 20.220.216.188:19379] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acGAxndtW_1bksndFbZGvwAAABI"]
[Tue Mar 24 02:04:54.927271 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19272] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acGAxndtW_1bksndFbZGwgAAAAE"]
[Tue Mar 24 02:04:55.341331 2026] [:error] [pid 56236:tid 56293] [client 20.220.216.188:19357] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acGAx3apFgYp0uZ8twAwJwAAAEA"]
[Tue Mar 24 02:04:55.792163 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19423] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acGAx3dtW_1bksndFbZGxwAAAAI"]
[Tue Mar 24 02:04:56.234709 2026] [:error] [pid 56236:tid 56306] [client 20.220.216.188:19412] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acGAyHapFgYp0uZ8twAwKgAAAE0"]
[Tue Mar 24 02:04:56.659568 2026] [:error] [pid 56238:tid 56355] [client 20.220.216.188:19331] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsd.php"] [unique_id "acGAyFSqceFAZRgPDq61tgAAAMc"]
[Tue Mar 24 02:04:57.090182 2026] [:error] [pid 56238:tid 56365] [client 20.220.216.188:19350] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acGAyVSqceFAZRgPDq61twAAANE"]
[Tue Mar 24 02:04:57.501848 2026] [:error] [pid 56238:tid 56351] [client 20.220.216.188:19365] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acGAyVSqceFAZRgPDq61uAAAAMM"]
[Tue Mar 24 02:04:57.969340 2026] [:error] [pid 56238:tid 56352] [client 20.220.216.188:19454] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acGAyVSqceFAZRgPDq61uwAAAMQ"]
[Tue Mar 24 02:04:58.409282 2026] [:error] [pid 56238:tid 56353] [client 20.220.216.188:19398] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gtc.php"] [unique_id "acGAylSqceFAZRgPDq61vQAAAMU"]
[Tue Mar 24 02:04:58.897350 2026] [:error] [pid 56237:tid 56333] [client 20.220.216.188:19339] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acGAygymO0MnzQb90MM4DQAAAIw"]
[Tue Mar 24 02:04:59.336390 2026] [:error] [pid 56236:tid 56294] [client 20.220.216.188:19354] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acGAy3apFgYp0uZ8twAwNAAAAEE"]
[Tue Mar 24 02:04:59.832051 2026] [:error] [pid 56238:tid 56349] [client 20.220.216.188:19380] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acGAy1SqceFAZRgPDq61wwAAAME"]
[Tue Mar 24 02:05:00.297651 2026] [:error] [pid 56238:tid 56369] [client 20.220.216.188:19345] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atx.php"] [unique_id "acGAzFSqceFAZRgPDq61xQAAANU"]
[Tue Mar 24 02:05:00.735041 2026] [:error] [pid 56238:tid 56355] [client 20.220.216.188:19287] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acGAzFSqceFAZRgPDq61yQAAAMc"]
[Tue Mar 24 02:05:01.200708 2026] [:error] [pid 56238:tid 56351] [client 20.220.216.188:19335] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acGAzVSqceFAZRgPDq61ywAAAMM"]
[Tue Mar 24 02:05:01.612844 2026] [:error] [pid 56237:tid 56337] [client 20.220.216.188:19394] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acGAzQymO0MnzQb90MM4EQAAAJA"]
[Tue Mar 24 02:05:02.218333 2026] [:error] [pid 56435:tid 56508] [client 20.220.216.188:19421] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acGAzsrwr-l5A-s9ryCZxgAAAQg"]
[Tue Mar 24 02:05:02.628956 2026] [:error] [pid 56236:tid 56309] [client 20.220.216.188:19383] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGAznapFgYp0uZ8twAwOwAAAFA"]
[Tue Mar 24 02:05:03.079519 2026] [:error] [pid 56238:tid 56358] [client 20.220.216.188:19391] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGAz1SqceFAZRgPDq61zwAAAMo"]
[Tue Mar 24 02:05:03.494129 2026] [:error] [pid 31798:tid 31819] [client 20.220.216.188:19351] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGAz3dtW_1bksndFbZG0wAAABM"]
[Tue Mar 24 02:05:03.918888 2026] [:error] [pid 31798:tid 31814] [client 20.220.216.188:19450] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGAz3dtW_1bksndFbZG1wAAAA4"]
[Tue Mar 24 02:05:04.331751 2026] [:error] [pid 31798:tid 31800] [client 20.220.216.188:19267] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acGA0HdtW_1bksndFbZG3AAAAAA"]
[Tue Mar 24 02:05:04.746364 2026] [:error] [pid 56238:tid 56362] [client 20.220.216.188:19368] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acGA0FSqceFAZRgPDq610gAAAM4"]
[Tue Mar 24 02:05:05.165079 2026] [:error] [pid 56238:tid 56371] [client 20.220.216.188:19414] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acGA0VSqceFAZRgPDq611gAAANc"]
[Tue Mar 24 02:05:05.581022 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19275] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/m.php"] [unique_id "acGA0crwr-l5A-s9ryCZywAAAQI"]
[Tue Mar 24 02:05:05.999278 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19372] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acGA0crwr-l5A-s9ryCZzAAAARQ"]
[Tue Mar 24 02:05:06.422014 2026] [:error] [pid 31798:tid 31816] [client 20.220.216.188:19319] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acGA0ndtW_1bksndFbZG5QAAABA"]
[Tue Mar 24 02:05:06.871809 2026] [:error] [pid 56435:tid 56515] [client 20.220.216.188:19340] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acGA0srwr-l5A-s9ryCZzwAAAQ4"]
[Tue Mar 24 02:05:07.291126 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:19392] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "acGA08rwr-l5A-s9ryCZ0QAAARg"]
[Tue Mar 24 02:05:07.702621 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19268] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acGA03dtW_1bksndFbZG6wAAAAI"]
[Tue Mar 24 02:05:08.114287 2026] [:error] [pid 56237:tid 56334] [client 20.220.216.188:19370] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acGA1AymO0MnzQb90MM4IQAAAI0"]
[Tue Mar 24 02:05:08.527587 2026] [:error] [pid 56435:tid 56524] [client 20.220.216.188:19305] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acGA1Mrwr-l5A-s9ryCZ1gAAARc"]
[Tue Mar 24 02:05:08.975167 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19437] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/about.php"] [unique_id "acGA1HapFgYp0uZ8twAwQQAAAEU"]
[Tue Mar 24 02:05:09.433077 2026] [:error] [pid 56435:tid 56507] [client 20.220.216.188:19286] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acGA1crwr-l5A-s9ryCZ2gAAAQc"]
[Tue Mar 24 02:05:09.844132 2026] [:error] [pid 56435:tid 56514] [client 20.220.216.188:19374] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acGA1crwr-l5A-s9ryCZ3AAAAQ0"]
[Tue Mar 24 02:05:10.267074 2026] [:error] [pid 56238:tid 56362] [client 20.220.216.188:19279] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acGA1lSqceFAZRgPDq614QAAAM4"]
[Tue Mar 24 02:05:10.678926 2026] [:error] [pid 56236:tid 56312] [client 20.220.216.188:19366] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "acGA1napFgYp0uZ8twAwRQAAAFM"]
[Tue Mar 24 02:05:11.122794 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19399] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acGA18rwr-l5A-s9ryCZ3wAAAQI"]
[Tue Mar 24 02:05:11.540093 2026] [:error] [pid 56236:tid 56311] [client 20.220.216.188:19204] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acGA13apFgYp0uZ8twAwSgAAAFI"]
[Tue Mar 24 02:05:11.966905 2026] [:error] [pid 56237:tid 56333] [client 20.220.216.188:19445] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acGA1wymO0MnzQb90MM4LAAAAIw"]
[Tue Mar 24 02:05:12.397858 2026] [:error] [pid 56238:tid 56365] [client 20.220.216.188:19356] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "acGA2FSqceFAZRgPDq615gAAANE"]
[Tue Mar 24 02:05:12.819873 2026] [:error] [pid 56237:tid 56329] [client 20.220.216.188:19274] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acGA2AymO0MnzQb90MM4MgAAAIg"]
[Tue Mar 24 02:05:13.233122 2026] [:error] [pid 56238:tid 56352] [client 20.220.216.188:19264] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acGA2VSqceFAZRgPDq616AAAAMQ"]
[Tue Mar 24 02:05:13.714380 2026] [:error] [pid 56237:tid 56338] [client 20.220.216.188:19328] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acGA2QymO0MnzQb90MM4OAAAAJE"]
[Tue Mar 24 02:05:14.202014 2026] [:error] [pid 56238:tid 56367] [client 20.220.216.188:19358] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "acGA2lSqceFAZRgPDq616wAAANM"]
[Tue Mar 24 02:05:14.618635 2026] [:error] [pid 56237:tid 56343] [client 20.220.216.188:19307] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acGA2gymO0MnzQb90MM4PgAAAJY"]
[Tue Mar 24 02:05:15.035579 2026] [:error] [pid 56435:tid 56504] [client 20.220.216.188:19291] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acGA28rwr-l5A-s9ryCZ4gAAAQU"]
[Tue Mar 24 02:05:15.572617 2026] [:error] [pid 56237:tid 56329] [client 20.220.216.188:19384] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acGA2wymO0MnzQb90MM4QQAAAIg"]
[Tue Mar 24 02:05:16.003806 2026] [:error] [pid 56238:tid 56369] [client 20.220.216.188:19420] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "acGA3FSqceFAZRgPDq618gAAANU"]
[Tue Mar 24 02:05:16.479834 2026] [:error] [pid 31798:tid 31804] [client 20.220.216.188:19449] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acGA3HdtW_1bksndFbZG-QAAAAQ"]
[Tue Mar 24 02:05:16.902457 2026] [:error] [pid 56237:tid 56323] [client 20.220.216.188:19409] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acGA3AymO0MnzQb90MM4RgAAAII"]
[Tue Mar 24 02:05:17.420711 2026] [:error] [pid 56238:tid 56370] [client 20.220.216.188:19378] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acGA3VSqceFAZRgPDq619gAAANY"]
[Tue Mar 24 02:05:17.860375 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19373] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "acGA3XdtW_1bksndFbZHAgAAAAg"]
[Tue Mar 24 02:05:18.273999 2026] [:error] [pid 56238:tid 56352] [client 20.220.216.188:19273] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acGA3lSqceFAZRgPDq61-AAAAMQ"]
[Tue Mar 24 02:05:18.686740 2026] [:error] [pid 56237:tid 56330] [client 20.220.216.188:19334] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acGA3gymO0MnzQb90MM4SgAAAIk"]
[Tue Mar 24 02:05:19.136170 2026] [:error] [pid 31798:tid 31813] [client 20.220.216.188:19428] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acGA33dtW_1bksndFbZHDQAAAA0"]
[Tue Mar 24 02:05:19.580160 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:19349] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "acGA33dtW_1bksndFbZHEgAAAAw"]
[Tue Mar 24 02:05:20.012829 2026] [:error] [pid 56238:tid 56363] [client 20.220.216.188:19359] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acGA4FSqceFAZRgPDq61_gAAAM8"]
[Tue Mar 24 02:05:20.434352 2026] [:error] [pid 56236:tid 56293] [client 20.220.216.188:19299] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acGA4HapFgYp0uZ8twAwVAAAAEA"]
[Tue Mar 24 02:05:20.860368 2026] [:error] [pid 56238:tid 56372] [client 20.220.216.188:19276] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acGA4FSqceFAZRgPDq62BQAAANg"]
[Tue Mar 24 02:05:21.300867 2026] [:error] [pid 56435:tid 56507] [client 20.220.216.188:19386] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acGA4crwr-l5A-s9ryCZ6gAAAQc"]
[Tue Mar 24 02:05:21.715485 2026] [:error] [pid 56238:tid 56363] [client 20.220.216.188:19324] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acGA4VSqceFAZRgPDq62DQAAAM8"]
[Tue Mar 24 02:05:22.126743 2026] [:error] [pid 56238:tid 56361] [client 20.220.216.188:19387] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acGA4lSqceFAZRgPDq62DgAAAM0"]
[Tue Mar 24 02:05:22.570633 2026] [:error] [pid 56435:tid 56517] [client 20.220.216.188:19312] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acGA4srwr-l5A-s9ryCZ7QAAARA"]
[Tue Mar 24 02:05:22.985813 2026] [:error] [pid 56237:tid 56344] [client 20.220.216.188:19402] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cong.php"] [unique_id "acGA4gymO0MnzQb90MM4TAAAAJc"]
[Tue Mar 24 02:05:23.399953 2026] [:error] [pid 56237:tid 56336] [client 20.220.216.188:19441] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acGA4wymO0MnzQb90MM4TgAAAI8"]
[Tue Mar 24 02:05:23.811537 2026] [:error] [pid 56238:tid 56356] [client 20.220.216.188:19355] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acGA41SqceFAZRgPDq62EQAAAMg"]
[Tue Mar 24 02:05:24.224593 2026] [:error] [pid 56238:tid 56367] [client 20.220.216.188:19227] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acGA5FSqceFAZRgPDq62FAAAANM"]
[Tue Mar 24 02:05:24.697481 2026] [:error] [pid 56435:tid 56507] [client 20.220.216.188:19290] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "acGA5Mrwr-l5A-s9ryCZ-AAAAQc"]
[Tue Mar 24 02:05:25.123734 2026] [:error] [pid 56238:tid 56348] [client 20.220.216.188:19265] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGA5VSqceFAZRgPDq62FgAAAMA"]
[Tue Mar 24 02:05:25.535030 2026] [:error] [pid 56236:tid 56317] [client 20.220.216.188:19281] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGA5XapFgYp0uZ8twAwXwAAAFg"]
[Tue Mar 24 02:05:25.955708 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:19288] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGA5crwr-l5A-s9ryCZ_QAAARg"]
[Tue Mar 24 02:05:26.366290 2026] [:error] [pid 56435:tid 56510] [client 20.220.216.188:19202] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGA5srwr-l5A-s9ryCZ_wAAAQo"]
[Tue Mar 24 02:05:26.782057 2026] [:error] [pid 56236:tid 56299] [client 20.220.216.188:19388] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acGA5napFgYp0uZ8twAwZAAAAEY"]
[Tue Mar 24 02:05:27.216900 2026] [:error] [pid 31798:tid 31816] [client 20.220.216.188:19316] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Mar 24 02:05:27.424720 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19316] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Mar 24 02:05:27.652684 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19316] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Mar 24 02:05:27.859995 2026] [:error] [pid 31798:tid 31815] [client 20.220.216.188:19316] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Mar 24 02:05:28.277360 2026] [:error] [pid 31798:tid 31814] [client 20.220.216.188:19316] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Mar 24 02:05:28.696095 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19316] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "acGA6HdtW_1bksndFbZHNAAAAAI"]
[Tue Mar 24 02:05:29.142322 2026] [:error] [pid 56236:tid 56307] [client 20.220.216.188:19243] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "acGA6XapFgYp0uZ8twAwZwAAAE4"]
[Tue Mar 24 02:05:29.559699 2026] [:error] [pid 56236:tid 56310] [client 20.220.216.188:19235] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "acGA6XapFgYp0uZ8twAwaAAAAFE"]
[Tue Mar 24 02:05:29.974961 2026] [:error] [pid 31798:tid 31814] [client 20.220.216.188:19369] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "acGA6XdtW_1bksndFbZHOQAAAA4"]
[Tue Mar 24 02:05:30.395796 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19296] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "acGA6srwr-l5A-s9ryCaCwAAAQI"]
[Tue Mar 24 02:05:30.832055 2026] [:error] [pid 56435:tid 56513] [client 20.220.216.188:19304] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "acGA6srwr-l5A-s9ryCaDQAAAQw"]
[Tue Mar 24 02:05:31.251793 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19203] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "acGA63dtW_1bksndFbZHQAAAAAg"]
[Tue Mar 24 02:05:31.695507 2026] [:error] [pid 31798:tid 31804] [client 20.220.216.188:19248] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "acGA63dtW_1bksndFbZHRgAAAAQ"]
[Tue Mar 24 02:05:32.109283 2026] [:error] [pid 31798:tid 31813] [client 20.220.216.188:19240] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "acGA7HdtW_1bksndFbZHSQAAAA0"]
[Tue Mar 24 02:05:32.577768 2026] [:error] [pid 31798:tid 31818] [client 20.220.216.188:19322] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "acGA7HdtW_1bksndFbZHTAAAABI"]
[Tue Mar 24 02:05:33.021351 2026] [:error] [pid 56238:tid 56359] [client 20.220.216.188:19320] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "acGA7VSqceFAZRgPDq62IgAAAMs"]
[Tue Mar 24 02:05:33.456325 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19219] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/autoload_classmap.php"] [unique_id "acGA7XdtW_1bksndFbZHVQAAAAo"]
[Tue Mar 24 02:05:33.884160 2026] [:error] [pid 31798:tid 31813] [client 20.220.216.188:19446] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "acGA7XdtW_1bksndFbZHWgAAAA0"]
[Tue Mar 24 02:05:34.330761 2026] [:error] [pid 56238:tid 56354] [client 20.220.216.188:19201] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "acGA7lSqceFAZRgPDq62JQAAAMY"]
[Tue Mar 24 02:05:34.810135 2026] [:error] [pid 56236:tid 56317] [client 20.220.216.188:19367] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "acGA7napFgYp0uZ8twAwbgAAAFg"]
[Tue Mar 24 02:05:35.231923 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19314] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "acGA73apFgYp0uZ8twAwbwAAAEU"]
[Tue Mar 24 02:05:35.646364 2026] [:error] [pid 56236:tid 56301] [client 20.220.216.188:19254] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "acGA73apFgYp0uZ8twAwcAAAAEg"]
[Tue Mar 24 02:05:36.065003 2026] [:error] [pid 56238:tid 56353] [client 20.220.216.188:19317] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "acGA8FSqceFAZRgPDq62LAAAAMU"]
[Tue Mar 24 02:05:36.645404 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19208] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "acGA8HdtW_1bksndFbZHZwAAAAs"]
[Tue Mar 24 02:05:37.060441 2026] [:error] [pid 56238:tid 56372] [client 20.220.216.188:19375] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "acGA8VSqceFAZRgPDq62LgAAANg"]
[Tue Mar 24 02:05:37.478371 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19293] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGA8XdtW_1bksndFbZHbwAAAAE"]
[Tue Mar 24 02:05:37.898793 2026] [:error] [pid 56238:tid 56350] [client 20.220.216.188:19318] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGA8VSqceFAZRgPDq62MAAAAMI"]
[Tue Mar 24 02:05:38.314641 2026] [:error] [pid 31798:tid 31813] [client 20.220.216.188:19220] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGA8ndtW_1bksndFbZHdAAAAA0"]
[Tue Mar 24 02:05:38.728497 2026] [:error] [pid 31798:tid 31805] [client 20.220.216.188:19140] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGA8ndtW_1bksndFbZHdwAAAAU"]
[Tue Mar 24 02:05:39.185919 2026] [:error] [pid 31798:tid 31809] [client 20.220.216.188:19376] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acGA83dtW_1bksndFbZHfQAAAAk"]
[Tue Mar 24 02:05:39.605707 2026] [:error] [pid 56236:tid 56310] [client 20.220.216.188:19364] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acGA83apFgYp0uZ8twAweAAAAFE"]
[Tue Mar 24 02:05:40.049896 2026] [:error] [pid 56238:tid 56354] [client 20.220.216.188:19150] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acGA9FSqceFAZRgPDq62NAAAAMY"]
[Tue Mar 24 02:05:40.463214 2026] [:error] [pid 56238:tid 56362] [client 20.220.216.188:19236] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acGA9FSqceFAZRgPDq62NwAAAM4"]
[Tue Mar 24 02:05:40.928777 2026] [:error] [pid 56238:tid 56371] [client 20.220.216.188:19230] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acGA9FSqceFAZRgPDq62OAAAANc"]
[Tue Mar 24 02:05:41.360679 2026] [:error] [pid 56236:tid 56300] [client 20.220.216.188:19174] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acGA9XapFgYp0uZ8twAwfAAAAEc"]
[Tue Mar 24 02:05:41.774755 2026] [:error] [pid 56435:tid 56523] [client 20.220.216.188:19377] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acGA9crwr-l5A-s9ryCaGAAAARY"]
[Tue Mar 24 02:05:42.249198 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19321] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acGA9srwr-l5A-s9ryCaGwAAARU"]
[Tue Mar 24 02:05:42.662832 2026] [:error] [pid 56435:tid 56513] [client 20.220.216.188:19309] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acGA9srwr-l5A-s9ryCaHQAAAQw"]
[Tue Mar 24 02:05:43.075681 2026] [:error] [pid 56435:tid 56510] [client 20.220.216.188:19280] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acGA98rwr-l5A-s9ryCaIAAAAQo"]
[Tue Mar 24 02:05:43.490115 2026] [:error] [pid 56435:tid 56519] [client 20.220.216.188:19422] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acGA98rwr-l5A-s9ryCaIgAAARI"]
[Tue Mar 24 02:05:43.921925 2026] [:error] [pid 56236:tid 56294] [client 20.220.216.188:19213] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acGA93apFgYp0uZ8twAwgAAAAEE"]
[Tue Mar 24 02:05:44.365920 2026] [:error] [pid 56435:tid 56518] [client 20.220.216.188:19313] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acGA-Mrwr-l5A-s9ryCaJQAAARE"]
[Tue Mar 24 02:05:44.785866 2026] [:error] [pid 56435:tid 56505] [client 20.220.216.188:19390] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acGA-Mrwr-l5A-s9ryCaKQAAAQY"]
[Tue Mar 24 02:05:45.199636 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:19258] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acGA-crwr-l5A-s9ryCaKwAAARg"]
[Tue Mar 24 02:05:45.626428 2026] [:error] [pid 56435:tid 56520] [client 20.220.216.188:19271] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acGA-crwr-l5A-s9ryCaLwAAARM"]
[Tue Mar 24 02:05:46.056843 2026] [:error] [pid 56238:tid 56364] [client 20.220.216.188:19228] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acGA-lSqceFAZRgPDq62QwAAANA"]
[Tue Mar 24 02:05:46.474899 2026] [:error] [pid 31798:tid 31800] [client 20.220.216.188:19232] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acGA-ndtW_1bksndFbZHhAAAAAA"]
[Tue Mar 24 02:05:46.970864 2026] [:error] [pid 56435:tid 56499] [client 20.220.216.188:19256] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acGA-srwr-l5A-s9ryCaQQAAAQA"]
[Tue Mar 24 02:05:47.489998 2026] [:error] [pid 56237:tid 56333] [client 20.220.216.188:19325] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/manager.php"] [unique_id "acGA-wymO0MnzQb90MM4aAAAAIw"]
[Tue Mar 24 02:05:47.906301 2026] [:error] [pid 31798:tid 31823] [client 20.220.216.188:19283] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acGA-3dtW_1bksndFbZHjAAAABc"]
[Tue Mar 24 02:05:48.546352 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19154] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acGA_HdtW_1bksndFbZHjwAAAAs"]
[Tue Mar 24 02:05:48.956710 2026] [:error] [pid 56435:tid 56507] [client 20.220.216.188:19295] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acGA_Mrwr-l5A-s9ryCaSwAAAQc"]
[Tue Mar 24 02:05:49.427168 2026] [:error] [pid 56238:tid 56369] [client 20.220.216.188:19382] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/item.php"] [unique_id "acGA_VSqceFAZRgPDq62TAAAANU"]
[Tue Mar 24 02:05:49.837746 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19269] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acGA_XapFgYp0uZ8twAwjAAAAEU"]
[Tue Mar 24 02:05:50.293580 2026] [:error] [pid 56238:tid 56372] [client 20.220.216.188:19215] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acGA_lSqceFAZRgPDq62UAAAANg"]
[Tue Mar 24 02:05:50.736653 2026] [:error] [pid 56238:tid 56370] [client 20.220.216.188:19300] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acGA_lSqceFAZRgPDq62UQAAANY"]
[Tue Mar 24 02:05:51.212893 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19212] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/Cache/footer.php"] [unique_id "acGA_3dtW_1bksndFbZHmgAAABE"]
[Tue Mar 24 02:05:51.633359 2026] [:error] [pid 31798:tid 31807] [client 20.220.216.188:19406] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGA_3dtW_1bksndFbZHmwAAAAc"]
[Tue Mar 24 02:05:52.051909 2026] [:error] [pid 56236:tid 56296] [client 20.220.216.188:19438] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGBAHapFgYp0uZ8twAwlQAAAEM"]
[Tue Mar 24 02:05:52.685636 2026] [:error] [pid 56237:tid 56321] [client 20.220.216.188:19292] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGBAAymO0MnzQb90MM4gQAAAIA"]
[Tue Mar 24 02:05:53.274849 2026] [:error] [pid 56435:tid 56499] [client 20.220.216.188:19444] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "acGBAcrwr-l5A-s9ryCaUQAAAQA"]
[Tue Mar 24 02:05:53.693987 2026] [:error] [pid 56237:tid 56323] [client 20.220.216.188:19253] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acGBAQymO0MnzQb90MM4hgAAAII"]
[Tue Mar 24 02:05:54.360448 2026] [:error] [pid 31798:tid 31821] [client 20.220.216.188:19226] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acGBAndtW_1bksndFbZHngAAABU"]
[Tue Mar 24 02:05:54.833272 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19303] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acGBAsrwr-l5A-s9ryCaVQAAARQ"]
[Tue Mar 24 02:05:55.267505 2026] [:error] [pid 56237:tid 56327] [client 20.220.216.188:19214] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "acGBAwymO0MnzQb90MM4iAAAAIY"]
[Tue Mar 24 02:05:55.711859 2026] [:error] [pid 56236:tid 56308] [client 20.220.216.188:19246] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acGBA3apFgYp0uZ8twAwmgAAAE8"]
[Tue Mar 24 02:05:56.214988 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19218] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acGBBHdtW_1bksndFbZHpAAAABE"]
[Tue Mar 24 02:05:56.691851 2026] [:error] [pid 56237:tid 56322] [client 20.220.216.188:19308] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acGBBAymO0MnzQb90MM4igAAAIE"]
[Tue Mar 24 02:05:57.103646 2026] [:error] [pid 56238:tid 56368] [client 20.220.216.188:19289] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acGBBVSqceFAZRgPDq62VQAAANQ"]
[Tue Mar 24 02:05:57.519020 2026] [:error] [pid 56435:tid 56500] [client 20.220.216.188:19381] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acGBBcrwr-l5A-s9ryCaXgAAAQE"]
[Tue Mar 24 02:05:57.930301 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19250] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acGBBXapFgYp0uZ8twAwnQAAAEU"]
[Tue Mar 24 02:05:58.358044 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19326] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acGBBndtW_1bksndFbZHrAAAAAI"]
[Tue Mar 24 02:05:58.776164 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19301] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sx.php"] [unique_id "acGBBndtW_1bksndFbZHrwAAAAo"]
[Tue Mar 24 02:05:59.188542 2026] [:error] [pid 31798:tid 31823] [client 20.220.216.188:19217] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acGBB3dtW_1bksndFbZHuwAAABc"]
[Tue Mar 24 02:05:59.602456 2026] [:error] [pid 31798:tid 31805] [client 20.220.216.188:19238] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acGBB3dtW_1bksndFbZHxAAAAAU"]
[Tue Mar 24 02:06:00.014651 2026] [:error] [pid 56237:tid 56329] [client 20.220.216.188:19216] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acGBCAymO0MnzQb90MM4jQAAAIg"]
[Tue Mar 24 02:06:00.437520 2026] [:error] [pid 56435:tid 56516] [client 20.220.216.188:19148] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acGBCMrwr-l5A-s9ryCaZwAAAQ8"]
[Tue Mar 24 02:06:00.850373 2026] [:error] [pid 31798:tid 31815] [client 20.220.216.188:19237] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGBCHdtW_1bksndFbZH2wAAAA8"]
[Tue Mar 24 02:06:01.279776 2026] [:error] [pid 56435:tid 56523] [client 20.220.216.188:19185] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGBCcrwr-l5A-s9ryCacAAAARY"]
[Tue Mar 24 02:06:01.694158 2026] [:error] [pid 31798:tid 31819] [client 20.220.216.188:19263] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGBCXdtW_1bksndFbZH6QAAABM"]
[Tue Mar 24 02:06:02.121664 2026] [:error] [pid 56435:tid 56508] [client 20.220.216.188:19310] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "acGBCsrwr-l5A-s9ryCadwAAAQg"]
[Tue Mar 24 02:06:02.537114 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19084] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acGBCndtW_1bksndFbZH8gAAABg"]
[Tue Mar 24 02:06:02.949137 2026] [:error] [pid 31798:tid 31807] [client 20.220.216.188:19143] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acGBCndtW_1bksndFbZH9AAAAAc"]
[Tue Mar 24 02:06:03.395612 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19277] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acGBC3dtW_1bksndFbZH9gAAAAE"]
[Tue Mar 24 02:06:03.824640 2026] [:error] [pid 56238:tid 56355] [client 20.220.216.188:19186] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acGBC1SqceFAZRgPDq62XgAAAMc"]
[Tue Mar 24 02:06:04.258946 2026] [:error] [pid 31798:tid 31818] [client 20.220.216.188:19393] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acGBDHdtW_1bksndFbZH_AAAABI"]
[Tue Mar 24 02:06:04.670395 2026] [:error] [pid 31798:tid 31809] [client 20.220.216.188:19266] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acGBDHdtW_1bksndFbZH_wAAAAk"]
[Tue Mar 24 02:06:05.083451 2026] [:error] [pid 56238:tid 56372] [client 20.220.216.188:19389] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acGBDVSqceFAZRgPDq62XwAAANg"]
[Tue Mar 24 02:06:05.498162 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19188] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byp.php"] [unique_id "acGBDXdtW_1bksndFbZIBQAAAAs"]
[Tue Mar 24 02:06:05.910891 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19141] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acGBDcrwr-l5A-s9ryCafQAAAQI"]
[Tue Mar 24 02:06:06.363326 2026] [:error] [pid 31798:tid 31813] [client 20.220.216.188:19175] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acGBDndtW_1bksndFbZICgAAAA0"]
[Tue Mar 24 02:06:06.789779 2026] [:error] [pid 56435:tid 56510] [client 20.220.216.188:19241] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acGBDsrwr-l5A-s9ryCafgAAAQo"]
[Tue Mar 24 02:06:07.236802 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19336] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "acGBD3dtW_1bksndFbZIDQAAAAg"]
[Tue Mar 24 02:06:07.661734 2026] [:error] [pid 56435:tid 56504] [client 20.220.216.188:19146] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acGBD8rwr-l5A-s9ryCagwAAAQU"]
[Tue Mar 24 02:06:08.072050 2026] [:error] [pid 56435:tid 56509] [client 20.220.216.188:19251] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acGBEMrwr-l5A-s9ryCahwAAAQk"]
[Tue Mar 24 02:06:08.489699 2026] [:error] [pid 56238:tid 56358] [client 20.220.216.188:19221] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acGBEFSqceFAZRgPDq62ZgAAAMo"]
[Tue Mar 24 02:06:08.912917 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:19162] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/index.php"] [unique_id "acGBEMrwr-l5A-s9ryCaiwAAARg"]
[Tue Mar 24 02:06:09.324682 2026] [:error] [pid 56435:tid 56500] [client 20.220.216.188:19200] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acGBEcrwr-l5A-s9ryCajgAAAQE"]
[Tue Mar 24 02:06:09.742316 2026] [:error] [pid 56435:tid 56518] [client 20.220.216.188:19211] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acGBEcrwr-l5A-s9ryCakAAAARE"]
[Tue Mar 24 02:06:10.155484 2026] [:error] [pid 56236:tid 56310] [client 20.220.216.188:19223] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acGBEnapFgYp0uZ8twAwpQAAAFE"]
[Tue Mar 24 02:06:10.632866 2026] [:error] [pid 56435:tid 56516] [client 20.220.216.188:19249] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "acGBEsrwr-l5A-s9ryCalQAAAQ8"]
[Tue Mar 24 02:06:11.045323 2026] [:error] [pid 56435:tid 56510] [client 20.220.216.188:19297] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acGBE8rwr-l5A-s9ryCamQAAAQo"]
[Tue Mar 24 02:06:11.458438 2026] [:error] [pid 56238:tid 56372] [client 20.220.216.188:19403] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acGBE1SqceFAZRgPDq62bAAAANg"]
[Tue Mar 24 02:06:11.899478 2026] [:error] [pid 56238:tid 56370] [client 20.220.216.188:19252] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acGBE1SqceFAZRgPDq62bwAAANY"]
[Tue Mar 24 02:06:12.320873 2026] [:error] [pid 56238:tid 56350] [client 20.220.216.188:19262] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "acGBFFSqceFAZRgPDq62cgAAAMI"]
[Tue Mar 24 02:06:12.750433 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19136] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acGBFHdtW_1bksndFbZIFQAAAAo"]
[Tue Mar 24 02:06:13.190673 2026] [:error] [pid 31798:tid 31807] [client 20.220.216.188:19210] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acGBFXdtW_1bksndFbZIGgAAAAc"]
[Tue Mar 24 02:06:13.648579 2026] [:error] [pid 56238:tid 56359] [client 20.220.216.188:19147] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acGBFVSqceFAZRgPDq62dAAAAMs"]
[Tue Mar 24 02:06:14.065288 2026] [:error] [pid 56435:tid 56519] [client 20.220.216.188:19165] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "acGBFsrwr-l5A-s9ryCanwAAARI"]
[Tue Mar 24 02:06:14.481892 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19193] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "acGBFndtW_1bksndFbZIHQAAAAE"]
[Tue Mar 24 02:06:14.895477 2026] [:error] [pid 56236:tid 56304] [client 20.220.216.188:19172] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "acGBFnapFgYp0uZ8twAwqQAAAEs"]
[Tue Mar 24 02:06:15.316797 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19239] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "acGBF8rwr-l5A-s9ryCapQAAAQI"]
[Tue Mar 24 02:06:15.803312 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19260] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/index.php"] [unique_id "acGBF8rwr-l5A-s9ryCaqAAAARQ"]
[Tue Mar 24 02:06:16.216416 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19311] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "acGBGHdtW_1bksndFbZIIwAAABE"]
[Tue Mar 24 02:06:16.656198 2026] [:error] [pid 56237:tid 56331] [client 20.220.216.188:19229] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "acGBGAymO0MnzQb90MM4lQAAAIo"]
[Tue Mar 24 02:06:17.068425 2026] [:error] [pid 56435:tid 56516] [client 20.220.216.188:19205] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "acGBGcrwr-l5A-s9ryCarwAAAQ8"]
[Tue Mar 24 02:06:17.481661 2026] [:error] [pid 56435:tid 56513] [client 20.220.216.188:19183] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/about.php"] [unique_id "acGBGcrwr-l5A-s9ryCasgAAAQw"]
[Tue Mar 24 02:06:17.938176 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:19072] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acGBGXdtW_1bksndFbZIJgAAAAw"]
[Tue Mar 24 02:06:18.354922 2026] [:error] [pid 56435:tid 56500] [client 20.220.216.188:19222] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acGBGsrwr-l5A-s9ryCaugAAAQE"]
[Tue Mar 24 02:06:18.765582 2026] [:error] [pid 56236:tid 56306] [client 20.220.216.188:19109] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acGBGnapFgYp0uZ8twAwqwAAAE0"]
[Tue Mar 24 02:06:19.197699 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19257] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "acGBG8rwr-l5A-s9ryCavwAAAQI"]
[Tue Mar 24 02:06:19.671714 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19284] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acGBG8rwr-l5A-s9ryCaxAAAARU"]
[Tue Mar 24 02:06:20.178782 2026] [:error] [pid 56435:tid 56500] [client 20.220.216.188:19149] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acGBHMrwr-l5A-s9ryCaxgAAAQE"]
[Tue Mar 24 02:06:20.615260 2026] [:error] [pid 56238:tid 56369] [client 20.220.216.188:19343] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acGBHFSqceFAZRgPDq62ewAAANU"]
[Tue Mar 24 02:06:21.037525 2026] [:error] [pid 56236:tid 56313] [client 20.220.216.188:19184] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/index.php"] [unique_id "acGBHXapFgYp0uZ8twAwrQAAAFQ"]
[Tue Mar 24 02:06:21.484105 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19419] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "acGBHXapFgYp0uZ8twAwrgAAAEU"]
[Tue Mar 24 02:06:21.902729 2026] [:error] [pid 56236:tid 56314] [client 20.220.216.188:19294] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "acGBHXapFgYp0uZ8twAwrwAAAFU"]
[Tue Mar 24 02:06:22.315432 2026] [:error] [pid 31798:tid 31818] [client 20.220.216.188:19163] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "acGBHndtW_1bksndFbZILQAAABI"]
[Tue Mar 24 02:06:22.739403 2026] [:error] [pid 56236:tid 56305] [client 20.220.216.188:19144] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "acGBHnapFgYp0uZ8twAwtAAAAEw"]
[Tue Mar 24 02:06:23.157665 2026] [:error] [pid 56435:tid 56507] [client 20.220.216.188:19142] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acGBH8rwr-l5A-s9ryCaygAAAQc"]
[Tue Mar 24 02:06:23.578389 2026] [:error] [pid 56237:tid 56343] [client 20.220.216.188:19170] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acGBHwymO0MnzQb90MM4mQAAAJY"]
[Tue Mar 24 02:06:24.023300 2026] [:error] [pid 56435:tid 56511] [client 20.220.216.188:19182] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acGBIMrwr-l5A-s9ryCazAAAAQs"]
[Tue Mar 24 02:06:24.437091 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19187] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "acGBIHapFgYp0uZ8twAwuQAAAEU"]
[Tue Mar 24 02:06:24.858546 2026] [:error] [pid 31798:tid 31820] [client 20.220.216.188:19245] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acGBIHdtW_1bksndFbZILwAAABQ"]
[Tue Mar 24 02:06:25.305104 2026] [:error] [pid 31798:tid 31807] [client 20.220.216.188:19224] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "acGBIXdtW_1bksndFbZIMQAAAAc"]
[Tue Mar 24 02:06:25.734611 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19225] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "acGBIXdtW_1bksndFbZINAAAAAg"]
[Tue Mar 24 02:06:26.178546 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19323] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww1.php"] [unique_id "acGBIndtW_1bksndFbZINgAAAAE"]
[Tue Mar 24 02:06:26.595618 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19192] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acGBIndtW_1bksndFbZIOgAAAAs"]
[Tue Mar 24 02:06:27.007572 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19153] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acGBI3dtW_1bksndFbZIPgAAAAI"]
[Tue Mar 24 02:06:27.422856 2026] [:error] [pid 56238:tid 56372] [client 20.220.216.188:19410] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acGBI1SqceFAZRgPDq62hwAAANg"]
[Tue Mar 24 02:06:27.859328 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19145] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about/function.php"] [unique_id "acGBI8rwr-l5A-s9ryCa0QAAARU"]
[Tue Mar 24 02:06:28.558816 2026] [:error] [pid 56435:tid 56515] [client 20.220.216.188:19259] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Mar 24 02:06:28.979705 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:19259] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Tue Mar 24 02:06:29.627616 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19259] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acGBJcrwr-l5A-s9ryCa5QAAARU"]
[Tue Mar 24 02:06:30.065924 2026] [:error] [pid 56237:tid 56328] [client 20.220.216.188:19075] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acGBJgymO0MnzQb90MM4nAAAAIc"]
[Tue Mar 24 02:06:30.482590 2026] [:error] [pid 56238:tid 56364] [client 20.220.216.188:19242] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acGBJlSqceFAZRgPDq62jAAAANA"]
[Tue Mar 24 02:06:30.925033 2026] [:error] [pid 31798:tid 31816] [client 20.220.216.188:19385] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "acGBJndtW_1bksndFbZIRgAAABA"]
[Tue Mar 24 02:06:31.337294 2026] [:error] [pid 56236:tid 56312] [client 20.220.216.188:19139] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acGBJ3apFgYp0uZ8twAwvQAAAFM"]
[Tue Mar 24 02:06:31.758171 2026] [:error] [pid 31798:tid 31814] [client 20.220.216.188:19118] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acGBJ3dtW_1bksndFbZISgAAAA4"]
[Tue Mar 24 02:06:32.190513 2026] [:error] [pid 31798:tid 31820] [client 20.220.216.188:19090] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acGBKHdtW_1bksndFbZITAAAABQ"]
[Tue Mar 24 02:06:32.637934 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19207] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acGBKHdtW_1bksndFbZITgAAABg"]
[Tue Mar 24 02:06:33.056856 2026] [:error] [pid 31798:tid 31821] [client 20.220.216.188:19191] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acGBKXdtW_1bksndFbZIUwAAABU"]
[Tue Mar 24 02:06:33.545314 2026] [:error] [pid 56238:tid 56364] [client 20.220.216.188:19094] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acGBKVSqceFAZRgPDq62lAAAANA"]
[Tue Mar 24 02:06:33.991667 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19114] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acGBKcrwr-l5A-s9ryCa7QAAARQ"]
[Tue Mar 24 02:06:34.527440 2026] [:error] [pid 56237:tid 56327] [client 20.220.216.188:19327] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acGBKgymO0MnzQb90MM4oAAAAIY"]
[Tue Mar 24 02:06:34.941347 2026] [:error] [pid 56238:tid 56355] [client 20.220.216.188:19306] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "acGBKlSqceFAZRgPDq62mQAAAMc"]
[Tue Mar 24 02:06:35.364621 2026] [:error] [pid 56435:tid 56509] [client 20.220.216.188:19179] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "acGBK8rwr-l5A-s9ryCa8AAAAQk"]
[Tue Mar 24 02:06:35.804738 2026] [:error] [pid 56435:tid 56520] [client 20.220.216.188:19255] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "acGBK8rwr-l5A-s9ryCa8wAAARM"]
[Tue Mar 24 02:06:36.285107 2026] [:error] [pid 56237:tid 56324] [client 20.220.216.188:19151] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/admin.php"] [unique_id "acGBLAymO0MnzQb90MM4oQAAAIM"]
[Tue Mar 24 02:06:36.939537 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19244] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acGBLMrwr-l5A-s9ryCa-wAAARU"]
[Tue Mar 24 02:06:37.356372 2026] [:error] [pid 56435:tid 56519] [client 20.220.216.188:19093] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acGBLcrwr-l5A-s9ryCa_wAAARI"]
[Tue Mar 24 02:06:37.835727 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19156] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acGBLXdtW_1bksndFbZIVQAAAAo"]
[Tue Mar 24 02:06:38.337938 2026] [:error] [pid 56435:tid 56520] [client 20.220.216.188:19152] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acGBLsrwr-l5A-s9ryCbAgAAARM"]
[Tue Mar 24 02:06:38.764043 2026] [:error] [pid 56236:tid 56316] [client 20.220.216.188:19158] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acGBLnapFgYp0uZ8twAwwAAAAFc"]
[Tue Mar 24 02:06:39.272364 2026] [:error] [pid 56236:tid 56295] [client 20.220.216.188:19167] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acGBL3apFgYp0uZ8twAwwwAAAEI"]
[Tue Mar 24 02:06:39.699207 2026] [:error] [pid 56435:tid 56515] [client 20.220.216.188:19233] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acGBL8rwr-l5A-s9ryCbBgAAAQ4"]
[Tue Mar 24 02:06:40.139629 2026] [:error] [pid 56238:tid 56356] [client 20.220.216.188:19049] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "acGBMFSqceFAZRgPDq62oAAAAMg"]
[Tue Mar 24 02:06:40.619687 2026] [:error] [pid 56238:tid 56349] [client 20.220.216.188:19087] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acGBMFSqceFAZRgPDq62oQAAAME"]
[Tue Mar 24 02:06:41.080660 2026] [:error] [pid 56238:tid 56352] [client 20.220.216.188:19196] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acGBMVSqceFAZRgPDq62owAAAMQ"]
[Tue Mar 24 02:06:41.543015 2026] [:error] [pid 56238:tid 56351] [client 20.220.216.188:19168] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acGBMVSqceFAZRgPDq62pwAAAMM"]
[Tue Mar 24 02:06:41.981740 2026] [:error] [pid 31798:tid 31805] [client 20.220.216.188:19169] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "acGBMXdtW_1bksndFbZIWgAAAAU"]
[Tue Mar 24 02:06:42.395672 2026] [:error] [pid 31798:tid 31809] [client 20.220.216.188:19195] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "acGBMndtW_1bksndFbZIXgAAAAk"]
[Tue Mar 24 02:06:42.810885 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19234] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "acGBMndtW_1bksndFbZIXwAAAAI"]
[Tue Mar 24 02:06:43.224396 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19171] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "acGBM3dtW_1bksndFbZIYwAAAAo"]
[Tue Mar 24 02:06:43.638750 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19083] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/log.php"] [unique_id "acGBM3dtW_1bksndFbZIZgAAABg"]
[Tue Mar 24 02:06:44.053869 2026] [:error] [pid 31798:tid 31803] [client 20.220.216.188:19138] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "acGBNHdtW_1bksndFbZIaQAAAAM"]
[Tue Mar 24 02:06:44.470345 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19081] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "acGBNMrwr-l5A-s9ryCbDAAAAQI"]
[Tue Mar 24 02:06:44.887548 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19138] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "acGBNHdtW_1bksndFbZIbwAAABE"]
[Tue Mar 24 02:06:45.353973 2026] [:error] [pid 31798:tid 31814] [client 20.220.216.188:19178] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "acGBNXdtW_1bksndFbZIcQAAAA4"]
[Tue Mar 24 02:06:45.823881 2026] [:error] [pid 56237:tid 56342] [client 20.220.216.188:19096] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "acGBNQymO0MnzQb90MM4pwAAAJU"]
[Tue Mar 24 02:06:46.249476 2026] [:error] [pid 31798:tid 31822] [client 20.220.216.188:19357] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "acGBNndtW_1bksndFbZIdgAAABY"]
[Tue Mar 24 02:06:46.678279 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19115] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "acGBNndtW_1bksndFbZIeAAAAAE"]
[Tue Mar 24 02:06:47.125665 2026] [:error] [pid 31798:tid 31821] [client 20.220.216.188:19103] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless5.php"] [unique_id "acGBN3dtW_1bksndFbZIfAAAABU"]
[Tue Mar 24 02:06:47.542870 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19104] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "acGBN3dtW_1bksndFbZIfgAAABE"]
[Tue Mar 24 02:06:47.962749 2026] [:error] [pid 31798:tid 31820] [client 20.220.216.188:19076] [client 20.220.216.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "acGBN3dtW_1bksndFbZIgQAAABQ"]
[Tue Mar 24 02:06:48.394552 2026] [:error] [pid 56238:tid 56365] [client 20.220.216.188:19164] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "acGBOFSqceFAZRgPDq62qgAAANE"]
[Tue Mar 24 02:06:48.823898 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:19285] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "acGBOMrwr-l5A-s9ryCbFAAAARg"]
[Tue Mar 24 02:06:49.240826 2026] [:error] [pid 56435:tid 56504] [client 20.220.216.188:19190] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "acGBOcrwr-l5A-s9ryCbFQAAAQU"]
[Tue Mar 24 02:06:49.663464 2026] [:error] [pid 56238:tid 56367] [client 20.220.216.188:19126] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock360.php"] [unique_id "acGBOVSqceFAZRgPDq62sAAAANM"]
[Tue Mar 24 02:06:50.097954 2026] [:error] [pid 56238:tid 56348] [client 20.220.216.188:19018] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "acGBOlSqceFAZRgPDq62tAAAAMA"]
[Tue Mar 24 02:06:50.563630 2026] [:error] [pid 56435:tid 56522] [client 20.220.216.188:19117] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "acGBOsrwr-l5A-s9ryCbGQAAARU"]
[Tue Mar 24 02:06:50.980538 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19159] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "acGBOndtW_1bksndFbZIhQAAAAE"]
[Tue Mar 24 02:06:51.410224 2026] [:error] [pid 56435:tid 56503] [client 20.220.216.188:19247] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "acGBO8rwr-l5A-s9ryCbHgAAAQQ"]
[Tue Mar 24 02:06:51.857910 2026] [:error] [pid 56238:tid 56353] [client 20.220.216.188:19130] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acGBO1SqceFAZRgPDq62twAAAMU"]
[Tue Mar 24 02:06:52.278174 2026] [:error] [pid 56238:tid 56358] [client 20.220.216.188:19096] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acGBPFSqceFAZRgPDq62uQAAAMo"]
[Tue Mar 24 02:06:52.717181 2026] [:error] [pid 56435:tid 56504] [client 20.220.216.188:19209] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acGBPMrwr-l5A-s9ryCbJQAAAQU"]
[Tue Mar 24 02:06:53.134009 2026] [:error] [pid 56435:tid 56499] [client 20.220.216.188:19180] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o1.php"] [unique_id "acGBPcrwr-l5A-s9ryCbKAAAAQA"]
[Tue Mar 24 02:06:53.577889 2026] [:error] [pid 56238:tid 56369] [client 20.220.216.188:19261] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acGBPVSqceFAZRgPDq62vQAAANU"]
[Tue Mar 24 02:06:54.030410 2026] [:error] [pid 56238:tid 56350] [client 20.220.216.188:19155] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acGBPlSqceFAZRgPDq62vwAAAMI"]
[Tue Mar 24 02:06:54.441099 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19231] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acGBPndtW_1bksndFbZIigAAAAI"]
[Tue Mar 24 02:06:54.893522 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19092] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/juuuu.php"] [unique_id "acGBPndtW_1bksndFbZIjAAAABE"]
[Tue Mar 24 02:06:55.317848 2026] [:error] [pid 31798:tid 31820] [client 20.220.216.188:19053] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acGBP3dtW_1bksndFbZIjgAAABQ"]
[Tue Mar 24 02:06:55.731185 2026] [:error] [pid 56238:tid 56364] [client 20.220.216.188:19055] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acGBP1SqceFAZRgPDq62wgAAANA"]
[Tue Mar 24 02:06:56.149453 2026] [:error] [pid 56236:tid 56315] [client 20.220.216.188:19019] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acGBQHapFgYp0uZ8twAwyAAAAFY"]
[Tue Mar 24 02:06:56.559501 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19189] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ha.php"] [unique_id "acGBQMrwr-l5A-s9ryCbMQAAARQ"]
[Tue Mar 24 02:06:56.993887 2026] [:error] [pid 31798:tid 31800] [client 20.220.216.188:19091] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acGBQHdtW_1bksndFbZIlQAAAAA"]
[Tue Mar 24 02:06:57.405888 2026] [:error] [pid 56435:tid 56523] [client 20.220.216.188:19086] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acGBQcrwr-l5A-s9ryCbNAAAARY"]
[Tue Mar 24 02:06:57.836832 2026] [:error] [pid 56237:tid 56331] [client 20.220.216.188:19029] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acGBQQymO0MnzQb90MM4sQAAAIo"]
[Tue Mar 24 02:06:58.254161 2026] [:error] [pid 56435:tid 56503] [client 20.220.216.188:19017] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gg.php"] [unique_id "acGBQsrwr-l5A-s9ryCbNwAAAQQ"]
[Tue Mar 24 02:06:58.700394 2026] [:error] [pid 31798:tid 31821] [client 20.220.216.188:19124] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acGBQndtW_1bksndFbZImQAAABU"]
[Tue Mar 24 02:06:59.157441 2026] [:error] [pid 56435:tid 56502] [client 20.220.216.188:19198] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acGBQ8rwr-l5A-s9ryCbOwAAAQM"]
[Tue Mar 24 02:06:59.581598 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19123] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acGBQ3dtW_1bksndFbZInQAAABg"]
[Tue Mar 24 02:06:59.994340 2026] [:error] [pid 56435:tid 56510] [client 20.220.216.188:19034] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acGBQ8rwr-l5A-s9ryCbPwAAAQo"]
[Tue Mar 24 02:07:00.452295 2026] [:error] [pid 31798:tid 31814] [client 20.220.216.188:19066] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acGBRHdtW_1bksndFbZInwAAAA4"]
[Tue Mar 24 02:07:00.916013 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19105] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acGBRHdtW_1bksndFbZIoAAAAAg"]
[Tue Mar 24 02:07:01.334728 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19102] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acGBRXdtW_1bksndFbZIoQAAAAs"]
[Tue Mar 24 02:07:01.745775 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19122] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acGBRXdtW_1bksndFbZIpAAAAAE"]
[Tue Mar 24 02:07:02.164056 2026] [:error] [pid 31798:tid 31823] [client 20.220.216.188:19199] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acGBRndtW_1bksndFbZIpwAAABc"]
[Tue Mar 24 02:07:02.577536 2026] [:error] [pid 31798:tid 31805] [client 20.220.216.188:19116] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acGBRndtW_1bksndFbZIqQAAAAU"]
[Tue Mar 24 02:07:03.039402 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19173] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acGBR3dtW_1bksndFbZIrQAAABg"]
[Tue Mar 24 02:07:03.558811 2026] [:error] [pid 56238:tid 56358] [client 20.220.216.188:19137] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acGBR1SqceFAZRgPDq62xgAAAMo"]
[Tue Mar 24 02:07:04.066530 2026] [:error] [pid 56236:tid 56293] [client 20.220.216.188:19095] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acGBSHapFgYp0uZ8twAwzAAAAEA"]
[Tue Mar 24 02:07:04.492580 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19113] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acGBSHdtW_1bksndFbZIsQAAAAE"]
[Tue Mar 24 02:07:05.041577 2026] [:error] [pid 56435:tid 56499] [client 20.220.216.188:19015] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acGBScrwr-l5A-s9ryCbTAAAAQA"]
[Tue Mar 24 02:07:05.455603 2026] [:error] [pid 56435:tid 56505] [client 20.220.216.188:18959] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/520.php"] [unique_id "acGBScrwr-l5A-s9ryCbTgAAAQY"]
[Tue Mar 24 02:07:05.879365 2026] [:error] [pid 31798:tid 31813] [client 20.220.216.188:19078] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acGBSXdtW_1bksndFbZIugAAAA0"]
[Tue Mar 24 02:07:06.302661 2026] [:error] [pid 31798:tid 31804] [client 20.220.216.188:19037] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acGBSndtW_1bksndFbZIvgAAAAQ"]
[Tue Mar 24 02:07:06.714064 2026] [:error] [pid 56435:tid 56523] [client 20.220.216.188:18955] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acGBSsrwr-l5A-s9ryCbUQAAARY"]
[Tue Mar 24 02:07:07.128467 2026] [:error] [pid 31798:tid 31806] [client 20.220.216.188:19101] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ar.php"] [unique_id "acGBS3dtW_1bksndFbZIyAAAAAY"]
[Tue Mar 24 02:07:07.542433 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19133] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acGBS3dtW_1bksndFbZIywAAAAo"]
[Tue Mar 24 02:07:07.962613 2026] [:error] [pid 56237:tid 56344] [client 20.220.216.188:19079] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acGBSwymO0MnzQb90MM4ugAAAJc"]
[Tue Mar 24 02:07:08.397499 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:19107] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acGBTMrwr-l5A-s9ryCbVAAAARQ"]
[Tue Mar 24 02:07:08.814323 2026] [:error] [pid 56236:tid 56300] [client 20.220.216.188:19074] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "acGBTHapFgYp0uZ8twAw0AAAAEc"]
[Tue Mar 24 02:07:09.240422 2026] [:error] [pid 56435:tid 56514] [client 20.220.216.188:19135] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acGBTcrwr-l5A-s9ryCbVgAAAQ0"]
[Tue Mar 24 02:07:09.658790 2026] [:error] [pid 56435:tid 56510] [client 20.220.216.188:19315] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acGBTcrwr-l5A-s9ryCbWQAAAQo"]
[Tue Mar 24 02:07:10.071995 2026] [:error] [pid 56238:tid 56354] [client 20.220.216.188:19121] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acGBTlSqceFAZRgPDq62yAAAAMY"]
[Tue Mar 24 02:07:10.484733 2026] [:error] [pid 31798:tid 31820] [client 20.220.216.188:19120] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "acGBTndtW_1bksndFbZI2gAAABQ"]
[Tue Mar 24 02:07:10.913134 2026] [:error] [pid 56237:tid 56325] [client 20.220.216.188:18983] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acGBTgymO0MnzQb90MM4wgAAAIQ"]
[Tue Mar 24 02:07:11.326267 2026] [:error] [pid 56237:tid 56326] [client 20.220.216.188:19036] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acGBTwymO0MnzQb90MM4xAAAAIU"]
[Tue Mar 24 02:07:11.738791 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19011] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acGBT3dtW_1bksndFbZI3gAAAAE"]
[Tue Mar 24 02:07:12.158349 2026] [:error] [pid 56236:tid 56304] [client 20.220.216.188:19176] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass4.php"] [unique_id "acGBUHapFgYp0uZ8twAw1QAAAEs"]
[Tue Mar 24 02:07:12.584005 2026] [:error] [pid 56237:tid 56334] [client 20.220.216.188:19129] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acGBUAymO0MnzQb90MM4yAAAAI0"]
[Tue Mar 24 02:07:13.026094 2026] [:error] [pid 31798:tid 31804] [client 20.220.216.188:18957] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acGBUXdtW_1bksndFbZI6AAAAAQ"]
[Tue Mar 24 02:07:13.463991 2026] [:error] [pid 31798:tid 31819] [client 20.220.216.188:19065] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acGBUXdtW_1bksndFbZI7gAAABM"]
[Tue Mar 24 02:07:13.933784 2026] [:error] [pid 56237:tid 56345] [client 20.220.216.188:19030] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2clas.php"] [unique_id "acGBUQymO0MnzQb90MM4ywAAAJg"]
[Tue Mar 24 02:07:14.349886 2026] [:error] [pid 56237:tid 56333] [client 20.220.216.188:19108] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acGBUgymO0MnzQb90MM4zQAAAIw"]
[Tue Mar 24 02:07:14.794475 2026] [:error] [pid 56435:tid 56500] [client 20.220.216.188:19160] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acGBUsrwr-l5A-s9ryCbZQAAAQE"]
[Tue Mar 24 02:07:15.219583 2026] [:error] [pid 56238:tid 56352] [client 20.220.216.188:19157] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acGBU1SqceFAZRgPDq620AAAAMQ"]
[Tue Mar 24 02:07:15.632839 2026] [:error] [pid 56238:tid 56351] [client 20.220.216.188:19077] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ave.php"] [unique_id "acGBU1SqceFAZRgPDq621AAAAMM"]
[Tue Mar 24 02:07:16.047961 2026] [:error] [pid 56238:tid 56358] [client 20.220.216.188:19046] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acGBVFSqceFAZRgPDq622AAAAMo"]
[Tue Mar 24 02:07:16.460899 2026] [:error] [pid 56435:tid 56509] [client 20.220.216.188:19125] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acGBVMrwr-l5A-s9ryCbZwAAAQk"]
[Tue Mar 24 02:07:16.876193 2026] [:error] [pid 56435:tid 56524] [client 20.220.216.188:19061] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acGBVMrwr-l5A-s9ryCbaQAAARc"]
[Tue Mar 24 02:07:17.288317 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19058] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wrt.php"] [unique_id "acGBVXdtW_1bksndFbZI9gAAAAI"]
[Tue Mar 24 02:07:17.757539 2026] [:error] [pid 56237:tid 56339] [client 20.220.216.188:19023] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acGBVQymO0MnzQb90MM40wAAAJI"]
[Tue Mar 24 02:07:18.191483 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19013] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acGBVsrwr-l5A-s9ryCbbQAAAQI"]
[Tue Mar 24 02:07:18.607200 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19050] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acGBVndtW_1bksndFbZI_gAAAAs"]
[Tue Mar 24 02:07:19.074190 2026] [:error] [pid 56238:tid 56361] [client 20.220.216.188:19161] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bibil.php"] [unique_id "acGBV1SqceFAZRgPDq624QAAAM0"]
[Tue Mar 24 02:07:19.520885 2026] [:error] [pid 56236:tid 56299] [client 20.220.216.188:19009] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acGBV3apFgYp0uZ8twAw3AAAAEY"]
[Tue Mar 24 02:07:19.953145 2026] [:error] [pid 56236:tid 56293] [client 20.220.216.188:19132] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acGBV3apFgYp0uZ8twAw3QAAAEA"]
[Tue Mar 24 02:07:20.384355 2026] [:error] [pid 56435:tid 56503] [client 20.220.216.188:19106] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acGBWMrwr-l5A-s9ryCbegAAAQQ"]
[Tue Mar 24 02:07:20.810325 2026] [:error] [pid 56435:tid 56517] [client 20.220.216.188:18967] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "acGBWMrwr-l5A-s9ryCbfgAAARA"]
[Tue Mar 24 02:07:21.244674 2026] [:error] [pid 56236:tid 56305] [client 20.220.216.188:19128] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acGBWXapFgYp0uZ8twAw3wAAAEw"]
[Tue Mar 24 02:07:21.691773 2026] [:error] [pid 56236:tid 56307] [client 20.220.216.188:19044] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acGBWXapFgYp0uZ8twAw4QAAAE4"]
[Tue Mar 24 02:07:22.117306 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19039] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acGBWndtW_1bksndFbZJCgAAAAI"]
[Tue Mar 24 02:07:22.535882 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19110] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files.php"] [unique_id "acGBWndtW_1bksndFbZJDAAAAAo"]
[Tue Mar 24 02:07:22.947579 2026] [:error] [pid 56237:tid 56323] [client 20.220.216.188:19438] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acGBWgymO0MnzQb90MM41QAAAII"]
[Tue Mar 24 02:07:23.367332 2026] [:error] [pid 31798:tid 31804] [client 20.220.216.188:19085] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acGBW3dtW_1bksndFbZJEAAAAAQ"]
[Tue Mar 24 02:07:23.800015 2026] [:error] [pid 56238:tid 56363] [client 20.220.216.188:19047] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acGBW1SqceFAZRgPDq625AAAAM8"]
[Tue Mar 24 02:07:24.225854 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19012] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file7.php"] [unique_id "acGBXHdtW_1bksndFbZJFQAAAAs"]
[Tue Mar 24 02:07:24.651932 2026] [:error] [pid 31798:tid 31818] [client 20.220.216.188:18901] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acGBXHdtW_1bksndFbZJGAAAABI"]
[Tue Mar 24 02:07:25.120943 2026] [:error] [pid 56238:tid 56356] [client 20.220.216.188:18986] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acGBXVSqceFAZRgPDq626AAAAMg"]
[Tue Mar 24 02:07:25.608282 2026] [:error] [pid 56435:tid 56502] [client 20.220.216.188:19080] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acGBXcrwr-l5A-s9ryCbiQAAAQM"]
[Tue Mar 24 02:07:26.022618 2026] [:error] [pid 56435:tid 56517] [client 20.220.216.188:19073] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acGBXsrwr-l5A-s9ryCbjAAAARA"]
[Tue Mar 24 02:07:26.445219 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19035] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acGBXnapFgYp0uZ8twAw8wAAAEU"]
[Tue Mar 24 02:07:26.895755 2026] [:error] [pid 56236:tid 56311] [client 20.220.216.188:19181] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acGBXnapFgYp0uZ8twAw9wAAAFI"]
[Tue Mar 24 02:07:27.375924 2026] [:error] [pid 56238:tid 56365] [client 20.220.216.188:19045] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acGBX1SqceFAZRgPDq626QAAANE"]
[Tue Mar 24 02:07:27.804688 2026] [:error] [pid 56238:tid 56364] [client 20.220.216.188:19177] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acGBX1SqceFAZRgPDq627AAAANA"]
[Tue Mar 24 02:07:28.245051 2026] [:error] [pid 31798:tid 31810] [client 20.220.216.188:19088] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "acGBYHdtW_1bksndFbZJHQAAAAo"]
[Tue Mar 24 02:07:28.680746 2026] [:error] [pid 56238:tid 56354] [client 20.220.216.188:19014] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nox.php"] [unique_id "acGBYFSqceFAZRgPDq627wAAAMY"]
[Tue Mar 24 02:07:29.178841 2026] [:error] [pid 31798:tid 31802] [client 20.220.216.188:19038] File does not exist: /usr/local/apache/htdocs/suspended-page/nox.php
[Tue Mar 24 02:07:29.387716 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19038] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Tue Mar 24 02:07:29.597887 2026] [:error] [pid 31798:tid 31814] [client 20.220.216.188:19038] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Mar 24 02:07:29.809452 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19038] File does not exist: /usr/local/apache/htdocs/suspended-page/class9.php
[Tue Mar 24 02:07:30.018687 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19038] File does not exist: /usr/local/apache/htdocs/suspended-page/la.php
[Tue Mar 24 02:07:30.227913 2026] [:error] [pid 31798:tid 31820] [client 20.220.216.188:19038] File does not exist: /usr/local/apache/htdocs/suspended-page/bless11.php
[Tue Mar 24 02:07:30.439444 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:19038] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "acGBYndtW_1bksndFbZJPQAAAAw"]
[Tue Mar 24 02:07:30.950076 2026] [:error] [pid 31798:tid 31811] [client 20.220.216.188:19025] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "acGBYndtW_1bksndFbZJRwAAAAs"]
[Tue Mar 24 02:07:31.372717 2026] [:error] [pid 56238:tid 56359] [client 20.220.216.188:19027] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "acGBY1SqceFAZRgPDq629QAAAMs"]
[Tue Mar 24 02:07:31.836293 2026] [:error] [pid 56435:tid 56509] [client 20.220.216.188:19082] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "acGBY8rwr-l5A-s9ryCbnQAAAQk"]
[Tue Mar 24 02:07:32.322406 2026] [:error] [pid 31798:tid 31806] [client 20.220.216.188:18971] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "acGBZHdtW_1bksndFbZJWgAAAAY"]
[Tue Mar 24 02:07:32.950071 2026] [:error] [pid 31798:tid 31808] [client 20.220.216.188:19028] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "acGBZHdtW_1bksndFbZJYgAAAAg"]
[Tue Mar 24 02:07:33.459734 2026] [:error] [pid 56238:tid 56356] [client 20.220.216.188:19112] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "acGBZVSqceFAZRgPDq62-QAAAMg"]
[Tue Mar 24 02:07:33.944114 2026] [:error] [pid 56435:tid 56523] [client 20.220.216.188:18962] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ton.php"] [unique_id "acGBZcrwr-l5A-s9ryCboAAAARY"]
[Tue Mar 24 02:07:34.482742 2026] [:error] [pid 56238:tid 56350] [client 20.220.216.188:18984] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGBZlSqceFAZRgPDq62_AAAAMI"]
[Tue Mar 24 02:07:34.964183 2026] [:error] [pid 31798:tid 31807] [client 20.220.216.188:19194] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGBZndtW_1bksndFbZJaAAAAAc"]
[Tue Mar 24 02:07:35.426897 2026] [:error] [pid 56237:tid 56325] [client 20.220.216.188:19054] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGBZwymO0MnzQb90MM44QAAAIQ"]
[Tue Mar 24 02:07:35.886407 2026] [:error] [pid 56238:tid 56372] [client 20.220.216.188:18944] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/403.php"] [unique_id "acGBZ1SqceFAZRgPDq63AQAAANg"]
[Tue Mar 24 02:07:36.340902 2026] [:error] [pid 31798:tid 31804] [client 20.220.216.188:19010] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "acGBaHdtW_1bksndFbZJbwAAAAQ"]
[Tue Mar 24 02:07:36.755208 2026] [:error] [pid 31798:tid 31817] [client 20.220.216.188:19208] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "acGBaHdtW_1bksndFbZJdAAAABE"]
[Tue Mar 24 02:07:37.187196 2026] [:error] [pid 56236:tid 56315] [client 20.220.216.188:19206] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "acGBaXapFgYp0uZ8twAxCQAAAFY"]
[Tue Mar 24 02:07:37.634352 2026] [:error] [pid 56238:tid 56351] [client 20.220.216.188:19100] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "acGBaVSqceFAZRgPDq63AwAAAMM"]
[Tue Mar 24 02:07:38.058138 2026] [:error] [pid 56238:tid 56349] [client 20.220.216.188:19134] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "acGBalSqceFAZRgPDq63BgAAAME"]
[Tue Mar 24 02:07:38.482635 2026] [:error] [pid 56238:tid 56366] [client 20.220.216.188:19031] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "acGBalSqceFAZRgPDq63CwAAANI"]
[Tue Mar 24 02:07:38.918559 2026] [:error] [pid 56237:tid 56337] [client 20.220.216.188:19026] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "acGBagymO0MnzQb90MM46AAAAJA"]
[Tue Mar 24 02:07:39.340523 2026] [:error] [pid 56236:tid 56296] [client 20.220.216.188:18945] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ac.php"] [unique_id "acGBa3apFgYp0uZ8twAxEQAAAEM"]
[Tue Mar 24 02:07:39.764522 2026] [:error] [pid 56237:tid 56330] [client 20.220.216.188:18996] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "acGBawymO0MnzQb90MM47gAAAIk"]
[Tue Mar 24 02:07:40.177403 2026] [:error] [pid 56237:tid 56333] [client 20.220.216.188:19042] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "acGBbAymO0MnzQb90MM48AAAAIw"]
[Tue Mar 24 02:07:40.604423 2026] [:error] [pid 56238:tid 56364] [client 20.220.216.188:18970] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "acGBbFSqceFAZRgPDq63DwAAANA"]
[Tue Mar 24 02:07:41.027415 2026] [:error] [pid 31798:tid 31806] [client 20.220.216.188:18964] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new4.php"] [unique_id "acGBbXdtW_1bksndFbZJdgAAAAY"]
[Tue Mar 24 02:07:41.451559 2026] [:error] [pid 56237:tid 56325] [client 20.220.216.188:19016] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "acGBbQymO0MnzQb90MM48wAAAIQ"]
[Tue Mar 24 02:07:41.870366 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:18974] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "acGBbcrwr-l5A-s9ryCbpAAAARQ"]
[Tue Mar 24 02:07:42.286906 2026] [:error] [pid 56238:tid 56363] [client 20.220.216.188:19051] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "acGBblSqceFAZRgPDq63FAAAAM8"]
[Tue Mar 24 02:07:42.722439 2026] [:error] [pid 56236:tid 56300] [client 20.220.216.188:18950] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pop.php"] [unique_id "acGBbnapFgYp0uZ8twAxFwAAAEc"]
[Tue Mar 24 02:07:43.167667 2026] [:error] [pid 56236:tid 56311] [client 20.220.216.188:19097] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "acGBb3apFgYp0uZ8twAxGgAAAFI"]
[Tue Mar 24 02:07:43.583297 2026] [:error] [pid 56236:tid 56297] [client 20.220.216.188:19043] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "acGBb3apFgYp0uZ8twAxHgAAAEQ"]
[Tue Mar 24 02:07:44.004561 2026] [:error] [pid 56435:tid 56507] [client 20.220.216.188:19059] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "acGBcMrwr-l5A-s9ryCbrAAAAQc"]
[Tue Mar 24 02:07:44.432525 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:18963] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "acGBcMrwr-l5A-s9ryCbrQAAARg"]
[Tue Mar 24 02:07:44.848326 2026] [:error] [pid 56435:tid 56516] [client 20.220.216.188:18997] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "acGBcMrwr-l5A-s9ryCbsgAAAQ8"]
[Tue Mar 24 02:07:45.262039 2026] [:error] [pid 56435:tid 56521] [client 20.220.216.188:18961] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "acGBccrwr-l5A-s9ryCbtAAAARQ"]
[Tue Mar 24 02:07:45.745628 2026] [:error] [pid 31798:tid 31803] [client 20.220.216.188:18960] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "acGBcXdtW_1bksndFbZJfwAAAAM"]
[Tue Mar 24 02:07:46.177626 2026] [:error] [pid 56237:tid 56339] [client 20.220.216.188:18905] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xaz.php"] [unique_id "acGBcgymO0MnzQb90MM49gAAAJI"]
[Tue Mar 24 02:07:46.627052 2026] [:error] [pid 56236:tid 56298] [client 20.220.216.188:19005] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "acGBcnapFgYp0uZ8twAxJwAAAEU"]
[Tue Mar 24 02:07:47.069483 2026] [:error] [pid 56238:tid 56359] [client 20.220.216.188:19127] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "acGBc1SqceFAZRgPDq63FwAAAMs"]
[Tue Mar 24 02:07:47.490642 2026] [:error] [pid 56435:tid 56511] [client 20.220.216.188:19060] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "acGBc8rwr-l5A-s9ryCbtwAAAQs"]
[Tue Mar 24 02:07:47.907476 2026] [:error] [pid 56435:tid 56517] [client 20.220.216.188:19040] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up4.php"] [unique_id "acGBc8rwr-l5A-s9ryCbuAAAARA"]
[Tue Mar 24 02:07:48.370205 2026] [:error] [pid 56238:tid 56361] [client 20.220.216.188:19282] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "acGBdFSqceFAZRgPDq63HAAAAM0"]
[Tue Mar 24 02:07:48.810904 2026] [:error] [pid 56435:tid 56509] [client 20.220.216.188:18958] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "acGBdMrwr-l5A-s9ryCbuwAAAQk"]
[Tue Mar 24 02:07:49.272811 2026] [:error] [pid 56238:tid 56355] [client 20.220.216.188:19003] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "acGBdVSqceFAZRgPDq63IAAAAMc"]
[Tue Mar 24 02:07:49.692824 2026] [:error] [pid 56236:tid 56317] [client 20.220.216.188:18990] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "acGBdXapFgYp0uZ8twAxKwAAAFg"]
[Tue Mar 24 02:07:50.155306 2026] [:error] [pid 56236:tid 56297] [client 20.220.216.188:19111] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acGBdnapFgYp0uZ8twAxLgAAAEQ"]
[Tue Mar 24 02:07:50.578987 2026] [:error] [pid 56236:tid 56316] [client 20.220.216.188:19048] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acGBdnapFgYp0uZ8twAxLwAAAFc"]
[Tue Mar 24 02:07:50.997358 2026] [:error] [pid 56236:tid 56295] [client 20.220.216.188:18908] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acGBdnapFgYp0uZ8twAxMgAAAEI"]
[Tue Mar 24 02:07:51.433535 2026] [:error] [pid 56238:tid 56353] [client 20.220.216.188:19089] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "acGBd1SqceFAZRgPDq63IQAAAMU"]
[Tue Mar 24 02:07:51.848539 2026] [:error] [pid 56236:tid 56304] [client 20.220.216.188:19303] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acGBd3apFgYp0uZ8twAxNgAAAEs"]
[Tue Mar 24 02:07:52.298971 2026] [:error] [pid 56236:tid 56302] [client 20.220.216.188:18979] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acGBeHapFgYp0uZ8twAxOAAAAEk"]
[Tue Mar 24 02:07:52.755070 2026] [:error] [pid 56435:tid 56525] [client 20.220.216.188:18956] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acGBeMrwr-l5A-s9ryCbwwAAARg"]
[Tue Mar 24 02:07:53.177717 2026] [:error] [pid 56435:tid 56501] [client 20.220.216.188:19024] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtz.php"] [unique_id "acGBecrwr-l5A-s9ryCbxgAAAQI"]
[Tue Mar 24 02:07:53.603498 2026] [:error] [pid 56237:tid 56338] [client 20.220.216.188:18898] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acGBeQymO0MnzQb90MM4-QAAAJE"]
[Tue Mar 24 02:07:54.058965 2026] [:error] [pid 56435:tid 56520] [client 20.220.216.188:19041] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acGBesrwr-l5A-s9ryCbygAAARM"]
[Tue Mar 24 02:07:54.692785 2026] [:error] [pid 56237:tid 56330] [client 20.220.216.188:19020] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acGBegymO0MnzQb90MM4_QAAAIk"]
[Tue Mar 24 02:07:55.344769 2026] [:error] [pid 56237:tid 56335] [client 20.220.216.188:19131] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/galex.php"] [unique_id "acGBewymO0MnzQb90MM5AgAAAI4"]
[Tue Mar 24 02:07:55.818833 2026] [:error] [pid 56238:tid 56368] [client 20.220.216.188:18975] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acGBe1SqceFAZRgPDq63JQAAANQ"]
[Tue Mar 24 02:07:56.231862 2026] [:error] [pid 56237:tid 56323] [client 20.220.216.188:19071] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acGBfAymO0MnzQb90MM5BwAAAII"]
[Tue Mar 24 02:07:56.690562 2026] [:error] [pid 31798:tid 31801] [client 20.220.216.188:19068] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acGBfHdtW_1bksndFbZJhQAAAAE"]
[Tue Mar 24 02:07:57.133303 2026] [:error] [pid 31798:tid 31818] [client 20.220.216.188:19056] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xb.php"] [unique_id "acGBfXdtW_1bksndFbZJhgAAABI"]
[Tue Mar 24 02:07:57.617980 2026] [:error] [pid 31798:tid 31812] [client 20.220.216.188:18977] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acGBfXdtW_1bksndFbZJiwAAAAw"]
[Tue Mar 24 02:07:58.085989 2026] [:error] [pid 31798:tid 31800] [client 20.220.216.188:18981] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acGBfndtW_1bksndFbZJjAAAAAA"]
[Tue Mar 24 02:07:58.506343 2026] [:error] [pid 31798:tid 31804] [client 20.220.216.188:19069] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acGBfndtW_1bksndFbZJjgAAAAQ"]
[Tue Mar 24 02:07:58.925581 2026] [:error] [pid 56238:tid 56352] [client 20.220.216.188:18889] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ova.php"] [unique_id "acGBflSqceFAZRgPDq63KQAAAMQ"]
[Tue Mar 24 02:07:59.361576 2026] [:error] [pid 31798:tid 31819] [client 20.220.216.188:18902] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acGBf3dtW_1bksndFbZJkgAAABM"]
[Tue Mar 24 02:07:59.821207 2026] [:error] [pid 31798:tid 31816] [client 20.220.216.188:18884] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acGBf3dtW_1bksndFbZJlAAAABA"]
[Tue Mar 24 02:08:00.258273 2026] [:error] [pid 31798:tid 31822] [client 20.220.216.188:18985] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acGBgHdtW_1bksndFbZJlgAAABY"]
[Tue Mar 24 02:08:00.678782 2026] [:error] [pid 31798:tid 31806] [client 20.220.216.188:19021] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "acGBgHdtW_1bksndFbZJmwAAAAY"]
[Tue Mar 24 02:08:01.175963 2026] [:error] [pid 31798:tid 31824] [client 20.220.216.188:19098] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acGBgXdtW_1bksndFbZJnQAAABg"]
[Tue Mar 24 02:08:01.694664 2026] [:error] [pid 56236:tid 56314] [client 20.220.216.188:18822] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acGBgXapFgYp0uZ8twAxPQAAAFU"]
[Tue Mar 24 02:08:02.172388 2026] [:error] [pid 56236:tid 56296] [client 20.220.216.188:19135] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acGBgnapFgYp0uZ8twAxPwAAAEM"]
[Tue Mar 24 02:08:02.651717 2026] [:error] [pid 56435:tid 56505] [client 20.220.216.188:19063] [client 20.220.216.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "acGBgsrwr-l5A-s9ryCb0wAAAQY"]
[Tue Mar 24 02:38:45.344355 2026] [:error] [pid 31798:tid 31813] [client 43.133.14.237:57322] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acGItXdtW_1bksndFbZfCwAAAA0"]
[Tue Mar 24 07:29:01.575103 2026] [:error] [pid 3031:tid 3099] [client 36.111.67.189:46886] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acHMvaJBKytnG47nuibyEgAAAFc"]
[Tue Mar 24 08:06:05.774486 2026] [:error] [pid 64198:tid 64210] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Tue Mar 24 08:06:06.142450 2026] [:error] [pid 64198:tid 64223] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Tue Mar 24 08:06:06.412713 2026] [:error] [pid 64198:tid 64222] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Mar 24 08:06:06.669010 2026] [:error] [pid 64198:tid 64208] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Tue Mar 24 08:06:06.908369 2026] [:error] [pid 64198:tid 64200] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Tue Mar 24 08:06:07.158863 2026] [:error] [pid 64198:tid 64203] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/baixy.php
[Tue Mar 24 08:06:07.405989 2026] [:error] [pid 64198:tid 64215] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Tue Mar 24 08:06:07.645656 2026] [:error] [pid 64198:tid 64204] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Mar 24 08:06:08.036887 2026] [:error] [pid 64198:tid 64224] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Tue Mar 24 08:06:08.300162 2026] [:error] [pid 64198:tid 64213] [client 51.103.234.179:17719] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Tue Mar 24 08:06:08.644313 2026] [:error] [pid 64198:tid 64218] [client 51.103.234.179:17719] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buc.php"] [unique_id "acHVcHVzJqf6OS_oSZ0RLwAAAVI"]
[Tue Mar 24 08:06:10.034300 2026] [:error] [pid 3030:tid 3066] [client 51.103.234.179:7602] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buc.php"] [unique_id "acHVcgyOuILyynfcqfkOeQAAABE"]
[Tue Mar 24 08:06:11.176231 2026] [:error] [pid 3031:tid 3096] [client 51.103.234.179:14252] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buc.php"] [unique_id "acHVc6JBKytnG47nuib56QAAAFQ"]
[Tue Mar 24 08:06:12.014229 2026] [:error] [pid 64198:tid 64221] [client 51.103.234.179:6664] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buc.php"] [unique_id "acHVdHVzJqf6OS_oSZ0RNQAAAVU"]
[Tue Mar 24 08:06:12.905161 2026] [:error] [pid 64198:tid 64219] [client 51.103.234.179:14696] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "acHVdHVzJqf6OS_oSZ0RNwAAAVM"]
[Tue Mar 24 08:06:13.485839 2026] [:error] [pid 64198:tid 64200] [client 51.103.234.179:7611] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "acHVdXVzJqf6OS_oSZ0ROAAAAUA"]
[Tue Mar 24 08:06:14.571804 2026] [:error] [pid 3032:tid 3124] [client 51.103.234.179:15457] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "acHVdia_-JXXD03-JNzqSwAAAJU"]
[Tue Mar 24 08:06:15.862681 2026] [:error] [pid 3030:tid 3049] [client 51.103.234.179:32564] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "acHVdwyOuILyynfcqfkOfQAAAAA"]
[Tue Mar 24 08:06:18.214491 2026] [:error] [pid 64198:tid 64202] [client 51.103.234.179:15487] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acHVenVzJqf6OS_oSZ0RRgAAAUI"]
[Tue Mar 24 08:06:19.308464 2026] [:error] [pid 64198:tid 64206] [client 51.103.234.179:35577] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acHVe3VzJqf6OS_oSZ0RSAAAAUY"]
[Tue Mar 24 08:06:20.623182 2026] [:error] [pid 38767:tid 38777] [client 51.103.234.179:14263] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acHVfPwkUqN4GJAI5oWtSwAAAQc"]
[Tue Mar 24 08:06:22.207868 2026] [:error] [pid 3137:tid 3140] [client 51.103.234.179:30865] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acHVfpdZesutm6dfYM8xqQAAAME"]
[Tue Mar 24 08:06:23.158560 2026] [:error] [pid 3137:tid 3145] [client 51.103.234.179:17695] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acHVf5dZesutm6dfYM8xsQAAAMY"]
[Tue Mar 24 08:06:24.135817 2026] [:error] [pid 3137:tid 3161] [client 51.103.234.179:7596] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acHVgJdZesutm6dfYM8xtgAAANY"]
[Tue Mar 24 08:06:25.073470 2026] [:error] [pid 3137:tid 3149] [client 51.103.234.179:23269] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acHVgZdZesutm6dfYM8xwAAAAMo"]
[Tue Mar 24 08:06:26.069195 2026] [:error] [pid 3031:tid 3081] [client 51.103.234.179:18602] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acHVgqJBKytnG47nuib58wAAAEU"]
[Tue Mar 24 08:06:27.177010 2026] [:error] [pid 64198:tid 64214] [client 51.103.234.179:18593] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "acHVg3VzJqf6OS_oSZ0RTAAAAU4"]
[Tue Mar 24 08:06:28.161795 2026] [:error] [pid 3137:tid 3157] [client 51.103.234.179:6710] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "acHVhJdZesutm6dfYM8x0QAAANI"]
[Tue Mar 24 08:06:32.188912 2026] [:error] [pid 3137:tid 3143] [client 51.103.234.179:17670] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "acHViJdZesutm6dfYM8x4gAAAMQ"]
[Tue Mar 24 08:06:33.743488 2026] [:error] [pid 38767:tid 38788] [client 51.103.234.179:18595] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "acHVifwkUqN4GJAI5oWtYAAAARI"]
[Tue Mar 24 08:06:35.244618 2026] [:error] [pid 3137:tid 3149] [client 51.103.234.179:35523] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "acHVi5dZesutm6dfYM8x6QAAAMo"]
[Tue Mar 24 08:06:36.132393 2026] [:error] [pid 3137:tid 3162] [client 51.103.234.179:32547] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "acHVjJdZesutm6dfYM8x8QAAANc"]
[Tue Mar 24 08:06:36.931412 2026] [:error] [pid 3032:tid 3128] [client 51.103.234.179:53258] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "acHVjCa_-JXXD03-JNzqYgAAAJg"]
[Tue Mar 24 08:06:45.794202 2026] [:error] [pid 38767:tid 38783] [client 51.103.234.179:7581] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "acHVlfwkUqN4GJAI5oWtfQAAAQ0"]
[Tue Mar 24 08:06:48.624960 2026] [:error] [pid 38767:tid 38770] [client 51.103.234.179:53286] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acHVmPwkUqN4GJAI5oWthwAAAQA"]
[Tue Mar 24 08:06:50.363826 2026] [:error] [pid 3137:tid 3149] [client 51.103.234.179:13513] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acHVmpdZesutm6dfYM8yJwAAAMo"]
[Tue Mar 24 08:06:51.953034 2026] [:error] [pid 3137:tid 3148] [client 51.103.234.179:34998] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acHVm5dZesutm6dfYM8yKQAAAMk"]
[Tue Mar 24 08:06:53.184901 2026] [:error] [pid 3031:tid 3094] [client 51.103.234.179:9141] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acHVnaJBKytnG47nuib6EQAAAFI"]
[Tue Mar 24 08:06:55.119313 2026] [:error] [pid 3030:tid 3062] [client 51.103.234.179:17716] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acHVnwyOuILyynfcqfkOrQAAAA0"]
[Tue Mar 24 08:06:56.676894 2026] [:error] [pid 3032:tid 3124] [client 51.103.234.179:6365] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acHVoCa_-JXXD03-JNzqdgAAAJU"]
[Tue Mar 24 08:06:58.648816 2026] [:error] [pid 64198:tid 64206] [client 51.103.234.179:9123] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acHVonVzJqf6OS_oSZ0RhQAAAUY"]
[Tue Mar 24 08:07:02.800940 2026] [:error] [pid 3137:tid 3155] [client 51.103.234.179:17665] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acHVppdZesutm6dfYM8yNQAAANA"]
[Tue Mar 24 08:07:03.803689 2026] [:error] [pid 3032:tid 3112] [client 51.103.234.179:19038] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "acHVpya_-JXXD03-JNzqgQAAAIk"]
[Tue Mar 24 08:07:05.534765 2026] [:error] [pid 3030:tid 3057] [client 51.103.234.179:14330] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "acHVqQyOuILyynfcqfkOuAAAAAg"]
[Tue Mar 24 08:07:06.659602 2026] [:error] [pid 3031:tid 3085] [client 51.103.234.179:21129] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "acHVqqJBKytnG47nuib6LAAAAEk"]
[Tue Mar 24 08:07:07.357590 2026] [:error] [pid 3032:tid 3107] [client 51.103.234.179:10392] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "acHVqya_-JXXD03-JNzqhgAAAIQ"]
[Tue Mar 24 08:07:08.822549 2026] [:error] [pid 3031:tid 3097] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Tue Mar 24 08:07:09.061922 2026] [:error] [pid 3031:tid 3084] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Tue Mar 24 08:07:09.304101 2026] [:error] [pid 3031:tid 3090] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Tue Mar 24 08:07:09.562877 2026] [:error] [pid 3031:tid 3088] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Tue Mar 24 08:07:09.829757 2026] [:error] [pid 3031:tid 3095] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Tue Mar 24 08:07:10.068374 2026] [:error] [pid 3031:tid 3085] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/ws75.php
[Tue Mar 24 08:07:10.355851 2026] [:error] [pid 3031:tid 3092] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Mar 24 08:07:10.595799 2026] [:error] [pid 3031:tid 3079] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Tue Mar 24 08:07:10.875978 2026] [:error] [pid 3031:tid 3091] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Tue Mar 24 08:07:11.115769 2026] [:error] [pid 3031:tid 3083] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 24 08:07:11.353819 2026] [:error] [pid 3031:tid 3086] [client 51.103.234.179:7507] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Tue Mar 24 08:07:11.706226 2026] [:error] [pid 3031:tid 3094] [client 51.103.234.179:7507] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "acHVr6JBKytnG47nuib6RAAAAFI"]
[Tue Mar 24 08:07:13.141501 2026] [:error] [pid 3031:tid 3082] [client 51.103.234.179:7993] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "acHVsaJBKytnG47nuib6RQAAAEY"]
[Tue Mar 24 08:07:14.958124 2026] [:error] [pid 64198:tid 64224] [client 51.103.234.179:20602] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "acHVsnVzJqf6OS_oSZ0RowAAAVg"]
[Tue Mar 24 08:07:16.205872 2026] [:error] [pid 3032:tid 3104] [client 51.103.234.179:29143] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "acHVtCa_-JXXD03-JNzqkwAAAIE"]
[Tue Mar 24 08:07:17.833703 2026] [:error] [pid 3137:tid 3143] [client 51.103.234.179:9904] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "acHVtZdZesutm6dfYM8yRwAAAMQ"]
[Tue Mar 24 08:07:19.316271 2026] [:error] [pid 64198:tid 64203] [client 51.103.234.179:29156] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "acHVt3VzJqf6OS_oSZ0RtAAAAUM"]
[Tue Mar 24 08:07:20.475008 2026] [:error] [pid 64198:tid 64211] [client 51.103.234.179:7259] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "acHVuHVzJqf6OS_oSZ0RtwAAAUs"]
[Tue Mar 24 08:07:22.503182 2026] [:error] [pid 3031:tid 3100] [client 51.103.234.179:22178] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "acHVuqJBKytnG47nuib6SgAAAFg"]
[Tue Mar 24 08:07:23.012425 2026] [:error] [pid 3137:tid 3139] [client 51.103.234.179:16516] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "acHVu5dZesutm6dfYM8yVAAAAMA"]
[Tue Mar 24 08:07:48.085017 2026] [:error] [pid 3032:tid 3104] [client 51.103.234.179:16156] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "acHV1Ca_-JXXD03-JNzqugAAAIE"]
[Tue Mar 24 08:07:49.688050 2026] [:error] [pid 64198:tid 64210] [client 51.103.234.179:30935] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "acHV1XVzJqf6OS_oSZ0SSgAAAUo"]
[Tue Mar 24 08:07:58.415143 2026] [:error] [pid 3137:tid 3140] [client 51.103.234.179:33899] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "acHV3pdZesutm6dfYM8yuwAAAME"]
[Tue Mar 24 08:08:00.234205 2026] [:error] [pid 64198:tid 64216] [client 51.103.234.179:21177] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "acHV4HVzJqf6OS_oSZ0SbgAAAVA"]
[Tue Mar 24 08:08:01.419267 2026] [:error] [pid 64198:tid 64220] [client 51.103.234.179:14299] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acHV4XVzJqf6OS_oSZ0SdQAAAVQ"]
[Tue Mar 24 08:08:02.182381 2026] [:error] [pid 3030:tid 3071] [client 51.103.234.179:9111] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acHV4gyOuILyynfcqfkO8gAAABY"]
[Tue Mar 24 08:08:03.217305 2026] [:error] [pid 38767:tid 38776] [client 51.103.234.179:6359] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acHV4_wkUqN4GJAI5oWt7wAAAQY"]
[Tue Mar 24 08:08:04.230101 2026] [:error] [pid 64198:tid 64201] [client 51.103.234.179:15474] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acHV5HVzJqf6OS_oSZ0SegAAAUE"]
[Tue Mar 24 08:08:05.187453 2026] [:error] [pid 64198:tid 64206] [client 51.103.234.179:6677] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "acHV5XVzJqf6OS_oSZ0SgAAAAUY"]
[Tue Mar 24 08:08:06.146709 2026] [:error] [pid 64198:tid 64203] [client 51.103.234.179:7582] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "acHV5nVzJqf6OS_oSZ0ShAAAAUM"]
[Tue Mar 24 08:08:06.875073 2026] [:error] [pid 64198:tid 64201] [client 51.103.234.179:14242] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "acHV5nVzJqf6OS_oSZ0SiAAAAUE"]
[Tue Mar 24 08:08:08.217535 2026] [:error] [pid 3137:tid 3143] [client 51.103.234.179:10148] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "acHV6JdZesutm6dfYM8y6QAAAMQ"]
[Tue Mar 24 08:08:09.388369 2026] [:error] [pid 3032:tid 3105] [client 51.103.234.179:7813] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acHV6Sa_-JXXD03-JNzqywAAAII"]
[Tue Mar 24 08:08:10.579353 2026] [:error] [pid 3137:tid 3143] [client 51.103.234.179:10895] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "acHV6pdZesutm6dfYM8y8QAAAMQ"]
[Tue Mar 24 08:08:11.943047 2026] [:error] [pid 64198:tid 64205] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Mar 24 08:08:12.645918 2026] [:error] [pid 64198:tid 64209] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Mar 24 08:08:12.906533 2026] [:error] [pid 64198:tid 64207] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Mar 24 08:08:14.493923 2026] [:error] [pid 64198:tid 64207] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Mar 24 08:08:14.733598 2026] [:error] [pid 64198:tid 64216] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Tue Mar 24 08:08:14.974041 2026] [:error] [pid 64198:tid 64208] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Mar 24 08:08:15.244987 2026] [:error] [pid 64198:tid 64214] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Mar 24 08:08:15.523733 2026] [:error] [pid 64198:tid 64217] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Tue Mar 24 08:08:15.763670 2026] [:error] [pid 64198:tid 64218] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Tue Mar 24 08:08:16.004445 2026] [:error] [pid 64198:tid 64210] [client 51.103.234.179:6484] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Tue Mar 24 08:08:16.240498 2026] [:error] [pid 64198:tid 64215] [client 51.103.234.179:6484] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "acHV8HVzJqf6OS_oSZ0SnwAAAU8"]
[Tue Mar 24 08:08:17.219230 2026] [:error] [pid 64198:tid 64212] [client 51.103.234.179:20513] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "acHV8XVzJqf6OS_oSZ0SoQAAAUw"]
[Tue Mar 24 08:08:18.680345 2026] [:error] [pid 64198:tid 64201] [client 51.103.234.179:6477] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "acHV8nVzJqf6OS_oSZ0SpwAAAUE"]
[Tue Mar 24 08:08:20.671959 2026] [:error] [pid 3030:tid 3055] [client 51.103.234.179:6542] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "acHV9AyOuILyynfcqfkO-AAAAAY"]
[Tue Mar 24 08:08:21.529803 2026] [:error] [pid 38767:tid 38775] [client 51.103.234.179:10920] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "acHV9fwkUqN4GJAI5oWuAgAAAQU"]
[Tue Mar 24 08:08:23.369888 2026] [:error] [pid 3032:tid 3123] [client 51.103.234.179:6408] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "acHV9ya_-JXXD03-JNzq3AAAAJQ"]
[Tue Mar 24 08:08:24.302441 2026] [:error] [pid 3030:tid 3068] [client 51.103.234.179:9255] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "acHV-AyOuILyynfcqfkO_gAAABM"]
[Tue Mar 24 08:08:25.706580 2026] [:error] [pid 64198:tid 64223] [client 51.103.234.179:9254] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "acHV-XVzJqf6OS_oSZ0SsgAAAVc"]
[Tue Mar 24 08:08:26.689841 2026] [:error] [pid 3032:tid 3119] [client 51.103.234.179:37476] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acHV-ia_-JXXD03-JNzq5gAAAJA"]
[Tue Mar 24 08:08:27.996733 2026] [:error] [pid 3032:tid 3123] [client 51.103.234.179:9279] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acHV-ya_-JXXD03-JNzq6QAAAJQ"]
[Tue Mar 24 08:08:29.067775 2026] [:error] [pid 3030:tid 3059] [client 51.103.234.179:9226] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acHV_QyOuILyynfcqfkPAAAAAAo"]
[Tue Mar 24 08:08:30.018883 2026] [:error] [pid 3032:tid 3119] [client 51.103.234.179:9269] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "acHV_ia_-JXXD03-JNzq8AAAAJA"]
[Tue Mar 24 08:08:31.205116 2026] [:error] [pid 64198:tid 64201] [client 51.103.234.179:20530] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "acHV_3VzJqf6OS_oSZ0SvwAAAUE"]
[Tue Mar 24 08:08:33.339355 2026] [:error] [pid 3032:tid 3120] [client 51.103.234.179:9179] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "acHWASa_-JXXD03-JNzrAgAAAJE"]
[Tue Mar 24 08:08:34.676305 2026] [:error] [pid 38767:tid 38774] [client 51.103.234.179:10705] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "acHWAvwkUqN4GJAI5oWuIAAAAQQ"]
[Tue Mar 24 08:08:36.042648 2026] [:error] [pid 38767:tid 38786] [client 51.103.234.179:6402] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "acHWBPwkUqN4GJAI5oWuIgAAARA"]
[Tue Mar 24 08:08:37.263543 2026] [:error] [pid 3032:tid 3103] [client 51.103.234.179:22968] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHWBSa_-JXXD03-JNzrDQAAAIA"]
[Tue Mar 24 08:08:40.641867 2026] [:error] [pid 64198:tid 64204] [client 51.103.234.179:15076] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHWCHVzJqf6OS_oSZ0S0AAAAUQ"]
[Tue Mar 24 08:08:45.351108 2026] [:error] [pid 3137:tid 3141] [client 51.103.234.179:8457] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHWDZdZesutm6dfYM8zFAAAAMI"]
[Tue Mar 24 08:08:48.095231 2026] [:error] [pid 3137:tid 3149] [client 51.103.234.179:8505] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acHWEJdZesutm6dfYM8zIQAAAMo"]
[Tue Mar 24 08:08:50.710600 2026] [:error] [pid 3137:tid 3160] [client 51.103.234.179:23021] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acHWEpdZesutm6dfYM8zKQAAANU"]
[Tue Mar 24 08:08:52.140396 2026] [:error] [pid 3032:tid 3116] [client 51.103.234.179:20122] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acHWFCa_-JXXD03-JNzrHgAAAI0"]
[Tue Mar 24 08:08:53.384196 2026] [:error] [pid 38767:tid 38788] [client 51.103.234.179:37915] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acHWFfwkUqN4GJAI5oWuPwAAARI"]
[Tue Mar 24 08:08:54.615312 2026] [:error] [pid 64198:tid 64212] [client 51.103.234.179:11683] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acHWFnVzJqf6OS_oSZ0S8QAAAUw"]
[Tue Mar 24 08:08:56.100893 2026] [:error] [pid 64198:tid 64204] [client 51.103.234.179:32296] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "acHWGHVzJqf6OS_oSZ0S9AAAAUQ"]
[Tue Mar 24 08:08:56.860648 2026] [:error] [pid 3030:tid 3057] [client 51.103.234.179:36373] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "acHWGAyOuILyynfcqfkPDwAAAAg"]
[Tue Mar 24 08:08:58.559009 2026] [:error] [pid 64198:tid 64213] [client 51.103.234.179:24338] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "acHWGnVzJqf6OS_oSZ0TAQAAAU0"]
[Tue Mar 24 08:09:01.227196 2026] [:error] [pid 64198:tid 64208] [client 51.103.234.179:8456] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "acHWHXVzJqf6OS_oSZ0TCwAAAUg"]
[Tue Mar 24 08:09:01.805520 2026] [:error] [pid 64198:tid 64203] [client 51.103.234.179:8466] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acHWHXVzJqf6OS_oSZ0TDAAAAUM"]
[Tue Mar 24 08:09:04.081671 2026] [:error] [pid 3032:tid 3112] [client 51.103.234.179:16594] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acHWICa_-JXXD03-JNzrMgAAAIk"]
[Tue Mar 24 08:09:06.085278 2026] [:error] [pid 3032:tid 3111] [client 51.103.234.179:10639] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acHWIia_-JXXD03-JNzrNwAAAIg"]
[Tue Mar 24 08:09:07.667141 2026] [:error] [pid 3031:tid 3099] [client 51.103.234.179:54165] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acHWI6JBKytnG47nuib6pwAAAFc"]
[Tue Mar 24 08:09:09.400658 2026] [:error] [pid 3031:tid 3096] [client 51.103.234.179:13858] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "acHWJaJBKytnG47nuib6qAAAAFQ"]
[Tue Mar 24 08:09:11.543767 2026] [:error] [pid 3137:tid 3153] [client 51.103.234.179:26531] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "acHWJ5dZesutm6dfYM8zVgAAAM4"]
[Tue Mar 24 08:09:12.527073 2026] [:error] [pid 38767:tid 38770] [client 51.103.234.179:55005] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "acHWKPwkUqN4GJAI5oWuWQAAAQA"]
[Tue Mar 24 08:09:14.635511 2026] [:error] [pid 64198:tid 64218] [client 51.103.234.179:20187] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "acHWKnVzJqf6OS_oSZ0TJAAAAVI"]
[Tue Mar 24 08:09:15.373966 2026] [:error] [pid 38767:tid 38793] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Mar 24 08:09:16.279817 2026] [:error] [pid 38767:tid 38776] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Tue Mar 24 08:09:16.522674 2026] [:error] [pid 38767:tid 38794] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Tue Mar 24 08:09:16.762205 2026] [:error] [pid 38767:tid 38781] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/drhunthq.php
[Tue Mar 24 08:09:17.012698 2026] [:error] [pid 38767:tid 38785] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Mar 24 08:09:18.027006 2026] [:error] [pid 38767:tid 38785] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue Mar 24 08:09:18.323854 2026] [:error] [pid 38767:tid 38792] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Tue Mar 24 08:09:18.599109 2026] [:error] [pid 38767:tid 38784] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Tue Mar 24 08:09:18.837530 2026] [:error] [pid 38767:tid 38773] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Mar 24 08:09:19.079540 2026] [:error] [pid 38767:tid 38772] [client 51.103.234.179:34203] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Mar 24 08:09:19.404676 2026] [:error] [pid 38767:tid 38771] [client 51.103.234.179:34203] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acHWL_wkUqN4GJAI5oWuaQAAAQE"]
[Tue Mar 24 08:09:20.467944 2026] [:error] [pid 3032:tid 3118] [client 51.103.234.179:11968] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acHWMCa_-JXXD03-JNzrRwAAAI8"]
[Tue Mar 24 08:09:21.955803 2026] [:error] [pid 64198:tid 64208] [client 51.103.234.179:11934] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acHWMXVzJqf6OS_oSZ0TOQAAAUg"]
[Tue Mar 24 08:09:23.821670 2026] [:error] [pid 3137:tid 3146] [client 51.103.234.179:9020] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acHWM5dZesutm6dfYM8zdwAAAMc"]
[Tue Mar 24 08:09:25.235700 2026] [:error] [pid 3137:tid 3144] [client 51.103.234.179:17377] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "acHWNZdZesutm6dfYM8zegAAAMU"]
[Tue Mar 24 08:09:26.881866 2026] [:error] [pid 64198:tid 64206] [client 51.103.234.179:6185] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "acHWNnVzJqf6OS_oSZ0TSwAAAUY"]
[Tue Mar 24 08:09:27.783024 2026] [:error] [pid 64198:tid 64202] [client 51.103.234.179:29377] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "acHWN3VzJqf6OS_oSZ0TUAAAAUI"]
[Tue Mar 24 08:09:28.674325 2026] [:error] [pid 64198:tid 64216] [client 51.103.234.179:29097] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "acHWOHVzJqf6OS_oSZ0TUwAAAVA"]
[Tue Mar 24 08:09:29.502979 2026] [:error] [pid 38767:tid 38789] [client 51.103.234.179:7056] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acHWOfwkUqN4GJAI5oWucQAAARM"]
[Tue Mar 24 08:09:30.401149 2026] [:error] [pid 64198:tid 64203] [client 51.103.234.179:33531] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acHWOnVzJqf6OS_oSZ0TVQAAAUM"]
[Tue Mar 24 08:09:31.469797 2026] [:error] [pid 38767:tid 38782] [client 51.103.234.179:30496] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acHWO_wkUqN4GJAI5oWuegAAAQw"]
[Tue Mar 24 08:09:32.992677 2026] [:error] [pid 38767:tid 38776] [client 51.103.234.179:10950] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "acHWPPwkUqN4GJAI5oWufgAAAQY"]
[Tue Mar 24 08:09:33.828138 2026] [:error] [pid 64198:tid 64207] [client 51.103.234.179:30136] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "acHWPXVzJqf6OS_oSZ0TXwAAAUc"]
[Tue Mar 24 08:09:34.884979 2026] [:error] [pid 64198:tid 64208] [client 51.103.234.179:33511] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "acHWPnVzJqf6OS_oSZ0TYgAAAUg"]
[Tue Mar 24 08:09:36.253153 2026] [:error] [pid 64198:tid 64222] [client 51.103.234.179:7762] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "acHWQHVzJqf6OS_oSZ0TZwAAAVY"]
[Tue Mar 24 08:09:41.411956 2026] [:error] [pid 3031:tid 3093] [client 51.103.234.179:30532] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "acHWRaJBKytnG47nuib6sgAAAFE"]
[Tue Mar 24 08:09:42.179361 2026] [:error] [pid 64198:tid 64211] [client 51.103.234.179:23991] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "acHWRnVzJqf6OS_oSZ0TdAAAAUs"]
[Tue Mar 24 08:09:46.138109 2026] [:error] [pid 64198:tid 64223] [client 51.103.234.179:7218] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "acHWSnVzJqf6OS_oSZ0TgQAAAVc"]
[Tue Mar 24 08:09:47.294651 2026] [:error] [pid 3137:tid 3149] [client 51.103.234.179:38704] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "acHWS5dZesutm6dfYM8zngAAAMo"]
[Tue Mar 24 08:09:49.745823 2026] [:error] [pid 38767:tid 38793] [client 51.103.234.179:17325] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "acHWTfwkUqN4GJAI5oWulgAAARc"]
[Tue Mar 24 08:09:51.375120 2026] [:error] [pid 3032:tid 3107] [client 51.103.234.179:15816] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "acHWTya_-JXXD03-JNzrWgAAAIQ"]
[Tue Mar 24 08:09:52.878574 2026] [:error] [pid 38767:tid 38788] [client 51.103.234.179:9045] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "acHWUPwkUqN4GJAI5oWungAAARI"]
[Tue Mar 24 08:09:54.485716 2026] [:error] [pid 3031:tid 3082] [client 51.103.234.179:9930] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "acHWUqJBKytnG47nuib6xgAAAEY"]
[Tue Mar 24 08:09:56.382473 2026] [:error] [pid 3137:tid 3162] [client 51.103.234.179:6333] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "acHWVJdZesutm6dfYM8z3QAAANc"]
[Tue Mar 24 08:09:59.434007 2026] [:error] [pid 3137:tid 3140] [client 51.103.234.179:16952] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "acHWV5dZesutm6dfYM8z5wAAAME"]
[Tue Mar 24 08:10:00.795536 2026] [:error] [pid 3137:tid 3155] [client 51.103.234.179:15830] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "acHWWJdZesutm6dfYM8z6QAAANA"]
[Tue Mar 24 08:10:02.224541 2026] [:error] [pid 64198:tid 64214] [client 51.103.234.179:8529] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "acHWWnVzJqf6OS_oSZ0TpQAAAU4"]
[Tue Mar 24 08:10:05.060941 2026] [:error] [pid 3137:tid 3160] [client 51.103.234.179:16922] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "acHWXZdZesutm6dfYM8z8AAAANU"]
[Tue Mar 24 08:10:05.846868 2026] [:error] [pid 64198:tid 64224] [client 51.103.234.179:27276] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "acHWXXVzJqf6OS_oSZ0TqwAAAVg"]
[Tue Mar 24 08:10:06.737338 2026] [:error] [pid 64198:tid 64218] [client 51.103.234.179:6599] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "acHWXnVzJqf6OS_oSZ0TrQAAAVI"]
[Tue Mar 24 08:10:07.307741 2026] [:error] [pid 38767:tid 38774] [client 51.103.234.179:22644] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "acHWX_wkUqN4GJAI5oWutQAAAQQ"]
[Tue Mar 24 08:10:08.675974 2026] [:error] [pid 3137:tid 3162] [client 51.103.234.179:36472] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "acHWYJdZesutm6dfYM8z9wAAANc"]
[Tue Mar 24 08:10:10.017413 2026] [:error] [pid 3137:tid 3142] [client 51.103.234.179:22647] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "acHWYpdZesutm6dfYM8z_AAAAMM"]
[Tue Mar 24 08:10:10.740424 2026] [:error] [pid 3137:tid 3148] [client 51.103.234.179:23170] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "acHWYpdZesutm6dfYM80BAAAAMk"]
[Tue Mar 24 08:10:11.590687 2026] [:error] [pid 3137:tid 3152] [client 51.103.234.179:23982] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "acHWY5dZesutm6dfYM80DAAAAM0"]
[Tue Mar 24 08:10:12.465992 2026] [:error] [pid 38767:tid 38791] [client 51.103.234.179:38675] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-footer.php"] [unique_id "acHWZPwkUqN4GJAI5oWuugAAARU"]
[Tue Mar 24 08:10:13.178691 2026] [:error] [pid 38767:tid 38775] [client 51.103.234.179:11472] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "acHWZfwkUqN4GJAI5oWuxQAAAQU"]
[Tue Mar 24 08:10:15.010763 2026] [:error] [pid 3137:tid 3139] [client 51.103.234.179:13912] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "acHWZ5dZesutm6dfYM80GwAAAMA"]
[Tue Mar 24 08:10:16.491283 2026] [:error] [pid 3030:tid 3049] [client 51.103.234.179:36428] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "acHWaAyOuILyynfcqfkPKwAAAAA"]
[Tue Mar 24 08:10:17.834466 2026] [:error] [pid 64198:tid 64204] [client 51.103.234.179:8002] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "acHWaXVzJqf6OS_oSZ0T4QAAAUQ"]
[Tue Mar 24 08:10:19.924994 2026] [:error] [pid 38767:tid 38788] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Tue Mar 24 08:10:21.700574 2026] [:error] [pid 38767:tid 38788] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Mar 24 08:10:22.044341 2026] [:error] [pid 38767:tid 38784] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Tue Mar 24 08:10:22.608184 2026] [:error] [pid 38767:tid 38793] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Tue Mar 24 08:10:22.850815 2026] [:error] [pid 38767:tid 38783] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/ws77.php
[Tue Mar 24 08:10:23.171221 2026] [:error] [pid 38767:tid 38770] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Tue Mar 24 08:10:23.578665 2026] [:error] [pid 38767:tid 38778] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Tue Mar 24 08:10:23.842395 2026] [:error] [pid 38767:tid 38791] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Tue Mar 24 08:10:24.083948 2026] [:error] [pid 38767:tid 38780] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue Mar 24 08:10:24.378687 2026] [:error] [pid 38767:tid 38776] [client 51.103.234.179:23230] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Tue Mar 24 08:10:24.615606 2026] [:error] [pid 38767:tid 38771] [client 51.103.234.179:23230] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "acHWcPwkUqN4GJAI5oWu8AAAAQE"]
[Tue Mar 24 08:10:25.623872 2026] [:error] [pid 64198:tid 64214] [client 51.103.234.179:8023] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "acHWcXVzJqf6OS_oSZ0UAgAAAU4"]
[Tue Mar 24 08:10:26.766225 2026] [:error] [pid 64198:tid 64213] [client 51.103.234.179:22632] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "acHWcnVzJqf6OS_oSZ0UBwAAAU0"]
[Tue Mar 24 08:10:28.079430 2026] [:error] [pid 3032:tid 3117] [client 51.103.234.179:33412] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "acHWdCa_-JXXD03-JNzroAAAAI4"]
[Tue Mar 24 08:10:29.395452 2026] [:error] [pid 64198:tid 64224] [client 51.103.234.179:9565] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "acHWdXVzJqf6OS_oSZ0UMAAAAVg"]
[Tue Mar 24 08:10:30.390619 2026] [:error] [pid 3137:tid 3147] [client 51.103.234.179:36031] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "acHWdpdZesutm6dfYM80PQAAAMg"]
[Tue Mar 24 08:10:31.148677 2026] [:error] [pid 38767:tid 38772] [client 51.103.234.179:33801] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "acHWd_wkUqN4GJAI5oWvBgAAAQI"]
[Tue Mar 24 08:10:32.190985 2026] [:error] [pid 3137:tid 3150] [client 51.103.234.179:8757] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "acHWeJdZesutm6dfYM80QQAAAMs"]
[Tue Mar 24 08:10:33.134870 2026] [:error] [pid 3137:tid 3142] [client 51.103.234.179:11489] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "acHWeZdZesutm6dfYM80RgAAAMM"]
[Tue Mar 24 08:10:33.999691 2026] [:error] [pid 64198:tid 64216] [client 51.103.234.179:11439] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "acHWeXVzJqf6OS_oSZ0UYgAAAVA"]
[Tue Mar 24 08:10:34.813120 2026] [:error] [pid 3137:tid 3143] [client 51.103.234.179:8720] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "acHWepdZesutm6dfYM80TAAAAMQ"]
[Tue Mar 24 08:10:35.692875 2026] [:error] [pid 64198:tid 64224] [client 51.103.234.179:8004] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/144.php"] [unique_id "acHWe3VzJqf6OS_oSZ0UZAAAAVg"]
[Tue Mar 24 08:10:36.636668 2026] [:error] [pid 3031:tid 3090] [client 51.103.234.179:9571] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "acHWfKJBKytnG47nuib62gAAAE4"]
[Tue Mar 24 08:10:37.900616 2026] [:error] [pid 64198:tid 64219] [client 51.103.234.179:8757] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "acHWfXVzJqf6OS_oSZ0UZwAAAVM"]
[Tue Mar 24 08:10:38.504212 2026] [:error] [pid 3137:tid 3151] [client 51.103.234.179:16969] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "acHWfpdZesutm6dfYM80WgAAAMw"]
[Tue Mar 24 08:10:39.546419 2026] [:error] [pid 38767:tid 38783] [client 51.103.234.179:36452] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "acHWf_wkUqN4GJAI5oWvCwAAAQ0"]
[Tue Mar 24 08:10:40.270712 2026] [:error] [pid 64198:tid 64202] [client 51.103.234.179:33423] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "acHWgHVzJqf6OS_oSZ0UcgAAAUI"]
[Tue Mar 24 08:10:41.227005 2026] [:error] [pid 3032:tid 3111] [client 51.103.234.179:36475] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "acHWgSa_-JXXD03-JNzr_QAAAIg"]
[Tue Mar 24 08:10:42.200949 2026] [:error] [pid 3032:tid 3106] [client 51.103.234.179:11414] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "acHWgia_-JXXD03-JNzr_wAAAIM"]
[Tue Mar 24 08:10:43.007493 2026] [:error] [pid 64198:tid 64210] [client 51.103.234.179:9551] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "acHWg3VzJqf6OS_oSZ0UfAAAAUo"]
[Tue Mar 24 08:10:43.775502 2026] [:error] [pid 3137:tid 3146] [client 51.103.234.179:11427] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "acHWg5dZesutm6dfYM80YwAAAMc"]
[Tue Mar 24 08:10:44.391575 2026] [:error] [pid 3031:tid 3079] [client 51.103.234.179:11396] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "acHWhKJBKytnG47nuib62wAAAEM"]
[Tue Mar 24 08:10:44.956974 2026] [:error] [pid 3031:tid 3092] [client 51.103.234.179:33826] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "acHWhKJBKytnG47nuib63AAAAFA"]
[Tue Mar 24 08:10:45.748668 2026] [:error] [pid 3032:tid 3124] [client 51.103.234.179:33793] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "acHWhSa_-JXXD03-JNzsBQAAAJU"]
[Tue Mar 24 08:10:47.088761 2026] [:error] [pid 3030:tid 3058] [client 51.103.234.179:11471] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "acHWhwyOuILyynfcqfkPMgAAAAk"]
[Tue Mar 24 08:10:47.905826 2026] [:error] [pid 3031:tid 3080] [client 51.103.234.179:13941] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "acHWh6JBKytnG47nuib65AAAAEQ"]
[Tue Mar 24 08:10:49.642086 2026] [:error] [pid 3137:tid 3154] [client 51.103.234.179:8009] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "acHWiZdZesutm6dfYM80bgAAAM8"]
[Tue Mar 24 08:10:50.724282 2026] [:error] [pid 3137:tid 3158] [client 51.103.234.179:22627] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "acHWipdZesutm6dfYM80dgAAANM"]
[Tue Mar 24 08:10:52.682824 2026] [:error] [pid 3137:tid 3156] [client 51.103.234.179:37959] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "acHWjJdZesutm6dfYM80ewAAANE"]
[Tue Mar 24 08:10:53.580063 2026] [:error] [pid 3137:tid 3155] [client 51.103.234.179:36460] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "acHWjZdZesutm6dfYM80gAAAANA"]
[Tue Mar 24 08:10:54.171178 2026] [:error] [pid 38767:tid 38779] [client 51.103.234.179:13901] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "acHWjvwkUqN4GJAI5oWvJgAAAQk"]
[Tue Mar 24 08:10:54.790731 2026] [:error] [pid 38767:tid 38788] [client 51.103.234.179:33803] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "acHWjvwkUqN4GJAI5oWvKAAAARI"]
[Tue Mar 24 08:10:55.446641 2026] [:error] [pid 3032:tid 3109] [client 51.103.234.179:33843] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "acHWjya_-JXXD03-JNzsEwAAAIY"]
[Tue Mar 24 08:10:56.323566 2026] [:error] [pid 38767:tid 38784] [client 51.103.234.179:7004] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "acHWkPwkUqN4GJAI5oWvLQAAAQ4"]
[Tue Mar 24 08:10:57.247654 2026] [:error] [pid 64198:tid 64204] [client 51.103.234.179:52555] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "acHWkXVzJqf6OS_oSZ0UtAAAAUQ"]
[Tue Mar 24 08:10:58.218945 2026] [:error] [pid 3137:tid 3154] [client 51.103.234.179:22634] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "acHWkpdZesutm6dfYM80hQAAAM8"]
[Tue Mar 24 08:10:58.839043 2026] [:error] [pid 38767:tid 38778] [client 51.103.234.179:17019] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "acHWkvwkUqN4GJAI5oWvMQAAAQg"]
[Tue Mar 24 08:11:00.095601 2026] [:error] [pid 3137:tid 3139] [client 51.103.234.179:22602] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "acHWlJdZesutm6dfYM80hwAAAMA"]
[Tue Mar 24 08:11:01.464373 2026] [:error] [pid 3032:tid 3109] [client 51.103.234.179:37974] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "acHWlSa_-JXXD03-JNzsJAAAAIY"]
[Tue Mar 24 08:11:02.918680 2026] [:error] [pid 3137:tid 3144] [client 51.103.234.179:8402] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "acHWlpdZesutm6dfYM80iwAAAMU"]
[Tue Mar 24 08:11:04.131722 2026] [:error] [pid 3031:tid 3097] [client 51.103.234.179:6604] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "acHWmKJBKytnG47nuib6-AAAAFU"]
[Tue Mar 24 08:11:05.641144 2026] [:error] [pid 3137:tid 3159] [client 51.103.234.179:35992] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "acHWmZdZesutm6dfYM80lQAAANQ"]
[Tue Mar 24 08:11:06.695046 2026] [:error] [pid 38767:tid 38791] [client 51.103.234.179:8435] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "acHWmvwkUqN4GJAI5oWvOwAAARU"]
[Tue Mar 24 08:11:08.529652 2026] [:error] [pid 38767:tid 38781] [client 51.103.234.179:8717] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "acHWnPwkUqN4GJAI5oWvPQAAAQs"]
[Tue Mar 24 08:11:09.674653 2026] [:error] [pid 3137:tid 3144] [client 51.103.234.179:13892] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "acHWnZdZesutm6dfYM80oQAAAMU"]
[Tue Mar 24 08:11:13.675114 2026] [:error] [pid 3137:tid 3148] [client 51.103.234.179:16983] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "acHWoZdZesutm6dfYM80swAAAMk"]
[Tue Mar 24 08:11:15.042134 2026] [:error] [pid 3030:tid 3056] [client 51.103.234.179:9566] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "acHWowyOuILyynfcqfkPPQAAAAc"]
[Tue Mar 24 08:11:16.409282 2026] [:error] [pid 38767:tid 38794] [client 51.103.234.179:8006] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "acHWpPwkUqN4GJAI5oWvTAAAARg"]
[Tue Mar 24 08:11:17.543570 2026] [:error] [pid 3137:tid 3159] [client 51.103.234.179:38011] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "acHWpZdZesutm6dfYM80vQAAANQ"]
[Tue Mar 24 08:11:19.034751 2026] [:error] [pid 64198:tid 64216] [client 51.103.234.179:9577] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "acHWp3VzJqf6OS_oSZ0U4gAAAVA"]
[Tue Mar 24 08:11:23.008568 2026] [:error] [pid 3137:tid 3161] [client 51.103.234.179:17005] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "acHWq5dZesutm6dfYM801QAAANY"]
[Tue Mar 24 08:11:25.512591 2026] [:error] [pid 64198:tid 64215] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/5b9ac.php
[Tue Mar 24 08:11:25.765129 2026] [:error] [pid 64198:tid 64216] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Mar 24 08:11:26.091455 2026] [:error] [pid 64198:tid 64217] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/6kDPjgFTmvS.php
[Tue Mar 24 08:11:26.346181 2026] [:error] [pid 64198:tid 64209] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/varb.php
[Tue Mar 24 08:11:26.726702 2026] [:error] [pid 64198:tid 64220] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/lm15.php
[Tue Mar 24 08:11:26.965093 2026] [:error] [pid 64198:tid 64201] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Tue Mar 24 08:11:27.282444 2026] [:error] [pid 64198:tid 64204] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Tue Mar 24 08:11:27.668868 2026] [:error] [pid 64198:tid 64208] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Tue Mar 24 08:11:27.908452 2026] [:error] [pid 64198:tid 64218] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Tue Mar 24 08:11:28.192656 2026] [:error] [pid 64198:tid 64224] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/56c53.php
[Tue Mar 24 08:11:28.476382 2026] [:error] [pid 64198:tid 64210] [client 51.103.234.179:33427] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Tue Mar 24 08:11:28.778911 2026] [:error] [pid 64198:tid 64217] [client 51.103.234.179:33427] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "acHWsHVzJqf6OS_oSZ0VUAAAAVE"]
[Tue Mar 24 08:11:30.555463 2026] [:error] [pid 3137:tid 3153] [client 51.103.234.179:8008] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "acHWspdZesutm6dfYM805wAAAM4"]
[Tue Mar 24 08:11:32.619283 2026] [:error] [pid 3031:tid 3083] [client 51.103.234.179:33817] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "acHWtKJBKytnG47nuib7EwAAAEc"]
[Tue Mar 24 08:11:34.248006 2026] [:error] [pid 3031:tid 3076] [client 51.103.234.179:12707] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "acHWtqJBKytnG47nuib7FQAAAEA"]
[Tue Mar 24 08:11:35.940118 2026] [:error] [pid 38767:tid 38786] [client 51.103.234.179:16971] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acHWt_wkUqN4GJAI5oWvZwAAARA"]
[Tue Mar 24 08:11:38.654249 2026] [:error] [pid 3137:tid 3157] [client 51.103.234.179:37983] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acHWupdZesutm6dfYM81EQAAANI"]
[Tue Mar 24 08:11:43.786901 2026] [:error] [pid 3032:tid 3119] [client 51.103.234.179:33449] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acHWvya_-JXXD03-JNzsPAAAAJA"]
[Tue Mar 24 08:11:46.366636 2026] [:error] [pid 3137:tid 3160] [client 51.103.234.179:22144] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acHWwpdZesutm6dfYM81KgAAANU"]
[Tue Mar 24 08:11:49.817768 2026] [:error] [pid 3137:tid 3146] [client 51.103.234.179:8768] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "acHWxZdZesutm6dfYM81PgAAAMc"]
[Tue Mar 24 08:12:00.439919 2026] [:error] [pid 3137:tid 3152] [client 51.103.234.179:33051] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "acHW0JdZesutm6dfYM81VgAAAM0"]
[Tue Mar 24 08:12:02.224531 2026] [:error] [pid 3032:tid 3118] [client 51.103.234.179:13246] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "acHW0ia_-JXXD03-JNzsTAAAAI8"]
[Tue Mar 24 08:12:04.470861 2026] [:error] [pid 3030:tid 3065] [client 51.103.234.179:9476] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "acHW1AyOuILyynfcqfkPUwAAABA"]
[Tue Mar 24 08:12:06.051327 2026] [:error] [pid 3137:tid 3150] [client 51.103.234.179:13195] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "acHW1pdZesutm6dfYM81WgAAAMs"]
[Tue Mar 24 08:12:07.064565 2026] [:error] [pid 64198:tid 64216] [client 51.103.234.179:26913] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "acHW13VzJqf6OS_oSZ0VmAAAAVA"]
[Tue Mar 24 08:12:08.483061 2026] [:error] [pid 64198:tid 64219] [client 51.103.234.179:16229] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acHW2HVzJqf6OS_oSZ0VnQAAAVM"]
[Tue Mar 24 08:12:09.859701 2026] [:error] [pid 38767:tid 38783] [client 51.103.234.179:13478] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acHW2fwkUqN4GJAI5oWvlwAAAQ0"]
[Tue Mar 24 08:12:10.930129 2026] [:error] [pid 3032:tid 3120] [client 51.103.234.179:8611] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acHW2ia_-JXXD03-JNzsVwAAAJE"]
[Tue Mar 24 08:12:12.064745 2026] [:error] [pid 64198:tid 64214] [client 51.103.234.179:8618] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acHW3HVzJqf6OS_oSZ0VqwAAAU4"]
[Tue Mar 24 08:12:13.030382 2026] [:error] [pid 3030:tid 3067] [client 51.103.234.179:19796] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "acHW3QyOuILyynfcqfkPWgAAABI"]
[Tue Mar 24 08:12:14.190717 2026] [:error] [pid 38767:tid 38774] [client 51.103.234.179:7140] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "acHW3vwkUqN4GJAI5oWvngAAAQQ"]
[Tue Mar 24 08:12:15.366788 2026] [:error] [pid 3137:tid 3155] [client 51.103.234.179:15366] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "acHW35dZesutm6dfYM81agAAANA"]
[Tue Mar 24 08:12:16.427870 2026] [:error] [pid 64198:tid 64222] [client 51.103.234.179:19839] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "acHW4HVzJqf6OS_oSZ0VvQAAAVY"]
[Tue Mar 24 08:12:17.934420 2026] [:error] [pid 3137:tid 3149] [client 51.103.234.179:13546] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "acHW4ZdZesutm6dfYM81cwAAAMo"]
[Tue Mar 24 08:12:18.655932 2026] [:error] [pid 3137:tid 3155] [client 51.103.234.179:34744] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "acHW4pdZesutm6dfYM81eAAAANA"]
[Tue Mar 24 08:12:19.960107 2026] [:error] [pid 3137:tid 3162] [client 51.103.234.179:35537] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "acHW45dZesutm6dfYM81fgAAANc"]
[Tue Mar 24 08:12:21.142439 2026] [:error] [pid 3137:tid 3145] [client 51.103.234.179:6924] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "acHW5ZdZesutm6dfYM81ggAAAMY"]
[Tue Mar 24 08:12:22.085213 2026] [:error] [pid 64198:tid 64219] [client 51.103.234.179:17688] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "acHW5nVzJqf6OS_oSZ0VywAAAVM"]
[Tue Mar 24 08:12:23.302897 2026] [:error] [pid 64198:tid 64211] [client 51.103.234.179:15387] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "acHW53VzJqf6OS_oSZ0V0gAAAUs"]
[Tue Mar 24 08:12:24.804730 2026] [:error] [pid 3137:tid 3155] [client 51.103.234.179:35561] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "acHW6JdZesutm6dfYM81jgAAANA"]
[Tue Mar 24 08:12:25.776609 2026] [:error] [pid 38767:tid 38788] [client 51.103.234.179:19362] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "acHW6fwkUqN4GJAI5oWvqAAAARI"]
[Tue Mar 24 08:12:26.806793 2026] [:error] [pid 3137:tid 3143] [client 51.103.234.179:35546] [client 51.103.234.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfd.php"] [unique_id "acHW6pdZesutm6dfYM81mAAAAMQ"]
[Tue Mar 24 08:12:28.385989 2026] [:error] [pid 3032:tid 3124] [client 51.103.234.179:33901] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Tue Mar 24 08:12:28.681330 2026] [:error] [pid 3032:tid 3108] [client 51.103.234.179:33901] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Tue Mar 24 08:12:28.942439 2026] [:error] [pid 3032:tid 3118] [client 51.103.234.179:33901] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Mar 24 08:12:29.189186 2026] [:error] [pid 3032:tid 3120] [client 51.103.234.179:33901] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Mar 24 08:12:29.428046 2026] [:error] [pid 3032:tid 3127] [client 51.103.234.179:33901] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Tue Mar 24 09:02:45.425730 2026] [:error] [pid 3032:tid 3113] [client 185.223.152.125:50961] [client 185.223.152.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.125, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "acHitSa_-JXXD03-JNz4AAAAAIo"]
[Tue Mar 24 09:02:45.431426 2026] [:error] [pid 3032:tid 3113] [client 185.223.152.125:50961] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Mar 24 10:49:35.710075 2026] [:error] [pid 64198:tid 64201] [client 49.51.245.241:44834] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acH7v3VzJqf6OS_oSZ18tQAAAUE"]
[Tue Mar 24 12:22:15.367675 2026] [:error] [pid 38767:tid 38787] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/gfile.php
[Tue Mar 24 12:22:15.516820 2026] [:error] [pid 38767:tid 38776] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Tue Mar 24 12:22:15.667797 2026] [:error] [pid 38767:tid 38790] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/sty.php
[Tue Mar 24 12:22:15.840750 2026] [:error] [pid 38767:tid 38775] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/xxxx.php
[Tue Mar 24 12:22:15.990616 2026] [:error] [pid 38767:tid 38773] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Tue Mar 24 12:22:16.149952 2026] [:error] [pid 38767:tid 38781] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Mar 24 12:22:16.306999 2026] [:error] [pid 38767:tid 38777] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Tue Mar 24 12:22:16.455818 2026] [:error] [pid 38767:tid 38778] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Tue Mar 24 12:22:16.646106 2026] [:error] [pid 38767:tid 38783] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Tue Mar 24 12:22:16.795829 2026] [:error] [pid 38767:tid 38792] [client 4.213.99.137:1671] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Tue Mar 24 12:22:16.996842 2026] [:error] [pid 38767:tid 38794] [client 4.213.99.137:1671] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acIRePwkUqN4GJAI5oU13gAAARg"]
[Tue Mar 24 12:22:17.318176 2026] [:error] [pid 64198:tid 64202] [client 4.213.99.137:1667] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acIReXVzJqf6OS_oSZ3MyAAAAUI"]
[Tue Mar 24 12:22:17.654442 2026] [:error] [pid 64198:tid 64213] [client 4.213.99.137:1715] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acIReXVzJqf6OS_oSZ3MywAAAU0"]
[Tue Mar 24 12:22:18.025035 2026] [:error] [pid 64198:tid 64220] [client 4.213.99.137:1679] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acIRenVzJqf6OS_oSZ3MzAAAAVQ"]
[Tue Mar 24 12:22:18.490196 2026] [:error] [pid 38767:tid 38770] [client 4.213.99.137:1933] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/path.php"] [unique_id "acIRevwkUqN4GJAI5oU13wAAAQA"]
[Tue Mar 24 12:22:18.837663 2026] [:error] [pid 3032:tid 3106] [client 4.213.99.137:1668] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/path.php"] [unique_id "acIReia_-JXXD03-JNwTVwAAAIM"]
[Tue Mar 24 12:22:19.179149 2026] [:error] [pid 64198:tid 64212] [client 4.213.99.137:1932] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/path.php"] [unique_id "acIRe3VzJqf6OS_oSZ3MzgAAAUw"]
[Tue Mar 24 12:22:19.574631 2026] [:error] [pid 48214:tid 48255] [client 4.213.99.137:1943] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/path.php"] [unique_id "acIRe7eshLWZ3uUDHKkf5gAAAcM"]
[Tue Mar 24 12:22:19.939575 2026] [:error] [pid 64198:tid 64216] [client 4.213.99.137:1691] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wdf.php"] [unique_id "acIRe3VzJqf6OS_oSZ3M1AAAAVA"]
[Tue Mar 24 12:22:20.347515 2026] [:error] [pid 64198:tid 64219] [client 4.213.99.137:1945] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wdf.php"] [unique_id "acIRfHVzJqf6OS_oSZ3M1gAAAVM"]
[Tue Mar 24 12:22:21.196063 2026] [:error] [pid 64198:tid 64217] [client 4.213.99.137:1931] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wdf.php"] [unique_id "acIRfXVzJqf6OS_oSZ3M2AAAAVE"]
[Tue Mar 24 12:22:21.592666 2026] [:error] [pid 64198:tid 64218] [client 4.213.99.137:1726] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wdf.php"] [unique_id "acIRfXVzJqf6OS_oSZ3M3AAAAVI"]
[Tue Mar 24 12:22:21.972782 2026] [:error] [pid 64198:tid 64208] [client 4.213.99.137:1720] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fleen.php"] [unique_id "acIRfXVzJqf6OS_oSZ3M3gAAAUg"]
[Tue Mar 24 12:22:22.283079 2026] [:error] [pid 48219:tid 48295] [client 4.213.99.137:1665] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fleen.php"] [unique_id "acIRfihf3b4R_lAIyv8QyAAAAg4"]
[Tue Mar 24 12:22:22.665364 2026] [:error] [pid 3137:tid 3146] [client 4.213.99.137:1944] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fleen.php"] [unique_id "acIRfpdZesutm6dfYM-iqQAAAMc"]
[Tue Mar 24 12:22:23.115785 2026] [:error] [pid 3030:tid 3055] [client 4.213.99.137:1708] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fleen.php"] [unique_id "acIRfwyOuILyynfcqfkr3gAAAAY"]
[Tue Mar 24 12:22:23.413062 2026] [:error] [pid 48219:tid 48304] [client 4.213.99.137:1037] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-tem.php"] [unique_id "acIRfyhf3b4R_lAIyv8QyQAAAhc"]
[Tue Mar 24 12:22:23.720621 2026] [:error] [pid 38767:tid 38777] [client 4.213.99.137:1683] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-tem.php"] [unique_id "acIRf_wkUqN4GJAI5oU16AAAAQc"]
[Tue Mar 24 12:22:24.210585 2026] [:error] [pid 3032:tid 3105] [client 4.213.99.137:1673] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-tem.php"] [unique_id "acIRgCa_-JXXD03-JNwTXwAAAII"]
[Tue Mar 24 12:22:24.663184 2026] [:error] [pid 3032:tid 3119] [client 4.213.99.137:1680] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-tem.php"] [unique_id "acIRgCa_-JXXD03-JNwTYAAAAJA"]
[Tue Mar 24 12:22:24.974041 2026] [:error] [pid 3137:tid 3145] [client 4.213.99.137:1713] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av6m.php"] [unique_id "acIRgJdZesutm6dfYM-iqwAAAMY"]
[Tue Mar 24 12:22:25.311142 2026] [:error] [pid 3032:tid 3107] [client 4.213.99.137:1695] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av6m.php"] [unique_id "acIRgSa_-JXXD03-JNwTYQAAAIQ"]
[Tue Mar 24 12:22:25.714950 2026] [:error] [pid 48219:tid 48288] [client 4.213.99.137:1941] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av6m.php"] [unique_id "acIRgShf3b4R_lAIyv8QygAAAgc"]
[Tue Mar 24 12:22:26.236179 2026] [:error] [pid 64198:tid 64215] [client 4.213.99.137:1710] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av6m.php"] [unique_id "acIRgnVzJqf6OS_oSZ3M9AAAAU8"]
[Tue Mar 24 12:22:26.587416 2026] [:error] [pid 3137:tid 3148] [client 4.213.99.137:1717] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autogooey.php"] [unique_id "acIRgpdZesutm6dfYM-irAAAAMk"]
[Tue Mar 24 12:22:26.893225 2026] [:error] [pid 3137:tid 3153] [client 4.213.99.137:1703] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autogooey.php"] [unique_id "acIRgpdZesutm6dfYM-irQAAAM4"]
[Tue Mar 24 12:22:27.195733 2026] [:error] [pid 3031:tid 3090] [client 4.213.99.137:1700] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autogooey.php"] [unique_id "acIRg6JBKytnG47nuiYSigAAAE4"]
[Tue Mar 24 12:22:27.680335 2026] [:error] [pid 3137:tid 3159] [client 4.213.99.137:1704] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/autogooey.php"] [unique_id "acIRg5dZesutm6dfYM-irwAAANQ"]
[Tue Mar 24 12:22:28.090309 2026] [:error] [pid 48219:tid 48282] [client 4.213.99.137:1977] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/btx25.php"] [unique_id "acIRhChf3b4R_lAIyv8QzAAAAgE"]
[Tue Mar 24 12:22:28.410393 2026] [:error] [pid 48219:tid 48286] [client 4.213.99.137:1707] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/btx25.php"] [unique_id "acIRhChf3b4R_lAIyv8QzgAAAgU"]
[Tue Mar 24 12:22:29.238863 2026] [:error] [pid 38767:tid 38786] [client 4.213.99.137:1676] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/btx25.php"] [unique_id "acIRhfwkUqN4GJAI5oU17gAAARA"]
[Tue Mar 24 12:22:29.545282 2026] [:error] [pid 38767:tid 38790] [client 4.213.99.137:1975] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/btx25.php"] [unique_id "acIRhfwkUqN4GJAI5oU17wAAARQ"]
[Tue Mar 24 12:22:30.018689 2026] [:error] [pid 48214:tid 48274] [client 4.213.99.137:1722] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mga.php"] [unique_id "acIRhreshLWZ3uUDHKkf7AAAAdY"]
[Tue Mar 24 12:22:30.753428 2026] [:error] [pid 3031:tid 3081] [client 4.213.99.137:1728] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mga.php"] [unique_id "acIRhqJBKytnG47nuiYSiwAAAEU"]
[Tue Mar 24 12:22:31.118802 2026] [:error] [pid 64198:tid 64200] [client 4.213.99.137:1030] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mga.php"] [unique_id "acIRh3VzJqf6OS_oSZ3M_AAAAUA"]
[Tue Mar 24 12:22:31.668471 2026] [:error] [pid 48219:tid 48295] [client 4.213.99.137:1034] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mga.php"] [unique_id "acIRhyhf3b4R_lAIyv8Q1wAAAg4"]
[Tue Mar 24 12:22:32.082081 2026] [:error] [pid 48128:tid 48172] [client 4.213.99.137:1714] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/maxro.php"] [unique_id "acIRiMvR4LIMFLbM5VkP9wAAAZM"]
[Tue Mar 24 12:22:32.444920 2026] [:error] [pid 64198:tid 64219] [client 4.213.99.137:1927] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/maxro.php"] [unique_id "acIRiHVzJqf6OS_oSZ3M_QAAAVM"]
[Tue Mar 24 12:22:33.132770 2026] [:error] [pid 38767:tid 38778] [client 4.213.99.137:1699] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/maxro.php"] [unique_id "acIRifwkUqN4GJAI5oU19QAAAQg"]
[Tue Mar 24 12:22:33.554930 2026] [:error] [pid 3137:tid 3149] [client 4.213.99.137:1936] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/maxro.php"] [unique_id "acIRiZdZesutm6dfYM-itAAAAMo"]
[Tue Mar 24 12:22:34.299879 2026] [:error] [pid 3137:tid 3162] [client 4.213.99.137:1946] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/agg.php"] [unique_id "acIRipdZesutm6dfYM-iuQAAANc"]
[Tue Mar 24 12:22:34.755108 2026] [:error] [pid 3137:tid 3153] [client 4.213.99.137:1967] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/agg.php"] [unique_id "acIRipdZesutm6dfYM-iuwAAAM4"]
[Tue Mar 24 12:22:35.079201 2026] [:error] [pid 3137:tid 3150] [client 4.213.99.137:1923] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/agg.php"] [unique_id "acIRi5dZesutm6dfYM-ivgAAAMs"]
[Tue Mar 24 12:22:35.465431 2026] [:error] [pid 38767:tid 38774] [client 4.213.99.137:1692] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/agg.php"] [unique_id "acIRi_wkUqN4GJAI5oU19wAAAQQ"]
[Tue Mar 24 12:22:36.066052 2026] [:error] [pid 64198:tid 64209] [client 4.213.99.137:1046] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass4.php"] [unique_id "acIRjHVzJqf6OS_oSZ3NAAAAAUk"]
[Tue Mar 24 12:22:36.526363 2026] [:error] [pid 64198:tid 64211] [client 4.213.99.137:1939] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass4.php"] [unique_id "acIRjHVzJqf6OS_oSZ3NAQAAAUs"]
[Tue Mar 24 12:22:37.315608 2026] [:error] [pid 48219:tid 48304] [client 4.213.99.137:1057] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass4.php"] [unique_id "acIRjShf3b4R_lAIyv8Q4AAAAhc"]
[Tue Mar 24 12:22:37.800163 2026] [:error] [pid 64198:tid 64221] [client 4.213.99.137:1972] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pass4.php"] [unique_id "acIRjXVzJqf6OS_oSZ3NEgAAAVU"]
[Tue Mar 24 12:22:38.154628 2026] [:error] [pid 64198:tid 64217] [client 4.213.99.137:1937] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "acIRjnVzJqf6OS_oSZ3NFgAAAVE"]
[Tue Mar 24 12:22:38.563608 2026] [:error] [pid 64198:tid 64204] [client 4.213.99.137:1942] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "acIRjnVzJqf6OS_oSZ3NGAAAAUQ"]
[Tue Mar 24 12:22:38.914820 2026] [:error] [pid 64198:tid 64203] [client 4.213.99.137:1706] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "acIRjnVzJqf6OS_oSZ3NGwAAAUM"]
[Tue Mar 24 12:22:39.323715 2026] [:error] [pid 64198:tid 64211] [client 4.213.99.137:1678] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wsvvs.php"] [unique_id "acIRj3VzJqf6OS_oSZ3NHwAAAUs"]
[Tue Mar 24 12:22:39.969822 2026] [:error] [pid 64198:tid 64222] [client 4.213.99.137:1953] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/G-In.php"] [unique_id "acIRj3VzJqf6OS_oSZ3NIgAAAVY"]
[Tue Mar 24 12:22:40.409607 2026] [:error] [pid 64198:tid 64208] [client 4.213.99.137:1684] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/G-In.php"] [unique_id "acIRkHVzJqf6OS_oSZ3NIwAAAUg"]
[Tue Mar 24 12:22:40.938462 2026] [:error] [pid 38767:tid 38775] [client 4.213.99.137:1965] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/G-In.php"] [unique_id "acIRkPwkUqN4GJAI5oU1-QAAAQU"]
[Tue Mar 24 12:22:41.271459 2026] [:error] [pid 38767:tid 38776] [client 4.213.99.137:1962] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/G-In.php"] [unique_id "acIRkfwkUqN4GJAI5oU1-wAAAQY"]
[Tue Mar 24 12:22:41.761194 2026] [:error] [pid 64198:tid 64213] [client 4.213.99.137:1689] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acIRkXVzJqf6OS_oSZ3NJgAAAU0"]
[Tue Mar 24 12:22:42.548072 2026] [:error] [pid 3031:tid 3092] [client 4.213.99.137:1924] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acIRkqJBKytnG47nuiYSjQAAAFA"]
[Tue Mar 24 12:22:42.984862 2026] [:error] [pid 38767:tid 38789] [client 4.213.99.137:1682] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acIRkvwkUqN4GJAI5oU2AgAAARM"]
[Tue Mar 24 12:22:43.437841 2026] [:error] [pid 64198:tid 64220] [client 4.213.99.137:1957] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acIRk3VzJqf6OS_oSZ3NJwAAAVQ"]
[Tue Mar 24 12:22:43.788292 2026] [:error] [pid 64198:tid 64214] [client 4.213.99.137:1971] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acIRk3VzJqf6OS_oSZ3NKAAAAU4"]
[Tue Mar 24 12:22:44.200520 2026] [:error] [pid 64198:tid 64218] [client 4.213.99.137:1955] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acIRlHVzJqf6OS_oSZ3NKgAAAVI"]
[Tue Mar 24 12:22:45.655773 2026] [:error] [pid 64198:tid 64224] [client 4.213.99.137:1029] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acIRlXVzJqf6OS_oSZ3NMAAAAVg"]
[Tue Mar 24 12:22:48.396142 2026] [:error] [pid 64198:tid 64210] [client 4.213.99.137:1723] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acIRmHVzJqf6OS_oSZ3NNgAAAUo"]
[Tue Mar 24 12:22:49.967150 2026] [:error] [pid 3137:tid 3154] [client 4.213.99.137:1718] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acIRmZdZesutm6dfYM-izQAAAM8"]
[Tue Mar 24 12:22:50.839484 2026] [:error] [pid 3137:tid 3150] [client 4.213.99.137:1961] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acIRmpdZesutm6dfYM-i0gAAAMs"]
[Tue Mar 24 12:22:51.178291 2026] [:error] [pid 48128:tid 48163] [client 4.213.99.137:1940] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acIRm8vR4LIMFLbM5VkP-wAAAYs"]
[Tue Mar 24 12:22:51.497790 2026] [:error] [pid 64198:tid 64213] [client 4.213.99.137:1686] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "acIRm3VzJqf6OS_oSZ3NOwAAAU0"]
[Tue Mar 24 12:22:51.926027 2026] [:error] [pid 64198:tid 64221] [client 4.213.99.137:1721] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acIRm3VzJqf6OS_oSZ3NPQAAAVU"]
[Tue Mar 24 12:22:52.315300 2026] [:error] [pid 64198:tid 64220] [client 4.213.99.137:1044] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acIRnHVzJqf6OS_oSZ3NPwAAAVQ"]
[Tue Mar 24 12:22:52.654763 2026] [:error] [pid 64198:tid 64222] [client 4.213.99.137:1065] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acIRnHVzJqf6OS_oSZ3NQQAAAVY"]
[Tue Mar 24 12:22:53.271168 2026] [:error] [pid 3137:tid 3160] [client 4.213.99.137:1688] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acIRnZdZesutm6dfYM-i1gAAANU"]
[Tue Mar 24 12:22:53.916488 2026] [:error] [pid 64198:tid 64204] [client 4.213.99.137:1033] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acIRnXVzJqf6OS_oSZ3NRAAAAUQ"]
[Tue Mar 24 12:22:54.281722 2026] [:error] [pid 3032:tid 3113] [client 4.213.99.137:1070] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acIRnia_-JXXD03-JNwTdwAAAIo"]
[Tue Mar 24 12:22:54.806693 2026] [:error] [pid 3032:tid 3122] [client 4.213.99.137:1080] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acIRnia_-JXXD03-JNwTeAAAAJM"]
[Tue Mar 24 12:22:55.239323 2026] [:error] [pid 48214:tid 48267] [client 4.213.99.137:1672] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acIRn7eshLWZ3uUDHKkf9QAAAc8"]
[Tue Mar 24 12:22:55.655888 2026] [:error] [pid 38767:tid 38770] [client 4.213.99.137:1926] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acIRn_wkUqN4GJAI5oU2CwAAAQA"]
[Tue Mar 24 12:22:56.090486 2026] [:error] [pid 3031:tid 3098] [client 4.213.99.137:1052] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acIRoKJBKytnG47nuiYSjgAAAFY"]
[Tue Mar 24 12:22:56.502127 2026] [:error] [pid 48214:tid 48259] [client 4.213.99.137:1694] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acIRoLeshLWZ3uUDHKkf9gAAAcc"]
[Tue Mar 24 12:22:56.822958 2026] [:error] [pid 48128:tid 48160] [client 4.213.99.137:1716] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acIRoMvR4LIMFLbM5VkP_wAAAYg"]
[Tue Mar 24 12:22:57.336449 2026] [:error] [pid 38767:tid 38793] [client 4.213.99.137:1056] [client 4.213.99.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acIRofwkUqN4GJAI5oU2DgAAARc"]
[Tue Mar 24 12:22:57.882335 2026] [:error] [pid 3030:tid 3051] [client 4.213.99.137:1925] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acIRoQyOuILyynfcqfkr6AAAAAI"]
[Tue Mar 24 12:22:58.472418 2026] [:error] [pid 3031:tid 3076] [client 4.213.99.137:1075] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acIRoqJBKytnG47nuiYSkQAAAEA"]
[Tue Mar 24 12:22:58.927315 2026] [:error] [pid 48219:tid 48292] [client 4.213.99.137:1930] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acIRoihf3b4R_lAIyv8Q7wAAAgs"]
[Tue Mar 24 12:23:00.159635 2026] [:error] [pid 3031:tid 3085] [client 4.213.99.137:1976] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acIRpKJBKytnG47nuiYSlAAAAEk"]
[Tue Mar 24 12:23:00.802609 2026] [:error] [pid 48219:tid 48295] [client 4.213.99.137:1960] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acIRpChf3b4R_lAIyv8Q8AAAAg4"]
[Tue Mar 24 12:23:01.508474 2026] [:error] [pid 3032:tid 3125] [client 4.213.99.137:1031] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acIRpSa_-JXXD03-JNwTgAAAAJY"]
[Tue Mar 24 12:23:01.844076 2026] [:error] [pid 48219:tid 48283] [client 4.213.99.137:1959] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acIRpShf3b4R_lAIyv8Q9QAAAgI"]
[Tue Mar 24 12:23:02.577552 2026] [:error] [pid 48219:tid 48296] [client 4.213.99.137:1729] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assets/css/index.php"] [unique_id "acIRpihf3b4R_lAIyv8Q9wAAAg8"]
[Tue Mar 24 12:23:03.057788 2026] [:error] [pid 64198:tid 64200] [client 4.213.99.137:1949] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assets/css/index.php"] [unique_id "acIRp3VzJqf6OS_oSZ3NUgAAAUA"]
[Tue Mar 24 12:23:03.865836 2026] [:error] [pid 38767:tid 38773] [client 4.213.99.137:1934] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assets/css/index.php"] [unique_id "acIRp_wkUqN4GJAI5oU2EwAAAQM"]
[Tue Mar 24 12:23:04.324600 2026] [:error] [pid 3030:tid 3062] [client 4.213.99.137:1027] [client 4.213.99.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/assets/css/index.php"] [unique_id "acIRqAyOuILyynfcqfkr7wAAAA0"]
[Tue Mar 24 12:58:05.575668 2026] [:error] [pid 3030:tid 3064] [client 43.130.3.120:51200] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acIZ3QyOuILyynfcqfkvsgAAAA8"]
[Tue Mar 24 15:53:22.630929 2026] [:error] [pid 48219:tid 48298] [client 45.128.39.211:54701] [client 45.128.39.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.39.211, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "acJC8ihf3b4R_lAIyv8-PQAAAhE"]
[Tue Mar 24 15:53:22.635031 2026] [:error] [pid 48219:tid 48298] [client 45.128.39.211:54701] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Mar 24 17:50:52.468442 2026] [:error] [pid 38767:tid 38781] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Mar 24 17:50:52.806378 2026] [:error] [pid 38767:tid 38773] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Mar 24 17:50:53.151173 2026] [:error] [pid 38767:tid 38778] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Mar 24 17:50:53.483049 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Mar 24 17:50:53.822661 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Mar 24 17:50:54.175595 2026] [:error] [pid 38767:tid 38775] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Mar 24 17:50:54.520056 2026] [:error] [pid 38767:tid 38790] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Tue Mar 24 17:50:54.852734 2026] [:error] [pid 38767:tid 38791] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Mar 24 17:50:55.240804 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Mar 24 17:50:56.759623 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Mar 24 17:50:57.091947 2026] [:error] [pid 38767:tid 38775] [client 2.57.170.218:27953] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Mar 24 17:50:57.449642 2026] [:error] [pid 38767:tid 38784] [client 2.57.170.218:27953] [client 2.57.170.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "acJegfwkUqN4GJAI5oXZqwAAAQ4"]
[Tue Mar 24 17:50:58.422017 2026] [:error] [pid 3031:tid 3094] [client 2.57.170.176:49421] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Mar 24 17:50:58.732438 2026] [:error] [pid 3031:tid 3076] [client 2.57.170.176:49421] [client 2.57.170.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "acJegqJBKytnG47nuiYqlQAAAEA"]
[Tue Mar 24 17:50:59.370703 2026] [:error] [pid 48219:tid 48297] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue Mar 24 17:50:59.751673 2026] [:error] [pid 48219:tid 48300] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Tue Mar 24 17:51:00.057969 2026] [:error] [pid 48219:tid 48290] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Tue Mar 24 17:51:00.363053 2026] [:error] [pid 48219:tid 48292] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Mar 24 17:51:00.714501 2026] [:error] [pid 48219:tid 48283] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Mar 24 17:51:01.021783 2026] [:error] [pid 48219:tid 48295] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Mar 24 17:51:01.327390 2026] [:error] [pid 48219:tid 48288] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Mar 24 17:51:01.694592 2026] [:error] [pid 48219:tid 48281] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Mar 24 17:51:02.037656 2026] [:error] [pid 48219:tid 48286] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Mar 24 17:51:02.336351 2026] [:error] [pid 48219:tid 48305] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Mar 24 17:51:02.649135 2026] [:error] [pid 48219:tid 48284] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 24 17:51:02.974941 2026] [:error] [pid 48219:tid 48285] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue Mar 24 17:51:03.325491 2026] [:error] [pid 48219:tid 48289] [client 2.57.170.177:47983] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue Mar 24 17:51:03.633313 2026] [:error] [pid 48219:tid 48287] [client 2.57.170.177:47983] [client 2.57.170.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "acJehyhf3b4R_lAIyv9aowAAAgY"]
[Tue Mar 24 17:51:04.242201 2026] [:error] [pid 38767:tid 38794] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Mar 24 17:51:04.532564 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Mar 24 17:51:04.844853 2026] [:error] [pid 38767:tid 38781] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Mar 24 17:51:05.148294 2026] [:error] [pid 38767:tid 38773] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Tue Mar 24 17:51:05.465097 2026] [:error] [pid 38767:tid 38788] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Tue Mar 24 17:51:05.761858 2026] [:error] [pid 38767:tid 38786] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Tue Mar 24 17:51:06.062153 2026] [:error] [pid 38767:tid 38793] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Mar 24 17:51:06.371138 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Tue Mar 24 17:51:08.231085 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue Mar 24 17:51:08.543649 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Mar 24 17:51:08.946656 2026] [:error] [pid 38767:tid 38775] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Mar 24 17:51:09.286481 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Tue Mar 24 17:51:09.608665 2026] [:error] [pid 38767:tid 38787] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Mar 24 17:51:09.957367 2026] [:error] [pid 38767:tid 38793] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Tue Mar 24 17:51:10.262528 2026] [:error] [pid 38767:tid 38791] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue Mar 24 17:51:10.581784 2026] [:error] [pid 38767:tid 38779] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Tue Mar 24 17:51:10.894829 2026] [:error] [pid 38767:tid 38789] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Mar 24 17:51:11.197125 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Tue Mar 24 17:51:11.507743 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Tue Mar 24 17:51:11.822071 2026] [:error] [pid 38767:tid 38775] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Mar 24 17:51:12.124795 2026] [:error] [pid 38767:tid 38781] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Tue Mar 24 17:51:12.420694 2026] [:error] [pid 38767:tid 38794] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Mar 24 17:51:12.728229 2026] [:error] [pid 38767:tid 38787] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Tue Mar 24 17:51:13.036981 2026] [:error] [pid 38767:tid 38773] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Mar 24 17:51:13.337365 2026] [:error] [pid 38767:tid 38790] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue Mar 24 17:51:13.641199 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Tue Mar 24 17:51:13.936552 2026] [:error] [pid 38767:tid 38783] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Tue Mar 24 17:51:14.241912 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Mar 24 17:51:14.540526 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Tue Mar 24 17:51:15.159469 2026] [:error] [pid 38767:tid 38794] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Mar 24 17:51:15.526672 2026] [:error] [pid 38767:tid 38787] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Mar 24 17:51:15.832703 2026] [:error] [pid 38767:tid 38773] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Tue Mar 24 17:51:16.150853 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Mar 24 17:51:16.455055 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Mar 24 17:51:16.770742 2026] [:error] [pid 38767:tid 38789] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Mar 24 17:51:17.081071 2026] [:error] [pid 38767:tid 38784] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Mar 24 17:51:17.380838 2026] [:error] [pid 38767:tid 38775] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Tue Mar 24 17:51:17.677958 2026] [:error] [pid 38767:tid 38773] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Tue Mar 24 17:51:17.971229 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Mar 24 17:51:18.582945 2026] [:error] [pid 38767:tid 38787] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Mar 24 17:51:18.893308 2026] [:error] [pid 38767:tid 38789] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Mar 24 17:51:19.190775 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Tue Mar 24 17:51:19.492592 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Tue Mar 24 17:51:19.786460 2026] [:error] [pid 38767:tid 38790] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Mar 24 17:51:20.115028 2026] [:error] [pid 38767:tid 38783] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Mar 24 17:51:20.421963 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Mar 24 17:51:20.720224 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Tue Mar 24 17:51:21.026887 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Mar 24 17:51:21.330044 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Mar 24 17:51:21.650469 2026] [:error] [pid 38767:tid 38793] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue Mar 24 17:51:21.972069 2026] [:error] [pid 38767:tid 38789] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Tue Mar 24 17:51:22.267305 2026] [:error] [pid 38767:tid 38777] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Mar 24 17:51:22.574356 2026] [:error] [pid 38767:tid 38783] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Tue Mar 24 17:51:22.887376 2026] [:error] [pid 38767:tid 38786] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Mar 24 17:51:23.185373 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Mar 24 17:51:23.497411 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Tue Mar 24 17:51:23.794149 2026] [:error] [pid 38767:tid 38770] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Mar 24 17:51:24.091710 2026] [:error] [pid 38767:tid 38788] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Tue Mar 24 17:51:24.427062 2026] [:error] [pid 38767:tid 38773] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Mar 24 17:51:24.731884 2026] [:error] [pid 38767:tid 38777] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Tue Mar 24 17:51:25.036719 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Tue Mar 24 17:51:25.339057 2026] [:error] [pid 38767:tid 38785] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Tue Mar 24 17:51:25.641804 2026] [:error] [pid 38767:tid 38775] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Mar 24 17:51:25.944500 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Mar 24 17:51:26.267598 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Mar 24 17:51:26.572340 2026] [:error] [pid 38767:tid 38791] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Mar 24 17:51:26.882750 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Tue Mar 24 17:51:27.184118 2026] [:error] [pid 38767:tid 38787] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Tue Mar 24 17:51:27.486344 2026] [:error] [pid 38767:tid 38784] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Tue Mar 24 17:51:27.835971 2026] [:error] [pid 38767:tid 38778] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Mar 24 17:51:28.148448 2026] [:error] [pid 38767:tid 38794] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Mar 24 17:51:28.452069 2026] [:error] [pid 38767:tid 38785] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Mar 24 17:51:28.757668 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Tue Mar 24 17:51:29.114852 2026] [:error] [pid 38767:tid 38781] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Tue Mar 24 17:51:29.420453 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Tue Mar 24 17:51:30.887021 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Tue Mar 24 17:51:31.243532 2026] [:error] [pid 38767:tid 38777] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Tue Mar 24 17:51:31.558835 2026] [:error] [pid 38767:tid 38788] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Mar 24 17:51:32.177247 2026] [:error] [pid 38767:tid 38778] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Tue Mar 24 17:51:32.550835 2026] [:error] [pid 38767:tid 38786] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Tue Mar 24 17:51:32.851858 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Tue Mar 24 17:51:33.148754 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Tue Mar 24 17:51:33.459198 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Tue Mar 24 17:51:33.758347 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Mar 24 17:51:34.063095 2026] [:error] [pid 38767:tid 38791] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Mar 24 17:51:34.362276 2026] [:error] [pid 38767:tid 38773] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Tue Mar 24 17:51:34.671401 2026] [:error] [pid 38767:tid 38793] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Tue Mar 24 17:51:34.973705 2026] [:error] [pid 38767:tid 38777] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/GA13.php
[Tue Mar 24 17:51:35.656355 2026] [:error] [pid 38767:tid 38779] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Mar 24 17:51:37.142613 2026] [:error] [pid 38767:tid 38779] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/locks.php
[Tue Mar 24 17:51:37.781025 2026] [:error] [pid 38767:tid 38787] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Tue Mar 24 17:51:38.121935 2026] [:error] [pid 38767:tid 38779] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Tue Mar 24 17:51:39.811313 2026] [:error] [pid 38767:tid 38779] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Tue Mar 24 17:51:40.136192 2026] [:error] [pid 38767:tid 38788] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Tue Mar 24 17:51:40.441155 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Tue Mar 24 17:51:41.437617 2026] [:error] [pid 38767:tid 38790] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Mar 24 17:51:41.785515 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.197:64613] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue Mar 24 17:51:42.367158 2026] [:error] [pid 64198:tid 64201] [client 2.57.170.209:64837] [client 2.57.170.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "acJernVzJqf6OS_oSZ1utQAAAUE"]
[Tue Mar 24 17:51:43.033712 2026] [:error] [pid 48219:tid 48298] [client 2.57.170.176:21997] [client 2.57.170.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "acJeryhf3b4R_lAIyv9arQAAAhE"]
[Tue Mar 24 17:51:47.178180 2026] [:error] [pid 48219:tid 48288] [client 2.57.170.199:45815] [client 2.57.170.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "acJesyhf3b4R_lAIyv9asgAAAgc"]
[Tue Mar 24 17:51:47.822365 2026] [:error] [pid 48128:tid 48172] [client 2.57.170.198:53343] [client 2.57.170.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "acJes8vR4LIMFLbM5VkrFgAAAZM"]
[Tue Mar 24 17:51:48.852406 2026] [:error] [pid 48214:tid 48258] [client 2.57.170.176:59089] [client 2.57.170.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "acJetLeshLWZ3uUDHKlT9gAAAcY"]
[Tue Mar 24 17:51:50.852949 2026] [:error] [pid 64198:tid 64210] [client 2.57.170.199:50199] [client 2.57.170.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "acJetnVzJqf6OS_oSZ1uzgAAAUo"]
[Tue Mar 24 17:51:51.479871 2026] [:error] [pid 3032:tid 3112] [client 2.57.170.199:51687] [client 2.57.170.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "acJetya_-JXXD03-JNw_GgAAAIk"]
[Tue Mar 24 17:51:53.031851 2026] [:error] [pid 48219:tid 48303] [client 2.57.170.212:53915] [client 2.57.170.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "acJeuShf3b4R_lAIyv9awgAAAhY"]
[Tue Mar 24 17:51:54.887662 2026] [:error] [pid 48214:tid 48260] [client 2.57.170.201:44621] [client 2.57.170.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "acJeureshLWZ3uUDHKlUBAAAAcg"]
[Tue Mar 24 17:51:55.547515 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.219:29417] [client 2.57.170.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "acJeu_wkUqN4GJAI5oXbKAAAAQw"]
[Tue Mar 24 17:51:56.161565 2026] [:error] [pid 48214:tid 48254] [client 2.57.170.197:31261] [client 2.57.170.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "acJevLeshLWZ3uUDHKlUCAAAAcI"]
[Tue Mar 24 17:51:56.777224 2026] [:error] [pid 3030:tid 3053] [client 2.57.170.171:41891] [client 2.57.170.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "acJevAyOuILyynfcqflNIQAAAAQ"]
[Tue Mar 24 17:51:59.880419 2026] [:error] [pid 3032:tid 3118] [client 2.57.170.217:65451] [client 2.57.170.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "acJevya_-JXXD03-JNw_JgAAAI8"]
[Tue Mar 24 17:52:00.954655 2026] [:error] [pid 3030:tid 3050] [client 2.57.170.181:33067] [client 2.57.170.181] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.181, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "acJewAyOuILyynfcqflNOgAAAAE"]
[Tue Mar 24 17:52:01.936990 2026] [:error] [pid 3030:tid 3055] [client 2.57.170.181:33067] [client 2.57.170.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/class-config.php"] [unique_id "acJewQyOuILyynfcqflNQQAAAAY"]
[Tue Mar 24 17:52:04.764701 2026] [:error] [pid 64198:tid 64216] [client 2.57.170.189:32541] [client 2.57.170.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "acJexHVzJqf6OS_oSZ1u5wAAAVA"]
[Tue Mar 24 17:52:06.698805 2026] [:error] [pid 3137:tid 3145] [client 2.57.170.190:25067] [client 2.57.170.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bak.php"] [unique_id "acJexpdZesutm6dfYM8AlwAAAMY"]
[Tue Mar 24 17:52:07.313032 2026] [:error] [pid 48219:tid 48296] [client 2.57.170.178:25821] [client 2.57.170.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acJexyhf3b4R_lAIyv9a3gAAAg8"]
[Tue Mar 24 17:52:08.721377 2026] [:error] [pid 48219:tid 48301] [client 2.57.170.198:32431] [client 2.57.170.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "acJeyChf3b4R_lAIyv9a6AAAAhQ"]
[Tue Mar 24 17:52:11.883614 2026] [:error] [pid 48219:tid 48304] [client 2.57.170.195:35125] [client 2.57.170.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/about.php"] [unique_id "acJeyyhf3b4R_lAIyv9a8gAAAhc"]
[Tue Mar 24 17:52:12.594728 2026] [:error] [pid 48214:tid 48261] [client 2.57.170.191:34463] [client 2.57.170.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "acJezLeshLWZ3uUDHKlUEwAAAck"]
[Tue Mar 24 17:52:13.848674 2026] [:error] [pid 48128:tid 48150] [client 2.57.170.175:27813] [client 2.57.170.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "acJezcvR4LIMFLbM5VkrNQAAAYE"]
[Tue Mar 24 17:52:14.483797 2026] [:error] [pid 48219:tid 48285] [client 2.57.170.59:21929] [client 2.57.170.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "acJezihf3b4R_lAIyv9a-wAAAgQ"]
[Tue Mar 24 17:52:16.082378 2026] [:error] [pid 64198:tid 64207] [client 2.57.170.187:35265] [client 2.57.170.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "acJe0HVzJqf6OS_oSZ1u9AAAAUc"]
[Tue Mar 24 17:52:16.726307 2026] [:error] [pid 38767:tid 38770] [client 2.57.170.204:21329] [client 2.57.170.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "acJe0PwkUqN4GJAI5oXbSwAAAQA"]
[Tue Mar 24 17:52:17.343215 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.192:63355] [client 2.57.170.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "acJe0fwkUqN4GJAI5oXbTQAAAQw"]
[Tue Mar 24 17:52:18.286503 2026] [:error] [pid 64198:tid 64201] [client 2.57.170.206:41089] [client 2.57.170.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "acJe0nVzJqf6OS_oSZ1u-QAAAUE"]
[Tue Mar 24 17:52:18.875260 2026] [:error] [pid 64198:tid 64209] [client 2.57.170.188:32435] [client 2.57.170.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "acJe0nVzJqf6OS_oSZ1u-wAAAUk"]
[Tue Mar 24 17:52:19.512290 2026] [:error] [pid 64198:tid 64221] [client 2.57.170.2:57923] [client 2.57.170.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "acJe03VzJqf6OS_oSZ1u_gAAAVU"]
[Tue Mar 24 17:52:20.136981 2026] [:error] [pid 48214:tid 48268] [client 2.57.170.205:60419] [client 2.57.170.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "acJe1LeshLWZ3uUDHKlUIQAAAdA"]
[Tue Mar 24 17:52:20.759504 2026] [:error] [pid 38767:tid 38770] [client 2.57.170.186:60439] [client 2.57.170.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acJe1PwkUqN4GJAI5oXbVgAAAQA"]
[Tue Mar 24 17:52:21.656303 2026] [:error] [pid 48219:tid 48288] [client 2.57.170.176:47885] [client 2.57.170.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "acJe1Shf3b4R_lAIyv9bBwAAAgc"]
[Tue Mar 24 17:52:24.194529 2026] [:error] [pid 64198:tid 64203] [client 2.57.170.190:31825] [client 2.57.170.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "acJe2HVzJqf6OS_oSZ1vDwAAAUM"]
[Tue Mar 24 17:52:24.801847 2026] [:error] [pid 64198:tid 64222] [client 2.57.170.205:23451] [client 2.57.170.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/network.php"] [unique_id "acJe2HVzJqf6OS_oSZ1vEAAAAVY"]
[Tue Mar 24 17:52:25.416472 2026] [:error] [pid 64198:tid 64200] [client 2.57.170.175:28943] [client 2.57.170.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "acJe2XVzJqf6OS_oSZ1vEgAAAUA"]
[Tue Mar 24 17:52:26.658886 2026] [:error] [pid 48219:tid 48291] [client 2.57.170.173:21617] [client 2.57.170.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "acJe2ihf3b4R_lAIyv9bJgAAAgo"]
[Tue Mar 24 17:52:27.288036 2026] [:error] [pid 48128:tid 48154] [client 2.57.170.195:41705] [client 2.57.170.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "acJe28vR4LIMFLbM5VkrPQAAAYU"]
[Tue Mar 24 17:52:28.502681 2026] [:error] [pid 64198:tid 64222] [client 2.57.170.178:40933] [client 2.57.170.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "acJe3HVzJqf6OS_oSZ1vIQAAAVY"]
[Tue Mar 24 17:52:29.405025 2026] [:error] [pid 38767:tid 38793] [client 2.57.170.60:48351] [client 2.57.170.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "acJe3fwkUqN4GJAI5oXbbgAAARc"]
[Tue Mar 24 17:52:30.032285 2026] [:error] [pid 3137:tid 3154] [client 2.57.170.178:38969] [client 2.57.170.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "acJe3pdZesutm6dfYM8ApwAAAM8"]
[Tue Mar 24 17:52:30.654998 2026] [:error] [pid 38767:tid 38784] [client 2.57.170.198:26051] [client 2.57.170.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "acJe3vwkUqN4GJAI5oXbcQAAAQ4"]
[Tue Mar 24 17:52:31.536692 2026] [:error] [pid 3032:tid 3104] [client 2.57.170.216:46643] [client 2.57.170.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acJe3ya_-JXXD03-JNw_SAAAAIE"]
[Tue Mar 24 17:52:32.438244 2026] [:error] [pid 3137:tid 3144] [client 2.57.170.212:36487] [client 2.57.170.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "acJe4JdZesutm6dfYM8ArwAAAMU"]
[Tue Mar 24 17:52:33.030510 2026] [:error] [pid 64198:tid 64208] [client 2.57.170.209:38131] [client 2.57.170.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "acJe4XVzJqf6OS_oSZ1vLwAAAUg"]
[Tue Mar 24 17:52:33.620527 2026] [:error] [pid 48219:tid 48302] [client 2.57.170.188:46607] [client 2.57.170.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acJe4Shf3b4R_lAIyv9bMwAAAhU"]
[Tue Mar 24 17:52:34.233883 2026] [:error] [pid 38767:tid 38786] [client 2.57.170.199:36691] [client 2.57.170.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "acJe4vwkUqN4GJAI5oXbcwAAARA"]
[Tue Mar 24 17:52:35.146969 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.184:36301] [client 2.57.170.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "acJe4_wkUqN4GJAI5oXbeQAAAQo"]
[Tue Mar 24 17:52:36.040412 2026] [:error] [pid 38767:tid 38775] [client 2.57.170.215:21299] [client 2.57.170.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/about.php"] [unique_id "acJe5PwkUqN4GJAI5oXbhAAAAQU"]
[Tue Mar 24 17:52:37.300468 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.175:44627] [client 2.57.170.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "acJe5fwkUqN4GJAI5oXbjAAAAQI"]
[Tue Mar 24 17:52:37.922562 2026] [:error] [pid 48219:tid 48294] [client 2.57.170.191:30155] [client 2.57.170.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acJe5Shf3b4R_lAIyv9bOQAAAg0"]
[Tue Mar 24 17:52:38.508073 2026] [:error] [pid 48219:tid 48291] [client 2.57.170.188:54113] [client 2.57.170.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "acJe5ihf3b4R_lAIyv9bPgAAAgo"]
[Tue Mar 24 17:52:39.098178 2026] [:error] [pid 48214:tid 48271] [client 2.57.170.186:47559] [client 2.57.170.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "acJe57eshLWZ3uUDHKlUTwAAAdM"]
[Tue Mar 24 17:52:39.718090 2026] [:error] [pid 64198:tid 64211] [client 2.57.170.195:53823] [client 2.57.170.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acJe53VzJqf6OS_oSZ1vNQAAAUs"]
[Tue Mar 24 17:52:40.595524 2026] [:error] [pid 48214:tid 48269] [client 2.57.170.203:37683] [client 2.57.170.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.203, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "acJe6LeshLWZ3uUDHKlUVAAAAdE"]
[Tue Mar 24 17:52:40.897813 2026] [:error] [pid 48214:tid 48263] [client 2.57.170.203:37683] [client 2.57.170.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "acJe6LeshLWZ3uUDHKlUVQAAAcs"]
[Tue Mar 24 17:52:41.503662 2026] [:error] [pid 48128:tid 48175] [client 2.57.170.190:62475] [client 2.57.170.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "acJe6cvR4LIMFLbM5VkrQQAAAZY"]
[Tue Mar 24 17:52:42.392079 2026] [:error] [pid 64198:tid 64209] [client 2.57.170.60:39579] [client 2.57.170.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "acJe6nVzJqf6OS_oSZ1vQAAAAUk"]
[Tue Mar 24 17:52:42.987223 2026] [:error] [pid 48128:tid 48156] [client 2.57.170.207:35667] [client 2.57.170.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "acJe6svR4LIMFLbM5VkrRAAAAYY"]
[Tue Mar 24 17:52:44.218631 2026] [:error] [pid 48128:tid 48164] [client 2.57.170.201:50255] [client 2.57.170.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "acJe7MvR4LIMFLbM5VkrSwAAAYw"]
[Tue Mar 24 17:52:44.815788 2026] [:error] [pid 48214:tid 48273] [client 2.57.170.215:20339] [client 2.57.170.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "acJe7LeshLWZ3uUDHKlUWQAAAdU"]
[Tue Mar 24 17:52:45.422378 2026] [:error] [pid 48214:tid 48268] [client 2.57.170.193:64293] [client 2.57.170.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "acJe7beshLWZ3uUDHKlUXAAAAdA"]
[Tue Mar 24 17:52:46.689827 2026] [:error] [pid 3030:tid 3060] [client 2.57.170.201:34041] [client 2.57.170.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acJe7gyOuILyynfcqflNVwAAAAs"]
[Tue Mar 24 17:52:47.317526 2026] [:error] [pid 48214:tid 48275] [client 2.57.170.207:64283] [client 2.57.170.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.207, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acJe77eshLWZ3uUDHKlUYQAAAdc"]
[Tue Mar 24 17:52:49.556220 2026] [:error] [pid 48214:tid 48253] [client 2.57.170.207:64283] [client 2.57.170.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "acJe8beshLWZ3uUDHKlUbQAAAcE"]
[Tue Mar 24 17:52:50.510524 2026] [:error] [pid 38767:tid 38784] [client 2.57.170.203:42737] [client 2.57.170.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/file.php"] [unique_id "acJe8vwkUqN4GJAI5oXbkQAAAQ4"]
[Tue Mar 24 17:52:52.035253 2026] [:error] [pid 3031:tid 3081] [client 2.57.170.181:55013] [client 2.57.170.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "acJe9KJBKytnG47nuiYqxgAAAEU"]
[Tue Mar 24 17:52:52.625305 2026] [:error] [pid 3030:tid 3049] [client 2.57.170.59:26969] [client 2.57.170.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "acJe9AyOuILyynfcqflNXAAAAAA"]
[Tue Mar 24 17:52:54.793404 2026] [:error] [pid 3030:tid 3069] [client 2.57.170.201:50209] [client 2.57.170.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.201, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "acJe9gyOuILyynfcqflNYwAAABQ"]
[Tue Mar 24 17:52:55.457851 2026] [:error] [pid 3030:tid 3068] [client 2.57.170.201:50209] [client 2.57.170.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "acJe9wyOuILyynfcqflNZQAAABM"]
[Tue Mar 24 17:52:57.038696 2026] [:error] [pid 38767:tid 38772] [client 2.57.170.184:23829] [client 2.57.170.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "acJe-fwkUqN4GJAI5oXbqgAAAQI"]
[Tue Mar 24 17:52:57.635533 2026] [:error] [pid 38767:tid 38786] [client 2.57.170.59:47013] [client 2.57.170.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/about.php"] [unique_id "acJe-fwkUqN4GJAI5oXbqwAAARA"]
[Tue Mar 24 17:52:58.840628 2026] [:error] [pid 38767:tid 38780] [client 2.57.170.212:25973] [client 2.57.170.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "acJe-vwkUqN4GJAI5oXbswAAAQo"]
[Tue Mar 24 17:52:59.469800 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.60:28599] [client 2.57.170.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "acJe-_wkUqN4GJAI5oXbtAAAARY"]
[Tue Mar 24 17:53:00.063663 2026] [:error] [pid 3137:tid 3160] [client 2.57.170.204:30149] [client 2.57.170.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "acJe_JdZesutm6dfYM8A1AAAANU"]
[Tue Mar 24 17:53:01.674442 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.192:27447] [client 2.57.170.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "acJe_fwkUqN4GJAI5oXbvQAAAQE"]
[Tue Mar 24 17:53:03.808632 2026] [:error] [pid 38767:tid 38782] [client 2.57.170.194:44131] [client 2.57.170.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/s/tinymce/skins/lightgray/fonts/index.php"] [unique_id "acJe__wkUqN4GJAI5oXb0AAAAQw"]
[Tue Mar 24 17:53:04.411703 2026] [:error] [pid 48128:tid 48169] [client 2.57.170.191:23059] [client 2.57.170.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "acJfAMvR4LIMFLbM5VkrVgAAAZA"]
[Tue Mar 24 17:53:05.007294 2026] [:error] [pid 48214:tid 48263] [client 2.57.170.215:57563] [client 2.57.170.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "acJfAbeshLWZ3uUDHKlUcwAAAcs"]
[Tue Mar 24 17:53:05.891325 2026] [:error] [pid 3137:tid 3153] [client 2.57.170.173:59055] [client 2.57.170.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/css.php"] [unique_id "acJfAZdZesutm6dfYM8A3AAAAM4"]
[Tue Mar 24 17:53:06.809740 2026] [:error] [pid 48214:tid 48265] [client 2.57.170.183:33269] [client 2.57.170.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "acJfAreshLWZ3uUDHKlUdgAAAc0"]
[Tue Mar 24 17:53:07.420013 2026] [:error] [pid 48219:tid 48292] [client 2.57.170.172:23449] [client 2.57.170.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "acJfAyhf3b4R_lAIyv9bSgAAAgs"]
[Tue Mar 24 17:53:09.223815 2026] [:error] [pid 48128:tid 48173] [client 2.57.170.186:56223] [client 2.57.170.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "acJfBcvR4LIMFLbM5VkrYAAAAZQ"]
[Tue Mar 24 17:53:09.819641 2026] [:error] [pid 48219:tid 48299] [client 2.57.170.201:34067] [client 2.57.170.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "acJfBShf3b4R_lAIyv9bTQAAAhI"]
[Tue Mar 24 17:53:10.400188 2026] [:error] [pid 48219:tid 48301] [client 2.57.170.194:42285] [client 2.57.170.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "acJfBihf3b4R_lAIyv9bTgAAAhQ"]
[Tue Mar 24 17:53:12.396768 2026] [:error] [pid 3137:tid 3145] [client 2.57.170.198:64423] [client 2.57.170.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "acJfCJdZesutm6dfYM8A6wAAAMY"]
[Tue Mar 24 17:53:12.998110 2026] [:error] [pid 38767:tid 38781] [client 2.57.170.209:65309] [client 2.57.170.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/pomo.php"] [unique_id "acJfCPwkUqN4GJAI5oXb3AAAAQs"]
[Tue Mar 24 17:53:13.658422 2026] [:error] [pid 38767:tid 38770] [client 2.57.170.177:37407] [client 2.57.170.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "acJfCfwkUqN4GJAI5oXb4gAAAQA"]
[Tue Mar 24 20:07:10.387797 2026] [:error] [pid 38767:tid 38770] [client 221.229.106.25:50878] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acJ-bvwkUqN4GJAI5oUv5gAAAQA"]
[Tue Mar 24 20:57:18.892554 2026] [:error] [pid 3032:tid 3118] [client 43.157.170.126:39566] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acKKLia_-JXXD03-JNxaNAAAAI8"]
[Tue Mar 24 23:30:52.283346 2026] [:error] [pid 48219:tid 48304] [client 43.130.53.252:52206] [client 43.130.53.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acKuLChf3b4R_lAIyv-l-AAAAhc"]
[Wed Mar 25 00:53:42.739720 2026] [:error] [pid 20371:tid 20380] [client 173.239.254.238:40631] [client 173.239.254.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.238, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "acLBlub25OL4yTv2fF9s0gAAAQc"]
[Wed Mar 25 00:53:42.743633 2026] [:error] [pid 20371:tid 20380] [client 173.239.254.238:40631] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Mar 25 01:39:29.791758 2026] [:error] [pid 57711:tid 58051] [client 170.106.143.6:44770] [client 170.106.143.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acLMUaLdPFdeRRktTdNgSQAAAIE"]
[Wed Mar 25 04:54:08.797641 2026] [:error] [pid 47989:tid 48000] [client 43.130.131.18:53870] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acL58CWKdJMhIccROjlI5AAAAUk"]
[Wed Mar 25 07:02:14.651486 2026] [:error] [pid 755:tid 839] [client 43.153.48.240:40374] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acMX9qS6bdaeEwgCGwpEiQAAAFA"]
[Wed Mar 25 07:38:40.400171 2026] [:error] [pid 892:tid 902] [client 45.94.31.15:62227] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMggCT_G8WMU3T3yxpORQAAAMU"]
[Wed Mar 25 07:38:40.402692 2026] [:error] [pid 47989:tid 47999] [client 45.94.31.15:62229] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "acMggCWKdJMhIccROjmeLgAAAUg"], referer: www.google.com
[Wed Mar 25 07:38:40.406092 2026] [:error] [pid 26269:tid 26296] [client 45.94.31.15:62237] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acMggEn7e-ZQbaIs7qx--wAAAZQ"]
[Wed Mar 25 07:38:40.406089 2026] [:error] [pid 26320:tid 26347] [client 45.94.31.15:62232] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMggDkUgS2mHAojGnl4QgAAAco"], referer: www.google.com
[Wed Mar 25 07:38:40.407061 2026] [:error] [pid 26269:tid 26277] [client 45.94.31.15:62226] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMggEn7e-ZQbaIs7qx-_AAAAYE"], referer: www.google.com
[Wed Mar 25 07:38:40.886439 2026] [:error] [pid 755:tid 823] [client 45.94.31.15:50445] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMggKS6bdaeEwgCGwpLqwAAAEg"]
[Wed Mar 25 07:38:40.890474 2026] [:error] [pid 26320:tid 26376] [client 45.94.31.15:50837] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "acMggDkUgS2mHAojGnl4SwAAAdQ"], referer: www.google.com
[Wed Mar 25 07:38:40.890679 2026] [:error] [pid 47946:tid 47970] [client 45.94.31.15:51874] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMggDipQTqBMSeKYhcXPQAAARY"], referer: www.google.com
[Wed Mar 25 07:38:40.900830 2026] [:error] [pid 755:tid 808] [client 45.94.31.15:51892] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMggKS6bdaeEwgCGwpLrAAAAEM"], referer: www.google.com
[Wed Mar 25 07:38:40.901324 2026] [:error] [pid 755:tid 835] [client 45.94.31.15:51996] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acMggKS6bdaeEwgCGwpLrQAAAEw"]
[Wed Mar 25 07:38:41.378642 2026] [:error] [pid 47989:tid 48002] [client 45.94.31.15:53960] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "acMggSWKdJMhIccROjmeRQAAAUs"], referer: www.google.com
[Wed Mar 25 07:38:41.379337 2026] [:error] [pid 754:tid 784] [client 45.94.31.15:53886] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMggTisL3asPbA3CtjOUAAAABM"]
[Wed Mar 25 07:38:41.380419 2026] [:error] [pid 756:tid 856] [client 45.94.31.15:53888] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMggTOaW6oylMIDBCTFOgAAAIQ"], referer: www.google.com
[Wed Mar 25 07:38:41.391157 2026] [:error] [pid 756:tid 871] [client 45.94.31.15:54022] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acMggTOaW6oylMIDBCTFPAAAAJM"]
[Wed Mar 25 07:38:41.393996 2026] [:error] [pid 756:tid 857] [client 45.94.31.15:54021] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMggTOaW6oylMIDBCTFPQAAAIU"], referer: www.google.com
[Wed Mar 25 07:38:41.869162 2026] [:error] [pid 26269:tid 26281] [client 45.94.31.15:50862] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "acMggUn7e-ZQbaIs7qx_NgAAAYU"], referer: www.google.com
[Wed Mar 25 07:38:41.869613 2026] [:error] [pid 47946:tid 47964] [client 45.94.31.15:50433] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMggTipQTqBMSeKYhcXWwAAARA"], referer: www.google.com
[Wed Mar 25 07:38:41.875367 2026] [:error] [pid 755:tid 822] [client 45.94.31.15:50560] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMggaS6bdaeEwgCGwpLygAAAEc"]
[Wed Mar 25 07:38:41.883323 2026] [:error] [pid 47989:tid 48007] [client 45.94.31.15:51070] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acMggSWKdJMhIccROjmeTgAAAVA"]
[Wed Mar 25 07:38:41.886249 2026] [:error] [pid 756:tid 872] [client 45.94.31.15:51071] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMggTOaW6oylMIDBCTFRgAAAJQ"], referer: www.google.com
[Wed Mar 25 07:38:42.359056 2026] [:error] [pid 26269:tid 26297] [client 45.94.31.15:54022] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMggkn7e-ZQbaIs7qx_RwAAAZU"], referer: www.google.com
[Wed Mar 25 07:38:42.359159 2026] [:error] [pid 47989:tid 47994] [client 45.94.31.15:54021] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "acMggiWKdJMhIccROjmeUwAAAUM"], referer: www.google.com
[Wed Mar 25 07:38:42.369347 2026] [:error] [pid 26320:tid 26368] [client 45.94.31.15:55038] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acMggjkUgS2mHAojGnl4gwAAAcw"]
[Wed Mar 25 07:38:42.377080 2026] [:error] [pid 892:tid 911] [client 45.94.31.15:54717] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "acMggiT_G8WMU3T3yxpOegAAAM0"]
[Wed Mar 25 07:38:42.384531 2026] [:error] [pid 754:tid 781] [client 45.94.31.15:55054] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMggjisL3asPbA3CtjObQAAABA"], referer: www.google.com
[Wed Mar 25 07:38:43.344748 2026] [:error] [pid 892:tid 919] [client 45.94.31.15:53245] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMggyT_G8WMU3T3yxpOlQAAANQ"], referer: www.google.com
[Wed Mar 25 07:38:43.363941 2026] [:error] [pid 754:tid 769] [client 45.94.31.15:53768] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMggzisL3asPbA3CtjOnAAAAAQ"], referer: www.google.com
[Wed Mar 25 07:38:44.344426 2026] [:error] [pid 755:tid 840] [client 45.94.31.15:65128] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghKS6bdaeEwgCGwpMGQAAAFE"], referer: www.google.com
[Wed Mar 25 07:38:44.363806 2026] [:error] [pid 26321:tid 26346] [client 45.94.31.15:49526] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghPKO65qqGZCSPZqwxQAAAgY"], referer: www.google.com
[Wed Mar 25 07:38:45.363201 2026] [:error] [pid 892:tid 913] [client 45.94.31.15:59078] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghST_G8WMU3T3yxpPCwAAAM8"], referer: www.google.com
[Wed Mar 25 07:38:45.408562 2026] [:error] [pid 892:tid 907] [client 45.94.31.15:59279] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghST_G8WMU3T3yxpPDQAAAMk"], referer: www.google.com
[Wed Mar 25 07:38:46.383730 2026] [:error] [pid 892:tid 908] [client 45.94.31.15:52339] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMghiT_G8WMU3T3yxpPTgAAAMo"], referer: www.google.com
[Wed Mar 25 07:38:46.399725 2026] [:error] [pid 756:tid 870] [client 45.94.31.15:53463] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghjOaW6oylMIDBCTF7AAAAJI"], referer: www.google.com
[Wed Mar 25 07:38:47.391485 2026] [:error] [pid 755:tid 825] [client 45.94.31.15:62357] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "acMgh6S6bdaeEwgCGwpMrQAAAEo"], referer: www.google.com
[Wed Mar 25 07:38:47.397751 2026] [:error] [pid 754:tid 773] [client 45.94.31.15:62706] [client 45.94.31.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "acMghzisL3asPbA3CtjPKwAAAAg"], referer: www.google.com
[Wed Mar 25 08:20:45.801463 2026] [:error] [pid 754:tid 782] [client 45.133.74.53:60570] [client 45.133.74.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "acMqXTisL3asPbA3CtjSpgAAABE"]
[Wed Mar 25 08:20:46.199474 2026] [:error] [pid 47989:tid 48005] [client 45.84.107.200:53276] [client 45.84.107.200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "acMqXiWKdJMhIccROjmtywAAAU4"]
[Wed Mar 25 08:20:47.634828 2026] [:error] [pid 26321:tid 26364] [client 185.220.101.10:9028] [client 185.220.101.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "acMqX_KO65qqGZCSPZq3bgAAAhc"]
[Wed Mar 25 08:20:48.764368 2026] [:error] [pid 47989:tid 48012] [client 185.220.101.25:43620] [client 185.220.101.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/.DS_Store"] [unique_id "acMqYCWKdJMhIccROjmt1AAAAVU"]
[Wed Mar 25 08:20:54.549713 2026] [:error] [pid 756:tid 862] [client 45.84.107.128:27021] [client 45.84.107.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "acMqZjOaW6oylMIDBCTPVwAAAIo"]
[Wed Mar 25 08:21:07.294183 2026] [:error] [pid 47989:tid 47997] [client 171.25.193.38:54678] [client 171.25.193.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "acMqcyWKdJMhIccROjmuCwAAAUY"]
[Wed Mar 25 10:12:23.098002 2026] [:error] [pid 47989:tid 47993] [client 43.166.129.247:36096] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acNEhyWKdJMhIccROjngWQAAAUI"]
[Wed Mar 25 12:22:28.372926 2026] [:error] [pid 26321:tid 26365] [client 43.157.38.131:47268] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acNjBPKO65qqGZCSPZrjZwAAAhg"]
[Wed Mar 25 16:55:13.488270 2026] [:error] [pid 25875:tid 25905] [client 182.42.104.32:43872] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acOi8RJ38QkS3NyfshzFygAAApg"]
[Wed Mar 25 17:48:16.486450 2026] [:error] [pid 25875:tid 25900] [client 43.135.145.73:47642] [client 43.135.145.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acOvYBJ38QkS3NyfshzVLgAAApM"]
[Wed Mar 25 18:28:11.789666 2026] [:error] [pid 25875:tid 25891] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/tx22.php
[Wed Mar 25 18:28:12.033939 2026] [:error] [pid 25875:tid 25895] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Mar 25 18:28:12.766921 2026] [:error] [pid 25875:tid 25885] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/lfm.php
[Wed Mar 25 18:28:13.017373 2026] [:error] [pid 25875:tid 25903] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/abca.php
[Wed Mar 25 18:28:13.259940 2026] [:error] [pid 25875:tid 25890] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Wed Mar 25 18:28:13.503630 2026] [:error] [pid 25875:tid 25896] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Wed Mar 25 18:28:13.747453 2026] [:error] [pid 25875:tid 25884] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2024.php
[Wed Mar 25 18:28:13.990672 2026] [:error] [pid 25875:tid 25900] [client 68.221.133.183:38927] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Wed Mar 25 18:28:14.234840 2026] [:error] [pid 25875:tid 25901] [client 68.221.133.183:38927] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acO4vhJ38QkS3NyfshzgywAAApQ"]
[Wed Mar 25 18:28:14.738581 2026] [:error] [pid 25875:tid 25904] [client 68.221.133.183:3980] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acO4vhJ38QkS3NyfshzgzAAAApc"]
[Wed Mar 25 18:28:15.295738 2026] [:error] [pid 25967:tid 25995] [client 68.221.133.183:25247] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acO4v_g8Qtq7ZM4mSFk6OwAAA1c"]
[Wed Mar 25 18:28:15.914156 2026] [:error] [pid 26449:tid 26466] [client 68.221.133.183:25224] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acO4v9pZ2T15NDqzAjFvBwAAAk0"]
[Wed Mar 25 18:28:16.708131 2026] [:error] [pid 26321:tid 26344] [client 68.221.133.183:54562] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acO4wPKO65qqGZCSPZo1jAAAAgU"]
[Wed Mar 25 18:28:28.905955 2026] [:error] [pid 25967:tid 25991] [client 68.221.133.183:24416] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acO4zPg8Qtq7ZM4mSFk6fQAAA1M"]
[Wed Mar 25 18:28:29.385306 2026] [:error] [pid 892:tid 904] [client 68.221.133.183:31194] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acO4zST_G8WMU3T3yxrJEgAAAMY"]
[Wed Mar 25 18:28:29.862911 2026] [:error] [pid 892:tid 895] [client 68.221.133.183:19648] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acO4zST_G8WMU3T3yxrJFAAAAME"]
[Wed Mar 25 18:28:30.341959 2026] [:error] [pid 47989:tid 48012] [client 68.221.133.183:16218] [client 68.221.133.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acO4ziWKdJMhIccROjmwwAAAAVU"]
[Wed Mar 25 20:46:55.406347 2026] [:error] [pid 47989:tid 47997] [client 170.106.165.76:37648] [client 170.106.165.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acPZPyWKdJMhIccROjnzIwAAAUY"]
[Wed Mar 25 21:16:26.908592 2026] [:error] [pid 756:tid 861] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/tx22.php
[Wed Mar 25 21:16:27.167679 2026] [:error] [pid 756:tid 858] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Mar 25 21:16:27.947121 2026] [:error] [pid 756:tid 872] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/lfm.php
[Wed Mar 25 21:16:28.206948 2026] [:error] [pid 756:tid 851] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/abca.php
[Wed Mar 25 21:16:28.465814 2026] [:error] [pid 756:tid 850] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Wed Mar 25 21:16:28.728775 2026] [:error] [pid 756:tid 870] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Wed Mar 25 21:16:28.988868 2026] [:error] [pid 756:tid 873] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2024.php
[Wed Mar 25 21:16:29.250325 2026] [:error] [pid 756:tid 856] [client 74.248.130.23:4334] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Wed Mar 25 21:16:29.505877 2026] [:error] [pid 756:tid 876] [client 74.248.130.23:4334] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPgLTOaW6oylMIDBCQlDgAAAJg"]
[Wed Mar 25 21:16:30.033249 2026] [:error] [pid 892:tid 896] [client 74.248.130.23:18289] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPgLiT_G8WMU3T3yxrdcwAAAMI"]
[Wed Mar 25 21:16:30.605902 2026] [:error] [pid 26321:tid 26350] [client 74.248.130.23:25403] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPgLvKO65qqGZCSPZpaZwAAAgk"]
[Wed Mar 25 21:16:31.172358 2026] [:error] [pid 26321:tid 26361] [client 74.248.130.23:33166] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPgL_KO65qqGZCSPZpaawAAAhQ"]
[Wed Mar 25 21:16:31.693225 2026] [:error] [pid 892:tid 922] [client 74.248.130.23:51577] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fde.php"] [unique_id "acPgLyT_G8WMU3T3yxrddQAAANc"]
[Wed Mar 25 21:16:32.302004 2026] [:error] [pid 47989:tid 47992] [client 74.248.130.23:24080] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fde.php"] [unique_id "acPgMCWKdJMhIccROjn8YQAAAUE"]
[Wed Mar 25 21:16:32.871693 2026] [:error] [pid 47989:tid 48010] [client 74.248.130.23:51629] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fde.php"] [unique_id "acPgMCWKdJMhIccROjn8ZQAAAVM"]
[Wed Mar 25 21:16:33.712684 2026] [:error] [pid 756:tid 861] [client 74.248.130.23:24696] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjde.php"] [unique_id "acPgMTOaW6oylMIDBCQlEQAAAIk"]
[Wed Mar 25 21:16:34.242025 2026] [:error] [pid 25967:tid 25995] [client 74.248.130.23:35226] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjde.php"] [unique_id "acPgMvg8Qtq7ZM4mSFlwSAAAA1c"]
[Wed Mar 25 21:16:34.853087 2026] [:error] [pid 756:tid 852] [client 74.248.130.23:33178] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPgMjOaW6oylMIDBCQlEgAAAII"]
[Wed Mar 25 21:16:35.366877 2026] [:error] [pid 26449:tid 26473] [client 74.248.130.23:24124] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPgM9pZ2T15NDqzAjGJAgAAAlQ"]
[Wed Mar 25 21:16:35.907216 2026] [:error] [pid 26321:tid 26354] [client 74.248.130.23:22384] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPgM_KO65qqGZCSPZpacAAAAg0"]
[Wed Mar 25 21:16:36.795935 2026] [:error] [pid 47989:tid 47999] [client 74.248.130.23:33209] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPgNCWKdJMhIccROjn8aQAAAUg"]
[Wed Mar 25 21:16:37.308361 2026] [:error] [pid 25875:tid 25893] [client 74.248.130.23:21794] [client 74.248.130.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta.php"] [unique_id "acPgNRJ38QkS3Nyfshwj8QAAAow"]
[Wed Mar 25 21:41:33.995306 2026] [:error] [pid 26321:tid 26344] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/tx22.php
[Wed Mar 25 21:41:34.259906 2026] [:error] [pid 26321:tid 26353] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/blurbs.php
[Wed Mar 25 21:41:35.057058 2026] [:error] [pid 26321:tid 26340] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/lfm.php
[Wed Mar 25 21:41:35.322183 2026] [:error] [pid 26321:tid 26359] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/abca.php
[Wed Mar 25 21:41:35.588801 2026] [:error] [pid 26321:tid 26348] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Wed Mar 25 21:41:35.853594 2026] [:error] [pid 26321:tid 26364] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Wed Mar 25 21:41:36.118162 2026] [:error] [pid 26321:tid 26356] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2024.php
[Wed Mar 25 21:41:36.386099 2026] [:error] [pid 26321:tid 26355] [client 20.166.31.118:48282] File does not exist: /usr/local/apache/htdocs/suspended-page/fgd.php
[Wed Mar 25 21:41:36.647718 2026] [:error] [pid 26321:tid 26363] [client 20.166.31.118:48282] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPmEPKO65qqGZCSPZpdwAAAAhY"]
[Wed Mar 25 21:41:37.180107 2026] [:error] [pid 25875:tid 25884] [client 20.166.31.118:60084] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPmERJ38QkS3NyfshwtUwAAAoM"]
[Wed Mar 25 21:41:37.682587 2026] [:error] [pid 25875:tid 25892] [client 20.166.31.118:60043] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPmERJ38QkS3NyfshwtVAAAAos"]
[Wed Mar 25 21:41:38.184782 2026] [:error] [pid 25967:tid 25979] [client 20.166.31.118:5545] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/AAAA.php"] [unique_id "acPmEvg8Qtq7ZM4mSFl1nQAAA0c"]
[Wed Mar 25 21:41:38.723586 2026] [:error] [pid 25875:tid 25894] [client 20.166.31.118:59810] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjde.php"] [unique_id "acPmEhJ38QkS3NyfshwtWQAAAo0"]
[Wed Mar 25 21:41:39.256301 2026] [:error] [pid 25875:tid 25904] [client 20.166.31.118:43603] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjde.php"] [unique_id "acPmExJ38QkS3NyfshwtXAAAApc"]
[Wed Mar 25 21:41:39.762592 2026] [:error] [pid 25875:tid 25884] [client 20.166.31.118:40920] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mjde.php"] [unique_id "acPmExJ38QkS3NyfshwtYAAAAoM"]
[Wed Mar 25 21:41:40.402263 2026] [:error] [pid 25875:tid 25895] [client 20.166.31.118:60062] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPmFBJ38QkS3NyfshwtYgAAAo4"]
[Wed Mar 25 21:41:40.902075 2026] [:error] [pid 25967:tid 25974] [client 20.166.31.118:55985] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPmFPg8Qtq7ZM4mSFl1nwAAA0I"]
[Wed Mar 25 21:41:41.405843 2026] [:error] [pid 47989:tid 47993] [client 20.166.31.118:55956] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPmFSWKdJMhIccROjkCsQAAAUI"]
[Wed Mar 25 21:41:41.909108 2026] [:error] [pid 892:tid 923] [client 20.166.31.118:60048] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gin.php"] [unique_id "acPmFST_G8WMU3T3yxrfgQAAANg"]
[Wed Mar 25 21:41:42.410253 2026] [:error] [pid 26449:tid 26475] [client 20.166.31.118:62467] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta.php"] [unique_id "acPmFtpZ2T15NDqzAjGLhAAAAlY"]
[Wed Mar 25 21:41:42.918920 2026] [:error] [pid 26449:tid 26457] [client 20.166.31.118:55953] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta.php"] [unique_id "acPmFtpZ2T15NDqzAjGLhQAAAkQ"]
[Wed Mar 25 21:41:43.421740 2026] [:error] [pid 26449:tid 26458] [client 20.166.31.118:59804] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta.php"] [unique_id "acPmF9pZ2T15NDqzAjGLiAAAAkU"]
[Wed Mar 25 21:41:43.939714 2026] [:error] [pid 26449:tid 26471] [client 20.166.31.118:40948] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yawa.php"] [unique_id "acPmF9pZ2T15NDqzAjGLiQAAAlI"]
[Wed Mar 25 21:41:44.441479 2026] [:error] [pid 26449:tid 26467] [client 20.166.31.118:62481] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yawa.php"] [unique_id "acPmGNpZ2T15NDqzAjGLiwAAAk4"]
[Wed Mar 25 21:41:44.941721 2026] [:error] [pid 47946:tid 47968] [client 20.166.31.118:55961] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yawa.php"] [unique_id "acPmGDipQTqBMSeKYheLDAAAARQ"]
[Wed Mar 25 21:41:45.478277 2026] [:error] [pid 892:tid 921] [client 20.166.31.118:64202] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bays.php"] [unique_id "acPmGST_G8WMU3T3yxrfggAAANY"]
[Wed Mar 25 21:41:45.979481 2026] [:error] [pid 892:tid 896] [client 20.166.31.118:62466] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bays.php"] [unique_id "acPmGST_G8WMU3T3yxrfgwAAAMI"]
[Wed Mar 25 21:41:46.483416 2026] [:error] [pid 47989:tid 48004] [client 20.166.31.118:5538] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bays.php"] [unique_id "acPmGiWKdJMhIccROjkCswAAAU0"]
[Wed Mar 25 21:41:46.984492 2026] [:error] [pid 47946:tid 47953] [client 20.166.31.118:39112] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bays.php"] [unique_id "acPmGjipQTqBMSeKYheLDgAAAQU"]
[Wed Mar 25 21:41:47.490735 2026] [:error] [pid 47946:tid 47959] [client 20.166.31.118:43611] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0rg.php"] [unique_id "acPmGzipQTqBMSeKYheLDwAAAQs"]
[Wed Mar 25 21:41:48.022966 2026] [:error] [pid 892:tid 901] [client 20.166.31.118:40899] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0rg.php"] [unique_id "acPmHCT_G8WMU3T3yxrfhAAAAMQ"]
[Wed Mar 25 21:41:48.524167 2026] [:error] [pid 47946:tid 47958] [client 20.166.31.118:48298] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0rg.php"] [unique_id "acPmHDipQTqBMSeKYheLFAAAAQo"]
[Wed Mar 25 21:41:49.028967 2026] [:error] [pid 47946:tid 47965] [client 20.166.31.118:40939] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x0rg.php"] [unique_id "acPmHTipQTqBMSeKYheLFgAAARE"]
[Wed Mar 25 21:41:49.560189 2026] [:error] [pid 47989:tid 47999] [client 20.166.31.118:40949] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dk.php"] [unique_id "acPmHSWKdJMhIccROjkCtAAAAUg"]
[Wed Mar 25 21:41:50.070453 2026] [:error] [pid 26269:tid 26290] [client 20.166.31.118:40885] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dk.php"] [unique_id "acPmHkn7e-ZQbaIs7qzDLAAAAY4"]
[Wed Mar 25 21:41:50.578156 2026] [:error] [pid 26269:tid 26284] [client 20.166.31.118:59277] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dk.php"] [unique_id "acPmHkn7e-ZQbaIs7qzDLQAAAYg"]
[Wed Mar 25 21:41:51.078656 2026] [:error] [pid 25969:tid 26041] [client 20.166.31.118:59280] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dk.php"] [unique_id "acPmHxd3aEUmOfdKja8UIQAAA88"]
[Wed Mar 25 21:41:51.582986 2026] [:error] [pid 47989:tid 48002] [client 20.166.31.118:43610] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "acPmHyWKdJMhIccROjkCuQAAAUs"]
[Wed Mar 25 21:41:52.085588 2026] [:error] [pid 47989:tid 48015] [client 20.166.31.118:62214] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "acPmICWKdJMhIccROjkCuwAAAVg"]
[Wed Mar 25 21:41:52.617989 2026] [:error] [pid 25875:tid 25887] [client 20.166.31.118:5419] [client 20.166.31.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "acPmIBJ38QkS3NyfshwtZAAAAoY"]
[Wed Mar 25 22:33:17.727685 2026] [:error] [pid 25875:tid 25886] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Mar 25 22:33:17.967808 2026] [:error] [pid 25875:tid 25900] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Wed Mar 25 22:33:18.226596 2026] [:error] [pid 25875:tid 25896] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Wed Mar 25 22:33:18.851914 2026] [:error] [pid 25875:tid 25889] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Mar 25 22:33:19.090425 2026] [:error] [pid 25875:tid 25892] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Wed Mar 25 22:33:19.329589 2026] [:error] [pid 25875:tid 25884] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Wed Mar 25 22:33:19.570496 2026] [:error] [pid 25875:tid 25881] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Wed Mar 25 22:33:19.823979 2026] [:error] [pid 25875:tid 25901] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Wed Mar 25 22:33:20.062043 2026] [:error] [pid 25875:tid 25895] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Wed Mar 25 22:33:20.401113 2026] [:error] [pid 25875:tid 25897] [client 20.216.138.90:15571] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Mar 25 22:33:20.796591 2026] [:error] [pid 25875:tid 25904] [client 20.216.138.90:15571] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acPyMBJ38QkS3NyfshxFhAAAApc"]
[Wed Mar 25 22:33:22.433661 2026] [:error] [pid 26321:tid 26343] [client 20.216.138.90:35067] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acPyMvKO65qqGZCSPZpmMAAAAgQ"]
[Wed Mar 25 22:33:24.764006 2026] [:error] [pid 47946:tid 47965] [client 20.216.138.90:43190] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acPyNDipQTqBMSeKYheNaQAAARE"]
[Wed Mar 25 22:33:27.730323 2026] [:error] [pid 47946:tid 47958] [client 20.216.138.90:42779] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "acPyNzipQTqBMSeKYheNcgAAAQo"]
[Wed Mar 25 22:33:29.044699 2026] [:error] [pid 25967:tid 25988] [client 20.216.138.90:42179] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blogs.php"] [unique_id "acPyOfg8Qtq7ZM4mSFmGfQAAA1A"]
[Wed Mar 25 22:33:31.627467 2026] [:error] [pid 25967:tid 25991] [client 20.216.138.90:15595] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blogs.php"] [unique_id "acPyO_g8Qtq7ZM4mSFmGjAAAA1M"]
[Wed Mar 25 22:33:33.546595 2026] [:error] [pid 47989:tid 48014] [client 20.216.138.90:35036] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blogs.php"] [unique_id "acPyPSWKdJMhIccROjkOYwAAAVc"]
[Wed Mar 25 22:33:35.008159 2026] [:error] [pid 26321:tid 26354] [client 20.216.138.90:13825] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blogs.php"] [unique_id "acPyP_KO65qqGZCSPZpmNQAAAg0"]
[Wed Mar 25 22:33:36.192614 2026] [:error] [pid 47989:tid 47994] [client 20.216.138.90:35055] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wen.php"] [unique_id "acPyQCWKdJMhIccROjkOawAAAUM"]
[Wed Mar 25 22:33:38.301084 2026] [:error] [pid 25967:tid 25974] [client 20.216.138.90:42215] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wen.php"] [unique_id "acPyQvg8Qtq7ZM4mSFmGlwAAA0I"]
[Wed Mar 25 22:34:12.919833 2026] [:error] [pid 25875:tid 25886] [client 20.216.138.90:15601] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "acPyZBJ38QkS3NyfshxFzgAAAoU"]
[Wed Mar 25 22:34:14.556307 2026] [:error] [pid 25969:tid 26048] [client 20.216.138.90:42233] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "acPyZhd3aEUmOfdKja8X3wAAA9Y"]
[Wed Mar 25 22:34:15.717939 2026] [:error] [pid 756:tid 869] [client 20.216.138.90:29770] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "acPyZzOaW6oylMIDBCQobQAAAJE"]
[Wed Mar 25 22:34:18.805856 2026] [:error] [pid 25967:tid 25993] [client 20.216.138.90:33922] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "acPyavg8Qtq7ZM4mSFmG0AAAA1U"]
[Wed Mar 25 22:34:20.010951 2026] [:error] [pid 26321:tid 26363] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Wed Mar 25 22:34:20.298280 2026] [:error] [pid 26321:tid 26351] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Wed Mar 25 22:34:20.563587 2026] [:error] [pid 26321:tid 26357] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Wed Mar 25 22:34:20.845581 2026] [:error] [pid 26321:tid 26362] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Wed Mar 25 22:34:21.227406 2026] [:error] [pid 26321:tid 26364] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Wed Mar 25 22:34:21.705125 2026] [:error] [pid 26321:tid 26341] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Mar 25 22:34:21.982817 2026] [:error] [pid 26321:tid 26342] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Mar 25 22:34:22.223854 2026] [:error] [pid 26321:tid 26356] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Mar 25 22:34:22.505492 2026] [:error] [pid 26321:tid 26348] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Wed Mar 25 22:34:22.745083 2026] [:error] [pid 26321:tid 26346] [client 20.216.138.90:33923] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Wed Mar 25 22:34:23.022485 2026] [:error] [pid 26321:tid 26365] [client 20.216.138.90:33923] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "acPyb_KO65qqGZCSPZpmWQAAAhg"]
[Wed Mar 25 22:34:25.082523 2026] [:error] [pid 25875:tid 25888] [client 20.216.138.90:51136] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "acPycRJ38QkS3NyfshxF1AAAAoc"]
[Wed Mar 25 22:34:28.803891 2026] [:error] [pid 25967:tid 25995] [client 20.216.138.90:51491] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "acPydPg8Qtq7ZM4mSFmG4AAAA1c"]
[Wed Mar 25 22:34:32.741576 2026] [:error] [pid 25875:tid 25886] [client 20.216.138.90:29771] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "acPyeBJ38QkS3NyfshxF4gAAAoU"]
[Wed Mar 25 22:34:39.006499 2026] [:error] [pid 25967:tid 25984] [client 20.216.138.90:33981] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acPyf_g8Qtq7ZM4mSFmG6gAAA0w"]
[Wed Mar 25 22:34:44.054498 2026] [:error] [pid 26321:tid 26343] [client 20.216.138.90:37851] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acPyhPKO65qqGZCSPZpmZgAAAgQ"]
[Wed Mar 25 22:34:45.348498 2026] [:error] [pid 25875:tid 25889] [client 20.216.138.90:5252] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acPyhRJ38QkS3NyfshxF7wAAAog"]
[Wed Mar 25 22:34:46.141544 2026] [:error] [pid 25875:tid 25882] [client 20.216.138.90:21665] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "acPyhhJ38QkS3NyfshxF8gAAAoE"]
[Wed Mar 25 22:34:47.275094 2026] [:error] [pid 26321:tid 26358] [client 20.216.138.90:38717] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws83.php"] [unique_id "acPyh_KO65qqGZCSPZpmZwAAAhE"]
[Wed Mar 25 22:34:49.314302 2026] [:error] [pid 26321:tid 26363] [client 20.216.138.90:38222] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws83.php"] [unique_id "acPyifKO65qqGZCSPZpmbgAAAhY"]
[Wed Mar 25 22:34:50.269735 2026] [:error] [pid 25875:tid 25900] [client 20.216.138.90:16105] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws83.php"] [unique_id "acPyihJ38QkS3NyfshxF_AAAApM"]
[Wed Mar 25 22:34:51.855464 2026] [:error] [pid 47989:tid 47998] [client 20.216.138.90:20645] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws83.php"] [unique_id "acPyiyWKdJMhIccROjkOsgAAAUc"]
[Wed Mar 25 22:34:53.863874 2026] [:error] [pid 26449:tid 26470] [client 20.216.138.90:7812] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "acPyjdpZ2T15NDqzAjGSKQAAAlE"]
[Wed Mar 25 22:34:57.333503 2026] [:error] [pid 25875:tid 25883] [client 20.216.138.90:9204] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "acPykRJ38QkS3NyfshxGHgAAAoI"]
[Wed Mar 25 22:34:59.360102 2026] [:error] [pid 47989:tid 48013] [client 20.216.138.90:31269] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "acPykyWKdJMhIccROjkO1AAAAVY"]
[Wed Mar 25 22:35:00.966401 2026] [:error] [pid 25875:tid 25896] [client 20.216.138.90:9536] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "acPylBJ38QkS3NyfshxGKwAAAo8"]
[Wed Mar 25 22:35:01.808503 2026] [:error] [pid 25875:tid 25885] [client 20.216.138.90:20191] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "acPylRJ38QkS3NyfshxGMQAAAoQ"]
[Wed Mar 25 22:35:02.702810 2026] [:error] [pid 25969:tid 26035] [client 20.216.138.90:20172] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "acPylhd3aEUmOfdKja8YAQAAA8k"]
[Wed Mar 25 22:35:03.508568 2026] [:error] [pid 47989:tid 48002] [client 20.216.138.90:29252] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "acPylyWKdJMhIccROjkO2wAAAUs"]
[Wed Mar 25 22:35:06.692623 2026] [:error] [pid 25875:tid 25883] [client 20.216.138.90:43720] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "acPymhJ38QkS3NyfshxGRQAAAoI"]
[Wed Mar 25 22:35:07.629023 2026] [:error] [pid 47989:tid 48005] [client 20.216.138.90:9538] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "acPymyWKdJMhIccROjkO3wAAAU4"]
[Wed Mar 25 22:35:08.372854 2026] [:error] [pid 47989:tid 48007] [client 20.216.138.90:43208] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "acPynCWKdJMhIccROjkO4wAAAVA"]
[Wed Mar 25 22:35:09.180004 2026] [:error] [pid 25875:tid 25900] [client 20.216.138.90:6009] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "acPynRJ38QkS3NyfshxGRgAAApM"]
[Wed Mar 25 22:35:09.931533 2026] [:error] [pid 25875:tid 25901] [client 20.216.138.90:19088] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "acPynRJ38QkS3NyfshxGSQAAApQ"]
[Wed Mar 25 22:35:11.555954 2026] [:error] [pid 25875:tid 25897] [client 20.216.138.90:32272] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acPynxJ38QkS3NyfshxGTAAAApA"]
[Wed Mar 25 22:35:12.276752 2026] [:error] [pid 26321:tid 26365] [client 20.216.138.90:18074] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acPyoPKO65qqGZCSPZpmqQAAAhg"]
[Wed Mar 25 22:35:13.554728 2026] [:error] [pid 25967:tid 25973] [client 20.216.138.90:30809] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acPyofg8Qtq7ZM4mSFmHDwAAA0E"]
[Wed Mar 25 22:35:14.979859 2026] [:error] [pid 25967:tid 25994] [client 20.216.138.90:43260] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "acPyovg8Qtq7ZM4mSFmHFAAAA1Y"]
[Wed Mar 25 22:35:15.931035 2026] [:error] [pid 26321:tid 26353] [client 20.216.138.90:44243] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bjfl.php"] [unique_id "acPyo_KO65qqGZCSPZpmrQAAAgw"]
[Wed Mar 25 22:35:16.632946 2026] [:error] [pid 26269:tid 26285] [client 20.216.138.90:17071] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bjfl.php"] [unique_id "acPypEn7e-ZQbaIs7qzGWgAAAYk"]
[Wed Mar 25 22:35:17.460211 2026] [:error] [pid 25967:tid 25989] [client 20.216.138.90:17598] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bjfl.php"] [unique_id "acPypfg8Qtq7ZM4mSFmHHwAAA1E"]
[Wed Mar 25 22:35:18.589695 2026] [:error] [pid 25967:tid 25980] [client 20.216.138.90:22204] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bjfl.php"] [unique_id "acPypvg8Qtq7ZM4mSFmHIAAAA0g"]
[Wed Mar 25 22:35:19.147951 2026] [:error] [pid 25967:tid 25994] [client 20.216.138.90:18067] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acPyp_g8Qtq7ZM4mSFmHIgAAA1Y"]
[Wed Mar 25 22:35:20.554943 2026] [:error] [pid 756:tid 860] [client 20.216.138.90:32304] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "acPyqDOaW6oylMIDBCQoeAAAAIg"]
[Wed Mar 25 22:35:22.201351 2026] [:error] [pid 26321:tid 26364] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Mar 25 22:35:22.446289 2026] [:error] [pid 26321:tid 26360] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Mar 25 22:35:22.687957 2026] [:error] [pid 26321:tid 26341] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-p2r3q9c8k4.php
[Wed Mar 25 22:35:22.934643 2026] [:error] [pid 26321:tid 26363] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Wed Mar 25 22:35:23.174950 2026] [:error] [pid 26321:tid 26357] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Wed Mar 25 22:35:23.486349 2026] [:error] [pid 26321:tid 26365] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Wed Mar 25 22:35:23.754451 2026] [:error] [pid 26321:tid 26350] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Wed Mar 25 22:35:24.060052 2026] [:error] [pid 26321:tid 26342] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Wed Mar 25 22:35:24.546704 2026] [:error] [pid 26321:tid 26362] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Wed Mar 25 22:35:24.892129 2026] [:error] [pid 26321:tid 26351] [client 20.216.138.90:30785] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Wed Mar 25 22:35:25.141772 2026] [:error] [pid 26321:tid 26344] [client 20.216.138.90:30785] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/155.php"] [unique_id "acPyrfKO65qqGZCSPZpmxwAAAgU"]
[Wed Mar 25 22:35:26.474873 2026] [:error] [pid 25875:tid 25901] [client 20.216.138.90:46942] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/155.php"] [unique_id "acPyrhJ38QkS3NyfshxGaQAAApQ"]
[Wed Mar 25 22:35:28.326601 2026] [:error] [pid 47946:tid 47962] [client 20.216.138.90:17073] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/155.php"] [unique_id "acPysDipQTqBMSeKYheNfgAAAQ4"]
[Wed Mar 25 22:35:30.049886 2026] [:error] [pid 25875:tid 25904] [client 20.216.138.90:22173] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/155.php"] [unique_id "acPyshJ38QkS3NyfshxGgwAAApc"]
[Wed Mar 25 22:35:31.137787 2026] [:error] [pid 892:tid 917] [client 20.216.138.90:38148] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/d12.php"] [unique_id "acPysyT_G8WMU3T3yxrkuQAAANI"]
[Wed Mar 25 22:35:31.976314 2026] [:error] [pid 892:tid 918] [client 20.216.138.90:18054] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/d12.php"] [unique_id "acPysyT_G8WMU3T3yxrkuwAAANM"]
[Wed Mar 25 22:35:32.678388 2026] [:error] [pid 892:tid 894] [client 20.216.138.90:38197] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/d12.php"] [unique_id "acPytCT_G8WMU3T3yxrkwAAAAMA"]
[Wed Mar 25 22:35:33.614223 2026] [:error] [pid 756:tid 876] [client 20.216.138.90:13395] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/d12.php"] [unique_id "acPytTOaW6oylMIDBCQoggAAAJg"]
[Wed Mar 25 22:35:34.506301 2026] [:error] [pid 756:tid 852] [client 20.216.138.90:36021] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tfm.php"] [unique_id "acPytjOaW6oylMIDBCQohwAAAII"]
[Wed Mar 25 22:35:35.181907 2026] [:error] [pid 25875:tid 25896] [client 20.216.138.90:46948] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tfm.php"] [unique_id "acPytxJ38QkS3NyfshxGiwAAAo8"]
[Wed Mar 25 22:35:36.819048 2026] [:error] [pid 26269:tid 26279] [client 20.216.138.90:12815] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tfm.php"] [unique_id "acPyuEn7e-ZQbaIs7qzGcQAAAYM"]
[Wed Mar 25 22:35:37.513536 2026] [:error] [pid 25875:tid 25902] [client 20.216.138.90:10362] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tfm.php"] [unique_id "acPyuRJ38QkS3NyfshxGmQAAApU"]
[Wed Mar 25 22:35:38.300309 2026] [:error] [pid 25875:tid 25881] [client 20.216.138.90:30258] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "acPyuhJ38QkS3NyfshxGnwAAAoA"]
[Wed Mar 25 22:35:39.597028 2026] [:error] [pid 26321:tid 26352] [client 20.216.138.90:46940] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "acPyu_KO65qqGZCSPZpm0gAAAgs"]
[Wed Mar 25 22:35:40.935569 2026] [:error] [pid 26449:tid 26477] [client 20.216.138.90:12802] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "acPyvNpZ2T15NDqzAjGSQwAAAlg"]
[Wed Mar 25 22:35:41.805407 2026] [:error] [pid 47989:tid 47992] [client 20.216.138.90:10367] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "acPyvSWKdJMhIccROjkPCQAAAUE"]
[Wed Mar 25 22:35:42.988657 2026] [:error] [pid 25969:tid 26047] [client 20.216.138.90:38166] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "acPyvhd3aEUmOfdKja8YBwAAA9U"]
[Wed Mar 25 22:35:44.204105 2026] [:error] [pid 47989:tid 48001] [client 20.216.138.90:13392] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "acPywCWKdJMhIccROjkPEgAAAUo"]
[Wed Mar 25 22:35:45.392696 2026] [:error] [pid 25875:tid 25905] [client 20.216.138.90:10304] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "acPywRJ38QkS3NyfshxGrAAAApg"]
[Wed Mar 25 22:35:48.789418 2026] [:error] [pid 25875:tid 25894] [client 20.216.138.90:50390] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "acPyxBJ38QkS3NyfshxGuwAAAo0"]
[Wed Mar 25 22:35:51.865665 2026] [:error] [pid 25875:tid 25889] [client 20.216.138.90:36022] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws86.php"] [unique_id "acPyxxJ38QkS3NyfshxGxgAAAog"]
[Wed Mar 25 22:35:55.181124 2026] [:error] [pid 47989:tid 48003] [client 20.216.138.90:50414] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws86.php"] [unique_id "acPyyyWKdJMhIccROjkPGwAAAUw"]
[Wed Mar 25 22:35:56.304831 2026] [:error] [pid 47946:tid 47963] [client 20.216.138.90:46872] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws86.php"] [unique_id "acPyzDipQTqBMSeKYheNgwAAAQ8"]
[Wed Mar 25 22:35:57.543434 2026] [:error] [pid 26449:tid 26474] [client 20.216.138.90:52228] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws86.php"] [unique_id "acPyzdpZ2T15NDqzAjGSUgAAAlU"]
[Wed Mar 25 22:35:58.551786 2026] [:error] [pid 26449:tid 26465] [client 20.216.138.90:30323] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "acPyztpZ2T15NDqzAjGSVAAAAkw"]
[Wed Mar 25 22:35:59.976741 2026] [:error] [pid 26449:tid 26459] [client 20.216.138.90:30296] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "acPyz9pZ2T15NDqzAjGSWAAAAkY"]
[Wed Mar 25 22:36:00.779716 2026] [:error] [pid 25875:tid 25896] [client 20.216.138.90:26793] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "acPy0BJ38QkS3NyfshxG5gAAAo8"]
[Wed Mar 25 22:36:01.673222 2026] [:error] [pid 47989:tid 48007] [client 20.216.138.90:52280] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "acPy0SWKdJMhIccROjkPIwAAAVA"]
[Wed Mar 25 22:36:02.607765 2026] [:error] [pid 25967:tid 25982] [client 20.216.138.90:46856] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "acPy0vg8Qtq7ZM4mSFmHTgAAA0o"]
[Wed Mar 25 22:36:03.537994 2026] [:error] [pid 25967:tid 25976] [client 20.216.138.90:13438] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "acPy0_g8Qtq7ZM4mSFmHUgAAA0Q"]
[Wed Mar 25 22:36:04.231942 2026] [:error] [pid 25967:tid 25986] [client 20.216.138.90:46966] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "acPy1Pg8Qtq7ZM4mSFmHWAAAA04"]
[Wed Mar 25 22:36:06.057555 2026] [:error] [pid 26321:tid 26340] [client 20.216.138.90:46962] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "acPy1vKO65qqGZCSPZpm5AAAAgE"]
[Wed Mar 25 22:36:07.565612 2026] [:error] [pid 26321:tid 26362] [client 20.216.138.90:30327] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin-footer.php"] [unique_id "acPy1_KO65qqGZCSPZpm7QAAAhU"]
[Wed Mar 25 22:36:09.178818 2026] [:error] [pid 47989:tid 48001] [client 20.216.138.90:17113] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin-footer.php"] [unique_id "acPy2SWKdJMhIccROjkPKwAAAUo"]
[Wed Mar 25 22:36:10.825818 2026] [:error] [pid 26321:tid 26340] [client 20.216.138.90:26766] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin-footer.php"] [unique_id "acPy2vKO65qqGZCSPZpm_AAAAgE"]
[Wed Mar 25 22:36:14.562434 2026] [:error] [pid 25967:tid 25977] [client 20.216.138.90:46867] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin-footer.php"] [unique_id "acPy3vg8Qtq7ZM4mSFmHYgAAA0U"]
[Wed Mar 25 22:36:54.134516 2026] [:error] [pid 26321:tid 26353] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Wed Mar 25 22:36:54.430968 2026] [:error] [pid 26321:tid 26354] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Wed Mar 25 22:36:54.938443 2026] [:error] [pid 26321:tid 26343] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/buc.php
[Wed Mar 25 22:36:55.199607 2026] [:error] [pid 26321:tid 26365] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Wed Mar 25 22:36:55.475923 2026] [:error] [pid 26321:tid 26355] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Wed Mar 25 22:36:55.714139 2026] [:error] [pid 26321:tid 26352] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Wed Mar 25 22:36:55.954409 2026] [:error] [pid 26321:tid 26361] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Wed Mar 25 22:36:56.271978 2026] [:error] [pid 26321:tid 26362] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Wed Mar 25 22:36:56.511502 2026] [:error] [pid 26321:tid 26360] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/44.php
[Wed Mar 25 22:36:56.750030 2026] [:error] [pid 26321:tid 26350] [client 20.216.138.90:50409] File does not exist: /usr/local/apache/htdocs/suspended-page/ws49.php
[Wed Mar 25 22:36:57.027248 2026] [:error] [pid 26321:tid 26344] [client 20.216.138.90:50409] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amp.php"] [unique_id "acPzCfKO65qqGZCSPZpnnwAAAgU"]
[Wed Mar 25 22:36:58.225660 2026] [:error] [pid 47946:tid 47971] [client 20.216.138.90:17136] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amp.php"] [unique_id "acPzCjipQTqBMSeKYheNrAAAARc"]
[Wed Mar 25 22:37:00.002988 2026] [:error] [pid 47989:tid 48002] [client 20.216.138.90:11282] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amp.php"] [unique_id "acPzDCWKdJMhIccROjkPUgAAAUs"]
[Wed Mar 25 22:37:01.222436 2026] [:error] [pid 26321:tid 26355] [client 20.216.138.90:39243] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amp.php"] [unique_id "acPzDfKO65qqGZCSPZpnqAAAAg4"]
[Wed Mar 25 22:37:02.538436 2026] [:error] [pid 25875:tid 25891] [client 20.216.138.90:39275] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "acPzDhJ38QkS3NyfshxHYQAAAoo"]
[Wed Mar 25 22:37:04.540371 2026] [:error] [pid 25875:tid 25894] [client 20.216.138.90:40157] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "acPzEBJ38QkS3NyfshxHcAAAAo0"]
[Wed Mar 25 22:37:05.608269 2026] [:error] [pid 26449:tid 26471] [client 20.216.138.90:40649] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "acPzEdpZ2T15NDqzAjGSjwAAAlI"]
[Wed Mar 25 22:37:07.606483 2026] [:error] [pid 25875:tid 25890] [client 20.216.138.90:40139] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/install.php"] [unique_id "acPzExJ38QkS3NyfshxHfgAAAok"]
[Wed Mar 25 22:37:10.363563 2026] [:error] [pid 25875:tid 25897] [client 20.216.138.90:40697] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "acPzFhJ38QkS3NyfshxHigAAApA"]
[Wed Mar 25 22:37:12.750512 2026] [:error] [pid 25875:tid 25888] [client 20.216.138.90:14396] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "acPzGBJ38QkS3NyfshxHlgAAAoc"]
[Wed Mar 25 22:37:13.723338 2026] [:error] [pid 25875:tid 25900] [client 20.216.138.90:15049] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "acPzGRJ38QkS3NyfshxHmwAAApM"]
[Wed Mar 25 22:37:15.163050 2026] [:error] [pid 26321:tid 26349] [client 20.216.138.90:13313] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "acPzG_KO65qqGZCSPZpnxAAAAgg"]
[Wed Mar 25 22:37:16.312577 2026] [:error] [pid 25875:tid 25892] [client 20.216.138.90:15014] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws81.php"] [unique_id "acPzHBJ38QkS3NyfshxHpwAAAos"]
[Wed Mar 25 22:37:16.958963 2026] [:error] [pid 25875:tid 25899] [client 20.216.138.90:15056] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws81.php"] [unique_id "acPzHBJ38QkS3NyfshxHqgAAApI"]
[Wed Mar 25 22:37:17.954787 2026] [:error] [pid 47946:tid 47961] [client 20.216.138.90:15027] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws81.php"] [unique_id "acPzHTipQTqBMSeKYheNrgAAAQ0"]
[Wed Mar 25 22:37:19.012368 2026] [:error] [pid 25967:tid 25993] [client 20.216.138.90:15031] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws81.php"] [unique_id "acPzH_g8Qtq7ZM4mSFmH_QAAA1U"]
[Wed Mar 25 22:37:21.378210 2026] [:error] [pid 47989:tid 47996] [client 20.216.138.90:15021] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "acPzISWKdJMhIccROjkPXwAAAUU"]
[Wed Mar 25 22:37:22.298037 2026] [:error] [pid 25967:tid 25977] [client 20.216.138.90:31327] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "acPzIvg8Qtq7ZM4mSFmIBgAAA0U"]
[Wed Mar 25 22:37:25.116753 2026] [:error] [pid 25875:tid 25890] [client 20.216.138.90:46329] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "acPzJRJ38QkS3NyfshxHxgAAAok"]
[Wed Mar 25 22:37:26.004609 2026] [:error] [pid 47989:tid 48000] [client 20.216.138.90:39700] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "acPzJiWKdJMhIccROjkPYgAAAUk"]
[Wed Mar 25 22:37:27.028598 2026] [:error] [pid 26321:tid 26357] [client 20.216.138.90:38776] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx78.php"] [unique_id "acPzJ_KO65qqGZCSPZpn0AAAAhA"]
[Wed Mar 25 22:37:27.655686 2026] [:error] [pid 25969:tid 26037] [client 20.216.138.90:38754] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx78.php"] [unique_id "acPzJxd3aEUmOfdKja8YKAAAA8s"]
[Wed Mar 25 22:37:28.518161 2026] [:error] [pid 25875:tid 25886] [client 20.216.138.90:45288] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx78.php"] [unique_id "acPzKBJ38QkS3NyfshxH1AAAAoU"]
[Wed Mar 25 22:37:29.972981 2026] [:error] [pid 25969:tid 26031] [client 20.216.138.90:45649] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx78.php"] [unique_id "acPzKRd3aEUmOfdKja8YKgAAA8U"]
[Wed Mar 25 22:37:31.132648 2026] [:error] [pid 25875:tid 25893] [client 20.216.138.90:12894] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acPzKxJ38QkS3NyfshxH2gAAAow"]
[Wed Mar 25 22:37:32.216006 2026] [:error] [pid 25875:tid 25887] [client 20.216.138.90:39716] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acPzLBJ38QkS3NyfshxH3wAAAoY"]
[Wed Mar 25 22:37:33.059661 2026] [:error] [pid 25967:tid 25994] [client 20.216.138.90:33270] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acPzLfg8Qtq7ZM4mSFmIDQAAA1Y"]
[Wed Mar 25 22:37:33.704762 2026] [:error] [pid 26449:tid 26454] [client 20.216.138.90:40123] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "acPzLdpZ2T15NDqzAjGSpwAAAkE"]
[Wed Mar 25 22:37:34.306426 2026] [:error] [pid 892:tid 919] [client 20.216.138.90:27270] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "acPzLiT_G8WMU3T3yxrlCAAAANQ"]
[Wed Mar 25 22:37:35.237065 2026] [:error] [pid 25967:tid 25977] [client 20.216.138.90:53705] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "acPzL_g8Qtq7ZM4mSFmIFAAAA0U"]
[Wed Mar 25 22:37:35.895887 2026] [:error] [pid 26321:tid 26360] [client 20.216.138.90:33266] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "acPzL_KO65qqGZCSPZpn2wAAAhM"]
[Wed Mar 25 22:37:36.680302 2026] [:error] [pid 25875:tid 25903] [client 20.216.138.90:45303] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cu.php"] [unique_id "acPzMBJ38QkS3NyfshxH5wAAApY"]
[Wed Mar 25 22:37:37.490342 2026] [:error] [pid 892:tid 920] [client 20.216.138.90:40598] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd.php"] [unique_id "acPzMST_G8WMU3T3yxrlCgAAANU"]
[Wed Mar 25 22:37:38.088251 2026] [:error] [pid 892:tid 909] [client 20.216.138.90:6030] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd.php"] [unique_id "acPzMiT_G8WMU3T3yxrlCwAAAMs"]
[Wed Mar 25 22:37:38.842586 2026] [:error] [pid 26269:tid 26291] [client 20.216.138.90:33273] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd.php"] [unique_id "acPzMkn7e-ZQbaIs7qzGnQAAAY8"]
[Wed Mar 25 22:37:39.723492 2026] [:error] [pid 25967:tid 25976] [client 20.216.138.90:19652] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/asd.php"] [unique_id "acPzM_g8Qtq7ZM4mSFmIHgAAA0Q"]
[Wed Mar 25 22:37:40.969765 2026] [:error] [pid 25875:tid 25900] [client 20.216.138.90:27291] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "acPzNBJ38QkS3NyfshxH8AAAApM"]
[Wed Mar 25 22:37:42.251838 2026] [:error] [pid 25875:tid 25898] [client 20.216.138.90:53756] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "acPzNhJ38QkS3NyfshxH8wAAApE"]
[Wed Mar 25 22:37:42.801450 2026] [:error] [pid 25967:tid 25982] [client 20.216.138.90:27824] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "acPzNvg8Qtq7ZM4mSFmIKQAAA0o"]
[Wed Mar 25 22:37:43.711452 2026] [:error] [pid 25967:tid 25986] [client 20.216.138.90:12877] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "acPzN_g8Qtq7ZM4mSFmILwAAA04"]
[Wed Mar 25 22:37:45.258396 2026] [:error] [pid 26449:tid 26466] [client 20.216.138.90:20110] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/myfile.php"] [unique_id "acPzOdpZ2T15NDqzAjGSrQAAAk0"]
[Wed Mar 25 22:37:46.016784 2026] [:error] [pid 25969:tid 26040] [client 20.216.138.90:39755] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/myfile.php"] [unique_id "acPzOhd3aEUmOfdKja8YNgAAA84"]
[Wed Mar 25 22:37:46.624129 2026] [:error] [pid 25967:tid 25983] [client 20.216.138.90:26828] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/myfile.php"] [unique_id "acPzOvg8Qtq7ZM4mSFmINAAAA0s"]
[Wed Mar 25 22:37:47.230460 2026] [:error] [pid 26449:tid 26456] [client 20.216.138.90:46321] [client 20.216.138.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/myfile.php"] [unique_id "acPzO9pZ2T15NDqzAjGSrwAAAkM"]
[Wed Mar 25 22:52:16.367817 2026] [:error] [pid 25967:tid 25982] [client 170.106.35.153:43474] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acP2oPg8Qtq7ZM4mSFmNJwAAA0o"]
[Thu Mar 26 02:07:57.067271 2026] [:error] [pid 32829:tid 32833] [client 170.106.15.3:50650] [client 170.106.15.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acQkfXFEeazI9mYaKszxYwAAAEI"]
[Thu Mar 26 07:03:26.917607 2026] [:error] [pid 60829:tid 60834] [client 182.44.9.147:37495] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acRpvvTdjHKeZokybaQhCgAAAQM"]
[Thu Mar 26 07:12:52.156012 2026] [:error] [pid 19710:tid 19743] [client 192.3.207.218:56646] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/artisan"] [unique_id "acRr9AVEWP8Ar68Njk6onwAAABU"]
[Thu Mar 26 07:12:52.595445 2026] [:error] [pid 19818:tid 19836] [client 192.3.207.218:57178] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/artisan"] [unique_id "acRr9MzaSnm3d1BeM5WNfgAAANA"]
[Thu Mar 26 07:12:53.692385 2026] [:error] [pid 60829:tid 60836] [client 192.3.207.218:57595] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/artisan"] [unique_id "acRr9fTdjHKeZokybaQpowAAAQU"]
[Thu Mar 26 07:12:54.118687 2026] [:error] [pid 19711:tid 19749] [client 192.3.207.218:58219] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/artisan"] [unique_id "acRr9mj3l1y81GYfluRJkAAAAEA"]
[Thu Mar 26 07:12:54.973297 2026] [:error] [pid 60829:tid 60849] [client 192.3.207.218:58570] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "acRr9vTdjHKeZokybaQpzwAAARI"]
[Thu Mar 26 07:12:55.398499 2026] [:error] [pid 19712:tid 19782] [client 192.3.207.218:59328] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "acRr99WhKhRNqm23vFPeZwAAAIY"]
[Thu Mar 26 07:12:56.266410 2026] [:error] [pid 31778:tid 31810] [client 192.3.207.218:59848] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "acRr-A3kybI2o-xasmA3JQAAAdE"]
[Thu Mar 26 07:12:56.685631 2026] [:error] [pid 19712:tid 19791] [client 192.3.207.218:60671] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "acRr-NWhKhRNqm23vFPemAAAAI8"]
[Thu Mar 26 07:54:27.159915 2026] [:error] [pid 31780:tid 31822] [client 43.133.187.11:38830] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acR1s5JDwZsy5O4ZXEiyqQAAAgI"]
[Thu Mar 26 14:07:21.418302 2026] [:error] [pid 31778:tid 31805] [client 182.42.104.32:50579] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acTNGQ3kybI2o-xasmCyvwAAAcw"]
[Thu Mar 26 17:49:46.823595 2026] [:error] [pid 31780:tid 31839] [client 45.89.60.157:62663] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Thu Mar 26 18:10:25.757677 2026] [:error] [pid 19710:tid 19724] [client 43.159.128.155:46334] [client 43.159.128.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acUGEQVEWP8Ar68Njk76OQAAAAI"]
[Thu Mar 26 21:41:50.283566 2026] [:error] [pid 19818:tid 19837] [client 182.42.104.32:43599] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acU3nszaSnm3d1BeM5U2pAAAANE"]
[Thu Mar 26 22:53:11.055665 2026] [:error] [pid 19711:tid 19760] [client 43.159.148.221:49398] [client 43.159.148.221] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acVIV2j3l1y81GYfluTPGQAAAEs"]
[Fri Mar 27 00:55:19.642336 2026] [:error] [pid 62149:tid 62526] [client 43.166.136.24:53192] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acVk92Hvvta9MPqU8PVavAAAAQI"]
[Fri Mar 27 01:38:49.860454 2026] [:error] [pid 62551:tid 62568] [client 185.169.4.152:57100] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "acVvKYQvFHgfE1g4p7CRaAAAAc4"]
[Fri Mar 27 04:19:46.763016 2026] [:error] [pid 27743:tid 27788] [client 43.154.127.188:49724] [client 43.154.127.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acWU4iA46UYYLqzw99DqBAAAABg"]
[Fri Mar 27 04:41:08.066018 2026] [:error] [pid 63897:tid 63900] [client 43.138.68.113:60608] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acWZ5GVSkmYmLu7ycYjAqAAAAQE"]
[Fri Mar 27 10:40:49.914475 2026] [:error] [pid 4293:tid 4299] [client 216.81.248.32:44864] [client 216.81.248.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "acXuMZLjeJUC3OKtEx8T1QAAAUQ"]
[Fri Mar 27 11:32:51.146171 2026] [:error] [pid 4341:tid 4352] [client 101.42.46.71:47318] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acX6Y-KJWrNB5dMlERGcHwAAAYk"]
[Fri Mar 27 12:10:06.864754 2026] [:error] [pid 4293:tid 4313] [client 43.135.133.194:60548] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acYDHpLjeJUC3OKtEx9WWQAAAVI"]
[Fri Mar 27 15:36:30.887952 2026] [:error] [pid 27743:tid 27782] [client 43.157.188.74:58442] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acYzfiA46UYYLqzw99BYGQAAABI"]
[Fri Mar 27 18:12:29.809781 2026] [:error] [pid 27743:tid 27788] [client 43.166.247.155:41740] [client 43.166.247.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acZYDSA46UYYLqzw99Cq2gAAABg"]
[Fri Mar 27 18:44:08.047435 2026] [:error] [pid 27749:tid 27811] [client 182.44.2.148:52907] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acZfeMEqyoMni2Q6_X7k3AAAAFQ"]
[Fri Mar 27 21:05:35.239908 2026] [:error] [pid 4293:tid 4296] [client 129.226.213.145:54284] [client 129.226.213.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acaAn5LjeJUC3OKtEx-n7QAAAUE"]
[Fri Mar 27 23:14:23.228638 2026] [:error] [pid 27851:tid 27866] [client 43.166.136.202:56716] [client 43.166.136.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acaez3R2ccxe3RMCLboglQAAAMg"]
[Fri Mar 27 23:19:37.469084 2026] [:error] [pid 4341:tid 4361] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Fri Mar 27 23:19:37.856337 2026] [:error] [pid 4341:tid 4360] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/xc0252.php
[Fri Mar 27 23:19:38.120634 2026] [:error] [pid 4341:tid 4351] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Mar 27 23:19:38.385282 2026] [:error] [pid 4341:tid 4350] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Mar 27 23:19:38.746886 2026] [:error] [pid 4341:tid 4359] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Fri Mar 27 23:19:39.014045 2026] [:error] [pid 4341:tid 4367] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Fri Mar 27 23:19:39.287185 2026] [:error] [pid 4341:tid 4345] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/ws47.php
[Fri Mar 27 23:19:39.601585 2026] [:error] [pid 4341:tid 4358] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/vvvb.php
[Fri Mar 27 23:19:39.875909 2026] [:error] [pid 4341:tid 4365] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/x12.php
[Fri Mar 27 23:19:40.190875 2026] [:error] [pid 4341:tid 4364] [client 20.100.186.223:59748] File does not exist: /usr/local/apache/htdocs/suspended-page/zcsu.php
[Fri Mar 27 23:19:40.449823 2026] [:error] [pid 4341:tid 4349] [client 20.100.186.223:59748] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acagDOKJWrNB5dMlERHR7wAAAYY"]
[Fri Mar 27 23:19:41.162669 2026] [:error] [pid 27749:tid 27792] [client 20.100.186.223:58599] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acagDcEqyoMni2Q6_X4kZAAAAEE"]
[Fri Mar 27 23:19:41.775628 2026] [:error] [pid 27749:tid 27811] [client 20.100.186.223:56149] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acagDcEqyoMni2Q6_X4kZwAAAFQ"]
[Fri Mar 27 23:19:42.532721 2026] [:error] [pid 54663:tid 54666] [client 20.100.186.223:59755] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acagDhUtStIXFk9WHe3pNQAAAcA"]
[Fri Mar 27 23:19:43.298347 2026] [:error] [pid 27743:tid 27784] [client 20.100.186.223:59761] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxs.php"] [unique_id "acagDyA46UYYLqzw99AnMQAAABQ"]
[Fri Mar 27 23:19:43.949318 2026] [:error] [pid 4293:tid 4296] [client 20.100.186.223:59760] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxs.php"] [unique_id "acagD5LjeJUC3OKtEx_GKAAAAUE"]
[Fri Mar 27 23:19:44.538109 2026] [:error] [pid 4341:tid 4350] [client 20.100.186.223:58509] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxs.php"] [unique_id "acagEOKJWrNB5dMlERHR8AAAAYc"]
[Fri Mar 27 23:19:45.122349 2026] [:error] [pid 54663:tid 54676] [client 20.100.186.223:59660] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxs.php"] [unique_id "acagERUtStIXFk9WHe3pOgAAAco"]
[Fri Mar 27 23:19:45.813442 2026] [:error] [pid 4341:tid 4366] [client 20.100.186.223:59712] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "acagEeKJWrNB5dMlERHR8gAAAZc"]
[Fri Mar 27 23:19:46.809213 2026] [:error] [pid 27749:tid 27797] [client 20.100.186.223:59256] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "acagEsEqyoMni2Q6_X4kagAAAEY"]
[Fri Mar 27 23:19:47.444361 2026] [:error] [pid 63897:tid 63920] [client 20.100.186.223:59713] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "acagE2VSkmYmLu7ycYhxVgAAARU"]
[Fri Mar 27 23:19:48.209265 2026] [:error] [pid 27750:tid 27834] [client 20.100.186.223:59726] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "acagFIaSil5rd17ieLwUWgAAAJA"]
[Fri Mar 27 23:19:49.474203 2026] [:error] [pid 4341:tid 4344] [client 20.100.186.223:58595] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "acagFeKJWrNB5dMlERHR-QAAAYE"]
[Fri Mar 27 23:19:50.658327 2026] [:error] [pid 54663:tid 54690] [client 20.100.186.223:58546] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "acagFhUtStIXFk9WHe3pQgAAAdg"]
[Fri Mar 27 23:19:51.420024 2026] [:error] [pid 4293:tid 4310] [client 20.100.186.223:61638] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "acagF5LjeJUC3OKtEx_GLAAAAU8"]
[Fri Mar 27 23:19:52.552897 2026] [:error] [pid 27851:tid 27861] [client 20.100.186.223:59769] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "acagGHR2ccxe3RMCLbojzgAAAMM"]
[Fri Mar 27 23:19:54.572932 2026] [:error] [pid 27749:tid 27809] [client 20.100.186.223:58498] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/24.php"] [unique_id "acagGsEqyoMni2Q6_X4kcwAAAFI"]
[Fri Mar 27 23:19:55.156917 2026] [:error] [pid 27749:tid 27808] [client 20.100.186.223:58532] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/24.php"] [unique_id "acagG8EqyoMni2Q6_X4kdgAAAFE"]
[Fri Mar 27 23:19:55.745284 2026] [:error] [pid 27750:tid 27822] [client 20.100.186.223:62322] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/24.php"] [unique_id "acagG4aSil5rd17ieLwUYgAAAIQ"]
[Fri Mar 27 23:19:56.455076 2026] [:error] [pid 27750:tid 27836] [client 20.100.186.223:56180] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/24.php"] [unique_id "acagHIaSil5rd17ieLwUZAAAAJI"]
[Fri Mar 27 23:19:56.989096 2026] [:error] [pid 27749:tid 27807] [client 20.100.186.223:59663] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zz8.php"] [unique_id "acagHMEqyoMni2Q6_X4keQAAAFA"]
[Fri Mar 27 23:19:57.594252 2026] [:error] [pid 27743:tid 27773] [client 20.100.186.223:61658] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zz8.php"] [unique_id "acagHSA46UYYLqzw99AnRAAAAAk"]
[Fri Mar 27 23:19:58.359673 2026] [:error] [pid 54663:tid 54683] [client 20.100.186.223:58619] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zz8.php"] [unique_id "acagHhUtStIXFk9WHe3pbgAAAdE"]
[Fri Mar 27 23:19:58.896670 2026] [:error] [pid 54663:tid 54681] [client 20.100.186.223:58539] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zz8.php"] [unique_id "acagHhUtStIXFk9WHe3pcgAAAc8"]
[Fri Mar 27 23:19:59.440478 2026] [:error] [pid 54663:tid 54678] [client 20.100.186.223:59232] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "acagHxUtStIXFk9WHe3pdgAAAcw"]
[Fri Mar 27 23:19:59.988085 2026] [:error] [pid 27743:tid 27780] [client 20.100.186.223:58533] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "acagHyA46UYYLqzw99AnRQAAABA"]
[Fri Mar 27 23:20:00.588324 2026] [:error] [pid 27743:tid 27788] [client 20.100.186.223:56155] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "acagICA46UYYLqzw99AnRwAAABg"]
[Fri Mar 27 23:20:01.109381 2026] [:error] [pid 54663:tid 54690] [client 20.100.186.223:59215] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "acagIRUtStIXFk9WHe3pegAAAdg"]
[Fri Mar 27 23:20:01.682161 2026] [:error] [pid 54663:tid 54668] [client 20.100.186.223:59772] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "acagIRUtStIXFk9WHe3pfQAAAcI"]
[Fri Mar 27 23:20:02.247470 2026] [:error] [pid 27743:tid 27770] [client 20.100.186.223:61632] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "acagIiA46UYYLqzw99AnSQAAAAY"]
[Fri Mar 27 23:20:02.828349 2026] [:error] [pid 54663:tid 54678] [client 20.100.186.223:61688] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "acagIhUtStIXFk9WHe3pgwAAAcw"]
[Fri Mar 27 23:20:03.408500 2026] [:error] [pid 54663:tid 54671] [client 20.100.186.223:61686] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "acagIxUtStIXFk9WHe3phQAAAcU"]
[Fri Mar 27 23:20:03.943421 2026] [:error] [pid 54663:tid 54668] [client 20.100.186.223:56152] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpmini.php"] [unique_id "acagIxUtStIXFk9WHe3pigAAAcI"]
[Fri Mar 27 23:20:04.530908 2026] [:error] [pid 27851:tid 27867] [client 20.100.186.223:58501] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpmini.php"] [unique_id "acagJHR2ccxe3RMCLboj-wAAAMk"]
[Fri Mar 27 23:20:05.206710 2026] [:error] [pid 27851:tid 27866] [client 20.100.186.223:59255] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpmini.php"] [unique_id "acagJXR2ccxe3RMCLboj_QAAAMg"]
[Fri Mar 27 23:20:05.769941 2026] [:error] [pid 4341:tid 4364] [client 20.100.186.223:59771] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpmini.php"] [unique_id "acagJeKJWrNB5dMlERHR_QAAAZU"]
[Fri Mar 27 23:20:06.353275 2026] [:error] [pid 27851:tid 27879] [client 20.100.186.223:59705] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "acagJnR2ccxe3RMCLbokBgAAANU"]
[Fri Mar 27 23:20:06.959909 2026] [:error] [pid 54663:tid 54685] [client 20.100.186.223:59677] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "acagJhUtStIXFk9WHe3pjQAAAdM"]
[Fri Mar 27 23:20:07.609283 2026] [:error] [pid 27851:tid 27867] [client 20.100.186.223:59200] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "acagJ3R2ccxe3RMCLbokDgAAAMk"]
[Fri Mar 27 23:20:08.260610 2026] [:error] [pid 27743:tid 27788] [client 20.100.186.223:59239] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "acagKCA46UYYLqzw99AnSwAAABg"]
[Fri Mar 27 23:20:08.787367 2026] [:error] [pid 27851:tid 27861] [client 20.100.186.223:56173] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tbute.php"] [unique_id "acagKHR2ccxe3RMCLbokEgAAAMM"]
[Fri Mar 27 23:20:09.469772 2026] [:error] [pid 27851:tid 27882] [client 20.100.186.223:58512] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tbute.php"] [unique_id "acagKXR2ccxe3RMCLbokFwAAANg"]
[Fri Mar 27 23:20:10.007169 2026] [:error] [pid 63897:tid 63916] [client 20.100.186.223:59201] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tbute.php"] [unique_id "acagKmVSkmYmLu7ycYhxagAAARE"]
[Fri Mar 27 23:20:10.529410 2026] [:error] [pid 27851:tid 27858] [client 20.100.186.223:62275] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tbute.php"] [unique_id "acagKnR2ccxe3RMCLbokGgAAAMA"]
[Fri Mar 27 23:20:11.059655 2026] [:error] [pid 27750:tid 27823] [client 20.100.186.223:59667] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rovoj.php"] [unique_id "acagK4aSil5rd17ieLwUbAAAAIU"]
[Fri Mar 27 23:20:11.730727 2026] [:error] [pid 27851:tid 27879] [client 20.100.186.223:59249] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rovoj.php"] [unique_id "acagK3R2ccxe3RMCLbokHwAAANU"]
[Fri Mar 27 23:20:12.523371 2026] [:error] [pid 4341:tid 4357] [client 20.100.186.223:59718] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rovoj.php"] [unique_id "acagLOKJWrNB5dMlERHSAQAAAY4"]
[Fri Mar 27 23:20:13.123868 2026] [:error] [pid 27851:tid 27858] [client 20.100.186.223:59709] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rovoj.php"] [unique_id "acagLXR2ccxe3RMCLbokIgAAAMA"]
[Fri Mar 27 23:20:13.697380 2026] [:error] [pid 4341:tid 4351] [client 20.100.186.223:59674] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r3grt7.php"] [unique_id "acagLeKJWrNB5dMlERHSBAAAAYg"]
[Fri Mar 27 23:20:14.307938 2026] [:error] [pid 4341:tid 4367] [client 20.100.186.223:56175] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r3grt7.php"] [unique_id "acagLuKJWrNB5dMlERHSBwAAAZg"]
[Fri Mar 27 23:20:14.867521 2026] [:error] [pid 27743:tid 27775] [client 20.100.186.223:59669] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r3grt7.php"] [unique_id "acagLiA46UYYLqzw99AnTgAAAAs"]
[Fri Mar 27 23:20:15.552039 2026] [:error] [pid 27743:tid 27765] [client 20.100.186.223:61651] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r3grt7.php"] [unique_id "acagLyA46UYYLqzw99AnUgAAAAE"]
[Fri Mar 27 23:20:16.217479 2026] [:error] [pid 54663:tid 54668] [client 20.100.186.223:59715] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phina.php"] [unique_id "acagMBUtStIXFk9WHe3plAAAAcI"]
[Fri Mar 27 23:20:16.807628 2026] [:error] [pid 27743:tid 27766] [client 20.100.186.223:59679] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phina.php"] [unique_id "acagMCA46UYYLqzw99AnVAAAAAI"]
[Fri Mar 27 23:20:17.375188 2026] [:error] [pid 27749:tid 27796] [client 20.100.186.223:58513] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phina.php"] [unique_id "acagMcEqyoMni2Q6_X4kggAAAEU"]
[Fri Mar 27 23:20:17.939925 2026] [:error] [pid 27749:tid 27803] [client 20.100.186.223:59222] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phina.php"] [unique_id "acagMcEqyoMni2Q6_X4kgwAAAEw"]
[Fri Mar 27 23:20:18.484054 2026] [:error] [pid 27749:tid 27798] [client 20.100.186.223:61051] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acagMsEqyoMni2Q6_X4khwAAAEc"]
[Fri Mar 27 23:20:19.084861 2026] [:error] [pid 4293:tid 4298] [client 20.100.186.223:61672] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acagM5LjeJUC3OKtEx_GNQAAAUM"]
[Fri Mar 27 23:20:19.725578 2026] [:error] [pid 63897:tid 63907] [client 20.100.186.223:58534] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acagM2VSkmYmLu7ycYhxcgAAAQg"]
[Fri Mar 27 23:20:20.269373 2026] [:error] [pid 27851:tid 27882] [client 20.100.186.223:59768] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acagNHR2ccxe3RMCLbokLwAAANg"]
[Fri Mar 27 23:20:20.805050 2026] [:error] [pid 4341:tid 4349] [client 20.100.186.223:59741] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "acagNOKJWrNB5dMlERHSCQAAAYY"]
[Fri Mar 27 23:20:21.395807 2026] [:error] [pid 27851:tid 27878] [client 20.100.186.223:59257] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "acagNXR2ccxe3RMCLbokNQAAANQ"]
[Fri Mar 27 23:20:22.172016 2026] [:error] [pid 27743:tid 27786] [client 20.100.186.223:59770] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "acagNiA46UYYLqzw99AnWQAAABY"]
[Fri Mar 27 23:20:22.917963 2026] [:error] [pid 27851:tid 27860] [client 20.100.186.223:56179] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "acagNnR2ccxe3RMCLbokOQAAAMI"]
[Fri Mar 27 23:20:23.621103 2026] [:error] [pid 27851:tid 27878] [client 20.100.186.223:58526] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "acagN3R2ccxe3RMCLbokPgAAANQ"]
[Fri Mar 27 23:20:24.236696 2026] [:error] [pid 27851:tid 27865] [client 20.100.186.223:61644] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "acagOHR2ccxe3RMCLbokQgAAAMc"]
[Fri Mar 27 23:20:24.892715 2026] [:error] [pid 27851:tid 27869] [client 20.100.186.223:56189] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "acagOHR2ccxe3RMCLbokSgAAAMs"]
[Fri Mar 27 23:20:25.524829 2026] [:error] [pid 27750:tid 27821] [client 20.100.186.223:59739] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "acagOYaSil5rd17ieLwUbgAAAIM"]
[Fri Mar 27 23:20:26.053760 2026] [:error] [pid 27851:tid 27877] [client 20.100.186.223:61660] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kbfr.php"] [unique_id "acagOnR2ccxe3RMCLbokTwAAANM"]
[Fri Mar 27 23:20:26.693086 2026] [:error] [pid 27743:tid 27773] [client 20.100.186.223:56191] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kbfr.php"] [unique_id "acagOiA46UYYLqzw99AnWwAAAAk"]
[Fri Mar 27 23:20:27.356039 2026] [:error] [pid 63897:tid 63923] [client 20.100.186.223:61633] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kbfr.php"] [unique_id "acagO2VSkmYmLu7ycYhxdgAAARg"]
[Fri Mar 27 23:20:27.896514 2026] [:error] [pid 54663:tid 54685] [client 20.100.186.223:59689] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kbfr.php"] [unique_id "acagOxUtStIXFk9WHe3pnQAAAdM"]
[Fri Mar 27 23:20:28.571641 2026] [:error] [pid 27851:tid 27878] [client 20.100.186.223:56170] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/595.php"] [unique_id "acagPHR2ccxe3RMCLbokUwAAANQ"]
[Fri Mar 27 23:20:29.164396 2026] [:error] [pid 27750:tid 27829] [client 20.100.186.223:61682] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/595.php"] [unique_id "acagPYaSil5rd17ieLwUcQAAAIs"]
[Fri Mar 27 23:20:29.712555 2026] [:error] [pid 54663:tid 54688] [client 20.100.186.223:56176] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/595.php"] [unique_id "acagPRUtStIXFk9WHe3poAAAAdY"]
[Fri Mar 27 23:20:30.236360 2026] [:error] [pid 4293:tid 4313] [client 20.100.186.223:58529] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/595.php"] [unique_id "acagPpLjeJUC3OKtEx_GNwAAAVI"]
[Fri Mar 27 23:20:31.008973 2026] [:error] [pid 54663:tid 54669] [client 20.100.186.223:58621] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1.php"] [unique_id "acagPxUtStIXFk9WHe3pogAAAcM"]
[Fri Mar 27 23:20:31.615487 2026] [:error] [pid 63897:tid 63920] [client 20.100.186.223:58562] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1.php"] [unique_id "acagP2VSkmYmLu7ycYhxegAAARU"]
[Fri Mar 27 23:20:32.240307 2026] [:error] [pid 27743:tid 27786] [client 20.100.186.223:58590] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1.php"] [unique_id "acagQCA46UYYLqzw99AnYwAAABY"]
[Fri Mar 27 23:20:33.059511 2026] [:error] [pid 27851:tid 27874] [client 20.100.186.223:56186] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1.php"] [unique_id "acagQXR2ccxe3RMCLbokYwAAANA"]
[Fri Mar 27 23:20:33.583598 2026] [:error] [pid 27749:tid 27808] [client 20.100.186.223:60434] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "acagQcEqyoMni2Q6_X4kjgAAAFE"]
[Fri Mar 27 23:20:34.157866 2026] [:error] [pid 27851:tid 27865] [client 20.100.186.223:59234] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "acagQnR2ccxe3RMCLbokaAAAAMc"]
[Fri Mar 27 23:20:34.787119 2026] [:error] [pid 54663:tid 54671] [client 20.100.186.223:59235] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "acagQhUtStIXFk9WHe3ppgAAAcU"]
[Fri Mar 27 23:20:35.519687 2026] [:error] [pid 27851:tid 27860] [client 20.100.186.223:59263] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "acagQ3R2ccxe3RMCLbokagAAAMI"]
[Fri Mar 27 23:20:36.188102 2026] [:error] [pid 27851:tid 27874] [client 20.100.186.223:61668] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acagRHR2ccxe3RMCLbokawAAANA"]
[Fri Mar 27 23:20:36.806714 2026] [:error] [pid 27743:tid 27783] [client 20.100.186.223:61687] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acagRCA46UYYLqzw99AnZgAAABM"]
[Fri Mar 27 23:20:37.391014 2026] [:error] [pid 4341:tid 4364] [client 20.100.186.223:59675] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acagReKJWrNB5dMlERHSEwAAAZU"]
[Fri Mar 27 23:20:38.006699 2026] [:error] [pid 27749:tid 27803] [client 20.100.186.223:59753] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acagRsEqyoMni2Q6_X4klwAAAEw"]
[Fri Mar 27 23:20:38.604645 2026] [:error] [pid 27749:tid 27805] [client 20.100.186.223:61685] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "acagRsEqyoMni2Q6_X4kmQAAAE4"]
[Fri Mar 27 23:20:39.410430 2026] [:error] [pid 54663:tid 54681] [client 20.100.186.223:65369] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "acagRxUtStIXFk9WHe3ptQAAAc8"]
[Fri Mar 27 23:20:39.942721 2026] [:error] [pid 27749:tid 27802] [client 20.100.186.223:59672] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "acagR8EqyoMni2Q6_X4koQAAAEs"]
[Fri Mar 27 23:20:40.483265 2026] [:error] [pid 54663:tid 54689] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Fri Mar 27 23:20:40.748018 2026] [:error] [pid 54663:tid 54687] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Fri Mar 27 23:20:41.065475 2026] [:error] [pid 54663:tid 54671] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws79.php
[Fri Mar 27 23:20:41.336974 2026] [:error] [pid 54663:tid 54681] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Fri Mar 27 23:20:41.603097 2026] [:error] [pid 54663:tid 54689] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws50.php
[Fri Mar 27 23:20:41.866185 2026] [:error] [pid 54663:tid 54682] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws44.php
[Fri Mar 27 23:20:42.129801 2026] [:error] [pid 54663:tid 54668] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws43.php
[Fri Mar 27 23:20:42.396894 2026] [:error] [pid 54663:tid 54687] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws42.php
[Fri Mar 27 23:20:42.659446 2026] [:error] [pid 54663:tid 54676] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws40.php
[Fri Mar 27 23:20:42.925945 2026] [:error] [pid 54663:tid 54671] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/ws36.php
[Fri Mar 27 23:20:43.222537 2026] [:error] [pid 54663:tid 54685] [client 20.100.186.223:61657] File does not exist: /usr/local/apache/htdocs/suspended-page/vwxbi.php
[Fri Mar 27 23:20:43.522878 2026] [:error] [pid 54663:tid 54690] [client 20.100.186.223:61657] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "acagSxUtStIXFk9WHe3pyAAAAdg"]
[Fri Mar 27 23:20:44.269307 2026] [:error] [pid 4341:tid 4367] [client 20.100.186.223:58575] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "acagTOKJWrNB5dMlERHSHgAAAZg"]
[Fri Mar 27 23:20:44.836107 2026] [:error] [pid 4341:tid 4345] [client 20.100.186.223:58555] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "acagTOKJWrNB5dMlERHSHwAAAYI"]
[Fri Mar 27 23:20:45.429184 2026] [:error] [pid 4341:tid 4352] [client 20.100.186.223:59767] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "acagTeKJWrNB5dMlERHSIgAAAYk"]
[Fri Mar 27 23:20:45.975800 2026] [:error] [pid 4341:tid 4362] [client 20.100.186.223:61693] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acagTeKJWrNB5dMlERHSKAAAAZM"]
[Fri Mar 27 23:20:46.502355 2026] [:error] [pid 27743:tid 27768] [client 20.100.186.223:59236] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acagTiA46UYYLqzw99AnaQAAAAQ"]
[Fri Mar 27 23:20:47.029925 2026] [:error] [pid 27749:tid 27800] [client 20.100.186.223:58616] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acagT8EqyoMni2Q6_X4kqQAAAEk"]
[Fri Mar 27 23:20:47.620293 2026] [:error] [pid 27749:tid 27811] [client 20.100.186.223:59258] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acagT8EqyoMni2Q6_X4kqwAAAFQ"]
[Fri Mar 27 23:20:48.293797 2026] [:error] [pid 27749:tid 27803] [client 20.100.186.223:59242] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cvz.php"] [unique_id "acagUMEqyoMni2Q6_X4krgAAAEw"]
[Fri Mar 27 23:20:48.836127 2026] [:error] [pid 27851:tid 27873] [client 20.100.186.223:58535] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cvz.php"] [unique_id "acagUHR2ccxe3RMCLbokeQAAAM8"]
[Fri Mar 27 23:20:49.440443 2026] [:error] [pid 27749:tid 27809] [client 20.100.186.223:59714] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cvz.php"] [unique_id "acagUcEqyoMni2Q6_X4ksQAAAFI"]
[Fri Mar 27 23:20:49.961690 2026] [:error] [pid 27743:tid 27769] [client 20.100.186.223:62914] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cvz.php"] [unique_id "acagUSA46UYYLqzw99AncQAAAAU"]
[Fri Mar 27 23:20:50.513585 2026] [:error] [pid 54663:tid 54677] [client 20.100.186.223:58518] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acagUhUtStIXFk9WHe3pzQAAAcs"]
[Fri Mar 27 23:20:51.039817 2026] [:error] [pid 27743:tid 27770] [client 20.100.186.223:59673] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acagUyA46UYYLqzw99AndgAAAAY"]
[Fri Mar 27 23:20:51.567366 2026] [:error] [pid 27749:tid 27801] [client 20.100.186.223:58618] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acagU8EqyoMni2Q6_X4ktAAAAEo"]
[Fri Mar 27 23:20:52.112024 2026] [:error] [pid 63897:tid 63916] [client 20.100.186.223:59759] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acagVGVSkmYmLu7ycYhxfwAAARE"]
[Fri Mar 27 23:20:52.670265 2026] [:error] [pid 27749:tid 27796] [client 20.100.186.223:58567] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aee.php"] [unique_id "acagVMEqyoMni2Q6_X4kugAAAEU"]
[Fri Mar 27 23:20:53.275535 2026] [:error] [pid 27851:tid 27862] [client 20.100.186.223:58581] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aee.php"] [unique_id "acagVXR2ccxe3RMCLbokfQAAAMQ"]
[Fri Mar 27 23:20:53.919200 2026] [:error] [pid 54663:tid 54685] [client 20.100.186.223:61009] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aee.php"] [unique_id "acagVRUtStIXFk9WHe3p0wAAAdM"]
[Fri Mar 27 23:20:54.496080 2026] [:error] [pid 27851:tid 27881] [client 20.100.186.223:58499] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aee.php"] [unique_id "acagVnR2ccxe3RMCLbokgAAAANc"]
[Fri Mar 27 23:20:55.025423 2026] [:error] [pid 27851:tid 27877] [client 20.100.186.223:58504] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sweg.php"] [unique_id "acagV3R2ccxe3RMCLbokggAAANM"]
[Fri Mar 27 23:20:55.573652 2026] [:error] [pid 54663:tid 54680] [client 20.100.186.223:58554] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sweg.php"] [unique_id "acagVxUtStIXFk9WHe3p1gAAAc4"]
[Fri Mar 27 23:20:56.337687 2026] [:error] [pid 54663:tid 54688] [client 20.100.186.223:59223] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sweg.php"] [unique_id "acagWBUtStIXFk9WHe3p2AAAAdY"]
[Fri Mar 27 23:20:56.927450 2026] [:error] [pid 27743:tid 27788] [client 20.100.186.223:59224] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sweg.php"] [unique_id "acagWCA46UYYLqzw99AnfAAAABg"]
[Fri Mar 27 23:20:57.537063 2026] [:error] [pid 27750:tid 27827] [client 20.100.186.223:58589] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acagWYaSil5rd17ieLwUiQAAAIk"]
[Fri Mar 27 23:20:58.075886 2026] [:error] [pid 27750:tid 27834] [client 20.100.186.223:59737] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acagWoaSil5rd17ieLwUjAAAAJA"]
[Fri Mar 27 23:20:58.761644 2026] [:error] [pid 54663:tid 54690] [client 20.100.186.223:59241] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acagWhUtStIXFk9WHe3p4QAAAdg"]
[Fri Mar 27 23:20:59.283993 2026] [:error] [pid 63897:tid 63919] [client 20.100.186.223:58565] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acagW2VSkmYmLu7ycYhxiwAAARQ"]
[Fri Mar 27 23:20:59.825510 2026] [:error] [pid 27851:tid 27863] [client 20.100.186.223:58569] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "acagW3R2ccxe3RMCLbokjQAAAMU"]
[Fri Mar 27 23:21:00.367102 2026] [:error] [pid 27851:tid 27865] [client 20.100.186.223:56131] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "acagXHR2ccxe3RMCLbokkAAAAMc"]
[Fri Mar 27 23:21:01.025874 2026] [:error] [pid 27851:tid 27860] [client 20.100.186.223:58537] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "acagXXR2ccxe3RMCLboklAAAAMI"]
[Fri Mar 27 23:21:01.642157 2026] [:error] [pid 54663:tid 54689] [client 20.100.186.223:56137] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "acagXRUtStIXFk9WHe3p5wAAAdc"]
[Fri Mar 27 23:21:02.179090 2026] [:error] [pid 54663:tid 54668] [client 20.100.186.223:59666] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acagXhUtStIXFk9WHe3p6gAAAcI"]
[Fri Mar 27 23:21:02.752975 2026] [:error] [pid 27749:tid 27801] [client 20.100.186.223:58563] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acagXsEqyoMni2Q6_X4k3QAAAEo"]
[Fri Mar 27 23:21:03.285939 2026] [:error] [pid 27749:tid 27792] [client 20.100.186.223:60486] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acagX8EqyoMni2Q6_X4k4AAAAEE"]
[Fri Mar 27 23:21:03.851856 2026] [:error] [pid 27743:tid 27767] [client 20.100.186.223:61001] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acagXyA46UYYLqzw99AngwAAAAM"]
[Fri Mar 27 23:21:04.476399 2026] [:error] [pid 27743:tid 27774] [client 20.100.186.223:58561] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acagYCA46UYYLqzw99AnhwAAAAo"]
[Fri Mar 27 23:21:05.163095 2026] [:error] [pid 27749:tid 27807] [client 20.100.186.223:58594] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acagYcEqyoMni2Q6_X4k9AAAAFA"]
[Fri Mar 27 23:21:05.683829 2026] [:error] [pid 4341:tid 4361] [client 20.100.186.223:56157] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acagYeKJWrNB5dMlERHSMwAAAZI"]
[Fri Mar 27 23:21:06.274844 2026] [:error] [pid 27750:tid 27838] [client 20.100.186.223:58604] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acagYoaSil5rd17ieLwUmAAAAJQ"]
[Fri Mar 27 23:21:06.824824 2026] [:error] [pid 27749:tid 27792] [client 20.100.186.223:58500] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acagYsEqyoMni2Q6_X4k9QAAAEE"]
[Fri Mar 27 23:21:07.541167 2026] [:error] [pid 4293:tid 4305] [client 20.100.186.223:58614] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acagY5LjeJUC3OKtEx_GRAAAAUo"]
[Fri Mar 27 23:21:10.475036 2026] [:error] [pid 27851:tid 27862] [client 20.100.186.223:56178] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acagZnR2ccxe3RMCLbokoQAAAMQ"]
[Fri Mar 27 23:21:11.219447 2026] [:error] [pid 27851:tid 27858] [client 20.100.186.223:56138] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acagZ3R2ccxe3RMCLbokpQAAAMA"]
[Fri Mar 27 23:21:11.779680 2026] [:error] [pid 27749:tid 27802] [client 20.100.186.223:58579] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roter.php"] [unique_id "acagZ8EqyoMni2Q6_X4k_wAAAEs"]
[Fri Mar 27 23:21:12.313729 2026] [:error] [pid 27851:tid 27867] [client 20.100.186.223:56174] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roter.php"] [unique_id "acagaHR2ccxe3RMCLbokpwAAAMk"]
[Fri Mar 27 23:21:12.862828 2026] [:error] [pid 27851:tid 27861] [client 20.100.186.223:59214] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roter.php"] [unique_id "acagaHR2ccxe3RMCLbokqwAAAMM"]
[Fri Mar 27 23:21:13.389028 2026] [:error] [pid 4341:tid 4347] [client 20.100.186.223:59253] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roter.php"] [unique_id "acagaeKJWrNB5dMlERHSQQAAAYQ"]
[Fri Mar 27 23:21:13.946567 2026] [:error] [pid 27851:tid 27878] [client 20.100.186.223:59662] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acagaXR2ccxe3RMCLboksAAAANQ"]
[Fri Mar 27 23:21:14.500023 2026] [:error] [pid 27749:tid 27810] [client 20.100.186.223:59213] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acagasEqyoMni2Q6_X4lAgAAAFM"]
[Fri Mar 27 23:21:15.042791 2026] [:error] [pid 27749:tid 27797] [client 20.100.186.223:59261] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acaga8EqyoMni2Q6_X4lBQAAAEY"]
[Fri Mar 27 23:21:15.572401 2026] [:error] [pid 27749:tid 27815] [client 20.100.186.223:61690] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acaga8EqyoMni2Q6_X4lCQAAAFg"]
[Fri Mar 27 23:21:16.166462 2026] [:error] [pid 27851:tid 27874] [client 20.100.186.223:62962] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acagbHR2ccxe3RMCLboktQAAANA"]
[Fri Mar 27 23:21:16.719167 2026] [:error] [pid 27851:tid 27868] [client 20.100.186.223:61010] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acagbHR2ccxe3RMCLbokuAAAAMo"]
[Fri Mar 27 23:21:17.256869 2026] [:error] [pid 54663:tid 54684] [client 20.100.186.223:56190] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acagbRUtStIXFk9WHe3p7QAAAdI"]
[Fri Mar 27 23:21:17.801211 2026] [:error] [pid 27851:tid 27873] [client 20.100.186.223:56181] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acagbXR2ccxe3RMCLbokvAAAAM8"]
[Fri Mar 27 23:21:18.515707 2026] [:error] [pid 4341:tid 4349] [client 20.100.186.223:62955] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acagbuKJWrNB5dMlERHSQwAAAYY"]
[Fri Mar 27 23:21:19.151574 2026] [:error] [pid 27743:tid 27780] [client 20.100.186.223:61662] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acagbyA46UYYLqzw99AnlAAAABA"]
[Fri Mar 27 23:21:19.741909 2026] [:error] [pid 63897:tid 63920] [client 20.100.186.223:61663] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acagb2VSkmYmLu7ycYhxmQAAARU"]
[Fri Mar 27 23:21:20.376145 2026] [:error] [pid 27743:tid 27764] [client 20.100.186.223:59716] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acagcCA46UYYLqzw99AnmgAAAAA"]
[Fri Mar 27 23:21:20.975977 2026] [:error] [pid 27749:tid 27798] [client 20.100.186.223:58520] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1GiO.php"] [unique_id "acagcMEqyoMni2Q6_X4lEAAAAEc"]
[Fri Mar 27 23:21:21.628969 2026] [:error] [pid 27851:tid 27876] [client 20.100.186.223:61649] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1GiO.php"] [unique_id "acagcXR2ccxe3RMCLbokxwAAANI"]
[Fri Mar 27 23:21:22.533938 2026] [:error] [pid 4341:tid 4353] [client 20.100.186.223:61650] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1GiO.php"] [unique_id "acagcuKJWrNB5dMlERHSRgAAAYo"]
[Fri Mar 27 23:21:23.142427 2026] [:error] [pid 54663:tid 54677] [client 20.100.186.223:62273] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n1GiO.php"] [unique_id "acagcxUtStIXFk9WHe3p8wAAAcs"]
[Fri Mar 27 23:21:23.710647 2026] [:error] [pid 27749:tid 27813] [client 20.100.186.223:59687] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pLdK1.php"] [unique_id "acagc8EqyoMni2Q6_X4lEwAAAFY"]
[Fri Mar 27 23:21:24.382998 2026] [:error] [pid 27749:tid 27805] [client 20.100.186.223:59220] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pLdK1.php"] [unique_id "acagdMEqyoMni2Q6_X4lFQAAAE4"]
[Fri Mar 27 23:21:24.996903 2026] [:error] [pid 27749:tid 27807] [client 20.100.186.223:59218] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pLdK1.php"] [unique_id "acagdMEqyoMni2Q6_X4lGgAAAFA"]
[Fri Mar 27 23:21:25.648369 2026] [:error] [pid 27851:tid 27861] [client 20.100.186.223:59244] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pLdK1.php"] [unique_id "acagdXR2ccxe3RMCLbokygAAAMM"]
[Fri Mar 27 23:21:26.598828 2026] [:error] [pid 27851:tid 27871] [client 20.100.186.223:59733] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/llb1J.php"] [unique_id "acagdnR2ccxe3RMCLbokzQAAAM0"]
[Fri Mar 27 23:21:27.303692 2026] [:error] [pid 54663:tid 54688] [client 20.100.186.223:59240] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/llb1J.php"] [unique_id "acagdxUtStIXFk9WHe3p_gAAAdY"]
[Fri Mar 27 23:21:27.865297 2026] [:error] [pid 27851:tid 27870] [client 20.100.186.223:59751] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/llb1J.php"] [unique_id "acagd3R2ccxe3RMCLbok0wAAAMw"]
[Fri Mar 27 23:21:28.516020 2026] [:error] [pid 27743:tid 27774] [client 20.100.186.223:59230] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/llb1J.php"] [unique_id "acageCA46UYYLqzw99AnoQAAAAo"]
[Fri Mar 27 23:21:29.149143 2026] [:error] [pid 27851:tid 27867] [client 20.100.186.223:60497] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jeZDu.php"] [unique_id "acageXR2ccxe3RMCLbok4QAAAMk"]
[Fri Mar 27 23:21:29.748099 2026] [:error] [pid 27750:tid 27818] [client 20.100.186.223:61013] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jeZDu.php"] [unique_id "acageYaSil5rd17ieLwUpAAAAIA"]
[Fri Mar 27 23:21:30.290784 2026] [:error] [pid 54663:tid 54681] [client 20.100.186.223:61020] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jeZDu.php"] [unique_id "acagehUtStIXFk9WHe3qAQAAAc8"]
[Fri Mar 27 23:21:30.857144 2026] [:error] [pid 4293:tid 4313] [client 20.100.186.223:59678] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jeZDu.php"] [unique_id "acagepLjeJUC3OKtEx_GSwAAAVI"]
[Fri Mar 27 23:21:31.547816 2026] [:error] [pid 27750:tid 27833] [client 20.100.186.223:60502] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acage4aSil5rd17ieLwUqgAAAI8"]
[Fri Mar 27 23:21:32.318946 2026] [:error] [pid 27749:tid 27797] [client 20.100.186.223:61655] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acagfMEqyoMni2Q6_X4lIgAAAEY"]
[Fri Mar 27 23:21:33.303815 2026] [:error] [pid 27851:tid 27867] [client 20.100.186.223:62283] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acagfXR2ccxe3RMCLbok6QAAAMk"]
[Fri Mar 27 23:21:33.826554 2026] [:error] [pid 27749:tid 27795] [client 20.100.186.223:59670] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acagfcEqyoMni2Q6_X4lIwAAAEQ"]
[Fri Mar 27 23:21:34.371135 2026] [:error] [pid 54663:tid 54686] [client 20.100.186.223:59250] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfuKK.php"] [unique_id "acagfhUtStIXFk9WHe3qBwAAAdQ"]
[Fri Mar 27 23:21:34.901665 2026] [:error] [pid 4293:tid 4297] [client 20.100.186.223:58592] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfuKK.php"] [unique_id "acagfpLjeJUC3OKtEx_GUAAAAUI"]
[Fri Mar 27 23:21:35.459002 2026] [:error] [pid 27749:tid 27802] [client 20.100.186.223:58596] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfuKK.php"] [unique_id "acagf8EqyoMni2Q6_X4lJQAAAEs"]
[Fri Mar 27 23:21:36.063014 2026] [:error] [pid 27743:tid 27775] [client 20.100.186.223:58514] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfuKK.php"] [unique_id "acaggCA46UYYLqzw99AnpAAAAAs"]
[Fri Mar 27 23:21:36.793988 2026] [:error] [pid 27743:tid 27772] [client 20.100.186.223:56154] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OpVq6.php"] [unique_id "acaggCA46UYYLqzw99AnpQAAAAg"]
[Fri Mar 27 23:21:37.324556 2026] [:error] [pid 54663:tid 54681] [client 20.100.186.223:59221] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OpVq6.php"] [unique_id "acaggRUtStIXFk9WHe3qDAAAAc8"]
[Fri Mar 27 23:21:37.852726 2026] [:error] [pid 54663:tid 54689] [client 20.100.186.223:62285] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OpVq6.php"] [unique_id "acaggRUtStIXFk9WHe3qDwAAAdc"]
[Fri Mar 27 23:21:38.451451 2026] [:error] [pid 54663:tid 54666] [client 20.100.186.223:62919] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/OpVq6.php"] [unique_id "acagghUtStIXFk9WHe3qEgAAAcA"]
[Fri Mar 27 23:21:38.972633 2026] [:error] [pid 27851:tid 27858] [client 20.100.186.223:61636] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Q73BO.php"] [unique_id "acaggnR2ccxe3RMCLbok7QAAAMA"]
[Fri Mar 27 23:21:39.497862 2026] [:error] [pid 54663:tid 54668] [client 20.100.186.223:6489] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Q73BO.php"] [unique_id "acaggxUtStIXFk9WHe3qFgAAAcI"]
[Fri Mar 27 23:21:40.125550 2026] [:error] [pid 54663:tid 54685] [client 20.100.186.223:58506] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Q73BO.php"] [unique_id "acaghBUtStIXFk9WHe3qFwAAAdM"]
[Fri Mar 27 23:21:40.703696 2026] [:error] [pid 27749:tid 27793] [client 20.100.186.223:59210] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Q73BO.php"] [unique_id "acaghMEqyoMni2Q6_X4lLAAAAEI"]
[Fri Mar 27 23:21:41.232672 2026] [:error] [pid 54663:tid 54666] [client 20.100.186.223:59711] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rmpoa.php"] [unique_id "acaghRUtStIXFk9WHe3qHAAAAcA"]
[Fri Mar 27 23:21:41.799921 2026] [:error] [pid 27749:tid 27802] [client 20.100.186.223:61014] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rmpoa.php"] [unique_id "acaghcEqyoMni2Q6_X4lLwAAAEs"]
[Fri Mar 27 23:21:42.336451 2026] [:error] [pid 27749:tid 27800] [client 20.100.186.223:58515] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rmpoa.php"] [unique_id "acaghsEqyoMni2Q6_X4lNAAAAEk"]
[Fri Mar 27 23:21:42.966635 2026] [:error] [pid 27750:tid 27822] [client 20.100.186.223:61012] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rmpoa.php"] [unique_id "acaghoaSil5rd17ieLwUsQAAAIQ"]
[Fri Mar 27 23:21:43.591902 2026] [:error] [pid 4293:tid 4297] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Fri Mar 27 23:21:43.891506 2026] [:error] [pid 4293:tid 4304] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Fri Mar 27 23:21:44.167731 2026] [:error] [pid 4293:tid 4317] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Fri Mar 27 23:21:44.443898 2026] [:error] [pid 4293:tid 4295] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Fri Mar 27 23:21:44.718383 2026] [:error] [pid 4293:tid 4301] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/v2.php
[Fri Mar 27 23:21:44.982319 2026] [:error] [pid 4293:tid 4303] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Fri Mar 27 23:21:45.245329 2026] [:error] [pid 4293:tid 4299] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/v4.php
[Fri Mar 27 23:21:45.517024 2026] [:error] [pid 4293:tid 4297] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/ant.php
[Fri Mar 27 23:21:45.786010 2026] [:error] [pid 4293:tid 4304] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Fri Mar 27 23:21:46.079970 2026] [:error] [pid 4293:tid 4317] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/cc13.php
[Fri Mar 27 23:21:46.343129 2026] [:error] [pid 4293:tid 4312] [client 20.100.186.223:59208] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Fri Mar 27 23:21:46.603126 2026] [:error] [pid 4293:tid 4302] [client 20.100.186.223:59208] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "acagipLjeJUC3OKtEx_GbgAAAUc"]
[Fri Mar 27 23:21:47.181316 2026] [:error] [pid 54663:tid 54689] [client 20.100.186.223:59219] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "acagixUtStIXFk9WHe3qHgAAAdc"]
[Fri Mar 27 23:21:47.774657 2026] [:error] [pid 4341:tid 4350] [client 20.100.186.223:61002] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "acagi-KJWrNB5dMlERHSUgAAAYc"]
[Fri Mar 27 23:21:48.338432 2026] [:error] [pid 27851:tid 27865] [client 20.100.186.223:59763] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "acagjHR2ccxe3RMCLbok8AAAAMc"]
[Fri Mar 27 23:21:48.876699 2026] [:error] [pid 27743:tid 27766] [client 20.100.186.223:61692] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccu.php"] [unique_id "acagjCA46UYYLqzw99AntAAAAAI"]
[Fri Mar 27 23:21:49.436266 2026] [:error] [pid 27851:tid 27872] [client 20.100.186.223:59743] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccu.php"] [unique_id "acagjXR2ccxe3RMCLbok9AAAAM4"]
[Fri Mar 27 23:21:49.984041 2026] [:error] [pid 4293:tid 4314] [client 20.100.186.223:58586] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccu.php"] [unique_id "acagjZLjeJUC3OKtEx_GdQAAAVM"]
[Fri Mar 27 23:21:50.507362 2026] [:error] [pid 63897:tid 63906] [client 20.100.186.223:59648] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccu.php"] [unique_id "acagjmVSkmYmLu7ycYhxrwAAAQc"]
[Fri Mar 27 23:21:51.049713 2026] [:error] [pid 27743:tid 27788] [client 20.100.186.223:58598] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acagjyA46UYYLqzw99AnuAAAABg"]
[Fri Mar 27 23:21:51.575965 2026] [:error] [pid 27743:tid 27787] [client 20.100.186.223:61664] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acagjyA46UYYLqzw99AnugAAABc"]
[Fri Mar 27 23:21:52.105353 2026] [:error] [pid 27750:tid 27837] [client 20.100.186.223:62323] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acagkIaSil5rd17ieLwUvAAAAJM"]
[Fri Mar 27 23:21:52.701680 2026] [:error] [pid 27743:tid 27772] [client 20.100.186.223:61665] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acagkCA46UYYLqzw99AnvQAAAAg"]
[Fri Mar 27 23:21:53.225921 2026] [:error] [pid 54663:tid 54685] [client 20.100.186.223:58593] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acagkRUtStIXFk9WHe3qKAAAAdM"]
[Fri Mar 27 23:21:53.752354 2026] [:error] [pid 27750:tid 27831] [client 20.100.186.223:61675] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acagkYaSil5rd17ieLwUvQAAAI0"]
[Fri Mar 27 23:21:54.276184 2026] [:error] [pid 27750:tid 27836] [client 20.100.186.223:59217] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acagkoaSil5rd17ieLwUvgAAAJI"]
[Fri Mar 27 23:21:54.823534 2026] [:error] [pid 27743:tid 27777] [client 20.100.186.223:62954] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acagkiA46UYYLqzw99AnwAAAAA0"]
[Fri Mar 27 23:21:55.359536 2026] [:error] [pid 27749:tid 27794] [client 20.100.186.223:58570] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dragonshell.php"] [unique_id "acagk8EqyoMni2Q6_X4lQAAAAEM"]
[Fri Mar 27 23:21:55.911121 2026] [:error] [pid 27750:tid 27821] [client 20.100.186.223:59736] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dragonshell.php"] [unique_id "acagk4aSil5rd17ieLwUwwAAAIM"]
[Fri Mar 27 23:21:56.490335 2026] [:error] [pid 27851:tid 27873] [client 20.100.186.223:61036] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dragonshell.php"] [unique_id "acaglHR2ccxe3RMCLbok_QAAAM8"]
[Fri Mar 27 23:21:57.011377 2026] [:error] [pid 4293:tid 4306] [client 20.100.186.223:62922] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dragonshell.php"] [unique_id "acaglZLjeJUC3OKtEx_GegAAAUs"]
[Fri Mar 27 23:21:57.551859 2026] [:error] [pid 63897:tid 63919] [client 20.100.186.223:60445] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acaglWVSkmYmLu7ycYhxsAAAARQ"]
[Fri Mar 27 23:21:58.074513 2026] [:error] [pid 63897:tid 63907] [client 20.100.186.223:59745] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acaglmVSkmYmLu7ycYhxsQAAAQg"]
[Fri Mar 27 23:21:58.598922 2026] [:error] [pid 27749:tid 27807] [client 20.100.186.223:59684] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acaglsEqyoMni2Q6_X4lSAAAAFA"]
[Fri Mar 27 23:21:59.152699 2026] [:error] [pid 27743:tid 27772] [client 20.100.186.223:59750] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acaglyA46UYYLqzw99AnxQAAAAg"]
[Fri Mar 27 23:21:59.699263 2026] [:error] [pid 4293:tid 4303] [client 20.100.186.223:58601] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/caiij.php"] [unique_id "acagl5LjeJUC3OKtEx_GfQAAAUg"]
[Fri Mar 27 23:22:00.228897 2026] [:error] [pid 4293:tid 4307] [client 20.100.186.223:56187] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/caiij.php"] [unique_id "acagmJLjeJUC3OKtEx_GfgAAAUw"]
[Fri Mar 27 23:22:00.819108 2026] [:error] [pid 27743:tid 27775] [client 20.100.186.223:59681] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/caiij.php"] [unique_id "acagmCA46UYYLqzw99AnyAAAAAs"]
[Fri Mar 27 23:22:01.360696 2026] [:error] [pid 27743:tid 27788] [client 20.100.186.223:61007] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/caiij.php"] [unique_id "acagmSA46UYYLqzw99AnzAAAABg"]
[Fri Mar 27 23:22:01.884425 2026] [:error] [pid 27743:tid 27772] [client 20.100.186.223:58528] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "acagmSA46UYYLqzw99An0AAAAAg"]
[Fri Mar 27 23:22:02.404061 2026] [:error] [pid 4293:tid 4318] [client 20.100.186.223:59654] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "acagmpLjeJUC3OKtEx_GgAAAAVc"]
[Fri Mar 27 23:22:02.927620 2026] [:error] [pid 54663:tid 54684] [client 20.100.186.223:61039] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "acagmhUtStIXFk9WHe3qMQAAAdI"]
[Fri Mar 27 23:22:03.463287 2026] [:error] [pid 27743:tid 27768] [client 20.100.186.223:61003] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gel4y.php"] [unique_id "acagmyA46UYYLqzw99An0gAAAAQ"]
[Fri Mar 27 23:22:04.010113 2026] [:error] [pid 54663:tid 54672] [client 20.100.186.223:59237] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "acagnBUtStIXFk9WHe3qNQAAAcY"]
[Fri Mar 27 23:22:04.543613 2026] [:error] [pid 4341:tid 4364] [client 20.100.186.223:59260] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "acagnOKJWrNB5dMlERHSWAAAAZU"]
[Fri Mar 27 23:22:05.100954 2026] [:error] [pid 4293:tid 4295] [client 20.100.186.223:61017] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "acagnZLjeJUC3OKtEx_GgwAAAUA"]
[Fri Mar 27 23:22:05.667815 2026] [:error] [pid 27750:tid 27837] [client 20.100.186.223:60479] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "acagnYaSil5rd17ieLwU0wAAAJM"]
[Fri Mar 27 23:22:06.206510 2026] [:error] [pid 27750:tid 27818] [client 20.100.186.223:59732] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rkiea.php"] [unique_id "acagnoaSil5rd17ieLwU1QAAAIA"]
[Fri Mar 27 23:22:06.740987 2026] [:error] [pid 54663:tid 54681] [client 20.100.186.223:61671] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rkiea.php"] [unique_id "acagnhUtStIXFk9WHe3qPAAAAc8"]
[Fri Mar 27 23:22:07.365112 2026] [:error] [pid 4341:tid 4353] [client 20.100.186.223:60480] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rkiea.php"] [unique_id "acagn-KJWrNB5dMlERHSWQAAAYo"]
[Fri Mar 27 23:22:07.996012 2026] [:error] [pid 4341:tid 4360] [client 20.100.186.223:59773] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rkiea.php"] [unique_id "acagn-KJWrNB5dMlERHSWgAAAZE"]
[Fri Mar 27 23:22:08.576111 2026] [:error] [pid 27743:tid 27780] [client 20.100.186.223:62916] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "acagoCA46UYYLqzw99An2wAAABA"]
[Fri Mar 27 23:22:09.132082 2026] [:error] [pid 27851:tid 27879] [client 20.100.186.223:6477] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "acagoXR2ccxe3RMCLbolCQAAANU"]
[Fri Mar 27 23:22:09.662429 2026] [:error] [pid 27851:tid 27878] [client 20.100.186.223:58525] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "acagoXR2ccxe3RMCLbolDAAAANQ"]
[Fri Mar 27 23:22:10.227276 2026] [:error] [pid 27851:tid 27866] [client 20.100.186.223:62933] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resp.php"] [unique_id "acagonR2ccxe3RMCLbolEAAAAMg"]
[Fri Mar 27 23:22:10.810696 2026] [:error] [pid 27743:tid 27788] [client 20.100.186.223:60491] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanou.php"] [unique_id "acagoiA46UYYLqzw99An4QAAABg"]
[Fri Mar 27 23:22:11.418476 2026] [:error] [pid 27743:tid 27769] [client 20.100.186.223:61025] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanou.php"] [unique_id "acagoyA46UYYLqzw99An4gAAAAU"]
[Fri Mar 27 23:22:11.963029 2026] [:error] [pid 54663:tid 54666] [client 20.100.186.223:59259] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanou.php"] [unique_id "acagoxUtStIXFk9WHe3qPgAAAcA"]
[Fri Mar 27 23:22:12.663632 2026] [:error] [pid 27743:tid 27770] [client 20.100.186.223:62934] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lanou.php"] [unique_id "acagpCA46UYYLqzw99An6QAAAAY"]
[Fri Mar 27 23:22:13.230156 2026] [:error] [pid 4293:tid 4298] [client 20.100.186.223:58605] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eursi.php"] [unique_id "acagpZLjeJUC3OKtEx_GhQAAAUM"]
[Fri Mar 27 23:22:13.824595 2026] [:error] [pid 54663:tid 54690] [client 20.100.186.223:58540] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eursi.php"] [unique_id "acagpRUtStIXFk9WHe3qPwAAAdg"]
[Fri Mar 27 23:22:14.348661 2026] [:error] [pid 54663:tid 54678] [client 20.100.186.223:59731] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eursi.php"] [unique_id "acagphUtStIXFk9WHe3qRAAAAcw"]
[Fri Mar 27 23:22:14.884964 2026] [:error] [pid 4341:tid 4348] [client 20.100.186.223:59717] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eursi.php"] [unique_id "acagpuKJWrNB5dMlERHSYwAAAYU"]
[Fri Mar 27 23:22:15.477434 2026] [:error] [pid 27851:tid 27863] [client 20.100.186.223:56165] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pas2.php"] [unique_id "acagp3R2ccxe3RMCLbolFgAAAMU"]
[Fri Mar 27 23:22:16.015017 2026] [:error] [pid 27851:tid 27874] [client 20.100.186.223:59665] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pas2.php"] [unique_id "acagqHR2ccxe3RMCLbolGgAAANA"]
[Fri Mar 27 23:22:16.614664 2026] [:error] [pid 27851:tid 27879] [client 20.100.186.223:59653] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pas2.php"] [unique_id "acagqHR2ccxe3RMCLbolHQAAANU"]
[Fri Mar 27 23:22:17.186663 2026] [:error] [pid 27851:tid 27875] [client 20.100.186.223:60505] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pas2.php"] [unique_id "acagqXR2ccxe3RMCLbolIAAAANE"]
[Fri Mar 27 23:22:17.712227 2026] [:error] [pid 54663:tid 54667] [client 20.100.186.223:62329] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schal.php"] [unique_id "acagqRUtStIXFk9WHe3qSwAAAcE"]
[Fri Mar 27 23:22:18.318689 2026] [:error] [pid 27750:tid 27819] [client 20.100.186.223:56169] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schal.php"] [unique_id "acagqoaSil5rd17ieLwU2QAAAIE"]
[Fri Mar 27 23:22:18.906958 2026] [:error] [pid 27851:tid 27882] [client 20.100.186.223:58602] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schal.php"] [unique_id "acagqnR2ccxe3RMCLbolJgAAANg"]
[Fri Mar 27 23:22:19.496132 2026] [:error] [pid 27750:tid 27822] [client 20.100.186.223:59238] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schal.php"] [unique_id "acagq4aSil5rd17ieLwU2wAAAIQ"]
[Fri Mar 27 23:22:20.067760 2026] [:error] [pid 4341:tid 4350] [client 20.100.186.223:58571] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "acagrOKJWrNB5dMlERHSZwAAAYc"]
[Fri Mar 27 23:22:20.614073 2026] [:error] [pid 27851:tid 27858] [client 20.100.186.223:62328] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "acagrHR2ccxe3RMCLbolLQAAAMA"]
[Fri Mar 27 23:22:21.173340 2026] [:error] [pid 27750:tid 27834] [client 20.100.186.223:59721] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "acagrYaSil5rd17ieLwU4AAAAJA"]
[Fri Mar 27 23:22:21.737159 2026] [:error] [pid 63897:tid 63911] [client 20.100.186.223:56129] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xex.php"] [unique_id "acagrWVSkmYmLu7ycYhxtAAAAQw"]
[Fri Mar 27 23:22:22.276747 2026] [:error] [pid 4341:tid 4352] [client 20.100.186.223:58617] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acagruKJWrNB5dMlERHSaAAAAYk"]
[Fri Mar 27 23:22:22.858472 2026] [:error] [pid 27750:tid 27840] [client 20.100.186.223:58603] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acagroaSil5rd17ieLwU5AAAAJY"]
[Fri Mar 27 23:22:23.443070 2026] [:error] [pid 27851:tid 27872] [client 20.100.186.223:59740] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acagr3R2ccxe3RMCLbolMQAAAM4"]
[Fri Mar 27 23:22:23.996477 2026] [:error] [pid 27851:tid 27859] [client 20.100.186.223:62307] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acagr3R2ccxe3RMCLbolNAAAAME"]
[Fri Mar 27 23:22:24.573796 2026] [:error] [pid 4293:tid 4307] [client 20.100.186.223:62284] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acagsJLjeJUC3OKtEx_GhwAAAUw"]
[Fri Mar 27 23:22:25.103586 2026] [:error] [pid 27851:tid 27861] [client 20.100.186.223:61681] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acagsXR2ccxe3RMCLbolOwAAAMM"]
[Fri Mar 27 23:22:25.661616 2026] [:error] [pid 27750:tid 27838] [client 20.100.186.223:58606] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acagsYaSil5rd17ieLwU5gAAAJQ"]
[Fri Mar 27 23:22:26.200447 2026] [:error] [pid 27750:tid 27841] [client 20.100.186.223:59722] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acagsoaSil5rd17ieLwU6QAAAJc"]
[Fri Mar 27 23:22:26.725129 2026] [:error] [pid 4341:tid 4356] [client 20.100.186.223:59205] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtyh.php"] [unique_id "acagsuKJWrNB5dMlERHSagAAAY0"]
[Fri Mar 27 23:22:27.247211 2026] [:error] [pid 54663:tid 54682] [client 20.100.186.223:60427] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtyh.php"] [unique_id "acagsxUtStIXFk9WHe3qWgAAAdA"]
[Fri Mar 27 23:22:27.813281 2026] [:error] [pid 63897:tid 63915] [client 20.100.186.223:59203] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtyh.php"] [unique_id "acags2VSkmYmLu7ycYhxvAAAARA"]
[Fri Mar 27 23:22:28.362870 2026] [:error] [pid 27851:tid 27859] [client 20.100.186.223:61683] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtyh.php"] [unique_id "acagtHR2ccxe3RMCLbolQwAAAME"]
[Fri Mar 27 23:22:28.980948 2026] [:error] [pid 27750:tid 27842] [client 20.100.186.223:61026] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wta.php"] [unique_id "acagtIaSil5rd17ieLwU8AAAAJg"]
[Fri Mar 27 23:22:29.593864 2026] [:error] [pid 27750:tid 27822] [client 20.100.186.223:56144] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wta.php"] [unique_id "acagtYaSil5rd17ieLwU8QAAAIQ"]
[Fri Mar 27 23:22:30.185883 2026] [:error] [pid 27750:tid 27827] [client 20.100.186.223:62940] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wta.php"] [unique_id "acagtoaSil5rd17ieLwU9gAAAIk"]
[Fri Mar 27 23:22:30.759352 2026] [:error] [pid 27743:tid 27766] [client 20.100.186.223:59723] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wta.php"] [unique_id "acagtiA46UYYLqzw99An7gAAAAI"]
[Fri Mar 27 23:22:31.311808 2026] [:error] [pid 27749:tid 27797] [client 20.100.186.223:60997] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acagt8EqyoMni2Q6_X4lVQAAAEY"]
[Fri Mar 27 23:22:31.933975 2026] [:error] [pid 27749:tid 27791] [client 20.100.186.223:6509] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acagt8EqyoMni2Q6_X4lXAAAAEA"]
[Fri Mar 27 23:22:32.518207 2026] [:error] [pid 4341:tid 4358] [client 20.100.186.223:59251] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acaguOKJWrNB5dMlERHSbQAAAY8"]
[Fri Mar 27 23:22:33.225351 2026] [:error] [pid 27750:tid 27841] [client 20.100.186.223:58552] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acaguYaSil5rd17ieLwU_AAAAJc"]
[Fri Mar 27 23:22:33.848216 2026] [:error] [pid 27851:tid 27881] [client 20.100.186.223:62306] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acaguXR2ccxe3RMCLbolRwAAANc"]
[Fri Mar 27 23:22:34.438810 2026] [:error] [pid 54663:tid 54676] [client 20.100.186.223:59216] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acaguhUtStIXFk9WHe3qaAAAAco"]
[Fri Mar 27 23:22:35.020702 2026] [:error] [pid 54663:tid 54679] [client 20.100.186.223:62281] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acaguxUtStIXFk9WHe3qbgAAAc0"]
[Fri Mar 27 23:22:35.542133 2026] [:error] [pid 54663:tid 54683] [client 20.100.186.223:58606] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acaguxUtStIXFk9WHe3qcwAAAdE"]
[Fri Mar 27 23:22:36.270371 2026] [:error] [pid 27749:tid 27797] [client 20.100.186.223:62320] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acagvMEqyoMni2Q6_X4lYwAAAEY"]
[Fri Mar 27 23:22:36.792115 2026] [:error] [pid 27749:tid 27815] [client 20.100.186.223:58574] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acagvMEqyoMni2Q6_X4lZAAAAFg"]
[Fri Mar 27 23:22:37.345449 2026] [:error] [pid 27743:tid 27778] [client 20.100.186.223:58530] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acagvSA46UYYLqzw99An9gAAAA4"]
[Fri Mar 27 23:22:37.955474 2026] [:error] [pid 63897:tid 63904] [client 20.100.186.223:56172] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acagvWVSkmYmLu7ycYhxwQAAAQU"]
[Fri Mar 27 23:22:38.509852 2026] [:error] [pid 27743:tid 27771] [client 20.100.186.223:61680] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acagviA46UYYLqzw99An_AAAAAc"]
[Fri Mar 27 23:22:39.069441 2026] [:error] [pid 54663:tid 54669] [client 20.100.186.223:56155] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acagvxUtStIXFk9WHe3qewAAAcM"]
[Fri Mar 27 23:22:39.778774 2026] [:error] [pid 27743:tid 27777] [client 20.100.186.223:61674] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acagvyA46UYYLqzw99An_gAAAA0"]
[Fri Mar 27 23:22:40.457381 2026] [:error] [pid 54663:tid 54682] [client 20.100.186.223:59658] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acagwBUtStIXFk9WHe3qggAAAdA"]
[Fri Mar 27 23:22:40.998951 2026] [:error] [pid 54663:tid 54669] [client 20.100.186.223:58578] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acagwBUtStIXFk9WHe3qhwAAAcM"]
[Fri Mar 27 23:22:41.679871 2026] [:error] [pid 4341:tid 4343] [client 20.100.186.223:59712] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acagweKJWrNB5dMlERHSdQAAAYA"]
[Fri Mar 27 23:22:42.209014 2026] [:error] [pid 4341:tid 4349] [client 20.100.186.223:60526] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acagwuKJWrNB5dMlERHSdgAAAYY"]
[Fri Mar 27 23:22:42.762214 2026] [:error] [pid 4293:tid 4298] [client 20.100.186.223:62314] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acagwpLjeJUC3OKtEx_GkgAAAUM"]
[Fri Mar 27 23:22:43.422615 2026] [:error] [pid 54663:tid 54672] [client 20.100.186.223:58522] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acagwxUtStIXFk9WHe3qiQAAAcY"]
[Fri Mar 27 23:22:44.009347 2026] [:error] [pid 54663:tid 54673] [client 20.100.186.223:61647] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acagxBUtStIXFk9WHe3qiwAAAcc"]
[Fri Mar 27 23:22:44.636661 2026] [:error] [pid 4341:tid 4360] [client 20.100.186.223:59686] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acagxOKJWrNB5dMlERHSeAAAAZE"]
[Fri Mar 27 23:22:45.231038 2026] [:error] [pid 27851:tid 27860] [client 20.100.186.223:56183] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acagxXR2ccxe3RMCLbolUwAAAMI"]
[Fri Mar 27 23:22:45.781738 2026] [:error] [pid 27851:tid 27872] [client 20.100.186.223:59688] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "acagxXR2ccxe3RMCLbolVQAAAM4"]
[Fri Mar 27 23:22:46.379664 2026] [:error] [pid 54663:tid 54679] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Fri Mar 27 23:22:46.696801 2026] [:error] [pid 54663:tid 54673] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/bywaf.php
[Fri Mar 27 23:22:46.980113 2026] [:error] [pid 54663:tid 54682] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-true.php
[Fri Mar 27 23:22:47.367021 2026] [:error] [pid 54663:tid 54671] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Fri Mar 27 23:22:47.668535 2026] [:error] [pid 54663:tid 54690] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/tx88.php
[Fri Mar 27 23:22:47.948910 2026] [:error] [pid 54663:tid 54678] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Fri Mar 27 23:22:48.227075 2026] [:error] [pid 54663:tid 54685] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Fri Mar 27 23:22:48.532780 2026] [:error] [pid 54663:tid 54682] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/z60.php
[Fri Mar 27 23:22:48.830436 2026] [:error] [pid 54663:tid 54671] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/utky.php
[Fri Mar 27 23:22:49.142243 2026] [:error] [pid 54663:tid 54667] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/uang.php
[Fri Mar 27 23:22:49.506686 2026] [:error] [pid 54663:tid 54666] [client 20.100.186.223:60514] File does not exist: /usr/local/apache/htdocs/suspended-page/wp3.php
[Fri Mar 27 23:22:49.886504 2026] [:error] [pid 54663:tid 54679] [client 20.100.186.223:60514] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acagyRUtStIXFk9WHe3qrAAAAc0"]
[Fri Mar 27 23:22:50.656693 2026] [:error] [pid 27743:tid 27779] [client 20.100.186.223:56168] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acagyiA46UYYLqzw99AoBgAAAA8"]
[Fri Mar 27 23:22:51.257848 2026] [:error] [pid 27749:tid 27807] [client 20.100.186.223:58612] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acagy8EqyoMni2Q6_X4lbQAAAFA"]
[Fri Mar 27 23:22:51.824564 2026] [:error] [pid 27743:tid 27781] [client 20.100.186.223:59231] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acagyyA46UYYLqzw99AoDgAAABE"]
[Fri Mar 27 23:22:52.829845 2026] [:error] [pid 54663:tid 54671] [client 20.100.186.223:58542] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acagzBUtStIXFk9WHe3qrwAAAcU"]
[Fri Mar 27 23:22:53.426579 2026] [:error] [pid 27749:tid 27799] [client 20.100.186.223:61043] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acagzcEqyoMni2Q6_X4lcwAAAEg"]
[Fri Mar 27 23:22:53.997254 2026] [:error] [pid 63897:tid 63901] [client 20.100.186.223:59680] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acagzWVSkmYmLu7ycYhxxAAAAQI"]
[Fri Mar 27 23:22:54.652883 2026] [:error] [pid 27743:tid 27765] [client 20.100.186.223:59692] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/absorption.php"] [unique_id "acagziA46UYYLqzw99AoEgAAAAE"]
[Fri Mar 27 23:22:55.241536 2026] [:error] [pid 27749:tid 27809] [client 20.100.186.223:62956] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "acagz8EqyoMni2Q6_X4ldQAAAFI"]
[Fri Mar 27 23:22:55.920984 2026] [:error] [pid 27851:tid 27882] [client 20.100.186.223:59233] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "acagz3R2ccxe3RMCLbolWgAAANg"]
[Fri Mar 27 23:22:56.532118 2026] [:error] [pid 27851:tid 27877] [client 20.100.186.223:59650] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "acag0HR2ccxe3RMCLbolXAAAANM"]
[Fri Mar 27 23:22:57.157888 2026] [:error] [pid 27851:tid 27862] [client 20.100.186.223:61027] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ticket.php"] [unique_id "acag0XR2ccxe3RMCLbolXgAAAMQ"]
[Fri Mar 27 23:22:57.818204 2026] [:error] [pid 27851:tid 27863] [client 20.100.186.223:60432] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "acag0XR2ccxe3RMCLbolYwAAAMU"]
[Fri Mar 27 23:22:58.375640 2026] [:error] [pid 63897:tid 63916] [client 20.100.186.223:59697] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "acag0mVSkmYmLu7ycYhxzAAAARE"]
[Fri Mar 27 23:22:59.095252 2026] [:error] [pid 27851:tid 27881] [client 20.100.186.223:62330] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "acag03R2ccxe3RMCLbolaAAAANc"]
[Fri Mar 27 23:22:59.720377 2026] [:error] [pid 27851:tid 27862] [client 20.100.186.223:61654] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "acag03R2ccxe3RMCLbolbAAAAMQ"]
[Fri Mar 27 23:23:00.524993 2026] [:error] [pid 27750:tid 27821] [client 20.100.186.223:59202] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "acag1IaSil5rd17ieLwVFQAAAIM"]
[Fri Mar 27 23:23:01.456274 2026] [:error] [pid 27851:tid 27873] [client 20.100.186.223:60540] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "acag1XR2ccxe3RMCLbolbgAAAM8"]
[Fri Mar 27 23:23:02.025066 2026] [:error] [pid 27743:tid 27787] [client 20.100.186.223:59725] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "acag1iA46UYYLqzw99AoGQAAABc"]
[Fri Mar 27 23:23:02.639180 2026] [:error] [pid 27851:tid 27865] [client 20.100.186.223:59652] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpwer1.php"] [unique_id "acag1nR2ccxe3RMCLbolcQAAAMc"]
[Fri Mar 27 23:23:03.256178 2026] [:error] [pid 27851:tid 27868] [client 20.100.186.223:56143] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "acag13R2ccxe3RMCLbolcwAAAMo"]
[Fri Mar 27 23:23:03.820760 2026] [:error] [pid 27851:tid 27861] [client 20.100.186.223:59744] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "acag13R2ccxe3RMCLboldwAAAMM"]
[Fri Mar 27 23:23:04.510424 2026] [:error] [pid 27851:tid 27865] [client 20.100.186.223:62306] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "acag2HR2ccxe3RMCLbolfQAAAMc"]
[Fri Mar 27 23:23:05.109062 2026] [:error] [pid 27851:tid 27875] [client 20.100.186.223:59693] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "acag2XR2ccxe3RMCLbolfgAAANE"]
[Fri Mar 27 23:23:05.718686 2026] [:error] [pid 4341:tid 4348] [client 20.100.186.223:59727] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "acag2eKJWrNB5dMlERHSiAAAAYU"]
[Fri Mar 27 23:23:06.310570 2026] [:error] [pid 4341:tid 4349] [client 20.100.186.223:62295] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "acag2uKJWrNB5dMlERHSiQAAAYY"]
[Fri Mar 27 23:23:06.966012 2026] [:error] [pid 4293:tid 4308] [client 20.100.186.223:60992] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "acag2pLjeJUC3OKtEx_GnAAAAU0"]
[Fri Mar 27 23:23:07.927185 2026] [:error] [pid 4293:tid 4300] [client 20.100.186.223:60528] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "acag25LjeJUC3OKtEx_GogAAAUU"]
[Fri Mar 27 23:23:08.470543 2026] [:error] [pid 4293:tid 4301] [client 20.100.186.223:56188] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpass.php"] [unique_id "acag3JLjeJUC3OKtEx_GowAAAUY"]
[Fri Mar 27 23:23:09.008646 2026] [:error] [pid 63897:tid 63919] [client 20.100.186.223:56167] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpass.php"] [unique_id "acag3WVSkmYmLu7ycYhxzgAAARQ"]
[Fri Mar 27 23:23:09.570005 2026] [:error] [pid 4293:tid 4299] [client 20.100.186.223:59225] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpass.php"] [unique_id "acag3ZLjeJUC3OKtEx_GpgAAAUQ"]
[Fri Mar 27 23:23:10.149326 2026] [:error] [pid 4341:tid 4352] [client 20.100.186.223:61661] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xpass.php"] [unique_id "acag3uKJWrNB5dMlERHSkAAAAYk"]
[Fri Mar 27 23:23:10.726987 2026] [:error] [pid 4341:tid 4356] [client 20.100.186.223:56147] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acag3uKJWrNB5dMlERHSkwAAAY0"]
[Fri Mar 27 23:23:11.367947 2026] [:error] [pid 27743:tid 27785] [client 20.100.186.223:59774] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acag3yA46UYYLqzw99AoHwAAABU"]
[Fri Mar 27 23:23:11.946039 2026] [:error] [pid 4293:tid 4312] [client 20.100.186.223:62325] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acag35LjeJUC3OKtEx_GrQAAAVE"]
[Fri Mar 27 23:23:12.464907 2026] [:error] [pid 27743:tid 27787] [client 20.100.186.223:59707] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acag4CA46UYYLqzw99AoIAAAABc"]
[Fri Mar 27 23:23:13.120363 2026] [:error] [pid 4293:tid 4311] [client 20.100.186.223:60468] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acag4ZLjeJUC3OKtEx_GsQAAAVA"]
[Fri Mar 27 23:23:13.681472 2026] [:error] [pid 27750:tid 27840] [client 20.100.186.223:59252] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acag4YaSil5rd17ieLwVGgAAAJY"]
[Fri Mar 27 23:23:14.238756 2026] [:error] [pid 27750:tid 27823] [client 20.100.186.223:58566] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acag4oaSil5rd17ieLwVHAAAAIU"]
[Fri Mar 27 23:23:14.840270 2026] [:error] [pid 4293:tid 4314] [client 20.100.186.223:59207] [client 20.100.186.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acag4pLjeJUC3OKtEx_GtAAAAVM"]
[Sat Mar 28 06:05:40.646489 2026] [:error] [pid 43547:tid 43563] [client 217.216.37.54:58952] [client 217.216.37.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "acb_ND4ZEfdetXP-9aCpzAAAAg4"]
[Sat Mar 28 06:05:41.029741 2026] [:error] [pid 43579:tid 43624] [client 217.216.37.54:61206] [client 217.216.37.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acb_NSRqN4JVI8gB7AmBVAAAApA"]
[Sat Mar 28 06:05:41.242123 2026] [:error] [pid 43547:tid 43570] [client 217.216.37.54:62161] [client 217.216.37.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/media/system/js/core.js"] [unique_id "acb_NT4ZEfdetXP-9aCpzwAAAhU"]
[Sat Mar 28 06:36:27.066092 2026] [:error] [pid 64966:tid 64997] [client 94.247.172.129:42203] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "accGa9fSvF5AFfSuKxXyDQAAANg"]
[Sat Mar 28 08:55:39.158281 2026] [:error] [pid 64860:tid 64913] [client 203.2.64.59:54399] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "accnCxkU3N0pg_4aEL8EqgAAAEU"]
[Sat Mar 28 13:09:42.019171 2026] [:error] [pid 34631:tid 34664] [client 43.128.156.124:44662] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acdiljtzjMMS6kojpeSrCwAAAcQ"]
[Sat Mar 28 16:20:49.505201 2026] [:error] [pid 64966:tid 64980] [client 125.94.144.102:36853] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acePYdfSvF5AFfSuKxUiOAAAAMc"]
[Sat Mar 28 18:49:55.278892 2026] [:error] [pid 43547:tid 43567] [client 43.167.241.46:51148] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aceyUz4ZEfdetXP-9aDy5AAAAhI"]
[Sat Mar 28 23:36:41.232366 2026] [:error] [pid 43578:tid 43603] [client 45.94.31.49:62480] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acf1iXNG2YdGm41aN8I3xAAAAlY"]
[Sat Mar 28 23:36:41.882441 2026] [:error] [pid 43578:tid 43604] [client 45.94.31.49:56706] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acf1iXNG2YdGm41aN8I37gAAAlc"]
[Sat Mar 28 23:36:42.681284 2026] [:error] [pid 64860:tid 64919] [client 45.94.31.49:53731] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acf1ihkU3N0pg_4aEL-7sQAAAEs"]
[Sat Mar 28 23:36:43.329795 2026] [:error] [pid 2877:tid 2882] [client 45.94.31.49:55079] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acf1i7gM4xL1Xj409YQdsgAAAQM"]
[Sat Mar 28 23:36:44.097812 2026] [:error] [pid 43578:tid 43587] [client 45.94.31.49:55082] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "acf1jHNG2YdGm41aN8I3_wAAAkY"]
[Sat Mar 28 23:41:19.349572 2026] [:error] [pid 34631:tid 34671] [client 49.7.227.204:58144] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acf2nztzjMMS6kojpeSG3gAAAcs"]
[Sat Mar 28 23:48:05.540464 2026] [:error] [pid 43578:tid 43604] [client 49.51.243.156:41308] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acf4NXNG2YdGm41aN8JCEAAAAlc"]
[Sun Mar 29 05:22:40.349406 2026] [:error] [pid 32257:tid 32323] [client 20.122.187.158:12269] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achGoCE3TArOFrUtgWoxUgAAAIU"]
[Sun Mar 29 05:22:40.772667 2026] [:error] [pid 12910:tid 12934] [client 20.122.187.158:12230] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achGoCnoNBcZwnBvsMNJ5gAAAVY"]
[Sun Mar 29 05:22:41.251036 2026] [:error] [pid 12910:tid 12915] [client 20.122.187.158:12160] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achGoSnoNBcZwnBvsMNJ6QAAAUM"]
[Sun Mar 29 05:22:41.655212 2026] [:error] [pid 32257:tid 32338] [client 20.122.187.158:12240] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "achGoSE3TArOFrUtgWoxVgAAAJQ"]
[Sun Mar 29 06:56:02.814000 2026] [:error] [pid 23168:tid 23203] [client 182.44.12.37:56672] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "achcgmP8p0yRL8ot_2__qwAAAgY"]
[Sun Mar 29 06:58:52.170348 2026] [:error] [pid 23284:tid 23298] [client 43.135.133.194:45028] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "achdLIzBujdPHsq7wyRU6QAAAow"]
[Sun Mar 29 09:59:42.986284 2026] [:error] [pid 32257:tid 32336] [client 43.153.71.12:46212] [client 43.153.71.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aciHjiE3TArOFrUtgWps-wAAAJI"]
[Sun Mar 29 15:47:00.305360 2026] [:error] [pid 32255:tid 32294] [client 43.163.206.70:50260] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acjY9Gnfn-AtRoMbquw6KQAAAEM"]
[Sun Mar 29 21:34:51.491312 2026] [:error] [pid 23167:tid 23194] [client 182.42.111.213:56522] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ackqexIAHJCFaHff3_e7egAAAdg"]
[Sun Mar 29 21:58:34.894848 2026] [:error] [pid 23250:tid 23274] [client 20.119.40.59:23182] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ackwCpxrpj-dQjy1cvoF3QAAAlY"]
[Sun Mar 29 21:58:36.530751 2026] [:error] [pid 32254:tid 32266] [client 20.119.40.59:43547] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ackwDKug2IHuyGgCTn9dIwAAAAI"]
[Sun Mar 29 21:58:42.902493 2026] [:error] [pid 23250:tid 23273] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/bjfl.php
[Sun Mar 29 21:58:43.113101 2026] [:error] [pid 23250:tid 23274] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/ad1.php
[Sun Mar 29 21:58:43.325737 2026] [:error] [pid 23250:tid 23259] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Sun Mar 29 21:58:43.537614 2026] [:error] [pid 23250:tid 23272] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/tanjiro.php
[Sun Mar 29 21:58:43.786105 2026] [:error] [pid 23250:tid 23261] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Mar 29 21:58:43.996015 2026] [:error] [pid 23250:tid 23275] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/file22.php
[Sun Mar 29 21:58:44.206283 2026] [:error] [pid 23250:tid 23258] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/inwp.php
[Sun Mar 29 21:58:44.416344 2026] [:error] [pid 23250:tid 23264] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Sun Mar 29 21:58:44.628289 2026] [:error] [pid 23250:tid 23252] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/nz.php
[Sun Mar 29 21:58:44.838953 2026] [:error] [pid 23250:tid 23262] [client 20.119.40.59:25838] File does not exist: /usr/local/apache/htdocs/suspended-page/bnn_.php
[Sun Mar 29 21:58:45.046350 2026] [:error] [pid 23250:tid 23268] [client 20.119.40.59:25838] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "ackwFZxrpj-dQjy1cvoF9gAAAlA"]
[Sun Mar 29 21:58:47.079536 2026] [:error] [pid 23284:tid 23291] [client 20.119.40.59:48822] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/anz.php"] [unique_id "ackwF4zBujdPHsq7wyShzwAAAoU"]
[Sun Mar 29 21:58:52.687606 2026] [:error] [pid 23284:tid 23310] [client 20.119.40.59:54654] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "ackwHIzBujdPHsq7wySh5QAAApg"]
[Sun Mar 29 21:58:56.209569 2026] [:error] [pid 23137:tid 23159] [client 20.119.40.59:23231] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "ackwIBaWQa7LdZ_qGFb7sgAAAZQ"]
[Sun Mar 29 21:58:58.323193 2026] [:error] [pid 23137:tid 23143] [client 20.119.40.59:44009] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file66.php"] [unique_id "ackwIhaWQa7LdZ_qGFb7swAAAYQ"]
[Sun Mar 29 21:59:04.307373 2026] [:error] [pid 32254:tid 32279] [client 20.119.40.59:26342] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kure.php"] [unique_id "ackwKKug2IHuyGgCTn9dKwAAAA8"]
[Sun Mar 29 21:59:11.861987 2026] [:error] [pid 23250:tid 23272] [client 20.119.40.59:47948] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fgd.php"] [unique_id "ackwL5xrpj-dQjy1cvoGAwAAAlQ"]
[Sun Mar 29 21:59:23.098538 2026] [:error] [pid 23168:tid 23210] [client 20.119.40.59:22761] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fgd.php"] [unique_id "ackwO2P8p0yRL8ot_2-eIgAAAg0"]
[Sun Mar 29 21:59:27.026870 2026] [:error] [pid 32257:tid 32328] [client 20.119.40.59:27658] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7T6.php"] [unique_id "ackwPyE3TArOFrUtgWo2pAAAAIo"]
[Sun Mar 29 21:59:31.390410 2026] [:error] [pid 32255:tid 32310] [client 20.119.40.59:50052] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alog.php"] [unique_id "ackwQ2nfn-AtRoMbquzv8QAAAFM"]
[Sun Mar 29 21:59:31.891603 2026] [:error] [pid 32255:tid 32300] [client 20.119.40.59:44395] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alog.php"] [unique_id "ackwQ2nfn-AtRoMbquzv8wAAAEk"]
[Sun Mar 29 21:59:34.059866 2026] [:error] [pid 23284:tid 23310] [client 20.119.40.59:44732] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alog.php"] [unique_id "ackwRozBujdPHsq7wySiegAAApg"]
[Sun Mar 29 21:59:38.102398 2026] [:error] [pid 23284:tid 23307] [client 20.119.40.59:38165] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "ackwSozBujdPHsq7wySimgAAApU"]
[Sun Mar 29 21:59:40.831856 2026] [:error] [pid 23284:tid 23307] [client 20.119.40.59:49554] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "ackwTIzBujdPHsq7wySirgAAApU"]
[Sun Mar 29 21:59:42.834867 2026] [:error] [pid 32359:tid 32365] [client 20.119.40.59:56156] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "ackwTgMb8G3UzfQP3WgwAQAAAMQ"]
[Sun Mar 29 21:59:48.552316 2026] [:error] [pid 23284:tid 23301] [client 20.119.40.59:50016] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Sun Mar 29 21:59:48.766487 2026] [:error] [pid 23284:tid 23289] [client 20.119.40.59:50016] File does not exist: /usr/local/apache/htdocs/suspended-page/ty.php
[Sun Mar 29 21:59:49.184332 2026] [:error] [pid 23284:tid 23291] [client 20.119.40.59:50016] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "ackwVYzBujdPHsq7wySi8QAAAoU"]
[Sun Mar 29 21:59:50.833319 2026] [:error] [pid 23284:tid 23287] [client 20.119.40.59:50011] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Sun Mar 29 21:59:51.700100 2026] [:error] [pid 23284:tid 23287] [client 20.119.40.59:50011] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Sun Mar 29 21:59:51.917387 2026] [:error] [pid 23284:tid 23289] [client 20.119.40.59:50011] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Sun Mar 29 21:59:52.131802 2026] [:error] [pid 23284:tid 23300] [client 20.119.40.59:50011] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/images/28c5400b0b.php"] [unique_id "ackwWIzBujdPHsq7wySjEQAAAo4"]
[Sun Mar 29 21:59:55.435670 2026] [:error] [pid 32257:tid 32332] [client 20.119.40.59:18396] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-includes/wp-config-sample.php"] [unique_id "ackwWyE3TArOFrUtgWo28AAAAI4"]
[Sun Mar 29 21:59:59.500706 2026] [:error] [pid 23167:tid 23188] [client 20.119.40.59:23768] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackwXxIAHJCFaHff3_fB9wAAAdI"]
[Sun Mar 29 22:00:00.606438 2026] [:error] [pid 32255:tid 32299] [client 20.119.40.59:5665] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackwYGnfn-AtRoMbquzwNgAAAEg"]
[Sun Mar 29 22:00:03.116606 2026] [:error] [pid 23284:tid 23294] [client 20.119.40.59:25598] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackwY4zBujdPHsq7wySjTgAAAog"]
[Sun Mar 29 22:00:04.272636 2026] [:error] [pid 23284:tid 23301] [client 20.119.40.59:5666] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/.info.php"] [unique_id "ackwZIzBujdPHsq7wySjWQAAAo8"]
[Sun Mar 29 22:00:07.011520 2026] [:error] [pid 32254:tid 32266] [client 20.119.40.59:40970] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ackwZ6ug2IHuyGgCTn9dOAAAAAI"]
[Sun Mar 29 22:00:08.543073 2026] [:error] [pid 23250:tid 23260] [client 20.119.40.59:22413] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ackwaJxrpj-dQjy1cvoGDQAAAkg"]
[Sun Mar 29 22:00:11.180810 2026] [:error] [pid 32359:tid 32380] [client 20.119.40.59:5670] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ackwawMb8G3UzfQP3WgwCwAAANM"]
[Sun Mar 29 22:00:13.148703 2026] [:error] [pid 23250:tid 23269] [client 20.119.40.59:41392] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "ackwbZxrpj-dQjy1cvoGDgAAAlE"]
[Sun Mar 29 22:00:14.612031 2026] [:error] [pid 32257:tid 32326] [client 20.119.40.59:5884] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/install.php"] [unique_id "ackwbiE3TArOFrUtgWo3CgAAAIg"]
[Sun Mar 29 22:00:18.426411 2026] [:error] [pid 32257:tid 32327] [client 20.119.40.59:5876] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/install.php"] [unique_id "ackwciE3TArOFrUtgWo3GAAAAIk"]
[Sun Mar 29 22:03:01.538587 2026] [:error] [pid 32257:tid 32330] [client 20.119.40.59:19931] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "ackxFSE3TArOFrUtgWo5FwAAAIw"]
[Sun Mar 29 22:03:03.005917 2026] [:error] [pid 32255:tid 32312] [client 20.119.40.59:5898] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "ackxF2nfn-AtRoMbquzyCAAAAFU"]
[Sun Mar 29 22:03:03.942428 2026] [:error] [pid 32257:tid 32332] [client 20.119.40.59:54668] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "ackxFyE3TArOFrUtgWo5KQAAAI4"]
[Sun Mar 29 22:03:08.555385 2026] [:error] [pid 23284:tid 23305] [client 20.119.40.59:31578] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "ackxHIzBujdPHsq7wySl5wAAApM"]
[Sun Mar 29 22:03:10.829005 2026] [:error] [pid 23284:tid 23306] [client 20.119.40.59:43597] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "ackxHozBujdPHsq7wySl9gAAApQ"]
[Sun Mar 29 22:03:14.271935 2026] [:error] [pid 8818:tid 8840] [client 20.119.40.59:48778] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "ackxIiCDvotZNSF0FBrhPAAAAVI"]
[Sun Mar 29 22:03:19.188939 2026] [:error] [pid 23284:tid 23297] [client 20.119.40.59:18057] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "ackxJ4zBujdPHsq7wySmGgAAAos"]
[Sun Mar 29 22:03:21.369856 2026] [:error] [pid 8818:tid 8828] [client 20.119.40.59:35592] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/file.php"] [unique_id "ackxKSCDvotZNSF0FBrhSQAAAUY"]
[Sun Mar 29 22:03:23.334315 2026] [:error] [pid 23284:tid 23297] [client 20.119.40.59:54717] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/file.php"] [unique_id "ackxK4zBujdPHsq7wySmMQAAAos"]
[Sun Mar 29 22:03:24.911516 2026] [:error] [pid 23284:tid 23306] [client 20.119.40.59:26793] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/file.php"] [unique_id "ackxLIzBujdPHsq7wySmOwAAApQ"]
[Sun Mar 29 22:03:27.316701 2026] [:error] [pid 32255:tid 32303] [client 20.119.40.59:49503] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/file.php"] [unique_id "ackxL2nfn-AtRoMbquzyLAAAAEw"]
[Sun Mar 29 22:03:28.935934 2026] [:error] [pid 32257:tid 32321] [client 20.119.40.59:37214] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "ackxMCE3TArOFrUtgWo5jwAAAIM"]
[Sun Mar 29 22:03:37.134572 2026] [:error] [pid 32255:tid 32314] [client 20.119.40.59:22501] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "ackxOWnfn-AtRoMbquzyQAAAAFc"]
[Sun Mar 29 22:03:45.289009 2026] [:error] [pid 32257:tid 32329] [client 20.119.40.59:36816] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "ackxQSE3TArOFrUtgWo5wQAAAIs"]
[Sun Mar 29 22:03:49.049526 2026] [:error] [pid 23168:tid 23216] [client 20.119.40.59:25811] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "ackxRWP8p0yRL8ot_2-ffgAAAhM"]
[Sun Mar 29 22:03:52.569222 2026] [:error] [pid 32255:tid 32305] [client 20.119.40.59:19403] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/xp.php"] [unique_id "ackxSGnfn-AtRoMbquzyXgAAAE4"]
[Sun Mar 29 22:03:55.090052 2026] [:error] [pid 32257:tid 32323] [client 20.119.40.59:5715] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/xp.php"] [unique_id "ackxSyE3TArOFrUtgWo54AAAAIU"]
[Sun Mar 29 22:03:58.043822 2026] [:error] [pid 23284:tid 23288] [client 20.119.40.59:18938] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/xp.php"] [unique_id "ackxTozBujdPHsq7wySmjgAAAoI"]
[Sun Mar 29 22:04:00.951528 2026] [:error] [pid 32257:tid 32338] [client 20.119.40.59:37696] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/xp.php"] [unique_id "ackxUCE3TArOFrUtgWo57gAAAJQ"]
[Sun Mar 29 22:04:06.976629 2026] [:error] [pid 23284:tid 23291] [client 20.119.40.59:51738] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "ackxVozBujdPHsq7wySmzAAAAoU"]
[Sun Mar 29 22:04:10.879119 2026] [:error] [pid 32257:tid 32324] [client 20.119.40.59:12804] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "ackxWiE3TArOFrUtgWo6DgAAAIY"]
[Sun Mar 29 22:04:14.600867 2026] [:error] [pid 23168:tid 23212] [client 20.119.40.59:41841] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/chosen.php"] [unique_id "ackxXmP8p0yRL8ot_2-fngAAAg8"]
[Sun Mar 29 22:04:24.645906 2026] [:error] [pid 23284:tid 23298] [client 20.119.40.59:44366] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ackxaIzBujdPHsq7wySnEAAAAow"]
[Sun Mar 29 22:04:31.754544 2026] [:error] [pid 8818:tid 8830] [client 20.119.40.59:23461] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "ackxbyCDvotZNSF0FBrhcwAAAUg"]
[Sun Mar 29 22:04:40.308605 2026] [:error] [pid 32254:tid 32287] [client 20.119.40.59:43919] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "ackxeKug2IHuyGgCTn9d1wAAABc"]
[Sun Mar 29 22:04:47.232528 2026] [:error] [pid 32257:tid 32331] [client 20.119.40.59:6108] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Sun Mar 29 22:04:47.445472 2026] [:error] [pid 32257:tid 32330] [client 20.119.40.59:6108] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "ackxfyE3TArOFrUtgWo6XAAAAIw"]
[Sun Mar 29 22:04:57.365830 2026] [:error] [pid 32254:tid 32272] [client 20.119.40.59:26259] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "ackxiaug2IHuyGgCTn9d4wAAAAg"]
[Sun Mar 29 22:05:08.737251 2026] [:error] [pid 23168:tid 23200] [client 20.119.40.59:21889] [client 20.119.40.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/dropdown.php"] [unique_id "ackxlGP8p0yRL8ot_2-f_gAAAgM"]
[Sun Mar 29 22:06:52.303881 2026] [:error] [pid 23168:tid 23221] [client 20.119.40.59:51016] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "ackx_GP8p0yRL8ot_2-gWAAAAhg"]
[Sun Mar 29 22:07:04.029201 2026] [:error] [pid 23167:tid 23193] [client 20.119.40.59:40283] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sun Mar 29 22:07:04.255303 2026] [:error] [pid 23167:tid 23194] [client 20.119.40.59:40283] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Sun Mar 29 22:07:04.478985 2026] [:error] [pid 23167:tid 23180] [client 20.119.40.59:40283] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "ackyCBIAHJCFaHff3_fDZgAAAco"]
[Sun Mar 29 22:07:11.002838 2026] [:error] [pid 23137:tid 23148] [client 20.119.40.59:40311] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "ackyDxaWQa7LdZ_qGFb8tgAAAYk"]
[Sun Mar 29 22:07:21.588580 2026] [:error] [pid 23168:tid 23216] [client 20.119.40.59:34113] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ackyGWP8p0yRL8ot_2-geAAAAhM"]
[Sun Mar 29 22:07:39.887597 2026] [:error] [pid 32255:tid 32301] [client 20.119.40.59:5988] File does not exist: /usr/local/apache/htdocs/suspended-page/user.php
[Sun Mar 29 22:07:40.114460 2026] [:error] [pid 32255:tid 32304] [client 20.119.40.59:5988] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Mar 29 22:07:40.337771 2026] [:error] [pid 32255:tid 32309] [client 20.119.40.59:5988] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "ackyLGnfn-AtRoMbquzzvQAAAFI"]
[Sun Mar 29 22:07:41.853269 2026] [:error] [pid 23168:tid 23213] [client 20.119.40.59:19137] [client 20.119.40.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "ackyLWP8p0yRL8ot_2-gmgAAAhA"]
[Sun Mar 29 23:40:48.560357 2026] [:error] [pid 32255:tid 32297] [client 43.167.157.80:38136] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aclIAGnfn-AtRoMbquwfqQAAAEY"]
[Mon Mar 30 02:36:57.695666 2026] [:error] [pid 23284:tid 23301] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Mon Mar 30 02:36:58.006396 2026] [:error] [pid 23284:tid 23299] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Mon Mar 30 02:36:58.317213 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Mon Mar 30 02:36:58.628593 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Mon Mar 30 02:36:58.938869 2026] [:error] [pid 23284:tid 23310] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/wxfyf.php
[Mon Mar 30 02:36:59.249628 2026] [:error] [pid 23284:tid 23307] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Mon Mar 30 02:36:59.559900 2026] [:error] [pid 23284:tid 23286] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/h2.php
[Mon Mar 30 02:36:59.871036 2026] [:error] [pid 23284:tid 23306] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/d12.php
[Mon Mar 30 02:37:00.190366 2026] [:error] [pid 23284:tid 23304] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Mon Mar 30 02:37:00.501652 2026] [:error] [pid 23284:tid 23295] [client 20.197.183.189:64735] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Mon Mar 30 02:37:00.810667 2026] [:error] [pid 23284:tid 23300] [client 20.197.183.189:64735] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "aclxTIzBujdPHsq7wyRiSQAAAo4"]
[Mon Mar 30 02:37:01.467443 2026] [:error] [pid 32359:tid 32372] [client 20.197.183.189:63822] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "aclxTQMb8G3UzfQP3WhXSgAAAMs"]
[Mon Mar 30 02:37:02.089470 2026] [:error] [pid 8818:tid 8840] [client 20.197.183.189:65103] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "aclxTiCDvotZNSF0FBojzgAAAVI"]
[Mon Mar 30 02:37:02.785585 2026] [:error] [pid 23167:tid 23174] [client 20.197.183.189:65135] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "aclxThIAHJCFaHff3_cPigAAAcQ"]
[Mon Mar 30 02:37:03.436822 2026] [:error] [pid 23167:tid 23193] [client 20.197.183.189:65053] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aclxTxIAHJCFaHff3_cPjQAAAdc"]
[Mon Mar 30 02:37:04.066270 2026] [:error] [pid 23168:tid 23214] [client 20.197.183.189:65025] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aclxUGP8p0yRL8ot_28BuAAAAhE"]
[Mon Mar 30 02:37:04.751047 2026] [:error] [pid 23167:tid 23181] [client 20.197.183.189:63852] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aclxUBIAHJCFaHff3_cPkQAAAcs"]
[Mon Mar 30 02:37:05.381715 2026] [:error] [pid 23168:tid 23216] [client 20.197.183.189:63856] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aclxUWP8p0yRL8ot_28BvAAAAhM"]
[Mon Mar 30 02:37:06.130384 2026] [:error] [pid 23284:tid 23302] [client 20.197.183.189:64752] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aclxUozBujdPHsq7wyRiTgAAApA"]
[Mon Mar 30 02:37:06.819128 2026] [:error] [pid 23168:tid 23205] [client 20.197.183.189:65081] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aclxUmP8p0yRL8ot_28BwQAAAgg"]
[Mon Mar 30 02:37:07.498800 2026] [:error] [pid 23168:tid 23208] [client 20.197.183.189:65134] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aclxU2P8p0yRL8ot_28BwwAAAgs"]
[Mon Mar 30 02:37:08.207995 2026] [:error] [pid 8818:tid 8835] [client 20.197.183.189:65062] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aclxVCCDvotZNSF0FBoj4QAAAU0"]
[Mon Mar 30 02:37:08.909881 2026] [:error] [pid 32359:tid 32383] [client 20.197.183.189:63845] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aclxVAMb8G3UzfQP3WhXWQAAANY"]
[Mon Mar 30 02:37:09.641495 2026] [:error] [pid 8818:tid 8831] [client 20.197.183.189:65104] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aclxVSCDvotZNSF0FBoj6AAAAUk"]
[Mon Mar 30 02:37:10.278661 2026] [:error] [pid 32255:tid 32312] [client 20.197.183.189:64708] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aclxVmnfn-AtRoMbquxy8QAAAFU"]
[Mon Mar 30 02:37:11.018454 2026] [:error] [pid 32359:tid 32364] [client 20.197.183.189:65115] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aclxVwMb8G3UzfQP3WhXYwAAAMM"]
[Mon Mar 30 02:37:11.654008 2026] [:error] [pid 32255:tid 32298] [client 20.197.183.189:63817] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aclxV2nfn-AtRoMbquxy-AAAAEc"]
[Mon Mar 30 02:37:12.414154 2026] [:error] [pid 23284:tid 23304] [client 20.197.183.189:64757] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aclxWIzBujdPHsq7wyRiUQAAApI"]
[Mon Mar 30 02:37:13.115144 2026] [:error] [pid 32257:tid 32319] [client 20.197.183.189:65137] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aclxWSE3TArOFrUtgWrzlgAAAIE"]
[Mon Mar 30 02:37:13.760695 2026] [:error] [pid 32255:tid 32310] [client 20.197.183.189:65069] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "aclxWWnfn-AtRoMbquxzBQAAAFM"]
[Mon Mar 30 02:37:14.384450 2026] [:error] [pid 32257:tid 32334] [client 20.197.183.189:64746] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aclxWiE3TArOFrUtgWrzmQAAAJA"]
[Mon Mar 30 02:37:15.004569 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:64740] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aclxWyE3TArOFrUtgWrznQAAAIQ"]
[Mon Mar 30 02:37:15.629613 2026] [:error] [pid 32257:tid 32340] [client 20.197.183.189:64725] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aclxWyE3TArOFrUtgWrzpAAAAJY"]
[Mon Mar 30 02:37:16.270414 2026] [:error] [pid 23284:tid 23299] [client 20.197.183.189:63858] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aclxXIzBujdPHsq7wyRiVAAAAo0"]
[Mon Mar 30 02:37:16.903708 2026] [:error] [pid 23284:tid 23298] [client 20.197.183.189:65114] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "aclxXIzBujdPHsq7wyRiVgAAAow"]
[Mon Mar 30 02:37:17.523517 2026] [:error] [pid 32359:tid 32368] [client 20.197.183.189:64712] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "aclxXQMb8G3UzfQP3WhXdwAAAMc"]
[Mon Mar 30 02:37:18.141165 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:63829] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "aclxXozBujdPHsq7wyRiWQAAApE"]
[Mon Mar 30 02:37:18.764446 2026] [:error] [pid 23250:tid 23272] [client 20.197.183.189:64753] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "aclxXpxrpj-dQjy1cvo9CQAAAlQ"]
[Mon Mar 30 02:37:19.392788 2026] [:error] [pid 23250:tid 23264] [client 20.197.183.189:64758] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aclxX5xrpj-dQjy1cvo9DAAAAkw"]
[Mon Mar 30 02:37:20.039804 2026] [:error] [pid 23168:tid 23197] [client 20.197.183.189:64751] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aclxYGP8p0yRL8ot_28B0AAAAgA"]
[Mon Mar 30 02:37:20.656670 2026] [:error] [pid 8818:tid 8831] [client 20.197.183.189:64726] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aclxYCCDvotZNSF0FBoj-gAAAUk"]
[Mon Mar 30 02:37:21.279085 2026] [:error] [pid 23167:tid 23184] [client 20.197.183.189:65070] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aclxYRIAHJCFaHff3_cPrgAAAc4"]
[Mon Mar 30 02:37:21.904982 2026] [:error] [pid 23167:tid 23188] [client 20.197.183.189:64734] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2ksm17n.php"] [unique_id "aclxYRIAHJCFaHff3_cPswAAAdI"]
[Mon Mar 30 02:37:22.542514 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:65033] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2ksm17n.php"] [unique_id "aclxYiE3TArOFrUtgWrzrgAAAJU"]
[Mon Mar 30 02:37:23.169157 2026] [:error] [pid 23167:tid 23176] [client 20.197.183.189:65030] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2ksm17n.php"] [unique_id "aclxYxIAHJCFaHff3_cPuAAAAcY"]
[Mon Mar 30 02:37:23.806737 2026] [:error] [pid 32257:tid 32328] [client 20.197.183.189:63867] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2ksm17n.php"] [unique_id "aclxYyE3TArOFrUtgWrzsAAAAIo"]
[Mon Mar 30 02:37:24.430422 2026] [:error] [pid 23250:tid 23272] [client 20.197.183.189:65088] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aclxZJxrpj-dQjy1cvo9EwAAAlQ"]
[Mon Mar 30 02:37:25.054085 2026] [:error] [pid 23168:tid 23219] [client 20.197.183.189:63818] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aclxZWP8p0yRL8ot_28B3AAAAhY"]
[Mon Mar 30 02:37:25.686523 2026] [:error] [pid 32255:tid 32306] [client 20.197.183.189:65094] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aclxZWnfn-AtRoMbquxzEwAAAE8"]
[Mon Mar 30 02:37:26.310821 2026] [:error] [pid 32257:tid 32327] [client 20.197.183.189:65065] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aclxZiE3TArOFrUtgWrztgAAAIk"]
[Mon Mar 30 02:37:26.947401 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:63853] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "aclxZiE3TArOFrUtgWrzuwAAAJU"]
[Mon Mar 30 02:37:27.578333 2026] [:error] [pid 32257:tid 32332] [client 20.197.183.189:64090] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "aclxZyE3TArOFrUtgWrzwgAAAI4"]
[Mon Mar 30 02:37:28.220371 2026] [:error] [pid 23137:tid 23161] [client 20.197.183.189:64707] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "aclxaBaWQa7LdZ_qGFYtfgAAAZY"]
[Mon Mar 30 02:37:28.856598 2026] [:error] [pid 23167:tid 23173] [client 20.197.183.189:65060] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hots.php"] [unique_id "aclxaBIAHJCFaHff3_cPvAAAAcM"]
[Mon Mar 30 02:37:29.484450 2026] [:error] [pid 32255:tid 32304] [client 20.197.183.189:64721] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aclxaWnfn-AtRoMbquxzFwAAAE0"]
[Mon Mar 30 02:37:30.135341 2026] [:error] [pid 32255:tid 32311] [client 20.197.183.189:63868] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aclxamnfn-AtRoMbquxzGgAAAFQ"]
[Mon Mar 30 02:37:30.770790 2026] [:error] [pid 23168:tid 23198] [client 20.197.183.189:63849] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aclxamP8p0yRL8ot_28B7gAAAgE"]
[Mon Mar 30 02:37:31.392450 2026] [:error] [pid 32359:tid 32366] [client 20.197.183.189:64085] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aclxawMb8G3UzfQP3WhXfQAAAMU"]
[Mon Mar 30 02:37:32.029353 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:64656] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aclxbIzBujdPHsq7wyRicAAAApE"]
[Mon Mar 30 02:37:32.672065 2026] [:error] [pid 23167:tid 23190] [client 20.197.183.189:65112] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aclxbBIAHJCFaHff3_cPwgAAAdQ"]
[Mon Mar 30 02:37:33.306506 2026] [:error] [pid 32359:tid 32372] [client 20.197.183.189:64719] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aclxbQMb8G3UzfQP3WhXjQAAAMs"]
[Mon Mar 30 02:37:33.955331 2026] [:error] [pid 8818:tid 8842] [client 20.197.183.189:65063] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aclxbSCDvotZNSF0FBokEAAAAVQ"]
[Mon Mar 30 02:37:34.581491 2026] [:error] [pid 23284:tid 23286] [client 20.197.183.189:65125] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aclxbozBujdPHsq7wyRicgAAAoA"]
[Mon Mar 30 02:37:35.239515 2026] [:error] [pid 23250:tid 23255] [client 20.197.183.189:65139] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aclxb5xrpj-dQjy1cvo9GgAAAkM"]
[Mon Mar 30 02:37:35.881639 2026] [:error] [pid 23167:tid 23188] [client 20.197.183.189:65064] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aclxbxIAHJCFaHff3_cPzQAAAdI"]
[Mon Mar 30 02:37:36.510005 2026] [:error] [pid 23250:tid 23269] [client 20.197.183.189:64766] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aclxcJxrpj-dQjy1cvo9HAAAAlE"]
[Mon Mar 30 02:37:37.224940 2026] [:error] [pid 32255:tid 32305] [client 20.197.183.189:65035] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclxcWnfn-AtRoMbquxzKgAAAE4"]
[Mon Mar 30 02:37:37.923575 2026] [:error] [pid 23168:tid 23219] [client 20.197.183.189:64722] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclxcWP8p0yRL8ot_28CCwAAAhY"]
[Mon Mar 30 02:37:38.728722 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:65039] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclxcozBujdPHsq7wyRigQAAApE"]
[Mon Mar 30 02:37:39.375316 2026] [:error] [pid 23250:tid 23272] [client 20.197.183.189:63871] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclxc5xrpj-dQjy1cvo9HwAAAlQ"]
[Mon Mar 30 02:37:40.102888 2026] [:error] [pid 32255:tid 32301] [client 20.197.183.189:63842] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aclxdGnfn-AtRoMbquxzQgAAAEo"]
[Mon Mar 30 02:37:40.870315 2026] [:error] [pid 23284:tid 23295] [client 20.197.183.189:65027] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aclxdIzBujdPHsq7wyRiiwAAAok"]
[Mon Mar 30 02:37:41.669316 2026] [:error] [pid 23167:tid 23178] [client 20.197.183.189:64748] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aclxdRIAHJCFaHff3_cP1gAAAcg"]
[Mon Mar 30 02:37:42.459423 2026] [:error] [pid 32257:tid 32340] [client 20.197.183.189:64104] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aclxdiE3TArOFrUtgWrz6QAAAJY"]
[Mon Mar 30 02:37:43.118090 2026] [:error] [pid 32257:tid 32341] [client 20.197.183.189:63865] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aclxdyE3TArOFrUtgWrz8gAAAJc"]
[Mon Mar 30 02:37:43.815745 2026] [:error] [pid 8818:tid 8840] [client 20.197.183.189:64086] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aclxdyCDvotZNSF0FBokGAAAAVI"]
[Mon Mar 30 02:37:44.568581 2026] [:error] [pid 8818:tid 8830] [client 20.197.183.189:64018] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aclxeCCDvotZNSF0FBokGQAAAUg"]
[Mon Mar 30 02:37:45.294563 2026] [:error] [pid 23167:tid 23187] [client 20.197.183.189:65102] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aclxeRIAHJCFaHff3_cP4QAAAdE"]
[Mon Mar 30 02:37:46.160853 2026] [:error] [pid 23284:tid 23296] [client 20.197.183.189:65129] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aclxeozBujdPHsq7wyRilAAAAoo"]
[Mon Mar 30 02:37:46.786393 2026] [:error] [pid 23284:tid 23291] [client 20.197.183.189:65072] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aclxeozBujdPHsq7wyRilwAAAoU"]
[Mon Mar 30 02:37:47.447531 2026] [:error] [pid 32255:tid 32292] [client 20.197.183.189:65120] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aclxe2nfn-AtRoMbquxzSwAAAEE"]
[Mon Mar 30 02:37:48.086382 2026] [:error] [pid 23137:tid 23149] [client 20.197.183.189:65128] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "aclxfBaWQa7LdZ_qGFYtiQAAAYo"]
[Mon Mar 30 02:37:48.725817 2026] [:error] [pid 32257:tid 32336] [client 20.197.183.189:65140] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws83.php"] [unique_id "aclxfCE3TArOFrUtgWr0AwAAAJI"]
[Mon Mar 30 02:37:49.368362 2026] [:error] [pid 32257:tid 32319] [client 20.197.183.189:65042] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws83.php"] [unique_id "aclxfSE3TArOFrUtgWr0CgAAAIE"]
[Mon Mar 30 02:37:50.023308 2026] [:error] [pid 23167:tid 23184] [client 20.197.183.189:65084] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws83.php"] [unique_id "aclxfhIAHJCFaHff3_cP5gAAAc4"]
[Mon Mar 30 02:37:50.714963 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:63816] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws83.php"] [unique_id "aclxfiE3TArOFrUtgWr0EwAAAIQ"]
[Mon Mar 30 02:37:51.337309 2026] [:error] [pid 23250:tid 23266] [client 20.197.183.189:63835] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aclxf5xrpj-dQjy1cvo9KwAAAk4"]
[Mon Mar 30 02:37:52.007367 2026] [:error] [pid 23168:tid 23197] [client 20.197.183.189:64715] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aclxgGP8p0yRL8ot_28CLAAAAgA"]
[Mon Mar 30 02:37:52.669014 2026] [:error] [pid 23167:tid 23176] [client 20.197.183.189:65026] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aclxgBIAHJCFaHff3_cP6QAAAcY"]
[Mon Mar 30 02:37:53.299812 2026] [:error] [pid 23168:tid 23203] [client 20.197.183.189:65144] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "aclxgWP8p0yRL8ot_28CMAAAAgY"]
[Mon Mar 30 02:37:53.935286 2026] [:error] [pid 23250:tid 23268] [client 20.197.183.189:64671] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aclxgZxrpj-dQjy1cvo9LgAAAlA"]
[Mon Mar 30 02:37:54.584152 2026] [:error] [pid 32257:tid 32320] [client 20.197.183.189:64696] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aclxgiE3TArOFrUtgWr0JgAAAII"]
[Mon Mar 30 02:37:55.225622 2026] [:error] [pid 32257:tid 32337] [client 20.197.183.189:63859] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aclxgyE3TArOFrUtgWr0LAAAAJM"]
[Mon Mar 30 02:37:55.860393 2026] [:error] [pid 23250:tid 23267] [client 20.197.183.189:65078] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aclxg5xrpj-dQjy1cvo9MgAAAk8"]
[Mon Mar 30 02:37:56.503355 2026] [:error] [pid 32257:tid 32335] [client 20.197.183.189:65040] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aclxhCE3TArOFrUtgWr0NgAAAJE"]
[Mon Mar 30 02:37:57.127809 2026] [:error] [pid 32257:tid 32321] [client 20.197.183.189:64709] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aclxhSE3TArOFrUtgWr0OwAAAIM"]
[Mon Mar 30 02:37:57.753879 2026] [:error] [pid 23137:tid 23157] [client 20.197.183.189:63866] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aclxhRaWQa7LdZ_qGFYtjgAAAZI"]
[Mon Mar 30 02:37:58.383688 2026] [:error] [pid 23167:tid 23188] [client 20.197.183.189:64056] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/grsiuk.php"] [unique_id "aclxhhIAHJCFaHff3_cP8AAAAdI"]
[Mon Mar 30 02:37:59.001680 2026] [:error] [pid 23168:tid 23207] [client 20.197.183.189:64755] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aclxh2P8p0yRL8ot_28CNQAAAgo"]
[Mon Mar 30 02:37:59.620276 2026] [:error] [pid 23167:tid 23178] [client 20.197.183.189:64691] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aclxhxIAHJCFaHff3_cP8QAAAcg"]
[Mon Mar 30 02:38:00.247383 2026] [:error] [pid 23284:tid 23308] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Mon Mar 30 02:38:00.561307 2026] [:error] [pid 23284:tid 23291] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/bo.php
[Mon Mar 30 02:38:00.873194 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/5b9ac.php
[Mon Mar 30 02:38:01.185735 2026] [:error] [pid 23284:tid 23304] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Mon Mar 30 02:38:01.518162 2026] [:error] [pid 23284:tid 23300] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Mon Mar 30 02:38:01.829453 2026] [:error] [pid 23284:tid 23301] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Mon Mar 30 02:38:02.140971 2026] [:error] [pid 23284:tid 23290] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Mon Mar 30 02:38:02.452763 2026] [:error] [pid 23284:tid 23305] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Mon Mar 30 02:38:02.764271 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Mon Mar 30 02:38:03.075518 2026] [:error] [pid 23284:tid 23302] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Mon Mar 30 02:38:03.394273 2026] [:error] [pid 23284:tid 23286] [client 20.197.183.189:65126] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Mon Mar 30 02:38:03.702480 2026] [:error] [pid 23284:tid 23296] [client 20.197.183.189:65126] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aclxi4zBujdPHsq7wyRiswAAAoo"]
[Mon Mar 30 02:38:04.333409 2026] [:error] [pid 23137:tid 23150] [client 20.197.183.189:63826] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aclxjBaWQa7LdZ_qGFYtkAAAAYs"]
[Mon Mar 30 02:38:05.045101 2026] [:error] [pid 23284:tid 23290] [client 20.197.183.189:64082] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aclxjYzBujdPHsq7wyRivQAAAoQ"]
[Mon Mar 30 02:38:05.678162 2026] [:error] [pid 32257:tid 32319] [client 20.197.183.189:63870] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aclxjSE3TArOFrUtgWr0ZAAAAIE"]
[Mon Mar 30 02:38:06.310162 2026] [:error] [pid 23284:tid 23291] [client 20.197.183.189:65080] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aclxjozBujdPHsq7wyRiwwAAAoU"]
[Mon Mar 30 02:38:06.931827 2026] [:error] [pid 32255:tid 32292] [client 20.197.183.189:64697] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aclxjmnfn-AtRoMbquxzZwAAAEE"]
[Mon Mar 30 02:38:07.594764 2026] [:error] [pid 32255:tid 32301] [client 20.197.183.189:65141] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aclxj2nfn-AtRoMbquxzbQAAAEo"]
[Mon Mar 30 02:38:08.249713 2026] [:error] [pid 23167:tid 23190] [client 20.197.183.189:64685] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "aclxkBIAHJCFaHff3_cP9wAAAdQ"]
[Mon Mar 30 02:38:08.881747 2026] [:error] [pid 32254:tid 32269] [client 20.197.183.189:64084] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aclxkKug2IHuyGgCTn9-AgAAAAU"]
[Mon Mar 30 02:38:09.554014 2026] [:error] [pid 23168:tid 23202] [client 20.197.183.189:65034] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aclxkWP8p0yRL8ot_28CPQAAAgU"]
[Mon Mar 30 02:38:10.189724 2026] [:error] [pid 32255:tid 32306] [client 20.197.183.189:65108] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aclxkmnfn-AtRoMbquxzegAAAE8"]
[Mon Mar 30 02:38:10.831418 2026] [:error] [pid 32255:tid 32312] [client 20.197.183.189:64118] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aclxkmnfn-AtRoMbquxzfAAAAFU"]
[Mon Mar 30 02:38:11.453840 2026] [:error] [pid 23168:tid 23219] [client 20.197.183.189:64729] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aclxk2P8p0yRL8ot_28CPgAAAhY"]
[Mon Mar 30 02:38:12.109081 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:64030] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aclxlIzBujdPHsq7wyRiywAAAoY"]
[Mon Mar 30 02:38:12.742844 2026] [:error] [pid 23284:tid 23288] [client 20.197.183.189:65148] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aclxlIzBujdPHsq7wyRi0QAAAoI"]
[Mon Mar 30 02:38:13.390202 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:65057] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aclxlSE3TArOFrUtgWr0bgAAAJU"]
[Mon Mar 30 02:38:14.079464 2026] [:error] [pid 32255:tid 32298] [client 20.197.183.189:64713] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "aclxlmnfn-AtRoMbquxzhAAAAEc"]
[Mon Mar 30 02:38:14.724360 2026] [:error] [pid 23250:tid 23269] [client 20.197.183.189:64682] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "aclxlpxrpj-dQjy1cvo9OwAAAlE"]
[Mon Mar 30 02:38:15.369378 2026] [:error] [pid 23284:tid 23304] [client 20.197.183.189:64660] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "aclxl4zBujdPHsq7wyRi1wAAApI"]
[Mon Mar 30 02:38:16.000728 2026] [:error] [pid 23284:tid 23305] [client 20.197.183.189:64690] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "aclxl4zBujdPHsq7wyRi2wAAApM"]
[Mon Mar 30 02:38:16.637688 2026] [:error] [pid 23284:tid 23302] [client 20.197.183.189:63814] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfd.php"] [unique_id "aclxmIzBujdPHsq7wyRi3wAAApA"]
[Mon Mar 30 02:38:17.277883 2026] [:error] [pid 23284:tid 23305] [client 20.197.183.189:64749] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfd.php"] [unique_id "aclxmYzBujdPHsq7wyRi5wAAApM"]
[Mon Mar 30 02:38:17.903447 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:63855] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfd.php"] [unique_id "aclxmSE3TArOFrUtgWr0dQAAAIQ"]
[Mon Mar 30 02:38:18.572590 2026] [:error] [pid 23284:tid 23310] [client 20.197.183.189:65044] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gfd.php"] [unique_id "aclxmozBujdPHsq7wyRi6wAAApg"]
[Mon Mar 30 02:38:19.192402 2026] [:error] [pid 8818:tid 8826] [client 20.197.183.189:64711] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aclxmyCDvotZNSF0FBokIQAAAUQ"]
[Mon Mar 30 02:38:19.825883 2026] [:error] [pid 32255:tid 32303] [client 20.197.183.189:64717] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aclxm2nfn-AtRoMbquxzigAAAEw"]
[Mon Mar 30 02:38:20.447844 2026] [:error] [pid 23284:tid 23293] [client 20.197.183.189:64677] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aclxnIzBujdPHsq7wyRi8QAAAoc"]
[Mon Mar 30 02:38:21.075372 2026] [:error] [pid 23168:tid 23212] [client 20.197.183.189:64124] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aclxnWP8p0yRL8ot_28CRgAAAg8"]
[Mon Mar 30 02:38:21.697166 2026] [:error] [pid 32257:tid 32328] [client 20.197.183.189:63828] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amp.php"] [unique_id "aclxnSE3TArOFrUtgWr0gwAAAIo"]
[Mon Mar 30 02:38:22.317295 2026] [:error] [pid 32257:tid 32318] [client 20.197.183.189:64714] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amp.php"] [unique_id "aclxniE3TArOFrUtgWr0iAAAAIA"]
[Mon Mar 30 02:38:22.937908 2026] [:error] [pid 8818:tid 8837] [client 20.197.183.189:65043] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amp.php"] [unique_id "aclxniCDvotZNSF0FBokKAAAAU8"]
[Mon Mar 30 02:38:23.556748 2026] [:error] [pid 32359:tid 32383] [client 20.197.183.189:63820] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amp.php"] [unique_id "aclxnwMb8G3UzfQP3WhXrAAAANY"]
[Mon Mar 30 02:38:24.186898 2026] [:error] [pid 23168:tid 23199] [client 20.197.183.189:64654] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aclxoGP8p0yRL8ot_28CRwAAAgI"]
[Mon Mar 30 02:38:24.808805 2026] [:error] [pid 23168:tid 23200] [client 20.197.183.189:65091] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aclxoGP8p0yRL8ot_28CSQAAAgM"]
[Mon Mar 30 02:38:25.429809 2026] [:error] [pid 23168:tid 23209] [client 20.197.183.189:64738] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aclxoWP8p0yRL8ot_28CSgAAAgw"]
[Mon Mar 30 02:38:26.046294 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:64070] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws75.php"] [unique_id "aclxoozBujdPHsq7wyRi_QAAApE"]
[Mon Mar 30 02:38:26.672693 2026] [:error] [pid 23284:tid 23304] [client 20.197.183.189:65122] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aclxoozBujdPHsq7wyRjAAAAApI"]
[Mon Mar 30 02:38:27.322375 2026] [:error] [pid 23284:tid 23294] [client 20.197.183.189:64105] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aclxo4zBujdPHsq7wyRjAwAAAog"]
[Mon Mar 30 02:38:27.956778 2026] [:error] [pid 32255:tid 32303] [client 20.197.183.189:64695] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aclxo2nfn-AtRoMbquxzkwAAAEw"]
[Mon Mar 30 02:38:28.600768 2026] [:error] [pid 8818:tid 8823] [client 20.197.183.189:64745] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "aclxpCCDvotZNSF0FBokLQAAAUE"]
[Mon Mar 30 02:38:29.239472 2026] [:error] [pid 23284:tid 23295] [client 20.197.183.189:65109] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "aclxpYzBujdPHsq7wyRjBgAAAok"]
[Mon Mar 30 02:38:29.868423 2026] [:error] [pid 32359:tid 32377] [client 20.197.183.189:64126] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "aclxpQMb8G3UzfQP3WhXrwAAANA"]
[Mon Mar 30 02:38:30.496820 2026] [:error] [pid 23284:tid 23302] [client 20.197.183.189:65095] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "aclxpozBujdPHsq7wyRjCgAAApA"]
[Mon Mar 30 02:38:31.120080 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:65150] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "aclxpyE3TArOFrUtgWr0kwAAAJU"]
[Mon Mar 30 02:38:31.744175 2026] [:error] [pid 32255:tid 32308] [client 20.197.183.189:63812] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lowpr.php"] [unique_id "aclxp2nfn-AtRoMbquxzlAAAAFE"]
[Mon Mar 30 02:38:32.393202 2026] [:error] [pid 32254:tid 32272] [client 20.197.183.189:64764] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lowpr.php"] [unique_id "aclxqKug2IHuyGgCTn9-EwAAAAg"]
[Mon Mar 30 02:38:33.026570 2026] [:error] [pid 32254:tid 32268] [client 20.197.183.189:64765] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lowpr.php"] [unique_id "aclxqaug2IHuyGgCTn9-FAAAAAQ"]
[Mon Mar 30 02:38:33.693047 2026] [:error] [pid 23137:tid 23152] [client 20.197.183.189:65106] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lowpr.php"] [unique_id "aclxqRaWQa7LdZ_qGFYtmgAAAY0"]
[Mon Mar 30 02:38:34.405759 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:61896] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aclxqiE3TArOFrUtgWr0lAAAAIQ"]
[Mon Mar 30 02:38:35.106306 2026] [:error] [pid 23284:tid 23300] [client 20.197.183.189:64087] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aclxq4zBujdPHsq7wyRjDgAAAo4"]
[Mon Mar 30 02:38:35.806540 2026] [:error] [pid 32255:tid 32304] [client 20.197.183.189:64733] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aclxq2nfn-AtRoMbquxzlgAAAE0"]
[Mon Mar 30 02:38:36.874111 2026] [:error] [pid 23168:tid 23220] [client 20.197.183.189:64742] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "aclxrGP8p0yRL8ot_28CUQAAAhc"]
[Mon Mar 30 02:38:37.685703 2026] [:error] [pid 23167:tid 23176] [client 20.197.183.189:65117] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aclxrRIAHJCFaHff3_cQBAAAAcY"]
[Mon Mar 30 02:38:38.647524 2026] [:error] [pid 23284:tid 23291] [client 20.197.183.189:63819] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aclxrozBujdPHsq7wyRjDwAAAoU"]
[Mon Mar 30 02:38:39.690251 2026] [:error] [pid 32257:tid 32326] [client 20.197.183.189:65047] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aclxryE3TArOFrUtgWr0pQAAAIg"]
[Mon Mar 30 02:38:41.979756 2026] [:error] [pid 23167:tid 23171] [client 20.197.183.189:65090] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aclxsRIAHJCFaHff3_cQBwAAAcE"]
[Mon Mar 30 02:38:43.209303 2026] [:error] [pid 32257:tid 32332] [client 20.197.183.189:65093] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aclxsyE3TArOFrUtgWr0rgAAAI4"]
[Mon Mar 30 02:38:44.427945 2026] [:error] [pid 32257:tid 32334] [client 20.197.183.189:64744] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aclxtCE3TArOFrUtgWr0rwAAAJA"]
[Mon Mar 30 02:38:45.138174 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:63847] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aclxtSE3TArOFrUtgWr0swAAAJU"]
[Mon Mar 30 02:38:45.801116 2026] [:error] [pid 23168:tid 23219] [client 20.197.183.189:63848] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/domains.php"] [unique_id "aclxtWP8p0yRL8ot_28CVgAAAhY"]
[Mon Mar 30 02:38:46.493045 2026] [:error] [pid 23168:tid 23214] [client 20.197.183.189:64106] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aclxtmP8p0yRL8ot_28CWQAAAhE"]
[Mon Mar 30 02:38:47.156575 2026] [:error] [pid 23284:tid 23294] [client 20.197.183.189:64720] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aclxt4zBujdPHsq7wyRjFwAAAog"]
[Mon Mar 30 02:38:47.814043 2026] [:error] [pid 23250:tid 23268] [client 20.197.183.189:61888] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aclxt5xrpj-dQjy1cvo9SAAAAlA"]
[Mon Mar 30 02:38:48.487585 2026] [:error] [pid 23168:tid 23197] [client 20.197.183.189:63850] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aclxuGP8p0yRL8ot_28CZAAAAgA"]
[Mon Mar 30 02:38:49.192948 2026] [:error] [pid 32255:tid 32303] [client 20.197.183.189:64653] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aclxuWnfn-AtRoMbquxznwAAAEw"]
[Mon Mar 30 02:38:49.852348 2026] [:error] [pid 8818:tid 8841] [client 20.197.183.189:63825] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aclxuSCDvotZNSF0FBokQAAAAVM"]
[Mon Mar 30 02:38:50.542527 2026] [:error] [pid 23250:tid 23267] [client 20.197.183.189:64659] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aclxupxrpj-dQjy1cvo9TQAAAk8"]
[Mon Mar 30 02:38:51.170728 2026] [:error] [pid 23168:tid 23208] [client 20.197.183.189:65149] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aclxu2P8p0yRL8ot_28CawAAAgs"]
[Mon Mar 30 02:38:51.801395 2026] [:error] [pid 23284:tid 23305] [client 20.197.183.189:64102] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aclxu4zBujdPHsq7wyRjGAAAApM"]
[Mon Mar 30 02:38:52.460444 2026] [:error] [pid 8818:tid 8837] [client 20.197.183.189:65124] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aclxvCCDvotZNSF0FBokRwAAAU8"]
[Mon Mar 30 02:38:53.098574 2026] [:error] [pid 32255:tid 32313] [client 20.197.183.189:63824] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aclxvWnfn-AtRoMbquxzpQAAAFY"]
[Mon Mar 30 02:38:53.730770 2026] [:error] [pid 23167:tid 23188] [client 20.197.183.189:65071] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "aclxvRIAHJCFaHff3_cQEAAAAdI"]
[Mon Mar 30 02:38:54.351967 2026] [:error] [pid 32254:tid 32282] [client 20.197.183.189:65031] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aclxvqug2IHuyGgCTn9-HQAAABI"]
[Mon Mar 30 02:38:54.986739 2026] [:error] [pid 32254:tid 32276] [client 20.197.183.189:65079] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aclxvqug2IHuyGgCTn9-IAAAAAw"]
[Mon Mar 30 02:38:55.610346 2026] [:error] [pid 23250:tid 23271] [client 20.197.183.189:65024] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aclxv5xrpj-dQjy1cvo9TwAAAlM"]
[Mon Mar 30 02:38:56.238709 2026] [:error] [pid 32255:tid 32309] [client 20.197.183.189:63836] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aclxwGnfn-AtRoMbquxzpwAAAFI"]
[Mon Mar 30 02:38:56.870075 2026] [:error] [pid 8818:tid 8832] [client 20.197.183.189:65058] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ne2026.php"] [unique_id "aclxwCCDvotZNSF0FBokTQAAAUo"]
[Mon Mar 30 02:38:57.491894 2026] [:error] [pid 8818:tid 8835] [client 20.197.183.189:64117] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ne2026.php"] [unique_id "aclxwSCDvotZNSF0FBokTgAAAU0"]
[Mon Mar 30 02:38:58.111223 2026] [:error] [pid 23168:tid 23210] [client 20.197.183.189:64673] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ne2026.php"] [unique_id "aclxwmP8p0yRL8ot_28CeAAAAg0"]
[Mon Mar 30 02:38:58.751434 2026] [:error] [pid 32359:tid 32376] [client 20.197.183.189:64716] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ne2026.php"] [unique_id "aclxwgMb8G3UzfQP3WhXtwAAAM8"]
[Mon Mar 30 02:38:59.397011 2026] [:error] [pid 32359:tid 32363] [client 20.197.183.189:64045] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws73.php"] [unique_id "aclxwwMb8G3UzfQP3WhXuAAAAMI"]
[Mon Mar 30 02:39:00.018067 2026] [:error] [pid 32257:tid 32331] [client 20.197.183.189:64110] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws73.php"] [unique_id "aclxxCE3TArOFrUtgWr0vwAAAI0"]
[Mon Mar 30 02:39:00.639531 2026] [:error] [pid 23168:tid 23217] [client 20.197.183.189:63841] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws73.php"] [unique_id "aclxxGP8p0yRL8ot_28CfgAAAhQ"]
[Mon Mar 30 02:39:01.263392 2026] [:error] [pid 23168:tid 23221] [client 20.197.183.189:61826] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws73.php"] [unique_id "aclxxWP8p0yRL8ot_28CggAAAhg"]
[Mon Mar 30 02:39:01.885989 2026] [:error] [pid 32254:tid 32273] [client 20.197.183.189:63839] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aclxxaug2IHuyGgCTn9-KgAAAAk"]
[Mon Mar 30 02:39:02.519636 2026] [:error] [pid 32359:tid 32366] [client 20.197.183.189:64664] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aclxxgMb8G3UzfQP3WhXuQAAAMU"]
[Mon Mar 30 02:39:03.139414 2026] [:error] [pid 23167:tid 23189] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Mon Mar 30 02:39:03.454609 2026] [:error] [pid 23167:tid 23192] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/baixy.php
[Mon Mar 30 02:39:03.765744 2026] [:error] [pid 23167:tid 23170] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Mon Mar 30 02:39:04.078694 2026] [:error] [pid 23167:tid 23191] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Mon Mar 30 02:39:05.657298 2026] [:error] [pid 23167:tid 23191] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/ws77.php
[Mon Mar 30 02:39:05.969678 2026] [:error] [pid 23167:tid 23181] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Mon Mar 30 02:39:06.281711 2026] [:error] [pid 23167:tid 23183] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/a5e0a.php
[Mon Mar 30 02:39:06.593154 2026] [:error] [pid 23167:tid 23175] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Mon Mar 30 02:39:06.904728 2026] [:error] [pid 23167:tid 23171] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Mon Mar 30 02:39:07.216327 2026] [:error] [pid 23167:tid 23193] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/55b76.php
[Mon Mar 30 02:39:07.527999 2026] [:error] [pid 23167:tid 23173] [client 20.197.183.189:63869] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Mon Mar 30 02:39:07.836135 2026] [:error] [pid 23167:tid 23192] [client 20.197.183.189:63869] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aclxyxIAHJCFaHff3_cQKQAAAdY"]
[Mon Mar 30 02:39:08.471086 2026] [:error] [pid 23168:tid 23205] [client 20.197.183.189:63808] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aclxzGP8p0yRL8ot_28CjgAAAgg"]
[Mon Mar 30 02:39:09.093290 2026] [:error] [pid 23167:tid 23178] [client 20.197.183.189:65037] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aclxzRIAHJCFaHff3_cQKwAAAcg"]
[Mon Mar 30 02:39:09.718890 2026] [:error] [pid 23137:tid 23157] [client 20.197.183.189:63857] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aclxzRaWQa7LdZ_qGFYtsQAAAZI"]
[Mon Mar 30 02:39:10.346910 2026] [:error] [pid 32257:tid 32318] [client 20.197.183.189:64036] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aclxziE3TArOFrUtgWr0zAAAAIA"]
[Mon Mar 30 02:39:10.968444 2026] [:error] [pid 23137:tid 23145] [client 20.197.183.189:64683] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aclxzhaWQa7LdZ_qGFYttAAAAYY"]
[Mon Mar 30 02:39:11.601961 2026] [:error] [pid 32359:tid 32381] [client 20.197.183.189:64688] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aclxzwMb8G3UzfQP3WhXvwAAANQ"]
[Mon Mar 30 02:39:12.221778 2026] [:error] [pid 8818:tid 8834] [client 20.197.183.189:61945] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aclx0CCDvotZNSF0FBokVQAAAUw"]
[Mon Mar 30 02:39:12.842517 2026] [:error] [pid 32359:tid 32372] [client 20.197.183.189:64674] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aclx0AMb8G3UzfQP3WhXwAAAAMs"]
[Mon Mar 30 02:39:13.490997 2026] [:error] [pid 23167:tid 23183] [client 20.197.183.189:64675] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aclx0RIAHJCFaHff3_cQLwAAAc0"]
[Mon Mar 30 02:39:14.127961 2026] [:error] [pid 32255:tid 32294] [client 20.197.183.189:61935] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aclx0mnfn-AtRoMbquxztgAAAEM"]
[Mon Mar 30 02:39:14.753857 2026] [:error] [pid 32257:tid 32341] [client 20.197.183.189:64693] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aclx0iE3TArOFrUtgWr01AAAAJc"]
[Mon Mar 30 02:39:15.373784 2026] [:error] [pid 32257:tid 32330] [client 20.197.183.189:64767] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "aclx0yE3TArOFrUtgWr01QAAAIw"]
[Mon Mar 30 02:39:16.011580 2026] [:error] [pid 23284:tid 23304] [client 20.197.183.189:64032] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "aclx1IzBujdPHsq7wyRjNQAAApI"]
[Mon Mar 30 02:39:16.642123 2026] [:error] [pid 23137:tid 23140] [client 20.197.183.189:64710] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "aclx1BaWQa7LdZ_qGFYtuwAAAYE"]
[Mon Mar 30 02:39:17.285988 2026] [:error] [pid 32254:tid 32282] [client 20.197.183.189:64667] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "aclx1aug2IHuyGgCTn9-NAAAABI"]
[Mon Mar 30 02:39:17.916775 2026] [:error] [pid 23168:tid 23208] [client 20.197.183.189:64031] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/file.php"] [unique_id "aclx1WP8p0yRL8ot_28ClAAAAgs"]
[Mon Mar 30 02:39:18.538432 2026] [:error] [pid 32254:tid 32270] [client 20.197.183.189:65097] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/file.php"] [unique_id "aclx1qug2IHuyGgCTn9-NwAAAAY"]
[Mon Mar 30 02:39:19.170123 2026] [:error] [pid 32255:tid 32302] [client 20.197.183.189:65131] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/file.php"] [unique_id "aclx12nfn-AtRoMbquxzuQAAAEs"]
[Mon Mar 30 02:39:19.806302 2026] [:error] [pid 23284:tid 23305] [client 20.197.183.189:65049] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/file.php"] [unique_id "aclx14zBujdPHsq7wyRjOQAAApM"]
[Mon Mar 30 02:39:20.422588 2026] [:error] [pid 23284:tid 23300] [client 20.197.183.189:64077] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "aclx2IzBujdPHsq7wyRjPAAAAo4"]
[Mon Mar 30 02:39:21.042747 2026] [:error] [pid 23284:tid 23287] [client 20.197.183.189:65151] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "aclx2YzBujdPHsq7wyRjQAAAAoE"]
[Mon Mar 30 02:39:21.670681 2026] [:error] [pid 23137:tid 23157] [client 20.197.183.189:65133] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "aclx2RaWQa7LdZ_qGFYtxwAAAZI"]
[Mon Mar 30 02:39:22.291287 2026] [:error] [pid 32255:tid 32312] [client 20.197.183.189:65061] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxw.php"] [unique_id "aclx2mnfn-AtRoMbquxzugAAAFU"]
[Mon Mar 30 02:39:22.911114 2026] [:error] [pid 23284:tid 23302] [client 20.197.183.189:64028] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aclx2ozBujdPHsq7wyRjRQAAApA"]
[Mon Mar 30 02:39:23.541318 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:65077] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aclx2yE3TArOFrUtgWr04QAAAJU"]
[Mon Mar 30 02:39:24.214746 2026] [:error] [pid 23284:tid 23295] [client 20.197.183.189:63854] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aclx3IzBujdPHsq7wyRjTAAAAok"]
[Mon Mar 30 02:39:24.862610 2026] [:error] [pid 23284:tid 23286] [client 20.197.183.189:64665] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aclx3IzBujdPHsq7wyRjTwAAAoA"]
[Mon Mar 30 02:39:25.482353 2026] [:error] [pid 23137:tid 23145] [client 20.197.183.189:64741] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aclx3RaWQa7LdZ_qGFYtygAAAYY"]
[Mon Mar 30 02:39:26.107676 2026] [:error] [pid 23284:tid 23309] [client 20.197.183.189:65092] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aclx3ozBujdPHsq7wyRjUwAAApc"]
[Mon Mar 30 02:39:26.727314 2026] [:error] [pid 32257:tid 32333] [client 20.197.183.189:63810] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aclx3iE3TArOFrUtgWr05wAAAI8"]
[Mon Mar 30 02:39:27.359122 2026] [:error] [pid 8818:tid 8843] [client 20.197.183.189:64705] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aclx3yCDvotZNSF0FBokcAAAAVU"]
[Mon Mar 30 02:39:27.975991 2026] [:error] [pid 32257:tid 32332] [client 20.197.183.189:65082] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aclx3yE3TArOFrUtgWr06QAAAI4"]
[Mon Mar 30 02:39:28.666276 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:65138] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aclx4IzBujdPHsq7wyRjVAAAAoY"]
[Mon Mar 30 02:39:29.313428 2026] [:error] [pid 23250:tid 23253] [client 20.197.183.189:64123] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aclx4Zxrpj-dQjy1cvo9VgAAAkE"]
[Mon Mar 30 02:39:29.979940 2026] [:error] [pid 23284:tid 23286] [client 20.197.183.189:63838] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "aclx4YzBujdPHsq7wyRjVQAAAoA"]
[Mon Mar 30 02:39:30.646803 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:65059] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aclx4iE3TArOFrUtgWr07QAAAIQ"]
[Mon Mar 30 02:39:31.275574 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:61833] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aclx44zBujdPHsq7wyRjVgAAApE"]
[Mon Mar 30 02:39:31.914706 2026] [:error] [pid 23137:tid 23158] [client 20.197.183.189:64065] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aclx4xaWQa7LdZ_qGFYt0QAAAZM"]
[Mon Mar 30 02:39:32.543759 2026] [:error] [pid 23168:tid 23197] [client 20.197.183.189:64002] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/green.php"] [unique_id "aclx5GP8p0yRL8ot_28CmwAAAgA"]
[Mon Mar 30 02:39:33.183436 2026] [:error] [pid 23137:tid 23141] [client 20.197.183.189:65086] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aclx5RaWQa7LdZ_qGFYt1QAAAYI"]
[Mon Mar 30 02:39:33.848177 2026] [:error] [pid 32257:tid 32321] [client 20.197.183.189:65083] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aclx5SE3TArOFrUtgWr09wAAAIM"]
[Mon Mar 30 02:39:34.501851 2026] [:error] [pid 23168:tid 23218] [client 20.197.183.189:63809] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aclx5mP8p0yRL8ot_28CnwAAAhU"]
[Mon Mar 30 02:39:35.161093 2026] [:error] [pid 32254:tid 32287] [client 20.197.183.189:64111] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aclx56ug2IHuyGgCTn9-PAAAABc"]
[Mon Mar 30 02:39:35.796644 2026] [:error] [pid 23137:tid 23157] [client 20.197.183.189:61900] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aclx5xaWQa7LdZ_qGFYt2QAAAZI"]
[Mon Mar 30 02:39:36.432466 2026] [:error] [pid 8818:tid 8830] [client 20.197.183.189:64052] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aclx6CCDvotZNSF0FBokgwAAAUg"]
[Mon Mar 30 02:39:37.062476 2026] [:error] [pid 32359:tid 32363] [client 20.197.183.189:65028] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aclx6QMb8G3UzfQP3WhXzwAAAMI"]
[Mon Mar 30 02:39:37.704460 2026] [:error] [pid 23137:tid 23150] [client 20.197.183.189:61857] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aclx6RaWQa7LdZ_qGFYt3QAAAYs"]
[Mon Mar 30 02:39:38.335166 2026] [:error] [pid 32257:tid 32327] [client 20.197.183.189:64080] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aclx6iE3TArOFrUtgWr0-wAAAIk"]
[Mon Mar 30 02:39:38.954945 2026] [:error] [pid 23168:tid 23213] [client 20.197.183.189:64678] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aclx6mP8p0yRL8ot_28CogAAAhA"]
[Mon Mar 30 02:39:39.578654 2026] [:error] [pid 32257:tid 32334] [client 20.197.183.189:64068] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aclx6yE3TArOFrUtgWr0_QAAAJA"]
[Mon Mar 30 02:39:40.232406 2026] [:error] [pid 32257:tid 32337] [client 20.197.183.189:65089] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aclx7CE3TArOFrUtgWr1AQAAAJM"]
[Mon Mar 30 02:39:40.862846 2026] [:error] [pid 32257:tid 32335] [client 20.197.183.189:64099] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aclx7CE3TArOFrUtgWr1BQAAAJE"]
[Mon Mar 30 02:39:41.478786 2026] [:error] [pid 8818:tid 8838] [client 20.197.183.189:64073] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aclx7SCDvotZNSF0FBokkgAAAVA"]
[Mon Mar 30 02:39:42.107543 2026] [:error] [pid 8818:tid 8839] [client 20.197.183.189:64093] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aclx7iCDvotZNSF0FBokkwAAAVE"]
[Mon Mar 30 02:39:42.731879 2026] [:error] [pid 23137:tid 23157] [client 20.197.183.189:65110] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aclx7haWQa7LdZ_qGFYt4wAAAZI"]
[Mon Mar 30 02:39:43.388201 2026] [:error] [pid 32257:tid 32325] [client 20.197.183.189:64119] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aclx7yE3TArOFrUtgWr1DAAAAIc"]
[Mon Mar 30 02:39:44.007018 2026] [:error] [pid 8818:tid 8832] [client 20.197.183.189:64079] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aclx8CCDvotZNSF0FBoklwAAAUo"]
[Mon Mar 30 02:39:44.631091 2026] [:error] [pid 32257:tid 32335] [client 20.197.183.189:65068] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aclx8CE3TArOFrUtgWr1EQAAAJE"]
[Mon Mar 30 02:39:45.251678 2026] [:error] [pid 23284:tid 23299] [client 20.197.183.189:65118] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "aclx8YzBujdPHsq7wyRjYAAAAo0"]
[Mon Mar 30 02:39:45.886286 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:64739] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "aclx8SE3TArOFrUtgWr1GwAAAJU"]
[Mon Mar 30 02:39:46.540577 2026] [:error] [pid 23284:tid 23287] [client 20.197.183.189:64701] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "aclx8ozBujdPHsq7wyRjYwAAAoE"]
[Mon Mar 30 02:39:47.162965 2026] [:error] [pid 23284:tid 23302] [client 20.197.183.189:64013] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "aclx84zBujdPHsq7wyRjaAAAApA"]
[Mon Mar 30 02:39:47.788939 2026] [:error] [pid 23284:tid 23294] [client 20.197.183.189:64662] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "aclx84zBujdPHsq7wyRjbwAAAog"]
[Mon Mar 30 02:39:48.406290 2026] [:error] [pid 23284:tid 23297] [client 20.197.183.189:63868] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aclx9IzBujdPHsq7wyRjdwAAAos"]
[Mon Mar 30 02:39:49.047719 2026] [:error] [pid 23168:tid 23216] [client 20.197.183.189:64001] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aclx9WP8p0yRL8ot_28CrAAAAhM"]
[Mon Mar 30 02:39:49.728513 2026] [:error] [pid 23167:tid 23190] [client 20.197.183.189:64672] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aclx9RIAHJCFaHff3_cQRQAAAdQ"]
[Mon Mar 30 02:39:50.365351 2026] [:error] [pid 32257:tid 32321] [client 20.197.183.189:65032] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aclx9iE3TArOFrUtgWr1JgAAAIM"]
[Mon Mar 30 02:39:50.982477 2026] [:error] [pid 32257:tid 32331] [client 20.197.183.189:65127] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aclx9iE3TArOFrUtgWr1KwAAAI0"]
[Mon Mar 30 02:39:51.602769 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:65085] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aclx9yE3TArOFrUtgWr1MAAAAIQ"]
[Mon Mar 30 02:39:52.228510 2026] [:error] [pid 32257:tid 32335] [client 20.197.183.189:64703] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aclx-CE3TArOFrUtgWr1NQAAAJE"]
[Mon Mar 30 02:39:52.907141 2026] [:error] [pid 23284:tid 23290] [client 20.197.183.189:64743] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aclx-IzBujdPHsq7wyRjkwAAAoQ"]
[Mon Mar 30 02:39:53.559145 2026] [:error] [pid 32255:tid 32311] [client 20.197.183.189:65046] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aclx-Wnfn-AtRoMbquxzyQAAAFQ"]
[Mon Mar 30 02:39:54.211110 2026] [:error] [pid 32255:tid 32292] [client 20.197.183.189:64747] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aclx-mnfn-AtRoMbquxzzQAAAEE"]
[Mon Mar 30 02:39:54.836968 2026] [:error] [pid 23250:tid 23266] [client 20.197.183.189:65029] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aclx-pxrpj-dQjy1cvo9YQAAAk4"]
[Mon Mar 30 02:39:55.462771 2026] [:error] [pid 23250:tid 23260] [client 20.197.183.189:64699] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/init.php"] [unique_id "aclx-5xrpj-dQjy1cvo9YgAAAkg"]
[Mon Mar 30 02:39:56.119556 2026] [:error] [pid 23284:tid 23310] [client 20.197.183.189:61832] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "aclx_IzBujdPHsq7wyRjrgAAApg"]
[Mon Mar 30 02:39:56.742812 2026] [:error] [pid 23284:tid 23296] [client 20.197.183.189:61915] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "aclx_IzBujdPHsq7wyRjtgAAAoo"]
[Mon Mar 30 02:39:57.365972 2026] [:error] [pid 23250:tid 23262] [client 20.197.183.189:64760] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "aclx_Zxrpj-dQjy1cvo9ZwAAAko"]
[Mon Mar 30 02:39:57.989031 2026] [:error] [pid 32257:tid 32319] [client 20.197.183.189:64089] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "aclx_SE3TArOFrUtgWr1PgAAAIE"]
[Mon Mar 30 02:39:58.608076 2026] [:error] [pid 23168:tid 23213] [client 20.197.183.189:64737] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "aclx_mP8p0yRL8ot_28CtAAAAhA"]
[Mon Mar 30 02:39:59.237414 2026] [:error] [pid 32257:tid 32342] [client 20.197.183.189:61925] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "aclx_yE3TArOFrUtgWr1QgAAAJg"]
[Mon Mar 30 02:39:59.857061 2026] [:error] [pid 32359:tid 32368] [client 20.197.183.189:64718] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "aclx_wMb8G3UzfQP3WhX3wAAAMc"]
[Mon Mar 30 02:40:00.479684 2026] [:error] [pid 32359:tid 32369] [client 20.197.183.189:64092] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "aclyAAMb8G3UzfQP3WhX4QAAAMg"]
[Mon Mar 30 02:40:01.110667 2026] [:error] [pid 23284:tid 23297] [client 20.197.183.189:64114] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aclyAYzBujdPHsq7wyRj3wAAAos"]
[Mon Mar 30 02:40:01.728515 2026] [:error] [pid 32255:tid 32306] [client 20.197.183.189:64012] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aclyAWnfn-AtRoMbquxz3gAAAE8"]
[Mon Mar 30 02:40:02.348680 2026] [:error] [pid 32257:tid 32333] [client 20.197.183.189:64666] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aclyAiE3TArOFrUtgWr1SQAAAI8"]
[Mon Mar 30 02:40:02.965797 2026] [:error] [pid 23167:tid 23172] [client 20.197.183.189:61845] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aclyAhIAHJCFaHff3_cQVgAAAcI"]
[Mon Mar 30 02:40:03.625783 2026] [:error] [pid 32255:tid 32299] [client 20.197.183.189:64679] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclyA2nfn-AtRoMbquxz6QAAAEg"]
[Mon Mar 30 02:40:04.267648 2026] [:error] [pid 32255:tid 32298] [client 20.197.183.189:65076] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclyBGnfn-AtRoMbquxz7wAAAEc"]
[Mon Mar 30 02:40:04.889781 2026] [:error] [pid 32255:tid 32300] [client 20.197.183.189:61922] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclyBGnfn-AtRoMbquxz9QAAAEk"]
[Mon Mar 30 02:40:05.508525 2026] [:error] [pid 32257:tid 32335] [client 20.197.183.189:63867] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclyBSE3TArOFrUtgWr1TgAAAJE"]
[Mon Mar 30 02:40:06.134983 2026] [:error] [pid 32255:tid 32298] [client 20.197.183.189:64728] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aclyBmnfn-AtRoMbquxz-gAAAEc"]
[Mon Mar 30 02:40:06.757400 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:64689] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aclyBozBujdPHsq7wyRkAQAAAoY"]
[Mon Mar 30 02:40:07.405180 2026] [:error] [pid 32257:tid 32329] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Mon Mar 30 02:40:07.724657 2026] [:error] [pid 32257:tid 32340] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Mon Mar 30 02:40:08.036560 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Mon Mar 30 02:40:08.348775 2026] [:error] [pid 32257:tid 32330] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Mon Mar 30 02:40:08.661204 2026] [:error] [pid 32257:tid 32338] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/buc.php
[Mon Mar 30 02:40:08.978707 2026] [:error] [pid 32257:tid 32318] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Mon Mar 30 02:40:09.291221 2026] [:error] [pid 32257:tid 32325] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Mon Mar 30 02:40:09.604113 2026] [:error] [pid 32257:tid 32324] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/okxh.php
[Mon Mar 30 02:40:09.916874 2026] [:error] [pid 32257:tid 32333] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Mon Mar 30 02:40:10.230703 2026] [:error] [pid 32257:tid 32334] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-104.php
[Mon Mar 30 02:40:10.542778 2026] [:error] [pid 32257:tid 32321] [client 20.197.183.189:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Mon Mar 30 02:40:10.853053 2026] [:error] [pid 32257:tid 32335] [client 20.197.183.189:65074] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aclyCiE3TArOFrUtgWr1XQAAAJE"]
[Mon Mar 30 02:40:11.474461 2026] [:error] [pid 23284:tid 23289] [client 20.197.183.189:65121] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aclyC4zBujdPHsq7wyRkDAAAAoM"]
[Mon Mar 30 02:40:12.126523 2026] [:error] [pid 23250:tid 23270] [client 20.197.183.189:61927] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aclyDJxrpj-dQjy1cvo9egAAAlI"]
[Mon Mar 30 02:40:12.748200 2026] [:error] [pid 32257:tid 32320] [client 20.197.183.189:64663] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aclyDCE3TArOFrUtgWr1YQAAAII"]
[Mon Mar 30 02:40:13.371738 2026] [:error] [pid 23284:tid 23300] [client 20.197.183.189:65048] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aclyDYzBujdPHsq7wyRkEgAAAo4"]
[Mon Mar 30 02:40:13.989646 2026] [:error] [pid 23284:tid 23301] [client 20.197.183.189:64014] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aclyDYzBujdPHsq7wyRkFAAAAo8"]
[Mon Mar 30 02:40:14.612337 2026] [:error] [pid 23284:tid 23303] [client 20.197.183.189:64058] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aclyDozBujdPHsq7wyRkFwAAApE"]
[Mon Mar 30 02:40:15.250667 2026] [:error] [pid 23168:tid 23213] [client 20.197.183.189:64700] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aclyD2P8p0yRL8ot_28CwQAAAhA"]
[Mon Mar 30 02:40:16.042106 2026] [:error] [pid 23168:tid 23210] [client 20.197.183.189:64736] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aclyEGP8p0yRL8ot_28CxgAAAg0"]
[Mon Mar 30 02:40:16.757594 2026] [:error] [pid 32257:tid 32324] [client 20.197.183.189:63834] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aclyECE3TArOFrUtgWr1ZwAAAIY"]
[Mon Mar 30 02:40:17.564000 2026] [:error] [pid 32257:tid 32336] [client 20.197.183.189:64075] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aclyESE3TArOFrUtgWr1bAAAAJI"]
[Mon Mar 30 02:40:18.367654 2026] [:error] [pid 23250:tid 23266] [client 20.197.183.189:64668] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aclyEpxrpj-dQjy1cvo9fQAAAk4"]
[Mon Mar 30 02:40:19.264509 2026] [:error] [pid 32255:tid 32303] [client 20.197.183.189:64754] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "aclyE2nfn-AtRoMbqux0AgAAAEw"]
[Mon Mar 30 02:40:20.023885 2026] [:error] [pid 32254:tid 32264] [client 20.197.183.189:64760] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "aclyFKug2IHuyGgCTn9-TgAAAAA"]
[Mon Mar 30 02:40:20.744421 2026] [:error] [pid 23284:tid 23288] [client 20.197.183.189:65143] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "aclyFIzBujdPHsq7wyRkGwAAAoI"]
[Mon Mar 30 02:40:21.556993 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:64044] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xfun.php"] [unique_id "aclyFYzBujdPHsq7wyRkHgAAAoY"]
[Mon Mar 30 02:40:22.265448 2026] [:error] [pid 32255:tid 32311] [client 20.197.183.189:63811] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aclyFmnfn-AtRoMbqux0DQAAAFQ"]
[Mon Mar 30 02:40:22.917508 2026] [:error] [pid 32255:tid 32305] [client 20.197.183.189:64004] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aclyFmnfn-AtRoMbqux0EQAAAE4"]
[Mon Mar 30 02:40:23.588558 2026] [:error] [pid 23167:tid 23189] [client 20.197.183.189:64023] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aclyFxIAHJCFaHff3_cQWwAAAdM"]
[Mon Mar 30 02:40:24.434092 2026] [:error] [pid 32255:tid 32303] [client 20.197.183.189:65038] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bjfl.php"] [unique_id "aclyGGnfn-AtRoMbqux0FgAAAEw"]
[Mon Mar 30 02:40:25.196497 2026] [:error] [pid 23250:tid 23276] [client 20.197.183.189:65087] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aclyGZxrpj-dQjy1cvo9ggAAAlg"]
[Mon Mar 30 02:40:25.835143 2026] [:error] [pid 23137:tid 23159] [client 20.197.183.189:64644] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aclyGRaWQa7LdZ_qGFYuBgAAAZQ"]
[Mon Mar 30 02:40:26.614925 2026] [:error] [pid 32255:tid 32302] [client 20.197.183.189:65111] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aclyGmnfn-AtRoMbqux0GQAAAEs"]
[Mon Mar 30 02:40:27.440004 2026] [:error] [pid 23167:tid 23173] [client 20.197.183.189:64029] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "aclyGxIAHJCFaHff3_cQYgAAAcM"]
[Mon Mar 30 02:40:28.152963 2026] [:error] [pid 23284:tid 23290] [client 20.197.183.189:64061] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aclyHIzBujdPHsq7wyRkLwAAAoQ"]
[Mon Mar 30 02:40:28.853551 2026] [:error] [pid 23167:tid 23177] [client 20.197.183.189:64049] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aclyHBIAHJCFaHff3_cQZQAAAcc"]
[Mon Mar 30 02:40:29.539158 2026] [:error] [pid 32257:tid 32318] [client 20.197.183.189:61282] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aclyHSE3TArOFrUtgWr1egAAAIA"]
[Mon Mar 30 02:40:30.218707 2026] [:error] [pid 23168:tid 23202] [client 20.197.183.189:64692] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "aclyHmP8p0yRL8ot_28CzwAAAgU"]
[Mon Mar 30 02:40:30.920959 2026] [:error] [pid 23137:tid 23146] [client 20.197.183.189:65116] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aclyHhaWQa7LdZ_qGFYuCQAAAYc"]
[Mon Mar 30 02:40:31.628164 2026] [:error] [pid 23137:tid 23144] [client 20.197.183.189:63860] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aclyHxaWQa7LdZ_qGFYuCwAAAYU"]
[Mon Mar 30 02:40:32.363527 2026] [:error] [pid 32254:tid 32277] [client 20.197.183.189:61911] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aclyIKug2IHuyGgCTn9-UwAAAA0"]
[Mon Mar 30 02:40:33.064350 2026] [:error] [pid 32254:tid 32265] [client 20.197.183.189:64000] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aclyIaug2IHuyGgCTn9-VAAAAAE"]
[Mon Mar 30 02:40:33.819331 2026] [:error] [pid 32257:tid 32320] [client 20.197.183.189:65105] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aclyISE3TArOFrUtgWr1kQAAAII"]
[Mon Mar 30 02:40:34.453151 2026] [:error] [pid 32257:tid 32341] [client 20.197.183.189:64060] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aclyIiE3TArOFrUtgWr1lgAAAJc"]
[Mon Mar 30 02:40:35.085208 2026] [:error] [pid 23168:tid 23208] [client 20.197.183.189:64761] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aclyI2P8p0yRL8ot_28C1gAAAgs"]
[Mon Mar 30 02:40:35.718915 2026] [:error] [pid 32257:tid 32326] [client 20.197.183.189:61929] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws49.php"] [unique_id "aclyIyE3TArOFrUtgWr1ngAAAIg"]
[Mon Mar 30 02:40:36.367246 2026] [:error] [pid 32359:tid 32378] [client 20.197.183.189:61902] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aclyJAMb8G3UzfQP3WhX8gAAANE"]
[Mon Mar 30 02:40:36.996009 2026] [:error] [pid 8818:tid 8829] [client 20.197.183.189:64011] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aclyJCCDvotZNSF0FBokuQAAAUc"]
[Mon Mar 30 02:40:37.634740 2026] [:error] [pid 23250:tid 23271] [client 20.197.183.189:61262] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aclyJZxrpj-dQjy1cvo9jAAAAlM"]
[Mon Mar 30 02:40:38.263810 2026] [:error] [pid 32255:tid 32312] [client 20.197.183.189:64072] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aclyJmnfn-AtRoMbqux0HwAAAFU"]
[Mon Mar 30 02:40:38.919807 2026] [:error] [pid 8818:tid 8825] [client 20.197.183.189:61277] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aclyJiCDvotZNSF0FBokwwAAAUM"]
[Mon Mar 30 02:40:39.575856 2026] [:error] [pid 23250:tid 23273] [client 20.197.183.189:64655] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aclyJ5xrpj-dQjy1cvo9jgAAAlU"]
[Mon Mar 30 02:40:40.220559 2026] [:error] [pid 23168:tid 23206] [client 20.197.183.189:64684] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aclyKGP8p0yRL8ot_28C9AAAAgk"]
[Mon Mar 30 02:40:40.872882 2026] [:error] [pid 23168:tid 23214] [client 20.197.183.189:64661] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aclyKGP8p0yRL8ot_28C-AAAAhE"]
[Mon Mar 30 02:40:41.502985 2026] [:error] [pid 23168:tid 23216] [client 20.197.183.189:65096] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aclyKWP8p0yRL8ot_28C_QAAAhM"]
[Mon Mar 30 02:40:42.121577 2026] [:error] [pid 32359:tid 32365] [client 20.197.183.189:64723] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aclyKgMb8G3UzfQP3WhX9AAAAMQ"]
[Mon Mar 30 02:40:42.747852 2026] [:error] [pid 32255:tid 32298] [client 20.197.183.189:64096] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aclyKmnfn-AtRoMbqux0KgAAAEc"]
[Mon Mar 30 02:40:43.379419 2026] [:error] [pid 32257:tid 32337] [client 20.197.183.189:64067] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vanda.php"] [unique_id "aclyKyE3TArOFrUtgWr1rQAAAJM"]
[Mon Mar 30 02:40:44.020618 2026] [:error] [pid 32359:tid 32361] [client 20.197.183.189:61951] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aclyLAMb8G3UzfQP3WhX9QAAAMA"]
[Mon Mar 30 02:40:44.657178 2026] [:error] [pid 23167:tid 23180] [client 20.197.183.189:64033] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aclyLBIAHJCFaHff3_cQcgAAAco"]
[Mon Mar 30 02:40:45.279806 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:64047] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aclyLYzBujdPHsq7wyRkYAAAAoY"]
[Mon Mar 30 02:40:45.899904 2026] [:error] [pid 8818:tid 8835] [client 20.197.183.189:63851] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "aclyLSCDvotZNSF0FBok1AAAAU0"]
[Mon Mar 30 02:40:46.522277 2026] [:error] [pid 23167:tid 23190] [client 20.197.183.189:64059] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aclyLhIAHJCFaHff3_cQdAAAAdQ"]
[Mon Mar 30 02:40:47.147174 2026] [:error] [pid 8818:tid 8832] [client 20.197.183.189:65066] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aclyLyCDvotZNSF0FBok1wAAAUo"]
[Mon Mar 30 02:40:47.764316 2026] [:error] [pid 23284:tid 23310] [client 20.197.183.189:65055] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aclyL4zBujdPHsq7wyRkYgAAApg"]
[Mon Mar 30 02:40:48.387657 2026] [:error] [pid 32257:tid 32338] [client 20.197.183.189:65041] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aclyMCE3TArOFrUtgWr11AAAAJQ"]
[Mon Mar 30 02:40:49.019278 2026] [:error] [pid 32257:tid 32336] [client 20.197.183.189:65075] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aclyMSE3TArOFrUtgWr12QAAAJI"]
[Mon Mar 30 02:40:49.647285 2026] [:error] [pid 23167:tid 23181] [client 20.197.183.189:64687] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aclyMRIAHJCFaHff3_cQdwAAAcs"]
[Mon Mar 30 02:40:50.265762 2026] [:error] [pid 23137:tid 23149] [client 20.197.183.189:64055] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aclyMhaWQa7LdZ_qGFYuFgAAAYo"]
[Mon Mar 30 02:40:50.890188 2026] [:error] [pid 23250:tid 23265] [client 20.197.183.189:64657] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aclyMpxrpj-dQjy1cvo9mAAAAk0"]
[Mon Mar 30 02:40:51.512320 2026] [:error] [pid 32257:tid 32328] [client 20.197.183.189:61852] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aclyMyE3TArOFrUtgWr13gAAAIo"]
[Mon Mar 30 02:40:52.140463 2026] [:error] [pid 32257:tid 32332] [client 20.197.183.189:61829] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aclyNCE3TArOFrUtgWr15gAAAI4"]
[Mon Mar 30 02:40:52.758407 2026] [:error] [pid 32255:tid 32293] [client 20.197.183.189:64112] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aclyNGnfn-AtRoMbqux0NwAAAEI"]
[Mon Mar 30 02:40:53.403014 2026] [:error] [pid 23284:tid 23299] [client 20.197.183.189:64649] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aclyNYzBujdPHsq7wyRkcgAAAo0"]
[Mon Mar 30 02:40:54.030964 2026] [:error] [pid 32255:tid 32305] [client 20.197.183.189:65123] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aclyNmnfn-AtRoMbqux0OAAAAE4"]
[Mon Mar 30 02:40:54.667576 2026] [:error] [pid 23284:tid 23292] [client 20.197.183.189:65100] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aclyNozBujdPHsq7wyRkfAAAAoY"]
[Mon Mar 30 02:40:55.302718 2026] [:error] [pid 23284:tid 23298] [client 20.197.183.189:64756] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aclyN4zBujdPHsq7wyRkgAAAAow"]
[Mon Mar 30 02:40:55.924992 2026] [:error] [pid 32255:tid 32313] [client 20.197.183.189:65056] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aclyN2nfn-AtRoMbqux0PQAAAFY"]
[Mon Mar 30 02:40:56.556777 2026] [:error] [pid 23250:tid 23264] [client 20.197.183.189:64048] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa21.php"] [unique_id "aclyOJxrpj-dQjy1cvo9mwAAAkw"]
[Mon Mar 30 02:40:57.180818 2026] [:error] [pid 32254:tid 32282] [client 20.197.183.189:64038] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa21.php"] [unique_id "aclyOaug2IHuyGgCTn9-XQAAABI"]
[Mon Mar 30 02:40:57.809039 2026] [:error] [pid 8818:tid 8841] [client 20.197.183.189:65136] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa21.php"] [unique_id "aclyOSCDvotZNSF0FBok3QAAAVM"]
[Mon Mar 30 02:40:58.426440 2026] [:error] [pid 8818:tid 8823] [client 20.197.183.189:65101] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa21.php"] [unique_id "aclyOiCDvotZNSF0FBok3gAAAUE"]
[Mon Mar 30 02:40:59.062304 2026] [:error] [pid 8818:tid 8843] [client 20.197.183.189:61882] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aclyOyCDvotZNSF0FBok4QAAAVU"]
[Mon Mar 30 02:40:59.695399 2026] [:error] [pid 32257:tid 32322] [client 20.197.183.189:61858] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aclyOyE3TArOFrUtgWr1_AAAAIQ"]
[Mon Mar 30 02:41:00.316985 2026] [:error] [pid 32257:tid 32334] [client 20.197.183.189:64698] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aclyPCE3TArOFrUtgWr2BgAAAJA"]
[Mon Mar 30 02:41:00.939048 2026] [:error] [pid 32359:tid 32373] [client 20.197.183.189:65073] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "aclyPAMb8G3UzfQP3WhX_gAAAMw"]
[Mon Mar 30 02:41:01.559415 2026] [:error] [pid 23284:tid 23308] [client 20.197.183.189:64750] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aclyPYzBujdPHsq7wyRkhgAAApY"]
[Mon Mar 30 02:41:02.177580 2026] [:error] [pid 23168:tid 23215] [client 20.197.183.189:61254] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aclyPmP8p0yRL8ot_28DWwAAAhI"]
[Mon Mar 30 02:41:02.807461 2026] [:error] [pid 32257:tid 32328] [client 20.197.183.189:61918] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aclyPiE3TArOFrUtgWr2GAAAAIo"]
[Mon Mar 30 02:41:03.425157 2026] [:error] [pid 23284:tid 23302] [client 20.197.183.189:61285] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aclyP4zBujdPHsq7wyRkiwAAApA"]
[Mon Mar 30 02:41:04.045978 2026] [:error] [pid 32257:tid 32339] [client 20.197.183.189:61257] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bootstrap.php"] [unique_id "aclyQCE3TArOFrUtgWr2HQAAAJU"]
[Mon Mar 30 02:41:04.682853 2026] [:error] [pid 23284:tid 23307] [client 20.197.183.189:60625] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bootstrap.php"] [unique_id "aclyQIzBujdPHsq7wyRkkQAAApU"]
[Mon Mar 30 02:41:05.313805 2026] [:error] [pid 23284:tid 23286] [client 20.197.183.189:64694] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bootstrap.php"] [unique_id "aclyQYzBujdPHsq7wyRklgAAAoA"]
[Mon Mar 30 02:41:05.932783 2026] [:error] [pid 32255:tid 32314] [client 20.197.183.189:63832] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bootstrap.php"] [unique_id "aclyQWnfn-AtRoMbqux0iQAAAFc"]
[Mon Mar 30 02:41:06.558066 2026] [:error] [pid 32255:tid 32294] [client 20.197.183.189:64026] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "aclyQmnfn-AtRoMbqux0kAAAAEM"]
[Mon Mar 30 02:41:07.178467 2026] [:error] [pid 32255:tid 32298] [client 20.197.183.189:65132] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "aclyQ2nfn-AtRoMbqux0lgAAAEc"]
[Mon Mar 30 02:41:07.834174 2026] [:error] [pid 23250:tid 23271] [client 20.197.183.189:61879] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "aclyQ5xrpj-dQjy1cvo9oAAAAlM"]
[Mon Mar 30 02:41:08.456754 2026] [:error] [pid 32255:tid 32309] [client 20.197.183.189:63843] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "aclyRGnfn-AtRoMbqux0mgAAAFI"]
[Mon Mar 30 02:41:09.073242 2026] [:error] [pid 32257:tid 32321] [client 20.197.183.189:64074] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aclyRSE3TArOFrUtgWr2NAAAAIM"]
[Mon Mar 30 02:41:09.692289 2026] [:error] [pid 23167:tid 23186] [client 20.197.183.189:65053] [client 20.197.183.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aclyRRIAHJCFaHff3_cQjAAAAdA"]
[Mon Mar 30 02:41:10.315533 2026] [:error] [pid 23168:tid 23197] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Mon Mar 30 02:41:10.628141 2026] [:error] [pid 23168:tid 23219] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/csv.php
[Mon Mar 30 02:41:10.940550 2026] [:error] [pid 23168:tid 23211] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/varb.php
[Mon Mar 30 02:41:11.253837 2026] [:error] [pid 23168:tid 23208] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Mon Mar 30 02:41:11.566093 2026] [:error] [pid 23168:tid 23216] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Mon Mar 30 02:41:11.878353 2026] [:error] [pid 23168:tid 23203] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Mon Mar 30 02:41:12.190576 2026] [:error] [pid 23168:tid 23205] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Mon Mar 30 02:41:12.502955 2026] [:error] [pid 23168:tid 23214] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Mon Mar 30 02:41:12.814550 2026] [:error] [pid 23168:tid 23199] [client 20.197.183.189:61849] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Mon Mar 30 11:01:09.566421 2026] [:error] [pid 35250:tid 35334] [client 43.157.95.131:53804] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acnndYaKM1MR6zcp2YOd_wAAANc"]
[Mon Mar 30 11:51:37.908667 2026] [:error] [pid 64743:tid 64758] [client 119.96.24.54:45216] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acnzSSzmpVL6Ubzil4hdvAAAAU0"]
[Mon Mar 30 13:44:08.738792 2026] [:error] [pid 35250:tid 35332] [client 104.168.66.97:61222] [client 104.168.66.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "acoNqIaKM1MR6zcp2YPQigAAANU"]
[Mon Mar 30 17:50:20.806609 2026] [:error] [pid 35248:tid 35278] [client 170.106.35.187:56082] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acpHXL3igMCgAQPFS_9vwgAAAFg"]
[Mon Mar 30 22:06:21.145346 2026] [:error] [pid 60835:tid 60852] [client 43.153.54.138:53342] [client 43.153.54.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acqDXQIOJ4Lc0iJVRzzVHwAAAA8"]
[Tue Mar 31 00:33:28.796821 2026] [:error] [pid 36672:tid 36828] [client 119.28.89.249:41900] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acql2LKHDzEfeL3XiLovJwAAAFU"]
[Tue Mar 31 01:46:58.184220 2026] [:error] [pid 36672:tid 36828] [client 20.220.217.186:34073] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Mar 31 01:47:00.036710 2026] [:error] [pid 36672:tid 36822] [client 20.220.217.186:34073] [client 20.220.217.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.217.186, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acq3FLKHDzEfeL3XiLpGfwAAAE8"]
[Tue Mar 31 01:47:00.302881 2026] [:error] [pid 36672:tid 36817] [client 20.220.217.186:34073] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Tue Mar 31 01:47:01.338083 2026] [:error] [pid 36672:tid 36829] [client 20.220.217.186:34073] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Tue Mar 31 01:47:02.055286 2026] [:error] [pid 36672:tid 36820] [client 20.220.217.186:34073] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Mar 31 01:47:02.296042 2026] [:error] [pid 36672:tid 36810] [client 20.220.217.186:34073] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acq3FrKHDzEfeL3XiLpGjQAAAEM"]
[Tue Mar 31 01:47:03.300478 2026] [:error] [pid 39123:tid 39140] [client 20.220.217.186:34064] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acq3FyobgVY20PMQKVtqzQAAAQ8"]
[Tue Mar 31 01:47:04.289674 2026] [:error] [pid 39123:tid 39142] [client 20.220.217.186:65472] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acq3GCobgVY20PMQKVtq1gAAARE"]
[Tue Mar 31 01:47:05.273255 2026] [:error] [pid 39123:tid 39146] [client 20.220.217.186:33863] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "acq3GSobgVY20PMQKVtq3wAAARU"]
[Tue Mar 31 03:31:00.330395 2026] [:error] [pid 15567:tid 15579] [client 20.220.217.186:58765] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Mar 31 03:31:00.751464 2026] [:error] [pid 15567:tid 15586] [client 20.220.217.186:58765] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Mar 31 03:31:00.960907 2026] [:error] [pid 15567:tid 15573] [client 20.220.217.186:58765] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Mar 31 03:31:01.170199 2026] [:error] [pid 15567:tid 15578] [client 20.220.217.186:58765] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Mar 31 03:31:01.379875 2026] [:error] [pid 15567:tid 15575] [client 20.220.217.186:58765] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue Mar 31 03:31:01.801398 2026] [:error] [pid 15567:tid 15571] [client 20.220.217.186:58765] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Mar 31 03:31:02.220623 2026] [:error] [pid 15567:tid 15588] [client 20.220.217.186:58765] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conf.php
[Tue Mar 31 03:31:02.636361 2026] [:error] [pid 15567:tid 15583] [client 20.220.217.186:58765] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "acrPdpx4rriuHvPbfx3AbgAAAMw"]
[Tue Mar 31 03:31:03.457664 2026] [:error] [pid 15567:tid 15586] [client 20.220.217.186:58769] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "acrPd5x4rriuHvPbfx3AcQAAAM8"]
[Tue Mar 31 03:31:04.306548 2026] [:error] [pid 15454:tid 15543] [client 20.220.217.186:54995] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "acrPeHCerH-ZHr3-moQs7gAAAI8"]
[Tue Mar 31 03:31:05.131905 2026] [:error] [pid 15567:tid 15591] [client 20.220.217.186:55006] [client 20.220.217.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "acrPeZx4rriuHvPbfx3AeQAAANQ"]
[Tue Mar 31 04:04:07.744205 2026] [:error] [pid 18439:tid 18454] [client 161.178.139.119:62278] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Tue Mar 31 04:04:08.679306 2026] [:error] [pid 18334:tid 18412] [client 161.178.139.119:62764] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Tue Mar 31 04:04:10.539057 2026] [:error] [pid 18334:tid 18409] [client 161.178.139.119:63418] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "acrXOnqQrXLbk1cg3mgRhgAAAIM"]
[Tue Mar 31 04:04:11.469584 2026] [:error] [pid 18439:tid 18454] [client 161.178.139.119:63712] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/db.sql"] [unique_id "acrXOy-R9nOaA8Xqs7iHxgAAAMM"]
[Tue Mar 31 04:04:12.400863 2026] [:error] [pid 18333:tid 18398] [client 161.178.139.119:63967] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/dump.sql"] [unique_id "acrXPESx2C5hLR0-8dLB7QAAAFM"]
[Tue Mar 31 04:04:13.332489 2026] [:error] [pid 18334:tid 18425] [client 161.178.139.119:64271] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/database.sql"] [unique_id "acrXPXqQrXLbk1cg3mgRjgAAAJM"]
[Tue Mar 31 04:04:14.264164 2026] [:error] [pid 18332:tid 18372] [client 161.178.139.119:64571] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/backup.sql"] [unique_id "acrXPr4KXr1F9raS5GR8KgAAABc"]
[Tue Mar 31 04:04:15.194559 2026] [:error] [pid 18439:tid 18472] [client 161.178.139.119:64870] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/config/db.sql"] [unique_id "acrXPy-R9nOaA8Xqs7iH1QAAANU"]
[Tue Mar 31 04:04:16.124488 2026] [:error] [pid 18333:tid 18397] [client 161.178.139.119:65182] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/sql/db.sql"] [unique_id "acrXQESx2C5hLR0-8dLB8wAAAFI"]
[Tue Mar 31 04:04:17.056450 2026] [:error] [pid 18332:tid 18366] [client 161.178.139.119:49158] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/data/dump.sql"] [unique_id "acrXQb4KXr1F9raS5GR8LQAAABI"]
[Tue Mar 31 04:04:17.990509 2026] [:error] [pid 18439:tid 18462] [client 161.178.139.119:49535] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/backups/database.sql"] [unique_id "acrXQS-R9nOaA8Xqs7iH5wAAAMs"]
[Tue Mar 31 04:04:18.923450 2026] [:error] [pid 18332:tid 18371] [client 161.178.139.119:49897] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/mysql.sql"] [unique_id "acrXQr4KXr1F9raS5GR8NgAAABY"]
[Tue Mar 31 04:04:19.853726 2026] [:error] [pid 18332:tid 18365] [client 161.178.139.119:50275] [client 161.178.139.119] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/db_backup.sql"] [unique_id "acrXQ74KXr1F9raS5GR8PQAAABE"]
[Tue Mar 31 04:16:33.070352 2026] [:error] [pid 18334:tid 18412] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Tue Mar 31 04:16:33.323989 2026] [:error] [pid 18334:tid 18428] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/sw.php
[Tue Mar 31 04:16:33.576608 2026] [:error] [pid 18334:tid 18419] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/fsgdjkl.php
[Tue Mar 31 04:16:33.829890 2026] [:error] [pid 18334:tid 18413] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/ahutr.php
[Tue Mar 31 04:16:34.084556 2026] [:error] [pid 18334:tid 18424] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Tue Mar 31 04:16:34.341999 2026] [:error] [pid 18334:tid 18420] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Tue Mar 31 04:16:34.595500 2026] [:error] [pid 18334:tid 18430] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/abouta.php
[Tue Mar 31 04:16:34.848148 2026] [:error] [pid 18334:tid 18427] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/zfe.php
[Tue Mar 31 04:16:35.100895 2026] [:error] [pid 18334:tid 18409] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Tue Mar 31 04:16:35.353756 2026] [:error] [pid 18334:tid 18423] [client 20.166.54.109:6248] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Mar 31 04:16:35.602954 2026] [:error] [pid 18334:tid 18414] [client 20.166.54.109:6248] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asudo.php"] [unique_id "acraI3qQrXLbk1cg3mgaWQAAAIg"]
[Tue Mar 31 04:16:36.102955 2026] [:error] [pid 18439:tid 18463] [client 20.166.54.109:5047] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asudo.php"] [unique_id "acraJC-R9nOaA8Xqs7iSwAAAAMw"]
[Tue Mar 31 04:16:36.605716 2026] [:error] [pid 18333:tid 18381] [client 20.166.54.109:5043] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asudo.php"] [unique_id "acraJESx2C5hLR0-8dLIJgAAAEI"]
[Tue Mar 31 04:16:37.104448 2026] [:error] [pid 18439:tid 18468] [client 20.166.54.109:7423] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asudo.php"] [unique_id "acraJS-R9nOaA8Xqs7iSwgAAANE"]
[Tue Mar 31 04:16:37.604758 2026] [:error] [pid 18439:tid 18459] [client 20.166.54.109:13157] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "acraJS-R9nOaA8Xqs7iSyAAAAMg"]
[Tue Mar 31 04:16:38.104319 2026] [:error] [pid 18439:tid 18466] [client 20.166.54.109:1060] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "acraJi-R9nOaA8Xqs7iSywAAAM8"]
[Tue Mar 31 04:16:38.605579 2026] [:error] [pid 18332:tid 18366] [client 20.166.54.109:3565] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "acraJr4KXr1F9raS5GSCVAAAABI"]
[Tue Mar 31 04:16:39.108092 2026] [:error] [pid 18439:tid 18475] [client 20.166.54.109:12486] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "acraJy-R9nOaA8Xqs7iS0wAAANg"]
[Tue Mar 31 04:16:39.610002 2026] [:error] [pid 18332:tid 18355] [client 20.166.54.109:5215] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "acraJ74KXr1F9raS5GSCVwAAAAc"]
[Tue Mar 31 04:16:40.110053 2026] [:error] [pid 18439:tid 18471] [client 20.166.54.109:12485] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "acraKC-R9nOaA8Xqs7iS4gAAANQ"]
[Tue Mar 31 04:16:40.609880 2026] [:error] [pid 18333:tid 18400] [client 20.166.54.109:13278] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "acraKESx2C5hLR0-8dLINQAAAFU"]
[Tue Mar 31 04:16:41.118516 2026] [:error] [pid 18334:tid 18415] [client 20.166.54.109:7360] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "acraKXqQrXLbk1cg3mgabQAAAIk"]
[Tue Mar 31 04:16:41.621572 2026] [:error] [pid 18439:tid 18470] [client 20.166.54.109:7368] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "acraKS-R9nOaA8Xqs7iS8AAAANM"]
[Tue Mar 31 04:16:42.121517 2026] [:error] [pid 18439:tid 18451] [client 20.166.54.109:5128] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "acraKi-R9nOaA8Xqs7iS9QAAAMA"]
[Tue Mar 31 04:16:42.657590 2026] [:error] [pid 18333:tid 18394] [client 20.166.54.109:1553] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "acraKkSx2C5hLR0-8dLIOAAAAE8"]
[Tue Mar 31 04:16:43.174828 2026] [:error] [pid 18439:tid 18468] [client 20.166.54.109:9616] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "acraKy-R9nOaA8Xqs7iS_wAAANE"]
[Tue Mar 31 04:16:43.675993 2026] [:error] [pid 18332:tid 18356] [client 20.166.54.109:1050] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "acraK74KXr1F9raS5GSCZwAAAAg"]
[Tue Mar 31 04:16:44.183384 2026] [:error] [pid 18439:tid 18465] [client 20.166.54.109:7474] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "acraLC-R9nOaA8Xqs7iTCgAAAM4"]
[Tue Mar 31 04:16:44.683385 2026] [:error] [pid 18333:tid 18388] [client 20.166.54.109:7403] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "acraLESx2C5hLR0-8dLIOwAAAEk"]
[Tue Mar 31 04:16:45.178753 2026] [:error] [pid 18332:tid 18348] [client 20.166.54.109:6241] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "acraLb4KXr1F9raS5GSCcQAAAAA"]
[Tue Mar 31 04:16:45.676820 2026] [:error] [pid 18334:tid 18409] [client 20.166.54.109:7373] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "acraLXqQrXLbk1cg3mgahgAAAIM"]
[Tue Mar 31 04:16:46.183862 2026] [:error] [pid 18334:tid 18429] [client 20.166.54.109:11805] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "acraLnqQrXLbk1cg3mgaiQAAAJc"]
[Tue Mar 31 04:16:46.680921 2026] [:error] [pid 18334:tid 18419] [client 20.166.54.109:5190] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "acraLnqQrXLbk1cg3mgajAAAAI0"]
[Tue Mar 31 04:16:47.181617 2026] [:error] [pid 18439:tid 18469] [client 20.166.54.109:7380] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "acraLy-R9nOaA8Xqs7iTHwAAANI"]
[Tue Mar 31 04:16:47.682280 2026] [:error] [pid 18439:tid 18466] [client 20.166.54.109:3571] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zlnckdxn.php"] [unique_id "acraLy-R9nOaA8Xqs7iTJAAAAM8"]
[Tue Mar 31 04:16:48.180590 2026] [:error] [pid 18334:tid 18410] [client 20.166.54.109:14272] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zlnckdxn.php"] [unique_id "acraMHqQrXLbk1cg3mgalAAAAIQ"]
[Tue Mar 31 04:16:48.681335 2026] [:error] [pid 18332:tid 18358] [client 20.166.54.109:11838] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zlnckdxn.php"] [unique_id "acraML4KXr1F9raS5GSChgAAAAo"]
[Tue Mar 31 04:16:49.179647 2026] [:error] [pid 18334:tid 18423] [client 20.166.54.109:5183] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zlnckdxn.php"] [unique_id "acraMXqQrXLbk1cg3mganwAAAJE"]
[Tue Mar 31 04:16:49.679409 2026] [:error] [pid 18333:tid 18387] [client 20.166.54.109:6223] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-thi.php"] [unique_id "acraMUSx2C5hLR0-8dLIQQAAAEg"]
[Tue Mar 31 04:16:50.187402 2026] [:error] [pid 18439:tid 18464] [client 20.166.54.109:13175] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-thi.php"] [unique_id "acraMi-R9nOaA8Xqs7iTNwAAAM0"]
[Tue Mar 31 04:16:50.691655 2026] [:error] [pid 18439:tid 18455] [client 20.166.54.109:1560] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-thi.php"] [unique_id "acraMi-R9nOaA8Xqs7iTPgAAAMQ"]
[Tue Mar 31 04:16:51.193989 2026] [:error] [pid 18332:tid 18368] [client 20.166.54.109:1723] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-thi.php"] [unique_id "acraM74KXr1F9raS5GSCiAAAABQ"]
[Tue Mar 31 04:16:51.700692 2026] [:error] [pid 18334:tid 18415] [client 20.166.54.109:13272] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acraM3qQrXLbk1cg3mgapwAAAIk"]
[Tue Mar 31 04:16:52.213722 2026] [:error] [pid 18334:tid 18426] [client 20.166.54.109:13123] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acraNHqQrXLbk1cg3mgarQAAAJQ"]
[Tue Mar 31 04:16:52.718311 2026] [:error] [pid 18334:tid 18414] [client 20.166.54.109:13255] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acraNHqQrXLbk1cg3mgatgAAAIg"]
[Tue Mar 31 04:16:53.225988 2026] [:error] [pid 18334:tid 18421] [client 20.166.54.109:13256] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acraNXqQrXLbk1cg3mgavwAAAI8"]
[Tue Mar 31 04:16:53.734836 2026] [:error] [pid 18334:tid 18425] [client 20.166.54.109:4993] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acraNXqQrXLbk1cg3mgaxwAAAJM"]
[Tue Mar 31 04:16:54.234395 2026] [:error] [pid 18333:tid 18390] [client 20.166.54.109:1694] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acraNkSx2C5hLR0-8dLITAAAAEs"]
[Tue Mar 31 04:16:54.734384 2026] [:error] [pid 18439:tid 18455] [client 20.166.54.109:13125] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acraNi-R9nOaA8Xqs7iTSAAAAMQ"]
[Tue Mar 31 04:16:55.237557 2026] [:error] [pid 18333:tid 18394] [client 20.166.54.109:3260] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acraN0Sx2C5hLR0-8dLIVAAAAE8"]
[Tue Mar 31 04:16:55.738697 2026] [:error] [pid 18332:tid 18348] [client 20.166.54.109:5122] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "acraN74KXr1F9raS5GSCjgAAAAA"]
[Tue Mar 31 04:16:56.241488 2026] [:error] [pid 18439:tid 18452] [client 20.166.54.109:3255] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "acraOC-R9nOaA8Xqs7iTTQAAAME"]
[Tue Mar 31 04:16:56.743366 2026] [:error] [pid 18439:tid 18463] [client 20.166.54.109:12510] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "acraOC-R9nOaA8Xqs7iTUgAAAMw"]
[Tue Mar 31 04:16:57.246541 2026] [:error] [pid 18439:tid 18453] [client 20.166.54.109:3546] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "acraOS-R9nOaA8Xqs7iTWAAAAMI"]
[Tue Mar 31 04:16:57.750292 2026] [:error] [pid 18333:tid 18388] [client 20.166.54.109:12104] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "acraOUSx2C5hLR0-8dLIYgAAAEk"]
[Tue Mar 31 04:16:58.256129 2026] [:error] [pid 18333:tid 18402] [client 20.166.54.109:5015] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "acraOkSx2C5hLR0-8dLIZwAAAFc"]
[Tue Mar 31 04:16:58.755605 2026] [:error] [pid 18439:tid 18455] [client 20.166.54.109:1105] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "acraOi-R9nOaA8Xqs7iTYgAAAMQ"]
[Tue Mar 31 04:16:59.264252 2026] [:error] [pid 18439:tid 18472] [client 20.166.54.109:13258] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "acraOy-R9nOaA8Xqs7iTZwAAANU"]
[Tue Mar 31 04:16:59.765573 2026] [:error] [pid 18332:tid 18367] [client 20.166.54.109:4996] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "acraO74KXr1F9raS5GSCnQAAABM"]
[Tue Mar 31 04:17:00.267203 2026] [:error] [pid 18332:tid 18369] [client 20.166.54.109:3579] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "acraPL4KXr1F9raS5GSCoAAAABU"]
[Tue Mar 31 04:17:00.767075 2026] [:error] [pid 18333:tid 18389] [client 20.166.54.109:11778] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "acraPESx2C5hLR0-8dLIdAAAAEo"]
[Tue Mar 31 04:17:01.265729 2026] [:error] [pid 18332:tid 18356] [client 20.166.54.109:6109] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "acraPb4KXr1F9raS5GSCqgAAAAg"]
[Tue Mar 31 04:17:01.763987 2026] [:error] [pid 18439:tid 18454] [client 20.166.54.109:5897] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "acraPS-R9nOaA8Xqs7iTeAAAAMM"]
[Tue Mar 31 04:17:02.263969 2026] [:error] [pid 18333:tid 18393] [client 20.166.54.109:9389] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "acraPkSx2C5hLR0-8dLIfgAAAE4"]
[Tue Mar 31 04:17:02.764319 2026] [:error] [pid 18333:tid 18388] [client 20.166.54.109:12127] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "acraPkSx2C5hLR0-8dLIfwAAAEk"]
[Tue Mar 31 04:17:03.264861 2026] [:error] [pid 18333:tid 18401] [client 20.166.54.109:7398] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "acraP0Sx2C5hLR0-8dLIggAAAFY"]
[Tue Mar 31 04:17:03.770826 2026] [:error] [pid 18333:tid 18398] [client 20.166.54.109:7412] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vvedr.php"] [unique_id "acraP0Sx2C5hLR0-8dLIhQAAAFM"]
[Tue Mar 31 04:17:04.279391 2026] [:error] [pid 18333:tid 18392] [client 20.166.54.109:1590] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vvedr.php"] [unique_id "acraQESx2C5hLR0-8dLIjAAAAE0"]
[Tue Mar 31 04:17:04.782641 2026] [:error] [pid 18439:tid 18463] [client 20.166.54.109:5228] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vvedr.php"] [unique_id "acraQC-R9nOaA8Xqs7iTfgAAAMw"]
[Tue Mar 31 04:17:05.287494 2026] [:error] [pid 18439:tid 18459] [client 20.166.54.109:13273] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vvedr.php"] [unique_id "acraQS-R9nOaA8Xqs7iTgwAAAMg"]
[Tue Mar 31 04:17:05.789632 2026] [:error] [pid 18333:tid 18402] [client 20.166.54.109:13148] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "acraQUSx2C5hLR0-8dLIkgAAAFc"]
[Tue Mar 31 04:17:06.302789 2026] [:error] [pid 18334:tid 18426] [client 20.166.54.109:13303] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "acraQnqQrXLbk1cg3mga7gAAAJQ"]
[Tue Mar 31 04:17:06.809032 2026] [:error] [pid 18439:tid 18468] [client 20.166.54.109:10771] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "acraQi-R9nOaA8Xqs7iTjQAAANE"]
[Tue Mar 31 04:17:07.312432 2026] [:error] [pid 18333:tid 18386] [client 20.166.54.109:4493] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "acraQ0Sx2C5hLR0-8dLIlwAAAEc"]
[Tue Mar 31 04:17:07.828328 2026] [:error] [pid 18334:tid 18419] [client 20.166.54.109:1028] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acraQ3qQrXLbk1cg3mga9gAAAI0"]
[Tue Mar 31 04:17:08.333327 2026] [:error] [pid 18334:tid 18414] [client 20.166.54.109:9388] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acraRHqQrXLbk1cg3mga-wAAAIg"]
[Tue Mar 31 04:17:08.836865 2026] [:error] [pid 18439:tid 18454] [client 20.166.54.109:9356] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acraRC-R9nOaA8Xqs7iTnwAAAMM"]
[Tue Mar 31 04:17:09.353855 2026] [:error] [pid 18334:tid 18410] [client 20.166.54.109:5213] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acraRXqQrXLbk1cg3mgbAwAAAIQ"]
[Tue Mar 31 04:17:09.857498 2026] [:error] [pid 18439:tid 18452] [client 20.166.54.109:1567] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acraRS-R9nOaA8Xqs7iTpQAAAME"]
[Tue Mar 31 04:17:10.370190 2026] [:error] [pid 18439:tid 18453] [client 20.166.54.109:10783] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acraRi-R9nOaA8Xqs7iTqgAAAMI"]
[Tue Mar 31 04:17:10.873361 2026] [:error] [pid 18439:tid 18455] [client 20.166.54.109:5212] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acraRi-R9nOaA8Xqs7iTrwAAAMQ"]
[Tue Mar 31 04:17:11.384972 2026] [:error] [pid 18439:tid 18466] [client 20.166.54.109:6048] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "acraRy-R9nOaA8Xqs7iTtAAAAM8"]
[Tue Mar 31 04:17:11.883603 2026] [:error] [pid 18332:tid 18350] [client 20.166.54.109:6217] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "acraR74KXr1F9raS5GSCwwAAAAI"]
[Tue Mar 31 04:17:12.395076 2026] [:error] [pid 18439:tid 18468] [client 20.166.54.109:6122] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "acraSC-R9nOaA8Xqs7iTwQAAANE"]
[Tue Mar 31 04:17:12.901908 2026] [:error] [pid 18439:tid 18464] [client 20.166.54.109:12490] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "acraSC-R9nOaA8Xqs7iTyAAAAM0"]
[Tue Mar 31 04:17:13.417831 2026] [:error] [pid 18439:tid 18457] [client 20.166.54.109:12513] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "acraSS-R9nOaA8Xqs7iTzgAAAMY"]
[Tue Mar 31 04:17:13.919842 2026] [:error] [pid 18439:tid 18475] [client 20.166.54.109:3214] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xhejulap.php"] [unique_id "acraSS-R9nOaA8Xqs7iT1QAAANg"]
[Tue Mar 31 04:17:14.429038 2026] [:error] [pid 18333:tid 18396] [client 20.166.54.109:11821] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xhejulap.php"] [unique_id "acraSkSx2C5hLR0-8dLIqgAAAFE"]
[Tue Mar 31 04:17:14.939898 2026] [:error] [pid 18332:tid 18361] [client 20.166.54.109:6123] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xhejulap.php"] [unique_id "acraSr4KXr1F9raS5GSCyAAAAA0"]
[Tue Mar 31 04:17:15.449055 2026] [:error] [pid 18334:tid 18408] [client 20.166.54.109:5040] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xhejulap.php"] [unique_id "acraS3qQrXLbk1cg3mgbFQAAAII"]
[Tue Mar 31 04:17:15.949664 2026] [:error] [pid 18334:tid 18417] [client 20.166.54.109:6104] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acraS3qQrXLbk1cg3mgbGgAAAIs"]
[Tue Mar 31 04:17:16.457310 2026] [:error] [pid 18333:tid 18385] [client 20.166.54.109:3822] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acraTESx2C5hLR0-8dLIuAAAAEY"]
[Tue Mar 31 04:17:16.957012 2026] [:error] [pid 18333:tid 18388] [client 20.166.54.109:7419] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acraTESx2C5hLR0-8dLIvQAAAEk"]
[Tue Mar 31 04:17:17.460445 2026] [:error] [pid 18333:tid 18379] [client 20.166.54.109:12532] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acraTUSx2C5hLR0-8dLIwQAAAEA"]
[Tue Mar 31 04:17:17.973029 2026] [:error] [pid 18334:tid 18413] [client 20.166.54.109:1135] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8pewqMTX.php"] [unique_id "acraTXqQrXLbk1cg3mgbIwAAAIc"]
[Tue Mar 31 04:17:18.481261 2026] [:error] [pid 18333:tid 18382] [client 20.166.54.109:1558] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8pewqMTX.php"] [unique_id "acraTkSx2C5hLR0-8dLIygAAAEM"]
[Tue Mar 31 04:17:18.986783 2026] [:error] [pid 18439:tid 18472] [client 20.166.54.109:3348] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8pewqMTX.php"] [unique_id "acraTi-R9nOaA8Xqs7iT9gAAANU"]
[Tue Mar 31 04:17:19.507095 2026] [:error] [pid 18333:tid 18379] [client 20.166.54.109:12113] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8pewqMTX.php"] [unique_id "acraT0Sx2C5hLR0-8dLIzQAAAEA"]
[Tue Mar 31 04:17:20.009893 2026] [:error] [pid 18334:tid 18430] [client 20.166.54.109:4515] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddpxi.php"] [unique_id "acraUHqQrXLbk1cg3mgbJwAAAJg"]
[Tue Mar 31 04:17:20.512980 2026] [:error] [pid 18334:tid 18422] [client 20.166.54.109:5023] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddpxi.php"] [unique_id "acraUHqQrXLbk1cg3mgbLAAAAJA"]
[Tue Mar 31 04:17:21.014570 2026] [:error] [pid 18334:tid 18412] [client 20.166.54.109:11783] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddpxi.php"] [unique_id "acraUXqQrXLbk1cg3mgbLwAAAIY"]
[Tue Mar 31 04:17:21.515989 2026] [:error] [pid 18333:tid 18400] [client 20.166.54.109:12126] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddpxi.php"] [unique_id "acraUUSx2C5hLR0-8dLI1wAAAFU"]
[Tue Mar 31 04:17:22.016163 2026] [:error] [pid 18439:tid 18461] [client 20.166.54.109:13271] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdkfu.php"] [unique_id "acraUi-R9nOaA8Xqs7iUAgAAAMo"]
[Tue Mar 31 04:17:22.516729 2026] [:error] [pid 18334:tid 18422] [client 20.166.54.109:6226] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdkfu.php"] [unique_id "acraUnqQrXLbk1cg3mgbOgAAAJA"]
[Tue Mar 31 04:17:23.017213 2026] [:error] [pid 18333:tid 18395] [client 20.166.54.109:1592] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdkfu.php"] [unique_id "acraU0Sx2C5hLR0-8dLI4QAAAFA"]
[Tue Mar 31 04:17:23.524159 2026] [:error] [pid 18333:tid 18385] [client 20.166.54.109:4537] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdkfu.php"] [unique_id "acraU0Sx2C5hLR0-8dLI5wAAAEY"]
[Tue Mar 31 04:17:24.023831 2026] [:error] [pid 18334:tid 18410] [client 20.166.54.109:7369] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/IcC7p.php"] [unique_id "acraVHqQrXLbk1cg3mgbQgAAAIQ"]
[Tue Mar 31 04:17:24.521634 2026] [:error] [pid 18439:tid 18468] [client 20.166.54.109:4527] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/IcC7p.php"] [unique_id "acraVC-R9nOaA8Xqs7iUEQAAANE"]
[Tue Mar 31 04:17:25.020493 2026] [:error] [pid 18439:tid 18466] [client 20.166.54.109:13264] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/IcC7p.php"] [unique_id "acraVS-R9nOaA8Xqs7iUFQAAAM8"]
[Tue Mar 31 04:17:25.518406 2026] [:error] [pid 18334:tid 18411] [client 20.166.54.109:13134] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/IcC7p.php"] [unique_id "acraVXqQrXLbk1cg3mgbTAAAAIU"]
[Tue Mar 31 04:17:26.016645 2026] [:error] [pid 18439:tid 18472] [client 20.166.54.109:2915] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "acraVi-R9nOaA8Xqs7iUIQAAANU"]
[Tue Mar 31 04:17:26.515109 2026] [:error] [pid 18439:tid 18467] [client 20.166.54.109:5243] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "acraVi-R9nOaA8Xqs7iUIwAAANA"]
[Tue Mar 31 04:17:27.011581 2026] [:error] [pid 18332:tid 18360] [client 20.166.54.109:9360] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "acraV74KXr1F9raS5GSC5gAAAAw"]
[Tue Mar 31 04:17:27.509199 2026] [:error] [pid 18333:tid 18392] [client 20.166.54.109:5234] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "acraV0Sx2C5hLR0-8dLI8gAAAE0"]
[Tue Mar 31 04:17:28.013942 2026] [:error] [pid 18333:tid 18390] [client 20.166.54.109:12106] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acraWESx2C5hLR0-8dLI8wAAAEs"]
[Tue Mar 31 04:17:28.519880 2026] [:error] [pid 18334:tid 18410] [client 20.166.54.109:1136] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acraWHqQrXLbk1cg3mgbXgAAAIQ"]
[Tue Mar 31 04:17:29.023409 2026] [:error] [pid 18332:tid 18369] [client 20.166.54.109:1572] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acraWb4KXr1F9raS5GSC7gAAABU"]
[Tue Mar 31 04:17:29.528384 2026] [:error] [pid 18332:tid 18353] [client 20.166.54.109:3877] [client 20.166.54.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acraWb4KXr1F9raS5GSC8QAAAAU"]
[Tue Mar 31 05:28:51.867487 2026] [:error] [pid 18439:tid 18455] [client 43.159.128.155:41440] [client 43.159.128.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acrrEy-R9nOaA8Xqs7jRNAAAAMQ"]
[Tue Mar 31 06:49:06.469541 2026] [:error] [pid 18333:tid 18384] [client 182.44.10.67:59818] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acr94kSx2C5hLR0-8dIdcAAAAEU"]
[Tue Mar 31 07:10:44.438526 2026] [:error] [pid 11907:tid 11913] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Tue Mar 31 07:10:44.673758 2026] [:error] [pid 11907:tid 11932] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/sw.php
[Tue Mar 31 07:10:44.909822 2026] [:error] [pid 11907:tid 11921] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/fsgdjkl.php
[Tue Mar 31 07:10:45.147087 2026] [:error] [pid 11907:tid 11930] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/ahutr.php
[Tue Mar 31 07:10:45.382011 2026] [:error] [pid 11907:tid 11925] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/y.php
[Tue Mar 31 07:10:45.619983 2026] [:error] [pid 11907:tid 11928] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Tue Mar 31 07:10:45.866849 2026] [:error] [pid 11907:tid 11912] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/abouta.php
[Tue Mar 31 07:10:46.101489 2026] [:error] [pid 11907:tid 11933] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/zfe.php
[Tue Mar 31 07:10:46.336267 2026] [:error] [pid 11907:tid 11931] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Tue Mar 31 07:10:46.571252 2026] [:error] [pid 11907:tid 11926] [client 72.146.12.161:30328] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Mar 31 07:10:46.803212 2026] [:error] [pid 11907:tid 11914] [client 72.146.12.161:30328] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asudo.php"] [unique_id "acsC9scoKGLZkBF4Ym1jtQAAAgQ"]
[Tue Mar 31 07:10:47.268688 2026] [:error] [pid 11822:tid 11834] [client 72.146.12.161:30288] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asudo.php"] [unique_id "acsC9yLLrL4a3YEM2I0UIwAAAYo"]
[Tue Mar 31 07:10:47.738343 2026] [:error] [pid 18334:tid 18416] [client 72.146.12.161:30322] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "acsC93qQrXLbk1cg3mhsqQAAAIo"]
[Tue Mar 31 07:10:48.207610 2026] [:error] [pid 11869:tid 11874] [client 72.146.12.161:30298] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acsC-BvAVplg9I6KoIIwPAAAAcI"]
[Tue Mar 31 07:10:48.677498 2026] [:error] [pid 11907:tid 11920] [client 72.146.12.161:30215] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acsC-McoKGLZkBF4Ym1juwAAAgo"]
[Tue Mar 31 07:10:49.144136 2026] [:error] [pid 11822:tid 11840] [client 72.146.12.161:30292] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acsC-SLLrL4a3YEM2I0UJQAAAZA"]
[Tue Mar 31 07:10:49.610577 2026] [:error] [pid 11869:tid 11895] [client 72.146.12.161:30307] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "acsC-RvAVplg9I6KoIIwPQAAAdc"]
[Tue Mar 31 07:10:50.080639 2026] [:error] [pid 11869:tid 11889] [client 72.146.12.161:30279] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acsC-hvAVplg9I6KoIIwPgAAAdE"]
[Tue Mar 31 07:10:50.550337 2026] [:error] [pid 11822:tid 11825] [client 72.146.12.161:30281] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "acsC-iLLrL4a3YEM2I0UJgAAAYE"]
[Tue Mar 31 07:10:51.017287 2026] [:error] [pid 18332:tid 18356] [client 72.146.12.161:30335] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "acsC-74KXr1F9raS5GSseAAAAAg"]
[Tue Mar 31 07:10:51.483332 2026] [:error] [pid 18332:tid 18362] [client 72.146.12.161:30222] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "acsC-74KXr1F9raS5GSseQAAAA4"]
[Tue Mar 31 07:10:51.951270 2026] [:error] [pid 1224:tid 1243] [client 72.146.12.161:30308] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acsC-8XGPQPzIHnCuJhTUwAAARE"]
[Tue Mar 31 07:10:52.421463 2026] [:error] [pid 11869:tid 11891] [client 72.146.12.161:30294] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acsC_BvAVplg9I6KoIIwQQAAAdM"]
[Tue Mar 31 07:10:52.887884 2026] [:error] [pid 11869:tid 11888] [client 72.146.12.161:30230] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acsC_BvAVplg9I6KoIIwQwAAAdA"]
[Tue Mar 31 07:10:53.374611 2026] [:error] [pid 11786:tid 11792] [client 72.146.12.161:30274] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acsC_U-ANHwuqDZumRDgEAAAAUQ"]
[Tue Mar 31 07:10:53.862155 2026] [:error] [pid 18333:tid 18402] [client 72.146.12.161:30148] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acsC_USx2C5hLR0-8dIqZgAAAFc"]
[Tue Mar 31 07:10:54.328847 2026] [:error] [pid 18333:tid 18397] [client 72.146.12.161:30312] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acsC_kSx2C5hLR0-8dIqagAAAFI"]
[Tue Mar 31 07:10:54.796053 2026] [:error] [pid 18333:tid 18403] [client 72.146.12.161:30331] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acsC_kSx2C5hLR0-8dIqbwAAAFg"]
[Tue Mar 31 07:10:55.263021 2026] [:error] [pid 18333:tid 18400] [client 72.146.12.161:30304] [client 72.146.12.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Jcrop.php"] [unique_id "acsC_0Sx2C5hLR0-8dIqdgAAAFU"]
[Tue Mar 31 10:16:44.164982 2026] [:error] [pid 36890:tid 36919] [client 43.133.66.51:33454] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acsujJ8FASPd_uH8z7dsJAAAABg"]
[Tue Mar 31 10:38:09.586213 2026] [:error] [pid 41421:tid 41425] [client 89.187.187.74:55456] [client 89.187.187.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.187.187.74, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "acszkRSaDjY9kKFtUQCjgAAAAQE"]
[Tue Mar 31 10:38:09.589754 2026] [:error] [pid 41421:tid 41425] [client 89.187.187.74:55456] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Mar 31 10:38:11.468434 2026] [:error] [pid 41421:tid 41426] [client 89.187.187.74:55456] [client 89.187.187.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "acszkxSaDjY9kKFtUQCjkAAAAQI"]
[Tue Mar 31 10:38:11.789618 2026] [:error] [pid 36982:tid 37006] [client 89.187.187.74:55462] [client 89.187.187.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "acszk_lMmeoQKN0r_GPaSQAAANU"]
[Tue Mar 31 10:38:12.114703 2026] [:error] [pid 36890:tid 36916] [client 89.187.187.74:55476] [client 89.187.187.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "acszlJ8FASPd_uH8z7d0PAAAABU"]
[Tue Mar 31 10:38:12.437642 2026] [:error] [pid 6548:tid 6567] [client 89.187.187.74:55478] [client 89.187.187.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "acszlLgIz9HgMl9YwE7KXQAAAVE"]
[Tue Mar 31 10:38:12.760371 2026] [:error] [pid 6548:tid 6570] [client 89.187.187.74:55488] [client 89.187.187.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "acszlLgIz9HgMl9YwE7KYAAAAVQ"]
[Tue Mar 31 10:38:13.085968 2026] [:error] [pid 36892:tid 36967] [client 89.187.187.74:55496] [client 89.187.187.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "acszlUyj9S4G0ek3O4LxAAAAAJA"]
[Tue Mar 31 10:38:13.408824 2026] [:error] [pid 36890:tid 36896] [client 89.187.187.74:55512] [client 89.187.187.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "acszlZ8FASPd_uH8z7d0PgAAAAE"]
[Tue Mar 31 13:06:52.314926 2026] [:error] [pid 36890:tid 36919] [client 221.229.106.25:36310] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "actWbJ8FASPd_uH8z7eqgwAAABg"]
[Tue Mar 31 15:44:00.888539 2026] [:error] [pid 6548:tid 6565] [client 192.227.231.190:58580] [client 192.227.231.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "act7QLgIz9HgMl9YwE6MlAAAAU8"], referer: https://www.google.com/search?q=admin+panel
[Tue Mar 31 17:58:29.076160 2026] [:error] [pid 36891:tid 36933] [client 192.227.231.190:55650] [client 192.227.231.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acuaxZJhiMaJUqoqfl62DwAAAEk"], referer: https://www.google.com/search?q=admin+panel
[Tue Mar 31 19:13:03.568849 2026] [:error] [pid 6548:tid 6556] [client 182.42.110.255:54909] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acusP7gIz9HgMl9YwE4WLwAAAUY"]
[Tue Mar 31 21:02:17.277326 2026] [:error] [pid 6548:tid 6564] [client 43.153.102.138:34006] [client 43.153.102.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acvF2bgIz9HgMl9YwE5blgAAAU4"]
[Tue Mar 31 23:37:07.698007 2026] [:error] [pid 41421:tid 41433] [client 43.153.71.12:39706] [client 43.153.71.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acvqIxSaDjY9kKFtUQDbMgAAAQk"]
[Wed Apr 01 01:51:42.597566 2026] [:error] [pid 52836:tid 52912] [client 43.131.26.226:36996] [client 43.131.26.226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acwJrpjk_YTY8bXnEz5K0AAAAFQ"]
[Wed Apr 01 03:35:39.554320 2026] [:error] [pid 45612:tid 45678] [client 20.203.130.156:62749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-Blogs.php
[Wed Apr 01 05:43:22.203491 2026] [:error] [pid 23715:tid 23771] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/fffff.php
[Wed Apr 01 05:43:22.444220 2026] [:error] [pid 23715:tid 23770] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/xdd.php
[Wed Apr 01 05:43:22.684147 2026] [:error] [pid 23715:tid 23776] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php
[Wed Apr 01 05:43:22.923262 2026] [:error] [pid 23715:tid 23785] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/wdone1.php
[Wed Apr 01 05:43:23.163431 2026] [:error] [pid 23715:tid 23766] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/ws79.php
[Wed Apr 01 05:43:23.404278 2026] [:error] [pid 23715:tid 23765] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Wed Apr 01 05:43:23.653922 2026] [:error] [pid 23715:tid 23780] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Wed Apr 01 05:43:23.903969 2026] [:error] [pid 23715:tid 23761] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Wed Apr 01 05:43:24.146860 2026] [:error] [pid 23715:tid 23768] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/wglum1.php
[Wed Apr 01 05:43:24.386599 2026] [:error] [pid 23715:tid 23782] [client 20.203.142.71:63454] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Wed Apr 01 05:43:24.622191 2026] [:error] [pid 23715:tid 23784] [client 20.203.142.71:63454] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "acw__K-REzOruNbiT9wuxwAAAFc"]
[Wed Apr 01 05:43:25.105023 2026] [:error] [pid 23819:tid 23833] [client 20.203.142.71:9679] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "acw__ddfUS_37wFAM77agAAAAMs"]
[Wed Apr 01 05:43:25.595677 2026] [:error] [pid 23715:tid 23767] [client 20.203.142.71:9603] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "acw__a-REzOruNbiT9wuyQAAAEY"]
[Wed Apr 01 05:43:26.100456 2026] [:error] [pid 23715:tid 23783] [client 20.203.142.71:49824] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "acw__q-REzOruNbiT9wuzAAAAFY"]
[Wed Apr 01 05:43:26.585103 2026] [:error] [pid 24348:tid 24383] [client 20.203.142.71:63539] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "acw__m0Vs69Y5nF1HA_DSgAAAYQ"]
[Wed Apr 01 05:43:27.118105 2026] [:error] [pid 23714:tid 23740] [client 20.203.142.71:9621] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "acw__0HxDDU2ETcG9DSp3wAAAAY"]
[Wed Apr 01 05:43:27.592116 2026] [:error] [pid 23819:tid 23825] [client 20.203.142.71:63468] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "acw__9dfUS_37wFAM77ahQAAAMM"]
[Wed Apr 01 05:43:28.072027 2026] [:error] [pid 23819:tid 23844] [client 20.203.142.71:9632] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "acxAANdfUS_37wFAM77aiQAAANY"]
[Wed Apr 01 05:43:28.583933 2026] [:error] [pid 23714:tid 23753] [client 20.203.142.71:63445] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acxAAEHxDDU2ETcG9DSp5QAAABM"]
[Wed Apr 01 05:43:29.075818 2026] [:error] [pid 23714:tid 23751] [client 20.203.142.71:9660] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acxAAUHxDDU2ETcG9DSp5wAAABE"]
[Wed Apr 01 05:43:29.590419 2026] [:error] [pid 23716:tid 23791] [client 20.203.142.71:63432] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acxAAXVtFUg_mx-RYb5dfAAAAIM"]
[Wed Apr 01 05:43:30.089307 2026] [:error] [pid 24314:tid 24341] [client 20.203.142.71:63501] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "acxAApRF3FCzjmMUX5bXkAAAARc"]
[Wed Apr 01 05:43:30.585244 2026] [:error] [pid 24348:tid 24400] [client 20.203.142.71:63524] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "acxAAm0Vs69Y5nF1HA_DUAAAAZU"]
[Wed Apr 01 05:43:31.076568 2026] [:error] [pid 24348:tid 24399] [client 20.203.142.71:63496] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "acxAA20Vs69Y5nF1HA_DVAAAAZQ"]
[Wed Apr 01 05:43:31.552585 2026] [:error] [pid 23715:tid 23784] [client 20.203.142.71:63475] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "acxAA6-REzOruNbiT9wu0QAAAFc"]
[Wed Apr 01 05:43:32.028105 2026] [:error] [pid 23715:tid 23783] [client 20.203.142.71:49834] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "acxABK-REzOruNbiT9wu1gAAAFY"]
[Wed Apr 01 05:43:32.508836 2026] [:error] [pid 23716:tid 23797] [client 20.203.142.71:49843] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acxABHVtFUg_mx-RYb5dgAAAAIk"]
[Wed Apr 01 05:43:32.980511 2026] [:error] [pid 23714:tid 23738] [client 20.203.142.71:9693] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acxABEHxDDU2ETcG9DSp6wAAAAQ"]
[Wed Apr 01 05:43:33.473881 2026] [:error] [pid 23716:tid 23801] [client 20.203.142.71:9682] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acxABXVtFUg_mx-RYb5dggAAAI0"]
[Wed Apr 01 05:43:33.982479 2026] [:error] [pid 23716:tid 23796] [client 20.203.142.71:63449] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "acxABXVtFUg_mx-RYb5dgwAAAIg"]
[Wed Apr 01 05:43:34.463403 2026] [:error] [pid 23715:tid 23780] [client 20.203.142.71:9719] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acxABq-REzOruNbiT9wu3AAAAFM"]
[Wed Apr 01 05:43:34.954242 2026] [:error] [pid 23714:tid 23736] [client 20.203.142.71:9676] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acxABkHxDDU2ETcG9DSp8AAAAAI"]
[Wed Apr 01 05:43:35.438556 2026] [:error] [pid 23715:tid 23774] [client 20.203.142.71:49841] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acxAB6-REzOruNbiT9wu5AAAAE0"]
[Wed Apr 01 05:43:35.919368 2026] [:error] [pid 23714:tid 23737] [client 20.203.142.71:63448] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "acxAB0HxDDU2ETcG9DSp8QAAAAM"]
[Wed Apr 01 05:43:36.390164 2026] [:error] [pid 24348:tid 24401] [client 20.203.142.71:49809] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acxACG0Vs69Y5nF1HA_DYAAAAZY"]
[Wed Apr 01 05:43:36.868015 2026] [:error] [pid 23714:tid 23752] [client 20.203.142.71:49807] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acxACEHxDDU2ETcG9DSp9AAAABI"]
[Wed Apr 01 05:43:37.357962 2026] [:error] [pid 23714:tid 23749] [client 20.203.142.71:9656] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acxACUHxDDU2ETcG9DSp-QAAAA8"]
[Wed Apr 01 05:43:37.837866 2026] [:error] [pid 23714:tid 23747] [client 20.203.142.71:63467] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "acxACUHxDDU2ETcG9DSp_AAAAA0"]
[Wed Apr 01 05:43:38.336321 2026] [:error] [pid 24346:tid 24353] [client 20.203.142.71:49850] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acxACrc1l8kg9MhGHIJ6AwAAAUE"]
[Wed Apr 01 05:43:38.809883 2026] [:error] [pid 24346:tid 24357] [client 20.203.142.71:9644] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acxACrc1l8kg9MhGHIJ6BQAAAUU"]
[Wed Apr 01 05:43:39.311502 2026] [:error] [pid 24314:tid 24342] [client 20.203.142.71:63471] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acxAC5RF3FCzjmMUX5bXkwAAARg"]
[Wed Apr 01 05:43:39.784023 2026] [:error] [pid 23714:tid 23755] [client 20.203.142.71:63518] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "acxAC0HxDDU2ETcG9DSqAwAAABU"]
[Wed Apr 01 05:43:40.265211 2026] [:error] [pid 24348:tid 24391] [client 20.203.142.71:53450] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "acxADG0Vs69Y5nF1HA_DYgAAAYw"]
[Wed Apr 01 05:43:40.738840 2026] [:error] [pid 24348:tid 24403] [client 20.203.142.71:63453] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "acxADG0Vs69Y5nF1HA_DZgAAAZg"]
[Wed Apr 01 05:43:41.209890 2026] [:error] [pid 23714:tid 23756] [client 20.203.142.71:49792] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "acxADUHxDDU2ETcG9DSqCwAAABY"]
[Wed Apr 01 05:43:41.707295 2026] [:error] [pid 23714:tid 23742] [client 20.203.142.71:9645] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "acxADUHxDDU2ETcG9DSqDQAAAAg"]
[Wed Apr 01 05:43:42.191749 2026] [:error] [pid 24314:tid 24318] [client 20.203.142.71:9670] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acxADpRF3FCzjmMUX5bXlwAAAQA"]
[Wed Apr 01 05:43:42.680319 2026] [:error] [pid 23715:tid 23771] [client 20.203.142.71:63506] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acxADq-REzOruNbiT9wu6gAAAEo"]
[Wed Apr 01 05:43:43.157508 2026] [:error] [pid 24314:tid 24320] [client 20.203.142.71:63546] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acxAD5RF3FCzjmMUX5bXmAAAAQI"]
[Wed Apr 01 05:43:43.658542 2026] [:error] [pid 24346:tid 24354] [client 20.203.142.71:9637] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "acxAD7c1l8kg9MhGHIJ6CQAAAUI"]
[Wed Apr 01 05:43:44.147561 2026] [:error] [pid 23716:tid 23802] [client 20.203.142.71:9721] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "acxAEHVtFUg_mx-RYb5dhgAAAI4"]
[Wed Apr 01 05:43:44.619005 2026] [:error] [pid 24348:tid 24401] [client 20.203.142.71:9711] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "acxAEG0Vs69Y5nF1HA_DbQAAAZY"]
[Wed Apr 01 05:43:45.092127 2026] [:error] [pid 24346:tid 24369] [client 20.203.142.71:9929] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "acxAEbc1l8kg9MhGHIJ6CgAAAVE"]
[Wed Apr 01 05:43:45.572012 2026] [:error] [pid 23714:tid 23735] [client 20.203.142.71:49835] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "acxAEUHxDDU2ETcG9DSqGQAAAAE"]
[Wed Apr 01 05:43:46.047088 2026] [:error] [pid 23714:tid 23753] [client 20.203.142.71:9724] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "acxAEkHxDDU2ETcG9DSqHAAAABM"]
[Wed Apr 01 05:43:46.553209 2026] [:error] [pid 24346:tid 24370] [client 20.203.142.71:63541] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "acxAErc1l8kg9MhGHIJ6DgAAAVI"]
[Wed Apr 01 05:43:47.052839 2026] [:error] [pid 24346:tid 24359] [client 20.203.142.71:9690] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "acxAE7c1l8kg9MhGHIJ6DwAAAUc"]
[Wed Apr 01 05:43:47.557610 2026] [:error] [pid 23714:tid 23752] [client 20.203.142.71:63456] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "acxAE0HxDDU2ETcG9DSqJAAAABI"]
[Wed Apr 01 05:43:48.034318 2026] [:error] [pid 23716:tid 23791] [client 20.203.142.71:16214] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acxAFHVtFUg_mx-RYb5diAAAAIM"]
[Wed Apr 01 05:43:48.507147 2026] [:error] [pid 24314:tid 24341] [client 20.203.142.71:9717] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acxAFJRF3FCzjmMUX5bXnQAAARc"]
[Wed Apr 01 05:43:48.979436 2026] [:error] [pid 24348:tid 24402] [client 20.203.142.71:62944] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acxAFG0Vs69Y5nF1HA_DdgAAAZc"]
[Wed Apr 01 05:43:49.451582 2026] [:error] [pid 23716:tid 23793] [client 20.203.142.71:9602] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "acxAFXVtFUg_mx-RYb5diwAAAIU"]
[Wed Apr 01 05:43:49.942432 2026] [:error] [pid 24348:tid 24400] [client 20.203.142.71:9714] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "acxAFW0Vs69Y5nF1HA_DeAAAAZU"]
[Wed Apr 01 05:43:50.424091 2026] [:error] [pid 24348:tid 24379] [client 20.203.142.71:9705] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "acxAFm0Vs69Y5nF1HA_DeQAAAYA"]
[Wed Apr 01 05:43:50.897292 2026] [:error] [pid 24348:tid 24392] [client 20.203.142.71:9948] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "acxAFm0Vs69Y5nF1HA_DegAAAY0"]
[Wed Apr 01 05:43:51.376518 2026] [:error] [pid 23819:tid 23846] [client 20.203.142.71:9607] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "acxAF9dfUS_37wFAM77aqQAAANg"]
[Wed Apr 01 05:43:51.895554 2026] [:error] [pid 24314:tid 24321] [client 20.203.142.71:63536] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acxAF5RF3FCzjmMUX5bXoAAAAQM"]
[Wed Apr 01 05:43:52.368584 2026] [:error] [pid 24348:tid 24391] [client 20.203.142.71:63519] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acxAGG0Vs69Y5nF1HA_DfQAAAYw"]
[Wed Apr 01 05:43:52.859762 2026] [:error] [pid 24346:tid 24376] [client 20.203.142.71:49798] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acxAGLc1l8kg9MhGHIJ6FQAAAVg"]
[Wed Apr 01 05:43:53.363439 2026] [:error] [pid 23715:tid 23779] [client 20.203.142.71:49800] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "acxAGa-REzOruNbiT9wu_QAAAFI"]
[Wed Apr 01 05:43:53.858134 2026] [:error] [pid 23714:tid 23739] [client 20.203.142.71:9646] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acxAGUHxDDU2ETcG9DSqMwAAAAU"]
[Wed Apr 01 05:43:54.329447 2026] [:error] [pid 23714:tid 23758] [client 20.203.142.71:9661] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acxAGkHxDDU2ETcG9DSqOAAAABg"]
[Wed Apr 01 05:43:54.806247 2026] [:error] [pid 23714:tid 23743] [client 20.203.142.71:63535] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acxAGkHxDDU2ETcG9DSqOwAAAAk"]
[Wed Apr 01 05:43:55.281206 2026] [:error] [pid 23714:tid 23748] [client 20.203.142.71:62953] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "acxAG0HxDDU2ETcG9DSqPwAAAA4"]
[Wed Apr 01 05:43:55.754296 2026] [:error] [pid 24346:tid 24362] [client 20.203.142.71:63470] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acxAG7c1l8kg9MhGHIJ6FwAAAUo"]
[Wed Apr 01 05:43:56.231028 2026] [:error] [pid 24346:tid 24366] [client 20.203.142.71:9631] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acxAHLc1l8kg9MhGHIJ6GQAAAU4"]
[Wed Apr 01 05:43:56.705897 2026] [:error] [pid 23715:tid 23769] [client 20.203.142.71:63438] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acxAHK-REzOruNbiT9wvAgAAAEg"]
[Wed Apr 01 05:43:57.182463 2026] [:error] [pid 24346:tid 24369] [client 20.203.142.71:63440] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "acxAHbc1l8kg9MhGHIJ6GgAAAVE"]
[Wed Apr 01 05:43:57.656905 2026] [:error] [pid 24348:tid 24390] [client 20.203.142.71:63476] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acxAHW0Vs69Y5nF1HA_DgAAAAYs"]
[Wed Apr 01 05:43:58.182342 2026] [:error] [pid 23714:tid 23744] [client 20.203.142.71:63521] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acxAHkHxDDU2ETcG9DSqRwAAAAo"]
[Wed Apr 01 05:43:58.694991 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:9609] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acxAHkHxDDU2ETcG9DSqSQAAAAA"]
[Wed Apr 01 05:43:59.177692 2026] [:error] [pid 23714:tid 23752] [client 20.203.142.71:49853] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "acxAH0HxDDU2ETcG9DSqSwAAABI"]
[Wed Apr 01 05:43:59.660418 2026] [:error] [pid 23714:tid 23735] [client 20.203.142.71:62972] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acxAH0HxDDU2ETcG9DSqTgAAAAE"]
[Wed Apr 01 05:44:00.150523 2026] [:error] [pid 23819:tid 23830] [client 20.203.142.71:53443] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acxAINdfUS_37wFAM77atgAAAMg"]
[Wed Apr 01 05:44:00.626301 2026] [:error] [pid 23714:tid 23737] [client 20.203.142.71:53482] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acxAIEHxDDU2ETcG9DSqUgAAAAM"]
[Wed Apr 01 05:44:01.188933 2026] [:error] [pid 24346:tid 24372] [client 20.203.142.71:9610] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acxAIbc1l8kg9MhGHIJ6HwAAAVQ"]
[Wed Apr 01 05:44:01.667279 2026] [:error] [pid 23819:tid 23843] [client 20.203.142.71:16203] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acxAIddfUS_37wFAM77auQAAANU"]
[Wed Apr 01 05:44:02.192737 2026] [:error] [pid 24348:tid 24387] [client 20.203.142.71:9628] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acxAIm0Vs69Y5nF1HA_DigAAAYg"]
[Wed Apr 01 05:44:02.673157 2026] [:error] [pid 24346:tid 24367] [client 20.203.142.71:16239] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acxAIrc1l8kg9MhGHIJ6IAAAAU8"]
[Wed Apr 01 05:44:03.149242 2026] [:error] [pid 23715:tid 23764] [client 20.203.142.71:63442] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "acxAI6-REzOruNbiT9wvCAAAAEM"]
[Wed Apr 01 05:44:03.622292 2026] [:error] [pid 23715:tid 23780] [client 20.203.142.71:63435] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acxAI6-REzOruNbiT9wvCwAAAFM"]
[Wed Apr 01 05:44:04.106646 2026] [:error] [pid 24348:tid 24395] [client 20.203.142.71:49801] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acxAJG0Vs69Y5nF1HA_DjAAAAZA"]
[Wed Apr 01 05:44:04.582913 2026] [:error] [pid 24346:tid 24364] [client 20.203.142.71:9600] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acxAJLc1l8kg9MhGHIJ6JAAAAUw"]
[Wed Apr 01 05:44:05.077974 2026] [:error] [pid 23716:tid 23789] [client 20.203.142.71:49837] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "acxAJXVtFUg_mx-RYb5djgAAAIE"]
[Wed Apr 01 05:44:05.549956 2026] [:error] [pid 24314:tid 24325] [client 20.203.142.71:9657] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acxAJZRF3FCzjmMUX5bXsgAAAQc"]
[Wed Apr 01 05:44:06.048879 2026] [:error] [pid 24314:tid 24339] [client 20.203.142.71:9933] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acxAJpRF3FCzjmMUX5bXswAAARU"]
[Wed Apr 01 05:44:06.542770 2026] [:error] [pid 23714:tid 23739] [client 20.203.142.71:16241] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acxAJkHxDDU2ETcG9DSqWgAAAAU"]
[Wed Apr 01 05:44:07.049709 2026] [:error] [pid 23714:tid 23740] [client 20.203.142.71:9936] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "acxAJ0HxDDU2ETcG9DSqXQAAAAY"]
[Wed Apr 01 05:44:07.525182 2026] [:error] [pid 23714:tid 23758] [client 20.203.142.71:63472] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "acxAJ0HxDDU2ETcG9DSqYwAAABg"]
[Wed Apr 01 05:44:08.017564 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:9633] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "acxAKEHxDDU2ETcG9DSqZQAAAAA"]
[Wed Apr 01 05:44:08.572380 2026] [:error] [pid 23715:tid 23782] [client 20.203.142.71:9642] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "acxAKK-REzOruNbiT9wvDwAAAFU"]
[Wed Apr 01 05:44:09.072472 2026] [:error] [pid 23714:tid 23752] [client 20.203.142.71:9931] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "acxAKUHxDDU2ETcG9DSqaQAAABI"]
[Wed Apr 01 05:44:09.549034 2026] [:error] [pid 24348:tid 24386] [client 20.203.142.71:63485] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "acxAKW0Vs69Y5nF1HA_DkAAAAYc"]
[Wed Apr 01 05:44:10.023951 2026] [:error] [pid 23714:tid 23753] [client 20.203.142.71:9692] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "acxAKkHxDDU2ETcG9DSqbQAAABM"]
[Wed Apr 01 05:44:10.518053 2026] [:error] [pid 23714:tid 23746] [client 20.203.142.71:63551] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "acxAKkHxDDU2ETcG9DSqcgAAAAw"]
[Wed Apr 01 05:44:10.995619 2026] [:error] [pid 23714:tid 23748] [client 20.203.142.71:63474] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "acxAKkHxDDU2ETcG9DSqdQAAAA4"]
[Wed Apr 01 05:44:11.470200 2026] [:error] [pid 23714:tid 23753] [client 20.203.142.71:63511] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uang.php"] [unique_id "acxAK0HxDDU2ETcG9DSqeAAAABM"]
[Wed Apr 01 05:44:11.948025 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:9940] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uang.php"] [unique_id "acxAK0HxDDU2ETcG9DSqeQAAAAA"]
[Wed Apr 01 05:44:12.456337 2026] [:error] [pid 23714:tid 23752] [client 20.203.142.71:9605] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uang.php"] [unique_id "acxALEHxDDU2ETcG9DSqgQAAABI"]
[Wed Apr 01 05:44:12.944418 2026] [:error] [pid 24348:tid 24394] [client 20.203.142.71:9650] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uang.php"] [unique_id "acxALG0Vs69Y5nF1HA_DkQAAAY8"]
[Wed Apr 01 05:44:13.420961 2026] [:error] [pid 23714:tid 23745] [client 20.203.142.71:49797] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acxALUHxDDU2ETcG9DSqgwAAAAs"]
[Wed Apr 01 05:44:13.894322 2026] [:error] [pid 24348:tid 24387] [client 20.203.142.71:62932] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acxALW0Vs69Y5nF1HA_DlQAAAYg"]
[Wed Apr 01 05:44:14.373251 2026] [:error] [pid 23714:tid 23738] [client 20.203.142.71:16236] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acxALkHxDDU2ETcG9DSqiAAAAAQ"]
[Wed Apr 01 05:44:14.856539 2026] [:error] [pid 23819:tid 23829] [client 20.203.142.71:62918] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/save.php"] [unique_id "acxALtdfUS_37wFAM77azQAAAMc"]
[Wed Apr 01 05:44:15.371367 2026] [:error] [pid 24346:tid 24359] [client 20.203.142.71:49811] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acxAL7c1l8kg9MhGHIJ6KQAAAUc"]
[Wed Apr 01 05:44:15.842743 2026] [:error] [pid 24346:tid 24372] [client 20.203.142.71:9649] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acxAL7c1l8kg9MhGHIJ6LQAAAVQ"]
[Wed Apr 01 05:44:16.407290 2026] [:error] [pid 24346:tid 24367] [client 20.203.142.71:9922] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acxAMLc1l8kg9MhGHIJ6LgAAAU8"]
[Wed Apr 01 05:44:16.950052 2026] [:error] [pid 24348:tid 24389] [client 20.203.142.71:16192] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "acxAMG0Vs69Y5nF1HA_DlwAAAYo"]
[Wed Apr 01 05:44:17.422897 2026] [:error] [pid 23714:tid 23736] [client 20.203.142.71:10189] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "acxAMUHxDDU2ETcG9DSqkgAAAAI"]
[Wed Apr 01 05:44:17.910993 2026] [:error] [pid 23714:tid 23751] [client 20.203.142.71:63463] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "acxAMUHxDDU2ETcG9DSqlgAAABE"]
[Wed Apr 01 05:44:18.517165 2026] [:error] [pid 23714:tid 23741] [client 20.203.142.71:63509] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "acxAMkHxDDU2ETcG9DSqngAAAAc"]
[Wed Apr 01 05:44:19.096615 2026] [:error] [pid 23715:tid 23766] [client 20.203.142.71:9641] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "acxAM6-REzOruNbiT9wvEQAAAEU"]
[Wed Apr 01 05:44:19.578194 2026] [:error] [pid 23714:tid 23749] [client 20.203.142.71:49823] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "acxAM0HxDDU2ETcG9DSqoAAAAA8"]
[Wed Apr 01 05:44:20.097718 2026] [:error] [pid 23714:tid 23751] [client 20.203.142.71:63464] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "acxANEHxDDU2ETcG9DSqpAAAABE"]
[Wed Apr 01 05:44:20.614167 2026] [:error] [pid 24348:tid 24395] [client 20.203.142.71:63526] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "acxANG0Vs69Y5nF1HA_DmAAAAZA"]
[Wed Apr 01 05:44:21.090094 2026] [:error] [pid 23714:tid 23742] [client 20.203.142.71:63434] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "acxANUHxDDU2ETcG9DSqpwAAAAg"]
[Wed Apr 01 05:44:21.659424 2026] [:error] [pid 23819:tid 23841] [client 20.203.142.71:63548] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "acxANddfUS_37wFAM77a1AAAANM"]
[Wed Apr 01 05:44:22.239083 2026] [:error] [pid 23715:tid 23762] [client 20.203.142.71:49831] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "acxANq-REzOruNbiT9wvFgAAAEE"]
[Wed Apr 01 05:44:22.760493 2026] [:error] [pid 23715:tid 23776] [client 20.203.142.71:9663] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "acxANq-REzOruNbiT9wvGgAAAE8"]
[Wed Apr 01 05:44:23.239470 2026] [:error] [pid 24314:tid 24336] [client 20.203.142.71:9626] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "acxAN5RF3FCzjmMUX5bXwQAAARI"]
[Wed Apr 01 05:44:23.773208 2026] [:error] [pid 24314:tid 24328] [client 20.203.142.71:9708] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "acxAN5RF3FCzjmMUX5bXwwAAAQo"]
[Wed Apr 01 05:44:24.364437 2026] [:error] [pid 23714:tid 23756] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Apr 01 05:44:24.666369 2026] [:error] [pid 23714:tid 23735] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Wed Apr 01 05:44:24.950806 2026] [:error] [pid 23714:tid 23739] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Wed Apr 01 05:44:25.231872 2026] [:error] [pid 23714:tid 23748] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/sweg.php
[Wed Apr 01 05:44:25.472169 2026] [:error] [pid 23714:tid 23737] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Wed Apr 01 05:44:25.765150 2026] [:error] [pid 23714:tid 23747] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/ws40.php
[Wed Apr 01 05:44:26.004955 2026] [:error] [pid 23714:tid 23757] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Wed Apr 01 05:44:26.246821 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/awh.php
[Wed Apr 01 05:44:26.488342 2026] [:error] [pid 23714:tid 23752] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/shellerr.php
[Wed Apr 01 05:44:26.771418 2026] [:error] [pid 23714:tid 23753] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-scanner.php
[Wed Apr 01 05:44:27.012642 2026] [:error] [pid 23714:tid 23758] [client 20.203.142.71:62941] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Wed Apr 01 05:44:27.249740 2026] [:error] [pid 23714:tid 23743] [client 20.203.142.71:62941] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "acxAO0HxDDU2ETcG9DSqxQAAAAk"]
[Wed Apr 01 05:44:27.817796 2026] [:error] [pid 23716:tid 23794] [client 20.203.142.71:9613] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "acxAO3VtFUg_mx-RYb5dlQAAAIY"]
[Wed Apr 01 05:44:28.546821 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:63444] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "acxAPEHxDDU2ETcG9DSqzAAAAAA"]
[Wed Apr 01 05:44:29.108835 2026] [:error] [pid 23819:tid 23843] [client 20.203.142.71:63514] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "acxAPddfUS_37wFAM77a3gAAANU"]
[Wed Apr 01 05:44:29.619338 2026] [:error] [pid 23715:tid 23780] [client 20.203.142.71:63428] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acxAPa-REzOruNbiT9wvHwAAAFM"]
[Wed Apr 01 05:44:30.132404 2026] [:error] [pid 24346:tid 24359] [client 20.203.142.71:9713] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acxAPrc1l8kg9MhGHIJ6NQAAAUc"]
[Wed Apr 01 05:44:30.613484 2026] [:error] [pid 23819:tid 23835] [client 20.203.142.71:10182] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acxAPtdfUS_37wFAM77a4QAAAM0"]
[Wed Apr 01 05:44:31.206011 2026] [:error] [pid 24346:tid 24354] [client 20.203.142.71:9964] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "acxAP7c1l8kg9MhGHIJ6NwAAAUI"]
[Wed Apr 01 05:44:31.711439 2026] [:error] [pid 23714:tid 23737] [client 20.203.142.71:16251] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "acxAP0HxDDU2ETcG9DSq1AAAAAM"]
[Wed Apr 01 05:44:32.245356 2026] [:error] [pid 23714:tid 23747] [client 20.203.142.71:9725] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "acxAQEHxDDU2ETcG9DSq2AAAAA0"]
[Wed Apr 01 05:44:32.742738 2026] [:error] [pid 23714:tid 23757] [client 20.203.142.71:9698] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "acxAQEHxDDU2ETcG9DSq2wAAABc"]
[Wed Apr 01 05:44:33.224281 2026] [:error] [pid 24346:tid 24358] [client 20.203.142.71:9630] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "acxAQbc1l8kg9MhGHIJ6OQAAAUY"]
[Wed Apr 01 05:44:33.702346 2026] [:error] [pid 23714:tid 23755] [client 20.203.142.71:16218] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acxAQUHxDDU2ETcG9DSq3wAAABU"]
[Wed Apr 01 05:44:34.206927 2026] [:error] [pid 23714:tid 23758] [client 20.203.142.71:9638] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acxAQkHxDDU2ETcG9DSq4AAAABg"]
[Wed Apr 01 05:44:34.730507 2026] [:error] [pid 23716:tid 23805] [client 20.203.142.71:9664] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acxAQnVtFUg_mx-RYb5dmwAAAJE"]
[Wed Apr 01 05:44:35.245424 2026] [:error] [pid 23714:tid 23746] [client 20.203.142.71:63458] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "acxAQ0HxDDU2ETcG9DSq4wAAAAw"]
[Wed Apr 01 05:44:35.738340 2026] [:error] [pid 23714:tid 23744] [client 20.203.142.71:49825] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acxAQ0HxDDU2ETcG9DSq5AAAAAo"]
[Wed Apr 01 05:44:36.214168 2026] [:error] [pid 24314:tid 24330] [client 20.203.142.71:63480] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acxARJRF3FCzjmMUX5bXyQAAAQw"]
[Wed Apr 01 05:44:36.697670 2026] [:error] [pid 24314:tid 24322] [client 20.203.142.71:49851] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acxARJRF3FCzjmMUX5bXygAAAQQ"]
[Wed Apr 01 05:44:37.237705 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:9723] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "acxARUHxDDU2ETcG9DSq6AAAAAA"]
[Wed Apr 01 05:44:37.711488 2026] [:error] [pid 24314:tid 24334] [client 20.203.142.71:63466] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acxARZRF3FCzjmMUX5bXzQAAARA"]
[Wed Apr 01 05:44:38.249630 2026] [:error] [pid 23715:tid 23783] [client 20.203.142.71:9965] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acxARq-REzOruNbiT9wvJgAAAFY"]
[Wed Apr 01 05:44:38.776627 2026] [:error] [pid 24348:tid 24398] [client 20.203.142.71:63462] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acxARm0Vs69Y5nF1HA_DqgAAAZM"]
[Wed Apr 01 05:44:39.267836 2026] [:error] [pid 24346:tid 24363] [client 20.203.142.71:63479] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "acxAR7c1l8kg9MhGHIJ6OgAAAUs"]
[Wed Apr 01 05:44:39.744558 2026] [:error] [pid 23715:tid 23766] [client 20.203.142.71:63425] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "acxAR6-REzOruNbiT9wvKwAAAEU"]
[Wed Apr 01 05:44:40.352969 2026] [:error] [pid 23715:tid 23764] [client 20.203.142.71:9620] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "acxASK-REzOruNbiT9wvLQAAAEM"]
[Wed Apr 01 05:44:40.935081 2026] [:error] [pid 23715:tid 23770] [client 20.203.142.71:16220] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "acxASK-REzOruNbiT9wvMAAAAEk"]
[Wed Apr 01 05:44:41.416653 2026] [:error] [pid 24346:tid 24368] [client 20.203.142.71:9612] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "acxASbc1l8kg9MhGHIJ6PAAAAVA"]
[Wed Apr 01 05:44:41.932089 2026] [:error] [pid 23715:tid 23777] [client 20.203.142.71:9679] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "acxASa-REzOruNbiT9wvNQAAAFA"]
[Wed Apr 01 05:44:42.411849 2026] [:error] [pid 24348:tid 24379] [client 20.203.142.71:53490] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "acxASm0Vs69Y5nF1HA_DrgAAAYA"]
[Wed Apr 01 05:44:42.888501 2026] [:error] [pid 23819:tid 23829] [client 20.203.142.71:9616] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "acxAStdfUS_37wFAM77a8wAAAMc"]
[Wed Apr 01 05:44:43.366446 2026] [:error] [pid 24348:tid 24396] [client 20.203.142.71:16233] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "acxAS20Vs69Y5nF1HA_DswAAAZE"]
[Wed Apr 01 05:44:43.861091 2026] [:error] [pid 24314:tid 24342] [client 20.203.142.71:49828] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "acxAS5RF3FCzjmMUX5bX0QAAARg"]
[Wed Apr 01 05:44:44.377599 2026] [:error] [pid 23716:tid 23799] [client 20.203.142.71:9726] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "acxATHVtFUg_mx-RYb5dogAAAIs"]
[Wed Apr 01 05:44:44.876703 2026] [:error] [pid 24314:tid 24326] [client 20.203.142.71:9703] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "acxATJRF3FCzjmMUX5bX0gAAAQg"]
[Wed Apr 01 05:44:45.428741 2026] [:error] [pid 23715:tid 23779] [client 20.203.142.71:9689] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "acxATa-REzOruNbiT9wvPQAAAFI"]
[Wed Apr 01 05:44:45.996758 2026] [:error] [pid 24346:tid 24370] [client 20.203.142.71:9697] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acxATbc1l8kg9MhGHIJ6QwAAAVI"]
[Wed Apr 01 05:44:46.513387 2026] [:error] [pid 23715:tid 23767] [client 20.203.142.71:9707] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acxATq-REzOruNbiT9wvRAAAAEY"]
[Wed Apr 01 05:44:46.986689 2026] [:error] [pid 24346:tid 24375] [client 20.203.142.71:63477] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acxATrc1l8kg9MhGHIJ6RwAAAVc"]
[Wed Apr 01 05:44:47.893541 2026] [:error] [pid 24346:tid 24358] [client 20.203.142.71:62949] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "acxAT7c1l8kg9MhGHIJ6SQAAAUY"]
[Wed Apr 01 05:44:48.491662 2026] [:error] [pid 24346:tid 24368] [client 20.203.142.71:9625] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acxAULc1l8kg9MhGHIJ6TAAAAVA"]
[Wed Apr 01 05:44:48.966669 2026] [:error] [pid 24346:tid 24360] [client 20.203.142.71:9601] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acxAULc1l8kg9MhGHIJ6TQAAAUg"]
[Wed Apr 01 05:44:49.558179 2026] [:error] [pid 24346:tid 24356] [client 20.203.142.71:16194] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acxAUbc1l8kg9MhGHIJ6TgAAAUQ"]
[Wed Apr 01 05:44:50.206241 2026] [:error] [pid 24348:tid 24394] [client 20.203.142.71:9716] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "acxAUm0Vs69Y5nF1HA_DuQAAAY8"]
[Wed Apr 01 05:44:50.685409 2026] [:error] [pid 23819:tid 23831] [client 20.203.142.71:9684] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acxAUtdfUS_37wFAM77bAAAAAMk"]
[Wed Apr 01 05:44:51.219251 2026] [:error] [pid 24314:tid 24330] [client 20.203.142.71:16226] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acxAU5RF3FCzjmMUX5bX1gAAAQw"]
[Wed Apr 01 05:44:51.744830 2026] [:error] [pid 23715:tid 23763] [client 20.203.142.71:9926] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acxAU6-REzOruNbiT9wvUgAAAEI"]
[Wed Apr 01 05:44:52.228980 2026] [:error] [pid 23715:tid 23785] [client 20.203.142.71:63426] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "acxAVK-REzOruNbiT9wvVwAAAFg"]
[Wed Apr 01 05:44:52.777903 2026] [:error] [pid 24346:tid 24373] [client 20.203.142.71:9647] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acxAVLc1l8kg9MhGHIJ6UwAAAVU"]
[Wed Apr 01 05:44:53.314342 2026] [:error] [pid 24346:tid 24352] [client 20.203.142.71:16212] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acxAVbc1l8kg9MhGHIJ6VgAAAUA"]
[Wed Apr 01 05:44:53.809353 2026] [:error] [pid 24314:tid 24336] [client 20.203.142.71:63542] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acxAVZRF3FCzjmMUX5bX3AAAARI"]
[Wed Apr 01 05:44:54.308819 2026] [:error] [pid 24348:tid 24387] [client 20.203.142.71:16202] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "acxAVm0Vs69Y5nF1HA_DwAAAAYg"]
[Wed Apr 01 05:44:54.783010 2026] [:error] [pid 24348:tid 24388] [client 20.203.142.71:63529] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acxAVm0Vs69Y5nF1HA_DwgAAAYk"]
[Wed Apr 01 05:44:55.279810 2026] [:error] [pid 24348:tid 24393] [client 20.203.142.71:63465] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acxAV20Vs69Y5nF1HA_DxwAAAY4"]
[Wed Apr 01 05:44:55.842837 2026] [:error] [pid 24348:tid 24390] [client 20.203.142.71:9938] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acxAV20Vs69Y5nF1HA_DyQAAAYs"]
[Wed Apr 01 05:44:56.346761 2026] [:error] [pid 23714:tid 23747] [client 20.203.142.71:63455] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "acxAWEHxDDU2ETcG9DSq8wAAAA0"]
[Wed Apr 01 05:44:56.835800 2026] [:error] [pid 23714:tid 23755] [client 20.203.142.71:49854] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acxAWEHxDDU2ETcG9DSq9wAAABU"]
[Wed Apr 01 05:44:57.345451 2026] [:error] [pid 23714:tid 23758] [client 20.203.142.71:9695] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acxAWUHxDDU2ETcG9DSq-wAAABg"]
[Wed Apr 01 05:44:57.884693 2026] [:error] [pid 23714:tid 23737] [client 20.203.142.71:62929] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acxAWUHxDDU2ETcG9DSq_QAAAAM"]
[Wed Apr 01 05:44:58.380047 2026] [:error] [pid 23714:tid 23739] [client 20.203.142.71:10213] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "acxAWkHxDDU2ETcG9DSrAAAAAAU"]
[Wed Apr 01 05:44:58.936302 2026] [:error] [pid 23819:tid 23841] [client 20.203.142.71:49846] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "acxAWtdfUS_37wFAM77bCgAAANM"]
[Wed Apr 01 05:44:59.419168 2026] [:error] [pid 23715:tid 23777] [client 20.203.142.71:49816] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "acxAW6-REzOruNbiT9wvZAAAAFA"]
[Wed Apr 01 05:44:59.923320 2026] [:error] [pid 23714:tid 23736] [client 20.203.142.71:60800] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "acxAW0HxDDU2ETcG9DSrBQAAAAI"]
[Wed Apr 01 05:45:00.418945 2026] [:error] [pid 23714:tid 23735] [client 20.203.142.71:9622] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "acxAXEHxDDU2ETcG9DSrCAAAAAE"]
[Wed Apr 01 05:45:00.946451 2026] [:error] [pid 23714:tid 23738] [client 20.203.142.71:60860] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acxAXEHxDDU2ETcG9DSrCwAAAAQ"]
[Wed Apr 01 05:45:01.423421 2026] [:error] [pid 23714:tid 23739] [client 20.203.142.71:63505] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acxAXUHxDDU2ETcG9DSrEAAAAAU"]
[Wed Apr 01 05:45:01.975629 2026] [:error] [pid 24346:tid 24368] [client 20.203.142.71:9677] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acxAXbc1l8kg9MhGHIJ6WgAAAVA"]
[Wed Apr 01 05:45:02.458405 2026] [:error] [pid 24348:tid 24395] [client 20.203.142.71:63538] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b.php"] [unique_id "acxAXm0Vs69Y5nF1HA_D0QAAAZA"]
[Wed Apr 01 05:45:02.957202 2026] [:error] [pid 24346:tid 24371] [client 20.203.142.71:9932] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acxAXrc1l8kg9MhGHIJ6XQAAAVM"]
[Wed Apr 01 05:45:03.434173 2026] [:error] [pid 24346:tid 24366] [client 20.203.142.71:9955] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acxAX7c1l8kg9MhGHIJ6XwAAAU4"]
[Wed Apr 01 05:45:03.915836 2026] [:error] [pid 24346:tid 24365] [client 20.203.142.71:48404] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acxAX7c1l8kg9MhGHIJ6YgAAAU0"]
[Wed Apr 01 05:45:04.398813 2026] [:error] [pid 24346:tid 24355] [client 20.203.142.71:63488] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vaza.php"] [unique_id "acxAYLc1l8kg9MhGHIJ6ZAAAAUM"]
[Wed Apr 01 05:45:04.925069 2026] [:error] [pid 24314:tid 24322] [client 20.203.142.71:9627] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "acxAYJRF3FCzjmMUX5bX5AAAAQQ"]
[Wed Apr 01 05:45:05.422060 2026] [:error] [pid 24314:tid 24332] [client 20.203.142.71:63497] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "acxAYZRF3FCzjmMUX5bX5QAAAQ4"]
[Wed Apr 01 05:45:05.902191 2026] [:error] [pid 23716:tid 23800] [client 20.203.142.71:9617] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "acxAYXVtFUg_mx-RYb5drgAAAIw"]
[Wed Apr 01 05:45:06.396949 2026] [:error] [pid 23715:tid 23761] [client 20.203.142.71:62968] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "acxAYq-REzOruNbiT9wvbQAAAEA"]
[Wed Apr 01 05:45:06.898643 2026] [:error] [pid 23714:tid 23745] [client 20.203.142.71:49832] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxAYkHxDDU2ETcG9DSrHAAAAAs"]
[Wed Apr 01 05:45:07.384048 2026] [:error] [pid 23715:tid 23764] [client 20.203.142.71:9678] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxAY6-REzOruNbiT9wvdQAAAEM"]
[Wed Apr 01 05:45:07.864891 2026] [:error] [pid 23715:tid 23782] [client 20.203.142.71:63540] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxAY6-REzOruNbiT9wvegAAAFU"]
[Wed Apr 01 05:45:08.364597 2026] [:error] [pid 24346:tid 24374] [client 20.203.142.71:9949] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxAZLc1l8kg9MhGHIJ6aQAAAVY"]
[Wed Apr 01 05:45:08.898356 2026] [:error] [pid 23716:tid 23806] [client 20.203.142.71:49822] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "acxAZHVtFUg_mx-RYb5dsAAAAJI"]
[Wed Apr 01 05:45:09.471480 2026] [:error] [pid 23715:tid 23763] [client 20.203.142.71:16195] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "acxAZa-REzOruNbiT9wvhAAAAEI"]
[Wed Apr 01 05:45:09.989016 2026] [:error] [pid 23715:tid 23773] [client 20.203.142.71:9648] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "acxAZa-REzOruNbiT9wvigAAAEw"]
[Wed Apr 01 05:45:10.777338 2026] [:error] [pid 24314:tid 24321] [client 20.203.142.71:10201] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "acxAZpRF3FCzjmMUX5bX6QAAAQM"]
[Wed Apr 01 05:45:11.271281 2026] [:error] [pid 23819:tid 23830] [client 20.203.142.71:53454] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acxAZ9dfUS_37wFAM77bDgAAAMg"]
[Wed Apr 01 05:45:11.924971 2026] [:error] [pid 24348:tid 24403] [client 20.203.142.71:9956] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acxAZ20Vs69Y5nF1HA_D4AAAAZg"]
[Wed Apr 01 05:45:12.415787 2026] [:error] [pid 23714:tid 23758] [client 20.203.142.71:9680] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acxAaEHxDDU2ETcG9DSrJAAAABg"]
[Wed Apr 01 05:45:13.119680 2026] [:error] [pid 23819:tid 23842] [client 20.203.142.71:53479] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "acxAaddfUS_37wFAM77bEQAAANQ"]
[Wed Apr 01 05:45:13.677547 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:63436] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "acxAaUHxDDU2ETcG9DSrKQAAAAA"]
[Wed Apr 01 05:45:14.213250 2026] [:error] [pid 23714:tid 23742] [client 20.203.142.71:9709] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "acxAakHxDDU2ETcG9DSrLgAAAAg"]
[Wed Apr 01 05:45:14.754761 2026] [:error] [pid 24348:tid 24390] [client 20.203.142.71:63527] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "acxAam0Vs69Y5nF1HA_D5QAAAYs"]
[Wed Apr 01 05:45:15.505228 2026] [:error] [pid 24348:tid 24384] [client 20.203.142.71:63491] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "acxAa20Vs69Y5nF1HA_D7AAAAYU"]
[Wed Apr 01 05:45:16.940091 2026] [:error] [pid 24346:tid 24361] [client 20.203.142.71:9694] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acxAbLc1l8kg9MhGHIJ6dgAAAUk"]
[Wed Apr 01 05:45:18.952983 2026] [:error] [pid 23715:tid 23766] [client 20.203.142.71:9675] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acxAbq-REzOruNbiT9wvqQAAAEU"]
[Wed Apr 01 05:45:20.907304 2026] [:error] [pid 23716:tid 23804] [client 20.203.142.71:63547] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acxAcHVtFUg_mx-RYb5duAAAAJA"]
[Wed Apr 01 05:45:22.388491 2026] [:error] [pid 24314:tid 24328] [client 20.203.142.71:63500] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "acxAcpRF3FCzjmMUX5bX8AAAAQo"]
[Wed Apr 01 05:45:23.766046 2026] [:error] [pid 23715:tid 23766] [client 20.203.142.71:9973] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp3.php"] [unique_id "acxAc6-REzOruNbiT9wvtAAAAEU"]
[Wed Apr 01 05:45:25.407306 2026] [:error] [pid 23714:tid 23735] [client 20.203.142.71:63430] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp3.php"] [unique_id "acxAdUHxDDU2ETcG9DSrSQAAAAE"]
[Wed Apr 01 05:45:26.593348 2026] [:error] [pid 24314:tid 24340] [client 20.203.142.71:10224] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp3.php"] [unique_id "acxAdpRF3FCzjmMUX5bX8gAAARY"]
[Wed Apr 01 05:45:27.675606 2026] [:error] [pid 23716:tid 23810] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/wp3.php
[Wed Apr 01 05:45:27.914184 2026] [:error] [pid 23716:tid 23803] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Wed Apr 01 05:45:28.152322 2026] [:error] [pid 23716:tid 23806] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/v.php
[Wed Apr 01 05:45:28.404185 2026] [:error] [pid 23716:tid 23790] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/d2.php
[Wed Apr 01 05:45:28.645323 2026] [:error] [pid 23716:tid 23799] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/xc.php
[Wed Apr 01 05:45:28.886015 2026] [:error] [pid 23716:tid 23795] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Wed Apr 01 05:45:29.131822 2026] [:error] [pid 23716:tid 23794] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/gmo.php
[Wed Apr 01 05:45:29.405869 2026] [:error] [pid 23716:tid 23798] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Wed Apr 01 05:45:29.656085 2026] [:error] [pid 23716:tid 23804] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/20.php
[Wed Apr 01 05:45:29.941611 2026] [:error] [pid 23716:tid 23812] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 01 05:45:30.181931 2026] [:error] [pid 23716:tid 23792] [client 20.203.142.71:9634] File does not exist: /usr/local/apache/htdocs/suspended-page/c.php
[Wed Apr 01 05:45:30.493375 2026] [:error] [pid 23716:tid 23801] [client 20.203.142.71:9634] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acxAenVtFUg_mx-RYb5dzAAAAI0"]
[Wed Apr 01 05:45:30.981613 2026] [:error] [pid 23714:tid 23734] [client 20.203.142.71:53440] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acxAekHxDDU2ETcG9DSrYQAAAAA"]
[Wed Apr 01 05:45:31.540152 2026] [:error] [pid 23715:tid 23764] [client 20.203.142.71:63515] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acxAe6-REzOruNbiT9wvvgAAAEM"]
[Wed Apr 01 05:45:32.074628 2026] [:error] [pid 23714:tid 23735] [client 20.203.142.71:9611] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "acxAfEHxDDU2ETcG9DSrZgAAAAE"]
[Wed Apr 01 05:45:32.605638 2026] [:error] [pid 23714:tid 23738] [client 20.203.142.71:9978] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acxAfEHxDDU2ETcG9DSraQAAAAQ"]
[Wed Apr 01 05:45:33.132341 2026] [:error] [pid 23714:tid 23737] [client 20.203.142.71:9718] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acxAfUHxDDU2ETcG9DSrawAAAAM"]
[Wed Apr 01 05:45:33.616997 2026] [:error] [pid 23716:tid 23789] [client 20.203.142.71:9674] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acxAfXVtFUg_mx-RYb5d0AAAAIE"]
[Wed Apr 01 05:45:34.134562 2026] [:error] [pid 23714:tid 23751] [client 20.203.142.71:16219] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "acxAfkHxDDU2ETcG9DSrbwAAABE"]
[Wed Apr 01 05:45:34.607975 2026] [:error] [pid 23714:tid 23745] [client 20.203.142.71:16213] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acxAfkHxDDU2ETcG9DSrcgAAAAs"]
[Wed Apr 01 05:45:35.105843 2026] [:error] [pid 23715:tid 23769] [client 20.203.142.71:9983] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acxAf6-REzOruNbiT9wvvwAAAEg"]
[Wed Apr 01 05:45:35.587477 2026] [:error] [pid 23714:tid 23749] [client 20.203.142.71:10216] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acxAf0HxDDU2ETcG9DSreQAAAA8"]
[Wed Apr 01 05:45:36.101608 2026] [:error] [pid 23819:tid 23838] [client 20.203.142.71:10130] [client 20.203.142.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "acxAgNdfUS_37wFAM77bEwAAANA"]
[Wed Apr 01 07:00:29.303381 2026] [:error] [pid 23715:tid 23784] [client 43.165.135.242:44904] [client 43.165.135.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acxSDa-REzOruNbiT9xT6QAAAFc"]
[Wed Apr 01 07:20:04.193589 2026] [:error] [pid 23715:tid 23782] [client 74.248.134.58:26390] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Wed Apr 01 07:20:04.454485 2026] [:error] [pid 23715:tid 23783] [client 74.248.134.58:26390] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Wed Apr 01 07:38:06.189373 2026] [:error] [pid 23714:tid 23756] [client 74.248.134.58:16351] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Wed Apr 01 07:38:06.448439 2026] [:error] [pid 23714:tid 23737] [client 74.248.134.58:16351] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Wed Apr 01 08:09:48.367536 2026] [:error] [pid 23715:tid 23762] [client 221.229.106.25:44654] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "acxiTK-REzOruNbiT9x3dAAAAEE"]
[Wed Apr 01 09:55:45.786196 2026] [:error] [pid 23716:tid 23791] [client 43.135.130.202:50678] [client 43.135.130.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acx7IXVtFUg_mx-RYb6qOAAAAIM"]
[Wed Apr 01 14:35:16.444343 2026] [:error] [pid 17856:tid 17873] [client 36.41.75.167:55602] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acy8pD7Idlm5j9frhqQgBAAAAE8"]
[Wed Apr 01 16:39:33.980617 2026] [:error] [pid 62559:tid 62573] [client 43.128.156.124:53018] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aczZxS7NKI8IaNKZFIc_WgAAAUw"]
[Wed Apr 01 17:21:39.571719 2026] [:error] [pid 8995:tid 9001] [client 173.239.218.70:53363] [client 173.239.218.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "aczjo-onaBjs3qxcReeERQAAAAM"]
[Wed Apr 01 19:08:54.807876 2026] [:error] [pid 62559:tid 62576] [client 43.166.255.102:54418] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "acz8xi7NKI8IaNKZFIdzdQAAAU8"]
[Wed Apr 01 19:48:18.247895 2026] [:error] [pid 8995:tid 9014] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Wed Apr 01 19:48:18.635982 2026] [:error] [pid 8995:tid 9021] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/8daf1238_1774208172.php
[Wed Apr 01 19:48:18.899250 2026] [:error] [pid 8995:tid 9004] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/0yellow.php
[Wed Apr 01 19:48:19.186144 2026] [:error] [pid 8995:tid 9018] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/dichku.php
[Wed Apr 01 19:48:19.471286 2026] [:error] [pid 8995:tid 9003] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 01 19:48:19.737344 2026] [:error] [pid 8995:tid 9008] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Wed Apr 01 19:48:19.979084 2026] [:error] [pid 8995:tid 9005] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Wed Apr 01 19:48:20.259439 2026] [:error] [pid 8995:tid 8999] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/a9.php
[Wed Apr 01 19:48:20.512502 2026] [:error] [pid 8995:tid 9006] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Wed Apr 01 19:48:20.791590 2026] [:error] [pid 8995:tid 9014] [client 158.158.51.104:52492] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Wed Apr 01 19:48:21.031066 2026] [:error] [pid 8995:tid 9010] [client 158.158.51.104:52492] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hnphq.php"] [unique_id "ac0GBeonaBjs3qxcReewAQAAAAw"]
[Wed Apr 01 19:48:22.456354 2026] [:error] [pid 17856:tid 17862] [client 158.158.51.104:39267] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hnphq.php"] [unique_id "ac0GBj7Idlm5j9frhqT-OQAAAEQ"]
[Wed Apr 01 19:48:24.101484 2026] [:error] [pid 17856:tid 17870] [client 158.158.51.104:22740] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hnphq.php"] [unique_id "ac0GCD7Idlm5j9frhqT-QQAAAEw"]
[Wed Apr 01 19:48:25.213101 2026] [:error] [pid 17856:tid 17882] [client 158.158.51.104:22733] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hnphq.php"] [unique_id "ac0GCT7Idlm5j9frhqT-TAAAAFg"]
[Wed Apr 01 19:48:26.630374 2026] [:error] [pid 17856:tid 17859] [client 158.158.51.104:24109] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0GCj7Idlm5j9frhqT-UAAAAEE"]
[Wed Apr 01 19:48:30.032327 2026] [:error] [pid 8995:tid 9010] [client 158.158.51.104:52435] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0GDuonaBjs3qxcReewDAAAAAw"]
[Wed Apr 01 19:48:32.650485 2026] [:error] [pid 8910:tid 8978] [client 158.158.51.104:52426] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0GEKJZINUcF3tYgExM_gAAAQo"]
[Wed Apr 01 19:48:33.646043 2026] [:error] [pid 8910:tid 8977] [client 158.158.51.104:25169] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0GEaJZINUcF3tYgExNBAAAAQk"]
[Wed Apr 01 19:48:34.870274 2026] [:error] [pid 8909:tid 8965] [client 158.158.51.104:25166] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "ac0GEjvP_a0662gDl6CEigAAANg"]
[Wed Apr 01 19:48:36.534477 2026] [:error] [pid 17856:tid 17858] [client 158.158.51.104:25938] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "ac0GFD7Idlm5j9frhqT-dgAAAEA"]
[Wed Apr 01 19:48:37.440785 2026] [:error] [pid 17856:tid 17862] [client 158.158.51.104:47288] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "ac0GFT7Idlm5j9frhqT-fwAAAEQ"]
[Wed Apr 01 19:48:39.931416 2026] [:error] [pid 8995:tid 9002] [client 158.158.51.104:31928] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "ac0GF-onaBjs3qxcReewIQAAAAQ"]
[Wed Apr 01 19:48:41.536482 2026] [:error] [pid 8910:tid 8992] [client 158.158.51.104:27271] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "ac0GGaJZINUcF3tYgExNDwAAARg"]
[Wed Apr 01 19:48:58.195039 2026] [:error] [pid 8909:tid 8955] [client 158.158.51.104:39809] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0GKjvP_a0662gDl6CE6AAAAM4"]
[Wed Apr 01 19:48:59.126822 2026] [:error] [pid 8908:tid 8935] [client 158.158.51.104:49340] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0GK_kmxtJXGnLdvgBkbwAAAJY"]
[Wed Apr 01 19:49:00.225337 2026] [:error] [pid 17856:tid 17875] [client 158.158.51.104:32961] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0GLD7Idlm5j9frhqT-rQAAAFE"]
[Wed Apr 01 19:49:01.459247 2026] [:error] [pid 62559:tid 62569] [client 158.158.51.104:25393] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0GLS7NKI8IaNKZFIeCMAAAAUg"]
[Wed Apr 01 19:49:02.199173 2026] [:error] [pid 8908:tid 8913] [client 158.158.51.104:64843] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0GLvkmxtJXGnLdvgBkdQAAAIA"]
[Wed Apr 01 19:49:04.033479 2026] [:error] [pid 17856:tid 17880] [client 158.158.51.104:47236] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0GMD7Idlm5j9frhqT-tAAAAFY"]
[Wed Apr 01 19:49:05.699973 2026] [:error] [pid 8995:tid 9010] [client 158.158.51.104:22728] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0GMeonaBjs3qxcReewSAAAAAw"]
[Wed Apr 01 19:49:08.344456 2026] [:error] [pid 17856:tid 17870] [client 158.158.51.104:53743] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0GND7Idlm5j9frhqT-twAAAEw"]
[Wed Apr 01 19:49:09.918972 2026] [:error] [pid 17856:tid 17858] [client 158.158.51.104:25972] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "ac0GNT7Idlm5j9frhqT-ugAAAEA"]
[Wed Apr 01 19:49:30.365353 2026] [:error] [pid 17856:tid 17875] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/q7lhrgzoo7ijhnkcedq2Cdefault.php
[Wed Apr 01 19:49:30.638667 2026] [:error] [pid 17856:tid 17867] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/kthusnjbc8ab0jiryls2jinCdefault.php
[Wed Apr 01 19:49:30.882380 2026] [:error] [pid 17856:tid 17870] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/only.php
[Wed Apr 01 19:49:31.170719 2026] [:error] [pid 17856:tid 17873] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/repurify.php
[Wed Apr 01 19:49:31.455384 2026] [:error] [pid 17856:tid 17876] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/tdsaz.php
[Wed Apr 01 19:49:31.735595 2026] [:error] [pid 17856:tid 17859] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Wed Apr 01 19:49:31.978637 2026] [:error] [pid 17856:tid 17867] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/hfles.php
[Wed Apr 01 19:49:32.221605 2026] [:error] [pid 17856:tid 17882] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Wed Apr 01 19:49:32.466993 2026] [:error] [pid 17856:tid 17879] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Wed Apr 01 19:49:32.747948 2026] [:error] [pid 17856:tid 17871] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-20260318122951.php
[Wed Apr 01 19:49:32.991462 2026] [:error] [pid 17856:tid 17876] [client 158.158.51.104:43597] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Wed Apr 01 19:49:33.230955 2026] [:error] [pid 17856:tid 17872] [client 158.158.51.104:43597] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "ac0GTT7Idlm5j9frhqT--wAAAE4"]
[Wed Apr 01 19:49:34.813660 2026] [:error] [pid 62559:tid 62571] [client 158.158.51.104:41841] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "ac0GTi7NKI8IaNKZFIeCfQAAAUo"]
[Wed Apr 01 19:49:35.919397 2026] [:error] [pid 8909:tid 8959] [client 158.158.51.104:23910] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "ac0GTzvP_a0662gDl6CFOgAAANI"]
[Wed Apr 01 19:49:36.677912 2026] [:error] [pid 8909:tid 8951] [client 158.158.51.104:25726] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-moonka.php"] [unique_id "ac0GUDvP_a0662gDl6CFPwAAAMo"]
[Wed Apr 01 19:49:37.656118 2026] [:error] [pid 8909:tid 8942] [client 158.158.51.104:33993] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ac0GUTvP_a0662gDl6CFQgAAAME"]
[Wed Apr 01 19:49:38.491064 2026] [:error] [pid 8909:tid 8953] [client 158.158.51.104:23343] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ac0GUjvP_a0662gDl6CFRwAAAMw"]
[Wed Apr 01 19:49:39.137712 2026] [:error] [pid 8909:tid 8955] [client 158.158.51.104:50052] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ac0GUzvP_a0662gDl6CFSwAAAM4"]
[Wed Apr 01 19:49:40.387193 2026] [:error] [pid 8909:tid 8948] [client 158.158.51.104:53705] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ac0GVDvP_a0662gDl6CFVQAAAMc"]
[Wed Apr 01 19:49:41.607293 2026] [:error] [pid 8908:tid 8928] [client 158.158.51.104:23831] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "ac0GVfkmxtJXGnLdvgBkvgAAAI8"]
[Wed Apr 01 19:49:42.971826 2026] [:error] [pid 8909:tid 8962] [client 158.158.51.104:23371] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "ac0GVjvP_a0662gDl6CFXwAAANU"]
[Wed Apr 01 19:49:44.545113 2026] [:error] [pid 8995:tid 9016] [client 158.158.51.104:41857] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "ac0GWOonaBjs3qxcReewhQAAABI"]
[Wed Apr 01 19:49:45.722448 2026] [:error] [pid 8909:tid 8954] [client 158.158.51.104:23925] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "ac0GWTvP_a0662gDl6CFZQAAAM0"]
[Wed Apr 01 19:49:47.326935 2026] [:error] [pid 8909:tid 8959] [client 158.158.51.104:24914] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0GWzvP_a0662gDl6CFbQAAANI"]
[Wed Apr 01 19:49:50.281844 2026] [:error] [pid 17856:tid 17869] [client 158.158.51.104:24944] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0GXj7Idlm5j9frhqT_CwAAAEs"]
[Wed Apr 01 19:49:51.619558 2026] [:error] [pid 17856:tid 17861] [client 158.158.51.104:41907] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0GXz7Idlm5j9frhqT_DQAAAEM"]
[Wed Apr 01 19:49:55.515315 2026] [:error] [pid 8908:tid 8937] [client 158.158.51.104:23833] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0GY_kmxtJXGnLdvgBk-QAAAJg"]
[Wed Apr 01 19:50:01.433466 2026] [:error] [pid 17856:tid 17881] [client 158.158.51.104:23852] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ac0GaT7Idlm5j9frhqT_IgAAAFc"]
[Wed Apr 01 19:50:03.927561 2026] [:error] [pid 8910:tid 8985] [client 158.158.51.104:37019] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ac0Ga6JZINUcF3tYgExNZAAAARE"]
[Wed Apr 01 19:50:05.070070 2026] [:error] [pid 17856:tid 17862] [client 158.158.51.104:41806] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ac0GbT7Idlm5j9frhqT_MAAAAEQ"]
[Wed Apr 01 19:50:05.929062 2026] [:error] [pid 8909:tid 8947] [client 158.158.51.104:23909] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ac0GbTvP_a0662gDl6CFnQAAAMY"]
[Wed Apr 01 19:50:09.004983 2026] [:error] [pid 8995:tid 9006] [client 158.158.51.104:58367] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "ac0GceonaBjs3qxcReewmwAAAAg"]
[Wed Apr 01 19:50:39.914485 2026] [:error] [pid 8908:tid 8920] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Wed Apr 01 19:50:40.156630 2026] [:error] [pid 8908:tid 8919] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Wed Apr 01 19:50:40.414678 2026] [:error] [pid 8908:tid 8916] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/t2gorhwasq4vioshtatw5eCdefault.php
[Wed Apr 01 19:50:40.681224 2026] [:error] [pid 8908:tid 8933] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/new3.php
[Wed Apr 01 19:50:40.933981 2026] [:error] [pid 8908:tid 8932] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Wed Apr 01 19:50:41.188807 2026] [:error] [pid 8908:tid 8913] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/rogsa.php
[Wed Apr 01 19:50:41.431938 2026] [:error] [pid 8908:tid 8930] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/htzevfl4k9ey5hoaywdwiCdefault.php
[Wed Apr 01 19:50:41.674735 2026] [:error] [pid 8908:tid 8929] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Wed Apr 01 19:50:41.927477 2026] [:error] [pid 8908:tid 8918] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/nhj6t74aqmkde3hgpCdefault.php
[Wed Apr 01 19:50:42.185779 2026] [:error] [pid 8908:tid 8921] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/wlld5fjtdpjmjhsds3qzmipfCdefault.php
[Wed Apr 01 19:50:42.444636 2026] [:error] [pid 8908:tid 8923] [client 158.158.51.104:26445] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Wed Apr 01 19:50:42.700191 2026] [:error] [pid 8908:tid 8917] [client 158.158.51.104:26445] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "ac0GkvkmxtJXGnLdvgBlPwAAAIQ"]
[Wed Apr 01 19:50:43.815279 2026] [:error] [pid 62559:tid 62565] [client 158.158.51.104:26447] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "ac0Gky7NKI8IaNKZFIeCuQAAAUQ"]
[Wed Apr 01 19:50:44.600029 2026] [:error] [pid 17856:tid 17860] [client 158.158.51.104:41349] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "ac0GlD7Idlm5j9frhqT_gwAAAEI"]
[Wed Apr 01 19:50:45.293947 2026] [:error] [pid 62559:tid 62564] [client 158.158.51.104:30861] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "ac0GlS7NKI8IaNKZFIeCvQAAAUM"]
[Wed Apr 01 19:50:46.143106 2026] [:error] [pid 8909:tid 8963] [client 158.158.51.104:41404] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynjli.php"] [unique_id "ac0GljvP_a0662gDl6CF-gAAANY"]
[Wed Apr 01 19:50:47.550012 2026] [:error] [pid 8909:tid 8959] [client 158.158.51.104:2155] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynjli.php"] [unique_id "ac0GlzvP_a0662gDl6CF_gAAANI"]
[Wed Apr 01 19:50:48.333534 2026] [:error] [pid 8909:tid 8953] [client 158.158.51.104:25885] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynjli.php"] [unique_id "ac0GmDvP_a0662gDl6CGAQAAAMw"]
[Wed Apr 01 19:50:49.548509 2026] [:error] [pid 8995:tid 9009] [client 158.158.51.104:33650] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ynjli.php"] [unique_id "ac0GmeonaBjs3qxcReewwwAAAAs"]
[Wed Apr 01 19:50:50.987566 2026] [:error] [pid 62559:tid 62578] [client 158.158.51.104:33634] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6.php"] [unique_id "ac0Gmi7NKI8IaNKZFIeCwgAAAVE"]
[Wed Apr 01 19:50:52.467554 2026] [:error] [pid 8910:tid 8992] [client 158.158.51.104:41361] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6.php"] [unique_id "ac0GnKJZINUcF3tYgExNlgAAARg"]
[Wed Apr 01 19:50:55.472450 2026] [:error] [pid 17856:tid 17876] [client 158.158.51.104:26116] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6.php"] [unique_id "ac0Gnz7Idlm5j9frhqT_kwAAAFI"]
[Wed Apr 01 19:50:56.907052 2026] [:error] [pid 8910:tid 8979] [client 158.158.51.104:30887] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a6.php"] [unique_id "ac0GoKJZINUcF3tYgExNngAAAQs"]
[Wed Apr 01 19:50:59.077719 2026] [:error] [pid 8909:tid 8947] [client 158.158.51.104:2450] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0GozvP_a0662gDl6CGHgAAAMY"]
[Wed Apr 01 19:51:00.779970 2026] [:error] [pid 8910:tid 8971] [client 158.158.51.104:33607] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0GpKJZINUcF3tYgExNpAAAAQM"]
[Wed Apr 01 19:51:03.601088 2026] [:error] [pid 8908:tid 8919] [client 158.158.51.104:2829] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0Gp_kmxtJXGnLdvgBlXgAAAIY"]
[Wed Apr 01 19:51:05.821018 2026] [:error] [pid 17856:tid 17874] [client 158.158.51.104:57117] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0GqT7Idlm5j9frhqT_tQAAAFA"]
[Wed Apr 01 19:51:08.276801 2026] [:error] [pid 8910:tid 8990] [client 158.158.51.104:20416] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "ac0GrKJZINUcF3tYgExNqwAAARY"]
[Wed Apr 01 19:51:08.968824 2026] [:error] [pid 8909:tid 8965] [client 158.158.51.104:65507] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "ac0GrDvP_a0662gDl6CGQQAAANg"]
[Wed Apr 01 19:51:10.273256 2026] [:error] [pid 8909:tid 8949] [client 158.158.51.104:49989] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "ac0GrjvP_a0662gDl6CGSAAAAMg"]
[Wed Apr 01 19:51:12.920753 2026] [:error] [pid 8995:tid 9010] [client 158.158.51.104:2629] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sts.php"] [unique_id "ac0GsOonaBjs3qxcReew0gAAAAw"]
[Wed Apr 01 19:51:14.205136 2026] [:error] [pid 17856:tid 17880] [client 158.158.51.104:29398] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0Gsj7Idlm5j9frhqT_yAAAAFY"]
[Wed Apr 01 19:51:19.935023 2026] [:error] [pid 8908:tid 8929] [client 158.158.51.104:33991] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0Gt_kmxtJXGnLdvgBlbgAAAJA"]
[Wed Apr 01 19:51:21.403814 2026] [:error] [pid 8995:tid 8998] [client 158.158.51.104:22727] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0GueonaBjs3qxcReew4QAAAAA"]
[Wed Apr 01 19:51:25.653541 2026] [:error] [pid 17856:tid 17862] [client 158.158.51.104:24095] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0GvT7Idlm5j9frhqT_4AAAAEQ"]
[Wed Apr 01 19:51:27.653617 2026] [:error] [pid 8909:tid 8944] [client 158.158.51.104:63446] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "ac0GvzvP_a0662gDl6CGdAAAAMM"]
[Wed Apr 01 19:51:28.923528 2026] [:error] [pid 62559:tid 62570] [client 158.158.51.104:2459] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "ac0GwC7NKI8IaNKZFIeC9wAAAUk"]
[Wed Apr 01 19:51:29.970763 2026] [:error] [pid 62559:tid 62561] [client 158.158.51.104:2466] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "ac0GwS7NKI8IaNKZFIeC-gAAAUA"]
[Wed Apr 01 19:51:31.067942 2026] [:error] [pid 8910:tid 8991] [client 158.158.51.104:2065] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "ac0Gw6JZINUcF3tYgExNxwAAARc"]
[Wed Apr 01 19:51:32.061352 2026] [:error] [pid 8909:tid 8957] [client 158.158.51.104:22731] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac0GxDvP_a0662gDl6CGgQAAANA"]
[Wed Apr 01 19:51:32.695154 2026] [:error] [pid 8909:tid 8954] [client 158.158.51.104:22726] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac0GxDvP_a0662gDl6CGhQAAAM0"]
[Wed Apr 01 19:51:34.021355 2026] [:error] [pid 8909:tid 8950] [client 158.158.51.104:26224] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac0GxjvP_a0662gDl6CGkAAAAMk"]
[Wed Apr 01 19:51:35.083439 2026] [:error] [pid 17856:tid 17860] [client 158.158.51.104:51177] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac0Gxz7Idlm5j9frhqT_8AAAAEI"]
[Wed Apr 01 19:51:35.893877 2026] [:error] [pid 8995:tid 9012] [client 158.158.51.104:64224] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0Gx-onaBjs3qxcReew7AAAAA4"]
[Wed Apr 01 19:51:36.604895 2026] [:error] [pid 8908:tid 8937] [client 158.158.51.104:20393] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0GyPkmxtJXGnLdvgBlkQAAAJg"]
[Wed Apr 01 19:51:37.473496 2026] [:error] [pid 8908:tid 8932] [client 158.158.51.104:64302] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0GyfkmxtJXGnLdvgBllQAAAJM"]
[Wed Apr 01 19:51:38.557330 2026] [:error] [pid 8908:tid 8927] [client 158.158.51.104:2694] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0GyvkmxtJXGnLdvgBlmQAAAI4"]
[Wed Apr 01 19:51:39.325651 2026] [:error] [pid 8909:tid 8961] [client 158.158.51.104:51176] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "ac0GyzvP_a0662gDl6CGnAAAANQ"]
[Wed Apr 01 19:51:40.234994 2026] [:error] [pid 8909:tid 8950] [client 158.158.51.104:64312] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "ac0GzDvP_a0662gDl6CGoAAAAMk"]
[Wed Apr 01 19:51:40.833395 2026] [:error] [pid 8909:tid 8961] [client 158.158.51.104:64318] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "ac0GzDvP_a0662gDl6CGowAAANQ"]
[Wed Apr 01 19:51:41.344791 2026] [:error] [pid 8909:tid 8942] [client 158.158.51.104:51166] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "ac0GzTvP_a0662gDl6CGpwAAAME"]
[Wed Apr 01 19:51:42.214724 2026] [:error] [pid 17856:tid 17866] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/a8.php
[Wed Apr 01 19:51:42.524826 2026] [:error] [pid 17856:tid 17879] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/lmutxdvyp7u5yksqke8ozbjgCdefault.php
[Wed Apr 01 19:51:42.767549 2026] [:error] [pid 17856:tid 17865] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Wed Apr 01 19:51:43.078799 2026] [:error] [pid 17856:tid 17870] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Wed Apr 01 19:51:43.376053 2026] [:error] [pid 17856:tid 17858] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/index-20260330022921.php
[Wed Apr 01 19:51:43.637394 2026] [:error] [pid 17856:tid 17859] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Wed Apr 01 19:51:43.910938 2026] [:error] [pid 17856:tid 17871] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Wed Apr 01 19:51:44.153068 2026] [:error] [pid 17856:tid 17875] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ccv.php
[Wed Apr 01 19:51:44.689610 2026] [:error] [pid 17856:tid 17869] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/luyuc.php
[Wed Apr 01 19:51:45.015536 2026] [:error] [pid 17856:tid 17882] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 01 19:51:45.278834 2026] [:error] [pid 17856:tid 17873] [client 158.158.51.104:2436] File does not exist: /usr/local/apache/htdocs/suspended-page/htto.php
[Wed Apr 01 20:37:48.125456 2026] [:error] [pid 8908:tid 8921] [client 43.138.68.113:35564] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ac0RnPkmxtJXGnLdvgB9TgAAAIg"]
[Wed Apr 01 20:59:17.457039 2026] [:error] [pid 8908:tid 8922] [client 49.51.233.46:33110] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ac0WpfkmxtJXGnLdvgCHAAAAAIk"]
[Wed Apr 01 22:17:37.343802 2026] [:error] [pid 17856:tid 17866] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/fffff.php
[Wed Apr 01 22:17:38.185159 2026] [:error] [pid 17856:tid 17874] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/xdd.php
[Wed Apr 01 22:17:38.443940 2026] [:error] [pid 17856:tid 17880] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php
[Wed Apr 01 22:17:38.697048 2026] [:error] [pid 17856:tid 17864] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/wdone1.php
[Wed Apr 01 22:17:38.951796 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/ws79.php
[Wed Apr 01 22:17:39.205563 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Wed Apr 01 22:17:39.459581 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/max.php
[Wed Apr 01 22:17:39.722183 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Wed Apr 01 22:17:39.975590 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/wglum1.php
[Wed Apr 01 22:17:40.229864 2026] [:error] [pid 17856:tid 17872] [client 52.156.211.140:36996] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Wed Apr 01 22:17:40.487052 2026] [:error] [pid 17856:tid 17870] [client 52.156.211.140:36996] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "ac0pBD7Idlm5j9frhqRkPgAAAEw"]
[Wed Apr 01 22:17:41.065094 2026] [:error] [pid 62559:tid 62580] [client 52.156.211.140:37213] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "ac0pBS7NKI8IaNKZFIe8lwAAAVM"]
[Wed Apr 01 22:17:41.586015 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:37000] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "ac0pBS7NKI8IaNKZFIe8nAAAAUg"]
[Wed Apr 01 22:17:42.181615 2026] [:error] [pid 8909:tid 8954] [client 52.156.211.140:37013] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-true.php"] [unique_id "ac0pBjvP_a0662gDl6DzZgAAAM0"]
[Wed Apr 01 22:17:42.689812 2026] [:error] [pid 8995:tid 9016] [client 52.156.211.140:37235] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "ac0pBuonaBjs3qxcRefeTAAAABI"]
[Wed Apr 01 22:17:43.291428 2026] [:error] [pid 8995:tid 9000] [client 52.156.211.140:37008] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "ac0pB-onaBjs3qxcRefeUAAAAAI"]
[Wed Apr 01 22:17:43.792881 2026] [:error] [pid 62559:tid 62575] [client 52.156.211.140:37192] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "ac0pBy7NKI8IaNKZFIe8pQAAAU4"]
[Wed Apr 01 22:17:44.374746 2026] [:error] [pid 8910:tid 8974] [client 52.156.211.140:37024] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws42.php"] [unique_id "ac0pCKJZINUcF3tYgExy4QAAAQY"]
[Wed Apr 01 22:17:44.900601 2026] [:error] [pid 17856:tid 17869] [client 52.156.211.140:37218] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "ac0pCD7Idlm5j9frhqRkRAAAAEs"]
[Wed Apr 01 22:17:45.456056 2026] [:error] [pid 17856:tid 17880] [client 52.156.211.140:37187] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "ac0pCT7Idlm5j9frhqRkRgAAAFY"]
[Wed Apr 01 22:17:45.963968 2026] [:error] [pid 8908:tid 8914] [client 52.156.211.140:37006] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "ac0pCfkmxtJXGnLdvgCq6AAAAIE"]
[Wed Apr 01 22:17:46.473367 2026] [:error] [pid 8908:tid 8920] [client 52.156.211.140:37246] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "ac0pCvkmxtJXGnLdvgCq7gAAAIc"]
[Wed Apr 01 22:17:46.992635 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:37242] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0pCi7NKI8IaNKZFIe8sQAAAVU"]
[Wed Apr 01 22:17:47.531636 2026] [:error] [pid 8910:tid 8989] [client 52.156.211.140:36993] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0pC6JZINUcF3tYgExy4gAAARU"]
[Wed Apr 01 22:17:48.050508 2026] [:error] [pid 62559:tid 62568] [client 52.156.211.140:4057] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0pDC7NKI8IaNKZFIe8uQAAAUc"]
[Wed Apr 01 22:17:48.577015 2026] [:error] [pid 8909:tid 8947] [client 52.156.211.140:37191] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0pDDvP_a0662gDl6DzcgAAAMY"]
[Wed Apr 01 22:17:49.142645 2026] [:error] [pid 8908:tid 8916] [client 52.156.211.140:37237] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ac0pDfkmxtJXGnLdvgCq9QAAAIM"]
[Wed Apr 01 22:17:49.647721 2026] [:error] [pid 8909:tid 8945] [client 52.156.211.140:37203] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ac0pDTvP_a0662gDl6DzdQAAAMQ"]
[Wed Apr 01 22:17:50.158444 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:4052] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ac0pDjvP_a0662gDl6DzeQAAAMo"]
[Wed Apr 01 22:17:50.659225 2026] [:error] [pid 8908:tid 8925] [client 52.156.211.140:4045] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ac0pDvkmxtJXGnLdvgCq_gAAAIw"]
[Wed Apr 01 22:17:51.170303 2026] [:error] [pid 62559:tid 62579] [client 52.156.211.140:37021] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "ac0pDy7NKI8IaNKZFIe8xAAAAVI"]
[Wed Apr 01 22:17:51.682024 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:37001] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "ac0pDy7NKI8IaNKZFIe8xwAAAVA"]
[Wed Apr 01 22:17:52.194502 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:37196] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "ac0pEDvP_a0662gDl6DzgAAAANQ"]
[Wed Apr 01 22:17:52.712149 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37243] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/north1.php"] [unique_id "ac0pEPkmxtJXGnLdvgCrCgAAAI8"]
[Wed Apr 01 22:17:53.261996 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:37017] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ac0pES7NKI8IaNKZFIe8zAAAAU0"]
[Wed Apr 01 22:17:53.784250 2026] [:error] [pid 8909:tid 8943] [client 52.156.211.140:37053] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ac0pETvP_a0662gDl6DziQAAAMI"]
[Wed Apr 01 22:17:54.296854 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:37231] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ac0pEi7NKI8IaNKZFIe80wAAAVA"]
[Wed Apr 01 22:17:54.802967 2026] [:error] [pid 62559:tid 62584] [client 52.156.211.140:37002] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ac0pEi7NKI8IaNKZFIe81wAAAVc"]
[Wed Apr 01 22:17:55.334147 2026] [:error] [pid 17856:tid 17864] [client 52.156.211.140:37247] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ac0pEz7Idlm5j9frhqRkVgAAAEY"]
[Wed Apr 01 22:17:55.896315 2026] [:error] [pid 8908:tid 8933] [client 52.156.211.140:36998] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ac0pE_kmxtJXGnLdvgCrDwAAAJQ"]
[Wed Apr 01 22:17:56.396974 2026] [:error] [pid 8995:tid 9013] [client 52.156.211.140:37007] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ac0pFOonaBjs3qxcRefeVQAAAA8"]
[Wed Apr 01 22:17:56.910679 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:4060] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ac0pFPkmxtJXGnLdvgCrGAAAAI8"]
[Wed Apr 01 22:17:57.415393 2026] [:error] [pid 62559:tid 62567] [client 52.156.211.140:37186] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "ac0pFS7NKI8IaNKZFIe83wAAAUY"]
[Wed Apr 01 22:17:58.054345 2026] [:error] [pid 8908:tid 8923] [client 52.156.211.140:37004] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "ac0pFvkmxtJXGnLdvgCrGgAAAIo"]
[Wed Apr 01 22:17:58.564359 2026] [:error] [pid 8995:tid 9018] [client 52.156.211.140:37010] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "ac0pFuonaBjs3qxcRefeXwAAABQ"]
[Wed Apr 01 22:17:59.067784 2026] [:error] [pid 8909:tid 8955] [client 52.156.211.140:37185] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/admin.php"] [unique_id "ac0pFzvP_a0662gDl6DzkAAAAM4"]
[Wed Apr 01 22:17:59.569476 2026] [:error] [pid 62559:tid 62568] [client 52.156.211.140:37190] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "ac0pFy7NKI8IaNKZFIe85wAAAUc"]
[Wed Apr 01 22:18:00.069193 2026] [:error] [pid 62559:tid 62562] [client 52.156.211.140:37208] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "ac0pGC7NKI8IaNKZFIe86wAAAUE"]
[Wed Apr 01 22:18:00.589378 2026] [:error] [pid 62559:tid 62581] [client 52.156.211.140:37210] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "ac0pGC7NKI8IaNKZFIe87QAAAVQ"]
[Wed Apr 01 22:18:01.150996 2026] [:error] [pid 62559:tid 62578] [client 52.156.211.140:37189] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "ac0pGS7NKI8IaNKZFIe88gAAAVE"]
[Wed Apr 01 22:18:01.661513 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:37223] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "ac0pGeonaBjs3qxcRefehAAAABg"]
[Wed Apr 01 22:18:02.164721 2026] [:error] [pid 8995:tid 9009] [client 52.156.211.140:4064] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "ac0pGuonaBjs3qxcRefehwAAAAs"]
[Wed Apr 01 22:18:02.676904 2026] [:error] [pid 8995:tid 8999] [client 52.156.211.140:37226] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "ac0pGuonaBjs3qxcRefeigAAAAE"]
[Wed Apr 01 22:18:03.767672 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:37197] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "ac0pG_kmxtJXGnLdvgCrKAAAAIk"]
[Wed Apr 01 22:18:04.294640 2026] [:error] [pid 62559:tid 62575] [client 52.156.211.140:37041] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ac0pHC7NKI8IaNKZFIe8_AAAAU4"]
[Wed Apr 01 22:18:04.797058 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:37209] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ac0pHC7NKI8IaNKZFIe9AAAAAUg"]
[Wed Apr 01 22:18:05.888764 2026] [:error] [pid 8908:tid 8914] [client 52.156.211.140:37194] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ac0pHfkmxtJXGnLdvgCrMgAAAIE"]
[Wed Apr 01 22:18:06.416437 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:37035] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ac0pHi7NKI8IaNKZFIe9AgAAAU0"]
[Wed Apr 01 22:18:06.928559 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:37043] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ac0pHjvP_a0662gDl6DznAAAAME"]
[Wed Apr 01 22:18:07.486791 2026] [:error] [pid 62559:tid 62575] [client 52.156.211.140:37016] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ac0pHy7NKI8IaNKZFIe9CQAAAU4"]
[Wed Apr 01 22:18:07.989930 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:37201] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ac0pH-onaBjs3qxcRefelgAAAA4"]
[Wed Apr 01 22:18:08.493122 2026] [:error] [pid 62559:tid 62562] [client 52.156.211.140:4059] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ac0pIC7NKI8IaNKZFIe9DwAAAUE"]
[Wed Apr 01 22:18:08.999888 2026] [:error] [pid 8909:tid 8952] [client 52.156.211.140:37239] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "ac0pIDvP_a0662gDl6DzogAAAMs"]
[Wed Apr 01 22:18:09.504157 2026] [:error] [pid 8909:tid 8941] [client 52.156.211.140:37217] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "ac0pITvP_a0662gDl6DzpAAAAMA"]
[Wed Apr 01 22:18:10.021136 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:37051] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "ac0pIi7NKI8IaNKZFIe9FQAAAVA"]
[Wed Apr 01 22:18:10.538971 2026] [:error] [pid 62559:tid 62562] [client 52.156.211.140:37188] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wander.php"] [unique_id "ac0pIi7NKI8IaNKZFIe9GgAAAUE"]
[Wed Apr 01 22:18:11.042940 2026] [:error] [pid 8908:tid 8931] [client 52.156.211.140:4051] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "ac0pI_kmxtJXGnLdvgCrOAAAAJI"]
[Wed Apr 01 22:18:12.302751 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:37238] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "ac0pJC7NKI8IaNKZFIe9JQAAAUg"]
[Wed Apr 01 22:18:12.827532 2026] [:error] [pid 62559:tid 62573] [client 52.156.211.140:37232] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "ac0pJC7NKI8IaNKZFIe9LQAAAUw"]
[Wed Apr 01 22:18:13.350697 2026] [:error] [pid 62559:tid 62561] [client 52.156.211.140:37046] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h02ugyh.php"] [unique_id "ac0pJS7NKI8IaNKZFIe9MgAAAUA"]
[Wed Apr 01 22:18:13.857185 2026] [:error] [pid 62559:tid 62584] [client 52.156.211.140:37045] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "ac0pJS7NKI8IaNKZFIe9NwAAAVc"]
[Wed Apr 01 22:18:14.363448 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:37012] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "ac0pJvkmxtJXGnLdvgCrQwAAAIk"]
[Wed Apr 01 22:18:15.883679 2026] [:error] [pid 8909:tid 8956] [client 52.156.211.140:4032] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "ac0pJzvP_a0662gDl6DzqwAAAM8"]
[Wed Apr 01 22:18:16.414562 2026] [:error] [pid 8908:tid 8919] [client 52.156.211.140:37215] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ad.php"] [unique_id "ac0pKPkmxtJXGnLdvgCrTwAAAIY"]
[Wed Apr 01 22:18:16.931141 2026] [:error] [pid 8910:tid 8989] [client 52.156.211.140:37054] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "ac0pKKJZINUcF3tYgExzOAAAARU"]
[Wed Apr 01 22:18:17.440638 2026] [:error] [pid 8910:tid 8991] [client 52.156.211.140:36995] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "ac0pKaJZINUcF3tYgExzOgAAARc"]
[Wed Apr 01 22:18:17.955252 2026] [:error] [pid 62559:tid 62570] [client 52.156.211.140:37214] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "ac0pKS7NKI8IaNKZFIe9QQAAAUk"]
[Wed Apr 01 22:18:18.470984 2026] [:error] [pid 62559:tid 62578] [client 52.156.211.140:4042] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/z60.php"] [unique_id "ac0pKi7NKI8IaNKZFIe9RQAAAVE"]
[Wed Apr 01 22:18:18.978842 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:36992] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "ac0pKi7NKI8IaNKZFIe9SwAAAVU"]
[Wed Apr 01 22:18:19.484764 2026] [:error] [pid 8995:tid 9007] [client 52.156.211.140:37050] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "ac0pK-onaBjs3qxcRefeogAAAAk"]
[Wed Apr 01 22:18:19.995554 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:36994] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "ac0pK_kmxtJXGnLdvgCrVgAAAI8"]
[Wed Apr 01 22:18:21.528820 2026] [:error] [pid 8995:tid 9011] [client 52.156.211.140:4034] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "ac0pLeonaBjs3qxcRefepAAAAA0"]
[Wed Apr 01 22:18:23.085988 2026] [:error] [pid 8910:tid 8973] [client 52.156.211.140:37230] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0pL6JZINUcF3tYgExzQAAAAQU"]
[Wed Apr 01 22:18:23.619519 2026] [:error] [pid 17856:tid 17861] [client 52.156.211.140:36997] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0pLz7Idlm5j9frhqRkxAAAAEM"]
[Wed Apr 01 22:18:25.346426 2026] [:error] [pid 62559:tid 62561] [client 52.156.211.140:37233] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0pMS7NKI8IaNKZFIe9XQAAAUA"]
[Wed Apr 01 22:18:25.852685 2026] [:error] [pid 8910:tid 8970] [client 52.156.211.140:37055] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "ac0pMaJZINUcF3tYgExzRAAAAQI"]
[Wed Apr 01 22:18:26.378129 2026] [:error] [pid 8995:tid 9006] [client 52.156.211.140:4067] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "ac0pMuonaBjs3qxcRefergAAAAg"]
[Wed Apr 01 22:18:26.903988 2026] [:error] [pid 62559:tid 62576] [client 52.156.211.140:37240] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "ac0pMi7NKI8IaNKZFIe9YwAAAU8"]
[Wed Apr 01 22:18:27.406904 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:37014] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "ac0pMy7NKI8IaNKZFIe9ZQAAAVU"]
[Wed Apr 01 22:18:28.921448 2026] [:error] [pid 17856:tid 17861] [client 52.156.211.140:37034] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sql.php"] [unique_id "ac0pND7Idlm5j9frhqRkzwAAAEM"]
[Wed Apr 01 22:18:29.443700 2026] [:error] [pid 62559:tid 62567] [client 52.156.211.140:37222] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0pNS7NKI8IaNKZFIe9bQAAAUY"]
[Wed Apr 01 22:18:29.975667 2026] [:error] [pid 62559:tid 62570] [client 52.156.211.140:37019] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0pNS7NKI8IaNKZFIe9dAAAAUk"]
[Wed Apr 01 22:18:30.486141 2026] [:error] [pid 8909:tid 8951] [client 52.156.211.140:4047] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0pNjvP_a0662gDl6DztQAAAMo"]
[Wed Apr 01 22:18:31.012105 2026] [:error] [pid 8910:tid 8974] [client 52.156.211.140:37033] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0pN6JZINUcF3tYgExzTgAAAQY"]
[Wed Apr 01 22:18:31.540535 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:37205] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "ac0pNy7NKI8IaNKZFIe9eQAAAVY"]
[Wed Apr 01 22:18:32.048144 2026] [:error] [pid 62559:tid 62571] [client 52.156.211.140:37236] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "ac0pOC7NKI8IaNKZFIe9ewAAAUo"]
[Wed Apr 01 22:18:32.555226 2026] [:error] [pid 62559:tid 62581] [client 52.156.211.140:37023] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "ac0pOC7NKI8IaNKZFIe9ggAAAVQ"]
[Wed Apr 01 22:18:33.058082 2026] [:error] [pid 62559:tid 62567] [client 52.156.211.140:37195] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "ac0pOS7NKI8IaNKZFIe9hAAAAUY"]
[Wed Apr 01 22:18:33.562193 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:37003] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "ac0pOS7NKI8IaNKZFIe9iAAAAUM"]
[Wed Apr 01 22:18:34.086500 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:4048] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "ac0pOj7Idlm5j9frhqRk4AAAAEE"]
[Wed Apr 01 22:18:35.591362 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:4094] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "ac0pOz7Idlm5j9frhqRk5QAAAEA"]
[Wed Apr 01 22:18:36.113157 2026] [:error] [pid 8909:tid 8959] [client 52.156.211.140:37027] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "ac0pPDvP_a0662gDl6DzvwAAANI"]
[Wed Apr 01 22:18:36.647922 2026] [:error] [pid 8908:tid 8917] [client 52.156.211.140:4043] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "ac0pPPkmxtJXGnLdvgCrZgAAAIQ"]
[Wed Apr 01 22:18:37.155788 2026] [:error] [pid 8908:tid 8920] [client 52.156.211.140:36999] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "ac0pPfkmxtJXGnLdvgCragAAAIc"]
[Wed Apr 01 22:18:37.672354 2026] [:error] [pid 8908:tid 8933] [client 52.156.211.140:4049] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "ac0pPfkmxtJXGnLdvgCrbAAAAJQ"]
[Wed Apr 01 22:18:38.208158 2026] [:error] [pid 8910:tid 8978] [client 52.156.211.140:37224] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "ac0pPqJZINUcF3tYgExzWAAAAQo"]
[Wed Apr 01 22:18:38.715708 2026] [:error] [pid 8910:tid 8977] [client 52.156.211.140:37022] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uang.php"] [unique_id "ac0pPqJZINUcF3tYgExzWgAAAQk"]
[Wed Apr 01 22:18:39.219627 2026] [:error] [pid 8908:tid 8936] [client 52.156.211.140:37219] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uang.php"] [unique_id "ac0pP_kmxtJXGnLdvgCrbgAAAJc"]
[Wed Apr 01 22:18:39.724861 2026] [:error] [pid 8908:tid 8928] [client 52.156.211.140:37204] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uang.php"] [unique_id "ac0pP_kmxtJXGnLdvgCrcQAAAI8"]
[Wed Apr 01 22:18:40.231539 2026] [:error] [pid 17856:tid 17872] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/uang.php
[Wed Apr 01 22:18:40.486810 2026] [:error] [pid 17856:tid 17860] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/save.php
[Wed Apr 01 22:18:40.818700 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Wed Apr 01 22:18:41.092872 2026] [:error] [pid 17856:tid 17876] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Wed Apr 01 22:18:41.360975 2026] [:error] [pid 17856:tid 17862] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Apr 01 22:18:41.614741 2026] [:error] [pid 17856:tid 17877] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Wed Apr 01 22:18:42.477925 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Apr 01 22:18:42.740883 2026] [:error] [pid 17856:tid 17875] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Wed Apr 01 22:18:43.420714 2026] [:error] [pid 17856:tid 17858] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Wed Apr 01 22:18:43.704586 2026] [:error] [pid 17856:tid 17866] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/sweg.php
[Wed Apr 01 22:18:43.958513 2026] [:error] [pid 17856:tid 17867] [client 52.156.211.140:4086] File does not exist: /usr/local/apache/htdocs/suspended-page/xpwer1.php
[Wed Apr 01 22:18:44.210069 2026] [:error] [pid 17856:tid 17874] [client 52.156.211.140:4086] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws40.php"] [unique_id "ac0pRD7Idlm5j9frhqRlAwAAAFA"]
[Wed Apr 01 22:18:45.211087 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:37011] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws40.php"] [unique_id "ac0pRTvP_a0662gDl6Dz3AAAANQ"]
[Wed Apr 01 22:18:46.715811 2026] [:error] [pid 62559:tid 62561] [client 52.156.211.140:37026] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws40.php"] [unique_id "ac0pRi7NKI8IaNKZFIe9mgAAAUA"]
[Wed Apr 01 22:18:47.217440 2026] [:error] [pid 8995:tid 9010] [client 52.156.211.140:4036] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws40.php"] [unique_id "ac0pR-onaBjs3qxcRefeuAAAAAw"]
[Wed Apr 01 22:18:47.719940 2026] [:error] [pid 8909:tid 8948] [client 52.156.211.140:37020] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ac0pRzvP_a0662gDl6Dz5gAAAMc"]
[Wed Apr 01 22:18:48.231749 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:4087] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ac0pSC7NKI8IaNKZFIe9oQAAAVU"]
[Wed Apr 01 22:18:48.733345 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:37199] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ac0pSC7NKI8IaNKZFIe9pwAAAVY"]
[Wed Apr 01 22:18:49.241577 2026] [:error] [pid 8910:tid 8973] [client 52.156.211.140:4072] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ac0pSaJZINUcF3tYgExzYwAAAQU"]
[Wed Apr 01 22:18:50.344816 2026] [:error] [pid 62559:tid 62563] [client 52.156.211.140:4046] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "ac0pSi7NKI8IaNKZFIe9rgAAAUI"]
[Wed Apr 01 22:18:51.443101 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:4062] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "ac0pSy7NKI8IaNKZFIe9sAAAAVU"]
[Wed Apr 01 22:18:52.547961 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:37193] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "ac0pTC7NKI8IaNKZFIe9swAAAUg"]
[Wed Apr 01 22:18:53.046947 2026] [:error] [pid 8909:tid 8965] [client 52.156.211.140:4004] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "ac0pTTvP_a0662gDl6Dz8gAAANg"]
[Wed Apr 01 22:18:54.124936 2026] [:error] [pid 17856:tid 17881] [client 52.156.211.140:4063] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "ac0pTj7Idlm5j9frhqRlGAAAAFc"]
[Wed Apr 01 22:18:54.646603 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:37202] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "ac0pTi7NKI8IaNKZFIe9uwAAAUM"]
[Wed Apr 01 22:18:56.033115 2026] [:error] [pid 17856:tid 17863] [client 52.156.211.140:4039] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "ac0pUD7Idlm5j9frhqRlGgAAAEU"]
[Wed Apr 01 22:18:56.558749 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:4090] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellerr.php"] [unique_id "ac0pUDvP_a0662gDl6Dz_AAAAME"]
[Wed Apr 01 22:18:58.089293 2026] [:error] [pid 8909:tid 8947] [client 52.156.211.140:37030] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "ac0pUjvP_a0662gDl6D0BQAAAMY"]
[Wed Apr 01 22:18:58.607491 2026] [:error] [pid 8908:tid 8931] [client 52.156.211.140:4033] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "ac0pUvkmxtJXGnLdvgCrggAAAJI"]
[Wed Apr 01 22:18:59.126115 2026] [:error] [pid 8995:tid 9012] [client 52.156.211.140:37200] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "ac0pU-onaBjs3qxcRefevQAAAA4"]
[Wed Apr 01 22:18:59.636118 2026] [:error] [pid 8909:tid 8950] [client 52.156.211.140:3998] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-scanner.php"] [unique_id "ac0pUzvP_a0662gDl6D0CgAAAMk"]
[Wed Apr 01 22:19:00.160518 2026] [:error] [pid 8908:tid 8918] [client 52.156.211.140:37228] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ac0pVPkmxtJXGnLdvgCrhwAAAIU"]
[Wed Apr 01 22:19:01.670353 2026] [:error] [pid 8995:tid 9002] [client 52.156.211.140:4055] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ac0pVeonaBjs3qxcRefewgAAAAQ"]
[Wed Apr 01 22:19:02.179685 2026] [:error] [pid 8995:tid 9009] [client 52.156.211.140:4081] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ac0pVuonaBjs3qxcRefexgAAAAs"]
[Wed Apr 01 22:19:02.682776 2026] [:error] [pid 62559:tid 62584] [client 52.156.211.140:4053] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ac0pVi7NKI8IaNKZFIe9yQAAAVc"]
[Wed Apr 01 22:19:03.198481 2026] [:error] [pid 62559:tid 62580] [client 52.156.211.140:4065] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "ac0pVy7NKI8IaNKZFIe9ygAAAVM"]
[Wed Apr 01 22:19:03.732715 2026] [:error] [pid 17856:tid 17862] [client 52.156.211.140:3994] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "ac0pVz7Idlm5j9frhqRlIAAAAEQ"]
[Wed Apr 01 22:19:04.239570 2026] [:error] [pid 62559:tid 62561] [client 52.156.211.140:37212] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "ac0pWC7NKI8IaNKZFIe90AAAAUA"]
[Wed Apr 01 22:19:04.740545 2026] [:error] [pid 62559:tid 62584] [client 52.156.211.140:4020] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/to.php"] [unique_id "ac0pWC7NKI8IaNKZFIe91AAAAVc"]
[Wed Apr 01 22:19:05.243088 2026] [:error] [pid 8909:tid 8952] [client 52.156.211.140:3989] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0pWTvP_a0662gDl6D0DwAAAMs"]
[Wed Apr 01 22:19:05.753252 2026] [:error] [pid 8908:tid 8936] [client 52.156.211.140:37245] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0pWfkmxtJXGnLdvgCriwAAAJc"]
[Wed Apr 01 22:19:06.258137 2026] [:error] [pid 62559:tid 62582] [client 52.156.211.140:37225] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0pWi7NKI8IaNKZFIe93gAAAVU"]
[Wed Apr 01 22:19:06.761375 2026] [:error] [pid 62559:tid 62576] [client 52.156.211.140:4061] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0pWi7NKI8IaNKZFIe94wAAAU8"]
[Wed Apr 01 22:19:07.851475 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:3977] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "ac0pW_kmxtJXGnLdvgCrkAAAAIk"]
[Wed Apr 01 22:19:08.387422 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:4001] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "ac0pXD7Idlm5j9frhqRlJwAAAFQ"]
[Wed Apr 01 22:19:08.892012 2026] [:error] [pid 8910:tid 8971] [client 52.156.211.140:37015] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "ac0pXKJZINUcF3tYgExzaAAAAQM"]
[Wed Apr 01 22:19:09.985862 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:3997] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ant.php"] [unique_id "ac0pXeonaBjs3qxcRefezgAAABg"]
[Wed Apr 01 22:19:10.533060 2026] [:error] [pid 62559:tid 62576] [client 52.156.211.140:3908] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "ac0pXi7NKI8IaNKZFIe98AAAAU8"]
[Wed Apr 01 22:19:11.046810 2026] [:error] [pid 8995:tid 9011] [client 52.156.211.140:3990] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "ac0pX-onaBjs3qxcRefe0QAAAA0"]
[Wed Apr 01 22:19:12.141092 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:37211] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "ac0pYC7NKI8IaNKZFIe99QAAAVY"]
[Wed Apr 01 22:19:12.730350 2026] [:error] [pid 8908:tid 8916] [client 52.156.211.140:37029] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "ac0pYPkmxtJXGnLdvgCrnwAAAIM"]
[Wed Apr 01 22:19:13.241355 2026] [:error] [pid 8908:tid 8934] [client 52.156.211.140:37039] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "ac0pYfkmxtJXGnLdvgCroAAAAJU"]
[Wed Apr 01 22:19:13.747990 2026] [:error] [pid 8908:tid 8914] [client 52.156.211.140:37044] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "ac0pYfkmxtJXGnLdvgCroQAAAIE"]
[Wed Apr 01 22:19:14.251221 2026] [:error] [pid 8910:tid 8969] [client 52.156.211.140:4085] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "ac0pYqJZINUcF3tYgExzbwAAAQE"]
[Wed Apr 01 22:19:14.753118 2026] [:error] [pid 8910:tid 8973] [client 52.156.211.140:37018] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "ac0pYqJZINUcF3tYgExzcAAAAQU"]
[Wed Apr 01 22:19:15.266444 2026] [:error] [pid 17856:tid 17878] [client 52.156.211.140:3921] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ac0pYz7Idlm5j9frhqRlLgAAAFQ"]
[Wed Apr 01 22:19:16.795660 2026] [:error] [pid 8908:tid 8932] [client 52.156.211.140:37031] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ac0pZPkmxtJXGnLdvgCrrAAAAJM"]
[Wed Apr 01 22:19:17.297465 2026] [:error] [pid 8909:tid 8957] [client 52.156.211.140:3971] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ac0pZTvP_a0662gDl6D0GAAAANA"]
[Wed Apr 01 22:19:17.799063 2026] [:error] [pid 8910:tid 8992] [client 52.156.211.140:37221] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ac0pZaJZINUcF3tYgExzdQAAARg"]
[Wed Apr 01 22:19:18.302738 2026] [:error] [pid 8909:tid 8961] [client 52.156.211.140:37009] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "ac0pZjvP_a0662gDl6D0GQAAANQ"]
[Wed Apr 01 22:19:18.831394 2026] [:error] [pid 8908:tid 8927] [client 52.156.211.140:4040] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "ac0pZvkmxtJXGnLdvgCrsgAAAI4"]
[Wed Apr 01 22:19:20.103669 2026] [:error] [pid 8908:tid 8929] [client 52.156.211.140:37234] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "ac0paPkmxtJXGnLdvgCrtwAAAJA"]
[Wed Apr 01 22:19:20.608641 2026] [:error] [pid 17856:tid 17872] [client 52.156.211.140:4050] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classgoto24.php"] [unique_id "ac0paD7Idlm5j9frhqRlNgAAAE4"]
[Wed Apr 01 22:19:21.112008 2026] [:error] [pid 8908:tid 8927] [client 52.156.211.140:4076] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "ac0pafkmxtJXGnLdvgCrvAAAAI4"]
[Wed Apr 01 22:19:21.644536 2026] [:error] [pid 8908:tid 8918] [client 52.156.211.140:3923] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "ac0pafkmxtJXGnLdvgCrvgAAAIU"]
[Wed Apr 01 22:19:22.160414 2026] [:error] [pid 8910:tid 8978] [client 52.156.211.140:37028] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "ac0paqJZINUcF3tYgExzgwAAAQo"]
[Wed Apr 01 22:19:22.674432 2026] [:error] [pid 8910:tid 8982] [client 52.156.211.140:3968] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "ac0paqJZINUcF3tYgExzhgAAAQ4"]
[Wed Apr 01 22:19:23.177030 2026] [:error] [pid 8908:tid 8922] [client 52.156.211.140:37032] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "ac0pa_kmxtJXGnLdvgCrxgAAAIk"]
[Wed Apr 01 22:19:23.681451 2026] [:error] [pid 8910:tid 8990] [client 52.156.211.140:37005] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "ac0pa6JZINUcF3tYgExzigAAARY"]
[Wed Apr 01 22:19:24.186830 2026] [:error] [pid 8908:tid 8934] [client 52.156.211.140:4089] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "ac0pbPkmxtJXGnLdvgCrzAAAAJU"]
[Wed Apr 01 22:19:25.698897 2026] [:error] [pid 62559:tid 62575] [client 52.156.211.140:4038] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws43.php"] [unique_id "ac0pbS7NKI8IaNKZFIe-BgAAAU4"]
[Wed Apr 01 22:19:26.216928 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:37047] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "ac0pbj7Idlm5j9frhqRlQAAAAFg"]
[Wed Apr 01 22:19:26.740983 2026] [:error] [pid 62559:tid 62562] [client 52.156.211.140:37025] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "ac0pbi7NKI8IaNKZFIe-CQAAAUE"]
[Wed Apr 01 22:19:27.249461 2026] [:error] [pid 17856:tid 17859] [client 52.156.211.140:4025] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "ac0pbz7Idlm5j9frhqRlQQAAAEE"]
[Wed Apr 01 22:19:27.772962 2026] [:error] [pid 8995:tid 9017] [client 52.156.211.140:4014] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gec.php"] [unique_id "ac0pb-onaBjs3qxcRefe8AAAABM"]
[Wed Apr 01 22:19:28.274219 2026] [:error] [pid 62559:tid 62570] [client 52.156.211.140:3916] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ac0pcC7NKI8IaNKZFIe-DwAAAUk"]
[Wed Apr 01 22:19:28.780917 2026] [:error] [pid 62559:tid 62571] [client 52.156.211.140:3999] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ac0pcC7NKI8IaNKZFIe-EQAAAUo"]
[Wed Apr 01 22:19:29.297310 2026] [:error] [pid 62559:tid 62563] [client 52.156.211.140:3972] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ac0pcS7NKI8IaNKZFIe-GAAAAUI"]
[Wed Apr 01 22:19:30.822907 2026] [:error] [pid 8909:tid 8964] [client 52.156.211.140:3992] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ac0pcjvP_a0662gDl6D0MwAAANc"]
[Wed Apr 01 22:19:31.329752 2026] [:error] [pid 8995:tid 9010] [client 52.156.211.140:4022] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ac0pc-onaBjs3qxcRefe-QAAAAw"]
[Wed Apr 01 22:19:31.853469 2026] [:error] [pid 8909:tid 8947] [client 52.156.211.140:4073] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ac0pczvP_a0662gDl6D0NAAAAMY"]
[Wed Apr 01 22:19:32.360330 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:4056] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ac0pdC7NKI8IaNKZFIe-HQAAAUM"]
[Wed Apr 01 22:19:32.867621 2026] [:error] [pid 8910:tid 8970] [client 52.156.211.140:3978] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ac0pdKJZINUcF3tYgExzjQAAAQI"]
[Wed Apr 01 22:19:34.146991 2026] [:error] [pid 62559:tid 62561] [client 52.156.211.140:3973] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "ac0pdi7NKI8IaNKZFIe-IwAAAUA"]
[Wed Apr 01 22:19:34.658972 2026] [:error] [pid 8908:tid 8924] [client 52.156.211.140:4041] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "ac0pdvkmxtJXGnLdvgCr1AAAAIs"]
[Wed Apr 01 22:19:35.189647 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:4092] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "ac0pdy7NKI8IaNKZFIe-KQAAAUM"]
[Wed Apr 01 22:19:36.695527 2026] [:error] [pid 8909:tid 8960] [client 52.156.211.140:37040] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "ac0peDvP_a0662gDl6D0QAAAANM"]
[Wed Apr 01 22:19:37.205168 2026] [:error] [pid 8995:tid 9020] [client 52.156.211.140:4075] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ac0peeonaBjs3qxcRefe_QAAABY"]
[Wed Apr 01 22:19:37.807415 2026] [:error] [pid 8908:tid 8921] [client 52.156.211.140:37216] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ac0pefkmxtJXGnLdvgCr3gAAAIg"]
[Wed Apr 01 22:19:38.311411 2026] [:error] [pid 62559:tid 62565] [client 52.156.211.140:37049] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ac0pei7NKI8IaNKZFIe-LwAAAUQ"]
[Wed Apr 01 22:19:38.818223 2026] [:error] [pid 8909:tid 8954] [client 52.156.211.140:37037] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ac0pejvP_a0662gDl6D0RgAAAM0"]
[Wed Apr 01 22:19:40.363387 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:4010] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ac0pfOonaBjs3qxcReffAgAAABg"]
[Wed Apr 01 22:19:40.869168 2026] [:error] [pid 17856:tid 17873] [client 52.156.211.140:4080] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ac0pfD7Idlm5j9frhqRlUQAAAE8"]
[Wed Apr 01 22:19:41.388637 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:3962] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ac0pfS7NKI8IaNKZFIe-OgAAAU0"]
[Wed Apr 01 22:19:41.893067 2026] [:error] [pid 8910:tid 8969] [client 52.156.211.140:37229] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ac0pfaJZINUcF3tYgExzkAAAAQE"]
[Wed Apr 01 22:19:42.393397 2026] [:error] [pid 8910:tid 8979] [client 52.156.211.140:3957] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "ac0pfqJZINUcF3tYgExzkgAAAQs"]
[Wed Apr 01 22:19:45.905375 2026] [:error] [pid 62559:tid 62573] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Wed Apr 01 22:19:46.159062 2026] [:error] [pid 62559:tid 62570] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Wed Apr 01 22:19:46.412674 2026] [:error] [pid 62559:tid 62572] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/vaza.php
[Wed Apr 01 22:19:46.678324 2026] [:error] [pid 62559:tid 62567] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Wed Apr 01 22:19:47.749704 2026] [:error] [pid 62559:tid 62575] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/xc0252.php
[Wed Apr 01 22:19:48.003938 2026] [:error] [pid 62559:tid 62580] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Wed Apr 01 22:19:48.254811 2026] [:error] [pid 62559:tid 62563] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Wed Apr 01 22:19:48.862492 2026] [:error] [pid 62559:tid 62572] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/wp3.php
[Wed Apr 01 22:19:49.125977 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:4093] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Wed Apr 01 22:19:49.404181 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:4093] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "ac0phS7NKI8IaNKZFIe-VwAAAVA"]
[Wed Apr 01 22:19:50.448635 2026] [:error] [pid 62559:tid 62563] [client 52.156.211.140:3969] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "ac0phi7NKI8IaNKZFIe-WgAAAUI"]
[Wed Apr 01 22:19:51.054506 2026] [:error] [pid 8908:tid 8919] [client 52.156.211.140:3985] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "ac0ph_kmxtJXGnLdvgCsJgAAAIY"]
[Wed Apr 01 22:19:51.586790 2026] [:error] [pid 17856:tid 17864] [client 52.156.211.140:3986] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v.php"] [unique_id "ac0phz7Idlm5j9frhqRlXAAAAEY"]
[Wed Apr 01 22:19:52.174369 2026] [:error] [pid 8908:tid 8916] [client 52.156.211.140:4011] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "ac0piPkmxtJXGnLdvgCsLAAAAIM"]
[Wed Apr 01 22:19:52.707114 2026] [:error] [pid 8909:tid 8942] [client 52.156.211.140:3910] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "ac0piDvP_a0662gDl6D0VgAAAME"]
[Wed Apr 01 22:19:53.854708 2026] [:error] [pid 8909:tid 8959] [client 52.156.211.140:37207] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "ac0piTvP_a0662gDl6D0WwAAANI"]
[Wed Apr 01 22:19:54.382579 2026] [:error] [pid 8995:tid 9011] [client 52.156.211.140:4023] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d2.php"] [unique_id "ac0piuonaBjs3qxcReffDgAAAA0"]
[Wed Apr 01 22:19:54.897732 2026] [:error] [pid 8908:tid 8937] [client 52.156.211.140:4026] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "ac0pivkmxtJXGnLdvgCsPAAAAJg"]
[Wed Apr 01 22:19:55.400321 2026] [:error] [pid 8910:tid 8986] [client 52.156.211.140:37038] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "ac0pi6JZINUcF3tYgExznwAAARI"]
[Wed Apr 01 22:19:55.910773 2026] [:error] [pid 62559:tid 62580] [client 52.156.211.140:4008] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "ac0piy7NKI8IaNKZFIe-YgAAAVM"]
[Wed Apr 01 22:19:57.472490 2026] [:error] [pid 62559:tid 62576] [client 52.156.211.140:4082] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc.php"] [unique_id "ac0pjS7NKI8IaNKZFIe-ZwAAAU8"]
[Wed Apr 01 22:19:58.023627 2026] [:error] [pid 8909:tid 8960] [client 52.156.211.140:4044] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ac0pjjvP_a0662gDl6D0ZwAAANM"]
[Wed Apr 01 22:19:59.560977 2026] [:error] [pid 8910:tid 8970] [client 52.156.211.140:4035] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ac0pj6JZINUcF3tYgExzpAAAAQI"]
[Wed Apr 01 22:20:00.067547 2026] [:error] [pid 62559:tid 62564] [client 52.156.211.140:37048] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ac0pkC7NKI8IaNKZFIe-bgAAAUM"]
[Wed Apr 01 22:20:01.148852 2026] [:error] [pid 62559:tid 62569] [client 52.156.211.140:3930] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ac0pkS7NKI8IaNKZFIe-cQAAAUg"]
[Wed Apr 01 22:20:02.238718 2026] [:error] [pid 8910:tid 8985] [client 52.156.211.140:3980] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "ac0pkqJZINUcF3tYgExzqgAAARE"]
[Wed Apr 01 22:20:03.641498 2026] [:error] [pid 8910:tid 8990] [client 52.156.211.140:3907] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "ac0pk6JZINUcF3tYgExzsgAAARY"]
[Wed Apr 01 22:20:04.143823 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:37042] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "ac0plC7NKI8IaNKZFIe-eQAAAVA"]
[Wed Apr 01 22:20:04.727712 2026] [:error] [pid 8995:tid 9013] [client 52.156.211.140:3993] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "ac0plOonaBjs3qxcReffEQAAAA8"]
[Wed Apr 01 22:20:05.232297 2026] [:error] [pid 8995:tid 9002] [client 52.156.211.140:4071] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "ac0pleonaBjs3qxcReffFgAAAAQ"]
[Wed Apr 01 22:20:05.735936 2026] [:error] [pid 8995:tid 8999] [client 52.156.211.140:4068] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "ac0pleonaBjs3qxcReffGgAAAAE"]
[Wed Apr 01 22:20:06.247127 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:4077] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "ac0pli7NKI8IaNKZFIe-fwAAAU0"]
[Wed Apr 01 22:20:06.762488 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:3870] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "ac0plj7Idlm5j9frhqRldQAAAFg"]
[Wed Apr 01 22:20:07.285343 2026] [:error] [pid 8908:tid 8914] [client 52.156.211.140:3991] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/20.php"] [unique_id "ac0pl_kmxtJXGnLdvgCsQwAAAIE"]
[Wed Apr 01 22:20:07.791653 2026] [:error] [pid 62559:tid 62579] [client 52.156.211.140:3984] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/20.php"] [unique_id "ac0ply7NKI8IaNKZFIe-hQAAAVI"]
[Wed Apr 01 22:20:08.296306 2026] [:error] [pid 8908:tid 8931] [client 52.156.211.140:3964] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/20.php"] [unique_id "ac0pmPkmxtJXGnLdvgCsRAAAAJI"]
[Wed Apr 01 22:20:08.803925 2026] [:error] [pid 62559:tid 62566] [client 52.156.211.140:3922] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/20.php"] [unique_id "ac0pmC7NKI8IaNKZFIe-iwAAAUU"]
[Wed Apr 01 22:20:09.364193 2026] [:error] [pid 62559:tid 62580] [client 52.156.211.140:4078] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ac0pmS7NKI8IaNKZFIe-jAAAAVM"]
[Wed Apr 01 22:20:09.873725 2026] [:error] [pid 8995:tid 9001] [client 52.156.211.140:3919] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ac0pmeonaBjs3qxcReffIgAAAAM"]
[Wed Apr 01 22:20:10.387499 2026] [:error] [pid 8995:tid 9022] [client 52.156.211.140:3944] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ac0pmuonaBjs3qxcReffJQAAABg"]
[Wed Apr 01 22:20:10.897082 2026] [:error] [pid 17856:tid 17868] [client 52.156.211.140:3976] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ac0pmj7Idlm5j9frhqRlfgAAAEo"]
[Wed Apr 01 22:20:11.467431 2026] [:error] [pid 17856:tid 17865] [client 52.156.211.140:3913] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "ac0pmz7Idlm5j9frhqRliAAAAEc"]
[Wed Apr 01 22:20:11.971068 2026] [:error] [pid 8995:tid 9003] [client 52.156.211.140:3931] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "ac0pm-onaBjs3qxcReffKgAAAAU"]
[Wed Apr 01 22:20:12.475593 2026] [:error] [pid 17856:tid 17882] [client 52.156.211.140:3915] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "ac0pnD7Idlm5j9frhqRlngAAAFg"]
[Wed Apr 01 22:20:12.988271 2026] [:error] [pid 62559:tid 62574] [client 52.156.211.140:3959] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c.php"] [unique_id "ac0pnC7NKI8IaNKZFIe-lQAAAU0"]
[Wed Apr 01 22:20:13.508874 2026] [:error] [pid 62559:tid 62577] [client 52.156.211.140:37184] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "ac0pnS7NKI8IaNKZFIe-mQAAAVA"]
[Wed Apr 01 22:20:14.038743 2026] [:error] [pid 8995:tid 9010] [client 52.156.211.140:4002] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "ac0pnuonaBjs3qxcReffLgAAAAw"]
[Wed Apr 01 22:20:14.560415 2026] [:error] [pid 62559:tid 62583] [client 52.156.211.140:4007] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "ac0pni7NKI8IaNKZFIe-ogAAAVY"]
[Wed Apr 01 22:20:15.069713 2026] [:error] [pid 62559:tid 62571] [client 52.156.211.140:4013] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we2.php"] [unique_id "ac0pny7NKI8IaNKZFIe-qQAAAUo"]
[Wed Apr 01 22:20:16.605673 2026] [:error] [pid 8909:tid 8959] [client 52.156.211.140:4070] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "ac0poDvP_a0662gDl6D0bAAAANI"]
[Wed Apr 01 22:20:17.106707 2026] [:error] [pid 62559:tid 62573] [client 52.156.211.140:4037] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "ac0poS7NKI8IaNKZFIe-vQAAAUw"]
[Wed Apr 01 22:20:17.628498 2026] [:error] [pid 8909:tid 8960] [client 52.156.211.140:3911] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "ac0poTvP_a0662gDl6D0bwAAANM"]
[Wed Apr 01 22:20:18.129694 2026] [:error] [pid 8910:tid 8985] [client 52.156.211.140:3918] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/04.php"] [unique_id "ac0poqJZINUcF3tYgExzuQAAARE"]
[Wed Apr 01 22:20:18.644920 2026] [:error] [pid 8995:tid 9009] [client 52.156.211.140:4027] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0pouonaBjs3qxcReffMQAAAAs"]
[Wed Apr 01 22:20:19.152345 2026] [:error] [pid 8995:tid 9021] [client 52.156.211.140:3974] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0po-onaBjs3qxcReffMgAAABc"]
[Wed Apr 01 22:20:19.658657 2026] [:error] [pid 8995:tid 9020] [client 52.156.211.140:3904] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0po-onaBjs3qxcReffNAAAABY"]
[Wed Apr 01 22:20:20.246567 2026] [:error] [pid 8995:tid 9014] [client 52.156.211.140:3966] [client 52.156.211.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0ppOonaBjs3qxcReffNwAAABA"]
[Wed Apr 01 22:36:17.638609 2026] [:error] [pid 8910:tid 8976] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 01 22:36:17.911587 2026] [:error] [pid 8910:tid 8988] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Wed Apr 01 22:36:18.170164 2026] [:error] [pid 8910:tid 8982] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Wed Apr 01 22:36:18.436837 2026] [:error] [pid 8910:tid 8972] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Wed Apr 01 22:36:18.696840 2026] [:error] [pid 8910:tid 8978] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/x1.php
[Wed Apr 01 22:36:18.954652 2026] [:error] [pid 8910:tid 8977] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Wed Apr 01 22:36:19.473618 2026] [:error] [pid 8910:tid 8971] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Wed Apr 01 22:36:19.741612 2026] [:error] [pid 8910:tid 8990] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/24.php
[Wed Apr 01 22:36:19.998377 2026] [:error] [pid 8910:tid 8975] [client 74.248.17.99:10214] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Wed Apr 01 22:36:20.253349 2026] [:error] [pid 8910:tid 8970] [client 74.248.17.99:10214] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "ac0tZKJZINUcF3tYgEx3sAAAAQI"]
[Wed Apr 01 22:36:20.768304 2026] [:error] [pid 8995:tid 8998] [client 74.248.17.99:10199] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "ac0tZOonaBjs3qxcRefj4AAAAAA"]
[Wed Apr 01 22:36:21.277329 2026] [:error] [pid 8908:tid 8933] [client 74.248.17.99:10225] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "ac0tZfkmxtJXGnLdvgC02gAAAJQ"]
[Wed Apr 01 22:36:21.789178 2026] [:error] [pid 8995:tid 9004] [client 74.248.17.99:10123] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "ac0tZeonaBjs3qxcRefj5QAAAAY"]
[Wed Apr 01 22:36:22.301349 2026] [:error] [pid 8908:tid 8919] [client 74.248.17.99:10196] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyiiz.php"] [unique_id "ac0tZvkmxtJXGnLdvgC04AAAAIY"]
[Wed Apr 01 22:36:22.814311 2026] [:error] [pid 8908:tid 8926] [client 74.248.17.99:10191] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyiiz.php"] [unique_id "ac0tZvkmxtJXGnLdvgC04wAAAI0"]
[Wed Apr 01 22:36:23.335737 2026] [:error] [pid 8910:tid 8988] [client 74.248.17.99:10132] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyiiz.php"] [unique_id "ac0tZ6JZINUcF3tYgEx3tAAAARQ"]
[Wed Apr 01 22:36:23.849340 2026] [:error] [pid 8995:tid 9017] [client 74.248.17.99:10124] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyiiz.php"] [unique_id "ac0tZ-onaBjs3qxcRefj6gAAABM"]
[Wed Apr 01 22:36:24.360518 2026] [:error] [pid 17856:tid 17863] [client 74.248.17.99:10172] [client 74.248.17.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/app.php"] [unique_id "ac0taD7Idlm5j9frhqRq5QAAAEU"]
[Wed Apr 01 22:36:24.873220 2026] [:error] [pid 17856:tid 17871] [client 74.248.17.99:10117] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0taD7Idlm5j9frhqRq5wAAAE0"]
[Wed Apr 01 22:36:25.386193 2026] [:error] [pid 62559:tid 62569] [client 74.248.17.99:10189] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0taS7NKI8IaNKZFIfKNQAAAUg"]
[Wed Apr 01 22:36:25.901084 2026] [:error] [pid 62559:tid 62565] [client 74.248.17.99:10234] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/max.php"] [unique_id "ac0taS7NKI8IaNKZFIfKOAAAAUQ"]
[Wed Apr 01 22:36:26.439204 2026] [:error] [pid 17856:tid 17873] [client 74.248.17.99:10119] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ac0taj7Idlm5j9frhqRq6QAAAE8"]
[Wed Apr 01 22:36:26.951948 2026] [:error] [pid 8910:tid 8992] [client 74.248.17.99:10232] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ac0taqJZINUcF3tYgEx3ugAAARg"]
[Wed Apr 01 22:36:27.462770 2026] [:error] [pid 62559:tid 62575] [client 74.248.17.99:10206] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ac0tay7NKI8IaNKZFIfKQAAAAU4"]
[Wed Apr 01 22:36:27.973077 2026] [:error] [pid 8908:tid 8928] [client 74.248.17.99:10137] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ac0ta_kmxtJXGnLdvgC08wAAAI8"]
[Wed Apr 01 22:36:28.483764 2026] [:error] [pid 8909:tid 8945] [client 74.248.17.99:10188] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0tbDvP_a0662gDl6D7GgAAAMQ"]
[Wed Apr 01 22:36:28.997055 2026] [:error] [pid 8909:tid 8960] [client 74.248.17.99:10115] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0tbDvP_a0662gDl6D7GwAAANM"]
[Wed Apr 01 22:36:29.508206 2026] [:error] [pid 8995:tid 9003] [client 74.248.17.99:10208] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0tbeonaBjs3qxcRefj8gAAAAU"]
[Wed Apr 01 22:36:30.018930 2026] [:error] [pid 8910:tid 8988] [client 74.248.17.99:10178] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "ac0tbqJZINUcF3tYgEx3vQAAARQ"]
[Wed Apr 01 22:36:30.555972 2026] [:error] [pid 8909:tid 8958] [client 74.248.17.99:10203] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ac0tbjvP_a0662gDl6D7HgAAANE"]
[Wed Apr 01 22:36:31.068179 2026] [:error] [pid 8995:tid 9009] [client 74.248.17.99:10211] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ac0tb-onaBjs3qxcRefj9AAAAAs"]
[Wed Apr 01 22:36:31.579906 2026] [:error] [pid 62559:tid 62567] [client 74.248.17.99:10202] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ac0tby7NKI8IaNKZFIfKUQAAAUY"]
[Wed Apr 01 22:36:32.089696 2026] [:error] [pid 62559:tid 62570] [client 74.248.17.99:10125] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ac0tcC7NKI8IaNKZFIfKVAAAAUk"]
[Wed Apr 01 22:36:32.600702 2026] [:error] [pid 8910:tid 8985] [client 74.248.17.99:10181] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tcKJZINUcF3tYgEx3vwAAARE"]
[Wed Apr 01 22:36:33.115403 2026] [:error] [pid 8910:tid 8969] [client 74.248.17.99:10127] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tcaJZINUcF3tYgEx3wgAAAQE"]
[Wed Apr 01 22:36:33.628584 2026] [:error] [pid 62559:tid 62575] [client 74.248.17.99:10185] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tcS7NKI8IaNKZFIfKXQAAAU4"]
[Wed Apr 01 22:36:34.146176 2026] [:error] [pid 62559:tid 62572] [client 74.248.17.99:10204] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/index.php"] [unique_id "ac0tci7NKI8IaNKZFIfKYAAAAUs"]
[Wed Apr 01 22:36:34.655876 2026] [:error] [pid 62559:tid 62577] [client 74.248.17.99:10236] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "ac0tci7NKI8IaNKZFIfKZgAAAVA"]
[Wed Apr 01 22:36:35.169683 2026] [:error] [pid 8909:tid 8950] [client 74.248.17.99:10120] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "ac0tczvP_a0662gDl6D7JAAAAMk"]
[Wed Apr 01 22:36:35.679880 2026] [:error] [pid 17856:tid 17873] [client 74.248.17.99:10122] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "ac0tcz7Idlm5j9frhqRq8gAAAE8"]
[Wed Apr 01 22:36:36.190008 2026] [:error] [pid 8909:tid 8945] [client 74.248.17.99:10217] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/erty.php"] [unique_id "ac0tdDvP_a0662gDl6D7KwAAAMQ"]
[Wed Apr 01 22:36:36.702872 2026] [:error] [pid 8995:tid 9003] [client 74.248.17.99:10205] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "ac0tdOonaBjs3qxcRefj_wAAAAU"]
[Wed Apr 01 22:36:37.231101 2026] [:error] [pid 62559:tid 62566] [client 74.248.17.99:10118] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "ac0tdS7NKI8IaNKZFIfKdQAAAUU"]
[Wed Apr 01 22:36:37.744091 2026] [:error] [pid 17856:tid 17862] [client 74.248.17.99:10200] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "ac0tdT7Idlm5j9frhqRq9QAAAEQ"]
[Wed Apr 01 22:36:38.254183 2026] [:error] [pid 62559:tid 62577] [client 74.248.17.99:10193] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0.php"] [unique_id "ac0tdi7NKI8IaNKZFIfKeAAAAVA"]
[Wed Apr 01 22:36:38.767971 2026] [:error] [pid 8908:tid 8916] [client 74.248.17.99:10116] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0tdvkmxtJXGnLdvgC1BQAAAIM"]
[Wed Apr 01 22:36:39.279037 2026] [:error] [pid 8908:tid 8915] [client 74.248.17.99:10064] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0td_kmxtJXGnLdvgC1BgAAAII"]
[Wed Apr 01 22:36:39.800382 2026] [:error] [pid 62559:tid 62581] [client 74.248.17.99:10195] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0tdy7NKI8IaNKZFIfKfgAAAVQ"]
[Wed Apr 01 22:36:40.313516 2026] [:error] [pid 8995:tid 9002] [client 74.248.17.99:10237] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "ac0teOonaBjs3qxcRefkBQAAAAQ"]
[Wed Apr 01 22:36:40.824935 2026] [:error] [pid 8908:tid 8929] [client 74.248.17.99:10228] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0tePkmxtJXGnLdvgC1DQAAAJA"]
[Wed Apr 01 22:36:41.337908 2026] [:error] [pid 62559:tid 62574] [client 74.248.17.99:10209] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0teS7NKI8IaNKZFIfKhAAAAU0"]
[Wed Apr 01 22:36:41.851268 2026] [:error] [pid 8908:tid 8932] [client 74.248.17.99:10050] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0tefkmxtJXGnLdvgC1FAAAAJM"]
[Wed Apr 01 22:36:42.379019 2026] [:error] [pid 62559:tid 62581] [client 74.248.17.99:10207] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "ac0tei7NKI8IaNKZFIfKigAAAVQ"]
[Wed Apr 01 22:36:42.894030 2026] [:error] [pid 8908:tid 8927] [client 74.248.17.99:10231] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "ac0tevkmxtJXGnLdvgC1HQAAAI4"]
[Wed Apr 01 22:36:43.406952 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:10230] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "ac0tey7NKI8IaNKZFIfKkQAAAVY"]
[Wed Apr 01 22:36:43.938013 2026] [:error] [pid 62559:tid 62582] [client 74.248.17.99:10182] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "ac0tey7NKI8IaNKZFIfKlgAAAVU"]
[Wed Apr 01 22:36:44.465027 2026] [:error] [pid 62559:tid 62576] [client 74.248.17.99:10213] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "ac0tfC7NKI8IaNKZFIfKmQAAAU8"]
[Wed Apr 01 22:36:44.976437 2026] [:error] [pid 62559:tid 62569] [client 74.248.17.99:10143] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "ac0tfC7NKI8IaNKZFIfKnAAAAUg"]
[Wed Apr 01 22:36:45.505741 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:10223] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "ac0tfS7NKI8IaNKZFIfKoAAAAVY"]
[Wed Apr 01 22:36:46.017787 2026] [:error] [pid 62559:tid 62572] [client 74.248.17.99:10049] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "ac0tfi7NKI8IaNKZFIfKogAAAUs"]
[Wed Apr 01 22:36:46.527996 2026] [:error] [pid 62559:tid 62578] [client 74.248.17.99:10176] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "ac0tfi7NKI8IaNKZFIfKpAAAAVE"]
[Wed Apr 01 22:36:47.038248 2026] [:error] [pid 8995:tid 8998] [client 74.248.17.99:10141] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwq13.php"] [unique_id "ac0tf-onaBjs3qxcRefkCgAAAAA"]
[Wed Apr 01 22:36:47.548676 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:10059] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwq13.php"] [unique_id "ac0tfy7NKI8IaNKZFIfKrQAAAVY"]
[Wed Apr 01 22:36:48.062106 2026] [:error] [pid 62559:tid 62578] [client 74.248.17.99:10197] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwq13.php"] [unique_id "ac0tgC7NKI8IaNKZFIfKtAAAAVE"]
[Wed Apr 01 22:36:48.577397 2026] [:error] [pid 62559:tid 62581] [client 74.248.17.99:10149] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwq13.php"] [unique_id "ac0tgC7NKI8IaNKZFIfKtwAAAVQ"]
[Wed Apr 01 22:36:49.090000 2026] [:error] [pid 17856:tid 17865] [client 74.248.17.99:10128] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aapig.php"] [unique_id "ac0tgT7Idlm5j9frhqRrAQAAAEc"]
[Wed Apr 01 22:36:49.601957 2026] [:error] [pid 62559:tid 62570] [client 74.248.17.99:10142] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aapig.php"] [unique_id "ac0tgS7NKI8IaNKZFIfKvwAAAUk"]
[Wed Apr 01 22:36:50.116373 2026] [:error] [pid 62559:tid 62575] [client 74.248.17.99:10121] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aapig.php"] [unique_id "ac0tgi7NKI8IaNKZFIfKwgAAAU4"]
[Wed Apr 01 22:36:50.633672 2026] [:error] [pid 8995:tid 9008] [client 74.248.17.99:10055] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aapig.php"] [unique_id "ac0tguonaBjs3qxcRefkDwAAAAo"]
[Wed Apr 01 22:36:51.144796 2026] [:error] [pid 62559:tid 62582] [client 74.248.17.99:9987] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webadmin.php"] [unique_id "ac0tgy7NKI8IaNKZFIfKygAAAVU"]
[Wed Apr 01 22:36:51.656424 2026] [:error] [pid 62559:tid 62564] [client 74.248.17.99:10002] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webadmin.php"] [unique_id "ac0tgy7NKI8IaNKZFIfKzgAAAUM"]
[Wed Apr 01 22:36:52.172521 2026] [:error] [pid 62559:tid 62568] [client 74.248.17.99:10187] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webadmin.php"] [unique_id "ac0thC7NKI8IaNKZFIfK0gAAAUc"]
[Wed Apr 01 22:36:52.682051 2026] [:error] [pid 62559:tid 62562] [client 74.248.17.99:10215] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webadmin.php"] [unique_id "ac0thC7NKI8IaNKZFIfK0wAAAUE"]
[Wed Apr 01 22:36:53.210790 2026] [:error] [pid 17856:tid 17874] [client 74.248.17.99:10222] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "ac0thT7Idlm5j9frhqRrBgAAAFA"]
[Wed Apr 01 22:36:53.722936 2026] [:error] [pid 17856:tid 17867] [client 74.248.17.99:10212] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "ac0thT7Idlm5j9frhqRrCwAAAEk"]
[Wed Apr 01 22:36:54.237364 2026] [:error] [pid 62559:tid 62574] [client 74.248.17.99:10061] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "ac0thi7NKI8IaNKZFIfK2gAAAU0"]
[Wed Apr 01 22:36:54.749722 2026] [:error] [pid 62559:tid 62562] [client 74.248.17.99:10190] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xc0252.php"] [unique_id "ac0thi7NKI8IaNKZFIfK3AAAAUE"]
[Wed Apr 01 22:36:55.260798 2026] [:error] [pid 8908:tid 8932] [client 74.248.17.99:10112] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "ac0th_kmxtJXGnLdvgC1PgAAAJM"]
[Wed Apr 01 22:36:55.781384 2026] [:error] [pid 8908:tid 8928] [client 74.248.17.99:10226] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "ac0th_kmxtJXGnLdvgC1QQAAAI8"]
[Wed Apr 01 22:36:56.294140 2026] [:error] [pid 62559:tid 62581] [client 74.248.17.99:10144] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "ac0tiC7NKI8IaNKZFIfK5gAAAVQ"]
[Wed Apr 01 22:36:56.808357 2026] [:error] [pid 8995:tid 9006] [client 74.248.17.99:10076] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "ac0tiOonaBjs3qxcRefkEwAAAAg"]
[Wed Apr 01 22:36:57.323704 2026] [:error] [pid 62559:tid 62564] [client 74.248.17.99:10115] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "ac0tiS7NKI8IaNKZFIfK7QAAAUM"]
[Wed Apr 01 22:36:57.870093 2026] [:error] [pid 17856:tid 17876] [client 74.248.17.99:10133] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "ac0tiT7Idlm5j9frhqRrEwAAAFI"]
[Wed Apr 01 22:36:58.382540 2026] [:error] [pid 62559:tid 62578] [client 74.248.17.99:10210] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "ac0tii7NKI8IaNKZFIfK8wAAAVE"]
[Wed Apr 01 22:36:58.894582 2026] [:error] [pid 62559:tid 62565] [client 74.248.17.99:10173] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sc.php"] [unique_id "ac0tii7NKI8IaNKZFIfK9wAAAUQ"]
[Wed Apr 01 22:36:59.408330 2026] [:error] [pid 17856:tid 17872] [client 74.248.17.99:10113] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mis.php"] [unique_id "ac0tiz7Idlm5j9frhqRrGAAAAE4"]
[Wed Apr 01 22:36:59.922366 2026] [:error] [pid 17856:tid 17873] [client 74.248.17.99:10157] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mis.php"] [unique_id "ac0tiz7Idlm5j9frhqRrHQAAAE8"]
[Wed Apr 01 22:37:00.439728 2026] [:error] [pid 8908:tid 8925] [client 74.248.17.99:10239] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mis.php"] [unique_id "ac0tjPkmxtJXGnLdvgC1TAAAAIw"]
[Wed Apr 01 22:37:00.951519 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:10224] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mis.php"] [unique_id "ac0tjC7NKI8IaNKZFIfLAgAAAVY"]
[Wed Apr 01 22:37:01.470136 2026] [:error] [pid 8908:tid 8931] [client 74.248.17.99:10154] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "ac0tjfkmxtJXGnLdvgC1UwAAAJI"]
[Wed Apr 01 22:37:01.981177 2026] [:error] [pid 8995:tid 9018] [client 74.248.17.99:10126] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "ac0tjeonaBjs3qxcRefkGAAAABQ"]
[Wed Apr 01 22:37:02.493620 2026] [:error] [pid 17856:tid 17865] [client 74.248.17.99:10163] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "ac0tjj7Idlm5j9frhqRrIAAAAEc"]
[Wed Apr 01 22:37:03.003641 2026] [:error] [pid 8995:tid 9014] [client 74.248.17.99:10145] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "ac0tj-onaBjs3qxcRefkHgAAABA"]
[Wed Apr 01 22:37:03.513700 2026] [:error] [pid 8908:tid 8932] [client 74.248.17.99:10220] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xvs.php"] [unique_id "ac0tj_kmxtJXGnLdvgC1WAAAAJM"]
[Wed Apr 01 22:37:04.024996 2026] [:error] [pid 8995:tid 9000] [client 74.248.17.99:10091] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xvs.php"] [unique_id "ac0tkOonaBjs3qxcRefkIAAAAAI"]
[Wed Apr 01 22:37:04.544913 2026] [:error] [pid 8908:tid 8930] [client 74.248.17.99:10201] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xvs.php"] [unique_id "ac0tkPkmxtJXGnLdvgC1WgAAAJE"]
[Wed Apr 01 22:37:05.057405 2026] [:error] [pid 8909:tid 8951] [client 74.248.17.99:10235] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xvs.php"] [unique_id "ac0tkTvP_a0662gDl6D7PwAAAMo"]
[Wed Apr 01 22:37:05.568505 2026] [:error] [pid 8910:tid 8968] [client 74.248.17.99:10074] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ac0tkaJZINUcF3tYgEx4CAAAAQA"]
[Wed Apr 01 22:37:06.085345 2026] [:error] [pid 8910:tid 8981] [client 74.248.17.99:10229] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ac0tkqJZINUcF3tYgEx4DQAAAQ0"]
[Wed Apr 01 22:37:06.596945 2026] [:error] [pid 8910:tid 8991] [client 74.248.17.99:10149] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ac0tkqJZINUcF3tYgEx4EwAAARc"]
[Wed Apr 01 22:37:07.109200 2026] [:error] [pid 17856:tid 17876] [client 74.248.17.99:10233] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ac0tkz7Idlm5j9frhqRrLgAAAFI"]
[Wed Apr 01 22:37:07.636250 2026] [:error] [pid 17856:tid 17882] [client 74.248.17.99:10168] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "ac0tkz7Idlm5j9frhqRrMAAAAFg"]
[Wed Apr 01 22:37:08.149304 2026] [:error] [pid 62559:tid 62577] [client 74.248.17.99:10147] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "ac0tlC7NKI8IaNKZFIfLEAAAAVA"]
[Wed Apr 01 22:37:08.664505 2026] [:error] [pid 8909:tid 8952] [client 74.248.17.99:10138] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "ac0tlDvP_a0662gDl6D7RQAAAMs"]
[Wed Apr 01 22:37:09.177503 2026] [:error] [pid 8909:tid 8956] [client 74.248.17.99:10180] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/az.php"] [unique_id "ac0tlTvP_a0662gDl6D7RwAAAM8"]
[Wed Apr 01 22:37:09.691783 2026] [:error] [pid 8910:tid 8984] [client 74.248.17.99:10166] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "ac0tlaJZINUcF3tYgEx4JQAAARA"]
[Wed Apr 01 22:37:10.207953 2026] [:error] [pid 8910:tid 8980] [client 74.248.17.99:10221] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "ac0tlqJZINUcF3tYgEx4LAAAAQw"]
[Wed Apr 01 22:37:10.728290 2026] [:error] [pid 8995:tid 9014] [client 74.248.17.99:10152] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "ac0tluonaBjs3qxcRefkLQAAABA"]
[Wed Apr 01 22:37:11.255346 2026] [:error] [pid 8909:tid 8962] [client 74.248.17.99:10100] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web.php"] [unique_id "ac0tlzvP_a0662gDl6D7TAAAANU"]
[Wed Apr 01 22:37:11.772112 2026] [:error] [pid 8909:tid 8960] [client 74.248.17.99:10056] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tlzvP_a0662gDl6D7UQAAANM"]
[Wed Apr 01 22:37:12.283369 2026] [:error] [pid 62559:tid 62578] [client 74.248.17.99:10153] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tmC7NKI8IaNKZFIfLGgAAAVE"]
[Wed Apr 01 22:37:12.815331 2026] [:error] [pid 17856:tid 17872] [client 74.248.17.99:9996] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tmD7Idlm5j9frhqRrOQAAAE4"]
[Wed Apr 01 22:37:13.335284 2026] [:error] [pid 62559:tid 62580] [client 74.248.17.99:10128] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "ac0tmS7NKI8IaNKZFIfLIAAAAVM"]
[Wed Apr 01 22:37:13.883445 2026] [:error] [pid 62559:tid 62567] [client 74.248.17.99:10135] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "ac0tmS7NKI8IaNKZFIfLIwAAAUY"]
[Wed Apr 01 22:37:14.393695 2026] [:error] [pid 62559:tid 62581] [client 74.248.17.99:10146] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "ac0tmi7NKI8IaNKZFIfLJgAAAVQ"]
[Wed Apr 01 22:37:14.929063 2026] [:error] [pid 8908:tid 8933] [client 74.248.17.99:10221] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "ac0tmvkmxtJXGnLdvgC1aAAAAJQ"]
[Wed Apr 01 22:37:15.449150 2026] [:error] [pid 62559:tid 62562] [client 74.248.17.99:10114] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lp6.php"] [unique_id "ac0tmy7NKI8IaNKZFIfLKgAAAUE"]
[Wed Apr 01 22:37:15.960014 2026] [:error] [pid 17856:tid 17869] [client 74.248.17.99:10088] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/com.php"] [unique_id "ac0tmz7Idlm5j9frhqRrOwAAAEs"]
[Wed Apr 01 22:37:16.472763 2026] [:error] [pid 62559:tid 62566] [client 74.248.17.99:10097] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/com.php"] [unique_id "ac0tnC7NKI8IaNKZFIfLLAAAAUU"]
[Wed Apr 01 22:37:16.985913 2026] [:error] [pid 8909:tid 8962] [client 74.248.17.99:10174] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/com.php"] [unique_id "ac0tnDvP_a0662gDl6D7bQAAANU"]
[Wed Apr 01 22:37:17.504727 2026] [:error] [pid 8908:tid 8914] [client 74.248.17.99:10048] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/com.php"] [unique_id "ac0tnfkmxtJXGnLdvgC1bgAAAIE"]
[Wed Apr 01 22:37:18.023817 2026] [:error] [pid 8908:tid 8937] [client 74.248.17.99:10183] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "ac0tnvkmxtJXGnLdvgC1cAAAAJg"]
[Wed Apr 01 22:37:18.537609 2026] [:error] [pid 62559:tid 62576] [client 74.248.17.99:10140] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "ac0tni7NKI8IaNKZFIfLMAAAAU8"]
[Wed Apr 01 22:37:19.052305 2026] [:error] [pid 8910:tid 8973] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Wed Apr 01 22:37:19.310470 2026] [:error] [pid 8910:tid 8974] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/wander.php
[Wed Apr 01 22:37:19.567930 2026] [:error] [pid 8910:tid 8968] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Wed Apr 01 22:37:19.826706 2026] [:error] [pid 8910:tid 8992] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 01 22:37:20.346533 2026] [:error] [pid 8910:tid 8986] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/v3.php
[Wed Apr 01 22:37:20.603803 2026] [:error] [pid 8910:tid 8969] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Wed Apr 01 22:37:20.866869 2026] [:error] [pid 8910:tid 8985] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/to.php
[Wed Apr 01 22:37:21.125029 2026] [:error] [pid 8910:tid 8972] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/wqqs.php
[Wed Apr 01 22:37:21.403735 2026] [:error] [pid 8910:tid 8975] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Wed Apr 01 22:37:21.665204 2026] [:error] [pid 8910:tid 8971] [client 74.248.17.99:10158] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Wed Apr 01 22:37:21.923622 2026] [:error] [pid 8910:tid 8983] [client 74.248.17.99:10158] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aifa.php"] [unique_id "ac0toaJZINUcF3tYgEx4SgAAAQ8"]
[Wed Apr 01 22:37:22.450690 2026] [:error] [pid 8910:tid 8980] [client 74.248.17.99:10160] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aifa.php"] [unique_id "ac0toqJZINUcF3tYgEx4SwAAAQw"]
[Wed Apr 01 22:37:22.962656 2026] [:error] [pid 8908:tid 8933] [client 74.248.17.99:10130] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aifa.php"] [unique_id "ac0tovkmxtJXGnLdvgC1ggAAAJQ"]
[Wed Apr 01 22:37:23.480801 2026] [:error] [pid 8908:tid 8929] [client 74.248.17.99:10094] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aifa.php"] [unique_id "ac0to_kmxtJXGnLdvgC1hwAAAJA"]
[Wed Apr 01 22:37:23.991783 2026] [:error] [pid 8908:tid 8918] [client 74.248.17.99:10051] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "ac0to_kmxtJXGnLdvgC1igAAAIU"]
[Wed Apr 01 22:37:24.501551 2026] [:error] [pid 8909:tid 8964] [client 74.248.17.99:10073] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "ac0tpDvP_a0662gDl6D7fQAAANc"]
[Wed Apr 01 22:37:25.018008 2026] [:error] [pid 8909:tid 8959] [client 74.248.17.99:10019] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "ac0tpTvP_a0662gDl6D7gAAAANI"]
[Wed Apr 01 22:37:25.553139 2026] [:error] [pid 8908:tid 8930] [client 74.248.17.99:10150] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "ac0tpfkmxtJXGnLdvgC1kwAAAJE"]
[Wed Apr 01 22:37:26.129638 2026] [:error] [pid 8908:tid 8936] [client 74.248.17.99:10030] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "ac0tpvkmxtJXGnLdvgC1mQAAAJc"]
[Wed Apr 01 22:37:26.662684 2026] [:error] [pid 8909:tid 8962] [client 74.248.17.99:10062] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "ac0tpjvP_a0662gDl6D7hwAAANU"]
[Wed Apr 01 22:37:27.176395 2026] [:error] [pid 62559:tid 62568] [client 74.248.17.99:10093] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "ac0tpy7NKI8IaNKZFIfLRAAAAUc"]
[Wed Apr 01 22:37:27.686729 2026] [:error] [pid 62559:tid 62564] [client 74.248.17.99:10039] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feokc.php"] [unique_id "ac0tpy7NKI8IaNKZFIfLSgAAAUM"]
[Wed Apr 01 22:37:28.205639 2026] [:error] [pid 8995:tid 9019] [client 74.248.17.99:10086] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "ac0tqOonaBjs3qxcRefkRgAAABU"]
[Wed Apr 01 22:37:28.719775 2026] [:error] [pid 8995:tid 9010] [client 74.248.17.99:10216] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "ac0tqOonaBjs3qxcRefkRwAAAAw"]
[Wed Apr 01 22:37:29.232744 2026] [:error] [pid 8909:tid 8953] [client 74.248.17.99:10004] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "ac0tqTvP_a0662gDl6D7igAAAMw"]
[Wed Apr 01 22:37:29.743832 2026] [:error] [pid 8909:tid 8964] [client 74.248.17.99:10065] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nc4.php"] [unique_id "ac0tqTvP_a0662gDl6D7jQAAANc"]
[Wed Apr 01 22:37:30.301388 2026] [:error] [pid 8909:tid 8954] [client 74.248.17.99:10219] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0tqjvP_a0662gDl6D7kAAAAM0"]
[Wed Apr 01 22:37:30.817114 2026] [:error] [pid 8910:tid 8983] [client 74.248.17.99:10159] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0tqqJZINUcF3tYgEx4VAAAAQ8"]
[Wed Apr 01 22:37:31.329794 2026] [:error] [pid 8910:tid 8978] [client 74.248.17.99:10021] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0tq6JZINUcF3tYgEx4VQAAAQo"]
[Wed Apr 01 22:37:31.844003 2026] [:error] [pid 8909:tid 8960] [client 74.248.17.99:10179] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "ac0tqzvP_a0662gDl6D7lgAAANM"]
[Wed Apr 01 22:37:32.358801 2026] [:error] [pid 17856:tid 17865] [client 74.248.17.99:10186] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0trD7Idlm5j9frhqRrVAAAAEc"]
[Wed Apr 01 22:37:32.871202 2026] [:error] [pid 8908:tid 8926] [client 74.248.17.99:10098] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0trPkmxtJXGnLdvgC1qgAAAI0"]
[Wed Apr 01 22:37:33.382420 2026] [:error] [pid 8910:tid 8976] [client 74.248.17.99:10071] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0traJZINUcF3tYgEx4XgAAAQg"]
[Wed Apr 01 22:37:33.902104 2026] [:error] [pid 8909:tid 8941] [client 74.248.17.99:10085] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/acxx.php"] [unique_id "ac0trTvP_a0662gDl6D7mgAAAMA"]
[Wed Apr 01 22:37:34.414161 2026] [:error] [pid 8995:tid 9012] [client 74.248.17.99:10072] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "ac0truonaBjs3qxcRefkTAAAAA4"]
[Wed Apr 01 22:37:34.927223 2026] [:error] [pid 62559:tid 62577] [client 74.248.17.99:10169] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "ac0tri7NKI8IaNKZFIfLWQAAAVA"]
[Wed Apr 01 22:37:35.442433 2026] [:error] [pid 17856:tid 17864] [client 74.248.17.99:10058] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "ac0trz7Idlm5j9frhqRrXAAAAEY"]
[Wed Apr 01 22:37:35.955518 2026] [:error] [pid 8909:tid 8951] [client 74.248.17.99:10080] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "ac0trzvP_a0662gDl6D7oAAAAMo"]
[Wed Apr 01 22:37:36.470951 2026] [:error] [pid 8910:tid 8980] [client 74.248.17.99:10014] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "ac0tsKJZINUcF3tYgEx4ZgAAAQw"]
[Wed Apr 01 22:37:36.984321 2026] [:error] [pid 17856:tid 17878] [client 74.248.17.99:10161] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "ac0tsD7Idlm5j9frhqRrXgAAAFQ"]
[Wed Apr 01 22:37:37.494906 2026] [:error] [pid 8908:tid 8916] [client 74.248.17.99:10063] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "ac0tsfkmxtJXGnLdvgC1sgAAAIM"]
[Wed Apr 01 22:37:38.018780 2026] [:error] [pid 8995:tid 9022] [client 74.248.17.99:10218] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goat1.php"] [unique_id "ac0tsuonaBjs3qxcRefkUQAAABg"]
[Wed Apr 01 22:37:38.543796 2026] [:error] [pid 8908:tid 8930] [client 74.248.17.99:10139] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cron.php"] [unique_id "ac0tsvkmxtJXGnLdvgC1tQAAAJE"]
[Wed Apr 01 22:37:39.068651 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:10164] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cron.php"] [unique_id "ac0tsy7NKI8IaNKZFIfLZAAAAVY"]
[Wed Apr 01 22:37:39.579478 2026] [:error] [pid 8995:tid 9019] [client 74.248.17.99:10177] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cron.php"] [unique_id "ac0ts-onaBjs3qxcRefkVgAAABU"]
[Wed Apr 01 22:37:40.100688 2026] [:error] [pid 62559:tid 62576] [client 74.248.17.99:10148] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cron.php"] [unique_id "ac0ttC7NKI8IaNKZFIfLZwAAAU8"]
[Wed Apr 01 22:37:40.616533 2026] [:error] [pid 8995:tid 9008] [client 74.248.17.99:10105] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "ac0ttOonaBjs3qxcRefkWgAAAAo"]
[Wed Apr 01 22:37:41.143780 2026] [:error] [pid 8995:tid 9011] [client 74.248.17.99:10165] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "ac0tteonaBjs3qxcRefkWwAAAA0"]
[Wed Apr 01 22:37:41.660609 2026] [:error] [pid 17856:tid 17858] [client 74.248.17.99:10156] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "ac0ttT7Idlm5j9frhqRrZgAAAEA"]
[Wed Apr 01 22:37:42.187538 2026] [:error] [pid 8909:tid 8943] [client 74.248.17.99:10227] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yanz.php"] [unique_id "ac0ttjvP_a0662gDl6D7rQAAAMI"]
[Wed Apr 01 22:37:42.706440 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:10057] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "ac0tti7NKI8IaNKZFIfLbwAAAVY"]
[Wed Apr 01 22:37:43.243164 2026] [:error] [pid 8909:tid 8947] [client 74.248.17.99:10087] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "ac0ttzvP_a0662gDl6D7rwAAAMY"]
[Wed Apr 01 22:37:43.754462 2026] [:error] [pid 62559:tid 62571] [client 74.248.17.99:10006] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "ac0tty7NKI8IaNKZFIfLdgAAAUo"]
[Wed Apr 01 22:37:44.268532 2026] [:error] [pid 62559:tid 62579] [client 74.248.17.99:10194] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "ac0tuC7NKI8IaNKZFIfLegAAAVI"]
[Wed Apr 01 22:37:44.787796 2026] [:error] [pid 8910:tid 8981] [client 74.248.17.99:10110] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/network.php"] [unique_id "ac0tuKJZINUcF3tYgEx4egAAAQ0"]
[Wed Apr 01 22:37:45.298269 2026] [:error] [pid 8995:tid 9010] [client 74.248.17.99:10029] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/network.php"] [unique_id "ac0tueonaBjs3qxcRefkYgAAAAw"]
[Wed Apr 01 22:37:45.810389 2026] [:error] [pid 8995:tid 8999] [client 74.248.17.99:10103] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/network.php"] [unique_id "ac0tueonaBjs3qxcRefkZAAAAAE"]
[Wed Apr 01 22:37:46.322674 2026] [:error] [pid 8910:tid 8982] [client 74.248.17.99:10082] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/network.php"] [unique_id "ac0tuqJZINUcF3tYgEx4gAAAAQ4"]
[Wed Apr 01 22:37:46.833296 2026] [:error] [pid 8909:tid 8961] [client 74.248.17.99:9986] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-2019.php"] [unique_id "ac0tujvP_a0662gDl6D7uAAAANQ"]
[Wed Apr 01 22:37:47.346865 2026] [:error] [pid 8910:tid 8972] [client 74.248.17.99:9990] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-2019.php"] [unique_id "ac0tu6JZINUcF3tYgEx4hQAAAQQ"]
[Wed Apr 01 22:37:47.857021 2026] [:error] [pid 8910:tid 8968] [client 74.248.17.99:9984] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-2019.php"] [unique_id "ac0tu6JZINUcF3tYgEx4hgAAAQA"]
[Wed Apr 01 22:37:48.381890 2026] [:error] [pid 62559:tid 62585] [client 74.248.17.99:10162] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-2019.php"] [unique_id "ac0tvC7NKI8IaNKZFIfLiAAAAVg"]
[Wed Apr 01 22:37:48.896684 2026] [:error] [pid 8995:tid 9007] [client 74.248.17.99:10077] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypass.php"] [unique_id "ac0tvOonaBjs3qxcRefkaAAAAAk"]
[Wed Apr 01 22:37:49.406904 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:9993] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypass.php"] [unique_id "ac0tvS7NKI8IaNKZFIfLjAAAAVY"]
[Wed Apr 01 22:37:49.916923 2026] [:error] [pid 62559:tid 62575] [client 74.248.17.99:10092] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypass.php"] [unique_id "ac0tvS7NKI8IaNKZFIfLjgAAAU4"]
[Wed Apr 01 22:37:50.433429 2026] [:error] [pid 62559:tid 62569] [client 74.248.17.99:10106] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypass.php"] [unique_id "ac0tvi7NKI8IaNKZFIfLkAAAAUg"]
[Wed Apr 01 22:37:50.952609 2026] [:error] [pid 8909:tid 8961] [client 74.248.17.99:9989] [client 74.248.17.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ac0tvjvP_a0662gDl6D7wgAAANQ"]
[Wed Apr 01 22:37:51.465465 2026] [:error] [pid 17856:tid 17871] [client 74.248.17.99:9934] [client 74.248.17.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ac0tvz7Idlm5j9frhqRrcAAAAE0"]
[Wed Apr 01 22:37:52.112445 2026] [:error] [pid 62559:tid 62582] [client 74.248.17.99:10081] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "ac0twC7NKI8IaNKZFIfLlgAAAVU"]
[Wed Apr 01 22:37:52.624446 2026] [:error] [pid 62559:tid 62562] [client 74.248.17.99:10090] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "ac0twC7NKI8IaNKZFIfLmgAAAUE"]
[Wed Apr 01 22:37:53.149878 2026] [:error] [pid 62559:tid 62567] [client 74.248.17.99:10175] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "ac0twS7NKI8IaNKZFIfLnQAAAUY"]
[Wed Apr 01 22:37:53.659934 2026] [:error] [pid 8910:tid 8983] [client 74.248.17.99:10184] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "ac0twaJZINUcF3tYgEx4mwAAAQ8"]
[Wed Apr 01 22:37:54.179675 2026] [:error] [pid 8910:tid 8971] [client 74.248.17.99:10171] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "ac0twqJZINUcF3tYgEx4nwAAAQM"]
[Wed Apr 01 22:37:54.691109 2026] [:error] [pid 8910:tid 8989] [client 74.248.17.99:10096] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "ac0twqJZINUcF3tYgEx4oQAAARU"]
[Wed Apr 01 22:37:55.210799 2026] [:error] [pid 62559:tid 62576] [client 74.248.17.99:10111] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lock.php"] [unique_id "ac0twy7NKI8IaNKZFIfLqwAAAU8"]
[Wed Apr 01 22:37:55.721719 2026] [:error] [pid 62559:tid 62584] [client 74.248.17.99:9999] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "ac0twy7NKI8IaNKZFIfLrgAAAVc"]
[Wed Apr 01 22:37:56.256773 2026] [:error] [pid 62559:tid 62566] [client 74.248.17.99:10068] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "ac0txC7NKI8IaNKZFIfLtAAAAUU"]
[Wed Apr 01 22:37:56.769818 2026] [:error] [pid 62559:tid 62577] [client 74.248.17.99:10129] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "ac0txC7NKI8IaNKZFIfLtgAAAVA"]
[Wed Apr 01 22:37:57.282101 2026] [:error] [pid 17856:tid 17861] [client 74.248.17.99:9935] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail.php"] [unique_id "ac0txT7Idlm5j9frhqRrggAAAEM"]
[Wed Apr 01 22:37:57.793658 2026] [:error] [pid 62559:tid 62568] [client 74.248.17.99:10136] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/marijuana.php"] [unique_id "ac0txS7NKI8IaNKZFIfLwAAAAUc"]
[Wed Apr 01 22:37:58.304069 2026] [:error] [pid 62559:tid 62576] [client 74.248.17.99:10000] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/marijuana.php"] [unique_id "ac0txi7NKI8IaNKZFIfLxAAAAU8"]
[Wed Apr 01 22:37:58.817292 2026] [:error] [pid 17856:tid 17875] [client 74.248.17.99:10102] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/marijuana.php"] [unique_id "ac0txj7Idlm5j9frhqRrhwAAAFE"]
[Wed Apr 01 22:37:59.328103 2026] [:error] [pid 8910:tid 8983] [client 74.248.17.99:9995] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/marijuana.php"] [unique_id "ac0tx6JZINUcF3tYgEx4pQAAAQ8"]
[Wed Apr 01 22:37:59.840277 2026] [:error] [pid 8908:tid 8918] [client 74.248.17.99:10052] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0tx_kmxtJXGnLdvgC1vAAAAIU"]
[Wed Apr 01 22:38:00.357478 2026] [:error] [pid 8995:tid 9022] [client 74.248.17.99:9954] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0tyOonaBjs3qxcRefkcgAAABg"]
[Wed Apr 01 22:38:00.869839 2026] [:error] [pid 62559:tid 62581] [client 74.248.17.99:9928] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0tyC7NKI8IaNKZFIfL1gAAAVQ"]
[Wed Apr 01 22:38:01.380544 2026] [:error] [pid 8909:tid 8957] [client 74.248.17.99:10109] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/333.php"] [unique_id "ac0tyTvP_a0662gDl6D7zAAAANA"]
[Wed Apr 01 22:38:01.890790 2026] [:error] [pid 17856:tid 17881] [client 74.248.17.99:9991] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/444.php"] [unique_id "ac0tyT7Idlm5j9frhqRrjAAAAFc"]
[Wed Apr 01 22:38:02.403515 2026] [:error] [pid 8910:tid 8989] [client 74.248.17.99:10044] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/444.php"] [unique_id "ac0tyqJZINUcF3tYgEx4rAAAARU"]
[Wed Apr 01 22:38:02.917276 2026] [:error] [pid 17856:tid 17862] [client 74.248.17.99:10017] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/444.php"] [unique_id "ac0tyj7Idlm5j9frhqRrkQAAAEQ"]
[Wed Apr 01 22:38:03.428089 2026] [:error] [pid 17856:tid 17868] [client 74.248.17.99:10238] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/444.php"] [unique_id "ac0tyz7Idlm5j9frhqRrlAAAAEo"]
[Wed Apr 01 22:38:03.940277 2026] [:error] [pid 8910:tid 8981] [client 74.248.17.99:10060] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "ac0ty6JZINUcF3tYgEx4sgAAAQ0"]
[Wed Apr 01 22:38:04.452612 2026] [:error] [pid 8909:tid 8954] [client 74.248.17.99:10198] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "ac0tzDvP_a0662gDl6D70AAAAM0"]
[Wed Apr 01 22:38:04.968005 2026] [:error] [pid 8910:tid 8978] [client 74.248.17.99:10151] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "ac0tzKJZINUcF3tYgEx4uAAAAQo"]
[Wed Apr 01 22:38:05.478419 2026] [:error] [pid 8909:tid 8951] [client 74.248.17.99:9992] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file9.php"] [unique_id "ac0tzTvP_a0662gDl6D71wAAAMo"]
[Wed Apr 01 22:38:05.990044 2026] [:error] [pid 8910:tid 8973] [client 74.248.17.99:10007] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filesss.php"] [unique_id "ac0tzaJZINUcF3tYgEx4uQAAAQU"]
[Wed Apr 01 22:38:06.501756 2026] [:error] [pid 17856:tid 17869] [client 74.248.17.99:9939] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filesss.php"] [unique_id "ac0tzj7Idlm5j9frhqRroQAAAEs"]
[Wed Apr 01 22:38:07.022607 2026] [:error] [pid 8910:tid 8991] [client 74.248.17.99:10070] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filesss.php"] [unique_id "ac0tz6JZINUcF3tYgEx4uwAAARc"]
[Wed Apr 01 22:38:07.537493 2026] [:error] [pid 8909:tid 8958] [client 74.248.17.99:10015] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filesss.php"] [unique_id "ac0tzzvP_a0662gDl6D72wAAANE"]
[Wed Apr 01 22:38:08.048130 2026] [:error] [pid 62559:tid 62575] [client 74.248.17.99:10013] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file88.php"] [unique_id "ac0t0C7NKI8IaNKZFIfL7QAAAU4"]
[Wed Apr 01 22:38:08.566013 2026] [:error] [pid 8910:tid 8970] [client 74.248.17.99:10066] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file88.php"] [unique_id "ac0t0KJZINUcF3tYgEx4vwAAAQI"]
[Wed Apr 01 22:38:09.085153 2026] [:error] [pid 8909:tid 8945] [client 74.248.17.99:10042] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file88.php"] [unique_id "ac0t0TvP_a0662gDl6D74gAAAMQ"]
[Wed Apr 01 22:38:09.599801 2026] [:error] [pid 8910:tid 8969] [client 74.248.17.99:10010] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file88.php"] [unique_id "ac0t0aJZINUcF3tYgEx4wQAAAQE"]
[Wed Apr 01 22:38:10.137800 2026] [:error] [pid 8909:tid 8952] [client 74.248.17.99:9943] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "ac0t0jvP_a0662gDl6D76AAAAMs"]
[Wed Apr 01 22:38:10.657599 2026] [:error] [pid 8910:tid 8987] [client 74.248.17.99:9864] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "ac0t0qJZINUcF3tYgEx4xAAAARM"]
[Wed Apr 01 22:38:11.169668 2026] [:error] [pid 8908:tid 8930] [client 74.248.17.99:10225] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "ac0t0_kmxtJXGnLdvgC13gAAAJE"]
[Wed Apr 01 22:38:11.693778 2026] [:error] [pid 8995:tid 9018] [client 74.248.17.99:10155] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/X7x.php"] [unique_id "ac0t0-onaBjs3qxcRefkgwAAABQ"]
[Wed Apr 01 22:38:12.205975 2026] [:error] [pid 62559:tid 62576] [client 74.248.17.99:9955] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "ac0t1C7NKI8IaNKZFIfL_QAAAU8"]
[Wed Apr 01 22:38:12.720738 2026] [:error] [pid 8908:tid 8927] [client 74.248.17.99:10053] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "ac0t1PkmxtJXGnLdvgC16QAAAI4"]
[Wed Apr 01 22:38:13.242106 2026] [:error] [pid 62559:tid 62583] [client 74.248.17.99:10167] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "ac0t1S7NKI8IaNKZFIfMAgAAAVY"]
[Wed Apr 01 22:38:13.754473 2026] [:error] [pid 8909:tid 8954] [client 74.248.17.99:9925] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admir.php"] [unique_id "ac0t1TvP_a0662gDl6D78QAAAM0"]
[Wed Apr 01 22:38:14.264622 2026] [:error] [pid 62559:tid 62566] [client 74.248.17.99:10020] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "ac0t1i7NKI8IaNKZFIfMCAAAAUU"]
[Wed Apr 01 22:38:14.773508 2026] [:error] [pid 62559:tid 62577] [client 74.248.17.99:10003] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "ac0t1i7NKI8IaNKZFIfMDgAAAVA"]
[Wed Apr 01 22:38:15.296669 2026] [:error] [pid 62559:tid 62578] [client 74.248.17.99:10101] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "ac0t1y7NKI8IaNKZFIfMEQAAAVE"]
[Wed Apr 01 22:38:15.808769 2026] [:error] [pid 8908:tid 8925] [client 74.248.17.99:10008] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj.php"] [unique_id "ac0t1_kmxtJXGnLdvgC17gAAAIw"]
[Wed Apr 01 22:38:16.321724 2026] [:error] [pid 8908:tid 8920] [client 74.248.17.99:10131] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "ac0t2PkmxtJXGnLdvgC18wAAAIc"]
[Wed Apr 01 22:38:16.840764 2026] [:error] [pid 17856:tid 17875] [client 74.248.17.99:10008] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "ac0t2D7Idlm5j9frhqRrsAAAAFE"]
[Wed Apr 01 22:38:17.364708 2026] [:error] [pid 17856:tid 17870] [client 74.248.17.99:9889] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "ac0t2T7Idlm5j9frhqRrsgAAAEw"]
[Wed Apr 01 22:38:17.877878 2026] [:error] [pid 17856:tid 17863] [client 74.248.17.99:9998] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/opts.php"] [unique_id "ac0t2T7Idlm5j9frhqRrtQAAAEU"]
[Wed Apr 01 22:38:18.396814 2026] [:error] [pid 8995:tid 9019] [client 74.248.17.99:9997] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filer.php"] [unique_id "ac0t2uonaBjs3qxcRefkkgAAABU"]
[Wed Apr 01 22:38:18.917312 2026] [:error] [pid 8995:tid 9002] [client 74.248.17.99:10047] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filer.php"] [unique_id "ac0t2uonaBjs3qxcRefklQAAAAQ"]
[Wed Apr 01 22:38:19.429329 2026] [:error] [pid 8908:tid 8933] [client 74.248.17.99:9927] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filer.php"] [unique_id "ac0t2_kmxtJXGnLdvgC1-wAAAJQ"]
[Wed Apr 01 22:38:19.940874 2026] [:error] [pid 8908:tid 8934] [client 74.248.17.99:9931] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filer.php"] [unique_id "ac0t2_kmxtJXGnLdvgC1_wAAAJU"]
[Wed Apr 01 22:38:20.450659 2026] [:error] [pid 8909:tid 8961] [client 74.248.17.99:10089] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lites.php"] [unique_id "ac0t3DvP_a0662gDl6D7_AAAANQ"]
[Wed Apr 01 22:38:20.961339 2026] [:error] [pid 8909:tid 8962] [client 74.248.17.99:10054] [client 74.248.17.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lites.php"] [unique_id "ac0t3DvP_a0662gDl6D7_wAAANU"]
[Wed Apr 01 22:38:21.484199 2026] [:error] [pid 62559:tid 62582] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/lites.php
[Wed Apr 01 22:38:21.741919 2026] [:error] [pid 62559:tid 62574] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Wed Apr 01 22:38:22.001076 2026] [:error] [pid 62559:tid 62577] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/he.php
[Wed Apr 01 22:38:22.262466 2026] [:error] [pid 62559:tid 62584] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/aves.php
[Wed Apr 01 22:38:22.521591 2026] [:error] [pid 62559:tid 62579] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/gorila.php
[Wed Apr 01 22:38:22.780831 2026] [:error] [pid 62559:tid 62564] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/vanta.php
[Wed Apr 01 22:38:23.043426 2026] [:error] [pid 62559:tid 62582] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/sh3ll.php
[Wed Apr 01 22:38:23.302391 2026] [:error] [pid 62559:tid 62569] [client 74.248.17.99:10011] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Thu Apr 02 00:16:03.672407 2026] [:error] [pid 8910:tid 8973] [client 52.67.37.208:50858] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "ac1Ew6JZINUcF3tYgEyP7QAAAQU"]
[Thu Apr 02 00:16:05.138138 2026] [:error] [pid 62559:tid 62567] [client 52.67.37.208:50928] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.local"] [unique_id "ac1ExS7NKI8IaNKZFIck1AAAAUY"]
[Thu Apr 02 00:16:06.602514 2026] [:error] [pid 8908:tid 8917] [client 52.67.37.208:51000] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.production"] [unique_id "ac1ExvkmxtJXGnLdvgD31wAAAIQ"]
[Thu Apr 02 00:16:08.070340 2026] [:error] [pid 8909:tid 8949] [client 52.67.37.208:51196] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.staging"] [unique_id "ac1EyDvP_a0662gDl6AvTAAAAMg"]
[Thu Apr 02 00:16:09.534070 2026] [:error] [pid 8995:tid 9006] [client 52.67.37.208:51424] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.development"] [unique_id "ac1EyeonaBjs3qxcRecFfwAAAAg"]
[Thu Apr 02 00:16:10.997541 2026] [:error] [pid 8909:tid 8947] [client 52.67.37.208:51546] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.test"] [unique_id "ac1EyjvP_a0662gDl6AvUwAAAMY"]
[Thu Apr 02 00:16:12.456759 2026] [:error] [pid 62559:tid 62583] [client 52.67.37.208:51748] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.remote"] [unique_id "ac1EzC7NKI8IaNKZFIck4AAAAVY"]
[Thu Apr 02 00:16:13.919196 2026] [:error] [pid 8909:tid 8950] [client 52.67.37.208:51850] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.bak"] [unique_id "ac1EzTvP_a0662gDl6AvXAAAAMk"]
[Thu Apr 02 00:16:15.383631 2026] [:error] [pid 8908:tid 8934] [client 52.67.37.208:51984] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.backup"] [unique_id "ac1Ez_kmxtJXGnLdvgD35AAAAJU"]
[Thu Apr 02 00:16:16.841275 2026] [:error] [pid 8908:tid 8923] [client 52.67.37.208:52076] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.save"] [unique_id "ac1E0PkmxtJXGnLdvgD35QAAAIo"]
[Thu Apr 02 00:16:18.306937 2026] [:error] [pid 8908:tid 8913] [client 52.67.37.208:52160] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.old"] [unique_id "ac1E0vkmxtJXGnLdvgD36wAAAIA"]
[Thu Apr 02 00:16:19.767799 2026] [:error] [pid 8909:tid 8959] [client 52.67.37.208:52306] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.sample"] [unique_id "ac1E0zvP_a0662gDl6AvbgAAANI"]
[Thu Apr 02 00:16:21.236006 2026] [:error] [pid 62559:tid 62576] [client 52.67.37.208:52362] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/vendor/.env"] [unique_id "ac1E1S7NKI8IaNKZFIck_gAAAU8"]
[Thu Apr 02 00:16:22.701178 2026] [:error] [pid 62559:tid 62582] [client 52.67.37.208:52448] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/lib/.env"] [unique_id "ac1E1i7NKI8IaNKZFIclAQAAAVU"]
[Thu Apr 02 00:16:24.163621 2026] [:error] [pid 8909:tid 8941] [client 52.67.37.208:52516] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/lab/.env"] [unique_id "ac1E2DvP_a0662gDl6AveQAAAMA"]
[Thu Apr 02 00:16:25.630189 2026] [:error] [pid 62559:tid 62569] [client 52.67.37.208:52564] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/cronlab/.env"] [unique_id "ac1E2S7NKI8IaNKZFIclBwAAAUg"]
[Thu Apr 02 00:16:27.094670 2026] [:error] [pid 8910:tid 8981] [client 52.67.37.208:52656] [client 52.67.37.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/cron/.env"] [unique_id "ac1E26JZINUcF3tYgEyQAQAAAQ0"]
[Thu Apr 02 03:13:03.316864 2026] [:error] [pid 61542:tid 61700] [client 182.44.2.148:54223] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac1uPx9WkdpC39CsbLysNwAAAEw"]
[Thu Apr 02 04:42:55.548382 2026] [:error] [pid 37543:tid 37568] [client 74.248.113.81:33132] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-Blogs.php
[Thu Apr 02 04:45:34.093980 2026] [:error] [pid 29467:tid 29484] [client 43.164.197.224:53242] [client 43.164.197.224] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac2D7r4VUBFCJAq-WOn8dgAAAQ4"]
[Thu Apr 02 06:53:08.551457 2026] [:error] [pid 37543:tid 37556] [client 49.51.132.100:55700] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ac2h1Hhdk2bEYJCvILYzJwAAAUs"]
[Thu Apr 02 07:06:10.353764 2026] [:error] [pid 37543:tid 37562] [client 74.248.113.81:8192] File does not exist: /usr/local/apache/htdocs/suspended-page/class-bda.php
[Thu Apr 02 09:22:09.597793 2026] [:error] [pid 23927:tid 23940] [client 123.187.240.242:57102] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ac3EwUsZwqCndhl9uKCidAAAAYs"]
[Thu Apr 02 09:45:41.930584 2026] [:error] [pid 37543:tid 37566] [client 43.130.139.136:43646] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac3KRXhdk2bEYJCvILZb-AAAAVU"]
[Thu Apr 02 14:29:27.680745 2026] [:error] [pid 59200:tid 59246] [client 43.135.186.135:37532] [client 43.135.186.135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac4Mx7fP26txrdLs3Eo7sgAAAEY"]
[Thu Apr 02 16:27:28.524430 2026] [:error] [pid 29467:tid 29476] [client 114.80.36.40:37300] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac4ocL4VUBFCJAq-WOnkCQAAAQY"]
[Thu Apr 02 16:27:56.888756 2026] [:error] [pid 37543:tid 37556] [client 43.130.3.122:35966] [client 43.130.3.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ac4ojHhdk2bEYJCvILaiNgAAAUs"]
[Thu Apr 02 19:51:14.517782 2026] [:error] [pid 29467:tid 29486] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/pass4.php
[Thu Apr 02 19:51:14.775826 2026] [:error] [pid 29467:tid 29488] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/8daf1238_1774208172.php
[Thu Apr 02 19:51:15.034638 2026] [:error] [pid 29467:tid 29490] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/0yellow.php
[Thu Apr 02 19:51:15.302811 2026] [:error] [pid 29467:tid 29493] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/dichku.php
[Thu Apr 02 19:51:15.562300 2026] [:error] [pid 29467:tid 29475] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 02 19:51:15.823898 2026] [:error] [pid 29467:tid 29485] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Thu Apr 02 19:51:16.083417 2026] [:error] [pid 29467:tid 29472] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Thu Apr 02 19:51:16.341416 2026] [:error] [pid 29467:tid 29488] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/a9.php
[Thu Apr 02 19:51:16.601683 2026] [:error] [pid 29467:tid 29481] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Thu Apr 02 19:51:16.860847 2026] [:error] [pid 29467:tid 29490] [client 20.215.208.99:28290] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Thu Apr 02 19:51:17.116345 2026] [:error] [pid 29467:tid 29493] [client 20.215.208.99:28290] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hnphq.php"] [unique_id "ac5YNb4VUBFCJAq-WOl7KAAAARc"]
[Thu Apr 02 19:51:17.687478 2026] [:error] [pid 29467:tid 29480] [client 20.215.208.99:35213] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hnphq.php"] [unique_id "ac5YNb4VUBFCJAq-WOl7LAAAAQo"]
[Thu Apr 02 19:51:18.425714 2026] [:error] [pid 59305:tid 59316] [client 20.215.208.99:59334] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hnphq.php"] [unique_id "ac5YNqr2tV4rDwKFxKeFbgAAAMc"]
[Thu Apr 02 19:51:18.936822 2026] [:error] [pid 59305:tid 59317] [client 20.215.208.99:59381] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hnphq.php"] [unique_id "ac5YNqr2tV4rDwKFxKeFcwAAAMg"]
[Thu Apr 02 19:51:19.531107 2026] [:error] [pid 59305:tid 59319] [client 20.215.208.99:22347] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac5YN6r2tV4rDwKFxKeFdAAAAMo"]
[Thu Apr 02 19:51:20.102948 2026] [:error] [pid 37543:tid 37552] [client 20.215.208.99:29604] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac5YOHhdk2bEYJCvILbapAAAAUc"]
[Thu Apr 02 19:51:20.755427 2026] [:error] [pid 59194:tid 59233] [client 20.215.208.99:21827] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac5YOBMpAeV11hcQehxD4gAAABQ"]
[Thu Apr 02 19:51:21.843910 2026] [:error] [pid 29467:tid 29494] [client 20.215.208.99:22342] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac5YOb4VUBFCJAq-WOl7NgAAARg"]
[Thu Apr 02 19:51:23.198447 2026] [:error] [pid 59305:tid 59323] [client 20.215.208.99:62297] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "ac5YO6r2tV4rDwKFxKeFeQAAAM4"]
[Thu Apr 02 19:51:24.628031 2026] [:error] [pid 59200:tid 59260] [client 20.215.208.99:5098] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "ac5YPLfP26txrdLs3Epz3QAAAFQ"]
[Thu Apr 02 19:51:25.617957 2026] [:error] [pid 54384:tid 54409] [client 20.215.208.99:26807] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "ac5YPdWWpaby3TVN7McNaQAAAdc"]
[Thu Apr 02 19:51:27.091265 2026] [:error] [pid 54384:tid 54387] [client 20.215.208.99:5088] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "ac5YP9WWpaby3TVN7McNawAAAcE"]
[Thu Apr 02 19:51:28.022797 2026] [:error] [pid 37543:tid 37556] [client 20.215.208.99:22395] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "ac5YQHhdk2bEYJCvILbarAAAAUs"]
[Thu Apr 02 19:51:29.060721 2026] [:error] [pid 23927:tid 23951] [client 20.215.208.99:59368] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "ac5YQUsZwqCndhl9uKCtpwAAAZY"]
[Thu Apr 02 19:51:29.795084 2026] [:error] [pid 59201:tid 59276] [client 20.215.208.99:27864] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "ac5YQcAC0Tw8eL6gzZ4a2AAAAIk"]
[Thu Apr 02 19:51:30.572962 2026] [:error] [pid 59200:tid 59258] [client 20.215.208.99:27875] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "ac5YQrfP26txrdLs3Epz5wAAAFI"]
[Thu Apr 02 19:51:31.234381 2026] [:error] [pid 23927:tid 23950] [client 20.215.208.99:15709] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac5YQ0sZwqCndhl9uKCtrAAAAZU"]
[Thu Apr 02 19:51:31.878731 2026] [:error] [pid 23927:tid 23929] [client 20.215.208.99:5070] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac5YQ0sZwqCndhl9uKCtrgAAAYA"]
[Thu Apr 02 19:51:32.782169 2026] [:error] [pid 23927:tid 23930] [client 20.215.208.99:26808] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac5YREsZwqCndhl9uKCtsgAAAYE"]
[Thu Apr 02 19:51:33.507699 2026] [:error] [pid 59194:tid 59232] [client 20.215.208.99:38378] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-class-20260318124352.php"] [unique_id "ac5YRRMpAeV11hcQehxD8wAAABM"]
[Thu Apr 02 19:51:34.862208 2026] [:error] [pid 59194:tid 59237] [client 20.215.208.99:34019] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac5YRhMpAeV11hcQehxD9wAAABg"]
[Thu Apr 02 19:51:36.894770 2026] [:error] [pid 23927:tid 23942] [client 20.215.208.99:22377] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac5YSEsZwqCndhl9uKCttwAAAY0"]
[Thu Apr 02 19:51:38.606364 2026] [:error] [pid 59201:tid 59289] [client 20.215.208.99:39600] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac5YSsAC0Tw8eL6gzZ4a2wAAAJY"]
[Thu Apr 02 19:51:39.716197 2026] [:error] [pid 59201:tid 59275] [client 20.215.208.99:59367] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac5YS8AC0Tw8eL6gzZ4a3AAAAIg"]
[Thu Apr 02 19:51:40.824042 2026] [:error] [pid 59200:tid 59258] [client 20.215.208.99:21340] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Okxob.php"] [unique_id "ac5YTLfP26txrdLs3Epz7AAAAFI"]
[Thu Apr 02 19:51:41.909121 2026] [:error] [pid 29467:tid 29479] [client 20.215.208.99:29601] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Okxob.php"] [unique_id "ac5YTb4VUBFCJAq-WOl7UQAAAQk"]
[Thu Apr 02 19:51:43.011165 2026] [:error] [pid 59201:tid 59280] [client 20.215.208.99:29595] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Okxob.php"] [unique_id "ac5YT8AC0Tw8eL6gzZ4a3gAAAI0"]
[Thu Apr 02 19:51:44.388084 2026] [:error] [pid 29467:tid 29480] [client 20.215.208.99:22322] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Okxob.php"] [unique_id "ac5YUL4VUBFCJAq-WOl7VQAAAQo"]
[Thu Apr 02 19:51:45.421315 2026] [:error] [pid 29467:tid 29483] [client 20.215.208.99:21327] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac5YUb4VUBFCJAq-WOl7VgAAAQ0"]
[Thu Apr 02 19:51:46.568833 2026] [:error] [pid 29467:tid 29481] [client 20.215.208.99:37594] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac5YUr4VUBFCJAq-WOl7WgAAAQs"]
[Thu Apr 02 19:51:47.806312 2026] [:error] [pid 59194:tid 59216] [client 20.215.208.99:23403] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac5YUxMpAeV11hcQehxEBgAAAAM"]
[Thu Apr 02 19:51:50.688308 2026] [:error] [pid 54384:tid 54401] [client 20.215.208.99:38281] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac5YVtWWpaby3TVN7McNgAAAAc8"]
[Thu Apr 02 19:51:54.267756 2026] [:error] [pid 37543:tid 37553] [client 20.215.208.99:17667] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac5YWnhdk2bEYJCvILbaswAAAUg"]
[Thu Apr 02 19:51:56.420821 2026] [:error] [pid 37543:tid 37567] [client 20.215.208.99:4163] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac5YXHhdk2bEYJCvILbaugAAAVY"]
[Thu Apr 02 19:51:57.265905 2026] [:error] [pid 59194:tid 59237] [client 20.215.208.99:45824] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac5YXRMpAeV11hcQehxEGQAAABg"]
[Thu Apr 02 19:51:58.772769 2026] [:error] [pid 59305:tid 59317] [client 20.215.208.99:47374] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac5YXqr2tV4rDwKFxKeFwQAAAMg"]
[Thu Apr 02 19:51:59.706713 2026] [:error] [pid 29467:tid 29488] [client 20.215.208.99:4416] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/only.php"] [unique_id "ac5YX74VUBFCJAq-WOl7YQAAARI"]
[Thu Apr 02 19:52:00.595773 2026] [:error] [pid 59201:tid 59291] [client 20.215.208.99:16666] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/only.php"] [unique_id "ac5YYMAC0Tw8eL6gzZ4a4gAAAJg"]
[Thu Apr 02 19:52:01.176938 2026] [:error] [pid 37543:tid 37564] [client 20.215.208.99:62219] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/only.php"] [unique_id "ac5YYXhdk2bEYJCvILbavgAAAVM"]
[Thu Apr 02 19:52:02.183104 2026] [:error] [pid 59200:tid 59264] [client 20.215.208.99:32008] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/only.php"] [unique_id "ac5YYrfP26txrdLs3Epz8gAAAFg"]
[Thu Apr 02 19:52:03.084200 2026] [:error] [pid 37543:tid 37547] [client 20.215.208.99:40078] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/repurify.php"] [unique_id "ac5YY3hdk2bEYJCvILbavwAAAUI"]
[Thu Apr 02 19:52:03.906266 2026] [:error] [pid 59200:tid 59255] [client 20.215.208.99:21269] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/repurify.php"] [unique_id "ac5YY7fP26txrdLs3Epz9QAAAE8"]
[Thu Apr 02 19:52:04.757271 2026] [:error] [pid 23927:tid 23941] [client 20.215.208.99:16674] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/repurify.php"] [unique_id "ac5YZEsZwqCndhl9uKCt4AAAAYw"]
[Thu Apr 02 19:52:05.470855 2026] [:error] [pid 59305:tid 59321] [client 20.215.208.99:4476] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/repurify.php"] [unique_id "ac5YZar2tV4rDwKFxKeFywAAAMw"]
[Thu Apr 02 19:52:06.075970 2026] [:error] [pid 37543:tid 37566] [client 20.215.208.99:16699] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tdsaz.php"] [unique_id "ac5YZnhdk2bEYJCvILbawQAAAVU"]
[Thu Apr 02 19:52:06.741395 2026] [:error] [pid 29467:tid 29494] [client 20.215.208.99:17747] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tdsaz.php"] [unique_id "ac5YZr4VUBFCJAq-WOl7bQAAARg"]
[Thu Apr 02 19:52:07.341522 2026] [:error] [pid 59201:tid 59280] [client 20.215.208.99:16217] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tdsaz.php"] [unique_id "ac5YZ8AC0Tw8eL6gzZ4a6gAAAI0"]
[Thu Apr 02 19:52:07.894678 2026] [:error] [pid 54384:tid 54392] [client 20.215.208.99:35729] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tdsaz.php"] [unique_id "ac5YZ9WWpaby3TVN7McNigAAAcY"]
[Thu Apr 02 19:52:08.437109 2026] [:error] [pid 59305:tid 59321] [client 20.215.208.99:16700] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "ac5YaKr2tV4rDwKFxKeF2wAAAMw"]
[Thu Apr 02 19:52:08.954809 2026] [:error] [pid 59305:tid 59329] [client 20.215.208.99:27778] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "ac5YaKr2tV4rDwKFxKeF3gAAANQ"]
[Thu Apr 02 19:52:09.487692 2026] [:error] [pid 54384:tid 54394] [client 20.215.208.99:27797] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "ac5YadWWpaby3TVN7McNiwAAAcg"]
[Thu Apr 02 19:52:10.221349 2026] [:error] [pid 54384:tid 54398] [client 20.215.208.99:47420] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "ac5YatWWpaby3TVN7McNjAAAAcw"]
[Thu Apr 02 19:52:10.846662 2026] [:error] [pid 59305:tid 59319] [client 20.215.208.99:27794] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hfles.php"] [unique_id "ac5Yaqr2tV4rDwKFxKeF5gAAAMo"]
[Thu Apr 02 19:52:11.676526 2026] [:error] [pid 29467:tid 29473] [client 20.215.208.99:4768] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hfles.php"] [unique_id "ac5Ya74VUBFCJAq-WOl7dQAAAQM"]
[Thu Apr 02 19:52:12.490597 2026] [:error] [pid 23927:tid 23947] [client 20.215.208.99:4738] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hfles.php"] [unique_id "ac5YbEsZwqCndhl9uKCt6QAAAZI"]
[Thu Apr 02 19:52:13.094963 2026] [:error] [pid 59201:tid 59290] [client 20.215.208.99:47379] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hfles.php"] [unique_id "ac5YbcAC0Tw8eL6gzZ4a8wAAAJc"]
[Thu Apr 02 19:52:13.641123 2026] [:error] [pid 37543:tid 37568] [client 20.215.208.99:62234] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac5YbXhdk2bEYJCvILbaxwAAAVc"]
[Thu Apr 02 19:52:14.187764 2026] [:error] [pid 59201:tid 59289] [client 20.215.208.99:4464] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac5YbsAC0Tw8eL6gzZ4a9QAAAJY"]
[Thu Apr 02 19:52:14.785302 2026] [:error] [pid 54384:tid 54391] [client 20.215.208.99:16211] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac5YbtWWpaby3TVN7McNkQAAAcU"]
[Thu Apr 02 19:52:15.517637 2026] [:error] [pid 29467:tid 29491] [client 20.215.208.99:47404] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac5Yb74VUBFCJAq-WOl7eQAAARU"]
[Thu Apr 02 19:52:16.408608 2026] [:error] [pid 29467:tid 29474] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Thu Apr 02 19:52:16.735611 2026] [:error] [pid 29467:tid 29484] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-20260318122951.php
[Thu Apr 02 19:52:17.000902 2026] [:error] [pid 29467:tid 29477] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Thu Apr 02 19:52:17.299084 2026] [:error] [pid 29467:tid 29471] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-moonka.php
[Thu Apr 02 19:52:17.557990 2026] [:error] [pid 29467:tid 29478] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Thu Apr 02 19:52:17.815298 2026] [:error] [pid 29467:tid 29489] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Thu Apr 02 19:52:18.073588 2026] [:error] [pid 29467:tid 29473] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/irpl4xz4fmlzm4tlvvu4h1mCdefault.php
[Thu Apr 02 19:52:18.332219 2026] [:error] [pid 29467:tid 29479] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Thu Apr 02 19:52:18.590844 2026] [:error] [pid 29467:tid 29487] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Thu Apr 02 19:52:18.942988 2026] [:error] [pid 29467:tid 29480] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Thu Apr 02 19:52:19.201946 2026] [:error] [pid 29467:tid 29483] [client 20.215.208.99:28882] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Thu Apr 02 19:52:19.457806 2026] [:error] [pid 29467:tid 29472] [client 20.215.208.99:28882] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac5Yc74VUBFCJAq-WOl7hwAAAQI"]
[Thu Apr 02 19:52:19.972052 2026] [:error] [pid 59305:tid 59319] [client 20.215.208.99:16655] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac5Yc6r2tV4rDwKFxKeF9QAAAMo"]
[Thu Apr 02 19:52:20.508772 2026] [:error] [pid 59194:tid 59221] [client 20.215.208.99:16665] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac5YdBMpAeV11hcQehxEJgAAAAg"]
[Thu Apr 02 19:52:21.087758 2026] [:error] [pid 54384:tid 54410] [client 20.215.208.99:4753] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac5YddWWpaby3TVN7McNpAAAAdg"]
[Thu Apr 02 19:52:21.602659 2026] [:error] [pid 59305:tid 59328] [client 20.215.208.99:62209] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new3.php"] [unique_id "ac5Ydar2tV4rDwKFxKeF9gAAANM"]
[Thu Apr 02 19:52:22.171423 2026] [:error] [pid 37543:tid 37548] [client 20.215.208.99:17761] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new3.php"] [unique_id "ac5Ydnhdk2bEYJCvILbaywAAAUM"]
[Thu Apr 02 19:53:18.529670 2026] [:error] [pid 54384:tid 54394] [client 20.215.208.99:36405] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xy.php"] [unique_id "ac5YrtWWpaby3TVN7McN8wAAAcg"]
[Thu Apr 02 19:53:20.560126 2026] [:error] [pid 59305:tid 59324] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Thu Apr 02 19:53:20.817924 2026] [:error] [pid 59305:tid 59320] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/rogsa.php
[Thu Apr 02 19:53:21.075851 2026] [:error] [pid 59305:tid 59313] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/htzevfl4k9ey5hoaywdwiCdefault.php
[Thu Apr 02 19:53:21.335332 2026] [:error] [pid 59305:tid 59314] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Thu Apr 02 19:53:21.591933 2026] [:error] [pid 59305:tid 59310] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/nhj6t74aqmkde3hgpCdefault.php
[Thu Apr 02 19:53:21.850569 2026] [:error] [pid 59305:tid 59309] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/wlld5fjtdpjmjhsds3qzmipfCdefault.php
[Thu Apr 02 19:53:22.109399 2026] [:error] [pid 59305:tid 59311] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Thu Apr 02 19:53:22.367615 2026] [:error] [pid 59305:tid 59327] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Thu Apr 02 19:53:22.649297 2026] [:error] [pid 59305:tid 59327] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/ynjli.php
[Thu Apr 02 19:53:22.907781 2026] [:error] [pid 59305:tid 59330] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/a6.php
[Thu Apr 02 19:53:23.167037 2026] [:error] [pid 59305:tid 59320] [client 20.215.208.99:16195] File does not exist: /usr/local/apache/htdocs/suspended-page/mI35rZhMg1zJ1vuXdefault.php
[Thu Apr 02 19:53:23.424091 2026] [:error] [pid 59305:tid 59315] [client 20.215.208.99:16195] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sts.php"] [unique_id "ac5Ys6r2tV4rDwKFxKeGhgAAAMY"]
[Thu Apr 02 19:53:23.938424 2026] [:error] [pid 59305:tid 59312] [client 20.215.208.99:39660] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sts.php"] [unique_id "ac5Ys6r2tV4rDwKFxKeGiAAAAMM"]
[Thu Apr 02 19:53:24.831556 2026] [:error] [pid 59194:tid 59224] [client 20.215.208.99:16740] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sts.php"] [unique_id "ac5YtBMpAeV11hcQehxETgAAAAs"]
[Thu Apr 02 19:53:25.781511 2026] [:error] [pid 59305:tid 59309] [client 20.215.208.99:27795] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sts.php"] [unique_id "ac5Ytar2tV4rDwKFxKeGjQAAAMA"]
[Thu Apr 02 19:53:27.495961 2026] [:error] [pid 23927:tid 23944] [client 20.215.208.99:28892] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac5Yt0sZwqCndhl9uKCuOQAAAY8"]
[Thu Apr 02 19:53:30.011474 2026] [:error] [pid 29467:tid 29478] [client 20.215.208.99:28921] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac5Yur4VUBFCJAq-WOl7-QAAAQg"]
[Thu Apr 02 19:53:31.550369 2026] [:error] [pid 59305:tid 59329] [client 20.215.208.99:28899] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac5Yu6r2tV4rDwKFxKeGkgAAANQ"]
[Thu Apr 02 19:53:33.153586 2026] [:error] [pid 23927:tid 23935] [client 20.215.208.99:16215] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac5YvUsZwqCndhl9uKCuRgAAAYY"]
[Thu Apr 02 19:53:33.708295 2026] [:error] [pid 29467:tid 29479] [client 20.215.208.99:28910] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "ac5Yvb4VUBFCJAq-WOl8BgAAAQk"]
[Thu Apr 02 19:53:34.965964 2026] [:error] [pid 29467:tid 29488] [client 20.215.208.99:28887] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "ac5Yvr4VUBFCJAq-WOl8DgAAARI"]
[Thu Apr 02 19:53:36.038497 2026] [:error] [pid 23927:tid 23930] [client 20.215.208.99:57794] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "ac5YwEsZwqCndhl9uKCuRwAAAYE"]
[Thu Apr 02 19:53:37.054477 2026] [:error] [pid 37543:tid 37565] [client 20.215.208.99:39676] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "ac5YwXhdk2bEYJCvILbbFwAAAVQ"]
[Thu Apr 02 19:53:38.220049 2026] [:error] [pid 54384:tid 54400] [client 20.215.208.99:39632] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac5YwtWWpaby3TVN7McOBwAAAc4"]
[Thu Apr 02 19:53:39.586182 2026] [:error] [pid 59200:tid 59256] [client 20.215.208.99:21311] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac5Yw7fP26txrdLs3Ep0HQAAAFA"]
[Thu Apr 02 19:53:40.627756 2026] [:error] [pid 59305:tid 59333] [client 20.215.208.99:35717] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac5YxKr2tV4rDwKFxKeGowAAANg"]
[Thu Apr 02 19:53:41.427679 2026] [:error] [pid 29467:tid 29485] [client 20.215.208.99:21294] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fsgdjkl.php"] [unique_id "ac5Yxb4VUBFCJAq-WOl8FwAAAQ8"]
[Thu Apr 02 19:53:42.163396 2026] [:error] [pid 54384:tid 54392] [client 20.215.208.99:57804] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac5YxtWWpaby3TVN7McODgAAAcY"]
[Thu Apr 02 19:53:42.991505 2026] [:error] [pid 59201:tid 59281] [client 20.215.208.99:17736] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac5YxsAC0Tw8eL6gzZ4bIQAAAI4"]
[Thu Apr 02 19:53:43.840456 2026] [:error] [pid 23927:tid 23950] [client 20.215.208.99:57797] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac5Yx0sZwqCndhl9uKCuUAAAAZU"]
[Thu Apr 02 19:53:45.270176 2026] [:error] [pid 23927:tid 23943] [client 20.215.208.99:28918] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac5YyUsZwqCndhl9uKCuUgAAAY4"]
[Thu Apr 02 19:53:46.499442 2026] [:error] [pid 59200:tid 59246] [client 20.215.208.99:16192] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CDX2.php"] [unique_id "ac5YyrfP26txrdLs3Ep0JQAAAEY"]
[Thu Apr 02 19:53:47.673138 2026] [:error] [pid 59200:tid 59245] [client 20.215.208.99:25337] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CDX2.php"] [unique_id "ac5Yy7fP26txrdLs3Ep0JwAAAEU"]
[Thu Apr 02 19:53:48.616247 2026] [:error] [pid 59305:tid 59323] [client 20.215.208.99:21269] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CDX2.php"] [unique_id "ac5YzKr2tV4rDwKFxKeGuAAAAM4"]
[Thu Apr 02 19:53:49.319996 2026] [:error] [pid 59201:tid 59278] [client 20.215.208.99:62231] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CDX2.php"] [unique_id "ac5YzcAC0Tw8eL6gzZ4bJgAAAIs"]
[Thu Apr 02 19:53:49.999865 2026] [:error] [pid 37543:tid 37560] [client 20.215.208.99:27789] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a8.php"] [unique_id "ac5YzXhdk2bEYJCvILbbJwAAAU8"]
[Thu Apr 02 19:53:50.560465 2026] [:error] [pid 23927:tid 23929] [client 20.215.208.99:25289] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a8.php"] [unique_id "ac5YzksZwqCndhl9uKCuXAAAAYA"]
[Thu Apr 02 19:53:51.344635 2026] [:error] [pid 23927:tid 23932] [client 20.215.208.99:27830] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a8.php"] [unique_id "ac5Yz0sZwqCndhl9uKCuXgAAAYM"]
[Thu Apr 02 19:53:51.933403 2026] [:error] [pid 59194:tid 59222] [client 20.215.208.99:28866] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a8.php"] [unique_id "ac5YzxMpAeV11hcQehxEYQAAAAk"]
[Thu Apr 02 19:53:52.524881 2026] [:error] [pid 59305:tid 59328] [client 20.215.208.99:57802] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac5Y0Kr2tV4rDwKFxKeGvAAAANM"]
[Thu Apr 02 19:53:53.080871 2026] [:error] [pid 59201:tid 59272] [client 20.215.208.99:36403] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac5Y0cAC0Tw8eL6gzZ4bKgAAAIU"]
[Thu Apr 02 19:53:53.781355 2026] [:error] [pid 59194:tid 59215] [client 20.215.208.99:35733] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac5Y0RMpAeV11hcQehxEZAAAAAI"]
[Thu Apr 02 19:53:54.300757 2026] [:error] [pid 54384:tid 54395] [client 20.215.208.99:57851] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac5Y0tWWpaby3TVN7McOFwAAAck"]
[Thu Apr 02 19:53:55.024478 2026] [:error] [pid 37543:tid 37548] [client 20.215.208.99:27805] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "ac5Y03hdk2bEYJCvILbbNAAAAUM"]
[Thu Apr 02 19:53:55.561470 2026] [:error] [pid 37543:tid 37549] [client 20.215.208.99:35762] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "ac5Y03hdk2bEYJCvILbbNwAAAUQ"]
[Thu Apr 02 19:53:56.159891 2026] [:error] [pid 37543:tid 37555] [client 20.215.208.99:62236] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "ac5Y1Hhdk2bEYJCvILbbOgAAAUo"]
[Thu Apr 02 19:53:56.783904 2026] [:error] [pid 29467:tid 29476] [client 20.215.208.99:57800] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "ac5Y1L4VUBFCJAq-WOl8HQAAAQY"]
[Thu Apr 02 19:53:57.317841 2026] [:error] [pid 59305:tid 59320] [client 20.215.208.99:57852] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "ac5Y1ar2tV4rDwKFxKeGyQAAAMs"]
[Thu Apr 02 19:53:58.090181 2026] [:error] [pid 59305:tid 59313] [client 20.215.208.99:57792] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "ac5Y1qr2tV4rDwKFxKeGzQAAAMQ"]
[Thu Apr 02 19:53:58.779717 2026] [:error] [pid 23927:tid 23948] [client 20.215.208.99:25297] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "ac5Y1ksZwqCndhl9uKCuagAAAZM"]
[Thu Apr 02 19:53:59.375040 2026] [:error] [pid 37543:tid 37563] [client 20.215.208.99:28864] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "ac5Y13hdk2bEYJCvILbbRAAAAVI"]
[Thu Apr 02 19:54:00.169529 2026] [:error] [pid 37543:tid 37554] [client 20.215.208.99:27804] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Geforce.php"] [unique_id "ac5Y2Hhdk2bEYJCvILbbSAAAAUk"]
[Thu Apr 02 19:54:00.787413 2026] [:error] [pid 54384:tid 54406] [client 20.215.208.99:35738] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Geforce.php"] [unique_id "ac5Y2NWWpaby3TVN7McOGwAAAdQ"]
[Thu Apr 02 19:54:01.424334 2026] [:error] [pid 59305:tid 59322] [client 20.215.208.99:62251] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Geforce.php"] [unique_id "ac5Y2ar2tV4rDwKFxKeG0QAAAM0"]
[Thu Apr 02 19:54:02.020850 2026] [:error] [pid 23927:tid 23939] [client 20.215.208.99:36375] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Geforce.php"] [unique_id "ac5Y2ksZwqCndhl9uKCudgAAAYo"]
[Thu Apr 02 19:54:02.541167 2026] [:error] [pid 23927:tid 23949] [client 20.215.208.99:39629] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "ac5Y2ksZwqCndhl9uKCufQAAAZQ"]
[Thu Apr 02 19:54:03.069230 2026] [:error] [pid 59305:tid 59329] [client 20.215.208.99:57825] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "ac5Y26r2tV4rDwKFxKeG0gAAANQ"]
[Thu Apr 02 19:54:03.615852 2026] [:error] [pid 37543:tid 37565] [client 20.215.208.99:39649] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "ac5Y23hdk2bEYJCvILbbTwAAAVQ"]
[Thu Apr 02 19:54:04.128649 2026] [:error] [pid 37543:tid 37555] [client 20.215.208.99:27782] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "ac5Y3Hhdk2bEYJCvILbbUgAAAUo"]
[Thu Apr 02 19:54:04.760544 2026] [:error] [pid 37543:tid 37563] [client 20.215.208.99:36374] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-ccv.php"] [unique_id "ac5Y3Hhdk2bEYJCvILbbVQAAAVI"]
[Thu Apr 02 19:54:05.335098 2026] [:error] [pid 54384:tid 54396] [client 20.215.208.99:16738] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-ccv.php"] [unique_id "ac5Y3dWWpaby3TVN7McOIQAAAco"]
[Thu Apr 02 19:54:06.006570 2026] [:error] [pid 54384:tid 54386] [client 20.215.208.99:28915] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-ccv.php"] [unique_id "ac5Y3tWWpaby3TVN7McOJQAAAcA"]
[Thu Apr 02 19:54:06.646105 2026] [:error] [pid 59201:tid 59280] [client 20.215.208.99:39619] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-ccv.php"] [unique_id "ac5Y3sAC0Tw8eL6gzZ4bMgAAAI0"]
[Thu Apr 02 19:54:07.169358 2026] [:error] [pid 37543:tid 37549] [client 20.215.208.99:25307] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/luyuc.php"] [unique_id "ac5Y33hdk2bEYJCvILbbWwAAAUQ"]
[Thu Apr 02 19:54:07.698619 2026] [:error] [pid 59201:tid 59279] [client 20.215.208.99:57793] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/luyuc.php"] [unique_id "ac5Y38AC0Tw8eL6gzZ4bNgAAAIw"]
[Thu Apr 02 19:54:08.297643 2026] [:error] [pid 59201:tid 59273] [client 20.215.208.99:16721] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/luyuc.php"] [unique_id "ac5Y4MAC0Tw8eL6gzZ4bNwAAAIY"]
[Thu Apr 02 19:54:08.953171 2026] [:error] [pid 54384:tid 54386] [client 20.215.208.99:21258] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/luyuc.php"] [unique_id "ac5Y4NWWpaby3TVN7McONgAAAcA"]
[Thu Apr 02 19:54:09.494479 2026] [:error] [pid 29467:tid 29474] [client 20.215.208.99:28894] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "ac5Y4b4VUBFCJAq-WOl8KAAAAQQ"]
[Thu Apr 02 19:54:10.006052 2026] [:error] [pid 29467:tid 29473] [client 20.215.208.99:39668] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "ac5Y4r4VUBFCJAq-WOl8LQAAAQM"]
[Thu Apr 02 19:54:10.578825 2026] [:error] [pid 37543:tid 37563] [client 20.215.208.99:62258] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "ac5Y4nhdk2bEYJCvILbbYQAAAVI"]
[Thu Apr 02 19:54:11.114895 2026] [:error] [pid 23927:tid 23948] [client 20.215.208.99:25341] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bless.php"] [unique_id "ac5Y40sZwqCndhl9uKCuiQAAAZM"]
[Thu Apr 02 19:54:11.663836 2026] [:error] [pid 29467:tid 29474] [client 20.215.208.99:16710] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htto.php"] [unique_id "ac5Y474VUBFCJAq-WOl8NgAAAQQ"]
[Thu Apr 02 19:54:12.189746 2026] [:error] [pid 59305:tid 59310] [client 20.215.208.99:36370] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htto.php"] [unique_id "ac5Y5Kr2tV4rDwKFxKeG4gAAAME"]
[Thu Apr 02 19:54:12.743262 2026] [:error] [pid 23927:tid 23942] [client 20.215.208.99:57831] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htto.php"] [unique_id "ac5Y5EsZwqCndhl9uKCukAAAAY0"]
[Thu Apr 02 19:54:13.277378 2026] [:error] [pid 59305:tid 59329] [client 20.215.208.99:36358] [client 20.215.208.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htto.php"] [unique_id "ac5Y5ar2tV4rDwKFxKeG6AAAANQ"]
[Thu Apr 02 23:34:47.688119 2026] [:error] [pid 37543:tid 37548] [client 43.153.104.196:52130] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac6Ml3hdk2bEYJCvILYV9wAAAUM"]
[Fri Apr 03 04:57:46.917124 2026] [:error] [pid 58590:tid 58608] [client 182.44.2.148:38423] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac7YSkze_aEPDM9xEE2R5QAAARA"]
[Fri Apr 03 10:13:09.738589 2026] [:error] [pid 33542:tid 33564] [client 43.135.211.148:39538] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac8iNXwb6uB1LaGtepZ7SgAAANM"]
[Fri Apr 03 14:12:37.743430 2026] [:error] [pid 40562:tid 40586] [client 194.5.52.2:43765] [client 194.5.52.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac9aVTfFMXuP9zvqCeoAkQAAAZU"]
[Fri Apr 03 14:59:52.965353 2026] [:error] [pid 33542:tid 33567] [client 43.153.104.196:40382] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac9laHwb6uB1LaGtepa0PgAAANY"]
[Fri Apr 03 17:17:47.736902 2026] [:error] [pid 40533:tid 40556] [client 192.144.148.122:53676] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac-Fu_bIAA8AViDmwsuCMAAAAVU"]
[Fri Apr 03 20:56:29.877972 2026] [:error] [pid 40562:tid 40578] [client 45.92.1.144:64160] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Fri Apr 03 20:56:30.849974 2026] [:error] [pid 33446:tid 33500] [client 45.92.1.144:63728] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ac-4_tg3dCqFYIIdw0pdRQAAAFc"]
[Fri Apr 03 20:56:31.335222 2026] [:error] [pid 35469:tid 35488] [client 45.92.1.144:62261] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ac-4_6GvTIc8-wY3jUSGdQAAARE"]
[Fri Apr 03 20:56:31.820775 2026] [:error] [pid 33446:tid 33483] [client 45.92.1.144:52539] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ac-4_9g3dCqFYIIdw0pdUgAAAEY"]
[Fri Apr 03 20:56:32.803709 2026] [:error] [pid 33542:tid 33562] [client 45.92.1.144:63765] [client 45.92.1.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "ac-5AHwb6uB1LaGtepb2kQAAANE"]
[Fri Apr 03 20:56:33.293280 2026] [:error] [pid 40562:tid 40565] [client 45.92.1.144:52825] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Fri Apr 03 20:56:33.792669 2026] [:error] [pid 35469:tid 35474] [client 45.92.1.144:57679] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Fri Apr 03 23:41:33.122602 2026] [:error] [pid 33542:tid 33549] [client 106.54.62.156:41910] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ac_frXwb6uB1LaGtepYuAQAAAMQ"]
[Fri Apr 03 23:59:02.916906 2026] [:error] [pid 33446:tid 33477] [client 43.153.71.12:34650] [client 43.153.71.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ac_jxtg3dCqFYIIdw0qiBQAAAEA"]
[Sat Apr 04 05:03:17.710752 2026] [:error] [pid 2458:tid 2519] [client 20.250.11.224:52906] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-Blogs.php
[Sat Apr 04 05:03:17.951304 2026] [:error] [pid 2458:tid 2518] [client 20.250.11.224:52906] File does not exist: /usr/local/apache/htdocs/suspended-page/wpb.php
[Sat Apr 04 05:03:18.191184 2026] [:error] [pid 2458:tid 2523] [client 20.250.11.224:52906] File does not exist: /usr/local/apache/htdocs/suspended-page/ftde.php
[Sat Apr 04 05:03:18.429764 2026] [:error] [pid 2458:tid 2510] [client 20.250.11.224:52906] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Sat Apr 04 05:05:02.704405 2026] [:error] [pid 37114:tid 37137] [client 20.199.111.128:38276] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-Blogs.php
[Sat Apr 04 05:05:02.942168 2026] [:error] [pid 37114:tid 37117] [client 20.199.111.128:38276] File does not exist: /usr/local/apache/htdocs/suspended-page/ftde.php
[Sat Apr 04 05:05:03.180908 2026] [:error] [pid 37114:tid 37116] [client 20.199.111.128:38276] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Sat Apr 04 05:05:35.069699 2026] [:error] [pid 2457:tid 2491] [client 158.158.32.192:12487] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-Blogs.php
[Sat Apr 04 05:05:35.314281 2026] [:error] [pid 2457:tid 2478] [client 158.158.32.192:12487] File does not exist: /usr/local/apache/htdocs/suspended-page/wpb.php
[Sat Apr 04 05:05:35.556457 2026] [:error] [pid 2457:tid 2480] [client 158.158.32.192:12487] File does not exist: /usr/local/apache/htdocs/suspended-page/ftde.php
[Sat Apr 04 05:05:35.798806 2026] [:error] [pid 2457:tid 2484] [client 158.158.32.192:12487] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Sat Apr 04 05:53:05.155208 2026] [:error] [pid 37114:tid 37128] [client 77.90.185.80:55162] [client 77.90.185.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "adA2wc-DnSj3fGMexeKFEwAAAQw"]
[Sat Apr 04 05:53:05.155380 2026] [:error] [pid 37114:tid 37132] [client 77.90.185.80:55154] [client 77.90.185.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "adA2wc-DnSj3fGMexeKFFAAAARA"]
[Sat Apr 04 05:53:07.587746 2026] [:error] [pid 2459:tid 2546] [client 77.90.185.80:43338] [client 77.90.185.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "adA2wwefyCmu4LR_Plpw9gAAAI4"]
[Sat Apr 04 05:53:07.605207 2026] [:error] [pid 2457:tid 2486] [client 77.90.185.80:43344] [client 77.90.185.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "adA2w0mNHppaMd92ZpdXsgAAAAk"]
[Sat Apr 04 11:44:14.031899 2026] [:error] [pid 37114:tid 37124] [client 43.133.69.37:51846] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adCJDs-DnSj3fGMexeIrzgAAAQg"]
[Sat Apr 04 12:16:33.829902 2026] [:error] [pid 2457:tid 2497] [client 43.138.68.113:57296] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adCQoUmNHppaMd92Zpe1ZwAAABQ"]
[Sat Apr 04 15:00:52.047999 2026] [:error] [pid 2458:tid 2509] [client 43.154.127.188:59814] [client 43.154.127.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adC3JCNozic5SuWqcll9ywAAAEU"]
[Sat Apr 04 17:13:05.676102 2026] [:error] [pid 2459:tid 2540] [client 43.166.250.187:50752] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adDWIQefyCmu4LR_Plp8-QAAAIg"]
[Sat Apr 04 18:47:23.982879 2026] [:error] [pid 2458:tid 2518] [client 119.96.24.54:36466] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adDsOyNozic5SuWqclng3QAAAE4"]
[Sat Apr 04 19:50:51.456467 2026] [:error] [pid 2458:tid 2521] [client 43.153.86.78:51920] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adD7GyNozic5SuWqclkCMAAAAFE"]
[Sat Apr 04 21:39:51.716405 2026] [:error] [pid 63487:tid 63495] [client 43.156.228.27:54994] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adEUp2pqOMD5fJ8_5q39TwAAAUU"]
[Sun Apr 05 00:27:20.631942 2026] [:error] [pid 63487:tid 63501] [client 45.131.195.66:57619] [client 45.131.195.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adE76GpqOMD5fJ8_5q1dCwAAAUs"]
[Sun Apr 05 06:46:54.451325 2026] [:error] [pid 45303:tid 45330] [client 43.157.22.109:48774] [client 43.157.22.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adGU3rboQ9eViZ4hdnmYLQAAAA0"]
[Sun Apr 05 07:23:38.070352 2026] [:error] [pid 45305:tid 45388] [client 182.44.67.97:40009] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adGdeujDQjr7aWhjflBgGwAAAJE"]
[Sun Apr 05 10:03:19.195187 2026] [:error] [pid 45305:tid 45376] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 05 10:03:19.450382 2026] [:error] [pid 45305:tid 45388] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sun Apr 05 10:03:19.713653 2026] [:error] [pid 45305:tid 45374] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Sun Apr 05 10:03:19.973344 2026] [:error] [pid 45305:tid 45392] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Sun Apr 05 10:03:20.210349 2026] [:error] [pid 45305:tid 45379] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sun Apr 05 10:03:20.463103 2026] [:error] [pid 45305:tid 45380] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Apr 05 10:03:20.702436 2026] [:error] [pid 45305:tid 45372] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Apr 05 10:03:20.945583 2026] [:error] [pid 45305:tid 45386] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/xxc.php
[Sun Apr 05 10:03:21.977612 2026] [:error] [pid 45305:tid 45393] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Sun Apr 05 10:03:23.452282 2026] [:error] [pid 45305:tid 45393] [client 20.199.97.195:56848] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Apr 05 10:03:23.994852 2026] [:error] [pid 45305:tid 45381] [client 20.199.97.195:56848] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHC6-jDQjr7aWhjflDaHQAAAIo"]
[Sun Apr 05 10:03:30.416882 2026] [:error] [pid 45409:tid 45435] [client 20.199.97.195:57526] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHC8tHt_Oyw03gjCNhXywAAANg"]
[Sun Apr 05 10:03:32.427930 2026] [:error] [pid 45409:tid 45427] [client 20.199.97.195:46722] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHC9NHt_Oyw03gjCNhX1AAAANA"]
[Sun Apr 05 10:03:35.722127 2026] [:error] [pid 45305:tid 45390] [client 20.199.97.195:9861] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHC9-jDQjr7aWhjflDaOQAAAJM"]
[Sun Apr 05 10:03:37.489070 2026] [:error] [pid 45305:tid 45381] [client 20.199.97.195:46731] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHC-ejDQjr7aWhjflDaQwAAAIo"]
[Sun Apr 05 10:03:38.759795 2026] [:error] [pid 30921:tid 30945] [client 20.199.97.195:47168] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHC-mFGQVn8Q0ueB27UZwAAARY"]
[Sun Apr 05 10:03:39.687844 2026] [:error] [pid 45409:tid 45420] [client 20.199.97.195:56863] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHC-9Ht_Oyw03gjCNhX3wAAAMk"]
[Sun Apr 05 10:03:40.969668 2026] [:error] [pid 45305:tid 45392] [client 20.199.97.195:59920] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHC_OjDQjr7aWhjflDaVwAAAJU"]
[Sun Apr 05 10:03:42.288531 2026] [:error] [pid 45304:tid 45356] [client 20.199.97.195:47194] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHC_g5jnqDKKovdRklLvAAAAEw"]
[Sun Apr 05 10:03:43.700595 2026] [:error] [pid 45409:tid 45420] [client 20.199.97.195:56852] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHC_9Ht_Oyw03gjCNhX6gAAAMk"]
[Sun Apr 05 10:03:46.002204 2026] [:error] [pid 45305:tid 45386] [client 20.199.97.195:57506] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHDAujDQjr7aWhjflDabQAAAI8"]
[Sun Apr 05 10:03:47.281005 2026] [:error] [pid 45304:tid 45347] [client 20.199.97.195:47224] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHDAw5jnqDKKovdRklLyQAAAEM"]
[Sun Apr 05 10:03:47.981274 2026] [:error] [pid 45304:tid 45355] [client 20.199.97.195:9916] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "adHDAw5jnqDKKovdRklLzQAAAEs"]
[Sun Apr 05 10:03:51.003376 2026] [:error] [pid 30921:tid 30933] [client 20.199.97.195:56885] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "adHDB2FGQVn8Q0ueB27UdAAAAQo"]
[Sun Apr 05 10:03:53.115584 2026] [:error] [pid 45409:tid 45429] [client 20.199.97.195:9869] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "adHDCdHt_Oyw03gjCNhX-QAAANI"]
[Sun Apr 05 10:03:57.979885 2026] [:error] [pid 45303:tid 45327] [client 20.199.97.195:56269] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "adHDDbboQ9eViZ4hdnnVswAAAAo"]
[Sun Apr 05 10:04:00.973192 2026] [:error] [pid 45304:tid 45354] [client 20.199.97.195:59923] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "adHDEA5jnqDKKovdRklL4QAAAEo"]
[Sun Apr 05 10:04:11.066110 2026] [:error] [pid 45304:tid 45347] [client 20.199.97.195:59937] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "adHDGw5jnqDKKovdRklL-wAAAEM"]
[Sun Apr 05 10:04:18.080471 2026] [:error] [pid 45305:tid 45385] [client 20.199.97.195:59958] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HLA-dd.php"] [unique_id "adHDIujDQjr7aWhjflDatQAAAI4"]
[Sun Apr 05 10:04:20.028245 2026] [:error] [pid 45305:tid 45382] [client 20.199.97.195:57494] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HLA-dd.php"] [unique_id "adHDJOjDQjr7aWhjflDa0wAAAIs"]
[Sun Apr 05 10:04:21.815853 2026] [:error] [pid 45305:tid 45385] [client 20.199.97.195:58651] [client 20.199.97.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HLA-dd.php"] [unique_id "adHDJejDQjr7aWhjflDa3gAAAI4"]
[Sun Apr 05 10:04:24.077006 2026] [:error] [pid 45305:tid 45389] [client 20.199.97.195:57508] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Sun Apr 05 10:04:24.336637 2026] [:error] [pid 45305:tid 45380] [client 20.199.97.195:57508] File does not exist: /usr/local/apache/htdocs/suspended-page/wsc.php
[Sun Apr 05 10:04:24.574323 2026] [:error] [pid 45305:tid 45377] [client 20.199.97.195:57508] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lvminl.php
[Sun Apr 05 10:04:24.813195 2026] [:error] [pid 45305:tid 45389] [client 20.199.97.195:57508] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Sun Apr 05 10:04:25.071923 2026] [:error] [pid 45305:tid 45386] [client 20.199.97.195:57508] File does not exist: /usr/local/apache/htdocs/suspended-page/dczem.php
[Sun Apr 05 10:04:25.312396 2026] [:error] [pid 45305:tid 45392] [client 20.199.97.195:57508] File does not exist: /usr/local/apache/htdocs/suspended-page/albrt.php
[Sun Apr 05 10:16:25.653059 2026] [:error] [pid 30921:tid 30942] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 05 10:16:25.920540 2026] [:error] [pid 30921:tid 30941] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sun Apr 05 10:16:26.193452 2026] [:error] [pid 30921:tid 30936] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Sun Apr 05 10:16:26.464407 2026] [:error] [pid 30921:tid 30943] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Sun Apr 05 10:16:26.723635 2026] [:error] [pid 30921:tid 30939] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sun Apr 05 10:16:26.981777 2026] [:error] [pid 30921:tid 30925] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Sun Apr 05 10:16:27.244662 2026] [:error] [pid 30921:tid 30930] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Apr 05 10:16:27.539745 2026] [:error] [pid 30921:tid 30928] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/xxc.php
[Sun Apr 05 10:16:27.807971 2026] [:error] [pid 30921:tid 30929] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Sun Apr 05 10:16:28.074015 2026] [:error] [pid 30921:tid 30935] [client 74.248.146.253:21480] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sun Apr 05 10:16:28.329352 2026] [:error] [pid 30921:tid 30947] [client 74.248.146.253:21480] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHF_GFGQVn8Q0ueB27Z0gAAARg"]
[Sun Apr 05 10:16:29.483831 2026] [:error] [pid 45304:tid 45344] [client 74.248.146.253:21462] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHF_Q5jnqDKKovdRklO9gAAAEA"]
[Sun Apr 05 10:16:31.400009 2026] [:error] [pid 45305:tid 45391] [client 74.248.146.253:18164] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHF_-jDQjr7aWhjflDl8gAAAJQ"]
[Sun Apr 05 10:16:34.167870 2026] [:error] [pid 45409:tid 45412] [client 74.248.146.253:21448] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55l453.php"] [unique_id "adHGAtHt_Oyw03gjCNhfIgAAAME"]
[Sun Apr 05 10:16:36.106233 2026] [:error] [pid 30921:tid 30943] [client 74.248.146.253:21442] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHGBGFGQVn8Q0ueB27Z5QAAARQ"]
[Sun Apr 05 10:16:37.478807 2026] [:error] [pid 45409:tid 45421] [client 74.248.146.253:65399] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHGBdHt_Oyw03gjCNhfLwAAAMo"]
[Sun Apr 05 10:16:38.980111 2026] [:error] [pid 45305:tid 45387] [client 74.248.146.253:2896] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHGBujDQjr7aWhjflDmEAAAAJA"]
[Sun Apr 05 10:16:40.340328 2026] [:error] [pid 30921:tid 30937] [client 74.248.146.253:2918] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "adHGCGFGQVn8Q0ueB27Z6wAAAQ4"]
[Sun Apr 05 10:16:42.470064 2026] [:error] [pid 45409:tid 45417] [client 74.248.146.253:18133] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHGCtHt_Oyw03gjCNhfOgAAAMY"]
[Sun Apr 05 10:16:46.866602 2026] [:error] [pid 45409:tid 45415] [client 74.248.146.253:21458] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHGDtHt_Oyw03gjCNhfSAAAAMQ"]
[Sun Apr 05 10:16:52.497742 2026] [:error] [pid 30921:tid 30944] [client 74.248.146.253:65370] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHGFGFGQVn8Q0ueB27aCQAAARU"]
[Sun Apr 05 10:16:55.504994 2026] [:error] [pid 45409:tid 45425] [client 74.248.146.253:18163] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "adHGF9Ht_Oyw03gjCNhfYwAAAM4"]
[Sun Apr 05 10:17:01.228313 2026] [:error] [pid 45305:tid 45383] [client 74.248.146.253:2886] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsc.php"] [unique_id "adHGHejDQjr7aWhjflDmVwAAAIw"]
[Sun Apr 05 10:17:03.237973 2026] [:error] [pid 45305:tid 45389] [client 74.248.146.253:21477] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsc.php"] [unique_id "adHGH-jDQjr7aWhjflDmZgAAAJI"]
[Sun Apr 05 10:17:05.036266 2026] [:error] [pid 45409:tid 45431] [client 74.248.146.253:63387] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsc.php"] [unique_id "adHGIdHt_Oyw03gjCNhfiQAAANQ"]
[Sun Apr 05 10:17:06.232501 2026] [:error] [pid 45305:tid 45371] [client 74.248.146.253:15308] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsc.php"] [unique_id "adHGIujDQjr7aWhjflDmcAAAAIA"]
[Sun Apr 05 10:17:07.847671 2026] [:error] [pid 45409:tid 45414] [client 74.248.146.253:18173] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-lvminl.php"] [unique_id "adHGI9Ht_Oyw03gjCNhfkwAAAMM"]
[Sun Apr 05 10:17:11.360878 2026] [:error] [pid 45303:tid 45326] [client 74.248.146.253:63372] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-lvminl.php"] [unique_id "adHGJ7boQ9eViZ4hdnnaEwAAAAk"]
[Sun Apr 05 10:17:19.546740 2026] [:error] [pid 30921:tid 30925] [client 74.248.146.253:2892] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-lvminl.php"] [unique_id "adHGL2FGQVn8Q0ueB27aOgAAAQI"]
[Sun Apr 05 10:17:25.769684 2026] [:error] [pid 30921:tid 30923] [client 74.248.146.253:18147] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "adHGNWFGQVn8Q0ueB27aVgAAAQA"]
[Sun Apr 05 10:17:33.962615 2026] [:error] [pid 45409:tid 45423] [client 74.248.146.253:65351] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Sun Apr 05 10:17:34.620883 2026] [:error] [pid 45409:tid 45423] [client 74.248.146.253:65351] File does not exist: /usr/local/apache/htdocs/suspended-page/dczem.php
[Sun Apr 05 10:17:34.880914 2026] [:error] [pid 45409:tid 45419] [client 74.248.146.253:65351] File does not exist: /usr/local/apache/htdocs/suspended-page/albrt.php
[Sun Apr 05 11:41:50.117307 2026] [:error] [pid 45409:tid 45417] [client 74.248.146.253:13176] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Sun Apr 05 12:27:49.924605 2026] [:error] [pid 45409:tid 45420] [client 43.135.140.225:34162] [client 43.135.140.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adHkxdHt_Oyw03gjCNizTwAAAMk"]
[Sun Apr 05 14:22:11.183790 2026] [:error] [pid 45409:tid 45424] [client 20.199.97.195:15347] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Sun Apr 05 19:30:24.348156 2026] [:error] [pid 30921:tid 30923] [client 170.106.180.153:59978] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adJH0GFGQVn8Q0ueB27nvgAAAQA"]
[Sun Apr 05 22:01:54.240403 2026] [:error] [pid 45305:tid 45385] [client 170.106.37.134:54914] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adJrUujDQjr7aWhjflBqjwAAAI4"]
[Sun Apr 05 23:54:22.307009 2026] [:error] [pid 45305:tid 45373] [client 170.106.163.48:45932] [client 170.106.163.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adKFrujDQjr7aWhjflCd0AAAAII"]
[Mon Apr 06 00:49:26.655932 2026] [:error] [pid 51584:tid 51719] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Mon Apr 06 00:49:26.921342 2026] [:error] [pid 51584:tid 51708] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Mon Apr 06 00:49:27.186104 2026] [:error] [pid 51584:tid 51710] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/ghhjh.php
[Mon Apr 06 00:49:27.457716 2026] [:error] [pid 51584:tid 51707] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/cacheee.php
[Mon Apr 06 00:49:27.726298 2026] [:error] [pid 51584:tid 51715] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Mon Apr 06 00:49:27.999196 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Mon Apr 06 00:49:28.266424 2026] [:error] [pid 51584:tid 51706] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Mon Apr 06 00:49:28.531119 2026] [:error] [pid 51584:tid 51709] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 06 00:49:28.796468 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Mon Apr 06 00:49:29.061409 2026] [:error] [pid 51584:tid 51710] [client 4.223.110.88:25209] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Mon Apr 06 00:49:29.323859 2026] [:error] [pid 51584:tid 51712] [client 4.223.110.88:25209] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "adKSmcZ4qY_GoNCPARAKUgAAAM8"]
[Mon Apr 06 00:49:29.880991 2026] [:error] [pid 51581:tid 51677] [client 4.223.110.88:52418] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "adKSmd4k74fhQLPUy7Ew1AAAAIg"]
[Mon Apr 06 00:49:30.414979 2026] [:error] [pid 51753:tid 51816] [client 4.223.110.88:56479] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "adKSmq3pmp1JkaicYbtRFQAAAQU"]
[Mon Apr 06 00:49:30.939606 2026] [:error] [pid 51584:tid 51699] [client 4.223.110.88:63842] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "adKSmsZ4qY_GoNCPARAKWwAAAMI"]
[Mon Apr 06 00:49:31.508303 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:8594] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "adKSm63pmp1JkaicYbtRGgAAARQ"]
[Mon Apr 06 00:49:32.099114 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:45143] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "adKSnK3pmp1JkaicYbtRHAAAARI"]
[Mon Apr 06 00:49:32.656911 2026] [:error] [pid 51580:tid 51641] [client 4.223.110.88:45138] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "adKSnFNFl1NiyNgNZAkP-gAAAEI"]
[Mon Apr 06 00:49:33.198743 2026] [:error] [pid 51580:tid 51649] [client 4.223.110.88:25210] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "adKSnVNFl1NiyNgNZAkP_AAAAEo"]
[Mon Apr 06 00:49:33.745582 2026] [:error] [pid 51580:tid 51652] [client 4.223.110.88:8335] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "adKSnVNFl1NiyNgNZAkP_gAAAE0"]
[Mon Apr 06 00:49:34.271817 2026] [:error] [pid 51580:tid 51660] [client 4.223.110.88:8220] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "adKSnlNFl1NiyNgNZAkP_wAAAFU"]
[Mon Apr 06 00:49:34.821559 2026] [:error] [pid 51580:tid 51651] [client 4.223.110.88:29120] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "adKSnlNFl1NiyNgNZAkQBQAAAEw"]
[Mon Apr 06 00:49:35.368273 2026] [:error] [pid 51581:tid 51686] [client 4.223.110.88:63831] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "adKSn94k74fhQLPUy7Ew3AAAAJE"]
[Mon Apr 06 00:49:35.914545 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:25183] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adKSn63pmp1JkaicYbtRNwAAAQY"]
[Mon Apr 06 00:49:36.557146 2026] [:error] [pid 51584:tid 51718] [client 4.223.110.88:40207] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adKSoMZ4qY_GoNCPARAKdwAAANU"]
[Mon Apr 06 00:49:37.104391 2026] [:error] [pid 51581:tid 51680] [client 4.223.110.88:22050] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adKSod4k74fhQLPUy7Ew5AAAAIs"]
[Mon Apr 06 00:49:37.832695 2026] [:error] [pid 51581:tid 51669] [client 4.223.110.88:8196] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adKSod4k74fhQLPUy7Ew6AAAAIA"]
[Mon Apr 06 00:49:38.383404 2026] [:error] [pid 51753:tid 51823] [client 4.223.110.88:8621] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "adKSoq3pmp1JkaicYbtRPwAAAQw"]
[Mon Apr 06 00:49:38.936252 2026] [:error] [pid 51581:tid 51687] [client 4.223.110.88:25157] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "adKSot4k74fhQLPUy7Ew8AAAAJI"]
[Mon Apr 06 00:49:39.512421 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:52447] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "adKSo63pmp1JkaicYbtRQgAAARA"]
[Mon Apr 06 00:49:40.090557 2026] [:error] [pid 51753:tid 51816] [client 4.223.110.88:56450] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "adKSpK3pmp1JkaicYbtRRwAAAQU"]
[Mon Apr 06 00:49:40.690055 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:8595] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "adKSpK3pmp1JkaicYbtRTQAAAQM"]
[Mon Apr 06 00:49:41.255077 2026] [:error] [pid 51581:tid 51671] [client 4.223.110.88:25164] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "adKSpd4k74fhQLPUy7Ew9AAAAII"]
[Mon Apr 06 00:49:41.794006 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:8221] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "adKSpa3pmp1JkaicYbtRUwAAAQE"]
[Mon Apr 06 00:49:42.343060 2026] [:error] [pid 51580:tid 51650] [client 4.223.110.88:8218] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "adKSplNFl1NiyNgNZAkQIwAAAEs"]
[Mon Apr 06 00:49:42.944362 2026] [:error] [pid 51584:tid 51718] [client 4.223.110.88:45142] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.yuf.php"] [unique_id "adKSpsZ4qY_GoNCPARAKiwAAANU"]
[Mon Apr 06 00:49:43.535893 2026] [:error] [pid 51580:tid 51642] [client 4.223.110.88:8233] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.yuf.php"] [unique_id "adKSp1NFl1NiyNgNZAkQKQAAAEM"]
[Mon Apr 06 00:49:44.116009 2026] [:error] [pid 51581:tid 51694] [client 4.223.110.88:8590] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.yuf.php"] [unique_id "adKSqN4k74fhQLPUy7Ew-AAAAJg"]
[Mon Apr 06 00:49:44.723866 2026] [:error] [pid 51753:tid 51818] [client 4.223.110.88:56466] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.yuf.php"] [unique_id "adKSqK3pmp1JkaicYbtRZAAAAQc"]
[Mon Apr 06 00:49:45.302345 2026] [:error] [pid 51753:tid 51824] [client 4.223.110.88:8627] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "adKSqa3pmp1JkaicYbtRagAAAQ0"]
[Mon Apr 06 00:49:45.874525 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:29148] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "adKSqa3pmp1JkaicYbtRbwAAARQ"]
[Mon Apr 06 00:49:46.413519 2026] [:error] [pid 51580:tid 51640] [client 4.223.110.88:8193] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "adKSqlNFl1NiyNgNZAkQMAAAAEE"]
[Mon Apr 06 00:49:46.969180 2026] [:error] [pid 51580:tid 51643] [client 4.223.110.88:45174] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "adKSqlNFl1NiyNgNZAkQNwAAAEQ"]
[Mon Apr 06 00:49:47.530940 2026] [:error] [pid 51580:tid 51651] [client 4.223.110.88:25160] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "adKSq1NFl1NiyNgNZAkQPwAAAEw"]
[Mon Apr 06 00:49:48.088717 2026] [:error] [pid 51580:tid 51647] [client 4.223.110.88:56459] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "adKSrFNFl1NiyNgNZAkQQwAAAEg"]
[Mon Apr 06 00:49:48.643822 2026] [:error] [pid 51581:tid 51685] [client 4.223.110.88:45125] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "adKSrN4k74fhQLPUy7ExAgAAAJA"]
[Mon Apr 06 00:49:49.181401 2026] [:error] [pid 51584:tid 51708] [client 4.223.110.88:8205] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "adKSrcZ4qY_GoNCPARAKngAAAMs"]
[Mon Apr 06 00:49:49.767999 2026] [:error] [pid 51584:tid 51704] [client 4.223.110.88:8597] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adKSrcZ4qY_GoNCPARAKowAAAMc"]
[Mon Apr 06 00:49:50.303739 2026] [:error] [pid 51753:tid 51815] [client 4.223.110.88:8204] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adKSrq3pmp1JkaicYbtRgAAAAQQ"]
[Mon Apr 06 00:49:50.891490 2026] [:error] [pid 51580:tid 51661] [client 4.223.110.88:8612] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adKSrlNFl1NiyNgNZAkQVAAAAFY"]
[Mon Apr 06 00:49:51.445558 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:52427] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adKSr63pmp1JkaicYbtRjgAAAQY"]
[Mon Apr 06 00:49:51.985516 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:21429] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "adKSr63pmp1JkaicYbtRlQAAAQE"]
[Mon Apr 06 00:49:52.565599 2026] [:error] [pid 51580:tid 51646] [client 4.223.110.88:63858] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "adKSsFNFl1NiyNgNZAkQWAAAAEc"]
[Mon Apr 06 00:49:53.118830 2026] [:error] [pid 51753:tid 51813] [client 4.223.110.88:29137] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "adKSsa3pmp1JkaicYbtRngAAAQI"]
[Mon Apr 06 00:49:53.698808 2026] [:error] [pid 51584:tid 51704] [client 4.223.110.88:45121] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "adKSscZ4qY_GoNCPARAKsAAAAMc"]
[Mon Apr 06 00:49:54.257632 2026] [:error] [pid 51584:tid 51702] [client 4.223.110.88:8253] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "adKSssZ4qY_GoNCPARAKtQAAAMU"]
[Mon Apr 06 00:49:54.824162 2026] [:error] [pid 51584:tid 51706] [client 4.223.110.88:63861] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "adKSssZ4qY_GoNCPARAKvAAAAMk"]
[Mon Apr 06 00:49:55.391857 2026] [:error] [pid 51580:tid 51652] [client 4.223.110.88:56481] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "adKSs1NFl1NiyNgNZAkQYwAAAE0"]
[Mon Apr 06 00:49:55.941756 2026] [:error] [pid 51580:tid 51641] [client 4.223.110.88:29156] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "adKSs1NFl1NiyNgNZAkQaAAAAEI"]
[Mon Apr 06 00:49:56.567507 2026] [:error] [pid 51584:tid 51720] [client 4.223.110.88:40230] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adKStMZ4qY_GoNCPARAKxwAAANc"]
[Mon Apr 06 00:49:57.123344 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:45149] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adKStcZ4qY_GoNCPARAKzwAAANg"]
[Mon Apr 06 00:49:57.664675 2026] [:error] [pid 51580:tid 51642] [client 4.223.110.88:56497] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adKStVNFl1NiyNgNZAkQcgAAAEM"]
[Mon Apr 06 00:49:58.206914 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:29132] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adKStt4k74fhQLPUy7ExOgAAAIU"]
[Mon Apr 06 00:49:58.763801 2026] [:error] [pid 51581:tid 51680] [client 4.223.110.88:21412] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/control.php"] [unique_id "adKStt4k74fhQLPUy7ExQAAAAIs"]
[Mon Apr 06 00:49:59.366297 2026] [:error] [pid 51580:tid 51643] [client 4.223.110.88:25094] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/control.php"] [unique_id "adKSt1NFl1NiyNgNZAkQfgAAAEQ"]
[Mon Apr 06 00:49:59.965159 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:25161] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/control.php"] [unique_id "adKSt63pmp1JkaicYbtRsAAAARM"]
[Mon Apr 06 00:50:00.561060 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:63825] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/control.php"] [unique_id "adKSuN4k74fhQLPUy7ExSgAAAIU"]
[Mon Apr 06 00:50:01.116838 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:25162] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "adKSua3pmp1JkaicYbtRuAAAARQ"]
[Mon Apr 06 00:50:01.758073 2026] [:error] [pid 51581:tid 51671] [client 4.223.110.88:25127] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "adKSud4k74fhQLPUy7ExUwAAAII"]
[Mon Apr 06 00:50:02.298896 2026] [:error] [pid 51584:tid 51706] [client 4.223.110.88:25172] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "adKSusZ4qY_GoNCPARAK2gAAAMk"]
[Mon Apr 06 00:50:02.973590 2026] [:error] [pid 51753:tid 51813] [client 4.223.110.88:63863] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "adKSuq3pmp1JkaicYbtRvwAAAQI"]
[Mon Apr 06 00:50:03.501227 2026] [:error] [pid 51584:tid 51713] [client 4.223.110.88:25096] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1111.php"] [unique_id "adKSu8Z4qY_GoNCPARAK4wAAANA"]
[Mon Apr 06 00:50:04.030819 2026] [:error] [pid 51580:tid 51657] [client 4.223.110.88:25201] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1111.php"] [unique_id "adKSvFNFl1NiyNgNZAkQjQAAAFI"]
[Mon Apr 06 00:50:04.563992 2026] [:error] [pid 51581:tid 51692] [client 4.223.110.88:8623] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1111.php"] [unique_id "adKSvN4k74fhQLPUy7ExWQAAAJY"]
[Mon Apr 06 00:50:05.107201 2026] [:error] [pid 51581:tid 51671] [client 4.223.110.88:8587] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1111.php"] [unique_id "adKSvd4k74fhQLPUy7ExXAAAAII"]
[Mon Apr 06 00:50:05.679000 2026] [:error] [pid 51753:tid 51828] [client 4.223.110.88:63811] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adKSva3pmp1JkaicYbtRyAAAARE"]
[Mon Apr 06 00:50:06.208125 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:25151] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adKSvq3pmp1JkaicYbtRzQAAAQE"]
[Mon Apr 06 00:50:06.734764 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:63853] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adKSvq3pmp1JkaicYbtR0gAAARI"]
[Mon Apr 06 00:50:07.276481 2026] [:error] [pid 51753:tid 51835] [client 4.223.110.88:29133] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adKSv63pmp1JkaicYbtR2QAAARc"]
[Mon Apr 06 00:50:07.814871 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:25168] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adKSv63pmp1JkaicYbtR3QAAARI"]
[Mon Apr 06 00:50:08.347328 2026] [:error] [pid 51580:tid 51657] [client 4.223.110.88:25110] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adKSwFNFl1NiyNgNZAkQkwAAAFI"]
[Mon Apr 06 00:50:08.889932 2026] [:error] [pid 51580:tid 51663] [client 4.223.110.88:29137] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adKSwFNFl1NiyNgNZAkQlgAAAFg"]
[Mon Apr 06 00:50:09.432446 2026] [:error] [pid 51580:tid 51654] [client 4.223.110.88:40213] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adKSwVNFl1NiyNgNZAkQmQAAAE8"]
[Mon Apr 06 00:50:10.006920 2026] [:error] [pid 51581:tid 51684] [client 4.223.110.88:45146] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adKSwt4k74fhQLPUy7ExXgAAAI8"]
[Mon Apr 06 00:50:10.542930 2026] [:error] [pid 51584:tid 51706] [client 4.223.110.88:45166] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adKSwsZ4qY_GoNCPARAK_AAAAMk"]
[Mon Apr 06 00:50:11.076651 2026] [:error] [pid 51580:tid 51658] [client 4.223.110.88:45130] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adKSw1NFl1NiyNgNZAkQngAAAFM"]
[Mon Apr 06 00:50:11.648706 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:8342] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adKSw8Z4qY_GoNCPARAK_gAAAMA"]
[Mon Apr 06 00:50:12.184371 2026] [:error] [pid 51584:tid 51713] [client 4.223.110.88:63813] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adKSxMZ4qY_GoNCPARAK_wAAANA"]
[Mon Apr 06 00:50:12.711190 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:40227] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adKSxK3pmp1JkaicYbtR_wAAAQE"]
[Mon Apr 06 00:50:13.263320 2026] [:error] [pid 51580:tid 51659] [client 4.223.110.88:42048] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adKSxVNFl1NiyNgNZAkQqQAAAFQ"]
[Mon Apr 06 00:50:13.800286 2026] [:error] [pid 51753:tid 51822] [client 4.223.110.88:63845] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adKSxa3pmp1JkaicYbtSCAAAAQs"]
[Mon Apr 06 00:50:14.419646 2026] [:error] [pid 51753:tid 51824] [client 4.223.110.88:42051] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adKSxq3pmp1JkaicYbtSDAAAAQ0"]
[Mon Apr 06 00:50:15.019278 2026] [:error] [pid 51580:tid 51645] [client 4.223.110.88:45160] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adKSx1NFl1NiyNgNZAkQswAAAEY"]
[Mon Apr 06 00:50:15.578746 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:63823] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adKSx63pmp1JkaicYbtSEwAAARM"]
[Mon Apr 06 00:50:16.147853 2026] [:error] [pid 51584:tid 51710] [client 4.223.110.88:22058] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adKSyMZ4qY_GoNCPARALBAAAAM0"]
[Mon Apr 06 00:50:16.886528 2026] [:error] [pid 51581:tid 51675] [client 4.223.110.88:40196] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adKSyN4k74fhQLPUy7ExZgAAAIY"]
[Mon Apr 06 00:50:17.493786 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:40234] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adKSycZ4qY_GoNCPARALCAAAAMA"]
[Mon Apr 06 00:50:18.146960 2026] [:error] [pid 51584:tid 51708] [client 4.223.110.88:29170] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adKSysZ4qY_GoNCPARALDAAAAMs"]
[Mon Apr 06 00:50:18.757853 2026] [:error] [pid 51580:tid 51649] [client 4.223.110.88:8580] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adKSylNFl1NiyNgNZAkQvAAAAEo"]
[Mon Apr 06 00:50:19.346381 2026] [:error] [pid 51584:tid 51719] [client 4.223.110.88:9064] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adKSy8Z4qY_GoNCPARALEAAAANY"]
[Mon Apr 06 00:50:19.893205 2026] [:error] [pid 51581:tid 51678] [client 4.223.110.88:8352] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adKSy94k74fhQLPUy7ExegAAAIk"]
[Mon Apr 06 00:50:20.429527 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:8244] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adKSzK3pmp1JkaicYbtSJgAAAQM"]
[Mon Apr 06 00:50:20.966919 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:40204] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adKSzK3pmp1JkaicYbtSKQAAARA"]
[Mon Apr 06 00:50:21.536566 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:21380] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adKSza3pmp1JkaicYbtSLAAAAQE"]
[Mon Apr 06 00:50:22.101114 2026] [:error] [pid 51580:tid 51642] [client 4.223.110.88:63854] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adKSzlNFl1NiyNgNZAkQywAAAEM"]
[Mon Apr 06 00:50:22.670687 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:63856] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adKSzq3pmp1JkaicYbtSNwAAARQ"]
[Mon Apr 06 00:50:23.226416 2026] [:error] [pid 51753:tid 51821] [client 4.223.110.88:8350] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adKSz63pmp1JkaicYbtSOgAAAQo"]
[Mon Apr 06 00:50:23.788092 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:8340] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adKSz63pmp1JkaicYbtSPwAAARY"]
[Mon Apr 06 00:50:24.388293 2026] [:error] [pid 51753:tid 51826] [client 4.223.110.88:25176] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adKS0K3pmp1JkaicYbtSRQAAAQ8"]
[Mon Apr 06 00:50:25.014110 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:8208] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adKS0a3pmp1JkaicYbtSSgAAAQY"]
[Mon Apr 06 00:50:25.552044 2026] [:error] [pid 51580:tid 51650] [client 4.223.110.88:25153] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adKS0VNFl1NiyNgNZAkQ1AAAAEs"]
[Mon Apr 06 00:50:26.081808 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:63847] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adKS0q3pmp1JkaicYbtSUAAAARA"]
[Mon Apr 06 00:50:26.659303 2026] [:error] [pid 51753:tid 51813] [client 4.223.110.88:45159] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adKS0q3pmp1JkaicYbtSVgAAAQI"]
[Mon Apr 06 00:50:27.198968 2026] [:error] [pid 51580:tid 51661] [client 4.223.110.88:22049] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adKS01NFl1NiyNgNZAkQ3gAAAFY"]
[Mon Apr 06 00:50:27.740087 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:42057] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adKS063pmp1JkaicYbtSWAAAARQ"]
[Mon Apr 06 00:50:28.266464 2026] [:error] [pid 51584:tid 51705] [client 4.223.110.88:20089] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/read.php"] [unique_id "adKS1MZ4qY_GoNCPARALMQAAAMg"]
[Mon Apr 06 00:50:28.863851 2026] [:error] [pid 51580:tid 51642] [client 4.223.110.88:8612] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/read.php"] [unique_id "adKS1FNFl1NiyNgNZAkQ6AAAAEM"]
[Mon Apr 06 00:50:29.470438 2026] [:error] [pid 51580:tid 51640] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/read.php
[Mon Apr 06 00:50:29.735029 2026] [:error] [pid 51580:tid 51654] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kd4xalrg7m.php
[Mon Apr 06 00:50:30.000562 2026] [:error] [pid 51580:tid 51655] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Mon Apr 06 00:50:30.265944 2026] [:error] [pid 51580:tid 51662] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Mon Apr 06 00:50:30.542625 2026] [:error] [pid 51580:tid 51651] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Mon Apr 06 00:50:30.808531 2026] [:error] [pid 51580:tid 51649] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 06 00:50:31.073695 2026] [:error] [pid 51580:tid 51652] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mter.php
[Mon Apr 06 00:50:31.339027 2026] [:error] [pid 51580:tid 51639] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Mon Apr 06 00:50:31.616716 2026] [:error] [pid 51580:tid 51650] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Mon Apr 06 00:50:31.881827 2026] [:error] [pid 51580:tid 51659] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Mon Apr 06 00:50:32.153411 2026] [:error] [pid 51580:tid 51647] [client 4.223.110.88:45177] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Mon Apr 06 00:50:32.415512 2026] [:error] [pid 51580:tid 51654] [client 4.223.110.88:45177] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adKS2FNFl1NiyNgNZAkQ_AAAAE8"]
[Mon Apr 06 00:50:32.975146 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:8637] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adKS2N4k74fhQLPUy7ExlwAAAIU"]
[Mon Apr 06 00:50:33.507933 2026] [:error] [pid 51580:tid 51660] [client 4.223.110.88:56511] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adKS2VNFl1NiyNgNZAkRAQAAAFU"]
[Mon Apr 06 00:50:34.059303 2026] [:error] [pid 51584:tid 51710] [client 4.223.110.88:25187] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adKS2sZ4qY_GoNCPARALPgAAAM0"]
[Mon Apr 06 00:50:34.655070 2026] [:error] [pid 51581:tid 51670] [client 4.223.110.88:56503] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adKS2t4k74fhQLPUy7ExnwAAAIE"]
[Mon Apr 06 00:50:35.215643 2026] [:error] [pid 51581:tid 51693] [client 4.223.110.88:56506] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adKS294k74fhQLPUy7ExpAAAAJc"]
[Mon Apr 06 00:50:35.741256 2026] [:error] [pid 51580:tid 51639] [client 4.223.110.88:45182] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adKS21NFl1NiyNgNZAkRDwAAAEA"]
[Mon Apr 06 00:50:36.302487 2026] [:error] [pid 51584:tid 51699] [client 4.223.110.88:63836] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adKS3MZ4qY_GoNCPARALRQAAAMI"]
[Mon Apr 06 00:50:36.915379 2026] [:error] [pid 51584:tid 51705] [client 4.223.110.88:25205] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "adKS3MZ4qY_GoNCPARALRwAAAMg"]
[Mon Apr 06 00:50:37.448345 2026] [:error] [pid 51581:tid 51687] [client 4.223.110.88:25131] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "adKS3d4k74fhQLPUy7ExsAAAAJI"]
[Mon Apr 06 00:50:37.978139 2026] [:error] [pid 51584:tid 51700] [client 4.223.110.88:45132] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "adKS3cZ4qY_GoNCPARALTAAAAMM"]
[Mon Apr 06 00:50:38.550364 2026] [:error] [pid 51580:tid 51658] [client 4.223.110.88:20057] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "adKS3lNFl1NiyNgNZAkRHAAAAFM"]
[Mon Apr 06 00:50:39.116716 2026] [:error] [pid 51584:tid 51716] [client 4.223.110.88:25159] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adKS38Z4qY_GoNCPARALUwAAANM"]
[Mon Apr 06 00:50:39.697845 2026] [:error] [pid 51753:tid 51815] [client 4.223.110.88:20033] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adKS363pmp1JkaicYbtSmAAAAQQ"]
[Mon Apr 06 00:50:40.230296 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:8219] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adKS4K3pmp1JkaicYbtSnAAAARQ"]
[Mon Apr 06 00:50:40.762827 2026] [:error] [pid 51584:tid 51712] [client 4.223.110.88:45170] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adKS4MZ4qY_GoNCPARALXQAAAM8"]
[Mon Apr 06 00:50:41.341859 2026] [:error] [pid 51753:tid 51819] [client 4.223.110.88:56492] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adKS4a3pmp1JkaicYbtSogAAAQg"]
[Mon Apr 06 00:50:41.914887 2026] [:error] [pid 51753:tid 51815] [client 4.223.110.88:20043] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adKS4a3pmp1JkaicYbtSpQAAAQQ"]
[Mon Apr 06 00:50:42.443415 2026] [:error] [pid 51580:tid 51659] [client 4.223.110.88:8245] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adKS4lNFl1NiyNgNZAkRJwAAAFQ"]
[Mon Apr 06 00:50:42.988692 2026] [:error] [pid 51581:tid 51681] [client 4.223.110.88:63852] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adKS4t4k74fhQLPUy7ExwwAAAIw"]
[Mon Apr 06 00:50:43.535888 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:8366] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/swallowable.php"] [unique_id "adKS463pmp1JkaicYbtSqQAAARQ"]
[Mon Apr 06 00:50:44.076222 2026] [:error] [pid 51581:tid 51685] [client 4.223.110.88:49621] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/swallowable.php"] [unique_id "adKS5N4k74fhQLPUy7ExyQAAAJA"]
[Mon Apr 06 00:50:44.667847 2026] [:error] [pid 51753:tid 51818] [client 4.223.110.88:8246] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/swallowable.php"] [unique_id "adKS5K3pmp1JkaicYbtSsAAAAQc"]
[Mon Apr 06 00:50:45.285729 2026] [:error] [pid 51581:tid 51670] [client 4.223.110.88:56541] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/swallowable.php"] [unique_id "adKS5d4k74fhQLPUy7ExzgAAAIE"]
[Mon Apr 06 00:50:45.950228 2026] [:error] [pid 51580:tid 51663] [client 4.223.110.88:63850] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adKS5VNFl1NiyNgNZAkRLwAAAFg"]
[Mon Apr 06 00:50:46.497755 2026] [:error] [pid 51581:tid 51682] [client 4.223.110.88:26446] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adKS5t4k74fhQLPUy7Ex0gAAAI0"]
[Mon Apr 06 00:50:47.073985 2026] [:error] [pid 51581:tid 51694] [client 4.223.110.88:8230] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adKS594k74fhQLPUy7Ex1wAAAJg"]
[Mon Apr 06 00:50:47.706766 2026] [:error] [pid 51581:tid 51692] [client 4.223.110.88:8226] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adKS594k74fhQLPUy7Ex3AAAAJY"]
[Mon Apr 06 00:50:48.267306 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:8618] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adKS6K3pmp1JkaicYbtSvAAAARM"]
[Mon Apr 06 00:50:48.900875 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:25101] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adKS6K3pmp1JkaicYbtSwAAAARI"]
[Mon Apr 06 00:50:49.494988 2026] [:error] [pid 51584:tid 51698] [client 4.223.110.88:60800] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adKS6cZ4qY_GoNCPARALjAAAAME"]
[Mon Apr 06 00:50:50.075875 2026] [:error] [pid 51581:tid 51670] [client 4.223.110.88:40193] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adKS6t4k74fhQLPUy7Ex5AAAAIE"]
[Mon Apr 06 00:50:50.674325 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:56541] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "adKS6q3pmp1JkaicYbtSyAAAARA"]
[Mon Apr 06 00:50:51.237066 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:49655] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "adKS663pmp1JkaicYbtSzQAAAQY"]
[Mon Apr 06 00:50:51.898490 2026] [:error] [pid 51753:tid 51828] [client 4.223.110.88:45139] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "adKS663pmp1JkaicYbtS0QAAARE"]
[Mon Apr 06 00:50:52.476687 2026] [:error] [pid 51584:tid 51713] [client 4.223.110.88:8636] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "adKS7MZ4qY_GoNCPARALmQAAANA"]
[Mon Apr 06 00:50:53.236034 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:56480] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adKS7a3pmp1JkaicYbtS2AAAARA"]
[Mon Apr 06 00:50:53.780034 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:8610] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adKS7a3pmp1JkaicYbtS3wAAAQM"]
[Mon Apr 06 00:50:54.438329 2026] [:error] [pid 51753:tid 51816] [client 4.223.110.88:52461] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adKS7q3pmp1JkaicYbtS6AAAAQU"]
[Mon Apr 06 00:50:55.127966 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:27663] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adKS763pmp1JkaicYbtS7gAAARA"]
[Mon Apr 06 00:50:55.711441 2026] [:error] [pid 51753:tid 51826] [client 4.223.110.88:45856] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adKS763pmp1JkaicYbtS9wAAAQ8"]
[Mon Apr 06 00:50:56.315491 2026] [:error] [pid 51580:tid 51654] [client 4.223.110.88:49626] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adKS8FNFl1NiyNgNZAkRNwAAAE8"]
[Mon Apr 06 00:50:56.975608 2026] [:error] [pid 51584:tid 51707] [client 4.223.110.88:25123] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adKS8MZ4qY_GoNCPARALtgAAAMo"]
[Mon Apr 06 00:50:57.553600 2026] [:error] [pid 51753:tid 51835] [client 4.223.110.88:20069] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adKS8a3pmp1JkaicYbtTAQAAARc"]
[Mon Apr 06 00:50:58.390038 2026] [:error] [pid 51580:tid 51660] [client 4.223.110.88:60839] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKS8lNFl1NiyNgNZAkRPgAAAFU"]
[Mon Apr 06 00:50:58.955924 2026] [:error] [pid 51584:tid 51717] [client 4.223.110.88:25793] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKS8sZ4qY_GoNCPARALyQAAANQ"]
[Mon Apr 06 00:50:59.544869 2026] [:error] [pid 51584:tid 51700] [client 4.223.110.88:45824] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKS88Z4qY_GoNCPARALzgAAAMM"]
[Mon Apr 06 00:51:00.249531 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:8809] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKS9K3pmp1JkaicYbtTEgAAARI"]
[Mon Apr 06 00:51:00.901050 2026] [:error] [pid 51753:tid 51816] [client 4.223.110.88:41987] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adKS9K3pmp1JkaicYbtTGQAAAQU"]
[Mon Apr 06 00:51:01.487951 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:8820] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adKS9a3pmp1JkaicYbtTHQAAAQE"]
[Mon Apr 06 00:51:02.229143 2026] [:error] [pid 51753:tid 51835] [client 4.223.110.88:21475] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adKS9q3pmp1JkaicYbtTIwAAARc"]
[Mon Apr 06 00:51:02.913685 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:9019] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adKS9q3pmp1JkaicYbtTJwAAARY"]
[Mon Apr 06 00:51:03.456137 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:8805] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adKS963pmp1JkaicYbtTKgAAAQA"]
[Mon Apr 06 00:51:04.081631 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:21489] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adKS-MZ4qY_GoNCPARAL6QAAAMA"]
[Mon Apr 06 00:51:04.723404 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:47678] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adKS-K3pmp1JkaicYbtTMgAAARQ"]
[Mon Apr 06 00:51:05.322553 2026] [:error] [pid 51581:tid 51683] [client 4.223.110.88:44588] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adKS-d4k74fhQLPUy7EyAgAAAI4"]
[Mon Apr 06 00:51:06.115094 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:50180] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adKS-q3pmp1JkaicYbtTPAAAARM"]
[Mon Apr 06 00:51:06.813181 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:36339] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adKS-q3pmp1JkaicYbtTPgAAARY"]
[Mon Apr 06 00:51:07.427157 2026] [:error] [pid 51753:tid 51825] [client 4.223.110.88:25778] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adKS-63pmp1JkaicYbtTRAAAAQ4"]
[Mon Apr 06 00:51:07.953285 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:36313] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adKS-63pmp1JkaicYbtTRwAAAQA"]
[Mon Apr 06 00:51:08.633345 2026] [:error] [pid 51753:tid 51821] [client 4.223.110.88:22699] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "adKS_K3pmp1JkaicYbtTUAAAAQo"]
[Mon Apr 06 00:51:09.266450 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:30635] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "adKS_a3pmp1JkaicYbtTXgAAARI"]
[Mon Apr 06 00:51:09.890400 2026] [:error] [pid 51584:tid 51700] [client 4.223.110.88:30599] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "adKS_cZ4qY_GoNCPARAMBwAAAMM"]
[Mon Apr 06 00:51:10.435439 2026] [:error] [pid 51581:tid 51694] [client 4.223.110.88:36333] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "adKS_t4k74fhQLPUy7EyCQAAAJg"]
[Mon Apr 06 00:51:11.183247 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:46432] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "adKS_94k74fhQLPUy7EyDAAAAIU"]
[Mon Apr 06 00:51:11.743764 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:8700] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "adKS_8Z4qY_GoNCPARAMDQAAANg"]
[Mon Apr 06 00:51:12.355436 2026] [:error] [pid 51580:tid 51649] [client 4.223.110.88:44648] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "adKTAFNFl1NiyNgNZAkReAAAAEo"]
[Mon Apr 06 00:51:13.529448 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:22660] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "adKTAcZ4qY_GoNCPARAMGwAAAMA"]
[Mon Apr 06 00:51:15.104311 2026] [:error] [pid 51753:tid 51826] [client 4.223.110.88:55255] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "adKTA63pmp1JkaicYbtTkAAAAQ8"]
[Mon Apr 06 00:51:16.110680 2026] [:error] [pid 51581:tid 51678] [client 4.223.110.88:33485] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "adKTBN4k74fhQLPUy7EyFgAAAIk"]
[Mon Apr 06 00:51:17.070463 2026] [:error] [pid 51584:tid 51719] [client 4.223.110.88:46447] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "adKTBcZ4qY_GoNCPARAMLQAAANY"]
[Mon Apr 06 00:51:17.972752 2026] [:error] [pid 51753:tid 51821] [client 4.223.110.88:54643] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "adKTBa3pmp1JkaicYbtToQAAAQo"]
[Mon Apr 06 00:51:18.944753 2026] [:error] [pid 51580:tid 51663] [client 4.223.110.88:9146] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adKTBlNFl1NiyNgNZAkRmAAAAFg"]
[Mon Apr 06 00:51:19.784580 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:51818] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adKTB63pmp1JkaicYbtTrwAAARM"]
[Mon Apr 06 00:51:20.788815 2026] [:error] [pid 51581:tid 51684] [client 4.223.110.88:41534] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adKTCN4k74fhQLPUy7EyIwAAAI8"]
[Mon Apr 06 00:51:21.494054 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:33474] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adKTCa3pmp1JkaicYbtTvQAAAQM"]
[Mon Apr 06 00:51:22.631078 2026] [:error] [pid 51580:tid 51640] [client 4.223.110.88:43267] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "adKTClNFl1NiyNgNZAkRrAAAAEE"]
[Mon Apr 06 00:51:23.463323 2026] [:error] [pid 51753:tid 51828] [client 4.223.110.88:36240] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "adKTC63pmp1JkaicYbtTywAAARE"]
[Mon Apr 06 00:51:24.229005 2026] [:error] [pid 51584:tid 51703] [client 4.223.110.88:8698] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "adKTDMZ4qY_GoNCPARAMQAAAAMY"]
[Mon Apr 06 00:51:24.860368 2026] [:error] [pid 51581:tid 51675] [client 4.223.110.88:36239] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "adKTDN4k74fhQLPUy7EyLAAAAIY"]
[Mon Apr 06 00:51:25.693422 2026] [:error] [pid 51580:tid 51645] [client 4.223.110.88:51837] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKTDVNFl1NiyNgNZAkRswAAAEY"]
[Mon Apr 06 00:51:26.417503 2026] [:error] [pid 51580:tid 51644] [client 4.223.110.88:41526] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKTDlNFl1NiyNgNZAkRuAAAAEU"]
[Mon Apr 06 00:51:27.200558 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:8656] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKTD63pmp1JkaicYbtT6QAAARI"]
[Mon Apr 06 00:51:27.878630 2026] [:error] [pid 51584:tid 51714] [client 4.223.110.88:43308] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKTD8Z4qY_GoNCPARAMRgAAANE"]
[Mon Apr 06 00:51:28.845391 2026] [:error] [pid 51753:tid 51823] [client 4.223.110.88:54607] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adKTEK3pmp1JkaicYbtT-QAAAQw"]
[Mon Apr 06 00:51:29.567850 2026] [:error] [pid 51753:tid 51832] [client 4.223.110.88:8641] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adKTEa3pmp1JkaicYbtUAAAAARU"]
[Mon Apr 06 00:51:30.769597 2026] [:error] [pid 51753:tid 51823] [client 4.223.110.88:9089] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adKTEq3pmp1JkaicYbtUCgAAAQw"]
[Mon Apr 06 00:51:31.818153 2026] [:error] [pid 51584:tid 51711] [client 4.223.110.88:9097] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adKTE8Z4qY_GoNCPARAMVwAAAM4"]
[Mon Apr 06 00:51:33.153470 2026] [:error] [pid 51584:tid 51715] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Mon Apr 06 00:51:33.498608 2026] [:error] [pid 51584:tid 51702] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Mon Apr 06 00:51:33.764466 2026] [:error] [pid 51584:tid 51704] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Mon Apr 06 00:51:34.030761 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Mon Apr 06 00:51:35.517331 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Mon Apr 06 00:51:35.784349 2026] [:error] [pid 51584:tid 51717] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Apr 06 00:51:36.363128 2026] [:error] [pid 51584:tid 51719] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Mon Apr 06 00:51:37.167665 2026] [:error] [pid 51584:tid 51718] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Mon Apr 06 00:51:37.434852 2026] [:error] [pid 51584:tid 51711] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Mon Apr 06 00:51:37.704580 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:54593] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Mon Apr 06 00:51:37.996666 2026] [:error] [pid 51584:tid 51703] [client 4.223.110.88:54593] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adKTGcZ4qY_GoNCPARAMcwAAAMY"]
[Mon Apr 06 00:51:39.587533 2026] [:error] [pid 51753:tid 51823] [client 4.223.110.88:51796] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adKTG63pmp1JkaicYbtUUQAAAQw"]
[Mon Apr 06 00:51:40.347726 2026] [:error] [pid 51580:tid 51644] [client 4.223.110.88:37019] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adKTHFNFl1NiyNgNZAkR8QAAAEU"]
[Mon Apr 06 00:51:41.161299 2026] [:error] [pid 51581:tid 51694] [client 4.223.110.88:37002] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adKTHd4k74fhQLPUy7EyVAAAAJg"]
[Mon Apr 06 00:51:41.970088 2026] [:error] [pid 51581:tid 51687] [client 4.223.110.88:36237] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKTHd4k74fhQLPUy7EyXAAAAJI"]
[Mon Apr 06 00:51:42.920148 2026] [:error] [pid 51753:tid 51825] [client 4.223.110.88:45895] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKTHq3pmp1JkaicYbtUXQAAAQ4"]
[Mon Apr 06 00:51:43.726473 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:37560] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKTH63pmp1JkaicYbtUZwAAAQM"]
[Mon Apr 06 00:51:44.760315 2026] [:error] [pid 51584:tid 51704] [client 4.223.110.88:45914] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adKTIMZ4qY_GoNCPARAMfgAAAMc"]
[Mon Apr 06 00:51:45.707574 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:9094] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTIa3pmp1JkaicYbtUcgAAAQE"]
[Mon Apr 06 00:51:46.395063 2026] [:error] [pid 51753:tid 51820] [client 4.223.110.88:37003] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTIq3pmp1JkaicYbtUdAAAAQk"]
[Mon Apr 06 00:51:47.110812 2026] [:error] [pid 51753:tid 51822] [client 4.223.110.88:60894] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTI63pmp1JkaicYbtUdQAAAQs"]
[Mon Apr 06 00:51:48.073081 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:41502] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTJK3pmp1JkaicYbtUegAAARY"]
[Mon Apr 06 00:51:49.299152 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:23954] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adKTJa3pmp1JkaicYbtUhQAAAQA"]
[Mon Apr 06 00:51:50.524793 2026] [:error] [pid 51584:tid 51718] [client 4.223.110.88:36229] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adKTJsZ4qY_GoNCPARAMkwAAANU"]
[Mon Apr 06 00:51:51.790073 2026] [:error] [pid 51580:tid 51657] [client 4.223.110.88:60924] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adKTJ1NFl1NiyNgNZAkSHAAAAFI"]
[Mon Apr 06 00:51:53.574737 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:43281] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adKTKa3pmp1JkaicYbtUmgAAARA"]
[Mon Apr 06 00:51:54.776739 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:54635] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adKTKt4k74fhQLPUy7EycQAAAIU"]
[Mon Apr 06 00:51:56.067466 2026] [:error] [pid 51753:tid 51832] [client 4.223.110.88:51793] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adKTLK3pmp1JkaicYbtUtAAAARU"]
[Mon Apr 06 00:51:57.979057 2026] [:error] [pid 51581:tid 51680] [client 4.223.110.88:37505] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adKTLd4k74fhQLPUy7EydwAAAIs"]
[Mon Apr 06 00:51:59.363094 2026] [:error] [pid 51581:tid 51679] [client 4.223.110.88:23952] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adKTL94k74fhQLPUy7EyeAAAAIo"]
[Mon Apr 06 00:52:02.676938 2026] [:error] [pid 51580:tid 51655] [client 4.223.110.88:33522] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTMlNFl1NiyNgNZAkSPAAAAFA"]
[Mon Apr 06 00:52:04.206713 2026] [:error] [pid 51581:tid 51693] [client 4.223.110.88:45889] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTNN4k74fhQLPUy7EyigAAAJc"]
[Mon Apr 06 00:52:05.333969 2026] [:error] [pid 51580:tid 51640] [client 4.223.110.88:8683] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTNVNFl1NiyNgNZAkSRQAAAEE"]
[Mon Apr 06 00:52:08.069176 2026] [:error] [pid 51753:tid 51820] [client 4.223.110.88:45941] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adKTOK3pmp1JkaicYbtU-gAAAQk"]
[Mon Apr 06 00:52:09.202393 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:36230] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adKTOa3pmp1JkaicYbtVAQAAAQM"]
[Mon Apr 06 00:52:09.923423 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:45930] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adKTOa3pmp1JkaicYbtVBwAAARY"]
[Mon Apr 06 00:52:13.225884 2026] [:error] [pid 51580:tid 51649] [client 4.223.110.88:23359] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adKTPVNFl1NiyNgNZAkSewAAAEo"]
[Mon Apr 06 00:52:15.059152 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:51789] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adKTP63pmp1JkaicYbtVIQAAARI"]
[Mon Apr 06 00:52:17.606646 2026] [:error] [pid 51753:tid 51836] [client 4.223.110.88:37004] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adKTQa3pmp1JkaicYbtVMgAAARg"]
[Mon Apr 06 00:52:20.673883 2026] [:error] [pid 51584:tid 51710] [client 4.223.110.88:23966] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adKTRMZ4qY_GoNCPARAM3gAAAM0"]
[Mon Apr 06 00:52:22.103719 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:43272] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adKTRq3pmp1JkaicYbtVRwAAAQY"]
[Mon Apr 06 00:52:23.865104 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:29100] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adKTR63pmp1JkaicYbtVSwAAAQA"]
[Mon Apr 06 00:52:24.962529 2026] [:error] [pid 51580:tid 51659] [client 4.223.110.88:64505] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adKTSFNFl1NiyNgNZAkSsAAAAFQ"]
[Mon Apr 06 00:52:26.556535 2026] [:error] [pid 51580:tid 51656] [client 4.223.110.88:43321] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adKTSlNFl1NiyNgNZAkSwwAAAFE"]
[Mon Apr 06 00:52:27.250343 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:64484] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adKTS63pmp1JkaicYbtVXAAAARY"]
[Mon Apr 06 00:52:28.202709 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:43303] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adKTTK3pmp1JkaicYbtVYwAAARA"]
[Mon Apr 06 00:52:30.082623 2026] [:error] [pid 51753:tid 51819] [client 4.223.110.88:33477] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTTq3pmp1JkaicYbtVfgAAAQg"]
[Mon Apr 06 00:52:31.396452 2026] [:error] [pid 51581:tid 51686] [client 4.223.110.88:23991] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTT94k74fhQLPUy7EyvwAAAJE"]
[Mon Apr 06 00:52:32.258133 2026] [:error] [pid 51753:tid 51824] [client 4.223.110.88:64458] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTUK3pmp1JkaicYbtVgwAAAQ0"]
[Mon Apr 06 00:52:33.348666 2026] [:error] [pid 51584:tid 51710] [client 4.223.110.88:29089] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTUcZ4qY_GoNCPARANEAAAAM0"]
[Mon Apr 06 00:52:34.077358 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:43271] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "adKTUq3pmp1JkaicYbtVkgAAAQY"]
[Mon Apr 06 00:52:35.079040 2026] [:error] [pid 51753:tid 51821] [client 4.223.110.88:64492] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "adKTU63pmp1JkaicYbtVmAAAAQo"]
[Mon Apr 06 00:52:36.350850 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:45949] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "adKTVK3pmp1JkaicYbtVpgAAARY"]
[Mon Apr 06 00:52:37.587659 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:64453] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Mon Apr 06 00:52:38.024491 2026] [:error] [pid 51584:tid 51703] [client 4.223.110.88:64453] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Mon Apr 06 00:52:38.348585 2026] [:error] [pid 51584:tid 51701] [client 4.223.110.88:64453] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Mon Apr 06 00:52:38.657326 2026] [:error] [pid 51584:tid 51720] [client 4.223.110.88:64453] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Mon Apr 06 00:52:39.062074 2026] [:error] [pid 51584:tid 51702] [client 4.223.110.88:64453] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Mon Apr 06 00:52:39.329974 2026] [:error] [pid 51584:tid 51707] [client 4.223.110.88:64453] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "adKTV8Z4qY_GoNCPARANIQAAAMo"]
[Mon Apr 06 00:52:40.767695 2026] [:error] [pid 51584:tid 51716] [client 4.223.110.88:50276] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "adKTWMZ4qY_GoNCPARANJAAAANM"]
[Mon Apr 06 00:52:41.764892 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:37546] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "adKTWa3pmp1JkaicYbtV2QAAAQY"]
[Mon Apr 06 00:52:42.659420 2026] [:error] [pid 51753:tid 51832] [client 4.223.110.88:45951] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "adKTWq3pmp1JkaicYbtV5AAAARU"]
[Mon Apr 06 00:52:43.439993 2026] [:error] [pid 51580:tid 51642] [client 4.223.110.88:33504] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "adKTW1NFl1NiyNgNZAkS7QAAAEM"]
[Mon Apr 06 00:52:44.184894 2026] [:error] [pid 51753:tid 51826] [client 4.223.110.88:45903] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "adKTXK3pmp1JkaicYbtV8AAAAQ8"]
[Mon Apr 06 00:52:44.868063 2026] [:error] [pid 51581:tid 51692] [client 4.223.110.88:23305] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "adKTXN4k74fhQLPUy7Ey8AAAAJY"]
[Mon Apr 06 00:52:45.636379 2026] [:error] [pid 51580:tid 51659] [client 4.223.110.88:50265] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "adKTXVNFl1NiyNgNZAkS8wAAAFQ"]
[Mon Apr 06 00:52:46.359610 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:23306] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "adKTXq3pmp1JkaicYbtWAQAAARM"]
[Mon Apr 06 00:52:47.007727 2026] [:error] [pid 51753:tid 51818] [client 4.223.110.88:45902] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "adKTX63pmp1JkaicYbtWBwAAAQc"]
[Mon Apr 06 00:52:47.776110 2026] [:error] [pid 51580:tid 51649] [client 4.223.110.88:23947] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "adKTX1NFl1NiyNgNZAkTBQAAAEo"]
[Mon Apr 06 00:52:48.920551 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:43273] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "adKTYK3pmp1JkaicYbtWEwAAAQA"]
[Mon Apr 06 00:52:49.971129 2026] [:error] [pid 51580:tid 51652] [client 4.223.110.88:23297] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adKTYVNFl1NiyNgNZAkTFAAAAE0"]
[Mon Apr 06 00:52:50.850061 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:54616] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adKTYsZ4qY_GoNCPARANOwAAAMA"]
[Mon Apr 06 00:52:51.727481 2026] [:error] [pid 51580:tid 51649] [client 4.223.110.88:37539] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adKTY1NFl1NiyNgNZAkTHwAAAEo"]
[Mon Apr 06 00:52:52.718114 2026] [:error] [pid 51753:tid 51823] [client 4.223.110.88:43315] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adKTZK3pmp1JkaicYbtWNQAAAQw"]
[Mon Apr 06 00:52:53.454628 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:64454] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adKTZa3pmp1JkaicYbtWPQAAAQA"]
[Mon Apr 06 00:52:54.389350 2026] [:error] [pid 51580:tid 51648] [client 4.223.110.88:37033] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adKTZlNFl1NiyNgNZAkTJwAAAEk"]
[Mon Apr 06 00:52:56.099401 2026] [:error] [pid 51584:tid 51718] [client 4.223.110.88:50287] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adKTaMZ4qY_GoNCPARANTwAAANU"]
[Mon Apr 06 00:52:57.222810 2026] [:error] [pid 51580:tid 51661] [client 4.223.110.88:43298] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adKTaVNFl1NiyNgNZAkTNwAAAFY"]
[Mon Apr 06 00:52:57.984486 2026] [:error] [pid 51753:tid 51820] [client 4.223.110.88:23331] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adKTaa3pmp1JkaicYbtWVgAAAQk"]
[Mon Apr 06 00:52:58.775122 2026] [:error] [pid 51584:tid 51699] [client 4.223.110.88:50245] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adKTasZ4qY_GoNCPARANWwAAAMI"]
[Mon Apr 06 00:53:00.132020 2026] [:error] [pid 51584:tid 51719] [client 4.223.110.88:37022] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adKTbMZ4qY_GoNCPARANZAAAANY"]
[Mon Apr 06 00:53:00.866102 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:43284] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adKTbMZ4qY_GoNCPARANaAAAANg"]
[Mon Apr 06 00:53:02.276598 2026] [:error] [pid 51584:tid 51700] [client 4.223.110.88:37011] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adKTbsZ4qY_GoNCPARANbwAAAMM"]
[Mon Apr 06 00:53:03.676233 2026] [:error] [pid 51580:tid 51655] [client 4.223.110.88:29058] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adKTb1NFl1NiyNgNZAkTTAAAAFA"]
[Mon Apr 06 00:53:04.776696 2026] [:error] [pid 51584:tid 51701] [client 4.223.110.88:36996] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adKTcMZ4qY_GoNCPARANeAAAAMQ"]
[Mon Apr 06 00:53:06.200439 2026] [:error] [pid 51581:tid 51685] [client 4.223.110.88:29119] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adKTct4k74fhQLPUy7EzGQAAAJA"]
[Mon Apr 06 00:53:07.984502 2026] [:error] [pid 51580:tid 51660] [client 4.223.110.88:50291] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adKTc1NFl1NiyNgNZAkTWgAAAFU"]
[Mon Apr 06 00:53:09.053756 2026] [:error] [pid 51584:tid 51703] [client 4.223.110.88:29077] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adKTdcZ4qY_GoNCPARANhwAAAMY"]
[Mon Apr 06 00:53:11.684305 2026] [:error] [pid 51753:tid 51822] [client 4.223.110.88:64496] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adKTd63pmp1JkaicYbtWjQAAAQs"]
[Mon Apr 06 00:53:13.406517 2026] [:error] [pid 51584:tid 51707] [client 4.223.110.88:37049] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adKTecZ4qY_GoNCPARANjAAAAMo"]
[Mon Apr 06 00:53:15.004431 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:23343] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adKTe94k74fhQLPUy7EzKAAAAIU"]
[Mon Apr 06 00:53:16.155497 2026] [:error] [pid 51580:tid 51646] [client 4.223.110.88:23341] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adKTfFNFl1NiyNgNZAkTcQAAAEc"]
[Mon Apr 06 00:53:17.488837 2026] [:error] [pid 51581:tid 51694] [client 4.223.110.88:50247] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adKTfd4k74fhQLPUy7EzLAAAAJg"]
[Mon Apr 06 00:53:18.366317 2026] [:error] [pid 51584:tid 51699] [client 4.223.110.88:37006] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adKTfsZ4qY_GoNCPARANlAAAAMI"]
[Mon Apr 06 00:53:19.947065 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:45901] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKTf8Z4qY_GoNCPARANnAAAANg"]
[Mon Apr 06 00:53:21.118185 2026] [:error] [pid 51584:tid 51706] [client 4.223.110.88:50251] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKTgcZ4qY_GoNCPARANpQAAAMk"]
[Mon Apr 06 00:53:22.279784 2026] [:error] [pid 51580:tid 51662] [client 4.223.110.88:60889] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKTglNFl1NiyNgNZAkTjwAAAFc"]
[Mon Apr 06 00:53:24.006580 2026] [:error] [pid 51580:tid 51641] [client 4.223.110.88:50267] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adKThFNFl1NiyNgNZAkTmQAAAEI"]
[Mon Apr 06 00:53:25.085318 2026] [:error] [pid 51580:tid 51639] [client 4.223.110.88:23961] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adKThVNFl1NiyNgNZAkToQAAAEA"]
[Mon Apr 06 00:53:25.830767 2026] [:error] [pid 51580:tid 51650] [client 4.223.110.88:37015] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adKThVNFl1NiyNgNZAkTpwAAAEs"]
[Mon Apr 06 00:53:27.094348 2026] [:error] [pid 51581:tid 51684] [client 4.223.110.88:60890] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adKTh94k74fhQLPUy7EzNwAAAI8"]
[Mon Apr 06 00:53:28.201906 2026] [:error] [pid 51580:tid 51657] [client 4.223.110.88:60877] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adKTiFNFl1NiyNgNZAkTtQAAAFI"]
[Mon Apr 06 00:53:29.448965 2026] [:error] [pid 51580:tid 51650] [client 4.223.110.88:45937] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about2.php"] [unique_id "adKTiVNFl1NiyNgNZAkTvAAAAEs"]
[Mon Apr 06 00:53:30.495841 2026] [:error] [pid 51580:tid 51641] [client 4.223.110.88:64478] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about2.php"] [unique_id "adKTilNFl1NiyNgNZAkTwQAAAEI"]
[Mon Apr 06 00:53:31.079339 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:36339] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about2.php"] [unique_id "adKTi8Z4qY_GoNCPARANzgAAANg"]
[Mon Apr 06 00:53:31.916876 2026] [:error] [pid 51753:tid 51832] [client 4.223.110.88:50276] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about2.php"] [unique_id "adKTi63pmp1JkaicYbtWzQAAARU"]
[Mon Apr 06 00:53:32.536370 2026] [:error] [pid 51581:tid 51684] [client 4.223.110.88:29057] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adKTjN4k74fhQLPUy7EzQwAAAI8"]
[Mon Apr 06 00:53:33.405976 2026] [:error] [pid 51581:tid 51672] [client 4.223.110.88:50299] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adKTjd4k74fhQLPUy7EzSQAAAIM"]
[Mon Apr 06 00:53:34.183804 2026] [:error] [pid 51580:tid 51660] [client 4.223.110.88:23347] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adKTjlNFl1NiyNgNZAkT0AAAAFU"]
[Mon Apr 06 00:53:34.922623 2026] [:error] [pid 51580:tid 51651] [client 4.223.110.88:29067] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adKTjlNFl1NiyNgNZAkT1AAAAEw"]
[Mon Apr 06 00:53:35.538827 2026] [:error] [pid 51580:tid 51655] [client 4.223.110.88:50271] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adKTj1NFl1NiyNgNZAkT2AAAAFA"]
[Mon Apr 06 00:53:36.199954 2026] [:error] [pid 51753:tid 51828] [client 4.223.110.88:43301] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adKTkK3pmp1JkaicYbtW3gAAARE"]
[Mon Apr 06 00:53:36.858480 2026] [:error] [pid 51581:tid 51685] [client 4.223.110.88:29092] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adKTkN4k74fhQLPUy7EzWQAAAJA"]
[Mon Apr 06 00:53:37.565808 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:50282] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adKTka3pmp1JkaicYbtW5AAAARY"]
[Mon Apr 06 00:53:38.186980 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:23974] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "adKTkq3pmp1JkaicYbtW6QAAARI"]
[Mon Apr 06 00:53:38.979932 2026] [:error] [pid 51753:tid 51834] [client 4.223.110.88:64482] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "adKTkq3pmp1JkaicYbtW7wAAARY"]
[Mon Apr 06 00:53:40.137754 2026] [:error] [pid 51584:tid 51715] [client 4.223.110.88:23996] [client 4.223.110.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adKTlMZ4qY_GoNCPARAN2gAAANI"]
[Mon Apr 06 00:53:40.837098 2026] [:error] [pid 51581:tid 51684] [client 4.223.110.88:50298] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Apr 06 00:53:41.440911 2026] [:error] [pid 51581:tid 51673] [client 4.223.110.88:50298] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adKTld4k74fhQLPUy7EzZwAAAIQ"]
[Mon Apr 06 00:53:42.078709 2026] [:error] [pid 51580:tid 51653] [client 4.223.110.88:50273] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adKTllNFl1NiyNgNZAkT_AAAAE4"]
[Mon Apr 06 00:53:42.727076 2026] [:error] [pid 51580:tid 51661] [client 4.223.110.88:9122] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adKTllNFl1NiyNgNZAkUAwAAAFY"]
[Mon Apr 06 00:53:43.471792 2026] [:error] [pid 51580:tid 51643] [client 4.223.110.88:37527] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adKTl1NFl1NiyNgNZAkUBQAAAEQ"]
[Mon Apr 06 00:53:44.175299 2026] [:error] [pid 51753:tid 51815] [client 4.223.110.88:29109] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adKTmK3pmp1JkaicYbtXDAAAAQQ"]
[Mon Apr 06 00:53:45.417961 2026] [:error] [pid 51581:tid 51691] [client 4.223.110.88:23340] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adKTmd4k74fhQLPUy7EzcQAAAJU"]
[Mon Apr 06 00:53:46.059373 2026] [:error] [pid 51581:tid 51688] [client 4.223.110.88:43327] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adKTmt4k74fhQLPUy7EzcwAAAJM"]
[Mon Apr 06 00:53:46.741922 2026] [:error] [pid 51753:tid 51816] [client 4.223.110.88:64461] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adKTmq3pmp1JkaicYbtXHQAAAQU"]
[Mon Apr 06 00:53:47.473432 2026] [:error] [pid 51584:tid 51706] [client 4.223.110.88:60922] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adKTm8Z4qY_GoNCPARAN-AAAAMk"]
[Mon Apr 06 00:53:48.151328 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:9119] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adKTnK3pmp1JkaicYbtXKgAAAQA"]
[Mon Apr 06 00:53:48.789336 2026] [:error] [pid 51580:tid 51651] [client 4.223.110.88:23351] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adKTnFNFl1NiyNgNZAkUFgAAAEw"]
[Mon Apr 06 00:53:49.362169 2026] [:error] [pid 51580:tid 51642] [client 4.223.110.88:64483] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adKTnVNFl1NiyNgNZAkUGAAAAEM"]
[Mon Apr 06 00:53:50.040829 2026] [:error] [pid 51753:tid 51836] [client 4.223.110.88:60875] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adKTnq3pmp1JkaicYbtXNAAAARg"]
[Mon Apr 06 00:53:50.682838 2026] [:error] [pid 51581:tid 51677] [client 4.223.110.88:29088] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adKTnt4k74fhQLPUy7EzfAAAAIg"]
[Mon Apr 06 00:53:51.317539 2026] [:error] [pid 51753:tid 51820] [client 4.223.110.88:37055] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adKTn63pmp1JkaicYbtXOwAAAQk"]
[Mon Apr 06 00:53:51.998366 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:37514] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adKTn63pmp1JkaicYbtXRAAAAQE"]
[Mon Apr 06 00:53:52.541174 2026] [:error] [pid 51753:tid 51820] [client 4.223.110.88:23936] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adKToK3pmp1JkaicYbtXSwAAAQk"]
[Mon Apr 06 00:53:53.156679 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:50281] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adKToa3pmp1JkaicYbtXUAAAARQ"]
[Mon Apr 06 00:53:53.771792 2026] [:error] [pid 51584:tid 51708] [client 4.223.110.88:29091] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adKTocZ4qY_GoNCPARAODAAAAMs"]
[Mon Apr 06 00:53:54.777771 2026] [:error] [pid 51580:tid 51648] [client 4.223.110.88:23966] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adKTolNFl1NiyNgNZAkULQAAAEk"]
[Mon Apr 06 00:53:55.330311 2026] [:error] [pid 51580:tid 51647] [client 4.223.110.88:41523] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adKTo1NFl1NiyNgNZAkUMAAAAEg"]
[Mon Apr 06 00:53:56.035386 2026] [:error] [pid 51580:tid 51640] [client 4.223.110.88:50249] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adKTpFNFl1NiyNgNZAkUNwAAAEE"]
[Mon Apr 06 00:53:56.638936 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:29083] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adKTpK3pmp1JkaicYbtXZAAAARI"]
[Mon Apr 06 00:53:57.242608 2026] [:error] [pid 51753:tid 51831] [client 4.223.110.88:8665] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adKTpa3pmp1JkaicYbtXaQAAARQ"]
[Mon Apr 06 00:53:57.807583 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:29110] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adKTpa3pmp1JkaicYbtXbAAAAQE"]
[Mon Apr 06 00:53:58.470139 2026] [:error] [pid 51581:tid 51689] [client 4.223.110.88:45909] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adKTpt4k74fhQLPUy7EzkgAAAJQ"]
[Mon Apr 06 00:53:59.062603 2026] [:error] [pid 51584:tid 51708] [client 4.223.110.88:45921] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adKTp8Z4qY_GoNCPARAOFQAAAMs"]
[Mon Apr 06 00:53:59.753086 2026] [:error] [pid 51581:tid 51677] [client 4.223.110.88:29080] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adKTp94k74fhQLPUy7EzlQAAAIg"]
[Mon Apr 06 00:54:00.344390 2026] [:error] [pid 51581:tid 51673] [client 4.223.110.88:43310] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adKTqN4k74fhQLPUy7EzmAAAAIQ"]
[Mon Apr 06 00:54:00.950479 2026] [:error] [pid 51581:tid 51672] [client 4.223.110.88:45927] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adKTqN4k74fhQLPUy7EzngAAAIM"]
[Mon Apr 06 00:54:01.599428 2026] [:error] [pid 51580:tid 51641] [client 4.223.110.88:37523] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adKTqVNFl1NiyNgNZAkUSwAAAEI"]
[Mon Apr 06 00:54:02.173822 2026] [:error] [pid 51580:tid 51659] [client 4.223.110.88:45928] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adKTqlNFl1NiyNgNZAkUUwAAAFQ"]
[Mon Apr 06 00:54:02.717474 2026] [:error] [pid 51753:tid 51818] [client 4.223.110.88:36995] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adKTqq3pmp1JkaicYbtXeAAAAQc"]
[Mon Apr 06 00:54:03.435056 2026] [:error] [pid 51753:tid 51813] [client 4.223.110.88:43312] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adKTq63pmp1JkaicYbtXfAAAAQI"]
[Mon Apr 06 00:54:04.041071 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:23962] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adKTrK3pmp1JkaicYbtXfQAAAQY"]
[Mon Apr 06 00:54:04.649430 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:60887] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adKTrK3pmp1JkaicYbtXgwAAARI"]
[Mon Apr 06 00:54:05.316719 2026] [:error] [pid 51753:tid 51817] [client 4.223.110.88:29083] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adKTra3pmp1JkaicYbtXjAAAAQY"]
[Mon Apr 06 00:54:05.928547 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:64488] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adKTra3pmp1JkaicYbtXkwAAAQM"]
[Mon Apr 06 00:54:06.621672 2026] [:error] [pid 51753:tid 51815] [client 4.223.110.88:37532] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adKTrq3pmp1JkaicYbtXnQAAAQQ"]
[Mon Apr 06 00:54:07.474179 2026] [:error] [pid 51753:tid 51816] [client 4.223.110.88:23302] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adKTr63pmp1JkaicYbtXqQAAAQU"]
[Mon Apr 06 00:54:08.076975 2026] [:error] [pid 51584:tid 51705] [client 4.223.110.88:23357] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adKTsMZ4qY_GoNCPARAOHgAAAMg"]
[Mon Apr 06 00:54:08.609127 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:43268] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adKTsK3pmp1JkaicYbtXrwAAARA"]
[Mon Apr 06 00:54:09.238022 2026] [:error] [pid 51584:tid 51701] [client 4.223.110.88:29082] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adKTscZ4qY_GoNCPARAOIgAAAMQ"]
[Mon Apr 06 00:54:10.066550 2026] [:error] [pid 51753:tid 51816] [client 4.223.110.88:29085] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adKTsq3pmp1JkaicYbtXtwAAAQU"]
[Mon Apr 06 00:54:10.739084 2026] [:error] [pid 51581:tid 51684] [client 4.223.110.88:45913] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adKTst4k74fhQLPUy7EztAAAAI8"]
[Mon Apr 06 00:54:11.507370 2026] [:error] [pid 51584:tid 51697] [client 4.223.110.88:51783] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adKTs8Z4qY_GoNCPARAOMQAAAMA"]
[Mon Apr 06 00:54:12.294425 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:50269] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adKTtK3pmp1JkaicYbtXwAAAARM"]
[Mon Apr 06 00:54:13.444894 2026] [:error] [pid 51753:tid 51815] [client 4.223.110.88:64506] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adKTta3pmp1JkaicYbtXygAAAQQ"]
[Mon Apr 06 00:54:14.052367 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:37555] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adKTtq3pmp1JkaicYbtXzgAAAQA"]
[Mon Apr 06 00:54:14.799004 2026] [:error] [pid 51753:tid 51814] [client 4.223.110.88:37525] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adKTtq3pmp1JkaicYbtX2QAAAQM"]
[Mon Apr 06 00:54:15.501845 2026] [:error] [pid 51753:tid 51822] [client 4.223.110.88:37528] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adKTt63pmp1JkaicYbtX4gAAAQs"]
[Mon Apr 06 00:54:16.277120 2026] [:error] [pid 51753:tid 51825] [client 4.223.110.88:37521] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adKTuK3pmp1JkaicYbtX8AAAAQ4"]
[Mon Apr 06 00:54:17.106922 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:50255] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adKTua3pmp1JkaicYbtYAQAAARA"]
[Mon Apr 06 00:54:18.118820 2026] [:error] [pid 51581:tid 51681] [client 4.223.110.88:37012] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adKTut4k74fhQLPUy7EzuwAAAIw"]
[Mon Apr 06 00:54:19.005408 2026] [:error] [pid 51753:tid 51825] [client 4.223.110.88:36238] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adKTu63pmp1JkaicYbtYEAAAAQ4"]
[Mon Apr 06 00:54:19.578901 2026] [:error] [pid 51753:tid 51824] [client 4.223.110.88:23336] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adKTu63pmp1JkaicYbtYFAAAAQ0"]
[Mon Apr 06 00:54:20.381185 2026] [:error] [pid 51584:tid 51698] [client 4.223.110.88:43294] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adKTvMZ4qY_GoNCPARAOQAAAAME"]
[Mon Apr 06 00:54:21.695731 2026] [:error] [pid 51584:tid 51709] [client 4.223.110.88:64489] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adKTvcZ4qY_GoNCPARAORgAAAMw"]
[Mon Apr 06 00:54:22.492355 2026] [:error] [pid 51753:tid 51832] [client 4.223.110.88:23327] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adKTvq3pmp1JkaicYbtYJAAAARU"]
[Mon Apr 06 00:54:23.054917 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:50259] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adKTv63pmp1JkaicYbtYKAAAAQA"]
[Mon Apr 06 00:54:23.600291 2026] [:error] [pid 51580:tid 51643] [client 4.223.110.88:23940] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adKTv1NFl1NiyNgNZAkUkgAAAEQ"]
[Mon Apr 06 00:54:24.282263 2026] [:error] [pid 51753:tid 51819] [client 4.223.110.88:45894] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adKTwK3pmp1JkaicYbtYLQAAAQg"]
[Mon Apr 06 00:54:25.132337 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:45942] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adKTwa3pmp1JkaicYbtYNQAAARI"]
[Mon Apr 06 00:54:25.738985 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:64462] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adKTwa3pmp1JkaicYbtYPgAAARA"]
[Mon Apr 06 00:54:26.322507 2026] [:error] [pid 51753:tid 51832] [client 4.223.110.88:50286] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adKTwq3pmp1JkaicYbtYRQAAARU"]
[Mon Apr 06 00:54:26.996122 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:29111] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adKTwq3pmp1JkaicYbtYSQAAARA"]
[Mon Apr 06 00:54:27.561162 2026] [:error] [pid 51584:tid 51717] [client 4.223.110.88:37558] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adKTw8Z4qY_GoNCPARAOWAAAANQ"]
[Mon Apr 06 00:54:28.169937 2026] [:error] [pid 51584:tid 51709] [client 4.223.110.88:43324] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adKTxMZ4qY_GoNCPARAOXQAAAMw"]
[Mon Apr 06 00:54:28.753422 2026] [:error] [pid 51580:tid 51660] [client 4.223.110.88:43306] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTxFNFl1NiyNgNZAkUnQAAAFU"]
[Mon Apr 06 00:54:29.348141 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:36994] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTxa3pmp1JkaicYbtYUQAAARI"]
[Mon Apr 06 00:54:30.130341 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:37504] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTxq3pmp1JkaicYbtYWQAAARA"]
[Mon Apr 06 00:54:30.802070 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:43289] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adKTxt4k74fhQLPUy7Ez3QAAAIU"]
[Mon Apr 06 00:54:31.497787 2026] [:error] [pid 51584:tid 51700] [client 4.223.110.88:45900] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "adKTx8Z4qY_GoNCPARAOZgAAAMM"]
[Mon Apr 06 00:54:32.133882 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:37048] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "adKTyK3pmp1JkaicYbtYaAAAARA"]
[Mon Apr 06 00:54:32.699058 2026] [:error] [pid 51580:tid 51640] [client 4.223.110.88:45926] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "adKTyFNFl1NiyNgNZAkUqQAAAEE"]
[Mon Apr 06 00:54:33.664836 2026] [:error] [pid 51584:tid 51698] [client 4.223.110.88:23943] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "adKTycZ4qY_GoNCPARAOcgAAAME"]
[Mon Apr 06 00:54:34.439832 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:50274] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "adKTyq3pmp1JkaicYbtYfQAAARI"]
[Mon Apr 06 00:54:35.409163 2026] [:error] [pid 51584:tid 51709] [client 4.223.110.88:64486] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "adKTy8Z4qY_GoNCPARAOdwAAAMw"]
[Mon Apr 06 00:54:36.290789 2026] [:error] [pid 51581:tid 51683] [client 4.223.110.88:43264] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "adKTzN4k74fhQLPUy7Ez7QAAAI4"]
[Mon Apr 06 00:54:37.076030 2026] [:error] [pid 51580:tid 51648] [client 4.223.110.88:45943] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "adKTzVNFl1NiyNgNZAkUtQAAAEk"]
[Mon Apr 06 00:54:37.807509 2026] [:error] [pid 51753:tid 51815] [client 4.223.110.88:54629] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "adKTza3pmp1JkaicYbtYlQAAAQQ"]
[Mon Apr 06 00:54:38.675849 2026] [:error] [pid 51584:tid 51715] [client 4.223.110.88:60913] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "adKTzsZ4qY_GoNCPARAOiAAAANI"]
[Mon Apr 06 00:54:39.684448 2026] [:error] [pid 51753:tid 51828] [client 4.223.110.88:45932] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "adKTz63pmp1JkaicYbtYnwAAARE"]
[Mon Apr 06 00:54:40.399850 2026] [:error] [pid 51584:tid 51716] [client 4.223.110.88:23314] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "adKT0MZ4qY_GoNCPARAOjQAAANM"]
[Mon Apr 06 00:54:41.138969 2026] [:error] [pid 51581:tid 51685] [client 4.223.110.88:23965] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Mon Apr 06 00:54:41.405383 2026] [:error] [pid 51581:tid 51669] [client 4.223.110.88:23965] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Mon Apr 06 00:54:41.671931 2026] [:error] [pid 51581:tid 51680] [client 4.223.110.88:23965] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Mon Apr 06 00:54:41.939896 2026] [:error] [pid 51581:tid 51674] [client 4.223.110.88:23965] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Mon Apr 06 00:54:42.227229 2026] [:error] [pid 51581:tid 51693] [client 4.223.110.88:23965] File does not exist: /usr/local/apache/htdocs/suspended-page/efile.php
[Mon Apr 06 00:54:42.493573 2026] [:error] [pid 51581:tid 51671] [client 4.223.110.88:23965] File does not exist: /usr/local/apache/htdocs/suspended-page/afile.php
[Mon Apr 06 00:54:42.756737 2026] [:error] [pid 51581:tid 51677] [client 4.223.110.88:23965] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "adKT0t4k74fhQLPUy7E0BgAAAIg"]
[Mon Apr 06 00:54:43.579406 2026] [:error] [pid 51584:tid 51703] [client 4.223.110.88:23311] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "adKT08Z4qY_GoNCPARAOkAAAAMY"]
[Mon Apr 06 00:54:44.496754 2026] [:error] [pid 51753:tid 51824] [client 4.223.110.88:37017] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "adKT1K3pmp1JkaicYbtYvgAAAQ0"]
[Mon Apr 06 00:54:45.096786 2026] [:error] [pid 51584:tid 51721] [client 4.223.110.88:29064] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "adKT1cZ4qY_GoNCPARAOlAAAANg"]
[Mon Apr 06 00:54:45.666579 2026] [:error] [pid 51580:tid 51640] [client 4.223.110.88:23976] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adKT1VNFl1NiyNgNZAkU1AAAAEE"]
[Mon Apr 06 00:54:46.721010 2026] [:error] [pid 51581:tid 51683] [client 4.223.110.88:43279] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adKT1t4k74fhQLPUy7E0DwAAAI4"]
[Mon Apr 06 00:54:47.496727 2026] [:error] [pid 51753:tid 51827] [client 4.223.110.88:60920] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adKT163pmp1JkaicYbtYzAAAARA"]
[Mon Apr 06 00:54:48.321460 2026] [:error] [pid 51584:tid 51702] [client 4.223.110.88:45897] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adKT2MZ4qY_GoNCPARAOmwAAAMU"]
[Mon Apr 06 00:54:49.162228 2026] [:error] [pid 51580:tid 51657] [client 4.223.110.88:45938] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "adKT2VNFl1NiyNgNZAkU3AAAAFI"]
[Mon Apr 06 00:54:50.075492 2026] [:error] [pid 51584:tid 51707] [client 4.223.110.88:60881] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "adKT2sZ4qY_GoNCPARAOoQAAAMo"]
[Mon Apr 06 00:54:50.843130 2026] [:error] [pid 51580:tid 51639] [client 4.223.110.88:50253] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "adKT2lNFl1NiyNgNZAkU6AAAAEA"]
[Mon Apr 06 00:54:51.761577 2026] [:error] [pid 51580:tid 51654] [client 4.223.110.88:41486] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "adKT21NFl1NiyNgNZAkU6gAAAE8"]
[Mon Apr 06 00:54:52.679873 2026] [:error] [pid 51580:tid 51663] [client 4.223.110.88:51799] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adKT3FNFl1NiyNgNZAkU7wAAAFg"]
[Mon Apr 06 00:54:53.440184 2026] [:error] [pid 51580:tid 51641] [client 4.223.110.88:33510] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adKT3VNFl1NiyNgNZAkU-AAAAEI"]
[Mon Apr 06 00:54:54.414777 2026] [:error] [pid 51753:tid 51829] [client 4.223.110.88:37041] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adKT3q3pmp1JkaicYbtY5AAAARI"]
[Mon Apr 06 00:54:55.306851 2026] [:error] [pid 51753:tid 51836] [client 4.223.110.88:55262] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adKT363pmp1JkaicYbtY6QAAARg"]
[Mon Apr 06 00:54:56.079355 2026] [:error] [pid 51753:tid 51830] [client 4.223.110.88:33507] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adKT4K3pmp1JkaicYbtY8wAAARM"]
[Mon Apr 06 00:54:57.058350 2026] [:error] [pid 51753:tid 51811] [client 4.223.110.88:24547] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adKT4a3pmp1JkaicYbtY_AAAAQA"]
[Mon Apr 06 00:54:58.129479 2026] [:error] [pid 51753:tid 51812] [client 4.223.110.88:37553] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adKT4q3pmp1JkaicYbtZAQAAAQE"]
[Mon Apr 06 00:54:58.848731 2026] [:error] [pid 51584:tid 51703] [client 4.223.110.88:60876] [client 4.223.110.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adKT4sZ4qY_GoNCPARAOuAAAAMY"]
[Mon Apr 06 02:43:44.761118 2026] [:error] [pid 51580:tid 51660] [client 101.32.52.164:59698] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adKtYFNFl1NiyNgNZAloYwAAAFU"]
[Mon Apr 06 07:49:02.397886 2026] [:error] [pid 35786:tid 35813] [client 43.135.115.233:46456] [client 43.135.115.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adL07mgkfCKTaLhwaKRfxgAAANQ"]
[Mon Apr 06 12:55:41.134127 2026] [:error] [pid 9442:tid 9466] [client 43.128.149.102:49948] [client 43.128.149.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adM8zUPsNnAJTnmz6sbZ8gAAARY"]
[Mon Apr 06 15:04:48.228569 2026] [:error] [pid 38562:tid 38584] [client 43.159.136.201:47220] [client 43.159.136.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adNbEKeD6Ohe6wzRuy7tgAAAAVM"]
[Mon Apr 06 17:47:14.210587 2026] [:error] [pid 35687:tid 35727] [client 43.157.181.189:54866] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adOBIp3LtDozV0i8BitJbgAAAEQ"]
[Mon Apr 06 19:34:58.407454 2026] [:error] [pid 10280:tid 10296] [client 43.153.71.132:43500] [client 43.153.71.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adOaYl8QUJkf8g-BFfPkBgAAAc0"]
[Mon Apr 06 21:57:53.826921 2026] [:error] [pid 35687:tid 35738] [client 223.244.35.77:45436] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adO74Z3LtDozV0i8Bit8YAAAAE8"]
[Mon Apr 06 23:55:45.441676 2026] [:error] [pid 9442:tid 9457] [client 43.157.181.189:47408] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adPXgUPsNnAJTnmz6sZzMgAAAQ0"]
[Tue Apr 07 02:42:33.335567 2026] [:error] [pid 55003:tid 55024] [client 162.62.213.165:32796] [client 162.62.213.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adP-mQiMyAbcUkWpJeAixAAAARE"]
[Tue Apr 07 04:24:54.952563 2026] [:error] [pid 37597:tid 37643] [client 182.40.104.255:54024] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adQWlg6uAY0QAy-8EEIiYAAAAEk"]
[Tue Apr 07 05:00:14.440479 2026] [:error] [pid 37596:tid 37615] [client 43.130.100.35:44014] [client 43.130.100.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adQe3qpaAOZHEjRWjP3iCQAAAAk"]
[Tue Apr 07 07:48:07.598740 2026] [:error] [pid 37598:tid 37670] [client 194.26.192.92:51875] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Tue Apr 07 07:48:08.576264 2026] [:error] [pid 12948:tid 12962] [client 194.26.192.92:52095] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "adRGOMbeSPAN8LvMqsZ_JwAAAQs"]
[Tue Apr 07 07:48:09.074082 2026] [:error] [pid 12948:tid 12964] [client 194.26.192.92:52186] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "adRGOcbeSPAN8LvMqsZ_KwAAAQ0"]
[Tue Apr 07 07:48:09.558117 2026] [:error] [pid 12948:tid 12960] [client 194.26.192.92:52290] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "adRGOcbeSPAN8LvMqsZ_LgAAAQk"]
[Tue Apr 07 07:48:10.558639 2026] [:error] [pid 37598:tid 37672] [client 194.26.192.92:52492] [client 194.26.192.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "adRGOu9g7q_cV2WhPayywwAAAIs"]
[Tue Apr 07 07:48:11.042696 2026] [:error] [pid 12948:tid 12962] [client 194.26.192.92:52585] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Tue Apr 07 07:48:11.527626 2026] [:error] [pid 37719:tid 37734] [client 194.26.192.92:52737] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Tue Apr 07 10:28:56.792811 2026] [:error] [pid 37719:tid 37725] [client 125.94.144.102:37430] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adRr6E09Xv52u2xXGLDdJwAAAMM"]
[Tue Apr 07 10:56:57.931939 2026] [:error] [pid 37598:tid 37663] [client 217.216.72.68:57685] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adRyee9g7q_cV2WhPawTMwAAAII"]
[Tue Apr 07 10:57:01.672395 2026] [:error] [pid 59490:tid 59509] [client 217.216.72.68:61253] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/"] [unique_id "adRyfUcw8OFbiUZ7Rx0RyQAAAVE"]
[Tue Apr 07 10:57:01.797228 2026] [:error] [pid 37598:tid 37675] [client 217.216.72.68:61313] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/"] [unique_id "adRyfe9g7q_cV2WhPawTZAAAAI4"]
[Tue Apr 07 10:57:11.230839 2026] [:error] [pid 37598:tid 37685] [client 217.216.72.68:57364] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "adRyh-9g7q_cV2WhPawTjAAAAJg"]
[Tue Apr 07 10:57:11.419099 2026] [:error] [pid 37598:tid 37665] [client 217.216.72.68:59937] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "adRyh-9g7q_cV2WhPawTjgAAAIQ"]
[Tue Apr 07 10:57:23.909411 2026] [:error] [pid 12948:tid 12966] [client 217.216.72.68:56076] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/"] [unique_id "adRyk8beSPAN8LvMqsY3hwAAAQ8"]
[Tue Apr 07 10:57:25.944157 2026] [:error] [pid 37597:tid 37654] [client 217.216.72.68:62548] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/readme.html"] [unique_id "adRylQ6uAY0QAy-8EELAMwAAAFQ"]
[Tue Apr 07 10:57:36.045511 2026] [:error] [pid 59660:tid 59669] [client 217.216.72.68:54557] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "adRyoDp3-oiX2o5bTsyw7AAAAcc"]
[Tue Apr 07 16:46:41.573327 2026] [:error] [pid 12948:tid 12970] [client 36.111.67.189:40015] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adTEccbeSPAN8LvMqsZ6kwAAARM"]
[Tue Apr 07 23:21:38.451539 2026] [:error] [pid 59660:tid 59685] [client 36.41.75.167:39342] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adUhAjp3-oiX2o5bTswsdQAAAdc"]
[Wed Apr 08 04:16:09.936637 2026] [:error] [pid 47626:tid 47685] [client 124.156.157.91:43662] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adVmCajWI8TWtHx2sdbgegAAAFE"]
[Wed Apr 08 04:42:55.345472 2026] [:error] [pid 16630:tid 16652] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Wed Apr 08 04:42:55.640113 2026] [:error] [pid 16630:tid 16636] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Wed Apr 08 04:42:55.930400 2026] [:error] [pid 16630:tid 16634] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Wed Apr 08 04:42:56.223075 2026] [:error] [pid 16630:tid 16655] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Wed Apr 08 04:42:56.517135 2026] [:error] [pid 16630:tid 16644] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 08 04:42:56.809956 2026] [:error] [pid 16630:tid 16654] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 08 04:42:57.110696 2026] [:error] [pid 16630:tid 16655] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 08 04:42:57.405704 2026] [:error] [pid 16630:tid 16649] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Wed Apr 08 04:42:57.990835 2026] [:error] [pid 16630:tid 16641] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Wed Apr 08 04:42:58.284819 2026] [:error] [pid 16630:tid 16655] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Wed Apr 08 04:42:58.577668 2026] [:error] [pid 16630:tid 16642] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 04:42:58.869928 2026] [:error] [pid 16630:tid 16641] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Wed Apr 08 04:43:00.615642 2026] [:error] [pid 16630:tid 16641] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 08 04:43:00.907656 2026] [:error] [pid 16630:tid 16639] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Wed Apr 08 04:43:01.203198 2026] [:error] [pid 16630:tid 16649] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Wed Apr 08 04:43:01.503806 2026] [:error] [pid 16630:tid 16648] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Wed Apr 08 04:43:01.796112 2026] [:error] [pid 16630:tid 16653] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed Apr 08 04:43:02.089735 2026] [:error] [pid 16630:tid 16643] [client 151.240.254.46:58936] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Wed Apr 08 04:43:06.220523 2026] [:error] [pid 16630:tid 16635] [client 151.240.254.46:58936] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adVsWijfVAkPG-jgJEpjIQAAAQM"]
[Wed Apr 08 04:43:07.629849 2026] [:error] [pid 16630:tid 16643] [client 151.240.254.46:41674] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adVsWyjfVAkPG-jgJEpjKwAAAQs"]
[Wed Apr 08 04:43:09.027151 2026] [:error] [pid 47732:tid 47735] [client 151.240.254.46:41686] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 08 04:43:09.867157 2026] [:error] [pid 47732:tid 47747] [client 151.240.254.46:41686] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "adVsXYm4N5QW9Mh7G10VJAAAAM0"]
[Wed Apr 08 04:43:12.639444 2026] [:error] [pid 47627:tid 47722] [client 151.240.254.46:41702] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed Apr 08 04:43:12.914349 2026] [:error] [pid 47627:tid 47703] [client 151.240.254.46:41702] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "adVsYHOljf1Quv_kDjl54wAAAIQ"]
[Wed Apr 08 04:43:13.792586 2026] [:error] [pid 47627:tid 47716] [client 151.240.254.46:45956] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Wed Apr 08 04:43:15.284946 2026] [:error] [pid 47627:tid 47699] [client 151.240.254.46:45956] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adVsY3Oljf1Quv_kDjl58gAAAIA"]
[Wed Apr 08 04:43:16.144866 2026] [:error] [pid 47627:tid 47720] [client 151.240.254.46:45960] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adVsZHOljf1Quv_kDjl5-QAAAJU"]
[Wed Apr 08 04:43:16.720060 2026] [:error] [pid 47732:tid 47735] [client 151.240.254.46:45972] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adVsZIm4N5QW9Mh7G10VTQAAAME"]
[Wed Apr 08 04:43:17.272086 2026] [:error] [pid 47732:tid 47745] [client 151.240.254.46:45978] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adVsZYm4N5QW9Mh7G10VUQAAAMs"]
[Wed Apr 08 04:43:17.821863 2026] [:error] [pid 16630:tid 16635] [client 151.240.254.46:45990] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adVsZSjfVAkPG-jgJEpjWAAAAQM"]
[Wed Apr 08 04:43:18.400451 2026] [:error] [pid 47732:tid 47748] [client 151.240.254.46:45996] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adVsZom4N5QW9Mh7G10VWQAAAM4"]
[Wed Apr 08 04:43:19.271806 2026] [:error] [pid 47625:tid 47644] [client 151.240.254.46:46012] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adVsZyVuHyNWzZlE8PDpowAAAAo"]
[Wed Apr 08 04:43:19.857546 2026] [:error] [pid 47627:tid 47714] [client 151.240.254.46:46020] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Wed Apr 08 04:43:20.436164 2026] [:error] [pid 47627:tid 47704] [client 151.240.254.46:46020] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "adVsaHOljf1Quv_kDjl6AwAAAIU"]
[Wed Apr 08 04:43:21.545569 2026] [:error] [pid 47732:tid 47743] [client 151.240.254.46:46026] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adVsaYm4N5QW9Mh7G10VcAAAAMk"]
[Wed Apr 08 04:43:22.369856 2026] [:error] [pid 47732:tid 47740] [client 151.240.254.46:46030] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adVsaom4N5QW9Mh7G10VdwAAAMY"]
[Wed Apr 08 04:43:22.925399 2026] [:error] [pid 47627:tid 47719] [client 151.240.254.46:33770] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Wed Apr 08 04:43:23.203675 2026] [:error] [pid 47627:tid 47705] [client 151.240.254.46:33770] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adVsa3Oljf1Quv_kDjl6CgAAAIY"]
[Wed Apr 08 04:43:23.783550 2026] [:error] [pid 47627:tid 47715] [client 151.240.254.46:33776] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Wed Apr 08 04:43:24.661560 2026] [:error] [pid 47627:tid 47714] [client 151.240.254.46:33776] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Wed Apr 08 04:43:25.529590 2026] [:error] [pid 47627:tid 47710] [client 151.240.254.46:33776] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adVsbXOljf1Quv_kDjl6FQAAAIs"]
[Wed Apr 08 04:43:26.078856 2026] [:error] [pid 16630:tid 16635] [client 151.240.254.46:33786] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Wed Apr 08 04:43:26.358554 2026] [:error] [pid 16630:tid 16646] [client 151.240.254.46:33786] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adVsbijfVAkPG-jgJEpjdwAAAQ4"]
[Wed Apr 08 04:43:28.440141 2026] [:error] [pid 47732:tid 47747] [client 151.240.254.46:33792] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Wed Apr 08 04:43:29.004004 2026] [:error] [pid 47732:tid 47758] [client 151.240.254.46:33792] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "adVscYm4N5QW9Mh7G10VjwAAANg"]
[Wed Apr 08 04:43:29.837712 2026] [:error] [pid 16630:tid 16639] [client 151.240.254.46:33800] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adVscSjfVAkPG-jgJEpjjgAAAQc"]
[Wed Apr 08 04:43:30.668291 2026] [:error] [pid 47625:tid 47655] [client 151.240.254.46:33812] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Wed Apr 08 04:43:30.947147 2026] [:error] [pid 47625:tid 47644] [client 151.240.254.46:33812] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Wed Apr 08 04:43:31.496135 2026] [:error] [pid 47625:tid 47652] [client 151.240.254.46:33812] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adVscyVuHyNWzZlE8PDpyAAAABI"]
[Wed Apr 08 04:43:32.364701 2026] [:error] [pid 16630:tid 16645] [client 151.240.254.46:33822] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adVsdCjfVAkPG-jgJEpjmAAAAQ0"]
[Wed Apr 08 04:43:33.228305 2026] [:error] [pid 47732:tid 47756] [client 151.240.254.46:50678] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adVsdYm4N5QW9Mh7G10VoAAAANY"]
[Wed Apr 08 04:43:33.778829 2026] [:error] [pid 47627:tid 47710] [client 151.240.254.46:50684] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adVsdXOljf1Quv_kDjl6IwAAAIs"]
[Wed Apr 08 04:43:34.389836 2026] [:error] [pid 16630:tid 16636] [client 151.240.254.46:50686] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adVsdijfVAkPG-jgJEpjpAAAAQQ"]
[Wed Apr 08 04:43:35.508514 2026] [:error] [pid 47625:tid 47651] [client 151.240.254.46:50694] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Wed Apr 08 04:43:35.781905 2026] [:error] [pid 47625:tid 47657] [client 151.240.254.46:50694] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adVsdyVuHyNWzZlE8PDp0gAAABc"]
[Wed Apr 08 04:43:36.359886 2026] [:error] [pid 47626:tid 47673] [client 151.240.254.46:50696] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "adVseKjWI8TWtHx2sdbrKAAAAEU"]
[Wed Apr 08 04:43:36.942825 2026] [:error] [pid 16630:tid 16633] [client 151.240.254.46:50712] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adVseCjfVAkPG-jgJEpjqAAAAQE"]
[Wed Apr 08 04:43:38.104481 2026] [:error] [pid 16630:tid 16638] [client 151.240.254.46:50728] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Wed Apr 08 04:43:38.689276 2026] [:error] [pid 16630:tid 16655] [client 151.240.254.46:50728] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Wed Apr 08 04:43:41.159449 2026] [:error] [pid 16630:tid 16648] [client 151.240.254.46:50728] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "adVsfSjfVAkPG-jgJEpjwQAAARA"]
[Wed Apr 08 04:43:42.619923 2026] [:error] [pid 16630:tid 16636] [client 151.240.254.46:50732] [client 151.240.254.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.240.254.46, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adVsfijfVAkPG-jgJEpjzgAAAQQ"]
[Wed Apr 08 04:43:42.918261 2026] [:error] [pid 16630:tid 16638] [client 151.240.254.46:50732] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Wed Apr 08 04:43:45.819279 2026] [:error] [pid 16630:tid 16643] [client 151.240.254.46:50732] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Wed Apr 08 04:43:46.112075 2026] [:error] [pid 16630:tid 16646] [client 151.240.254.46:50732] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Apr 08 04:43:47.591619 2026] [:error] [pid 16630:tid 16651] [client 151.240.254.46:50732] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adVsgyjfVAkPG-jgJEpj4QAAARM"]
[Wed Apr 08 04:43:48.473604 2026] [:error] [pid 47627:tid 47707] [client 151.240.254.46:38444] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Wed Apr 08 04:43:48.766167 2026] [:error] [pid 47627:tid 47706] [client 151.240.254.46:38444] [client 151.240.254.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.240.254.46, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adVshHOljf1Quv_kDjl6XQAAAIc"]
[Wed Apr 08 04:43:49.361492 2026] [:error] [pid 47627:tid 47713] [client 151.240.254.46:38444] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "adVshXOljf1Quv_kDjl6YQAAAI4"]
[Wed Apr 08 04:43:51.044966 2026] [:error] [pid 47626:tid 47668] [client 151.240.254.46:38446] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Wed Apr 08 04:43:51.608053 2026] [:error] [pid 47626:tid 47673] [client 151.240.254.46:38446] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Wed Apr 08 04:43:52.172307 2026] [:error] [pid 47626:tid 47681] [client 151.240.254.46:38446] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adVsiKjWI8TWtHx2sdbrVAAAAE0"]
[Wed Apr 08 04:43:52.756186 2026] [:error] [pid 47732:tid 47740] [client 151.240.254.46:58248] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Wed Apr 08 04:43:53.639889 2026] [:error] [pid 47732:tid 47751] [client 151.240.254.46:58248] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Wed Apr 08 04:43:54.224721 2026] [:error] [pid 47732:tid 47744] [client 151.240.254.46:58248] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Wed Apr 08 04:43:54.813782 2026] [:error] [pid 47732:tid 47740] [client 151.240.254.46:58248] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Wed Apr 08 04:43:55.105609 2026] [:error] [pid 47732:tid 47745] [client 151.240.254.46:58248] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adVsi4m4N5QW9Mh7G10V-wAAAMs"]
[Wed Apr 08 04:43:55.691013 2026] [:error] [pid 47626:tid 47682] [client 151.240.254.46:58256] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Wed Apr 08 04:43:55.982450 2026] [:error] [pid 47626:tid 47675] [client 151.240.254.46:58256] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Apr 08 04:43:56.272700 2026] [:error] [pid 47626:tid 47668] [client 151.240.254.46:58256] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adVsjKjWI8TWtHx2sdbrWwAAAEA"]
[Wed Apr 08 04:43:57.152283 2026] [:error] [pid 16630:tid 16649] [client 151.240.254.46:58260] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Wed Apr 08 04:43:57.742954 2026] [:error] [pid 16630:tid 16636] [client 151.240.254.46:58260] [client 151.240.254.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.240.254.46, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adVsjSjfVAkPG-jgJEpkDAAAAQQ"]
[Wed Apr 08 04:43:58.039312 2026] [:error] [pid 16630:tid 16639] [client 151.240.254.46:58260] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adVsjijfVAkPG-jgJEpkEgAAAQc"]
[Wed Apr 08 04:44:02.960934 2026] [:error] [pid 47732:tid 47756] [client 151.240.254.46:58276] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Wed Apr 08 04:44:04.732305 2026] [:error] [pid 47732:tid 47753] [client 151.240.254.46:58276] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Wed Apr 08 04:44:05.020612 2026] [:error] [pid 47732:tid 47734] [client 151.240.254.46:58276] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adVslYm4N5QW9Mh7G10WLgAAAMA"]
[Wed Apr 08 04:44:05.579081 2026] [:error] [pid 16630:tid 16633] [client 151.240.254.46:43990] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Wed Apr 08 04:44:06.417426 2026] [:error] [pid 16630:tid 16651] [client 151.240.254.46:43990] [client 151.240.254.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.240.254.46, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adVslijfVAkPG-jgJEpkMQAAARM"]
[Wed Apr 08 04:44:06.707066 2026] [:error] [pid 16630:tid 16642] [client 151.240.254.46:43990] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Wed Apr 08 04:44:06.987925 2026] [:error] [pid 16630:tid 16632] [client 151.240.254.46:43990] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Wed Apr 08 04:44:07.265725 2026] [:error] [pid 16630:tid 16644] [client 151.240.254.46:43990] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Wed Apr 08 04:44:07.581952 2026] [:error] [pid 16630:tid 16635] [client 151.240.254.46:43990] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adVslyjfVAkPG-jgJEpkOAAAAQM"]
[Wed Apr 08 04:44:08.161880 2026] [:error] [pid 47732:tid 47743] [client 151.240.254.46:44000] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Wed Apr 08 04:44:08.454808 2026] [:error] [pid 47732:tid 47744] [client 151.240.254.46:44000] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "adVsmIm4N5QW9Mh7G10WQQAAAMo"]
[Wed Apr 08 04:44:09.309514 2026] [:error] [pid 16630:tid 16651] [client 151.240.254.46:44002] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Wed Apr 08 04:44:09.584020 2026] [:error] [pid 16630:tid 16650] [client 151.240.254.46:44002] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adVsmSjfVAkPG-jgJEpkQwAAARI"]
[Wed Apr 08 04:44:10.767400 2026] [:error] [pid 47732:tid 47737] [client 151.240.254.46:44016] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Wed Apr 08 04:44:11.061615 2026] [:error] [pid 47732:tid 47738] [client 151.240.254.46:44016] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adVsm4m4N5QW9Mh7G10WVAAAAMQ"]
[Wed Apr 08 04:44:11.613140 2026] [:error] [pid 47627:tid 47720] [client 151.240.254.46:44018] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adVsm3Oljf1Quv_kDjl6pAAAAJU"]
[Wed Apr 08 04:44:12.170036 2026] [:error] [pid 47625:tid 47647] [client 151.240.254.46:44030] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Wed Apr 08 04:44:12.459139 2026] [:error] [pid 47625:tid 47641] [client 151.240.254.46:44030] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Wed Apr 08 04:44:13.583986 2026] [:error] [pid 47625:tid 47651] [client 151.240.254.46:44030] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adVsnSVuHyNWzZlE8PDqUQAAABE"]
[Wed Apr 08 04:44:14.417857 2026] [:error] [pid 16630:tid 16635] [client 151.240.254.46:53882] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adVsnijfVAkPG-jgJEpkWQAAAQM"]
[Wed Apr 08 04:44:15.872124 2026] [:error] [pid 47626:tid 47669] [client 151.240.254.46:53884] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "adVsn6jWI8TWtHx2sdbrgQAAAEE"]
[Wed Apr 08 04:44:16.428336 2026] [:error] [pid 47627:tid 47702] [client 151.240.254.46:53894] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Wed Apr 08 04:44:16.999290 2026] [:error] [pid 47627:tid 47720] [client 151.240.254.46:53894] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Wed Apr 08 04:44:17.278098 2026] [:error] [pid 47627:tid 47712] [client 151.240.254.46:53894] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adVsoXOljf1Quv_kDjl6swAAAI0"]
[Wed Apr 08 04:44:17.834684 2026] [:error] [pid 47732:tid 47747] [client 151.240.254.46:53902] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Wed Apr 08 04:44:18.404989 2026] [:error] [pid 47732:tid 47739] [client 151.240.254.46:53902] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "adVsoom4N5QW9Mh7G10WegAAAMU"]
[Wed Apr 08 04:44:19.854084 2026] [:error] [pid 47732:tid 47742] [client 151.240.254.46:53910] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adVso4m4N5QW9Mh7G10WiAAAAMg"]
[Wed Apr 08 04:44:20.732657 2026] [:error] [pid 47625:tid 47646] [client 151.240.254.46:53924] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Wed Apr 08 04:44:21.616389 2026] [:error] [pid 47625:tid 47639] [client 151.240.254.46:53924] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Wed Apr 08 04:44:22.208435 2026] [:error] [pid 47625:tid 47645] [client 151.240.254.46:53924] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Wed Apr 08 04:44:22.496070 2026] [:error] [pid 47625:tid 47640] [client 151.240.254.46:53924] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adVspiVuHyNWzZlE8PDqcQAAAAY"]
[Wed Apr 08 04:44:23.088787 2026] [:error] [pid 16630:tid 16638] [client 151.240.254.46:54158] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adVspyjfVAkPG-jgJEpkbwAAAQY"]
[Wed Apr 08 04:44:23.670932 2026] [:error] [pid 47732:tid 47735] [client 151.240.254.46:54160] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adVsp4m4N5QW9Mh7G10WmwAAAME"]
[Wed Apr 08 04:44:24.319313 2026] [:error] [pid 16630:tid 16647] [client 151.240.254.46:54164] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adVsqCjfVAkPG-jgJEpkdQAAAQ8"]
[Wed Apr 08 04:44:24.879476 2026] [:error] [pid 16630:tid 16644] [client 151.240.254.46:54166] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Wed Apr 08 04:44:25.156494 2026] [:error] [pid 16630:tid 16643] [client 151.240.254.46:54166] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adVsqSjfVAkPG-jgJEpkfAAAAQs"]
[Wed Apr 08 04:44:25.731718 2026] [:error] [pid 47732:tid 47734] [client 151.240.254.46:54180] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adVsqYm4N5QW9Mh7G10WpgAAAMA"]
[Wed Apr 08 04:44:26.313607 2026] [:error] [pid 47732:tid 47755] [client 151.240.254.46:54192] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Wed Apr 08 04:44:26.897914 2026] [:error] [pid 47732:tid 47734] [client 151.240.254.46:54192] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "adVsqom4N5QW9Mh7G10WsgAAAMA"]
[Wed Apr 08 04:44:27.489083 2026] [:error] [pid 47732:tid 47757] [client 151.240.254.46:2275] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adVsq4m4N5QW9Mh7G10WuwAAANc"]
[Wed Apr 08 04:44:28.041997 2026] [:error] [pid 47732:tid 47745] [client 151.240.254.46:54210] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adVsrIm4N5QW9Mh7G10WwAAAAMs"]
[Wed Apr 08 04:44:28.595714 2026] [:error] [pid 16630:tid 16638] [client 151.240.254.46:54218] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adVsrCjfVAkPG-jgJEpkhgAAAQY"]
[Wed Apr 08 04:44:29.437528 2026] [:error] [pid 47626:tid 47670] [client 151.240.254.46:54226] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adVsrajWI8TWtHx2sdbrnQAAAEI"]
[Wed Apr 08 04:44:30.552741 2026] [:error] [pid 47627:tid 47705] [client 151.240.254.46:54242] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adVsrnOljf1Quv_kDjl6xQAAAIY"]
[Wed Apr 08 04:44:31.133541 2026] [:error] [pid 16630:tid 16632] [client 151.240.254.46:54256] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Wed Apr 08 04:44:32.049179 2026] [:error] [pid 16630:tid 16634] [client 151.240.254.46:54256] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Wed Apr 08 04:44:32.337409 2026] [:error] [pid 16630:tid 16635] [client 151.240.254.46:54256] [client 151.240.254.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adVssCjfVAkPG-jgJEpklwAAAQM"]
[Wed Apr 08 04:44:32.911899 2026] [:error] [pid 47626:tid 47686] [client 151.240.254.46:50686] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "adVssKjWI8TWtHx2sdbroQAAAFI"]
[Wed Apr 08 04:44:33.487406 2026] [:error] [pid 47626:tid 47684] [client 151.240.254.46:50688] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "adVssajWI8TWtHx2sdbrowAAAFA"]
[Wed Apr 08 04:44:34.041833 2026] [:error] [pid 16630:tid 16646] [client 151.240.254.46:50694] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "adVssijfVAkPG-jgJEpkoAAAAQ4"]
[Wed Apr 08 04:44:34.586431 2026] [:error] [pid 47732:tid 47748] [client 151.240.254.46:50706] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/about.php"] [unique_id "adVssom4N5QW9Mh7G10W3gAAAM4"]
[Wed Apr 08 04:45:02.683113 2026] [autoindex:error] [pid 47732:tid 47756] [client 151.240.254.46:50718] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 04:45:03.538435 2026] [:error] [pid 47732:tid 47753] [client 151.240.254.46:50718] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/"] [unique_id "adVsz4m4N5QW9Mh7G10XmQAAANM"]
[Wed Apr 08 04:45:04.205247 2026] [:error] [pid 16630:tid 16643] [client 151.240.254.46:51282] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/"] [unique_id "adVs0CjfVAkPG-jgJEplTwAAAQs"]
[Wed Apr 08 04:45:04.761682 2026] [:error] [pid 47627:tid 47716] [client 151.240.254.46:51288] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/"] [unique_id "adVs0HOljf1Quv_kDjl7HwAAAJE"]
[Wed Apr 08 04:45:05.320849 2026] [:error] [pid 47732:tid 47739] [client 151.240.254.46:51304] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/"] [unique_id "adVs0Ym4N5QW9Mh7G10XnAAAAMU"]
[Wed Apr 08 04:45:05.899705 2026] [:error] [pid 16630:tid 16636] [client 151.240.254.46:51318] [client 151.240.254.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/"] [unique_id "adVs0SjfVAkPG-jgJEplWwAAAQQ"]
[Wed Apr 08 05:42:31.365068 2026] [:error] [pid 47627:tid 47706] [client 119.96.24.54:59038] [client 119.96.24.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adV6R3Oljf1Quv_kDjmbCgAAAIc"]
[Wed Apr 08 06:06:24.383755 2026] [:error] [pid 16630:tid 16643] [client 20.100.182.194:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Wed Apr 08 06:06:24.648728 2026] [:error] [pid 16630:tid 16649] [client 20.100.182.194:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/bogles.php
[Wed Apr 08 06:06:25.177223 2026] [:error] [pid 16630:tid 16654] [client 20.100.182.194:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Apr 08 06:06:25.440986 2026] [:error] [pid 16630:tid 16645] [client 20.100.182.194:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Wed Apr 08 06:06:25.702959 2026] [:error] [pid 16630:tid 16640] [client 20.100.182.194:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Wed Apr 08 06:06:26.229126 2026] [:error] [pid 16630:tid 16634] [client 20.100.182.194:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/x123.php
[Wed Apr 08 06:06:26.491920 2026] [:error] [pid 16630:tid 16653] [client 20.100.182.194:33431] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 08:42:36.689685 2026] [:error] [pid 47627:tid 47709] [client 20.215.49.238:8907] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Wed Apr 08 08:42:36.950538 2026] [:error] [pid 47627:tid 47719] [client 20.215.49.238:8907] File does not exist: /usr/local/apache/htdocs/suspended-page/bogles.php
[Wed Apr 08 08:42:37.472300 2026] [:error] [pid 47627:tid 47699] [client 20.215.49.238:8907] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Apr 08 08:42:37.733395 2026] [:error] [pid 47627:tid 47713] [client 20.215.49.238:8907] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Wed Apr 08 08:42:37.992073 2026] [:error] [pid 47627:tid 47712] [client 20.215.49.238:8907] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Wed Apr 08 08:42:38.511696 2026] [:error] [pid 47627:tid 47703] [client 20.215.49.238:8907] File does not exist: /usr/local/apache/htdocs/suspended-page/x123.php
[Wed Apr 08 08:42:38.770781 2026] [:error] [pid 47627:tid 47705] [client 20.215.49.238:8907] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 09:22:06.561559 2026] [:error] [pid 49984:tid 49999] [client 170.106.113.235:55286] [client 170.106.113.235] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adWtvuYY_Bz5lRHcJIE75gAAAUk"]
[Wed Apr 08 09:25:36.637125 2026] [:error] [pid 47625:tid 47634] [client 103.168.67.159:5572] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "adWukCVuHyNWzZlE8PA2-gAAAAA"]
[Wed Apr 08 09:25:37.333715 2026] [:error] [pid 49984:tid 49997] [client 103.168.67.159:6050] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "adWukeYY_Bz5lRHcJIE-mAAAAUc"]
[Wed Apr 08 09:25:38.038533 2026] [:error] [pid 47732:tid 47741] [client 103.168.67.159:6586] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "adWukom4N5QW9Mh7G128QAAAAMc"]
[Wed Apr 08 09:25:38.747950 2026] [:error] [pid 16630:tid 16639] [client 103.168.67.159:7048] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "adWukijfVAkPG-jgJEpRMgAAAQc"]
[Wed Apr 08 09:25:39.464110 2026] [:error] [pid 16630:tid 16648] [client 103.168.67.159:7522] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dashboard"] [unique_id "adWukyjfVAkPG-jgJEpRRAAAARA"]
[Wed Apr 08 09:25:40.181416 2026] [:error] [pid 47627:tid 47721] [client 103.168.67.159:7936] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dashboard"] [unique_id "adWulHOljf1Quv_kDjn1BwAAAJY"]
[Wed Apr 08 09:25:40.885241 2026] [:error] [pid 49984:tid 49995] [client 103.168.67.159:8336] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dashboard"] [unique_id "adWulOYY_Bz5lRHcJIE-uwAAAUU"]
[Wed Apr 08 09:25:41.626672 2026] [:error] [pid 49984:tid 49991] [client 103.168.67.159:63942] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dashboard"] [unique_id "adWuleYY_Bz5lRHcJIE-yAAAAUE"]
[Wed Apr 08 11:10:16.618317 2026] [:error] [pid 16630:tid 16652] [client 172.213.26.45:33286] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Wed Apr 08 11:10:16.856679 2026] [:error] [pid 16630:tid 16639] [client 172.213.26.45:33286] File does not exist: /usr/local/apache/htdocs/suspended-page/bogles.php
[Wed Apr 08 11:10:17.327781 2026] [:error] [pid 16630:tid 16643] [client 172.213.26.45:33286] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Wed Apr 08 11:10:17.564771 2026] [:error] [pid 16630:tid 16637] [client 172.213.26.45:33286] File does not exist: /usr/local/apache/htdocs/suspended-page/co.php
[Wed Apr 08 11:10:17.800088 2026] [:error] [pid 16630:tid 16638] [client 172.213.26.45:33286] File does not exist: /usr/local/apache/htdocs/suspended-page/database.php
[Wed Apr 08 11:10:18.273070 2026] [:error] [pid 16630:tid 16636] [client 172.213.26.45:33286] File does not exist: /usr/local/apache/htdocs/suspended-page/x123.php
[Wed Apr 08 11:10:18.510296 2026] [:error] [pid 16630:tid 16639] [client 172.213.26.45:33286] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 08 14:11:15.377061 2026] [:error] [pid 35642:tid 35666] [client 43.153.7.191:37898] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adXxgw-CqryxdEs5DN9eXQAAAFY"]
[Wed Apr 08 16:15:04.147760 2026] [:error] [pid 12490:tid 12516] [client 172.213.152.228:65054] File does not exist: /usr/local/apache/htdocs/suspended-page/image.php
[Wed Apr 08 16:15:04.857089 2026] [:error] [pid 12490:tid 12513] [client 172.213.152.228:65054] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Wed Apr 08 16:15:05.140357 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:65054] File does not exist: /usr/local/apache/htdocs/suspended-page/spip.php
[Wed Apr 08 16:15:06.911251 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:65054] File does not exist: /usr/local/apache/htdocs/suspended-page/geido.php
[Wed Apr 08 16:15:07.190879 2026] [:error] [pid 12490:tid 12497] [client 172.213.152.228:65054] [client 172.213.152.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adYOi21Fea4F4fbumr0-7gAAAMU"]
[Wed Apr 08 16:15:08.165251 2026] [:error] [pid 12386:tid 12418] [client 172.213.152.228:65501] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Wed Apr 08 16:15:08.474781 2026] [:error] [pid 12386:tid 12433] [client 172.213.152.228:65501] File does not exist: /usr/local/apache/htdocs/suspended-page/1337.php
[Wed Apr 08 16:15:09.148674 2026] [:error] [pid 12386:tid 12437] [client 172.213.152.228:65501] File does not exist: /usr/local/apache/htdocs/suspended-page/wpupex.php
[Wed Apr 08 16:15:09.434249 2026] [:error] [pid 12386:tid 12422] [client 172.213.152.228:65501] File does not exist: /usr/local/apache/htdocs/suspended-page/myy.php
[Wed Apr 08 16:15:09.773001 2026] [:error] [pid 12386:tid 12429] [client 172.213.152.228:65501] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rezor.php"] [unique_id "adYOjRLhhLtqHi2gK7WyiwAAAQ0"]
[Wed Apr 08 16:15:10.888025 2026] [:error] [pid 12453:tid 12472] [client 172.213.152.228:65062] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rezor.php"] [unique_id "adYOjhjtW7S6XsLPvrSM_AAAAJE"]
[Wed Apr 08 16:15:11.615795 2026] [:error] [pid 12453:tid 12474] [client 172.213.152.228:64999] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rezor.php"] [unique_id "adYOjxjtW7S6XsLPvrSNAAAAAJM"]
[Wed Apr 08 16:15:12.439063 2026] [:error] [pid 35642:tid 35662] [client 172.213.152.228:65512] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rezor.php"] [unique_id "adYOkA-CqryxdEs5DN_KKgAAAFI"]
[Wed Apr 08 16:15:13.751607 2026] [:error] [pid 12490:tid 12507] [client 172.213.152.228:64981] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "adYOkW1Fea4F4fbumr0--wAAAM8"]
[Wed Apr 08 16:15:15.324968 2026] [:error] [pid 12490:tid 12507] [client 172.213.152.228:65026] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "adYOk21Fea4F4fbumr0_IgAAAM8"]
[Wed Apr 08 16:15:18.451621 2026] [:error] [pid 12385:tid 12412] [client 172.213.152.228:64561] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "adYOliAjtvRQEkLosq1KeQAAABc"]
[Wed Apr 08 16:15:25.055031 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:65495] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "adYOnW1Fea4F4fbumr0_ggAAAMM"]
[Wed Apr 08 16:15:27.646535 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:65499] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "adYOn21Fea4F4fbumr0_nQAAAME"]
[Wed Apr 08 16:15:28.987089 2026] [:error] [pid 12490:tid 12496] [client 172.213.152.228:65034] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "adYOoG1Fea4F4fbumr0_rQAAAMQ"]
[Wed Apr 08 16:15:29.668989 2026] [:error] [pid 12490:tid 12513] [client 172.213.152.228:65472] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "adYOoW1Fea4F4fbumr0_vQAAANU"]
[Wed Apr 08 16:15:31.101825 2026] [:error] [pid 12490:tid 12505] [client 172.213.152.228:65070] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "adYOo21Fea4F4fbumr0_vwAAAM0"]
[Wed Apr 08 16:15:31.919741 2026] [:error] [pid 35642:tid 35654] [client 172.213.152.228:65013] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "adYOow-CqryxdEs5DN_KhwAAAEo"]
[Wed Apr 08 16:15:32.700293 2026] [:error] [pid 12385:tid 12413] [client 172.213.152.228:65087] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "adYOpCAjtvRQEkLosq1KhwAAABg"]
[Wed Apr 08 16:15:33.353202 2026] [:error] [pid 12490:tid 12502] [client 172.213.152.228:64983] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "adYOpW1Fea4F4fbumr0_wwAAAMo"]
[Wed Apr 08 16:15:33.981749 2026] [:error] [pid 12386:tid 12418] [client 172.213.152.228:64970] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "adYOpRLhhLtqHi2gK7Wy0wAAAQI"]
[Wed Apr 08 16:15:34.570375 2026] [:error] [pid 12490:tid 12499] [client 172.213.152.228:65481] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adYOpm1Fea4F4fbumr0_ygAAAMc"]
[Wed Apr 08 16:15:35.236633 2026] [:error] [pid 12453:tid 12467] [client 172.213.152.228:65025] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adYOpxjtW7S6XsLPvrSNRwAAAIw"]
[Wed Apr 08 16:15:36.103044 2026] [:error] [pid 12453:tid 12462] [client 172.213.152.228:65068] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adYOqBjtW7S6XsLPvrSNTgAAAIc"]
[Wed Apr 08 16:15:36.752499 2026] [:error] [pid 35642:tid 35667] [client 172.213.152.228:64965] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adYOqA-CqryxdEs5DN_KjgAAAFc"]
[Wed Apr 08 16:15:37.442972 2026] [:error] [pid 35642:tid 35645] [client 172.213.152.228:64989] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adYOqQ-CqryxdEs5DN_KkQAAAEE"]
[Wed Apr 08 16:15:38.078438 2026] [:error] [pid 12385:tid 12395] [client 172.213.152.228:65057] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adYOqiAjtvRQEkLosq1KjAAAAAY"]
[Wed Apr 08 16:15:39.069281 2026] [:error] [pid 12385:tid 12412] [client 172.213.152.228:65502] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adYOqyAjtvRQEkLosq1KjwAAABc"]
[Wed Apr 08 16:15:39.966757 2026] [:error] [pid 12453:tid 12476] [client 172.213.152.228:65494] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adYOqxjtW7S6XsLPvrSNWwAAAJU"]
[Wed Apr 08 16:15:40.919797 2026] [:error] [pid 12386:tid 12420] [client 172.213.152.228:65508] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adYOrBLhhLtqHi2gK7Wy4QAAAQQ"]
[Wed Apr 08 16:15:42.857287 2026] [:error] [pid 35642:tid 35662] [client 172.213.152.228:65520] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adYOrg-CqryxdEs5DN_KlwAAAFI"]
[Wed Apr 08 16:15:44.228313 2026] [:error] [pid 35642:tid 35657] [client 172.213.152.228:65488] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adYOsA-CqryxdEs5DN_KmgAAAE0"]
[Wed Apr 08 16:15:46.886057 2026] [:error] [pid 12386:tid 12416] [client 172.213.152.228:64990] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adYOshLhhLtqHi2gK7Wy7AAAAQA"]
[Wed Apr 08 16:15:50.171168 2026] [:error] [pid 12490:tid 12499] [client 172.213.152.228:65500] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "adYOtm1Fea4F4fbumr1AewAAAMc"]
[Wed Apr 08 16:15:51.858996 2026] [:error] [pid 12490:tid 12512] [client 172.213.152.228:65043] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "adYOt21Fea4F4fbumr1AmgAAANQ"]
[Wed Apr 08 16:15:52.704422 2026] [:error] [pid 12490:tid 12510] [client 172.213.152.228:65050] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "adYOuG1Fea4F4fbumr1AnQAAANI"]
[Wed Apr 08 16:15:53.316465 2026] [:error] [pid 12386:tid 12433] [client 172.213.152.228:65045] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "adYOuRLhhLtqHi2gK7Wy8gAAARE"]
[Wed Apr 08 16:15:54.339066 2026] [:error] [pid 12490:tid 12501] [client 172.213.152.228:65000] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adYOum1Fea4F4fbumr1ApAAAAMk"]
[Wed Apr 08 16:15:54.930606 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:64985] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adYOum1Fea4F4fbumr1AugAAAME"]
[Wed Apr 08 16:15:55.647555 2026] [:error] [pid 12490:tid 12514] [client 172.213.152.228:65082] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adYOu21Fea4F4fbumr1AzgAAANY"]
[Wed Apr 08 16:15:56.400090 2026] [:error] [pid 35642:tid 35654] [client 172.213.152.228:65014] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adYOvA-CqryxdEs5DN_LAQAAAEo"]
[Wed Apr 08 16:15:57.003946 2026] [:error] [pid 12490:tid 12508] [client 172.213.152.228:64520] [client 172.213.152.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "adYOvW1Fea4F4fbumr1A7wAAANA"]
[Wed Apr 08 16:15:57.615001 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:64963] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "adYOvW1Fea4F4fbumr1BAgAAAMw"]
[Wed Apr 08 16:15:58.310299 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:64997] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "adYOvm1Fea4F4fbumr1BCQAAAM4"]
[Wed Apr 08 16:15:58.942209 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:64518] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "adYOvm1Fea4F4fbumr1BDwAAAMw"]
[Wed Apr 08 16:15:59.547710 2026] [:error] [pid 35642:tid 35663] [client 172.213.152.228:64998] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adYOvw-CqryxdEs5DN_LCwAAAFM"]
[Wed Apr 08 16:16:00.180779 2026] [:error] [pid 35642:tid 35666] [client 172.213.152.228:64972] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adYOwA-CqryxdEs5DN_LEgAAAFY"]
[Wed Apr 08 16:16:00.840331 2026] [:error] [pid 12490:tid 12499] [client 172.213.152.228:64467] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adYOwG1Fea4F4fbumr1BLAAAAMc"]
[Wed Apr 08 16:16:01.706077 2026] [:error] [pid 12490:tid 12512] [client 172.213.152.228:65075] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adYOwW1Fea4F4fbumr1BOgAAANQ"]
[Wed Apr 08 16:16:02.379545 2026] [:error] [pid 35642:tid 35661] [client 172.213.152.228:65069] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "adYOwg-CqryxdEs5DN_LHQAAAFE"]
[Wed Apr 08 16:16:02.990626 2026] [:error] [pid 35642:tid 35667] [client 172.213.152.228:64966] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "adYOwg-CqryxdEs5DN_LHgAAAFc"]
[Wed Apr 08 16:16:03.812428 2026] [:error] [pid 12385:tid 12409] [client 172.213.152.228:65063] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "adYOwyAjtvRQEkLosq1KqAAAABQ"]
[Wed Apr 08 16:16:04.782173 2026] [:error] [pid 12490:tid 12497] [client 172.213.152.228:64455] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "adYOxG1Fea4F4fbumr1BRwAAAMU"]
[Wed Apr 08 16:16:05.953462 2026] [:error] [pid 12490:tid 12505] [client 172.213.152.228:65483] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adYOxW1Fea4F4fbumr1BSwAAAM0"]
[Wed Apr 08 16:16:06.750076 2026] [:error] [pid 12490:tid 12499] [client 172.213.152.228:64991] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adYOxm1Fea4F4fbumr1BTgAAAMc"]
[Wed Apr 08 16:16:07.771354 2026] [:error] [pid 12386:tid 12430] [client 172.213.152.228:65473] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adYOxxLhhLtqHi2gK7WzEQAAAQ4"]
[Wed Apr 08 16:16:08.591347 2026] [:error] [pid 12386:tid 12433] [client 172.213.152.228:65058] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adYOyBLhhLtqHi2gK7WzFgAAARE"]
[Wed Apr 08 16:16:10.046744 2026] [:error] [pid 12453:tid 12479] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/ng.php
[Wed Apr 08 16:16:10.340313 2026] [:error] [pid 12453:tid 12476] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/awh.php
[Wed Apr 08 16:16:10.624848 2026] [:error] [pid 12453:tid 12477] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/aee.php
[Wed Apr 08 16:16:10.991816 2026] [:error] [pid 12453:tid 12458] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/new3.php
[Wed Apr 08 16:16:11.274973 2026] [:error] [pid 12453:tid 12459] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/ruabjw00.php
[Wed Apr 08 16:16:11.557725 2026] [:error] [pid 12453:tid 12457] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Wed Apr 08 16:16:11.864865 2026] [:error] [pid 12453:tid 12467] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/webx.php
[Wed Apr 08 16:16:12.152527 2026] [:error] [pid 12453:tid 12478] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/hhxc.php
[Wed Apr 08 16:16:12.439226 2026] [:error] [pid 12453:tid 12460] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-22.php
[Wed Apr 08 16:16:12.725074 2026] [:error] [pid 12453:tid 12463] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/villain.php
[Wed Apr 08 16:16:13.105078 2026] [:error] [pid 12453:tid 12455] [client 172.213.152.228:64978] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Wed Apr 08 16:16:13.384993 2026] [:error] [pid 12453:tid 12474] [client 172.213.152.228:64978] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adYOzRjtW7S6XsLPvrSN5wAAAJM"]
[Wed Apr 08 16:16:14.092349 2026] [:error] [pid 12386:tid 12416] [client 172.213.152.228:65524] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adYOzhLhhLtqHi2gK7WzKAAAAQA"]
[Wed Apr 08 16:16:14.801195 2026] [:error] [pid 35642:tid 35645] [client 172.213.152.228:65071] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adYOzg-CqryxdEs5DN_LPwAAAEE"]
[Wed Apr 08 16:16:15.368181 2026] [:error] [pid 35642:tid 35662] [client 172.213.152.228:65001] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adYOzw-CqryxdEs5DN_LQAAAAFI"]
[Wed Apr 08 16:16:16.343949 2026] [:error] [pid 35642:tid 35668] [client 172.213.152.228:64519] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "adYO0A-CqryxdEs5DN_LRwAAAFg"]
[Wed Apr 08 16:16:17.787935 2026] [:error] [pid 12386:tid 12437] [client 172.213.152.228:65006] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "adYO0RLhhLtqHi2gK7WzLQAAARU"]
[Wed Apr 08 16:16:18.657079 2026] [:error] [pid 12490:tid 12501] [client 172.213.152.228:65061] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "adYO0m1Fea4F4fbumr1BaQAAAMk"]
[Wed Apr 08 16:16:19.322905 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:65038] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an7.php"] [unique_id "adYO021Fea4F4fbumr1BbwAAAMM"]
[Wed Apr 08 16:16:20.525022 2026] [:error] [pid 35642:tid 35668] [client 172.213.152.228:65060] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adYO1A-CqryxdEs5DN_LUgAAAFg"]
[Wed Apr 08 16:16:21.443497 2026] [:error] [pid 12386:tid 12430] [client 172.213.152.228:65510] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adYO1RLhhLtqHi2gK7WzLgAAAQ4"]
[Wed Apr 08 16:16:22.987151 2026] [:error] [pid 12490:tid 12492] [client 172.213.152.228:65517] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adYO1m1Fea4F4fbumr1BegAAAMA"]
[Wed Apr 08 16:16:24.223627 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:64513] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adYO2G1Fea4F4fbumr1BfgAAAMw"]
[Wed Apr 08 16:16:25.716152 2026] [:error] [pid 12386:tid 12427] [client 172.213.152.228:64569] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "adYO2RLhhLtqHi2gK7WzMwAAAQs"]
[Wed Apr 08 16:16:26.853369 2026] [:error] [pid 12453:tid 12466] [client 172.213.152.228:65498] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "adYO2hjtW7S6XsLPvrSN_AAAAIs"]
[Wed Apr 08 16:16:27.831369 2026] [:error] [pid 35642:tid 35665] [client 172.213.152.228:64974] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "adYO2w-CqryxdEs5DN_LVQAAAFU"]
[Wed Apr 08 16:16:28.850152 2026] [:error] [pid 12490:tid 12494] [client 172.213.152.228:64486] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxijj.php"] [unique_id "adYO3G1Fea4F4fbumr1BmQAAAMI"]
[Wed Apr 08 16:16:29.513200 2026] [:error] [pid 12490:tid 12501] [client 172.213.152.228:64142] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "adYO3W1Fea4F4fbumr1BnQAAAMk"]
[Wed Apr 08 16:16:31.138538 2026] [:error] [pid 12490:tid 12512] [client 172.213.152.228:65504] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "adYO321Fea4F4fbumr1BowAAANQ"]
[Wed Apr 08 16:16:32.652996 2026] [:error] [pid 12490:tid 12494] [client 172.213.152.228:65511] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "adYO4G1Fea4F4fbumr1BqwAAAMI"]
[Wed Apr 08 16:16:33.685306 2026] [:error] [pid 12490:tid 12499] [client 172.213.152.228:65476] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs7.php"] [unique_id "adYO4W1Fea4F4fbumr1BsAAAAMc"]
[Wed Apr 08 16:16:34.379978 2026] [:error] [pid 12490:tid 12498] [client 172.213.152.228:64547] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool2.php"] [unique_id "adYO4m1Fea4F4fbumr1BtQAAAMY"]
[Wed Apr 08 16:16:35.020501 2026] [:error] [pid 12490:tid 12509] [client 172.213.152.228:65078] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool2.php"] [unique_id "adYO421Fea4F4fbumr1BvAAAANE"]
[Wed Apr 08 16:16:35.784043 2026] [:error] [pid 12386:tid 12417] [client 172.213.152.228:64557] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool2.php"] [unique_id "adYO4xLhhLtqHi2gK7WzOwAAAQE"]
[Wed Apr 08 16:16:36.519417 2026] [:error] [pid 12490:tid 12494] [client 172.213.152.228:65011] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool2.php"] [unique_id "adYO5G1Fea4F4fbumr1BwgAAAMI"]
[Wed Apr 08 16:16:37.383148 2026] [:error] [pid 12385:tid 12413] [client 172.213.152.228:65506] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zjllx.php"] [unique_id "adYO5SAjtvRQEkLosq1KyAAAABg"]
[Wed Apr 08 16:16:38.111374 2026] [:error] [pid 35642:tid 35644] [client 172.213.152.228:65493] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zjllx.php"] [unique_id "adYO5g-CqryxdEs5DN_LYgAAAEA"]
[Wed Apr 08 16:16:38.755626 2026] [:error] [pid 35642:tid 35645] [client 172.213.152.228:64542] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zjllx.php"] [unique_id "adYO5g-CqryxdEs5DN_LYwAAAEE"]
[Wed Apr 08 16:16:39.415514 2026] [:error] [pid 12490:tid 12497] [client 172.213.152.228:65028] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zjllx.php"] [unique_id "adYO521Fea4F4fbumr1BzQAAAMU"]
[Wed Apr 08 16:16:40.383499 2026] [:error] [pid 35642:tid 35657] [client 172.213.152.228:65036] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2.php"] [unique_id "adYO6A-CqryxdEs5DN_LZgAAAE0"]
[Wed Apr 08 16:16:41.629656 2026] [:error] [pid 12386:tid 12423] [client 172.213.152.228:65489] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2.php"] [unique_id "adYO6RLhhLtqHi2gK7WzQAAAAQc"]
[Wed Apr 08 16:16:42.462109 2026] [:error] [pid 12386:tid 12439] [client 172.213.152.228:65046] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2.php"] [unique_id "adYO6hLhhLtqHi2gK7WzQgAAARc"]
[Wed Apr 08 16:16:43.065157 2026] [:error] [pid 12490:tid 12516] [client 172.213.152.228:64466] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2.php"] [unique_id "adYO621Fea4F4fbumr1B1wAAANg"]
[Wed Apr 08 16:16:44.339465 2026] [:error] [pid 12385:tid 12407] [client 172.213.152.228:64987] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "adYO7CAjtvRQEkLosq1KzQAAABI"]
[Wed Apr 08 16:16:45.532516 2026] [:error] [pid 12385:tid 12394] [client 172.213.152.228:64549] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "adYO7SAjtvRQEkLosq1K0QAAAAU"]
[Wed Apr 08 16:16:46.280174 2026] [:error] [pid 12453:tid 12462] [client 172.213.152.228:65067] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "adYO7hjtW7S6XsLPvrSOJAAAAIc"]
[Wed Apr 08 16:16:46.974320 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:64982] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "adYO7m1Fea4F4fbumr1B3AAAAME"]
[Wed Apr 08 16:16:48.063771 2026] [:error] [pid 12385:tid 12405] [client 172.213.152.228:64969] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adYO8CAjtvRQEkLosq1K1QAAABA"]
[Wed Apr 08 16:16:48.783036 2026] [:error] [pid 12385:tid 12400] [client 172.213.152.228:64514] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adYO8CAjtvRQEkLosq1K1gAAAAs"]
[Wed Apr 08 16:16:49.892018 2026] [:error] [pid 12453:tid 12472] [client 172.213.152.228:65078] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adYO8RjtW7S6XsLPvrSOKQAAAJE"]
[Wed Apr 08 16:16:50.641323 2026] [:error] [pid 12453:tid 12456] [client 172.213.152.228:65015] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adYO8hjtW7S6XsLPvrSOLgAAAIE"]
[Wed Apr 08 16:16:51.295431 2026] [:error] [pid 12490:tid 12507] [client 172.213.152.228:65022] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dbc.php"] [unique_id "adYO821Fea4F4fbumr1B7wAAAM8"]
[Wed Apr 08 16:16:51.969086 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:64480] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dbc.php"] [unique_id "adYO821Fea4F4fbumr1B9wAAAME"]
[Wed Apr 08 16:16:52.717201 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:64479] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dbc.php"] [unique_id "adYO9G1Fea4F4fbumr1B_wAAAMM"]
[Wed Apr 08 16:16:53.396982 2026] [:error] [pid 12385:tid 12409] [client 172.213.152.228:65059] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dbc.php"] [unique_id "adYO9SAjtvRQEkLosq1K3AAAABQ"]
[Wed Apr 08 16:16:54.943256 2026] [:error] [pid 35642:tid 35661] [client 172.213.152.228:64961] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ukaa.php"] [unique_id "adYO9g-CqryxdEs5DN_LdQAAAFE"]
[Wed Apr 08 16:16:55.520349 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:65478] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ukaa.php"] [unique_id "adYO921Fea4F4fbumr1CHAAAAMw"]
[Wed Apr 08 16:16:56.146063 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:65009] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ukaa.php"] [unique_id "adYO-G1Fea4F4fbumr1CKQAAAMM"]
[Wed Apr 08 16:16:56.822468 2026] [:error] [pid 12385:tid 12398] [client 172.213.152.228:64482] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ukaa.php"] [unique_id "adYO-CAjtvRQEkLosq1K4QAAAAk"]
[Wed Apr 08 16:16:57.556796 2026] [:error] [pid 35642:tid 35655] [client 172.213.152.228:64522] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adYO-Q-CqryxdEs5DN_LdgAAAEs"]
[Wed Apr 08 16:16:58.172006 2026] [:error] [pid 12386:tid 12429] [client 172.213.152.228:64967] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adYO-hLhhLtqHi2gK7WzZAAAAQ0"]
[Wed Apr 08 16:16:58.800091 2026] [:error] [pid 12490:tid 12510] [client 172.213.152.228:65505] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adYO-m1Fea4F4fbumr1COgAAANI"]
[Wed Apr 08 16:16:59.599824 2026] [:error] [pid 12490:tid 12502] [client 172.213.152.228:64993] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adYO-21Fea4F4fbumr1CRAAAAMo"]
[Wed Apr 08 16:17:00.309156 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:65084] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adYO_G1Fea4F4fbumr1CSQAAAME"]
[Wed Apr 08 16:17:00.903908 2026] [:error] [pid 12490:tid 12507] [client 172.213.152.228:64521] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adYO_G1Fea4F4fbumr1CTwAAAM8"]
[Wed Apr 08 16:17:01.500401 2026] [:error] [pid 12386:tid 12418] [client 172.213.152.228:64130] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adYO_RLhhLtqHi2gK7WzaAAAAQI"]
[Wed Apr 08 16:17:02.120046 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:64968] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adYO_m1Fea4F4fbumr1CUwAAAM4"]
[Wed Apr 08 16:17:02.904912 2026] [:error] [pid 35642:tid 35668] [client 172.213.152.228:64995] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "adYO_g-CqryxdEs5DN_LdwAAAFg"]
[Wed Apr 08 16:17:03.577093 2026] [:error] [pid 35642:tid 35652] [client 172.213.152.228:64962] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "adYO_w-CqryxdEs5DN_LeQAAAEg"]
[Wed Apr 08 16:17:04.347571 2026] [:error] [pid 12385:tid 12389] [client 172.213.152.228:65081] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "adYPACAjtvRQEkLosq1K5wAAAAA"]
[Wed Apr 08 16:17:05.200478 2026] [:error] [pid 12385:tid 12410] [client 172.213.152.228:64573] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "adYPASAjtvRQEkLosq1K6QAAABU"]
[Wed Apr 08 16:17:05.998254 2026] [:error] [pid 12386:tid 12430] [client 172.213.152.228:64540] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adYPARLhhLtqHi2gK7WzbgAAAQ4"]
[Wed Apr 08 16:17:07.366869 2026] [:error] [pid 35642:tid 35667] [client 172.213.152.228:64986] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adYPAw-CqryxdEs5DN_LgAAAAFc"]
[Wed Apr 08 16:17:08.287523 2026] [:error] [pid 12453:tid 12459] [client 172.213.152.228:64562] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adYPBBjtW7S6XsLPvrSObgAAAIQ"]
[Wed Apr 08 16:17:09.324831 2026] [:error] [pid 12453:tid 12477] [client 172.213.152.228:65064] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adYPBRjtW7S6XsLPvrSOcwAAAJY"]
[Wed Apr 08 16:17:12.037718 2026] [:error] [pid 35642:tid 35657] [client 172.213.152.228:64996] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adYPCA-CqryxdEs5DN_LjAAAAE0"]
[Wed Apr 08 16:17:14.977375 2026] [:error] [pid 35642:tid 35656] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Wed Apr 08 16:17:15.293168 2026] [:error] [pid 35642:tid 35661] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/cc13.php
[Wed Apr 08 16:17:15.606270 2026] [:error] [pid 35642:tid 35646] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Wed Apr 08 16:17:16.170856 2026] [:error] [pid 35642:tid 35660] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/ccu.php
[Wed Apr 08 16:17:16.485843 2026] [:error] [pid 35642:tid 35652] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Wed Apr 08 16:17:16.801216 2026] [:error] [pid 35642:tid 35644] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Wed Apr 08 16:17:17.116188 2026] [:error] [pid 35642:tid 35650] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-turn.php
[Wed Apr 08 16:17:17.477419 2026] [:error] [pid 35642:tid 35665] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Wed Apr 08 16:17:17.793963 2026] [:error] [pid 35642:tid 35667] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/kolda.php
[Wed Apr 08 16:17:18.111050 2026] [:error] [pid 35642:tid 35663] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/yussef.php
[Wed Apr 08 16:17:18.454401 2026] [:error] [pid 35642:tid 35647] [client 172.213.152.228:65012] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Wed Apr 08 16:17:18.793628 2026] [:error] [pid 35642:tid 35651] [client 172.213.152.228:65012] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adYPDg-CqryxdEs5DN_LrAAAAEc"]
[Wed Apr 08 16:17:21.851633 2026] [:error] [pid 35642:tid 35666] [client 172.213.152.228:65040] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adYPEQ-CqryxdEs5DN_LsQAAAFY"]
[Wed Apr 08 16:17:24.476968 2026] [:error] [pid 35642:tid 35650] [client 172.213.152.228:64469] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adYPFA-CqryxdEs5DN_LtQAAAEY"]
[Wed Apr 08 16:17:25.980024 2026] [:error] [pid 12453:tid 12464] [client 172.213.152.228:64459] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adYPFRjtW7S6XsLPvrSOhAAAAIk"]
[Wed Apr 08 16:17:27.545632 2026] [:error] [pid 12453:tid 12474] [client 172.213.152.228:65037] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btx25.php"] [unique_id "adYPFxjtW7S6XsLPvrSOhwAAAJM"]
[Wed Apr 08 16:17:28.698116 2026] [:error] [pid 12490:tid 12505] [client 172.213.152.228:64977] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btx25.php"] [unique_id "adYPGG1Fea4F4fbumr1CigAAAM0"]
[Wed Apr 08 16:17:29.912174 2026] [:error] [pid 12386:tid 12440] [client 172.213.152.228:65004] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btx25.php"] [unique_id "adYPGRLhhLtqHi2gK7WzgQAAARg"]
[Wed Apr 08 16:17:31.731532 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:65007] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/btx25.php"] [unique_id "adYPG21Fea4F4fbumr1CnQAAAMM"]
[Wed Apr 08 16:17:33.924643 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:65475] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "adYPHW1Fea4F4fbumr1CqQAAAME"]
[Wed Apr 08 16:17:38.924946 2026] [:error] [pid 35642:tid 35662] [client 172.213.152.228:64566] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "adYPIg-CqryxdEs5DN_L0wAAAFI"]
[Wed Apr 08 16:17:42.554619 2026] [:error] [pid 12386:tid 12417] [client 172.213.152.228:64473] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "adYPJhLhhLtqHi2gK7WzjQAAAQE"]
[Wed Apr 08 16:17:43.697348 2026] [:error] [pid 12386:tid 12436] [client 172.213.152.228:65008] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x123x.php"] [unique_id "adYPJxLhhLtqHi2gK7WzjgAAARQ"]
[Wed Apr 08 16:17:44.892542 2026] [:error] [pid 12490:tid 12510] [client 172.213.152.228:64485] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trx24.php"] [unique_id "adYPKG1Fea4F4fbumr1CugAAANI"]
[Wed Apr 08 16:17:45.855772 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:65074] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trx24.php"] [unique_id "adYPKW1Fea4F4fbumr1CvgAAAMM"]
[Wed Apr 08 16:17:46.448979 2026] [:error] [pid 12386:tid 12438] [client 172.213.152.228:64512] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trx24.php"] [unique_id "adYPKhLhhLtqHi2gK7WzkQAAARY"]
[Wed Apr 08 16:17:47.990246 2026] [:error] [pid 35642:tid 35647] [client 172.213.152.228:64089] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/trx24.php"] [unique_id "adYPKw-CqryxdEs5DN_L5gAAAEM"]
[Wed Apr 08 16:17:49.921457 2026] [:error] [pid 12385:tid 12406] [client 172.213.152.228:65002] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adYPLSAjtvRQEkLosq1LEQAAABE"]
[Wed Apr 08 16:17:50.684265 2026] [:error] [pid 12385:tid 12396] [client 172.213.152.228:64176] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adYPLiAjtvRQEkLosq1LEwAAAAc"]
[Wed Apr 08 16:17:51.618835 2026] [:error] [pid 12385:tid 12398] [client 172.213.152.228:65513] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adYPLyAjtvRQEkLosq1LFQAAAAk"]
[Wed Apr 08 16:17:52.327918 2026] [:error] [pid 12490:tid 12511] [client 172.213.152.228:64543] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adYPMG1Fea4F4fbumr1CzgAAANM"]
[Wed Apr 08 16:17:52.948333 2026] [:error] [pid 12490:tid 12498] [client 172.213.152.228:65486] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adYPMG1Fea4F4fbumr1C0QAAAMY"]
[Wed Apr 08 16:17:53.653122 2026] [:error] [pid 35642:tid 35656] [client 172.213.152.228:64135] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adYPMQ-CqryxdEs5DN_L8QAAAEw"]
[Wed Apr 08 16:17:54.803387 2026] [:error] [pid 12490:tid 12503] [client 172.213.152.228:64529] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adYPMm1Fea4F4fbumr1C1wAAAMs"]
[Wed Apr 08 16:17:56.064565 2026] [:error] [pid 12490:tid 12505] [client 172.213.152.228:65479] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adYPNG1Fea4F4fbumr1C3AAAAM0"]
[Wed Apr 08 16:17:56.672793 2026] [:error] [pid 12490:tid 12503] [client 172.213.152.228:64964] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/less.php"] [unique_id "adYPNG1Fea4F4fbumr1C4QAAAMs"]
[Wed Apr 08 16:17:57.461516 2026] [:error] [pid 12490:tid 12497] [client 172.213.152.228:64572] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/less.php"] [unique_id "adYPNW1Fea4F4fbumr1C5gAAAMU"]
[Wed Apr 08 16:17:58.472781 2026] [:error] [pid 12490:tid 12509] [client 172.213.152.228:64453] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/less.php"] [unique_id "adYPNm1Fea4F4fbumr1C6QAAANE"]
[Wed Apr 08 16:17:59.509491 2026] [:error] [pid 12490:tid 12508] [client 172.213.152.228:65484] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/less.php"] [unique_id "adYPN21Fea4F4fbumr1C7gAAANA"]
[Wed Apr 08 16:18:01.202249 2026] [:error] [pid 12490:tid 12494] [client 172.213.152.228:65020] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adYPOW1Fea4F4fbumr1C-wAAAMI"]
[Wed Apr 08 16:18:02.242760 2026] [:error] [pid 12386:tid 12423] [client 172.213.152.228:65010] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adYPOhLhhLtqHi2gK7WzpAAAAQc"]
[Wed Apr 08 16:18:03.226042 2026] [:error] [pid 35642:tid 35660] [client 172.213.152.228:65085] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adYPOw-CqryxdEs5DN_MAgAAAFA"]
[Wed Apr 08 16:18:04.581208 2026] [:error] [pid 35642:tid 35659] [client 172.213.152.228:64140] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adYPPA-CqryxdEs5DN_MCgAAAE8"]
[Wed Apr 08 16:18:05.733893 2026] [:error] [pid 12453:tid 12459] [client 172.213.152.228:65496] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xdd.php"] [unique_id "adYPPRjtW7S6XsLPvrSOrQAAAIQ"]
[Wed Apr 08 16:18:07.101756 2026] [:error] [pid 35642:tid 35649] [client 172.213.152.228:65485] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xdd.php"] [unique_id "adYPPw-CqryxdEs5DN_MFAAAAEU"]
[Wed Apr 08 16:18:07.900865 2026] [:error] [pid 12385:tid 12410] [client 172.213.152.228:64490] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xdd.php"] [unique_id "adYPPyAjtvRQEkLosq1LIwAAABU"]
[Wed Apr 08 16:18:08.637203 2026] [:error] [pid 35642:tid 35652] [client 172.213.152.228:65073] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xdd.php"] [unique_id "adYPQA-CqryxdEs5DN_MHwAAAEg"]
[Wed Apr 08 16:18:09.828629 2026] [:error] [pid 35642:tid 35655] [client 172.213.152.228:65509] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adYPQQ-CqryxdEs5DN_MKgAAAEs"]
[Wed Apr 08 16:18:11.519153 2026] [:error] [pid 12453:tid 12461] [client 172.213.152.228:65490] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adYPQxjtW7S6XsLPvrSOuAAAAIY"]
[Wed Apr 08 16:18:13.266292 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:64095] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adYPRW1Fea4F4fbumr1DBgAAAMw"]
[Wed Apr 08 16:18:14.067094 2026] [:error] [pid 12490:tid 12510] [client 172.213.152.228:64988] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adYPRm1Fea4F4fbumr1DDAAAANI"]
[Wed Apr 08 16:18:15.144740 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:64546] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "adYPR21Fea4F4fbumr1DEQAAAM4"]
[Wed Apr 08 16:18:16.058531 2026] [:error] [pid 12490:tid 12493] [client 172.213.152.228:65024] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "adYPSG1Fea4F4fbumr1DFAAAAME"]
[Wed Apr 08 16:18:17.159174 2026] [:error] [pid 35642:tid 35664] [client 172.213.152.228:64534] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "adYPSQ-CqryxdEs5DN_MRAAAAFQ"]
[Wed Apr 08 16:18:18.274584 2026] [:error] [pid 35642:tid 35651] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Wed Apr 08 16:18:19.167987 2026] [:error] [pid 35642:tid 35664] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/update1.php
[Wed Apr 08 16:18:19.432523 2026] [:error] [pid 35642:tid 35655] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Wed Apr 08 16:18:19.704735 2026] [:error] [pid 35642:tid 35663] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Wed Apr 08 16:18:19.967280 2026] [:error] [pid 35642:tid 35650] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/new2.php
[Wed Apr 08 16:18:20.230585 2026] [:error] [pid 35642:tid 35649] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Wed Apr 08 16:18:20.476813 2026] [:error] [pid 35642:tid 35648] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/wziar1.php
[Wed Apr 08 16:18:20.743379 2026] [:error] [pid 35642:tid 35655] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/wswer1.php
[Wed Apr 08 16:18:21.021664 2026] [:error] [pid 35642:tid 35660] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ccv.php
[Wed Apr 08 16:18:21.284339 2026] [:error] [pid 35642:tid 35650] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/wo.php
[Wed Apr 08 16:18:21.548481 2026] [:error] [pid 35642:tid 35649] [client 172.213.152.228:65019] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Wed Apr 08 16:18:21.944878 2026] [:error] [pid 35642:tid 35662] [client 172.213.152.228:65019] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/floya.php"] [unique_id "adYPTQ-CqryxdEs5DN_MZwAAAFI"]
[Wed Apr 08 16:18:26.657376 2026] [:error] [pid 12453:tid 12455] [client 172.213.152.228:64533] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/floya.php"] [unique_id "adYPUhjtW7S6XsLPvrSOyQAAAIA"]
[Wed Apr 08 16:18:27.864531 2026] [:error] [pid 35642:tid 35662] [client 172.213.152.228:64975] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/floya.php"] [unique_id "adYPUw-CqryxdEs5DN_MfAAAAFI"]
[Wed Apr 08 16:18:28.927965 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:64545] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/floya.php"] [unique_id "adYPVG1Fea4F4fbumr1DKgAAAM4"]
[Wed Apr 08 16:18:29.612707 2026] [:error] [pid 12385:tid 12389] [client 172.213.152.228:65492] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adYPVSAjtvRQEkLosq1LLAAAAAA"]
[Wed Apr 08 16:18:30.375526 2026] [:error] [pid 12490:tid 12509] [client 172.213.152.228:64548] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adYPVm1Fea4F4fbumr1DLwAAANE"]
[Wed Apr 08 16:18:30.901048 2026] [:error] [pid 12453:tid 12478] [client 172.213.152.228:65018] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adYPVhjtW7S6XsLPvrSOzwAAAJc"]
[Wed Apr 08 16:18:31.448042 2026] [:error] [pid 35642:tid 35661] [client 172.213.152.228:64477] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adYPVw-CqryxdEs5DN_MiQAAAFE"]
[Wed Apr 08 16:18:32.047230 2026] [:error] [pid 12386:tid 12426] [client 172.213.152.228:65515] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adYPWBLhhLtqHi2gK7WzyQAAAQo"]
[Wed Apr 08 16:18:32.601640 2026] [:error] [pid 12453:tid 12468] [client 172.213.152.228:64478] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adYPWBjtW7S6XsLPvrSO0QAAAI0"]
[Wed Apr 08 16:18:33.467484 2026] [:error] [pid 12453:tid 12462] [client 172.213.152.228:65480] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adYPWRjtW7S6XsLPvrSO0wAAAIc"]
[Wed Apr 08 16:18:34.441440 2026] [:error] [pid 12386:tid 12435] [client 172.213.152.228:64498] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adYPWhLhhLtqHi2gK7Wz0gAAARM"]
[Wed Apr 08 16:18:35.003122 2026] [:error] [pid 35642:tid 35665] [client 172.213.152.228:65514] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vdb.php"] [unique_id "adYPWw-CqryxdEs5DN_MlgAAAFU"]
[Wed Apr 08 16:18:35.754158 2026] [:error] [pid 12453:tid 12460] [client 172.213.152.228:64471] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vdb.php"] [unique_id "adYPWxjtW7S6XsLPvrSO1wAAAIU"]
[Wed Apr 08 16:18:36.274051 2026] [:error] [pid 12453:tid 12474] [client 172.213.152.228:64530] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vdb.php"] [unique_id "adYPXBjtW7S6XsLPvrSO2AAAAJM"]
[Wed Apr 08 16:18:36.834444 2026] [:error] [pid 12490:tid 12498] [client 172.213.152.228:64564] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vdb.php"] [unique_id "adYPXG1Fea4F4fbumr1DOQAAAMY"]
[Wed Apr 08 16:18:37.654513 2026] [:error] [pid 12490:tid 12508] [client 172.213.152.228:64508] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "adYPXW1Fea4F4fbumr1DOwAAANA"]
[Wed Apr 08 16:18:38.267317 2026] [:error] [pid 35642:tid 35646] [client 172.213.152.228:65491] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "adYPXg-CqryxdEs5DN_MpAAAAEI"]
[Wed Apr 08 16:18:38.782383 2026] [:error] [pid 12490:tid 12503] [client 172.213.152.228:64495] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "adYPXm1Fea4F4fbumr1DPgAAAMs"]
[Wed Apr 08 16:18:39.369566 2026] [:error] [pid 12490:tid 12498] [client 172.213.152.228:65086] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/om.php"] [unique_id "adYPX21Fea4F4fbumr1DQAAAAMY"]
[Wed Apr 08 16:18:40.016435 2026] [:error] [pid 35642:tid 35665] [client 172.213.152.228:64113] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox.php"] [unique_id "adYPYA-CqryxdEs5DN_MqwAAAFU"]
[Wed Apr 08 16:18:40.702888 2026] [:error] [pid 12453:tid 12460] [client 172.213.152.228:65041] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox.php"] [unique_id "adYPYBjtW7S6XsLPvrSO3wAAAIU"]
[Wed Apr 08 16:18:41.442863 2026] [:error] [pid 35642:tid 35651] [client 172.213.152.228:64106] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox.php"] [unique_id "adYPYQ-CqryxdEs5DN_MsQAAAEc"]
[Wed Apr 08 16:18:42.066503 2026] [:error] [pid 12453:tid 12456] [client 172.213.152.228:65484] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ox.php"] [unique_id "adYPYhjtW7S6XsLPvrSO5wAAAIE"]
[Wed Apr 08 16:18:42.766849 2026] [:error] [pid 12385:tid 12412] [client 172.213.152.228:64470] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "adYPYiAjtvRQEkLosq1LOwAAABc"]
[Wed Apr 08 16:18:43.617180 2026] [:error] [pid 12453:tid 12474] [client 172.213.152.228:64175] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "adYPYxjtW7S6XsLPvrSO7QAAAJM"]
[Wed Apr 08 16:18:44.139663 2026] [:error] [pid 12453:tid 12473] [client 172.213.152.228:64149] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "adYPZBjtW7S6XsLPvrSO8AAAAJI"]
[Wed Apr 08 16:18:44.825766 2026] [:error] [pid 12453:tid 12462] [client 172.213.152.228:65029] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htto.php"] [unique_id "adYPZBjtW7S6XsLPvrSO9QAAAIc"]
[Wed Apr 08 16:18:45.383964 2026] [:error] [pid 12385:tid 12395] [client 172.213.152.228:64456] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2h.php"] [unique_id "adYPZSAjtvRQEkLosq1LPQAAAAY"]
[Wed Apr 08 16:18:46.008850 2026] [:error] [pid 12453:tid 12474] [client 172.213.152.228:65053] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2h.php"] [unique_id "adYPZhjtW7S6XsLPvrSO-QAAAJM"]
[Wed Apr 08 16:18:46.648907 2026] [:error] [pid 12490:tid 12496] [client 172.213.152.228:65491] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2h.php"] [unique_id "adYPZm1Fea4F4fbumr1DRgAAAMQ"]
[Wed Apr 08 16:18:47.175433 2026] [:error] [pid 12453:tid 12465] [client 172.213.152.228:64462] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h2h.php"] [unique_id "adYPZxjtW7S6XsLPvrSO_AAAAIo"]
[Wed Apr 08 16:18:47.769423 2026] [:error] [pid 12453:tid 12476] [client 172.213.152.228:64129] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adYPZxjtW7S6XsLPvrSO_wAAAJU"]
[Wed Apr 08 16:18:48.812589 2026] [:error] [pid 12453:tid 12469] [client 172.213.152.228:64559] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adYPaBjtW7S6XsLPvrSPAgAAAI4"]
[Wed Apr 08 16:18:50.738310 2026] [:error] [pid 12385:tid 12413] [client 172.213.152.228:64115] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adYPaiAjtvRQEkLosq1LQwAAABg"]
[Wed Apr 08 16:18:51.389368 2026] [:error] [pid 12453:tid 12457] [client 172.213.152.228:64457] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adYPaxjtW7S6XsLPvrSPCAAAAII"]
[Wed Apr 08 16:18:52.371861 2026] [:error] [pid 35642:tid 35651] [client 172.213.152.228:64553] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "adYPbA-CqryxdEs5DN_M4AAAAEc"]
[Wed Apr 08 16:18:54.119332 2026] [:error] [pid 12490:tid 12500] [client 172.213.152.228:64994] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "adYPbm1Fea4F4fbumr1DSAAAAMg"]
[Wed Apr 08 16:18:55.091949 2026] [:error] [pid 12453:tid 12472] [client 172.213.152.228:64172] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "adYPbxjtW7S6XsLPvrSPCwAAAJE"]
[Wed Apr 08 16:18:56.060905 2026] [:error] [pid 35642:tid 35653] [client 172.213.152.228:64526] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dichku.php"] [unique_id "adYPcA-CqryxdEs5DN_M5AAAAEk"]
[Wed Apr 08 16:18:56.821230 2026] [:error] [pid 12490:tid 12501] [client 172.213.152.228:64164] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "adYPcG1Fea4F4fbumr1DTgAAAMk"]
[Wed Apr 08 16:18:58.297989 2026] [:error] [pid 35642:tid 35662] [client 172.213.152.228:65503] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "adYPcg-CqryxdEs5DN_M6AAAAFI"]
[Wed Apr 08 16:18:59.090316 2026] [:error] [pid 12453:tid 12460] [client 172.213.152.228:64068] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "adYPcxjtW7S6XsLPvrSPEAAAAIU"]
[Wed Apr 08 16:18:59.884298 2026] [:error] [pid 12385:tid 12411] [client 172.213.152.228:64079] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "adYPcyAjtvRQEkLosq1LTQAAABY"]
[Wed Apr 08 16:19:00.999144 2026] [:error] [pid 12490:tid 12516] [client 172.213.152.228:64083] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/store.php"] [unique_id "adYPdG1Fea4F4fbumr1DVgAAANg"]
[Wed Apr 08 16:19:02.412000 2026] [:error] [pid 12490:tid 12510] [client 172.213.152.228:64509] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/store.php"] [unique_id "adYPdm1Fea4F4fbumr1DXwAAANI"]
[Wed Apr 08 16:19:03.622049 2026] [:error] [pid 12386:tid 12416] [client 172.213.152.228:65482] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/store.php"] [unique_id "adYPdxLhhLtqHi2gK7Wz6wAAAQA"]
[Wed Apr 08 16:19:04.641650 2026] [:error] [pid 35642:tid 35653] [client 172.213.152.228:64102] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/store.php"] [unique_id "adYPeA-CqryxdEs5DN_M8gAAAEk"]
[Wed Apr 08 16:19:06.874415 2026] [:error] [pid 12453:tid 12458] [client 172.213.152.228:64465] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xenium4.php"] [unique_id "adYPehjtW7S6XsLPvrSPHgAAAIM"]
[Wed Apr 08 16:19:09.168851 2026] [:error] [pid 12490:tid 12513] [client 172.213.152.228:64544] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xenium4.php"] [unique_id "adYPfW1Fea4F4fbumr1DZQAAANU"]
[Wed Apr 08 16:19:11.887960 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:65047] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xenium4.php"] [unique_id "adYPf21Fea4F4fbumr1DcgAAAMw"]
[Wed Apr 08 16:19:13.073171 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:65033] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xenium4.php"] [unique_id "adYPgW1Fea4F4fbumr1DeQAAAM4"]
[Wed Apr 08 16:19:13.915428 2026] [:error] [pid 12386:tid 12422] [client 172.213.152.228:63566] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adYPgRLhhLtqHi2gK7Wz8wAAAQY"]
[Wed Apr 08 16:19:15.396550 2026] [:error] [pid 12490:tid 12503] [client 172.213.152.228:64554] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adYPg21Fea4F4fbumr1DfQAAAMs"]
[Wed Apr 08 16:19:17.194885 2026] [:error] [pid 12490:tid 12510] [client 172.213.152.228:64075] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adYPhW1Fea4F4fbumr1DhgAAANI"]
[Wed Apr 08 16:19:18.193858 2026] [:error] [pid 35642:tid 35667] [client 172.213.152.228:64500] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adYPhg-CqryxdEs5DN_NBgAAAFc"]
[Wed Apr 08 16:19:19.575250 2026] [:error] [pid 35642:tid 35660] [client 172.213.152.228:64161] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpyur.php"] [unique_id "adYPhw-CqryxdEs5DN_NDgAAAFA"]
[Wed Apr 08 16:19:20.601189 2026] [:error] [pid 12490:tid 12497] [client 172.213.152.228:64098] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpyur.php"] [unique_id "adYPiG1Fea4F4fbumr1DjAAAAMU"]
[Wed Apr 08 16:19:21.668088 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/wpyur.php
[Wed Apr 08 16:19:21.956313 2026] [:error] [pid 12490:tid 12501] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/wglum.php
[Wed Apr 08 16:19:22.233195 2026] [:error] [pid 12490:tid 12494] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Wed Apr 08 16:19:22.512463 2026] [:error] [pid 12490:tid 12497] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/byp8.php
[Wed Apr 08 16:19:22.771735 2026] [:error] [pid 12490:tid 12504] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Wed Apr 08 16:19:23.038139 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/gilo.php
[Wed Apr 08 16:19:23.299633 2026] [:error] [pid 12490:tid 12514] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Wed Apr 08 16:19:23.570083 2026] [:error] [pid 12490:tid 12492] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/x7r.php
[Wed Apr 08 16:19:23.832014 2026] [:error] [pid 12490:tid 12500] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/riz.php
[Wed Apr 08 16:19:24.096071 2026] [:error] [pid 12490:tid 12496] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/wp3.php
[Wed Apr 08 16:19:24.344892 2026] [:error] [pid 12490:tid 12505] [client 172.213.152.228:64531] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Wed Apr 08 16:19:24.608492 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:64531] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ympoo.php"] [unique_id "adYPjG1Fea4F4fbumr1DogAAAM4"]
[Wed Apr 08 16:19:25.342944 2026] [:error] [pid 12453:tid 12469] [client 172.213.152.228:65051] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ympoo.php"] [unique_id "adYPjRjtW7S6XsLPvrSPcgAAAI4"]
[Wed Apr 08 16:19:26.091041 2026] [:error] [pid 12490:tid 12509] [client 172.213.152.228:65518] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ympoo.php"] [unique_id "adYPjm1Fea4F4fbumr1DpQAAANE"]
[Wed Apr 08 16:19:26.739829 2026] [:error] [pid 12490:tid 12515] [client 172.213.152.228:65083] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ympoo.php"] [unique_id "adYPjm1Fea4F4fbumr1DqQAAANc"]
[Wed Apr 08 16:19:27.582719 2026] [:error] [pid 12490:tid 12495] [client 172.213.152.228:64516] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/she.php"] [unique_id "adYPj21Fea4F4fbumr1DvAAAAMM"]
[Wed Apr 08 16:19:28.480953 2026] [:error] [pid 12453:tid 12457] [client 172.213.152.228:65521] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/she.php"] [unique_id "adYPkBjtW7S6XsLPvrSPgwAAAII"]
[Wed Apr 08 16:19:29.325352 2026] [:error] [pid 12490:tid 12506] [client 172.213.152.228:64187] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/she.php"] [unique_id "adYPkW1Fea4F4fbumr1D1gAAAM4"]
[Wed Apr 08 16:19:30.154198 2026] [:error] [pid 12490:tid 12502] [client 172.213.152.228:64527] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/she.php"] [unique_id "adYPkm1Fea4F4fbumr1D2gAAAMo"]
[Wed Apr 08 16:19:30.997651 2026] [:error] [pid 12490:tid 12511] [client 172.213.152.228:65516] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haojj.php"] [unique_id "adYPkm1Fea4F4fbumr1D3QAAANM"]
[Wed Apr 08 16:19:31.557750 2026] [:error] [pid 12490:tid 12514] [client 172.213.152.228:64505] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haojj.php"] [unique_id "adYPk21Fea4F4fbumr1D3wAAANY"]
[Wed Apr 08 16:19:32.343852 2026] [:error] [pid 12386:tid 12417] [client 172.213.152.228:64476] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haojj.php"] [unique_id "adYPlBLhhLtqHi2gK7W0DQAAAQE"]
[Wed Apr 08 16:19:33.222073 2026] [:error] [pid 35642:tid 35667] [client 172.213.152.228:64166] [client 172.213.152.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/haojj.php"] [unique_id "adYPlQ-CqryxdEs5DN_NGQAAAFc"]
[Wed Apr 08 17:01:42.973683 2026] [:error] [pid 35642:tid 35659] [client 129.153.94.60:55681] [client 129.153.94.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/"] [unique_id "adYZdg-CqryxdEs5DN_p6gAAAE8"]
[Wed Apr 08 18:09:09.636197 2026] [:error] [pid 35642:tid 35652] [client 182.42.110.255:44534] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adYpRQ-CqryxdEs5DN8uUQAAAEg"]
[Wed Apr 08 18:43:57.605149 2026] [:error] [pid 7047:tid 7055] [client 150.109.46.88:55700] [client 150.109.46.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adYxbeNh3oGO3pKiCzzMLgAAAYY"]
[Wed Apr 08 21:13:05.648086 2026] [:error] [pid 7047:tid 7069] [client 170.106.180.153:38550] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adZUYeNh3oGO3pKiCzwkkAAAAZQ"]
[Wed Apr 08 22:43:19.826394 2026] [:error] [pid 12490:tid 12511] [client 43.165.69.68:49364] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adZph21Fea4F4fbumr0rwgAAANM"]
[Wed Apr 08 23:05:27.321296 2026] [:error] [pid 64066:tid 64091] [client 43.157.38.228:51372] [client 43.157.38.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adZut1R3WucJgr2vZGaFUwAAAVY"]
[Thu Apr 09 00:39:54.981500 2026] [:error] [pid 7047:tid 7053] [client 182.44.2.148:42665] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adaE2uNh3oGO3pKiCzxpEAAAAYQ"]
[Thu Apr 09 01:08:58.711056 2026] [:error] [pid 22056:tid 22058] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 09 01:08:59.128113 2026] [:error] [pid 22056:tid 22066] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/uwu2.php
[Thu Apr 09 01:08:59.368159 2026] [:error] [pid 22056:tid 22067] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/nc4.php
[Thu Apr 09 01:09:00.057902 2026] [:error] [pid 22056:tid 22081] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/akcc.php
[Thu Apr 09 01:09:00.317277 2026] [:error] [pid 22056:tid 22079] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 09 01:09:00.731930 2026] [:error] [pid 22056:tid 22079] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/zews.php
[Thu Apr 09 01:09:01.032452 2026] [:error] [pid 22056:tid 22059] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 09 01:09:01.272457 2026] [:error] [pid 22056:tid 22058] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/124.php
[Thu Apr 09 01:09:01.513250 2026] [:error] [pid 22056:tid 22066] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/epinyins.php
[Thu Apr 09 01:09:01.784862 2026] [:error] [pid 22056:tid 22080] [client 20.250.23.224:18145] File does not exist: /usr/local/apache/htdocs/suspended-page/geck.php
[Thu Apr 09 01:09:02.039280 2026] [:error] [pid 22056:tid 22068] [client 20.250.23.224:18145] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shout.php"] [unique_id "adaLrmQ3CidOGkmVXZggZgAAAMo"]
[Thu Apr 09 01:09:18.637027 2026] [:error] [pid 40460:tid 40482] [client 20.250.23.224:20808] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "adaLvow-4-9CKD2kKMYbdgAAAFM"]
[Thu Apr 09 01:09:21.486443 2026] [:error] [pid 40053:tid 40059] [client 20.250.23.224:18349] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "adaLwddyKTqfO6aiQ6UMFQAAAAE"]
[Thu Apr 09 01:09:24.345743 2026] [:error] [pid 22056:tid 22067] [client 20.250.23.224:24886] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "adaLxGQ3CidOGkmVXZgg4gAAAMk"]
[Thu Apr 09 01:09:25.745584 2026] [:error] [pid 22056:tid 22076] [client 20.250.23.224:65323] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/size.php"] [unique_id "adaLxWQ3CidOGkmVXZgg6QAAANI"]
[Thu Apr 09 01:09:29.598691 2026] [:error] [pid 22056:tid 22081] [client 20.250.23.224:15295] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "adaLyWQ3CidOGkmVXZgg9wAAANc"]
[Thu Apr 09 01:09:31.003139 2026] [:error] [pid 40460:tid 40473] [client 20.250.23.224:34319] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "adaLy4w-4-9CKD2kKMYbkgAAAEo"]
[Thu Apr 09 01:09:33.239307 2026] [:error] [pid 22056:tid 22077] [client 20.250.23.224:18357] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "adaLzWQ3CidOGkmVXZghAQAAANM"]
[Thu Apr 09 01:09:35.925820 2026] [:error] [pid 40053:tid 40058] [client 20.250.23.224:13130] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-gr.php"] [unique_id "adaLz9dyKTqfO6aiQ6UMLQAAAAA"]
[Thu Apr 09 01:09:44.130045 2026] [:error] [pid 40055:tid 40135] [client 20.250.23.224:15294] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mn.php"] [unique_id "adaL2H_5SjAJycOw5k-6BwAAAIU"]
[Thu Apr 09 01:09:48.343723 2026] [:error] [pid 40055:tid 40137] [client 20.250.23.224:15268] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mn.php"] [unique_id "adaL3H_5SjAJycOw5k-6EwAAAIc"]
[Thu Apr 09 01:09:50.392919 2026] [:error] [pid 40460:tid 40485] [client 20.250.23.224:34335] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mn.php"] [unique_id "adaL3ow-4-9CKD2kKMYbrAAAAFY"]
[Thu Apr 09 01:09:52.553982 2026] [:error] [pid 40055:tid 40151] [client 20.250.23.224:18680] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mt.php"] [unique_id "adaL4H_5SjAJycOw5k-6JgAAAJU"]
[Thu Apr 09 01:09:53.699295 2026] [:error] [pid 40055:tid 40133] [client 20.250.23.224:21617] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mt.php"] [unique_id "adaL4X_5SjAJycOw5k-6KQAAAIM"]
[Thu Apr 09 01:09:56.001900 2026] [:error] [pid 22056:tid 22059] [client 20.250.23.224:21628] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mt.php"] [unique_id "adaL5GQ3CidOGkmVXZghOAAAAME"]
[Thu Apr 09 01:09:56.943680 2026] [:error] [pid 40460:tid 40472] [client 20.250.23.224:34353] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mt.php"] [unique_id "adaL5Iw-4-9CKD2kKMYbyAAAAEk"]
[Thu Apr 09 01:10:00.580410 2026] [:error] [pid 22056:tid 22068] [client 20.250.23.224:14791] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "adaL6GQ3CidOGkmVXZghQwAAAMo"]
[Thu Apr 09 01:10:03.973132 2026] [:error] [pid 22056:tid 22066] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Thu Apr 09 01:10:04.250467 2026] [:error] [pid 22056:tid 22061] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Thu Apr 09 01:10:04.560837 2026] [:error] [pid 22056:tid 22068] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/ova.php
[Thu Apr 09 01:10:04.879459 2026] [:error] [pid 22056:tid 22082] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu Apr 09 01:10:05.118272 2026] [:error] [pid 22056:tid 22078] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 09 01:10:05.421905 2026] [:error] [pid 22056:tid 22062] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/123.php
[Thu Apr 09 01:10:05.755923 2026] [:error] [pid 22056:tid 22072] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Thu Apr 09 01:10:05.995306 2026] [:error] [pid 22056:tid 22069] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Apr 09 01:10:06.263005 2026] [:error] [pid 22056:tid 22081] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 09 01:10:06.543871 2026] [:error] [pid 22056:tid 22073] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/v.php
[Thu Apr 09 01:10:06.799737 2026] [:error] [pid 22056:tid 22080] [client 20.250.23.224:10573] File does not exist: /usr/local/apache/htdocs/suspended-page/ar.php
[Thu Apr 09 01:10:07.051447 2026] [:error] [pid 22056:tid 22079] [client 20.250.23.224:10573] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qing.php"] [unique_id "adaL72Q3CidOGkmVXZghUwAAANU"]
[Thu Apr 09 01:10:08.481400 2026] [:error] [pid 22056:tid 22058] [client 20.250.23.224:28969] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qing.php"] [unique_id "adaL8GQ3CidOGkmVXZghVwAAAMA"]
[Thu Apr 09 01:10:11.172624 2026] [:error] [pid 40053:tid 40071] [client 20.250.23.224:65047] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qing.php"] [unique_id "adaL89dyKTqfO6aiQ6UMYwAAAA0"]
[Thu Apr 09 01:10:12.458598 2026] [:error] [pid 22056:tid 22080] [client 20.250.23.224:60290] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qing.php"] [unique_id "adaL9GQ3CidOGkmVXZghXgAAANY"]
[Thu Apr 09 01:10:18.916429 2026] [:error] [pid 22056:tid 22061] [client 20.250.23.224:17304] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adaL-mQ3CidOGkmVXZghfAAAAMM"]
[Thu Apr 09 01:10:20.109174 2026] [:error] [pid 40460:tid 40471] [client 20.250.23.224:60315] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adaL_Iw-4-9CKD2kKMYcOQAAAEg"]
[Thu Apr 09 01:10:30.096843 2026] [:error] [pid 22056:tid 22079] [client 20.250.23.224:60316] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mms.php"] [unique_id "adaMBmQ3CidOGkmVXZghrgAAANU"]
[Thu Apr 09 01:10:31.489413 2026] [:error] [pid 40054:tid 40100] [client 20.250.23.224:16391] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mms.php"] [unique_id "adaMB6ymwSVk3s67lDd8JAAAAQI"]
[Thu Apr 09 01:10:57.232102 2026] [:error] [pid 40054:tid 40106] [client 20.250.23.224:17145] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "adaMIaymwSVk3s67lDd8SgAAAQg"]
[Thu Apr 09 01:10:59.991145 2026] [:error] [pid 40054:tid 40098] [client 20.250.23.224:57817] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gmo.php"] [unique_id "adaMI6ymwSVk3s67lDd8TQAAAQA"]
[Thu Apr 09 01:11:01.274862 2026] [:error] [pid 40055:tid 40136] [client 20.250.23.224:10402] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adaMJX_5SjAJycOw5k-6fAAAAIY"]
[Thu Apr 09 01:11:05.705210 2026] [:error] [pid 22056:tid 22074] [client 20.250.23.224:51007] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adaMKWQ3CidOGkmVXZgh2QAAANA"]
[Thu Apr 09 01:11:07.341825 2026] [:error] [pid 40460:tid 40473] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Thu Apr 09 01:11:07.580839 2026] [:error] [pid 40460:tid 40482] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/lite.php
[Thu Apr 09 01:11:07.885404 2026] [:error] [pid 40460:tid 40470] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Apr 09 01:11:08.227207 2026] [:error] [pid 40460:tid 40479] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Thu Apr 09 01:11:08.518476 2026] [:error] [pid 40460:tid 40465] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Thu Apr 09 01:11:08.758448 2026] [:error] [pid 40460:tid 40478] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Thu Apr 09 01:11:09.026969 2026] [:error] [pid 40460:tid 40481] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 09 01:11:09.350768 2026] [:error] [pid 40460:tid 40467] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Apr 09 01:11:09.619871 2026] [:error] [pid 40460:tid 40464] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/ee.php
[Thu Apr 09 01:11:09.857836 2026] [:error] [pid 40460:tid 40475] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Thu Apr 09 01:11:10.097414 2026] [:error] [pid 40460:tid 40463] [client 20.250.23.224:11691] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Thu Apr 09 01:11:10.333721 2026] [:error] [pid 40460:tid 40468] [client 20.250.23.224:11691] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/02.php"] [unique_id "adaMLow-4-9CKD2kKMYc7QAAAEU"]
[Thu Apr 09 01:11:14.227813 2026] [:error] [pid 40055:tid 40141] [client 20.250.23.224:17108] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/02.php"] [unique_id "adaMMn_5SjAJycOw5k-6iQAAAIs"]
[Thu Apr 09 01:11:15.413710 2026] [:error] [pid 40460:tid 40468] [client 20.250.23.224:63349] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/02.php"] [unique_id "adaMM4w-4-9CKD2kKMYc-wAAAEU"]
[Thu Apr 09 01:11:20.630848 2026] [:error] [pid 40460:tid 40476] [client 20.250.23.224:10617] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/02.php"] [unique_id "adaMOIw-4-9CKD2kKMYdAQAAAE0"]
[Thu Apr 09 01:11:24.547850 2026] [:error] [pid 40460:tid 40480] [client 20.250.23.224:15831] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "adaMPIw-4-9CKD2kKMYdBQAAAFE"]
[Thu Apr 09 01:11:29.321200 2026] [:error] [pid 22056:tid 22062] [client 20.250.23.224:50949] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "adaMQWQ3CidOGkmVXZgiGQAAAMQ"]
[Thu Apr 09 01:11:32.334998 2026] [:error] [pid 40460:tid 40484] [client 20.250.23.224:65068] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "adaMRIw-4-9CKD2kKMYdEAAAAFU"]
[Thu Apr 09 01:11:36.656522 2026] [:error] [pid 40055:tid 40130] [client 20.250.23.224:16401] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "adaMSH_5SjAJycOw5k-6qAAAAIA"]
[Thu Apr 09 01:11:44.826976 2026] [:error] [pid 40055:tid 40145] [client 20.250.23.224:16495] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "adaMUH_5SjAJycOw5k-6tgAAAI8"]
[Thu Apr 09 01:11:49.921328 2026] [:error] [pid 22056:tid 22081] [client 20.250.23.224:15095] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "adaMVWQ3CidOGkmVXZgiPAAAANc"]
[Thu Apr 09 01:11:53.234172 2026] [:error] [pid 22056:tid 22072] [client 20.250.23.224:17257] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "adaMWWQ3CidOGkmVXZgiRgAAAM4"]
[Thu Apr 09 01:11:55.584386 2026] [:error] [pid 40460:tid 40473] [client 20.250.23.224:61964] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "adaMW4w-4-9CKD2kKMYdLAAAAEo"]
[Thu Apr 09 01:11:58.649361 2026] [:error] [pid 40053:tid 40078] [client 20.250.23.224:12919] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "adaMXtdyKTqfO6aiQ6UMzAAAABQ"]
[Thu Apr 09 01:12:01.222412 2026] [:error] [pid 40460:tid 40472] [client 20.250.23.224:11434] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13k.php"] [unique_id "adaMYYw-4-9CKD2kKMYdNwAAAEk"]
[Thu Apr 09 01:12:02.149982 2026] [:error] [pid 40053:tid 40064] [client 20.250.23.224:26825] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "adaMYtdyKTqfO6aiQ6UM1gAAAAY"]
[Thu Apr 09 01:12:03.943905 2026] [:error] [pid 40055:tid 40140] [client 20.250.23.224:62301] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "adaMY3_5SjAJycOw5k-6ygAAAIo"]
[Thu Apr 09 01:12:06.518191 2026] [:error] [pid 22056:tid 22081] [client 20.250.23.224:12891] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "adaMZmQ3CidOGkmVXZgiUAAAANc"]
[Thu Apr 09 01:12:10.665882 2026] [:error] [pid 40053:tid 40079] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Apr 09 01:12:10.905778 2026] [:error] [pid 40053:tid 40061] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Apr 09 01:12:11.249114 2026] [:error] [pid 40053:tid 40065] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Thu Apr 09 01:12:11.489367 2026] [:error] [pid 40053:tid 40058] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Thu Apr 09 01:12:11.728748 2026] [:error] [pid 40053:tid 40071] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/kk.php
[Thu Apr 09 01:12:11.978456 2026] [:error] [pid 40053:tid 40073] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/cf.php
[Thu Apr 09 01:12:12.218102 2026] [:error] [pid 40053:tid 40062] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/456.php
[Thu Apr 09 01:12:12.659399 2026] [:error] [pid 40053:tid 40080] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Thu Apr 09 01:12:13.374879 2026] [:error] [pid 40053:tid 40075] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/2x.php
[Thu Apr 09 01:12:13.614687 2026] [:error] [pid 40053:tid 40063] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 09 01:12:13.854158 2026] [:error] [pid 40053:tid 40070] [client 20.250.23.224:34981] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 09 01:12:14.093043 2026] [:error] [pid 40053:tid 40060] [client 20.250.23.224:34981] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "adaMbtdyKTqfO6aiQ6UM-QAAAAI"]
[Thu Apr 09 01:12:15.454839 2026] [:error] [pid 22056:tid 22070] [client 20.250.23.224:22448] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "adaMb2Q3CidOGkmVXZgibQAAAMw"]
[Thu Apr 09 01:12:21.780972 2026] [:error] [pid 40460:tid 40487] [client 20.250.23.224:32422] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "adaMdYw-4-9CKD2kKMYdSwAAAFg"]
[Thu Apr 09 01:12:23.066836 2026] [:error] [pid 40055:tid 40146] [client 20.250.23.224:19127] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pepe.php"] [unique_id "adaMd3_5SjAJycOw5k-62AAAAJA"]
[Thu Apr 09 01:12:26.198619 2026] [:error] [pid 40055:tid 40138] [client 20.250.23.224:12884] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file32.php"] [unique_id "adaMen_5SjAJycOw5k-62gAAAIg"]
[Thu Apr 09 01:12:27.854473 2026] [:error] [pid 40055:tid 40130] [client 20.250.23.224:11450] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file32.php"] [unique_id "adaMe3_5SjAJycOw5k-63AAAAIA"]
[Thu Apr 09 01:12:29.526271 2026] [:error] [pid 40054:tid 40107] [client 20.250.23.224:38621] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file32.php"] [unique_id "adaMfaymwSVk3s67lDd8rgAAAQk"]
[Thu Apr 09 01:12:30.741912 2026] [:error] [pid 40460:tid 40468] [client 20.250.23.224:16947] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file32.php"] [unique_id "adaMfow-4-9CKD2kKMYdUwAAAEU"]
[Thu Apr 09 01:12:32.059166 2026] [:error] [pid 40054:tid 40123] [client 20.250.23.224:12918] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "adaMgKymwSVk3s67lDd8sgAAARc"]
[Thu Apr 09 01:12:35.947798 2026] [:error] [pid 40053:tid 40079] [client 20.250.23.224:51478] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "adaMg9dyKTqfO6aiQ6UNKwAAABU"]
[Thu Apr 09 01:12:40.112402 2026] [:error] [pid 22056:tid 22078] [client 20.250.23.224:63356] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "adaMiGQ3CidOGkmVXZginwAAANQ"]
[Thu Apr 09 01:12:47.981530 2026] [:error] [pid 40053:tid 40073] [client 20.250.23.224:15242] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "adaMj9dyKTqfO6aiQ6UNNwAAAA8"]
[Thu Apr 09 01:12:53.198411 2026] [:error] [pid 40460:tid 40479] [client 20.250.23.224:18166] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "adaMlYw-4-9CKD2kKMYdlgAAAFA"]
[Thu Apr 09 01:13:13.883163 2026] [:error] [pid 40053:tid 40067] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Thu Apr 09 01:13:14.149279 2026] [:error] [pid 40053:tid 40069] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Apr 09 01:13:14.390157 2026] [:error] [pid 40053:tid 40066] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/ll.php
[Thu Apr 09 01:13:14.876556 2026] [:error] [pid 40053:tid 40064] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Apr 09 01:13:15.593985 2026] [:error] [pid 40053:tid 40079] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Apr 09 01:13:15.951685 2026] [:error] [pid 40053:tid 40081] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-gr.php
[Thu Apr 09 01:13:16.209618 2026] [:error] [pid 40053:tid 40073] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/asus.php
[Thu Apr 09 01:13:16.448351 2026] [:error] [pid 40053:tid 40068] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 09 01:13:16.849215 2026] [:error] [pid 40053:tid 40070] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Apr 09 01:13:17.119124 2026] [:error] [pid 40053:tid 40080] [client 20.250.23.224:23584] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mn.php
[Thu Apr 09 01:13:17.442968 2026] [:error] [pid 40053:tid 40074] [client 20.250.23.224:23584] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adaMrddyKTqfO6aiQ6UNVwAAABA"]
[Thu Apr 09 01:13:18.578658 2026] [:error] [pid 22056:tid 22081] [client 20.250.23.224:28190] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adaMrmQ3CidOGkmVXZgi7wAAANc"]
[Thu Apr 09 01:13:20.528617 2026] [:error] [pid 40055:tid 40145] [client 20.250.23.224:28214] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adaMsH_5SjAJycOw5k-7DwAAAI8"]
[Thu Apr 09 01:13:21.446559 2026] [:error] [pid 40054:tid 40098] [client 20.250.23.224:23585] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adaMsaymwSVk3s67lDd86wAAAQA"]
[Thu Apr 09 01:13:22.451085 2026] [:error] [pid 22056:tid 22062] [client 20.250.23.224:26814] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "adaMsmQ3CidOGkmVXZgi-wAAAMQ"]
[Thu Apr 09 01:13:23.951580 2026] [:error] [pid 22056:tid 22073] [client 20.250.23.224:16891] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "adaMs2Q3CidOGkmVXZgjAAAAAM8"]
[Thu Apr 09 01:13:26.539658 2026] [:error] [pid 22056:tid 22065] [client 20.250.23.224:26752] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css.php"] [unique_id "adaMtmQ3CidOGkmVXZgjCgAAAMc"]
[Thu Apr 09 01:13:42.520781 2026] [:error] [pid 22056:tid 22067] [client 20.250.23.224:19386] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adaMxmQ3CidOGkmVXZgjNgAAAMk"]
[Thu Apr 09 01:13:44.400380 2026] [:error] [pid 40055:tid 40154] [client 20.250.23.224:24694] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adaMyH_5SjAJycOw5k-7IwAAAJg"]
[Thu Apr 09 01:13:46.063811 2026] [:error] [pid 22056:tid 22071] [client 20.250.23.224:51562] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adaMymQ3CidOGkmVXZgjQgAAAM0"]
[Thu Apr 09 01:13:50.713627 2026] [:error] [pid 40054:tid 40116] [client 20.250.23.224:63938] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adaMzqymwSVk3s67lDd9CgAAARE"]
[Thu Apr 09 01:13:55.616102 2026] [:error] [pid 40055:tid 40142] [client 20.250.23.224:31566] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/html.php"] [unique_id "adaM03_5SjAJycOw5k-7LAAAAIw"]
[Thu Apr 09 01:14:00.091038 2026] [:error] [pid 22056:tid 22072] [client 20.250.23.224:19370] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/html.php"] [unique_id "adaM2GQ3CidOGkmVXZgjcQAAAM4"]
[Thu Apr 09 01:14:02.457306 2026] [:error] [pid 40055:tid 40154] [client 20.250.23.224:10328] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/html.php"] [unique_id "adaM2n_5SjAJycOw5k-7TAAAAJg"]
[Thu Apr 09 01:14:05.513449 2026] [:error] [pid 40054:tid 40098] [client 20.250.23.224:10358] [client 20.250.23.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/html.php"] [unique_id "adaM3aymwSVk3s67lDd9HQAAAQA"]
[Thu Apr 09 04:31:49.793342 2026] [:error] [pid 20537:tid 20618] [client 43.130.141.193:39898] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ada7NcSTjpSeyrxLmN74bAAAAJQ"]
[Thu Apr 09 06:42:06.598653 2026] [:error] [pid 20641:tid 20660] [client 49.235.136.28:47200] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adbZvm3LksBSF-6rlkZ_yQAAAM8"]
[Thu Apr 09 07:49:47.002550 2026] [:error] [pid 20535:tid 20556] [client 43.135.211.148:41552] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adbpmgWiD9hWnEUHWdNqtwAAAAw"]
[Thu Apr 09 08:42:03.415719 2026] [:error] [pid 20536:tid 20577] [client 20.63.32.44:45252] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 08:42:03.623724 2026] [:error] [pid 20536:tid 20582] [client 20.63.32.44:45252] File does not exist: /usr/local/apache/htdocs/suspended-page/shadow-bot.php
[Thu Apr 09 08:42:03.831295 2026] [:error] [pid 20536:tid 20591] [client 20.63.32.44:45252] File does not exist: /usr/local/apache/htdocs/suspended-page/zxcs.php
[Thu Apr 09 08:42:04.039289 2026] [:error] [pid 20536:tid 20580] [client 20.63.32.44:45252] File does not exist: /usr/local/apache/htdocs/suspended-page/btx25.php
[Thu Apr 09 08:42:04.249396 2026] [:error] [pid 20536:tid 20575] [client 20.63.32.44:45252] File does not exist: /usr/local/apache/htdocs/suspended-page/ca-022.php
[Thu Apr 09 08:42:04.459261 2026] [:error] [pid 20536:tid 20581] [client 20.63.32.44:45252] File does not exist: /usr/local/apache/htdocs/suspended-page/rnenu.php
[Thu Apr 09 08:42:04.666964 2026] [:error] [pid 20536:tid 20595] [client 20.63.32.44:45252] File does not exist: /usr/local/apache/htdocs/suspended-page/fallbackapi.php
[Thu Apr 09 09:38:14.696181 2026] [:error] [pid 31629:tid 31653] [client 20.63.32.44:19857] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 09:38:14.905793 2026] [:error] [pid 31629:tid 31632] [client 20.63.32.44:19857] File does not exist: /usr/local/apache/htdocs/suspended-page/shadow-bot.php
[Thu Apr 09 09:38:15.115308 2026] [:error] [pid 31629:tid 31649] [client 20.63.32.44:19857] File does not exist: /usr/local/apache/htdocs/suspended-page/zxcs.php
[Thu Apr 09 09:38:15.325100 2026] [:error] [pid 31629:tid 31647] [client 20.63.32.44:19857] File does not exist: /usr/local/apache/htdocs/suspended-page/btx25.php
[Thu Apr 09 09:38:15.533924 2026] [:error] [pid 31629:tid 31650] [client 20.63.32.44:19857] File does not exist: /usr/local/apache/htdocs/suspended-page/ca-022.php
[Thu Apr 09 09:38:15.743718 2026] [:error] [pid 31629:tid 31653] [client 20.63.32.44:19857] File does not exist: /usr/local/apache/htdocs/suspended-page/rnenu.php
[Thu Apr 09 09:38:15.955799 2026] [:error] [pid 31629:tid 31632] [client 20.63.32.44:19857] File does not exist: /usr/local/apache/htdocs/suspended-page/fallbackapi.php
[Thu Apr 09 12:50:14.772354 2026] [:error] [pid 24517:tid 24576] [client 101.42.46.71:43086] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adcwBnboYEn2ZFM_PS8xtwAAAII"]
[Thu Apr 09 13:26:34.336954 2026] [:error] [pid 24517:tid 24593] [client 170.106.72.93:56116] [client 170.106.72.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adc4inboYEn2ZFM_PS859QAAAJM"]
[Thu Apr 09 15:24:26.999035 2026] [:error] [pid 24516:tid 24548] [client 43.131.45.213:50722] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "addUKthW7vSS-UkeWCUB_AAAAEE"]
[Thu Apr 09 18:20:45.352324 2026] [:error] [pid 24927:tid 24932] [client 129.226.213.145:37326] [client 129.226.213.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "add9fTXObuzEuw8mNJvvuQAAAQI"]
[Thu Apr 09 18:41:07.616088 2026] [:error] [pid 20837:tid 20840] [client 4.232.89.114:64934] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeCQ_SL71FHZkjrGzPMtQAAAYE"]
[Thu Apr 09 18:41:08.125322 2026] [:error] [pid 24516:tid 24549] [client 4.232.89.114:64478] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeCRNhW7vSS-UkeWCUgLwAAAEI"]
[Thu Apr 09 18:41:08.728924 2026] [:error] [pid 24927:tid 24949] [client 4.232.89.114:64413] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adeCRDXObuzEuw8mNJv5dgAAARM"]
[Thu Apr 09 18:41:10.412064 2026] [:error] [pid 24516:tid 24559] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/xfile25.php
[Thu Apr 09 18:41:10.647925 2026] [:error] [pid 24516:tid 24560] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Thu Apr 09 18:41:10.886270 2026] [:error] [pid 24516:tid 24564] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/azs.php
[Thu Apr 09 18:41:11.121588 2026] [:error] [pid 24516:tid 24566] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Thu Apr 09 18:41:11.372929 2026] [:error] [pid 24516:tid 24561] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/awa.php
[Thu Apr 09 18:41:11.608781 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Thu Apr 09 18:41:13.182725 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/popo.php
[Thu Apr 09 18:41:13.464326 2026] [:error] [pid 24516:tid 24568] [client 4.232.89.114:64918] File does not exist: /usr/local/apache/htdocs/suspended-page/syndicate.php
[Thu Apr 09 18:41:13.696981 2026] [:error] [pid 24516:tid 24563] [client 4.232.89.114:64918] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "adeCSdhW7vSS-UkeWCUgOgAAAFA"]
[Thu Apr 09 18:41:34.119339 2026] [:error] [pid 24516:tid 24547] [client 4.232.89.114:64976] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "adeCXthW7vSS-UkeWCUgQQAAAEA"]
[Thu Apr 09 18:41:34.830620 2026] [:error] [pid 24927:tid 24938] [client 4.232.89.114:64481] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "adeCXjXObuzEuw8mNJv6TwAAAQg"]
[Thu Apr 09 18:41:35.586961 2026] [:error] [pid 18477:tid 18494] [client 4.232.89.114:65018] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "adeCX8De826HlFeoLPJ9iAAAAU8"]
[Thu Apr 09 18:41:36.064180 2026] [:error] [pid 24927:tid 24949] [client 4.232.89.114:64499] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "adeCYDXObuzEuw8mNJv6YAAAARM"]
[Thu Apr 09 18:41:36.591090 2026] [:error] [pid 24516:tid 24549] [client 4.232.89.114:64930] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxx.php"] [unique_id "adeCYNhW7vSS-UkeWCUgQgAAAEI"]
[Thu Apr 09 18:41:37.107263 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:63812] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxx.php"] [unique_id "adeCYa1OMnvM2fMnB1N-8AAAAAc"]
[Thu Apr 09 18:41:37.585055 2026] [:error] [pid 24515:tid 24538] [client 4.232.89.114:64457] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxx.php"] [unique_id "adeCYa1OMnvM2fMnB1N-8QAAABM"]
[Thu Apr 09 18:41:38.211079 2026] [:error] [pid 24517:tid 24597] [client 4.232.89.114:65007] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-cxx.php"] [unique_id "adeCYnboYEn2ZFM_PS9yjwAAAJc"]
[Thu Apr 09 18:41:38.790960 2026] [:error] [pid 24516:tid 24560] [client 4.232.89.114:64463] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "adeCYthW7vSS-UkeWCUgRgAAAE0"]
[Thu Apr 09 18:41:39.334619 2026] [:error] [pid 24927:tid 24930] [client 4.232.89.114:64443] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "adeCYzXObuzEuw8mNJv6fQAAAQA"]
[Thu Apr 09 18:41:39.810026 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:64461] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "adeCYzXObuzEuw8mNJv6jgAAAQ8"]
[Thu Apr 09 18:41:40.350770 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:64437] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "adeCZK1OMnvM2fMnB1N-9gAAAAk"]
[Thu Apr 09 18:41:40.962754 2026] [:error] [pid 24515:tid 24520] [client 4.232.89.114:64417] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adeCZK1OMnvM2fMnB1N-9wAAAAE"]
[Thu Apr 09 18:41:41.547988 2026] [:error] [pid 24515:tid 24525] [client 4.232.89.114:65014] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adeCZa1OMnvM2fMnB1N--QAAAAY"]
[Thu Apr 09 18:41:42.057678 2026] [:error] [pid 24515:tid 24536] [client 4.232.89.114:64947] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adeCZq1OMnvM2fMnB1N--wAAABE"]
[Thu Apr 09 18:41:42.563127 2026] [:error] [pid 24515:tid 24530] [client 4.232.89.114:64415] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adeCZq1OMnvM2fMnB1N-_AAAAAs"]
[Thu Apr 09 18:41:43.076004 2026] [:error] [pid 24515:tid 24543] [client 4.232.89.114:64935] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adeCZ61OMnvM2fMnB1N-_QAAABg"]
[Thu Apr 09 18:41:43.541804 2026] [:error] [pid 24927:tid 24938] [client 4.232.89.114:64438] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adeCZzXObuzEuw8mNJv6twAAAQg"]
[Thu Apr 09 18:41:44.088029 2026] [:error] [pid 24516:tid 24565] [client 4.232.89.114:64489] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adeCaNhW7vSS-UkeWCUgUQAAAFI"]
[Thu Apr 09 18:41:44.611170 2026] [:error] [pid 24927:tid 24940] [client 4.232.89.114:63830] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adeCaDXObuzEuw8mNJv6xAAAAQo"]
[Thu Apr 09 18:41:45.154960 2026] [:error] [pid 24927:tid 24952] [client 4.232.89.114:64424] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "adeCaTXObuzEuw8mNJv6yQAAARY"]
[Thu Apr 09 18:41:45.648390 2026] [:error] [pid 24927:tid 24946] [client 4.232.89.114:64902] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "adeCaTXObuzEuw8mNJv6ygAAARA"]
[Thu Apr 09 18:41:46.209052 2026] [:error] [pid 24515:tid 24537] [client 4.232.89.114:64421] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "adeCaq1OMnvM2fMnB1N_AAAAABI"]
[Thu Apr 09 18:41:46.686196 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:64503] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "adeCajXObuzEuw8mNJv6zgAAAQ4"]
[Thu Apr 09 18:41:47.173244 2026] [:error] [pid 24927:tid 24936] [client 4.232.89.114:64959] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "adeCazXObuzEuw8mNJv60QAAAQY"]
[Thu Apr 09 18:41:47.746692 2026] [:error] [pid 24927:tid 24937] [client 4.232.89.114:64486] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "adeCazXObuzEuw8mNJv61AAAAQc"]
[Thu Apr 09 18:41:48.229808 2026] [:error] [pid 24515:tid 24534] [client 4.232.89.114:64970] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "adeCbK1OMnvM2fMnB1N_AgAAAA8"]
[Thu Apr 09 18:41:48.932825 2026] [:error] [pid 24927:tid 24938] [client 4.232.89.114:64482] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "adeCbDXObuzEuw8mNJv62gAAAQg"]
[Thu Apr 09 18:41:49.458818 2026] [:error] [pid 20837:tid 20862] [client 4.232.89.114:64988] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "adeCbfSL71FHZkjrGzPM2AAAAZc"]
[Thu Apr 09 18:41:49.944733 2026] [:error] [pid 24927:tid 24942] [client 4.232.89.114:65008] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "adeCbTXObuzEuw8mNJv63gAAAQw"]
[Thu Apr 09 18:41:50.451706 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:65016] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "adeCbjXObuzEuw8mNJv65AAAARc"]
[Thu Apr 09 18:41:50.954872 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:64418] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "adeCbjXObuzEuw8mNJv65gAAARI"]
[Thu Apr 09 18:41:51.439078 2026] [:error] [pid 24927:tid 24941] [client 4.232.89.114:64968] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "adeCbzXObuzEuw8mNJv66wAAAQs"]
[Thu Apr 09 18:41:51.983049 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:64992] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "adeCbzXObuzEuw8mNJv67gAAAQ8"]
[Thu Apr 09 18:41:52.558628 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:64491] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "adeCcK1OMnvM2fMnB1N_DAAAABU"]
[Thu Apr 09 18:41:53.032306 2026] [:error] [pid 24624:tid 24650] [client 4.232.89.114:64459] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "adeCce4Jn-WvK1ZBTvi6vAAAANg"]
[Thu Apr 09 18:41:53.558723 2026] [:error] [pid 24515:tid 24530] [client 4.232.89.114:64468] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "adeCca1OMnvM2fMnB1N_EgAAAAs"]
[Thu Apr 09 18:41:54.158674 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:64407] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "adeCcu4Jn-WvK1ZBTvi6vwAAAMU"]
[Thu Apr 09 18:41:54.656491 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:63828] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "adeCcq1OMnvM2fMnB1N_FQAAAAg"]
[Thu Apr 09 18:41:55.267619 2026] [:error] [pid 18477:tid 18480] [client 4.232.89.114:64509] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "adeCc8De826HlFeoLPJ9sAAAAUE"]
[Thu Apr 09 18:41:55.752938 2026] [:error] [pid 18477:tid 18489] [client 4.232.89.114:65001] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adeCc8De826HlFeoLPJ9swAAAUo"]
[Thu Apr 09 18:41:56.289435 2026] [:error] [pid 24927:tid 24936] [client 4.232.89.114:64385] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adeCdDXObuzEuw8mNJv6-AAAAQY"]
[Thu Apr 09 18:41:56.881709 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:64967] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adeCdDXObuzEuw8mNJv6-wAAARc"]
[Thu Apr 09 18:41:57.417068 2026] [:error] [pid 24516:tid 24552] [client 4.232.89.114:63168] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adeCddhW7vSS-UkeWCUgWgAAAEU"]
[Thu Apr 09 18:41:57.939191 2026] [:error] [pid 24927:tid 24941] [client 4.232.89.114:64948] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "adeCdTXObuzEuw8mNJv7BAAAAQs"]
[Thu Apr 09 18:41:58.407165 2026] [:error] [pid 18477:tid 18494] [client 4.232.89.114:64411] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "adeCdsDe826HlFeoLPJ9uAAAAU8"]
[Thu Apr 09 18:41:58.932890 2026] [:error] [pid 18477:tid 18482] [client 4.232.89.114:64909] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "adeCdsDe826HlFeoLPJ9uQAAAUM"]
[Thu Apr 09 18:41:59.515867 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:64395] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "adeCdzXObuzEuw8mNJv7CwAAARI"]
[Thu Apr 09 18:42:00.015524 2026] [:error] [pid 20837:tid 20842] [client 4.232.89.114:64975] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "adeCePSL71FHZkjrGzPM3QAAAYM"]
[Thu Apr 09 18:42:00.555012 2026] [:error] [pid 24515:tid 24541] [client 4.232.89.114:64954] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "adeCeK1OMnvM2fMnB1N_GwAAABY"]
[Thu Apr 09 18:42:01.083465 2026] [:error] [pid 24516:tid 24567] [client 4.232.89.114:64467] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "adeCedhW7vSS-UkeWCUgXgAAAFQ"]
[Thu Apr 09 18:42:01.628317 2026] [:error] [pid 20837:tid 20856] [client 4.232.89.114:63826] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "adeCefSL71FHZkjrGzPM3gAAAZE"]
[Thu Apr 09 18:42:02.173010 2026] [:error] [pid 24927:tid 24934] [client 4.232.89.114:64474] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "adeCejXObuzEuw8mNJv7FAAAAQQ"]
[Thu Apr 09 18:42:02.640567 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:64897] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "adeCejXObuzEuw8mNJv7FgAAARc"]
[Thu Apr 09 18:42:03.124907 2026] [:error] [pid 20837:tid 20855] [client 4.232.89.114:64453] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "adeCe_SL71FHZkjrGzPM4QAAAZA"]
[Thu Apr 09 18:42:03.657956 2026] [:error] [pid 20837:tid 20848] [client 4.232.89.114:64991] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "adeCe_SL71FHZkjrGzPM5AAAAYk"]
[Thu Apr 09 18:42:04.140321 2026] [:error] [pid 20837:tid 20845] [client 4.232.89.114:63777] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "adeCfPSL71FHZkjrGzPM6AAAAYY"]
[Thu Apr 09 18:42:04.613092 2026] [:error] [pid 24515:tid 24529] [client 4.232.89.114:64974] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "adeCfK1OMnvM2fMnB1N_JQAAAAo"]
[Thu Apr 09 18:42:05.088482 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:63824] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "adeCfa1OMnvM2fMnB1N_JwAAAAc"]
[Thu Apr 09 18:42:05.621515 2026] [:error] [pid 24927:tid 24950] [client 4.232.89.114:64397] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "adeCfTXObuzEuw8mNJv7GQAAARQ"]
[Thu Apr 09 18:42:06.088014 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:64434] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adeCfjXObuzEuw8mNJv7GwAAAQ4"]
[Thu Apr 09 18:42:06.719720 2026] [:error] [pid 18477:tid 18490] [client 4.232.89.114:64928] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adeCfsDe826HlFeoLPJ9vQAAAUs"]
[Thu Apr 09 18:42:07.189406 2026] [:error] [pid 24624:tid 24646] [client 4.232.89.114:65002] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adeCf-4Jn-WvK1ZBTvi6zwAAANQ"]
[Thu Apr 09 18:42:07.710726 2026] [:error] [pid 24927:tid 24931] [client 4.232.89.114:64955] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adeCfzXObuzEuw8mNJv7IQAAAQE"]
[Thu Apr 09 18:42:08.182027 2026] [:error] [pid 24624:tid 24642] [client 4.232.89.114:64961] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "adeCgO4Jn-WvK1ZBTvi60wAAANA"]
[Thu Apr 09 18:42:08.782950 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:64940] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "adeCgDXObuzEuw8mNJv7IwAAARc"]
[Thu Apr 09 18:42:09.280904 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:64938] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "adeCga1OMnvM2fMnB1N_KwAAABU"]
[Thu Apr 09 18:42:09.746631 2026] [:error] [pid 18477:tid 18493] [client 4.232.89.114:64962] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "adeCgcDe826HlFeoLPJ9xAAAAU4"]
[Thu Apr 09 18:42:10.258118 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:64500] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adeCgjXObuzEuw8mNJv7KQAAAQ4"]
[Thu Apr 09 18:42:10.908788 2026] [:error] [pid 18477:tid 18494] [client 4.232.89.114:64979] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adeCgsDe826HlFeoLPJ9zAAAAU8"]
[Thu Apr 09 18:42:11.423393 2026] [:error] [pid 24515:tid 24531] [client 4.232.89.114:65010] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adeCg61OMnvM2fMnB1N_MgAAAAw"]
[Thu Apr 09 18:42:11.917406 2026] [:error] [pid 18477:tid 18484] [client 4.232.89.114:64983] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adeCg8De826HlFeoLPJ90AAAAUU"]
[Thu Apr 09 18:42:12.426668 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:64907] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "adeChO4Jn-WvK1ZBTvi61wAAAME"]
[Thu Apr 09 18:42:12.924457 2026] [:error] [pid 24624:tid 24632] [client 4.232.89.114:64511] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "adeChO4Jn-WvK1ZBTvi63AAAAMY"]
[Thu Apr 09 18:42:13.406428 2026] [:error] [pid 20837:tid 20846] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Thu Apr 09 18:42:13.647465 2026] [:error] [pid 20837:tid 20848] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Thu Apr 09 18:42:13.978043 2026] [:error] [pid 20837:tid 20858] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Thu Apr 09 18:42:14.215127 2026] [:error] [pid 20837:tid 20851] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Thu Apr 09 18:42:14.454492 2026] [:error] [pid 20837:tid 20863] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Thu Apr 09 18:42:14.690849 2026] [:error] [pid 20837:tid 20847] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Thu Apr 09 18:42:14.976033 2026] [:error] [pid 20837:tid 20843] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Thu Apr 09 18:42:15.215008 2026] [:error] [pid 20837:tid 20839] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/.mopj.php
[Thu Apr 09 18:42:15.496831 2026] [:error] [pid 20837:tid 20854] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Thu Apr 09 18:42:15.765093 2026] [:error] [pid 20837:tid 20842] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/nano.php
[Thu Apr 09 18:42:16.001443 2026] [:error] [pid 20837:tid 20849] [client 4.232.89.114:64406] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_S.php
[Thu Apr 09 18:42:16.234098 2026] [:error] [pid 20837:tid 20855] [client 4.232.89.114:64406] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adeCiPSL71FHZkjrGzPNCwAAAZA"]
[Thu Apr 09 18:42:16.751962 2026] [:error] [pid 24515:tid 24524] [client 4.232.89.114:63222] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adeCiK1OMnvM2fMnB1N_PwAAAAU"]
[Thu Apr 09 18:42:17.271011 2026] [:error] [pid 24927:tid 24933] [client 4.232.89.114:64485] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adeCiTXObuzEuw8mNJv7MQAAAQM"]
[Thu Apr 09 18:42:17.859182 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:64398] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "adeCiTXObuzEuw8mNJv7MwAAAQI"]
[Thu Apr 09 18:42:18.367974 2026] [:error] [pid 24927:tid 24930] [client 4.232.89.114:64447] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adeCijXObuzEuw8mNJv7OAAAAQA"]
[Thu Apr 09 18:42:18.925016 2026] [:error] [pid 24927:tid 24942] [client 4.232.89.114:64455] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adeCijXObuzEuw8mNJv7OgAAAQw"]
[Thu Apr 09 18:42:19.466582 2026] [:error] [pid 24927:tid 24952] [client 4.232.89.114:64442] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adeCizXObuzEuw8mNJv7PQAAARY"]
[Thu Apr 09 18:42:19.947059 2026] [:error] [pid 20837:tid 20861] [client 4.232.89.114:64982] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "adeCi_SL71FHZkjrGzPNEQAAAZY"]
[Thu Apr 09 18:42:20.426020 2026] [:error] [pid 24516:tid 24571] [client 4.232.89.114:64900] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adeCjNhW7vSS-UkeWCUgcwAAAFg"]
[Thu Apr 09 18:42:20.904623 2026] [:error] [pid 24515:tid 24519] [client 4.232.89.114:64396] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adeCjK1OMnvM2fMnB1N_RgAAAAA"]
[Thu Apr 09 18:42:21.412217 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:65021] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adeCje4Jn-WvK1ZBTvi67wAAAMA"]
[Thu Apr 09 18:42:21.890560 2026] [:error] [pid 18477:tid 18481] [client 4.232.89.114:64402] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "adeCjcDe826HlFeoLPJ90wAAAUI"]
[Thu Apr 09 18:42:22.388246 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:64399] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adeCjsDe826HlFeoLPJ91QAAAVg"]
[Thu Apr 09 18:42:22.945966 2026] [:error] [pid 24624:tid 24647] [client 4.232.89.114:63811] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adeCju4Jn-WvK1ZBTvi69gAAANU"]
[Thu Apr 09 18:42:23.462508 2026] [:error] [pid 24516:tid 24560] [client 4.232.89.114:64966] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adeCj9hW7vSS-UkeWCUgeQAAAE0"]
[Thu Apr 09 18:42:24.049495 2026] [:error] [pid 24516:tid 24547] [client 4.232.89.114:63862] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adeCkNhW7vSS-UkeWCUgewAAAEA"]
[Thu Apr 09 18:42:24.556597 2026] [:error] [pid 24517:tid 24583] [client 4.232.89.114:64387] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adeCkHboYEn2ZFM_PS9ynwAAAIk"]
[Thu Apr 09 18:42:25.081858 2026] [:error] [pid 24517:tid 24584] [client 4.232.89.114:64960] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adeCkXboYEn2ZFM_PS9yoQAAAIo"]
[Thu Apr 09 18:42:25.771279 2026] [:error] [pid 24515:tid 24524] [client 4.232.89.114:63809] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adeCka1OMnvM2fMnB1N_TQAAAAU"]
[Thu Apr 09 18:42:26.261774 2026] [:error] [pid 20837:tid 20845] [client 4.232.89.114:64427] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adeCkvSL71FHZkjrGzPNIAAAAYY"]
[Thu Apr 09 18:42:26.766426 2026] [:error] [pid 18477:tid 18488] [client 4.232.89.114:64436] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adeCksDe826HlFeoLPJ92gAAAUk"]
[Thu Apr 09 18:42:27.238863 2026] [:error] [pid 24927:tid 24940] [client 4.232.89.114:64986] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adeCkzXObuzEuw8mNJv7ZQAAAQo"]
[Thu Apr 09 18:42:27.769828 2026] [:error] [pid 18477:tid 18496] [client 4.232.89.114:64422] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adeCk8De826HlFeoLPJ93wAAAVE"]
[Thu Apr 09 18:42:28.301091 2026] [:error] [pid 24927:tid 24936] [client 4.232.89.114:63759] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "adeClDXObuzEuw8mNJv7bwAAAQY"]
[Thu Apr 09 18:42:28.852540 2026] [:error] [pid 24515:tid 24541] [client 4.232.89.114:64493] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adeClK1OMnvM2fMnB1N_TwAAABY"]
[Thu Apr 09 18:42:29.335537 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:63109] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adeClTXObuzEuw8mNJv7dgAAAQ8"]
[Thu Apr 09 18:42:29.808923 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:63799] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adeCla1OMnvM2fMnB1N_UQAAAAg"]
[Thu Apr 09 18:42:30.367844 2026] [:error] [pid 24927:tid 24940] [client 4.232.89.114:64393] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "adeCljXObuzEuw8mNJv7ewAAAQo"]
[Thu Apr 09 18:42:30.888895 2026] [:error] [pid 24927:tid 24941] [client 4.232.89.114:64441] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adeCljXObuzEuw8mNJv7gQAAAQs"]
[Thu Apr 09 18:42:31.418919 2026] [:error] [pid 24624:tid 24644] [client 4.232.89.114:64937] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adeCl-4Jn-WvK1ZBTvi7AAAAANI"]
[Thu Apr 09 18:42:31.984554 2026] [:error] [pid 24517:tid 24595] [client 4.232.89.114:64408] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adeCl3boYEn2ZFM_PS9ypwAAAJU"]
[Thu Apr 09 18:42:32.471542 2026] [:error] [pid 20837:tid 20853] [client 4.232.89.114:63198] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "adeCmPSL71FHZkjrGzPNJgAAAY4"]
[Thu Apr 09 18:42:33.044208 2026] [:error] [pid 20837:tid 20859] [client 4.232.89.114:63181] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adeCmfSL71FHZkjrGzPNKAAAAZQ"]
[Thu Apr 09 18:42:33.546487 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:64456] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adeCmcDe826HlFeoLPJ95AAAAVU"]
[Thu Apr 09 18:42:34.097801 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:64943] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adeCmjXObuzEuw8mNJv7mQAAAQI"]
[Thu Apr 09 18:42:34.564164 2026] [:error] [pid 24927:tid 24951] [client 4.232.89.114:64472] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adeCmjXObuzEuw8mNJv7oAAAARU"]
[Thu Apr 09 18:42:35.043482 2026] [:error] [pid 24927:tid 24937] [client 4.232.89.114:64448] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adeCmzXObuzEuw8mNJv7owAAAQc"]
[Thu Apr 09 18:42:35.595844 2026] [:error] [pid 24517:tid 24596] [client 4.232.89.114:64506] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adeCm3boYEn2ZFM_PS9yqgAAAJY"]
[Thu Apr 09 18:42:36.100917 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:64963] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adeCnK1OMnvM2fMnB1N_WgAAAAc"]
[Thu Apr 09 18:42:36.609625 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:64392] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "adeCnMDe826HlFeoLPJ96AAAAVI"]
[Thu Apr 09 18:42:37.299993 2026] [:error] [pid 24927:tid 24934] [client 4.232.89.114:63829] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adeCnTXObuzEuw8mNJv7rgAAAQQ"]
[Thu Apr 09 18:42:37.809725 2026] [:error] [pid 18477:tid 18499] [client 4.232.89.114:64910] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adeCncDe826HlFeoLPJ97gAAAVQ"]
[Thu Apr 09 18:42:38.295183 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:64470] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adeCnjXObuzEuw8mNJv7twAAAQU"]
[Thu Apr 09 18:42:38.825712 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:64898] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "adeCnsDe826HlFeoLPJ99QAAAVM"]
[Thu Apr 09 18:42:39.301968 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:64949] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adeCn8De826HlFeoLPJ9-QAAAVU"]
[Thu Apr 09 18:42:39.858615 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:64498] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adeCn8De826HlFeoLPJ9-wAAAVI"]
[Thu Apr 09 18:42:40.395615 2026] [:error] [pid 24927:tid 24946] [client 4.232.89.114:64510] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adeCoDXObuzEuw8mNJv7xAAAARA"]
[Thu Apr 09 18:42:40.928775 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:64906] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adeCoDXObuzEuw8mNJv7yQAAAQU"]
[Thu Apr 09 18:42:41.500419 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:63786] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "adeCoe4Jn-WvK1ZBTvi7DQAAAMA"]
[Thu Apr 09 18:42:41.983921 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:64404] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "adeCoTXObuzEuw8mNJv70gAAAQI"]
[Thu Apr 09 18:42:42.468315 2026] [:error] [pid 24927:tid 24943] [client 4.232.89.114:65022] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "adeCojXObuzEuw8mNJv72AAAAQ0"]
[Thu Apr 09 18:42:43.056149 2026] [:error] [pid 24517:tid 24582] [client 4.232.89.114:64431] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "adeCo3boYEn2ZFM_PS9ysAAAAIg"]
[Thu Apr 09 18:42:43.588111 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:64389] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "adeCozXObuzEuw8mNJv74QAAARc"]
[Thu Apr 09 18:42:44.141162 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:64403] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "adeCpMDe826HlFeoLPJ9_wAAAVM"]
[Thu Apr 09 18:42:44.612691 2026] [:error] [pid 24927:tid 24933] [client 4.232.89.114:64942] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "adeCpDXObuzEuw8mNJv76AAAAQM"]
[Thu Apr 09 18:42:45.194282 2026] [:error] [pid 24517:tid 24578] [client 4.232.89.114:63785] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "adeCpXboYEn2ZFM_PS9ytQAAAIQ"]
[Thu Apr 09 18:42:45.727351 2026] [:error] [pid 24516:tid 24562] [client 4.232.89.114:63817] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adeCpdhW7vSS-UkeWCUghgAAAE8"]
[Thu Apr 09 18:42:46.253819 2026] [:error] [pid 24517:tid 24595] [client 4.232.89.114:64452] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adeCpnboYEn2ZFM_PS9yuQAAAJU"]
[Thu Apr 09 18:42:46.777018 2026] [:error] [pid 24927:tid 24942] [client 4.232.89.114:64978] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adeCpjXObuzEuw8mNJv79AAAAQw"]
[Thu Apr 09 18:42:47.282094 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:63822] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adeCp8De826HlFeoLPJ-BQAAAVU"]
[Thu Apr 09 18:42:47.809443 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:64997] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeCp-4Jn-WvK1ZBTvi7GwAAAMU"]
[Thu Apr 09 18:42:48.480672 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:64908] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeCqMDe826HlFeoLPJ-CAAAAVI"]
[Thu Apr 09 18:42:48.974533 2026] [:error] [pid 18477:tid 18502] [client 4.232.89.114:63846] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeCqMDe826HlFeoLPJ-DgAAAVc"]
[Thu Apr 09 18:42:49.500769 2026] [:error] [pid 18477:tid 18495] [client 4.232.89.114:64912] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeCqcDe826HlFeoLPJ-EgAAAVA"]
[Thu Apr 09 18:42:50.082045 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:64924] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adeCqsDe826HlFeoLPJ-FAAAAVU"]
[Thu Apr 09 18:42:50.551451 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:64384] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adeCqsDe826HlFeoLPJ-FgAAAVg"]
[Thu Apr 09 18:42:51.031291 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:64430] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adeCqzXObuzEuw8mNJv8AgAAAQU"]
[Thu Apr 09 18:42:51.543107 2026] [:error] [pid 24927:tid 24954] [client 4.232.89.114:63194] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "adeCqzXObuzEuw8mNJv8BgAAARg"]
[Thu Apr 09 18:42:52.097104 2026] [:error] [pid 24927:tid 24934] [client 4.232.89.114:64458] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adeCrDXObuzEuw8mNJv8CwAAAQQ"]
[Thu Apr 09 18:42:52.563562 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:63798] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adeCrDXObuzEuw8mNJv8DwAAAQU"]
[Thu Apr 09 18:42:53.044177 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:64945] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adeCre4Jn-WvK1ZBTvi7IgAAAMA"]
[Thu Apr 09 18:42:53.580993 2026] [:error] [pid 24927:tid 24934] [client 4.232.89.114:63851] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "adeCrTXObuzEuw8mNJv8FQAAAQQ"]
[Thu Apr 09 18:42:54.050949 2026] [:error] [pid 20837:tid 20847] [client 4.232.89.114:64409] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adeCrvSL71FHZkjrGzPNLwAAAYg"]
[Thu Apr 09 18:42:54.544849 2026] [:error] [pid 24927:tid 24947] [client 4.232.89.114:62656] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adeCrjXObuzEuw8mNJv8GgAAARE"]
[Thu Apr 09 18:42:55.215083 2026] [:error] [pid 24927:tid 24931] [client 4.232.89.114:63775] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adeCrzXObuzEuw8mNJv8HwAAAQE"]
[Thu Apr 09 18:42:55.731849 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:64454] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "adeCrzXObuzEuw8mNJv8IwAAARc"]
[Thu Apr 09 18:42:56.328318 2026] [:error] [pid 18477:tid 18501] [client 4.232.89.114:64933] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adeCsMDe826HlFeoLPJ-IgAAAVY"]
[Thu Apr 09 18:42:56.817069 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:64440] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adeCsDXObuzEuw8mNJv8LgAAARI"]
[Thu Apr 09 18:42:57.314533 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:64977] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adeCscDe826HlFeoLPJ-JgAAAVI"]
[Thu Apr 09 18:42:57.808108 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:63752] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "adeCsTXObuzEuw8mNJv8NAAAAQ4"]
[Thu Apr 09 18:42:58.293505 2026] [:error] [pid 24927:tid 24947] [client 4.232.89.114:63753] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adeCsjXObuzEuw8mNJv8NgAAARE"]
[Thu Apr 09 18:42:58.793231 2026] [:error] [pid 18477:tid 18490] [client 4.232.89.114:64965] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adeCssDe826HlFeoLPJ-KwAAAUs"]
[Thu Apr 09 18:42:59.285801 2026] [:error] [pid 18477:tid 18485] [client 4.232.89.114:64465] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adeCs8De826HlFeoLPJ-MAAAAUY"]
[Thu Apr 09 18:42:59.833332 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:63212] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "adeCszXObuzEuw8mNJv8QAAAAQ4"]
[Thu Apr 09 18:43:00.303592 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:63834] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adeCtDXObuzEuw8mNJv8QQAAAQI"]
[Thu Apr 09 18:43:00.816145 2026] [:error] [pid 24927:tid 24942] [client 4.232.89.114:64505] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adeCtDXObuzEuw8mNJv8RwAAAQw"]
[Thu Apr 09 18:43:01.315047 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:64936] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adeCtcDe826HlFeoLPJ-MwAAAVg"]
[Thu Apr 09 18:43:01.799479 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:63225] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "adeCtcDe826HlFeoLPJ-NgAAAVM"]
[Thu Apr 09 18:43:02.312333 2026] [:error] [pid 24515:tid 24538] [client 4.232.89.114:64401] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adeCtq1OMnvM2fMnB1N_agAAABM"]
[Thu Apr 09 18:43:02.832223 2026] [:error] [pid 24516:tid 24561] [client 4.232.89.114:64941] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adeCtthW7vSS-UkeWCUghwAAAE4"]
[Thu Apr 09 18:43:03.312797 2026] [:error] [pid 24624:tid 24630] [client 4.232.89.114:64508] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adeCt-4Jn-WvK1ZBTvi7KAAAAMQ"]
[Thu Apr 09 18:43:03.895199 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:63185] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adeCtzXObuzEuw8mNJv8VgAAAQI"]
[Thu Apr 09 18:43:04.423733 2026] [:error] [pid 24927:tid 24936] [client 4.232.89.114:64932] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adeCuDXObuzEuw8mNJv8WgAAAQY"]
[Thu Apr 09 18:43:04.893186 2026] [:error] [pid 24927:tid 24933] [client 4.232.89.114:64899] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adeCuDXObuzEuw8mNJv8WwAAAQM"]
[Thu Apr 09 18:43:05.362410 2026] [:error] [pid 18477:tid 18493] [client 4.232.89.114:64420] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adeCucDe826HlFeoLPJ-PAAAAU4"]
[Thu Apr 09 18:43:05.939763 2026] [:error] [pid 24927:tid 24939] [client 4.232.89.114:64914] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adeCuTXObuzEuw8mNJv8ZQAAAQk"]
[Thu Apr 09 18:43:06.524848 2026] [:error] [pid 20837:tid 20843] [client 4.232.89.114:63219] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeCuvSL71FHZkjrGzPNNAAAAYQ"]
[Thu Apr 09 18:43:07.026569 2026] [:error] [pid 24927:tid 24942] [client 4.232.89.114:64445] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeCuzXObuzEuw8mNJv8bAAAAQw"]
[Thu Apr 09 18:43:07.704996 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:63853] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeCuzXObuzEuw8mNJv8dAAAAQ4"]
[Thu Apr 09 18:43:08.212187 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:64496] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeCvO4Jn-WvK1ZBTvi7LQAAAMU"]
[Thu Apr 09 18:43:08.706659 2026] [:error] [pid 18477:tid 18495] [client 4.232.89.114:63863] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adeCvMDe826HlFeoLPJ-QwAAAVA"]
[Thu Apr 09 18:43:09.231682 2026] [:error] [pid 18477:tid 18487] [client 4.232.89.114:63211] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adeCvcDe826HlFeoLPJ-RQAAAUg"]
[Thu Apr 09 18:43:09.726568 2026] [:error] [pid 20837:tid 20845] [client 4.232.89.114:63833] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adeCvfSL71FHZkjrGzPNNgAAAYY"]
[Thu Apr 09 18:43:10.234306 2026] [:error] [pid 24624:tid 24643] [client 4.232.89.114:63756] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "adeCvu4Jn-WvK1ZBTvi7NQAAANE"]
[Thu Apr 09 18:43:10.741461 2026] [:error] [pid 20837:tid 20851] [client 4.232.89.114:64390] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adeCvvSL71FHZkjrGzPNOwAAAYw"]
[Thu Apr 09 18:43:11.298721 2026] [:error] [pid 24516:tid 24552] [client 4.232.89.114:64905] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adeCv9hW7vSS-UkeWCUgjQAAAEU"]
[Thu Apr 09 18:43:11.784429 2026] [:error] [pid 24517:tid 24592] [client 4.232.89.114:64426] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adeCv3boYEn2ZFM_PS9ywgAAAJI"]
[Thu Apr 09 18:43:12.271529 2026] [:error] [pid 24516:tid 24549] [client 4.232.89.114:63774] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adeCwNhW7vSS-UkeWCUgjwAAAEI"]
[Thu Apr 09 18:43:12.752898 2026] [:error] [pid 24517:tid 24587] [client 4.232.89.114:64989] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adeCwHboYEn2ZFM_PS9yxQAAAI0"]
[Thu Apr 09 18:43:13.261041 2026] [:error] [pid 24515:tid 24538] [client 4.232.89.114:63839] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adeCwa1OMnvM2fMnB1N_egAAABM"]
[Thu Apr 09 18:43:13.827335 2026] [:error] [pid 24515:tid 24530] [client 4.232.89.114:64490] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adeCwa1OMnvM2fMnB1N_gAAAAAs"]
[Thu Apr 09 18:43:14.317652 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:63770] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "adeCwq1OMnvM2fMnB1N_ggAAAAg"]
[Thu Apr 09 18:43:15.163866 2026] [:error] [pid 24624:tid 24628] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Thu Apr 09 18:43:15.420118 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 09 18:43:15.758964 2026] [:error] [pid 24624:tid 24641] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Apr 09 18:43:15.995823 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 09 18:43:16.234671 2026] [:error] [pid 24624:tid 24640] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 09 18:43:16.755630 2026] [:error] [pid 24624:tid 24649] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Thu Apr 09 18:43:16.992507 2026] [:error] [pid 24624:tid 24650] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Thu Apr 09 18:43:17.252485 2026] [:error] [pid 24624:tid 24646] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Thu Apr 09 18:43:17.489295 2026] [:error] [pid 24624:tid 24645] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Thu Apr 09 18:43:17.731222 2026] [:error] [pid 24624:tid 24633] [client 4.232.89.114:63746] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Thu Apr 09 18:43:17.965555 2026] [:error] [pid 24624:tid 24648] [client 4.232.89.114:63746] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adeCxe4Jn-WvK1ZBTvi7SwAAANY"]
[Thu Apr 09 18:43:18.443191 2026] [:error] [pid 20837:tid 20839] [client 4.232.89.114:64953] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adeCxvSL71FHZkjrGzPNQwAAAYA"]
[Thu Apr 09 18:43:18.953072 2026] [:error] [pid 20837:tid 20844] [client 4.232.89.114:63108] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adeCxvSL71FHZkjrGzPNRQAAAYU"]
[Thu Apr 09 18:43:19.585881 2026] [:error] [pid 18477:tid 18490] [client 4.232.89.114:64903] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adeCx8De826HlFeoLPJ-TgAAAUs"]
[Thu Apr 09 18:43:20.222805 2026] [:error] [pid 18477:tid 18502] [client 4.232.89.114:63124] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "adeCyMDe826HlFeoLPJ-UAAAAVc"]
[Thu Apr 09 18:43:20.790116 2026] [:error] [pid 18477:tid 18485] [client 4.232.89.114:64944] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "adeCyMDe826HlFeoLPJ-UgAAAUY"]
[Thu Apr 09 18:43:21.287460 2026] [:error] [pid 24516:tid 24567] [client 4.232.89.114:64488] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "adeCydhW7vSS-UkeWCUgmQAAAFQ"]
[Thu Apr 09 18:43:21.830985 2026] [:error] [pid 24516:tid 24561] [client 4.232.89.114:64939] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "adeCydhW7vSS-UkeWCUgngAAAE4"]
[Thu Apr 09 18:43:22.609763 2026] [:error] [pid 24516:tid 24566] [client 4.232.89.114:64484] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "adeCythW7vSS-UkeWCUgpAAAAFM"]
[Thu Apr 09 18:43:23.106352 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:64996] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "adeCy8De826HlFeoLPJ-WAAAAVg"]
[Thu Apr 09 18:43:23.646667 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:64497] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "adeCyzXObuzEuw8mNJv8kQAAARI"]
[Thu Apr 09 18:43:24.239182 2026] [:error] [pid 24927:tid 24949] [client 4.232.89.114:63853] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "adeCzDXObuzEuw8mNJv8lAAAARM"]
[Thu Apr 09 18:43:24.723990 2026] [:error] [pid 18477:tid 18492] [client 4.232.89.114:63158] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "adeCzMDe826HlFeoLPJ-XgAAAU0"]
[Thu Apr 09 18:43:25.224902 2026] [:error] [pid 20837:tid 20842] [client 4.232.89.114:63193] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "adeCzfSL71FHZkjrGzPNVgAAAYM"]
[Thu Apr 09 18:43:25.714109 2026] [:error] [pid 24516:tid 24568] [client 4.232.89.114:63789] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "adeCzdhW7vSS-UkeWCUgpwAAAFU"]
[Thu Apr 09 18:43:26.207636 2026] [:error] [pid 18477:tid 18480] [client 4.232.89.114:63832] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "adeCzsDe826HlFeoLPJ-agAAAUE"]
[Thu Apr 09 18:43:26.764501 2026] [:error] [pid 24927:tid 24952] [client 4.232.89.114:64913] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "adeCzjXObuzEuw8mNJv8nAAAARY"]
[Thu Apr 09 18:43:27.325311 2026] [:error] [pid 24517:tid 24577] [client 4.232.89.114:63813] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "adeCz3boYEn2ZFM_PS9yzQAAAIM"]
[Thu Apr 09 18:43:27.873626 2026] [:error] [pid 18477:tid 18495] [client 4.232.89.114:63749] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "adeCz8De826HlFeoLPJ-bQAAAVA"]
[Thu Apr 09 18:43:28.509807 2026] [:error] [pid 18477:tid 18501] [client 4.232.89.114:63178] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "adeC0MDe826HlFeoLPJ-cQAAAVY"]
[Thu Apr 09 18:43:29.087869 2026] [:error] [pid 18477:tid 18491] [client 4.232.89.114:63207] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adeC0cDe826HlFeoLPJ-cgAAAUw"]
[Thu Apr 09 18:43:29.567512 2026] [:error] [pid 18477:tid 18496] [client 4.232.89.114:64984] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adeC0cDe826HlFeoLPJ-dAAAAVE"]
[Thu Apr 09 18:43:30.065672 2026] [:error] [pid 24624:tid 24642] [client 4.232.89.114:63843] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adeC0u4Jn-WvK1ZBTvi7VQAAANA"]
[Thu Apr 09 18:43:30.624652 2026] [:error] [pid 24624:tid 24641] [client 4.232.89.114:62040] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adeC0u4Jn-WvK1ZBTvi7WQAAAM8"]
[Thu Apr 09 18:43:31.108440 2026] [:error] [pid 24624:tid 24640] [client 4.232.89.114:62607] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adeC0-4Jn-WvK1ZBTvi7WgAAAM4"]
[Thu Apr 09 18:43:31.604914 2026] [:error] [pid 24517:tid 24584] [client 4.232.89.114:64994] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "adeC03boYEn2ZFM_PS9y0QAAAIo"]
[Thu Apr 09 18:43:55.895140 2026] [:error] [pid 24517:tid 24578] [client 4.232.89.114:63171] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeC63boYEn2ZFM_PS9y8AAAAIQ"]
[Thu Apr 09 18:43:57.155657 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:64973] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeC7e4Jn-WvK1ZBTvi7gAAAAMU"]
[Thu Apr 09 18:43:57.752561 2026] [:error] [pid 24516:tid 24548] [client 4.232.89.114:62682] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeC7dhW7vSS-UkeWCUgxQAAAEE"]
[Thu Apr 09 18:43:58.291297 2026] [:error] [pid 24624:tid 24637] [client 4.232.89.114:64993] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "adeC7u4Jn-WvK1ZBTvi7iAAAAMs"]
[Thu Apr 09 18:43:58.823184 2026] [:error] [pid 18477:tid 18491] [client 4.232.89.114:65012] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC7sDe826HlFeoLPJ-tgAAAUw"]
[Thu Apr 09 18:43:59.408777 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:63810] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC7-4Jn-WvK1ZBTvi7iwAAAMA"]
[Thu Apr 09 18:44:00.039959 2026] [:error] [pid 20837:tid 20853] [client 4.232.89.114:65018] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC8PSL71FHZkjrGzPNfQAAAY4"]
[Thu Apr 09 18:44:00.593842 2026] [:error] [pid 24927:tid 24947] [client 4.232.89.114:64904] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC8DXObuzEuw8mNJv8-wAAARE"]
[Thu Apr 09 18:44:01.269721 2026] [:error] [pid 18477:tid 18489] [client 4.232.89.114:64957] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adeC8cDe826HlFeoLPJ-vwAAAUo"]
[Thu Apr 09 18:44:01.803550 2026] [:error] [pid 24927:tid 24939] [client 4.232.89.114:64915] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adeC8TXObuzEuw8mNJv9AwAAAQk"]
[Thu Apr 09 18:44:02.369842 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:63201] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adeC8sDe826HlFeoLPJ-xgAAAVg"]
[Thu Apr 09 18:44:02.902514 2026] [:error] [pid 18477:tid 18502] [client 4.232.89.114:64435] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "adeC8sDe826HlFeoLPJ-ygAAAVc"]
[Thu Apr 09 18:44:03.444367 2026] [:error] [pid 18477:tid 18483] [client 4.232.89.114:64483] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adeC88De826HlFeoLPJ-zgAAAUQ"]
[Thu Apr 09 18:44:03.973158 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:63815] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adeC89hW7vSS-UkeWCUgyQAAAEs"]
[Thu Apr 09 18:44:04.455295 2026] [:error] [pid 18477:tid 18480] [client 4.232.89.114:63748] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adeC9MDe826HlFeoLPJ-1wAAAUE"]
[Thu Apr 09 18:44:05.191689 2026] [:error] [pid 20837:tid 20858] [client 4.232.89.114:64911] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "adeC9fSL71FHZkjrGzPNjgAAAZM"]
[Thu Apr 09 18:44:05.739700 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:63808] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC9TXObuzEuw8mNJv9DQAAARI"]
[Thu Apr 09 18:44:06.286459 2026] [:error] [pid 24927:tid 24951] [client 4.232.89.114:63776] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC9jXObuzEuw8mNJv9DgAAARU"]
[Thu Apr 09 18:44:06.819679 2026] [:error] [pid 24624:tid 24641] [client 4.232.89.114:63229] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC9u4Jn-WvK1ZBTvi7lAAAAM8"]
[Thu Apr 09 18:44:07.320900 2026] [:error] [pid 24624:tid 24629] [client 4.232.89.114:63754] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "adeC9-4Jn-WvK1ZBTvi7lwAAAMM"]
[Thu Apr 09 18:44:07.909415 2026] [:error] [pid 24517:tid 24590] [client 4.232.89.114:64444] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adeC93boYEn2ZFM_PS9zBQAAAJA"]
[Thu Apr 09 18:44:08.406824 2026] [:error] [pid 24927:tid 24936] [client 4.232.89.114:63107] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adeC-DXObuzEuw8mNJv9GwAAAQY"]
[Thu Apr 09 18:44:08.923845 2026] [:error] [pid 24927:tid 24937] [client 4.232.89.114:62659] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adeC-DXObuzEuw8mNJv9HQAAAQc"]
[Thu Apr 09 18:44:09.407526 2026] [:error] [pid 24927:tid 24952] [client 4.232.89.114:64449] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adeC-TXObuzEuw8mNJv9IgAAARY"]
[Thu Apr 09 18:44:09.926668 2026] [:error] [pid 18477:tid 18482] [client 4.232.89.114:64410] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adeC-cDe826HlFeoLPJ-7wAAAUM"]
[Thu Apr 09 18:44:10.405614 2026] [:error] [pid 18477:tid 18491] [client 4.232.89.114:63845] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adeC-sDe826HlFeoLPJ-8wAAAUw"]
[Thu Apr 09 18:44:10.990488 2026] [:error] [pid 24927:tid 24930] [client 4.232.89.114:64998] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adeC-jXObuzEuw8mNJv9KAAAAQA"]
[Thu Apr 09 18:44:11.474424 2026] [:error] [pid 18477:tid 18487] [client 4.232.89.114:64433] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "adeC-8De826HlFeoLPJ--wAAAUg"]
[Thu Apr 09 18:44:11.941025 2026] [:error] [pid 24927:tid 24950] [client 4.232.89.114:64446] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adeC-zXObuzEuw8mNJv9LwAAARQ"]
[Thu Apr 09 18:44:12.444085 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:63745] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adeC_MDe826HlFeoLPJ_AwAAAVU"]
[Thu Apr 09 18:44:13.472282 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:63793] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adeC_TXObuzEuw8mNJv9NgAAARI"]
[Thu Apr 09 18:44:13.944418 2026] [:error] [pid 24927:tid 24952] [client 4.232.89.114:64428] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "adeC_TXObuzEuw8mNJv9OwAAARY"]
[Thu Apr 09 18:44:14.435337 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:63196] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adeC_u4Jn-WvK1ZBTvi7ngAAAMA"]
[Thu Apr 09 18:44:14.917289 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:63111] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adeC_jXObuzEuw8mNJv9QAAAAQU"]
[Thu Apr 09 18:44:15.386279 2026] [:error] [pid 24624:tid 24640] [client 4.232.89.114:65017] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adeC_-4Jn-WvK1ZBTvi7oAAAAM4"]
[Thu Apr 09 18:44:15.907706 2026] [:error] [pid 24927:tid 24950] [client 4.232.89.114:64922] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "adeC_zXObuzEuw8mNJv9QgAAARQ"]
[Thu Apr 09 18:44:16.391161 2026] [:error] [pid 24624:tid 24639] [client 4.232.89.114:63146] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "adeDAO4Jn-WvK1ZBTvi7oQAAAM0"]
[Thu Apr 09 18:44:16.905115 2026] [:error] [pid 24516:tid 24555] [client 4.232.89.114:64950] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "adeDANhW7vSS-UkeWCUg7wAAAEg"]
[Thu Apr 09 18:44:17.454394 2026] [:error] [pid 24515:tid 24537] [client 4.232.89.114:63213] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Thu Apr 09 18:44:17.777312 2026] [:error] [pid 24515:tid 24543] [client 4.232.89.114:63213] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Thu Apr 09 18:44:18.015120 2026] [:error] [pid 24515:tid 24520] [client 4.232.89.114:63213] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Apr 09 18:44:18.282110 2026] [:error] [pid 24515:tid 24534] [client 4.232.89.114:63213] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Thu Apr 09 18:44:18.547317 2026] [:error] [pid 24515:tid 24535] [client 4.232.89.114:63213] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Apr 09 18:44:20.392666 2026] [:error] [pid 24515:tid 24538] [client 4.232.89.114:63213] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Thu Apr 09 18:44:20.871070 2026] [:error] [pid 24515:tid 24524] [client 4.232.89.114:63213] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Thu Apr 09 18:44:21.106946 2026] [:error] [pid 24515:tid 24521] [client 4.232.89.114:63213] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adeDBa1OMnvM2fMnB1OAPQAAAAI"]
[Thu Apr 09 18:44:21.603921 2026] [:error] [pid 24516:tid 24560] [client 4.232.89.114:63764] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adeDBdhW7vSS-UkeWCUg-gAAAE0"]
[Thu Apr 09 18:44:22.117634 2026] [:error] [pid 24516:tid 24564] [client 4.232.89.114:63838] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adeDBthW7vSS-UkeWCUg_gAAAFE"]
[Thu Apr 09 18:44:22.595405 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:64405] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adeDBjXObuzEuw8mNJv9XAAAARI"]
[Thu Apr 09 18:44:23.069742 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:64429] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adeDB61OMnvM2fMnB1OARgAAAAc"]
[Thu Apr 09 18:44:23.565400 2026] [:error] [pid 20837:tid 20856] [client 4.232.89.114:63769] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adeDB_SL71FHZkjrGzPNoQAAAZE"]
[Thu Apr 09 18:44:24.034665 2026] [:error] [pid 20837:tid 20839] [client 4.232.89.114:63865] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adeDCPSL71FHZkjrGzPNpQAAAYA"]
[Thu Apr 09 18:44:24.569335 2026] [:error] [pid 24927:tid 24943] [client 4.232.89.114:63867] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "adeDCDXObuzEuw8mNJv9YwAAAQ0"]
[Thu Apr 09 18:44:25.046093 2026] [:error] [pid 24927:tid 24950] [client 4.232.89.114:64921] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeDCTXObuzEuw8mNJv9aAAAARQ"]
[Thu Apr 09 18:44:25.562760 2026] [:error] [pid 24624:tid 24629] [client 4.232.89.114:62024] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeDCe4Jn-WvK1ZBTvi7qgAAAMM"]
[Thu Apr 09 18:44:26.159347 2026] [:error] [pid 18477:tid 18481] [client 4.232.89.114:63179] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeDCsDe826HlFeoLPJ_JAAAAUI"]
[Thu Apr 09 18:44:26.641729 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:63159] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "adeDCsDe826HlFeoLPJ_KQAAAVU"]
[Thu Apr 09 18:44:27.140755 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:63172] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adeDC8De826HlFeoLPJ_LgAAAVg"]
[Thu Apr 09 18:44:27.703369 2026] [:error] [pid 24515:tid 24536] [client 4.232.89.114:63747] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adeDC61OMnvM2fMnB1OASAAAABE"]
[Thu Apr 09 18:44:28.193951 2026] [:error] [pid 24927:tid 24930] [client 4.232.89.114:65005] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adeDDDXObuzEuw8mNJv9cgAAAQA"]
[Thu Apr 09 18:44:28.902799 2026] [:error] [pid 24927:tid 24941] [client 4.232.89.114:64981] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adeDDDXObuzEuw8mNJv9dAAAAQs"]
[Thu Apr 09 18:44:29.426989 2026] [:error] [pid 24927:tid 24933] [client 4.232.89.114:63149] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adeDDTXObuzEuw8mNJv9eAAAAQM"]
[Thu Apr 09 18:44:29.949163 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:63772] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adeDDa1OMnvM2fMnB1OASgAAABU"]
[Thu Apr 09 18:44:30.451677 2026] [:error] [pid 24927:tid 24941] [client 4.232.89.114:62654] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adeDDjXObuzEuw8mNJv9hQAAAQs"]
[Thu Apr 09 18:44:30.969380 2026] [:error] [pid 24927:tid 24934] [client 4.232.89.114:63197] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "adeDDjXObuzEuw8mNJv9iQAAAQQ"]
[Thu Apr 09 18:44:31.483522 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:63788] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adeDDzXObuzEuw8mNJv9jAAAAQ8"]
[Thu Apr 09 18:44:32.120703 2026] [:error] [pid 24927:tid 24937] [client 4.232.89.114:63773] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adeDEDXObuzEuw8mNJv9lQAAAQc"]
[Thu Apr 09 18:44:32.883762 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:63837] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adeDEDXObuzEuw8mNJv9mwAAARc"]
[Thu Apr 09 18:44:33.506769 2026] [:error] [pid 18477:tid 18496] [client 4.232.89.114:63132] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adeDEcDe826HlFeoLPJ_PwAAAVE"]
[Thu Apr 09 18:44:33.976878 2026] [:error] [pid 24624:tid 24645] [client 4.232.89.114:62599] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adeDEe4Jn-WvK1ZBTvi7qwAAANM"]
[Thu Apr 09 18:44:34.488167 2026] [:error] [pid 18477:tid 18493] [client 4.232.89.114:64439] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adeDEsDe826HlFeoLPJ_SAAAAU4"]
[Thu Apr 09 18:44:34.966585 2026] [:error] [pid 20837:tid 20850] [client 4.232.89.114:64414] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adeDEvSL71FHZkjrGzPNtAAAAYs"]
[Thu Apr 09 18:44:35.741256 2026] [:error] [pid 18477:tid 18502] [client 4.232.89.114:63783] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "adeDE8De826HlFeoLPJ_UgAAAVc"]
[Thu Apr 09 18:44:36.209794 2026] [:error] [pid 24927:tid 24950] [client 4.232.89.114:64985] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adeDFDXObuzEuw8mNJv9rAAAARQ"]
[Thu Apr 09 18:44:36.736710 2026] [:error] [pid 24515:tid 24535] [client 4.232.89.114:62602] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adeDFK1OMnvM2fMnB1OAUAAAABA"]
[Thu Apr 09 18:44:37.252469 2026] [:error] [pid 24516:tid 24548] [client 4.232.89.114:63214] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adeDFdhW7vSS-UkeWCUhLgAAAEE"]
[Thu Apr 09 18:44:37.771051 2026] [:error] [pid 24624:tid 24648] [client 4.232.89.114:63762] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "adeDFe4Jn-WvK1ZBTvi7rwAAANY"]
[Thu Apr 09 18:44:38.398954 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:63134] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "adeDFu4Jn-WvK1ZBTvi7sgAAAMA"]
[Thu Apr 09 18:44:38.896493 2026] [:error] [pid 24515:tid 24536] [client 4.232.89.114:65003] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "adeDFq1OMnvM2fMnB1OAWwAAABE"]
[Thu Apr 09 18:44:39.457726 2026] [:error] [pid 24624:tid 24641] [client 4.232.89.114:63105] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "adeDF-4Jn-WvK1ZBTvi7vwAAAM8"]
[Thu Apr 09 18:44:39.946269 2026] [:error] [pid 18477:tid 18488] [client 4.232.89.114:64925] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "adeDF8De826HlFeoLPJ_WgAAAUk"]
[Thu Apr 09 18:44:40.457782 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:64504] [client 4.232.89.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adeDGK1OMnvM2fMnB1OAXgAAAAk"]
[Thu Apr 09 18:44:40.972040 2026] [:error] [pid 24624:tid 24636] [client 4.232.89.114:62666] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "adeDGO4Jn-WvK1ZBTvi7ygAAAMo"]
[Thu Apr 09 18:44:41.436955 2026] [:error] [pid 24515:tid 24522] [client 4.232.89.114:63831] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "adeDGa1OMnvM2fMnB1OAZgAAAAM"]
[Thu Apr 09 18:44:41.904769 2026] [:error] [pid 24516:tid 24552] [client 4.232.89.114:65013] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "adeDGdhW7vSS-UkeWCUhMgAAAEU"]
[Thu Apr 09 18:44:42.450876 2026] [:error] [pid 24515:tid 24519] [client 4.232.89.114:63182] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "adeDGq1OMnvM2fMnB1OAagAAAAA"]
[Thu Apr 09 18:44:42.984477 2026] [:error] [pid 18477:tid 18479] [client 4.232.89.114:63206] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "adeDGsDe826HlFeoLPJ_XwAAAUA"]
[Thu Apr 09 18:44:43.462880 2026] [:error] [pid 18477:tid 18495] [client 4.232.89.114:63807] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "adeDG8De826HlFeoLPJ_YwAAAVA"]
[Thu Apr 09 18:44:44.014952 2026] [:error] [pid 24516:tid 24553] [client 4.232.89.114:62032] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "adeDHNhW7vSS-UkeWCUhNAAAAEY"]
[Thu Apr 09 18:44:44.482243 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:63104] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adeDHK1OMnvM2fMnB1OAcAAAAAk"]
[Thu Apr 09 18:44:44.951826 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:63779] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adeDHNhW7vSS-UkeWCUhOQAAAEs"]
[Thu Apr 09 18:44:45.444687 2026] [:error] [pid 24517:tid 24597] [client 4.232.89.114:64473] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adeDHXboYEn2ZFM_PS9zFAAAAJc"]
[Thu Apr 09 18:44:45.917637 2026] [:error] [pid 24515:tid 24529] [client 4.232.89.114:64419] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "adeDHa1OMnvM2fMnB1OAdQAAAAo"]
[Thu Apr 09 18:44:46.444666 2026] [:error] [pid 24515:tid 24533] [client 4.232.89.114:62669] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adeDHq1OMnvM2fMnB1OAdgAAAA4"]
[Thu Apr 09 18:44:46.956580 2026] [:error] [pid 24624:tid 24634] [client 4.232.89.114:63780] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adeDHu4Jn-WvK1ZBTvi77QAAAMg"]
[Thu Apr 09 18:44:47.506791 2026] [:error] [pid 18477:tid 18492] [client 4.232.89.114:63216] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adeDH8De826HlFeoLPJ_aQAAAU0"]
[Thu Apr 09 18:44:48.009990 2026] [:error] [pid 24927:tid 24949] [client 4.232.89.114:62651] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prv8.php"] [unique_id "adeDIDXObuzEuw8mNJv9xgAAARM"]
[Thu Apr 09 18:44:48.477853 2026] [:error] [pid 24624:tid 24642] [client 4.232.89.114:64464] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adeDIO4Jn-WvK1ZBTvi79QAAANA"]
[Thu Apr 09 18:44:48.982640 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:64469] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adeDIMDe826HlFeoLPJ_bwAAAVg"]
[Thu Apr 09 18:44:49.450670 2026] [:error] [pid 24927:tid 24931] [client 4.232.89.114:62620] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adeDITXObuzEuw8mNJv90QAAAQE"]
[Thu Apr 09 18:44:49.961215 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:63218] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "adeDITXObuzEuw8mNJv91AAAARI"]
[Thu Apr 09 18:44:50.490166 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:63787] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adeDIq1OMnvM2fMnB1OAgQAAABU"]
[Thu Apr 09 18:44:51.017660 2026] [:error] [pid 24517:tid 24577] [client 4.232.89.114:62643] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adeDI3boYEn2ZFM_PS9zJAAAAIM"]
[Thu Apr 09 18:44:51.493931 2026] [:error] [pid 24927:tid 24939] [client 4.232.89.114:64412] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adeDIzXObuzEuw8mNJv94QAAAQk"]
[Thu Apr 09 18:44:51.984077 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:64386] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "adeDI8De826HlFeoLPJ_dQAAAVU"]
[Thu Apr 09 18:44:52.554733 2026] [:error] [pid 18477:tid 18480] [client 4.232.89.114:63227] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adeDJMDe826HlFeoLPJ_dwAAAUE"]
[Thu Apr 09 18:44:53.056911 2026] [:error] [pid 24624:tid 24642] [client 4.232.89.114:63814] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adeDJe4Jn-WvK1ZBTvi8CgAAANA"]
[Thu Apr 09 18:44:53.622524 2026] [:error] [pid 24624:tid 24633] [client 4.232.89.114:62630] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adeDJe4Jn-WvK1ZBTvi8EAAAAMc"]
[Thu Apr 09 18:44:54.102386 2026] [:error] [pid 24624:tid 24639] [client 4.232.89.114:64507] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "adeDJu4Jn-WvK1ZBTvi8EgAAAM0"]
[Thu Apr 09 18:44:54.611925 2026] [:error] [pid 24624:tid 24647] [client 4.232.89.114:63848] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adeDJu4Jn-WvK1ZBTvi8FwAAANU"]
[Thu Apr 09 18:44:55.141597 2026] [:error] [pid 24624:tid 24636] [client 4.232.89.114:63796] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adeDJ-4Jn-WvK1ZBTvi8HwAAAMo"]
[Thu Apr 09 18:44:55.907470 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:63151] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adeDJ61OMnvM2fMnB1OAkAAAAAc"]
[Thu Apr 09 18:44:56.407138 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:64501] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "adeDKK1OMnvM2fMnB1OAkgAAABU"]
[Thu Apr 09 18:44:56.992367 2026] [:error] [pid 18477:tid 18500] [client 4.232.89.114:64388] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adeDKMDe826HlFeoLPJ_gwAAAVU"]
[Thu Apr 09 18:44:57.466752 2026] [:error] [pid 24515:tid 24521] [client 4.232.89.114:63861] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adeDKa1OMnvM2fMnB1OAlwAAAAI"]
[Thu Apr 09 18:44:58.104729 2026] [:error] [pid 24927:tid 24954] [client 4.232.89.114:64471] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adeDKjXObuzEuw8mNJv9-wAAARg"]
[Thu Apr 09 18:44:58.680458 2026] [:error] [pid 24624:tid 24638] [client 4.232.89.114:65009] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "adeDKu4Jn-WvK1ZBTvi8OQAAAMw"]
[Thu Apr 09 18:44:59.147293 2026] [:error] [pid 24515:tid 24523] [client 4.232.89.114:63170] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adeDK61OMnvM2fMnB1OAnQAAAAQ"]
[Thu Apr 09 18:44:59.622644 2026] [:error] [pid 24927:tid 24936] [client 4.232.89.114:63855] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adeDKzXObuzEuw8mNJv-BQAAAQY"]
[Thu Apr 09 18:45:00.128239 2026] [:error] [pid 24927:tid 24939] [client 4.232.89.114:63110] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adeDLDXObuzEuw8mNJv-CAAAAQk"]
[Thu Apr 09 18:45:00.644080 2026] [:error] [pid 24927:tid 24931] [client 4.232.89.114:63816] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adeDLDXObuzEuw8mNJv-DgAAAQE"]
[Thu Apr 09 18:45:01.153168 2026] [:error] [pid 24927:tid 24939] [client 4.232.89.114:62691] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adeDLTXObuzEuw8mNJv-FgAAAQk"]
[Thu Apr 09 18:45:01.679431 2026] [:error] [pid 24927:tid 24930] [client 4.232.89.114:62617] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adeDLTXObuzEuw8mNJv-HAAAAQA"]
[Thu Apr 09 18:45:02.283395 2026] [:error] [pid 24927:tid 24950] [client 4.232.89.114:63160] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adeDLjXObuzEuw8mNJv-IAAAARQ"]
[Thu Apr 09 18:45:02.839143 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:63750] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "adeDLq1OMnvM2fMnB1OAsAAAAAg"]
[Thu Apr 09 18:45:03.327280 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:63800] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adeDL8De826HlFeoLPJ_jQAAAVg"]
[Thu Apr 09 18:45:03.809374 2026] [:error] [pid 18477:tid 18486] [client 4.232.89.114:64451] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adeDL8De826HlFeoLPJ_jwAAAUc"]
[Thu Apr 09 18:45:04.356982 2026] [:error] [pid 24927:tid 24954] [client 4.232.89.114:63827] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adeDMDXObuzEuw8mNJv-KwAAARg"]
[Thu Apr 09 18:45:04.923833 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:63164] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "adeDMMDe826HlFeoLPJ_lAAAAVM"]
[Thu Apr 09 18:45:05.552760 2026] [:error] [pid 18477:tid 18482] [client 4.232.89.114:62678] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adeDMcDe826HlFeoLPJ_lgAAAUM"]
[Thu Apr 09 18:45:06.050938 2026] [:error] [pid 24516:tid 24552] [client 4.232.89.114:63175] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adeDMthW7vSS-UkeWCUhQwAAAEU"]
[Thu Apr 09 18:45:06.639733 2026] [:error] [pid 20837:tid 20849] [client 4.232.89.114:64502] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adeDMvSL71FHZkjrGzPN-QAAAYo"]
[Thu Apr 09 18:45:07.115078 2026] [:error] [pid 18477:tid 18487] [client 4.232.89.114:63205] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adeDM8De826HlFeoLPJ_mgAAAUg"]
[Thu Apr 09 18:45:07.669180 2026] [:error] [pid 18477:tid 18489] [client 4.232.89.114:64990] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adeDM8De826HlFeoLPJ_ogAAAUo"]
[Thu Apr 09 18:45:08.172180 2026] [:error] [pid 24516:tid 24553] [client 4.232.89.114:63849] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adeDNNhW7vSS-UkeWCUhRgAAAEY"]
[Thu Apr 09 18:45:08.715392 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:63125] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adeDNO4Jn-WvK1ZBTvi8VAAAAME"]
[Thu Apr 09 18:45:09.269683 2026] [:error] [pid 24516:tid 24570] [client 4.232.89.114:63763] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "adeDNdhW7vSS-UkeWCUhRwAAAFc"]
[Thu Apr 09 18:45:09.963404 2026] [:error] [pid 18477:tid 18483] [client 4.232.89.114:63760] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adeDNcDe826HlFeoLPJ_rQAAAUQ"]
[Thu Apr 09 18:45:10.469066 2026] [:error] [pid 20837:tid 20860] [client 4.232.89.114:63126] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adeDNvSL71FHZkjrGzPN_AAAAZU"]
[Thu Apr 09 18:45:10.982365 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:63180] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adeDNsDe826HlFeoLPJ_sQAAAVM"]
[Thu Apr 09 18:45:11.478795 2026] [:error] [pid 18477:tid 18482] [client 4.232.89.114:63790] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "adeDN8De826HlFeoLPJ_tQAAAUM"]
[Thu Apr 09 18:45:11.996930 2026] [:error] [pid 20837:tid 20846] [client 4.232.89.114:62056] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adeDN_SL71FHZkjrGzPN_QAAAYc"]
[Thu Apr 09 18:45:12.463632 2026] [:error] [pid 20837:tid 20848] [client 4.232.89.114:63765] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adeDOPSL71FHZkjrGzPN_gAAAYk"]
[Thu Apr 09 18:45:13.018390 2026] [:error] [pid 24516:tid 24568] [client 4.232.89.114:64929] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adeDOdhW7vSS-UkeWCUhTAAAAFU"]
[Thu Apr 09 18:45:13.501123 2026] [:error] [pid 18477:tid 18490] [client 4.232.89.114:62065] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "adeDOcDe826HlFeoLPJ_uAAAAUs"]
[Thu Apr 09 18:45:13.993919 2026] [:error] [pid 24515:tid 24519] [client 4.232.89.114:62665] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adeDOa1OMnvM2fMnB1OAwAAAAAA"]
[Thu Apr 09 18:45:14.529905 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:64394] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adeDOjXObuzEuw8mNJv-PwAAAQU"]
[Thu Apr 09 18:45:15.056377 2026] [:error] [pid 24927:tid 24946] [client 4.232.89.114:63806] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adeDOzXObuzEuw8mNJv-QgAAARA"]
[Thu Apr 09 18:45:15.571437 2026] [:error] [pid 18477:tid 18481] [client 4.232.89.114:63854] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "adeDO8De826HlFeoLPJ_vQAAAUI"]
[Thu Apr 09 18:45:16.114193 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:64980] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adeDPDXObuzEuw8mNJv-RQAAAQ8"]
[Thu Apr 09 18:45:16.611479 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:64931] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adeDPMDe826HlFeoLPJ_wQAAAVM"]
[Thu Apr 09 18:45:17.090121 2026] [:error] [pid 24927:tid 24936] [client 4.232.89.114:63767] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adeDPTXObuzEuw8mNJv-SQAAAQY"]
[Thu Apr 09 18:45:17.573610 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:62663] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "adeDPTXObuzEuw8mNJv-TAAAAQI"]
[Thu Apr 09 18:45:18.051661 2026] [:error] [pid 24927:tid 24931] [client 4.232.89.114:64917] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adeDPjXObuzEuw8mNJv-TQAAAQE"]
[Thu Apr 09 18:45:18.531114 2026] [:error] [pid 20837:tid 20840] [client 4.232.89.114:61987] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adeDPvSL71FHZkjrGzPOAAAAAYE"]
[Thu Apr 09 18:45:19.001841 2026] [:error] [pid 18477:tid 18479] [client 4.232.89.114:63192] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adeDP8De826HlFeoLPJ_xAAAAUA"]
[Thu Apr 09 18:45:19.564320 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:62706] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "adeDP8De826HlFeoLPJ_yQAAAVI"]
[Thu Apr 09 18:45:20.419709 2026] [:error] [pid 20837:tid 20863] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 09 18:45:20.656751 2026] [:error] [pid 20837:tid 20857] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Thu Apr 09 18:45:20.892543 2026] [:error] [pid 20837:tid 20842] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Thu Apr 09 18:45:21.165175 2026] [:error] [pid 20837:tid 20862] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Thu Apr 09 18:45:21.431604 2026] [:error] [pid 20837:tid 20847] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Thu Apr 09 18:45:21.669147 2026] [:error] [pid 20837:tid 20858] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Thu Apr 09 18:45:21.905602 2026] [:error] [pid 20837:tid 20841] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Thu Apr 09 18:45:22.586003 2026] [:error] [pid 20837:tid 20861] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Thu Apr 09 18:45:22.838125 2026] [:error] [pid 20837:tid 20860] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Thu Apr 09 18:45:23.084719 2026] [:error] [pid 20837:tid 20859] [client 4.232.89.114:61379] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Thu Apr 09 18:45:23.323943 2026] [:error] [pid 20837:tid 20844] [client 4.232.89.114:61379] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adeDQ_SL71FHZkjrGzPOEwAAAYU"]
[Thu Apr 09 18:45:23.806816 2026] [:error] [pid 24517:tid 24596] [client 4.232.89.114:64480] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adeDQ3boYEn2ZFM_PS9zYAAAAJY"]
[Thu Apr 09 18:45:24.317981 2026] [:error] [pid 24517:tid 24576] [client 4.232.89.114:63850] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adeDRHboYEn2ZFM_PS9zYgAAAII"]
[Thu Apr 09 18:45:24.968431 2026] [:error] [pid 24927:tid 24951] [client 4.232.89.114:64946] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adeDRDXObuzEuw8mNJv-XgAAARU"]
[Thu Apr 09 18:45:25.454719 2026] [:error] [pid 24927:tid 24948] [client 4.232.89.114:63200] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adeDRTXObuzEuw8mNJv-YwAAARI"]
[Thu Apr 09 18:45:26.119540 2026] [:error] [pid 24927:tid 24949] [client 4.232.89.114:63784] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adeDRjXObuzEuw8mNJv-aAAAARM"]
[Thu Apr 09 18:45:26.697456 2026] [:error] [pid 20837:tid 20850] [client 4.232.89.114:62658] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adeDRvSL71FHZkjrGzPOFgAAAYs"]
[Thu Apr 09 18:45:27.189562 2026] [:error] [pid 20837:tid 20857] [client 4.232.89.114:64916] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adeDR_SL71FHZkjrGzPOFwAAAZI"]
[Thu Apr 09 20:27:29.775474 2026] [:error] [pid 24515:tid 24527] [client 170.106.143.6:50750] [client 170.106.143.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adebMa1OMnvM2fMnB1OllwAAAAg"]
[Thu Apr 09 21:03:29.167664 2026] [:error] [pid 20837:tid 20859] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Apr 09 21:03:29.671862 2026] [:error] [pid 20837:tid 20844] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Apr 09 21:03:30.176743 2026] [:error] [pid 20837:tid 20845] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 09 21:03:30.785917 2026] [:error] [pid 20837:tid 20858] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 09 21:03:31.290965 2026] [:error] [pid 20837:tid 20849] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 09 21:03:31.801057 2026] [:error] [pid 20837:tid 20839] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 09 21:03:32.307501 2026] [:error] [pid 20837:tid 20859] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 09 21:03:32.812132 2026] [:error] [pid 20837:tid 20860] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Apr 09 21:03:33.821380 2026] [:error] [pid 20837:tid 20848] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Apr 09 21:03:34.324019 2026] [:error] [pid 20837:tid 20847] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Apr 09 21:03:34.831107 2026] [:error] [pid 20837:tid 20862] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 09 21:03:35.336934 2026] [:error] [pid 20837:tid 20861] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Apr 09 21:03:35.842614 2026] [:error] [pid 20837:tid 20844] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 09 21:03:36.348384 2026] [:error] [pid 20837:tid 20860] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Apr 09 21:03:36.855068 2026] [:error] [pid 20837:tid 20855] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 09 21:03:37.359769 2026] [:error] [pid 20837:tid 20856] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 09 21:03:37.864611 2026] [:error] [pid 20837:tid 20841] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 09 21:03:38.369032 2026] [:error] [pid 20837:tid 20846] [client 45.137.126.25:58423] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 09 21:03:46.598853 2026] [:error] [pid 20837:tid 20841] [client 45.137.126.25:58423] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adejsvSL71FHZkjrGzPzpwAAAYI"]
[Thu Apr 09 21:03:49.117158 2026] [:error] [pid 24515:tid 24542] [client 45.137.126.13:43759] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adejta1OMnvM2fMnB1O5JAAAABc"]
[Thu Apr 09 21:03:51.626259 2026] [:error] [pid 24515:tid 24522] [client 45.137.126.24:51135] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 09 21:03:53.133309 2026] [:error] [pid 24515:tid 24542] [client 45.137.126.24:51135] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "adejua1OMnvM2fMnB1O5MgAAABc"]
[Thu Apr 09 21:03:55.139506 2026] [:error] [pid 24515:tid 24533] [client 45.137.126.23:47623] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 09 21:03:55.638402 2026] [:error] [pid 24515:tid 24529] [client 45.137.126.23:47623] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "adeju61OMnvM2fMnB1O5WAAAAAo"]
[Thu Apr 09 21:03:57.145513 2026] [:error] [pid 24515:tid 24540] [client 45.137.126.16:29301] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Apr 09 21:03:59.655940 2026] [:error] [pid 24515:tid 24529] [client 45.137.126.16:29301] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adejv61OMnvM2fMnB1O5cgAAAAo"]
[Thu Apr 09 21:04:01.162416 2026] [:error] [pid 18477:tid 18484] [client 45.137.126.43:28159] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adejwcDe826HlFeoLPKeBgAAAUU"]
[Thu Apr 09 21:04:02.160046 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.6:45375] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adejwq1OMnvM2fMnB1O5fQAAABA"]
[Thu Apr 09 21:04:03.161344 2026] [:error] [pid 24927:tid 24935] [client 45.137.126.23:42003] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adejwzXObuzEuw8mNJskdQAAAQU"]
[Thu Apr 09 21:04:04.163690 2026] [:error] [pid 24624:tid 24635] [client 45.137.126.26:53813] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adejxO4Jn-WvK1ZBTvjdrgAAAMk"]
[Thu Apr 09 21:04:05.163849 2026] [:error] [pid 20837:tid 20862] [client 45.137.126.16:57001] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adejxfSL71FHZkjrGzPztAAAAZc"]
[Thu Apr 09 21:04:06.666495 2026] [:error] [pid 24927:tid 24934] [client 45.137.126.48:36153] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adejxjXObuzEuw8mNJskdwAAAQQ"]
[Thu Apr 09 21:04:07.671453 2026] [:error] [pid 24624:tid 24634] [client 45.137.126.12:39355] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Apr 09 21:04:08.674214 2026] [:error] [pid 24624:tid 24642] [client 45.137.126.12:39355] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "adejyO4Jn-WvK1ZBTvjdtgAAANA"]
[Thu Apr 09 21:04:10.689020 2026] [:error] [pid 18477:tid 18481] [client 45.137.126.38:28261] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adejysDe826HlFeoLPKeCgAAAUI"]
[Thu Apr 09 21:04:12.195566 2026] [:error] [pid 18477:tid 18503] [client 45.137.126.12:61795] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adejzMDe826HlFeoLPKeDAAAAVg"]
[Thu Apr 09 21:04:13.200140 2026] [:error] [pid 18477:tid 18495] [client 45.137.126.31:55201] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Apr 09 21:04:13.700675 2026] [:error] [pid 18477:tid 18502] [client 45.137.126.31:55201] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adejzcDe826HlFeoLPKeDwAAAVc"]
[Thu Apr 09 21:04:14.699711 2026] [:error] [pid 18477:tid 18490] [client 45.137.126.52:25751] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Apr 09 21:04:16.208066 2026] [:error] [pid 18477:tid 18482] [client 45.137.126.52:25751] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Apr 09 21:04:17.708467 2026] [:error] [pid 18477:tid 18485] [client 45.137.126.52:25751] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adej0cDe826HlFeoLPKeGgAAAUY"]
[Thu Apr 09 21:04:18.708713 2026] [:error] [pid 24516:tid 24552] [client 45.137.126.24:60559] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Apr 09 21:04:19.208593 2026] [:error] [pid 24516:tid 24569] [client 45.137.126.24:60559] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adej09hW7vSS-UkeWCUxfgAAAFY"]
[Thu Apr 09 21:04:20.210141 2026] [:error] [pid 24516:tid 24570] [client 45.137.126.28:42319] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Apr 09 21:04:21.209846 2026] [:error] [pid 24516:tid 24568] [client 45.137.126.28:42319] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "adej1dhW7vSS-UkeWCUxggAAAFU"]
[Thu Apr 09 21:04:22.713288 2026] [:error] [pid 24927:tid 24930] [client 45.137.126.8:22829] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adej1jXObuzEuw8mNJsklAAAAQA"]
[Thu Apr 09 21:04:24.990004 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.9:32627] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Apr 09 21:04:25.492730 2026] [:error] [pid 24515:tid 24523] [client 45.137.126.9:32627] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Apr 09 21:04:26.495979 2026] [:error] [pid 24515:tid 24540] [client 45.137.126.9:32627] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adej2q1OMnvM2fMnB1O5nAAAABU"]
[Thu Apr 09 21:04:27.998416 2026] [:error] [pid 63331:tid 63356] [client 45.137.126.10:36865] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adej2ybKfIYuVjWbE4VxXQAAAdc"]
[Thu Apr 09 21:04:29.510769 2026] [:error] [pid 24515:tid 24521] [client 45.137.126.34:50223] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adej3a1OMnvM2fMnB1O5oQAAAAI"]
[Thu Apr 09 21:04:30.511883 2026] [:error] [pid 24515:tid 24538] [client 45.137.126.48:44637] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adej3q1OMnvM2fMnB1O5owAAABM"]
[Thu Apr 09 21:04:31.523356 2026] [:error] [pid 63331:tid 63348] [client 45.137.126.53:58421] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adej3ybKfIYuVjWbE4VxaAAAAc8"]
[Thu Apr 09 21:04:33.991577 2026] [:error] [pid 18477:tid 18502] [client 45.137.126.27:37519] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Apr 09 21:04:34.490672 2026] [:error] [pid 18477:tid 18489] [client 45.137.126.27:37519] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adej4sDe826HlFeoLPKeIgAAAUo"]
[Thu Apr 09 21:04:35.489683 2026] [:error] [pid 20837:tid 20863] [client 45.137.126.20:42497] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "adej4_SL71FHZkjrGzPzzgAAAZg"]
[Thu Apr 09 21:04:36.491021 2026] [:error] [pid 24517:tid 24598] [client 45.137.126.19:40073] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adej5HboYEn2ZFM_PS-A9QAAAJg"]
[Thu Apr 09 21:04:38.507142 2026] [:error] [pid 63331:tid 63345] [client 45.137.126.19:55265] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Apr 09 21:04:39.520291 2026] [:error] [pid 63331:tid 63335] [client 45.137.126.19:55265] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Apr 09 21:04:41.535962 2026] [:error] [pid 63331:tid 63338] [client 45.137.126.19:55265] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "adej6SbKfIYuVjWbE4VxdwAAAcU"]
[Thu Apr 09 21:04:44.047495 2026] [:error] [pid 20837:tid 20859] [client 45.137.126.5:62073] [client 45.137.126.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.5, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adej7PSL71FHZkjrGzPz1QAAAZQ"]
[Thu Apr 09 21:04:44.556954 2026] [:error] [pid 20837:tid 20840] [client 45.137.126.5:62073] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Apr 09 21:04:47.069958 2026] [:error] [pid 20837:tid 20851] [client 45.137.126.5:62073] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Apr 09 21:04:47.572564 2026] [:error] [pid 20837:tid 20856] [client 45.137.126.5:62073] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Apr 09 21:04:50.082459 2026] [:error] [pid 20837:tid 20850] [client 45.137.126.5:62073] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adej8vSL71FHZkjrGzPz6AAAAYs"]
[Thu Apr 09 21:04:51.586697 2026] [:error] [pid 63331:tid 63335] [client 45.137.126.8:43589] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Apr 09 21:04:52.087137 2026] [:error] [pid 63331:tid 63337] [client 45.137.126.8:43589] [client 45.137.126.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.8, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adej9CbKfIYuVjWbE4VxhAAAAcQ"]
[Thu Apr 09 21:04:53.095776 2026] [:error] [pid 63331:tid 63346] [client 45.137.126.8:43589] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "adej9SbKfIYuVjWbE4VxhgAAAc0"]
[Thu Apr 09 21:04:56.149691 2026] [:error] [pid 24515:tid 24519] [client 45.137.126.23:61703] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Apr 09 21:04:57.154932 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.23:61703] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Apr 09 21:04:58.158630 2026] [:error] [pid 24515:tid 24534] [client 45.137.126.23:61703] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adej-q1OMnvM2fMnB1O58gAAAA8"]
[Thu Apr 09 21:04:59.169467 2026] [:error] [pid 24515:tid 24525] [client 45.137.126.29:26561] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 09 21:05:00.685125 2026] [:error] [pid 24515:tid 24522] [client 45.137.126.29:26561] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Apr 09 21:05:01.702531 2026] [:error] [pid 24515:tid 24531] [client 45.137.126.29:26561] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Apr 09 21:05:02.714764 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.29:26561] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Apr 09 21:05:03.217567 2026] [:error] [pid 24515:tid 24524] [client 45.137.126.29:26561] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adej_61OMnvM2fMnB1O5_gAAAAU"]
[Thu Apr 09 21:05:04.218467 2026] [:error] [pid 24927:tid 24945] [client 45.137.126.27:48345] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Apr 09 21:05:04.719630 2026] [:error] [pid 24927:tid 24954] [client 45.137.126.27:48345] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Apr 09 21:05:05.218798 2026] [:error] [pid 24927:tid 24950] [client 45.137.126.27:48345] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adekATXObuzEuw8mNJsktAAAARQ"]
[Thu Apr 09 21:05:07.713269 2026] [:error] [pid 63331:tid 63342] [client 45.137.126.48:51589] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Apr 09 21:05:08.712326 2026] [:error] [pid 63331:tid 63357] [client 45.137.126.48:51589] [client 45.137.126.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.48, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adekBCbKfIYuVjWbE4VxnAAAAdg"]
[Thu Apr 09 21:05:09.213602 2026] [:error] [pid 63331:tid 63353] [client 45.137.126.48:51589] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adekBSbKfIYuVjWbE4VxngAAAdQ"]
[Thu Apr 09 21:05:15.189741 2026] [:error] [pid 24517:tid 24589] [client 45.137.126.7:29169] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Apr 09 21:05:18.152162 2026] [:error] [pid 24517:tid 24574] [client 45.137.126.7:29169] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Apr 09 21:05:18.644408 2026] [:error] [pid 24517:tid 24586] [client 45.137.126.7:29169] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adekDnboYEn2ZFM_PS-BFAAAAIw"]
[Thu Apr 09 21:05:19.630893 2026] [:error] [pid 20837:tid 20850] [client 45.137.126.37:43789] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Apr 09 21:05:21.142034 2026] [:error] [pid 20837:tid 20862] [client 45.137.126.37:43789] [client 45.137.126.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.37, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adekEfSL71FHZkjrGzPz9wAAAZc"]
[Thu Apr 09 21:05:21.649165 2026] [:error] [pid 20837:tid 20839] [client 45.137.126.37:43789] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Apr 09 21:05:22.152490 2026] [:error] [pid 20837:tid 20863] [client 45.137.126.37:43789] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Apr 09 21:05:22.656246 2026] [:error] [pid 20837:tid 20842] [client 45.137.126.37:43789] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Apr 09 21:05:23.155576 2026] [:error] [pid 20837:tid 20854] [client 45.137.126.37:43789] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adekE_SL71FHZkjrGzP0AAAAAY8"]
[Thu Apr 09 21:05:24.154890 2026] [:error] [pid 63331:tid 63349] [client 45.137.126.20:34949] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Apr 09 21:05:24.652697 2026] [:error] [pid 63331:tid 63343] [client 45.137.126.20:34949] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "adekFCbKfIYuVjWbE4VxpgAAAco"]
[Thu Apr 09 21:05:26.160660 2026] [:error] [pid 63331:tid 63352] [client 45.137.126.8:57455] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Apr 09 21:05:26.660613 2026] [:error] [pid 63331:tid 63342] [client 45.137.126.8:57455] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adekFibKfIYuVjWbE4VxqgAAAck"]
[Thu Apr 09 21:05:28.667328 2026] [:error] [pid 24515:tid 24534] [client 45.137.126.6:58887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Apr 09 21:05:29.166737 2026] [:error] [pid 24515:tid 24530] [client 45.137.126.6:58887] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adekGa1OMnvM2fMnB1O6PgAAAAs"]
[Thu Apr 09 21:05:30.168195 2026] [:error] [pid 24624:tid 24634] [client 45.137.126.30:23949] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adekGu4Jn-WvK1ZBTvjdzgAAAMg"]
[Thu Apr 09 21:05:31.239219 2026] [:error] [pid 24624:tid 24635] [client 45.137.126.31:26145] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Apr 09 21:05:31.741612 2026] [:error] [pid 24624:tid 24638] [client 45.137.126.31:26145] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Apr 09 21:05:33.753306 2026] [:error] [pid 24624:tid 24627] [client 45.137.126.31:26145] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adekHe4Jn-WvK1ZBTvjd2gAAAME"]
[Thu Apr 09 21:05:35.262167 2026] [:error] [pid 20837:tid 20843] [client 45.137.126.14:31051] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adekH_SL71FHZkjrGzP0BQAAAYQ"]
[Thu Apr 09 21:05:37.762041 2026] [:error] [pid 24515:tid 24541] [client 45.137.126.25:37921] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "adekIa1OMnvM2fMnB1O6UwAAABY"]
[Thu Apr 09 21:05:38.764603 2026] [:error] [pid 18477:tid 18486] [client 45.137.126.22:22959] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Apr 09 21:05:39.769801 2026] [:error] [pid 18477:tid 18481] [client 45.137.126.22:22959] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Apr 09 21:05:40.269350 2026] [:error] [pid 18477:tid 18483] [client 45.137.126.22:22959] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adekJMDe826HlFeoLPKePAAAAUQ"]
[Thu Apr 09 21:05:41.275774 2026] [:error] [pid 24624:tid 24627] [client 45.137.126.30:37745] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Apr 09 21:05:42.285890 2026] [:error] [pid 24624:tid 24632] [client 45.137.126.30:37745] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "adekJu4Jn-WvK1ZBTvjd5gAAAMY"]
[Thu Apr 09 21:05:44.787389 2026] [:error] [pid 24624:tid 24636] [client 45.137.126.51:65233] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adekKO4Jn-WvK1ZBTvjd6wAAAMo"]
[Thu Apr 09 21:05:46.295603 2026] [:error] [pid 63331:tid 63349] [client 45.137.126.20:40823] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 09 21:05:47.803877 2026] [:error] [pid 63331:tid 63342] [client 45.137.126.20:40823] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Apr 09 21:05:48.820570 2026] [:error] [pid 63331:tid 63336] [client 45.137.126.20:40823] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Apr 09 21:05:49.319952 2026] [:error] [pid 63331:tid 63345] [client 45.137.126.20:40823] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adekLSbKfIYuVjWbE4VxzwAAAcw"]
[Thu Apr 09 21:05:50.318629 2026] [:error] [pid 24515:tid 24541] [client 45.137.126.24:56199] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adekLq1OMnvM2fMnB1O6aQAAABY"]
[Thu Apr 09 21:05:51.316426 2026] [:error] [pid 63331:tid 63354] [client 45.137.126.33:53821] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adekLybKfIYuVjWbE4Vx0AAAAdU"]
[Thu Apr 09 21:05:52.313410 2026] [:error] [pid 63331:tid 63351] [client 45.137.126.49:51051] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adekMCbKfIYuVjWbE4Vx0wAAAdI"]
[Thu Apr 09 21:05:53.319452 2026] [:error] [pid 24515:tid 24533] [client 45.137.126.34:64453] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Apr 09 21:05:53.820250 2026] [:error] [pid 24515:tid 24529] [client 45.137.126.34:64453] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adekMa1OMnvM2fMnB1O6egAAAAo"]
[Thu Apr 09 21:05:54.823832 2026] [:error] [pid 24515:tid 24540] [client 45.137.126.7:33999] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adekMq1OMnvM2fMnB1O6ggAAABU"]
[Thu Apr 09 21:05:55.831311 2026] [:error] [pid 24515:tid 24526] [client 45.137.126.16:28041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Apr 09 21:05:56.837778 2026] [:error] [pid 24515:tid 24523] [client 45.137.126.16:28041] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "adekNK1OMnvM2fMnB1O6kgAAAAQ"]
[Thu Apr 09 21:05:57.841355 2026] [:error] [pid 20837:tid 20849] [client 45.137.126.41:48475] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adekNfSL71FHZkjrGzP0CgAAAYo"]
[Thu Apr 09 21:05:58.844666 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.42:61539] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adekNq1OMnvM2fMnB1O6nQAAAAg"]
[Thu Apr 09 21:05:59.850849 2026] [:error] [pid 24927:tid 24948] [client 45.137.126.20:38551] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adekNzXObuzEuw8mNJsk1QAAARI"]
[Thu Apr 09 21:06:01.403771 2026] [:error] [pid 24624:tid 24630] [client 45.137.126.37:64959] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adekOe4Jn-WvK1ZBTvjeCQAAAMQ"]
[Thu Apr 09 21:06:03.406862 2026] [:error] [pid 63331:tid 63350] [client 45.137.126.30:37111] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adekOybKfIYuVjWbE4Vx3wAAAdE"]
[Thu Apr 09 21:06:04.411153 2026] [:error] [pid 18477:tid 18483] [client 45.137.126.24:57457] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Apr 09 21:06:05.921302 2026] [:error] [pid 18477:tid 18502] [client 45.137.126.24:57457] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Apr 09 21:06:06.421008 2026] [:error] [pid 18477:tid 18490] [client 45.137.126.24:57457] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adekPsDe826HlFeoLPKeUQAAAUs"]
[Thu Apr 09 21:06:07.930608 2026] [:error] [pid 24516:tid 24557] [client 45.137.126.37:58783] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Apr 09 21:06:08.434920 2026] [:error] [pid 24516:tid 24562] [client 45.137.126.37:58783] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Apr 09 21:06:10.947797 2026] [:error] [pid 24516:tid 24553] [client 45.137.126.37:58783] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adekQthW7vSS-UkeWCUxsAAAAEY"]
[Thu Apr 09 21:06:13.447658 2026] [:error] [pid 20837:tid 20850] [client 45.137.126.48:30513] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adekRfSL71FHZkjrGzP0GgAAAYs"]
[Thu Apr 09 21:06:14.448789 2026] [:error] [pid 24516:tid 24556] [client 45.137.126.48:21661] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adekRthW7vSS-UkeWCUxsQAAAEk"]
[Thu Apr 09 21:06:17.453315 2026] [:error] [pid 63331:tid 63347] [client 45.137.126.29:60405] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adekSSbKfIYuVjWbE4Vx_QAAAc4"]
[Thu Apr 09 21:06:19.467314 2026] [:error] [pid 18477:tid 18495] [client 45.137.126.28:22311] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Apr 09 21:06:19.974170 2026] [:error] [pid 18477:tid 18502] [client 45.137.126.28:22311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Apr 09 21:06:21.476715 2026] [:error] [pid 18477:tid 18502] [client 45.137.126.28:22311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Apr 09 21:06:21.980670 2026] [:error] [pid 18477:tid 18488] [client 45.137.126.28:22311] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Apr 09 21:06:24.502333 2026] [:error] [pid 18477:tid 18487] [client 45.137.126.28:22311] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adekUMDe826HlFeoLPKebgAAAUg"]
[Thu Apr 09 21:06:25.505109 2026] [:error] [pid 24927:tid 24953] [client 45.137.126.44:62099] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adekUTXObuzEuw8mNJsk5AAAARc"]
[Thu Apr 09 21:06:26.507336 2026] [:error] [pid 20837:tid 20855] [client 45.137.126.12:44731] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adekUvSL71FHZkjrGzP0JAAAAZA"]
[Thu Apr 09 21:06:27.508507 2026] [:error] [pid 20837:tid 20840] [client 45.137.126.22:42651] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adekU_SL71FHZkjrGzP0JwAAAYE"]
[Thu Apr 09 21:06:28.506725 2026] [:error] [pid 24515:tid 24524] [client 45.137.126.9:22405] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adekVK1OMnvM2fMnB1O7AQAAAAU"]
[Thu Apr 09 21:06:29.506477 2026] [:error] [pid 18477:tid 18499] [client 45.137.126.2:35163] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adekVcDe826HlFeoLPKecwAAAVQ"]
[Thu Apr 09 21:06:31.056154 2026] [:error] [pid 24624:tid 24631] [client 45.137.126.17:46423] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adekV-4Jn-WvK1ZBTvjeLwAAAMU"]
[Thu Apr 09 21:06:32.061974 2026] [:error] [pid 24515:tid 24528] [client 45.137.126.10:40321] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adekWK1OMnvM2fMnB1O7DwAAAAk"]
[Thu Apr 09 21:06:33.062891 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.45:57917] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adekWa1OMnvM2fMnB1O7FQAAAAg"]
[Thu Apr 09 21:06:34.060891 2026] [:error] [pid 24927:tid 24931] [client 45.137.126.19:43549] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adekWjXObuzEuw8mNJsk5wAAAQE"]
[Thu Apr 09 21:06:36.065939 2026] [:error] [pid 24516:tid 24549] [client 45.137.126.40:23495] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adekXNhW7vSS-UkeWCUxvQAAAEI"]
[Thu Apr 09 21:06:37.568104 2026] [:error] [pid 20837:tid 20854] [client 45.137.126.10:45445] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adekXfSL71FHZkjrGzP0LwAAAY8"]
[Thu Apr 09 21:06:38.576443 2026] [:error] [pid 24624:tid 24650] [client 45.137.126.17:50167] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Apr 09 21:06:39.581425 2026] [:error] [pid 24624:tid 24641] [client 45.137.126.17:50167] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adekX-4Jn-WvK1ZBTvjeOwAAAM8"]
[Thu Apr 09 21:06:41.585581 2026] [:error] [pid 20837:tid 20862] [client 45.137.126.25:40601] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "adekYfSL71FHZkjrGzP0PgAAAZc"]
[Thu Apr 09 21:06:43.600072 2026] [:error] [pid 24515:tid 24522] [client 45.137.126.37:50317] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Apr 09 21:06:44.101765 2026] [:error] [pid 24515:tid 24520] [client 45.137.126.37:50317] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adekZK1OMnvM2fMnB1O7JQAAAAE"]
[Thu Apr 09 21:06:45.603361 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.53:35317] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Apr 09 21:06:46.106405 2026] [:error] [pid 24515:tid 24528] [client 45.137.126.53:35317] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Apr 09 21:06:46.608646 2026] [:error] [pid 24515:tid 24529] [client 45.137.126.53:35317] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Apr 09 21:06:47.107505 2026] [:error] [pid 24515:tid 24539] [client 45.137.126.53:35317] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adekZ61OMnvM2fMnB1O7LQAAABQ"]
[Thu Apr 09 21:06:48.108543 2026] [:error] [pid 63331:tid 63334] [client 45.137.126.33:21531] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Apr 09 21:06:48.607653 2026] [:error] [pid 63331:tid 63343] [client 45.137.126.33:21531] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adekaCbKfIYuVjWbE4VyHQAAAco"]
[Thu Apr 09 21:06:50.620394 2026] [:error] [pid 24515:tid 24528] [client 45.137.126.2:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 09 21:06:51.124529 2026] [:error] [pid 24515:tid 24529] [client 45.137.126.2:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Apr 09 21:06:51.631971 2026] [:error] [pid 24515:tid 24533] [client 45.137.126.2:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Apr 09 21:06:54.150611 2026] [:error] [pid 24515:tid 24529] [client 45.137.126.2:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Apr 09 21:06:54.654122 2026] [:error] [pid 24515:tid 24531] [client 45.137.126.2:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Apr 09 21:06:55.661632 2026] [:error] [pid 24515:tid 24519] [client 45.137.126.2:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Apr 09 21:06:57.172330 2026] [:error] [pid 24515:tid 24520] [client 45.137.126.2:50057] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 09 21:06:57.672758 2026] [:error] [pid 24515:tid 24521] [client 45.137.126.2:50057] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adekca1OMnvM2fMnB1O7TwAAAAI"]
[Thu Apr 09 21:06:58.674267 2026] [:error] [pid 24516:tid 24550] [client 45.137.126.51:26059] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adekcthW7vSS-UkeWCUxwAAAAEM"]
[Thu Apr 09 21:06:59.678813 2026] [:error] [pid 24515:tid 24537] [client 45.137.126.6:37973] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Apr 09 21:07:00.179040 2026] [:error] [pid 24515:tid 24536] [client 45.137.126.6:37973] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adekdK1OMnvM2fMnB1O7WgAAABE"]
[Thu Apr 09 21:07:01.745367 2026] [:error] [pid 24515:tid 24541] [client 45.137.126.51:44681] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 09 21:07:02.246816 2026] [:error] [pid 24515:tid 24521] [client 45.137.126.51:44681] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adekdq1OMnvM2fMnB1O7XwAAAAI"]
[Thu Apr 09 21:07:03.243034 2026] [:error] [pid 20837:tid 20839] [client 45.137.126.20:49847] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adekd_SL71FHZkjrGzP0bwAAAYA"]
[Thu Apr 09 21:07:06.272552 2026] [:error] [pid 24517:tid 24590] [client 45.137.126.10:51949] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adekenboYEn2ZFM_PS-BNAAAAJA"]
[Thu Apr 09 21:07:07.275030 2026] [:error] [pid 63331:tid 63342] [client 45.137.126.37:42761] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "adekeybKfIYuVjWbE4VyMQAAAck"]
[Thu Apr 09 21:07:09.823724 2026] [:error] [pid 24515:tid 24528] [client 45.137.126.28:37913] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Apr 09 21:07:10.833005 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.28:37913] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adekfq1OMnvM2fMnB1O7bQAAABA"]
[Thu Apr 09 21:07:12.337382 2026] [:error] [pid 24515:tid 24537] [client 45.137.126.19:60635] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Apr 09 21:07:13.341295 2026] [:error] [pid 24515:tid 24533] [client 45.137.126.19:60635] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "adekga1OMnvM2fMnB1O7cwAAAA4"]
[Thu Apr 09 21:07:14.340837 2026] [:error] [pid 24517:tid 24575] [client 45.137.126.29:29617] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "adekgnboYEn2ZFM_PS-BNwAAAIE"]
[Thu Apr 09 21:07:15.850811 2026] [:error] [pid 24927:tid 24953] [client 45.137.126.36:32507] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Apr 09 21:07:16.351687 2026] [:error] [pid 24927:tid 24952] [client 45.137.126.36:32507] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adekhDXObuzEuw8mNJsk_gAAARY"]
[Thu Apr 09 21:07:17.354993 2026] [:error] [pid 24624:tid 24635] [client 45.137.126.21:64223] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adekhe4Jn-WvK1ZBTvjeSAAAAMk"]
[Thu Apr 09 21:07:19.358119 2026] [:error] [pid 24624:tid 24636] [client 45.137.126.27:43325] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Apr 09 21:07:19.860732 2026] [:error] [pid 24624:tid 24647] [client 45.137.126.27:43325] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Apr 09 21:07:20.864333 2026] [:error] [pid 24624:tid 24626] [client 45.137.126.27:43325] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Apr 09 21:07:21.863595 2026] [:error] [pid 24624:tid 24644] [client 45.137.126.27:43325] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adekie4Jn-WvK1ZBTvjeVQAAANI"]
[Thu Apr 09 21:07:22.862150 2026] [:error] [pid 20837:tid 20845] [client 45.137.126.53:35217] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adekivSL71FHZkjrGzP0mwAAAYY"]
[Thu Apr 09 21:07:25.383072 2026] [:error] [pid 24927:tid 24954] [client 45.137.126.13:61195] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Apr 09 21:07:25.884200 2026] [:error] [pid 24927:tid 24933] [client 45.137.126.13:61195] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "adekjTXObuzEuw8mNJslBQAAAQM"]
[Thu Apr 09 21:07:26.887851 2026] [:error] [pid 24515:tid 24532] [client 45.137.126.31:61139] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adekjq1OMnvM2fMnB1O7hgAAAA0"]
[Thu Apr 09 21:07:27.885092 2026] [:error] [pid 24516:tid 24548] [client 45.137.126.13:51591] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adekj9hW7vSS-UkeWCUxwwAAAEE"]
[Thu Apr 09 21:07:30.916411 2026] [:error] [pid 63331:tid 63346] [client 45.137.126.12:52763] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Apr 09 21:07:31.417906 2026] [:error] [pid 63331:tid 63340] [client 45.137.126.12:52763] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adekkybKfIYuVjWbE4VyUQAAAcc"]
[Thu Apr 09 21:07:32.922939 2026] [:error] [pid 63331:tid 63341] [client 45.137.126.45:23331] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adeklCbKfIYuVjWbE4VyVQAAAcg"]
[Thu Apr 09 21:07:33.927878 2026] [:error] [pid 24624:tid 24630] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Apr 09 21:07:34.431803 2026] [:error] [pid 24624:tid 24633] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Apr 09 21:07:35.440838 2026] [:error] [pid 24624:tid 24639] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Apr 09 21:07:37.451325 2026] [:error] [pid 24624:tid 24643] [client 45.137.126.42:58383] [client 45.137.126.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.42, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "adekme4Jn-WvK1ZBTvjeYwAAANE"]
[Thu Apr 09 21:07:38.463014 2026] [:error] [pid 24624:tid 24634] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Apr 09 21:07:38.966180 2026] [:error] [pid 24624:tid 24631] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Apr 09 21:07:39.469130 2026] [:error] [pid 24624:tid 24628] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Apr 09 21:07:40.474796 2026] [:error] [pid 24624:tid 24627] [client 45.137.126.42:58383] [client 45.137.126.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.42, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adeknO4Jn-WvK1ZBTvjebwAAAME"]
[Thu Apr 09 21:07:43.084323 2026] [:error] [pid 24624:tid 24650] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Apr 09 21:07:43.587077 2026] [:error] [pid 24624:tid 24632] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Apr 09 21:07:44.596205 2026] [:error] [pid 24624:tid 24646] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Apr 09 21:07:45.602440 2026] [:error] [pid 24624:tid 24638] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Apr 09 21:07:47.668995 2026] [:error] [pid 24624:tid 24645] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Apr 09 21:07:51.192927 2026] [:error] [pid 24624:tid 24630] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 09 21:07:51.695778 2026] [:error] [pid 24624:tid 24626] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Apr 09 21:07:54.212913 2026] [:error] [pid 24624:tid 24644] [client 45.137.126.42:58383] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Apr 09 21:07:55.217108 2026] [:error] [pid 24624:tid 24646] [client 45.137.126.42:58383] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adekq-4Jn-WvK1ZBTvjejQAAANQ"]
[Thu Apr 09 21:07:57.230635 2026] [:error] [pid 24624:tid 24629] [client 45.137.126.26:61615] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Apr 09 21:07:57.728844 2026] [:error] [pid 24624:tid 24636] [client 45.137.126.26:61615] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adekre4Jn-WvK1ZBTvjemQAAAMo"]
[Thu Apr 09 21:07:59.237276 2026] [:error] [pid 24515:tid 24539] [client 45.137.126.25:24967] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Apr 09 21:07:59.737930 2026] [:error] [pid 24515:tid 24522] [client 45.137.126.25:24967] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adekr61OMnvM2fMnB1O7wAAAAAM"]
[Thu Apr 09 21:08:01.748783 2026] [:error] [pid 20837:tid 20848] [client 45.137.126.16:21977] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Apr 09 21:08:02.750706 2026] [:error] [pid 20837:tid 20840] [client 45.137.126.16:21977] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Apr 09 21:08:03.756981 2026] [:error] [pid 20837:tid 20855] [client 45.137.126.16:21977] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu Apr 09 21:08:04.257524 2026] [:error] [pid 20837:tid 20850] [client 45.137.126.16:21977] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Thu Apr 09 21:08:05.258978 2026] [:error] [pid 20837:tid 20849] [client 45.137.126.16:21977] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adektfSL71FHZkjrGzP04AAAAYo"]
[Thu Apr 09 21:08:06.262117 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.14:64141] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Thu Apr 09 21:08:06.763439 2026] [:error] [pid 24515:tid 24532] [client 45.137.126.14:64141] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Thu Apr 09 21:08:07.261762 2026] [:error] [pid 24515:tid 24542] [client 45.137.126.14:64141] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adekt61OMnvM2fMnB1O74QAAABc"]
[Thu Apr 09 21:08:08.760145 2026] [:error] [pid 24624:tid 24632] [client 45.137.126.43:27999] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adekuO4Jn-WvK1ZBTvjetAAAAMY"]
[Thu Apr 09 21:08:10.261748 2026] [:error] [pid 24624:tid 24642] [client 45.137.126.41:51805] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Thu Apr 09 21:08:11.764206 2026] [:error] [pid 24624:tid 24628] [client 45.137.126.41:51805] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Thu Apr 09 21:08:12.278983 2026] [:error] [pid 24624:tid 24645] [client 45.137.126.41:51805] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Thu Apr 09 21:08:12.777350 2026] [:error] [pid 24624:tid 24635] [client 45.137.126.41:51805] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adekvO4Jn-WvK1ZBTvjevQAAAMk"]
[Thu Apr 09 21:08:13.778934 2026] [:error] [pid 24624:tid 24626] [client 45.137.126.8:33973] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adekve4Jn-WvK1ZBTvjewAAAAMA"]
[Thu Apr 09 21:08:17.311073 2026] [:error] [pid 24927:tid 24934] [client 45.137.126.45:42691] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Thu Apr 09 21:08:18.319790 2026] [:error] [pid 24927:tid 24940] [client 45.137.126.45:42691] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adekwjXObuzEuw8mNJslKAAAAQo"]
[Thu Apr 09 21:08:19.828571 2026] [:error] [pid 63331:tid 63343] [client 45.137.126.24:58701] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "adekwybKfIYuVjWbE4VyhAAAAco"]
[Thu Apr 09 21:08:21.338635 2026] [:error] [pid 63331:tid 63339] [client 45.137.126.5:58303] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Apr 09 21:08:21.843274 2026] [:error] [pid 63331:tid 63352] [client 45.137.126.5:58303] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Thu Apr 09 21:08:22.344860 2026] [:error] [pid 63331:tid 63333] [client 45.137.126.5:58303] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adekxibKfIYuVjWbE4VyjAAAAcA"]
[Thu Apr 09 21:08:23.854102 2026] [:error] [pid 20837:tid 20850] [client 45.137.126.26:23709] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Thu Apr 09 21:08:24.358453 2026] [:error] [pid 20837:tid 20851] [client 45.137.126.26:23709] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Thu Apr 09 21:08:25.375765 2026] [:error] [pid 20837:tid 20863] [client 45.137.126.26:23709] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 09 21:08:26.901396 2026] [:error] [pid 20837:tid 20841] [client 45.137.126.26:23709] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adekyvSL71FHZkjrGzP08AAAAYI"]
[Thu Apr 09 21:08:27.901173 2026] [:error] [pid 24927:tid 24949] [client 45.137.126.27:30971] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Thu Apr 09 21:08:29.405749 2026] [:error] [pid 24927:tid 24943] [client 45.137.126.27:30971] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adekzTXObuzEuw8mNJslMAAAAQ0"]
[Thu Apr 09 21:08:30.948019 2026] [:error] [pid 24624:tid 24641] [client 45.137.126.38:32247] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Thu Apr 09 21:08:32.456200 2026] [:error] [pid 24624:tid 24634] [client 45.137.126.38:32247] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Thu Apr 09 21:08:32.961688 2026] [:error] [pid 24624:tid 24631] [client 45.137.126.38:32247] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Thu Apr 09 21:08:34.783344 2026] [:error] [pid 24624:tid 24628] [client 45.137.126.38:32247] [client 45.137.126.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.38, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adek0u4Jn-WvK1ZBTvje1wAAAMI"]
[Thu Apr 09 21:08:37.303441 2026] [:error] [pid 24624:tid 24627] [client 45.137.126.38:32247] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adek1e4Jn-WvK1ZBTvje3AAAAME"]
[Thu Apr 09 21:08:38.308013 2026] [:error] [pid 24927:tid 24939] [client 45.137.126.41:21527] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Thu Apr 09 21:08:38.808279 2026] [:error] [pid 24927:tid 24950] [client 45.137.126.41:21527] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adek1jXObuzEuw8mNJslQgAAARQ"]
[Thu Apr 09 21:08:39.813439 2026] [:error] [pid 63331:tid 63346] [client 45.137.126.31:21869] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Thu Apr 09 21:08:40.821000 2026] [:error] [pid 63331:tid 63353] [client 45.137.126.31:21869] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Thu Apr 09 21:08:41.826080 2026] [:error] [pid 63331:tid 63352] [client 45.137.126.31:21869] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adek2SbKfIYuVjWbE4VymAAAAdM"]
[Thu Apr 09 21:08:43.336789 2026] [:error] [pid 24517:tid 24597] [client 45.137.126.12:22105] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Thu Apr 09 21:08:43.841083 2026] [:error] [pid 24517:tid 24579] [client 45.137.126.12:22105] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Thu Apr 09 21:08:44.343068 2026] [:error] [pid 24517:tid 24589] [client 45.137.126.12:22105] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adek3HboYEn2ZFM_PS-BSQAAAI8"]
[Thu Apr 09 21:08:45.347000 2026] [:error] [pid 63331:tid 63345] [client 45.137.126.16:30871] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adek3SbKfIYuVjWbE4VymgAAAcw"]
[Thu Apr 09 21:08:46.346940 2026] [:error] [pid 63331:tid 63337] [client 45.137.126.41:64885] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Thu Apr 09 21:08:46.848921 2026] [:error] [pid 63331:tid 63336] [client 45.137.126.41:64885] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Thu Apr 09 21:08:47.851839 2026] [:error] [pid 63331:tid 63357] [client 45.137.126.41:64885] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adek3ybKfIYuVjWbE4VypAAAAdg"]
[Thu Apr 09 21:08:48.854161 2026] [:error] [pid 63331:tid 63341] [client 45.137.126.19:43549] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Thu Apr 09 21:08:49.859141 2026] [:error] [pid 63331:tid 63344] [client 45.137.126.19:43549] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Thu Apr 09 21:08:50.359612 2026] [:error] [pid 63331:tid 63351] [client 45.137.126.19:43549] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adek4ibKfIYuVjWbE4VyrAAAAdI"]
[Thu Apr 09 21:08:51.865399 2026] [:error] [pid 20837:tid 20847] [client 45.137.126.7:53261] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "adek4_SL71FHZkjrGzP1IAAAAYg"]
[Thu Apr 09 21:08:52.861927 2026] [:error] [pid 24515:tid 24528] [client 45.137.126.34:62339] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adek5K1OMnvM2fMnB1O8CQAAAAk"]
[Thu Apr 09 21:08:53.868123 2026] [:error] [pid 24517:tid 24575] [client 45.137.126.5:44265] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adek5XboYEn2ZFM_PS-BWQAAAIE"]
[Thu Apr 09 21:08:54.869955 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.32:20479] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adek5q1OMnvM2fMnB1O8DgAAAAg"]
[Thu Apr 09 21:08:55.874201 2026] [:error] [pid 24515:tid 24525] [client 45.137.126.37:52479] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adek561OMnvM2fMnB1O8EAAAAAY"]
[Thu Apr 09 21:08:56.876135 2026] [:error] [pid 63331:tid 63356] [client 45.137.126.39:55315] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adek6CbKfIYuVjWbE4VyrgAAAdc"]
[Thu Apr 09 21:08:58.886215 2026] [:error] [pid 24515:tid 24530] [client 45.137.126.32:25731] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adek6q1OMnvM2fMnB1O8EwAAAAs"]
[Thu Apr 09 21:08:59.882968 2026] [:error] [pid 24927:tid 24951] [client 45.137.126.3:37471] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adek6zXObuzEuw8mNJslSQAAARU"]
[Thu Apr 09 21:09:00.894142 2026] [:error] [pid 24515:tid 24536] [client 45.137.126.39:27637] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adek7K1OMnvM2fMnB1O8FAAAABE"]
[Thu Apr 09 21:09:01.891083 2026] [:error] [pid 24927:tid 24949] [client 45.137.126.32:57637] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adek7TXObuzEuw8mNJslTAAAARM"]
[Thu Apr 09 21:09:02.886498 2026] [:error] [pid 24516:tid 24571] [client 45.137.126.35:56545] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adek7thW7vSS-UkeWCUySgAAAFg"]
[Thu Apr 09 21:09:03.891156 2026] [:error] [pid 24516:tid 24565] [client 45.137.126.27:60497] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Thu Apr 09 21:09:05.398302 2026] [:error] [pid 24516:tid 24551] [client 45.137.126.27:60497] [client 45.137.126.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.27, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adek8dhW7vSS-UkeWCUyUQAAAEQ"]
[Thu Apr 09 21:09:07.920381 2026] [:error] [pid 24516:tid 24549] [client 45.137.126.27:60497] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adek89hW7vSS-UkeWCUyWgAAAEI"]
[Thu Apr 09 21:09:09.933809 2026] [:error] [pid 24516:tid 24571] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Apr 09 21:09:10.437265 2026] [:error] [pid 24516:tid 24568] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Thu Apr 09 21:09:12.452167 2026] [:error] [pid 24516:tid 24567] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Thu Apr 09 21:09:12.954694 2026] [:error] [pid 24516:tid 24555] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Thu Apr 09 21:09:14.972938 2026] [:error] [pid 24516:tid 24561] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Thu Apr 09 21:09:15.474959 2026] [:error] [pid 24516:tid 24569] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Thu Apr 09 21:09:15.977160 2026] [:error] [pid 24516:tid 24571] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Thu Apr 09 21:09:16.481865 2026] [:error] [pid 24516:tid 24547] [client 45.137.126.30:34707] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Thu Apr 09 21:09:16.980841 2026] [:error] [pid 24516:tid 24559] [client 45.137.126.30:34707] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adek_NhW7vSS-UkeWCUyewAAAEw"]
[Thu Apr 09 21:09:17.981950 2026] [:error] [pid 24927:tid 24941] [client 45.137.126.7:45927] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adek_TXObuzEuw8mNJslUwAAAQs"]
[Thu Apr 09 21:09:18.986272 2026] [:error] [pid 24517:tid 24589] [client 45.137.126.29:58915] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adek_nboYEn2ZFM_PS-BXAAAAI8"]
[Thu Apr 09 21:09:20.497270 2026] [:error] [pid 24515:tid 24540] [client 45.137.126.10:24625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Thu Apr 09 21:09:21.001685 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.10:24625] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Thu Apr 09 21:09:22.011150 2026] [:error] [pid 24515:tid 24539] [client 45.137.126.10:24625] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Thu Apr 09 21:09:23.019613 2026] [:error] [pid 24515:tid 24538] [client 45.137.126.10:24625] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adelA61OMnvM2fMnB1O8LwAAABM"]
[Thu Apr 09 21:09:24.021352 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.27:62177] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adelBK1OMnvM2fMnB1O8MgAAABA"]
[Thu Apr 09 21:09:25.023083 2026] [:error] [pid 24517:tid 24591] [client 45.137.126.48:49755] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adelBXboYEn2ZFM_PS-BXgAAAJE"]
[Thu Apr 09 21:09:28.041466 2026] [:error] [pid 63331:tid 63347] [client 45.137.126.39:62043] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adelCCbKfIYuVjWbE4VyzwAAAc4"]
[Thu Apr 09 21:09:30.441250 2026] [:error] [pid 24516:tid 24553] [client 45.137.126.52:61443] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adelCthW7vSS-UkeWCUyhgAAAEY"]
[Thu Apr 09 21:09:32.445816 2026] [:error] [pid 24515:tid 24540] [client 45.137.126.11:56865] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adelDK1OMnvM2fMnB1O8RwAAABU"]
[Thu Apr 09 21:09:38.986111 2026] [:error] [pid 24624:tid 24644] [client 45.137.126.5:65345] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adelEu4Jn-WvK1ZBTvje9gAAANI"]
[Thu Apr 09 21:09:39.992813 2026] [:error] [pid 24927:tid 24947] [client 45.137.126.5:39425] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Thu Apr 09 21:09:40.497483 2026] [:error] [pid 24927:tid 24951] [client 45.137.126.5:39425] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "adelFDXObuzEuw8mNJslYQAAARU"]
[Thu Apr 09 21:09:42.511920 2026] [:error] [pid 24516:tid 24567] [client 45.137.126.24:44855] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Thu Apr 09 21:09:44.026649 2026] [:error] [pid 24516:tid 24555] [client 45.137.126.24:44855] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Thu Apr 09 21:09:44.529177 2026] [:error] [pid 24516:tid 24557] [client 45.137.126.24:44855] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "adelGNhW7vSS-UkeWCUykQAAAEo"]
[Thu Apr 09 21:09:46.539670 2026] [:error] [pid 63331:tid 63339] [client 45.137.126.28:54261] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adelGibKfIYuVjWbE4Vy8QAAAcY"]
[Thu Apr 09 21:09:49.549908 2026] [:error] [pid 24624:tid 24647] [client 45.137.126.50:64443] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adelHe4Jn-WvK1ZBTvje_wAAANU"]
[Thu Apr 09 21:09:52.554093 2026] [:error] [pid 63331:tid 63346] [client 45.137.126.17:39621] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adelICbKfIYuVjWbE4Vy_wAAAc0"]
[Thu Apr 09 21:09:54.065566 2026] [:error] [pid 63331:tid 63355] [client 45.137.126.19:22477] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Thu Apr 09 21:09:54.570320 2026] [:error] [pid 63331:tid 63349] [client 45.137.126.19:22477] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adelIibKfIYuVjWbE4VzBgAAAdA"]
[Thu Apr 09 21:09:55.570722 2026] [:error] [pid 24516:tid 24562] [client 45.137.126.15:25745] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adelI9hW7vSS-UkeWCUykgAAAE8"]
[Thu Apr 09 21:09:59.073998 2026] [:error] [pid 24624:tid 24642] [client 45.137.126.36:42001] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adelJ-4Jn-WvK1ZBTvjfDQAAANA"]
[Thu Apr 09 21:10:00.073992 2026] [:error] [pid 24517:tid 24590] [client 45.137.126.21:59997] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Thu Apr 09 21:10:02.087572 2026] [:error] [pid 24517:tid 24598] [client 45.137.126.21:59997] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Thu Apr 09 21:10:02.585943 2026] [:error] [pid 24517:tid 24575] [client 45.137.126.21:59997] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adelKnboYEn2ZFM_PS-BZwAAAIE"]
[Thu Apr 09 21:10:04.593947 2026] [:error] [pid 24515:tid 24539] [client 45.137.126.50:33553] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Thu Apr 09 21:10:05.595271 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.50:33553] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adelLa1OMnvM2fMnB1O8bQAAABA"]
[Thu Apr 09 21:10:06.598274 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.35:63217] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adelLq1OMnvM2fMnB1O8cQAAAAg"]
[Thu Apr 09 21:10:08.100319 2026] [:error] [pid 20837:tid 20845] [client 45.137.126.44:46149] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adelMPSL71FHZkjrGzP1SQAAAYY"]
[Thu Apr 09 21:10:10.106370 2026] [:error] [pid 24515:tid 24541] [client 45.137.126.49:38161] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "adelMq1OMnvM2fMnB1O8egAAABY"]
[Thu Apr 09 21:10:11.111879 2026] [:error] [pid 24927:tid 24940] [client 45.137.126.7:41347] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adelMzXObuzEuw8mNJslaQAAAQo"]
[Thu Apr 09 21:10:13.617277 2026] [:error] [pid 24927:tid 24930] [client 45.137.126.14:25949] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Thu Apr 09 21:10:16.136547 2026] [:error] [pid 24927:tid 24939] [client 45.137.126.14:25949] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "adelODXObuzEuw8mNJsldQAAAQk"]
[Thu Apr 09 21:10:18.148146 2026] [:error] [pid 24624:tid 24630] [client 45.137.126.11:52843] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/db.php"] [unique_id "adelOu4Jn-WvK1ZBTvjfEwAAAMQ"]
[Thu Apr 09 21:10:19.151194 2026] [:error] [pid 20837:tid 20847] [client 45.137.126.11:29305] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "adelO_SL71FHZkjrGzP1UQAAAYg"]
[Thu Apr 09 21:10:20.658739 2026] [:error] [pid 24515:tid 24537] [client 45.137.126.38:52497] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Thu Apr 09 21:10:21.158386 2026] [:error] [pid 24515:tid 24532] [client 45.137.126.38:52497] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adelPa1OMnvM2fMnB1O8lwAAAA0"]
[Thu Apr 09 21:10:22.658527 2026] [:error] [pid 20837:tid 20858] [client 45.137.126.52:28165] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adelPvSL71FHZkjrGzP1WwAAAZM"]
[Thu Apr 09 21:10:26.183929 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.42:22023] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adelQq1OMnvM2fMnB1O8nwAAABA"]
[Thu Apr 09 21:10:27.687160 2026] [:error] [pid 63331:tid 63348] [client 45.137.126.17:38041] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Thu Apr 09 21:10:28.186363 2026] [:error] [pid 63331:tid 63353] [client 45.137.126.17:38041] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adelRCbKfIYuVjWbE4VzGwAAAdQ"]
[Thu Apr 09 21:10:30.198757 2026] [:error] [pid 20837:tid 20842] [client 45.137.126.41:36657] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adelRvSL71FHZkjrGzP1ZAAAAYM"]
[Thu Apr 09 21:10:31.774364 2026] [:error] [pid 18477:tid 18502] [client 45.137.126.51:36425] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "adelR8De826HlFeoLPKetgAAAVc"]
[Thu Apr 09 21:10:33.283207 2026] [:error] [pid 20837:tid 20860] [client 45.137.126.6:61757] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adelSfSL71FHZkjrGzP1ZgAAAZU"]
[Thu Apr 09 21:10:34.282666 2026] [:error] [pid 24927:tid 24945] [client 45.137.126.53:52589] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "adelSjXObuzEuw8mNJsldwAAAQ8"]
[Thu Apr 09 21:10:35.281185 2026] [:error] [pid 18477:tid 18483] [client 45.137.126.12:54969] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "adelS8De826HlFeoLPKeuQAAAUQ"]
[Thu Apr 09 21:10:39.293838 2026] [:error] [pid 63331:tid 63347] [client 45.137.126.53:40897] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adelTybKfIYuVjWbE4VzLAAAAc4"]
[Thu Apr 09 21:10:41.812964 2026] [:error] [pid 24517:tid 24587] [client 45.137.126.2:26205] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "adelUXboYEn2ZFM_PS-BcgAAAI0"]
[Thu Apr 09 21:10:43.322734 2026] [:error] [pid 24927:tid 24931] [client 45.137.126.13:22247] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Thu Apr 09 21:10:43.823512 2026] [:error] [pid 24927:tid 24938] [client 45.137.126.13:22247] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "adelUzXObuzEuw8mNJslfwAAAQg"]
[Thu Apr 09 21:10:45.833062 2026] [:error] [pid 63331:tid 63335] [client 45.137.126.35:44421] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "adelVSbKfIYuVjWbE4VzMwAAAcI"]
[Thu Apr 09 21:10:46.838624 2026] [:error] [pid 24515:tid 24539] [client 45.137.126.31:53901] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Thu Apr 09 21:10:49.362344 2026] [:error] [pid 24515:tid 24519] [client 45.137.126.31:53901] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adelWa1OMnvM2fMnB1O8qwAAAAA"]
[Thu Apr 09 21:10:50.867338 2026] [:error] [pid 63331:tid 63337] [client 45.137.126.26:34757] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adelWibKfIYuVjWbE4VzOgAAAcQ"]
[Thu Apr 09 21:10:52.369223 2026] [:error] [pid 63331:tid 63355] [client 45.137.126.15:49199] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adelXCbKfIYuVjWbE4VzPgAAAdY"]
[Thu Apr 09 21:10:54.385213 2026] [:error] [pid 20837:tid 20844] [client 45.137.126.28:44797] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adelXvSL71FHZkjrGzP1cwAAAYU"]
[Thu Apr 09 21:10:59.415944 2026] [:error] [pid 63331:tid 63336] [client 45.137.126.51:48399] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adelYybKfIYuVjWbE4VzSwAAAcM"]
[Thu Apr 09 21:11:00.418428 2026] [:error] [pid 24517:tid 24580] [client 45.137.126.36:28929] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adelZHboYEn2ZFM_PS-BdQAAAIY"]
[Thu Apr 09 21:11:02.946977 2026] [:error] [pid 24516:tid 24560] [client 45.137.126.7:25109] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adelZthW7vSS-UkeWCUypQAAAE0"]
[Thu Apr 09 21:11:03.946644 2026] [:error] [pid 24517:tid 24578] [client 45.137.126.22:27689] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adelZ3boYEn2ZFM_PS-BegAAAIQ"]
[Thu Apr 09 21:11:05.960281 2026] [:error] [pid 24516:tid 24556] [client 45.137.126.7:35011] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adeladhW7vSS-UkeWCUyqQAAAEk"]
[Thu Apr 09 21:11:06.965994 2026] [:error] [pid 63331:tid 63344] [client 45.137.126.49:55751] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-file.php"] [unique_id "adelaibKfIYuVjWbE4VzUQAAAcs"]
[Thu Apr 09 21:11:07.967145 2026] [:error] [pid 63331:tid 63351] [client 45.137.126.38:63021] [client 45.137.126.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.38, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adelaybKfIYuVjWbE4VzVQAAAdI"]
[Thu Apr 09 21:11:07.971453 2026] [:error] [pid 63331:tid 63351] [client 45.137.126.38:63021] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Thu Apr 09 21:11:08.472421 2026] [:error] [pid 63331:tid 63352] [client 45.137.126.38:63021] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "adelbCbKfIYuVjWbE4VzVgAAAdM"]
[Thu Apr 09 21:11:09.977373 2026] [:error] [pid 24516:tid 24561] [client 45.137.126.42:63411] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Thu Apr 09 21:11:10.477154 2026] [:error] [pid 24516:tid 24571] [client 45.137.126.42:63411] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adelbthW7vSS-UkeWCUyswAAAFg"]
[Thu Apr 09 21:11:11.479734 2026] [:error] [pid 63331:tid 63337] [client 45.137.126.26:62789] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "adelbybKfIYuVjWbE4VzWAAAAcQ"]
[Thu Apr 09 21:11:12.485917 2026] [:error] [pid 24624:tid 24636] [client 45.137.126.46:31991] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Thu Apr 09 21:11:16.008070 2026] [:error] [pid 24624:tid 24641] [client 45.137.126.46:31991] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adeldO4Jn-WvK1ZBTvjfNQAAAM8"]
[Thu Apr 09 21:11:17.005580 2026] [:error] [pid 24517:tid 24586] [client 45.137.126.12:26611] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "adeldXboYEn2ZFM_PS-BfgAAAIw"]
[Thu Apr 09 21:11:20.571137 2026] [:error] [pid 24517:tid 24590] [client 45.137.126.15:49151] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adeleHboYEn2ZFM_PS-BgwAAAJA"]
[Thu Apr 09 21:11:21.566719 2026] [:error] [pid 18477:tid 18488] [client 45.137.126.10:63169] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/install.php"] [unique_id "adelecDe826HlFeoLPKe0wAAAUk"]
[Thu Apr 09 21:11:22.565889 2026] [:error] [pid 18477:tid 18484] [client 45.137.126.21:24659] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Thu Apr 09 21:11:23.063933 2026] [:error] [pid 18477:tid 18503] [client 45.137.126.21:24659] [client 45.137.126.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.21, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adele8De826HlFeoLPKe2AAAAVg"]
[Thu Apr 09 21:11:24.067552 2026] [:error] [pid 18477:tid 18493] [client 45.137.126.21:24659] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adelfMDe826HlFeoLPKe2gAAAU4"]
[Thu Apr 09 21:11:26.567778 2026] [:error] [pid 24517:tid 24578] [client 45.137.126.7:21003] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adelfnboYEn2ZFM_PS-BiAAAAIQ"]
[Thu Apr 09 21:11:27.566769 2026] [:error] [pid 18477:tid 18489] [client 45.137.126.21:27009] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Thu Apr 09 21:11:28.065127 2026] [:error] [pid 18477:tid 18498] [client 45.137.126.21:27009] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adelgMDe826HlFeoLPKe3gAAAVM"]
[Thu Apr 09 21:11:29.061158 2026] [:error] [pid 24927:tid 24947] [client 45.137.126.16:25943] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adelgTXObuzEuw8mNJslhgAAARE"]
[Thu Apr 09 21:11:30.061868 2026] [:error] [pid 24516:tid 24561] [client 45.137.126.11:31881] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Thu Apr 09 21:11:31.575392 2026] [:error] [pid 24516:tid 24565] [client 45.137.126.11:31881] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adelg9hW7vSS-UkeWCUyvwAAAFI"]
[Thu Apr 09 21:11:33.587298 2026] [:error] [pid 24624:tid 24626] [client 45.137.126.36:24733] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adelhe4Jn-WvK1ZBTvjfRAAAAMA"]
[Thu Apr 09 21:11:34.588704 2026] [:error] [pid 24624:tid 24650] [client 45.137.126.6:53421] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Thu Apr 09 21:11:35.591811 2026] [:error] [pid 24624:tid 24633] [client 45.137.126.6:53421] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Thu Apr 09 21:11:36.591128 2026] [:error] [pid 24624:tid 24646] [client 45.137.126.6:53421] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adeliO4Jn-WvK1ZBTvjfSgAAANQ"]
[Thu Apr 09 21:11:37.592273 2026] [:error] [pid 24624:tid 24629] [client 45.137.126.33:41161] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "adelie4Jn-WvK1ZBTvjfSwAAAMM"]
[Thu Apr 09 21:11:39.094189 2026] [:error] [pid 24624:tid 24649] [client 45.137.126.31:23569] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/count.php"] [unique_id "adeli-4Jn-WvK1ZBTvjfTwAAANc"]
[Thu Apr 09 21:11:40.100703 2026] [:error] [pid 24624:tid 24634] [client 45.137.126.53:65241] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Thu Apr 09 21:11:43.129224 2026] [:error] [pid 24624:tid 24637] [client 45.137.126.53:65241] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adelj-4Jn-WvK1ZBTvjfWAAAAMs"]
[Thu Apr 09 21:11:45.140811 2026] [:error] [pid 18477:tid 18498] [client 45.137.126.44:24109] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rejuva.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rejuva.au"] [uri "/images/stories/themes.php"] [unique_id "adelkcDe826HlFeoLPKe6wAAAVM"]
[Thu Apr 09 21:11:45.640358 2026] [:error] [pid 18477:tid 18482] [client 45.137.126.44:24109] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "adelkcDe826HlFeoLPKe7AAAAUM"]
[Thu Apr 09 21:11:47.640112 2026] [:error] [pid 24927:tid 24931] [client 45.137.126.45:23499] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "adelkzXObuzEuw8mNJsliwAAAQE"]
[Thu Apr 09 21:11:48.634930 2026] [:error] [pid 20837:tid 20863] [client 45.137.126.3:48805] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "adellPSL71FHZkjrGzP1mQAAAZg"]
[Thu Apr 09 21:11:50.644838 2026] [:error] [pid 63331:tid 63346] [client 45.137.126.49:35355] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Thu Apr 09 21:11:52.654183 2026] [:error] [pid 63331:tid 63341] [client 45.137.126.49:35355] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "adelmCbKfIYuVjWbE4VzbwAAAcg"]
[Thu Apr 09 21:11:54.656483 2026] [:error] [pid 24515:tid 24524] [client 45.137.126.29:43669] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "adelmq1OMnvM2fMnB1O8wQAAAAU"]
[Thu Apr 09 21:11:56.162142 2026] [:error] [pid 63331:tid 63347] [client 45.137.126.28:27505] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "adelnCbKfIYuVjWbE4VzdAAAAc4"]
[Thu Apr 09 21:11:57.166320 2026] [:error] [pid 24515:tid 24523] [client 45.137.126.16:62561] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Thu Apr 09 21:11:59.681155 2026] [:error] [pid 24515:tid 24532] [client 45.137.126.16:62561] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "adeln61OMnvM2fMnB1O8yAAAAA0"]
[Thu Apr 09 21:12:00.684170 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.42:63189] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/colour.php"] [unique_id "adeloK1OMnvM2fMnB1O8yQAAAAg"]
[Thu Apr 09 21:12:01.684844 2026] [:error] [pid 63331:tid 63357] [client 45.137.126.20:38813] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Thu Apr 09 21:12:02.184032 2026] [:error] [pid 63331:tid 63339] [client 45.137.126.20:38813] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "adeloibKfIYuVjWbE4VzegAAAcY"]
[Thu Apr 09 21:12:03.185591 2026] [:error] [pid 24927:tid 24935] [client 45.137.126.31:29159] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "adelozXObuzEuw8mNJsljAAAAQU"]
[Thu Apr 09 21:12:05.183550 2026] [:error] [pid 24927:tid 24936] [client 45.137.126.15:31499] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "adelpTXObuzEuw8mNJslkAAAAQY"]
[Thu Apr 09 21:12:07.192485 2026] [:error] [pid 24517:tid 24583] [client 45.137.126.6:31613] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "adelp3boYEn2ZFM_PS-BjwAAAIk"]
[Thu Apr 09 21:12:08.190275 2026] [:error] [pid 63331:tid 63341] [client 45.137.126.26:63977] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "adelqCbKfIYuVjWbE4VzfAAAAcg"]
[Thu Apr 09 21:12:11.198979 2026] [:error] [pid 24516:tid 24556] [client 45.137.126.37:48601] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "adelq9hW7vSS-UkeWCUy2gAAAEk"]
[Thu Apr 09 21:12:14.199611 2026] [:error] [pid 24624:tid 24642] [client 45.137.126.22:29127] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "adelru4Jn-WvK1ZBTvjfYgAAANA"]
[Thu Apr 09 21:12:15.205437 2026] [:error] [pid 18477:tid 18496] [client 45.137.126.12:44175] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Thu Apr 09 21:12:16.717388 2026] [:error] [pid 18477:tid 18495] [client 45.137.126.12:44175] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "adelsMDe826HlFeoLPKe9AAAAVA"]
[Thu Apr 09 21:12:17.715794 2026] [:error] [pid 24927:tid 24953] [client 45.137.126.2:28759] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "adelsTXObuzEuw8mNJslkgAAARc"]
[Thu Apr 09 21:12:18.712632 2026] [:error] [pid 18477:tid 18487] [client 45.137.126.2:29949] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "adelssDe826HlFeoLPKe9gAAAUg"]
[Thu Apr 09 21:12:19.713914 2026] [:error] [pid 24624:tid 24640] [client 45.137.126.47:38133] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Thu Apr 09 21:12:20.717396 2026] [:error] [pid 24624:tid 24626] [client 45.137.126.47:38133] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "adeltO4Jn-WvK1ZBTvjfZQAAAMA"]
[Thu Apr 09 21:12:21.720759 2026] [:error] [pid 18477:tid 18499] [client 45.137.126.47:34721] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Thu Apr 09 21:12:22.725362 2026] [:error] [pid 18477:tid 18492] [client 45.137.126.47:34721] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "adeltsDe826HlFeoLPKe-QAAAU0"]
[Thu Apr 09 21:12:23.721527 2026] [:error] [pid 63331:tid 63356] [client 45.137.126.21:59739] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "adeltybKfIYuVjWbE4VzhAAAAdc"]
[Thu Apr 09 21:12:25.228639 2026] [:error] [pid 20837:tid 20860] [client 45.137.126.41:25255] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "adelufSL71FHZkjrGzP1rAAAAZU"]
[Thu Apr 09 21:12:26.227625 2026] [:error] [pid 20837:tid 20861] [client 45.137.126.45:39129] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/simi.php"] [unique_id "adeluvSL71FHZkjrGzP1rQAAAZY"]
[Thu Apr 09 21:12:29.240385 2026] [:error] [pid 24516:tid 24568] [client 45.137.126.9:52709] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "adelvdhW7vSS-UkeWCUy5QAAAFU"]
[Thu Apr 09 21:12:31.750802 2026] [:error] [pid 24515:tid 24542] [client 45.137.126.3:57709] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "adelv61OMnvM2fMnB1O87AAAABc"]
[Thu Apr 09 21:12:32.747640 2026] [:error] [pid 24515:tid 24523] [client 45.137.126.25:59347] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adelwK1OMnvM2fMnB1O88wAAAAQ"]
[Thu Apr 09 21:12:34.743871 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.29:44411] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "adelwq1OMnvM2fMnB1O89wAAABA"]
[Thu Apr 09 21:12:36.754090 2026] [:error] [pid 24515:tid 24520] [client 45.137.126.32:52109] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "adelxK1OMnvM2fMnB1O8_gAAAAE"]
[Thu Apr 09 21:12:38.763582 2026] [:error] [pid 24927:tid 24941] [client 45.137.126.11:40639] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "adelxjXObuzEuw8mNJslmQAAAQs"]
[Thu Apr 09 21:12:40.267341 2026] [:error] [pid 24515:tid 24537] [client 45.137.126.10:41969] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "adelyK1OMnvM2fMnB1O9BgAAABI"]
[Thu Apr 09 21:12:41.769081 2026] [:error] [pid 20837:tid 20859] [client 45.137.126.42:57175] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "adelyfSL71FHZkjrGzP1xAAAAZQ"]
[Thu Apr 09 21:12:43.791656 2026] [:error] [pid 24515:tid 24526] [client 45.137.126.50:41611] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Thu Apr 09 21:12:45.808644 2026] [:error] [pid 24515:tid 24531] [client 45.137.126.50:41611] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "adelza1OMnvM2fMnB1O9IgAAAAw"]
[Thu Apr 09 21:12:46.811729 2026] [:error] [pid 24515:tid 24541] [client 45.137.126.52:65361] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "adelzq1OMnvM2fMnB1O9KwAAABY"]
[Thu Apr 09 21:12:48.321489 2026] [:error] [pid 18477:tid 18483] [client 45.137.126.46:21195] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Thu Apr 09 21:12:48.822791 2026] [:error] [pid 18477:tid 18480] [client 45.137.126.46:21195] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "adel0MDe826HlFeoLPKfAAAAAUE"]
[Thu Apr 09 21:12:51.836124 2026] [:error] [pid 18477:tid 18479] [client 45.137.126.16:62919] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "adel08De826HlFeoLPKfCAAAAUA"]
[Thu Apr 09 21:12:53.344498 2026] [:error] [pid 24624:tid 24631] [client 45.137.126.32:32211] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Thu Apr 09 21:12:53.846190 2026] [:error] [pid 24624:tid 24635] [client 45.137.126.32:32211] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "adel1e4Jn-WvK1ZBTvjfhQAAAMk"]
[Thu Apr 09 21:12:55.850989 2026] [:error] [pid 18477:tid 18481] [client 45.137.126.34:21451] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "adel18De826HlFeoLPKfDwAAAUI"]
[Thu Apr 09 21:12:56.854611 2026] [:error] [pid 24624:tid 24627] [client 45.137.126.5:38545] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Thu Apr 09 21:12:57.355953 2026] [:error] [pid 24624:tid 24640] [client 45.137.126.5:38545] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "adel2e4Jn-WvK1ZBTvjfjQAAAM4"]
[Thu Apr 09 21:12:58.869271 2026] [:error] [pid 24927:tid 24932] [client 45.137.126.28:32831] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "adel2jXObuzEuw8mNJslngAAAQI"]
[Thu Apr 09 21:13:01.426299 2026] [:error] [pid 20837:tid 20842] [client 45.137.126.41:56187] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Thu Apr 09 21:13:01.925290 2026] [:error] [pid 20837:tid 20857] [client 45.137.126.41:56187] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "adel3fSL71FHZkjrGzP10wAAAZI"]
[Thu Apr 09 21:13:05.443702 2026] [:error] [pid 24624:tid 24650] [client 45.137.126.3:45913] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "adel4e4Jn-WvK1ZBTvjfmAAAANg"]
[Thu Apr 09 21:13:06.443973 2026] [:error] [pid 63331:tid 63349] [client 45.137.126.51:30571] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Thu Apr 09 21:13:06.941912 2026] [:error] [pid 63331:tid 63337] [client 45.137.126.51:30571] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "adel4ibKfIYuVjWbE4VzmQAAAcQ"]
[Thu Apr 09 21:13:07.944302 2026] [:error] [pid 24624:tid 24639] [client 45.137.126.4:51705] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "adel4-4Jn-WvK1ZBTvjfmwAAAM0"]
[Thu Apr 09 21:13:08.944842 2026] [:error] [pid 24515:tid 24536] [client 45.137.126.9:52079] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Thu Apr 09 21:13:09.943366 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.9:52079] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "adel5a1OMnvM2fMnB1O9OgAAAAg"]
[Thu Apr 09 21:13:10.940686 2026] [:error] [pid 24515:tid 24522] [client 45.137.126.47:50529] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "adel5q1OMnvM2fMnB1O9PwAAAAM"]
[Thu Apr 09 21:13:14.948815 2026] [:error] [pid 24515:tid 24534] [client 45.137.126.32:29923] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "adel6q1OMnvM2fMnB1O9UgAAAA8"]
[Thu Apr 09 21:13:15.950292 2026] [:error] [pid 63331:tid 63352] [client 45.137.126.22:25875] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "adel6ybKfIYuVjWbE4VzoQAAAdM"]
[Thu Apr 09 21:13:17.459416 2026] [:error] [pid 18477:tid 18499] [client 45.137.126.50:30363] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/log.php"] [unique_id "adel7cDe826HlFeoLPKfGwAAAVQ"]
[Thu Apr 09 21:13:18.467666 2026] [:error] [pid 63331:tid 63348] [client 45.137.126.22:29753] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "adel7ibKfIYuVjWbE4VzpgAAAc8"]
[Thu Apr 09 21:13:19.463350 2026] [:error] [pid 24516:tid 24568] [client 45.137.126.49:30525] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "adel79hW7vSS-UkeWCUzPQAAAFU"]
[Thu Apr 09 21:13:20.463317 2026] [:error] [pid 24515:tid 24520] [client 45.137.126.22:34875] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/aw.php"] [unique_id "adel8K1OMnvM2fMnB1O9VwAAAAE"]
[Thu Apr 09 21:13:24.466880 2026] [:error] [pid 24517:tid 24576] [client 45.137.126.10:47163] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "adel9HboYEn2ZFM_PS-BqAAAAII"]
[Thu Apr 09 21:13:25.468425 2026] [:error] [pid 63331:tid 63341] [client 45.137.126.3:60675] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/install.php"] [unique_id "adel9SbKfIYuVjWbE4VzrwAAAcg"]
[Thu Apr 09 21:13:26.973319 2026] [:error] [pid 20837:tid 20843] [client 45.137.126.39:38137] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Thu Apr 09 21:13:27.473093 2026] [:error] [pid 20837:tid 20841] [client 45.137.126.39:38137] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "adel9_SL71FHZkjrGzP12wAAAYI"]
[Thu Apr 09 21:13:28.468777 2026] [:error] [pid 20837:tid 20861] [client 45.137.126.28:55565] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "adel-PSL71FHZkjrGzP13wAAAZY"]
[Thu Apr 09 21:13:30.478335 2026] [:error] [pid 24624:tid 24637] [client 45.137.126.39:55499] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/template-less.php"] [unique_id "adel-u4Jn-WvK1ZBTvjfpwAAAMs"]
[Thu Apr 09 21:13:31.484824 2026] [:error] [pid 20837:tid 20854] [client 45.137.126.21:31571] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "adel-_SL71FHZkjrGzP17gAAAY8"]
[Thu Apr 09 21:13:36.016184 2026] [:error] [pid 24927:tid 24936] [client 45.137.126.41:37699] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/min.php"] [unique_id "ademADXObuzEuw8mNJslrgAAAQY"]
[Thu Apr 09 21:13:37.014091 2026] [:error] [pid 24516:tid 24571] [client 45.137.126.47:45871] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "ademAdhW7vSS-UkeWCUzQAAAAFg"]
[Thu Apr 09 21:13:39.026369 2026] [:error] [pid 24624:tid 24647] [client 45.137.126.53:40711] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "ademA-4Jn-WvK1ZBTvjfrgAAANU"]
[Thu Apr 09 21:13:40.532113 2026] [:error] [pid 24516:tid 24554] [client 45.137.126.25:40149] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "ademBNhW7vSS-UkeWCUzQwAAAEc"]
[Thu Apr 09 21:13:42.031091 2026] [:error] [pid 63331:tid 63336] [client 45.137.126.45:34319] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/load.php"] [unique_id "ademBibKfIYuVjWbE4VzxAAAAcM"]
[Thu Apr 09 21:13:43.027857 2026] [:error] [pid 24927:tid 24930] [client 45.137.126.32:27253] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "ademBzXObuzEuw8mNJsltAAAAQA"]
[Thu Apr 09 21:13:44.024905 2026] [:error] [pid 63331:tid 63340] [client 45.137.126.46:38643] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "ademCCbKfIYuVjWbE4VzxgAAAcc"]
[Thu Apr 09 21:13:46.530786 2026] [:error] [pid 24517:tid 24585] [client 45.137.126.23:47893] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "ademCnboYEn2ZFM_PS-BtAAAAIs"]
[Thu Apr 09 21:13:47.534365 2026] [:error] [pid 63331:tid 63349] [client 45.137.126.46:20321] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Thu Apr 09 21:13:48.033457 2026] [:error] [pid 63331:tid 63339] [client 45.137.126.46:20321] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "ademDCbKfIYuVjWbE4Vz0gAAAcY"]
[Thu Apr 09 21:13:49.542299 2026] [:error] [pid 63331:tid 63340] [client 45.137.126.31:65197] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Thu Apr 09 21:13:50.043432 2026] [:error] [pid 63331:tid 63344] [client 45.137.126.31:65197] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "ademDibKfIYuVjWbE4Vz2gAAAcs"]
[Thu Apr 09 21:13:51.045478 2026] [:error] [pid 63331:tid 63354] [client 45.137.126.48:64333] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "ademDybKfIYuVjWbE4Vz3QAAAdU"]
[Thu Apr 09 21:13:52.048043 2026] [:error] [pid 20837:tid 20845] [client 45.137.126.16:21269] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "ademEPSL71FHZkjrGzP2GgAAAYY"]
[Thu Apr 09 21:13:55.057069 2026] [:error] [pid 24927:tid 24938] [client 45.137.126.15:35449] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Thu Apr 09 21:13:57.066462 2026] [:error] [pid 24927:tid 24950] [client 45.137.126.15:35449] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/system.php"] [unique_id "ademFTXObuzEuw8mNJslzwAAARQ"]
[Thu Apr 09 21:13:59.673014 2026] [:error] [pid 18477:tid 18494] [client 45.137.126.26:29675] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "ademF8De826HlFeoLPKfXQAAAU8"]
[Thu Apr 09 21:14:01.676374 2026] [:error] [pid 24517:tid 24574] [client 45.137.126.2:23329] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "ademGXboYEn2ZFM_PS-BvQAAAIA"]
[Thu Apr 09 21:14:02.678157 2026] [:error] [pid 24624:tid 24626] [client 45.137.126.4:39459] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "ademGu4Jn-WvK1ZBTvjf0wAAAMA"]
[Thu Apr 09 21:14:03.676138 2026] [:error] [pid 24927:tid 24940] [client 45.137.126.34:21091] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "ademGzXObuzEuw8mNJsl1AAAAQo"]
[Thu Apr 09 21:14:05.679846 2026] [:error] [pid 24516:tid 24570] [client 45.137.126.52:39287] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ademHdhW7vSS-UkeWCUzVQAAAFc"]
[Thu Apr 09 21:14:10.213162 2026] [:error] [pid 24517:tid 24584] [client 45.137.126.31:26175] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "ademInboYEn2ZFM_PS-BzAAAAIo"]
[Thu Apr 09 21:14:13.261666 2026] [:error] [pid 24515:tid 24535] [client 45.137.126.8:59269] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "ademJa1OMnvM2fMnB1O9jAAAABA"]
[Thu Apr 09 21:14:15.442179 2026] [:error] [pid 63331:tid 63343] [client 45.137.126.24:60227] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "ademJybKfIYuVjWbE4Vz6gAAAco"]
[Thu Apr 09 21:14:16.444757 2026] [:error] [pid 24624:tid 24630] [client 45.137.126.15:48017] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "ademKO4Jn-WvK1ZBTvjf6wAAAMQ"]
[Thu Apr 09 21:14:22.954212 2026] [:error] [pid 24517:tid 24587] [client 45.137.126.27:39737] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "ademLnboYEn2ZFM_PS-B3QAAAI0"]
[Thu Apr 09 21:14:23.956680 2026] [:error] [pid 24624:tid 24646] [client 45.137.126.24:33093] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "ademL-4Jn-WvK1ZBTvjf_QAAANQ"]
[Thu Apr 09 21:14:24.957119 2026] [:error] [pid 24515:tid 24521] [client 45.137.126.35:62177] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "ademMK1OMnvM2fMnB1O9mQAAAAI"]
[Thu Apr 09 21:14:26.455795 2026] [:error] [pid 24515:tid 24522] [client 45.137.126.20:55065] [client 45.137.126.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.20, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "ademMq1OMnvM2fMnB1O9oAAAAAM"]
[Thu Apr 09 21:14:27.459653 2026] [:error] [pid 24515:tid 24527] [client 45.137.126.20:55065] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "ademM61OMnvM2fMnB1O9owAAAAg"]
[Thu Apr 09 21:14:28.459358 2026] [:error] [pid 24624:tid 24633] [client 45.137.126.9:54255] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "ademNO4Jn-WvK1ZBTvjgAQAAAMc"]
[Thu Apr 09 21:14:29.455307 2026] [:error] [pid 63331:tid 63333] [client 45.137.126.22:62445] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "ademNSbKfIYuVjWbE4Vz_gAAAcA"]
[Thu Apr 09 21:14:33.477063 2026] [:error] [pid 20837:tid 20842] [client 45.137.126.19:25957] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "ademOfSL71FHZkjrGzP2NAAAAYM"]
[Thu Apr 09 21:14:38.013961 2026] [:error] [pid 20837:tid 20863] [client 45.137.126.46:43063] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "ademPvSL71FHZkjrGzP2RAAAAZg"]
[Thu Apr 09 21:14:40.016992 2026] [:error] [pid 63331:tid 63339] [client 45.137.126.32:24929] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "ademQCbKfIYuVjWbE4V0EgAAAcY"]
[Thu Apr 09 21:14:47.038128 2026] [:error] [pid 24624:tid 24634] [client 45.137.126.41:61005] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ademR-4Jn-WvK1ZBTvjgGwAAAMg"]
[Thu Apr 09 21:14:48.041853 2026] [:error] [pid 24927:tid 24939] [client 45.137.126.42:44739] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "ademSDXObuzEuw8mNJsl-gAAAQk"]
[Thu Apr 09 21:14:49.038930 2026] [:error] [pid 63331:tid 63343] [client 45.137.126.38:30679] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "ademSSbKfIYuVjWbE4V0JQAAAco"]
[Thu Apr 09 21:14:50.043456 2026] [:error] [pid 24515:tid 24523] [client 45.137.126.7:31791] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "ademSq1OMnvM2fMnB1O9pQAAAAQ"]
[Thu Apr 09 21:14:52.585435 2026] [:error] [pid 63331:tid 63351] [client 45.137.126.25:34569] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "ademTCbKfIYuVjWbE4V0LwAAAdI"]
[Thu Apr 09 21:14:53.584271 2026] [:error] [pid 63331:tid 63342] [client 45.137.126.30:22341] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "ademTSbKfIYuVjWbE4V0NgAAAck"]
[Thu Apr 09 21:14:57.088065 2026] [:error] [pid 24515:tid 24522] [client 45.137.126.11:43781] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "ademUa1OMnvM2fMnB1O9sAAAAAM"]
[Thu Apr 09 21:15:01.121331 2026] [:error] [pid 63331:tid 63341] [client 45.137.126.53:54965] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "ademVSbKfIYuVjWbE4V0WwAAAcg"]
[Thu Apr 09 21:15:02.124310 2026] [:error] [pid 24624:tid 24650] [client 45.137.126.5:48963] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "ademVu4Jn-WvK1ZBTvjgIgAAANg"]
[Thu Apr 09 21:15:47.949924 2026] [:error] [pid 24516:tid 24568] [client 45.137.126.42:62263] [client 45.137.126.42] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "91.230.225.92_92777f268ca7948dd0b63b7c1eeff6915a72a3b5"): Internal error (specific information not available) [hostname "rejuva.au"] [uri "/index.html"] [unique_id "ademgthW7vSS-UkeWCUzxwAAAFU"]
[Thu Apr 09 21:15:49.466297 2026] [autoindex:error] [pid 24516:tid 24569] [client 45.137.126.42:62263] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 22:44:01.276197 2026] [:error] [pid 24516:tid 24568] [client 43.165.65.180:54600] [client 43.165.65.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ade7MdhW7vSS-UkeWCU90gAAAFU"]
[Thu Apr 09 23:14:16.718287 2026] [:error] [pid 24927:tid 24947] [client 43.164.195.17:56512] [client 43.164.195.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adfCSDXObuzEuw8mNJs6iAAAARE"]
[Thu Apr 09 23:18:42.349038 2026] [:error] [pid 24624:tid 24649] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/green.php
[Thu Apr 09 23:18:42.612745 2026] [:error] [pid 24624:tid 24629] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Thu Apr 09 23:18:42.876759 2026] [:error] [pid 24624:tid 24645] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/qiumnpor3orjwr6me3zmgqCdefault.php
[Thu Apr 09 23:18:43.140494 2026] [:error] [pid 24624:tid 24632] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Thu Apr 09 23:18:43.418614 2026] [:error] [pid 24624:tid 24644] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/5xkfgawzejgwqh9hiaznCdefault.php
[Thu Apr 09 23:18:43.685051 2026] [:error] [pid 24624:tid 24633] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Thu Apr 09 23:18:44.190819 2026] [:error] [pid 24624:tid 24636] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Thu Apr 09 23:18:44.456247 2026] [:error] [pid 24624:tid 24648] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu Apr 09 23:18:44.719912 2026] [:error] [pid 24624:tid 24650] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/tx78.php
[Thu Apr 09 23:18:44.991592 2026] [:error] [pid 24624:tid 24626] [client 20.100.175.19:37326] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Thu Apr 09 23:18:45.255663 2026] [:error] [pid 24624:tid 24642] [client 20.100.175.19:37326] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adfDVe4Jn-WvK1ZBTvj7FwAAANA"]
[Thu Apr 09 23:18:47.932093 2026] [:error] [pid 63331:tid 63353] [client 20.100.175.19:34378] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adfDVybKfIYuVjWbE4WkMAAAAdQ"]
[Thu Apr 09 23:18:48.964301 2026] [:error] [pid 63331:tid 63338] [client 20.100.175.19:36896] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adfDWCbKfIYuVjWbE4WkMgAAAcU"]
[Thu Apr 09 23:18:50.602739 2026] [:error] [pid 24515:tid 24525] [client 20.100.175.19:33985] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adfDWq1OMnvM2fMnB1P7KwAAAAY"]
[Thu Apr 09 23:18:51.529984 2026] [:error] [pid 24515:tid 24526] [client 20.100.175.19:33999] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adfDW61OMnvM2fMnB1P7LAAAAAc"]
[Thu Apr 09 23:18:52.813862 2026] [:error] [pid 24515:tid 24535] [client 20.100.175.19:4283] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adfDXK1OMnvM2fMnB1P7MAAAABA"]
[Thu Apr 09 23:18:55.417680 2026] [:error] [pid 24515:tid 24536] [client 20.100.175.19:4252] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adfDX61OMnvM2fMnB1P7NQAAABE"]
[Thu Apr 09 23:18:56.877537 2026] [:error] [pid 24516:tid 24566] [client 20.100.175.19:50598] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adfDYNhW7vSS-UkeWCVChgAAAFM"]
[Thu Apr 09 23:18:58.778314 2026] [:error] [pid 24624:tid 24634] [client 20.100.175.19:45776] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adfDYu4Jn-WvK1ZBTvj7HQAAAMg"]
[Thu Apr 09 23:19:00.651441 2026] [:error] [pid 20837:tid 20847] [client 20.100.175.19:50614] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adfDZPSL71FHZkjrGzMXnAAAAYg"]
[Thu Apr 09 23:19:03.581920 2026] [:error] [pid 18477:tid 18483] [client 20.100.175.19:34002] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adfDZ8De826HlFeoLPKxBQAAAUQ"]
[Thu Apr 09 23:19:05.543293 2026] [:error] [pid 24516:tid 24557] [client 20.100.175.19:49941] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adfDadhW7vSS-UkeWCVCigAAAEo"]
[Thu Apr 09 23:19:07.713139 2026] [:error] [pid 18477:tid 18494] [client 20.100.175.19:40546] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "adfDa8De826HlFeoLPKxCQAAAU8"]
[Thu Apr 09 23:19:11.755714 2026] [:error] [pid 24515:tid 24520] [client 20.100.175.19:36906] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "adfDb61OMnvM2fMnB1P7RQAAAAE"]
[Thu Apr 09 23:19:13.963655 2026] [:error] [pid 20837:tid 20855] [client 20.100.175.19:24138] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "adfDcfSL71FHZkjrGzMXswAAAZA"]
[Thu Apr 09 23:19:16.543825 2026] [:error] [pid 18477:tid 18479] [client 20.100.175.19:48640] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "adfDdMDe826HlFeoLPKxDwAAAUA"]
[Thu Apr 09 23:19:18.706182 2026] [:error] [pid 63331:tid 63342] [client 20.100.175.19:50605] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adfDdibKfIYuVjWbE4WkOQAAAck"]
[Thu Apr 09 23:19:21.319674 2026] [:error] [pid 24516:tid 24549] [client 20.100.175.19:51390] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adfDedhW7vSS-UkeWCVCjQAAAEI"]
[Thu Apr 09 23:19:23.664086 2026] [:error] [pid 24927:tid 24944] [client 20.100.175.19:24154] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adfDezXObuzEuw8mNJs7DwAAAQ4"]
[Thu Apr 09 23:19:28.619988 2026] [:error] [pid 18477:tid 18494] [client 20.100.175.19:4993] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adfDgMDe826HlFeoLPKxGgAAAU8"]
[Thu Apr 09 23:19:34.173559 2026] [:error] [pid 24624:tid 24634] [client 20.100.175.19:30669] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adfDhu4Jn-WvK1ZBTvj7NgAAAMg"]
[Thu Apr 09 23:19:36.005181 2026] [:error] [pid 24624:tid 24648] [client 20.100.175.19:40533] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adfDiO4Jn-WvK1ZBTvj7OAAAANY"]
[Thu Apr 09 23:19:37.376607 2026] [:error] [pid 20837:tid 20853] [client 20.100.175.19:48644] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adfDifSL71FHZkjrGzMXuwAAAY4"]
[Thu Apr 09 23:19:39.250130 2026] [:error] [pid 24516:tid 24570] [client 20.100.175.19:48702] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adfDi9hW7vSS-UkeWCVCkQAAAFc"]
[Thu Apr 09 23:19:41.974497 2026] [:error] [pid 24516:tid 24558] [client 20.100.175.19:51338] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "adfDjdhW7vSS-UkeWCVClAAAAEs"]
[Thu Apr 09 23:19:45.098359 2026] [:error] [pid 24927:tid 24952] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Thu Apr 09 23:19:45.389553 2026] [:error] [pid 24927:tid 24938] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Apr 09 23:19:45.651477 2026] [:error] [pid 24927:tid 24945] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Thu Apr 09 23:19:45.922051 2026] [:error] [pid 24927:tid 24937] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Thu Apr 09 23:19:46.189288 2026] [:error] [pid 24927:tid 24944] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Thu Apr 09 23:19:46.452723 2026] [:error] [pid 24927:tid 24948] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Thu Apr 09 23:19:46.716056 2026] [:error] [pid 24927:tid 24943] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Thu Apr 09 23:19:47.437827 2026] [:error] [pid 24927:tid 24933] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Thu Apr 09 23:19:47.839478 2026] [:error] [pid 24927:tid 24936] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu Apr 09 23:19:48.137462 2026] [:error] [pid 24927:tid 24951] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/mI35rZhMg1zJ1vuXdefault.php
[Thu Apr 09 23:19:48.400547 2026] [:error] [pid 24927:tid 24946] [client 20.100.175.19:25865] File does not exist: /usr/local/apache/htdocs/suspended-page/q7lhrgzoo7ijhnkcedq2Cdefault.php
[Thu Apr 09 23:19:48.659709 2026] [:error] [pid 24927:tid 24935] [client 20.100.175.19:25865] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfDlDXObuzEuw8mNJs7JQAAAQU"]
[Thu Apr 09 23:19:51.962799 2026] [:error] [pid 24624:tid 24629] [client 20.100.175.19:52227] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfDl-4Jn-WvK1ZBTvj7SQAAAMM"]
[Thu Apr 09 23:19:53.844184 2026] [:error] [pid 24624:tid 24636] [client 20.100.175.19:36853] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfDme4Jn-WvK1ZBTvj7TgAAAMo"]
[Thu Apr 09 23:19:56.035918 2026] [:error] [pid 20837:tid 20854] [client 20.100.175.19:31034] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adfDnPSL71FHZkjrGzMXxwAAAY8"]
[Thu Apr 09 23:19:57.815120 2026] [:error] [pid 24516:tid 24560] [client 20.100.175.19:50978] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfDndhW7vSS-UkeWCVCnQAAAE0"]
[Thu Apr 09 23:19:59.558709 2026] [:error] [pid 18477:tid 18485] [client 20.100.175.19:29709] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfDn8De826HlFeoLPKxKgAAAUY"]
[Thu Apr 09 23:20:01.400893 2026] [:error] [pid 20837:tid 20843] [client 20.100.175.19:52260] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfDofSL71FHZkjrGzMX4gAAAYQ"]
[Thu Apr 09 23:20:03.444371 2026] [:error] [pid 63331:tid 63350] [client 20.100.175.19:52231] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adfDoybKfIYuVjWbE4WkbQAAAdE"]
[Thu Apr 09 23:20:05.582908 2026] [:error] [pid 63331:tid 63336] [client 20.100.175.19:4353] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "adfDpSbKfIYuVjWbE4WkeQAAAcM"]
[Thu Apr 09 23:20:13.981676 2026] [:error] [pid 63331:tid 63340] [client 20.100.175.19:4202] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "adfDrSbKfIYuVjWbE4WkrAAAAcc"]
[Thu Apr 09 23:20:17.349940 2026] [:error] [pid 20837:tid 20848] [client 20.100.175.19:48150] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "adfDsfSL71FHZkjrGzMYTwAAAYk"]
[Thu Apr 09 23:20:20.051713 2026] [:error] [pid 20837:tid 20839] [client 20.100.175.19:48137] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "adfDtPSL71FHZkjrGzMYXgAAAYA"]
[Thu Apr 09 23:20:22.546541 2026] [:error] [pid 24624:tid 24631] [client 20.100.175.19:34803] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "adfDtu4Jn-WvK1ZBTvj7XgAAAMU"]
[Thu Apr 09 23:20:25.778829 2026] [:error] [pid 63331:tid 63338] [client 20.100.175.19:45063] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "adfDuSbKfIYuVjWbE4WlBgAAAcU"]
[Thu Apr 09 23:20:31.040719 2026] [:error] [pid 18477:tid 18501] [client 20.100.175.19:25525] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "adfDv8De826HlFeoLPKxPgAAAVY"]
[Thu Apr 09 23:20:34.498308 2026] [:error] [pid 24517:tid 24588] [client 20.100.175.19:32043] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adfDwnboYEn2ZFM_PS-OOAAAAI4"]
[Thu Apr 09 23:20:39.112558 2026] [:error] [pid 20837:tid 20849] [client 20.100.175.19:31940] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adfDx_SL71FHZkjrGzMYgAAAAYo"]
[Thu Apr 09 23:20:42.122116 2026] [:error] [pid 24515:tid 24520] [client 20.100.175.19:31965] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adfDyq1OMnvM2fMnB1P78QAAAAE"]
[Thu Apr 09 23:20:45.064295 2026] [:error] [pid 24624:tid 24643] [client 20.100.175.19:31414] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adfDze4Jn-WvK1ZBTvj7bAAAANE"]
[Thu Apr 09 23:20:47.606052 2026] [:error] [pid 20837:tid 20853] [client 20.100.175.19:26698] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adfDz_SL71FHZkjrGzMYiQAAAY4"]
[Thu Apr 09 23:20:50.122472 2026] [:error] [pid 63331:tid 63350] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 09 23:20:51.576953 2026] [:error] [pid 63331:tid 63356] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Thu Apr 09 23:20:51.839853 2026] [:error] [pid 63331:tid 63347] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Thu Apr 09 23:20:52.102662 2026] [:error] [pid 63331:tid 63345] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Apr 09 23:20:53.490872 2026] [:error] [pid 63331:tid 63355] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Thu Apr 09 23:20:53.760932 2026] [:error] [pid 63331:tid 63338] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Thu Apr 09 23:20:54.025126 2026] [:error] [pid 63331:tid 63334] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Thu Apr 09 23:20:54.296827 2026] [:error] [pid 63331:tid 63343] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/wlld5fjtdpjmjhsds3qzmipfCdefault.php
[Thu Apr 09 23:20:54.823052 2026] [:error] [pid 63331:tid 63352] [client 20.100.175.19:32991] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 09 23:20:55.112953 2026] [:error] [pid 63331:tid 63353] [client 20.100.175.19:32991] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adfD1ybKfIYuVjWbE4WlOQAAAdQ"]
[Thu Apr 09 23:20:58.286784 2026] [:error] [pid 63331:tid 63347] [client 20.100.175.19:38360] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adfD2ibKfIYuVjWbE4WlPAAAAc4"]
[Thu Apr 09 23:21:02.993174 2026] [:error] [pid 63331:tid 63352] [client 20.100.175.19:4717] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adfD3ibKfIYuVjWbE4WlRAAAAdM"]
[Thu Apr 09 23:21:06.171566 2026] [:error] [pid 24624:tid 24635] [client 20.100.175.19:4712] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adfD4u4Jn-WvK1ZBTvj7dwAAAMk"]
[Thu Apr 09 23:21:07.831480 2026] [:error] [pid 24515:tid 24536] [client 20.100.175.19:33499] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adfD461OMnvM2fMnB1P7-wAAABE"]
[Thu Apr 09 23:21:11.091315 2026] [:error] [pid 24517:tid 24578] [client 20.100.175.19:39878] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adfD53boYEn2ZFM_PS-OPwAAAIQ"]
[Thu Apr 09 23:21:14.520426 2026] [:error] [pid 20837:tid 20846] [client 20.100.175.19:31077] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adfD6vSL71FHZkjrGzMYpQAAAYc"]
[Thu Apr 09 23:21:15.631077 2026] [:error] [pid 24516:tid 24551] [client 20.100.175.19:31070] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adfD69hW7vSS-UkeWCVCsAAAAEQ"]
[Thu Apr 09 23:21:17.343547 2026] [:error] [pid 24515:tid 24530] [client 20.100.175.19:41507] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adfD7a1OMnvM2fMnB1P8AgAAAAs"]
[Thu Apr 09 23:21:19.892691 2026] [:error] [pid 24515:tid 24543] [client 20.100.175.19:39121] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adfD761OMnvM2fMnB1P8BgAAABg"]
[Thu Apr 09 23:21:22.638828 2026] [:error] [pid 24515:tid 24523] [client 20.100.175.19:39138] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adfD8q1OMnvM2fMnB1P8CQAAAAQ"]
[Thu Apr 09 23:21:24.800407 2026] [:error] [pid 24517:tid 24574] [client 20.100.175.19:31069] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adfD9HboYEn2ZFM_PS-OQQAAAIA"]
[Thu Apr 09 23:21:25.747326 2026] [:error] [pid 24515:tid 24537] [client 20.100.175.19:43247] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adfD9a1OMnvM2fMnB1P8FQAAABI"]
[Thu Apr 09 23:21:26.886801 2026] [:error] [pid 20837:tid 20860] [client 20.100.175.19:39167] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adfD9vSL71FHZkjrGzMYugAAAZU"]
[Thu Apr 09 23:21:28.170929 2026] [:error] [pid 20837:tid 20843] [client 20.100.175.19:34441] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adfD-PSL71FHZkjrGzMYvwAAAYQ"]
[Thu Apr 09 23:21:29.941941 2026] [:error] [pid 24515:tid 24539] [client 20.100.175.19:43240] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adfD-a1OMnvM2fMnB1P8HQAAABQ"]
[Thu Apr 09 23:21:32.625438 2026] [:error] [pid 20837:tid 20859] [client 20.100.175.19:44411] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adfD_PSL71FHZkjrGzMYwgAAAZQ"]
[Thu Apr 09 23:21:34.770786 2026] [:error] [pid 24927:tid 24950] [client 20.100.175.19:48204] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adfD_jXObuzEuw8mNJs7UQAAARQ"]
[Thu Apr 09 23:21:36.978597 2026] [:error] [pid 24927:tid 24934] [client 20.100.175.19:33549] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adfEADXObuzEuw8mNJs7VAAAAQQ"]
[Thu Apr 09 23:21:40.584262 2026] [:error] [pid 24515:tid 24539] [client 20.100.175.19:50673] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adfEBK1OMnvM2fMnB1P8IwAAABQ"]
[Thu Apr 09 23:21:44.474681 2026] [:error] [pid 24927:tid 24937] [client 20.100.175.19:31385] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adfECDXObuzEuw8mNJs7VgAAAQc"]
[Thu Apr 09 23:21:45.925293 2026] [:error] [pid 24515:tid 24541] [client 20.100.175.19:31372] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adfECa1OMnvM2fMnB1P8JgAAABY"]
[Thu Apr 09 23:21:48.383513 2026] [:error] [pid 24927:tid 24954] [client 20.100.175.19:33546] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adfEDDXObuzEuw8mNJs7VwAAARg"]
[Thu Apr 09 23:21:50.018135 2026] [:error] [pid 24516:tid 24570] [client 20.100.175.19:28244] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adfEDthW7vSS-UkeWCVCtgAAAFc"]
[Thu Apr 09 23:21:51.461103 2026] [:error] [pid 24927:tid 24931] [client 20.100.175.19:34048] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "adfEDzXObuzEuw8mNJs7WgAAAQE"]
[Thu Apr 09 23:21:52.687842 2026] [:error] [pid 24927:tid 24935] [client 20.100.175.19:34073] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "adfEEDXObuzEuw8mNJs7XAAAAQU"]
[Thu Apr 09 23:22:01.712687 2026] [:error] [pid 63331:tid 63340] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 09 23:22:01.975415 2026] [:error] [pid 63331:tid 63335] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Thu Apr 09 23:22:02.238157 2026] [:error] [pid 63331:tid 63352] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Apr 09 23:22:02.502371 2026] [:error] [pid 63331:tid 63357] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Thu Apr 09 23:22:02.765095 2026] [:error] [pid 63331:tid 63341] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/ws87.php
[Thu Apr 09 23:22:03.042991 2026] [:error] [pid 63331:tid 63348] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Thu Apr 09 23:22:03.329212 2026] [:error] [pid 63331:tid 63350] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/new3.php
[Thu Apr 09 23:22:03.593024 2026] [:error] [pid 63331:tid 63346] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Thu Apr 09 23:22:03.856827 2026] [:error] [pid 63331:tid 63336] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Thu Apr 09 23:22:04.119738 2026] [:error] [pid 63331:tid 63333] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/t2gorhwasq4vioshtatw5eCdefault.php
[Thu Apr 09 23:22:04.384096 2026] [:error] [pid 63331:tid 63354] [client 20.100.175.19:28747] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Thu Apr 09 23:22:05.150009 2026] [:error] [pid 63331:tid 63338] [client 20.100.175.19:28747] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adfEHSbKfIYuVjWbE4WlawAAAcU"]
[Thu Apr 09 23:22:07.576370 2026] [:error] [pid 24515:tid 24527] [client 20.100.175.19:31637] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adfEH61OMnvM2fMnB1P8RgAAAAg"]
[Thu Apr 09 23:22:11.008830 2026] [:error] [pid 24515:tid 24523] [client 20.100.175.19:4313] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adfEI61OMnvM2fMnB1P8WwAAAAQ"]
[Thu Apr 09 23:22:14.894080 2026] [:error] [pid 24515:tid 24533] [client 20.100.175.19:31627] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "adfEJq1OMnvM2fMnB1P8YAAAAA4"]
[Thu Apr 09 23:22:15.872406 2026] [:error] [pid 20837:tid 20861] [client 20.100.175.19:4350] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adfEJ_SL71FHZkjrGzMY0gAAAZY"]
[Thu Apr 09 23:22:17.099422 2026] [:error] [pid 20837:tid 20839] [client 20.100.175.19:39525] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adfEKfSL71FHZkjrGzMY1AAAAYA"]
[Thu Apr 09 23:22:18.981530 2026] [:error] [pid 24624:tid 24646] [client 20.100.175.19:4326] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adfEKu4Jn-WvK1ZBTvj7nwAAANQ"]
[Thu Apr 09 23:22:23.979229 2026] [:error] [pid 24515:tid 24535] [client 20.100.175.19:47636] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adfEL61OMnvM2fMnB1P8ZAAAABA"]
[Thu Apr 09 23:22:25.641976 2026] [:error] [pid 18477:tid 18490] [client 20.100.175.19:5097] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adfEMcDe826HlFeoLPKxWAAAAUs"]
[Thu Apr 09 23:22:26.918324 2026] [:error] [pid 63331:tid 63339] [client 20.100.175.19:36134] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adfEMibKfIYuVjWbE4WlcgAAAcY"]
[Thu Apr 09 23:22:28.215980 2026] [:error] [pid 24927:tid 24932] [client 20.100.175.19:36036] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adfENDXObuzEuw8mNJs7cQAAAQI"]
[Thu Apr 09 23:22:30.036593 2026] [:error] [pid 24516:tid 24549] [client 20.100.175.19:36051] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adfENthW7vSS-UkeWCVCvwAAAEI"]
[Thu Apr 09 23:22:31.176036 2026] [:error] [pid 24515:tid 24527] [client 20.100.175.19:32454] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfEN61OMnvM2fMnB1P8aAAAAAg"]
[Thu Apr 09 23:22:36.990764 2026] [:error] [pid 20837:tid 20842] [client 20.100.175.19:25549] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfEPPSL71FHZkjrGzMY2AAAAYM"]
[Thu Apr 09 23:22:39.883171 2026] [:error] [pid 20837:tid 20854] [client 20.100.175.19:50346] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfEP_SL71FHZkjrGzMY2gAAAY8"]
[Thu Apr 09 23:22:44.224962 2026] [:error] [pid 20837:tid 20850] [client 20.100.175.19:4666] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adfERPSL71FHZkjrGzMY2wAAAYs"]
[Thu Apr 09 23:22:44.902202 2026] [:error] [pid 63331:tid 63340] [client 20.100.175.19:43923] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adfERCbKfIYuVjWbE4WleAAAAcc"]
[Thu Apr 09 23:22:58.273959 2026] [:error] [pid 24515:tid 24529] [client 20.100.175.19:36127] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adfEUq1OMnvM2fMnB1P8fQAAAAo"]
[Thu Apr 09 23:23:05.602372 2026] [:error] [pid 63331:tid 63339] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/8daf1238_1774208172.php
[Thu Apr 09 23:23:05.865292 2026] [:error] [pid 63331:tid 63346] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Thu Apr 09 23:23:06.129942 2026] [:error] [pid 63331:tid 63356] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Thu Apr 09 23:23:06.849852 2026] [:error] [pid 63331:tid 63347] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Thu Apr 09 23:23:07.112341 2026] [:error] [pid 63331:tid 63345] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/buc.php
[Thu Apr 09 23:23:07.390324 2026] [:error] [pid 63331:tid 63336] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Thu Apr 09 23:23:07.654474 2026] [:error] [pid 63331:tid 63353] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Thu Apr 09 23:23:07.924043 2026] [:error] [pid 63331:tid 63355] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Thu Apr 09 23:23:08.208567 2026] [:error] [pid 63331:tid 63333] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Thu Apr 09 23:23:08.471687 2026] [:error] [pid 63331:tid 63354] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Thu Apr 09 23:23:08.745431 2026] [:error] [pid 63331:tid 63334] [client 20.100.175.19:37370] File does not exist: /usr/local/apache/htdocs/suspended-page/hhxc.php
[Thu Apr 09 23:23:09.004812 2026] [:error] [pid 63331:tid 63344] [client 20.100.175.19:37370] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0yellow.php"] [unique_id "adfEXSbKfIYuVjWbE4WliQAAAcs"]
[Thu Apr 09 23:23:10.019058 2026] [:error] [pid 63331:tid 63349] [client 20.100.175.19:42433] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0yellow.php"] [unique_id "adfEXibKfIYuVjWbE4WliwAAAdA"]
[Thu Apr 09 23:23:11.035984 2026] [:error] [pid 24515:tid 24533] [client 20.100.175.19:42439] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0yellow.php"] [unique_id "adfEX61OMnvM2fMnB1P8hAAAAA4"]
[Thu Apr 09 23:23:12.324361 2026] [:error] [pid 24624:tid 24642] [client 20.100.175.19:37368] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0yellow.php"] [unique_id "adfEYO4Jn-WvK1ZBTvj7qAAAANA"]
[Thu Apr 09 23:23:13.653029 2026] [:error] [pid 20837:tid 20851] [client 20.100.175.19:42432] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adfEYfSL71FHZkjrGzMY5AAAAYw"]
[Thu Apr 09 23:23:14.492699 2026] [:error] [pid 24515:tid 24535] [client 20.100.175.19:35485] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adfEYq1OMnvM2fMnB1P8iAAAABA"]
[Thu Apr 09 23:23:15.642550 2026] [:error] [pid 24515:tid 24536] [client 20.100.175.19:33999] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adfEY61OMnvM2fMnB1P8jgAAABE"]
[Thu Apr 09 23:23:16.887400 2026] [:error] [pid 24927:tid 24951] [client 20.100.175.19:47731] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/only.php"] [unique_id "adfEZDXObuzEuw8mNJs7eQAAARU"]
[Thu Apr 09 23:23:18.087815 2026] [:error] [pid 24515:tid 24526] [client 20.100.175.19:54983] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adfEZq1OMnvM2fMnB1P8lQAAAAc"]
[Thu Apr 09 23:23:19.136032 2026] [:error] [pid 24624:tid 24643] [client 20.100.175.19:42840] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adfEZ-4Jn-WvK1ZBTvj7sAAAANE"]
[Thu Apr 09 23:23:20.506988 2026] [:error] [pid 63331:tid 63345] [client 20.100.175.19:47288] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adfEaCbKfIYuVjWbE4WlkQAAAcw"]
[Thu Apr 09 23:23:22.238943 2026] [:error] [pid 63331:tid 63336] [client 20.100.175.19:42843] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adfEaibKfIYuVjWbE4WlkgAAAcM"]
[Thu Apr 09 23:23:24.298535 2026] [:error] [pid 24927:tid 24938] [client 20.100.175.19:47691] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adfEbDXObuzEuw8mNJs7ggAAAQg"]
[Thu Apr 09 23:23:27.809980 2026] [:error] [pid 63331:tid 63353] [client 20.100.175.19:28165] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adfEbybKfIYuVjWbE4WlkwAAAdQ"]
[Thu Apr 09 23:23:31.402275 2026] [:error] [pid 63331:tid 63355] [client 20.100.175.19:42859] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adfEcybKfIYuVjWbE4WllAAAAdY"]
[Thu Apr 09 23:23:33.907101 2026] [:error] [pid 20837:tid 20851] [client 20.100.175.19:28223] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adfEdfSL71FHZkjrGzMY9gAAAYw"]
[Thu Apr 09 23:23:39.743353 2026] [:error] [pid 24624:tid 24640] [client 20.100.175.19:47278] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adfEe-4Jn-WvK1ZBTvj7vgAAAM4"]
[Thu Apr 09 23:23:44.641596 2026] [:error] [pid 24624:tid 24634] [client 20.100.175.19:54772] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adfEgO4Jn-WvK1ZBTvj7xwAAAMg"]
[Thu Apr 09 23:23:48.054613 2026] [:error] [pid 20837:tid 20848] [client 20.100.175.19:45809] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adfEhPSL71FHZkjrGzMZDAAAAYk"]
[Thu Apr 09 23:23:50.939511 2026] [:error] [pid 24515:tid 24527] [client 20.100.175.19:33011] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adfEhq1OMnvM2fMnB1P8sQAAAAg"]
[Thu Apr 09 23:23:52.649530 2026] [:error] [pid 24517:tid 24580] [client 20.100.175.19:34412] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adfEiHboYEn2ZFM_PS-OYQAAAIY"]
[Thu Apr 09 23:23:54.080505 2026] [:error] [pid 24927:tid 24944] [client 20.100.175.19:34414] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adfEijXObuzEuw8mNJs7igAAAQ4"]
[Thu Apr 09 23:23:55.303086 2026] [:error] [pid 24515:tid 24522] [client 20.100.175.19:50426] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "adfEi61OMnvM2fMnB1P8uwAAAAM"]
[Thu Apr 09 23:23:57.957105 2026] [:error] [pid 20837:tid 20862] [client 20.100.175.19:32978] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfEjfSL71FHZkjrGzMZEQAAAZc"]
[Thu Apr 09 23:23:59.916587 2026] [:error] [pid 24515:tid 24520] [client 20.100.175.19:36914] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfEj61OMnvM2fMnB1P8wwAAAAE"]
[Thu Apr 09 23:24:03.744650 2026] [:error] [pid 24515:tid 24534] [client 20.100.175.19:32979] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfEk61OMnvM2fMnB1P8xgAAAA8"]
[Thu Apr 09 23:24:07.363117 2026] [:error] [pid 24515:tid 24537] [client 20.100.175.19:49931] [client 20.100.175.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "adfEl61OMnvM2fMnB1P8ywAAABI"]
[Thu Apr 09 23:24:08.984468 2026] [:error] [pid 20837:tid 20844] [client 20.100.175.19:48665] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Thu Apr 09 23:24:09.258062 2026] [:error] [pid 20837:tid 20855] [client 20.100.175.19:48665] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Fri Apr 10 01:26:25.502741 2026] [:error] [pid 29569:tid 29585] [client 49.51.47.100:42840] [client 49.51.47.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adfhQbt9mkieWu8HPk5C5gAAAUw"]
[Fri Apr 10 08:12:23.528451 2026] [:error] [pid 59286:tid 59293] [client 101.42.46.71:54624] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adhAZ21gMezN4JEr-RXHPgAAAcU"]
[Fri Apr 10 11:02:58.619912 2026] [:error] [pid 13100:tid 13108] [client 43.130.78.203:50872] [client 43.130.78.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adhoYlzg-ZkZ0InWIP3ibwAAAQM"]
[Fri Apr 10 11:42:04.965730 2026] [:error] [pid 13102:tid 13168] [client 146.70.40.70:45966] [client 146.70.40.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.40.70, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "adhxjP9xLvjW2guI55Z5ggAAAAg"]
[Fri Apr 10 11:42:04.969221 2026] [:error] [pid 13102:tid 13168] [client 146.70.40.70:45966] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri Apr 10 11:42:08.117543 2026] [:error] [pid 13102:tid 13184] [client 146.70.40.70:45966] [client 146.70.40.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "adhxkP9xLvjW2guI55Z5lAAAABg"]
[Fri Apr 10 11:42:08.654579 2026] [:error] [pid 13101:tid 13135] [client 146.70.40.70:35424] [client 146.70.40.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "adhxkN8Ldw85818pj2ru2gAAAII"]
[Fri Apr 10 11:42:09.186091 2026] [:error] [pid 13189:tid 13207] [client 146.70.40.70:35436] [client 146.70.40.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "adhxkZAxiJKPums3eBBG_gAAAE8"]
[Fri Apr 10 11:42:09.724147 2026] [:error] [pid 13189:tid 13215] [client 146.70.40.70:35446] [client 146.70.40.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "adhxkZAxiJKPums3eBBHAQAAAFc"]
[Fri Apr 10 11:42:10.265564 2026] [:error] [pid 13189:tid 13199] [client 146.70.40.70:35456] [client 146.70.40.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "adhxkpAxiJKPums3eBBHAwAAAEc"]
[Fri Apr 10 11:42:10.838943 2026] [:error] [pid 13102:tid 13165] [client 146.70.40.70:35470] [client 146.70.40.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "adhxkv9xLvjW2guI55Z5ngAAAAU"]
[Fri Apr 10 11:42:11.379906 2026] [:error] [pid 13102:tid 13181] [client 146.70.40.70:35478] [client 146.70.40.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "adhxk_9xLvjW2guI55Z5oQAAABU"]
[Fri Apr 10 13:22:26.606745 2026] [:error] [pid 13102:tid 13168] [client 43.128.156.124:49454] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adiJEv9xLvjW2guI55a0zAAAAAg"]
[Fri Apr 10 14:31:07.777070 2026] [:error] [pid 13100:tid 13113] [client 216.24.210.173:37279] [client 216.24.210.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adiZK1zg-ZkZ0InWIP0tegAAAQg"]
[Fri Apr 10 16:25:45.546840 2026] [:error] [pid 3934:tid 3959] [client 49.51.243.156:54922] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adi0CYa41m-BS8mg82cKcAAAANQ"]
[Fri Apr 10 18:30:40.523676 2026] [:error] [pid 13189:tid 13202] [client 43.167.157.80:59464] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adjRUJAxiJKPums3eBBvzwAAAEo"]
[Fri Apr 10 21:16:08.506734 2026] [:error] [pid 62615:tid 62635] [client 43.159.149.56:44858] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adj4GNSLyvZ9rO5uVseV6AAAAZI"]
[Sat Apr 11 00:32:08.723828 2026] [:error] [pid 63062:tid 63085] [client 20.238.64.167:38333] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Sat Apr 11 00:32:08.974205 2026] [:error] [pid 63062:tid 63075] [client 20.238.64.167:38333] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sat Apr 11 00:32:09.225693 2026] [:error] [pid 63062:tid 63073] [client 20.238.64.167:38333] File does not exist: /usr/local/apache/htdocs/suspended-page/ga.php
[Sat Apr 11 00:32:09.476771 2026] [:error] [pid 63062:tid 63069] [client 20.238.64.167:38333] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Sat Apr 11 00:32:09.727384 2026] [:error] [pid 63062:tid 63077] [client 20.238.64.167:38333] File does not exist: /usr/local/apache/htdocs/suspended-page/x3x.php
[Sat Apr 11 00:32:09.975716 2026] [:error] [pid 63062:tid 63064] [client 20.238.64.167:38333] [client 20.238.64.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adkmCZ2HtsmV85NqkMcg2AAAA4A"]
[Sat Apr 11 00:32:10.475565 2026] [:error] [pid 62769:tid 62779] [client 20.238.64.167:38282] File does not exist: /usr/local/apache/htdocs/suspended-page/state.php
[Sat Apr 11 00:32:10.726561 2026] [:error] [pid 62769:tid 62789] [client 20.238.64.167:38282] File does not exist: /usr/local/apache/htdocs/suspended-page/xozx.php
[Sat Apr 11 00:32:10.975976 2026] [:error] [pid 62769:tid 62794] [client 20.238.64.167:38282] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Sat Apr 11 00:32:11.225521 2026] [:error] [pid 62769:tid 62773] [client 20.238.64.167:38282] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sat Apr 11 00:32:11.476327 2026] [:error] [pid 62769:tid 62777] [client 20.238.64.167:38282] File does not exist: /usr/local/apache/htdocs/suspended-page/97.php
[Sat Apr 11 00:32:11.722570 2026] [:error] [pid 62769:tid 62776] [client 20.238.64.167:38282] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "adkmC8WsSnfLoB8ifjD6rAAAAkU"]
[Sat Apr 11 00:32:12.223652 2026] [:error] [pid 13189:tid 13201] [client 20.238.64.167:38297] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "adkmDJAxiJKPums3eBA2oAAAAEk"]
[Sat Apr 11 00:32:12.722391 2026] [:error] [pid 62769:tid 62780] [client 20.238.64.167:38318] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "adkmDMWsSnfLoB8ifjD6twAAAkk"]
[Sat Apr 11 00:32:13.222443 2026] [:error] [pid 13189:tid 13210] [client 20.238.64.167:38327] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "adkmDZAxiJKPums3eBA2pAAAAFI"]
[Sat Apr 11 00:32:13.720374 2026] [:error] [pid 63134:tid 63141] [client 20.238.64.167:36098] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adkmDdFALqPDwWi6eJLeNQAAA8Q"]
[Sat Apr 11 00:32:14.223144 2026] [:error] [pid 13101:tid 13143] [client 20.238.64.167:36143] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adkmDt8Ldw85818pj2pABgAAAIo"]
[Sat Apr 11 00:32:14.743499 2026] [:error] [pid 62769:tid 62794] [client 20.238.64.167:36127] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adkmDsWsSnfLoB8ifjD6ywAAAlc"]
[Sat Apr 11 00:32:15.240449 2026] [:error] [pid 63062:tid 63081] [client 20.238.64.167:38312] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adkmD52HtsmV85NqkMcg5AAAA5E"]
[Sat Apr 11 00:32:15.739758 2026] [:error] [pid 63134:tid 63147] [client 20.238.64.167:36113] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adkmD9FALqPDwWi6eJLeOgAAA8o"]
[Sat Apr 11 00:32:16.233550 2026] [:error] [pid 62710:tid 62731] [client 20.238.64.167:36122] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adkmEOME7qrf5xEWWJteYwAAAhI"]
[Sat Apr 11 00:32:16.730764 2026] [:error] [pid 13101:tid 13155] [client 20.238.64.167:36114] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adkmEN8Ldw85818pj2pADQAAAJY"]
[Sat Apr 11 00:32:17.237779 2026] [:error] [pid 13189:tid 13204] [client 20.238.64.167:38307] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "adkmEZAxiJKPums3eBA2tQAAAEw"]
[Sat Apr 11 00:32:17.747552 2026] [:error] [pid 63134:tid 63157] [client 20.238.64.167:36121] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "adkmEdFALqPDwWi6eJLeOwAAA9Q"]
[Sat Apr 11 00:32:18.257356 2026] [:error] [pid 13189:tid 13211] [client 20.238.64.167:38275] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "adkmEpAxiJKPums3eBA2twAAAFM"]
[Sat Apr 11 00:32:18.765353 2026] [:error] [pid 62819:tid 62845] [client 20.238.64.167:36117] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "adkmEvU20EyPf7NlsleSLgAAApc"]
[Sat Apr 11 00:32:19.263265 2026] [:error] [pid 62651:tid 62673] [client 20.238.64.167:38313] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "adkmEzbAH0le57SIaqxC9AAAAdQ"]
[Sat Apr 11 00:32:19.760296 2026] [:error] [pid 13101:tid 13144] [client 20.238.64.167:38334] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adkmE98Ldw85818pj2pAFAAAAIs"]
[Sat Apr 11 00:32:20.262228 2026] [:error] [pid 62884:tid 62912] [client 20.238.64.167:36118] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adkmFOUCK1xrhnnmpo2mMgAAAtU"]
[Sat Apr 11 00:32:20.775411 2026] [:error] [pid 63134:tid 63152] [client 20.238.64.167:38329] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adkmFNFALqPDwWi6eJLeQQAAA88"]
[Sat Apr 11 00:32:21.274835 2026] [:error] [pid 13100:tid 13105] [client 20.238.64.167:38298] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adkmFVzg-ZkZ0InWIP3a9QAAAQA"]
[Sat Apr 11 00:32:21.770580 2026] [:error] [pid 62884:tid 62904] [client 20.238.64.167:36101] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adkmFeUCK1xrhnnmpo2mNQAAAs0"]
[Sat Apr 11 00:32:22.274937 2026] [:error] [pid 62769:tid 62778] [client 20.238.64.167:36158] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adkmFsWsSnfLoB8ifjD62AAAAkc"]
[Sat Apr 11 00:32:22.771056 2026] [:error] [pid 62769:tid 62784] [client 20.238.64.167:36124] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adkmFsWsSnfLoB8ifjD64QAAAk0"]
[Sat Apr 11 00:32:23.276056 2026] [:error] [pid 63134:tid 63154] [client 20.238.64.167:36154] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "adkmF9FALqPDwWi6eJLeRwAAA9E"]
[Sat Apr 11 00:32:23.770952 2026] [:error] [pid 13189:tid 13199] [client 20.238.64.167:38324] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "adkmF5AxiJKPums3eBA2wwAAAEc"]
[Sat Apr 11 00:32:24.267975 2026] [:error] [pid 13189:tid 13208] [client 20.238.64.167:38321] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "adkmGJAxiJKPums3eBA2ygAAAFA"]
[Sat Apr 11 00:32:24.764011 2026] [:error] [pid 13101:tid 13157] [client 20.238.64.167:38303] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "adkmGN8Ldw85818pj2pAIwAAAJg"]
[Sat Apr 11 00:32:25.260510 2026] [:error] [pid 13101:tid 13138] [client 20.238.64.167:38283] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "adkmGd8Ldw85818pj2pAKQAAAIU"]
[Sat Apr 11 00:32:25.757484 2026] [:error] [pid 63134:tid 63151] [client 20.238.64.167:38281] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adkmGdFALqPDwWi6eJLeTQAAA84"]
[Sat Apr 11 00:32:26.256860 2026] [:error] [pid 13101:tid 13156] [client 20.238.64.167:36139] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adkmGt8Ldw85818pj2pAMAAAAJc"]
[Sat Apr 11 00:32:26.757033 2026] [:error] [pid 62884:tid 62906] [client 20.238.64.167:38316] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adkmGuUCK1xrhnnmpo2mNgAAAs8"]
[Sat Apr 11 00:32:27.257035 2026] [:error] [pid 62769:tid 62781] [client 20.238.64.167:36103] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adkmG8WsSnfLoB8ifjD7IwAAAko"]
[Sat Apr 11 00:32:27.764107 2026] [:error] [pid 62884:tid 62914] [client 20.238.64.167:38273] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wswer1.php"] [unique_id "adkmG-UCK1xrhnnmpo2mNwAAAtc"]
[Sat Apr 11 00:32:28.262378 2026] [:error] [pid 13101:tid 13137] [client 20.238.64.167:38330] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wswer1.php"] [unique_id "adkmHN8Ldw85818pj2pAPAAAAIQ"]
[Sat Apr 11 00:32:28.759656 2026] [:error] [pid 62769:tid 62780] [client 20.238.64.167:38323] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wswer1.php"] [unique_id "adkmHMWsSnfLoB8ifjD7PQAAAkk"]
[Sat Apr 11 00:32:29.256213 2026] [:error] [pid 13101:tid 13143] [client 20.238.64.167:38304] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wswer1.php"] [unique_id "adkmHd8Ldw85818pj2pAQAAAAIo"]
[Sat Apr 11 00:32:29.750617 2026] [:error] [pid 62769:tid 62771] [client 20.238.64.167:38314] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adkmHcWsSnfLoB8ifjD7RgAAAkA"]
[Sat Apr 11 00:32:30.246747 2026] [:error] [pid 62769:tid 62778] [client 20.238.64.167:36109] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adkmHsWsSnfLoB8ifjD7SgAAAkc"]
[Sat Apr 11 00:32:30.742503 2026] [:error] [pid 62769:tid 62772] [client 20.238.64.167:36126] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adkmHsWsSnfLoB8ifjD7TgAAAkE"]
[Sat Apr 11 00:32:31.247186 2026] [:error] [pid 62710:tid 62713] [client 20.238.64.167:38294] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adkmH-ME7qrf5xEWWJteggAAAgA"]
[Sat Apr 11 00:32:31.743723 2026] [:error] [pid 62710:tid 62732] [client 20.238.64.167:36123] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adkmH-ME7qrf5xEWWJteigAAAhM"]
[Sat Apr 11 00:32:32.239140 2026] [:error] [pid 13189:tid 13203] [client 20.238.64.167:8082] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adkmIJAxiJKPums3eBA2_AAAAEs"]
[Sat Apr 11 00:32:32.737990 2026] [:error] [pid 13189:tid 13202] [client 20.238.64.167:38306] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adkmIJAxiJKPums3eBA3CAAAAEo"]
[Sat Apr 11 00:32:33.233058 2026] [:error] [pid 13189:tid 13196] [client 20.238.64.167:38279] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adkmIZAxiJKPums3eBA3EQAAAEQ"]
[Sat Apr 11 00:32:33.732342 2026] [:error] [pid 62769:tid 62781] [client 20.238.64.167:36155] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adkmIcWsSnfLoB8ifjD7WAAAAko"]
[Sat Apr 11 00:32:34.236384 2026] [:error] [pid 13100:tid 13105] [client 20.238.64.167:36119] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adkmIlzg-ZkZ0InWIP3bAAAAAQA"]
[Sat Apr 11 00:32:34.732032 2026] [:error] [pid 13189:tid 13193] [client 20.238.64.167:38272] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adkmIpAxiJKPums3eBA3IAAAAEE"]
[Sat Apr 11 00:32:35.249425 2026] [:error] [pid 62710:tid 62733] [client 20.238.64.167:36111] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adkmI-ME7qrf5xEWWJtejwAAAhQ"]
[Sat Apr 11 00:32:35.755691 2026] [:error] [pid 62769:tid 62779] [client 20.238.64.167:38325] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adkmI8WsSnfLoB8ifjD7ZwAAAkg"]
[Sat Apr 11 00:32:36.263900 2026] [:error] [pid 62710:tid 62734] [client 20.238.64.167:8153] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adkmJOME7qrf5xEWWJtelAAAAhU"]
[Sat Apr 11 00:32:36.757607 2026] [:error] [pid 62710:tid 62732] [client 20.238.64.167:36099] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adkmJOME7qrf5xEWWJtelgAAAhM"]
[Sat Apr 11 00:32:37.255514 2026] [:error] [pid 62769:tid 62783] [client 20.238.64.167:36105] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adkmJcWsSnfLoB8ifjD7bwAAAkw"]
[Sat Apr 11 00:32:37.756807 2026] [:error] [pid 13189:tid 13200] [client 20.238.64.167:36135] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-turn.php"] [unique_id "adkmJZAxiJKPums3eBA3NgAAAEg"]
[Sat Apr 11 00:32:38.264909 2026] [:error] [pid 13101:tid 13136] [client 20.238.64.167:8130] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-turn.php"] [unique_id "adkmJt8Ldw85818pj2pATAAAAIM"]
[Sat Apr 11 00:32:38.763696 2026] [:error] [pid 62769:tid 62791] [client 20.238.64.167:8178] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-turn.php"] [unique_id "adkmJsWsSnfLoB8ifjD7fAAAAlQ"]
[Sat Apr 11 00:32:39.267109 2026] [:error] [pid 62651:tid 62668] [client 20.238.64.167:38295] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-turn.php"] [unique_id "adkmJzbAH0le57SIaqxDGwAAAc8"]
[Sat Apr 11 00:32:39.823474 2026] [:error] [pid 62769:tid 62780] [client 20.238.64.167:8147] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "adkmJ8WsSnfLoB8ifjD7hAAAAkk"]
[Sat Apr 11 00:32:40.349872 2026] [:error] [pid 62769:tid 62786] [client 20.238.64.167:36157] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "adkmKMWsSnfLoB8ifjD7hgAAAk8"]
[Sat Apr 11 00:32:40.885378 2026] [:error] [pid 62651:tid 62665] [client 20.238.64.167:38292] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "adkmKDbAH0le57SIaqxDHAAAAcw"]
[Sat Apr 11 00:32:41.385296 2026] [:error] [pid 13101:tid 13157] [client 20.238.64.167:8132] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "adkmKd8Ldw85818pj2pAWAAAAJg"]
[Sat Apr 11 00:32:41.892026 2026] [:error] [pid 13101:tid 13135] [client 20.238.64.167:36096] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adkmKd8Ldw85818pj2pAXQAAAII"]
[Sat Apr 11 00:32:42.387690 2026] [:error] [pid 62769:tid 62773] [client 20.238.64.167:8164] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adkmKsWsSnfLoB8ifjD7kQAAAkI"]
[Sat Apr 11 00:32:42.896163 2026] [:error] [pid 62651:tid 62653] [client 20.238.64.167:36159] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adkmKjbAH0le57SIaqxDHwAAAcA"]
[Sat Apr 11 00:32:43.401909 2026] [:error] [pid 63134:tid 63155] [client 20.238.64.167:38309] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/red.php"] [unique_id "adkmK9FALqPDwWi6eJLeUgAAA9I"]
[Sat Apr 11 00:32:43.900259 2026] [:error] [pid 63134:tid 63154] [client 20.238.64.167:38332] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adkmK9FALqPDwWi6eJLeVAAAA9E"]
[Sat Apr 11 00:32:44.405893 2026] [:error] [pid 62884:tid 62910] [client 20.238.64.167:8148] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adkmLOUCK1xrhnnmpo2mQgAAAtM"]
[Sat Apr 11 00:32:44.902416 2026] [:error] [pid 63134:tid 63139] [client 20.238.64.167:38319] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adkmLNFALqPDwWi6eJLeXgAAA8I"]
[Sat Apr 11 00:32:45.398999 2026] [:error] [pid 13101:tid 13151] [client 20.238.64.167:36128] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "adkmLd8Ldw85818pj2pAcQAAAJI"]
[Sat Apr 11 00:32:45.893198 2026] [:error] [pid 62769:tid 62781] [client 20.238.64.167:38335] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adkmLcWsSnfLoB8ifjD7mgAAAko"]
[Sat Apr 11 00:32:46.391896 2026] [:error] [pid 13189:tid 13205] [client 20.238.64.167:8139] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adkmLpAxiJKPums3eBA3RQAAAE0"]
[Sat Apr 11 00:32:46.889284 2026] [:error] [pid 13189:tid 13196] [client 20.238.64.167:36108] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adkmLpAxiJKPums3eBA3SQAAAEQ"]
[Sat Apr 11 00:32:47.387088 2026] [:error] [pid 13101:tid 13137] [client 20.238.64.167:38308] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adkmL98Ldw85818pj2pAfAAAAIQ"]
[Sat Apr 11 00:32:47.885760 2026] [:error] [pid 62769:tid 62772] [client 20.238.64.167:36146] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "adkmL8WsSnfLoB8ifjD7pwAAAkE"]
[Sat Apr 11 00:32:48.387558 2026] [:error] [pid 62769:tid 62790] [client 20.238.64.167:36132] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "adkmMMWsSnfLoB8ifjD7rgAAAlM"]
[Sat Apr 11 00:32:48.880826 2026] [:error] [pid 63134:tid 63150] [client 20.238.64.167:8176] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "adkmMNFALqPDwWi6eJLeZQAAA80"]
[Sat Apr 11 00:32:49.377567 2026] [:error] [pid 62769:tid 62776] [client 20.238.64.167:36125] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "adkmMcWsSnfLoB8ifjD7uQAAAkU"]
[Sat Apr 11 00:32:49.872184 2026] [:error] [pid 62769:tid 62782] [client 20.238.64.167:38326] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adkmMcWsSnfLoB8ifjD7vwAAAks"]
[Sat Apr 11 00:32:50.368809 2026] [:error] [pid 62769:tid 62783] [client 20.238.64.167:38280] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adkmMsWsSnfLoB8ifjD7xQAAAkw"]
[Sat Apr 11 00:32:50.865478 2026] [:error] [pid 62884:tid 62914] [client 20.238.64.167:38300] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adkmMuUCK1xrhnnmpo2mRQAAAtc"]
[Sat Apr 11 00:32:51.370340 2026] [:error] [pid 13189:tid 13195] [client 20.238.64.167:38311] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "adkmM5AxiJKPums3eBA3TgAAAEM"]
[Sat Apr 11 00:32:51.866133 2026] [:error] [pid 63062:tid 63084] [client 20.238.64.167:38289] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adkmM52HtsmV85NqkMchDQAAA5Q"]
[Sat Apr 11 00:32:52.366608 2026] [:error] [pid 13101:tid 13146] [client 20.238.64.167:36106] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adkmNN8Ldw85818pj2pAgwAAAI0"]
[Sat Apr 11 00:32:52.864053 2026] [:error] [pid 13101:tid 13143] [client 20.238.64.167:8137] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adkmNN8Ldw85818pj2pAhwAAAIo"]
[Sat Apr 11 00:32:53.365796 2026] [:error] [pid 62769:tid 62773] [client 20.238.64.167:38296] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "adkmNcWsSnfLoB8ifjD70QAAAkI"]
[Sat Apr 11 00:32:53.867534 2026] [:error] [pid 62769:tid 62790] [client 20.238.64.167:36156] [client 20.238.64.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adkmNcWsSnfLoB8ifjD71gAAAlM"]
[Sat Apr 11 00:32:54.368300 2026] [:error] [pid 62710:tid 62719] [client 20.238.64.167:38288] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adkmNuME7qrf5xEWWJteqwAAAgY"]
[Sat Apr 11 00:32:54.868019 2026] [:error] [pid 63134:tid 63149] [client 20.238.64.167:38276] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adkmNtFALqPDwWi6eJLeagAAA8w"]
[Sat Apr 11 00:32:55.363196 2026] [:error] [pid 62769:tid 62792] [client 20.238.64.167:38320] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "adkmN8WsSnfLoB8ifjD72wAAAlU"]
[Sat Apr 11 00:32:55.863669 2026] [:error] [pid 63134:tid 63150] [client 20.238.64.167:8071] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myy.php"] [unique_id "adkmN9FALqPDwWi6eJLebwAAA80"]
[Sat Apr 11 00:32:56.361608 2026] [:error] [pid 13189:tid 13214] [client 20.238.64.167:36144] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myy.php"] [unique_id "adkmOJAxiJKPums3eBA3WAAAAFY"]
[Sat Apr 11 00:32:56.862645 2026] [:error] [pid 63062:tid 63072] [client 20.238.64.167:38328] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myy.php"] [unique_id "adkmOJ2HtsmV85NqkMchEgAAA4g"]
[Sat Apr 11 00:32:57.363748 2026] [:error] [pid 62769:tid 62784] [client 20.238.64.167:38302] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myy.php"] [unique_id "adkmOcWsSnfLoB8ifjD74QAAAk0"]
[Sat Apr 11 00:32:57.869036 2026] [:error] [pid 62769:tid 62789] [client 20.238.64.167:36129] [client 20.238.64.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "adkmOcWsSnfLoB8ifjD75QAAAlI"]
[Sat Apr 11 00:32:58.367783 2026] [:error] [pid 63134:tid 63151] [client 20.238.64.167:8141] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "adkmOtFALqPDwWi6eJLecgAAA84"]
[Sat Apr 11 00:32:58.862641 2026] [:error] [pid 62710:tid 62737] [client 20.238.64.167:38285] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "adkmOuME7qrf5xEWWJtesQAAAhg"]
[Sat Apr 11 00:32:59.359864 2026] [:error] [pid 13101:tid 13153] [client 20.238.64.167:8169] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wdone1.php"] [unique_id "adkmO98Ldw85818pj2pAlAAAAJQ"]
[Sat Apr 11 00:32:59.857976 2026] [:error] [pid 62710:tid 62713] [client 20.238.64.167:8149] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adkmO-ME7qrf5xEWWJtesgAAAgA"]
[Sat Apr 11 00:33:00.355069 2026] [:error] [pid 62651:tid 62666] [client 20.238.64.167:38284] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adkmPDbAH0le57SIaqxDIwAAAc0"]
[Sat Apr 11 00:33:00.870760 2026] [:error] [pid 13100:tid 13106] [client 20.238.64.167:8077] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adkmPFzg-ZkZ0InWIP3bHQAAAQE"]
[Sat Apr 11 00:33:01.365005 2026] [:error] [pid 13189:tid 13199] [client 20.238.64.167:36112] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "adkmPZAxiJKPums3eBA3gQAAAEc"]
[Sat Apr 11 00:33:01.861282 2026] [:error] [pid 13189:tid 13195] [client 20.238.64.167:8138] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adkmPZAxiJKPums3eBA3hgAAAEM"]
[Sat Apr 11 00:33:02.363004 2026] [:error] [pid 13189:tid 13211] [client 20.238.64.167:38301] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adkmPpAxiJKPums3eBA3jgAAAFM"]
[Sat Apr 11 00:33:02.864039 2026] [:error] [pid 63134:tid 63137] [client 20.238.64.167:8163] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adkmPtFALqPDwWi6eJLegwAAA8A"]
[Sat Apr 11 00:33:03.381122 2026] [:error] [pid 13189:tid 13210] [client 20.238.64.167:8158] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adkmP5AxiJKPums3eBA3mAAAAFI"]
[Sat Apr 11 00:33:03.889542 2026] [:error] [pid 13189:tid 13196] [client 20.238.64.167:8091] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "adkmP5AxiJKPums3eBA3mwAAAEQ"]
[Sat Apr 11 00:33:04.394664 2026] [:error] [pid 62710:tid 62718] [client 20.238.64.167:38305] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "adkmQOME7qrf5xEWWJteuAAAAgU"]
[Sat Apr 11 00:33:04.896610 2026] [:error] [pid 63062:tid 63070] [client 20.238.64.167:36130] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "adkmQJ2HtsmV85NqkMchGAAAA4Y"]
[Sat Apr 11 00:33:05.398906 2026] [:error] [pid 62819:tid 62841] [client 20.238.64.167:8142] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccs.php"] [unique_id "adkmQfU20EyPf7NlsleSSAAAApM"]
[Sat Apr 11 00:33:05.896698 2026] [:error] [pid 62819:tid 62843] [client 20.238.64.167:36115] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "adkmQfU20EyPf7NlsleSTAAAApU"]
[Sat Apr 11 00:33:06.398376 2026] [:error] [pid 63134:tid 63140] [client 20.238.64.167:36102] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "adkmQtFALqPDwWi6eJLehwAAA8M"]
[Sat Apr 11 00:33:06.896347 2026] [:error] [pid 62769:tid 62781] [client 20.238.64.167:38310] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "adkmQsWsSnfLoB8ifjD79wAAAko"]
[Sat Apr 11 00:33:07.399477 2026] [:error] [pid 63134:tid 63160] [client 20.238.64.167:8161] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "adkmQ9FALqPDwWi6eJLeiQAAA9c"]
[Sat Apr 11 00:33:07.904378 2026] [:error] [pid 13101:tid 13137] [client 20.238.64.167:8175] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adkmQ98Ldw85818pj2pAmQAAAIQ"]
[Sat Apr 11 00:33:08.401368 2026] [:error] [pid 62710:tid 62728] [client 20.238.64.167:8174] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adkmROME7qrf5xEWWJtexQAAAg8"]
[Sat Apr 11 00:33:08.898822 2026] [:error] [pid 13189:tid 13192] [client 20.238.64.167:8133] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adkmRJAxiJKPums3eBA3qgAAAEA"]
[Sat Apr 11 00:33:09.396164 2026] [:error] [pid 13189:tid 13211] [client 20.238.64.167:8152] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adkmRZAxiJKPums3eBA3rgAAAFM"]
[Sat Apr 11 00:33:09.901407 2026] [:error] [pid 62819:tid 62842] [client 20.238.64.167:38290] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adkmRfU20EyPf7NlsleSYQAAApQ"]
[Sat Apr 11 00:33:10.397108 2026] [:error] [pid 13189:tid 13216] [client 20.238.64.167:8182] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adkmRpAxiJKPums3eBA3sgAAAFg"]
[Sat Apr 11 00:33:10.911247 2026] [:error] [pid 62819:tid 62829] [client 20.238.64.167:38286] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adkmRvU20EyPf7NlsleSZwAAAoc"]
[Sat Apr 11 00:33:11.409845 2026] [:error] [pid 13189:tid 13192] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Sat Apr 11 00:33:11.660244 2026] [:error] [pid 13189:tid 13196] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny2.php
[Sat Apr 11 00:33:11.912005 2026] [:error] [pid 13189:tid 13212] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/ava.php
[Sat Apr 11 00:33:12.162379 2026] [:error] [pid 13189:tid 13204] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/awh.php
[Sat Apr 11 00:33:12.428309 2026] [:error] [pid 13189:tid 13213] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Sat Apr 11 00:33:12.679659 2026] [:error] [pid 13189:tid 13195] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sat Apr 11 00:33:12.930351 2026] [:error] [pid 13189:tid 13216] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sat Apr 11 00:33:13.181397 2026] [:error] [pid 13189:tid 13209] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Sat Apr 11 00:33:13.433013 2026] [:error] [pid 13189:tid 13200] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/riz.php
[Sat Apr 11 00:33:13.683761 2026] [:error] [pid 13189:tid 13212] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Sat Apr 11 00:33:13.934077 2026] [:error] [pid 13189:tid 13204] [client 20.238.64.167:36120] File does not exist: /usr/local/apache/htdocs/suspended-page/om.php
[Sat Apr 11 00:33:14.181819 2026] [:error] [pid 13189:tid 13205] [client 20.238.64.167:36120] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adkmSpAxiJKPums3eBA3zAAAAE0"]
[Sat Apr 11 00:33:14.678384 2026] [:error] [pid 13189:tid 13208] [client 20.238.64.167:8167] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adkmSpAxiJKPums3eBA3zgAAAFA"]
[Sat Apr 11 00:33:15.174472 2026] [:error] [pid 13189:tid 13192] [client 20.238.64.167:8079] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adkmS5AxiJKPums3eBA30gAAAEA"]
[Sat Apr 11 00:33:15.669187 2026] [:error] [pid 13101:tid 13139] [client 20.238.64.167:8184] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "adkmS98Ldw85818pj2pAqAAAAIY"]
[Sat Apr 11 00:33:16.167011 2026] [:error] [pid 62769:tid 62771] [client 20.238.64.167:8096] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adkmTMWsSnfLoB8ifjD8FgAAAkA"]
[Sat Apr 11 00:33:16.664631 2026] [:error] [pid 62769:tid 62773] [client 20.238.64.167:36134] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adkmTMWsSnfLoB8ifjD8GgAAAkI"]
[Sat Apr 11 00:33:17.158582 2026] [:error] [pid 62769:tid 62790] [client 20.238.64.167:8181] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adkmTcWsSnfLoB8ifjD8GwAAAlM"]
[Sat Apr 11 00:33:17.654454 2026] [:error] [pid 13189:tid 13213] [client 20.238.64.167:8064] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adkmTZAxiJKPums3eBA33QAAAFU"]
[Sat Apr 11 00:33:18.150986 2026] [:error] [pid 63134:tid 63153] [client 20.238.64.167:8171] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adkmTtFALqPDwWi6eJLemQAAA9A"]
[Sat Apr 11 00:33:18.657025 2026] [:error] [pid 62710:tid 62737] [client 20.238.64.167:36138] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adkmTuME7qrf5xEWWJte0QAAAhg"]
[Sat Apr 11 00:33:19.153320 2026] [:error] [pid 62710:tid 62729] [client 20.238.64.167:8144] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adkmT-ME7qrf5xEWWJte1gAAAhA"]
[Sat Apr 11 00:33:19.648947 2026] [:error] [pid 63134:tid 63145] [client 20.238.64.167:8123] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "adkmT9FALqPDwWi6eJLenAAAA8g"]
[Sat Apr 11 00:33:20.142442 2026] [:error] [pid 62884:tid 62909] [client 20.238.64.167:38322] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adkmUOUCK1xrhnnmpo2mUwAAAtI"]
[Sat Apr 11 00:33:20.641005 2026] [:error] [pid 63062:tid 63073] [client 20.238.64.167:8157] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adkmUJ2HtsmV85NqkMchLQAAA4k"]
[Sat Apr 11 00:33:21.138307 2026] [:error] [pid 63062:tid 63081] [client 20.238.64.167:36107] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adkmUZ2HtsmV85NqkMchMQAAA5E"]
[Sat Apr 11 00:33:21.676280 2026] [:error] [pid 62710:tid 62734] [client 20.238.64.167:8162] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wolf.php"] [unique_id "adkmUeME7qrf5xEWWJte3QAAAhU"]
[Sat Apr 11 00:33:22.175786 2026] [:error] [pid 13101:tid 13151] [client 20.238.64.167:8070] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "adkmUt8Ldw85818pj2pAsgAAAJI"]
[Sat Apr 11 00:33:22.674022 2026] [:error] [pid 13189:tid 13210] [client 20.238.64.167:8101] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "adkmUpAxiJKPums3eBA35AAAAFI"]
[Sat Apr 11 00:33:23.167677 2026] [:error] [pid 13189:tid 13209] [client 20.238.64.167:38322] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "adkmU5AxiJKPums3eBA35QAAAFE"]
[Sat Apr 11 00:33:23.664376 2026] [:error] [pid 13189:tid 13194] [client 20.238.64.167:36142] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "adkmU5AxiJKPums3eBA37AAAAEI"]
[Sat Apr 11 00:33:24.159573 2026] [:error] [pid 13189:tid 13211] [client 20.238.64.167:36141] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adkmVJAxiJKPums3eBA38QAAAFM"]
[Sat Apr 11 00:33:24.657043 2026] [:error] [pid 13189:tid 13212] [client 20.238.64.167:8092] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adkmVJAxiJKPums3eBA39wAAAFQ"]
[Sat Apr 11 00:33:25.151804 2026] [:error] [pid 62769:tid 62791] [client 20.238.64.167:8080] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adkmVcWsSnfLoB8ifjD8KAAAAlQ"]
[Sat Apr 11 00:33:25.652129 2026] [:error] [pid 63062:tid 63073] [client 20.238.64.167:36151] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "adkmVZ2HtsmV85NqkMchNAAAA4k"]
[Sat Apr 11 00:33:26.145481 2026] [:error] [pid 13101:tid 13147] [client 20.238.64.167:8191] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkmVt8Ldw85818pj2pAwQAAAI4"]
[Sat Apr 11 00:33:26.644313 2026] [:error] [pid 13101:tid 13157] [client 20.238.64.167:38287] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkmVt8Ldw85818pj2pAwgAAAJg"]
[Sat Apr 11 00:33:27.141456 2026] [:error] [pid 62710:tid 62720] [client 20.238.64.167:8150] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkmV-ME7qrf5xEWWJte4QAAAgc"]
[Sat Apr 11 00:33:27.647678 2026] [:error] [pid 62710:tid 62722] [client 20.238.64.167:38299] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pxw8hpvyfvvpojjxvnCdefault.php"] [unique_id "adkmV-ME7qrf5xEWWJte4wAAAgk"]
[Sat Apr 11 00:33:28.144713 2026] [:error] [pid 62710:tid 62736] [client 20.238.64.167:36110] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkmWOME7qrf5xEWWJte6QAAAhc"]
[Sat Apr 11 00:33:28.642289 2026] [:error] [pid 62769:tid 62781] [client 20.238.64.167:8119] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkmWMWsSnfLoB8ifjD8NwAAAko"]
[Sat Apr 11 00:33:29.139037 2026] [:error] [pid 62710:tid 62718] [client 20.238.64.167:8081] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkmWeME7qrf5xEWWJte8gAAAgU"]
[Sat Apr 11 00:33:29.634546 2026] [:error] [pid 63134:tid 63152] [client 20.238.64.167:36153] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/c6jpzOQvtPyeM9hdefault.php"] [unique_id "adkmWdFALqPDwWi6eJLeqQAAA88"]
[Sat Apr 11 00:33:30.127625 2026] [:error] [pid 62769:tid 62788] [client 20.238.64.167:8128] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkmWsWsSnfLoB8ifjD8OAAAAlE"]
[Sat Apr 11 00:33:30.629929 2026] [:error] [pid 62769:tid 62778] [client 20.238.64.167:8145] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkmWsWsSnfLoB8ifjD8OgAAAkc"]
[Sat Apr 11 00:33:31.125547 2026] [:error] [pid 63134:tid 63145] [client 20.238.64.167:38315] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkmW9FALqPDwWi6eJLeqwAAA8g"]
[Sat Apr 11 00:33:31.628633 2026] [:error] [pid 13100:tid 13110] [client 20.238.64.167:8066] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mfptbopeeg7v0sezxnbtgcgsCdefault.php"] [unique_id "adkmW1zg-ZkZ0InWIP3bKwAAAQU"]
[Sat Apr 11 00:33:32.128516 2026] [:error] [pid 62769:tid 62782] [client 20.238.64.167:8076] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/image.php"] [unique_id "adkmXMWsSnfLoB8ifjD8QgAAAks"]
[Sat Apr 11 00:33:32.623916 2026] [:error] [pid 13100:tid 13123] [client 20.238.64.167:8131] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/image.php"] [unique_id "adkmXFzg-ZkZ0InWIP3bLAAAARI"]
[Sat Apr 11 00:33:33.122134 2026] [:error] [pid 63062:tid 63079] [client 20.238.64.167:8090] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/image.php"] [unique_id "adkmXZ2HtsmV85NqkMchOQAAA48"]
[Sat Apr 11 00:33:33.618778 2026] [:error] [pid 62769:tid 62789] [client 20.238.64.167:8010] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/image.php"] [unique_id "adkmXcWsSnfLoB8ifjD8SQAAAlI"]
[Sat Apr 11 00:33:34.110447 2026] [:error] [pid 13189:tid 13200] [client 20.238.64.167:8089] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkmXpAxiJKPums3eBA4BwAAAEg"]
[Sat Apr 11 00:33:34.603304 2026] [:error] [pid 13100:tid 13108] [client 20.238.64.167:36148] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkmXlzg-ZkZ0InWIP3bLwAAAQM"]
[Sat Apr 11 00:33:35.108465 2026] [:error] [pid 13101:tid 13140] [client 20.238.64.167:8156] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkmX98Ldw85818pj2pAzQAAAIc"]
[Sat Apr 11 00:33:35.601878 2026] [:error] [pid 13100:tid 13124] [client 20.238.64.167:36145] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adkmX1zg-ZkZ0InWIP3bMAAAARM"]
[Sat Apr 11 00:33:36.103852 2026] [:error] [pid 62769:tid 62789] [client 20.238.64.167:8106] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkmYMWsSnfLoB8ifjD8WAAAAlI"]
[Sat Apr 11 00:33:36.600954 2026] [:error] [pid 13189:tid 13203] [client 20.238.64.167:36097] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkmYJAxiJKPums3eBA4DwAAAEs"]
[Sat Apr 11 00:33:37.109117 2026] [:error] [pid 63062:tid 63067] [client 20.238.64.167:36137] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkmYZ2HtsmV85NqkMchPAAAA4M"]
[Sat Apr 11 00:33:37.606334 2026] [:error] [pid 13189:tid 13213] [client 20.238.64.167:36140] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adkmYZAxiJKPums3eBA4EAAAAFU"]
[Sat Apr 11 00:33:38.113313 2026] [:error] [pid 13189:tid 13210] [client 20.238.64.167:8052] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkmYpAxiJKPums3eBA4EQAAAFI"]
[Sat Apr 11 00:33:38.612686 2026] [:error] [pid 13189:tid 13199] [client 20.238.64.167:8146] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkmYpAxiJKPums3eBA4EwAAAEc"]
[Sat Apr 11 00:33:39.120920 2026] [:error] [pid 13101:tid 13141] [client 20.238.64.167:8069] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkmY98Ldw85818pj2pA1QAAAIg"]
[Sat Apr 11 00:33:39.623407 2026] [:error] [pid 62819:tid 62844] [client 20.238.64.167:8190] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adkmY_U20EyPf7NlsleSxQAAApY"]
[Sat Apr 11 00:33:40.125988 2026] [:error] [pid 63062:tid 63086] [client 20.238.64.167:8159] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adkmZJ2HtsmV85NqkMchPwAAA5Y"]
[Sat Apr 11 00:33:40.629287 2026] [:error] [pid 63134:tid 63141] [client 20.238.64.167:8183] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adkmZNFALqPDwWi6eJLetwAAA8Q"]
[Sat Apr 11 00:33:41.128806 2026] [:error] [pid 13189:tid 13215] [client 20.238.64.167:8143] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adkmZZAxiJKPums3eBA4HAAAAFc"]
[Sat Apr 11 00:33:41.624916 2026] [:error] [pid 63134:tid 63154] [client 20.238.64.167:8097] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adkmZdFALqPDwWi6eJLeuAAAA9E"]
[Sat Apr 11 00:33:42.135812 2026] [:error] [pid 62769:tid 62780] [client 20.238.64.167:8166] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "adkmZsWsSnfLoB8ifjD8eQAAAkk"]
[Sat Apr 11 00:33:42.646787 2026] [:error] [pid 62769:tid 62794] [client 20.238.64.167:8009] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "adkmZsWsSnfLoB8ifjD8fwAAAlc"]
[Sat Apr 11 00:33:43.154179 2026] [:error] [pid 13101:tid 13140] [client 20.238.64.167:8189] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "adkmZ98Ldw85818pj2pA3AAAAIc"]
[Sat Apr 11 00:33:43.645640 2026] [:error] [pid 63134:tid 63143] [client 20.238.64.167:38331] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "adkmZ9FALqPDwWi6eJLevAAAA8Y"]
[Sat Apr 11 00:33:44.145251 2026] [:error] [pid 63134:tid 63138] [client 20.238.64.167:8160] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkmaNFALqPDwWi6eJLewAAAA8E"]
[Sat Apr 11 00:33:44.644066 2026] [:error] [pid 62819:tid 62842] [client 20.238.64.167:8074] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkmaPU20EyPf7NlsleSxwAAApQ"]
[Sat Apr 11 00:33:45.156482 2026] [:error] [pid 62819:tid 62846] [client 20.238.64.167:8168] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkmafU20EyPf7NlsleSyQAAApg"]
[Sat Apr 11 00:33:45.654313 2026] [:error] [pid 62769:tid 62790] [client 20.238.64.167:8155] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adkmacWsSnfLoB8ifjD8jgAAAlM"]
[Sat Apr 11 00:33:46.159299 2026] [:error] [pid 62769:tid 62776] [client 20.238.64.167:8107] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkmasWsSnfLoB8ifjD8kwAAAkU"]
[Sat Apr 11 00:33:46.681321 2026] [:error] [pid 13189:tid 13200] [client 20.238.64.167:8085] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkmapAxiJKPums3eBA4IgAAAEg"]
[Sat Apr 11 00:33:47.184590 2026] [:error] [pid 62769:tid 62778] [client 20.238.64.167:38320] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkma8WsSnfLoB8ifjD8mQAAAkc"]
[Sat Apr 11 00:33:47.690211 2026] [:error] [pid 63134:tid 63152] [client 20.238.64.167:36133] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oLEzRVqmJJPFSucdefault.php"] [unique_id "adkma9FALqPDwWi6eJLewwAAA88"]
[Sat Apr 11 00:33:48.191765 2026] [:error] [pid 13189:tid 13214] [client 20.238.64.167:8136] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adkmbJAxiJKPums3eBA4KAAAAFY"]
[Sat Apr 11 00:33:48.691525 2026] [:error] [pid 62769:tid 62772] [client 20.238.64.167:8095] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adkmbMWsSnfLoB8ifjD8nQAAAkE"]
[Sat Apr 11 00:33:49.192616 2026] [:error] [pid 62710:tid 62713] [client 20.238.64.167:8180] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adkmbeME7qrf5xEWWJtfBgAAAgA"]
[Sat Apr 11 00:33:49.714954 2026] [:error] [pid 62710:tid 62727] [client 20.238.64.167:36147] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adkmbeME7qrf5xEWWJtfCQAAAg4"]
[Sat Apr 11 00:33:50.235689 2026] [:error] [pid 62710:tid 62719] [client 20.238.64.167:8058] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkmbuME7qrf5xEWWJtfDwAAAgY"]
[Sat Apr 11 00:33:50.735444 2026] [:error] [pid 63062:tid 63087] [client 20.238.64.167:8186] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkmbp2HtsmV85NqkMchQwAAA5c"]
[Sat Apr 11 00:33:51.234001 2026] [:error] [pid 63062:tid 63071] [client 20.238.64.167:8151] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkmb52HtsmV85NqkMchRgAAA4c"]
[Sat Apr 11 00:33:51.725799 2026] [:error] [pid 62710:tid 62730] [client 20.238.64.167:38293] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adkmb-ME7qrf5xEWWJtfFAAAAhE"]
[Sat Apr 11 00:33:52.220004 2026] [:error] [pid 62769:tid 62780] [client 20.238.64.167:8102] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adkmcMWsSnfLoB8ifjD8pAAAAkk"]
[Sat Apr 11 00:33:52.720535 2026] [:error] [pid 62819:tid 62837] [client 20.238.64.167:36104] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adkmcPU20EyPf7NlsleSywAAAo8"]
[Sat Apr 11 00:33:53.219318 2026] [:error] [pid 63134:tid 63145] [client 20.238.64.167:8093] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adkmcdFALqPDwWi6eJLezQAAA8g"]
[Sat Apr 11 00:33:53.742136 2026] [:error] [pid 63134:tid 63148] [client 20.238.64.167:8098] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adkmcdFALqPDwWi6eJLezgAAA8s"]
[Sat Apr 11 00:33:54.281089 2026] [:error] [pid 62651:tid 62672] [client 20.238.64.167:36149] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkmcjbAH0le57SIaqxDRAAAAdM"]
[Sat Apr 11 00:33:54.799190 2026] [:error] [pid 13189:tid 13214] [client 20.238.64.167:36136] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkmcpAxiJKPums3eBA4MgAAAFY"]
[Sat Apr 11 00:33:55.311495 2026] [:error] [pid 63134:tid 63155] [client 20.238.64.167:8005] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkmc9FALqPDwWi6eJLe0QAAA9I"]
[Sat Apr 11 00:33:55.807372 2026] [:error] [pid 13101:tid 13134] [client 20.238.64.167:8084] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adkmc98Ldw85818pj2pA7gAAAIE"]
[Sat Apr 11 00:33:56.346157 2026] [:error] [pid 62819:tid 62825] [client 20.238.64.167:8129] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkmdPU20EyPf7NlsleSzwAAAoM"]
[Sat Apr 11 00:33:56.913168 2026] [:error] [pid 62769:tid 62789] [client 20.238.64.167:8011] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkmdMWsSnfLoB8ifjD8swAAAlI"]
[Sat Apr 11 00:33:57.479784 2026] [:error] [pid 62710:tid 62717] [client 20.238.64.167:8065] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkmdeME7qrf5xEWWJtfGwAAAgQ"]
[Sat Apr 11 00:33:58.043052 2026] [:error] [pid 13189:tid 13196] [client 20.238.64.167:8019] [client 20.238.64.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adkmdpAxiJKPums3eBA4NgAAAEQ"]
[Sat Apr 11 04:50:29.942195 2026] [:error] [pid 33171:tid 33188] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sat Apr 11 04:50:30.261094 2026] [:error] [pid 33171:tid 33205] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/4GrJSiwkF3A.php
[Sat Apr 11 04:50:30.551659 2026] [:error] [pid 33171:tid 33191] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/SS72_kKKjT.php
[Sat Apr 11 04:50:30.914665 2026] [:error] [pid 33171:tid 33207] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/wkogn.php
[Sat Apr 11 04:50:31.288787 2026] [:error] [pid 33171:tid 33204] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/hwjtry0zd1fzeakcuzn8Cdefault.php
[Sat Apr 11 04:50:31.552011 2026] [:error] [pid 33171:tid 33208] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sat Apr 11 04:50:31.853817 2026] [:error] [pid 33171:tid 33188] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/oLEzRVqmJJPFSucdefault.php
[Sat Apr 11 04:50:32.140714 2026] [:error] [pid 33171:tid 33205] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/wwdgl.php
[Sat Apr 11 04:50:32.442413 2026] [:error] [pid 33171:tid 33191] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/3akp.php
[Sat Apr 11 04:50:32.704709 2026] [:error] [pid 33171:tid 33202] [client 135.116.194.58:15334] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Sat Apr 11 04:50:32.963866 2026] [:error] [pid 33171:tid 33192] [client 135.116.194.58:15334] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adlimLoqTMlo30hcVw85-QAAAAY"]
[Sat Apr 11 04:50:34.142325 2026] [:error] [pid 33173:tid 33267] [client 135.116.194.58:21855] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adlimq8109xRDP2izWimzwAAAJY"]
[Sat Apr 11 04:50:34.787742 2026] [:error] [pid 33171:tid 33186] [client 135.116.194.58:21844] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adlimroqTMlo30hcVw85_gAAAAA"]
[Sat Apr 11 04:50:35.847761 2026] [:error] [pid 33171:tid 33187] [client 135.116.194.58:26538] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adlim7oqTMlo30hcVw86AQAAAAE"]
[Sat Apr 11 04:50:36.948875 2026] [:error] [pid 33173:tid 33265] [client 135.116.194.58:26232] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adlinK8109xRDP2izWim2wAAAJQ"]
[Sat Apr 11 04:50:37.806575 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:21456] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adlina8109xRDP2izWim3gAAAJE"]
[Sat Apr 11 04:50:41.100573 2026] [:error] [pid 33172:tid 33224] [client 135.116.194.58:14284] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adlioTn2G0IJw5EZY9kTIAAAAEY"]
[Sat Apr 11 04:50:42.798646 2026] [:error] [pid 33288:tid 33303] [client 135.116.194.58:16841] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adliomJmwJFFPEgRHfH5XQAAAM0"]
[Sat Apr 11 04:50:43.710500 2026] [:error] [pid 33288:tid 33301] [client 135.116.194.58:15590] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlio2JmwJFFPEgRHfH5ZQAAAMs"]
[Sat Apr 11 04:50:44.491048 2026] [:error] [pid 33173:tid 33266] [client 135.116.194.58:31299] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlipK8109xRDP2izWim8AAAAJU"]
[Sat Apr 11 04:50:45.434640 2026] [:error] [pid 33173:tid 33247] [client 135.116.194.58:17279] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlipa8109xRDP2izWim8QAAAII"]
[Sat Apr 11 04:50:46.742783 2026] [:error] [pid 33173:tid 33252] [client 135.116.194.58:15310] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adlipq8109xRDP2izWim9AAAAIc"]
[Sat Apr 11 04:50:47.537304 2026] [:error] [pid 33288:tid 33307] [client 135.116.194.58:16876] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adlip2JmwJFFPEgRHfH5cQAAANE"]
[Sat Apr 11 04:50:48.428764 2026] [:error] [pid 33288:tid 33293] [client 135.116.194.58:14281] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adliqGJmwJFFPEgRHfH5dgAAAMM"]
[Sat Apr 11 04:50:49.932983 2026] [:error] [pid 33171:tid 33198] [client 135.116.194.58:26196] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adliqboqTMlo30hcVw86KwAAAAw"]
[Sat Apr 11 04:50:50.646207 2026] [:error] [pid 33288:tid 33297] [client 135.116.194.58:15615] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adliqmJmwJFFPEgRHfH5fgAAAMc"]
[Sat Apr 11 04:50:51.292312 2026] [:error] [pid 33173:tid 33253] [client 135.116.194.58:32835] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adliq68109xRDP2izWinEQAAAIg"]
[Sat Apr 11 04:50:52.054562 2026] [:error] [pid 33288:tid 33309] [client 135.116.194.58:31341] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adlirGJmwJFFPEgRHfH5iQAAANM"]
[Sat Apr 11 04:50:52.783874 2026] [:error] [pid 33171:tid 33192] [client 135.116.194.58:14290] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adlirLoqTMlo30hcVw86MQAAAAY"]
[Sat Apr 11 04:50:53.465032 2026] [:error] [pid 33288:tid 33307] [client 135.116.194.58:31296] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adlirWJmwJFFPEgRHfH5lgAAANE"]
[Sat Apr 11 04:50:54.016887 2026] [:error] [pid 33172:tid 33242] [client 135.116.194.58:32843] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adlirjn2G0IJw5EZY9kTQQAAAFg"]
[Sat Apr 11 04:50:54.963688 2026] [:error] [pid 33288:tid 33300] [client 135.116.194.58:32857] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adlirmJmwJFFPEgRHfH5nwAAAMo"]
[Sat Apr 11 04:50:55.498037 2026] [:error] [pid 33173:tid 33265] [client 135.116.194.58:26542] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adlir68109xRDP2izWinIgAAAJQ"]
[Sat Apr 11 04:50:56.124662 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:21871] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adlisK8109xRDP2izWinJQAAAJE"]
[Sat Apr 11 04:50:57.062019 2026] [:error] [pid 33288:tid 33296] [client 135.116.194.58:21870] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adlisWJmwJFFPEgRHfH5rQAAAMY"]
[Sat Apr 11 04:50:57.697775 2026] [:error] [pid 33172:tid 33230] [client 135.116.194.58:14319] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adlisTn2G0IJw5EZY9kTSAAAAEw"]
[Sat Apr 11 04:50:58.394107 2026] [:error] [pid 33288:tid 33305] [client 135.116.194.58:16832] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adlismJmwJFFPEgRHfH5wgAAAM8"]
[Sat Apr 11 04:50:58.998503 2026] [:error] [pid 33172:tid 33237] [client 135.116.194.58:26203] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adlisjn2G0IJw5EZY9kTSwAAAFM"]
[Sat Apr 11 04:50:59.580714 2026] [:error] [pid 33173:tid 33268] [client 135.116.194.58:26192] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlis68109xRDP2izWinNwAAAJc"]
[Sat Apr 11 04:51:00.156916 2026] [:error] [pid 33172:tid 33219] [client 135.116.194.58:17259] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlitDn2G0IJw5EZY9kTUAAAAEE"]
[Sat Apr 11 04:51:01.043872 2026] [:error] [pid 33172:tid 33235] [client 135.116.194.58:26498] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlitTn2G0IJw5EZY9kTVwAAAFE"]
[Sat Apr 11 04:51:01.618270 2026] [:error] [pid 33288:tid 33312] [client 135.116.194.58:26214] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adlitWJmwJFFPEgRHfH5zAAAANY"]
[Sat Apr 11 04:51:02.220762 2026] [:error] [pid 33288:tid 33299] [client 135.116.194.58:16888] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adlitmJmwJFFPEgRHfH50gAAAMk"]
[Sat Apr 11 04:51:02.850880 2026] [:error] [pid 33173:tid 33265] [client 135.116.194.58:31351] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adlitq8109xRDP2izWinTwAAAJQ"]
[Sat Apr 11 04:51:03.426898 2026] [:error] [pid 33288:tid 33304] [client 135.116.194.58:15352] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adlit2JmwJFFPEgRHfH53QAAAM4"]
[Sat Apr 11 04:51:04.358560 2026] [:error] [pid 33173:tid 33247] [client 135.116.194.58:26510] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adliuK8109xRDP2izWinWQAAAII"]
[Sat Apr 11 04:51:05.036951 2026] [:error] [pid 33173:tid 33254] [client 135.116.194.58:32895] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adliua8109xRDP2izWinXAAAAIk"]
[Sat Apr 11 04:51:05.716887 2026] [:error] [pid 33288:tid 33311] [client 135.116.194.58:26239] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adliuWJmwJFFPEgRHfH57gAAANU"]
[Sat Apr 11 04:51:06.326944 2026] [:error] [pid 33288:tid 33298] [client 135.116.194.58:21455] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adliumJmwJFFPEgRHfH59AAAAMg"]
[Sat Apr 11 04:51:06.922578 2026] [:error] [pid 33171:tid 33208] [client 135.116.194.58:26234] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adliuroqTMlo30hcVw86QAAAABY"]
[Sat Apr 11 04:51:07.494396 2026] [:error] [pid 33288:tid 33294] [client 135.116.194.58:21482] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adliu2JmwJFFPEgRHfH5_wAAAMQ"]
[Sat Apr 11 04:51:08.157330 2026] [:error] [pid 33288:tid 33290] [client 135.116.194.58:26194] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adlivGJmwJFFPEgRHfH6CgAAAMA"]
[Sat Apr 11 04:51:08.808534 2026] [:error] [pid 33288:tid 33314] [client 135.116.194.58:17260] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adlivGJmwJFFPEgRHfH6EAAAANg"]
[Sat Apr 11 04:51:09.363408 2026] [:error] [pid 33172:tid 33235] [client 135.116.194.58:17240] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adlivTn2G0IJw5EZY9kTagAAAFE"]
[Sat Apr 11 04:51:10.008735 2026] [:error] [pid 33172:tid 33219] [client 135.116.194.58:26197] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adlivjn2G0IJw5EZY9kTcQAAAEE"]
[Sat Apr 11 04:51:10.721115 2026] [:error] [pid 33172:tid 33222] [client 135.116.194.58:15329] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adlivjn2G0IJw5EZY9kTdQAAAEQ"]
[Sat Apr 11 04:51:11.286875 2026] [:error] [pid 33173:tid 33246] [client 135.116.194.58:26226] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adliv68109xRDP2izWincwAAAIE"]
[Sat Apr 11 04:51:11.921859 2026] [:error] [pid 33288:tid 33297] [client 135.116.194.58:15592] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adliv2JmwJFFPEgRHfH6IgAAAMc"]
[Sat Apr 11 04:51:12.701097 2026] [:error] [pid 33288:tid 33313] [client 135.116.194.58:21472] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adliwGJmwJFFPEgRHfH6LAAAANc"]
[Sat Apr 11 04:51:13.311454 2026] [:error] [pid 33173:tid 33258] [client 135.116.194.58:26181] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adliwa8109xRDP2izWinfAAAAI0"]
[Sat Apr 11 04:51:13.882861 2026] [:error] [pid 33172:tid 33234] [client 135.116.194.58:15353] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adliwTn2G0IJw5EZY9kThgAAAFA"]
[Sat Apr 11 04:51:14.451943 2026] [:error] [pid 33288:tid 33310] [client 135.116.194.58:21465] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fetch.php"] [unique_id "adliwmJmwJFFPEgRHfH6NgAAANQ"]
[Sat Apr 11 04:51:15.025976 2026] [:error] [pid 33173:tid 33248] [client 135.116.194.58:15337] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adliw68109xRDP2izWinhgAAAIM"]
[Sat Apr 11 04:51:15.591645 2026] [:error] [pid 33172:tid 33219] [client 135.116.194.58:26186] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adliwzn2G0IJw5EZY9kTiQAAAEE"]
[Sat Apr 11 04:51:16.184776 2026] [:error] [pid 33288:tid 33294] [client 135.116.194.58:31355] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adlixGJmwJFFPEgRHfH6RQAAAMQ"]
[Sat Apr 11 04:51:16.766457 2026] [:error] [pid 33173:tid 33247] [client 135.116.194.58:15298] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adlixK8109xRDP2izWiniQAAAII"]
[Sat Apr 11 04:51:17.502176 2026] [:error] [pid 33288:tid 33301] [client 135.116.194.58:16885] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adlixWJmwJFFPEgRHfH6TQAAAMs"]
[Sat Apr 11 04:51:18.081395 2026] [:error] [pid 33288:tid 33291] [client 135.116.194.58:14325] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adlixmJmwJFFPEgRHfH6UQAAAME"]
[Sat Apr 11 04:51:20.650966 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:14335] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adliyK8109xRDP2izWinmAAAAJE"]
[Sat Apr 11 04:51:22.193553 2026] [:error] [pid 33288:tid 33298] [client 135.116.194.58:21462] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2nzyHnOkEg.php"] [unique_id "adliymJmwJFFPEgRHfH6bQAAAMg"]
[Sat Apr 11 04:51:22.817526 2026] [:error] [pid 33288:tid 33302] [client 135.116.194.58:14291] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oircv.php"] [unique_id "adliymJmwJFFPEgRHfH6cAAAAMw"]
[Sat Apr 11 04:51:23.385365 2026] [:error] [pid 33171:tid 33192] [client 135.116.194.58:26235] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oircv.php"] [unique_id "adliy7oqTMlo30hcVw86dAAAAAY"]
[Sat Apr 11 04:51:24.101288 2026] [:error] [pid 33288:tid 33295] [client 135.116.194.58:31343] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oircv.php"] [unique_id "adlizGJmwJFFPEgRHfH6dgAAAMU"]
[Sat Apr 11 04:51:24.749588 2026] [:error] [pid 33288:tid 33299] [client 135.116.194.58:15588] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oircv.php"] [unique_id "adlizGJmwJFFPEgRHfH6ewAAAMk"]
[Sat Apr 11 04:51:25.552508 2026] [:error] [pid 33288:tid 33309] [client 135.116.194.58:26209] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blnux.php"] [unique_id "adlizWJmwJFFPEgRHfH6hgAAANM"]
[Sat Apr 11 04:51:26.403753 2026] [:error] [pid 33288:tid 33301] [client 135.116.194.58:21836] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blnux.php"] [unique_id "adlizmJmwJFFPEgRHfH6jQAAAMs"]
[Sat Apr 11 04:51:27.007630 2026] [:error] [pid 33288:tid 33313] [client 135.116.194.58:21831] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blnux.php"] [unique_id "adliz2JmwJFFPEgRHfH6lQAAANc"]
[Sat Apr 11 04:51:27.632606 2026] [:error] [pid 33171:tid 33200] [client 135.116.194.58:17228] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blnux.php"] [unique_id "adliz7oqTMlo30hcVw86fgAAAA4"]
[Sat Apr 11 04:51:28.304644 2026] [:error] [pid 33173:tid 33250] [client 135.116.194.58:14282] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adli0K8109xRDP2izWinpgAAAIU"]
[Sat Apr 11 04:51:29.089330 2026] [:error] [pid 33288:tid 33312] [client 135.116.194.58:13307] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adli0WJmwJFFPEgRHfH6nwAAANY"]
[Sat Apr 11 04:51:29.867473 2026] [:error] [pid 33288:tid 33307] [client 135.116.194.58:16865] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adli0WJmwJFFPEgRHfH6pgAAANE"]
[Sat Apr 11 04:51:30.523138 2026] [:error] [pid 33172:tid 33225] [client 135.116.194.58:26531] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "adli0jn2G0IJw5EZY9kTogAAAEc"]
[Sat Apr 11 04:51:31.093256 2026] [:error] [pid 33288:tid 33305] [client 135.116.194.58:15358] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Spow_SRw.php"] [unique_id "adli02JmwJFFPEgRHfH6tAAAAM8"]
[Sat Apr 11 04:51:31.930152 2026] [:error] [pid 33173:tid 33267] [client 135.116.194.58:17250] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Spow_SRw.php"] [unique_id "adli068109xRDP2izWinsgAAAJY"]
[Sat Apr 11 04:51:32.537751 2026] [:error] [pid 33172:tid 33232] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/Spow_SRw.php
[Sat Apr 11 04:51:32.808926 2026] [:error] [pid 33172:tid 33231] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/albrt.php
[Sat Apr 11 04:51:33.157504 2026] [:error] [pid 33172:tid 33230] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/xxivicLhot.php
[Sat Apr 11 04:51:33.472706 2026] [:error] [pid 33172:tid 33223] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sat Apr 11 04:51:33.822599 2026] [:error] [pid 33172:tid 33241] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Sat Apr 11 04:51:34.105765 2026] [:error] [pid 33172:tid 33225] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/wxeyc.php
[Sat Apr 11 04:51:34.474761 2026] [:error] [pid 33172:tid 33226] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Sat Apr 11 04:51:34.740881 2026] [:error] [pid 33172:tid 33229] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Sat Apr 11 04:51:35.020968 2026] [:error] [pid 33172:tid 33234] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/fyflv.php
[Sat Apr 11 04:51:35.285956 2026] [:error] [pid 33172:tid 33222] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-942.php
[Sat Apr 11 04:51:35.557805 2026] [:error] [pid 33172:tid 33233] [client 135.116.194.58:21887] File does not exist: /usr/local/apache/htdocs/suspended-page/sde.php
[Sat Apr 11 04:51:35.854350 2026] [:error] [pid 33172:tid 33231] [client 135.116.194.58:21887] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adli1zn2G0IJw5EZY9kTvAAAAE0"]
[Sat Apr 11 04:51:36.509488 2026] [:error] [pid 33172:tid 33237] [client 135.116.194.58:15350] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adli2Dn2G0IJw5EZY9kTvQAAAFM"]
[Sat Apr 11 04:51:37.169113 2026] [:error] [pid 33171:tid 33198] [client 135.116.194.58:16887] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adli2boqTMlo30hcVw86kwAAAAw"]
[Sat Apr 11 04:51:37.907636 2026] [:error] [pid 33173:tid 33268] [client 135.116.194.58:14321] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adli2a8109xRDP2izWinvgAAAJc"]
[Sat Apr 11 04:51:38.624146 2026] [:error] [pid 33173:tid 33252] [client 135.116.194.58:21854] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adli2q8109xRDP2izWinwwAAAIc"]
[Sat Apr 11 04:51:39.210667 2026] [:error] [pid 33172:tid 33242] [client 135.116.194.58:32839] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adli2zn2G0IJw5EZY9kTyQAAAFg"]
[Sat Apr 11 04:51:39.895046 2026] [:error] [pid 33173:tid 33261] [client 135.116.194.58:17271] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adli268109xRDP2izWinxwAAAJA"]
[Sat Apr 11 04:51:40.636982 2026] [:error] [pid 33171:tid 33190] [client 135.116.194.58:26215] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adli3LoqTMlo30hcVw86mgAAAAQ"]
[Sat Apr 11 04:51:41.517372 2026] [:error] [pid 33173:tid 33256] [client 135.116.194.58:31326] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adli3a8109xRDP2izWinygAAAIs"]
[Sat Apr 11 04:51:42.095942 2026] [:error] [pid 33171:tid 33198] [client 135.116.194.58:14295] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adli3roqTMlo30hcVw86nwAAAAw"]
[Sat Apr 11 04:51:43.043359 2026] [:error] [pid 33172:tid 33235] [client 135.116.194.58:31301] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adli3zn2G0IJw5EZY9kT3QAAAFE"]
[Sat Apr 11 04:51:43.979895 2026] [:error] [pid 33288:tid 33290] [client 135.116.194.58:15578] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adli32JmwJFFPEgRHfH68wAAAMA"]
[Sat Apr 11 04:51:44.859790 2026] [:error] [pid 33288:tid 33296] [client 135.116.194.58:17262] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adli4GJmwJFFPEgRHfH6-QAAAMY"]
[Sat Apr 11 04:51:45.477000 2026] [:error] [pid 33288:tid 33300] [client 135.116.194.58:16891] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adli4WJmwJFFPEgRHfH6_AAAAMo"]
[Sat Apr 11 04:51:46.149912 2026] [:error] [pid 33288:tid 33290] [client 135.116.194.58:21491] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adli4mJmwJFFPEgRHfH7BQAAAMA"]
[Sat Apr 11 04:51:46.742624 2026] [:error] [pid 33288:tid 33301] [client 135.116.194.58:17258] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adli4mJmwJFFPEgRHfH7DgAAAMs"]
[Sat Apr 11 04:51:47.338726 2026] [:error] [pid 33172:tid 33223] [client 135.116.194.58:31338] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adli4zn2G0IJw5EZY9kT7AAAAEU"]
[Sat Apr 11 04:51:48.102843 2026] [:error] [pid 33173:tid 33254] [client 135.116.194.58:15325] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adli5K8109xRDP2izWin5wAAAIk"]
[Sat Apr 11 04:51:48.680292 2026] [:error] [pid 33288:tid 33292] [client 135.116.194.58:21858] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adli5GJmwJFFPEgRHfH7HQAAAMI"]
[Sat Apr 11 04:51:49.380417 2026] [:error] [pid 33288:tid 33309] [client 135.116.194.58:21857] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adli5WJmwJFFPEgRHfH7JgAAANM"]
[Sat Apr 11 04:51:49.906041 2026] [:error] [pid 33288:tid 33292] [client 135.116.194.58:17237] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adli5WJmwJFFPEgRHfH7KgAAAMI"]
[Sat Apr 11 04:51:50.465884 2026] [:error] [pid 33288:tid 33298] [client 135.116.194.58:16868] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adli5mJmwJFFPEgRHfH7LgAAAMg"]
[Sat Apr 11 04:51:51.204079 2026] [:error] [pid 33173:tid 33264] [client 135.116.194.58:21449] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adli568109xRDP2izWin_gAAAJM"]
[Sat Apr 11 04:51:51.937913 2026] [:error] [pid 33172:tid 33227] [client 135.116.194.58:14020] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adli5zn2G0IJw5EZY9kT9QAAAEk"]
[Sat Apr 11 04:51:52.623025 2026] [:error] [pid 33171:tid 33186] [client 135.116.194.58:26559] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adli6LoqTMlo30hcVw86twAAAAA"]
[Sat Apr 11 04:51:53.208231 2026] [:error] [pid 33172:tid 33221] [client 135.116.194.58:26204] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adli6Tn2G0IJw5EZY9kT_QAAAEM"]
[Sat Apr 11 04:51:53.933823 2026] [:error] [pid 33171:tid 33201] [client 135.116.194.58:14285] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adli6boqTMlo30hcVw86wQAAAA8"]
[Sat Apr 11 04:51:54.600292 2026] [:error] [pid 33171:tid 33204] [client 135.116.194.58:15307] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adli6roqTMlo30hcVw86xQAAABI"]
[Sat Apr 11 04:51:55.365958 2026] [:error] [pid 33288:tid 33298] [client 135.116.194.58:21839] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "adli62JmwJFFPEgRHfH7QgAAAMg"]
[Sat Apr 11 04:51:56.243941 2026] [:error] [pid 33171:tid 33207] [client 135.116.194.58:13250] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "adli7LoqTMlo30hcVw86ygAAABU"]
[Sat Apr 11 04:51:56.920913 2026] [:error] [pid 33173:tid 33269] [client 135.116.194.58:26523] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "adli7K8109xRDP2izWioDwAAAJg"]
[Sat Apr 11 04:51:57.636306 2026] [:error] [pid 33171:tid 33199] [client 135.116.194.58:32847] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "adli7boqTMlo30hcVw86zQAAAA0"]
[Sat Apr 11 04:51:58.211294 2026] [:error] [pid 33172:tid 33223] [client 135.116.194.58:15613] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "adli7jn2G0IJw5EZY9kUMwAAAEU"]
[Sat Apr 11 04:51:59.021713 2026] [:error] [pid 33288:tid 33290] [client 135.116.194.58:26212] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "adli72JmwJFFPEgRHfH7SQAAAMA"]
[Sat Apr 11 04:51:59.784525 2026] [:error] [pid 33288:tid 33312] [client 135.116.194.58:26187] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "adli72JmwJFFPEgRHfH7VAAAANY"]
[Sat Apr 11 04:52:00.412668 2026] [:error] [pid 33288:tid 33305] [client 135.116.194.58:21859] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "adli8GJmwJFFPEgRHfH7XgAAAM8"]
[Sat Apr 11 04:52:00.979969 2026] [:error] [pid 33288:tid 33302] [client 135.116.194.58:26188] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adli8GJmwJFFPEgRHfH7aAAAAMw"]
[Sat Apr 11 04:52:01.560793 2026] [:error] [pid 33172:tid 33222] [client 135.116.194.58:17251] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adli8Tn2G0IJw5EZY9kUOgAAAEQ"]
[Sat Apr 11 04:52:02.250588 2026] [:error] [pid 33173:tid 33252] [client 135.116.194.58:15305] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adli8q8109xRDP2izWioHgAAAIc"]
[Sat Apr 11 04:52:02.894424 2026] [:error] [pid 33171:tid 33210] [client 135.116.194.58:16879] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "adli8roqTMlo30hcVw864AAAABg"]
[Sat Apr 11 04:52:03.542187 2026] [:error] [pid 33173:tid 33251] [client 135.116.194.58:32891] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iindv.php"] [unique_id "adli868109xRDP2izWioJgAAAIY"]
[Sat Apr 11 04:52:04.118128 2026] [:error] [pid 33171:tid 33202] [client 135.116.194.58:16869] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iindv.php"] [unique_id "adli9LoqTMlo30hcVw866wAAABA"]
[Sat Apr 11 04:52:04.714502 2026] [:error] [pid 33172:tid 33242] [client 135.116.194.58:15569] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iindv.php"] [unique_id "adli9Dn2G0IJw5EZY9kUPgAAAFg"]
[Sat Apr 11 04:52:06.022373 2026] [:error] [pid 33288:tid 33303] [client 135.116.194.58:15313] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iindv.php"] [unique_id "adli9mJmwJFFPEgRHfH7eQAAAM0"]
[Sat Apr 11 04:52:06.620468 2026] [:error] [pid 33172:tid 33235] [client 135.116.194.58:14306] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maintura.php"] [unique_id "adli9jn2G0IJw5EZY9kUQAAAAFE"]
[Sat Apr 11 04:52:07.316596 2026] [:error] [pid 33172:tid 33224] [client 135.116.194.58:17223] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maintura.php"] [unique_id "adli9zn2G0IJw5EZY9kUSAAAAEY"]
[Sat Apr 11 04:52:07.892312 2026] [:error] [pid 33172:tid 33241] [client 135.116.194.58:13004] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maintura.php"] [unique_id "adli9zn2G0IJw5EZY9kUUQAAAFc"]
[Sat Apr 11 04:52:08.462373 2026] [:error] [pid 33171:tid 33210] [client 135.116.194.58:26191] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maintura.php"] [unique_id "adli-LoqTMlo30hcVw86-wAAABg"]
[Sat Apr 11 04:52:09.056448 2026] [:error] [pid 33173:tid 33253] [client 135.116.194.58:16884] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adli-a8109xRDP2izWioNwAAAIg"]
[Sat Apr 11 04:52:09.760594 2026] [:error] [pid 33171:tid 33208] [client 135.116.194.58:15301] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adli-boqTMlo30hcVw86_gAAABY"]
[Sat Apr 11 04:52:10.538029 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:14475] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adli-q8109xRDP2izWioQAAAAJE"]
[Sat Apr 11 04:52:11.296611 2026] [:error] [pid 33288:tid 33291] [client 135.116.194.58:17256] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "adli-2JmwJFFPEgRHfH7kQAAAME"]
[Sat Apr 11 04:52:11.888645 2026] [:error] [pid 33172:tid 33220] [client 135.116.194.58:14278] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adli-zn2G0IJw5EZY9kUZgAAAEI"]
[Sat Apr 11 04:52:12.493100 2026] [:error] [pid 33171:tid 33188] [client 135.116.194.58:32887] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adli_LoqTMlo30hcVw87BAAAAAI"]
[Sat Apr 11 04:52:13.260907 2026] [:error] [pid 33288:tid 33308] [client 135.116.194.58:21485] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adli_WJmwJFFPEgRHfH7mQAAANI"]
[Sat Apr 11 04:52:13.941384 2026] [:error] [pid 33288:tid 33303] [client 135.116.194.58:21843] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "adli_WJmwJFFPEgRHfH7ngAAAM0"]
[Sat Apr 11 04:52:14.564249 2026] [:error] [pid 33288:tid 33304] [client 135.116.194.58:21487] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-220.php"] [unique_id "adli_mJmwJFFPEgRHfH7pAAAAM4"]
[Sat Apr 11 04:52:15.212144 2026] [:error] [pid 33288:tid 33290] [client 135.116.194.58:14466] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-220.php"] [unique_id "adli_2JmwJFFPEgRHfH7rAAAAMA"]
[Sat Apr 11 04:52:15.879783 2026] [:error] [pid 33173:tid 33247] [client 135.116.194.58:15606] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-220.php"] [unique_id "adli_68109xRDP2izWioTwAAAII"]
[Sat Apr 11 04:52:16.417901 2026] [:error] [pid 33173:tid 33253] [client 135.116.194.58:32851] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-220.php"] [unique_id "adljAK8109xRDP2izWioUgAAAIg"]
[Sat Apr 11 04:52:17.031558 2026] [:error] [pid 33173:tid 33260] [client 135.116.194.58:26199] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adljAa8109xRDP2izWioWAAAAI8"]
[Sat Apr 11 04:52:17.661210 2026] [:error] [pid 33171:tid 33200] [client 135.116.194.58:14474] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adljAboqTMlo30hcVw87DgAAAA4"]
[Sat Apr 11 04:52:18.193546 2026] [:error] [pid 33173:tid 33250] [client 135.116.194.58:26556] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adljAq8109xRDP2izWioXgAAAIU"]
[Sat Apr 11 04:52:18.747280 2026] [:error] [pid 33288:tid 33311] [client 135.116.194.58:16890] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "adljAmJmwJFFPEgRHfH7tgAAANU"]
[Sat Apr 11 04:52:19.295767 2026] [:error] [pid 33173:tid 33245] [client 135.116.194.58:14299] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "adljA68109xRDP2izWioYwAAAIA"]
[Sat Apr 11 04:52:19.939324 2026] [:error] [pid 33288:tid 33312] [client 135.116.194.58:14468] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "adljA2JmwJFFPEgRHfH7vwAAANY"]
[Sat Apr 11 04:52:22.550712 2026] [:error] [pid 33171:tid 33204] [client 135.116.194.58:17226] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "adljBroqTMlo30hcVw87IwAAABI"]
[Sat Apr 11 04:52:28.029656 2026] [:error] [pid 33288:tid 33308] [client 135.116.194.58:15586] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "adljDGJmwJFFPEgRHfH76gAAANI"]
[Sat Apr 11 04:52:28.704881 2026] [:error] [pid 33171:tid 33198] [client 135.116.194.58:32862] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxiviLDIot.php"] [unique_id "adljDLoqTMlo30hcVw87MQAAAAw"]
[Sat Apr 11 04:52:29.392369 2026] [:error] [pid 33172:tid 33228] [client 135.116.194.58:32872] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxiviLDIot.php"] [unique_id "adljDTn2G0IJw5EZY9kUrAAAAEo"]
[Sat Apr 11 04:52:30.016902 2026] [:error] [pid 33171:tid 33197] [client 135.116.194.58:61735] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxiviLDIot.php"] [unique_id "adljDroqTMlo30hcVw87OAAAAAs"]
[Sat Apr 11 04:52:30.584962 2026] [:error] [pid 33172:tid 33241] [client 135.116.194.58:26547] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxiviLDIot.php"] [unique_id "adljDjn2G0IJw5EZY9kUsQAAAFc"]
[Sat Apr 11 04:52:31.148951 2026] [:error] [pid 33172:tid 33222] [client 135.116.194.58:26219] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hanyatersenyum.php"] [unique_id "adljDzn2G0IJw5EZY9kUtgAAAEQ"]
[Sat Apr 11 04:52:31.849431 2026] [:error] [pid 33172:tid 33230] [client 135.116.194.58:15332] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hanyatersenyum.php"] [unique_id "adljDzn2G0IJw5EZY9kUwAAAAEw"]
[Sat Apr 11 04:52:32.440649 2026] [:error] [pid 33173:tid 33266] [client 135.116.194.58:26185] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hanyatersenyum.php"] [unique_id "adljEK8109xRDP2izWiofAAAAJU"]
[Sat Apr 11 04:52:33.344615 2026] [:error] [pid 33173:tid 33258] [client 135.116.194.58:21875] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hanyatersenyum.php"] [unique_id "adljEa8109xRDP2izWiohwAAAI0"]
[Sat Apr 11 04:52:33.886286 2026] [:error] [pid 33173:tid 33251] [client 135.116.194.58:16860] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adljEa8109xRDP2izWiojQAAAIY"]
[Sat Apr 11 04:52:34.545951 2026] [:error] [pid 33171:tid 33194] [client 135.116.194.58:15555] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adljEroqTMlo30hcVw87RAAAAAg"]
[Sat Apr 11 04:52:35.300702 2026] [:error] [pid 33172:tid 33225] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php
[Sat Apr 11 04:52:35.589686 2026] [:error] [pid 33172:tid 33236] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/upll22.php
[Sat Apr 11 04:52:35.854570 2026] [:error] [pid 33172:tid 33240] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Sat Apr 11 04:52:36.171645 2026] [:error] [pid 33172:tid 33235] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Sat Apr 11 04:52:36.436280 2026] [:error] [pid 33172:tid 33222] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Sat Apr 11 04:52:36.788061 2026] [:error] [pid 33172:tid 33229] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/pm90apbv3v5fvgkbguyiCdefault.php
[Sat Apr 11 04:52:37.049418 2026] [:error] [pid 33172:tid 33234] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat Apr 11 04:52:37.312542 2026] [:error] [pid 33172:tid 33220] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX1.php
[Sat Apr 11 04:52:37.573192 2026] [:error] [pid 33172:tid 33242] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/gvg1bvpsgtot1rpklCdefault.php
[Sat Apr 11 04:52:37.873951 2026] [:error] [pid 33172:tid 33221] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Sat Apr 11 04:52:38.165056 2026] [:error] [pid 33172:tid 33226] [client 135.116.194.58:15554] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Sat Apr 11 04:52:38.436853 2026] [:error] [pid 33172:tid 33224] [client 135.116.194.58:15554] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adljFjn2G0IJw5EZY9kU1wAAAEY"]
[Sat Apr 11 04:52:39.005764 2026] [:error] [pid 33288:tid 33292] [client 135.116.194.58:16893] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adljF2JmwJFFPEgRHfH8CwAAAMI"]
[Sat Apr 11 04:52:39.660786 2026] [:error] [pid 33172:tid 33232] [client 135.116.194.58:15568] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adljFzn2G0IJw5EZY9kU2AAAAE4"]
[Sat Apr 11 04:52:40.232640 2026] [:error] [pid 33171:tid 33186] [client 135.116.194.58:21849] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adljGLoqTMlo30hcVw87cQAAAAA"]
[Sat Apr 11 04:52:41.002413 2026] [:error] [pid 33288:tid 33290] [client 135.116.194.58:14488] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adljGWJmwJFFPEgRHfH8EwAAAMA"]
[Sat Apr 11 04:52:41.694438 2026] [:error] [pid 33173:tid 33261] [client 135.116.194.58:26507] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adljGa8109xRDP2izWiopQAAAJA"]
[Sat Apr 11 04:52:42.421590 2026] [:error] [pid 33172:tid 33221] [client 135.116.194.58:14294] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adljGjn2G0IJw5EZY9kU5QAAAEM"]
[Sat Apr 11 04:52:43.069750 2026] [:error] [pid 33171:tid 33208] [client 135.116.194.58:21446] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adljG7oqTMlo30hcVw87egAAABY"]
[Sat Apr 11 04:52:43.773067 2026] [:error] [pid 33288:tid 33307] [client 135.116.194.58:17243] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adljG2JmwJFFPEgRHfH8HgAAANE"]
[Sat Apr 11 04:52:44.418570 2026] [:error] [pid 33288:tid 33297] [client 135.116.194.58:17221] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adljHGJmwJFFPEgRHfH8IgAAAMc"]
[Sat Apr 11 04:52:45.168152 2026] [:error] [pid 33288:tid 33295] [client 135.116.194.58:17242] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adljHWJmwJFFPEgRHfH8KAAAAMU"]
[Sat Apr 11 04:52:45.910266 2026] [:error] [pid 33172:tid 33218] [client 135.116.194.58:21480] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adljHTn2G0IJw5EZY9kU7AAAAEA"]
[Sat Apr 11 04:52:46.485087 2026] [:error] [pid 33172:tid 33238] [client 135.116.194.58:15587] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adljHjn2G0IJw5EZY9kU7QAAAFQ"]
[Sat Apr 11 04:52:47.305195 2026] [:error] [pid 33288:tid 33309] [client 135.116.194.58:17236] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adljH2JmwJFFPEgRHfH8PgAAANM"]
[Sat Apr 11 04:52:47.993201 2026] [:error] [pid 33288:tid 33302] [client 135.116.194.58:14303] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adljH2JmwJFFPEgRHfH8RwAAAMw"]
[Sat Apr 11 04:52:48.648661 2026] [:error] [pid 33288:tid 33312] [client 135.116.194.58:21826] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "adljIGJmwJFFPEgRHfH8UAAAANY"]
[Sat Apr 11 04:52:49.464964 2026] [:error] [pid 33173:tid 33261] [client 135.116.194.58:15299] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "adljIa8109xRDP2izWiotwAAAJA"]
[Sat Apr 11 04:52:50.365098 2026] [:error] [pid 33288:tid 33295] [client 135.116.194.58:13034] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "adljImJmwJFFPEgRHfH8XgAAAMU"]
[Sat Apr 11 04:52:51.141417 2026] [:error] [pid 33288:tid 33297] [client 135.116.194.58:14272] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "adljI2JmwJFFPEgRHfH8ZAAAAMc"]
[Sat Apr 11 04:52:52.416728 2026] [:error] [pid 33173:tid 33247] [client 135.116.194.58:17261] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "adljJK8109xRDP2izWiovwAAAII"]
[Sat Apr 11 04:52:53.032271 2026] [:error] [pid 33171:tid 33206] [client 135.116.194.58:16848] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adljJboqTMlo30hcVw87kgAAABQ"]
[Sat Apr 11 04:52:53.975114 2026] [:error] [pid 33288:tid 33292] [client 135.116.194.58:14331] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adljJWJmwJFFPEgRHfH8bgAAAMI"]
[Sat Apr 11 04:52:54.898054 2026] [:error] [pid 33172:tid 33231] [client 135.116.194.58:14471] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adljJjn2G0IJw5EZY9kVAQAAAE0"]
[Sat Apr 11 04:52:55.593208 2026] [:error] [pid 33173:tid 33264] [client 135.116.194.58:31359] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wtiiy.php"] [unique_id "adljJ68109xRDP2izWioyQAAAJM"]
[Sat Apr 11 04:52:56.537655 2026] [:error] [pid 33288:tid 33310] [client 135.116.194.58:17269] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "adljKGJmwJFFPEgRHfH8dgAAANQ"]
[Sat Apr 11 04:52:57.356000 2026] [:error] [pid 33172:tid 33232] [client 135.116.194.58:32875] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "adljKTn2G0IJw5EZY9kVCgAAAE4"]
[Sat Apr 11 04:52:57.974858 2026] [:error] [pid 33173:tid 33269] [client 135.116.194.58:31315] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "adljKa8109xRDP2izWio0AAAAJg"]
[Sat Apr 11 04:52:58.736135 2026] [:error] [pid 33288:tid 33292] [client 135.116.194.58:16840] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Sanskrit.php"] [unique_id "adljKmJmwJFFPEgRHfH8fwAAAMI"]
[Sat Apr 11 04:52:59.536123 2026] [:error] [pid 33288:tid 33293] [client 135.116.194.58:14513] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adljK2JmwJFFPEgRHfH8hQAAAMM"]
[Sat Apr 11 04:53:00.348934 2026] [:error] [pid 33173:tid 33267] [client 135.116.194.58:14041] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adljLK8109xRDP2izWio1AAAAJY"]
[Sat Apr 11 04:53:01.184244 2026] [:error] [pid 33288:tid 33298] [client 135.116.194.58:43934] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adljLWJmwJFFPEgRHfH8kgAAAMg"]
[Sat Apr 11 04:53:01.797426 2026] [:error] [pid 33288:tid 33308] [client 135.116.194.58:21495] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adljLWJmwJFFPEgRHfH8lgAAANI"]
[Sat Apr 11 04:53:02.711394 2026] [:error] [pid 33288:tid 33313] [client 135.116.194.58:21499] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "adljLmJmwJFFPEgRHfH8owAAANc"]
[Sat Apr 11 04:53:03.733287 2026] [:error] [pid 33171:tid 33200] [client 135.116.194.58:15308] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "adljL7oqTMlo30hcVw87qgAAAA4"]
[Sat Apr 11 04:53:04.447277 2026] [:error] [pid 33172:tid 33238] [client 135.116.194.58:43914] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "adljMDn2G0IJw5EZY9kVEgAAAFQ"]
[Sat Apr 11 04:53:05.273596 2026] [:error] [pid 33171:tid 33210] [client 135.116.194.58:13027] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "adljMboqTMlo30hcVw87rwAAABg"]
[Sat Apr 11 04:53:06.056317 2026] [:error] [pid 33173:tid 33257] [client 135.116.194.58:32881] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljMq8109xRDP2izWio5QAAAIw"]
[Sat Apr 11 04:53:06.684718 2026] [:error] [pid 33173:tid 33246] [client 135.116.194.58:32845] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljMq8109xRDP2izWio6wAAAIE"]
[Sat Apr 11 04:53:07.275061 2026] [:error] [pid 33288:tid 33311] [client 135.116.194.58:21473] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljM2JmwJFFPEgRHfH8tgAAANU"]
[Sat Apr 11 04:53:08.086749 2026] [:error] [pid 33288:tid 33295] [client 135.116.194.58:31334] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljNGJmwJFFPEgRHfH8ugAAAMU"]
[Sat Apr 11 04:53:09.013741 2026] [:error] [pid 33173:tid 33248] [client 135.116.194.58:31349] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adljNa8109xRDP2izWio8gAAAIM"]
[Sat Apr 11 04:53:09.823697 2026] [:error] [pid 33173:tid 33247] [client 135.116.194.58:14307] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adljNa8109xRDP2izWio9AAAAII"]
[Sat Apr 11 04:53:10.643056 2026] [:error] [pid 33173:tid 33265] [client 135.116.194.58:26224] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adljNq8109xRDP2izWio-wAAAJQ"]
[Sat Apr 11 04:53:11.361204 2026] [:error] [pid 33173:tid 33251] [client 135.116.194.58:21868] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adljN68109xRDP2izWipAAAAAIY"]
[Sat Apr 11 04:53:12.138782 2026] [:error] [pid 33173:tid 33258] [client 135.116.194.58:21470] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "adljOK8109xRDP2izWipAwAAAI0"]
[Sat Apr 11 04:53:12.911130 2026] [:error] [pid 33172:tid 33233] [client 135.116.194.58:43951] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "adljODn2G0IJw5EZY9kVIQAAAE8"]
[Sat Apr 11 04:53:14.225968 2026] [:error] [pid 33173:tid 33263] [client 135.116.194.58:26183] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "adljOq8109xRDP2izWipCgAAAJI"]
[Sat Apr 11 04:53:15.057559 2026] [:error] [pid 33288:tid 33313] [client 135.116.194.58:14472] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "adljO2JmwJFFPEgRHfH82wAAANc"]
[Sat Apr 11 04:53:15.888026 2026] [:error] [pid 33288:tid 33305] [client 135.116.194.58:21478] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adljO2JmwJFFPEgRHfH83wAAAM8"]
[Sat Apr 11 04:53:16.572642 2026] [:error] [pid 33173:tid 33268] [client 135.116.194.58:26202] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adljPK8109xRDP2izWipEQAAAJc"]
[Sat Apr 11 04:53:17.166229 2026] [:error] [pid 33173:tid 33253] [client 135.116.194.58:21474] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adljPa8109xRDP2izWipFgAAAIg"]
[Sat Apr 11 04:53:17.798897 2026] [:error] [pid 33173:tid 33264] [client 135.116.194.58:26207] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adljPa8109xRDP2izWipGgAAAJM"]
[Sat Apr 11 04:53:18.463005 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:15591] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adljPq8109xRDP2izWipIgAAAJE"]
[Sat Apr 11 04:53:19.120899 2026] [:error] [pid 33288:tid 33305] [client 135.116.194.58:14048] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adljP2JmwJFFPEgRHfH85QAAAM8"]
[Sat Apr 11 04:53:19.779630 2026] [:error] [pid 33173:tid 33251] [client 135.116.194.58:32855] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adljP68109xRDP2izWipJQAAAIY"]
[Sat Apr 11 04:53:20.510604 2026] [:error] [pid 33172:tid 33226] [client 135.116.194.58:14275] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adljQDn2G0IJw5EZY9kVMgAAAEg"]
[Sat Apr 11 04:53:21.156411 2026] [:error] [pid 33173:tid 33260] [client 135.116.194.58:14317] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adljQa8109xRDP2izWipLwAAAI8"]
[Sat Apr 11 04:53:23.311090 2026] [:error] [pid 33288:tid 33294] [client 135.116.194.58:31344] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adljQ2JmwJFFPEgRHfH89AAAAMQ"]
[Sat Apr 11 04:53:23.959120 2026] [:error] [pid 33288:tid 33292] [client 135.116.194.58:17216] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adljQ2JmwJFFPEgRHfH8-gAAAMI"]
[Sat Apr 11 04:53:25.697133 2026] [:error] [pid 33172:tid 33233] [client 135.116.194.58:16870] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adljRTn2G0IJw5EZY9kVPAAAAE8"]
[Sat Apr 11 04:53:26.284285 2026] [:error] [pid 33288:tid 33305] [client 135.116.194.58:32893] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adljRmJmwJFFPEgRHfH9DQAAAM8"]
[Sat Apr 11 04:53:26.895440 2026] [:error] [pid 33173:tid 33255] [client 135.116.194.58:17263] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adljRq8109xRDP2izWipQAAAAIo"]
[Sat Apr 11 04:53:27.480450 2026] [:error] [pid 33173:tid 33253] [client 135.116.194.58:21500] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adljR68109xRDP2izWipQwAAAIg"]
[Sat Apr 11 04:53:28.379964 2026] [:error] [pid 33173:tid 33266] [client 135.116.194.58:15340] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adljSK8109xRDP2izWipSAAAAJU"]
[Sat Apr 11 04:53:29.335290 2026] [:error] [pid 33172:tid 33234] [client 135.116.194.58:15598] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adljSTn2G0IJw5EZY9kVRAAAAFA"]
[Sat Apr 11 04:53:29.927209 2026] [:error] [pid 33171:tid 33195] [client 135.116.194.58:16844] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adljSboqTMlo30hcVw873AAAAAk"]
[Sat Apr 11 04:53:30.564358 2026] [:error] [pid 33171:tid 33210] [client 135.116.194.58:17217] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adljSroqTMlo30hcVw874AAAABg"]
[Sat Apr 11 04:53:31.232489 2026] [:error] [pid 33288:tid 33301] [client 135.116.194.58:5370] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adljS2JmwJFFPEgRHfH9HwAAAMs"]
[Sat Apr 11 04:53:31.834022 2026] [:error] [pid 33173:tid 33258] [client 135.116.194.58:21459] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adljS68109xRDP2izWipUAAAAI0"]
[Sat Apr 11 04:53:32.499572 2026] [:error] [pid 33171:tid 33187] [client 135.116.194.58:14498] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adljTLoqTMlo30hcVw875AAAAAE"]
[Sat Apr 11 04:53:33.376277 2026] [:error] [pid 33173:tid 33252] [client 135.116.194.58:26533] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adljTa8109xRDP2izWipWQAAAIc"]
[Sat Apr 11 04:53:34.278524 2026] [:error] [pid 33173:tid 33260] [client 135.116.194.58:14302] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adljTq8109xRDP2izWipYQAAAI8"]
[Sat Apr 11 04:53:35.060867 2026] [:error] [pid 33288:tid 33295] [client 135.116.194.58:14327] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adljT2JmwJFFPEgRHfH9NwAAAMU"]
[Sat Apr 11 04:53:36.709480 2026] [:error] [pid 33172:tid 33236] [client 135.116.194.58:21876] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adljUDn2G0IJw5EZY9kVVAAAAFI"]
[Sat Apr 11 04:53:37.375988 2026] [:error] [pid 33172:tid 33242] [client 135.116.194.58:26213] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adljUTn2G0IJw5EZY9kVWgAAAFg"]
[Sat Apr 11 04:53:37.954948 2026] [:error] [pid 33171:tid 33198] [client 135.116.194.58:33832] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adljUboqTMlo30hcVw878AAAAAw"]
[Sat Apr 11 04:53:38.660734 2026] [:error] [pid 33171:tid 33187] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Sat Apr 11 04:53:39.078182 2026] [:error] [pid 33171:tid 33186] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Sat Apr 11 04:53:39.379791 2026] [:error] [pid 33171:tid 33192] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Sat Apr 11 04:53:39.716427 2026] [:error] [pid 33171:tid 33205] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sat Apr 11 04:53:40.635998 2026] [:error] [pid 33171:tid 33208] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Sat Apr 11 04:53:40.951320 2026] [:error] [pid 33171:tid 33189] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sat Apr 11 04:53:41.228329 2026] [:error] [pid 33171:tid 33195] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sat Apr 11 04:53:41.572447 2026] [:error] [pid 33171:tid 33202] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sat Apr 11 04:53:41.894352 2026] [:error] [pid 33171:tid 33201] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Sat Apr 11 04:53:42.157991 2026] [:error] [pid 33171:tid 33199] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Sat Apr 11 04:53:42.447670 2026] [:error] [pid 33171:tid 33190] [client 135.116.194.58:15562] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Sat Apr 11 04:53:43.100626 2026] [:error] [pid 33171:tid 33205] [client 135.116.194.58:15562] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljV7oqTMlo30hcVw88CgAAABM"]
[Sat Apr 11 04:53:44.841937 2026] [:error] [pid 33288:tid 33306] [client 135.116.194.58:17224] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljWGJmwJFFPEgRHfH9XAAAANA"]
[Sat Apr 11 04:53:45.399087 2026] [:error] [pid 33288:tid 33294] [client 135.116.194.58:31347] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljWWJmwJFFPEgRHfH9YQAAAMQ"]
[Sat Apr 11 04:53:45.927121 2026] [:error] [pid 33288:tid 33295] [client 135.116.194.58:26508] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adljWWJmwJFFPEgRHfH9ZgAAAMU"]
[Sat Apr 11 04:53:46.660516 2026] [:error] [pid 33288:tid 33312] [client 135.116.194.58:14328] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "adljWmJmwJFFPEgRHfH9awAAANY"]
[Sat Apr 11 04:53:47.280803 2026] [:error] [pid 33173:tid 33268] [client 135.116.194.58:14305] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "adljW68109xRDP2izWipfwAAAJc"]
[Sat Apr 11 04:53:47.841709 2026] [:error] [pid 33171:tid 33197] [client 135.116.194.58:15355] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "adljW7oqTMlo30hcVw88EgAAAAs"]
[Sat Apr 11 04:53:48.369286 2026] [:error] [pid 33172:tid 33220] [client 135.116.194.58:14309] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "adljXDn2G0IJw5EZY9kVcwAAAEI"]
[Sat Apr 11 04:53:48.934600 2026] [:error] [pid 33173:tid 33245] [client 135.116.194.58:21865] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adljXK8109xRDP2izWiphwAAAIA"]
[Sat Apr 11 04:53:49.496593 2026] [:error] [pid 33288:tid 33291] [client 135.116.194.58:26180] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adljXWJmwJFFPEgRHfH9cwAAAME"]
[Sat Apr 11 04:53:50.279448 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:21830] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adljXq8109xRDP2izWipjwAAAJE"]
[Sat Apr 11 04:53:50.821808 2026] [:error] [pid 33173:tid 33245] [client 135.116.194.58:15343] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "adljXq8109xRDP2izWiplwAAAIA"]
[Sat Apr 11 04:53:51.356295 2026] [:error] [pid 33288:tid 33307] [client 135.116.194.58:31357] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "adljX2JmwJFFPEgRHfH9fgAAANE"]
[Sat Apr 11 04:53:51.932321 2026] [:error] [pid 33288:tid 33298] [client 135.116.194.58:21450] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "adljX2JmwJFFPEgRHfH9gwAAAMg"]
[Sat Apr 11 04:53:52.466266 2026] [:error] [pid 33173:tid 33263] [client 135.116.194.58:26176] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "adljYK8109xRDP2izWippgAAAJI"]
[Sat Apr 11 04:53:53.139821 2026] [:error] [pid 33288:tid 33306] [client 135.116.194.58:15303] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "adljYWJmwJFFPEgRHfH9jAAAANA"]
[Sat Apr 11 04:53:55.836319 2026] [:error] [pid 33288:tid 33314] [client 135.116.194.58:64005] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adljY2JmwJFFPEgRHfH9oAAAANg"]
[Sat Apr 11 04:53:56.457680 2026] [:error] [pid 33172:tid 33221] [client 135.116.194.58:15608] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adljZDn2G0IJw5EZY9kVdwAAAEM"]
[Sat Apr 11 04:53:57.215001 2026] [:error] [pid 33172:tid 33235] [client 135.116.194.58:14077] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adljZTn2G0IJw5EZY9kVeQAAAFE"]
[Sat Apr 11 04:54:01.924507 2026] [:error] [pid 33288:tid 33309] [client 135.116.194.58:21842] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "adljaWJmwJFFPEgRHfH93AAAANM"]
[Sat Apr 11 04:54:02.639418 2026] [:error] [pid 33171:tid 33188] [client 135.116.194.58:26541] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "adljaroqTMlo30hcVw88KwAAAAI"]
[Sat Apr 11 04:54:03.480008 2026] [:error] [pid 33288:tid 33305] [client 135.116.194.58:33826] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "adlja2JmwJFFPEgRHfH95wAAAM8"]
[Sat Apr 11 04:54:04.103026 2026] [:error] [pid 33288:tid 33300] [client 135.116.194.58:26553] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "adljbGJmwJFFPEgRHfH96QAAAMo"]
[Sat Apr 11 04:54:04.640530 2026] [:error] [pid 33288:tid 33297] [client 135.116.194.58:31303] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/torsa1.php"] [unique_id "adljbGJmwJFFPEgRHfH97wAAAMc"]
[Sat Apr 11 04:54:07.023250 2026] [:error] [pid 33172:tid 33220] [client 135.116.194.58:31331] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adljbzn2G0IJw5EZY9kVlQAAAEI"]
[Sat Apr 11 04:54:07.588199 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:21501] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adljb68109xRDP2izWip5gAAAJE"]
[Sat Apr 11 04:54:08.129761 2026] [:error] [pid 33173:tid 33268] [client 135.116.194.58:14037] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adljcK8109xRDP2izWip6QAAAJc"]
[Sat Apr 11 04:54:08.681074 2026] [:error] [pid 33288:tid 33314] [client 135.116.194.58:15357] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "adljcGJmwJFFPEgRHfH9_wAAANg"]
[Sat Apr 11 04:54:09.201739 2026] [:error] [pid 33288:tid 33311] [client 135.116.194.58:15577] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adljcWJmwJFFPEgRHfH-AgAAANU"]
[Sat Apr 11 04:54:09.732261 2026] [:error] [pid 33288:tid 33309] [client 135.116.194.58:21496] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adljcWJmwJFFPEgRHfH-BQAAANM"]
[Sat Apr 11 04:54:10.262778 2026] [:error] [pid 33172:tid 33223] [client 135.116.194.58:26216] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adljcjn2G0IJw5EZY9kVpwAAAEU"]
[Sat Apr 11 04:54:10.950109 2026] [:error] [pid 33171:tid 33191] [client 135.116.194.58:14304] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adljcroqTMlo30hcVw88WQAAAAU"]
[Sat Apr 11 04:54:11.524012 2026] [:error] [pid 33171:tid 33199] [client 135.116.194.58:32869] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adljc7oqTMlo30hcVw88XwAAAA0"]
[Sat Apr 11 04:54:12.126531 2026] [:error] [pid 33171:tid 33192] [client 135.116.194.58:32846] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adljdLoqTMlo30hcVw88ZQAAAAY"]
[Sat Apr 11 04:54:12.916033 2026] [:error] [pid 33288:tid 33291] [client 135.116.194.58:15601] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adljdGJmwJFFPEgRHfH-IgAAAME"]
[Sat Apr 11 04:54:13.461202 2026] [:error] [pid 33173:tid 33256] [client 135.116.194.58:31330] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adljda8109xRDP2izWip-AAAAIs"]
[Sat Apr 11 04:54:14.010520 2026] [:error] [pid 33173:tid 33268] [client 135.116.194.58:14516] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adljdq8109xRDP2izWip-wAAAJc"]
[Sat Apr 11 04:54:14.610203 2026] [:error] [pid 33173:tid 33245] [client 135.116.194.58:14039] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adljdq8109xRDP2izWip_wAAAIA"]
[Sat Apr 11 04:54:15.390049 2026] [:error] [pid 33173:tid 33260] [client 135.116.194.58:21483] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adljd68109xRDP2izWiqAQAAAI8"]
[Sat Apr 11 04:54:15.963635 2026] [:error] [pid 33173:tid 33267] [client 135.116.194.58:21882] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adljd68109xRDP2izWiqBgAAAJY"]
[Sat Apr 11 04:54:16.696545 2026] [:error] [pid 33173:tid 33262] [client 135.116.194.58:15346] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adljeK8109xRDP2izWiqDAAAAJE"]
[Sat Apr 11 04:54:17.372950 2026] [:error] [pid 33173:tid 33251] [client 135.116.194.58:13289] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adljea8109xRDP2izWiqEgAAAIY"]
[Sat Apr 11 04:54:18.248092 2026] [:error] [pid 33173:tid 33254] [client 135.116.194.58:43913] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adljeq8109xRDP2izWiqGAAAAIk"]
[Sat Apr 11 04:54:18.958979 2026] [:error] [pid 33171:tid 33189] [client 135.116.194.58:61738] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adljeroqTMlo30hcVw88dwAAAAM"]
[Sat Apr 11 04:54:19.603912 2026] [:error] [pid 33288:tid 33310] [client 135.116.194.58:26524] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adlje2JmwJFFPEgRHfH-SwAAANQ"]
[Sat Apr 11 04:54:20.273243 2026] [:error] [pid 33288:tid 33304] [client 135.116.194.58:14274] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adljfGJmwJFFPEgRHfH-UAAAAM4"]
[Sat Apr 11 04:54:20.891296 2026] [:error] [pid 33173:tid 33254] [client 135.116.194.58:15558] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adljfK8109xRDP2izWiqJAAAAIk"]
[Sat Apr 11 04:54:21.440075 2026] [:error] [pid 33171:tid 33200] [client 135.116.194.58:21851] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adljfboqTMlo30hcVw88fAAAAA4"]
[Sat Apr 11 04:54:22.128807 2026] [:error] [pid 33172:tid 33237] [client 135.116.194.58:14329] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adljfjn2G0IJw5EZY9kVxQAAAFM"]
[Sat Apr 11 04:54:22.785950 2026] [:error] [pid 33288:tid 33306] [client 135.116.194.58:31337] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adljfmJmwJFFPEgRHfH-agAAANA"]
[Sat Apr 11 04:54:24.929848 2026] [:error] [pid 33173:tid 33247] [client 135.116.194.58:26199] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adljgK8109xRDP2izWiqMwAAAII"]
[Sat Apr 11 04:54:25.789164 2026] [:error] [pid 33173:tid 33250] [client 135.116.194.58:17247] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adljga8109xRDP2izWiqOgAAAIU"]
[Sat Apr 11 04:54:26.739094 2026] [:error] [pid 33173:tid 33266] [client 135.116.194.58:26549] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adljgq8109xRDP2izWiqQgAAAJU"]
[Sat Apr 11 04:54:27.449648 2026] [:error] [pid 33173:tid 33267] [client 135.116.194.58:15304] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adljg68109xRDP2izWiqRAAAAJY"]
[Sat Apr 11 04:54:29.349003 2026] [:error] [pid 33288:tid 33301] [client 135.116.194.58:14312] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adljhWJmwJFFPEgRHfH-fQAAAMs"]
[Sat Apr 11 04:55:00.702971 2026] [:error] [pid 33173:tid 33261] [client 135.116.194.58:14470] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Sat Apr 11 04:55:02.093989 2026] [:error] [pid 33172:tid 33234] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Sat Apr 11 04:55:02.384996 2026] [:error] [pid 33172:tid 33231] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Sat Apr 11 04:55:02.649874 2026] [:error] [pid 33172:tid 33226] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/jlex.php
[Sat Apr 11 04:55:02.931863 2026] [:error] [pid 33172:tid 33240] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/xsas.php
[Sat Apr 11 04:55:03.470009 2026] [:error] [pid 33172:tid 33242] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Sat Apr 11 04:55:03.733202 2026] [:error] [pid 33172:tid 33219] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Sat Apr 11 04:55:04.005152 2026] [:error] [pid 33172:tid 33221] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sat Apr 11 04:55:04.268262 2026] [:error] [pid 33172:tid 33222] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Sat Apr 11 04:55:04.912191 2026] [:error] [pid 33172:tid 33233] [client 135.116.194.58:21469] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sat Apr 11 04:55:05.475941 2026] [:error] [pid 33172:tid 33232] [client 135.116.194.58:21469] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adljqTn2G0IJw5EZY9kWTQAAAE4"]
[Sat Apr 11 04:55:06.651602 2026] [:error] [pid 33173:tid 33258] [client 135.116.194.58:32858] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adljqq8109xRDP2izWiqygAAAI0"]
[Sat Apr 11 04:55:07.514504 2026] [:error] [pid 33173:tid 33259] [client 135.116.194.58:32873] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adljq68109xRDP2izWiq0wAAAI4"]
[Sat Apr 11 04:55:08.384372 2026] [:error] [pid 33288:tid 33308] [client 135.116.194.58:13055] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adljrGJmwJFFPEgRHfH_YgAAANI"]
[Sat Apr 11 08:00:43.553028 2026] [:error] [pid 15244:tid 15268] [client 68.221.135.129:17573] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Apr 11 08:00:43.792103 2026] [:error] [pid 15244:tid 15259] [client 68.221.135.129:17573] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-demomav.php
[Sat Apr 11 08:00:44.031611 2026] [:error] [pid 15244:tid 15267] [client 68.221.135.129:17573] File does not exist: /usr/local/apache/htdocs/suspended-page/itil.php
[Sat Apr 11 08:00:44.270340 2026] [:error] [pid 15244:tid 15265] [client 68.221.135.129:17573] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Apr 11 08:00:44.509571 2026] [:error] [pid 15244:tid 15251] [client 68.221.135.129:17573] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-filters.php
[Sat Apr 11 08:00:44.749408 2026] [:error] [pid 15244:tid 15266] [client 68.221.135.129:17573] File does not exist: /usr/local/apache/htdocs/suspended-page/new2.php
[Sat Apr 11 08:00:44.987820 2026] [:error] [pid 15244:tid 15262] [client 68.221.135.129:17573] File does not exist: /usr/local/apache/htdocs/suspended-page/mjq.php
[Sat Apr 11 09:12:14.661792 2026] [:error] [pid 18016:tid 18042] [client 20.250.31.31:49618] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sat Apr 11 09:12:14.896825 2026] [:error] [pid 18016:tid 18036] [client 20.250.31.31:49618] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-demomav.php
[Sat Apr 11 09:12:15.132574 2026] [:error] [pid 18016:tid 18025] [client 20.250.31.31:49618] File does not exist: /usr/local/apache/htdocs/suspended-page/itil.php
[Sat Apr 11 09:12:15.368139 2026] [:error] [pid 18016:tid 18027] [client 20.250.31.31:49618] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat Apr 11 09:12:15.603001 2026] [:error] [pid 18016:tid 18042] [client 20.250.31.31:49618] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-filters.php
[Sat Apr 11 09:12:15.837752 2026] [:error] [pid 18016:tid 18024] [client 20.250.31.31:49618] File does not exist: /usr/local/apache/htdocs/suspended-page/new2.php
[Sat Apr 11 09:12:16.073261 2026] [:error] [pid 18016:tid 18034] [client 20.250.31.31:49618] File does not exist: /usr/local/apache/htdocs/suspended-page/mjq.php
[Sat Apr 11 09:19:50.062769 2026] [:error] [pid 22756:tid 22766] [client 49.234.192.248:36202] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "admhtmfoSJ40LEm6kfquQgAAAAg"]
[Sat Apr 11 09:42:44.197190 2026] [:error] [pid 34824:tid 34893] [client 157.15.40.61:60089] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/system/js/core.js"] [unique_id "admnFF_rq5TGFWAbVHXeGAAAAYw"]
[Sat Apr 11 10:58:54.777214 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Sat Apr 11 10:58:55.028762 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sat Apr 11 10:58:55.321854 2026] [:error] [pid 2297:tid 2311] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Sat Apr 11 10:58:55.571361 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Sat Apr 11 10:58:55.822936 2026] [:error] [pid 2297:tid 2302] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sat Apr 11 10:58:56.221058 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/ws60.php
[Sat Apr 11 10:58:56.469354 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Sat Apr 11 10:58:56.767277 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Sat Apr 11 10:58:57.016761 2026] [:error] [pid 2297:tid 2304] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/144.php
[Sat Apr 11 10:58:57.266425 2026] [:error] [pid 2297:tid 2322] [client 20.238.68.44:24760] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Sat Apr 11 10:58:57.512401 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:24760] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "adm48bXJS-Jji11jZk11PAAAARA"]
[Sat Apr 11 10:58:58.368677 2026] [:error] [pid 2187:tid 2227] [client 20.238.68.44:39183] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "adm48g4J29_qQi0FkjhM3gAAAAE"]
[Sat Apr 11 10:58:59.215668 2026] [:error] [pid 2297:tid 2319] [client 20.238.68.44:14432] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "adm487XJS-Jji11jZk11QAAAARI"]
[Sat Apr 11 10:59:00.216436 2026] [:error] [pid 2186:tid 2203] [client 20.238.68.44:24733] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-104.php"] [unique_id "adm49MibnOEEvcO8wPLMbAAAAI0"]
[Sat Apr 11 10:59:00.745912 2026] [:error] [pid 2297:tid 2320] [client 20.238.68.44:39395] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "adm49LXJS-Jji11jZk11QgAAARM"]
[Sat Apr 11 10:59:01.287788 2026] [:error] [pid 2186:tid 2192] [client 20.238.68.44:39189] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "adm49cibnOEEvcO8wPLMcgAAAII"]
[Sat Apr 11 10:59:01.803891 2026] [:error] [pid 2188:tid 2260] [client 20.238.68.44:26535] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "adm49YDhDA-Xtn2nRSe-RwAAAMQ"]
[Sat Apr 11 10:59:02.448912 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:29893] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rzki.php"] [unique_id "adm49rXJS-Jji11jZk11QwAAARc"]
[Sat Apr 11 10:59:02.951956 2026] [:error] [pid 2187:tid 2246] [client 20.238.68.44:34287] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adm49g4J29_qQi0FkjhM6QAAABI"]
[Sat Apr 11 10:59:04.071959 2026] [:error] [pid 2188:tid 2265] [client 20.238.68.44:29889] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adm4-IDhDA-Xtn2nRSe-TgAAAMk"]
[Sat Apr 11 10:59:04.910040 2026] [:error] [pid 2186:tid 2203] [client 20.238.68.44:12981] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adm4-MibnOEEvcO8wPLMdQAAAI0"]
[Sat Apr 11 10:59:06.666105 2026] [:error] [pid 2297:tid 2304] [client 20.238.68.44:49895] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adm4-rXJS-Jji11jZk11VAAAAQM"]
[Sat Apr 11 10:59:07.384894 2026] [:error] [pid 2297:tid 2314] [client 20.238.68.44:24151] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "adm4-7XJS-Jji11jZk11WAAAAQ0"]
[Sat Apr 11 10:59:08.775289 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:39409] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "adm4_LXJS-Jji11jZk11XgAAAQg"]
[Sat Apr 11 10:59:09.612059 2026] [:error] [pid 2186:tid 2213] [client 20.238.68.44:39414] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "adm4_cibnOEEvcO8wPLMfgAAAJY"]
[Sat Apr 11 10:59:10.116012 2026] [:error] [pid 2187:tid 2235] [client 20.238.68.44:39198] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d12.php"] [unique_id "adm4_g4J29_qQi0FkjhM8QAAAAc"]
[Sat Apr 11 10:59:10.855590 2026] [:error] [pid 2187:tid 2245] [client 20.238.68.44:4389] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "adm4_g4J29_qQi0FkjhM8wAAABE"]
[Sat Apr 11 10:59:11.478091 2026] [:error] [pid 2188:tid 2263] [client 20.238.68.44:39374] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "adm4_4DhDA-Xtn2nRSe-WQAAAMc"]
[Sat Apr 11 10:59:11.984579 2026] [:error] [pid 2297:tid 2311] [client 20.238.68.44:29931] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "adm4_7XJS-Jji11jZk11YgAAAQo"]
[Sat Apr 11 10:59:12.478997 2026] [:error] [pid 2188:tid 2274] [client 20.238.68.44:39193] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/okxh.php"] [unique_id "adm5AIDhDA-Xtn2nRSe-XwAAANI"]
[Sat Apr 11 10:59:13.172870 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:34271] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "adm5AbXJS-Jji11jZk11ZwAAARA"]
[Sat Apr 11 10:59:13.706834 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:12975] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "adm5AYDhDA-Xtn2nRSe-YQAAAME"]
[Sat Apr 11 10:59:14.332135 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:29916] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "adm5ArXJS-Jji11jZk11bQAAAQQ"]
[Sat Apr 11 10:59:14.859320 2026] [:error] [pid 2297:tid 2320] [client 20.238.68.44:4268] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/55b76.php"] [unique_id "adm5ArXJS-Jji11jZk11cAAAARM"]
[Sat Apr 11 10:59:15.388123 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:39394] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "adm5A7XJS-Jji11jZk11cgAAARA"]
[Sat Apr 11 10:59:15.977174 2026] [:error] [pid 2188:tid 2267] [client 20.238.68.44:49881] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "adm5A4DhDA-Xtn2nRSe-ZQAAAMs"]
[Sat Apr 11 10:59:16.514371 2026] [:error] [pid 2188:tid 2262] [client 20.238.68.44:4697] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "adm5BIDhDA-Xtn2nRSe-ZwAAAMY"]
[Sat Apr 11 10:59:17.006184 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:39367] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "adm5BcibnOEEvcO8wPLMjAAAAIM"]
[Sat Apr 11 10:59:17.656367 2026] [:error] [pid 2188:tid 2260] [client 20.238.68.44:26543] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "adm5BYDhDA-Xtn2nRSe-agAAAMQ"]
[Sat Apr 11 10:59:18.157831 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:26781] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "adm5BoDhDA-Xtn2nRSe-bgAAAME"]
[Sat Apr 11 10:59:18.715799 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:39197] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "adm5BrXJS-Jji11jZk11egAAAQQ"]
[Sat Apr 11 10:59:19.226615 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:18682] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maul.php"] [unique_id "adm5B7XJS-Jji11jZk11ewAAARY"]
[Sat Apr 11 10:59:19.761448 2026] [:error] [pid 2186:tid 2208] [client 20.238.68.44:49919] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "adm5B8ibnOEEvcO8wPLMjgAAAJI"]
[Sat Apr 11 10:59:20.327780 2026] [:error] [pid 2186:tid 2196] [client 20.238.68.44:4734] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "adm5CMibnOEEvcO8wPLMkgAAAIY"]
[Sat Apr 11 10:59:20.930125 2026] [:error] [pid 2186:tid 2190] [client 20.238.68.44:26521] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "adm5CMibnOEEvcO8wPLMlgAAAIA"]
[Sat Apr 11 10:59:21.475749 2026] [:error] [pid 2187:tid 2234] [client 20.238.68.44:29904] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5b9ac.php"] [unique_id "adm5CQ4J29_qQi0FkjhNAQAAAAY"]
[Sat Apr 11 10:59:22.321015 2026] [:error] [pid 2186:tid 2205] [client 20.238.68.44:22418] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "adm5CsibnOEEvcO8wPLMogAAAI8"]
[Sat Apr 11 10:59:23.002280 2026] [:error] [pid 2297:tid 2313] [client 20.238.68.44:4713] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "adm5C7XJS-Jji11jZk11gwAAAQw"]
[Sat Apr 11 10:59:23.611252 2026] [:error] [pid 2297:tid 2320] [client 20.238.68.44:20865] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "adm5C7XJS-Jji11jZk11hAAAARM"]
[Sat Apr 11 10:59:24.145122 2026] [:error] [pid 2187:tid 2251] [client 20.238.68.44:4249] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hehe.php"] [unique_id "adm5DA4J29_qQi0FkjhNCQAAABc"]
[Sat Apr 11 10:59:24.910390 2026] [:error] [pid 2186:tid 2210] [client 20.238.68.44:34270] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adm5DMibnOEEvcO8wPLMqwAAAJQ"]
[Sat Apr 11 10:59:25.439533 2026] [:error] [pid 2187:tid 2231] [client 20.238.68.44:18429] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adm5DQ4J29_qQi0FkjhNDgAAAAM"]
[Sat Apr 11 10:59:25.994875 2026] [:error] [pid 2188:tid 2272] [client 20.238.68.44:26557] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adm5DYDhDA-Xtn2nRSe-eQAAANA"]
[Sat Apr 11 10:59:26.657853 2026] [:error] [pid 2188:tid 2271] [client 20.238.68.44:29936] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "adm5DoDhDA-Xtn2nRSe-fAAAAM8"]
[Sat Apr 11 10:59:27.220451 2026] [:error] [pid 2187:tid 2236] [client 20.238.68.44:30478] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/varb.php"] [unique_id "adm5Dw4J29_qQi0FkjhNFAAAAAg"]
[Sat Apr 11 10:59:27.795069 2026] [:error] [pid 2187:tid 2243] [client 20.238.68.44:26550] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/varb.php"] [unique_id "adm5Dw4J29_qQi0FkjhNFQAAAA8"]
[Sat Apr 11 10:59:28.379058 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:18411] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/varb.php"] [unique_id "adm5ELXJS-Jji11jZk11jQAAAQA"]
[Sat Apr 11 10:59:28.920906 2026] [:error] [pid 2297:tid 2310] [client 20.238.68.44:49916] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/varb.php"] [unique_id "adm5ELXJS-Jji11jZk11jwAAAQk"]
[Sat Apr 11 10:59:29.502724 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:11314] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "adm5EbXJS-Jji11jZk11lAAAAQI"]
[Sat Apr 11 10:59:30.121256 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:4248] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "adm5ErXJS-Jji11jZk11lgAAARA"]
[Sat Apr 11 10:59:30.648582 2026] [:error] [pid 2297:tid 2308] [client 20.238.68.44:40059] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "adm5ErXJS-Jji11jZk11mAAAAQc"]
[Sat Apr 11 10:59:31.291510 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:40037] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lm15.php"] [unique_id "adm5E7XJS-Jji11jZk11nQAAAQI"]
[Sat Apr 11 10:59:31.825186 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:26804] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "adm5E7XJS-Jji11jZk11ogAAARA"]
[Sat Apr 11 10:59:32.362666 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:18382] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "adm5FLXJS-Jji11jZk11pAAAAQg"]
[Sat Apr 11 10:59:33.060752 2026] [:error] [pid 2188:tid 2279] [client 20.238.68.44:39376] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "adm5FYDhDA-Xtn2nRSe-hwAAANc"]
[Sat Apr 11 10:59:33.831007 2026] [:error] [pid 2188:tid 2263] [client 20.238.68.44:11315] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clss.php"] [unique_id "adm5FYDhDA-Xtn2nRSe-iwAAAMc"]
[Sat Apr 11 10:59:34.606324 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:8633] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "adm5FrXJS-Jji11jZk11qwAAARc"]
[Sat Apr 11 10:59:35.403808 2026] [:error] [pid 2297:tid 2314] [client 20.238.68.44:4710] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "adm5F7XJS-Jji11jZk11sQAAAQ0"]
[Sat Apr 11 10:59:36.068961 2026] [:error] [pid 2297:tid 2315] [client 20.238.68.44:8604] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "adm5GLXJS-Jji11jZk11tgAAAQ4"]
[Sat Apr 11 10:59:36.643639 2026] [:error] [pid 2187:tid 2241] [client 20.238.68.44:22457] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/44.php"] [unique_id "adm5GA4J29_qQi0FkjhNIAAAAA0"]
[Sat Apr 11 10:59:37.294438 2026] [:error] [pid 2187:tid 2252] [client 20.238.68.44:18670] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "adm5GQ4J29_qQi0FkjhNIQAAABg"]
[Sat Apr 11 10:59:37.910856 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:26803] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "adm5GbXJS-Jji11jZk11vQAAAQA"]
[Sat Apr 11 10:59:38.501917 2026] [:error] [pid 2297:tid 2302] [client 20.238.68.44:26755] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "adm5GrXJS-Jji11jZk11vgAAAQE"]
[Sat Apr 11 10:59:39.053595 2026] [:error] [pid 2297:tid 2304] [client 20.238.68.44:37433] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5e0a.php"] [unique_id "adm5G7XJS-Jji11jZk11wAAAAQM"]
[Sat Apr 11 10:59:39.655894 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:40003] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "adm5G7XJS-Jji11jZk11xQAAAQg"]
[Sat Apr 11 10:59:40.342951 2026] [:error] [pid 2297:tid 2312] [client 20.238.68.44:40049] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "adm5HLXJS-Jji11jZk11xwAAAQs"]
[Sat Apr 11 10:59:40.965107 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:29899] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "adm5HLXJS-Jji11jZk11zQAAAQI"]
[Sat Apr 11 10:59:41.867006 2026] [:error] [pid 2297:tid 2325] [client 20.238.68.44:37379] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bo.php"] [unique_id "adm5HbXJS-Jji11jZk110QAAARg"]
[Sat Apr 11 10:59:42.568934 2026] [:error] [pid 2187:tid 2238] [client 20.238.68.44:42918] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "adm5Hg4J29_qQi0FkjhNJwAAAAo"]
[Sat Apr 11 10:59:43.200479 2026] [:error] [pid 2186:tid 2220] [client 20.238.68.44:4287] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "adm5H8ibnOEEvcO8wPLM2wAAAJg"]
[Sat Apr 11 10:59:43.713055 2026] [:error] [pid 2187:tid 2250] [client 20.238.68.44:20875] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "adm5Hw4J29_qQi0FkjhNKwAAABY"]
[Sat Apr 11 10:59:44.375593 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:26811] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/56c53.php"] [unique_id "adm5ILXJS-Jji11jZk111QAAAQI"]
[Sat Apr 11 10:59:45.074930 2026] [:error] [pid 2188:tid 2278] [client 20.238.68.44:39187] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "adm5IYDhDA-Xtn2nRSe-oQAAANY"]
[Sat Apr 11 10:59:45.749767 2026] [:error] [pid 2297:tid 2316] [client 20.238.68.44:8599] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "adm5IbXJS-Jji11jZk113AAAAQ8"]
[Sat Apr 11 10:59:46.331906 2026] [:error] [pid 2297:tid 2310] [client 20.238.68.44:4263] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "adm5IrXJS-Jji11jZk114AAAAQk"]
[Sat Apr 11 10:59:46.894333 2026] [:error] [pid 2188:tid 2280] [client 20.238.68.44:41237] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx78.php"] [unique_id "adm5IoDhDA-Xtn2nRSe-pQAAANg"]
[Sat Apr 11 10:59:47.683470 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:4973] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adm5I7XJS-Jji11jZk116QAAARQ"]
[Sat Apr 11 10:59:48.244842 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:41254] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adm5JLXJS-Jji11jZk117AAAAQQ"]
[Sat Apr 11 10:59:48.830856 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:20916] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adm5JLXJS-Jji11jZk118AAAAQg"]
[Sat Apr 11 10:59:49.506421 2026] [:error] [pid 2297:tid 2307] [client 20.238.68.44:18648] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adm5JbXJS-Jji11jZk118wAAAQY"]
[Sat Apr 11 10:59:50.113627 2026] [:error] [pid 2186:tid 2206] [client 20.238.68.44:18633] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adm5JsibnOEEvcO8wPLM4wAAAJA"]
[Sat Apr 11 10:59:50.752407 2026] [:error] [pid 2297:tid 2313] [client 20.238.68.44:42910] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adm5JrXJS-Jji11jZk119gAAAQw"]
[Sat Apr 11 10:59:51.660059 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:5039] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adm5Jw4J29_qQi0FkjhNOwAAAA4"]
[Sat Apr 11 10:59:54.017805 2026] [:error] [pid 2297:tid 2313] [client 20.238.68.44:40032] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "adm5KrXJS-Jji11jZk11_AAAAQw"]
[Sat Apr 11 10:59:54.710517 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:47203] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "adm5KrXJS-Jji11jZk12AAAAAQg"]
[Sat Apr 11 10:59:55.330597 2026] [:error] [pid 2188:tid 2260] [client 20.238.68.44:42895] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "adm5K4DhDA-Xtn2nRSe-tAAAAMQ"]
[Sat Apr 11 10:59:55.932530 2026] [:error] [pid 2186:tid 2198] [client 20.238.68.44:30519] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "adm5K8ibnOEEvcO8wPLM7gAAAIg"]
[Sat Apr 11 10:59:56.987479 2026] [:error] [pid 2187:tid 2246] [client 20.238.68.44:28246] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "adm5LA4J29_qQi0FkjhNTwAAABI"]
[Sat Apr 11 10:59:57.573048 2026] [:error] [pid 2186:tid 2194] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Sat Apr 11 10:59:58.091324 2026] [:error] [pid 2186:tid 2196] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sat Apr 11 10:59:58.539315 2026] [:error] [pid 2186:tid 2204] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/ws49.php
[Sat Apr 11 10:59:58.894019 2026] [:error] [pid 2186:tid 2191] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Sat Apr 11 10:59:59.145666 2026] [:error] [pid 2186:tid 2200] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Sat Apr 11 10:59:59.413382 2026] [:error] [pid 2186:tid 2212] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Sat Apr 11 10:59:59.775666 2026] [:error] [pid 2186:tid 2195] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/callback.php
[Sat Apr 11 11:00:00.139199 2026] [:error] [pid 2186:tid 2190] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sat Apr 11 11:00:00.400955 2026] [:error] [pid 2186:tid 2218] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sat Apr 11 11:00:00.930706 2026] [:error] [pid 2186:tid 2192] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Sat Apr 11 11:00:01.184037 2026] [:error] [pid 2186:tid 2197] [client 20.238.68.44:20887] File does not exist: /usr/local/apache/htdocs/suspended-page/zlnckdxn.php
[Sat Apr 11 11:00:01.468532 2026] [:error] [pid 2186:tid 2206] [client 20.238.68.44:20887] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "adm5McibnOEEvcO8wPLM_wAAAJA"]
[Sat Apr 11 11:00:02.038955 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:47175] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "adm5MrXJS-Jji11jZk12HgAAARA"]
[Sat Apr 11 11:00:02.695817 2026] [:error] [pid 2188:tid 2265] [client 20.238.68.44:43990] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "adm5MoDhDA-Xtn2nRSe-twAAAMk"]
[Sat Apr 11 11:00:03.244015 2026] [:error] [pid 2297:tid 2314] [client 20.238.68.44:4986] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs6.php"] [unique_id "adm5M7XJS-Jji11jZk12JwAAAQ0"]
[Sat Apr 11 11:00:03.840717 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:4960] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwzs.php"] [unique_id "adm5M8ibnOEEvcO8wPLNBAAAAIM"]
[Sat Apr 11 11:00:04.410767 2026] [:error] [pid 2188:tid 2277] [client 20.238.68.44:11274] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwzs.php"] [unique_id "adm5NIDhDA-Xtn2nRSe-uQAAANU"]
[Sat Apr 11 11:00:05.644562 2026] [:error] [pid 2188:tid 2276] [client 20.238.68.44:47210] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwzs.php"] [unique_id "adm5NYDhDA-Xtn2nRSe-vAAAANQ"]
[Sat Apr 11 11:00:06.256481 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:35580] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwzs.php"] [unique_id "adm5NrXJS-Jji11jZk12NQAAARE"]
[Sat Apr 11 11:00:06.780915 2026] [:error] [pid 2297:tid 2302] [client 20.238.68.44:35582] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "adm5NrXJS-Jji11jZk12OgAAAQE"]
[Sat Apr 11 11:00:07.562782 2026] [:error] [pid 2297:tid 2311] [client 20.238.68.44:42885] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "adm5N7XJS-Jji11jZk12PwAAAQo"]
[Sat Apr 11 11:00:08.214003 2026] [:error] [pid 2186:tid 2196] [client 20.238.68.44:41262] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "adm5OMibnOEEvcO8wPLNDgAAAIY"]
[Sat Apr 11 11:00:08.890063 2026] [:error] [pid 2186:tid 2200] [client 20.238.68.44:30510] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "adm5OMibnOEEvcO8wPLNEAAAAIo"]
[Sat Apr 11 11:00:09.678695 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:36441] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "adm5ObXJS-Jji11jZk12SgAAAQA"]
[Sat Apr 11 11:00:10.230880 2026] [:error] [pid 2188:tid 2266] [client 20.238.68.44:35532] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "adm5OoDhDA-Xtn2nRSe-wAAAAMo"]
[Sat Apr 11 11:00:10.891664 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:32987] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "adm5OrXJS-Jji11jZk12UwAAAQU"]
[Sat Apr 11 11:00:11.740290 2026] [:error] [pid 2297:tid 2319] [client 20.238.68.44:36469] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "adm5O7XJS-Jji11jZk12WQAAARI"]
[Sat Apr 11 11:00:12.449579 2026] [:error] [pid 2188:tid 2276] [client 20.238.68.44:22894] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewe.php"] [unique_id "adm5PIDhDA-Xtn2nRSe-yQAAANQ"]
[Sat Apr 11 11:00:12.962959 2026] [:error] [pid 2188:tid 2266] [client 20.238.68.44:47170] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewe.php"] [unique_id "adm5PIDhDA-Xtn2nRSe-zgAAAMo"]
[Sat Apr 11 11:00:13.598406 2026] [:error] [pid 2188:tid 2261] [client 20.238.68.44:43982] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewe.php"] [unique_id "adm5PYDhDA-Xtn2nRSe-0QAAAMU"]
[Sat Apr 11 11:00:14.222337 2026] [:error] [pid 2188:tid 2272] [client 20.238.68.44:22861] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewe.php"] [unique_id "adm5PoDhDA-Xtn2nRSe-1gAAANA"]
[Sat Apr 11 11:00:14.853677 2026] [:error] [pid 2187:tid 2239] [client 20.238.68.44:18572] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adm5Pg4J29_qQi0FkjhNfQAAAAs"]
[Sat Apr 11 11:00:15.573418 2026] [:error] [pid 2186:tid 2207] [client 20.238.68.44:10067] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adm5P8ibnOEEvcO8wPLNHAAAAJE"]
[Sat Apr 11 11:00:16.228299 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:12117] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adm5QIDhDA-Xtn2nRSe-5AAAAME"]
[Sat Apr 11 11:00:16.998985 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:36458] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "adm5QLXJS-Jji11jZk12XwAAAQI"]
[Sat Apr 11 11:00:17.704770 2026] [:error] [pid 2297:tid 2310] [client 20.238.68.44:30210] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x9.php"] [unique_id "adm5QbXJS-Jji11jZk12YgAAAQk"]
[Sat Apr 11 11:00:18.324431 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:41257] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x9.php"] [unique_id "adm5QrXJS-Jji11jZk12ZwAAAQQ"]
[Sat Apr 11 11:00:18.990708 2026] [:error] [pid 2186:tid 2194] [client 20.238.68.44:43465] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x9.php"] [unique_id "adm5QsibnOEEvcO8wPLNIQAAAIQ"]
[Sat Apr 11 11:00:19.714293 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:18560] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x9.php"] [unique_id "adm5Q8ibnOEEvcO8wPLNJAAAAIM"]
[Sat Apr 11 11:00:20.401432 2026] [:error] [pid 2186:tid 2218] [client 20.238.68.44:4967] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "adm5RMibnOEEvcO8wPLNJgAAAJc"]
[Sat Apr 11 11:00:21.092094 2026] [:error] [pid 2188:tid 2258] [client 20.238.68.44:4932] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "adm5RYDhDA-Xtn2nRSe-7QAAAMI"]
[Sat Apr 11 11:00:25.068814 2026] [:error] [pid 2297:tid 2312] [client 20.238.68.44:28282] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "adm5SbXJS-Jji11jZk12dgAAAQs"]
[Sat Apr 11 11:00:25.791184 2026] [:error] [pid 2188:tid 2261] [client 20.238.68.44:20670] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "adm5SYDhDA-Xtn2nRSe--QAAAMU"]
[Sat Apr 11 11:00:26.464295 2026] [:error] [pid 2187:tid 2234] [client 20.238.68.44:14030] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboutc.php"] [unique_id "adm5Sg4J29_qQi0FkjhNhgAAAAY"]
[Sat Apr 11 11:00:27.245068 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:4743] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboutc.php"] [unique_id "adm5S7XJS-Jji11jZk12fQAAARE"]
[Sat Apr 11 11:00:27.820605 2026] [:error] [pid 2188:tid 2258] [client 20.238.68.44:36451] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboutc.php"] [unique_id "adm5S4DhDA-Xtn2nRSe_AAAAAMI"]
[Sat Apr 11 11:00:28.376014 2026] [:error] [pid 2186:tid 2198] [client 20.238.68.44:36422] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboutc.php"] [unique_id "adm5TMibnOEEvcO8wPLNOgAAAIg"]
[Sat Apr 11 11:00:28.968503 2026] [:error] [pid 2188:tid 2278] [client 20.238.68.44:35570] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "adm5TIDhDA-Xtn2nRSe_BQAAANY"]
[Sat Apr 11 11:00:29.771200 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:20658] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "adm5TbXJS-Jji11jZk12iQAAARc"]
[Sat Apr 11 11:00:30.341068 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:35555] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "adm5ToDhDA-Xtn2nRSe_CAAAAME"]
[Sat Apr 11 11:00:30.885974 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:20875] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gdn.php"] [unique_id "adm5TrXJS-Jji11jZk12kwAAAQU"]
[Sat Apr 11 11:00:31.639179 2026] [:error] [pid 2188:tid 2266] [client 20.238.68.44:32961] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "adm5T4DhDA-Xtn2nRSe_CQAAAMo"]
[Sat Apr 11 11:00:32.388795 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:14062] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "adm5ULXJS-Jji11jZk12ngAAARA"]
[Sat Apr 11 11:00:33.243055 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:23574] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "adm5UbXJS-Jji11jZk12pQAAAQQ"]
[Sat Apr 11 11:00:33.789949 2026] [:error] [pid 2186:tid 2196] [client 20.238.68.44:23855] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "adm5UcibnOEEvcO8wPLNPgAAAIY"]
[Sat Apr 11 11:00:34.519811 2026] [:error] [pid 2187:tid 2239] [client 20.238.68.44:4787] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "adm5Ug4J29_qQi0FkjhNjwAAAAs"]
[Sat Apr 11 11:00:35.197821 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:18374] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "adm5U7XJS-Jji11jZk12swAAAQQ"]
[Sat Apr 11 11:00:35.784070 2026] [:error] [pid 2187:tid 2247] [client 20.238.68.44:5052] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "adm5Uw4J29_qQi0FkjhNkgAAABM"]
[Sat Apr 11 11:00:36.439057 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:36473] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "adm5VLXJS-Jji11jZk12tgAAARA"]
[Sat Apr 11 11:00:37.102828 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:36744] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpp2.php"] [unique_id "adm5VbXJS-Jji11jZk12ugAAAQQ"]
[Sat Apr 11 11:00:37.767812 2026] [:error] [pid 2188:tid 2268] [client 20.238.68.44:22872] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpp2.php"] [unique_id "adm5VYDhDA-Xtn2nRSe_IAAAAMw"]
[Sat Apr 11 11:00:38.549090 2026] [:error] [pid 2188:tid 2266] [client 20.238.68.44:12136] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpp2.php"] [unique_id "adm5VoDhDA-Xtn2nRSe_JAAAAMo"]
[Sat Apr 11 11:00:39.121495 2026] [:error] [pid 2188:tid 2272] [client 20.238.68.44:10052] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpp2.php"] [unique_id "adm5V4DhDA-Xtn2nRSe_KAAAANA"]
[Sat Apr 11 11:00:39.721999 2026] [:error] [pid 2297:tid 2311] [client 20.238.68.44:12208] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "adm5V7XJS-Jji11jZk12vwAAAQo"]
[Sat Apr 11 11:00:40.319311 2026] [:error] [pid 2186:tid 2213] [client 20.238.68.44:43995] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "adm5WMibnOEEvcO8wPLNRgAAAJY"]
[Sat Apr 11 11:00:41.291597 2026] [:error] [pid 2188:tid 2266] [client 20.238.68.44:10083] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "adm5WYDhDA-Xtn2nRSe_MgAAAMo"]
[Sat Apr 11 11:00:41.947086 2026] [:error] [pid 2187:tid 2252] [client 20.238.68.44:61100] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "adm5WQ4J29_qQi0FkjhNpQAAABg"]
[Sat Apr 11 11:00:42.705606 2026] [:error] [pid 2187:tid 2248] [client 20.238.68.44:18606] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-ajax.php"] [unique_id "adm5Wg4J29_qQi0FkjhNpwAAABQ"]
[Sat Apr 11 11:00:43.446701 2026] [:error] [pid 2187:tid 2232] [client 20.238.68.44:12214] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-ajax.php"] [unique_id "adm5Ww4J29_qQi0FkjhNrQAAAAQ"]
[Sat Apr 11 11:00:44.029354 2026] [:error] [pid 2188:tid 2274] [client 20.238.68.44:12206] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-ajax.php"] [unique_id "adm5XIDhDA-Xtn2nRSe_NwAAANI"]
[Sat Apr 11 11:00:44.981344 2026] [:error] [pid 2188:tid 2259] [client 20.238.68.44:24447] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin-ajax.php"] [unique_id "adm5XIDhDA-Xtn2nRSe_OQAAAMM"]
[Sat Apr 11 11:00:45.698167 2026] [:error] [pid 2186:tid 2210] [client 20.238.68.44:43466] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amthd.php"] [unique_id "adm5XcibnOEEvcO8wPLNUAAAAJQ"]
[Sat Apr 11 11:00:46.422632 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:12647] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amthd.php"] [unique_id "adm5XrXJS-Jji11jZk12xAAAARc"]
[Sat Apr 11 11:00:47.058398 2026] [:error] [pid 2187:tid 2238] [client 20.238.68.44:14049] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amthd.php"] [unique_id "adm5Xw4J29_qQi0FkjhNuwAAAAo"]
[Sat Apr 11 11:00:47.924801 2026] [:error] [pid 2188:tid 2276] [client 20.238.68.44:61724] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amthd.php"] [unique_id "adm5X4DhDA-Xtn2nRSe_QQAAANQ"]
[Sat Apr 11 11:00:48.527648 2026] [:error] [pid 2186:tid 2202] [client 20.238.68.44:39088] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "adm5YMibnOEEvcO8wPLNVgAAAIw"]
[Sat Apr 11 11:00:49.220556 2026] [:error] [pid 2187:tid 2246] [client 20.238.68.44:12614] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "adm5YQ4J29_qQi0FkjhNvgAAABI"]
[Sat Apr 11 11:00:50.070212 2026] [:error] [pid 2188:tid 2277] [client 20.238.68.44:12627] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "adm5YoDhDA-Xtn2nRSe_SAAAANU"]
[Sat Apr 11 11:00:51.063011 2026] [:error] [pid 2188:tid 2271] [client 20.238.68.44:23850] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8xyz.php"] [unique_id "adm5Y4DhDA-Xtn2nRSe_TgAAAM8"]
[Sat Apr 11 11:00:51.650297 2026] [:error] [pid 2188:tid 2274] [client 20.238.68.44:45249] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "adm5Y4DhDA-Xtn2nRSe_UwAAANI"]
[Sat Apr 11 11:00:52.220419 2026] [:error] [pid 2186:tid 2201] [client 20.238.68.44:39076] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "adm5ZMibnOEEvcO8wPLNWQAAAIs"]
[Sat Apr 11 11:00:52.821631 2026] [:error] [pid 2188:tid 2266] [client 20.238.68.44:12196] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "adm5ZIDhDA-Xtn2nRSe_XAAAAMo"]
[Sat Apr 11 11:00:53.470682 2026] [:error] [pid 2186:tid 2199] [client 20.238.68.44:4799] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "adm5ZcibnOEEvcO8wPLNXQAAAIk"]
[Sat Apr 11 11:00:54.135859 2026] [:error] [pid 2186:tid 2213] [client 20.238.68.44:12621] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws68.php"] [unique_id "adm5ZsibnOEEvcO8wPLNXwAAAJY"]
[Sat Apr 11 11:00:54.836573 2026] [:error] [pid 2188:tid 2278] [client 20.238.68.44:39051] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws68.php"] [unique_id "adm5ZoDhDA-Xtn2nRSe_aQAAANY"]
[Sat Apr 11 11:00:55.635080 2026] [:error] [pid 2187:tid 2227] [client 20.238.68.44:4746] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws68.php"] [unique_id "adm5Zw4J29_qQi0FkjhNxQAAAAE"]
[Sat Apr 11 11:00:56.694421 2026] [:error] [pid 2297:tid 2315] [client 20.238.68.44:45299] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws68.php"] [unique_id "adm5aLXJS-Jji11jZk121gAAAQ4"]
[Sat Apr 11 11:00:57.197780 2026] [:error] [pid 2297:tid 2322] [client 20.238.68.44:61736] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "adm5abXJS-Jji11jZk122gAAARU"]
[Sat Apr 11 11:00:57.738334 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:12184] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "adm5abXJS-Jji11jZk124wAAARA"]
[Sat Apr 11 11:00:58.311761 2026] [:error] [pid 2297:tid 2322] [client 20.238.68.44:29075] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "adm5arXJS-Jji11jZk125wAAARU"]
[Sat Apr 11 11:00:58.810411 2026] [:error] [pid 2188:tid 2275] [client 20.238.68.44:18980] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "adm5aoDhDA-Xtn2nRSe_dwAAANM"]
[Sat Apr 11 11:00:59.482625 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:4736] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/njxjtooj.php"] [unique_id "adm5a7XJS-Jji11jZk126gAAAQA"]
[Sat Apr 11 11:01:00.053366 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:29087] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/njxjtooj.php"] [unique_id "adm5bLXJS-Jji11jZk127AAAAQI"]
[Sat Apr 11 11:01:00.618068 2026] [:error] [pid 2188:tid 2279] [client 20.238.68.44:4760] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/njxjtooj.php"] [unique_id "adm5bIDhDA-Xtn2nRSe_gQAAANc"]
[Sat Apr 11 11:01:01.292526 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/njxjtooj.php
[Sat Apr 11 11:01:01.546207 2026] [:error] [pid 2297:tid 2325] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Sat Apr 11 11:01:01.812226 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/ws61.php
[Sat Apr 11 11:01:02.266433 2026] [:error] [pid 2297:tid 2314] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/iyy.php
[Sat Apr 11 11:01:02.532950 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/900.php
[Sat Apr 11 11:01:02.784890 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/blsvgeyaza.php
[Sat Apr 11 11:01:03.034728 2026] [:error] [pid 2297:tid 2304] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/gqhyti.php
[Sat Apr 11 11:01:03.291706 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/autoxxi.php
[Sat Apr 11 11:01:03.540712 2026] [:error] [pid 2297:tid 2322] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/1144452145_error_log.php
[Sat Apr 11 11:01:03.790479 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/ws48.php
[Sat Apr 11 11:01:04.054863 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:27586] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-asyn-upload.php
[Sat Apr 11 11:01:04.322032 2026] [:error] [pid 2297:tid 2316] [client 20.238.68.44:27586] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schallfuns.php"] [unique_id "adm5cLXJS-Jji11jZk13EQAAAQ8"]
[Sat Apr 11 11:01:04.848315 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:45674] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schallfuns.php"] [unique_id "adm5cLXJS-Jji11jZk13FQAAARQ"]
[Sat Apr 11 11:01:05.751593 2026] [:error] [pid 2188:tid 2269] [client 20.238.68.44:36817] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schallfuns.php"] [unique_id "adm5cYDhDA-Xtn2nRSe_jAAAAM0"]
[Sat Apr 11 11:01:06.511429 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:12634] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/schallfuns.php"] [unique_id "adm5crXJS-Jji11jZk13IAAAARE"]
[Sat Apr 11 11:01:07.075466 2026] [:error] [pid 2186:tid 2194] [client 20.238.68.44:27630] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adm5c8ibnOEEvcO8wPLNawAAAIQ"]
[Sat Apr 11 11:01:08.053692 2026] [:error] [pid 2188:tid 2256] [client 20.238.68.44:26041] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adm5dIDhDA-Xtn2nRSe_lAAAAMA"]
[Sat Apr 11 11:01:08.698329 2026] [:error] [pid 2186:tid 2203] [client 20.238.68.44:5087] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adm5dMibnOEEvcO8wPLNbwAAAI0"]
[Sat Apr 11 11:01:09.382216 2026] [:error] [pid 2186:tid 2209] [client 20.238.68.44:18970] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adm5dcibnOEEvcO8wPLNdgAAAJM"]
[Sat Apr 11 11:01:09.931291 2026] [:error] [pid 2188:tid 2278] [client 20.238.68.44:4795] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "adm5dYDhDA-Xtn2nRSe_lgAAANY"]
[Sat Apr 11 11:01:10.549783 2026] [:error] [pid 2188:tid 2269] [client 20.238.68.44:36443] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "adm5doDhDA-Xtn2nRSe_lwAAAM0"]
[Sat Apr 11 11:01:11.626956 2026] [:error] [pid 2297:tid 2302] [client 20.238.68.44:18976] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "adm5d7XJS-Jji11jZk13KQAAAQE"]
[Sat Apr 11 11:01:12.535418 2026] [:error] [pid 2188:tid 2266] [client 20.238.68.44:52729] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/clasa99.php"] [unique_id "adm5eIDhDA-Xtn2nRSe_nQAAAMo"]
[Sat Apr 11 11:01:13.073863 2026] [:error] [pid 2188:tid 2267] [client 20.238.68.44:40244] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myfilexxx.php"] [unique_id "adm5eYDhDA-Xtn2nRSe_ngAAAMs"]
[Sat Apr 11 11:01:13.636591 2026] [:error] [pid 2186:tid 2205] [client 20.238.68.44:19005] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myfilexxx.php"] [unique_id "adm5ecibnOEEvcO8wPLNfwAAAI8"]
[Sat Apr 11 11:01:14.166252 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:54338] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myfilexxx.php"] [unique_id "adm5erXJS-Jji11jZk13MQAAARA"]
[Sat Apr 11 11:01:15.865680 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:45648] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/myfilexxx.php"] [unique_id "adm5e7XJS-Jji11jZk13OgAAARE"]
[Sat Apr 11 11:01:16.516062 2026] [:error] [pid 2297:tid 2325] [client 20.238.68.44:40218] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_144a.php"] [unique_id "adm5fLXJS-Jji11jZk13PQAAARg"]
[Sat Apr 11 11:01:17.036763 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:61679] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_144a.php"] [unique_id "adm5fbXJS-Jji11jZk13PwAAAQg"]
[Sat Apr 11 11:01:17.579981 2026] [:error] [pid 2186:tid 2190] [client 20.238.68.44:5095] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_144a.php"] [unique_id "adm5fcibnOEEvcO8wPLNiAAAAIA"]
[Sat Apr 11 11:01:18.100640 2026] [:error] [pid 2297:tid 2310] [client 20.238.68.44:61670] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/karma_144a.php"] [unique_id "adm5frXJS-Jji11jZk13SQAAAQk"]
[Sat Apr 11 11:01:18.789657 2026] [:error] [pid 2188:tid 2275] [client 20.238.68.44:27601] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3586%20b64.php"] [unique_id "adm5foDhDA-Xtn2nRSe_pwAAANM"]
[Sat Apr 11 11:01:19.302340 2026] [:error] [pid 2297:tid 2319] [client 20.238.68.44:59479] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3586%20b64.php"] [unique_id "adm5f7XJS-Jji11jZk13TgAAARI"]
[Sat Apr 11 11:01:19.802695 2026] [:error] [pid 2297:tid 2322] [client 20.238.68.44:52713] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3586%20b64.php"] [unique_id "adm5f7XJS-Jji11jZk13UQAAARU"]
[Sat Apr 11 11:01:20.407952 2026] [:error] [pid 2188:tid 2264] [client 20.238.68.44:50710] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3586%20b64.php"] [unique_id "adm5gIDhDA-Xtn2nRSe_rgAAAMg"]
[Sat Apr 11 11:01:20.937175 2026] [:error] [pid 2187:tid 2237] [client 20.238.68.44:36857] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adm5gA4J29_qQi0FkjhN8wAAAAk"]
[Sat Apr 11 11:01:21.925254 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:59512] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adm5gbXJS-Jji11jZk13WgAAARQ"]
[Sat Apr 11 11:01:22.610112 2026] [:error] [pid 2188:tid 2280] [client 20.238.68.44:21836] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adm5goDhDA-Xtn2nRSe_sAAAANg"]
[Sat Apr 11 11:01:24.131755 2026] [:error] [pid 2187:tid 2241] [client 20.238.68.44:12248] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adm5hA4J29_qQi0FkjhN9QAAAA0"]
[Sat Apr 11 11:01:24.670083 2026] [:error] [pid 2187:tid 2250] [client 20.238.68.44:17386] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "adm5hA4J29_qQi0FkjhN-AAAABY"]
[Sat Apr 11 11:01:25.177354 2026] [:error] [pid 2188:tid 2258] [client 20.238.68.44:12265] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "adm5hYDhDA-Xtn2nRSe_uwAAAMI"]
[Sat Apr 11 11:01:25.680253 2026] [:error] [pid 2186:tid 2202] [client 20.238.68.44:26001] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "adm5hcibnOEEvcO8wPLNkQAAAIw"]
[Sat Apr 11 11:01:26.219462 2026] [:error] [pid 2186:tid 2208] [client 20.238.68.44:54360] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "adm5hsibnOEEvcO8wPLNlQAAAJI"]
[Sat Apr 11 11:01:26.780433 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:12229] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "adm5hrXJS-Jji11jZk13ZwAAAQA"]
[Sat Apr 11 11:01:27.312388 2026] [:error] [pid 2187:tid 2243] [client 20.238.68.44:17370] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "adm5hw4J29_qQi0FkjhN_AAAAA8"]
[Sat Apr 11 11:01:27.854204 2026] [:error] [pid 2297:tid 2325] [client 20.238.68.44:7742] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "adm5h7XJS-Jji11jZk13bgAAARg"]
[Sat Apr 11 11:01:28.372548 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:43919] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bypltspd.php"] [unique_id "adm5iLXJS-Jji11jZk13bwAAARY"]
[Sat Apr 11 11:01:28.931347 2026] [:error] [pid 2187:tid 2238] [client 20.238.68.44:25686] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "adm5iA4J29_qQi0FkjhOAQAAAAo"]
[Sat Apr 11 11:01:29.426618 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:56659] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "adm5iQ4J29_qQi0FkjhOAwAAAA4"]
[Sat Apr 11 11:01:29.921660 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:4128] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "adm5ibXJS-Jji11jZk13dgAAAQU"]
[Sat Apr 11 11:01:30.505217 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:50689] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "adm5irXJS-Jji11jZk13fAAAAQI"]
[Sat Apr 11 11:01:31.007145 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:34651] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "adm5i7XJS-Jji11jZk13fgAAAQQ"]
[Sat Apr 11 11:01:32.028343 2026] [:error] [pid 2187:tid 2243] [client 20.238.68.44:12227] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "adm5jA4J29_qQi0FkjhOCAAAAA8"]
[Sat Apr 11 11:01:32.531422 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:56651] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "adm5jLXJS-Jji11jZk13jgAAARE"]
[Sat Apr 11 11:01:33.606539 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:29872] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "adm5jbXJS-Jji11jZk13lgAAAQU"]
[Sat Apr 11 11:01:34.106345 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:20536] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "adm5jrXJS-Jji11jZk13mAAAAQI"]
[Sat Apr 11 11:01:34.894255 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:25719] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "adm5jrXJS-Jji11jZk13oQAAARE"]
[Sat Apr 11 11:01:35.396046 2026] [:error] [pid 2297:tid 2311] [client 20.238.68.44:28698] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "adm5j7XJS-Jji11jZk13pwAAAQo"]
[Sat Apr 11 11:01:35.897094 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:7710] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "adm5j7XJS-Jji11jZk13rAAAARE"]
[Sat Apr 11 11:01:36.408732 2026] [:error] [pid 2188:tid 2277] [client 20.238.68.44:35931] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "adm5kIDhDA-Xtn2nRSe_ygAAANU"]
[Sat Apr 11 11:01:36.963030 2026] [:error] [pid 2186:tid 2196] [client 20.238.68.44:17404] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "adm5kMibnOEEvcO8wPLNoQAAAIY"]
[Sat Apr 11 11:01:37.479573 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:4473] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "adm5kbXJS-Jji11jZk13uwAAARc"]
[Sat Apr 11 11:01:37.980787 2026] [:error] [pid 2297:tid 2311] [client 20.238.68.44:28723] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "adm5kbXJS-Jji11jZk13wgAAAQo"]
[Sat Apr 11 11:01:38.599382 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:43938] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "adm5krXJS-Jji11jZk13yQAAAQA"]
[Sat Apr 11 11:01:39.098638 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:29858] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "adm5k7XJS-Jji11jZk13ygAAAQU"]
[Sat Apr 11 11:01:39.619115 2026] [:error] [pid 2297:tid 2322] [client 20.238.68.44:28692] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "adm5k7XJS-Jji11jZk13ywAAARU"]
[Sat Apr 11 11:01:40.177536 2026] [:error] [pid 2297:tid 2312] [client 20.238.68.44:29871] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "adm5lLXJS-Jji11jZk130QAAAQs"]
[Sat Apr 11 11:01:40.690015 2026] [:error] [pid 2188:tid 2272] [client 20.238.68.44:22026] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "adm5lIDhDA-Xtn2nRSe_1AAAANA"]
[Sat Apr 11 11:01:41.271653 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:7699] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "adm5lbXJS-Jji11jZk131wAAAQA"]
[Sat Apr 11 11:01:41.782556 2026] [:error] [pid 2297:tid 2310] [client 20.238.68.44:54382] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "adm5lbXJS-Jji11jZk133QAAAQk"]
[Sat Apr 11 11:01:42.334920 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:50713] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "adm5lrXJS-Jji11jZk135AAAARE"]
[Sat Apr 11 11:01:42.833521 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:29876] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adm5lrXJS-Jji11jZk135wAAARA"]
[Sat Apr 11 11:01:43.329381 2026] [:error] [pid 2188:tid 2280] [client 20.238.68.44:22060] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adm5l4DhDA-Xtn2nRSe_1gAAANg"]
[Sat Apr 11 11:01:43.899823 2026] [:error] [pid 2188:tid 2264] [client 20.238.68.44:20508] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adm5l4DhDA-Xtn2nRSe_2AAAAMg"]
[Sat Apr 11 11:01:44.404427 2026] [:error] [pid 2188:tid 2259] [client 20.238.68.44:35937] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-mancvgertdxz.php"] [unique_id "adm5mIDhDA-Xtn2nRSe_2gAAAMM"]
[Sat Apr 11 11:01:44.955341 2026] [:error] [pid 2186:tid 2218] [client 20.238.68.44:4426] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adm5mMibnOEEvcO8wPLNowAAAJc"]
[Sat Apr 11 11:01:45.450168 2026] [:error] [pid 2187:tid 2234] [client 20.238.68.44:41969] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adm5mQ4J29_qQi0FkjhOEQAAAAY"]
[Sat Apr 11 11:01:45.950688 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:4474] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adm5mcibnOEEvcO8wPLNqAAAAIM"]
[Sat Apr 11 11:01:46.470200 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:25670] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/plugins.php"] [unique_id "adm5mrXJS-Jji11jZk13_AAAARE"]
[Sat Apr 11 11:01:46.985647 2026] [:error] [pid 2187:tid 2232] [client 20.238.68.44:54384] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "adm5mg4J29_qQi0FkjhOFAAAAAQ"]
[Sat Apr 11 11:01:47.723550 2026] [:error] [pid 2297:tid 2311] [client 20.238.68.44:43946] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "adm5m7XJS-Jji11jZk14AAAAAQo"]
[Sat Apr 11 11:01:48.285772 2026] [:error] [pid 2187:tid 2250] [client 20.238.68.44:38656] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "adm5nA4J29_qQi0FkjhOFwAAABY"]
[Sat Apr 11 11:01:48.843804 2026] [:error] [pid 2187:tid 2247] [client 20.238.68.44:54418] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "adm5nA4J29_qQi0FkjhOGQAAABM"]
[Sat Apr 11 11:01:49.347968 2026] [:error] [pid 2188:tid 2261] [client 20.238.68.44:29873] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.qiodetme.php"] [unique_id "adm5nYDhDA-Xtn2nRSe_6QAAAMU"]
[Sat Apr 11 11:01:49.848499 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:35966] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.qiodetme.php"] [unique_id "adm5nQ4J29_qQi0FkjhOGwAAAA4"]
[Sat Apr 11 11:01:50.387660 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:22044] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.qiodetme.php"] [unique_id "adm5nrXJS-Jji11jZk14DAAAAQQ"]
[Sat Apr 11 11:01:50.880798 2026] [:error] [pid 2188:tid 2269] [client 20.238.68.44:10395] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.qiodetme.php"] [unique_id "adm5noDhDA-Xtn2nRSe_7wAAAM0"]
[Sat Apr 11 11:01:51.418054 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:4444] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sodas.php"] [unique_id "adm5n7XJS-Jji11jZk14EAAAARA"]
[Sat Apr 11 11:01:51.933065 2026] [:error] [pid 2187:tid 2235] [client 20.238.68.44:56657] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sodas.php"] [unique_id "adm5nw4J29_qQi0FkjhOHQAAAAc"]
[Sat Apr 11 11:01:52.437510 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:35905] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sodas.php"] [unique_id "adm5oLXJS-Jji11jZk14FAAAARA"]
[Sat Apr 11 11:01:53.270829 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:10403] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sodas.php"] [unique_id "adm5obXJS-Jji11jZk14GAAAARQ"]
[Sat Apr 11 11:01:53.813295 2026] [:error] [pid 2187:tid 2252] [client 20.238.68.44:4477] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "adm5oQ4J29_qQi0FkjhOIQAAABg"]
[Sat Apr 11 11:01:54.354298 2026] [:error] [pid 2297:tid 2316] [client 20.238.68.44:38699] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "adm5orXJS-Jji11jZk14HgAAAQ8"]
[Sat Apr 11 11:01:54.859560 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:43925] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "adm5orXJS-Jji11jZk14IwAAAQQ"]
[Sat Apr 11 11:01:55.363152 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:29855] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "adm5o4DhDA-Xtn2nRSe_9QAAAME"]
[Sat Apr 11 11:01:55.856959 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:56677] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "adm5o7XJS-Jji11jZk14JwAAARc"]
[Sat Apr 11 11:01:56.374173 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:10415] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "adm5pLXJS-Jji11jZk14LQAAAQg"]
[Sat Apr 11 11:01:56.874002 2026] [:error] [pid 2186:tid 2220] [client 20.238.68.44:43922] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "adm5pMibnOEEvcO8wPLNrwAAAJg"]
[Sat Apr 11 11:01:57.382477 2026] [:error] [pid 2297:tid 2312] [client 20.238.68.44:4153] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "adm5pbXJS-Jji11jZk14MgAAAQs"]
[Sat Apr 11 11:01:57.885589 2026] [:error] [pid 2297:tid 2310] [client 20.238.68.44:34684] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "adm5pbXJS-Jji11jZk14NQAAAQk"]
[Sat Apr 11 11:01:58.393807 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:15862] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "adm5prXJS-Jji11jZk14OAAAAQg"]
[Sat Apr 11 11:01:58.891732 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:35927] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "adm5psibnOEEvcO8wPLNswAAAIM"]
[Sat Apr 11 11:01:59.445278 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:34682] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "adm5p7XJS-Jji11jZk14PAAAARc"]
[Sat Apr 11 11:01:59.948681 2026] [:error] [pid 2188:tid 2273] [client 20.238.68.44:60516] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adm5p4DhDA-Xtn2nRSfABQAAANE"]
[Sat Apr 11 11:02:00.451457 2026] [:error] [pid 2188:tid 2256] [client 20.238.68.44:21826] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adm5qIDhDA-Xtn2nRSfACQAAAMA"]
[Sat Apr 11 11:02:00.952019 2026] [:error] [pid 2188:tid 2269] [client 20.238.68.44:15817] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adm5qIDhDA-Xtn2nRSfADQAAAM0"]
[Sat Apr 11 11:02:01.492994 2026] [:error] [pid 2188:tid 2262] [client 20.238.68.44:59593] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adm5qYDhDA-Xtn2nRSfAEgAAAMY"]
[Sat Apr 11 11:02:02.039899 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:29854] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "adm5qoDhDA-Xtn2nRSfAFAAAAME"]
[Sat Apr 11 11:02:02.631315 2026] [:error] [pid 2188:tid 2280] [client 20.238.68.44:35949] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "adm5qoDhDA-Xtn2nRSfAGgAAANg"]
[Sat Apr 11 11:02:03.142602 2026] [:error] [pid 2188:tid 2278] [client 20.238.68.44:54458] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "adm5q4DhDA-Xtn2nRSfAGwAAANY"]
[Sat Apr 11 11:02:03.721569 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:35929] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws86.php"] [unique_id "adm5q7XJS-Jji11jZk14RAAAARQ"]
[Sat Apr 11 11:02:04.245060 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/vx.php
[Sat Apr 11 11:02:04.509806 2026] [:error] [pid 2297:tid 2302] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Sat Apr 11 11:02:04.769214 2026] [:error] [pid 2297:tid 2310] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Sat Apr 11 11:02:05.018636 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sat Apr 11 11:02:05.271793 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/ws83.php
[Sat Apr 11 11:02:05.533728 2026] [:error] [pid 2297:tid 2325] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/ws75.php
[Sat Apr 11 11:02:05.791652 2026] [:error] [pid 2297:tid 2316] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Apr 11 11:02:06.071655 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Sat Apr 11 11:02:06.322761 2026] [:error] [pid 2297:tid 2325] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sat Apr 11 11:02:06.581799 2026] [:error] [pid 2297:tid 2316] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Apr 11 11:02:06.841474 2026] [:error] [pid 2297:tid 2313] [client 20.238.68.44:41962] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Sat Apr 11 11:02:07.087184 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:41962] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "adm5r7XJS-Jji11jZk14YQAAARE"]
[Sat Apr 11 11:02:07.728486 2026] [:error] [pid 2186:tid 2220] [client 20.238.68.44:59605] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "adm5r8ibnOEEvcO8wPLNugAAAJg"]
[Sat Apr 11 11:02:08.363972 2026] [:error] [pid 2187:tid 2232] [client 20.238.68.44:60480] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "adm5sA4J29_qQi0FkjhOLwAAAAQ"]
[Sat Apr 11 11:02:08.884649 2026] [:error] [pid 2187:tid 2228] [client 20.238.68.44:59613] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "adm5sA4J29_qQi0FkjhONAAAAAI"]
[Sat Apr 11 11:02:09.514281 2026] [:error] [pid 2187:tid 2246] [client 20.238.68.44:20532] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adm5sQ4J29_qQi0FkjhONwAAABI"]
[Sat Apr 11 11:02:10.054163 2026] [:error] [pid 2297:tid 2312] [client 20.238.68.44:4465] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adm5srXJS-Jji11jZk14bQAAAQs"]
[Sat Apr 11 11:02:10.701694 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:29829] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adm5srXJS-Jji11jZk14cAAAARE"]
[Sat Apr 11 11:02:11.258888 2026] [:error] [pid 2186:tid 2202] [client 20.238.68.44:54406] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "adm5s8ibnOEEvcO8wPLNxgAAAIw"]
[Sat Apr 11 11:02:11.822436 2026] [:error] [pid 2297:tid 2307] [client 20.238.68.44:30569] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm5s7XJS-Jji11jZk14dAAAAQY"]
[Sat Apr 11 11:02:12.476857 2026] [:error] [pid 2188:tid 2256] [client 20.238.68.44:4476] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm5tIDhDA-Xtn2nRSfALAAAAMA"]
[Sat Apr 11 11:02:12.980511 2026] [:error] [pid 2297:tid 2307] [client 20.238.68.44:60494] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm5tLXJS-Jji11jZk14fAAAAQY"]
[Sat Apr 11 11:02:13.517823 2026] [:error] [pid 2187:tid 2245] [client 20.238.68.44:38675] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm5tQ4J29_qQi0FkjhOPQAAABE"]
[Sat Apr 11 11:02:14.131024 2026] [:error] [pid 2186:tid 2191] [client 20.238.68.44:35501] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "adm5tsibnOEEvcO8wPLNywAAAIE"]
[Sat Apr 11 11:02:15.063511 2026] [:error] [pid 2186:tid 2203] [client 20.238.68.44:14770] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "adm5t8ibnOEEvcO8wPLNzQAAAI0"]
[Sat Apr 11 11:02:15.761296 2026] [:error] [pid 2187:tid 2235] [client 20.238.68.44:30557] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "adm5tw4J29_qQi0FkjhOQgAAAAc"]
[Sat Apr 11 11:02:16.314989 2026] [:error] [pid 2297:tid 2304] [client 20.238.68.44:15825] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "adm5uLXJS-Jji11jZk14iQAAAQM"]
[Sat Apr 11 11:02:17.006527 2026] [:error] [pid 2187:tid 2241] [client 20.238.68.44:54420] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adm5uQ4J29_qQi0FkjhORAAAAA0"]
[Sat Apr 11 11:02:17.666435 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:30537] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adm5ubXJS-Jji11jZk14kQAAARY"]
[Sat Apr 11 11:02:18.257655 2026] [:error] [pid 2186:tid 2191] [client 20.238.68.44:19400] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adm5usibnOEEvcO8wPLN1AAAAIE"]
[Sat Apr 11 11:02:19.019415 2026] [:error] [pid 2187:tid 2247] [client 20.238.68.44:40645] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "adm5uw4J29_qQi0FkjhORgAAABM"]
[Sat Apr 11 11:02:19.833632 2026] [:error] [pid 2186:tid 2206] [client 20.238.68.44:29827] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "adm5u8ibnOEEvcO8wPLN1wAAAJA"]
[Sat Apr 11 11:02:20.574349 2026] [:error] [pid 2187:tid 2245] [client 20.238.68.44:59518] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "adm5vA4J29_qQi0FkjhOSAAAABE"]
[Sat Apr 11 11:02:21.582909 2026] [:error] [pid 2297:tid 2316] [client 20.238.68.44:59639] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "adm5vbXJS-Jji11jZk14qQAAAQ8"]
[Sat Apr 11 11:02:22.243679 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:35913] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/ws49.php"] [unique_id "adm5vrXJS-Jji11jZk14rgAAAQA"]
[Sat Apr 11 11:02:22.770380 2026] [:error] [pid 2188:tid 2276] [client 20.238.68.44:14777] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adm5voDhDA-Xtn2nRSfAPAAAANQ"]
[Sat Apr 11 11:02:23.442582 2026] [:error] [pid 2297:tid 2305] [client 20.238.68.44:20406] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adm5v7XJS-Jji11jZk14tAAAAQQ"]
[Sat Apr 11 11:02:24.013621 2026] [:error] [pid 2187:tid 2252] [client 20.238.68.44:54433] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adm5wA4J29_qQi0FkjhOTAAAABg"]
[Sat Apr 11 11:02:24.863091 2026] [:error] [pid 2187:tid 2235] [client 20.238.68.44:54455] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adm5wA4J29_qQi0FkjhOUAAAAAc"]
[Sat Apr 11 11:03:51.488501 2026] [:error] [pid 2187:tid 2247] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Sat Apr 11 11:03:51.800078 2026] [:error] [pid 2187:tid 2227] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Sat Apr 11 11:03:52.195413 2026] [:error] [pid 2187:tid 2248] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/amp.php
[Sat Apr 11 11:03:52.499434 2026] [:error] [pid 2187:tid 2234] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Sat Apr 11 11:03:52.751673 2026] [:error] [pid 2187:tid 2240] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Sat Apr 11 11:03:53.015982 2026] [:error] [pid 2187:tid 2249] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Sat Apr 11 11:03:53.270922 2026] [:error] [pid 2187:tid 2233] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/myfile.php
[Sat Apr 11 11:03:53.532281 2026] [:error] [pid 2187:tid 2226] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sat Apr 11 11:03:53.787884 2026] [:error] [pid 2187:tid 2251] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sat Apr 11 11:03:54.074280 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/xxw.php
[Sat Apr 11 11:03:54.327854 2026] [:error] [pid 2187:tid 2235] [client 20.238.68.44:46042] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Sat Apr 11 11:03:54.592867 2026] [:error] [pid 2187:tid 2238] [client 20.238.68.44:46042] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adm6Gg4J29_qQi0FkjhO7wAAAAo"]
[Sat Apr 11 11:03:55.296514 2026] [:error] [pid 2188:tid 2278] [client 20.238.68.44:46038] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adm6G4DhDA-Xtn2nRSfA6gAAANY"]
[Sat Apr 11 11:03:55.852329 2026] [:error] [pid 2188:tid 2261] [client 20.238.68.44:50083] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adm6G4DhDA-Xtn2nRSfA7wAAAMU"]
[Sat Apr 11 11:03:56.422736 2026] [:error] [pid 2297:tid 2320] [client 20.238.68.44:39537] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adm6HLXJS-Jji11jZk16VgAAARM"]
[Sat Apr 11 11:03:56.924679 2026] [:error] [pid 2188:tid 2271] [client 20.238.68.44:17848] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adm6HIDhDA-Xtn2nRSfA8wAAAM8"]
[Sat Apr 11 11:03:57.593567 2026] [:error] [pid 2186:tid 2200] [client 20.238.68.44:19152] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adm6HcibnOEEvcO8wPLORAAAAIo"]
[Sat Apr 11 11:03:58.221102 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:17801] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adm6Hg4J29_qQi0FkjhO9gAAAA4"]
[Sat Apr 11 11:03:58.782299 2026] [:error] [pid 2188:tid 2268] [client 20.238.68.44:39937] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "adm6HoDhDA-Xtn2nRSfA_QAAAMw"]
[Sat Apr 11 11:03:59.467312 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:53513] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adm6H8ibnOEEvcO8wPLORwAAAIM"]
[Sat Apr 11 11:04:00.205080 2026] [:error] [pid 2186:tid 2190] [client 20.238.68.44:21979] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adm6IMibnOEEvcO8wPLOSQAAAIA"]
[Sat Apr 11 11:04:00.811273 2026] [:error] [pid 2188:tid 2276] [client 20.238.68.44:42976] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adm6IIDhDA-Xtn2nRSfBDQAAANQ"]
[Sat Apr 11 11:04:01.365558 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:46051] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "adm6IQ4J29_qQi0FkjhO_wAAAA4"]
[Sat Apr 11 11:04:01.936861 2026] [:error] [pid 2186:tid 2208] [client 20.238.68.44:46048] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adm6IcibnOEEvcO8wPLOTAAAAJI"]
[Sat Apr 11 11:04:02.587007 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:62438] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adm6IrXJS-Jji11jZk16agAAARQ"]
[Sat Apr 11 11:04:03.200998 2026] [:error] [pid 2188:tid 2279] [client 20.238.68.44:62418] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adm6I4DhDA-Xtn2nRSfBFQAAANc"]
[Sat Apr 11 11:04:03.859474 2026] [:error] [pid 2188:tid 2269] [client 20.238.68.44:60425] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adm6I4DhDA-Xtn2nRSfBFwAAAM0"]
[Sat Apr 11 11:04:04.381503 2026] [:error] [pid 2187:tid 2233] [client 20.238.68.44:50073] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adm6JA4J29_qQi0FkjhPAQAAAAU"]
[Sat Apr 11 11:04:04.939231 2026] [:error] [pid 2188:tid 2259] [client 20.238.68.44:47061] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adm6JIDhDA-Xtn2nRSfBGQAAAMM"]
[Sat Apr 11 11:04:05.463830 2026] [:error] [pid 2188:tid 2265] [client 20.238.68.44:62422] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adm6JYDhDA-Xtn2nRSfBHAAAAMk"]
[Sat Apr 11 11:04:06.188676 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:57497] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "adm6JrXJS-Jji11jZk16fQAAARY"]
[Sat Apr 11 11:04:06.889747 2026] [:error] [pid 2188:tid 2262] [client 20.238.68.44:19149] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adm6JoDhDA-Xtn2nRSfBJQAAAMY"]
[Sat Apr 11 11:04:07.454340 2026] [:error] [pid 2187:tid 2236] [client 20.238.68.44:57472] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adm6Jw4J29_qQi0FkjhPBAAAAAg"]
[Sat Apr 11 11:04:08.061632 2026] [:error] [pid 2187:tid 2239] [client 20.238.68.44:47041] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adm6KA4J29_qQi0FkjhPBwAAAAs"]
[Sat Apr 11 11:04:08.588814 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:22001] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adm6KIDhDA-Xtn2nRSfBMAAAAME"]
[Sat Apr 11 11:04:09.167681 2026] [:error] [pid 2188:tid 2280] [client 20.238.68.44:50096] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "adm6KYDhDA-Xtn2nRSfBNwAAANg"]
[Sat Apr 11 11:04:09.715621 2026] [:error] [pid 2188:tid 2257] [client 20.238.68.44:39949] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "adm6KYDhDA-Xtn2nRSfBPQAAAME"]
[Sat Apr 11 11:04:10.451271 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:50052] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "adm6KrXJS-Jji11jZk16hQAAARE"]
[Sat Apr 11 11:04:11.020123 2026] [:error] [pid 2188:tid 2279] [client 20.238.68.44:62462] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ajax.php"] [unique_id "adm6K4DhDA-Xtn2nRSfBQgAAANc"]
[Sat Apr 11 11:04:11.566404 2026] [:error] [pid 2297:tid 2320] [client 20.238.68.44:39500] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "adm6K7XJS-Jji11jZk16jwAAARM"]
[Sat Apr 11 11:04:12.075702 2026] [:error] [pid 2187:tid 2228] [client 20.238.68.44:39522] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "adm6LA4J29_qQi0FkjhPCQAAAAI"]
[Sat Apr 11 11:04:12.578465 2026] [:error] [pid 2188:tid 2268] [client 20.238.68.44:44267] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "adm6LIDhDA-Xtn2nRSfBSgAAAMw"]
[Sat Apr 11 11:04:13.102274 2026] [:error] [pid 2188:tid 2279] [client 20.238.68.44:39507] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/install.php"] [unique_id "adm6LYDhDA-Xtn2nRSfBTAAAANc"]
[Sat Apr 11 11:04:13.732460 2026] [:error] [pid 2297:tid 2321] [client 20.238.68.44:4521] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "adm6LbXJS-Jji11jZk16mgAAARQ"]
[Sat Apr 11 11:04:14.286991 2026] [:error] [pid 2188:tid 2273] [client 20.238.68.44:50051] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "adm6LoDhDA-Xtn2nRSfBTgAAANE"]
[Sat Apr 11 11:04:14.908192 2026] [:error] [pid 2186:tid 2220] [client 20.238.68.44:50089] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "adm6LsibnOEEvcO8wPLOUwAAAJg"]
[Sat Apr 11 11:04:15.411047 2026] [:error] [pid 2297:tid 2301] [client 20.238.68.44:56592] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/wp-blog.php"] [unique_id "adm6L7XJS-Jji11jZk16pQAAAQA"]
[Sat Apr 11 11:04:15.932108 2026] [:error] [pid 2297:tid 2319] [client 20.238.68.44:44231] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm6L7XJS-Jji11jZk16qAAAARI"]
[Sat Apr 11 11:04:16.479352 2026] [:error] [pid 2187:tid 2247] [client 20.238.68.44:57528] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm6MA4J29_qQi0FkjhPFgAAABM"]
[Sat Apr 11 11:04:16.996480 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:44259] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm6MLXJS-Jji11jZk16rAAAARc"]
[Sat Apr 11 11:04:17.486451 2026] [:error] [pid 2186:tid 2203] [client 20.238.68.44:53557] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adm6McibnOEEvcO8wPLOWwAAAI0"]
[Sat Apr 11 11:04:17.997450 2026] [:error] [pid 2186:tid 2200] [client 20.238.68.44:53555] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "adm6McibnOEEvcO8wPLOXwAAAIo"]
[Sat Apr 11 11:04:18.526860 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:17845] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "adm6MrXJS-Jji11jZk16sAAAAQI"]
[Sat Apr 11 11:04:19.022781 2026] [:error] [pid 2188:tid 2264] [client 20.238.68.44:44279] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "adm6M4DhDA-Xtn2nRSfBVAAAAMg"]
[Sat Apr 11 11:04:19.570645 2026] [:error] [pid 2186:tid 2205] [client 20.238.68.44:56631] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "adm6M8ibnOEEvcO8wPLOYAAAAI8"]
[Sat Apr 11 11:04:20.172462 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:21989] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "adm6NMibnOEEvcO8wPLOYgAAAIM"]
[Sat Apr 11 11:04:20.693515 2026] [:error] [pid 2188:tid 2268] [client 20.238.68.44:56596] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "adm6NIDhDA-Xtn2nRSfBXAAAAMw"]
[Sat Apr 11 11:04:21.208091 2026] [:error] [pid 2186:tid 2207] [client 20.238.68.44:44231] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "adm6NcibnOEEvcO8wPLOZgAAAJE"]
[Sat Apr 11 11:04:21.802545 2026] [:error] [pid 2297:tid 2312] [client 20.238.68.44:17813] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drhunthq.php"] [unique_id "adm6NbXJS-Jji11jZk16ugAAAQs"]
[Sat Apr 11 11:04:22.353133 2026] [:error] [pid 2186:tid 2212] [client 20.238.68.44:39519] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "adm6NsibnOEEvcO8wPLOaAAAAJU"]
[Sat Apr 11 11:04:23.060773 2026] [:error] [pid 2188:tid 2271] [client 20.238.68.44:17823] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "adm6N4DhDA-Xtn2nRSfBaAAAAM8"]
[Sat Apr 11 11:04:23.601110 2026] [:error] [pid 2186:tid 2200] [client 20.238.68.44:39962] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "adm6N8ibnOEEvcO8wPLOagAAAIo"]
[Sat Apr 11 11:04:24.142381 2026] [:error] [pid 2186:tid 2206] [client 20.238.68.44:4508] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/index.php"] [unique_id "adm6OMibnOEEvcO8wPLObQAAAJA"]
[Sat Apr 11 11:04:24.924905 2026] [:error] [pid 2186:tid 2194] [client 20.238.68.44:4484] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6OMibnOEEvcO8wPLObwAAAIQ"]
[Sat Apr 11 11:04:26.243604 2026] [:error] [pid 2188:tid 2279] [client 20.238.68.44:27911] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6OoDhDA-Xtn2nRSfBdgAAANc"]
[Sat Apr 11 11:04:27.199482 2026] [:error] [pid 2297:tid 2303] [client 20.238.68.44:27929] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6O7XJS-Jji11jZk16ywAAAQI"]
[Sat Apr 11 11:04:27.733562 2026] [:error] [pid 2187:tid 2247] [client 20.238.68.44:19178] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6Ow4J29_qQi0FkjhPRgAAABM"]
[Sat Apr 11 11:04:28.424707 2026] [:error] [pid 2187:tid 2250] [client 20.238.68.44:53516] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adm6PA4J29_qQi0FkjhPTQAAABY"]
[Sat Apr 11 11:04:28.962908 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:53537] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adm6PA4J29_qQi0FkjhPUwAAAA4"]
[Sat Apr 11 11:04:29.623291 2026] [:error] [pid 2188:tid 2277] [client 20.238.68.44:47063] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adm6PYDhDA-Xtn2nRSfBeQAAANU"]
[Sat Apr 11 11:04:30.134792 2026] [:error] [pid 2186:tid 2191] [client 20.238.68.44:21997] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adm6PsibnOEEvcO8wPLOeAAAAIE"]
[Sat Apr 11 11:04:30.724464 2026] [:error] [pid 2297:tid 2314] [client 20.238.68.44:44260] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adm6PrXJS-Jji11jZk162wAAAQ0"]
[Sat Apr 11 11:04:31.392768 2026] [:error] [pid 2187:tid 2244] [client 20.238.68.44:44754] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adm6Pw4J29_qQi0FkjhPYQAAABA"]
[Sat Apr 11 11:04:32.215424 2026] [:error] [pid 2188:tid 2260] [client 20.238.68.44:14126] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adm6QIDhDA-Xtn2nRSfBfgAAAMQ"]
[Sat Apr 11 11:04:32.866202 2026] [:error] [pid 2187:tid 2251] [client 20.238.68.44:34388] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "adm6QA4J29_qQi0FkjhPbwAAABc"]
[Sat Apr 11 11:04:33.547939 2026] [:error] [pid 2297:tid 2319] [client 20.238.68.44:44744] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "adm6QbXJS-Jji11jZk165gAAARI"]
[Sat Apr 11 11:04:34.872661 2026] [:error] [pid 2186:tid 2204] [client 20.238.68.44:50056] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "adm6QsibnOEEvcO8wPLOggAAAI4"]
[Sat Apr 11 11:04:35.695123 2026] [:error] [pid 2187:tid 2242] [client 20.238.68.44:52003] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "adm6Qw4J29_qQi0FkjhPgwAAAA4"]
[Sat Apr 11 11:04:36.341894 2026] [:error] [pid 2297:tid 2309] [client 20.238.68.44:40218] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "adm6RLXJS-Jji11jZk166wAAAQg"]
[Sat Apr 11 11:04:36.957617 2026] [:error] [pid 2187:tid 2226] [client 20.238.68.44:51968] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adm6RA4J29_qQi0FkjhPjgAAAAA"]
[Sat Apr 11 11:04:37.540986 2026] [:error] [pid 2297:tid 2312] [client 20.238.68.44:4502] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adm6RbXJS-Jji11jZk168wAAAQs"]
[Sat Apr 11 11:04:38.566167 2026] [:error] [pid 2297:tid 2323] [client 20.238.68.44:46604] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adm6RrXJS-Jji11jZk169AAAARY"]
[Sat Apr 11 11:04:39.248508 2026] [:error] [pid 2186:tid 2197] [client 20.238.68.44:62426] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "adm6R8ibnOEEvcO8wPLOjQAAAIc"]
[Sat Apr 11 11:04:39.957997 2026] [:error] [pid 2297:tid 2325] [client 20.238.68.44:21826] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6R7XJS-Jji11jZk16-AAAARg"]
[Sat Apr 11 11:04:40.806374 2026] [:error] [pid 2297:tid 2317] [client 20.238.68.44:19141] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6SLXJS-Jji11jZk16_AAAARA"]
[Sat Apr 11 11:04:41.707603 2026] [:error] [pid 2297:tid 2316] [client 20.238.68.44:39971] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6SbXJS-Jji11jZk17AgAAAQ8"]
[Sat Apr 11 11:04:42.332119 2026] [:error] [pid 2186:tid 2192] [client 20.238.68.44:4541] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adm6SsibnOEEvcO8wPLOkAAAAII"]
[Sat Apr 11 11:04:42.966370 2026] [:error] [pid 2186:tid 2190] [client 20.238.68.44:39542] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adm6SsibnOEEvcO8wPLOkwAAAIA"]
[Sat Apr 11 11:04:43.570632 2026] [:error] [pid 2297:tid 2302] [client 20.238.68.44:39508] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adm6S7XJS-Jji11jZk17CQAAAQE"]
[Sat Apr 11 11:04:44.423508 2026] [:error] [pid 2187:tid 2228] [client 20.238.68.44:27942] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adm6TA4J29_qQi0FkjhPvAAAAAI"]
[Sat Apr 11 11:04:45.029311 2026] [:error] [pid 2187:tid 2247] [client 20.238.68.44:56605] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adm6TQ4J29_qQi0FkjhPwgAAABM"]
[Sat Apr 11 11:04:45.573974 2026] [:error] [pid 2187:tid 2251] [client 20.238.68.44:14111] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adm6TQ4J29_qQi0FkjhPygAAABc"]
[Sat Apr 11 11:04:46.137183 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:47066] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adm6TsibnOEEvcO8wPLOoQAAAIM"]
[Sat Apr 11 11:04:46.863935 2026] [:error] [pid 2186:tid 2190] [client 20.238.68.44:14127] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adm6TsibnOEEvcO8wPLOpwAAAIA"]
[Sat Apr 11 11:04:47.483525 2026] [:error] [pid 2186:tid 2200] [client 20.238.68.44:50098] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "adm6T8ibnOEEvcO8wPLOrQAAAIo"]
[Sat Apr 11 11:04:48.164710 2026] [:error] [pid 2186:tid 2193] [client 20.238.68.44:53542] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adm6UMibnOEEvcO8wPLOsAAAAIM"]
[Sat Apr 11 11:04:48.780039 2026] [:error] [pid 2187:tid 2250] [client 20.238.68.44:46599] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adm6UA4J29_qQi0FkjhP4QAAABY"]
[Sat Apr 11 11:04:49.427700 2026] [:error] [pid 2186:tid 2220] [client 20.238.68.44:44265] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adm6UcibnOEEvcO8wPLOvQAAAJg"]
[Sat Apr 11 11:04:49.955868 2026] [:error] [pid 2186:tid 2198] [client 20.238.68.44:51990] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adm6UcibnOEEvcO8wPLOwQAAAIg"]
[Sat Apr 11 11:04:50.508572 2026] [:error] [pid 2187:tid 2250] [client 20.238.68.44:4487] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "adm6Ug4J29_qQi0FkjhP7AAAABY"]
[Sat Apr 11 11:04:51.082037 2026] [:error] [pid 2187:tid 2233] [client 20.238.68.44:30142] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "adm6Uw4J29_qQi0FkjhP8gAAAAU"]
[Sat Apr 11 11:04:51.742173 2026] [:error] [pid 2188:tid 2265] [client 20.238.68.44:17822] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "adm6U4DhDA-Xtn2nRSfBkwAAAMk"]
[Sat Apr 11 11:04:52.266418 2026] [:error] [pid 2297:tid 2306] [client 20.238.68.44:14084] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "adm6VLXJS-Jji11jZk17EwAAAQU"]
[Sat Apr 11 11:04:52.830738 2026] [:error] [pid 2297:tid 2315] [client 20.238.68.44:62441] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "adm6VLXJS-Jji11jZk17FwAAAQ4"]
[Sat Apr 11 11:04:53.625982 2026] [:error] [pid 2187:tid 2238] [client 20.238.68.44:4532] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/155.php"] [unique_id "adm6VQ4J29_qQi0FkjhQAwAAAAo"]
[Sat Apr 11 11:04:54.219750 2026] [:error] [pid 2188:tid 2272] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/155.php
[Sat Apr 11 11:04:54.471074 2026] [:error] [pid 2188:tid 2262] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sat Apr 11 11:04:54.744318 2026] [:error] [pid 2188:tid 2275] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Sat Apr 11 11:04:55.049738 2026] [:error] [pid 2188:tid 2270] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sat Apr 11 11:04:55.372465 2026] [:error] [pid 2188:tid 2263] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/hots.php
[Sat Apr 11 11:04:55.642503 2026] [:error] [pid 2188:tid 2277] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Sat Apr 11 11:04:55.957532 2026] [:error] [pid 2188:tid 2269] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Sat Apr 11 11:04:56.209697 2026] [:error] [pid 2188:tid 2256] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Sat Apr 11 11:04:56.495985 2026] [:error] [pid 2188:tid 2268] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sat Apr 11 11:04:56.891385 2026] [:error] [pid 2188:tid 2273] [client 20.238.68.44:39970] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Sat Apr 11 11:04:57.459763 2026] [:error] [pid 2188:tid 2278] [client 20.238.68.44:39970] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "adm6WYDhDA-Xtn2nRSfBtgAAANY"]
[Sat Apr 11 11:04:58.003958 2026] [:error] [pid 2186:tid 2209] [client 20.238.68.44:14092] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "adm6WsibnOEEvcO8wPLO1QAAAJM"]
[Sat Apr 11 11:04:58.660164 2026] [:error] [pid 2188:tid 2275] [client 20.238.68.44:44273] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "adm6WoDhDA-Xtn2nRSfBtwAAANM"]
[Sat Apr 11 11:04:59.336859 2026] [:error] [pid 2188:tid 2279] [client 20.238.68.44:56608] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "adm6W4DhDA-Xtn2nRSfBuwAAANc"]
[Sat Apr 11 11:04:59.883603 2026] [:error] [pid 2297:tid 2324] [client 20.238.68.44:47096] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "adm6W7XJS-Jji11jZk17YgAAARc"]
[Sat Apr 11 11:05:00.478787 2026] [:error] [pid 2297:tid 2318] [client 20.238.68.44:46595] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "adm6XLXJS-Jji11jZk17ZwAAARE"]
[Sat Apr 11 11:05:01.046082 2026] [:error] [pid 2186:tid 2213] [client 20.238.68.44:44250] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "adm6XcibnOEEvcO8wPLO5AAAAJY"]
[Sat Apr 11 11:05:01.705656 2026] [:error] [pid 2188:tid 2270] [client 20.238.68.44:62449] [client 20.238.68.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws77.php"] [unique_id "adm6XYDhDA-Xtn2nRSfBwAAAAM4"]
[Sat Apr 11 14:11:37.979346 2026] [:error] [pid 2187:tid 2235] [client 157.15.40.61:56410] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "adnmGQ4J29_qQi0FkjiIJgAAAAc"]
[Sat Apr 11 14:11:39.241505 2026] [:error] [pid 2188:tid 2275] [client 157.15.40.61:56532] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/style.php"] [unique_id "adnmG4DhDA-Xtn2nRScJrgAAANM"]
[Sat Apr 11 14:11:40.529530 2026] [:error] [pid 2186:tid 2196] [client 157.15.40.61:56706] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/themes/style.php"] [unique_id "adnmHMibnOEEvcO8wPL9lAAAAIY"]
[Sat Apr 11 14:11:41.812595 2026] [:error] [pid 11067:tid 11084] [client 157.15.40.61:56979] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/style.php"] [unique_id "adnmHcW3w7N67R04YCKRNwAAAE8"]
[Sat Apr 11 14:11:42.495535 2026] [:error] [pid 11067:tid 11069] [client 157.15.40.61:57274] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style.php"] [unique_id "adnmHsW3w7N67R04YCKRogAAAEA"]
[Sat Apr 11 14:11:42.748414 2026] [:error] [pid 2188:tid 2265] [client 157.15.40.61:57337] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "adnmHoDhDA-Xtn2nRScJ-AAAAMk"]
[Sat Apr 11 14:11:43.780153 2026] [:error] [pid 2297:tid 2324] [client 157.15.40.61:57511] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "adnmH7XJS-Jji11jZk3aDQAAARc"]
[Sat Apr 11 14:11:46.009157 2026] [:error] [pid 11067:tid 11074] [client 157.15.40.61:57890] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "adnmIsW3w7N67R04YCKSLAAAAEU"]
[Sat Apr 11 14:11:47.280620 2026] [:error] [pid 2297:tid 2306] [client 157.15.40.61:58108] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "adnmI7XJS-Jji11jZk3apgAAAQU"]
[Sat Apr 11 14:11:48.347860 2026] [:error] [pid 11067:tid 11075] [client 157.15.40.61:58256] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "adnmJMW3w7N67R04YCKSdgAAAEY"]
[Sat Apr 11 14:11:49.635857 2026] [:error] [pid 11067:tid 11080] [client 157.15.40.61:58310] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "adnmJcW3w7N67R04YCKSygAAAEs"]
[Sat Apr 11 14:11:50.297308 2026] [:error] [pid 2297:tid 2311] [client 157.15.40.61:58669] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/blurbs.php"] [unique_id "adnmJrXJS-Jji11jZk3bKgAAAQo"]
[Sat Apr 11 14:11:50.552360 2026] [:error] [pid 2186:tid 2192] [client 157.15.40.61:58750] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/akcc.php"] [unique_id "adnmJsibnOEEvcO8wPL-LwAAAII"]
[Sat Apr 11 14:11:50.805572 2026] [:error] [pid 2297:tid 2318] [client 157.15.40.61:58803] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "adnmJrXJS-Jji11jZk3bSwAAARE"]
[Sat Apr 11 14:11:51.054628 2026] [:error] [pid 2188:tid 2277] [client 157.15.40.61:58859] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/shelp.php"] [unique_id "adnmJ4DhDA-Xtn2nRScK5gAAANU"]
[Sat Apr 11 14:11:51.310614 2026] [:error] [pid 2188:tid 2260] [client 157.15.40.61:58909] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/cord.php"] [unique_id "adnmJ4DhDA-Xtn2nRScK8QAAAMQ"]
[Sat Apr 11 14:11:51.570395 2026] [:error] [pid 11067:tid 11091] [client 157.15.40.61:58964] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/dex.php"] [unique_id "adnmJ8W3w7N67R04YCKTMAAAAFY"]
[Sat Apr 11 14:11:53.855640 2026] [:error] [pid 2187:tid 2234] [client 157.15.40.61:59230] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adnmKQ4J29_qQi0FkjiJJgAAAAY"]
[Sat Apr 11 14:11:54.518433 2026] [:error] [pid 11067:tid 11090] [client 157.15.40.61:59511] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "adnmKsW3w7N67R04YCKT-gAAAFU"]
[Sat Apr 11 14:11:54.773322 2026] [:error] [pid 11067:tid 11084] [client 157.15.40.61:59550] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "adnmKsW3w7N67R04YCKUDQAAAE8"]
[Sat Apr 11 14:11:55.554617 2026] [:error] [pid 2188:tid 2280] [client 157.15.40.61:59743] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/zwso.php"] [unique_id "adnmK4DhDA-Xtn2nRScLYQAAANg"]
[Sat Apr 11 14:11:55.814878 2026] [:error] [pid 11067:tid 11075] [client 157.15.40.61:59813] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "adnmK8W3w7N67R04YCKUeQAAAEY"]
[Sat Apr 11 14:11:56.082796 2026] [:error] [pid 2297:tid 2303] [client 157.15.40.61:59885] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "adnmLLXJS-Jji11jZk3b5AAAAQI"]
[Sat Apr 11 14:11:57.001803 2026] [:error] [pid 2188:tid 2279] [client 157.15.40.61:60084] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/shlo.php"] [unique_id "adnmLYDhDA-Xtn2nRScLfgAAANc"]
[Sat Apr 11 14:11:57.267071 2026] [:error] [pid 2187:tid 2226] [client 157.15.40.61:60132] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "adnmLQ4J29_qQi0FkjiJcgAAAAA"]
[Sat Apr 11 14:11:57.526029 2026] [:error] [pid 11067:tid 11089] [client 157.15.40.61:60201] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/ahax.php"] [unique_id "adnmLcW3w7N67R04YCKVRgAAAFQ"]
[Sat Apr 11 14:11:57.777755 2026] [:error] [pid 11067:tid 11086] [client 157.15.40.61:60276] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "adnmLcW3w7N67R04YCKVVQAAAFE"]
[Sat Apr 11 14:11:58.035500 2026] [:error] [pid 2188:tid 2271] [client 157.15.40.61:60346] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/lufix1.php"] [unique_id "adnmLoDhDA-Xtn2nRScLtwAAAM8"]
[Sat Apr 11 14:11:58.303188 2026] [:error] [pid 11067:tid 11090] [client 157.15.40.61:60430] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/witmm.php"] [unique_id "adnmLsW3w7N67R04YCKVjAAAAFU"]
[Sat Apr 11 14:11:59.578609 2026] [:error] [pid 11067:tid 11084] [client 157.15.40.61:60510] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-admin/css/index.php"] [unique_id "adnmL8W3w7N67R04YCKWDgAAAE8"]
[Sat Apr 11 14:12:00.349715 2026] [:error] [pid 11067:tid 11089] [client 157.15.40.61:60886] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "adnmMMW3w7N67R04YCKWRgAAAFQ"]
[Sat Apr 11 14:12:05.149667 2026] [:error] [pid 2187:tid 2233] [client 157.15.40.61:61340] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-content/index.php"] [unique_id "adnmNQ4J29_qQi0FkjiJ_gAAAAU"]
[Sat Apr 11 14:12:05.412087 2026] [:error] [pid 2297:tid 2310] [client 157.15.40.61:64057] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "adnmNbXJS-Jji11jZk3cnAAAAQk"]
[Sat Apr 11 14:12:08.552218 2026] [:error] [pid 11067:tid 11076] [client 157.15.40.61:49635] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "adnmOMW3w7N67R04YCKXNgAAAEc"]
[Sat Apr 11 19:22:22.543084 2026] [:error] [pid 54520:tid 54583] [client 216.24.210.150:51049] [client 216.24.210.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adou7sOfMlnGwwoJrMCcbgAAAEc"]
[Sat Apr 11 23:01:11.732818 2026] [:error] [pid 42313:tid 42325] [client 43.165.65.180:45486] [client 43.165.65.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adpiN12P8TxdbaN018JUxQAAAAk"]
[Sun Apr 12 02:06:57.888899 2026] [:error] [pid 34152:tid 34156] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Sun Apr 12 02:06:58.333937 2026] [:error] [pid 34152:tid 34162] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun Apr 12 02:06:58.582043 2026] [:error] [pid 34152:tid 34176] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Sun Apr 12 02:06:58.819329 2026] [:error] [pid 34152:tid 34170] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Sun Apr 12 02:06:59.056667 2026] [:error] [pid 34152:tid 34164] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Sun Apr 12 02:06:59.299885 2026] [:error] [pid 34152:tid 34167] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny2.php
[Sun Apr 12 02:06:59.536782 2026] [:error] [pid 34152:tid 34159] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Sun Apr 12 02:06:59.773907 2026] [:error] [pid 34152:tid 34166] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun Apr 12 02:07:00.023205 2026] [:error] [pid 34152:tid 34175] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/ga.php
[Sun Apr 12 02:07:00.262722 2026] [:error] [pid 34152:tid 34173] [client 20.203.243.187:19715] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Sun Apr 12 02:07:00.497057 2026] [:error] [pid 34152:tid 34160] [client 20.203.243.187:19715] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "adqNxIFtE4RhFslT1DrJkAAAAAY"]
[Sun Apr 12 02:07:01.957855 2026] [:error] [pid 36938:tid 36963] [client 20.203.243.187:9784] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "adqNxYSWpa_VL1JPU6zpeQAAAZc"]
[Sun Apr 12 02:07:06.660583 2026] [:error] [pid 44698:tid 44717] [client 20.203.243.187:12098] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "adqNyhgoH9UWd-U3D55wmAAAAI4"]
[Sun Apr 12 02:07:10.111456 2026] [:error] [pid 44698:tid 44712] [client 20.203.243.187:16935] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "adqNzhgoH9UWd-U3D55wsQAAAIk"]
[Sun Apr 12 02:07:11.414680 2026] [:error] [pid 44698:tid 44703] [client 20.203.243.187:27310] [client 20.203.243.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adqNzxgoH9UWd-U3D55wuQAAAIA"]
[Sun Apr 12 02:07:21.113512 2026] [:error] [pid 36938:tid 36945] [client 20.203.243.187:19210] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "adqN2YSWpa_VL1JPU6zpoQAAAYU"]
[Sun Apr 12 02:07:23.120138 2026] [:error] [pid 36938:tid 36943] [client 20.203.243.187:12105] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "adqN24SWpa_VL1JPU6zppQAAAYM"]
[Sun Apr 12 02:07:28.877881 2026] [:error] [pid 44700:tid 44761] [client 20.203.243.187:18042] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "adqN4GryPgh_uW4QPClwYAAAANE"]
[Sun Apr 12 02:07:32.676026 2026] [:error] [pid 34152:tid 34168] [client 20.203.243.187:11336] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "adqN5IFtE4RhFslT1DrJoAAAAA4"]
[Sun Apr 12 02:07:36.500215 2026] [:error] [pid 36909:tid 36913] [client 20.203.243.187:11347] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "adqN6EGk5GhxTCzHUOoh0gAAAQI"]
[Sun Apr 12 02:07:45.460335 2026] [:error] [pid 36938:tid 36958] [client 20.203.243.187:13975] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "adqN8YSWpa_VL1JPU6zpxgAAAZI"]
[Sun Apr 12 02:07:50.448357 2026] [:error] [pid 44698:tid 44709] [client 20.203.243.187:42742] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "adqN9hgoH9UWd-U3D55xcAAAAIY"]
[Sun Apr 12 02:07:54.749508 2026] [:error] [pid 44698:tid 44718] [client 20.203.243.187:10259] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "adqN-hgoH9UWd-U3D55xdwAAAI8"]
[Sun Apr 12 02:07:56.024613 2026] [:error] [pid 44700:tid 44744] [client 20.203.243.187:12814] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "adqN_GryPgh_uW4QPClwngAAAMA"]
[Sun Apr 12 02:07:59.664982 2026] [:error] [pid 36909:tid 36920] [client 20.203.243.187:13578] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "adqN_0Gk5GhxTCzHUOoiHwAAAQk"]
[Sun Apr 12 02:08:01.795958 2026] [:error] [pid 36938:tid 36943] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sun Apr 12 02:08:02.061549 2026] [:error] [pid 36938:tid 36951] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/97.php
[Sun Apr 12 02:08:02.297758 2026] [:error] [pid 36938:tid 36958] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/file-gertdxz.php
[Sun Apr 12 02:08:02.546281 2026] [:error] [pid 36938:tid 36954] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Sun Apr 12 02:08:02.782917 2026] [:error] [pid 36938:tid 36941] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Sun Apr 12 02:08:03.021793 2026] [:error] [pid 36938:tid 36949] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Sun Apr 12 02:08:03.392280 2026] [:error] [pid 36938:tid 36964] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Sun Apr 12 02:08:03.638252 2026] [:error] [pid 36938:tid 36952] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Sun Apr 12 02:08:03.875395 2026] [:error] [pid 36938:tid 36962] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/ng.php
[Sun Apr 12 02:08:04.116378 2026] [:error] [pid 36938:tid 36963] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Sun Apr 12 02:08:04.354566 2026] [:error] [pid 36938:tid 36948] [client 20.203.243.187:42688] File does not exist: /usr/local/apache/htdocs/suspended-page/wswer1.php
[Sun Apr 12 02:08:04.587934 2026] [:error] [pid 36938:tid 36959] [client 20.203.243.187:42688] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adqOBISWpa_VL1JPU6zqBgAAAZM"]
[Sun Apr 12 02:08:05.460652 2026] [:error] [pid 44698:tid 44721] [client 20.203.243.187:9563] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adqOBRgoH9UWd-U3D55xkgAAAJI"]
[Sun Apr 12 02:08:07.661461 2026] [:error] [pid 34152:tid 34159] [client 20.203.243.187:2358] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adqOB4FtE4RhFslT1DrJtAAAAAU"]
[Sun Apr 12 02:08:10.071001 2026] [:error] [pid 44700:tid 44761] [client 20.203.243.187:2312] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "adqOCmryPgh_uW4QPClwzgAAANE"]
[Sun Apr 12 02:08:15.607813 2026] [:error] [pid 44698:tid 44714] [client 20.203.243.187:18543] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adqODxgoH9UWd-U3D55xsAAAAIs"]
[Sun Apr 12 02:08:24.058550 2026] [:error] [pid 36938:tid 36956] [client 20.203.243.187:11064] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "adqOGISWpa_VL1JPU6zqKwAAAZA"]
[Sun Apr 12 02:08:32.356931 2026] [:error] [pid 44700:tid 44762] [client 20.203.243.187:11628] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adqOIGryPgh_uW4QPClw5wAAANI"]
[Sun Apr 12 02:08:33.987427 2026] [:error] [pid 36938:tid 36950] [client 20.203.243.187:16710] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adqOIYSWpa_VL1JPU6zqQgAAAYo"]
[Sun Apr 12 02:08:34.920160 2026] [:error] [pid 36938:tid 36954] [client 20.203.243.187:11300] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adqOIoSWpa_VL1JPU6zqRgAAAY4"]
[Sun Apr 12 02:08:36.139968 2026] [:error] [pid 45064:tid 45110] [client 20.203.243.187:20542] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "adqOJJcHBvLyJ6EUhUoLLgAAAVE"]
[Sun Apr 12 02:08:36.912274 2026] [:error] [pid 44701:tid 44791] [client 20.203.243.187:11616] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adqOJBGZAP4MrlxEPFdJBgAAAFA"]
[Sun Apr 12 02:08:41.369354 2026] [:error] [pid 44700:tid 44750] [client 20.203.243.187:20491] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adqOKWryPgh_uW4QPClw7wAAAMY"]
[Sun Apr 12 02:08:44.174246 2026] [:error] [pid 36938:tid 36949] [client 20.203.243.187:16728] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adqOLISWpa_VL1JPU6zqVQAAAYk"]
[Sun Apr 12 02:08:46.103328 2026] [:error] [pid 36909:tid 36919] [client 20.203.243.187:17948] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adqOLkGk5GhxTCzHUOoilgAAAQg"]
[Sun Apr 12 02:08:49.540015 2026] [:error] [pid 44698:tid 44727] [client 20.203.243.187:14717] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-turn.php"] [unique_id "adqOMRgoH9UWd-U3D55yKQAAAJg"]
[Sun Apr 12 02:08:50.521533 2026] [:error] [pid 44700:tid 44748] [client 20.203.243.187:10939] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-turn.php"] [unique_id "adqOMmryPgh_uW4QPClxKQAAAMQ"]
[Sun Apr 12 02:09:17.509287 2026] [:error] [pid 36938:tid 36945] [client 20.203.243.187:9921] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Sun Apr 12 02:09:17.761886 2026] [:error] [pid 36938:tid 36948] [client 20.203.243.187:9921] File does not exist: /usr/local/apache/htdocs/suspended-page/red.php
[Sun Apr 12 02:09:18.005562 2026] [:error] [pid 36938:tid 36950] [client 20.203.243.187:9921] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Sun Apr 12 02:09:18.340503 2026] [:error] [pid 36938:tid 36947] [client 20.203.243.187:9921] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Sun Apr 12 02:09:18.591593 2026] [:error] [pid 36938:tid 36960] [client 20.203.243.187:9921] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sun Apr 12 02:09:18.835667 2026] [:error] [pid 36938:tid 36949] [client 20.203.243.187:9921] File does not exist: /usr/local/apache/htdocs/suspended-page/wziar1.php
[Sun Apr 12 02:09:19.082182 2026] [:error] [pid 36938:tid 36944] [client 20.203.243.187:9921] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Sun Apr 12 02:09:19.325712 2026] [:error] [pid 36938:tid 36940] [client 20.203.243.187:9921] [client 20.203.243.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adqOT4SWpa_VL1JPU6zq0AAAAYA"]
[Sun Apr 12 02:09:21.603181 2026] [:error] [pid 44701:tid 44777] [client 20.203.243.187:17694] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sun Apr 12 02:09:22.149548 2026] [:error] [pid 44701:tid 44798] [client 20.203.243.187:17694] File does not exist: /usr/local/apache/htdocs/suspended-page/myy.php
[Sun Apr 12 02:09:22.400355 2026] [:error] [pid 44701:tid 44800] [client 20.203.243.187:17694] [client 20.203.243.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "adqOUhGZAP4MrlxEPFdJKAAAAFg"]
[Sun Apr 12 02:09:27.889364 2026] [:error] [pid 44698:tid 44706] [client 20.203.243.187:11087] File does not exist: /usr/local/apache/htdocs/suspended-page/wdone1.php
[Sun Apr 12 02:09:28.123220 2026] [:error] [pid 44698:tid 44704] [client 20.203.243.187:11087] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Sun Apr 12 02:09:28.358916 2026] [:error] [pid 44698:tid 44712] [client 20.203.243.187:11087] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adqOWBgoH9UWd-U3D55y2wAAAIk"]
[Sun Apr 12 02:09:30.287287 2026] [:error] [pid 36938:tid 36962] [client 20.203.243.187:10673] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adqOWoSWpa_VL1JPU6zq4AAAAZY"]
[Sun Apr 12 02:09:36.144210 2026] [:error] [pid 45064:tid 45096] [client 20.203.243.187:22173] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adqOYJcHBvLyJ6EUhUoLewAAAUQ"]
[Sun Apr 12 02:09:38.898901 2026] [:error] [pid 36938:tid 36951] [client 20.203.243.187:2892] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wsheet1.php"] [unique_id "adqOYoSWpa_VL1JPU6zq-AAAAYs"]
[Sun Apr 12 02:09:40.523755 2026] [:error] [pid 36909:tid 36934] [client 20.203.243.187:12641] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adqOZEGk5GhxTCzHUOojPgAAARc"]
[Sun Apr 12 02:09:46.134712 2026] [:error] [pid 44700:tid 44754] [client 20.203.243.187:11695] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adqOamryPgh_uW4QPClxeQAAAMo"]
[Sun Apr 12 02:09:47.534022 2026] [:error] [pid 34152:tid 34163] [client 20.203.243.187:26891] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adqOa4FtE4RhFslT1DrKAwAAAAk"]
[Sun Apr 12 02:09:48.714131 2026] [:error] [pid 36909:tid 36933] [client 20.203.243.187:11663] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "adqObEGk5GhxTCzHUOojVgAAARY"]
[Sun Apr 12 02:09:50.995711 2026] [:error] [pid 44698:tid 44718] [client 20.203.243.187:22161] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adqObhgoH9UWd-U3D55zLgAAAI8"]
[Sun Apr 12 02:09:52.218802 2026] [:error] [pid 36909:tid 36934] [client 20.203.243.187:20024] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adqOcEGk5GhxTCzHUOojaAAAARc"]
[Sun Apr 12 02:09:53.382658 2026] [:error] [pid 36938:tid 36946] [client 20.203.243.187:9318] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adqOcYSWpa_VL1JPU6zrJwAAAYY"]
[Sun Apr 12 02:09:54.242835 2026] [:error] [pid 44701:tid 44789] [client 20.203.243.187:12636] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ava.php"] [unique_id "adqOchGZAP4MrlxEPFdJOQAAAE4"]
[Sun Apr 12 02:09:55.915140 2026] [:error] [pid 44698:tid 44717] [client 20.203.243.187:20031] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "adqOcxgoH9UWd-U3D55zPwAAAI4"]
[Sun Apr 12 02:09:59.279305 2026] [:error] [pid 44700:tid 44754] [client 20.203.243.187:19996] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "adqOd2ryPgh_uW4QPClxiQAAAMo"]
[Sun Apr 12 02:10:01.235497 2026] [:error] [pid 36909:tid 36922] [client 20.203.243.187:32423] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awh.php"] [unique_id "adqOeUGk5GhxTCzHUOojgQAAAQs"]
[Sun Apr 12 02:10:25.241803 2026] [:error] [pid 44700:tid 44747] [client 20.203.243.187:10556] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "adqOkWryPgh_uW4QPClxswAAAMM"]
[Sun Apr 12 02:10:26.820072 2026] [:error] [pid 44700:tid 44758] [client 20.203.243.187:10026] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "adqOkmryPgh_uW4QPClxvAAAAM4"]
[Sun Apr 12 02:10:28.453842 2026] [:error] [pid 36938:tid 36941] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sun Apr 12 02:10:28.749788 2026] [:error] [pid 36938:tid 36956] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Sun Apr 12 02:10:28.987951 2026] [:error] [pid 36938:tid 36958] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Sun Apr 12 02:10:29.224017 2026] [:error] [pid 36938:tid 36964] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/riz.php
[Sun Apr 12 02:10:29.539505 2026] [:error] [pid 36938:tid 36949] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Sun Apr 12 02:10:30.302728 2026] [:error] [pid 36938:tid 36948] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/om.php
[Sun Apr 12 02:10:30.539220 2026] [:error] [pid 36938:tid 36952] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/006.php
[Sun Apr 12 02:10:30.798481 2026] [:error] [pid 36938:tid 36959] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sun Apr 12 02:10:31.055938 2026] [:error] [pid 36938:tid 36958] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/xda.php
[Sun Apr 12 02:10:31.294425 2026] [:error] [pid 36938:tid 36957] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/wolf.php
[Sun Apr 12 02:10:31.615980 2026] [:error] [pid 36938:tid 36943] [client 20.203.243.187:13385] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Sun Apr 12 02:10:31.849484 2026] [:error] [pid 36938:tid 36946] [client 20.203.243.187:13385] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adqOl4SWpa_VL1JPU6zrnQAAAYY"]
[Sun Apr 12 02:10:36.954131 2026] [:error] [pid 44698:tid 44707] [client 20.203.243.187:2501] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "adqOnBgoH9UWd-U3D55zyQAAAIQ"]
[Sun Apr 12 02:10:50.008130 2026] [:error] [pid 36909:tid 36933] [client 20.203.243.187:2464] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adqOqkGk5GhxTCzHUOoj5gAAARY"]
[Sun Apr 12 02:10:51.251562 2026] [:error] [pid 44698:tid 44723] [client 20.203.243.187:18796] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adqOqxgoH9UWd-U3D55z6QAAAJQ"]
[Sun Apr 12 02:10:52.847999 2026] [:error] [pid 44700:tid 44744] [client 20.203.243.187:2478] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adqOrGryPgh_uW4QPClx4QAAAMA"]
[Sun Apr 12 02:10:55.422147 2026] [:error] [pid 34152:tid 34173] [client 20.203.243.187:15217] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1aa.php"] [unique_id "adqOr4FtE4RhFslT1DrKLgAAABM"]
[Sun Apr 12 02:10:56.243155 2026] [:error] [pid 44700:tid 44763] [client 20.203.243.187:13657] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adqOsGryPgh_uW4QPClx7wAAANM"]
[Sun Apr 12 02:10:57.846518 2026] [:error] [pid 45064:tid 45117] [client 20.203.243.187:27903] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adqOsZcHBvLyJ6EUhUoLvwAAAVg"]
[Sun Apr 12 02:10:59.208602 2026] [:error] [pid 36938:tid 36959] [client 20.203.243.187:27248] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adqOs4SWpa_VL1JPU6zsEAAAAZM"]
[Sun Apr 12 02:11:00.697658 2026] [:error] [pid 44698:tid 44724] [client 20.203.243.187:22228] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "adqOtBgoH9UWd-U3D550DwAAAJU"]
[Sun Apr 12 02:11:02.590441 2026] [:error] [pid 44700:tid 44761] [client 20.203.243.187:12907] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqOtmryPgh_uW4QPClx9gAAANE"]
[Sun Apr 12 02:11:10.271309 2026] [:error] [pid 44698:tid 44713] [client 20.203.243.187:22271] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqOvhgoH9UWd-U3D550OwAAAIo"]
[Sun Apr 12 02:11:12.403427 2026] [:error] [pid 44701:tid 44773] [client 20.203.243.187:18462] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqOwBGZAP4MrlxEPFdJkgAAAEE"]
[Sun Apr 12 02:11:15.551494 2026] [:error] [pid 44700:tid 44767] [client 20.203.243.187:9228] [client 20.203.243.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "adqOw2ryPgh_uW4QPClx_QAAANc"]
[Sun Apr 12 05:06:05.183836 2026] [:error] [pid 26567:tid 26587] [client 43.166.136.24:59100] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adq3vXhRpg6ptWFyFx3wuQAAARI"]
[Sun Apr 12 05:54:05.988293 2026] [:error] [pid 60280:tid 60291] [client 62.197.152.148:34090] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Apr 12 05:54:07.270011 2026] [:error] [pid 60280:tid 60291] [client 62.197.152.148:34090] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Apr 12 05:54:07.582719 2026] [:error] [pid 60280:tid 60301] [client 62.197.152.148:34090] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Apr 12 05:54:07.902288 2026] [:error] [pid 60280:tid 60303] [client 62.197.152.148:34090] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "adrC_3BlLnDOYuIykkjpqAAAAdU"]
[Sun Apr 12 05:54:08.510527 2026] [:error] [pid 25329:tid 25386] [client 62.197.152.148:34374] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "adrDAGdcIYsS8Iyaj10y7QAAAIY"]
[Sun Apr 12 05:54:09.120275 2026] [:error] [pid 26599:tid 26612] [client 62.197.152.148:58388] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "adrDAXG89LXoQbk_rwBDNgAAAUo"]
[Sun Apr 12 05:54:09.733313 2026] [:error] [pid 26567:tid 26591] [client 62.197.152.148:58476] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "adrDAXhRpg6ptWFyFx0B5gAAARY"]
[Sun Apr 12 05:54:10.342326 2026] [:error] [pid 25328:tid 25375] [client 62.197.152.148:58582] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zwso.php"] [unique_id "adrDAsxUaQZxT-e0YsDnIAAAAEk"]
[Sun Apr 12 05:54:12.541883 2026] [:error] [pid 26599:tid 26608] [client 62.197.152.148:58654] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "adrDBHG89LXoQbk_rwBDVQAAAUY"]
[Sun Apr 12 05:54:13.150276 2026] [:error] [pid 25329:tid 25404] [client 62.197.152.148:58968] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "adrDBWdcIYsS8Iyaj10zIAAAAJA"]
[Sun Apr 12 05:54:13.778811 2026] [:error] [pid 26600:tid 26653] [client 62.197.152.148:59102] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "adrDBe1YwAZiXhQKLYp9GQAAAZg"]
[Sun Apr 12 05:54:14.419562 2026] [:error] [pid 25327:tid 25358] [client 62.197.152.148:59228] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "adrDBi6h2tZEVJo9JFJEcgAAABY"]
[Sun Apr 12 05:54:15.029181 2026] [:error] [pid 25329:tid 25378] [client 62.197.152.148:59346] [client 62.197.152.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "adrDB2dcIYsS8Iyaj10zOgAAAII"]
[Sun Apr 12 10:58:46.844459 2026] [:error] [pid 26600:tid 26648] [client 223.244.35.77:56845] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adsKZu1YwAZiXhQKLYrFxQAAAZM"]
[Sun Apr 12 11:59:53.915282 2026] [:error] [pid 26567:tid 26582] [client 43.165.69.68:57196] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adsYuXhRpg6ptWFyFx1bZQAAAQ0"]
[Sun Apr 12 12:59:22.045600 2026] [:error] [pid 25329:tid 25382] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Sun Apr 12 12:59:22.327642 2026] [:error] [pid 25329:tid 25409] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/4GrJSiwkF3A.php
[Sun Apr 12 12:59:22.583671 2026] [:error] [pid 25329:tid 25404] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/SS72_kKKjT.php
[Sun Apr 12 12:59:22.857443 2026] [:error] [pid 25329:tid 25415] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/wkogn.php
[Sun Apr 12 12:59:23.153397 2026] [:error] [pid 25329:tid 25397] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/hwjtry0zd1fzeakcuzn8Cdefault.php
[Sun Apr 12 12:59:23.447288 2026] [:error] [pid 25329:tid 25393] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sun Apr 12 12:59:23.719007 2026] [:error] [pid 25329:tid 25395] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/oLEzRVqmJJPFSucdefault.php
[Sun Apr 12 12:59:23.974700 2026] [:error] [pid 25329:tid 25378] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/wwdgl.php
[Sun Apr 12 12:59:24.240364 2026] [:error] [pid 25329:tid 25390] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/3akp.php
[Sun Apr 12 12:59:24.497982 2026] [:error] [pid 25329:tid 25411] [client 74.248.34.0:9176] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Sun Apr 12 12:59:25.081445 2026] [:error] [pid 25329:tid 25400] [client 74.248.34.0:9176] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adsmrWdcIYsS8Iyaj12A_QAAAI4"]
[Sun Apr 12 12:59:26.238791 2026] [:error] [pid 60280:tid 60299] [client 74.248.34.0:9156] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adsmrnBlLnDOYuIykki5_AAAAdE"]
[Sun Apr 12 12:59:27.318557 2026] [:error] [pid 60280:tid 60284] [client 74.248.34.0:9203] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adsmr3BlLnDOYuIykki6BAAAAcI"]
[Sun Apr 12 12:59:27.999958 2026] [:error] [pid 25328:tid 25391] [client 74.248.34.0:9108] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "adsmr8xUaQZxT-e0YsCSVQAAAFE"]
[Sun Apr 12 12:59:28.748308 2026] [:error] [pid 26600:tid 26652] [client 74.248.34.0:9161] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adsmsO1YwAZiXhQKLYriFwAAAZc"]
[Sun Apr 12 12:59:29.412300 2026] [:error] [pid 25328:tid 25396] [client 74.248.34.0:9107] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adsmscxUaQZxT-e0YsCSXAAAAFM"]
[Sun Apr 12 12:59:30.301384 2026] [:error] [pid 60280:tid 60292] [client 74.248.34.0:9181] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adsmsnBlLnDOYuIykki6BgAAAco"]
[Sun Apr 12 12:59:31.850159 2026] [:error] [pid 25328:tid 25380] [client 74.248.34.0:9191] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cdn3.php"] [unique_id "adsms8xUaQZxT-e0YsCSaAAAAEw"]
[Sun Apr 12 12:59:40.638688 2026] [:error] [pid 60280:tid 60304] [client 74.248.34.0:9197] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adsmvHBlLnDOYuIykki6GAAAAdY"]
[Sun Apr 12 12:59:44.651425 2026] [:error] [pid 26599:tid 26612] [client 74.248.34.0:9160] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adsmwHG89LXoQbk_rwCbsQAAAUo"]
[Sun Apr 12 12:59:45.771328 2026] [:error] [pid 25437:tid 25454] [client 74.248.34.0:9208] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adsmwXf97wYZje1ep_PTVwAAAM8"]
[Sun Apr 12 12:59:46.407563 2026] [:error] [pid 25328:tid 25369] [client 74.248.34.0:9168] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "adsmwsxUaQZxT-e0YsCShAAAAEU"]
[Sun Apr 12 12:59:46.969200 2026] [:error] [pid 26600:tid 26635] [client 74.248.34.0:9143] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adsmwu1YwAZiXhQKLYriIgAAAYY"]
[Sun Apr 12 12:59:47.578677 2026] [:error] [pid 60280:tid 60282] [client 74.248.34.0:9188] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adsmw3BlLnDOYuIykki6LQAAAcA"]
[Sun Apr 12 12:59:48.499396 2026] [:error] [pid 26567:tid 26580] [client 74.248.34.0:9099] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adsmxHhRpg6ptWFyFx1k7AAAAQs"]
[Sun Apr 12 12:59:49.253220 2026] [:error] [pid 25328:tid 25370] [client 74.248.34.0:9185] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beerd.php"] [unique_id "adsmxcxUaQZxT-e0YsCSjQAAAEY"]
[Sun Apr 12 12:59:49.830457 2026] [:error] [pid 25437:tid 25460] [client 74.248.34.0:9092] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adsmxXf97wYZje1ep_PTXgAAANU"]
[Sun Apr 12 12:59:50.815879 2026] [:error] [pid 60280:tid 60283] [client 74.248.34.0:9159] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adsmxnBlLnDOYuIykki6NgAAAcE"]
[Sun Apr 12 12:59:51.549129 2026] [:error] [pid 60280:tid 60285] [client 74.248.34.0:9157] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adsmx3BlLnDOYuIykki6OQAAAcM"]
[Sun Apr 12 12:59:52.559318 2026] [:error] [pid 26567:tid 26575] [client 74.248.34.0:9193] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hhxc.php"] [unique_id "adsmyHhRpg6ptWFyFx1k7wAAAQY"]
[Sun Apr 12 12:59:53.530302 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9175] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adsmyXBlLnDOYuIykki6PwAAAcw"]
[Sun Apr 12 12:59:54.730771 2026] [:error] [pid 60280:tid 60283] [client 74.248.34.0:9101] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adsmynBlLnDOYuIykki6RAAAAcE"]
[Sun Apr 12 12:59:55.960379 2026] [:error] [pid 26600:tid 26650] [client 74.248.34.0:9204] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adsmy-1YwAZiXhQKLYriLgAAAZU"]
[Sun Apr 12 12:59:57.471544 2026] [:error] [pid 60280:tid 60304] [client 74.248.34.0:9138] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/161dfd072f.php"] [unique_id "adsmzXBlLnDOYuIykki6TwAAAdY"]
[Sun Apr 12 12:59:58.946749 2026] [:error] [pid 26600:tid 26652] [client 74.248.34.0:9211] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adsmzu1YwAZiXhQKLYriMgAAAZc"]
[Sun Apr 12 13:00:00.672651 2026] [:error] [pid 60280:tid 60289] [client 74.248.34.0:9192] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adsm0HBlLnDOYuIykki6VgAAAcc"]
[Sun Apr 12 13:00:02.034644 2026] [:error] [pid 26599:tid 26615] [client 74.248.34.0:9210] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adsm0nG89LXoQbk_rwCbuwAAAU0"]
[Sun Apr 12 13:00:03.824826 2026] [:error] [pid 25329:tid 25404] [client 74.248.34.0:9166] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "adsm02dcIYsS8Iyaj12BBAAAAJA"]
[Sun Apr 12 13:00:04.413310 2026] [:error] [pid 26599:tid 26605] [client 74.248.34.0:9205] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adsm1HG89LXoQbk_rwCbvgAAAUM"]
[Sun Apr 12 13:00:05.220447 2026] [:error] [pid 26599:tid 26602] [client 74.248.34.0:9152] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adsm1XG89LXoQbk_rwCbwQAAAUA"]
[Sun Apr 12 13:00:06.755627 2026] [:error] [pid 25328:tid 25401] [client 74.248.34.0:9094] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adsm1sxUaQZxT-e0YsCSnAAAAFU"]
[Sun Apr 12 13:00:08.872989 2026] [:error] [pid 25328:tid 25391] [client 74.248.34.0:9196] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ylzed0twj8l9drdbchc1oocfCdefault.php"] [unique_id "adsm2MxUaQZxT-e0YsCSqAAAAFE"]
[Sun Apr 12 13:00:10.932619 2026] [:error] [pid 26600:tid 26633] [client 74.248.34.0:9095] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adsm2u1YwAZiXhQKLYriPQAAAYQ"]
[Sun Apr 12 13:00:11.620392 2026] [:error] [pid 26600:tid 26629] [client 74.248.34.0:9105] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adsm2-1YwAZiXhQKLYriPwAAAYA"]
[Sun Apr 12 13:00:12.310740 2026] [:error] [pid 60280:tid 60287] [client 74.248.34.0:9100] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adsm3HBlLnDOYuIykki6agAAAcU"]
[Sun Apr 12 13:00:13.071961 2026] [:error] [pid 26600:tid 26653] [client 74.248.34.0:9177] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RIP.php"] [unique_id "adsm3e1YwAZiXhQKLYriRQAAAZg"]
[Sun Apr 12 13:00:13.751301 2026] [:error] [pid 60280:tid 60283] [client 74.248.34.0:9093] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adsm3XBlLnDOYuIykki6bQAAAcE"]
[Sun Apr 12 13:00:14.805022 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9186] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adsm3nBlLnDOYuIykki6cAAAAcw"]
[Sun Apr 12 13:00:15.908158 2026] [:error] [pid 26567:tid 26593] [client 74.248.34.0:9158] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adsm33hRpg6ptWFyFx1lAAAAARg"]
[Sun Apr 12 13:00:16.623386 2026] [:error] [pid 26567:tid 26574] [client 74.248.34.0:9198] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "adsm4HhRpg6ptWFyFx1lBQAAAQU"]
[Sun Apr 12 13:00:17.997552 2026] [:error] [pid 25437:tid 25448] [client 74.248.34.0:9206] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adsm4Xf97wYZje1ep_PTiQAAAMk"]
[Sun Apr 12 13:00:19.300645 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9028] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adsm43BlLnDOYuIykki6fQAAAcw"]
[Sun Apr 12 13:00:19.997080 2026] [:error] [pid 60280:tid 60291] [client 74.248.34.0:9091] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adsm43BlLnDOYuIykki6gQAAAck"]
[Sun Apr 12 13:00:20.578915 2026] [:error] [pid 26599:tid 26621] [client 74.248.34.0:9167] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blqjs.php"] [unique_id "adsm5HG89LXoQbk_rwCbxQAAAVM"]
[Sun Apr 12 13:00:21.735349 2026] [:error] [pid 60280:tid 60284] [client 74.248.34.0:9151] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adsm5XBlLnDOYuIykki6iAAAAcI"]
[Sun Apr 12 13:00:22.678117 2026] [:error] [pid 60280:tid 60282] [client 74.248.34.0:9184] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adsm5nBlLnDOYuIykki6kAAAAcA"]
[Sun Apr 12 13:00:23.341506 2026] [:error] [pid 26600:tid 26631] [client 74.248.34.0:9034] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adsm5-1YwAZiXhQKLYriSQAAAYI"]
[Sun Apr 12 13:00:23.857822 2026] [:error] [pid 26567:tid 26580] [client 74.248.34.0:9140] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sk25_1.php"] [unique_id "adsm53hRpg6ptWFyFx1lDAAAAQs"]
[Sun Apr 12 13:00:25.362850 2026] [:error] [pid 25329:tid 25381] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/fetch.php
[Sun Apr 12 13:00:25.659970 2026] [:error] [pid 25329:tid 25406] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Sun Apr 12 13:00:25.928328 2026] [:error] [pid 25329:tid 25414] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/2nzyHnOkEg.php
[Sun Apr 12 13:00:26.198464 2026] [:error] [pid 25329:tid 25402] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/oircv.php
[Sun Apr 12 13:00:26.453587 2026] [:error] [pid 25329:tid 25374] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Sun Apr 12 13:00:26.720203 2026] [:error] [pid 25329:tid 25384] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/n3yUmQ6Q9xwQ8ocdefault.php
[Sun Apr 12 13:00:26.984424 2026] [:error] [pid 25329:tid 25399] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/Spow_SRw.php
[Sun Apr 12 13:00:27.239572 2026] [:error] [pid 25329:tid 25392] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/albrt.php
[Sun Apr 12 13:00:27.499138 2026] [:error] [pid 25329:tid 25386] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/xxivicLhot.php
[Sun Apr 12 13:00:27.753623 2026] [:error] [pid 25329:tid 25382] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Sun Apr 12 13:00:28.009528 2026] [:error] [pid 25329:tid 25407] [client 74.248.34.0:9201] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Sun Apr 12 13:00:28.280734 2026] [:error] [pid 25329:tid 25413] [client 74.248.34.0:9201] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxeyc.php"] [unique_id "adsm7GdcIYsS8Iyaj12BFwAAAJY"]
[Sun Apr 12 13:00:29.599176 2026] [:error] [pid 25437:tid 25462] [client 74.248.34.0:9119] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxeyc.php"] [unique_id "adsm7Xf97wYZje1ep_PTkgAAANc"]
[Sun Apr 12 13:00:31.437164 2026] [:error] [pid 25328:tid 25389] [client 74.248.34.0:9132] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxeyc.php"] [unique_id "adsm78xUaQZxT-e0YsCS0wAAAFA"]
[Sun Apr 12 13:00:33.679963 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9125] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxeyc.php"] [unique_id "adsm8XBlLnDOYuIykki6nAAAAcw"]
[Sun Apr 12 13:00:34.631629 2026] [:error] [pid 25437:tid 25458] [client 74.248.34.0:9098] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "adsm8nf97wYZje1ep_PTnAAAANM"]
[Sun Apr 12 13:00:35.546430 2026] [:error] [pid 25328:tid 25408] [client 74.248.34.0:9212] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "adsm88xUaQZxT-e0YsCS5wAAAFg"]
[Sun Apr 12 13:00:36.124875 2026] [:error] [pid 26567:tid 26587] [client 74.248.34.0:9115] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "adsm9HhRpg6ptWFyFx1lFQAAARI"]
[Sun Apr 12 13:00:36.763556 2026] [:error] [pid 25328:tid 25364] [client 74.248.34.0:9180] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "adsm9MxUaQZxT-e0YsCS7wAAAEA"]
[Sun Apr 12 13:00:38.320555 2026] [:error] [pid 25327:tid 25360] [client 74.248.34.0:9163] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adsm9i6h2tZEVJo9JFKaTQAAABg"]
[Sun Apr 12 13:00:39.100937 2026] [:error] [pid 25327:tid 25347] [client 74.248.34.0:9033] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adsm9y6h2tZEVJo9JFKaUAAAAAs"]
[Sun Apr 12 13:00:39.723515 2026] [:error] [pid 25329:tid 25412] [client 74.248.34.0:9032] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adsm92dcIYsS8Iyaj12BHQAAAJU"]
[Sun Apr 12 13:00:40.912836 2026] [:error] [pid 60280:tid 60283] [client 74.248.34.0:9116] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "adsm-HBlLnDOYuIykki6pQAAAcE"]
[Sun Apr 12 13:00:41.724097 2026] [:error] [pid 60280:tid 60287] [client 74.248.34.0:9037] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyflv.php"] [unique_id "adsm-XBlLnDOYuIykki6qAAAAcU"]
[Sun Apr 12 13:00:42.908126 2026] [:error] [pid 60280:tid 60288] [client 74.248.34.0:9024] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyflv.php"] [unique_id "adsm-nBlLnDOYuIykki6qwAAAcY"]
[Sun Apr 12 13:00:43.706954 2026] [:error] [pid 25329:tid 25400] [client 74.248.34.0:9120] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyflv.php"] [unique_id "adsm-2dcIYsS8Iyaj12BHgAAAI4"]
[Sun Apr 12 13:00:44.263841 2026] [:error] [pid 25437:tid 25457] [client 74.248.34.0:9169] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fyflv.php"] [unique_id "adsm_Hf97wYZje1ep_PTqwAAANI"]
[Sun Apr 12 13:00:44.857655 2026] [:error] [pid 60280:tid 60293] [client 74.248.34.0:9122] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-942.php"] [unique_id "adsm_HBlLnDOYuIykki6sAAAAcs"]
[Sun Apr 12 13:00:45.576210 2026] [:error] [pid 60280:tid 60302] [client 74.248.34.0:9200] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-942.php"] [unique_id "adsm_XBlLnDOYuIykki6sgAAAdQ"]
[Sun Apr 12 13:00:46.176500 2026] [:error] [pid 60280:tid 60303] [client 74.248.34.0:9118] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-942.php"] [unique_id "adsm_nBlLnDOYuIykki6tQAAAdU"]
[Sun Apr 12 13:00:47.085572 2026] [:error] [pid 60280:tid 60300] [client 74.248.34.0:9214] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-942.php"] [unique_id "adsm_3BlLnDOYuIykki6uAAAAdI"]
[Sun Apr 12 13:00:47.791867 2026] [:error] [pid 60280:tid 60291] [client 74.248.34.0:9145] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sde.php"] [unique_id "adsm_3BlLnDOYuIykki6vQAAAck"]
[Sun Apr 12 13:00:48.533365 2026] [:error] [pid 25437:tid 25448] [client 74.248.34.0:9149] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sde.php"] [unique_id "adsnAHf97wYZje1ep_PTrwAAAMk"]
[Sun Apr 12 13:00:49.628468 2026] [:error] [pid 60280:tid 60300] [client 74.248.34.0:9131] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sde.php"] [unique_id "adsnAXBlLnDOYuIykki6wwAAAdI"]
[Sun Apr 12 13:00:51.179258 2026] [:error] [pid 25329:tid 25402] [client 74.248.34.0:9110] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sde.php"] [unique_id "adsnA2dcIYsS8Iyaj12BIQAAAI8"]
[Sun Apr 12 13:00:52.028200 2026] [:error] [pid 25329:tid 25386] [client 74.248.34.0:9059] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adsnBGdcIYsS8Iyaj12BJAAAAIY"]
[Sun Apr 12 13:00:52.650650 2026] [:error] [pid 25437:tid 25459] [client 74.248.34.0:9187] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adsnBHf97wYZje1ep_PTuQAAANQ"]
[Sun Apr 12 13:00:53.372245 2026] [:error] [pid 60280:tid 60299] [client 74.248.34.0:9129] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adsnBXBlLnDOYuIykki6yAAAAdE"]
[Sun Apr 12 13:00:54.213202 2026] [:error] [pid 60280:tid 60285] [client 74.248.34.0:9153] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpb.php"] [unique_id "adsnBnBlLnDOYuIykki6zQAAAcM"]
[Sun Apr 12 13:00:54.740356 2026] [:error] [pid 25437:tid 25454] [client 74.248.34.0:9154] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adsnBnf97wYZje1ep_PTvQAAAM8"]
[Sun Apr 12 13:00:55.378495 2026] [:error] [pid 25437:tid 25448] [client 74.248.34.0:9041] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adsnB3f97wYZje1ep_PTvgAAAMk"]
[Sun Apr 12 13:00:55.988614 2026] [:error] [pid 60280:tid 60288] [client 74.248.34.0:9096] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adsnB3BlLnDOYuIykki61gAAAcY"]
[Sun Apr 12 13:00:56.570164 2026] [:error] [pid 25437:tid 25441] [client 74.248.34.0:9031] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Geforce.php"] [unique_id "adsnCHf97wYZje1ep_PTxAAAAMI"]
[Sun Apr 12 13:00:57.121015 2026] [:error] [pid 25437:tid 25450] [client 74.248.34.0:9162] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adsnCXf97wYZje1ep_PTxQAAAMs"]
[Sun Apr 12 13:00:57.676514 2026] [:error] [pid 60280:tid 60287] [client 74.248.34.0:9084] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adsnCXBlLnDOYuIykki62gAAAcU"]
[Sun Apr 12 13:00:58.197158 2026] [:error] [pid 60280:tid 60286] [client 74.248.34.0:9164] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adsnCnBlLnDOYuIykki63QAAAcQ"]
[Sun Apr 12 13:00:58.753481 2026] [:error] [pid 26567:tid 26584] [client 74.248.34.0:9053] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9EaklzMysJ.php"] [unique_id "adsnCnhRpg6ptWFyFx1lFwAAAQ8"]
[Sun Apr 12 13:00:59.347157 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9179] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adsnC3BlLnDOYuIykki63gAAAcw"]
[Sun Apr 12 13:00:59.873449 2026] [:error] [pid 25437:tid 25448] [client 74.248.34.0:8966] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adsnC3f97wYZje1ep_PTyQAAAMk"]
[Sun Apr 12 13:01:00.389724 2026] [:error] [pid 60280:tid 60290] [client 74.248.34.0:9195] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adsnDHBlLnDOYuIykki63wAAAcg"]
[Sun Apr 12 13:01:00.917661 2026] [:error] [pid 25327:tid 25341] [client 74.248.34.0:8987] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxl.php"] [unique_id "adsnDC6h2tZEVJo9JFKaWQAAAAU"]
[Sun Apr 12 13:01:01.676067 2026] [:error] [pid 25327:tid 25352] [client 74.248.34.0:9106] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adsnDS6h2tZEVJo9JFKaWgAAABA"]
[Sun Apr 12 13:01:02.303190 2026] [:error] [pid 26567:tid 26590] [client 74.248.34.0:9213] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adsnDnhRpg6ptWFyFx1lGgAAARU"]
[Sun Apr 12 13:01:02.831402 2026] [:error] [pid 26600:tid 26643] [client 74.248.34.0:9066] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adsnDu1YwAZiXhQKLYriYAAAAY4"]
[Sun Apr 12 13:01:03.382699 2026] [:error] [pid 25327:tid 25355] [client 74.248.34.0:9139] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "adsnDy6h2tZEVJo9JFKaXQAAABM"]
[Sun Apr 12 13:01:03.949468 2026] [:error] [pid 25329:tid 25393] [client 74.248.34.0:9102] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adsnD2dcIYsS8Iyaj12BKQAAAIo"]
[Sun Apr 12 13:01:04.621343 2026] [:error] [pid 25437:tid 25452] [client 74.248.34.0:9109] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adsnEHf97wYZje1ep_PT1AAAAM0"]
[Sun Apr 12 13:01:05.564102 2026] [:error] [pid 25328:tid 25366] [client 74.248.34.0:9061] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adsnEcxUaQZxT-e0YsCS-gAAAEI"]
[Sun Apr 12 13:01:06.206076 2026] [:error] [pid 26567:tid 26574] [client 74.248.34.0:9026] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "adsnEnhRpg6ptWFyFx1lHgAAAQU"]
[Sun Apr 12 13:01:07.003265 2026] [:error] [pid 26600:tid 26632] [client 74.248.34.0:9170] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adsnE-1YwAZiXhQKLYriYwAAAYM"]
[Sun Apr 12 13:01:07.764953 2026] [:error] [pid 25328:tid 25370] [client 74.248.34.0:9144] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adsnE8xUaQZxT-e0YsCS_wAAAEY"]
[Sun Apr 12 13:01:10.096468 2026] [:error] [pid 26599:tid 26614] [client 74.248.34.0:9042] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adsnFnG89LXoQbk_rwCb0AAAAUw"]
[Sun Apr 12 13:01:12.789889 2026] [:error] [pid 26600:tid 26651] [client 74.248.34.0:9172] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "adsnGO1YwAZiXhQKLYriZwAAAZY"]
[Sun Apr 12 13:01:16.574872 2026] [:error] [pid 60280:tid 60301] [client 74.248.34.0:9086] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "adsnHHBlLnDOYuIykki65gAAAdM"]
[Sun Apr 12 13:01:19.681260 2026] [:error] [pid 26600:tid 26641] [client 74.248.34.0:9202] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "adsnH-1YwAZiXhQKLYribAAAAYw"]
[Sun Apr 12 13:01:26.171189 2026] [:error] [pid 26600:tid 26642] [client 74.248.34.0:9207] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "adsnJu1YwAZiXhQKLYridwAAAY0"]
[Sun Apr 12 13:01:30.248946 2026] [:error] [pid 26600:tid 26637] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Sun Apr 12 13:01:30.859390 2026] [:error] [pid 26600:tid 26652] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/p14rAeWytPdH5hZcscCFdefault.php
[Sun Apr 12 13:01:31.433491 2026] [:error] [pid 26600:tid 26653] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/iindv.php
[Sun Apr 12 13:01:32.048785 2026] [:error] [pid 26600:tid 26646] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/maintura.php
[Sun Apr 12 13:01:32.308368 2026] [:error] [pid 26600:tid 26638] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/iee52ruz0s81ndrdefault.php
[Sun Apr 12 13:01:32.562381 2026] [:error] [pid 26600:tid 26645] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/nvwf4svpvqohxdjtbjCdefault.php
[Sun Apr 12 13:01:32.832270 2026] [:error] [pid 26600:tid 26647] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-220.php
[Sun Apr 12 13:01:33.096627 2026] [:error] [pid 26600:tid 26635] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/r9pbhistk1lifhnjadpCdefault.php
[Sun Apr 12 13:01:33.351570 2026] [:error] [pid 26600:tid 26642] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Sun Apr 12 13:01:33.606198 2026] [:error] [pid 26600:tid 26650] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/xxiviLDIot.php
[Sun Apr 12 13:01:33.858749 2026] [:error] [pid 26600:tid 26634] [client 74.248.34.0:9030] File does not exist: /usr/local/apache/htdocs/suspended-page/hanyatersenyum.php
[Sun Apr 12 13:01:34.110675 2026] [:error] [pid 26600:tid 26633] [client 74.248.34.0:9030] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adsnLu1YwAZiXhQKLYriiwAAAYQ"]
[Sun Apr 12 13:01:37.218979 2026] [:error] [pid 25328:tid 25389] [client 74.248.34.0:9182] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adsnMcxUaQZxT-e0YsCTKAAAAFA"]
[Sun Apr 12 13:01:38.973011 2026] [:error] [pid 25328:tid 25398] [client 74.248.34.0:9088] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adsnMsxUaQZxT-e0YsCTLAAAAFQ"]
[Sun Apr 12 13:01:40.679608 2026] [:error] [pid 25328:tid 25367] [client 74.248.34.0:9121] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "adsnNMxUaQZxT-e0YsCTMwAAAEM"]
[Sun Apr 12 13:01:42.293218 2026] [:error] [pid 25328:tid 25408] [client 74.248.34.0:9036] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upll22.php"] [unique_id "adsnNsxUaQZxT-e0YsCTOQAAAFg"]
[Sun Apr 12 13:01:43.673741 2026] [:error] [pid 25329:tid 25414] [client 74.248.34.0:9077] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upll22.php"] [unique_id "adsnN2dcIYsS8Iyaj12BOQAAAJc"]
[Sun Apr 12 13:01:45.509309 2026] [:error] [pid 25327:tid 25349] [client 74.248.34.0:9199] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upll22.php"] [unique_id "adsnOS6h2tZEVJo9JFKaZQAAAA0"]
[Sun Apr 12 13:01:46.562644 2026] [:error] [pid 26600:tid 26630] [client 74.248.34.0:9043] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upll22.php"] [unique_id "adsnOu1YwAZiXhQKLYrikwAAAYE"]
[Sun Apr 12 13:01:47.635721 2026] [:error] [pid 25328:tid 25365] [client 74.248.34.0:8974] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "adsnO8xUaQZxT-e0YsCTPwAAAEE"]
[Sun Apr 12 13:01:48.576878 2026] [:error] [pid 60280:tid 60306] [client 74.248.34.0:9183] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "adsnPHBlLnDOYuIykki6_AAAAdg"]
[Sun Apr 12 13:01:49.526988 2026] [:error] [pid 60280:tid 60282] [client 74.248.34.0:9136] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "adsnPXBlLnDOYuIykki7AwAAAcA"]
[Sun Apr 12 13:01:51.028000 2026] [:error] [pid 25328:tid 25372] [client 74.248.34.0:9155] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "adsnP8xUaQZxT-e0YsCTQQAAAEc"]
[Sun Apr 12 13:01:52.247487 2026] [:error] [pid 25328:tid 25377] [client 74.248.34.0:9097] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adsnQMxUaQZxT-e0YsCTQwAAAEo"]
[Sun Apr 12 13:01:53.089669 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9089] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adsnQXBlLnDOYuIykki7DwAAAcw"]
[Sun Apr 12 13:01:53.783988 2026] [:error] [pid 25328:tid 25375] [client 74.248.34.0:8977] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adsnQcxUaQZxT-e0YsCTRAAAAEk"]
[Sun Apr 12 13:01:54.813612 2026] [:error] [pid 26599:tid 26625] [client 74.248.34.0:9103] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "adsnQnG89LXoQbk_rwCb3AAAAVc"]
[Sun Apr 12 13:01:55.896980 2026] [:error] [pid 60280:tid 60282] [client 74.248.34.0:9104] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "adsnQ3BlLnDOYuIykki7GwAAAcA"]
[Sun Apr 12 13:01:56.780473 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9173] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "adsnRHBlLnDOYuIykki7HAAAAcw"]
[Sun Apr 12 13:01:57.526480 2026] [:error] [pid 26600:tid 26631] [client 74.248.34.0:9063] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "adsnRe1YwAZiXhQKLYrimwAAAYI"]
[Sun Apr 12 13:01:58.555474 2026] [:error] [pid 25328:tid 25387] [client 74.248.34.0:9027] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "adsnRsxUaQZxT-e0YsCTSgAAAE8"]
[Sun Apr 12 13:01:59.711152 2026] [:error] [pid 25327:tid 25347] [client 74.248.34.0:8984] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adsnRy6h2tZEVJo9JFKagwAAAAs"]
[Sun Apr 12 13:02:00.395737 2026] [:error] [pid 26599:tid 26607] [client 74.248.34.0:9081] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adsnSHG89LXoQbk_rwCb4QAAAUU"]
[Sun Apr 12 13:02:01.497274 2026] [:error] [pid 25328:tid 25379] [client 74.248.34.0:9130] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adsnScxUaQZxT-e0YsCTVAAAAEs"]
[Sun Apr 12 13:02:02.106565 2026] [:error] [pid 60280:tid 60284] [client 74.248.34.0:9124] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "adsnSnBlLnDOYuIykki7RwAAAcI"]
[Sun Apr 12 13:02:02.793249 2026] [:error] [pid 25328:tid 25364] [client 74.248.34.0:9046] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adsnSsxUaQZxT-e0YsCTVwAAAEA"]
[Sun Apr 12 13:02:03.900976 2026] [:error] [pid 26567:tid 26592] [client 74.248.34.0:8979] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adsnS3hRpg6ptWFyFx1lNQAAARc"]
[Sun Apr 12 13:02:05.722942 2026] [:error] [pid 26600:tid 26638] [client 74.248.34.0:9052] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adsnTe1YwAZiXhQKLYriuQAAAYk"]
[Sun Apr 12 13:02:06.999588 2026] [:error] [pid 26567:tid 26574] [client 74.248.34.0:9035] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "adsnTnhRpg6ptWFyFx1lNwAAAQU"]
[Sun Apr 12 13:02:08.643414 2026] [:error] [pid 60280:tid 60292] [client 74.248.34.0:8921] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adsnUHBlLnDOYuIykki7TgAAAco"]
[Sun Apr 12 13:02:09.557064 2026] [:error] [pid 60280:tid 60296] [client 74.248.34.0:8982] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adsnUXBlLnDOYuIykki7UgAAAc4"]
[Sun Apr 12 13:02:10.268007 2026] [:error] [pid 25328:tid 25408] [client 74.248.34.0:9029] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adsnUsxUaQZxT-e0YsCTYAAAAFg"]
[Sun Apr 12 13:02:11.230905 2026] [:error] [pid 25328:tid 25367] [client 74.248.34.0:8960] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "adsnU8xUaQZxT-e0YsCTYwAAAEM"]
[Sun Apr 12 13:02:12.492738 2026] [:error] [pid 25328:tid 25389] [client 74.248.34.0:9135] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adsnVMxUaQZxT-e0YsCTZQAAAFA"]
[Sun Apr 12 13:02:13.524556 2026] [:error] [pid 25328:tid 25385] [client 74.248.34.0:9078] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adsnVcxUaQZxT-e0YsCTZwAAAE4"]
[Sun Apr 12 13:02:14.784271 2026] [:error] [pid 25328:tid 25394] [client 74.248.34.0:9057] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adsnVsxUaQZxT-e0YsCTaQAAAFI"]
[Sun Apr 12 13:02:15.863113 2026] [:error] [pid 26599:tid 26613] [client 74.248.34.0:9025] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "adsnV3G89LXoQbk_rwCb5QAAAUs"]
[Sun Apr 12 13:02:16.524616 2026] [:error] [pid 25328:tid 25379] [client 74.248.34.0:9039] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adsnWMxUaQZxT-e0YsCTbAAAAEs"]
[Sun Apr 12 13:02:17.479337 2026] [:error] [pid 25327:tid 25346] [client 74.248.34.0:9156] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adsnWS6h2tZEVJo9JFKajAAAAAo"]
[Sun Apr 12 13:02:18.295137 2026] [:error] [pid 26600:tid 26633] [client 74.248.34.0:9126] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adsnWu1YwAZiXhQKLYrivgAAAYQ"]
[Sun Apr 12 13:02:19.079984 2026] [:error] [pid 25437:tid 25458] [client 74.248.34.0:9178] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "adsnW3f97wYZje1ep_PT-AAAANM"]
[Sun Apr 12 13:02:20.415562 2026] [:error] [pid 25329:tid 25388] [client 74.248.34.0:9127] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adsnXGdcIYsS8Iyaj12BQwAAAIc"]
[Sun Apr 12 13:02:21.876038 2026] [:error] [pid 25328:tid 25379] [client 74.248.34.0:9080] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adsnXcxUaQZxT-e0YsCTeAAAAEs"]
[Sun Apr 12 13:02:23.451158 2026] [:error] [pid 26600:tid 26637] [client 74.248.34.0:8962] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adsnX-1YwAZiXhQKLYriwQAAAYg"]
[Sun Apr 12 13:02:24.608573 2026] [:error] [pid 25328:tid 25383] [client 74.248.34.0:9051] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "adsnYMxUaQZxT-e0YsCThgAAAE0"]
[Sun Apr 12 13:02:25.348579 2026] [:error] [pid 25329:tid 25381] [client 74.248.34.0:9111] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adsnYWdcIYsS8Iyaj12BRQAAAIM"]
[Sun Apr 12 13:02:26.495349 2026] [:error] [pid 25437:tid 25457] [client 74.248.34.0:9114] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adsnYnf97wYZje1ep_PT_AAAANI"]
[Sun Apr 12 13:02:28.200366 2026] [:error] [pid 25328:tid 25370] [client 74.248.34.0:9068] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adsnZMxUaQZxT-e0YsCTiAAAAEY"]
[Sun Apr 12 13:02:29.864195 2026] [:error] [pid 26600:tid 26645] [client 74.248.34.0:9045] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "adsnZe1YwAZiXhQKLYrixQAAAZA"]
[Sun Apr 12 13:02:30.926653 2026] [:error] [pid 25437:tid 25462] [client 74.248.34.0:9038] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adsnZnf97wYZje1ep_PUAAAAANc"]
[Sun Apr 12 13:02:32.394772 2026] [:error] [pid 25328:tid 25394] [client 74.248.34.0:9209] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "adsnaMxUaQZxT-e0YsCTjwAAAFI"]
[Sun Apr 12 13:02:35.208983 2026] [:error] [pid 26599:tid 26624] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Sun Apr 12 13:02:35.463934 2026] [:error] [pid 26599:tid 26612] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Sun Apr 12 13:02:35.718600 2026] [:error] [pid 26599:tid 26616] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Sun Apr 12 13:02:37.183291 2026] [:error] [pid 26599:tid 26616] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Sun Apr 12 13:02:37.437311 2026] [:error] [pid 26599:tid 26618] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Sun Apr 12 13:02:37.691887 2026] [:error] [pid 26599:tid 26602] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Sun Apr 12 13:02:37.947705 2026] [:error] [pid 26599:tid 26608] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sun Apr 12 13:02:38.474397 2026] [:error] [pid 26599:tid 26613] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Sun Apr 12 13:02:38.746098 2026] [:error] [pid 26599:tid 26621] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Sun Apr 12 13:02:39.015354 2026] [:error] [pid 26599:tid 26606] [client 74.248.34.0:9064] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Sun Apr 12 13:02:39.281210 2026] [:error] [pid 26599:tid 26609] [client 74.248.34.0:9064] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adsnb3G89LXoQbk_rwCb_AAAAUc"]
[Sun Apr 12 13:02:40.833228 2026] [:error] [pid 26599:tid 26625] [client 74.248.34.0:8990] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adsncHG89LXoQbk_rwCb_QAAAVc"]
[Sun Apr 12 13:02:43.132729 2026] [:error] [pid 25437:tid 25449] [client 74.248.34.0:9087] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adsnc3f97wYZje1ep_PUFgAAAMo"]
[Sun Apr 12 13:02:45.233032 2026] [:error] [pid 60280:tid 60305] [client 74.248.34.0:9128] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "adsndXBlLnDOYuIykki7kAAAAdc"]
[Sun Apr 12 13:02:47.824779 2026] [:error] [pid 60280:tid 60303] [client 74.248.34.0:8967] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adsnd3BlLnDOYuIykki7mwAAAdU"]
[Sun Apr 12 13:02:50.176826 2026] [:error] [pid 60280:tid 60291] [client 74.248.34.0:9079] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adsnenBlLnDOYuIykki7tAAAAck"]
[Sun Apr 12 13:02:52.474651 2026] [:error] [pid 26599:tid 26619] [client 74.248.34.0:9146] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adsnfHG89LXoQbk_rwCcAQAAAVE"]
[Sun Apr 12 13:02:54.047747 2026] [:error] [pid 25328:tid 25365] [client 74.248.34.0:8993] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "adsnfsxUaQZxT-e0YsCTrQAAAEE"]
[Sun Apr 12 13:02:55.785212 2026] [:error] [pid 25437:tid 25456] [client 74.248.34.0:9189] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adsnf3f97wYZje1ep_PUJAAAANE"]
[Sun Apr 12 13:02:58.631154 2026] [:error] [pid 26599:tid 26623] [client 74.248.34.0:9142] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adsngnG89LXoQbk_rwCcAgAAAVU"]
[Sun Apr 12 13:03:00.624751 2026] [:error] [pid 60280:tid 60295] [client 74.248.34.0:8971] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adsnhHBlLnDOYuIykki79AAAAc0"]
[Sun Apr 12 13:03:01.480636 2026] [:error] [pid 60280:tid 60302] [client 74.248.34.0:9065] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "adsnhXBlLnDOYuIykki79wAAAdQ"]
[Sun Apr 12 13:03:02.766176 2026] [:error] [pid 25327:tid 25350] [client 74.248.34.0:8976] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adsnhi6h2tZEVJo9JFKamwAAAA4"]
[Sun Apr 12 13:03:03.842888 2026] [:error] [pid 25328:tid 25365] [client 74.248.34.0:9072] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adsnh8xUaQZxT-e0YsCT2AAAAEE"]
[Sun Apr 12 13:03:04.470149 2026] [:error] [pid 25327:tid 25336] [client 74.248.34.0:9006] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adsniC6h2tZEVJo9JFKanQAAAAA"]
[Sun Apr 12 13:03:05.338286 2026] [:error] [pid 60280:tid 60286] [client 74.248.34.0:9134] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "adsniXBlLnDOYuIykki7_gAAAcQ"]
[Sun Apr 12 13:03:06.222432 2026] [:error] [pid 60280:tid 60288] [client 74.248.34.0:8992] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adsninBlLnDOYuIykki8BQAAAcY"]
[Sun Apr 12 13:03:06.876338 2026] [:error] [pid 26599:tid 26610] [client 74.248.34.0:8970] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adsninG89LXoQbk_rwCcBAAAAUg"]
[Sun Apr 12 13:03:08.703397 2026] [:error] [pid 26600:tid 26641] [client 74.248.34.0:9215] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adsnjO1YwAZiXhQKLYri6gAAAYw"]
[Sun Apr 12 13:03:10.270479 2026] [:error] [pid 60280:tid 60287] [client 74.248.34.0:9071] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "adsnjnBlLnDOYuIykki8HwAAAcU"]
[Sun Apr 12 13:03:11.119001 2026] [:error] [pid 26567:tid 26576] [client 74.248.34.0:8934] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adsnj3hRpg6ptWFyFx1ldAAAAQc"]
[Sun Apr 12 13:03:12.229533 2026] [:error] [pid 60280:tid 60291] [client 74.248.34.0:8968] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adsnkHBlLnDOYuIykki8KQAAAck"]
[Sun Apr 12 13:03:12.764939 2026] [:error] [pid 25327:tid 25352] [client 74.248.34.0:9137] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adsnkC6h2tZEVJo9JFKaoAAAABA"]
[Sun Apr 12 13:03:13.279144 2026] [:error] [pid 25437:tid 25440] [client 74.248.34.0:9147] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "adsnkXf97wYZje1ep_PUOgAAAME"]
[Sun Apr 12 13:03:13.797950 2026] [:error] [pid 60280:tid 60298] [client 74.248.34.0:8996] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "adsnkXBlLnDOYuIykki8LAAAAdA"]
[Sun Apr 12 13:03:14.426949 2026] [:error] [pid 60280:tid 60305] [client 74.248.34.0:8991] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "adsnknBlLnDOYuIykki8MAAAAdc"]
[Sun Apr 12 13:03:15.115440 2026] [:error] [pid 25328:tid 25368] [client 74.248.34.0:9054] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "adsnk8xUaQZxT-e0YsCT5wAAAEQ"]
[Sun Apr 12 13:03:15.809343 2026] [:error] [pid 26600:tid 26634] [client 74.248.34.0:8902] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "adsnk-1YwAZiXhQKLYri9QAAAYU"]
[Sun Apr 12 13:03:16.402045 2026] [:error] [pid 26567:tid 26587] [client 74.248.34.0:9148] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adsnlHhRpg6ptWFyFx1leAAAARI"]
[Sun Apr 12 13:03:16.988959 2026] [:error] [pid 26600:tid 26644] [client 74.248.34.0:9015] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adsnlO1YwAZiXhQKLYri-AAAAY8"]
[Sun Apr 12 13:03:17.503995 2026] [:error] [pid 25437:tid 25442] [client 74.248.34.0:8965] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adsnlXf97wYZje1ep_PUPQAAAMM"]
[Sun Apr 12 13:03:18.052821 2026] [:error] [pid 60280:tid 60302] [client 74.248.34.0:9150] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "adsnlnBlLnDOYuIykki8OgAAAdQ"]
[Sun Apr 12 13:03:18.647068 2026] [:error] [pid 26600:tid 26643] [client 74.248.34.0:8985] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adsnlu1YwAZiXhQKLYri-wAAAY4"]
[Sun Apr 12 13:03:19.295115 2026] [:error] [pid 26600:tid 26640] [client 74.248.34.0:8867] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adsnl-1YwAZiXhQKLYri_gAAAYs"]
[Sun Apr 12 13:03:20.065088 2026] [:error] [pid 26599:tid 26621] [client 74.248.34.0:9090] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adsnmHG89LXoQbk_rwCcCgAAAVM"]
[Sun Apr 12 13:03:21.102491 2026] [:error] [pid 25328:tid 25372] [client 74.248.34.0:9044] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "adsnmcxUaQZxT-e0YsCT7AAAAEc"]
[Sun Apr 12 13:03:21.654987 2026] [:error] [pid 25328:tid 25373] [client 74.248.34.0:9010] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adsnmcxUaQZxT-e0YsCT7gAAAEg"]
[Sun Apr 12 13:03:22.290984 2026] [:error] [pid 25327:tid 25339] [client 74.248.34.0:9174] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adsnmi6h2tZEVJo9JFKaowAAAAM"]
[Sun Apr 12 13:03:22.820025 2026] [:error] [pid 25329:tid 25415] [client 74.248.34.0:8983] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adsnmmdcIYsS8Iyaj12BwAAAAJg"]
[Sun Apr 12 13:03:23.693771 2026] [:error] [pid 26600:tid 26637] [client 74.248.34.0:8961] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "adsnm-1YwAZiXhQKLYrjDAAAAYg"]
[Sun Apr 12 13:03:24.442484 2026] [:error] [pid 26567:tid 26590] [client 74.248.34.0:9194] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "adsnnHhRpg6ptWFyFx1leQAAARU"]
[Sun Apr 12 13:03:25.470761 2026] [:error] [pid 25328:tid 25391] [client 74.248.34.0:9165] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "adsnncxUaQZxT-e0YsCT9gAAAFE"]
[Sun Apr 12 13:03:27.464437 2026] [:error] [pid 60280:tid 60300] [client 74.248.34.0:9049] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "adsnn3BlLnDOYuIykki8PgAAAdI"]
[Sun Apr 12 13:03:30.131408 2026] [:error] [pid 60280:tid 60301] [client 74.248.34.0:8898] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "adsnonBlLnDOYuIykki8PwAAAdM"]
[Sun Apr 12 13:03:31.777818 2026] [:error] [pid 60280:tid 60293] [client 74.248.34.0:8980] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adsno3BlLnDOYuIykki8SgAAAcs"]
[Sun Apr 12 13:03:33.657215 2026] [:error] [pid 25327:tid 25340] [client 74.248.34.0:9007] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adsnpS6h2tZEVJo9JFKatQAAAAQ"]
[Sun Apr 12 13:03:34.802369 2026] [:error] [pid 60280:tid 60305] [client 74.248.34.0:9112] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adsnpnBlLnDOYuIykki8WwAAAdc"]
[Sun Apr 12 13:03:35.938561 2026] [:error] [pid 60280:tid 60291] [client 74.248.34.0:9083] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "adsnp3BlLnDOYuIykki8ZwAAAck"]
[Sun Apr 12 13:03:36.784698 2026] [:error] [pid 60280:tid 60300] [client 74.248.34.0:9123] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adsnqHBlLnDOYuIykki8cQAAAdI"]
[Sun Apr 12 13:03:37.289963 2026] [:error] [pid 60280:tid 60297] [client 74.248.34.0:9070] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adsnqXBlLnDOYuIykki8egAAAc8"]
[Sun Apr 12 13:03:37.888204 2026] [:error] [pid 26600:tid 26651] [client 74.248.34.0:9005] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adsnqe1YwAZiXhQKLYrjJwAAAZY"]
[Sun Apr 12 13:03:38.416027 2026] [:error] [pid 25327:tid 25348] [client 74.248.34.0:9058] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "adsnqi6h2tZEVJo9JFKatgAAAAw"]
[Sun Apr 12 13:03:38.944020 2026] [:error] [pid 25328:tid 25394] [client 74.248.34.0:8899] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "adsnqsxUaQZxT-e0YsCUFQAAAFI"]
[Sun Apr 12 13:03:39.726025 2026] [:error] [pid 26599:tid 26606] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Sun Apr 12 13:03:40.052459 2026] [:error] [pid 26599:tid 26609] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Sun Apr 12 13:03:40.309886 2026] [:error] [pid 26599:tid 26603] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Sun Apr 12 13:03:40.565824 2026] [:error] [pid 26599:tid 26622] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Sun Apr 12 13:03:40.820818 2026] [:error] [pid 26599:tid 26611] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/mI35rZhMg1zJ1vuXdefault.php
[Sun Apr 12 13:03:41.439485 2026] [:error] [pid 26599:tid 26611] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Sun Apr 12 13:03:41.693773 2026] [:error] [pid 26599:tid 26623] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Sun Apr 12 13:03:41.948361 2026] [:error] [pid 26599:tid 26610] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Sun Apr 12 13:03:42.214937 2026] [:error] [pid 26599:tid 26604] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/lmutxdvyp7u5yksqke8ozbjgCdefault.php
[Sun Apr 12 13:03:42.487795 2026] [:error] [pid 26599:tid 26624] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Sun Apr 12 13:03:42.746839 2026] [:error] [pid 26599:tid 26602] [client 74.248.34.0:9133] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Sun Apr 12 13:03:43.021465 2026] [:error] [pid 26599:tid 26613] [client 74.248.34.0:9133] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adsnr3G89LXoQbk_rwCcKAAAAUs"]
[Sun Apr 12 13:03:43.582691 2026] [:error] [pid 25327:tid 25347] [client 74.248.34.0:9009] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adsnry6h2tZEVJo9JFKavAAAAAs"]
[Sun Apr 12 13:03:44.101334 2026] [:error] [pid 25328:tid 25367] [client 74.248.34.0:9074] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adsnsMxUaQZxT-e0YsCUHAAAAEM"]
[Sun Apr 12 13:03:44.773402 2026] [:error] [pid 25327:tid 25358] [client 74.248.34.0:8989] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "adsnsC6h2tZEVJo9JFKavgAAABY"]
[Sun Apr 12 13:03:45.764537 2026] [:error] [pid 25327:tid 25350] [client 74.248.34.0:8988] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adsnsS6h2tZEVJo9JFKawAAAAA4"]
[Sun Apr 12 13:03:46.333452 2026] [:error] [pid 25327:tid 25338] [client 74.248.34.0:8995] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adsnsi6h2tZEVJo9JFKawwAAAAI"]
[Sun Apr 12 13:03:46.946120 2026] [:error] [pid 60280:tid 60295] [client 74.248.34.0:9113] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adsnsnBlLnDOYuIykki8jQAAAc0"]
[Sun Apr 12 13:03:48.284361 2026] [:error] [pid 25437:tid 25450] [client 74.248.34.0:9003] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "adsntHf97wYZje1ep_PUXAAAAMs"]
[Sun Apr 12 13:03:49.470784 2026] [:error] [pid 25328:tid 25394] [client 74.248.34.0:8981] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adsntcxUaQZxT-e0YsCUNgAAAFI"]
[Sun Apr 12 13:03:50.877856 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:9060] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adsntnBlLnDOYuIykki8mAAAAcw"]
[Sun Apr 12 13:03:51.907308 2026] [:error] [pid 60280:tid 60306] [client 74.248.34.0:9160] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adsnt3BlLnDOYuIykki8nAAAAdg"]
[Sun Apr 12 13:03:52.871538 2026] [:error] [pid 25329:tid 25376] [client 74.248.34.0:9001] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "adsnuGdcIYsS8Iyaj12B0QAAAIE"]
[Sun Apr 12 13:03:53.506379 2026] [:error] [pid 60280:tid 60288] [client 74.248.34.0:9189] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adsnuXBlLnDOYuIykki8pQAAAcY"]
[Sun Apr 12 13:03:54.059264 2026] [:error] [pid 26567:tid 26571] [client 74.248.34.0:9023] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adsnunhRpg6ptWFyFx1liwAAAQI"]
[Sun Apr 12 13:03:54.605439 2026] [:error] [pid 26599:tid 26615] [client 74.248.34.0:9141] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adsnunG89LXoQbk_rwCcMAAAAU0"]
[Sun Apr 12 13:03:55.140574 2026] [:error] [pid 25437:tid 25463] [client 74.248.34.0:9108] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "adsnu3f97wYZje1ep_PUYgAAANg"]
[Sun Apr 12 13:03:55.837190 2026] [:error] [pid 60280:tid 60290] [client 74.248.34.0:8922] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adsnu3BlLnDOYuIykki8qgAAAcg"]
[Sun Apr 12 13:03:56.639617 2026] [:error] [pid 26599:tid 26624] [client 74.248.34.0:9191] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adsnvHG89LXoQbk_rwCcMQAAAVY"]
[Sun Apr 12 13:03:57.333224 2026] [:error] [pid 25327:tid 25360] [client 74.248.34.0:8918] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adsnvS6h2tZEVJo9JFKaxgAAABg"]
[Sun Apr 12 13:03:57.920172 2026] [:error] [pid 26600:tid 26638] [client 74.248.34.0:9159] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "adsnve1YwAZiXhQKLYrjPAAAAYk"]
[Sun Apr 12 13:03:58.469671 2026] [:error] [pid 26567:tid 26588] [client 74.248.34.0:8912] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adsnvnhRpg6ptWFyFx1lkQAAARM"]
[Sun Apr 12 13:03:59.011718 2026] [:error] [pid 26567:tid 26585] [client 74.248.34.0:9203] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adsnv3hRpg6ptWFyFx1llAAAARA"]
[Sun Apr 12 13:03:59.564239 2026] [:error] [pid 60280:tid 60294] [client 74.248.34.0:8964] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adsnv3BlLnDOYuIykki8rQAAAcw"]
[Sun Apr 12 13:04:00.142366 2026] [:error] [pid 60280:tid 60295] [client 74.248.34.0:9056] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new3.php"] [unique_id "adsnwHBlLnDOYuIykki8sQAAAc0"]
[Sun Apr 12 13:04:00.778306 2026] [:error] [pid 25327:tid 25343] [client 74.248.34.0:9175] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adsnwC6h2tZEVJo9JFKaygAAAAc"]
[Sun Apr 12 13:04:01.299698 2026] [:error] [pid 60280:tid 60291] [client 74.248.34.0:9157] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adsnwXBlLnDOYuIykki8vAAAAck"]
[Sun Apr 12 13:04:01.824642 2026] [:error] [pid 25328:tid 25385] [client 74.248.34.0:9168] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adsnwcxUaQZxT-e0YsCUUwAAAE4"]
[Sun Apr 12 13:04:02.446456 2026] [:error] [pid 60280:tid 60295] [client 74.248.34.0:8900] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nw.php"] [unique_id "adsnwnBlLnDOYuIykki8vwAAAc0"]
[Sun Apr 12 13:04:03.057611 2026] [:error] [pid 60280:tid 60305] [client 74.248.34.0:9208] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "adsnw3BlLnDOYuIykki8xQAAAdc"]
[Sun Apr 12 13:04:03.617018 2026] [:error] [pid 26567:tid 26585] [client 74.248.34.0:9019] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "adsnw3hRpg6ptWFyFx1lqAAAARA"]
[Sun Apr 12 13:04:04.215852 2026] [:error] [pid 60280:tid 60304] [client 74.248.34.0:8905] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "adsnxHBlLnDOYuIykki8xgAAAdY"]
[Sun Apr 12 13:04:04.724169 2026] [:error] [pid 25327:tid 25351] [client 74.248.34.0:9082] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "adsnxC6h2tZEVJo9JFKa0QAAAA8"]
[Sun Apr 12 13:04:05.305447 2026] [:error] [pid 26600:tid 26634] [client 74.248.34.0:9008] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adsnxe1YwAZiXhQKLYrjRQAAAYU"]
[Sun Apr 12 13:04:05.816309 2026] [:error] [pid 60280:tid 60290] [client 74.248.34.0:9188] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adsnxXBlLnDOYuIykki8yQAAAcg"]
[Sun Apr 12 13:04:06.500507 2026] [:error] [pid 26567:tid 26575] [client 74.248.34.0:9062] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adsnxnhRpg6ptWFyFx1ltAAAAQY"]
[Sun Apr 12 13:04:07.541277 2026] [:error] [pid 26599:tid 26617] [client 74.248.34.0:8927] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rithin.php"] [unique_id "adsnx3G89LXoQbk_rwCcOAAAAU8"]
[Sun Apr 12 13:04:08.238044 2026] [:error] [pid 25327:tid 25353] [client 74.248.34.0:9014] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adsnyC6h2tZEVJo9JFKa1gAAABE"]
[Sun Apr 12 13:04:08.961074 2026] [:error] [pid 25329:tid 25376] [client 74.248.34.0:8969] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adsnyGdcIYsS8Iyaj12B4gAAAIE"]
[Sun Apr 12 13:04:09.677295 2026] [:error] [pid 60280:tid 60297] [client 74.248.34.0:8994] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adsnyXBlLnDOYuIykki81wAAAc8"]
[Sun Apr 12 13:04:10.389317 2026] [:error] [pid 25328:tid 25385] [client 74.248.34.0:8926] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "adsnysxUaQZxT-e0YsCUYwAAAE4"]
[Sun Apr 12 13:04:11.582309 2026] [:error] [pid 25329:tid 25382] [client 74.248.34.0:9101] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "adsny2dcIYsS8Iyaj12B5AAAAIQ"]
[Sun Apr 12 13:04:12.439067 2026] [:error] [pid 25328:tid 25408] [client 74.248.34.0:8910] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "adsnzMxUaQZxT-e0YsCUawAAAFg"]
[Sun Apr 12 13:04:13.106693 2026] [:error] [pid 60280:tid 60282] [client 74.248.34.0:8913] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "adsnzXBlLnDOYuIykki87wAAAcA"]
[Sun Apr 12 13:04:14.544542 2026] [:error] [pid 26567:tid 26569] [client 74.248.34.0:9040] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "adsnznhRpg6ptWFyFx1lugAAAQA"]
[Sun Apr 12 13:04:15.316755 2026] [:error] [pid 60280:tid 60303] [client 74.248.34.0:9099] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adsnz3BlLnDOYuIykki8_gAAAdU"]
[Sun Apr 12 13:04:16.105060 2026] [:error] [pid 60280:tid 60296] [client 74.248.34.0:8904] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adsn0HBlLnDOYuIykki9AQAAAc4"]
[Sun Apr 12 13:04:16.712179 2026] [:error] [pid 25328:tid 25377] [client 74.248.34.0:9067] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adsn0MxUaQZxT-e0YsCUggAAAEo"]
[Sun Apr 12 13:04:17.355743 2026] [:error] [pid 60280:tid 60304] [client 74.248.34.0:9171] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xsas.php"] [unique_id "adsn0XBlLnDOYuIykki9BwAAAdY"]
[Sun Apr 12 13:04:17.911914 2026] [:error] [pid 60280:tid 60291] [client 74.248.34.0:9095] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp/jp.php"] [unique_id "adsn0XBlLnDOYuIykki9DQAAAck"]
[Sun Apr 12 13:04:18.630722 2026] [:error] [pid 60280:tid 60286] [client 74.248.34.0:9107] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp/jp.php"] [unique_id "adsn0nBlLnDOYuIykki9FwAAAcQ"]
[Sun Apr 12 13:04:19.174859 2026] [:error] [pid 60280:tid 60300] [client 74.248.34.0:8986] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp/jp.php"] [unique_id "adsn03BlLnDOYuIykki9HAAAAdI"]
[Sun Apr 12 13:04:20.223302 2026] [:error] [pid 25328:tid 25405] [client 74.248.34.0:9017] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp/jp.php"] [unique_id "adsn1MxUaQZxT-e0YsCUhwAAAFc"]
[Sun Apr 12 13:04:21.042365 2026] [:error] [pid 25437:tid 25457] [client 74.248.34.0:8916] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adsn1Xf97wYZje1ep_PUfgAAANI"]
[Sun Apr 12 13:04:21.787217 2026] [:error] [pid 60280:tid 60302] [client 74.248.34.0:8930] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adsn1XBlLnDOYuIykki9HwAAAdQ"]
[Sun Apr 12 13:04:22.452150 2026] [:error] [pid 60280:tid 60288] [client 74.248.34.0:8973] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adsn1nBlLnDOYuIykki9JQAAAcY"]
[Sun Apr 12 13:04:22.985846 2026] [:error] [pid 60280:tid 60283] [client 74.248.34.0:8917] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "adsn1nBlLnDOYuIykki9KgAAAcE"]
[Sun Apr 12 13:04:23.602445 2026] [:error] [pid 60280:tid 60303] [client 74.248.34.0:9022] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adsn13BlLnDOYuIykki9MAAAAdU"]
[Sun Apr 12 13:04:24.195018 2026] [:error] [pid 26599:tid 26613] [client 74.248.34.0:9047] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adsn2HG89LXoQbk_rwCcRAAAAUs"]
[Sun Apr 12 13:04:24.723748 2026] [:error] [pid 26600:tid 26641] [client 74.248.34.0:9211] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adsn2O1YwAZiXhQKLYrjbgAAAYw"]
[Sun Apr 12 13:04:25.273155 2026] [:error] [pid 26600:tid 26642] [client 74.248.34.0:9181] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "adsn2e1YwAZiXhQKLYrjbwAAAY0"]
[Sun Apr 12 13:04:25.852702 2026] [:error] [pid 26599:tid 26614] [client 74.248.34.0:9193] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adsn2XG89LXoQbk_rwCcRwAAAUw"]
[Sun Apr 12 13:04:26.385719 2026] [:error] [pid 25327:tid 25345] [client 74.248.34.0:8931] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adsn2i6h2tZEVJo9JFKa8AAAAAk"]
[Sun Apr 12 13:04:26.904480 2026] [:error] [pid 25328:tid 25366] [client 74.248.34.0:8938] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adsn2sxUaQZxT-e0YsCUkQAAAEI"]
[Sun Apr 12 13:04:27.530570 2026] [:error] [pid 26567:tid 26587] [client 74.248.34.0:9186] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "adsn23hRpg6ptWFyFx1lwQAAARI"]
[Sun Apr 12 13:04:28.384933 2026] [:error] [pid 25328:tid 25364] [client 74.248.34.0:9151] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adsn3MxUaQZxT-e0YsCUmwAAAEA"]
[Sun Apr 12 13:04:28.903380 2026] [:error] [pid 25327:tid 25353] [client 74.248.34.0:8950] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adsn3C6h2tZEVJo9JFKa9gAAABE"]
[Sun Apr 12 13:04:29.628264 2026] [:error] [pid 25328:tid 25375] [client 74.248.34.0:9075] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adsn3cxUaQZxT-e0YsCUnwAAAEk"]
[Sun Apr 12 13:04:31.124591 2026] [:error] [pid 26600:tid 26653] [client 74.248.34.0:9197] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "adsn3-1YwAZiXhQKLYrjewAAAZg"]
[Sun Apr 12 13:04:33.373789 2026] [:error] [pid 25329:tid 25376] [client 74.248.34.0:9204] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adsn4WdcIYsS8Iyaj12CAgAAAIE"]
[Sun Apr 12 13:04:35.058115 2026] [:error] [pid 60280:tid 60295] [client 74.248.34.0:9210] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adsn43BlLnDOYuIykki9MgAAAc0"]
[Sun Apr 12 13:04:37.166026 2026] [:error] [pid 60280:tid 60286] [client 74.248.34.0:9201] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adsn5XBlLnDOYuIykki9MwAAAcQ"]
[Sun Apr 12 13:04:38.028891 2026] [:error] [pid 25437:tid 25456] [client 74.248.34.0:8924] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "adsn5nf97wYZje1ep_PUkgAAANE"]
[Sun Apr 12 13:04:39.702383 2026] [:error] [pid 60280:tid 60283] [client 74.248.34.0:8975] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adsn53BlLnDOYuIykki9OAAAAcE"]
[Sun Apr 12 13:04:41.828650 2026] [:error] [pid 25328:tid 25369] [client 74.248.34.0:8832] [client 74.248.34.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adsn6cxUaQZxT-e0YsCUqwAAAEU"]
[Sun Apr 12 13:04:43.681247 2026] [:error] [pid 60280:tid 60305] [client 74.248.34.0:9205] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Sun Apr 12 15:20:52.816912 2026] [:error] [pid 25328:tid 25389] [client 143.110.240.70:64044] [client 143.110.240.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "adtH1MxUaQZxT-e0YsDJ1QAAAFA"], referer: binance.com
[Sun Apr 12 15:21:00.107098 2026] [:error] [pid 25329:tid 25376] [client 143.110.240.70:49339] [client 143.110.240.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "adtH3GdcIYsS8Iyaj12QtAAAAIE"], referer: binance.com
[Sun Apr 12 15:44:21.464376 2026] [:error] [pid 60280:tid 60288] [client 34.48.41.131:61174] [client 34.48.41.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.41.131, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "adtNVXBlLnDOYuIykkgNOAAAAcY"]
[Sun Apr 12 15:44:21.467751 2026] [:error] [pid 60280:tid 60288] [client 34.48.41.131:61174] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun Apr 12 15:44:23.963995 2026] [:error] [pid 60280:tid 60291] [client 34.48.41.131:61174] [client 34.48.41.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "adtNV3BlLnDOYuIykkgNVgAAAck"]
[Sun Apr 12 15:44:24.410909 2026] [:error] [pid 25327:tid 25360] [client 34.48.41.131:57474] [client 34.48.41.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "adtNWC6h2tZEVJo9JFKyGwAAABg"]
[Sun Apr 12 15:44:24.837931 2026] [:error] [pid 26600:tid 26646] [client 34.48.41.131:61064] [client 34.48.41.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "adtNWO1YwAZiXhQKLYoFBQAAAZE"]
[Sun Apr 12 15:44:25.266571 2026] [:error] [pid 26600:tid 26652] [client 34.48.41.131:64076] [client 34.48.41.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "adtNWe1YwAZiXhQKLYoFCAAAAZc"]
[Sun Apr 12 15:44:25.695746 2026] [:error] [pid 25327:tid 25340] [client 34.48.41.131:51702] [client 34.48.41.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "adtNWS6h2tZEVJo9JFKyHAAAAAQ"]
[Sun Apr 12 15:44:26.122699 2026] [:error] [pid 25329:tid 25413] [client 34.48.41.131:55444] [client 34.48.41.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "adtNWmdcIYsS8Iyaj12TBwAAAJY"]
[Sun Apr 12 15:44:26.593059 2026] [:error] [pid 26567:tid 26588] [client 34.48.41.131:59427] [client 34.48.41.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "adtNWnhRpg6ptWFyFx2BLQAAARM"]
[Sun Apr 12 17:30:48.706296 2026] [:error] [pid 25328:tid 25379] [client 203.2.64.59:44078] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adtmSMxUaQZxT-e0YsD1XwAAAEs"]
[Sun Apr 12 18:17:39.789777 2026] [:error] [pid 25328:tid 25385] [client 43.135.185.59:57038] [client 43.135.185.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adtxQ8xUaQZxT-e0YsALQQAAAE4"]
[Mon Apr 13 00:10:25.727768 2026] [:error] [pid 26599:tid 26602] [client 182.44.8.254:56428] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "advD8XG89LXoQbk_rwD6_gAAAUA"]
[Mon Apr 13 05:47:18.587861 2026] [:error] [pid 33943:tid 34021] [client 43.153.135.208:54744] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adwS5qyoXuZjocnxM5FtRAAAAI8"]
[Mon Apr 13 06:22:56.133285 2026] [:error] [pid 33943:tid 34015] [client 20.104.245.70:17285] File does not exist: /usr/local/apache/htdocs/suspended-page/kma.php
[Mon Apr 13 06:22:56.343776 2026] [:error] [pid 33943:tid 34028] [client 20.104.245.70:17285] File does not exist: /usr/local/apache/htdocs/suspended-page/wpls.php
[Mon Apr 13 06:22:56.555226 2026] [:error] [pid 33943:tid 34029] [client 20.104.245.70:17285] File does not exist: /usr/local/apache/htdocs/suspended-page/i6z19N.php
[Mon Apr 13 06:22:56.764711 2026] [:error] [pid 33943:tid 34021] [client 20.104.245.70:17285] File does not exist: /usr/local/apache/htdocs/suspended-page/ssh3ll.php
[Mon Apr 13 06:22:56.975270 2026] [:error] [pid 33943:tid 34012] [client 20.104.245.70:17285] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Mon Apr 13 06:23:25.824880 2026] [:error] [pid 11325:tid 11343] [client 172.213.12.6:64933] File does not exist: /usr/local/apache/htdocs/suspended-page/hroxw.php
[Mon Apr 13 06:23:26.668379 2026] [:error] [pid 11325:tid 11348] [client 172.213.12.6:64933] File does not exist: /usr/local/apache/htdocs/suspended-page/rkszbxbh.php
[Mon Apr 13 06:23:26.946481 2026] [:error] [pid 11325:tid 11346] [client 172.213.12.6:64933] File does not exist: /usr/local/apache/htdocs/suspended-page/hanna1337.php
[Mon Apr 13 06:23:27.181928 2026] [:error] [pid 11325:tid 11340] [client 172.213.12.6:64933] File does not exist: /usr/local/apache/htdocs/suspended-page/gt.php
[Mon Apr 13 06:23:28.228389 2026] [:error] [pid 11325:tid 11332] [client 172.213.12.6:64933] File does not exist: /usr/local/apache/htdocs/suspended-page/rk1.php
[Mon Apr 13 06:23:29.001277 2026] [:error] [pid 11325:tid 11351] [client 172.213.12.6:64933] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex1.php"] [unique_id "adwbYeCGj3EEJtCwa0OkhQAAARg"]
[Mon Apr 13 06:23:31.223818 2026] [:error] [pid 33943:tid 34015] [client 172.213.12.6:63500] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex1.php"] [unique_id "adwbY6yoXuZjocnxM5F48gAAAIk"]
[Mon Apr 13 06:23:32.445711 2026] [:error] [pid 11325:tid 11328] [client 172.213.12.6:63533] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex1.php"] [unique_id "adwbZOCGj3EEJtCwa0OkkgAAAQE"]
[Mon Apr 13 06:23:34.493461 2026] [:error] [pid 11325:tid 11346] [client 172.213.12.6:63504] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa-rex1.php"] [unique_id "adwbZuCGj3EEJtCwa0OkngAAARM"]
[Mon Apr 13 06:23:37.034349 2026] [:error] [pid 33943:tid 34009] [client 172.213.12.6:63532] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suck.php"] [unique_id "adwbaayoXuZjocnxM5F4-QAAAIM"]
[Mon Apr 13 06:23:41.774547 2026] [:error] [pid 34048:tid 34053] [client 172.213.12.6:63541] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suck.php"] [unique_id "adwbbfSiQ_PJjlY5Ehz-YAAAAMM"]
[Mon Apr 13 06:23:47.146775 2026] [:error] [pid 33941:tid 33952] [client 172.213.12.6:63546] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suck.php"] [unique_id "adwbc2_NKERAxgG-rYM_zgAAAAI"]
[Mon Apr 13 06:23:49.288131 2026] [:error] [pid 34048:tid 34062] [client 172.213.12.6:63511] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/suck.php"] [unique_id "adwbdfSiQ_PJjlY5Ehz-aAAAAMw"]
[Mon Apr 13 06:23:51.424643 2026] [:error] [pid 11325:tid 11340] [client 172.213.12.6:64950] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hikudpno.php"] [unique_id "adwbd-CGj3EEJtCwa0OkyAAAAQ0"]
[Mon Apr 13 06:23:52.331742 2026] [:error] [pid 34048:tid 34070] [client 172.213.12.6:64901] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hikudpno.php"] [unique_id "adwbePSiQ_PJjlY5Ehz-bQAAANQ"]
[Mon Apr 13 06:23:53.253792 2026] [:error] [pid 33942:tid 33982] [client 172.213.12.6:63507] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hikudpno.php"] [unique_id "adwbeRNHe8geO_lMeFanDwAAAEM"]
[Mon Apr 13 06:23:54.080970 2026] [:error] [pid 34048:tid 34060] [client 172.213.12.6:63527] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hikudpno.php"] [unique_id "adwbevSiQ_PJjlY5Ehz-bwAAAMo"]
[Mon Apr 13 06:23:55.008132 2026] [:error] [pid 33942:tid 34002] [client 172.213.12.6:63502] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/moon.php"] [unique_id "adwbexNHe8geO_lMeFanEAAAAFc"]
[Mon Apr 13 06:23:55.780345 2026] [:error] [pid 11325:tid 11331] [client 172.213.12.6:63531] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/moon.php"] [unique_id "adwbe-CGj3EEJtCwa0OkzgAAAQQ"]
[Mon Apr 13 06:23:56.554135 2026] [:error] [pid 33942:tid 34000] [client 172.213.12.6:64896] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/moon.php"] [unique_id "adwbfBNHe8geO_lMeFanEwAAAFU"]
[Mon Apr 13 06:23:57.623848 2026] [:error] [pid 33942:tid 33984] [client 172.213.12.6:64900] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/moon.php"] [unique_id "adwbfRNHe8geO_lMeFanFgAAAEU"]
[Mon Apr 13 06:23:58.508533 2026] [:error] [pid 34048:tid 34059] [client 172.213.12.6:63499] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sure.php"] [unique_id "adwbfvSiQ_PJjlY5Ehz-dAAAAMk"]
[Mon Apr 13 06:23:59.503412 2026] [:error] [pid 33943:tid 34008] [client 172.213.12.6:63503] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sure.php"] [unique_id "adwbf6yoXuZjocnxM5F5EgAAAII"]
[Mon Apr 13 06:24:00.430816 2026] [:error] [pid 33941:tid 33960] [client 172.213.12.6:64930] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sure.php"] [unique_id "adwbgG_NKERAxgG-rYM_1AAAAAk"]
[Mon Apr 13 06:24:01.420522 2026] [:error] [pid 11325:tid 11327] [client 172.213.12.6:64938] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sure.php"] [unique_id "adwbgeCGj3EEJtCwa0Ok1AAAAQA"]
[Mon Apr 13 06:24:02.323748 2026] [:error] [pid 34048:tid 34065] [client 172.213.12.6:63496] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "adwbgvSiQ_PJjlY5Ehz-dQAAAM8"]
[Mon Apr 13 06:24:02.909395 2026] [:error] [pid 33941:tid 33965] [client 172.213.12.6:64941] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "adwbgm_NKERAxgG-rYM_1gAAAA4"]
[Mon Apr 13 06:24:03.495956 2026] [:error] [pid 34048:tid 34052] [client 172.213.12.6:64927] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "adwbg_SiQ_PJjlY5Ehz-dwAAAMI"]
[Mon Apr 13 06:24:04.152628 2026] [:error] [pid 34048:tid 34066] [client 172.213.12.6:63874] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "adwbhPSiQ_PJjlY5Ehz-eQAAANA"]
[Mon Apr 13 06:24:05.438327 2026] [:error] [pid 34048:tid 34050] [client 172.213.12.6:63520] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "adwbhfSiQ_PJjlY5Ehz-egAAAMA"]
[Mon Apr 13 06:24:06.343606 2026] [:error] [pid 11325:tid 11345] [client 172.213.12.6:63539] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "adwbhuCGj3EEJtCwa0Ok3QAAARI"]
[Mon Apr 13 06:24:07.224294 2026] [:error] [pid 33943:tid 34016] [client 172.213.12.6:63508] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "adwbh6yoXuZjocnxM5F5FAAAAIo"]
[Mon Apr 13 06:24:08.224036 2026] [:error] [pid 33943:tid 34017] [client 172.213.12.6:63508] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4563.php"] [unique_id "adwbiKyoXuZjocnxM5F5GAAAAIs"]
[Mon Apr 13 06:24:08.950762 2026] [:error] [pid 33943:tid 34020] [client 172.213.12.6:64937] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wunaivpl.php"] [unique_id "adwbiKyoXuZjocnxM5F5GgAAAI4"]
[Mon Apr 13 06:24:09.695959 2026] [:error] [pid 11325:tid 11336] [client 172.213.12.6:63497] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wunaivpl.php"] [unique_id "adwbieCGj3EEJtCwa0Ok4AAAAQk"]
[Mon Apr 13 06:24:10.392419 2026] [:error] [pid 33943:tid 34023] [client 172.213.12.6:64928] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wunaivpl.php"] [unique_id "adwbiqyoXuZjocnxM5F5HwAAAJE"]
[Mon Apr 13 06:24:11.131557 2026] [:error] [pid 33943:tid 34006] [client 172.213.12.6:63509] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wunaivpl.php"] [unique_id "adwbi6yoXuZjocnxM5F5IQAAAIA"]
[Mon Apr 13 06:24:13.064348 2026] [:error] [pid 33943:tid 34012] [client 172.213.12.6:63542] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reune.php"] [unique_id "adwbjayoXuZjocnxM5F5JAAAAIY"]
[Mon Apr 13 06:24:13.665204 2026] [:error] [pid 34048:tid 34061] [client 172.213.12.6:63495] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reune.php"] [unique_id "adwbjfSiQ_PJjlY5Ehz-gQAAAMs"]
[Mon Apr 13 06:24:14.732331 2026] [:error] [pid 11325:tid 11351] [client 172.213.12.6:63547] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reune.php"] [unique_id "adwbjuCGj3EEJtCwa0Ok4wAAARg"]
[Mon Apr 13 06:24:15.650811 2026] [:error] [pid 33942:tid 34001] [client 172.213.12.6:64949] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reune.php"] [unique_id "adwbjxNHe8geO_lMeFanHwAAAFY"]
[Mon Apr 13 06:24:16.807817 2026] [:error] [pid 11325:tid 11333] [client 172.213.12.6:63513] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dw.php"] [unique_id "adwbkOCGj3EEJtCwa0Ok5wAAAQY"]
[Mon Apr 13 06:24:17.635775 2026] [:error] [pid 11325:tid 11330] [client 172.213.12.6:63517] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dw.php"] [unique_id "adwbkeCGj3EEJtCwa0Ok6AAAAQM"]
[Mon Apr 13 06:24:18.357542 2026] [:error] [pid 33943:tid 34020] [client 172.213.12.6:63523] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dw.php"] [unique_id "adwbkqyoXuZjocnxM5F5KQAAAI4"]
[Mon Apr 13 06:24:18.942586 2026] [:error] [pid 11325:tid 11343] [client 172.213.12.6:64904] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dw.php"] [unique_id "adwbkuCGj3EEJtCwa0Ok6gAAARA"]
[Mon Apr 13 06:24:19.996842 2026] [:error] [pid 33943:tid 34022] [client 172.213.12.6:64906] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "adwbk6yoXuZjocnxM5F5LQAAAJA"]
[Mon Apr 13 06:24:20.870981 2026] [:error] [pid 33941:tid 33962] [client 172.213.12.6:64908] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "adwblG_NKERAxgG-rYM_3AAAAAs"]
[Mon Apr 13 06:24:21.475087 2026] [:error] [pid 11325:tid 11331] [client 172.213.12.6:64917] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "adwbleCGj3EEJtCwa0Ok7AAAAQQ"]
[Mon Apr 13 06:24:22.110750 2026] [:error] [pid 33943:tid 34013] [client 172.213.12.6:64919] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "adwblqyoXuZjocnxM5F5LwAAAIc"]
[Mon Apr 13 06:24:22.652633 2026] [:error] [pid 33943:tid 34026] [client 172.213.12.6:63526] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellx.php"] [unique_id "adwblqyoXuZjocnxM5F5MAAAAJQ"]
[Mon Apr 13 06:24:23.184619 2026] [:error] [pid 11325:tid 11335] [client 172.213.12.6:63551] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellx.php"] [unique_id "adwbl-CGj3EEJtCwa0Ok7gAAAQg"]
[Mon Apr 13 06:24:23.892848 2026] [:error] [pid 33943:tid 34009] [client 172.213.12.6:64848] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellx.php"] [unique_id "adwbl6yoXuZjocnxM5F5NAAAAIM"]
[Mon Apr 13 06:24:24.641546 2026] [:error] [pid 33942:tid 33981] [client 172.213.12.6:64899] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shellx.php"] [unique_id "adwbmBNHe8geO_lMeFanJgAAAEI"]
[Mon Apr 13 06:24:25.422323 2026] [:error] [pid 11325:tid 11341] [client 172.213.12.6:64909] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/l.php"] [unique_id "adwbmeCGj3EEJtCwa0Ok8AAAAQ4"]
[Mon Apr 13 06:24:26.222664 2026] [:error] [pid 11325:tid 11336] [client 172.213.12.6:64902] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/l.php"] [unique_id "adwbmuCGj3EEJtCwa0Ok8QAAAQk"]
[Mon Apr 13 06:24:26.911000 2026] [:error] [pid 11325:tid 11332] [client 172.213.12.6:64835] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/l.php"] [unique_id "adwbmuCGj3EEJtCwa0Ok8gAAAQU"]
[Mon Apr 13 06:24:27.692048 2026] [:error] [pid 11325:tid 11342] [client 172.213.12.6:64854] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/l.php"] [unique_id "adwbm-CGj3EEJtCwa0Ok8wAAAQ8"]
[Mon Apr 13 06:24:28.230679 2026] [:error] [pid 33942:tid 33982] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Mon Apr 13 06:24:29.339759 2026] [:error] [pid 33942:tid 33982] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/lnexugel.php
[Mon Apr 13 06:24:29.574364 2026] [:error] [pid 33942:tid 33989] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/online.php
[Mon Apr 13 06:24:29.812138 2026] [:error] [pid 33942:tid 33986] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/up-kon.php
[Mon Apr 13 06:24:30.047029 2026] [:error] [pid 33942:tid 34001] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/word.php
[Mon Apr 13 06:24:30.560799 2026] [:error] [pid 33942:tid 33999] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/jcsonquo.php
[Mon Apr 13 06:24:30.983309 2026] [:error] [pid 33942:tid 33984] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/termps.php
[Mon Apr 13 06:24:31.499741 2026] [:error] [pid 33942:tid 33993] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/indo.php
[Mon Apr 13 06:24:31.736695 2026] [:error] [pid 33942:tid 33988] [client 172.213.12.6:64924] File does not exist: /usr/local/apache/htdocs/suspended-page/rin.php
[Mon Apr 13 06:24:31.969718 2026] [:error] [pid 33942:tid 33997] [client 172.213.12.6:64924] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packages.php"] [unique_id "adwbnxNHe8geO_lMeFanOwAAAFI"]
[Mon Apr 13 06:24:32.534098 2026] [:error] [pid 33941:tid 33957] [client 172.213.12.6:63515] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packages.php"] [unique_id "adwboG_NKERAxgG-rYM_7AAAAAc"]
[Mon Apr 13 06:24:33.136324 2026] [:error] [pid 33941:tid 33969] [client 172.213.12.6:63534] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packages.php"] [unique_id "adwboW_NKERAxgG-rYM_7QAAABI"]
[Mon Apr 13 06:24:33.983554 2026] [:error] [pid 33942:tid 34000] [client 172.213.12.6:63524] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packages.php"] [unique_id "adwboRNHe8geO_lMeFanQAAAAFU"]
[Mon Apr 13 06:24:34.513060 2026] [:error] [pid 33943:tid 34006] [client 172.213.12.6:64903] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "adwboqyoXuZjocnxM5F5VQAAAIA"]
[Mon Apr 13 06:24:35.019225 2026] [:error] [pid 33943:tid 34019] [client 172.213.12.6:63550] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "adwbo6yoXuZjocnxM5F5VwAAAI0"]
[Mon Apr 13 06:24:35.600732 2026] [:error] [pid 33942:tid 33995] [client 172.213.12.6:64946] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "adwboxNHe8geO_lMeFanRAAAAFA"]
[Mon Apr 13 06:24:36.193949 2026] [:error] [pid 33942:tid 33991] [client 172.213.12.6:64845] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi.php"] [unique_id "adwbpBNHe8geO_lMeFanRgAAAEw"]
[Mon Apr 13 06:24:36.948861 2026] [:error] [pid 11325:tid 11349] [client 172.213.12.6:63525] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbv.php"] [unique_id "adwbpOCGj3EEJtCwa0Ok_QAAARY"]
[Mon Apr 13 06:24:37.521174 2026] [:error] [pid 33943:tid 34021] [client 172.213.12.6:64931] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbv.php"] [unique_id "adwbpayoXuZjocnxM5F5YQAAAI8"]
[Mon Apr 13 06:24:38.056327 2026] [:error] [pid 33943:tid 34012] [client 172.213.12.6:63516] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbv.php"] [unique_id "adwbpqyoXuZjocnxM5F5ZQAAAIY"]
[Mon Apr 13 06:24:38.639130 2026] [:error] [pid 33943:tid 34019] [client 172.213.12.6:64834] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vbv.php"] [unique_id "adwbpqyoXuZjocnxM5F5agAAAI0"]
[Mon Apr 13 06:24:39.259034 2026] [:error] [pid 33942:tid 33998] [client 172.213.12.6:64945] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "adwbpxNHe8geO_lMeFanSAAAAFM"]
[Mon Apr 13 06:24:39.872106 2026] [:error] [pid 33943:tid 34014] [client 172.213.12.6:64923] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "adwbp6yoXuZjocnxM5F5bwAAAIg"]
[Mon Apr 13 06:24:40.497047 2026] [:error] [pid 11325:tid 11329] [client 172.213.12.6:63540] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "adwbqOCGj3EEJtCwa0OlBQAAAQI"]
[Mon Apr 13 06:24:41.099224 2026] [:error] [pid 33943:tid 34009] [client 172.213.12.6:63894] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "adwbqayoXuZjocnxM5F5dQAAAIM"]
[Mon Apr 13 06:24:41.953330 2026] [:error] [pid 33943:tid 34011] [client 172.213.12.6:64947] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moderation.php"] [unique_id "adwbqayoXuZjocnxM5F5egAAAIU"]
[Mon Apr 13 06:24:42.748467 2026] [:error] [pid 34048:tid 34073] [client 172.213.12.6:64867] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moderation.php"] [unique_id "adwbqvSiQ_PJjlY5Ehz-mgAAANc"]
[Mon Apr 13 06:24:43.527451 2026] [:error] [pid 33943:tid 34023] [client 172.213.12.6:63876] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moderation.php"] [unique_id "adwbq6yoXuZjocnxM5F5ggAAAJE"]
[Mon Apr 13 06:24:44.235336 2026] [:error] [pid 33941:tid 33955] [client 172.213.12.6:64932] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moderation.php"] [unique_id "adwbrG_NKERAxgG-rYM_7wAAAAU"]
[Mon Apr 13 06:24:44.939530 2026] [:error] [pid 33941:tid 33966] [client 172.213.12.6:64944] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple-shell.php"] [unique_id "adwbrG_NKERAxgG-rYM_8QAAAA8"]
[Mon Apr 13 06:24:45.899048 2026] [:error] [pid 33941:tid 33967] [client 172.213.12.6:64951] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple-shell.php"] [unique_id "adwbrW_NKERAxgG-rYM_9AAAABA"]
[Mon Apr 13 06:24:47.060126 2026] [:error] [pid 11325:tid 11350] [client 172.213.12.6:64863] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple-shell.php"] [unique_id "adwbr-CGj3EEJtCwa0OlEQAAARc"]
[Mon Apr 13 06:24:48.540028 2026] [:error] [pid 11325:tid 11333] [client 172.213.12.6:64915] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple-shell.php"] [unique_id "adwbsOCGj3EEJtCwa0OlFgAAAQY"]
[Mon Apr 13 06:24:50.225500 2026] [:error] [pid 33943:tid 34026] [client 172.213.12.6:63878] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/dist/vendor/about.php"] [unique_id "adwbsqyoXuZjocnxM5F5mgAAAJQ"]
[Mon Apr 13 06:24:51.153633 2026] [:error] [pid 33943:tid 34009] [client 172.213.12.6:63903] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/dist/vendor/about.php"] [unique_id "adwbs6yoXuZjocnxM5F5mwAAAIM"]
[Mon Apr 13 06:24:51.924251 2026] [:error] [pid 33941:tid 33952] [client 172.213.12.6:63522] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/dist/vendor/about.php"] [unique_id "adwbs2_NKERAxgG-rYM_9QAAAAI"]
[Mon Apr 13 06:24:52.912185 2026] [:error] [pid 34048:tid 34066] [client 172.213.12.6:64936] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/dist/vendor/about.php"] [unique_id "adwbtPSiQ_PJjlY5Ehz-owAAANA"]
[Mon Apr 13 06:24:53.934578 2026] [:error] [pid 33943:tid 34010] [client 172.213.12.6:64891] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2Vu80QG.php"] [unique_id "adwbtayoXuZjocnxM5F5ngAAAIQ"]
[Mon Apr 13 06:24:54.965699 2026] [:error] [pid 33943:tid 34020] [client 172.213.12.6:63529] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2Vu80QG.php"] [unique_id "adwbtqyoXuZjocnxM5F5ogAAAI4"]
[Mon Apr 13 06:24:55.966388 2026] [:error] [pid 11325:tid 11333] [client 172.213.12.6:64873] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2Vu80QG.php"] [unique_id "adwbt-CGj3EEJtCwa0OlHwAAAQY"]
[Mon Apr 13 06:24:57.100142 2026] [:error] [pid 33943:tid 34023] [client 172.213.12.6:64910] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2Vu80QG.php"] [unique_id "adwbuayoXuZjocnxM5F5pgAAAJE"]
[Mon Apr 13 06:24:58.028505 2026] [:error] [pid 11325:tid 11346] [client 172.213.12.6:64952] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsr.php"] [unique_id "adwbuuCGj3EEJtCwa0OlIwAAARM"]
[Mon Apr 13 06:24:58.727211 2026] [:error] [pid 33943:tid 34009] [client 172.213.12.6:64865] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsr.php"] [unique_id "adwbuqyoXuZjocnxM5F5qQAAAIM"]
[Mon Apr 13 06:24:59.888971 2026] [:error] [pid 11325:tid 11337] [client 172.213.12.6:63889] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsr.php"] [unique_id "adwbu-CGj3EEJtCwa0OlJQAAAQo"]
[Mon Apr 13 06:25:01.027403 2026] [:error] [pid 34048:tid 34063] [client 172.213.12.6:64862] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bsr.php"] [unique_id "adwbvfSiQ_PJjlY5Ehz-qAAAAM0"]
[Mon Apr 13 06:25:02.052627 2026] [:error] [pid 33942:tid 33983] [client 172.213.12.6:63491] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ans.php"] [unique_id "adwbvhNHe8geO_lMeFanVwAAAEQ"]
[Mon Apr 13 06:25:02.870487 2026] [:error] [pid 11325:tid 11339] [client 172.213.12.6:64925] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ans.php"] [unique_id "adwbvuCGj3EEJtCwa0OlKgAAAQw"]
[Mon Apr 13 06:25:03.874221 2026] [:error] [pid 11325:tid 11327] [client 172.213.12.6:63549] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ans.php"] [unique_id "adwbv-CGj3EEJtCwa0OlLwAAAQA"]
[Mon Apr 13 06:25:04.535735 2026] [:error] [pid 11325:tid 11337] [client 172.213.12.6:64916] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ans.php"] [unique_id "adwbwOCGj3EEJtCwa0OlNgAAAQo"]
[Mon Apr 13 06:25:05.115277 2026] [:error] [pid 11325:tid 11331] [client 172.213.12.6:64942] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tot.php"] [unique_id "adwbweCGj3EEJtCwa0OlOwAAAQQ"]
[Mon Apr 13 06:25:05.917823 2026] [:error] [pid 33941:tid 33974] [client 172.213.12.6:63931] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tot.php"] [unique_id "adwbwW_NKERAxgG-rYM_-wAAABc"]
[Mon Apr 13 06:25:06.532571 2026] [:error] [pid 33941:tid 33970] [client 172.213.12.6:64859] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tot.php"] [unique_id "adwbwm_NKERAxgG-rYM__QAAABM"]
[Mon Apr 13 06:25:07.355355 2026] [:error] [pid 33941:tid 33963] [client 172.213.12.6:63493] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tot.php"] [unique_id "adwbw2_NKERAxgG-rYM__gAAAAw"]
[Mon Apr 13 06:25:08.070335 2026] [:error] [pid 33941:tid 33965] [client 172.213.12.6:63530] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Core-wp.php"] [unique_id "adwbxG_NKERAxgG-rYNAAwAAAA4"]
[Mon Apr 13 06:25:08.811757 2026] [:error] [pid 33943:tid 34019] [client 172.213.12.6:64878] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Core-wp.php"] [unique_id "adwbxKyoXuZjocnxM5F5rwAAAI0"]
[Mon Apr 13 06:25:09.760470 2026] [:error] [pid 33943:tid 34014] [client 172.213.12.6:64929] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Core-wp.php"] [unique_id "adwbxayoXuZjocnxM5F5sgAAAIg"]
[Mon Apr 13 06:25:11.034625 2026] [:error] [pid 11325:tid 11336] [client 172.213.12.6:63521] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Core-wp.php"] [unique_id "adwbx-CGj3EEJtCwa0OlPwAAAQk"]
[Mon Apr 13 06:25:12.024045 2026] [:error] [pid 11325:tid 11337] [client 172.213.12.6:63518] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/src.php"] [unique_id "adwbyOCGj3EEJtCwa0OlRAAAAQo"]
[Mon Apr 13 06:25:12.910865 2026] [:error] [pid 11325:tid 11342] [client 172.213.12.6:63522] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/src.php"] [unique_id "adwbyOCGj3EEJtCwa0OlRQAAAQ8"]
[Mon Apr 13 06:25:14.413714 2026] [:error] [pid 34048:tid 34056] [client 172.213.12.6:63886] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/src.php"] [unique_id "adwbyvSiQ_PJjlY5Ehz-sQAAAMY"]
[Mon Apr 13 06:25:15.492560 2026] [:error] [pid 34048:tid 34068] [client 172.213.12.6:63891] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/src.php"] [unique_id "adwby_SiQ_PJjlY5Ehz-tQAAANI"]
[Mon Apr 13 06:25:16.477150 2026] [:error] [pid 33943:tid 34025] [client 172.213.12.6:63896] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/v2.php"] [unique_id "adwbzKyoXuZjocnxM5F5uQAAAJM"]
[Mon Apr 13 06:25:17.212940 2026] [:error] [pid 11325:tid 11332] [client 172.213.12.6:64857] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/v2.php"] [unique_id "adwbzeCGj3EEJtCwa0OlSwAAAQU"]
[Mon Apr 13 06:25:18.261500 2026] [:error] [pid 11325:tid 11337] [client 172.213.12.6:64851] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/v2.php"] [unique_id "adwbzuCGj3EEJtCwa0OlTQAAAQo"]
[Mon Apr 13 06:25:19.622408 2026] [:error] [pid 11325:tid 11350] [client 172.213.12.6:64879] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/v2.php"] [unique_id "adwbz-CGj3EEJtCwa0OlTwAAARc"]
[Mon Apr 13 06:25:20.382502 2026] [:error] [pid 11325:tid 11329] [client 172.213.12.6:64894] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nxd.php"] [unique_id "adwb0OCGj3EEJtCwa0OlUQAAAQI"]
[Mon Apr 13 06:25:21.817881 2026] [:error] [pid 33943:tid 34020] [client 172.213.12.6:64935] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nxd.php"] [unique_id "adwb0ayoXuZjocnxM5F5vQAAAI4"]
[Mon Apr 13 06:25:22.637719 2026] [:error] [pid 11325:tid 11340] [client 172.213.12.6:63883] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nxd.php"] [unique_id "adwb0uCGj3EEJtCwa0OlVgAAAQ0"]
[Mon Apr 13 06:25:23.331594 2026] [:error] [pid 34048:tid 34071] [client 172.213.12.6:64844] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nxd.php"] [unique_id "adwb0_SiQ_PJjlY5Ehz-ugAAANU"]
[Mon Apr 13 06:25:24.015662 2026] [:error] [pid 33942:tid 33990] [client 172.213.12.6:64889] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/payout.php"] [unique_id "adwb1BNHe8geO_lMeFanYAAAAEs"]
[Mon Apr 13 06:25:24.788112 2026] [:error] [pid 33943:tid 34027] [client 172.213.12.6:64885] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/payout.php"] [unique_id "adwb1KyoXuZjocnxM5F5wwAAAJU"]
[Mon Apr 13 06:25:25.520062 2026] [:error] [pid 34048:tid 34065] [client 172.213.12.6:64934] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/payout.php"] [unique_id "adwb1fSiQ_PJjlY5Ehz-vQAAAM8"]
[Mon Apr 13 06:25:26.302351 2026] [:error] [pid 34048:tid 34051] [client 172.213.12.6:63884] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/payout.php"] [unique_id "adwb1vSiQ_PJjlY5Ehz-vwAAAME"]
[Mon Apr 13 06:25:26.981314 2026] [:error] [pid 33942:tid 33981] [client 172.213.12.6:63538] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxquidwa.php"] [unique_id "adwb1hNHe8geO_lMeFanZQAAAEI"]
[Mon Apr 13 06:25:27.755727 2026] [:error] [pid 11325:tid 11336] [client 172.213.12.6:64921] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxquidwa.php"] [unique_id "adwb1-CGj3EEJtCwa0OlWwAAAQk"]
[Mon Apr 13 06:25:28.498730 2026] [:error] [pid 34048:tid 34056] [client 172.213.12.6:63898] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxquidwa.php"] [unique_id "adwb2PSiQ_PJjlY5Ehz-wQAAAMY"]
[Mon Apr 13 06:25:29.141394 2026] [:error] [pid 34048:tid 34067] [client 172.213.12.6:63924] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uxquidwa.php"] [unique_id "adwb2fSiQ_PJjlY5Ehz-wgAAANE"]
[Mon Apr 13 06:25:29.749659 2026] [:error] [pid 11325:tid 11334] [client 172.213.12.6:64842] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/combined.php"] [unique_id "adwb2eCGj3EEJtCwa0OlXgAAAQc"]
[Mon Apr 13 06:25:30.583273 2026] [:error] [pid 33942:tid 33996] [client 172.213.12.6:63528] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/combined.php"] [unique_id "adwb2hNHe8geO_lMeFanZwAAAFE"]
[Mon Apr 13 06:25:31.445860 2026] [:error] [pid 33943:tid 34008] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/combined.php
[Mon Apr 13 06:25:31.773946 2026] [:error] [pid 33943:tid 34007] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/mari.php
[Mon Apr 13 06:25:32.007753 2026] [:error] [pid 33943:tid 34011] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/kodox.php
[Mon Apr 13 06:25:32.242097 2026] [:error] [pid 33943:tid 34015] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/ak47shell.php
[Mon Apr 13 06:25:32.489750 2026] [:error] [pid 33943:tid 34019] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Mon Apr 13 06:25:32.723593 2026] [:error] [pid 33943:tid 34020] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/log404.php
[Mon Apr 13 06:25:32.957470 2026] [:error] [pid 33943:tid 34022] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/wh.php
[Mon Apr 13 06:25:33.349117 2026] [:error] [pid 33943:tid 34016] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/luf.php
[Mon Apr 13 06:25:33.586693 2026] [:error] [pid 33943:tid 34028] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/bs2.php
[Mon Apr 13 06:25:34.004919 2026] [:error] [pid 33943:tid 34023] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/wf.php
[Mon Apr 13 06:25:34.239342 2026] [:error] [pid 33943:tid 34030] [client 172.213.12.6:63928] File does not exist: /usr/local/apache/htdocs/suspended-page/vcard.php
[Mon Apr 13 06:25:34.496516 2026] [:error] [pid 33943:tid 34006] [client 172.213.12.6:63928] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "adwb3qyoXuZjocnxM5F51wAAAIA"]
[Mon Apr 13 06:25:35.928755 2026] [:error] [pid 33943:tid 34018] [client 172.213.12.6:63519] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "adwb36yoXuZjocnxM5F52gAAAIw"]
[Mon Apr 13 06:25:38.378220 2026] [:error] [pid 34048:tid 34055] [client 172.213.12.6:63926] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "adwb4vSiQ_PJjlY5Ehz-xQAAAMU"]
[Mon Apr 13 06:25:40.145578 2026] [:error] [pid 33942:tid 33986] [client 172.213.12.6:63900] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/file2.php"] [unique_id "adwb5BNHe8geO_lMeFandQAAAEc"]
[Mon Apr 13 06:25:41.363925 2026] [:error] [pid 33942:tid 33989] [client 172.213.12.6:64839] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "adwb5RNHe8geO_lMeFaneQAAAEo"]
[Mon Apr 13 06:25:42.475183 2026] [:error] [pid 11325:tid 11334] [client 172.213.12.6:63819] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "adwb5uCGj3EEJtCwa0OlcAAAAQc"]
[Mon Apr 13 06:25:43.804253 2026] [:error] [pid 11325:tid 11330] [client 172.213.12.6:64897] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "adwb5-CGj3EEJtCwa0OlcwAAAQM"]
[Mon Apr 13 06:25:45.597647 2026] [:error] [pid 33943:tid 34017] [client 172.213.12.6:63510] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ddgg.php"] [unique_id "adwb6ayoXuZjocnxM5F56wAAAIs"]
[Mon Apr 13 06:25:46.313769 2026] [:error] [pid 33942:tid 33986] [client 172.213.12.6:63920] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rc.php7"] [unique_id "adwb6hNHe8geO_lMeFanggAAAEc"]
[Mon Apr 13 06:25:46.875995 2026] [:error] [pid 34048:tid 34074] [client 172.213.12.6:64939] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rc.php7"] [unique_id "adwb6vSiQ_PJjlY5Ehz-xgAAANg"]
[Mon Apr 13 06:25:47.468029 2026] [:error] [pid 11325:tid 11333] [client 172.213.12.6:64922] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rc.php7"] [unique_id "adwb6-CGj3EEJtCwa0OlegAAAQY"]
[Mon Apr 13 06:25:48.110853 2026] [:error] [pid 11325:tid 11334] [client 172.213.12.6:63835] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rc.php7"] [unique_id "adwb7OCGj3EEJtCwa0OlfQAAAQc"]
[Mon Apr 13 06:25:48.711688 2026] [:error] [pid 11325:tid 11330] [client 172.213.12.6:64852] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/indo.php"] [unique_id "adwb7OCGj3EEJtCwa0OlfgAAAQM"]
[Mon Apr 13 06:25:49.276121 2026] [:error] [pid 33942:tid 33989] [client 172.213.12.6:63809] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/indo.php"] [unique_id "adwb7RNHe8geO_lMeFanhQAAAEo"]
[Mon Apr 13 06:25:50.030275 2026] [:error] [pid 33942:tid 34001] [client 172.213.12.6:63869] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/indo.php"] [unique_id "adwb7hNHe8geO_lMeFanhgAAAFY"]
[Mon Apr 13 06:25:50.746885 2026] [:error] [pid 33942:tid 33990] [client 172.213.12.6:63535] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/indo.php"] [unique_id "adwb7hNHe8geO_lMeFanjAAAAEs"]
[Mon Apr 13 06:25:51.532584 2026] [:error] [pid 34048:tid 34071] [client 172.213.12.6:63900] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "adwb7_SiQ_PJjlY5Ehz-ygAAANU"]
[Mon Apr 13 06:25:52.440323 2026] [:error] [pid 34048:tid 34052] [client 172.213.12.6:63848] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "adwb8PSiQ_PJjlY5Ehz-zgAAAMI"]
[Mon Apr 13 06:25:53.381750 2026] [:error] [pid 11325:tid 11327] [client 172.213.12.6:64876] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "adwb8eCGj3EEJtCwa0OlhQAAAQA"]
[Mon Apr 13 06:25:54.540797 2026] [:error] [pid 33942:tid 33983] [client 172.213.12.6:64905] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pu.php"] [unique_id "adwb8hNHe8geO_lMeFanjgAAAEQ"]
[Mon Apr 13 06:25:55.501437 2026] [:error] [pid 33943:tid 34027] [client 172.213.12.6:63501] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "adwb86yoXuZjocnxM5F58wAAAJU"]
[Mon Apr 13 06:25:56.263795 2026] [:error] [pid 33943:tid 34030] [client 172.213.12.6:63904] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "adwb9KyoXuZjocnxM5F59gAAAJg"]
[Mon Apr 13 06:25:57.065875 2026] [:error] [pid 11325:tid 11336] [client 172.213.12.6:64874] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "adwb9eCGj3EEJtCwa0OljQAAAQk"]
[Mon Apr 13 06:25:57.850964 2026] [:error] [pid 11325:tid 11339] [client 172.213.12.6:63536] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs.php"] [unique_id "adwb9eCGj3EEJtCwa0OljwAAAQw"]
[Mon Apr 13 06:25:58.481900 2026] [:error] [pid 11325:tid 11331] [client 172.213.12.6:63833] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "adwb9uCGj3EEJtCwa0OlkAAAAQQ"]
[Mon Apr 13 06:25:59.394839 2026] [:error] [pid 34048:tid 34074] [client 172.213.12.6:64883] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "adwb9_SiQ_PJjlY5Ehz-1AAAANg"]
[Mon Apr 13 06:26:00.471159 2026] [:error] [pid 33943:tid 34017] [client 172.213.12.6:64838] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "adwb-KyoXuZjocnxM5F5-wAAAIs"]
[Mon Apr 13 06:26:01.155965 2026] [:error] [pid 33942:tid 33982] [client 172.213.12.6:64837] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/cache.php"] [unique_id "adwb-RNHe8geO_lMeFankwAAAEM"]
[Mon Apr 13 06:26:01.897071 2026] [:error] [pid 33943:tid 34022] [client 172.213.12.6:64888] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "adwb-ayoXuZjocnxM5F6AAAAAJA"]
[Mon Apr 13 06:26:02.702736 2026] [:error] [pid 11325:tid 11335] [client 172.213.12.6:64912] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "adwb-uCGj3EEJtCwa0OlmQAAAQg"]
[Mon Apr 13 06:26:03.331798 2026] [:error] [pid 11325:tid 11345] [client 172.213.12.6:64898] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "adwb--CGj3EEJtCwa0OlngAAARI"]
[Mon Apr 13 06:26:03.884591 2026] [:error] [pid 11325:tid 11344] [client 172.213.12.6:64841] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "adwb--CGj3EEJtCwa0OloAAAARE"]
[Mon Apr 13 06:26:04.646636 2026] [:error] [pid 33943:tid 34027] [client 172.213.12.6:64940] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/XX.php"] [unique_id "adwb_KyoXuZjocnxM5F6AgAAAJU"]
[Mon Apr 13 06:26:05.276665 2026] [:error] [pid 33941:tid 33969] [client 172.213.12.6:63512] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/XX.php"] [unique_id "adwb_W_NKERAxgG-rYNAIQAAABI"]
[Mon Apr 13 06:26:06.111876 2026] [:error] [pid 34048:tid 34062] [client 172.213.12.6:64833] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/XX.php"] [unique_id "adwb_vSiQ_PJjlY5Ehz-2QAAAMw"]
[Mon Apr 13 06:26:06.949171 2026] [:error] [pid 11325:tid 11349] [client 172.213.12.6:64892] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/XX.php"] [unique_id "adwb_uCGj3EEJtCwa0OlpgAAARY"]
[Mon Apr 13 06:26:07.794588 2026] [:error] [pid 34048:tid 34065] [client 172.213.12.6:64913] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php/sts.php"] [unique_id "adwb__SiQ_PJjlY5Ehz-2wAAAM8"]
[Mon Apr 13 06:26:08.605928 2026] [:error] [pid 11325:tid 11341] [client 172.213.12.6:64911] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php/sts.php"] [unique_id "adwcAOCGj3EEJtCwa0OlqgAAAQ4"]
[Mon Apr 13 06:26:09.365739 2026] [:error] [pid 11325:tid 11334] [client 172.213.12.6:64886] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php/sts.php"] [unique_id "adwcAeCGj3EEJtCwa0OlrAAAAQc"]
[Mon Apr 13 06:26:10.307848 2026] [:error] [pid 33942:tid 33989] [client 172.213.12.6:63548] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fm.php/sts.php"] [unique_id "adwcAhNHe8geO_lMeFanmgAAAEo"]
[Mon Apr 13 06:26:11.293198 2026] [:error] [pid 34048:tid 34056] [client 172.213.12.6:62418] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/cloud.php"] [unique_id "adwcA_SiQ_PJjlY5Ehz-3AAAAMY"]
[Mon Apr 13 06:26:12.340759 2026] [:error] [pid 33942:tid 34003] [client 172.213.12.6:64877] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/cloud.php"] [unique_id "adwcBBNHe8geO_lMeFannQAAAFg"]
[Mon Apr 13 06:26:13.525051 2026] [:error] [pid 11325:tid 11349] [client 172.213.12.6:63514] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/cloud.php"] [unique_id "adwcBeCGj3EEJtCwa0OltAAAARY"]
[Mon Apr 13 06:26:15.886616 2026] [:error] [pid 11325:tid 11341] [client 172.213.12.6:63831] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/cloud.php"] [unique_id "adwcB-CGj3EEJtCwa0OluQAAAQ4"]
[Mon Apr 13 06:26:17.639524 2026] [:error] [pid 33942:tid 33985] [client 172.213.12.6:63892] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owlmailer.php"] [unique_id "adwcCRNHe8geO_lMeFanngAAAEY"]
[Mon Apr 13 06:26:18.817444 2026] [:error] [pid 11325:tid 11335] [client 172.213.12.6:63818] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owlmailer.php"] [unique_id "adwcCuCGj3EEJtCwa0OlvQAAAQg"]
[Mon Apr 13 06:26:19.579578 2026] [:error] [pid 33942:tid 33983] [client 172.213.12.6:64856] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owlmailer.php"] [unique_id "adwcCxNHe8geO_lMeFanoAAAAEQ"]
[Mon Apr 13 06:26:20.616435 2026] [:error] [pid 33942:tid 33999] [client 172.213.12.6:64948] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/owlmailer.php"] [unique_id "adwcDBNHe8geO_lMeFanogAAAFQ"]
[Mon Apr 13 06:26:21.456935 2026] [:error] [pid 33941:tid 33965] [client 172.213.12.6:63887] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F0x.php"] [unique_id "adwcDW_NKERAxgG-rYNAKgAAAA4"]
[Mon Apr 13 06:26:22.525708 2026] [:error] [pid 33942:tid 33984] [client 172.213.12.6:63933] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F0x.php"] [unique_id "adwcDhNHe8geO_lMeFantwAAAEU"]
[Mon Apr 13 06:26:23.254951 2026] [:error] [pid 33942:tid 33996] [client 172.213.12.6:64847] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F0x.php"] [unique_id "adwcDxNHe8geO_lMeFanvAAAAFE"]
[Mon Apr 13 06:26:23.952183 2026] [:error] [pid 33943:tid 34013] [client 172.213.12.6:63935] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/F0x.php"] [unique_id "adwcD6yoXuZjocnxM5F6GQAAAIc"]
[Mon Apr 13 06:26:24.672320 2026] [:error] [pid 33943:tid 34016] [client 172.213.12.6:63895] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rlpc.php"] [unique_id "adwcEKyoXuZjocnxM5F6HgAAAIo"]
[Mon Apr 13 06:26:25.285336 2026] [:error] [pid 33942:tid 33982] [client 172.213.12.6:64956] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rlpc.php"] [unique_id "adwcERNHe8geO_lMeFanxgAAAEM"]
[Mon Apr 13 06:26:25.990870 2026] [:error] [pid 34048:tid 34055] [client 172.213.12.6:64858] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rlpc.php"] [unique_id "adwcEfSiQ_PJjlY5Ehz_FgAAAMU"]
[Mon Apr 13 06:26:26.810830 2026] [:error] [pid 33941:tid 33971] [client 172.213.12.6:64958] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rlpc.php"] [unique_id "adwcEm_NKERAxgG-rYNALwAAABQ"]
[Mon Apr 13 06:26:27.615867 2026] [:error] [pid 33943:tid 34018] [client 172.213.12.6:63872] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p.php7"] [unique_id "adwcE6yoXuZjocnxM5F6KQAAAIw"]
[Mon Apr 13 06:26:28.453573 2026] [:error] [pid 33942:tid 33989] [client 172.213.12.6:63506] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p.php7"] [unique_id "adwcFBNHe8geO_lMeFanzAAAAEo"]
[Mon Apr 13 06:26:29.309046 2026] [:error] [pid 33941:tid 33954] [client 172.213.12.6:62467] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p.php7"] [unique_id "adwcFW_NKERAxgG-rYNAOAAAAAQ"]
[Mon Apr 13 06:26:30.025805 2026] [:error] [pid 11325:tid 11345] [client 172.213.12.6:64861] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p.php7"] [unique_id "adwcFuCGj3EEJtCwa0Ol4wAAARI"]
[Mon Apr 13 06:26:30.981973 2026] [:error] [pid 33943:tid 34016] [client 172.213.12.6:64849] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "adwcFqyoXuZjocnxM5F6LgAAAIo"]
[Mon Apr 13 06:26:31.936136 2026] [:error] [pid 33942:tid 33996] [client 172.213.12.6:64907] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "adwcFxNHe8geO_lMeFan1gAAAFE"]
[Mon Apr 13 06:26:32.958907 2026] [:error] [pid 34048:tid 34057] [client 172.213.12.6:64881] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "adwcGPSiQ_PJjlY5Ehz_JQAAAMc"]
[Mon Apr 13 06:26:33.839228 2026] [:error] [pid 33943:tid 34023] [client 172.213.12.6:64880] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sale.php"] [unique_id "adwcGayoXuZjocnxM5F6MQAAAJE"]
[Mon Apr 13 06:26:34.868800 2026] [:error] [pid 33942:tid 33990] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/ran.php
[Mon Apr 13 06:26:35.100850 2026] [:error] [pid 33942:tid 33995] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/k90.php
[Mon Apr 13 06:26:35.333916 2026] [:error] [pid 33942:tid 33991] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/taff.php
[Mon Apr 13 06:26:35.593431 2026] [:error] [pid 33942:tid 33998] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Mon Apr 13 06:26:35.844815 2026] [:error] [pid 33942:tid 33983] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/133.php
[Mon Apr 13 06:26:36.274449 2026] [:error] [pid 33942:tid 33989] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/ssxsl.php
[Mon Apr 13 06:26:36.581972 2026] [:error] [pid 33942:tid 33992] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/AE5VAL.php
[Mon Apr 13 06:26:36.835515 2026] [:error] [pid 33942:tid 33984] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/gold.php
[Mon Apr 13 06:26:37.082187 2026] [:error] [pid 33942:tid 33988] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/gely.php
[Mon Apr 13 06:26:37.314203 2026] [:error] [pid 33942:tid 33986] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/xBrain.php
[Mon Apr 13 06:26:37.559105 2026] [:error] [pid 33942:tid 33990] [client 172.213.12.6:64890] File does not exist: /usr/local/apache/htdocs/suspended-page/sagafif.php
[Mon Apr 13 06:26:37.808198 2026] [:error] [pid 33942:tid 33995] [client 172.213.12.6:64890] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trc.php"] [unique_id "adwcHRNHe8geO_lMeFan5wAAAFA"]
[Mon Apr 13 06:26:38.536649 2026] [:error] [pid 34048:tid 34052] [client 172.213.12.6:63918] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trc.php"] [unique_id "adwcHvSiQ_PJjlY5Ehz_LAAAAMI"]
[Mon Apr 13 06:26:39.234336 2026] [:error] [pid 11325:tid 11334] [client 172.213.12.6:63899] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trc.php"] [unique_id "adwcH-CGj3EEJtCwa0Ol8QAAAQc"]
[Mon Apr 13 06:26:40.348621 2026] [:error] [pid 33943:tid 34022] [client 172.213.12.6:63934] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trc.php"] [unique_id "adwcIKyoXuZjocnxM5F6NwAAAJA"]
[Mon Apr 13 06:26:41.236694 2026] [:error] [pid 33943:tid 34008] [client 172.213.12.6:64855] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesla1.php"] [unique_id "adwcIayoXuZjocnxM5F6PQAAAII"]
[Mon Apr 13 06:26:41.808460 2026] [:error] [pid 33943:tid 34014] [client 172.213.12.6:63834] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesla1.php"] [unique_id "adwcIayoXuZjocnxM5F6PwAAAIg"]
[Mon Apr 13 06:26:42.570588 2026] [:error] [pid 34048:tid 34055] [client 172.213.12.6:64875] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesla1.php"] [unique_id "adwcIvSiQ_PJjlY5Ehz_LgAAAMU"]
[Mon Apr 13 06:26:43.467016 2026] [:error] [pid 34048:tid 34057] [client 172.213.12.6:64918] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tesla1.php"] [unique_id "adwcI_SiQ_PJjlY5Ehz_MAAAAMc"]
[Mon Apr 13 06:26:44.697929 2026] [:error] [pid 34048:tid 34064] [client 172.213.12.6:63544] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aks.php"] [unique_id "adwcJPSiQ_PJjlY5Ehz_MgAAAM4"]
[Mon Apr 13 06:26:46.251575 2026] [:error] [pid 34048:tid 34065] [client 172.213.12.6:64853] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aks.php"] [unique_id "adwcJvSiQ_PJjlY5Ehz_NgAAAM8"]
[Mon Apr 13 06:26:47.376336 2026] [:error] [pid 34048:tid 34073] [client 172.213.12.6:63923] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aks.php"] [unique_id "adwcJ_SiQ_PJjlY5Ehz_OQAAANc"]
[Mon Apr 13 06:26:48.638560 2026] [:error] [pid 33943:tid 34022] [client 172.213.12.6:63910] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aks.php"] [unique_id "adwcKKyoXuZjocnxM5F6RQAAAJA"]
[Mon Apr 13 06:26:49.344797 2026] [:error] [pid 33942:tid 33992] [client 172.213.12.6:64871] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/l.php"] [unique_id "adwcKRNHe8geO_lMeFan7wAAAE0"]
[Mon Apr 13 06:26:50.485694 2026] [:error] [pid 33942:tid 33991] [client 172.213.12.6:63825] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/l.php"] [unique_id "adwcKhNHe8geO_lMeFan9QAAAEw"]
[Mon Apr 13 06:26:51.411928 2026] [:error] [pid 34048:tid 34057] [client 172.213.12.6:64921] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/l.php"] [unique_id "adwcK_SiQ_PJjlY5Ehz_QAAAAMc"]
[Mon Apr 13 06:26:52.482873 2026] [:error] [pid 33943:tid 34013] [client 172.213.12.6:64954] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pomo/l.php"] [unique_id "adwcLKyoXuZjocnxM5F6SAAAAIc"]
[Mon Apr 13 06:26:53.448671 2026] [:error] [pid 11325:tid 11331] [client 172.213.12.6:64887] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ase.php"] [unique_id "adwcLeCGj3EEJtCwa0Ol9wAAAQQ"]
[Mon Apr 13 06:26:54.153261 2026] [:error] [pid 33943:tid 34023] [client 172.213.12.6:64920] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ase.php"] [unique_id "adwcLqyoXuZjocnxM5F6TQAAAJE"]
[Mon Apr 13 06:26:55.149040 2026] [:error] [pid 34048:tid 34062] [client 172.213.12.6:62500] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ase.php"] [unique_id "adwcL_SiQ_PJjlY5Ehz_RQAAAMw"]
[Mon Apr 13 06:26:56.044526 2026] [:error] [pid 34048:tid 34063] [client 172.213.12.6:63810] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ase.php"] [unique_id "adwcMPSiQ_PJjlY5Ehz_RwAAAM0"]
[Mon Apr 13 06:26:56.839291 2026] [:error] [pid 34048:tid 34058] [client 172.213.12.6:64914] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktgob.php"] [unique_id "adwcMPSiQ_PJjlY5Ehz_SgAAAMg"]
[Mon Apr 13 06:26:57.507537 2026] [:error] [pid 33941:tid 33964] [client 172.213.12.6:64836] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktgob.php"] [unique_id "adwcMW_NKERAxgG-rYNASQAAAA0"]
[Mon Apr 13 06:26:58.517771 2026] [:error] [pid 33941:tid 33955] [client 172.213.12.6:64836] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktgob.php"] [unique_id "adwcMm_NKERAxgG-rYNASwAAAAU"]
[Mon Apr 13 06:26:59.351521 2026] [:error] [pid 33941:tid 33962] [client 172.213.12.6:64959] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktgob.php"] [unique_id "adwcM2_NKERAxgG-rYNATwAAAAs"]
[Mon Apr 13 06:27:00.090819 2026] [:error] [pid 33943:tid 34014] [client 172.213.12.6:63537] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "adwcNKyoXuZjocnxM5F6VQAAAIg"]
[Mon Apr 13 06:27:00.754585 2026] [:error] [pid 33943:tid 34006] [client 172.213.12.6:64884] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "adwcNKyoXuZjocnxM5F6WQAAAIA"]
[Mon Apr 13 06:27:01.424763 2026] [:error] [pid 34048:tid 34069] [client 172.213.12.6:64850] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "adwcNfSiQ_PJjlY5Ehz_UAAAANM"]
[Mon Apr 13 06:27:02.036321 2026] [:error] [pid 34048:tid 34056] [client 172.213.12.6:63888] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "adwcNvSiQ_PJjlY5Ehz_UQAAAMY"]
[Mon Apr 13 06:27:02.689619 2026] [:error] [pid 33941:tid 33975] [client 172.213.12.6:63817] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/afile.php"] [unique_id "adwcNm_NKERAxgG-rYNAUwAAABg"]
[Mon Apr 13 06:27:03.574321 2026] [:error] [pid 33941:tid 33969] [client 172.213.12.6:64860] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/afile.php"] [unique_id "adwcN2_NKERAxgG-rYNAVAAAABI"]
[Mon Apr 13 06:27:04.544186 2026] [:error] [pid 33943:tid 34022] [client 172.213.12.6:63880] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/afile.php"] [unique_id "adwcOKyoXuZjocnxM5F6WwAAAJA"]
[Mon Apr 13 06:27:05.414616 2026] [:error] [pid 11325:tid 11328] [client 172.213.12.6:64846] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/afile.php"] [unique_id "adwcOeCGj3EEJtCwa0OmAwAAAQE"]
[Mon Apr 13 06:27:06.199743 2026] [:error] [pid 11325:tid 11336] [client 172.213.12.6:63870] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xBrain.php"] [unique_id "adwcOuCGj3EEJtCwa0OmBQAAAQk"]
[Mon Apr 13 06:27:07.181264 2026] [:error] [pid 11325:tid 11327] [client 172.213.12.6:63839] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xBrain.php"] [unique_id "adwcO-CGj3EEJtCwa0OmCAAAAQA"]
[Mon Apr 13 06:27:07.865340 2026] [:error] [pid 34048:tid 34053] [client 172.213.12.6:62489] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xBrain.php"] [unique_id "adwcO_SiQ_PJjlY5Ehz_VAAAAMM"]
[Mon Apr 13 06:27:09.119420 2026] [:error] [pid 11325:tid 11341] [client 172.213.12.6:63838] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xBrain.php"] [unique_id "adwcPeCGj3EEJtCwa0OmDwAAAQ4"]
[Mon Apr 13 06:27:10.081575 2026] [:error] [pid 34048:tid 34072] [client 172.213.12.6:63490] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yunu.php"] [unique_id "adwcPvSiQ_PJjlY5Ehz_VgAAANY"]
[Mon Apr 13 06:27:10.869710 2026] [:error] [pid 33942:tid 33993] [client 172.213.12.6:64840] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yunu.php"] [unique_id "adwcPhNHe8geO_lMeFaoCwAAAE4"]
[Mon Apr 13 06:27:11.817105 2026] [:error] [pid 34048:tid 34062] [client 172.213.12.6:64893] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yunu.php"] [unique_id "adwcP_SiQ_PJjlY5Ehz_WwAAAMw"]
[Mon Apr 13 06:27:12.530090 2026] [:error] [pid 33942:tid 33979] [client 172.213.12.6:64832] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yunu.php"] [unique_id "adwcQBNHe8geO_lMeFaoEQAAAEA"]
[Mon Apr 13 06:27:13.435414 2026] [:error] [pid 34048:tid 34064] [client 172.213.12.6:64843] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lexy.php"] [unique_id "adwcQfSiQ_PJjlY5Ehz_XgAAAM4"]
[Mon Apr 13 06:27:14.672720 2026] [:error] [pid 33941:tid 33962] [client 172.213.12.6:62505] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lexy.php"] [unique_id "adwcQm_NKERAxgG-rYNAWQAAAAs"]
[Mon Apr 13 06:27:16.021569 2026] [:error] [pid 33943:tid 34011] [client 172.213.12.6:63851] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lexy.php"] [unique_id "adwcRKyoXuZjocnxM5F6XgAAAIU"]
[Mon Apr 13 06:27:17.185576 2026] [:error] [pid 34048:tid 34060] [client 172.213.12.6:64882] [client 172.213.12.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lexy.php"] [unique_id "adwcRfSiQ_PJjlY5Ehz_ZwAAAMo"]
[Mon Apr 13 11:54:12.006617 2026] [:error] [pid 63309:tid 63313] [client 43.157.95.131:35450] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "adxo5EpIKZ10weXpf0XKdAAAAAA"]
[Mon Apr 13 15:11:39.968024 2026] [:error] [pid 63311:tid 63379] [client 43.134.141.244:52704] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "adyXK6HjrGN1MqBCVFmxRQAAAIg"]
[Mon Apr 13 18:10:40.309522 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Apr 13 18:10:40.567852 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Mon Apr 13 18:10:40.817427 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Apr 13 18:10:41.075907 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Apr 13 18:10:41.344835 2026] [:error] [pid 63406:tid 63429] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Apr 13 18:10:41.593294 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Apr 13 18:10:41.887754 2026] [:error] [pid 63406:tid 63418] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 13 18:10:42.138074 2026] [:error] [pid 63406:tid 63411] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Mon Apr 13 18:10:42.729680 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Mon Apr 13 18:10:42.973974 2026] [:error] [pid 63406:tid 63415] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Mon Apr 13 18:10:43.226014 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Apr 13 18:10:43.473713 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Mon Apr 13 18:10:43.742594 2026] [:error] [pid 63406:tid 63423] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Apr 13 18:10:43.986872 2026] [:error] [pid 63406:tid 63435] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Mon Apr 13 18:10:44.280490 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Mon Apr 13 18:10:44.550144 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Apr 13 18:10:44.803477 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Apr 13 18:10:45.152136 2026] [:error] [pid 63406:tid 63412] [client 45.130.202.96:23607] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Mon Apr 13 18:10:49.043570 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.96:23607] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adzBKbHZEIkQ0Zmgp5pFogAAAM4"]
[Mon Apr 13 18:10:50.828352 2026] [:error] [pid 63311:tid 63390] [client 45.130.202.60:58335] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adzBKqHjrGN1MqBCVFneMgAAAJM"]
[Mon Apr 13 18:10:52.928882 2026] [:error] [pid 7228:tid 7245] [client 45.130.202.60:27523] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Apr 13 18:10:53.679600 2026] [:error] [pid 7228:tid 7242] [client 45.130.202.60:27523] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "adzBLQEnn1dQrOSHHNVqVQAAAQw"]
[Mon Apr 13 18:10:55.791352 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.56:64829] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon Apr 13 18:10:56.055056 2026] [:error] [pid 63406:tid 63411] [client 45.130.202.56:64829] [client 45.130.202.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "adzBMLHZEIkQ0Zmgp5pFqgAAAMA"]
[Mon Apr 13 18:10:57.804083 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.69:50119] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Mon Apr 13 18:10:59.199120 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.69:50119] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adzBM7HZEIkQ0Zmgp5pFwwAAAMY"]
[Mon Apr 13 18:11:01.144977 2026] [:error] [pid 7228:tid 7246] [client 45.130.202.86:36209] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adzBNQEnn1dQrOSHHNVqWgAAARA"]
[Mon Apr 13 18:11:02.871711 2026] [:error] [pid 63309:tid 63317] [client 45.130.202.101:60677] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adzBNkpIKZ10weXpf0UOFQAAAAQ"]
[Mon Apr 13 18:11:04.023801 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.81:43187] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adzBOLHZEIkQ0Zmgp5pFzAAAANU"]
[Mon Apr 13 18:11:05.092756 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.77:33025] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adzBObHZEIkQ0Zmgp5pFzwAAANE"]
[Mon Apr 13 18:11:06.172932 2026] [:error] [pid 63406:tid 63418] [client 45.130.202.71:22501] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adzBOrHZEIkQ0Zmgp5pF0wAAAMc"]
[Mon Apr 13 18:11:07.456993 2026] [:error] [pid 63311:tid 63385] [client 45.130.202.80:64561] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adzBO6HjrGN1MqBCVFneQgAAAI4"]
[Mon Apr 13 18:11:08.448199 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.67:57993] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Mon Apr 13 18:11:08.953634 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.67:57993] [client 45.130.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "adzBPLHZEIkQ0Zmgp5pF4QAAAMg"]
[Mon Apr 13 18:11:10.320249 2026] [:error] [pid 63311:tid 63375] [client 45.130.202.80:25227] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adzBPqHjrGN1MqBCVFneRgAAAIQ"]
[Mon Apr 13 18:11:11.633203 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.69:53391] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adzBP7HZEIkQ0Zmgp5pF8wAAAMI"]
[Mon Apr 13 18:11:12.900721 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.95:33317] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Mon Apr 13 18:11:13.143691 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.95:33317] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adzBQbHZEIkQ0Zmgp5pF_AAAANA"]
[Mon Apr 13 18:11:14.243648 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.106:28465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Mon Apr 13 18:11:15.032210 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.106:28465] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Mon Apr 13 18:11:16.064945 2026] [:error] [pid 63406:tid 63431] [client 45.130.202.106:28465] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adzBRLHZEIkQ0Zmgp5pGDAAAANQ"]
[Mon Apr 13 18:11:17.043885 2026] [:error] [pid 57183:tid 57207] [client 45.130.202.89:42477] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Mon Apr 13 18:11:17.287903 2026] [:error] [pid 57183:tid 57195] [client 45.130.202.89:42477] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adzBRTDO3t8R5NaxzYTw3AAAAUo"]
[Mon Apr 13 18:11:18.329549 2026] [:error] [pid 7228:tid 7233] [client 45.130.202.89:58495] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Mon Apr 13 18:11:18.837518 2026] [:error] [pid 7228:tid 7230] [client 45.130.202.89:58495] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "adzBRgEnn1dQrOSHHNVqbgAAAQA"]
[Mon Apr 13 18:11:20.144088 2026] [:error] [pid 7228:tid 7254] [client 45.130.202.102:30185] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adzBSAEnn1dQrOSHHNVqdQAAARg"]
[Mon Apr 13 18:11:21.590766 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.71:62795] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Mon Apr 13 18:11:21.849024 2026] [:error] [pid 57183:tid 57190] [client 45.130.202.71:62795] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Mon Apr 13 18:11:22.460857 2026] [:error] [pid 57183:tid 57186] [client 45.130.202.71:62795] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adzBSjDO3t8R5NaxzYTw6QAAAUE"]
[Mon Apr 13 18:11:23.835858 2026] [:error] [pid 63310:tid 63346] [client 45.130.202.75:64315] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adzBS3oXpRU5ztmwPjI5xgAAAEI"]
[Mon Apr 13 18:11:25.245333 2026] [:error] [pid 63311:tid 63381] [client 45.130.202.64:24033] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adzBTaHjrGN1MqBCVFneTQAAAIo"]
[Mon Apr 13 18:11:26.286385 2026] [:error] [pid 63310:tid 63347] [client 45.130.202.108:41295] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adzBTnoXpRU5ztmwPjI5yAAAAEM"]
[Mon Apr 13 18:11:27.306971 2026] [:error] [pid 63311:tid 63376] [client 45.130.202.91:56685] [client 45.130.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adzBT6HjrGN1MqBCVFneTwAAAIU"]
[Mon Apr 13 18:11:29.103026 2026] [:error] [pid 57183:tid 57193] [client 45.130.202.75:64353] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Mon Apr 13 18:11:29.358509 2026] [:error] [pid 57183:tid 57186] [client 45.130.202.75:64353] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adzBUTDO3t8R5NaxzYTw8QAAAUE"]
[Mon Apr 13 18:11:30.470012 2026] [:error] [pid 63311:tid 63378] [client 45.130.202.90:44153] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "adzBUqHjrGN1MqBCVFneUQAAAIc"]
[Mon Apr 13 18:11:31.008684 2026] [:error] [pid 63311:tid 63395] [client 45.130.202.89:38455] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adzBU6HjrGN1MqBCVFneUwAAAJg"]
[Mon Apr 13 18:11:32.275681 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.63:55525] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Mon Apr 13 18:11:32.804655 2026] [:error] [pid 63406:tid 63412] [client 45.130.202.63:55525] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Mon Apr 13 18:11:33.984861 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.63:55525] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "adzBVbHZEIkQ0Zmgp5pGNgAAAM0"]
[Mon Apr 13 18:11:35.760245 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.84:45547] [client 45.130.202.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.84, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adzBV7HZEIkQ0Zmgp5pGPgAAANY"]
[Mon Apr 13 18:11:36.118228 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.84:45547] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Mon Apr 13 18:11:37.483500 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.84:45547] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Mon Apr 13 18:11:37.760099 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.84:45547] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Mon Apr 13 18:11:39.228435 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.84:45547] [client 45.130.202.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adzBW7HZEIkQ0Zmgp5pGZQAAAM8"]
[Mon Apr 13 18:11:42.099952 2026] [:error] [pid 63309:tid 63314] [client 45.130.202.72:34827] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Mon Apr 13 18:11:42.362975 2026] [:error] [pid 63309:tid 63333] [client 45.130.202.72:34827] [client 45.130.202.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.72, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adzBXkpIKZ10weXpf0UOTwAAABQ"]
[Mon Apr 13 18:11:42.863110 2026] [:error] [pid 63309:tid 63321] [client 45.130.202.72:34827] [client 45.130.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "adzBXkpIKZ10weXpf0UOUQAAAAg"]
[Mon Apr 13 18:11:46.517819 2026] [:error] [pid 63309:tid 63336] [client 45.130.202.102:21307] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon Apr 13 18:11:47.032177 2026] [:error] [pid 63309:tid 63315] [client 45.130.202.102:21307] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Mon Apr 13 18:11:47.594308 2026] [:error] [pid 63309:tid 63323] [client 45.130.202.102:21307] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adzBY0pIKZ10weXpf0UOXQAAAAo"]
[Mon Apr 13 18:11:49.682996 2026] [:error] [pid 57183:tid 57206] [client 45.130.202.105:44451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Mon Apr 13 18:11:51.674408 2026] [:error] [pid 57183:tid 57203] [client 45.130.202.105:44451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Mon Apr 13 18:11:52.286502 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.105:44451] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Mon Apr 13 18:11:52.944128 2026] [:error] [pid 57183:tid 57207] [client 45.130.202.105:44451] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Mon Apr 13 18:11:53.317067 2026] [:error] [pid 57183:tid 57203] [client 45.130.202.105:44451] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adzBaTDO3t8R5NaxzYTxLgAAAVI"]
[Mon Apr 13 18:11:54.445933 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.57:61141] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Mon Apr 13 18:11:54.694098 2026] [:error] [pid 57183:tid 57195] [client 45.130.202.57:61141] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Mon Apr 13 18:11:54.957795 2026] [:error] [pid 57183:tid 57185] [client 45.130.202.57:61141] [client 45.130.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adzBajDO3t8R5NaxzYTxOAAAAUA"]
[Mon Apr 13 18:11:57.456565 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.81:52367] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Mon Apr 13 18:11:57.967053 2026] [:error] [pid 63406:tid 63421] [client 45.130.202.81:52367] [client 45.130.202.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.81, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adzBbbHZEIkQ0Zmgp5pGjQAAAMo"]
[Mon Apr 13 18:11:58.221201 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.81:52367] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adzBbrHZEIkQ0Zmgp5pGjgAAANY"]
[Mon Apr 13 18:12:02.936324 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.58:33485] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Mon Apr 13 18:12:06.835032 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.58:33485] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Mon Apr 13 18:12:07.087548 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.58:33485] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adzBd7HZEIkQ0Zmgp5pGvQAAAM8"]
[Mon Apr 13 18:12:08.207290 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.85:29417] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Mon Apr 13 18:12:09.107173 2026] [:error] [pid 57183:tid 57192] [client 45.130.202.85:29417] [client 45.130.202.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.85, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adzBeTDO3t8R5NaxzYTxUwAAAUc"]
[Mon Apr 13 18:12:10.621851 2026] [:error] [pid 57183:tid 57192] [client 45.130.202.85:29417] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Mon Apr 13 18:12:10.879772 2026] [:error] [pid 57183:tid 57188] [client 45.130.202.85:29417] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Mon Apr 13 18:12:11.142762 2026] [:error] [pid 57183:tid 57197] [client 45.130.202.85:29417] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Mon Apr 13 18:12:11.487696 2026] [:error] [pid 57183:tid 57202] [client 45.130.202.85:29417] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adzBezDO3t8R5NaxzYTxYgAAAVE"]
[Mon Apr 13 18:12:12.065481 2026] [:error] [pid 9314:tid 9339] [client 45.130.202.69:26891] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Mon Apr 13 18:12:12.419130 2026] [:error] [pid 9314:tid 9338] [client 45.130.202.69:26891] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "adzBfG_r4W8fX2GWyGTgMQAAAZY"]
[Mon Apr 13 18:12:13.617826 2026] [:error] [pid 63406:tid 63411] [client 45.130.202.81:52073] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Mon Apr 13 18:12:13.914902 2026] [:error] [pid 63406:tid 63431] [client 45.130.202.81:52073] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adzBfbHZEIkQ0Zmgp5pG2QAAANQ"]
[Mon Apr 13 18:12:16.111090 2026] [:error] [pid 9314:tid 9332] [client 45.130.202.93:42869] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Mon Apr 13 18:12:16.393750 2026] [:error] [pid 9314:tid 9326] [client 45.130.202.93:42869] [client 45.130.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adzBgG_r4W8fX2GWyGTgOwAAAYo"]
[Mon Apr 13 18:12:17.512036 2026] [:error] [pid 57183:tid 57207] [client 45.130.202.63:47347] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adzBgTDO3t8R5NaxzYTxdAAAAVY"]
[Mon Apr 13 18:12:18.663173 2026] [:error] [pid 63406:tid 63411] [client 45.130.202.84:46299] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Mon Apr 13 18:12:18.934367 2026] [:error] [pid 63406:tid 63429] [client 45.130.202.84:46299] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Mon Apr 13 18:12:20.310526 2026] [:error] [pid 63406:tid 63412] [client 45.130.202.84:46299] [client 45.130.202.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adzBhLHZEIkQ0Zmgp5pG6wAAAME"]
[Mon Apr 13 18:12:21.732804 2026] [:error] [pid 63406:tid 63423] [client 45.130.202.97:43413] [client 45.130.202.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adzBhbHZEIkQ0Zmgp5pG9AAAAMw"]
[Mon Apr 13 18:12:23.915967 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.73:56841] [client 45.130.202.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "adzBh7HZEIkQ0Zmgp5pHBgAAANY"]
[Mon Apr 13 18:12:24.881387 2026] [:error] [pid 63406:tid 63431] [client 45.130.202.96:55573] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Mon Apr 13 18:12:25.434425 2026] [:error] [pid 63406:tid 63421] [client 45.130.202.96:55573] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Mon Apr 13 18:12:25.698055 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.96:55573] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adzBibHZEIkQ0Zmgp5pHGgAAANY"]
[Mon Apr 13 18:12:26.778540 2026] [:error] [pid 63311:tid 63383] [client 45.130.202.90:31599] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Mon Apr 13 18:12:27.364638 2026] [:error] [pid 63311:tid 63373] [client 45.130.202.90:31599] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "adzBi6HjrGN1MqBCVFnelAAAAII"]
[Mon Apr 13 18:12:29.589460 2026] [:error] [pid 9314:tid 9334] [client 45.130.202.73:42479] [client 45.130.202.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adzBjW_r4W8fX2GWyGTgTgAAAZI"]
[Mon Apr 13 18:12:31.208212 2026] [:error] [pid 9314:tid 9325] [client 45.130.202.89:27751] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Mon Apr 13 18:12:32.074539 2026] [:error] [pid 9314:tid 9324] [client 45.130.202.89:27751] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Mon Apr 13 18:12:32.587822 2026] [:error] [pid 9314:tid 9323] [client 45.130.202.89:27751] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Mon Apr 13 18:12:32.831510 2026] [:error] [pid 9314:tid 9337] [client 45.130.202.89:27751] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adzBkG_r4W8fX2GWyGTgWgAAAZU"]
[Mon Apr 13 18:12:34.351211 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.101:46695] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adzBkrHZEIkQ0Zmgp5pHNgAAANU"]
[Mon Apr 13 18:12:35.922786 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.95:28289] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adzBk7HZEIkQ0Zmgp5pHOgAAANY"]
[Mon Apr 13 18:12:38.525340 2026] [:error] [pid 63406:tid 63435] [client 45.130.202.90:45951] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adzBlrHZEIkQ0Zmgp5pHSAAAANg"]
[Mon Apr 13 18:12:41.963764 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.95:26041] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Mon Apr 13 18:12:42.223570 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.95:26041] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adzBmrHZEIkQ0Zmgp5pHWwAAAMg"]
[Mon Apr 13 18:12:45.201674 2026] [:error] [pid 9314:tid 9330] [client 45.130.202.95:38549] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adzBnW_r4W8fX2GWyGTgYgAAAY4"]
[Mon Apr 13 18:12:47.261541 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.54:31041] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Mon Apr 13 18:12:47.754793 2026] [:error] [pid 57183:tid 57207] [client 45.130.202.54:31041] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "adzBnzDO3t8R5NaxzYTxvQAAAVY"]
[Mon Apr 13 18:12:49.548931 2026] [:error] [pid 63309:tid 63315] [client 45.130.202.105:39579] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adzBoUpIKZ10weXpf0UOfwAAAAI"]
[Mon Apr 13 18:12:51.159422 2026] [:error] [pid 7228:tid 7249] [client 45.130.202.69:62115] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adzBowEnn1dQrOSHHNVqxwAAARM"]
[Mon Apr 13 18:12:52.756670 2026] [:error] [pid 63310:tid 63345] [client 45.130.202.56:32537] [client 45.130.202.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adzBpHoXpRU5ztmwPjI58AAAAEE"]
[Mon Apr 13 18:12:54.545103 2026] [:error] [pid 9314:tid 9327] [client 45.130.202.102:21859] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adzBpm_r4W8fX2GWyGTgbQAAAYs"]
[Mon Apr 13 18:12:58.061007 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.103:30523] [client 45.130.202.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adzBqrHZEIkQ0Zmgp5pHdgAAAMs"]
[Mon Apr 13 18:12:59.705095 2026] [:error] [pid 63310:tid 63368] [client 45.130.202.63:58739] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Mon Apr 13 18:13:00.484344 2026] [:error] [pid 63310:tid 63359] [client 45.130.202.63:58739] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Mon Apr 13 18:13:00.768821 2026] [:error] [pid 63310:tid 63360] [client 45.130.202.63:58739] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adzBrHoXpRU5ztmwPjI5-QAAAFA"]
[Mon Apr 13 18:13:02.112447 2026] [:error] [pid 63311:tid 63380] [client 45.130.202.56:51573] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Mon Apr 13 18:13:02.418065 2026] [:error] [pid 63311:tid 63394] [client 45.130.202.56:51573] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Mon Apr 13 18:13:03.802228 2026] [:error] [pid 63311:tid 63388] [client 45.130.202.56:51573] [client 45.130.202.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adzBr6HjrGN1MqBCVFneqgAAAJE"]
[Mon Apr 13 18:13:06.316131 2026] [:error] [pid 63311:tid 63393] [client 45.130.202.84:49505] [client 45.130.202.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adzBsqHjrGN1MqBCVFnetAAAAJY"]
[Mon Apr 13 18:13:07.358251 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.75:37645] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adzBs7HZEIkQ0Zmgp5pHkAAAANE"]
[Mon Apr 13 18:13:09.589004 2026] [:error] [pid 9314:tid 9335] [client 45.130.202.60:58315] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adzBtW_r4W8fX2GWyGTgnwAAAZM"]
[Mon Apr 13 18:13:11.720024 2026] [:error] [pid 7228:tid 7230] [client 45.130.202.62:42373] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Mon Apr 13 18:13:11.965066 2026] [:error] [pid 7228:tid 7252] [client 45.130.202.62:42373] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Mon Apr 13 18:13:12.228383 2026] [:error] [pid 7228:tid 7232] [client 45.130.202.62:42373] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Mon Apr 13 18:13:12.502188 2026] [:error] [pid 7228:tid 7253] [client 45.130.202.62:42373] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Mon Apr 13 18:13:14.022990 2026] [:error] [pid 7228:tid 7243] [client 45.130.202.62:42373] [client 45.130.202.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adzBugEnn1dQrOSHHNVq5wAAAQ0"]
[Mon Apr 13 18:13:15.054445 2026] [:error] [pid 63310:tid 63356] [client 45.130.202.103:35191] [client 45.130.202.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adzBu3oXpRU5ztmwPjI6BAAAAEw"]
[Mon Apr 13 18:13:15.637716 2026] [:error] [pid 57183:tid 57201] [client 45.130.202.81:58509] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adzBuzDO3t8R5NaxzYTx1wAAAVA"]
[Mon Apr 13 18:13:16.128030 2026] [:error] [pid 57183:tid 57197] [client 45.130.202.81:42087] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adzBvDDO3t8R5NaxzYTx2wAAAUw"]
[Mon Apr 13 18:13:17.684908 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.88:31167] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adzBvbHZEIkQ0Zmgp5pHpAAAAMU"]
[Mon Apr 13 18:13:19.103222 2026] [:error] [pid 63310:tid 63354] [client 45.130.202.108:20195] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adzBv3oXpRU5ztmwPjI6BgAAAEo"]
[Mon Apr 13 18:13:20.659967 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.105:24001] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adzBwLHZEIkQ0Zmgp5pHqwAAANM"]
[Mon Apr 13 18:13:21.830679 2026] [:error] [pid 63311:tid 63388] [client 45.130.202.101:40151] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adzBwaHjrGN1MqBCVFnexwAAAJE"]
[Mon Apr 13 18:13:23.871785 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.59:35813] [client 45.130.202.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adzBw7HZEIkQ0Zmgp5pHsgAAANY"]
[Mon Apr 13 18:13:25.028058 2026] [:error] [pid 7228:tid 7254] [client 45.130.202.75:31845] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adzBxQEnn1dQrOSHHNVq-AAAARg"]
[Mon Apr 13 18:13:27.178599 2026] [:error] [pid 63406:tid 63435] [client 45.130.202.105:23089] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adzBx7HZEIkQ0Zmgp5pHvgAAANg"]
[Mon Apr 13 18:13:29.060965 2026] [:error] [pid 57183:tid 57203] [client 45.130.202.77:23867] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adzByTDO3t8R5NaxzYTx8gAAAVI"]
[Mon Apr 13 18:13:30.137088 2026] [:error] [pid 9314:tid 9335] [client 45.130.202.74:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Mon Apr 13 18:13:30.897855 2026] [:error] [pid 9314:tid 9331] [client 45.130.202.74:37473] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adzBym_r4W8fX2GWyGTguAAAAY8"]
[Mon Apr 13 18:13:32.778678 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.79:49587] [client 45.130.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "adzBzLHZEIkQ0Zmgp5pH1AAAAMs"]
[Mon Apr 13 18:13:34.495914 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.72:20451] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Mon Apr 13 18:13:34.831920 2026] [:error] [pid 63406:tid 63411] [client 45.130.202.72:20451] [client 45.130.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adzBzrHZEIkQ0Zmgp5pH3AAAAMA"]
[Mon Apr 13 18:13:36.434641 2026] [:error] [pid 63309:tid 63321] [client 45.130.202.104:22339] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Mon Apr 13 18:13:36.877156 2026] [:error] [pid 63309:tid 63337] [client 45.130.202.104:22339] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Mon Apr 13 18:13:37.188809 2026] [:error] [pid 63309:tid 63326] [client 45.130.202.104:22339] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Mon Apr 13 18:13:38.422668 2026] [:error] [pid 63309:tid 63326] [client 45.130.202.104:22339] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adzB0kpIKZ10weXpf0UOpgAAAA0"]
[Mon Apr 13 18:13:41.492947 2026] [:error] [pid 63310:tid 63344] [client 45.130.202.88:61553] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Mon Apr 13 18:13:42.005306 2026] [:error] [pid 63310:tid 63344] [client 45.130.202.88:61553] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adzB1noXpRU5ztmwPjI6FwAAAEA"]
[Mon Apr 13 18:13:43.690223 2026] [:error] [pid 9314:tid 9325] [client 45.130.202.58:24641] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Apr 13 18:13:43.939310 2026] [:error] [pid 9314:tid 9322] [client 45.130.202.58:24641] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Mon Apr 13 18:13:44.204943 2026] [:error] [pid 9314:tid 9329] [client 45.130.202.58:24641] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Mon Apr 13 18:13:45.587246 2026] [:error] [pid 9314:tid 9330] [client 45.130.202.58:24641] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Apr 13 18:13:45.864587 2026] [:error] [pid 9314:tid 9340] [client 45.130.202.58:24641] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Mon Apr 13 18:13:46.518212 2026] [:error] [pid 9314:tid 9318] [client 45.130.202.58:24641] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Mon Apr 13 18:13:47.346310 2026] [:error] [pid 9314:tid 9337] [client 45.130.202.58:24641] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Mon Apr 13 18:13:47.592113 2026] [:error] [pid 9314:tid 9326] [client 45.130.202.58:24641] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adzB22_r4W8fX2GWyGTg2gAAAYo"]
[Mon Apr 13 18:13:48.576609 2026] [:error] [pid 63309:tid 63315] [client 45.130.202.85:37913] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adzB3EpIKZ10weXpf0UOrwAAAAI"]
[Mon Apr 13 18:13:51.468805 2026] [:error] [pid 57183:tid 57189] [client 45.130.202.71:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Mon Apr 13 18:13:51.919684 2026] [:error] [pid 57183:tid 57194] [client 45.130.202.71:35175] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adzB3zDO3t8R5NaxzYTyFAAAAUk"]
[Mon Apr 13 18:13:53.441920 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.76:45415] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 13 18:13:53.884524 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.76:45415] [client 45.130.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adzB4bHZEIkQ0Zmgp5pIAwAAANY"]
[Mon Apr 13 18:13:54.955862 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.106:56123] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adzB4rHZEIkQ0Zmgp5pIBAAAAMs"]
[Mon Apr 13 18:13:57.580445 2026] [:error] [pid 9314:tid 9337] [client 45.130.202.79:55561] [client 45.130.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adzB5W_r4W8fX2GWyGTg8QAAAZU"]
[Mon Apr 13 18:13:59.039410 2026] [:error] [pid 63406:tid 63435] [client 45.130.202.109:58957] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "adzB57HZEIkQ0Zmgp5pIDgAAANg"]
[Mon Apr 13 18:14:01.372974 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.78:21993] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Mon Apr 13 18:14:01.955514 2026] [:error] [pid 63406:tid 63429] [client 45.130.202.78:21993] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adzB6bHZEIkQ0Zmgp5pIIgAAANI"]
[Mon Apr 13 18:14:03.808527 2026] [:error] [pid 57183:tid 57188] [client 45.130.202.57:46261] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Mon Apr 13 18:14:04.398964 2026] [:error] [pid 57183:tid 57203] [client 45.130.202.57:46261] [client 45.130.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "adzB7DDO3t8R5NaxzYTyJQAAAVI"]
[Mon Apr 13 18:14:06.636664 2026] [:error] [pid 57183:tid 57207] [client 45.130.202.81:38163] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "adzB7jDO3t8R5NaxzYTyLgAAAVY"]
[Mon Apr 13 18:14:09.908694 2026] [:error] [pid 63309:tid 63315] [client 45.130.202.79:39367] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Mon Apr 13 18:14:10.166138 2026] [:error] [pid 63309:tid 63323] [client 45.130.202.79:39367] [client 45.130.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adzB8kpIKZ10weXpf0UOwgAAAAo"]
[Mon Apr 13 18:14:11.808578 2026] [:error] [pid 63406:tid 63421] [client 45.130.202.72:59373] [client 45.130.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adzB87HZEIkQ0Zmgp5pILQAAAMo"]
[Mon Apr 13 18:14:14.192598 2026] [:error] [pid 63310:tid 63362] [client 45.130.202.65:53237] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Mon Apr 13 18:14:14.563369 2026] [:error] [pid 63310:tid 63365] [client 45.130.202.65:53237] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Mon Apr 13 18:14:15.102265 2026] [:error] [pid 63310:tid 63351] [client 45.130.202.65:53237] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Mon Apr 13 18:14:15.657064 2026] [:error] [pid 63310:tid 63360] [client 45.130.202.65:53237] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adzB93oXpRU5ztmwPjI6PQAAAFA"]
[Mon Apr 13 18:14:17.180807 2026] [:error] [pid 9314:tid 9321] [client 45.130.202.102:25465] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adzB-W_r4W8fX2GWyGTg_wAAAYU"]
[Mon Apr 13 18:14:21.490363 2026] [:error] [pid 63309:tid 63317] [client 45.130.202.83:32483] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Mon Apr 13 18:14:21.803840 2026] [:error] [pid 63309:tid 63329] [client 45.130.202.83:32483] [client 45.130.202.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "adzB_UpIKZ10weXpf0UOyQAAABA"]
[Mon Apr 13 18:14:23.415865 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.90:22667] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adzB_7HZEIkQ0Zmgp5pISAAAANc"]
[Mon Apr 13 18:14:25.829073 2026] [:error] [pid 63309:tid 63323] [client 45.130.202.81:57495] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adzCAUpIKZ10weXpf0UOzQAAAAo"]
[Mon Apr 13 18:14:29.585161 2026] [:error] [pid 57183:tid 57208] [client 45.130.202.68:31239] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Mon Apr 13 18:14:29.860825 2026] [:error] [pid 57183:tid 57195] [client 45.130.202.68:31239] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adzCBTDO3t8R5NaxzYTyZgAAAUo"]
[Mon Apr 13 18:14:31.268851 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.80:45533] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adzCB7HZEIkQ0Zmgp5pIZQAAAMU"]
[Mon Apr 13 18:14:32.531272 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Mon Apr 13 18:14:32.794534 2026] [:error] [pid 63406:tid 63415] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Mon Apr 13 18:14:33.503789 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Mon Apr 13 18:14:34.515099 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.78:24319] [client 45.130.202.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.78, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "adzCCrHZEIkQ0Zmgp5pIfgAAANU"]
[Mon Apr 13 18:14:35.102697 2026] [:error] [pid 63406:tid 63418] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Mon Apr 13 18:14:35.393910 2026] [:error] [pid 63406:tid 63431] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Mon Apr 13 18:14:35.817726 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Mon Apr 13 18:14:36.368955 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.78:24319] [client 45.130.202.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.78, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adzCDLHZEIkQ0Zmgp5pIjAAAAMI"]
[Mon Apr 13 18:14:37.188647 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Mon Apr 13 18:14:37.447967 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Mon Apr 13 18:14:37.977898 2026] [:error] [pid 63406:tid 63418] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Mon Apr 13 18:14:38.650083 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Mon Apr 13 18:14:39.619277 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Mon Apr 13 18:14:41.614838 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Mon Apr 13 18:14:41.879351 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Mon Apr 13 18:14:43.232648 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.78:24319] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Mon Apr 13 18:14:44.024339 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.78:24319] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adzCFLHZEIkQ0Zmgp5pIwQAAANM"]
[Mon Apr 13 18:14:46.606372 2026] [:error] [pid 9314:tid 9329] [client 45.130.202.59:49985] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Mon Apr 13 18:14:46.857768 2026] [:error] [pid 9314:tid 9326] [client 45.130.202.59:49985] [client 45.130.202.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adzCFm_r4W8fX2GWyGThLgAAAYo"]
[Mon Apr 13 18:14:50.311762 2026] [:error] [pid 57183:tid 57204] [client 45.130.202.71:32011] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Mon Apr 13 18:14:50.697740 2026] [:error] [pid 57183:tid 57208] [client 45.130.202.71:32011] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adzCGjDO3t8R5NaxzYTyewAAAVc"]
[Mon Apr 13 18:14:54.075307 2026] [:error] [pid 63406:tid 63412] [client 45.130.202.87:27965] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Mon Apr 13 18:14:54.601608 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.87:27965] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Mon Apr 13 18:14:55.208524 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.87:27965] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Mon Apr 13 18:14:55.481134 2026] [:error] [pid 63406:tid 63421] [client 45.130.202.87:27965] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Mon Apr 13 18:14:56.106196 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.87:27965] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adzCILHZEIkQ0Zmgp5pI8AAAANc"]
[Mon Apr 13 18:14:58.489837 2026] [:error] [pid 9314:tid 9321] [client 45.130.202.65:45069] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Mon Apr 13 18:14:58.791044 2026] [:error] [pid 9314:tid 9316] [client 45.130.202.65:45069] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Mon Apr 13 18:14:59.068047 2026] [:error] [pid 9314:tid 9319] [client 45.130.202.65:45069] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adzCI2_r4W8fX2GWyGThPwAAAYM"]
[Mon Apr 13 18:15:01.040184 2026] [:error] [pid 63311:tid 63382] [client 45.130.202.91:37639] [client 45.130.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adzCJaHjrGN1MqBCVFne_QAAAIs"]
[Mon Apr 13 18:15:04.017429 2026] [:error] [pid 9314:tid 9326] [client 45.130.202.59:42991] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Mon Apr 13 18:15:05.324657 2026] [:error] [pid 9314:tid 9328] [client 45.130.202.59:42991] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Mon Apr 13 18:15:05.588095 2026] [:error] [pid 9314:tid 9317] [client 45.130.202.59:42991] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Mon Apr 13 18:15:05.840176 2026] [:error] [pid 9314:tid 9325] [client 45.130.202.59:42991] [client 45.130.202.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adzCKW_r4W8fX2GWyGThSgAAAYk"]
[Mon Apr 13 18:15:07.339073 2026] [:error] [pid 7228:tid 7236] [client 45.130.202.109:34943] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adzCKwEnn1dQrOSHHNVrOQAAAQY"]
[Mon Apr 13 18:15:10.213484 2026] [:error] [pid 9314:tid 9337] [client 45.130.202.108:50895] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Mon Apr 13 18:15:10.821512 2026] [:error] [pid 9314:tid 9340] [client 45.130.202.108:50895] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adzCLm_r4W8fX2GWyGThWQAAAZg"]
[Mon Apr 13 18:15:12.368288 2026] [:error] [pid 9314:tid 9319] [client 45.130.202.61:23533] [client 45.130.202.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "adzCMG_r4W8fX2GWyGThXAAAAYM"]
[Mon Apr 13 18:15:13.946253 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.89:26165] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Apr 13 18:15:14.202875 2026] [:error] [pid 57183:tid 57206] [client 45.130.202.89:26165] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Mon Apr 13 18:15:14.564248 2026] [:error] [pid 57183:tid 57191] [client 45.130.202.89:26165] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adzCMjDO3t8R5NaxzYTyngAAAUY"]
[Mon Apr 13 18:15:16.057808 2026] [:error] [pid 63309:tid 63314] [client 45.130.202.55:57603] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Mon Apr 13 18:15:16.310731 2026] [:error] [pid 63309:tid 63316] [client 45.130.202.55:57603] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Mon Apr 13 18:15:16.921481 2026] [:error] [pid 63309:tid 63330] [client 45.130.202.55:57603] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon Apr 13 18:15:17.721081 2026] [:error] [pid 63309:tid 63329] [client 45.130.202.55:57603] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adzCNUpIKZ10weXpf0UO4AAAABA"]
[Mon Apr 13 18:15:19.940788 2026] [:error] [pid 57183:tid 57205] [client 45.130.202.97:63853] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Mon Apr 13 18:15:20.806452 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.97:63853] [client 45.130.202.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adzCODDO3t8R5NaxzYTyqQAAAUI"]
[Mon Apr 13 18:15:22.388464 2026] [:error] [pid 7228:tid 7240] [client 45.130.202.94:62277] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Mon Apr 13 18:15:23.427887 2026] [:error] [pid 7228:tid 7253] [client 45.130.202.94:62277] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Mon Apr 13 18:15:23.722666 2026] [:error] [pid 7228:tid 7232] [client 45.130.202.94:62277] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Mon Apr 13 18:15:24.470420 2026] [:error] [pid 7228:tid 7235] [client 45.130.202.94:62277] [client 45.130.202.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.94, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adzCPAEnn1dQrOSHHNVrWgAAAQU"]
[Mon Apr 13 18:15:26.128600 2026] [:error] [pid 7228:tid 7246] [client 45.130.202.94:62277] [client 45.130.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adzCPgEnn1dQrOSHHNVrXwAAARA"]
[Mon Apr 13 18:15:27.157644 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.86:42711] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Mon Apr 13 18:15:27.459401 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.86:42711] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adzCP7HZEIkQ0Zmgp5pJJwAAAMM"]
[Mon Apr 13 18:15:28.719582 2026] [:error] [pid 9314:tid 9318] [client 45.130.202.104:55939] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Mon Apr 13 18:15:29.386598 2026] [:error] [pid 9314:tid 9325] [client 45.130.202.104:55939] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Mon Apr 13 18:15:29.902812 2026] [:error] [pid 9314:tid 9330] [client 45.130.202.104:55939] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adzCQW_r4W8fX2GWyGThhAAAAY4"]
[Mon Apr 13 18:15:31.172275 2026] [:error] [pid 9314:tid 9333] [client 45.130.202.75:28267] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Mon Apr 13 18:15:31.427724 2026] [:error] [pid 9314:tid 9334] [client 45.130.202.75:28267] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Mon Apr 13 18:15:31.722620 2026] [:error] [pid 9314:tid 9322] [client 45.130.202.75:28267] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adzCQ2_r4W8fX2GWyGThiAAAAYY"]
[Mon Apr 13 18:15:34.438405 2026] [:error] [pid 9314:tid 9337] [client 45.130.202.88:52327] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adzCRm_r4W8fX2GWyGThigAAAZU"]
[Mon Apr 13 18:15:35.500813 2026] [:error] [pid 9314:tid 9318] [client 45.130.202.104:32215] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Mon Apr 13 18:15:35.754848 2026] [:error] [pid 9314:tid 9340] [client 45.130.202.104:32215] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Mon Apr 13 18:15:36.277308 2026] [:error] [pid 9314:tid 9333] [client 45.130.202.104:32215] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adzCSG_r4W8fX2GWyGThlAAAAZE"]
[Mon Apr 13 18:15:38.046276 2026] [:error] [pid 63309:tid 63318] [client 45.130.202.89:40797] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Mon Apr 13 18:15:38.673501 2026] [:error] [pid 63309:tid 63315] [client 45.130.202.89:40797] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Mon Apr 13 18:15:38.950183 2026] [:error] [pid 63309:tid 63332] [client 45.130.202.89:40797] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adzCSkpIKZ10weXpf0UO9AAAABM"]
[Mon Apr 13 18:15:40.860497 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.74:50879] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "adzCTLHZEIkQ0Zmgp5pJRAAAAMs"]
[Mon Apr 13 18:15:41.390099 2026] [:error] [pid 63406:tid 63412] [client 45.130.202.104:25071] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adzCTbHZEIkQ0Zmgp5pJSAAAAME"]
[Mon Apr 13 18:15:41.914914 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.95:57733] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adzCTbHZEIkQ0Zmgp5pJTAAAANA"]
[Mon Apr 13 18:15:42.775417 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.95:45855] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adzCTrHZEIkQ0Zmgp5pJTwAAAM4"]
[Mon Apr 13 18:15:44.383165 2026] [:error] [pid 63309:tid 63323] [client 45.130.202.108:52375] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adzCUEpIKZ10weXpf0UO_gAAAAo"]
[Mon Apr 13 18:15:44.887617 2026] [:error] [pid 63311:tid 63394] [client 45.130.202.61:29463] [client 45.130.202.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adzCUKHjrGN1MqBCVFnfGAAAAJc"]
[Mon Apr 13 18:15:48.072309 2026] [:error] [pid 9314:tid 9322] [client 45.130.202.101:44259] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adzCVG_r4W8fX2GWyGThowAAAYY"]
[Mon Apr 13 18:15:49.276764 2026] [:error] [pid 57183:tid 57192] [client 45.130.202.75:53971] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adzCVTDO3t8R5NaxzYTyzwAAAUc"]
[Mon Apr 13 18:15:50.305761 2026] [:error] [pid 7228:tid 7232] [client 45.130.202.67:51191] [client 45.130.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adzCVgEnn1dQrOSHHNVrbAAAAQI"]
[Mon Apr 13 18:15:51.309852 2026] [:error] [pid 57183:tid 57206] [client 45.130.202.88:57627] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adzCVzDO3t8R5NaxzYTy1wAAAVU"]
[Mon Apr 13 18:15:52.421701 2026] [:error] [pid 7228:tid 7250] [client 45.130.202.62:37449] [client 45.130.202.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adzCWAEnn1dQrOSHHNVrcgAAARQ"]
[Mon Apr 13 18:15:52.972633 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.104:48811] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Mon Apr 13 18:15:54.036779 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.104:48811] [client 45.130.202.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.104, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adzCWrHZEIkQ0Zmgp5pJYgAAAMs"]
[Mon Apr 13 18:15:55.497368 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.104:48811] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adzCW7HZEIkQ0Zmgp5pJaAAAANc"]
[Mon Apr 13 18:15:57.493503 2026] [:error] [pid 7228:tid 7247] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Mon Apr 13 18:15:57.745627 2026] [:error] [pid 7228:tid 7250] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Mon Apr 13 18:15:58.914355 2026] [:error] [pid 7228:tid 7248] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Mon Apr 13 18:15:59.181994 2026] [:error] [pid 7228:tid 7253] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Mon Apr 13 18:16:00.383365 2026] [:error] [pid 7228:tid 7249] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Mon Apr 13 18:16:00.650046 2026] [:error] [pid 7228:tid 7234] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Mon Apr 13 18:16:00.913828 2026] [:error] [pid 7228:tid 7247] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Mon Apr 13 18:16:01.313357 2026] [:error] [pid 7228:tid 7240] [client 45.130.202.83:57369] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Mon Apr 13 18:16:01.581344 2026] [:error] [pid 7228:tid 7236] [client 45.130.202.83:57369] [client 45.130.202.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adzCYQEnn1dQrOSHHNVrkwAAAQY"]
[Mon Apr 13 18:16:03.721530 2026] [:error] [pid 9314:tid 9316] [client 45.130.202.84:64031] [client 45.130.202.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adzCY2_r4W8fX2GWyGThtgAAAYA"]
[Mon Apr 13 18:16:05.855798 2026] [:error] [pid 63311:tid 63378] [client 45.130.202.102:43517] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adzCZaHjrGN1MqBCVFnfJwAAAIc"]
[Mon Apr 13 18:16:08.340708 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.64:38933] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Mon Apr 13 18:16:08.594857 2026] [:error] [pid 57183:tid 57201] [client 45.130.202.64:38933] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Mon Apr 13 18:16:09.159809 2026] [:error] [pid 57183:tid 57190] [client 45.130.202.64:38933] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Mon Apr 13 18:16:09.700291 2026] [:error] [pid 57183:tid 57192] [client 45.130.202.64:38933] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adzCaTDO3t8R5NaxzYTzAwAAAUc"]
[Mon Apr 13 18:16:10.744463 2026] [:error] [pid 63309:tid 63329] [client 45.130.202.98:64307] [client 45.130.202.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adzCakpIKZ10weXpf0UPCgAAABA"]
[Mon Apr 13 18:16:12.440508 2026] [:error] [pid 9314:tid 9336] [client 45.130.202.57:32759] [client 45.130.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adzCbG_r4W8fX2GWyGThugAAAZQ"]
[Mon Apr 13 18:16:16.499311 2026] [:error] [pid 9314:tid 9330] [client 45.130.202.89:35761] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adzCcG_r4W8fX2GWyGThzAAAAY4"]
[Mon Apr 13 18:16:19.043686 2026] [:error] [pid 63311:tid 63378] [client 45.130.202.98:21523] [client 45.130.202.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adzCc6HjrGN1MqBCVFnfMgAAAIc"]
[Mon Apr 13 18:16:21.956148 2026] [:error] [pid 7228:tid 7246] [client 45.130.202.59:49309] [client 45.130.202.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adzCdQEnn1dQrOSHHNVrrwAAARA"]
[Mon Apr 13 18:16:28.496012 2026] [:error] [pid 63311:tid 63372] [client 45.130.202.86:30593] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adzCfKHjrGN1MqBCVFnfQAAAAIE"]
[Mon Apr 13 18:16:30.667719 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.74:44593] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Mon Apr 13 18:16:30.930988 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.74:44593] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "adzCfrHZEIkQ0Zmgp5pJogAAAMM"]
[Mon Apr 13 18:16:33.314282 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.108:39853] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Mon Apr 13 18:16:34.156541 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.108:39853] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Mon Apr 13 18:16:34.439126 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.108:39853] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "adzCgrHZEIkQ0Zmgp5pJsgAAAM4"]
[Mon Apr 13 18:16:36.011139 2026] [:error] [pid 9314:tid 9316] [client 45.130.202.64:43883] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adzChG_r4W8fX2GWyGTh9QAAAYA"]
[Mon Apr 13 18:16:39.118733 2026] [:error] [pid 63310:tid 63352] [client 45.130.202.81:44365] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adzCh3oXpRU5ztmwPjI65QAAAEg"]
[Mon Apr 13 18:16:41.609875 2026] [:error] [pid 57183:tid 57191] [client 45.130.202.84:31043] [client 45.130.202.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adzCiTDO3t8R5NaxzYTzmQAAAUY"]
[Mon Apr 13 18:16:42.993392 2026] [:error] [pid 63309:tid 63331] [client 45.130.202.109:23993] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Mon Apr 13 18:16:43.254167 2026] [:error] [pid 63309:tid 63333] [client 45.130.202.109:23993] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adzCi0pIKZ10weXpf0UPGwAAABQ"]
[Mon Apr 13 18:16:44.249735 2026] [:error] [pid 63309:tid 63328] [client 45.130.202.93:28217] [client 45.130.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adzCjEpIKZ10weXpf0UPHQAAAA8"]
[Mon Apr 13 18:16:46.610998 2026] [:error] [pid 63311:tid 63379] [client 45.130.202.69:44267] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adzCjqHjrGN1MqBCVFnfUgAAAIg"]
[Mon Apr 13 18:16:47.715752 2026] [:error] [pid 57183:tid 57193] [client 45.130.202.82:61063] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Mon Apr 13 18:16:48.891439 2026] [:error] [pid 57183:tid 57197] [client 45.130.202.82:61063] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Mon Apr 13 18:16:49.171614 2026] [:error] [pid 57183:tid 57209] [client 45.130.202.82:61063] [client 45.130.202.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adzCkTDO3t8R5NaxzYTzqwAAAVg"]
[Mon Apr 13 18:16:50.758942 2026] [:error] [pid 57183:tid 57199] [client 45.130.202.78:31595] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Mon Apr 13 18:16:51.291260 2026] [:error] [pid 57183:tid 57189] [client 45.130.202.78:31595] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adzCkzDO3t8R5NaxzYTzugAAAUQ"]
[Mon Apr 13 18:16:52.443633 2026] [:error] [pid 63310:tid 63346] [client 45.130.202.60:45523] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adzClHoXpRU5ztmwPjI66AAAAEI"]
[Mon Apr 13 18:16:53.716877 2026] [:error] [pid 63311:tid 63374] [client 45.130.202.108:40587] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adzClaHjrGN1MqBCVFnfWQAAAIM"]
[Mon Apr 13 18:16:55.456485 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.64:27145] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "adzCl7HZEIkQ0Zmgp5pJ4QAAAM4"]
[Mon Apr 13 18:16:56.582181 2026] [:error] [pid 7228:tid 7243] [client 45.130.202.54:50133] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adzCmAEnn1dQrOSHHNVr0AAAAQ0"]
[Mon Apr 13 18:16:57.936536 2026] [:error] [pid 57183:tid 57209] [client 45.130.202.90:21241] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Mon Apr 13 18:16:59.341441 2026] [:error] [pid 57183:tid 57208] [client 45.130.202.90:21241] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "adzCmzDO3t8R5NaxzYTzywAAAVc"]
[Mon Apr 13 18:17:01.363083 2026] [:error] [pid 63311:tid 63373] [client 45.130.202.88:52925] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/db.php"] [unique_id "adzCnaHjrGN1MqBCVFnfYAAAAII"]
[Mon Apr 13 18:17:03.138663 2026] [:error] [pid 9314:tid 9323] [client 45.130.202.91:29341] [client 45.130.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "adzCn2_r4W8fX2GWyGTiBwAAAYc"]
[Mon Apr 13 18:17:04.545590 2026] [:error] [pid 57183:tid 57205] [client 45.130.202.64:38401] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Mon Apr 13 18:17:04.861181 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.64:38401] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adzCoDDO3t8R5NaxzYTz4QAAAU8"]
[Mon Apr 13 18:17:06.005383 2026] [:error] [pid 63311:tid 63387] [client 45.130.202.62:64381] [client 45.130.202.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adzCoqHjrGN1MqBCVFnfaAAAAJA"]
[Mon Apr 13 18:17:08.465326 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.57:41519] [client 45.130.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adzCpDDO3t8R5NaxzYTz8QAAAUI"]
[Mon Apr 13 18:17:09.730401 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.75:52527] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Mon Apr 13 18:17:09.976555 2026] [:error] [pid 57183:tid 57201] [client 45.130.202.75:52527] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adzCpTDO3t8R5NaxzYTz-gAAAVA"]
[Mon Apr 13 18:17:11.671111 2026] [:error] [pid 63310:tid 63361] [client 45.130.202.96:53977] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adzCp3oXpRU5ztmwPjI7AgAAAFE"]
[Mon Apr 13 18:17:13.010897 2026] [:error] [pid 57183:tid 57185] [client 45.130.202.105:43805] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "adzCqTDO3t8R5NaxzYTz_QAAAUA"]
[Mon Apr 13 18:17:14.494973 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.87:61663] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adzCqrHZEIkQ0Zmgp5pKAQAAAM8"]
[Mon Apr 13 18:17:15.549394 2026] [:error] [pid 9314:tid 9334] [client 45.130.202.104:54695] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "adzCq2_r4W8fX2GWyGTiDQAAAZI"]
[Mon Apr 13 18:17:16.595836 2026] [:error] [pid 7228:tid 7247] [client 45.130.202.61:27779] [client 45.130.202.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "adzCrAEnn1dQrOSHHNVr6QAAARE"]
[Mon Apr 13 18:17:19.229732 2026] [:error] [pid 63310:tid 63347] [client 45.130.202.103:28267] [client 45.130.202.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adzCr3oXpRU5ztmwPjI7GAAAAEM"]
[Mon Apr 13 18:17:21.000488 2026] [:error] [pid 9314:tid 9330] [client 45.130.202.88:21397] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "adzCsG_r4W8fX2GWyGTiHgAAAY4"]
[Mon Apr 13 18:17:22.343883 2026] [:error] [pid 63406:tid 63420] [client 45.130.202.103:26069] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Mon Apr 13 18:17:22.597863 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.103:26069] [client 45.130.202.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "adzCsrHZEIkQ0Zmgp5pKMQAAAM8"]
[Mon Apr 13 18:17:24.114090 2026] [:error] [pid 57183:tid 57205] [client 45.130.202.60:61453] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "adzCtDDO3t8R5NaxzYT0CQAAAVQ"]
[Mon Apr 13 18:17:25.177318 2026] [:error] [pid 57183:tid 57199] [client 45.130.202.85:65027] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Mon Apr 13 18:17:26.533798 2026] [:error] [pid 57183:tid 57188] [client 45.130.202.85:65027] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adzCtjDO3t8R5NaxzYT0EAAAAUM"]
[Mon Apr 13 18:17:29.910098 2026] [:error] [pid 63311:tid 63392] [client 45.130.202.101:52893] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adzCuaHjrGN1MqBCVFnfiwAAAJU"]
[Mon Apr 13 18:17:31.314806 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.72:64035] [client 45.130.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adzCuzDO3t8R5NaxzYT0HAAAAUs"]
[Mon Apr 13 18:17:33.089834 2026] [:error] [pid 57183:tid 57203] [client 45.130.202.102:62371] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adzCvTDO3t8R5NaxzYT0LwAAAVI"]
[Mon Apr 13 18:17:36.449365 2026] [:error] [pid 9314:tid 9334] [client 45.130.202.80:35869] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adzCwG_r4W8fX2GWyGTiNwAAAZI"]
[Mon Apr 13 18:17:37.503280 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.104:51303] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adzCwbHZEIkQ0Zmgp5pKmgAAAMs"]
[Mon Apr 13 18:17:39.457506 2026] [:error] [pid 9314:tid 9338] [client 45.130.202.77:40809] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adzCw2_r4W8fX2GWyGTiPAAAAZY"]
[Mon Apr 13 18:17:40.576042 2026] [:error] [pid 63311:tid 63391] [client 45.130.202.83:49853] [client 45.130.202.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adzCxKHjrGN1MqBCVFnfjQAAAJQ"]
[Mon Apr 13 18:17:42.145145 2026] [:error] [pid 7228:tid 7246] [client 45.130.202.74:46533] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adzCxgEnn1dQrOSHHNVsDAAAARA"]
[Mon Apr 13 18:17:43.322858 2026] [:error] [pid 9314:tid 9328] [client 45.130.202.85:34357] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-file.php"] [unique_id "adzCx2_r4W8fX2GWyGTiPwAAAYw"]
[Mon Apr 13 18:17:44.442010 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.57:34563] [client 45.130.202.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.57, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adzCyDDO3t8R5NaxzYT0UAAAAUs"]
[Mon Apr 13 18:17:44.445620 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.57:34563] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Mon Apr 13 18:17:44.722492 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.57:34563] [client 45.130.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "adzCyDDO3t8R5NaxzYT0UgAAAUI"]
[Mon Apr 13 18:17:46.021862 2026] [:error] [pid 7228:tid 7232] [client 45.130.202.54:43667] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Mon Apr 13 18:17:46.282707 2026] [:error] [pid 7228:tid 7240] [client 45.130.202.54:43667] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adzCygEnn1dQrOSHHNVsHwAAAQo"]
[Mon Apr 13 18:17:47.703123 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.98:31455] [client 45.130.202.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "adzCy7HZEIkQ0Zmgp5pKuwAAAMU"]
[Mon Apr 13 18:17:48.892204 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.90:21613] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Mon Apr 13 18:17:50.816119 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.90:21613] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adzCzrHZEIkQ0Zmgp5pK4gAAAMI"]
[Mon Apr 13 18:17:51.842153 2026] [:error] [pid 57183:tid 57186] [client 45.130.202.90:36421] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "adzCzzDO3t8R5NaxzYT0bAAAAUE"]
[Mon Apr 13 18:17:53.394282 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.105:38043] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adzC0TDO3t8R5NaxzYT0eQAAAUI"]
[Mon Apr 13 18:17:55.750041 2026] [:error] [pid 9314:tid 9317] [client 45.130.202.100:23219] [client 45.130.202.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/install.php"] [unique_id "adzC02_r4W8fX2GWyGTiVAAAAYE"]
[Mon Apr 13 18:17:57.102752 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.64:54559] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Mon Apr 13 18:17:57.342229 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.64:54559] [client 45.130.202.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.64, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adzC1bHZEIkQ0Zmgp5pLGQAAAMY"]
[Mon Apr 13 18:17:57.887295 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.64:54559] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adzC1bHZEIkQ0Zmgp5pLHQAAANc"]
[Mon Apr 13 18:18:00.032442 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.54:21475] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adzC2LHZEIkQ0Zmgp5pLNwAAANE"]
[Mon Apr 13 18:18:00.948166 2026] [:error] [pid 7228:tid 7231] [client 45.130.202.72:35601] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Mon Apr 13 18:18:01.190330 2026] [:error] [pid 7228:tid 7252] [client 45.130.202.72:35601] [client 45.130.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adzC2QEnn1dQrOSHHNVsSgAAARY"]
[Mon Apr 13 18:18:02.853757 2026] [:error] [pid 63311:tid 63385] [client 45.130.202.105:22903] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adzC2qHjrGN1MqBCVFnfzQAAAI4"]
[Mon Apr 13 18:18:04.277422 2026] [:error] [pid 63406:tid 63418] [client 45.130.202.67:34695] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Mon Apr 13 18:18:05.051923 2026] [:error] [pid 63406:tid 63415] [client 45.130.202.67:34695] [client 45.130.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adzC3bHZEIkQ0Zmgp5pLVwAAAMQ"]
[Mon Apr 13 18:18:07.316343 2026] [:error] [pid 7228:tid 7240] [client 45.130.202.95:60507] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adzC3wEnn1dQrOSHHNVsVgAAAQo"]
[Mon Apr 13 18:18:08.437464 2026] [:error] [pid 9314:tid 9330] [client 45.130.202.71:40123] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Mon Apr 13 18:18:09.007274 2026] [:error] [pid 9314:tid 9323] [client 45.130.202.71:40123] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Mon Apr 13 18:18:09.536701 2026] [:error] [pid 9314:tid 9319] [client 45.130.202.71:40123] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adzC4W_r4W8fX2GWyGTigQAAAYM"]
[Mon Apr 13 18:18:10.485738 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.106:45481] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "adzC4rHZEIkQ0Zmgp5pLZQAAANY"]
[Mon Apr 13 18:18:11.591187 2026] [:error] [pid 63309:tid 63327] [client 45.130.202.65:24793] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/count.php"] [unique_id "adzC40pIKZ10weXpf0UPfwAAAA4"]
[Mon Apr 13 18:18:12.706616 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.77:41841] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Mon Apr 13 18:18:14.307243 2026] [:error] [pid 57183:tid 57209] [client 45.130.202.77:41841] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adzC5jDO3t8R5NaxzYT0xQAAAVg"]
[Mon Apr 13 18:18:51.305842 2026] [autoindex:error] [pid 9314:tid 9329] [client 45.130.202.107:57341] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 18:19:25.237735 2026] [:error] [pid 63406:tid 63418] [client 45.130.202.89:36249] [client 45.130.202.89] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "45.130.202.102_1326ef8602c7a8c29703a9e7b72acb90eb33ef85"): Internal error (specific information not available) [hostname "rejuva.au"] [uri "/index.html"] [unique_id "adzDKbHZEIkQ0Zmgp5pMqQAAAMc"]
[Mon Apr 13 20:40:43.853761 2026] [:error] [pid 57183:tid 57209] [client 103.77.107.178:62878] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "adzkSzDO3t8R5NaxzYQ8kQAAAVg"]
[Mon Apr 13 20:40:44.056320 2026] [:error] [pid 63310:tid 63344] [client 103.77.107.178:62889] [client 103.77.107.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "adzkTHoXpRU5ztmwPjJYZgAAAEA"]
[Mon Apr 13 23:38:10.464771 2026] [:error] [pid 63406:tid 63424] [client 43.165.69.68:37898] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad0N4rHZEIkQ0Zmgp5ozbwAAAM0"]
[Tue Apr 14 01:20:44.759749 2026] [:error] [pid 60317:tid 60340] [client 114.96.103.33:42882] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad0l7LBo7Bc8I7P_P--CFwAAAMA"]
[Tue Apr 14 06:33:54.715909 2026] [:error] [pid 37226:tid 37238] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 14 06:33:55.009730 2026] [:error] [pid 37226:tid 37233] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Apr 14 06:33:55.299701 2026] [:error] [pid 37226:tid 37228] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 14 06:33:55.589970 2026] [:error] [pid 37226:tid 37235] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Apr 14 06:33:55.900965 2026] [:error] [pid 37226:tid 37229] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 14 06:33:56.186147 2026] [:error] [pid 37226:tid 37250] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 14 06:33:56.500432 2026] [:error] [pid 37226:tid 37245] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 14 06:33:56.785772 2026] [:error] [pid 37226:tid 37229] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 14 06:33:57.354788 2026] [:error] [pid 37226:tid 37251] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Apr 14 06:33:57.656575 2026] [:error] [pid 37226:tid 37230] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 14 06:33:57.946173 2026] [:error] [pid 37226:tid 37251] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 14 06:33:58.240431 2026] [:error] [pid 37226:tid 37246] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 14 06:33:58.542904 2026] [:error] [pid 37226:tid 37244] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 14 06:33:58.834858 2026] [:error] [pid 37226:tid 37228] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Apr 14 06:33:59.159866 2026] [:error] [pid 37226:tid 37239] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Apr 14 06:33:59.446275 2026] [:error] [pid 37226:tid 37236] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 14 06:33:59.737561 2026] [:error] [pid 37226:tid 37232] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 14 06:34:00.027277 2026] [:error] [pid 37226:tid 37249] [client 185.82.72.130:33107] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 14 06:34:04.151734 2026] [:error] [pid 37226:tid 37247] [client 185.82.72.130:33107] [client 185.82.72.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ad1vXJOA5-IQ0IVmQCprcgAAAVM"]
[Tue Apr 14 06:34:05.505870 2026] [:error] [pid 35628:tid 35637] [client 185.82.72.129:59913] [client 185.82.72.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ad1vXefPm-ozGuwCWXJ-iwAAAAU"]
[Tue Apr 14 06:34:06.847862 2026] [:error] [pid 35628:tid 35650] [client 185.82.72.154:40521] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 14 06:34:07.661400 2026] [:error] [pid 35628:tid 35633] [client 185.82.72.154:40521] [client 185.82.72.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "ad1vX-fPm-ozGuwCWXJ-pgAAAAE"]
[Tue Apr 14 06:34:08.742664 2026] [:error] [pid 35629:tid 35659] [client 185.82.72.197:44543] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Apr 14 06:34:09.009142 2026] [:error] [pid 35629:tid 35668] [client 185.82.72.197:44543] [client 185.82.72.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "ad1vYTY8VahzC1YJBSiNAgAAAEk"]
[Tue Apr 14 06:34:09.821890 2026] [:error] [pid 37226:tid 37250] [client 185.82.72.122:25509] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Apr 14 06:34:11.182574 2026] [:error] [pid 37226:tid 37229] [client 185.82.72.122:25509] [client 185.82.72.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ad1vY5OA5-IQ0IVmQCpryAAAAUE"]
[Tue Apr 14 06:34:11.995339 2026] [:error] [pid 35628:tid 35655] [client 185.82.72.193:46123] [client 185.82.72.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ad1vY-fPm-ozGuwCWXJ-2AAAABc"]
[Tue Apr 14 06:34:12.535697 2026] [:error] [pid 37048:tid 37055] [client 185.82.72.136:56565] [client 185.82.72.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ad1vZJ52Bo1OyzeXo_xSdwAAAQU"]
[Tue Apr 14 06:34:14.245560 2026] [:error] [pid 35630:tid 35709] [client 185.82.72.129:25275] [client 185.82.72.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ad1vZjer0pVFxOiOauWMYAAAAJc"]
[Tue Apr 14 06:34:14.793442 2026] [:error] [pid 35713:tid 35738] [client 185.82.72.158:37879] [client 185.82.72.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ad1vZq6-hhx6ZepqOSlNkQAAANY"]
[Tue Apr 14 06:34:15.325633 2026] [:error] [pid 37226:tid 37252] [client 185.82.72.172:59319] [client 185.82.72.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ad1vZ5OA5-IQ0IVmQCpr_QAAAVg"]
[Tue Apr 14 06:34:16.151059 2026] [:error] [pid 37226:tid 37252] [client 185.82.72.166:28745] [client 185.82.72.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ad1vaJOA5-IQ0IVmQCpsCAAAAVg"]
[Tue Apr 14 06:34:16.714370 2026] [:error] [pid 37226:tid 37245] [client 185.82.72.167:53227] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Apr 14 06:34:17.287168 2026] [:error] [pid 37226:tid 37247] [client 185.82.72.167:53227] [client 185.82.72.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "ad1vaZOA5-IQ0IVmQCpsGgAAAVM"]
[Tue Apr 14 06:34:18.386902 2026] [:error] [pid 37226:tid 37231] [client 185.82.72.152:54243] [client 185.82.72.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ad1vapOA5-IQ0IVmQCpsLAAAAUM"]
[Tue Apr 14 06:34:19.231302 2026] [:error] [pid 35630:tid 35708] [client 185.82.72.120:60351] [client 185.82.72.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ad1vazer0pVFxOiOauWMoQAAAJY"]
[Tue Apr 14 06:34:19.831886 2026] [:error] [pid 35630:tid 35688] [client 185.82.72.153:21593] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Apr 14 06:34:20.111716 2026] [:error] [pid 35630:tid 35693] [client 185.82.72.153:21593] [client 185.82.72.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ad1vbDer0pVFxOiOauWMrQAAAIc"]
[Tue Apr 14 06:34:20.651887 2026] [:error] [pid 35629:tid 35676] [client 185.82.72.175:44175] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 14 06:34:21.492415 2026] [:error] [pid 35629:tid 35682] [client 185.82.72.175:44175] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 14 06:34:26.498533 2026] [:error] [pid 35629:tid 35664] [client 185.82.72.175:44175] [client 185.82.72.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ad1vcjY8VahzC1YJBSiNuAAAAEU"]
[Tue Apr 14 06:34:27.047948 2026] [:error] [pid 35630:tid 35705] [client 185.82.72.140:29861] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Apr 14 06:34:27.323928 2026] [:error] [pid 35630:tid 35696] [client 185.82.72.140:29861] [client 185.82.72.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ad1vczer0pVFxOiOauWM6gAAAIo"]
[Tue Apr 14 06:34:27.879381 2026] [:error] [pid 35630:tid 35705] [client 185.82.72.151:52063] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Apr 14 06:34:28.419433 2026] [:error] [pid 35630:tid 35708] [client 185.82.72.151:52063] [client 185.82.72.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "ad1vdDer0pVFxOiOauWM_AAAAJY"]
[Tue Apr 14 06:34:29.240491 2026] [:error] [pid 37048:tid 37054] [client 185.82.72.195:31727] [client 185.82.72.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "ad1vdZ52Bo1OyzeXo_xTTQAAAQQ"]
[Tue Apr 14 06:34:30.070549 2026] [:error] [pid 35629:tid 35674] [client 185.82.72.168:35061] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue Apr 14 06:34:30.344712 2026] [:error] [pid 35629:tid 35661] [client 185.82.72.168:35061] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Apr 14 06:34:30.913777 2026] [:error] [pid 35629:tid 35666] [client 185.82.72.168:35061] [client 185.82.72.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ad1vdjY8VahzC1YJBSiN5QAAAEc"]
[Tue Apr 14 06:34:32.925508 2026] [:error] [pid 37048:tid 37051] [client 185.82.72.168:40883] [client 185.82.72.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "ad1veJ52Bo1OyzeXo_xTjgAAAQE"]
[Tue Apr 14 06:34:33.728489 2026] [:error] [pid 35628:tid 35650] [client 185.82.72.12:44007] [client 185.82.72.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "ad1veefPm-ozGuwCWXJ_9AAAABI"]
[Tue Apr 14 06:34:34.276571 2026] [:error] [pid 35629:tid 35664] [client 185.82.72.191:21699] [client 185.82.72.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "ad1vejY8VahzC1YJBSiOBAAAAEU"]
[Tue Apr 14 06:34:34.810739 2026] [:error] [pid 35629:tid 35674] [client 185.82.72.118:51073] [client 185.82.72.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ad1vejY8VahzC1YJBSiOBwAAAE8"]
[Tue Apr 14 06:34:35.899398 2026] [:error] [pid 35713:tid 35734] [client 185.82.72.120:49711] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Apr 14 06:34:36.167528 2026] [:error] [pid 35713:tid 35728] [client 185.82.72.120:49711] [client 185.82.72.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "ad1vfK6-hhx6ZepqOSlOdwAAAMw"]
[Tue Apr 14 06:34:36.699894 2026] [:error] [pid 37048:tid 37061] [client 185.82.72.12:39397] [client 185.82.72.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "ad1vfJ52Bo1OyzeXo_xT1wAAAQs"]
[Tue Apr 14 06:34:37.234364 2026] [:error] [pid 37226:tid 37250] [client 185.82.72.165:65007] [client 185.82.72.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ad1vfZOA5-IQ0IVmQCptPAAAAVY"]
[Tue Apr 14 06:34:38.332374 2026] [:error] [pid 37226:tid 37233] [client 185.82.72.136:59001] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Apr 14 06:34:38.881307 2026] [:error] [pid 37226:tid 37236] [client 185.82.72.136:59001] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Apr 14 06:34:40.001700 2026] [:error] [pid 37226:tid 37238] [client 185.82.72.136:59001] [client 185.82.72.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "ad1vgJOA5-IQ0IVmQCptoQAAAUo"]
[Tue Apr 14 06:34:41.365879 2026] [:error] [pid 37226:tid 37247] [client 185.82.72.133:32399] [client 185.82.72.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.133, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "ad1vgZOA5-IQ0IVmQCptzQAAAVM"]
[Tue Apr 14 06:34:41.643982 2026] [:error] [pid 37226:tid 37238] [client 185.82.72.133:32399] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Apr 14 06:34:43.055872 2026] [:error] [pid 37226:tid 37252] [client 185.82.72.133:32399] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Apr 14 06:34:43.327514 2026] [:error] [pid 37226:tid 37245] [client 185.82.72.133:32399] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Apr 14 06:34:44.701480 2026] [:error] [pid 37226:tid 37233] [client 185.82.72.133:32399] [client 185.82.72.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "ad1vhJOA5-IQ0IVmQCpuMAAAAUU"]
[Tue Apr 14 06:34:45.510807 2026] [:error] [pid 35629:tid 35683] [client 185.82.72.134:32175] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Apr 14 06:34:45.779847 2026] [:error] [pid 35629:tid 35665] [client 185.82.72.134:32175] [client 185.82.72.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.134, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "ad1vhTY8VahzC1YJBSiOVwAAAEY"]
[Tue Apr 14 06:34:46.344749 2026] [:error] [pid 35629:tid 35668] [client 185.82.72.134:32175] [client 185.82.72.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "ad1vhjY8VahzC1YJBSiOWwAAAEk"]
[Tue Apr 14 06:34:49.111291 2026] [:error] [pid 35629:tid 35679] [client 185.82.72.118:39235] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 14 06:34:49.694043 2026] [:error] [pid 35629:tid 35668] [client 185.82.72.118:39235] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Tue Apr 14 06:34:50.270601 2026] [:error] [pid 35629:tid 35682] [client 185.82.72.118:39235] [client 185.82.72.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "ad1vijY8VahzC1YJBSiOfwAAAFc"]
[Tue Apr 14 06:34:50.830938 2026] [:error] [pid 35713:tid 35718] [client 185.82.72.131:21749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 14 06:34:51.659729 2026] [:error] [pid 35713:tid 35718] [client 185.82.72.131:21749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Tue Apr 14 06:34:52.211616 2026] [:error] [pid 35713:tid 35718] [client 185.82.72.131:21749] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue Apr 14 06:34:52.768723 2026] [:error] [pid 35713:tid 35719] [client 185.82.72.131:21749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 14 06:34:53.041153 2026] [:error] [pid 35713:tid 35717] [client 185.82.72.131:21749] [client 185.82.72.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "ad1vja6-hhx6ZepqOSlPPgAAAME"]
[Tue Apr 14 06:34:56.752093 2026] [:error] [pid 37048:tid 37050] [client 185.82.72.136:60065] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Tue Apr 14 06:34:57.025842 2026] [:error] [pid 37048:tid 37058] [client 185.82.72.136:60065] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Apr 14 06:34:57.294056 2026] [:error] [pid 37048:tid 37059] [client 185.82.72.136:60065] [client 185.82.72.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "ad1vkZ52Bo1OyzeXo_xVJAAAAQk"]
[Tue Apr 14 06:34:58.116333 2026] [:error] [pid 35629:tid 35663] [client 185.82.72.162:54035] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Apr 14 06:34:58.657421 2026] [:error] [pid 35629:tid 35682] [client 185.82.72.162:54035] [client 185.82.72.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.162, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "ad1vkjY8VahzC1YJBSiOvQAAAFc"]
[Tue Apr 14 06:34:58.930385 2026] [:error] [pid 35629:tid 35667] [client 185.82.72.162:54035] [client 185.82.72.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "ad1vkjY8VahzC1YJBSiOwQAAAEg"]
[Tue Apr 14 06:35:03.552024 2026] [:error] [pid 37226:tid 37244] [client 185.82.72.172:24499] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Tue Apr 14 06:35:08.033054 2026] [:error] [pid 37226:tid 37252] [client 185.82.72.172:24499] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Apr 14 06:35:08.312524 2026] [:error] [pid 37226:tid 37251] [client 185.82.72.172:24499] [client 185.82.72.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "ad1vnJOA5-IQ0IVmQCpv3gAAAVc"]
[Tue Apr 14 06:35:08.851067 2026] [:error] [pid 35713:tid 35731] [client 185.82.72.11:51071] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Apr 14 06:35:09.681308 2026] [:error] [pid 35713:tid 35723] [client 185.82.72.11:51071] [client 185.82.72.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.11, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "ad1vna6-hhx6ZepqOSlQfgAAAMc"]
[Tue Apr 14 06:35:09.959999 2026] [:error] [pid 35713:tid 35726] [client 185.82.72.11:51071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Apr 14 06:35:10.240190 2026] [:error] [pid 35713:tid 35738] [client 185.82.72.11:51071] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Apr 14 06:35:10.519941 2026] [:error] [pid 35713:tid 35735] [client 185.82.72.11:51071] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Tue Apr 14 06:35:10.793087 2026] [:error] [pid 35713:tid 35738] [client 185.82.72.11:51071] [client 185.82.72.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "ad1vnq6-hhx6ZepqOSlQkgAAANY"]
[Tue Apr 14 06:35:11.361210 2026] [:error] [pid 35630:tid 35710] [client 185.82.72.167:42691] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Apr 14 06:35:11.641528 2026] [:error] [pid 35630:tid 35708] [client 185.82.72.167:42691] [client 185.82.72.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "ad1vnzer0pVFxOiOauWO0gAAAJY"]
[Tue Apr 14 06:35:12.458604 2026] [:error] [pid 35713:tid 35716] [client 185.82.72.118:34631] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Apr 14 06:35:12.726434 2026] [:error] [pid 35713:tid 35716] [client 185.82.72.118:34631] [client 185.82.72.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "ad1voK6-hhx6ZepqOSlQyAAAAMA"]
[Tue Apr 14 06:35:14.910121 2026] [:error] [pid 35630:tid 35696] [client 185.82.72.129:31213] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Apr 14 06:35:15.191047 2026] [:error] [pid 35630:tid 35709] [client 185.82.72.129:31213] [client 185.82.72.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "ad1vozer0pVFxOiOauWO-AAAAJc"]
[Tue Apr 14 06:35:15.733364 2026] [:error] [pid 37048:tid 37057] [client 185.82.72.114:33939] [client 185.82.72.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "ad1vo552Bo1OyzeXo_xV-AAAAQc"]
[Tue Apr 14 06:35:16.292903 2026] [:error] [pid 35713:tid 35736] [client 185.82.72.154:53109] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue Apr 14 06:35:16.586476 2026] [:error] [pid 35713:tid 35729] [client 185.82.72.154:53109] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Tue Apr 14 06:35:17.724133 2026] [:error] [pid 35713:tid 35725] [client 185.82.72.154:53109] [client 185.82.72.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "ad1vpa6-hhx6ZepqOSlRKQAAAMk"]
[Tue Apr 14 06:35:18.531661 2026] [:error] [pid 37226:tid 37238] [client 185.82.72.131:48989] [client 185.82.72.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "ad1vppOA5-IQ0IVmQCpwSgAAAUo"]
[Tue Apr 14 06:35:19.988638 2026] [:error] [pid 37226:tid 37231] [client 185.82.72.168:34087] [client 185.82.72.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "ad1vp5OA5-IQ0IVmQCpwWwAAAUM"]
[Tue Apr 14 06:35:20.539511 2026] [:error] [pid 35629:tid 35668] [client 185.82.72.118:59513] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Apr 14 06:35:21.092340 2026] [:error] [pid 35629:tid 35660] [client 185.82.72.118:59513] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Apr 14 06:35:21.366539 2026] [:error] [pid 35629:tid 35677] [client 185.82.72.118:59513] [client 185.82.72.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "ad1vqTY8VahzC1YJBSiPmQAAAFI"]
[Tue Apr 14 06:35:23.029567 2026] [:error] [pid 35630:tid 35699] [client 185.82.72.144:30315] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Apr 14 06:35:23.569549 2026] [:error] [pid 35630:tid 35693] [client 185.82.72.144:30315] [client 185.82.72.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "ad1vqzer0pVFxOiOauWPlgAAAIc"]
[Tue Apr 14 06:35:24.941356 2026] [:error] [pid 37226:tid 37239] [client 185.82.72.154:46317] [client 185.82.72.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "ad1vrJOA5-IQ0IVmQCpwlAAAAUs"]
[Tue Apr 14 06:35:25.762801 2026] [:error] [pid 35630:tid 35708] [client 185.82.72.194:37349] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 14 06:35:26.579521 2026] [:error] [pid 35630:tid 35706] [client 185.82.72.194:37349] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Apr 14 06:35:27.140192 2026] [:error] [pid 35630:tid 35703] [client 185.82.72.194:37349] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 14 06:35:27.408208 2026] [:error] [pid 35630:tid 35692] [client 185.82.72.194:37349] [client 185.82.72.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "ad1vrzer0pVFxOiOauWP2wAAAIY"]
[Tue Apr 14 06:35:27.951302 2026] [:error] [pid 37226:tid 37247] [client 185.82.72.11:28265] [client 185.82.72.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "ad1vr5OA5-IQ0IVmQCpw7AAAAVM"]
[Tue Apr 14 06:35:28.492247 2026] [:error] [pid 37048:tid 37075] [client 185.82.72.140:26565] [client 185.82.72.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "ad1vsJ52Bo1OyzeXo_xWmAAAARg"]
[Tue Apr 14 06:35:29.088136 2026] [:error] [pid 35628:tid 35651] [client 185.82.72.130:59367] [client 185.82.72.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "ad1vsefPm-ozGuwCWXKCogAAABM"]
[Tue Apr 14 06:35:29.624998 2026] [:error] [pid 35630:tid 35694] [client 185.82.72.134:42149] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Tue Apr 14 06:35:29.900301 2026] [:error] [pid 35630:tid 35701] [client 185.82.72.134:42149] [client 185.82.72.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "ad1vsTer0pVFxOiOauWQBgAAAI8"]
[Tue Apr 14 06:35:30.452470 2026] [:error] [pid 35628:tid 35652] [client 185.82.72.171:34995] [client 185.82.72.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "ad1vsufPm-ozGuwCWXKCtwAAABQ"]
[Tue Apr 14 06:35:31.007644 2026] [:error] [pid 35629:tid 35662] [client 185.82.72.153:39561] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 14 06:35:31.573941 2026] [:error] [pid 35629:tid 35666] [client 185.82.72.153:39561] [client 185.82.72.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "ad1vszY8VahzC1YJBSiP8gAAAEc"]
[Tue Apr 14 06:35:32.131778 2026] [:error] [pid 35628:tid 35640] [client 185.82.72.164:49353] [client 185.82.72.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "ad1vtOfPm-ozGuwCWXKC4wAAAAg"]
[Tue Apr 14 06:35:32.690385 2026] [:error] [pid 37226:tid 37233] [client 185.82.72.194:36873] [client 185.82.72.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "ad1vtJOA5-IQ0IVmQCpxKwAAAUU"]
[Tue Apr 14 06:35:33.224862 2026] [:error] [pid 35630:tid 35708] [client 185.82.72.151:42037] [client 185.82.72.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "ad1vtTer0pVFxOiOauWQOgAAAJY"]
[Tue Apr 14 06:35:34.029583 2026] [:error] [pid 35630:tid 35702] [client 185.82.72.138:63335] [client 185.82.72.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "ad1vtjer0pVFxOiOauWQUgAAAJA"]
[Tue Apr 14 06:35:35.121944 2026] [:error] [pid 37226:tid 37241] [client 185.82.72.11:53269] [client 185.82.72.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "ad1vt5OA5-IQ0IVmQCpxUwAAAU0"]
[Tue Apr 14 06:35:39.940641 2026] [:error] [pid 35629:tid 35681] [client 185.82.72.130:43429] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue Apr 14 06:35:40.790102 2026] [:error] [pid 35629:tid 35683] [client 185.82.72.130:43429] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue Apr 14 06:35:41.062252 2026] [:error] [pid 35629:tid 35665] [client 185.82.72.130:43429] [client 185.82.72.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "ad1vvTY8VahzC1YJBSiQiAAAAEY"]
[Tue Apr 14 06:35:41.888007 2026] [:error] [pid 35713:tid 35731] [client 185.82.72.121:51695] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Apr 14 06:35:42.181636 2026] [:error] [pid 35713:tid 35739] [client 185.82.72.121:51695] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Apr 14 06:35:43.571312 2026] [:error] [pid 35713:tid 35723] [client 185.82.72.121:51695] [client 185.82.72.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "ad1vv66-hhx6ZepqOSlTeQAAAMc"]
[Tue Apr 14 06:35:44.971965 2026] [:error] [pid 37226:tid 37238] [client 185.82.72.151:43891] [client 185.82.72.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "ad1vwJOA5-IQ0IVmQCpyEAAAAUo"]
[Tue Apr 14 06:35:45.525163 2026] [:error] [pid 35713:tid 35726] [client 185.82.72.117:40257] [client 185.82.72.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "ad1vwa6-hhx6ZepqOSlTqAAAAMo"]
[Tue Apr 14 06:35:47.171542 2026] [:error] [pid 37048:tid 37070] [client 185.82.72.165:37031] [client 185.82.72.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ad1vw552Bo1OyzeXo_xXfAAAARM"]
[Tue Apr 14 06:35:48.259911 2026] [:error] [pid 35628:tid 35642] [client 185.82.72.140:36519] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Apr 14 06:35:48.529308 2026] [:error] [pid 35628:tid 35649] [client 185.82.72.140:36519] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Tue Apr 14 06:35:48.813473 2026] [:error] [pid 35628:tid 35644] [client 185.82.72.140:36519] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Tue Apr 14 06:35:49.088842 2026] [:error] [pid 35628:tid 35641] [client 185.82.72.140:36519] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Tue Apr 14 06:35:50.474623 2026] [:error] [pid 35628:tid 35641] [client 185.82.72.140:36519] [client 185.82.72.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "ad1vxufPm-ozGuwCWXKD9gAAAAk"]
[Tue Apr 14 06:35:52.041615 2026] [:error] [pid 37048:tid 37067] [client 185.82.72.160:64515] [client 185.82.72.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "ad1vyJ52Bo1OyzeXo_xXzgAAARE"]
[Tue Apr 14 06:35:52.576414 2026] [:error] [pid 35629:tid 35669] [client 185.82.72.12:47163] [client 185.82.72.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "ad1vyDY8VahzC1YJBSiRMAAAAEo"]
[Tue Apr 14 06:35:53.119561 2026] [:error] [pid 35713:tid 35721] [client 185.82.72.174:33899] [client 185.82.72.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "ad1vya6-hhx6ZepqOSlUPgAAAMU"]
[Tue Apr 14 06:35:53.682434 2026] [:error] [pid 35630:tid 35697] [client 185.82.72.158:56825] [client 185.82.72.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "ad1vyTer0pVFxOiOauWRUgAAAIs"]
[Tue Apr 14 06:35:54.218485 2026] [:error] [pid 35629:tid 35680] [client 185.82.72.152:52321] [client 185.82.72.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "ad1vyjY8VahzC1YJBSiRRgAAAFU"]
[Tue Apr 14 06:35:55.063326 2026] [:error] [pid 35629:tid 35671] [client 185.82.72.136:60579] [client 185.82.72.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "ad1vyzY8VahzC1YJBSiRVQAAAEw"]
[Tue Apr 14 06:35:55.608796 2026] [:error] [pid 35713:tid 35717] [client 185.82.72.175:21021] [client 185.82.72.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "ad1vy66-hhx6ZepqOSlUbgAAAME"]
[Tue Apr 14 06:35:56.168210 2026] [:error] [pid 35628:tid 35632] [client 185.82.72.149:40415] [client 185.82.72.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ad1vzOfPm-ozGuwCWXKELQAAAAA"]
[Tue Apr 14 06:35:56.700467 2026] [:error] [pid 35628:tid 35636] [client 185.82.72.147:51181] [client 185.82.72.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "ad1vzOfPm-ozGuwCWXKEMgAAAAQ"]
[Tue Apr 14 06:35:57.840101 2026] [:error] [pid 35713:tid 35719] [client 185.82.72.154:30059] [client 185.82.72.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "ad1vza6-hhx6ZepqOSlUkAAAAMM"]
[Tue Apr 14 06:35:58.659381 2026] [:error] [pid 37226:tid 37246] [client 185.82.72.117:31381] [client 185.82.72.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "ad1vzpOA5-IQ0IVmQCpyxwAAAVI"]
[Tue Apr 14 06:35:59.222902 2026] [:error] [pid 37226:tid 37234] [client 185.82.72.136:62761] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Apr 14 06:35:59.794470 2026] [:error] [pid 37226:tid 37244] [client 185.82.72.136:62761] [client 185.82.72.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "ad1vz5OA5-IQ0IVmQCpy0wAAAVA"]
[Tue Apr 14 06:36:00.899047 2026] [:error] [pid 35629:tid 35664] [client 185.82.72.151:43263] [client 185.82.72.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "ad1v0DY8VahzC1YJBSiRtwAAAEU"]
[Tue Apr 14 06:36:01.996875 2026] [:error] [pid 37048:tid 37075] [client 185.82.72.156:62759] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Apr 14 06:36:02.275169 2026] [:error] [pid 37048:tid 37057] [client 185.82.72.156:62759] [client 185.82.72.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "ad1v0p52Bo1OyzeXo_xYbgAAAQc"]
[Tue Apr 14 06:36:40.573952 2026] [autoindex:error] [pid 35713:tid 35716] [client 185.82.72.166:48447] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:59:16.057712 2026] [:error] [pid 35713:tid 35717] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Apr 14 06:59:16.328648 2026] [:error] [pid 35713:tid 35718] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Tue Apr 14 06:59:16.597824 2026] [:error] [pid 35713:tid 35720] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Apr 14 06:59:16.863721 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Tue Apr 14 06:59:17.154470 2026] [:error] [pid 35713:tid 35736] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Tue Apr 14 06:59:17.420756 2026] [:error] [pid 35713:tid 35729] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Tue Apr 14 06:59:17.708459 2026] [:error] [pid 35713:tid 35739] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Tue Apr 14 06:59:17.984870 2026] [:error] [pid 35713:tid 35716] [client 4.223.97.209:2684] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Tue Apr 14 06:59:18.254597 2026] [:error] [pid 35713:tid 35738] [client 4.223.97.209:2684] [client 4.223.97.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ad11Rq6-hhx6ZepqOSmTngAAANY"]
[Tue Apr 14 06:59:19.311475 2026] [:error] [pid 35630:tid 35695] [client 4.223.97.209:51305] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Tue Apr 14 06:59:19.574608 2026] [:error] [pid 35630:tid 35708] [client 4.223.97.209:51305] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Tue Apr 14 06:59:19.839700 2026] [:error] [pid 35630:tid 35690] [client 4.223.97.209:51305] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ad11Rzer0pVFxOiOauWtMAAAAIQ"]
[Tue Apr 14 06:59:23.520900 2026] [:error] [pid 35630:tid 35693] [client 4.223.97.209:51306] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ad11Szer0pVFxOiOauWtOgAAAIc"]
[Tue Apr 14 06:59:26.878302 2026] [:error] [pid 35629:tid 35661] [client 4.223.97.209:63796] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ad11TjY8VahzC1YJBSiodwAAAEI"]
[Tue Apr 14 06:59:30.238733 2026] [:error] [pid 35713:tid 35733] [client 4.223.97.209:63782] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ad11Uq6-hhx6ZepqOSmT1wAAANE"]
[Tue Apr 14 06:59:32.491632 2026] [:error] [pid 37048:tid 37051] [client 4.223.97.209:39111] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "ad11VJ52Bo1OyzeXo_x4TAAAAQE"]
[Tue Apr 14 06:59:34.796899 2026] [:error] [pid 35630:tid 35687] [client 4.223.97.209:54283] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "ad11Vjer0pVFxOiOauWtRAAAAIE"]
[Tue Apr 14 06:59:39.580855 2026] [:error] [pid 35629:tid 35679] [client 4.223.97.209:59510] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "ad11WzY8VahzC1YJBSiofAAAAFQ"]
[Tue Apr 14 06:59:41.838836 2026] [:error] [pid 35629:tid 35682] [client 4.223.97.209:2273] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "ad11XTY8VahzC1YJBSiofwAAAFc"]
[Tue Apr 14 06:59:47.009845 2026] [:error] [pid 35713:tid 35736] [client 4.223.97.209:47530] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "ad11Y66-hhx6ZepqOSmT-QAAANQ"]
[Tue Apr 14 06:59:48.978726 2026] [:error] [pid 35713:tid 35737] [client 4.223.97.209:2241] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "ad11ZK6-hhx6ZepqOSmT_gAAANU"]
[Tue Apr 14 06:59:50.984872 2026] [:error] [pid 37048:tid 37066] [client 4.223.97.209:39109] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "ad11Zp52Bo1OyzeXo_x4ZgAAARA"]
[Tue Apr 14 06:59:54.454937 2026] [:error] [pid 35713:tid 35737] [client 4.223.97.209:51314] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "ad11aq6-hhx6ZepqOSmUEQAAANU"]
[Tue Apr 14 07:00:02.061929 2026] [:error] [pid 35713:tid 35726] [client 4.223.97.209:63270] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "ad11cq6-hhx6ZepqOSmUKgAAAMo"]
[Tue Apr 14 07:00:07.723644 2026] [:error] [pid 35628:tid 35635] [client 4.223.97.209:40842] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "ad11d-fPm-ozGuwCWXKcMgAAAAM"]
[Tue Apr 14 07:00:09.702943 2026] [:error] [pid 35713:tid 35725] [client 4.223.97.209:40911] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "ad11ea6-hhx6ZepqOSmUOwAAAMk"]
[Tue Apr 14 07:00:11.904172 2026] [:error] [pid 37226:tid 37235] [client 4.223.97.209:44194] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "ad11e5OA5-IQ0IVmQCqfowAAAUc"]
[Tue Apr 14 07:00:21.004867 2026] [:error] [pid 37226:tid 37249] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Tue Apr 14 07:00:21.273334 2026] [:error] [pid 37226:tid 37248] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Tue Apr 14 07:00:21.554402 2026] [:error] [pid 37226:tid 37252] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Tue Apr 14 07:00:21.819874 2026] [:error] [pid 37226:tid 37231] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Tue Apr 14 07:00:22.085326 2026] [:error] [pid 37226:tid 37251] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Tue Apr 14 07:00:22.364075 2026] [:error] [pid 37226:tid 37229] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Tue Apr 14 07:00:22.909281 2026] [:error] [pid 37226:tid 37245] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue Apr 14 07:00:23.176531 2026] [:error] [pid 37226:tid 37247] [client 4.223.97.209:63259] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Tue Apr 14 07:00:23.779483 2026] [:error] [pid 37226:tid 37248] [client 4.223.97.209:63259] [client 4.223.97.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "ad11h5OA5-IQ0IVmQCqf1AAAAVQ"]
[Tue Apr 14 07:00:26.486220 2026] [:error] [pid 37048:tid 37069] [client 4.223.97.209:62769] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Tue Apr 14 07:00:26.751657 2026] [:error] [pid 37048:tid 37052] [client 4.223.97.209:62769] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "ad11ip52Bo1OyzeXo_x44QAAAQI"]
[Tue Apr 14 07:00:27.953753 2026] [:error] [pid 35713:tid 35719] [client 4.223.97.209:42911] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "ad11i66-hhx6ZepqOSmUTwAAAMM"]
[Tue Apr 14 07:00:30.759697 2026] [:error] [pid 37226:tid 37248] [client 4.223.97.209:49353] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "ad11jpOA5-IQ0IVmQCqf8gAAAVQ"]
[Tue Apr 14 07:00:31.681951 2026] [:error] [pid 37226:tid 37232] [client 4.223.97.209:50788] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "ad11j5OA5-IQ0IVmQCqf9gAAAUQ"]
[Tue Apr 14 07:00:34.311601 2026] [:error] [pid 35713:tid 35738] [client 4.223.97.209:42928] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ad11kq6-hhx6ZepqOSmUYgAAANY"]
[Tue Apr 14 07:00:45.180562 2026] [:error] [pid 35713:tid 35725] [client 4.223.97.209:60564] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ad11na6-hhx6ZepqOSmUeAAAAMk"]
[Tue Apr 14 07:00:48.097489 2026] [:error] [pid 37048:tid 37075] [client 4.223.97.209:60552] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad11oJ52Bo1OyzeXo_x5MQAAARg"]
[Tue Apr 14 07:00:50.488622 2026] [:error] [pid 37226:tid 37231] [client 4.223.97.209:45468] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad11opOA5-IQ0IVmQCqgBgAAAUM"]
[Tue Apr 14 07:00:51.970212 2026] [:error] [pid 37226:tid 37229] [client 4.223.97.209:48606] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad11o5OA5-IQ0IVmQCqgDAAAAUE"]
[Tue Apr 14 07:00:53.059472 2026] [:error] [pid 37226:tid 37246] [client 4.223.97.209:40263] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad11pZOA5-IQ0IVmQCqgDgAAAVI"]
[Tue Apr 14 07:00:54.447281 2026] [:error] [pid 35713:tid 35727] [client 4.223.97.209:39557] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/footer.php"] [unique_id "ad11pq6-hhx6ZepqOSmUkAAAAMs"]
[Tue Apr 14 07:00:55.395800 2026] [:error] [pid 35713:tid 35734] [client 4.223.97.209:2407] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/footer.php"] [unique_id "ad11p66-hhx6ZepqOSmUlQAAANI"]
[Tue Apr 14 07:00:57.343884 2026] [:error] [pid 35713:tid 35727] [client 4.223.97.209:48588] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/footer.php"] [unique_id "ad11qa6-hhx6ZepqOSmUnwAAAMs"]
[Tue Apr 14 07:00:59.861656 2026] [:error] [pid 35628:tid 35634] [client 4.223.97.209:2414] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/footer.php"] [unique_id "ad11q-fPm-ozGuwCWXKcdgAAAAI"]
[Tue Apr 14 07:01:04.071929 2026] [:error] [pid 35630:tid 35693] [client 4.223.97.209:59562] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "ad11sDer0pVFxOiOauWt5gAAAIc"]
[Tue Apr 14 07:01:06.864296 2026] [:error] [pid 35713:tid 35719] [client 4.223.97.209:42952] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "ad11sq6-hhx6ZepqOSmUwgAAAMM"]
[Tue Apr 14 07:01:14.441482 2026] [:error] [pid 35630:tid 35708] [client 4.223.97.209:49700] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "ad11ujer0pVFxOiOauWt_QAAAJY"]
[Tue Apr 14 07:01:17.999440 2026] [:error] [pid 37048:tid 37053] [client 4.223.97.209:44256] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "ad11vZ52Bo1OyzeXo_x5qQAAAQM"]
[Tue Apr 14 07:01:18.978024 2026] [:error] [pid 35713:tid 35717] [client 4.223.97.209:40240] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "ad11vq6-hhx6ZepqOSmVBgAAAME"]
[Tue Apr 14 07:01:25.610880 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:63827] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "ad11xa6-hhx6ZepqOSmVLwAAAMc"]
[Tue Apr 14 07:01:34.653784 2026] [:error] [pid 35713:tid 35728] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Tue Apr 14 07:01:34.917347 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Tue Apr 14 07:01:35.180037 2026] [:error] [pid 35713:tid 35720] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Tue Apr 14 07:01:35.456913 2026] [:error] [pid 35713:tid 35721] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Tue Apr 14 07:01:35.732514 2026] [:error] [pid 35713:tid 35722] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Tue Apr 14 07:01:36.145636 2026] [:error] [pid 35713:tid 35724] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 14 07:01:36.409151 2026] [:error] [pid 35713:tid 35740] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 14 07:01:36.691863 2026] [:error] [pid 35713:tid 35719] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Tue Apr 14 07:01:36.962180 2026] [:error] [pid 35713:tid 35725] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Apr 14 07:01:37.235771 2026] [:error] [pid 35713:tid 35720] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Tue Apr 14 07:01:37.531693 2026] [:error] [pid 35713:tid 35722] [client 4.223.97.209:53012] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Tue Apr 14 07:01:37.790946 2026] [:error] [pid 35713:tid 35724] [client 4.223.97.209:53012] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "ad110a6-hhx6ZepqOSmVdAAAAMg"]
[Tue Apr 14 07:01:41.164516 2026] [:error] [pid 37048:tid 37065] [client 4.223.97.209:47036] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "ad111Z52Bo1OyzeXo_x5uwAAAQ8"]
[Tue Apr 14 07:01:42.468482 2026] [:error] [pid 37048:tid 37050] [client 4.223.97.209:54354] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "ad111p52Bo1OyzeXo_x5wAAAAQA"]
[Tue Apr 14 07:01:46.236920 2026] [:error] [pid 35713:tid 35727] [client 4.223.97.209:44244] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "ad112q6-hhx6ZepqOSmVpwAAAMs"]
[Tue Apr 14 07:01:52.154567 2026] [:error] [pid 35713:tid 35729] [client 4.223.97.209:54353] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "ad114K6-hhx6ZepqOSmV1AAAAM0"]
[Tue Apr 14 07:01:55.458536 2026] [:error] [pid 35630:tid 35703] [client 4.223.97.209:40246] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "ad114zer0pVFxOiOauWuFgAAAJE"]
[Tue Apr 14 07:01:57.135917 2026] [:error] [pid 35713:tid 35718] [client 4.223.97.209:51901] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "ad115a6-hhx6ZepqOSmV5AAAAMI"]
[Tue Apr 14 07:02:03.658753 2026] [:error] [pid 35630:tid 35694] [client 4.223.97.209:47004] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1s7y8wt9dz.php"] [unique_id "ad116zer0pVFxOiOauWuHgAAAIg"]
[Tue Apr 14 07:02:06.286947 2026] [:error] [pid 37048:tid 37056] [client 4.223.97.209:51875] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1s7y8wt9dz.php"] [unique_id "ad117p52Bo1OyzeXo_x52wAAAQY"]
[Tue Apr 14 07:02:11.805744 2026] [:error] [pid 35713:tid 35732] [client 4.223.97.209:52353] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1s7y8wt9dz.php"] [unique_id "ad11866-hhx6ZepqOSmWOQAAANA"]
[Tue Apr 14 07:02:12.610036 2026] [:error] [pid 35713:tid 35720] [client 4.223.97.209:45006] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1s7y8wt9dz.php"] [unique_id "ad119K6-hhx6ZepqOSmWRQAAAMQ"]
[Tue Apr 14 07:02:13.859768 2026] [:error] [pid 35713:tid 35727] [client 4.223.97.209:54355] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bdktk.php"] [unique_id "ad119a6-hhx6ZepqOSmWUAAAAMs"]
[Tue Apr 14 07:02:14.833863 2026] [:error] [pid 35713:tid 35721] [client 4.223.97.209:52356] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bdktk.php"] [unique_id "ad119q6-hhx6ZepqOSmWVQAAAMU"]
[Tue Apr 14 07:02:16.241040 2026] [:error] [pid 37226:tid 37229] [client 4.223.97.209:54390] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bdktk.php"] [unique_id "ad11-JOA5-IQ0IVmQCqg5QAAAUE"]
[Tue Apr 14 07:02:19.066029 2026] [:error] [pid 35713:tid 35717] [client 4.223.97.209:54347] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bdktk.php"] [unique_id "ad11-66-hhx6ZepqOSmWbAAAAME"]
[Tue Apr 14 07:02:20.340862 2026] [:error] [pid 35713:tid 35732] [client 4.223.97.209:51850] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v5.php"] [unique_id "ad11_K6-hhx6ZepqOSmWcwAAANA"]
[Tue Apr 14 07:02:23.609527 2026] [:error] [pid 37226:tid 37236] [client 4.223.97.209:51865] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v5.php"] [unique_id "ad11_5OA5-IQ0IVmQCqg8gAAAUg"]
[Tue Apr 14 07:02:26.887522 2026] [:error] [pid 35630:tid 35695] [client 4.223.97.209:62363] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v5.php"] [unique_id "ad12Ajer0pVFxOiOauWuSQAAAIk"]
[Tue Apr 14 07:02:28.778832 2026] [:error] [pid 37226:tid 37243] [client 4.223.97.209:51862] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/v5.php"] [unique_id "ad12BJOA5-IQ0IVmQCqg-wAAAU8"]
[Tue Apr 14 07:02:30.243760 2026] [:error] [pid 35629:tid 35674] [client 4.223.97.209:51866] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ad12BjY8VahzC1YJBSipVQAAAE8"]
[Tue Apr 14 07:02:31.912664 2026] [:error] [pid 35629:tid 35666] [client 4.223.97.209:62389] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ad12BzY8VahzC1YJBSipVwAAAEc"]
[Tue Apr 14 07:02:34.680880 2026] [:error] [pid 35628:tid 35645] [client 4.223.97.209:62341] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ad12CufPm-ozGuwCWXKcswAAAA0"]
[Tue Apr 14 07:02:36.930391 2026] [:error] [pid 35630:tid 35704] [client 4.223.97.209:54340] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "ad12DDer0pVFxOiOauWuUgAAAJI"]
[Tue Apr 14 07:02:38.265864 2026] [:error] [pid 35713:tid 35735] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/ws87.php
[Tue Apr 14 07:02:38.543581 2026] [:error] [pid 35713:tid 35719] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Tue Apr 14 07:02:38.810051 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Tue Apr 14 07:02:39.074490 2026] [:error] [pid 35713:tid 35736] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Tue Apr 14 07:02:39.339509 2026] [:error] [pid 35713:tid 35737] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/006.php
[Tue Apr 14 07:02:39.626710 2026] [:error] [pid 35713:tid 35726] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Tue Apr 14 07:02:40.026481 2026] [:error] [pid 35713:tid 35717] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Tue Apr 14 07:02:40.292609 2026] [:error] [pid 35713:tid 35739] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/aios-bootstrap.php
[Tue Apr 14 07:02:40.576355 2026] [:error] [pid 35713:tid 35730] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Tue Apr 14 07:02:40.841634 2026] [:error] [pid 35713:tid 35731] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/gz.php
[Tue Apr 14 07:02:41.110522 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:54791] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Tue Apr 14 07:02:41.372064 2026] [:error] [pid 35713:tid 35736] [client 4.223.97.209:54791] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "ad12Ea6-hhx6ZepqOSmWsgAAANQ"]
[Tue Apr 14 07:02:42.221023 2026] [:error] [pid 35713:tid 35740] [client 4.223.97.209:57128] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "ad12Eq6-hhx6ZepqOSmWtQAAANg"]
[Tue Apr 14 07:02:46.550537 2026] [:error] [pid 35629:tid 35659] [client 4.223.97.209:54369] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "ad12FjY8VahzC1YJBSipbgAAAEA"]
[Tue Apr 14 07:02:52.662561 2026] [:error] [pid 37226:tid 37243] [client 4.223.97.209:54830] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "ad12HJOA5-IQ0IVmQCqhDwAAAU8"]
[Tue Apr 14 07:02:53.832358 2026] [:error] [pid 35713:tid 35736] [client 4.223.97.209:54784] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "ad12Ha6-hhx6ZepqOSmW1wAAANQ"]
[Tue Apr 14 07:02:54.770585 2026] [:error] [pid 35713:tid 35733] [client 4.223.97.209:2547] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "ad12Hq6-hhx6ZepqOSmW4AAAANE"]
[Tue Apr 14 07:02:56.776462 2026] [:error] [pid 35713:tid 35718] [client 4.223.97.209:2509] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "ad12IK6-hhx6ZepqOSmW7AAAAMI"]
[Tue Apr 14 07:02:58.546448 2026] [:error] [pid 35713:tid 35733] [client 4.223.97.209:51892] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "ad12Iq6-hhx6ZepqOSmW8AAAANE"]
[Tue Apr 14 07:02:59.675456 2026] [:error] [pid 35629:tid 35660] [client 4.223.97.209:51864] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad12IzY8VahzC1YJBSipfAAAAEE"]
[Tue Apr 14 07:03:00.692155 2026] [:error] [pid 35713:tid 35719] [client 4.223.97.209:62344] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad12JK6-hhx6ZepqOSmW9wAAAMM"]
[Tue Apr 14 07:03:02.567759 2026] [:error] [pid 35629:tid 35677] [client 4.223.97.209:51867] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad12JjY8VahzC1YJBSipggAAAFI"]
[Tue Apr 14 07:03:04.236530 2026] [:error] [pid 37048:tid 37054] [client 4.223.97.209:39648] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad12KJ52Bo1OyzeXo_x6CgAAAQQ"]
[Tue Apr 14 07:03:05.638637 2026] [:error] [pid 35628:tid 35655] [client 4.223.97.209:39630] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ga.php"] [unique_id "ad12KefPm-ozGuwCWXKc2gAAABc"]
[Tue Apr 14 07:03:06.822905 2026] [:error] [pid 35628:tid 35633] [client 4.223.97.209:51843] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ga.php"] [unique_id "ad12KufPm-ozGuwCWXKc2wAAAAE"]
[Tue Apr 14 07:03:11.890071 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:2537] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ga.php"] [unique_id "ad12L66-hhx6ZepqOSmXEQAAAMc"]
[Tue Apr 14 07:03:13.685133 2026] [:error] [pid 37226:tid 37229] [client 4.223.97.209:2557] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ga.php"] [unique_id "ad12MZOA5-IQ0IVmQCqhKwAAAUE"]
[Tue Apr 14 07:03:17.256354 2026] [:error] [pid 35713:tid 35732] [client 4.223.97.209:2518] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "ad12Na6-hhx6ZepqOSmXKwAAANA"]
[Tue Apr 14 07:03:23.848639 2026] [:error] [pid 37048:tid 37061] [client 4.223.97.209:64389] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "ad12O552Bo1OyzeXo_x6EwAAAQs"]
[Tue Apr 14 07:03:28.935833 2026] [:error] [pid 37226:tid 37248] [client 4.223.97.209:2543] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "ad12QJOA5-IQ0IVmQCqhPQAAAVQ"]
[Tue Apr 14 07:03:29.767355 2026] [:error] [pid 37226:tid 37242] [client 4.223.97.209:39634] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "ad12QZOA5-IQ0IVmQCqhQQAAAU4"]
[Tue Apr 14 07:03:33.714912 2026] [:error] [pid 37048:tid 37066] [client 4.223.97.209:2619] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "ad12RZ52Bo1OyzeXo_x6IQAAARA"]
[Tue Apr 14 07:03:35.987182 2026] [:error] [pid 35713:tid 35722] [client 4.223.97.209:48909] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "ad12R66-hhx6ZepqOSmXcQAAAMY"]
[Tue Apr 14 07:03:37.760771 2026] [:error] [pid 35713:tid 35725] [client 4.223.97.209:39068] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1100.php"] [unique_id "ad12Sa6-hhx6ZepqOSmXdgAAAMk"]
[Tue Apr 14 07:03:39.009383 2026] [:error] [pid 35713:tid 35726] [client 4.223.97.209:2585] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "ad12S66-hhx6ZepqOSmXegAAAMo"]
[Tue Apr 14 07:03:40.151805 2026] [:error] [pid 37226:tid 37237] [client 4.223.97.209:39639] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "ad12TJOA5-IQ0IVmQCqhSgAAAUk"]
[Tue Apr 14 07:03:40.904684 2026] [:error] [pid 37226:tid 37251] [client 4.223.97.209:57114] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "ad12TJOA5-IQ0IVmQCqhTQAAAVc"]
[Tue Apr 14 07:03:42.167367 2026] [:error] [pid 35713:tid 35737] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Tue Apr 14 07:03:42.450389 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 14 07:03:42.723278 2026] [:error] [pid 35713:tid 35733] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kz.php
[Tue Apr 14 07:03:42.987043 2026] [:error] [pid 35713:tid 35727] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lo.php
[Tue Apr 14 07:03:43.252289 2026] [:error] [pid 35713:tid 35717] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Tue Apr 14 07:03:43.530266 2026] [:error] [pid 35713:tid 35716] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/Ipv6.php
[Tue Apr 14 07:03:43.794580 2026] [:error] [pid 35713:tid 35739] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/file-gertdxz.php
[Tue Apr 14 07:03:44.061122 2026] [:error] [pid 35713:tid 35740] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Tue Apr 14 07:03:44.327019 2026] [:error] [pid 35713:tid 35735] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Tue Apr 14 07:03:44.665528 2026] [:error] [pid 35713:tid 35729] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/wglum1.php
[Tue Apr 14 07:03:44.975563 2026] [:error] [pid 35713:tid 35738] [client 4.223.97.209:44647] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Tue Apr 14 07:03:45.245326 2026] [:error] [pid 35713:tid 35717] [client 4.223.97.209:44647] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper.php"] [unique_id "ad12Ua6-hhx6ZepqOSmXlgAAAME"]
[Tue Apr 14 07:03:46.545524 2026] [:error] [pid 35713:tid 35723] [client 4.223.97.209:52468] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper.php"] [unique_id "ad12Uq6-hhx6ZepqOSmXoAAAAMc"]
[Tue Apr 14 07:03:48.426418 2026] [:error] [pid 37048:tid 37059] [client 4.223.97.209:39057] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper.php"] [unique_id "ad12VJ52Bo1OyzeXo_x6LgAAAQk"]
[Tue Apr 14 07:03:49.372660 2026] [:error] [pid 35630:tid 35692] [client 4.223.97.209:52470] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper.php"] [unique_id "ad12VTer0pVFxOiOauWueQAAAIY"]
[Tue Apr 14 07:03:51.523421 2026] [:error] [pid 35713:tid 35729] [client 4.223.97.209:44560] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxpass.php"] [unique_id "ad12V66-hhx6ZepqOSmXrQAAAM0"]
[Tue Apr 14 07:03:54.295360 2026] [:error] [pid 37226:tid 37243] [client 4.223.97.209:2767] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxpass.php"] [unique_id "ad12WpOA5-IQ0IVmQCqhWgAAAU8"]
[Tue Apr 14 07:03:54.922321 2026] [:error] [pid 35630:tid 35704] [client 4.223.97.209:44610] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxpass.php"] [unique_id "ad12Wjer0pVFxOiOauWufgAAAJI"]
[Tue Apr 14 07:04:01.816045 2026] [:error] [pid 35629:tid 35676] [client 4.223.97.209:53731] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxpass.php"] [unique_id "ad12YTY8VahzC1YJBSip0gAAAFE"]
[Tue Apr 14 07:04:03.889955 2026] [:error] [pid 37226:tid 37236] [client 4.223.97.209:60525] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "ad12Y5OA5-IQ0IVmQCqhZQAAAUg"]
[Tue Apr 14 07:04:07.614666 2026] [:error] [pid 37226:tid 37231] [client 4.223.97.209:39354] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "ad12Z5OA5-IQ0IVmQCqhawAAAUM"]
[Tue Apr 14 07:04:08.499745 2026] [:error] [pid 35629:tid 35677] [client 4.223.97.209:46030] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "ad12aDY8VahzC1YJBSip3QAAAFI"]
[Tue Apr 14 07:04:15.209414 2026] [:error] [pid 35713:tid 35726] [client 4.223.97.209:61921] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/000.php"] [unique_id "ad12b66-hhx6ZepqOSmXzAAAAMo"]
[Tue Apr 14 07:04:16.427588 2026] [:error] [pid 37226:tid 37237] [client 4.223.97.209:48134] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "ad12cJOA5-IQ0IVmQCqhiAAAAUk"]
[Tue Apr 14 07:04:20.341167 2026] [:error] [pid 37226:tid 37228] [client 4.223.97.209:42003] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "ad12dJOA5-IQ0IVmQCqhnAAAAUA"]
[Tue Apr 14 07:04:24.068860 2026] [:error] [pid 35628:tid 35648] [client 4.223.97.209:2468] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "ad12eOfPm-ozGuwCWXKc_AAAABA"]
[Tue Apr 14 07:04:33.383261 2026] [:error] [pid 35630:tid 35702] [client 4.223.97.209:57031] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "ad12gTer0pVFxOiOauWuoQAAAJA"]
[Tue Apr 14 07:04:35.501113 2026] [:error] [pid 35630:tid 35701] [client 4.223.97.209:57782] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "ad12gzer0pVFxOiOauWuqwAAAI8"]
[Tue Apr 14 07:04:39.815925 2026] [:error] [pid 35713:tid 35736] [client 4.223.97.209:57791] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "ad12h66-hhx6ZepqOSmX_AAAANQ"]
[Tue Apr 14 07:04:40.986588 2026] [:error] [pid 35630:tid 35686] [client 4.223.97.209:60013] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x3x.php"] [unique_id "ad12iDer0pVFxOiOauWurwAAAIA"]
[Tue Apr 14 07:04:43.734113 2026] [:error] [pid 37048:tid 37056] [client 4.223.97.209:57788] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xy.php"] [unique_id "ad12i552Bo1OyzeXo_x6VAAAAQY"]
[Tue Apr 14 07:04:46.171679 2026] [:error] [pid 35713:tid 35721] [client 4.223.97.209:54867] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Tue Apr 14 07:04:46.436361 2026] [:error] [pid 35713:tid 35722] [client 4.223.97.209:54867] File does not exist: /usr/local/apache/htdocs/suspended-page/global.php
[Tue Apr 14 07:04:46.699678 2026] [:error] [pid 35713:tid 35729] [client 4.223.97.209:54867] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Apr 14 07:04:46.969333 2026] [:error] [pid 35713:tid 35720] [client 4.223.97.209:54867] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Tue Apr 14 07:04:47.231866 2026] [:error] [pid 35713:tid 35724] [client 4.223.97.209:54867] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Tue Apr 14 07:04:47.494621 2026] [:error] [pid 35713:tid 35718] [client 4.223.97.209:54867] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Tue Apr 14 07:04:47.754858 2026] [:error] [pid 35713:tid 35734] [client 4.223.97.209:54867] [client 4.223.97.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wincust.php"] [unique_id "ad12j66-hhx6ZepqOSmYDQAAANI"]
[Tue Apr 14 07:04:50.129158 2026] [:error] [pid 37048:tid 37059] [client 4.223.97.209:54886] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Tue Apr 14 07:04:50.392543 2026] [:error] [pid 37048:tid 37057] [client 4.223.97.209:54886] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Tue Apr 14 07:04:50.945702 2026] [:error] [pid 37048:tid 37072] [client 4.223.97.209:54886] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Tue Apr 14 07:04:51.224928 2026] [:error] [pid 37048:tid 37056] [client 4.223.97.209:54886] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Tue Apr 14 07:04:51.487497 2026] [:error] [pid 37048:tid 37063] [client 4.223.97.209:54886] File does not exist: /usr/local/apache/htdocs/suspended-page/ws61.php
[Tue Apr 14 07:04:51.755550 2026] [:error] [pid 37048:tid 37075] [client 4.223.97.209:54886] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "ad12k552Bo1OyzeXo_x6agAAARg"]
[Tue Apr 14 07:04:54.099019 2026] [:error] [pid 37226:tid 37243] [client 4.223.97.209:59998] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "ad12lpOA5-IQ0IVmQCqh1AAAAU8"]
[Tue Apr 14 07:04:59.077625 2026] [:error] [pid 35629:tid 35661] [client 4.223.97.209:57754] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "ad12mzY8VahzC1YJBSiqJgAAAEI"]
[Tue Apr 14 07:05:00.401742 2026] [:error] [pid 37048:tid 37053] [client 4.223.97.209:39380] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "ad12nJ52Bo1OyzeXo_x6bgAAAQM"]
[Tue Apr 14 07:05:06.281618 2026] [:error] [pid 37226:tid 37241] [client 4.223.97.209:63313] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "ad12opOA5-IQ0IVmQCqh8gAAAU0"]
[Tue Apr 14 07:05:07.479208 2026] [:error] [pid 35630:tid 35694] [client 4.223.97.209:47562] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "ad12ozer0pVFxOiOauWu0gAAAIg"]
[Tue Apr 14 07:05:09.909761 2026] [:error] [pid 37226:tid 37249] [client 4.223.97.209:47600] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "ad12pZOA5-IQ0IVmQCqh_QAAAVU"]
[Tue Apr 14 07:05:21.958734 2026] [:error] [pid 37226:tid 37250] [client 4.223.97.209:47514] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "ad12sZOA5-IQ0IVmQCqiHQAAAVY"]
[Tue Apr 14 07:05:44.152550 2026] [:error] [pid 35630:tid 35695] [client 4.223.97.209:59007] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-01ul.php"] [unique_id "ad12yDer0pVFxOiOauWu7wAAAIk"]
[Tue Apr 14 07:05:46.723043 2026] [:error] [pid 37048:tid 37075] [client 4.223.97.209:2184] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-01ul.php"] [unique_id "ad12yp52Bo1OyzeXo_x6pQAAARg"]
[Tue Apr 14 07:05:47.590689 2026] [:error] [pid 35713:tid 35737] [client 4.223.97.209:39117] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e7.php"] [unique_id "ad12y66-hhx6ZepqOSmYjwAAANU"]
[Tue Apr 14 07:05:49.116155 2026] [:error] [pid 37226:tid 37236] [client 4.223.97.209:63283] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e7.php"] [unique_id "ad12zZOA5-IQ0IVmQCqiVQAAAUg"]
[Tue Apr 14 07:05:54.959380 2026] [:error] [pid 35713:tid 35740] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/e7.php
[Tue Apr 14 07:05:55.235773 2026] [:error] [pid 35713:tid 35717] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/e3.php
[Tue Apr 14 07:05:55.514633 2026] [:error] [pid 35713:tid 35736] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Tue Apr 14 07:05:55.776923 2026] [:error] [pid 35713:tid 35738] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue Apr 14 07:05:56.046071 2026] [:error] [pid 35713:tid 35727] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 14 07:05:56.330555 2026] [:error] [pid 35713:tid 35726] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Tue Apr 14 07:05:56.594852 2026] [:error] [pid 35713:tid 35719] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Tue Apr 14 07:05:56.871171 2026] [:error] [pid 35713:tid 35740] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Tue Apr 14 07:05:57.421535 2026] [:error] [pid 35713:tid 35734] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Tue Apr 14 07:05:57.989197 2026] [:error] [pid 35713:tid 35727] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/curl.php
[Tue Apr 14 07:05:58.449326 2026] [:error] [pid 35713:tid 35728] [client 4.223.97.209:2226] File does not exist: /usr/local/apache/htdocs/suspended-page/sallu.php
[Tue Apr 14 07:05:58.712158 2026] [:error] [pid 35713:tid 35735] [client 4.223.97.209:2226] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ad121q6-hhx6ZepqOSmYwgAAANM"]
[Tue Apr 14 07:06:01.173336 2026] [:error] [pid 37226:tid 37232] [client 4.223.97.209:49749] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ad122ZOA5-IQ0IVmQCqiYwAAAUQ"]
[Tue Apr 14 07:06:03.712730 2026] [:error] [pid 37048:tid 37067] [client 4.223.97.209:58999] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ad122552Bo1OyzeXo_x6uQAAARE"]
[Tue Apr 14 07:06:04.629673 2026] [:error] [pid 35630:tid 35693] [client 4.223.97.209:2912] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ad123Der0pVFxOiOauWu9QAAAIc"]
[Tue Apr 14 07:06:06.481849 2026] [:error] [pid 35713:tid 35720] [client 4.223.97.209:60583] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad123q6-hhx6ZepqOSmY2QAAAMQ"]
[Tue Apr 14 07:06:09.753179 2026] [:error] [pid 35628:tid 35641] [client 4.223.97.209:65105] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad124efPm-ozGuwCWXKdTwAAAAk"]
[Tue Apr 14 07:06:11.352356 2026] [:error] [pid 35713:tid 35740] [client 4.223.97.209:63824] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad12466-hhx6ZepqOSmY7wAAANg"]
[Tue Apr 14 07:06:12.914915 2026] [:error] [pid 35628:tid 35639] [client 4.223.97.209:40873] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad125OfPm-ozGuwCWXKdUwAAAAc"]
[Tue Apr 14 07:06:14.730537 2026] [:error] [pid 35629:tid 35667] [client 4.223.97.209:2671] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ad125jY8VahzC1YJBSiqdwAAAEg"]
[Tue Apr 14 07:06:16.791806 2026] [:error] [pid 35629:tid 35668] [client 4.223.97.209:45465] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ad126DY8VahzC1YJBSiqfgAAAEk"]
[Tue Apr 14 07:06:21.942900 2026] [:error] [pid 37226:tid 37243] [client 4.223.97.209:50243] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ad127ZOA5-IQ0IVmQCqihgAAAU8"]
[Tue Apr 14 07:06:24.262953 2026] [:error] [pid 35630:tid 35694] [client 4.223.97.209:40928] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ad128Der0pVFxOiOauWvBAAAAIg"]
[Tue Apr 14 07:06:26.609767 2026] [:error] [pid 35629:tid 35667] [client 4.223.97.209:53016] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "ad128jY8VahzC1YJBSiqjgAAAEg"]
[Tue Apr 14 07:06:27.769510 2026] [:error] [pid 37226:tid 37234] [client 4.223.97.209:45476] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "ad1285OA5-IQ0IVmQCqijgAAAUY"]
[Tue Apr 14 07:06:29.178899 2026] [:error] [pid 35629:tid 35679] [client 4.223.97.209:2697] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "ad129TY8VahzC1YJBSiqlQAAAFQ"]
[Tue Apr 14 07:06:31.086944 2026] [:error] [pid 35630:tid 35706] [client 4.223.97.209:53035] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "ad129zer0pVFxOiOauWvCgAAAJQ"]
[Tue Apr 14 07:06:32.228777 2026] [:error] [pid 35630:tid 35687] [client 4.223.97.209:2268] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "ad12-Der0pVFxOiOauWvDQAAAIE"]
[Tue Apr 14 07:06:34.273204 2026] [:error] [pid 35713:tid 35725] [client 4.223.97.209:54313] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "ad12-q6-hhx6ZepqOSmZFAAAAMk"]
[Tue Apr 14 07:06:39.468677 2026] [:error] [pid 35628:tid 35645] [client 4.223.97.209:2419] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "ad12_-fPm-ozGuwCWXKddQAAAA0"]
[Tue Apr 14 07:06:40.546828 2026] [:error] [pid 37226:tid 37242] [client 4.223.97.209:62806] [client 4.223.97.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "ad13AJOA5-IQ0IVmQCqingAAAU4"]
[Tue Apr 14 07:44:25.265149 2026] [:error] [pid 37048:tid 37062] [client 216.73.216.191:60774] [client 216.73.216.191] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.rejuva.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/robots.txt"] [unique_id "ad1_2Z52Bo1OyzeXo_yFSwAAAQw"]
[Tue Apr 14 10:46:22.170633 2026] [:error] [pid 35630:tid 35701] [client 170.106.140.110:39034] [client 170.106.140.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad2qfjer0pVFxOiOauXaXAAAAI8"]
[Tue Apr 14 12:15:33.639340 2026] [:error] [pid 35629:tid 35668] [client 43.165.69.68:36900] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad2_ZTY8VahzC1YJBSjZggAAAEk"]
[Tue Apr 14 12:28:49.946680 2026] [:error] [pid 35713:tid 35734] [client 43.135.134.127:47768] [client 43.135.134.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad3Cga6-hhx6ZepqOSk_QwAAANI"]
[Tue Apr 14 15:28:23.819811 2026] [:error] [pid 59985:tid 60015] [client 110.166.71.39:41233] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad3sl-gHaxkvLE6V1kkTJwAAABY"]
[Tue Apr 14 18:09:32.661149 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Tue Apr 14 18:09:32.894920 2026] [:error] [pid 60074:tid 60094] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Tue Apr 14 18:09:33.133020 2026] [:error] [pid 60074:tid 60079] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Tue Apr 14 18:09:33.368589 2026] [:error] [pid 60074:tid 60076] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Tue Apr 14 18:09:33.615486 2026] [:error] [pid 60074:tid 60098] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Tue Apr 14 18:09:33.863904 2026] [:error] [pid 60074:tid 60091] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/filemanger2.php
[Tue Apr 14 18:09:34.553209 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Tue Apr 14 18:09:34.804806 2026] [:error] [pid 60074:tid 60094] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-vn1.php
[Tue Apr 14 18:09:35.044626 2026] [:error] [pid 60074:tid 60093] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Tue Apr 14 18:09:35.526781 2026] [:error] [pid 60074:tid 60092] [client 172.213.160.163:64542] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Tue Apr 14 18:09:35.835393 2026] [:error] [pid 60074:tid 60086] [client 172.213.160.163:64542] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "ad4SX-tqnEmNU9vpHClTHwAAAMo"]
[Tue Apr 14 18:09:37.350370 2026] [:error] [pid 22177:tid 22203] [client 172.213.160.163:48397] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "ad4SYYTVeJSXHDIlEDtFywAAARg"]
[Tue Apr 14 18:09:38.151617 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:22702] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "ad4SYutqnEmNU9vpHClTLwAAAMU"]
[Tue Apr 14 18:09:39.147599 2026] [:error] [pid 60074:tid 60086] [client 172.213.160.163:26555] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "ad4SY-tqnEmNU9vpHClTNgAAAMo"]
[Tue Apr 14 18:09:40.283143 2026] [:error] [pid 60074:tid 60088] [client 172.213.160.163:28936] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad4SZOtqnEmNU9vpHClTOgAAAMw"]
[Tue Apr 14 18:09:41.477421 2026] [:error] [pid 60074:tid 60092] [client 172.213.160.163:47765] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad4SZetqnEmNU9vpHClTQgAAANA"]
[Tue Apr 14 18:09:42.591173 2026] [:error] [pid 59985:tid 60012] [client 172.213.160.163:48984] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad4SZugHaxkvLE6V1kk-QgAAABM"]
[Tue Apr 14 18:09:43.360400 2026] [:error] [pid 22177:tid 22179] [client 172.213.160.163:31106] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "ad4SZ4TVeJSXHDIlEDtFzAAAAQA"]
[Tue Apr 14 18:09:44.489154 2026] [:error] [pid 22177:tid 22190] [client 172.213.160.163:22662] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "ad4SaITVeJSXHDIlEDtFzgAAAQs"]
[Tue Apr 14 18:09:45.830737 2026] [:error] [pid 59986:tid 60020] [client 172.213.160.163:26500] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "ad4SaZ6axKeW6bX4H7cmGAAAAEA"]
[Tue Apr 14 18:09:47.193142 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:64520] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "ad4Sa4TVeJSXHDIlEDtF0QAAAQk"]
[Tue Apr 14 18:09:48.350126 2026] [:error] [pid 22177:tid 22193] [client 172.213.160.163:48978] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "ad4SbITVeJSXHDIlEDtF0gAAAQ4"]
[Tue Apr 14 18:09:49.224579 2026] [:error] [pid 59985:tid 60010] [client 172.213.160.163:22688] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "ad4SbegHaxkvLE6V1kk-QwAAABE"]
[Tue Apr 14 18:09:50.577103 2026] [:error] [pid 59987:tid 60055] [client 172.213.160.163:27745] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "ad4SblWpk-Tfi6_vLKrvCwAAAIg"]
[Tue Apr 14 18:09:51.924485 2026] [:error] [pid 22177:tid 22195] [client 172.213.160.163:31163] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "ad4Sb4TVeJSXHDIlEDtF3AAAARA"]
[Tue Apr 14 18:09:54.485164 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:64545] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "ad4ScutqnEmNU9vpHClTjAAAAM4"]
[Tue Apr 14 18:09:55.612150 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:49016] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "ad4Sc-tqnEmNU9vpHClTkwAAAMg"]
[Tue Apr 14 18:09:57.333946 2026] [:error] [pid 59985:tid 60002] [client 172.213.160.163:5992] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "ad4SdegHaxkvLE6V1kk-TQAAAAk"]
[Tue Apr 14 18:09:58.761212 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:48997] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "ad4SdutqnEmNU9vpHClTnwAAAM4"]
[Tue Apr 14 18:09:59.584141 2026] [:error] [pid 59985:tid 60005] [client 172.213.160.163:31215] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "ad4Sd-gHaxkvLE6V1kk-TwAAAAw"]
[Tue Apr 14 18:10:00.532492 2026] [:error] [pid 22177:tid 22183] [client 172.213.160.163:27754] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad4SeITVeJSXHDIlEDtF7AAAAQQ"]
[Tue Apr 14 18:10:01.574087 2026] [:error] [pid 22177:tid 22189] [client 172.213.160.163:24111] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad4SeYTVeJSXHDIlEDtF7wAAAQo"]
[Tue Apr 14 18:10:02.487165 2026] [:error] [pid 60074:tid 60086] [client 172.213.160.163:49011] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad4SeutqnEmNU9vpHClTpAAAAMo"]
[Tue Apr 14 18:10:03.751925 2026] [:error] [pid 60074:tid 60087] [client 172.213.160.163:26532] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "ad4Se-tqnEmNU9vpHClTqQAAAMs"]
[Tue Apr 14 18:10:05.015352 2026] [:error] [pid 60074:tid 60089] [client 172.213.160.163:38643] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "ad4SfetqnEmNU9vpHClTrQAAAM0"]
[Tue Apr 14 18:10:06.038362 2026] [:error] [pid 59985:tid 59993] [client 172.213.160.163:31137] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "ad4SfugHaxkvLE6V1kk-UwAAAAA"]
[Tue Apr 14 18:10:07.520172 2026] [:error] [pid 59986:tid 60029] [client 172.213.160.163:31220] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "ad4Sf56axKeW6bX4H7cmPgAAAEk"]
[Tue Apr 14 18:10:08.993226 2026] [:error] [pid 59986:tid 60032] [client 172.213.160.163:5966] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "ad4SgJ6axKeW6bX4H7cmRAAAAEw"]
[Tue Apr 14 18:10:09.774315 2026] [:error] [pid 60074:tid 60095] [client 172.213.160.163:35618] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "ad4SgetqnEmNU9vpHClTtQAAANM"]
[Tue Apr 14 18:10:15.060659 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:48969] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "ad4Sh-tqnEmNU9vpHClTxQAAAM4"]
[Tue Apr 14 18:10:17.106025 2026] [:error] [pid 60074:tid 60082] [client 172.213.160.163:31166] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "ad4SietqnEmNU9vpHClTywAAAMY"]
[Tue Apr 14 18:10:20.000454 2026] [:error] [pid 59986:tid 60020] [client 172.213.160.163:38595] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "ad4Si56axKeW6bX4H7cmVgAAAEA"]
[Tue Apr 14 18:10:21.355042 2026] [:error] [pid 60074:tid 60099] [client 172.213.160.163:5970] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ad4SjetqnEmNU9vpHClT3AAAANc"]
[Tue Apr 14 18:10:22.330451 2026] [:error] [pid 59985:tid 60012] [client 172.213.160.163:6005] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ad4SjugHaxkvLE6V1kk-WAAAABM"]
[Tue Apr 14 18:10:23.795593 2026] [:error] [pid 59986:tid 60043] [client 172.213.160.163:24665] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ad4Sj56axKeW6bX4H7cmWgAAAFc"]
[Tue Apr 14 18:10:24.896298 2026] [:error] [pid 60074:tid 60087] [client 172.213.160.163:25934] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ad4SkOtqnEmNU9vpHClT5wAAAMs"]
[Tue Apr 14 18:10:25.596548 2026] [:error] [pid 60074:tid 60080] [client 172.213.160.163:5953] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "ad4SketqnEmNU9vpHClT7AAAAMQ"]
[Tue Apr 14 18:10:26.872975 2026] [:error] [pid 59986:tid 60044] [client 172.213.160.163:24078] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "ad4Skp6axKeW6bX4H7cmYgAAAFg"]
[Tue Apr 14 18:10:27.779485 2026] [:error] [pid 22177:tid 22201] [client 172.213.160.163:35595] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "ad4Sk4TVeJSXHDIlEDtGNgAAARY"]
[Tue Apr 14 18:10:28.570697 2026] [:error] [pid 59986:tid 60034] [client 172.213.160.163:31208] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "ad4SlJ6axKeW6bX4H7cmYwAAAE4"]
[Tue Apr 14 18:10:29.356359 2026] [:error] [pid 59986:tid 60027] [client 172.213.160.163:24693] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "ad4SlZ6axKeW6bX4H7cmZAAAAEc"]
[Tue Apr 14 18:10:30.818173 2026] [:error] [pid 60074:tid 60087] [client 172.213.160.163:23094] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "ad4SlutqnEmNU9vpHClUAQAAAMs"]
[Tue Apr 14 18:10:31.846377 2026] [:error] [pid 60074:tid 60083] [client 172.213.160.163:25952] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "ad4Sl-tqnEmNU9vpHClUBwAAAMc"]
[Tue Apr 14 18:10:33.221137 2026] [:error] [pid 59987:tid 60047] [client 172.213.160.163:19893] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "ad4SmVWpk-Tfi6_vLKrvRgAAAIA"]
[Tue Apr 14 18:10:34.040864 2026] [:error] [pid 22177:tid 22201] [client 172.213.160.163:38600] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "ad4SmoTVeJSXHDIlEDtGQQAAARY"]
[Tue Apr 14 18:10:34.739050 2026] [:error] [pid 59985:tid 60004] [client 172.213.160.163:24700] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "ad4SmugHaxkvLE6V1kk-ZQAAAAs"]
[Tue Apr 14 18:10:35.660987 2026] [:error] [pid 22177:tid 22189] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Tue Apr 14 18:10:36.028970 2026] [:error] [pid 22177:tid 22192] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Tue Apr 14 18:10:36.284845 2026] [:error] [pid 22177:tid 22199] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/oij98gy.php
[Tue Apr 14 18:10:36.537052 2026] [:error] [pid 22177:tid 22180] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue Apr 14 18:10:36.785635 2026] [:error] [pid 22177:tid 22196] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/turkshell.php
[Tue Apr 14 18:10:37.066318 2026] [:error] [pid 22177:tid 22197] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Tue Apr 14 18:10:37.375400 2026] [:error] [pid 22177:tid 22183] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Tue Apr 14 18:10:37.610613 2026] [:error] [pid 22177:tid 22186] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Tue Apr 14 18:10:37.940723 2026] [:error] [pid 22177:tid 22200] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue Apr 14 18:10:38.177137 2026] [:error] [pid 22177:tid 22187] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 14 18:10:38.414172 2026] [:error] [pid 22177:tid 22198] [client 172.213.160.163:23063] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Tue Apr 14 18:10:38.648220 2026] [:error] [pid 22177:tid 22181] [client 172.213.160.163:23063] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "ad4SnoTVeJSXHDIlEDtGUgAAAQI"]
[Tue Apr 14 18:10:39.705190 2026] [:error] [pid 59986:tid 60029] [client 172.213.160.163:19891] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "ad4Sn56axKeW6bX4H7cmdAAAAEk"]
[Tue Apr 14 18:10:43.969394 2026] [:error] [pid 59987:tid 60049] [client 172.213.160.163:20610] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "ad4So1Wpk-Tfi6_vLKrvTQAAAII"]
[Tue Apr 14 18:10:46.588823 2026] [:error] [pid 59987:tid 60057] [client 172.213.160.163:25278] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "ad4SplWpk-Tfi6_vLKrvVQAAAIo"]
[Tue Apr 14 18:10:47.927436 2026] [:error] [pid 22177:tid 22181] [client 172.213.160.163:45826] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "ad4Sp4TVeJSXHDIlEDtGXQAAAQI"]
[Tue Apr 14 18:10:51.667669 2026] [:error] [pid 22177:tid 22196] [client 172.213.160.163:44599] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "ad4Sq4TVeJSXHDIlEDtGZwAAARE"]
[Tue Apr 14 18:10:52.743371 2026] [:error] [pid 59985:tid 59996] [client 172.213.160.163:38530] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "ad4SrOgHaxkvLE6V1kk-ewAAAAM"]
[Tue Apr 14 18:10:53.470909 2026] [:error] [pid 59987:tid 60061] [client 172.213.160.163:20179] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "ad4SrVWpk-Tfi6_vLKrvZwAAAI4"]
[Tue Apr 14 18:10:54.625344 2026] [:error] [pid 22177:tid 22194] [client 172.213.160.163:20992] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "ad4SroTVeJSXHDIlEDtGiAAAAQ8"]
[Tue Apr 14 18:10:55.702260 2026] [:error] [pid 59987:tid 60054] [client 172.213.160.163:25259] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "ad4Sr1Wpk-Tfi6_vLKrvbQAAAIc"]
[Tue Apr 14 18:10:56.687699 2026] [:error] [pid 22177:tid 22190] [client 172.213.160.163:45863] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "ad4SsITVeJSXHDIlEDtGkQAAAQs"]
[Tue Apr 14 18:10:57.559839 2026] [:error] [pid 59986:tid 60040] [client 172.213.160.163:35168] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "ad4SsZ6axKeW6bX4H7cmkwAAAFQ"]
[Tue Apr 14 18:10:58.466362 2026] [:error] [pid 59985:tid 59993] [client 172.213.160.163:20153] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "ad4SsugHaxkvLE6V1kk-fQAAAAA"]
[Tue Apr 14 18:10:59.519958 2026] [:error] [pid 59985:tid 60008] [client 172.213.160.163:31840] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "ad4Ss-gHaxkvLE6V1kk-gQAAAA8"]
[Tue Apr 14 18:11:01.267694 2026] [:error] [pid 60074:tid 60099] [client 172.213.160.163:38535] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "ad4StetqnEmNU9vpHClURgAAANc"]
[Tue Apr 14 18:11:02.445303 2026] [:error] [pid 59985:tid 60014] [client 172.213.160.163:35682] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "ad4StugHaxkvLE6V1kk-hAAAABU"]
[Tue Apr 14 18:11:03.310205 2026] [:error] [pid 59987:tid 60048] [client 172.213.160.163:30109] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "ad4St1Wpk-Tfi6_vLKrvdAAAAIE"]
[Tue Apr 14 18:11:04.678988 2026] [:error] [pid 59986:tid 60025] [client 172.213.160.163:35652] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "ad4SuJ6axKeW6bX4H7cmlQAAAEU"]
[Tue Apr 14 18:11:05.976800 2026] [:error] [pid 60074:tid 60096] [client 172.213.160.163:31782] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "ad4SuetqnEmNU9vpHClUUgAAANQ"]
[Tue Apr 14 18:11:06.733344 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:31791] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "ad4SuutqnEmNU9vpHClUWAAAAMU"]
[Tue Apr 14 18:11:08.034600 2026] [:error] [pid 22177:tid 22194] [client 172.213.160.163:38560] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "ad4SvITVeJSXHDIlEDtGpAAAAQ8"]
[Tue Apr 14 18:11:08.907878 2026] [:error] [pid 22177:tid 22191] [client 172.213.160.163:39997] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "ad4SvITVeJSXHDIlEDtGpwAAAQw"]
[Tue Apr 14 18:11:10.055770 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:31858] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "ad4SvutqnEmNU9vpHClUeAAAAM4"]
[Tue Apr 14 18:11:11.183749 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:20145] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "ad4Sv-tqnEmNU9vpHClUhQAAAMU"]
[Tue Apr 14 18:11:12.184688 2026] [:error] [pid 22177:tid 22202] [client 172.213.160.163:31795] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "ad4SwITVeJSXHDIlEDtGrQAAARc"]
[Tue Apr 14 18:11:13.525761 2026] [:error] [pid 59986:tid 60034] [client 172.213.160.163:35694] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "ad4SwZ6axKeW6bX4H7cmmwAAAE4"]
[Tue Apr 14 18:11:14.509136 2026] [:error] [pid 60074:tid 60096] [client 172.213.160.163:31826] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "ad4SwutqnEmNU9vpHClUjgAAANQ"]
[Tue Apr 14 18:11:15.489024 2026] [:error] [pid 22177:tid 22185] [client 172.213.160.163:55190] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "ad4Sw4TVeJSXHDIlEDtGugAAAQY"]
[Tue Apr 14 18:11:16.873728 2026] [:error] [pid 22177:tid 22200] [client 172.213.160.163:31750] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ad4SxITVeJSXHDIlEDtGvQAAARU"]
[Tue Apr 14 18:11:17.768838 2026] [:error] [pid 22177:tid 22199] [client 172.213.160.163:23658] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ad4SxYTVeJSXHDIlEDtGwAAAARQ"]
[Tue Apr 14 18:11:19.184132 2026] [:error] [pid 59985:tid 60007] [client 172.213.160.163:23638] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ad4Sx-gHaxkvLE6V1kk-kgAAAA4"]
[Tue Apr 14 18:11:20.373345 2026] [:error] [pid 59985:tid 60003] [client 172.213.160.163:55171] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ad4SyOgHaxkvLE6V1kk-kwAAAAo"]
[Tue Apr 14 18:11:21.547988 2026] [:error] [pid 60074:tid 60079] [client 172.213.160.163:20111] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "ad4SyetqnEmNU9vpHClUoQAAAMM"]
[Tue Apr 14 18:11:23.177812 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:23650] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "ad4Sy-tqnEmNU9vpHClUpgAAAMg"]
[Tue Apr 14 18:11:24.236567 2026] [:error] [pid 60074:tid 60097] [client 172.213.160.163:44566] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "ad4SzOtqnEmNU9vpHClUrgAAANU"]
[Tue Apr 14 18:11:25.494969 2026] [:error] [pid 60074:tid 60086] [client 172.213.160.163:55182] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "ad4SzetqnEmNU9vpHClUsQAAAMo"]
[Tue Apr 14 18:11:27.615712 2026] [:error] [pid 60074:tid 60100] [client 172.213.160.163:22746] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "ad4Sz-tqnEmNU9vpHClUtQAAANg"]
[Tue Apr 14 18:11:30.562902 2026] [:error] [pid 22177:tid 22190] [client 172.213.160.163:22721] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "ad4S0oTVeJSXHDIlEDtG2gAAAQs"]
[Tue Apr 14 18:11:31.736716 2026] [:error] [pid 59986:tid 60026] [client 172.213.160.163:19884] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "ad4S056axKeW6bX4H7cmugAAAEY"]
[Tue Apr 14 18:11:32.918077 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:29011] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "ad4S1ITVeJSXHDIlEDtG5gAAAQk"]
[Tue Apr 14 18:11:34.317117 2026] [:error] [pid 22177:tid 22181] [client 172.213.160.163:20617] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "ad4S1oTVeJSXHDIlEDtG6wAAAQI"]
[Tue Apr 14 18:11:35.738787 2026] [:error] [pid 59986:tid 60036] [client 172.213.160.163:25878] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "ad4S156axKeW6bX4H7cmvgAAAFA"]
[Tue Apr 14 18:11:37.991112 2026] [:error] [pid 59987:tid 60058] [client 172.213.160.163:38616] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "ad4S2VWpk-Tfi6_vLKrvpgAAAIs"]
[Tue Apr 14 18:11:38.788340 2026] [:error] [pid 22177:tid 22196] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Tue Apr 14 18:11:39.139918 2026] [:error] [pid 22177:tid 22203] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Tue Apr 14 18:11:39.375270 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Tue Apr 14 18:11:39.742919 2026] [:error] [pid 22177:tid 22185] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 14 18:11:40.034675 2026] [:error] [pid 22177:tid 22197] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Tue Apr 14 18:11:40.272495 2026] [:error] [pid 22177:tid 22184] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Tue Apr 14 18:11:40.563341 2026] [:error] [pid 22177:tid 22183] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Tue Apr 14 18:11:40.815718 2026] [:error] [pid 22177:tid 22179] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 14 18:11:41.051285 2026] [:error] [pid 22177:tid 22200] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Tue Apr 14 18:11:41.318339 2026] [:error] [pid 22177:tid 22189] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Tue Apr 14 18:11:41.555483 2026] [:error] [pid 22177:tid 22195] [client 172.213.160.163:48504] File does not exist: /usr/local/apache/htdocs/suspended-page/zample.php
[Tue Apr 14 18:11:41.832727 2026] [:error] [pid 22177:tid 22203] [client 172.213.160.163:48504] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "ad4S3YTVeJSXHDIlEDtHBAAAARg"]
[Tue Apr 14 18:11:42.826312 2026] [:error] [pid 60074:tid 60085] [client 172.213.160.163:5934] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "ad4S3utqnEmNU9vpHClUyAAAAMk"]
[Tue Apr 14 18:11:46.447666 2026] [:error] [pid 22177:tid 22202] [client 172.213.160.163:27100] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "ad4S4oTVeJSXHDIlEDtHDAAAARc"]
[Tue Apr 14 18:11:47.174296 2026] [:error] [pid 59986:tid 60020] [client 172.213.160.163:19899] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "ad4S456axKeW6bX4H7cmxgAAAEA"]
[Tue Apr 14 18:11:47.857908 2026] [:error] [pid 59987:tid 60047] [client 172.213.160.163:25916] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ad4S41Wpk-Tfi6_vLKrvrQAAAIA"]
[Tue Apr 14 18:11:48.826601 2026] [:error] [pid 59987:tid 60056] [client 172.213.160.163:48486] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ad4S5FWpk-Tfi6_vLKrvsQAAAIk"]
[Tue Apr 14 18:11:50.010156 2026] [:error] [pid 22177:tid 22190] [client 172.213.160.163:5924] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ad4S5oTVeJSXHDIlEDtHHAAAAQs"]
[Tue Apr 14 18:11:50.805429 2026] [:error] [pid 22177:tid 22181] [client 172.213.160.163:24650] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ad4S5oTVeJSXHDIlEDtHIgAAAQI"]
[Tue Apr 14 18:11:51.881828 2026] [:error] [pid 59985:tid 60003] [client 172.213.160.163:48499] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ad4S5-gHaxkvLE6V1kk-wAAAAAo"]
[Tue Apr 14 18:11:52.527926 2026] [:error] [pid 59987:tid 60064] [client 172.213.160.163:38606] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ad4S6FWpk-Tfi6_vLKrvtwAAAJE"]
[Tue Apr 14 18:11:53.590867 2026] [:error] [pid 60074:tid 60093] [client 172.213.160.163:19892] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ad4S6etqnEmNU9vpHClU1gAAANE"]
[Tue Apr 14 18:11:54.696413 2026] [:error] [pid 59986:tid 60027] [client 172.213.160.163:19849] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ad4S6p6axKeW6bX4H7cmzwAAAEc"]
[Tue Apr 14 18:11:55.906676 2026] [:error] [pid 22177:tid 22180] [client 172.213.160.163:25940] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "ad4S64TVeJSXHDIlEDtHNwAAAQE"]
[Tue Apr 14 18:11:56.745042 2026] [:error] [pid 59987:tid 60057] [client 172.213.160.163:19844] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "ad4S7FWpk-Tfi6_vLKrvvgAAAIo"]
[Tue Apr 14 18:11:57.321922 2026] [:error] [pid 59986:tid 60022] [client 172.213.160.163:48939] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "ad4S7Z6axKeW6bX4H7cm2wAAAEI"]
[Tue Apr 14 18:11:58.064278 2026] [:error] [pid 60074:tid 60092] [client 172.213.160.163:19881] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "ad4S7utqnEmNU9vpHClU3gAAANA"]
[Tue Apr 14 18:11:59.158403 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:25942] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4S7-tqnEmNU9vpHClU4gAAAMU"]
[Tue Apr 14 18:12:00.270398 2026] [:error] [pid 59987:tid 60067] [client 172.213.160.163:24684] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4S8FWpk-Tfi6_vLKrvwwAAAJQ"]
[Tue Apr 14 18:12:01.002138 2026] [:error] [pid 60074:tid 60100] [client 172.213.160.163:38629] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4S8etqnEmNU9vpHClU5wAAANg"]
[Tue Apr 14 18:12:02.386919 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:25974] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4S8oTVeJSXHDIlEDtHTwAAAQk"]
[Tue Apr 14 18:12:03.414088 2026] [:error] [pid 59986:tid 60022] [client 172.213.160.163:32434] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ad4S856axKeW6bX4H7cm6AAAAEI"]
[Tue Apr 14 18:12:05.009883 2026] [:error] [pid 22177:tid 22201] [client 172.213.160.163:32430] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ad4S9YTVeJSXHDIlEDtHWAAAARY"]
[Tue Apr 14 18:12:06.327615 2026] [:error] [pid 22177:tid 22184] [client 172.213.160.163:27130] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ad4S9oTVeJSXHDIlEDtHXQAAAQU"]
[Tue Apr 14 18:12:07.282689 2026] [:error] [pid 60074:tid 60083] [client 172.213.160.163:38604] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "ad4S9-tqnEmNU9vpHClU-gAAAMc"]
[Tue Apr 14 18:12:08.075720 2026] [:error] [pid 22177:tid 22187] [client 172.213.160.163:25889] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ad4S-ITVeJSXHDIlEDtHYAAAAQg"]
[Tue Apr 14 18:12:09.101048 2026] [:error] [pid 22177:tid 22195] [client 172.213.160.163:24694] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ad4S-YTVeJSXHDIlEDtHZQAAARA"]
[Tue Apr 14 18:12:10.056169 2026] [:error] [pid 60074:tid 60086] [client 172.213.160.163:48949] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ad4S-utqnEmNU9vpHClVAAAAAMo"]
[Tue Apr 14 18:12:12.100690 2026] [:error] [pid 59986:tid 60033] [client 172.213.160.163:20639] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ad4S_J6axKeW6bX4H7cm-QAAAE0"]
[Tue Apr 14 18:12:13.125312 2026] [:error] [pid 22177:tid 22199] [client 172.213.160.163:38634] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ad4S_YTVeJSXHDIlEDtHbgAAARQ"]
[Tue Apr 14 18:12:13.945324 2026] [:error] [pid 22177:tid 22196] [client 172.213.160.163:27117] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ad4S_YTVeJSXHDIlEDtHdAAAARE"]
[Tue Apr 14 18:12:14.604919 2026] [:error] [pid 22177:tid 22183] [client 172.213.160.163:48455] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ad4S_oTVeJSXHDIlEDtHegAAAQQ"]
[Tue Apr 14 18:12:15.434320 2026] [:error] [pid 60074:tid 60089] [client 172.213.160.163:20373] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ad4S_-tqnEmNU9vpHClVCAAAAM0"]
[Tue Apr 14 18:12:16.488379 2026] [:error] [pid 60074:tid 60093] [client 172.213.160.163:19896] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "ad4TAOtqnEmNU9vpHClVDAAAANE"]
[Tue Apr 14 18:12:17.266698 2026] [:error] [pid 60074:tid 60099] [client 172.213.160.163:25900] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "ad4TAetqnEmNU9vpHClVDwAAANc"]
[Tue Apr 14 18:12:18.353709 2026] [:error] [pid 22177:tid 22186] [client 172.213.160.163:48903] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "ad4TAoTVeJSXHDIlEDtHiAAAAQc"]
[Tue Apr 14 18:12:19.211818 2026] [:error] [pid 22177:tid 22179] [client 172.213.160.163:19868] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "ad4TA4TVeJSXHDIlEDtHjgAAAQA"]
[Tue Apr 14 18:12:20.099862 2026] [:error] [pid 22177:tid 22182] [client 172.213.160.163:5937] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "ad4TBITVeJSXHDIlEDtHmQAAAQM"]
[Tue Apr 14 18:12:20.952042 2026] [:error] [pid 60074:tid 60091] [client 172.213.160.163:5910] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "ad4TBOtqnEmNU9vpHClVGAAAAM8"]
[Tue Apr 14 18:12:23.593530 2026] [:error] [pid 60074:tid 60095] [client 172.213.160.163:20386] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "ad4TB-tqnEmNU9vpHClVKgAAANM"]
[Tue Apr 14 18:12:24.868155 2026] [:error] [pid 60074:tid 60088] [client 172.213.160.163:48928] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "ad4TCOtqnEmNU9vpHClVNAAAAMw"]
[Tue Apr 14 18:12:25.991693 2026] [:error] [pid 59987:tid 60069] [client 172.213.160.163:24641] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "ad4TCVWpk-Tfi6_vLKrv6AAAAJY"]
[Tue Apr 14 18:12:26.810624 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:27110] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "ad4TCutqnEmNU9vpHClVPwAAAMg"]
[Tue Apr 14 18:12:27.711418 2026] [:error] [pid 59987:tid 60064] [client 172.213.160.163:48465] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "ad4TC1Wpk-Tfi6_vLKrv6QAAAJE"]
[Tue Apr 14 18:12:28.764960 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:19877] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "ad4TDITVeJSXHDIlEDtHqgAAAQk"]
[Tue Apr 14 18:12:29.962257 2026] [:error] [pid 60074:tid 60082] [client 172.213.160.163:48959] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad4TDetqnEmNU9vpHClVWQAAAMY"]
[Tue Apr 14 18:12:31.280311 2026] [:error] [pid 22177:tid 22195] [client 172.213.160.163:48451] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad4TD4TVeJSXHDIlEDtHrQAAARA"]
[Tue Apr 14 18:12:31.878202 2026] [:error] [pid 59987:tid 60050] [client 172.213.160.163:5927] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad4TD1Wpk-Tfi6_vLKrv7gAAAIM"]
[Tue Apr 14 18:12:32.676975 2026] [:error] [pid 60074:tid 60088] [client 172.213.160.163:27127] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ad4TEOtqnEmNU9vpHClVZwAAAMw"]
[Tue Apr 14 18:12:33.331449 2026] [:error] [pid 22177:tid 22196] [client 172.213.160.163:5946] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "ad4TEYTVeJSXHDIlEDtHswAAARE"]
[Tue Apr 14 18:12:34.637853 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:25902] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "ad4TEutqnEmNU9vpHClVawAAAMU"]
[Tue Apr 14 18:12:35.370555 2026] [:error] [pid 22177:tid 22181] [client 172.213.160.163:20411] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "ad4TE4TVeJSXHDIlEDtHtwAAAQI"]
[Tue Apr 14 18:12:36.426568 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:48947] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "ad4TFOtqnEmNU9vpHClVcAAAAM4"]
[Tue Apr 14 18:12:37.093301 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:20375] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TFetqnEmNU9vpHClVcwAAAMU"]
[Tue Apr 14 18:12:37.872954 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:38636] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TFetqnEmNU9vpHClVdwAAAMg"]
[Tue Apr 14 18:12:39.276681 2026] [:error] [pid 22177:tid 22195] [client 172.213.160.163:24654] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TF4TVeJSXHDIlEDtHuAAAARA"]
[Tue Apr 14 18:12:40.235624 2026] [:error] [pid 22177:tid 22201] [client 172.213.160.163:25919] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TGITVeJSXHDIlEDtHvAAAARY"]
[Tue Apr 14 18:12:41.055354 2026] [:error] [pid 59985:tid 60006] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Tue Apr 14 18:12:41.315671 2026] [:error] [pid 59985:tid 60008] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Apr 14 18:12:41.619537 2026] [:error] [pid 59985:tid 60017] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Tue Apr 14 18:12:41.860272 2026] [:error] [pid 59985:tid 60000] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Tue Apr 14 18:12:42.096074 2026] [:error] [pid 59985:tid 60014] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 14 18:12:42.333564 2026] [:error] [pid 59985:tid 60013] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Apr 14 18:12:42.619079 2026] [:error] [pid 59985:tid 59995] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 14 18:12:42.855572 2026] [:error] [pid 59985:tid 60015] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue Apr 14 18:12:43.340325 2026] [:error] [pid 59985:tid 59996] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Tue Apr 14 18:12:43.709761 2026] [:error] [pid 59985:tid 60001] [client 172.213.160.163:25869] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Tue Apr 14 18:12:43.962604 2026] [:error] [pid 59985:tid 60011] [client 172.213.160.163:25869] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "ad4TG-gHaxkvLE6V1kk-7AAAABI"]
[Tue Apr 14 18:12:44.835401 2026] [:error] [pid 22177:tid 22197] [client 172.213.160.163:38627] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "ad4THITVeJSXHDIlEDtHwQAAARI"]
[Tue Apr 14 18:12:45.985372 2026] [:error] [pid 60074:tid 60085] [client 172.213.160.163:32415] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "ad4THetqnEmNU9vpHClVjAAAAMk"]
[Tue Apr 14 18:12:47.185013 2026] [:error] [pid 22177:tid 22194] [client 172.213.160.163:48456] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "ad4TH4TVeJSXHDIlEDtHyQAAAQ8"]
[Tue Apr 14 18:12:48.505896 2026] [:error] [pid 59985:tid 60012] [client 172.213.160.163:25927] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "ad4TIOgHaxkvLE6V1kk-7QAAABM"]
[Tue Apr 14 18:12:50.309507 2026] [:error] [pid 60074:tid 60092] [client 172.213.160.163:48956] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "ad4TIutqnEmNU9vpHClVlwAAANA"]
[Tue Apr 14 18:12:51.642692 2026] [:error] [pid 60074:tid 60080] [client 172.213.160.163:29026] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "ad4TI-tqnEmNU9vpHClVnQAAAMQ"]
[Tue Apr 14 18:12:52.653723 2026] [:error] [pid 22177:tid 22195] [client 172.213.160.163:48924] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "ad4TJITVeJSXHDIlEDtH5gAAARA"]
[Tue Apr 14 18:12:53.336575 2026] [:error] [pid 60074:tid 60079] [client 172.213.160.163:48921] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ad4TJetqnEmNU9vpHClVowAAAMM"]
[Tue Apr 14 18:12:54.664416 2026] [:error] [pid 59986:tid 60034] [client 172.213.160.163:24653] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ad4TJp6axKeW6bX4H7cnGQAAAE4"]
[Tue Apr 14 18:12:56.718294 2026] [:error] [pid 22177:tid 22187] [client 172.213.160.163:48484] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ad4TKITVeJSXHDIlEDtH8AAAAQg"]
[Tue Apr 14 18:12:58.382744 2026] [:error] [pid 59985:tid 60015] [client 172.213.160.163:5931] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ad4TKugHaxkvLE6V1kk-9wAAABY"]
[Tue Apr 14 18:13:00.080169 2026] [:error] [pid 60074:tid 60086] [client 172.213.160.163:38612] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "ad4TLOtqnEmNU9vpHClVxQAAAMo"]
[Tue Apr 14 18:13:01.765826 2026] [:error] [pid 60074:tid 60097] [client 172.213.160.163:48904] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "ad4TLetqnEmNU9vpHClVzQAAANU"]
[Tue Apr 14 18:13:03.532643 2026] [:error] [pid 60074:tid 60087] [client 172.213.160.163:25931] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "ad4TL-tqnEmNU9vpHClV0gAAAMs"]
[Tue Apr 14 18:13:04.801071 2026] [:error] [pid 22177:tid 22196] [client 172.213.160.163:38647] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "ad4TMITVeJSXHDIlEDtH_QAAARE"]
[Tue Apr 14 18:13:05.809261 2026] [:error] [pid 22177:tid 22179] [client 172.213.160.163:24659] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "ad4TMYTVeJSXHDIlEDtIAQAAAQA"]
[Tue Apr 14 18:13:06.952844 2026] [:error] [pid 22177:tid 22198] [client 172.213.160.163:48491] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "ad4TMoTVeJSXHDIlEDtIAwAAARM"]
[Tue Apr 14 18:13:08.672879 2026] [:error] [pid 60074:tid 60095] [client 172.213.160.163:20372] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "ad4TNOtqnEmNU9vpHClV5gAAANM"]
[Tue Apr 14 18:13:09.618279 2026] [:error] [pid 60074:tid 60076] [client 172.213.160.163:5901] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "ad4TNetqnEmNU9vpHClV7AAAAMA"]
[Tue Apr 14 18:13:11.053704 2026] [:error] [pid 60074:tid 60087] [client 172.213.160.163:48898] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "ad4TN-tqnEmNU9vpHClV9gAAAMs"]
[Tue Apr 14 18:13:12.526788 2026] [:error] [pid 59987:tid 60067] [client 172.213.160.163:5391] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "ad4TOFWpk-Tfi6_vLKrwFwAAAJQ"]
[Tue Apr 14 18:13:13.563801 2026] [:error] [pid 59985:tid 59998] [client 172.213.160.163:24688] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "ad4TOegHaxkvLE6V1kk-_AAAAAU"]
[Tue Apr 14 18:13:14.575047 2026] [:error] [pid 60074:tid 60097] [client 172.213.160.163:48950] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "ad4TOutqnEmNU9vpHClWBAAAANU"]
[Tue Apr 14 18:13:15.331982 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:32394] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "ad4TO-tqnEmNU9vpHClWBgAAAMU"]
[Tue Apr 14 18:13:17.431105 2026] [:error] [pid 60074:tid 60078] [client 172.213.160.163:48470] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "ad4TPetqnEmNU9vpHClWCAAAAMI"]
[Tue Apr 14 18:13:19.089282 2026] [:error] [pid 22177:tid 22202] [client 172.213.160.163:5944] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "ad4TP4TVeJSXHDIlEDtIEwAAARc"]
[Tue Apr 14 18:13:20.535545 2026] [:error] [pid 59987:tid 60065] [client 172.213.160.163:24677] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "ad4TQFWpk-Tfi6_vLKrwJQAAAJI"]
[Tue Apr 14 18:13:21.360247 2026] [:error] [pid 22177:tid 22183] [client 172.213.160.163:24646] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "ad4TQYTVeJSXHDIlEDtIHAAAAQQ"]
[Tue Apr 14 18:13:22.337659 2026] [:error] [pid 60074:tid 60076] [client 172.213.160.163:19874] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "ad4TQutqnEmNU9vpHClWDgAAAMA"]
[Tue Apr 14 18:13:23.078924 2026] [:error] [pid 59987:tid 60061] [client 172.213.160.163:32437] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "ad4TQ1Wpk-Tfi6_vLKrwNgAAAI4"]
[Tue Apr 14 18:13:24.239283 2026] [:error] [pid 59986:tid 60029] [client 172.213.160.163:38049] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "ad4TRJ6axKeW6bX4H7cnMgAAAEk"]
[Tue Apr 14 18:13:25.390452 2026] [:error] [pid 60074:tid 60091] [client 172.213.160.163:20366] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "ad4TRetqnEmNU9vpHClWIwAAAM8"]
[Tue Apr 14 18:13:27.125662 2026] [:error] [pid 59986:tid 60037] [client 172.213.160.163:25960] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "ad4TR56axKeW6bX4H7cnNgAAAFE"]
[Tue Apr 14 18:13:28.799686 2026] [:error] [pid 22177:tid 22181] [client 172.213.160.163:5925] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "ad4TSITVeJSXHDIlEDtIPAAAAQI"]
[Tue Apr 14 18:13:29.864376 2026] [:error] [pid 59985:tid 60014] [client 172.213.160.163:32405] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "ad4TSegHaxkvLE6V1kk_CwAAABU"]
[Tue Apr 14 18:13:31.009106 2026] [:error] [pid 60074:tid 60089] [client 172.213.160.163:19903] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ad4TS-tqnEmNU9vpHClWKQAAAM0"]
[Tue Apr 14 18:13:32.074476 2026] [:error] [pid 22177:tid 22193] [client 172.213.160.163:5919] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ad4TTITVeJSXHDIlEDtITQAAAQ4"]
[Tue Apr 14 18:13:32.799351 2026] [:error] [pid 60074:tid 60085] [client 172.213.160.163:25921] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ad4TTOtqnEmNU9vpHClWNgAAAMk"]
[Tue Apr 14 18:13:33.984683 2026] [:error] [pid 59985:tid 60004] [client 172.213.160.163:24683] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "ad4TTegHaxkvLE6V1kk_DgAAAAs"]
[Tue Apr 14 18:13:34.657684 2026] [:error] [pid 59987:tid 60066] [client 172.213.160.163:48452] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TTlWpk-Tfi6_vLKrwQgAAAJM"]
[Tue Apr 14 18:13:35.822524 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:38618] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TT-tqnEmNU9vpHClWQQAAAM4"]
[Tue Apr 14 18:13:37.640958 2026] [:error] [pid 60074:tid 60096] [client 172.213.160.163:48506] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TUetqnEmNU9vpHClWRwAAANQ"]
[Tue Apr 14 18:13:38.719962 2026] [:error] [pid 59986:tid 60035] [client 172.213.160.163:5900] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ad4TUp6axKeW6bX4H7cnPwAAAE8"]
[Tue Apr 14 18:13:39.512430 2026] [:error] [pid 22177:tid 22202] [client 172.213.160.163:25957] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "ad4TU4TVeJSXHDIlEDtIWAAAARc"]
[Tue Apr 14 18:13:41.412694 2026] [:error] [pid 59985:tid 60010] [client 172.213.160.163:20390] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "ad4TVegHaxkvLE6V1kk_EwAAABE"]
[Tue Apr 14 18:13:42.497591 2026] [:error] [pid 59986:tid 60032] [client 172.213.160.163:48929] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "ad4TVp6axKeW6bX4H7cnQgAAAEw"]
[Tue Apr 14 18:13:43.309808 2026] [:error] [pid 22177:tid 22189] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 14 18:13:43.698077 2026] [:error] [pid 22177:tid 22179] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 14 18:13:44.208271 2026] [:error] [pid 22177:tid 22191] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 14 18:13:44.457067 2026] [:error] [pid 22177:tid 22180] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 14 18:13:44.691452 2026] [:error] [pid 22177:tid 22197] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Apr 14 18:13:45.271792 2026] [:error] [pid 22177:tid 22198] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Tue Apr 14 18:13:45.911388 2026] [:error] [pid 22177:tid 22187] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue Apr 14 18:13:46.146172 2026] [:error] [pid 22177:tid 22185] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Tue Apr 14 18:13:46.387944 2026] [:error] [pid 22177:tid 22186] [client 172.213.160.163:48920] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Apr 14 18:13:46.623348 2026] [:error] [pid 22177:tid 22197] [client 172.213.160.163:48920] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "ad4TWoTVeJSXHDIlEDtIdQAAARI"]
[Tue Apr 14 18:13:47.812313 2026] [:error] [pid 59986:tid 60027] [client 172.213.160.163:48462] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "ad4TW56axKeW6bX4H7cnSgAAAEc"]
[Tue Apr 14 18:13:50.093816 2026] [:error] [pid 59985:tid 60008] [client 172.213.160.163:25866] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "ad4TXugHaxkvLE6V1kk_FgAAAA8"]
[Tue Apr 14 18:13:51.313374 2026] [:error] [pid 60074:tid 60080] [client 172.213.160.163:24680] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "ad4TX-tqnEmNU9vpHClWXQAAAMQ"]
[Tue Apr 14 18:13:51.982042 2026] [:error] [pid 59987:tid 60067] [client 172.213.160.163:29035] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ad4TX1Wpk-Tfi6_vLKrwUwAAAJQ"]
[Tue Apr 14 18:13:52.972801 2026] [:error] [pid 59985:tid 60015] [client 172.213.160.163:50297] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ad4TYOgHaxkvLE6V1kk_GgAAABY"]
[Tue Apr 14 18:13:53.840939 2026] [:error] [pid 60074:tid 60079] [client 172.213.160.163:21064] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ad4TYetqnEmNU9vpHClWYgAAAMM"]
[Tue Apr 14 18:13:54.737341 2026] [:error] [pid 59986:tid 60038] [client 172.213.160.163:18917] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ad4TYp6axKeW6bX4H7cnVgAAAFI"]
[Tue Apr 14 18:13:55.535491 2026] [:error] [pid 59987:tid 60060] [client 172.213.160.163:49788] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ad4TY1Wpk-Tfi6_vLKrwVQAAAI0"]
[Tue Apr 14 18:13:56.394322 2026] [:error] [pid 60074:tid 60093] [client 172.213.160.163:39264] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ad4TZOtqnEmNU9vpHClWawAAANE"]
[Tue Apr 14 18:13:57.355287 2026] [:error] [pid 59986:tid 60044] [client 172.213.160.163:39245] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ad4TZZ6axKeW6bX4H7cnWgAAAFg"]
[Tue Apr 14 18:13:58.378917 2026] [:error] [pid 60074:tid 60080] [client 172.213.160.163:44071] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ad4TZutqnEmNU9vpHClWcQAAAMQ"]
[Tue Apr 14 18:13:59.026961 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:44068] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ad4TZ-tqnEmNU9vpHClWcgAAAMg"]
[Tue Apr 14 18:14:00.217512 2026] [:error] [pid 59985:tid 60002] [client 172.213.160.163:64483] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ad4TaOgHaxkvLE6V1kk_HgAAAAk"]
[Tue Apr 14 18:14:01.181610 2026] [:error] [pid 60074:tid 60095] [client 172.213.160.163:48392] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ad4TaetqnEmNU9vpHClWewAAANM"]
[Tue Apr 14 18:14:01.859297 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:30164] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ad4TaetqnEmNU9vpHClWfwAAAMU"]
[Tue Apr 14 18:14:02.542150 2026] [:error] [pid 60074:tid 60077] [client 172.213.160.163:44064] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ad4TautqnEmNU9vpHClWgAAAAME"]
[Tue Apr 14 18:14:03.457111 2026] [:error] [pid 60074:tid 60083] [client 172.213.160.163:21646] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ad4Ta-tqnEmNU9vpHClWgwAAAMc"]
[Tue Apr 14 18:14:04.299541 2026] [:error] [pid 60074:tid 60093] [client 172.213.160.163:34317] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ad4TbOtqnEmNU9vpHClWhwAAANE"]
[Tue Apr 14 18:14:04.968816 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:22269] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ad4TbOtqnEmNU9vpHClWiAAAAMg"]
[Tue Apr 14 18:14:05.910981 2026] [:error] [pid 59987:tid 60047] [client 172.213.160.163:46679] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "ad4TbVWpk-Tfi6_vLKrwWgAAAIA"]
[Tue Apr 14 18:14:06.737687 2026] [:error] [pid 59986:tid 60036] [client 172.213.160.163:5227] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "ad4Tbp6axKeW6bX4H7cnXQAAAFA"]
[Tue Apr 14 18:14:07.735512 2026] [:error] [pid 59986:tid 60030] [client 172.213.160.163:21662] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "ad4Tb56axKeW6bX4H7cnYQAAAEo"]
[Tue Apr 14 18:14:08.758828 2026] [:error] [pid 60074:tid 60090] [client 172.213.160.163:35098] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "ad4TcOtqnEmNU9vpHClWlAAAAM4"]
[Tue Apr 14 18:14:09.593672 2026] [:error] [pid 60074:tid 60089] [client 172.213.160.163:18859] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ad4TcetqnEmNU9vpHClWmwAAAM0"]
[Tue Apr 14 18:14:11.566770 2026] [:error] [pid 60074:tid 60086] [client 172.213.160.163:49667] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ad4Tc-tqnEmNU9vpHClWqAAAAMo"]
[Tue Apr 14 18:14:12.409016 2026] [:error] [pid 59985:tid 59999] [client 172.213.160.163:36957] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ad4TdOgHaxkvLE6V1kk_KQAAAAY"]
[Tue Apr 14 18:14:13.831121 2026] [:error] [pid 59985:tid 59995] [client 172.213.160.163:41941] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ad4TdegHaxkvLE6V1kk_LwAAAAI"]
[Tue Apr 14 18:14:14.974366 2026] [:error] [pid 59985:tid 59996] [client 172.213.160.163:35083] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ad4TdugHaxkvLE6V1kk_OAAAAAM"]
[Tue Apr 14 18:14:15.636790 2026] [:error] [pid 59987:tid 60061] [client 172.213.160.163:35129] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ad4Td1Wpk-Tfi6_vLKrwawAAAI4"]
[Tue Apr 14 18:14:16.348410 2026] [:error] [pid 59986:tid 60042] [client 172.213.160.163:19230] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ad4TeJ6axKeW6bX4H7cnZgAAAFY"]
[Tue Apr 14 18:14:17.175635 2026] [:error] [pid 59986:tid 60040] [client 172.213.160.163:33146] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "ad4TeZ6axKeW6bX4H7cnaQAAAFQ"]
[Tue Apr 14 18:14:17.909687 2026] [:error] [pid 59987:tid 60066] [client 172.213.160.163:43357] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4TeVWpk-Tfi6_vLKrwbQAAAJM"]
[Tue Apr 14 18:14:19.787469 2026] [:error] [pid 59986:tid 60042] [client 172.213.160.163:37680] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4Te56axKeW6bX4H7cndwAAAFY"]
[Tue Apr 14 18:14:22.377062 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:37685] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4TfoTVeJSXHDIlEDtIigAAAQk"]
[Tue Apr 14 18:14:23.501208 2026] [:error] [pid 60074:tid 60094] [client 172.213.160.163:55238] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "ad4Tf-tqnEmNU9vpHClWuQAAANI"]
[Tue Apr 14 18:14:31.332448 2026] [:error] [pid 22177:tid 22198] [client 172.213.160.163:23560] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ad4Th4TVeJSXHDIlEDtInAAAARM"]
[Tue Apr 14 18:14:32.112305 2026] [:error] [pid 59987:tid 60061] [client 172.213.160.163:5611] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ad4TiFWpk-Tfi6_vLKrwfgAAAI4"]
[Tue Apr 14 18:14:32.942645 2026] [:error] [pid 60074:tid 60091] [client 172.213.160.163:5668] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ad4TiOtqnEmNU9vpHClWzQAAAM8"]
[Tue Apr 14 18:14:34.974819 2026] [:error] [pid 59986:tid 60032] [client 172.213.160.163:61208] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ad4Tip6axKeW6bX4H7cnigAAAEw"]
[Tue Apr 14 18:14:35.788073 2026] [:error] [pid 59985:tid 60005] [client 172.213.160.163:37633] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ad4Ti-gHaxkvLE6V1kk_UwAAAAw"]
[Tue Apr 14 18:14:36.620505 2026] [:error] [pid 60074:tid 60091] [client 172.213.160.163:23587] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ad4TjOtqnEmNU9vpHClW5QAAAM8"]
[Tue Apr 14 18:14:37.335792 2026] [:error] [pid 59985:tid 60015] [client 172.213.160.163:43265] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ad4TjegHaxkvLE6V1kk_WAAAABY"]
[Tue Apr 14 18:14:38.522786 2026] [:error] [pid 59985:tid 59996] [client 172.213.160.163:29617] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ad4TjugHaxkvLE6V1kk_WwAAAAM"]
[Tue Apr 14 18:14:39.201456 2026] [:error] [pid 59985:tid 60006] [client 172.213.160.163:5588] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ad4Tj-gHaxkvLE6V1kk_XQAAAA0"]
[Tue Apr 14 18:14:40.074306 2026] [:error] [pid 59986:tid 60030] [client 172.213.160.163:47134] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ad4TkJ6axKeW6bX4H7cnlQAAAEo"]
[Tue Apr 14 18:14:41.031332 2026] [:error] [pid 59987:tid 60061] [client 172.213.160.163:23590] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ad4TkVWpk-Tfi6_vLKrwiQAAAI4"]
[Tue Apr 14 18:14:42.782835 2026] [:error] [pid 59987:tid 60053] [client 172.213.160.163:61202] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ad4TklWpk-Tfi6_vLKrwjAAAAIY"]
[Tue Apr 14 18:14:44.162942 2026] [:error] [pid 59987:tid 60051] [client 172.213.160.163:33763] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "ad4TlFWpk-Tfi6_vLKrwkAAAAIQ"]
[Tue Apr 14 18:14:45.347455 2026] [:error] [pid 22177:tid 22195] [client 172.213.160.163:27068] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "ad4TlYTVeJSXHDIlEDtItQAAARA"]
[Tue Apr 14 18:14:46.009499 2026] [:error] [pid 22177:tid 22180] [client 172.213.160.163:25328] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Tue Apr 14 18:14:46.262281 2026] [:error] [pid 22177:tid 22179] [client 172.213.160.163:25328] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Tue Apr 14 18:14:46.744456 2026] [:error] [pid 22177:tid 22197] [client 172.213.160.163:25328] [client 172.213.160.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ad4TloTVeJSXHDIlEDtIwwAAARI"]
[Tue Apr 14 18:14:47.486308 2026] [:error] [pid 22177:tid 22187] [client 172.213.160.163:25323] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 14 18:14:48.195384 2026] [:error] [pid 22177:tid 22184] [client 172.213.160.163:25323] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Tue Apr 14 18:14:48.431087 2026] [:error] [pid 22177:tid 22186] [client 172.213.160.163:25323] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Tue Apr 14 18:14:48.666388 2026] [:error] [pid 22177:tid 22189] [client 172.213.160.163:25323] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Tue Apr 14 18:14:48.902662 2026] [:error] [pid 22177:tid 22193] [client 172.213.160.163:25323] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Tue Apr 14 18:14:49.149050 2026] [:error] [pid 22177:tid 22200] [client 172.213.160.163:25323] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Tue Apr 14 18:14:49.382668 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:25323] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "ad4TmYTVeJSXHDIlEDtI1QAAAQk"]
[Tue Apr 14 18:14:50.244693 2026] [:error] [pid 60074:tid 60095] [client 172.213.160.163:5343] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "ad4TmutqnEmNU9vpHClW8AAAANM"]
[Tue Apr 14 18:14:51.191691 2026] [:error] [pid 59985:tid 60000] [client 172.213.160.163:25327] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "ad4Tm-gHaxkvLE6V1kk_bwAAAAc"]
[Tue Apr 14 18:14:52.026290 2026] [:error] [pid 59986:tid 60031] [client 172.213.160.163:37725] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "ad4TnJ6axKeW6bX4H7cnqAAAAEs"]
[Tue Apr 14 18:14:53.260147 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:27019] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "ad4TnetqnEmNU9vpHClXBQAAAMg"]
[Tue Apr 14 18:14:54.403526 2026] [:error] [pid 22177:tid 22193] [client 172.213.160.163:19488] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "ad4TnoTVeJSXHDIlEDtI4wAAAQ4"]
[Tue Apr 14 18:14:55.684016 2026] [:error] [pid 22177:tid 22184] [client 172.213.160.163:5373] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "ad4Tn4TVeJSXHDIlEDtI6AAAAQU"]
[Tue Apr 14 18:14:56.618547 2026] [:error] [pid 60074:tid 60096] [client 172.213.160.163:43290] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "ad4ToOtqnEmNU9vpHClXDgAAANQ"]
[Tue Apr 14 18:14:57.508701 2026] [:error] [pid 59986:tid 60021] [client 172.213.160.163:43288] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "ad4ToZ6axKeW6bX4H7cnsAAAAEE"]
[Tue Apr 14 18:14:58.240492 2026] [:error] [pid 59987:tid 60070] [client 172.213.160.163:61242] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "ad4TolWpk-Tfi6_vLKrwsAAAAJc"]
[Tue Apr 14 18:15:00.341689 2026] [:error] [pid 60074:tid 60089] [client 172.213.160.163:47154] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "ad4TpOtqnEmNU9vpHClXHwAAAM0"]
[Tue Apr 14 18:15:01.585717 2026] [:error] [pid 59987:tid 60055] [client 172.213.160.163:37726] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "ad4TpVWpk-Tfi6_vLKrwuAAAAIg"]
[Tue Apr 14 18:15:02.532625 2026] [:error] [pid 60074:tid 60093] [client 172.213.160.163:27042] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "ad4TputqnEmNU9vpHClXMAAAANE"]
[Tue Apr 14 18:15:06.114952 2026] [:error] [pid 22177:tid 22190] [client 172.213.160.163:64564] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "ad4TqoTVeJSXHDIlEDtI_QAAAQs"]
[Tue Apr 14 18:15:07.032989 2026] [:error] [pid 22177:tid 22201] [client 172.213.160.163:29570] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "ad4Tq4TVeJSXHDIlEDtJAQAAARY"]
[Tue Apr 14 18:15:07.907055 2026] [:error] [pid 59987:tid 60048] [client 172.213.160.163:5643] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "ad4Tq1Wpk-Tfi6_vLKrwvgAAAIE"]
[Tue Apr 14 18:15:08.605575 2026] [:error] [pid 60074:tid 60099] [client 172.213.160.163:5342] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ad4TrOtqnEmNU9vpHClXWQAAANc"]
[Tue Apr 14 18:15:09.555067 2026] [:error] [pid 60074:tid 60091] [client 172.213.160.163:27062] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ad4TretqnEmNU9vpHClXWwAAAM8"]
[Tue Apr 14 18:15:10.336671 2026] [:error] [pid 22177:tid 22199] [client 172.213.160.163:27044] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ad4TroTVeJSXHDIlEDtJDgAAARQ"]
[Tue Apr 14 18:15:11.354026 2026] [:error] [pid 59987:tid 60068] [client 172.213.160.163:48964] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "ad4Tr1Wpk-Tfi6_vLKrwyAAAAJU"]
[Tue Apr 14 18:15:12.368032 2026] [:error] [pid 59985:tid 59999] [client 172.213.160.163:6105] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "ad4TsOgHaxkvLE6V1kk_dQAAAAY"]
[Tue Apr 14 18:15:13.460856 2026] [:error] [pid 22177:tid 22198] [client 172.213.160.163:27052] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "ad4TsYTVeJSXHDIlEDtJIQAAARM"]
[Tue Apr 14 18:15:14.736973 2026] [:error] [pid 60074:tid 60084] [client 172.213.160.163:37734] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "ad4TsutqnEmNU9vpHClXZgAAAMg"]
[Tue Apr 14 18:15:16.717180 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:5365] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "ad4TtOtqnEmNU9vpHClXeQAAAMU"]
[Tue Apr 14 18:15:17.644269 2026] [:error] [pid 60074:tid 60094] [client 172.213.160.163:44648] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "ad4TtetqnEmNU9vpHClXggAAANI"]
[Tue Apr 14 18:15:18.414132 2026] [:error] [pid 22177:tid 22201] [client 172.213.160.163:6094] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "ad4TtoTVeJSXHDIlEDtJJwAAARY"]
[Tue Apr 14 18:15:19.563733 2026] [:error] [pid 60074:tid 60077] [client 172.213.160.163:21694] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "ad4Tt-tqnEmNU9vpHClXkQAAAME"]
[Tue Apr 14 18:15:20.317378 2026] [:error] [pid 59985:tid 60004] [client 172.213.160.163:27031] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "ad4TuOgHaxkvLE6V1kk_dwAAAAs"]
[Tue Apr 14 18:15:21.465071 2026] [:error] [pid 59987:tid 60068] [client 172.213.160.163:21484] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ad4TuVWpk-Tfi6_vLKrw4QAAAJU"]
[Tue Apr 14 18:15:22.373324 2026] [:error] [pid 59985:tid 60010] [client 172.213.160.163:64512] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ad4TuugHaxkvLE6V1kk_eQAAABE"]
[Tue Apr 14 18:15:24.091073 2026] [:error] [pid 59985:tid 60011] [client 172.213.160.163:64525] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ad4TvOgHaxkvLE6V1kk_ewAAABI"]
[Tue Apr 14 18:15:26.168385 2026] [:error] [pid 22177:tid 22189] [client 172.213.160.163:48921] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ad4TvoTVeJSXHDIlEDtJPwAAAQo"]
[Tue Apr 14 18:15:29.292328 2026] [:error] [pid 60074:tid 60100] [client 172.213.160.163:50268] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "ad4TwetqnEmNU9vpHClXswAAANg"]
[Tue Apr 14 18:15:29.902823 2026] [:error] [pid 59986:tid 60020] [client 172.213.160.163:25292] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "ad4TwZ6axKeW6bX4H7cnywAAAEA"]
[Tue Apr 14 18:15:31.394230 2026] [:error] [pid 59986:tid 60041] [client 172.213.160.163:49006] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "ad4Tw56axKeW6bX4H7cn0QAAAFU"]
[Tue Apr 14 18:15:34.137878 2026] [:error] [pid 22177:tid 22183] [client 172.213.160.163:21652] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "ad4TxoTVeJSXHDIlEDtJUAAAAQQ"]
[Tue Apr 14 18:15:35.497749 2026] [:error] [pid 60074:tid 60081] [client 172.213.160.163:6012] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "ad4Tx-tqnEmNU9vpHClXwAAAAMU"]
[Tue Apr 14 18:15:37.622448 2026] [:error] [pid 60074:tid 60085] [client 172.213.160.163:21671] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "ad4TyetqnEmNU9vpHClXxQAAAMk"]
[Tue Apr 14 18:15:38.818898 2026] [:error] [pid 60074:tid 60095] [client 172.213.160.163:49023] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "ad4TyutqnEmNU9vpHClXzAAAANM"]
[Tue Apr 14 18:15:39.577141 2026] [:error] [pid 60074:tid 60099] [client 172.213.160.163:28984] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "ad4Ty-tqnEmNU9vpHClXzwAAANc"]
[Tue Apr 14 18:15:40.922485 2026] [:error] [pid 60074:tid 60078] [client 172.213.160.163:28943] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ad4TzOtqnEmNU9vpHClX2wAAAMI"]
[Tue Apr 14 18:15:41.826280 2026] [:error] [pid 60074:tid 60098] [client 172.213.160.163:48971] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ad4TzetqnEmNU9vpHClX3wAAANY"]
[Tue Apr 14 18:15:42.574545 2026] [:error] [pid 22177:tid 22192] [client 172.213.160.163:6005] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ad4TzoTVeJSXHDIlEDtJUwAAAQ0"]
[Tue Apr 14 18:15:43.341664 2026] [:error] [pid 22177:tid 22187] [client 172.213.160.163:21689] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "ad4Tz4TVeJSXHDIlEDtJWAAAAQg"]
[Tue Apr 14 18:15:44.840035 2026] [:error] [pid 60074:tid 60087] [client 172.213.160.163:48968] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "ad4T0OtqnEmNU9vpHClX7wAAAMs"]
[Tue Apr 14 18:15:46.406582 2026] [:error] [pid 60074:tid 60076] [client 172.213.160.163:28934] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "ad4T0utqnEmNU9vpHClX_AAAAMA"]
[Tue Apr 14 18:15:47.626049 2026] [:error] [pid 60074:tid 60094] [client 172.213.160.163:21673] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "ad4T0-tqnEmNU9vpHClYBQAAANI"]
[Tue Apr 14 18:15:49.733868 2026] [:error] [pid 59987:tid 60047] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 14 18:15:49.971134 2026] [:error] [pid 59987:tid 60065] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Tue Apr 14 18:15:50.212982 2026] [:error] [pid 59987:tid 60061] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Tue Apr 14 18:15:50.449630 2026] [:error] [pid 59987:tid 60056] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/class19.php
[Tue Apr 14 18:15:50.685199 2026] [:error] [pid 59987:tid 60055] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/class20.php
[Tue Apr 14 18:15:50.922213 2026] [:error] [pid 59987:tid 60066] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Tue Apr 14 18:15:51.158198 2026] [:error] [pid 59987:tid 60048] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/vee.php
[Tue Apr 14 18:15:51.512633 2026] [:error] [pid 59987:tid 60062] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Tue Apr 14 18:15:51.813032 2026] [:error] [pid 59987:tid 60057] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Tue Apr 14 18:15:52.052671 2026] [:error] [pid 59987:tid 60071] [client 172.213.160.163:22717] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Tue Apr 14 18:15:52.285282 2026] [:error] [pid 59987:tid 60053] [client 172.213.160.163:22717] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ad4T2FWpk-Tfi6_vLKrxIgAAAIY"]
[Tue Apr 14 18:15:53.386299 2026] [:error] [pid 22177:tid 22196] [client 172.213.160.163:50284] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ad4T2YTVeJSXHDIlEDtJZAAAARE"]
[Tue Apr 14 18:15:54.092164 2026] [:error] [pid 59987:tid 60061] [client 172.213.160.163:50248] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ad4T2lWpk-Tfi6_vLKrxLgAAAI4"]
[Tue Apr 14 18:15:54.995566 2026] [:error] [pid 22177:tid 22188] [client 172.213.160.163:31209] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ad4T2oTVeJSXHDIlEDtJaAAAAQk"]
[Tue Apr 14 18:15:55.843771 2026] [:error] [pid 59986:tid 60037] [client 172.213.160.163:50234] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "ad4T256axKeW6bX4H7cn7gAAAFE"]
[Tue Apr 14 18:15:56.660133 2026] [:error] [pid 59985:tid 60004] [client 172.213.160.163:50232] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "ad4T3OgHaxkvLE6V1kk_kQAAAAs"]
[Tue Apr 14 18:15:58.266279 2026] [:error] [pid 60074:tid 60080] [client 172.213.160.163:35590] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "ad4T3utqnEmNU9vpHClYGgAAAMQ"]
[Tue Apr 14 18:15:59.173182 2026] [:error] [pid 60074:tid 60097] [client 172.213.160.163:22667] [client 172.213.160.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "ad4T3-tqnEmNU9vpHClYHwAAANU"]
[Tue Apr 14 21:55:07.413020 2026] [:error] [pid 22177:tid 22184] [client 192.144.148.122:45378] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad5HO4TVeJSXHDIlEDuQRwAAAQU"]
[Tue Apr 14 22:15:54.810429 2026] [:error] [pid 59986:tid 60024] [client 216.81.248.211:50698] [client 216.81.248.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "ad5MGp6axKeW6bX4H7eeIwAAAEQ"]
[Tue Apr 14 22:54:38.092690 2026] [:error] [pid 3810:tid 3817] [client 170.106.163.48:35470] [client 170.106.163.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad5VLsqc5XaYZhFXVGfOeQAAAYQ"]
[Tue Apr 14 23:27:26.041650 2026] [:error] [pid 59986:tid 60027] [client 43.165.69.68:41612] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad5c3p6axKeW6bX4H7fErwAAAEc"]
[Wed Apr 15 02:12:15.392915 2026] [:error] [pid 62295:tid 62323] [client 43.166.240.231:55136] [client 43.166.240.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad6Dfxng-JDNFCa0BniNWQAAABg"]
[Wed Apr 15 02:31:00.158679 2026] [:error] [pid 62295:tid 62306] [client 45.131.194.37:61611] [client 45.131.194.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.194.37, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "ad6H5Bng-JDNFCa0BniUUwAAAAc"]
[Wed Apr 15 02:31:00.162704 2026] [:error] [pid 62295:tid 62306] [client 45.131.194.37:61611] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed Apr 15 04:24:46.500141 2026] [:error] [pid 4169:tid 4173] [client 1.15.52.154:51002] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad6ijh15U5D-N99n_jJOWgAAAME"]
[Wed Apr 15 04:37:35.282390 2026] [:error] [pid 4067:tid 4149] [client 130.12.180.144:43642] [client 130.12.180.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/HEAD"] [unique_id "ad6lj-5XHBJU8ZrRxZ0bVwAAAJI"]
[Wed Apr 15 04:37:37.040443 2026] [:error] [pid 4169:tid 4184] [client 130.12.180.144:41716] [client 130.12.180.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ad6lkR15U5D-N99n_jJY_QAAAMw"]
[Wed Apr 15 04:37:37.836842 2026] [:error] [pid 4169:tid 4197] [client 130.12.180.144:26202] [client 130.12.180.144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/HEAD"] [unique_id "ad6lkR15U5D-N99n_jJY_wAAANY"]
[Wed Apr 15 05:01:09.706749 2026] [:error] [pid 4066:tid 4111] [client 170.106.140.110:50868] [client 170.106.140.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad6rFYC2YXfSPsC9O_BaAAAAAEc"]
[Wed Apr 15 12:14:42.174829 2026] [:error] [pid 30555:tid 30614] [client 43.165.67.57:54504] [client 43.165.67.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad8QslTZEITMpQMsOnjeIAAAAIA"]
[Wed Apr 15 16:54:25.809596 2026] [:error] [pid 12433:tid 12459] [client 43.166.136.24:56612] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad9SQbwxDHWF005pP_68GwAAARg"]
[Wed Apr 15 20:00:51.196089 2026] [:error] [pid 31053:tid 31072] [client 43.133.91.48:59182] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad998xcEkLCmvF0fjDe_YAAAAJA"]
[Wed Apr 15 22:27:29.900128 2026] [:error] [pid 23913:tid 23931] [client 216.73.216.212:14319] [client 216.73.216.212] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||rejuva.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/robots.txt"] [unique_id "ad-gUVUaK3MLdSaLOyjEXgAAAVA"]
[Wed Apr 15 22:37:15.870296 2026] [:error] [pid 23913:tid 23918] [client 64.118.133.85:43597] [client 64.118.133.85] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/index.php"] [unique_id "ad-im1UaK3MLdSaLOyjJpwAAAUM"]
[Wed Apr 15 22:37:18.815280 2026] [:error] [pid 31053:tid 31079] [client 64.118.133.85:34781] [client 64.118.133.85] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-json/slider-future/v1/upload-image/"] [unique_id "ad-inhcEkLCmvF0fjDcw6QAAAJc"]
[Wed Apr 15 22:37:20.034740 2026] [:error] [pid 30956:tid 30983] [client 64.118.133.85:34087] [client 64.118.133.85] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "ad-ioEBGUpjaWntNYq2dYwAAABc"]
[Wed Apr 15 22:37:29.074640 2026] [:error] [pid 23913:tid 23933] [client 64.118.133.85:37899] [client 64.118.133.85] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/index.php"] [unique_id "ad-iqVUaK3MLdSaLOyjJ2gAAAVI"]
[Wed Apr 15 22:37:29.120981 2026] [:error] [pid 30956:tid 30963] [client 64.118.133.85:34253] [client 64.118.133.85] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "ad-iqUBGUpjaWntNYq2dZAAAAAM"]
[Wed Apr 15 22:37:36.088377 2026] [:error] [pid 31053:tid 31059] [client 64.118.133.85:45257] [client 64.118.133.85] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "ad-isBcEkLCmvF0fjDcxDwAAAIM"]
[Wed Apr 15 22:37:42.105137 2026] [:error] [pid 23913:tid 23934] [client 64.118.133.85:33341] [client 64.118.133.85] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-json/am-member/license"] [unique_id "ad-itlUaK3MLdSaLOyjKAwAAAVM"]
[Wed Apr 15 22:37:44.526610 2026] [:error] [pid 30958:tid 31040] [client 151.158.1.202:36919] [client 151.158.1.202] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-json/am-member/license"] [unique_id "ad-irseG3wSKTO7NWFHglQAAANg"]
[Wed Apr 15 22:51:03.732270 2026] [:error] [pid 31053:tid 31074] [client 192.227.138.144:58238] [client 192.227.138.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad-l1xcEkLCmvF0fjDc4qgAAAJI"], referer: https://www.google.com
[Wed Apr 15 23:29:01.609991 2026] [:error] [pid 30957:tid 30998] [client 123.187.240.242:36755] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ad-uvX5gwVEVXHfVSirCTwAAAEk"]
[Wed Apr 15 23:38:13.165583 2026] [:error] [pid 30956:tid 30969] [client 82.26.82.157:40515] [client 82.26.82.157] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "ad-w5UBGUpjaWntNYq2m3AAAAAk"]
[Wed Apr 15 23:38:43.049348 2026] [:error] [pid 31053:tid 31071] [client 82.26.82.157:44357] [client 82.26.82.157] ModSecurity: Error reading request body: Partial results are valid but processing is incomplete [hostname "rejuva.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "ad-xAxcEkLCmvF0fjDdWOgAAAI8"]
[Wed Apr 15 23:46:12.257306 2026] [:error] [pid 31053:tid 31078] [client 43.165.65.180:54838] [client 43.165.65.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad-yxBcEkLCmvF0fjDdZ3QAAAJY"]
[Thu Apr 16 02:43:08.974571 2026] [:error] [pid 912:tid 992] [client 91.200.101.138:61200] [client 91.200.101.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/graphql"] [unique_id "ad_cPMU0_VzYCBipADk8EAAAARg"]
[Thu Apr 16 03:44:25.831838 2026] [:error] [pid 30138:tid 30184] [client 48.214.55.34:23441] [client 48.214.55.34] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ad_qmf7uEIBsD9Ishpnf0QAAAYA"], referer: https://github.com/
[Thu Apr 16 03:45:05.393897 2026] [:error] [pid 30137:tid 30174] [client 172.174.188.181:59513] [client 172.174.188.181] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ad_qwdkzSU5uYok_jC4YEgAAAVE"]
[Thu Apr 16 03:45:58.001724 2026] [:error] [pid 26996:tid 27042] [client 64.236.200.114:60503] [client 64.236.200.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ad_q9rvcyX7-S8KS4WMPwgAAAEk"]
[Thu Apr 16 03:46:24.918564 2026] [:error] [pid 30138:tid 30194] [client 64.236.133.129:60481] [client 64.236.133.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ad_rEP7uEIBsD9Ishpng6AAAAYo"], referer: https://www.facebook.com/
[Thu Apr 16 03:47:35.717027 2026] [:error] [pid 30138:tid 30204] [client 52.162.9.246:40258] [client 52.162.9.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ad_rV_7uEIBsD9IshpnhcgAAAZQ"], referer: https://www.google.com/
[Thu Apr 16 04:38:00.577013 2026] [:error] [pid 57639:tid 57667] [client 43.130.78.203:55522] [client 43.130.78.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ad_3KKMCQoTw7TsxWumgBgAAANU"]
[Thu Apr 16 08:29:52.697250 2026] [:error] [pid 57639:tid 57658] [client 98.93.160.221:52006] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aeAtgKMCQoTw7TsxWun-1AAAAMw"]
[Thu Apr 16 10:34:40.325671 2026] [:error] [pid 57537:tid 57582] [client 98.93.160.221:38194] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aeBKwFVQRS8nm73ENAljEAAAAEc"]
[Thu Apr 16 12:35:00.264016 2026] [:error] [pid 57536:tid 57569] [client 43.165.65.180:41438] [client 43.165.65.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeBm9CQU4faGja6jpDvB-wAAABU"]
[Thu Apr 16 15:17:08.845806 2026] [:error] [pid 57538:tid 57602] [client 43.162.97.182:63308] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Thu Apr 16 15:59:10.872292 2026] [:error] [pid 29603:tid 29615] [client 43.162.97.182:55433] File does not exist: /usr/local/apache/htdocs/suspended-page/index.php
[Thu Apr 16 22:26:52.502726 2026] [:error] [pid 57639:tid 57663] [client 43.130.15.147:42326] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeDxrKMCQoTw7TsxWunf1QAAANE"]
[Thu Apr 16 22:36:47.440609 2026] [:error] [pid 7880:tid 7905] [client 34.7.154.241:42718] [client 34.7.154.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aeDz_6aezm4fSGc0yULFhwAAAZQ"]
[Thu Apr 16 22:52:29.543588 2026] [:error] [pid 57639:tid 57666] [client 45.130.203.164:57815] [client 45.130.203.164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/HEAD"] [unique_id "aeD3raMCQoTw7TsxWun3gAAAANQ"]
[Fri Apr 17 00:20:19.229781 2026] [:error] [pid 3245:tid 3264] [client 43.158.91.71:40840] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeEMQ6ESOMTHVLs-uFCvcwAAAQI"]
[Fri Apr 17 00:39:38.038565 2026] [:error] [pid 43386:tid 43445] [client 123.187.240.242:53825] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeEQyu91GAVgUfhPVDGyMQAAAFg"]
[Fri Apr 17 01:19:22.262713 2026] [:error] [pid 43482:tid 43497] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Apr 17 01:19:22.873646 2026] [:error] [pid 43482:tid 43491] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Fri Apr 17 01:19:23.133473 2026] [:error] [pid 43482:tid 43485] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Apr 17 01:19:23.415516 2026] [:error] [pid 43482:tid 43494] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Fri Apr 17 01:19:23.847509 2026] [:error] [pid 43482:tid 43502] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Fri Apr 17 01:19:24.106523 2026] [:error] [pid 43482:tid 43495] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Fri Apr 17 01:19:24.365073 2026] [:error] [pid 43482:tid 43498] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Fri Apr 17 01:19:24.625167 2026] [:error] [pid 43482:tid 43497] [client 74.248.157.73:46616] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Fri Apr 17 01:19:24.901488 2026] [:error] [pid 43482:tid 43506] [client 74.248.157.73:46616] [client 74.248.157.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeEaHD9SZnuKxlHrct2crQAAANY"]
[Fri Apr 17 01:19:29.068596 2026] [:error] [pid 43385:tid 43412] [client 74.248.157.73:42276] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Fri Apr 17 01:19:29.373834 2026] [:error] [pid 43385:tid 43390] [client 74.248.157.73:42276] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Fri Apr 17 01:19:29.674716 2026] [:error] [pid 43385:tid 43402] [client 74.248.157.73:42276] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aeEaIcnIxkJaUI8KNs4SdAAAAA0"]
[Fri Apr 17 01:19:34.099396 2026] [:error] [pid 43482:tid 43486] [client 74.248.157.73:7388] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aeEaJj9SZnuKxlHrct2c4gAAAMI"]
[Fri Apr 17 01:19:42.404409 2026] [:error] [pid 3245:tid 3283] [client 74.248.157.73:62278] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aeEaLqESOMTHVLs-uFDT7QAAARU"]
[Fri Apr 17 01:19:49.144340 2026] [:error] [pid 43482:tid 43492] [client 74.248.157.73:51741] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "aeEaNT9SZnuKxlHrct2dTgAAAMg"]
[Fri Apr 17 01:19:50.340619 2026] [:error] [pid 43482:tid 43486] [client 74.248.157.73:42247] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "aeEaNj9SZnuKxlHrct2dWgAAAMI"]
[Fri Apr 17 01:19:51.579340 2026] [:error] [pid 43385:tid 43412] [client 74.248.157.73:62262] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "aeEaN8nIxkJaUI8KNs4S3wAAABY"]
[Fri Apr 17 01:19:52.719990 2026] [:error] [pid 43482:tid 43484] [client 74.248.157.73:58578] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "aeEaOD9SZnuKxlHrct2dbAAAAMA"]
[Fri Apr 17 01:19:53.695939 2026] [:error] [pid 43482:tid 43505] [client 74.248.157.73:62302] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aeEaOT9SZnuKxlHrct2ddwAAANU"]
[Fri Apr 17 01:19:55.241019 2026] [:error] [pid 26480:tid 26489] [client 74.248.157.73:58582] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aeEaOwwLDJKTQNfarA1yaAAAAcc"]
[Fri Apr 17 01:19:56.103860 2026] [:error] [pid 26480:tid 26501] [client 74.248.157.73:60341] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aeEaPAwLDJKTQNfarA1ybgAAAdM"]
[Fri Apr 17 01:19:57.068269 2026] [:error] [pid 43482:tid 43493] [client 74.248.157.73:61593] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aeEaPT9SZnuKxlHrct2dggAAAMk"]
[Fri Apr 17 01:19:58.186785 2026] [:error] [pid 43482:tid 43506] [client 74.248.157.73:64214] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeEaPj9SZnuKxlHrct2djQAAANY"]
[Fri Apr 17 01:19:59.187492 2026] [:error] [pid 43482:tid 43493] [client 74.248.157.73:31753] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeEaPz9SZnuKxlHrct2dkQAAAMk"]
[Fri Apr 17 01:20:00.319800 2026] [:error] [pid 43385:tid 43415] [client 74.248.157.73:31765] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeEaQMnIxkJaUI8KNs4TEwAAABg"]
[Fri Apr 17 01:20:01.130697 2026] [:error] [pid 43482:tid 43493] [client 74.248.157.73:60288] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeEaQT9SZnuKxlHrct2doQAAAMk"]
[Fri Apr 17 01:20:02.054848 2026] [:error] [pid 26480:tid 26489] [client 74.248.157.73:52845] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aeEaQgwLDJKTQNfarA1ydwAAAcc"]
[Fri Apr 17 01:20:03.082586 2026] [:error] [pid 43482:tid 43499] [client 74.248.157.73:52870] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aeEaQz9SZnuKxlHrct2dtwAAAM8"]
[Fri Apr 17 01:20:04.207711 2026] [:error] [pid 4086:tid 4103] [client 74.248.157.73:44979] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aeEaRFlz7gxl_exM0FpGIAAAAU8"]
[Fri Apr 17 01:20:06.410772 2026] [:error] [pid 3245:tid 3266] [client 74.248.157.73:51718] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aeEaRqESOMTHVLs-uFDUMwAAAQQ"]
[Fri Apr 17 01:20:07.992055 2026] [:error] [pid 3245:tid 3262] [client 74.248.157.73:42940] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aeEaR6ESOMTHVLs-uFDUOQAAAQA"]
[Fri Apr 17 01:20:09.322979 2026] [:error] [pid 43386:tid 43445] [client 74.248.157.73:46539] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aeEaSe91GAVgUfhPVDG_HwAAAFg"]
[Fri Apr 17 01:20:11.396403 2026] [:error] [pid 43387:tid 43468] [client 74.248.157.73:62237] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aeEaSyBNsONqHxWTakU7vQAAAI8"]
[Fri Apr 17 01:20:12.828142 2026] [:error] [pid 43385:tid 43411] [client 74.248.157.73:44986] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aeEaTMnIxkJaUI8KNs4TWwAAABU"]
[Fri Apr 17 01:20:13.798317 2026] [:error] [pid 43385:tid 43407] [client 74.248.157.73:60293] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeEaTcnIxkJaUI8KNs4TbAAAABI"]
[Fri Apr 17 01:20:14.551727 2026] [:error] [pid 43386:tid 43429] [client 74.248.157.73:52859] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeEaTu91GAVgUfhPVDG_KQAAAEk"]
[Fri Apr 17 01:20:15.600390 2026] [:error] [pid 26102:tid 26105] [client 74.248.157.73:36565] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeEaT_127aFqw6ALdngUBAAAAYA"]
[Fri Apr 17 01:20:16.454596 2026] [:error] [pid 26480:tid 26485] [client 74.248.157.73:62495] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeEaUAwLDJKTQNfarA1yngAAAcM"]
[Fri Apr 17 01:20:17.698822 2026] [:error] [pid 43387:tid 43477] [client 74.248.157.73:7691] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aeEaUSBNsONqHxWTakU7yAAAAJg"]
[Fri Apr 17 01:20:19.200775 2026] [:error] [pid 43385:tid 43393] [client 74.248.157.73:34927] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aeEaU8nIxkJaUI8KNs4TmQAAAAQ"]
[Fri Apr 17 01:20:21.511364 2026] [:error] [pid 3245:tid 3267] [client 74.248.157.73:52907] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aeEaVaESOMTHVLs-uFDUXwAAAQU"]
[Fri Apr 17 01:20:22.629706 2026] [:error] [pid 4086:tid 4100] [client 74.248.157.73:62475] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aeEaVllz7gxl_exM0FpGPwAAAUw"]
[Fri Apr 17 01:20:24.032841 2026] [:error] [pid 43385:tid 43404] [client 74.248.157.73:35531] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeEaWMnIxkJaUI8KNs4TvQAAAA8"]
[Fri Apr 17 01:20:24.684922 2026] [:error] [pid 43385:tid 43412] [client 74.248.157.73:60311] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeEaWMnIxkJaUI8KNs4TygAAABY"]
[Fri Apr 17 01:20:25.429569 2026] [:error] [pid 43385:tid 43410] [client 74.248.157.73:53773] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeEaWcnIxkJaUI8KNs4T4wAAABQ"]
[Fri Apr 17 01:20:26.246680 2026] [:error] [pid 26480:tid 26501] [client 74.248.157.73:46558] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeEaWgwLDJKTQNfarA1yxAAAAdM"]
[Fri Apr 17 01:20:27.288238 2026] [:error] [pid 4086:tid 4092] [client 74.248.157.73:60350] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aeEaW1lz7gxl_exM0FpGRQAAAUQ"]
[Fri Apr 17 01:20:28.429513 2026] [:error] [pid 4086:tid 4104] [client 74.248.157.73:7861] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aeEaXFlz7gxl_exM0FpGSwAAAVA"]
[Fri Apr 17 01:20:29.901583 2026] [:error] [pid 4086:tid 4093] [client 74.248.157.73:42932] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Fri Apr 17 01:20:30.550893 2026] [:error] [pid 4086:tid 4100] [client 74.248.157.73:42932] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Apr 17 01:20:30.872544 2026] [:error] [pid 4086:tid 4101] [client 74.248.157.73:42932] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Fri Apr 17 01:20:32.259753 2026] [:error] [pid 4086:tid 4108] [client 74.248.157.73:42932] [client 74.248.157.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aeEaYFlz7gxl_exM0FpGagAAAVQ"]
[Fri Apr 17 01:20:35.740851 2026] [:error] [pid 3245:tid 3278] [client 74.248.157.73:34942] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Fri Apr 17 01:20:36.032598 2026] [:error] [pid 3245:tid 3270] [client 74.248.157.73:34942] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Fri Apr 17 01:20:36.325085 2026] [:error] [pid 3245:tid 3277] [client 74.248.157.73:34942] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 17 01:20:36.627169 2026] [:error] [pid 3245:tid 3283] [client 74.248.157.73:34942] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Fri Apr 17 01:20:36.936987 2026] [:error] [pid 3245:tid 3270] [client 74.248.157.73:34942] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Fri Apr 17 01:20:37.225530 2026] [:error] [pid 3245:tid 3264] [client 74.248.157.73:34942] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Fri Apr 17 01:20:37.557967 2026] [:error] [pid 3245:tid 3277] [client 74.248.157.73:34942] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aeEaZaESOMTHVLs-uFDUkwAAAQ8"]
[Fri Apr 17 01:20:39.564728 2026] [:error] [pid 43385:tid 43412] [client 74.248.157.73:53776] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aeEaZ8nIxkJaUI8KNs4UYQAAABY"]
[Fri Apr 17 01:20:41.607995 2026] [:error] [pid 43385:tid 43403] [client 74.248.157.73:31734] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aeEaacnIxkJaUI8KNs4UbwAAAA4"]
[Fri Apr 17 01:20:43.130340 2026] [:error] [pid 43482:tid 43501] [client 74.248.157.73:48915] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aeEaaz9SZnuKxlHrct2ekAAAANE"]
[Fri Apr 17 01:20:46.132328 2026] [:error] [pid 43482:tid 43507] [client 74.248.157.73:35551] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeEabj9SZnuKxlHrct2emQAAANc"]
[Fri Apr 17 01:20:48.088310 2026] [:error] [pid 43386:tid 43434] [client 74.248.157.73:48940] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeEacO91GAVgUfhPVDG_mQAAAE4"]
[Fri Apr 17 01:20:49.296896 2026] [:error] [pid 26480:tid 26499] [client 74.248.157.73:55366] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeEacQwLDJKTQNfarA1zXAAAAdE"]
[Fri Apr 17 01:20:52.492874 2026] [:error] [pid 26480:tid 26504] [client 74.248.157.73:35925] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeEadAwLDJKTQNfarA1zZQAAAdY"]
[Fri Apr 17 01:20:55.318569 2026] [:error] [pid 11692:tid 11719] [client 74.248.157.73:48917] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeEad81AYuhm4BZwKNoU2wAAAhY"]
[Fri Apr 17 01:20:56.684889 2026] [:error] [pid 3245:tid 3265] [client 74.248.157.73:35575] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeEaeKESOMTHVLs-uFDUuAAAAQM"]
[Fri Apr 17 01:21:01.337325 2026] [:error] [pid 26102:tid 26119] [client 74.248.157.73:42871] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeEaff127aFqw6ALdngUfQAAAY4"]
[Fri Apr 17 01:21:02.844602 2026] [:error] [pid 11854:tid 11881] [client 74.248.157.73:64144] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeEaftxJCSIaqP1XSdaUPAAAAlg"]
[Fri Apr 17 01:21:09.458925 2026] [:error] [pid 43385:tid 43402] [client 74.248.157.73:55381] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeEahcnIxkJaUI8KNs4VGgAAAA0"]
[Fri Apr 17 01:21:10.661322 2026] [:error] [pid 43385:tid 43406] [client 74.248.157.73:50237] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeEahsnIxkJaUI8KNs4VNQAAABE"]
[Fri Apr 17 01:21:12.172974 2026] [:error] [pid 43385:tid 43401] [client 74.248.157.73:37240] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeEaiMnIxkJaUI8KNs4VSAAAAAw"]
[Fri Apr 17 01:21:13.527827 2026] [:error] [pid 26480:tid 26482] [client 74.248.157.73:8113] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeEaiQwLDJKTQNfarA1z0wAAAcA"]
[Fri Apr 17 01:21:15.238939 2026] [:error] [pid 4086:tid 4112] [client 74.248.157.73:37228] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aeEai1lz7gxl_exM0FpGtgAAAVc"]
[Fri Apr 17 01:21:18.393426 2026] [:error] [pid 43385:tid 43402] [client 74.248.157.73:39736] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aeEajsnIxkJaUI8KNs4VigAAAA0"]
[Fri Apr 17 01:21:20.109129 2026] [:error] [pid 26480:tid 26492] [client 74.248.157.73:64155] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aeEakAwLDJKTQNfarA10AwAAAco"]
[Fri Apr 17 01:21:22.227901 2026] [:error] [pid 43482:tid 43489] [client 74.248.157.73:35917] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aeEakj9SZnuKxlHrct2e0AAAAMU"]
[Fri Apr 17 01:21:24.505604 2026] [:error] [pid 11692:tid 11712] [client 74.248.157.73:37256] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aeEalM1AYuhm4BZwKNoVSAAAAg8"]
[Fri Apr 17 01:21:26.290641 2026] [:error] [pid 43482:tid 43499] [client 74.248.157.73:48916] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aeEalj9SZnuKxlHrct2e1wAAAM8"]
[Fri Apr 17 01:21:27.014631 2026] [:error] [pid 11854:tid 11862] [client 74.248.157.73:55239] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aeEal9xJCSIaqP1XSdaUqQAAAkU"]
[Fri Apr 17 01:21:28.043409 2026] [:error] [pid 11854:tid 11875] [client 74.248.157.73:37218] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aeEamNxJCSIaqP1XSdaUsQAAAlI"]
[Fri Apr 17 01:21:29.203579 2026] [:error] [pid 43386:tid 43441] [client 74.248.157.73:39728] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeEame91GAVgUfhPVDHAOgAAAFQ"]
[Fri Apr 17 01:21:30.054531 2026] [:error] [pid 26480:tid 26499] [client 74.248.157.73:8100] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeEamgwLDJKTQNfarA10QwAAAdE"]
[Fri Apr 17 01:21:31.063441 2026] [:error] [pid 26480:tid 26506] [client 74.248.157.73:8077] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeEamwwLDJKTQNfarA10UgAAAdg"]
[Fri Apr 17 01:21:32.630416 2026] [:error] [pid 43482:tid 43501] [client 74.248.157.73:8074] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeEanD9SZnuKxlHrct2e9gAAANE"]
[Fri Apr 17 01:21:35.453338 2026] [:error] [pid 26480:tid 26488] [client 74.248.157.73:55278] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeEanwwLDJKTQNfarA10eAAAAcY"]
[Fri Apr 17 01:21:37.035072 2026] [:error] [pid 26480:tid 26500] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Apr 17 01:21:37.647578 2026] [:error] [pid 26480:tid 26489] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Fri Apr 17 01:21:38.065993 2026] [:error] [pid 26480:tid 26491] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Apr 17 01:21:38.520769 2026] [:error] [pid 26480:tid 26486] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Fri Apr 17 01:21:38.803629 2026] [:error] [pid 26480:tid 26488] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Fri Apr 17 01:21:39.260804 2026] [:error] [pid 26480:tid 26489] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Fri Apr 17 01:21:39.544403 2026] [:error] [pid 26480:tid 26497] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 17 01:21:40.394282 2026] [:error] [pid 26480:tid 26505] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/1s7y8wt9dz.php
[Fri Apr 17 01:21:40.678010 2026] [:error] [pid 26480:tid 26502] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/bdktk.php
[Fri Apr 17 01:21:40.960044 2026] [:error] [pid 26480:tid 26488] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/v5.php
[Fri Apr 17 01:21:41.366653 2026] [:error] [pid 26480:tid 26483] [client 74.248.157.73:64181] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Fri Apr 17 01:21:41.646146 2026] [:error] [pid 26480:tid 26489] [client 74.248.157.73:64181] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aeEapQwLDJKTQNfarA10ywAAAcc"]
[Fri Apr 17 01:21:42.516529 2026] [:error] [pid 43482:tid 43506] [client 74.248.157.73:42872] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aeEapj9SZnuKxlHrct2fGQAAANY"]
[Fri Apr 17 01:21:44.195618 2026] [:error] [pid 43482:tid 43495] [client 74.248.157.73:37215] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aeEaqD9SZnuKxlHrct2fIgAAAMs"]
[Fri Apr 17 01:21:45.505062 2026] [:error] [pid 4086:tid 4095] [client 74.248.157.73:34175] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws87.php"] [unique_id "aeEaqVlz7gxl_exM0FpG8QAAAUc"]
[Fri Apr 17 01:21:46.728571 2026] [:error] [pid 11692:tid 11713] [client 74.248.157.73:35967] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeEaqs1AYuhm4BZwKNoVcAAAAhA"]
[Fri Apr 17 01:21:47.898069 2026] [:error] [pid 11692:tid 11699] [client 74.248.157.73:35922] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeEaq81AYuhm4BZwKNoVcwAAAgI"]
[Fri Apr 17 01:21:49.025403 2026] [:error] [pid 26480:tid 26487] [client 74.248.157.73:35918] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeEarQwLDJKTQNfarA102AAAAcU"]
[Fri Apr 17 01:21:49.920605 2026] [:error] [pid 43386:tid 43424] [client 74.248.157.73:37271] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeEare91GAVgUfhPVDHAkwAAAEQ"]
[Fri Apr 17 01:21:50.738308 2026] [:error] [pid 43385:tid 43404] [client 74.248.157.73:55262] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "aeEarsnIxkJaUI8KNs4WgAAAAA8"]
[Fri Apr 17 01:21:51.645077 2026] [:error] [pid 43385:tid 43401] [client 74.248.157.73:50192] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "aeEar8nIxkJaUI8KNs4WkAAAAAw"]
[Fri Apr 17 01:21:52.456077 2026] [:error] [pid 43386:tid 43425] [client 74.248.157.73:42836] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "aeEasO91GAVgUfhPVDHAoAAAAEU"]
[Fri Apr 17 01:21:53.729255 2026] [:error] [pid 43385:tid 43410] [client 74.248.157.73:34132] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "aeEascnIxkJaUI8KNs4WpwAAABQ"]
[Fri Apr 17 01:21:54.984201 2026] [:error] [pid 26480:tid 26494] [client 74.248.157.73:51808] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "aeEasgwLDJKTQNfarA107QAAAcw"]
[Fri Apr 17 01:21:56.797661 2026] [:error] [pid 11692:tid 11714] [client 74.248.157.73:49521] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "aeEatM1AYuhm4BZwKNoVfAAAAhE"]
[Fri Apr 17 01:21:57.915997 2026] [:error] [pid 26480:tid 26488] [client 74.248.157.73:42860] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "aeEatQwLDJKTQNfarA10-QAAAcY"]
[Fri Apr 17 01:21:58.830524 2026] [:error] [pid 11854:tid 11863] [client 74.248.157.73:55283] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "aeEattxJCSIaqP1XSdaVCAAAAkY"]
[Fri Apr 17 01:21:59.783197 2026] [:error] [pid 43482:tid 43498] [client 74.248.157.73:64174] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "aeEatz9SZnuKxlHrct2fSwAAAM4"]
[Fri Apr 17 01:22:00.675206 2026] [:error] [pid 26102:tid 26107] [client 74.248.157.73:37251] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "aeEauP127aFqw6ALdngU-AAAAYI"]
[Fri Apr 17 01:22:01.551243 2026] [:error] [pid 43386:tid 43422] [client 74.248.157.73:50205] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "aeEaue91GAVgUfhPVDHAwQAAAEI"]
[Fri Apr 17 01:22:02.245172 2026] [:error] [pid 43482:tid 43488] [client 74.248.157.73:34120] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/006.php"] [unique_id "aeEauj9SZnuKxlHrct2fVAAAAMQ"]
[Fri Apr 17 01:22:03.121958 2026] [:error] [pid 43385:tid 43398] [client 74.248.157.73:37950] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "aeEau8nIxkJaUI8KNs4W_wAAAAk"]
[Fri Apr 17 01:22:04.006982 2026] [:error] [pid 4086:tid 4096] [client 74.248.157.73:49492] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "aeEavFlz7gxl_exM0FpHAwAAAUg"]
[Fri Apr 17 01:22:04.905523 2026] [:error] [pid 26480:tid 26505] [client 74.248.157.73:7824] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "aeEavAwLDJKTQNfarA11BwAAAdc"]
[Fri Apr 17 01:22:05.765482 2026] [:error] [pid 43385:tid 43407] [client 74.248.157.73:50233] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "aeEavcnIxkJaUI8KNs4XFgAAABI"]
[Fri Apr 17 01:22:06.782615 2026] [:error] [pid 43386:tid 43429] [client 74.248.157.73:64191] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "aeEavu91GAVgUfhPVDHA4AAAAEk"]
[Fri Apr 17 01:22:07.911990 2026] [:error] [pid 26102:tid 26112] [client 74.248.157.73:39680] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "aeEav_127aFqw6ALdngVBAAAAYc"]
[Fri Apr 17 01:22:09.145160 2026] [:error] [pid 26102:tid 26115] [client 74.248.157.73:49494] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "aeEawf127aFqw6ALdngVCQAAAYo"]
[Fri Apr 17 01:22:10.085470 2026] [:error] [pid 43386:tid 43441] [client 74.248.157.73:34139] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "aeEawu91GAVgUfhPVDHA6wAAAFQ"]
[Fri Apr 17 01:22:11.094788 2026] [:error] [pid 43385:tid 43407] [client 74.248.157.73:61650] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeEaw8nIxkJaUI8KNs4XOAAAABI"]
[Fri Apr 17 01:22:12.082337 2026] [:error] [pid 11692:tid 11718] [client 74.248.157.73:61654] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeEaxM1AYuhm4BZwKNoV1AAAAhU"]
[Fri Apr 17 01:22:12.874873 2026] [:error] [pid 26102:tid 26111] [client 74.248.157.73:64150] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeEaxP127aFqw6ALdngVHwAAAYY"]
[Fri Apr 17 01:22:14.114141 2026] [:error] [pid 43386:tid 43423] [client 74.248.157.73:51835] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeEaxu91GAVgUfhPVDHA-gAAAEM"]
[Fri Apr 17 01:22:15.033500 2026] [:error] [pid 11854:tid 11877] [client 74.248.157.73:37299] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aeEax9xJCSIaqP1XSdaVNAAAAlQ"]
[Fri Apr 17 01:22:16.014547 2026] [:error] [pid 26480:tid 26492] [client 74.248.157.73:39720] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aeEayAwLDJKTQNfarA11JQAAAco"]
[Fri Apr 17 01:22:17.057724 2026] [:error] [pid 43386:tid 43436] [client 74.248.157.73:50236] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aeEaye91GAVgUfhPVDHBBgAAAFA"]
[Fri Apr 17 01:22:17.923233 2026] [:error] [pid 43385:tid 43390] [client 74.248.157.73:61640] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aeEaycnIxkJaUI8KNs4XYgAAAAE"]
[Fri Apr 17 01:22:18.761858 2026] [:error] [pid 43387:tid 43460] [client 74.248.157.73:64182] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aeEayiBNsONqHxWTakU8ngAAAIk"]
[Fri Apr 17 01:22:19.705045 2026] [:error] [pid 26480:tid 26492] [client 74.248.157.73:48163] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aeEaywwLDJKTQNfarA11OQAAAco"]
[Fri Apr 17 01:22:21.246548 2026] [:error] [pid 11854:tid 11880] [client 74.248.157.73:37267] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aeEazdxJCSIaqP1XSdaVRQAAAlc"]
[Fri Apr 17 01:22:23.069048 2026] [:error] [pid 43385:tid 43413] [client 74.248.157.73:42865] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aeEaz8nIxkJaUI8KNs4XdQAAABc"]
[Fri Apr 17 01:22:24.641000 2026] [:error] [pid 26480:tid 26503] [client 74.248.157.73:37944] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeEa0AwLDJKTQNfarA11WAAAAdU"]
[Fri Apr 17 01:22:25.525833 2026] [:error] [pid 43482:tid 43494] [client 74.248.157.73:34142] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeEa0T9SZnuKxlHrct2fjAAAAMo"]
[Fri Apr 17 01:22:26.662291 2026] [:error] [pid 11692:tid 11713] [client 74.248.157.73:34171] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeEa0s1AYuhm4BZwKNoV_QAAAhA"]
[Fri Apr 17 01:22:27.402338 2026] [:error] [pid 26102:tid 26105] [client 74.248.157.73:48140] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeEa0_127aFqw6ALdngVRwAAAYA"]
[Fri Apr 17 01:22:28.268804 2026] [:error] [pid 43385:tid 43411] [client 74.248.157.73:49483] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeEa1MnIxkJaUI8KNs4XoAAAABU"]
[Fri Apr 17 01:22:29.683321 2026] [:error] [pid 26480:tid 26494] [client 74.248.157.73:61675] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeEa1QwLDJKTQNfarA11hAAAAcw"]
[Fri Apr 17 01:22:31.142108 2026] [:error] [pid 43385:tid 43415] [client 74.248.157.73:42831] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeEa18nIxkJaUI8KNs4XtwAAABg"]
[Fri Apr 17 01:22:33.219312 2026] [:error] [pid 43386:tid 43444] [client 74.248.157.73:30513] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeEa2e91GAVgUfhPVDHBQgAAAFc"]
[Fri Apr 17 01:22:35.024904 2026] [:error] [pid 11854:tid 11874] [client 74.248.157.73:7663] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "aeEa29xJCSIaqP1XSdaVjAAAAlE"]
[Fri Apr 17 01:22:36.696766 2026] [:error] [pid 11854:tid 11860] [client 74.248.157.73:30468] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "aeEa3NxJCSIaqP1XSdaVlQAAAkM"]
[Fri Apr 17 01:22:38.461841 2026] [:error] [pid 43385:tid 43401] [client 74.248.157.73:7674] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "aeEa3snIxkJaUI8KNs4X3gAAAAw"]
[Fri Apr 17 01:22:40.871065 2026] [:error] [pid 43385:tid 43393] [client 74.248.157.73:64190] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qqa.php"] [unique_id "aeEa4MnIxkJaUI8KNs4X5QAAAAQ"]
[Fri Apr 17 01:22:42.870661 2026] [:error] [pid 26480:tid 26494] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 17 01:22:43.147656 2026] [:error] [pid 26480:tid 26490] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/ga.php
[Fri Apr 17 01:22:43.408989 2026] [:error] [pid 26480:tid 26487] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/xozx.php
[Fri Apr 17 01:22:43.666839 2026] [:error] [pid 26480:tid 26496] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Fri Apr 17 01:22:43.936666 2026] [:error] [pid 26480:tid 26484] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Fri Apr 17 01:22:44.195087 2026] [:error] [pid 26480:tid 26485] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Apr 17 01:22:44.682794 2026] [:error] [pid 26480:tid 26503] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kz.php
[Fri Apr 17 01:22:44.961201 2026] [:error] [pid 26480:tid 26488] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lo.php
[Fri Apr 17 01:22:45.241032 2026] [:error] [pid 26480:tid 26498] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Fri Apr 17 01:22:45.573466 2026] [:error] [pid 26480:tid 26491] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/Ipv6.php
[Fri Apr 17 01:22:45.831565 2026] [:error] [pid 26480:tid 26489] [client 74.248.157.73:37223] File does not exist: /usr/local/apache/htdocs/suspended-page/file-gertdxz.php
[Fri Apr 17 01:22:46.086084 2026] [:error] [pid 26480:tid 26484] [client 74.248.157.73:37223] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeEa5gwLDJKTQNfarA115QAAAcI"]
[Fri Apr 17 01:22:47.025261 2026] [:error] [pid 43385:tid 43407] [client 74.248.157.73:50786] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeEa58nIxkJaUI8KNs4YBAAAABI"]
[Fri Apr 17 01:22:48.793246 2026] [:error] [pid 43386:tid 43431] [client 74.248.157.73:50809] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeEa6O91GAVgUfhPVDHBpgAAAEs"]
[Fri Apr 17 01:22:50.222583 2026] [:error] [pid 26480:tid 26483] [client 74.248.157.73:61673] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeEa6gwLDJKTQNfarA12BQAAAcE"]
[Fri Apr 17 01:22:52.209325 2026] [:error] [pid 11692:tid 11719] [client 74.248.157.73:48190] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeEa7M1AYuhm4BZwKNoWSAAAAhY"]
[Fri Apr 17 01:22:53.252463 2026] [:error] [pid 26480:tid 26487] [client 74.248.157.73:58030] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeEa7QwLDJKTQNfarA12EwAAAcU"]
[Fri Apr 17 01:22:55.226979 2026] [:error] [pid 43385:tid 43404] [client 74.248.157.73:57308] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeEa78nIxkJaUI8KNs4YOAAAAA8"]
[Fri Apr 17 01:22:56.486406 2026] [:error] [pid 11692:tid 11713] [client 74.248.157.73:50795] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeEa8M1AYuhm4BZwKNoWWwAAAhA"]
[Fri Apr 17 01:22:57.942841 2026] [:error] [pid 26480:tid 26494] [client 74.248.157.73:57984] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeEa8QwLDJKTQNfarA12PAAAAcw"]
[Fri Apr 17 01:23:00.323783 2026] [:error] [pid 43386:tid 43433] [client 74.248.157.73:46773] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeEa9O91GAVgUfhPVDHB4AAAAE0"]
[Fri Apr 17 01:23:03.326155 2026] [:error] [pid 43386:tid 43439] [client 74.248.157.73:35501] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeEa9-91GAVgUfhPVDHB_QAAAFM"]
[Fri Apr 17 01:23:06.632302 2026] [:error] [pid 43386:tid 43444] [client 74.248.157.73:35982] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeEa-u91GAVgUfhPVDHCJgAAAFc"]
[Fri Apr 17 01:23:09.053854 2026] [:error] [pid 26480:tid 26485] [client 74.248.157.73:36031] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeEa_QwLDJKTQNfarA12bQAAAcM"]
[Fri Apr 17 01:23:14.374693 2026] [:error] [pid 43482:tid 43501] [client 74.248.157.73:50162] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeEbAj9SZnuKxlHrct2f7wAAANE"]
[Fri Apr 17 01:23:17.788025 2026] [:error] [pid 11692:tid 11716] [client 74.248.157.73:57287] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeEbBc1AYuhm4BZwKNoWtAAAAhM"]
[Fri Apr 17 01:23:23.562262 2026] [:error] [pid 43385:tid 43398] [client 74.248.157.73:45523] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeEbC8nIxkJaUI8KNs4ZGgAAAAk"]
[Fri Apr 17 01:23:34.563766 2026] [:error] [pid 43385:tid 43415] [client 74.248.157.73:25240] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper.php"] [unique_id "aeEbFsnIxkJaUI8KNs4ZnwAAABg"]
[Fri Apr 17 01:23:39.106411 2026] [:error] [pid 3245:tid 3282] [client 74.248.157.73:49581] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper.php"] [unique_id "aeEbG6ESOMTHVLs-uFDV0wAAARQ"]
[Fri Apr 17 01:23:44.320343 2026] [:error] [pid 11854:tid 11873] [client 74.248.157.73:57446] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wxpass.php"] [unique_id "aeEbINxJCSIaqP1XSdaWWQAAAlA"]
[Fri Apr 17 01:24:16.808303 2026] [:error] [pid 43482:tid 43499] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Fri Apr 17 01:24:17.156520 2026] [:error] [pid 43482:tid 43489] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Apr 17 01:24:17.471492 2026] [:error] [pid 43482:tid 43484] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/x3x.php
[Fri Apr 17 01:24:17.821565 2026] [:error] [pid 43482:tid 43496] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Fri Apr 17 01:24:18.172248 2026] [:error] [pid 43482:tid 43501] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/global.php
[Fri Apr 17 01:24:18.514789 2026] [:error] [pid 43482:tid 43487] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Apr 17 01:24:18.827450 2026] [:error] [pid 43482:tid 43495] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Fri Apr 17 01:24:19.164538 2026] [:error] [pid 43482:tid 43494] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Fri Apr 17 01:24:19.478540 2026] [:error] [pid 43482:tid 43486] [client 74.248.157.73:49599] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Fri Apr 17 01:24:19.832605 2026] [:error] [pid 43482:tid 43504] [client 74.248.157.73:49599] [client 74.248.157.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wincust.php"] [unique_id "aeEbQz9SZnuKxlHrct2gaQAAANQ"]
[Fri Apr 17 01:25:09.842597 2026] [:error] [pid 3245:tid 3269] [client 74.248.157.73:46651] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Fri Apr 17 01:25:10.125127 2026] [:error] [pid 3245:tid 3285] [client 74.248.157.73:46651] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Fri Apr 17 01:25:10.404268 2026] [:error] [pid 3245:tid 3281] [client 74.248.157.73:46651] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aeEbdqESOMTHVLs-uFDWTAAAARM"]
[Fri Apr 17 01:25:19.257665 2026] [:error] [pid 43385:tid 43402] [client 74.248.157.73:39075] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aeEbf8nIxkJaUI8KNs4cIAAAAA0"]
[Fri Apr 17 01:25:51.594725 2026] [:error] [pid 43385:tid 43396] [client 74.248.157.73:7895] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aeEbn8nIxkJaUI8KNs4c5gAAAAc"]
[Fri Apr 17 01:26:09.247473 2026] [:error] [pid 43386:tid 43430] [client 74.248.157.73:39031] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aeEbse91GAVgUfhPVDHFEgAAAEo"]
[Fri Apr 17 01:26:43.715855 2026] [:error] [pid 43482:tid 43491] [client 74.248.157.73:58527] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-01ul.php
[Fri Apr 17 01:26:44.006323 2026] [:error] [pid 43482:tid 43499] [client 74.248.157.73:58527] File does not exist: /usr/local/apache/htdocs/suspended-page/e7.php
[Fri Apr 17 01:26:44.324803 2026] [:error] [pid 43482:tid 43494] [client 74.248.157.73:58527] File does not exist: /usr/local/apache/htdocs/suspended-page/e3.php
[Fri Apr 17 01:26:44.613569 2026] [:error] [pid 43482:tid 43490] [client 74.248.157.73:58527] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Fri Apr 17 01:26:44.899981 2026] [:error] [pid 43482:tid 43487] [client 74.248.157.73:58527] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeEb1D9SZnuKxlHrct2hbgAAAMM"]
[Fri Apr 17 01:26:46.389499 2026] [:error] [pid 26102:tid 26129] [client 74.248.157.73:25084] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeEb1v127aFqw6ALdngW9wAAAZg"]
[Fri Apr 17 01:26:48.163974 2026] [:error] [pid 43386:tid 43424] [client 74.248.157.73:56249] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeEb2O91GAVgUfhPVDHFxwAAAEQ"]
[Fri Apr 17 01:26:49.497472 2026] [:error] [pid 43385:tid 43406] [client 74.248.157.73:56211] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeEb2cnIxkJaUI8KNs4dvAAAABE"]
[Fri Apr 17 01:26:52.544524 2026] [:error] [pid 43385:tid 43395] [client 74.248.157.73:56238] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeEb3MnIxkJaUI8KNs4d2wAAAAY"]
[Fri Apr 17 01:26:53.782740 2026] [:error] [pid 43385:tid 43395] [client 74.248.157.73:31034] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeEb3cnIxkJaUI8KNs4d7gAAAAY"]
[Fri Apr 17 01:26:55.436893 2026] [:error] [pid 43385:tid 43390] [client 74.248.157.73:52390] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeEb38nIxkJaUI8KNs4eBAAAAAE"]
[Fri Apr 17 01:26:58.293657 2026] [:error] [pid 43385:tid 43398] [client 74.248.157.73:52375] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeEb4snIxkJaUI8KNs4eHQAAAAk"]
[Fri Apr 17 01:27:01.736666 2026] [:error] [pid 11854:tid 11876] [client 74.248.157.73:31006] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aeEb5dxJCSIaqP1XSdaYcwAAAlM"]
[Fri Apr 17 01:27:06.912050 2026] [:error] [pid 11854:tid 11873] [client 74.248.157.73:58538] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aeEb6txJCSIaqP1XSdaYjQAAAlA"]
[Fri Apr 17 01:27:09.151167 2026] [:error] [pid 26480:tid 26499] [client 74.248.157.73:60336] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aeEb7QwLDJKTQNfarA15BAAAAdE"]
[Fri Apr 17 01:27:10.235629 2026] [:error] [pid 43386:tid 43442] [client 74.248.157.73:58550] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aeEb7u91GAVgUfhPVDHGAQAAAFU"]
[Fri Apr 17 01:27:12.529088 2026] [:error] [pid 43385:tid 43394] [client 74.248.157.73:7234] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aeEb8MnIxkJaUI8KNs4eZwAAAAU"]
[Fri Apr 17 01:27:14.817823 2026] [:error] [pid 11854:tid 11868] [client 74.248.157.73:56219] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aeEb8txJCSIaqP1XSdaYkAAAAks"]
[Fri Apr 17 01:27:16.059534 2026] [:error] [pid 26102:tid 26129] [client 74.248.157.73:47330] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aeEb9P127aFqw6ALdngXKAAAAZg"]
[Fri Apr 17 01:27:18.867747 2026] [:error] [pid 4086:tid 4097] [client 74.248.157.73:60409] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aeEb9llz7gxl_exM0FpIbwAAAUk"]
[Fri Apr 17 01:27:20.732022 2026] [:error] [pid 26480:tid 26499] [client 74.248.157.73:56261] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aeEb-AwLDJKTQNfarA15KgAAAdE"]
[Fri Apr 17 01:27:23.521502 2026] [:error] [pid 43385:tid 43395] [client 74.248.157.73:58597] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aeEb-8nIxkJaUI8KNs4ezAAAAAY"]
[Fri Apr 17 01:27:25.302208 2026] [:error] [pid 43387:tid 43470] [client 74.248.157.73:52346] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aeEb_SBNsONqHxWTakU94gAAAJE"]
[Fri Apr 17 01:27:26.842600 2026] [:error] [pid 11692:tid 11705] [client 74.248.157.73:58593] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aeEb_s1AYuhm4BZwKNoZfAAAAgg"]
[Fri Apr 17 01:27:28.246642 2026] [:error] [pid 26480:tid 26488] [client 74.248.157.73:42274] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aeEcAAwLDJKTQNfarA15NQAAAcY"]
[Fri Apr 17 01:27:29.549196 2026] [:error] [pid 11692:tid 11719] [client 74.248.157.73:32891] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aeEcAc1AYuhm4BZwKNoZgAAAAhY"]
[Fri Apr 17 01:27:30.301502 2026] [:error] [pid 3245:tid 3271] [client 74.248.157.73:47355] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aeEcAqESOMTHVLs-uFDW3wAAAQk"]
[Fri Apr 17 01:27:31.007155 2026] [:error] [pid 43387:tid 43469] [client 74.248.157.73:40305] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aeEcAyBNsONqHxWTakU95AAAAJA"]
[Fri Apr 17 01:27:33.137249 2026] [:error] [pid 43385:tid 43389] [client 74.248.157.73:7434] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/curl.php"] [unique_id "aeEcBcnIxkJaUI8KNs4e_gAAAAA"]
[Fri Apr 17 01:27:34.822286 2026] [:error] [pid 43385:tid 43412] [client 74.248.157.73:7445] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/curl.php"] [unique_id "aeEcBsnIxkJaUI8KNs4fDAAAABY"]
[Fri Apr 17 01:27:35.709383 2026] [:error] [pid 4086:tid 4088] [client 74.248.157.73:52288] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/curl.php"] [unique_id "aeEcB1lz7gxl_exM0FpIigAAAUA"]
[Fri Apr 17 01:27:36.884938 2026] [:error] [pid 11692:tid 11715] [client 74.248.157.73:52333] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/curl.php"] [unique_id "aeEcCM1AYuhm4BZwKNoZkAAAAhI"]
[Fri Apr 17 01:27:38.207694 2026] [:error] [pid 4086:tid 4095] [client 74.248.157.73:56302] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aeEcCllz7gxl_exM0FpIkAAAAUc"]
[Fri Apr 17 01:27:39.443048 2026] [:error] [pid 43387:tid 43456] [client 74.248.157.73:7486] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aeEcCyBNsONqHxWTakU96AAAAIU"]
[Fri Apr 17 01:27:40.434582 2026] [:error] [pid 43385:tid 43396] [client 74.248.157.73:52329] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aeEcDMnIxkJaUI8KNs4fGgAAAAc"]
[Fri Apr 17 01:27:41.279511 2026] [:error] [pid 4086:tid 4108] [client 74.248.157.73:47313] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aeEcDVlz7gxl_exM0FpImAAAAVQ"]
[Fri Apr 17 01:27:42.340958 2026] [:error] [pid 4086:tid 4094] [client 74.248.157.73:56272] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeEcDllz7gxl_exM0FpImgAAAUY"]
[Fri Apr 17 01:27:43.508575 2026] [:error] [pid 26102:tid 26112] [client 74.248.157.73:44968] [client 74.248.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeEcD_127aFqw6ALdngXVwAAAYc"]
[Fri Apr 17 01:27:44.564355 2026] [:error] [pid 26102:tid 26115] [client 74.248.157.73:52310] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Apr 17 01:27:44.866194 2026] [:error] [pid 26102:tid 26122] [client 74.248.157.73:52310] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Apr 17 01:27:45.124622 2026] [:error] [pid 26102:tid 26110] [client 74.248.157.73:52310] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Apr 17 01:27:45.990718 2026] [:error] [pid 26102:tid 26106] [client 74.248.157.73:52310] File does not exist: /usr/local/apache/htdocs/suspended-page/goods_260325043000.php
[Fri Apr 17 01:27:46.275477 2026] [:error] [pid 26102:tid 26111] [client 74.248.157.73:52310] File does not exist: /usr/local/apache/htdocs/suspended-page/goods_260401065719.php
[Fri Apr 17 01:31:38.009569 2026] [:error] [pid 43387:tid 43466] [client 34.106.52.127:52722] [client 34.106.52.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aeEc-iBNsONqHxWTakU-YwAAAI0"]
[Fri Apr 17 03:07:54.375895 2026] [:error] [pid 43386:tid 43432] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/tymi.php
[Fri Apr 17 03:07:54.661110 2026] [:error] [pid 43386:tid 43431] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/4GrJSiwkF3A.php
[Fri Apr 17 03:07:54.937553 2026] [:error] [pid 43386:tid 43444] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/SS72_kKKjT.php
[Fri Apr 17 03:07:55.220738 2026] [:error] [pid 43386:tid 43421] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/wkogn.php
[Fri Apr 17 03:07:55.482778 2026] [:error] [pid 43386:tid 43434] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/hwjtry0zd1fzeakcuzn8Cdefault.php
[Fri Apr 17 03:07:55.765277 2026] [:error] [pid 43386:tid 43423] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Fri Apr 17 03:07:56.040501 2026] [:error] [pid 43386:tid 43420] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/oLEzRVqmJJPFSucdefault.php
[Fri Apr 17 03:07:56.303157 2026] [:error] [pid 43386:tid 43429] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/wwdgl.php
[Fri Apr 17 03:07:56.585946 2026] [:error] [pid 43386:tid 43424] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/3akp.php
[Fri Apr 17 03:07:56.862707 2026] [:error] [pid 43386:tid 43425] [client 51.107.222.225:36435] File does not exist: /usr/local/apache/htdocs/suspended-page/HLA-dd.php
[Fri Apr 17 03:07:57.134199 2026] [:error] [pid 43386:tid 43437] [client 51.107.222.225:36435] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeEzje91GAVgUfhPVDH0HAAAAFE"]
[Fri Apr 17 03:08:01.974653 2026] [:error] [pid 43482:tid 43506] [client 51.107.222.225:36859] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeEzkT9SZnuKxlHrct3FIwAAANY"]
[Fri Apr 17 03:08:03.374720 2026] [:error] [pid 43482:tid 43488] [client 51.107.222.225:46224] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeEzkz9SZnuKxlHrct3FKQAAAMQ"]
[Fri Apr 17 03:08:04.344760 2026] [:error] [pid 26102:tid 26119] [client 51.107.222.225:29214] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BhqKs28Cw94.php"] [unique_id "aeEzlP127aFqw6ALdnglHwAAAY4"]
[Fri Apr 17 03:08:06.275140 2026] [:error] [pid 43387:tid 43448] [client 51.107.222.225:27500] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cdn3.php"] [unique_id "aeEzliBNsONqHxWTakVitQAAAIA"]
[Fri Apr 17 03:08:10.003530 2026] [:error] [pid 26102:tid 26114] [client 51.107.222.225:1658] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cdn3.php"] [unique_id "aeEzmv127aFqw6ALdnglJgAAAYk"]
[Fri Apr 17 03:08:11.092801 2026] [:error] [pid 43482:tid 43486] [client 51.107.222.225:31391] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cdn3.php"] [unique_id "aeEzmz9SZnuKxlHrct3FNQAAAMI"]
[Fri Apr 17 03:08:13.931648 2026] [:error] [pid 43386:tid 43421] [client 51.107.222.225:32634] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cdn3.php"] [unique_id "aeEzne91GAVgUfhPVDH0IwAAAEE"]
[Fri Apr 17 03:08:15.946114 2026] [:error] [pid 26102:tid 26108] [client 51.107.222.225:31397] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeEzn_127aFqw6ALdnglKgAAAYM"]
[Fri Apr 17 03:08:20.959657 2026] [:error] [pid 43386:tid 43422] [client 51.107.222.225:50327] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeEzpO91GAVgUfhPVDH0KwAAAEI"]
[Fri Apr 17 03:08:21.716153 2026] [:error] [pid 43386:tid 43441] [client 51.107.222.225:49400] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeEzpe91GAVgUfhPVDH0LwAAAFQ"]
[Fri Apr 17 03:08:22.823933 2026] [:error] [pid 43386:tid 43431] [client 51.107.222.225:32627] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeEzpu91GAVgUfhPVDH0MgAAAEs"]
[Fri Apr 17 03:08:23.932022 2026] [:error] [pid 11854:tid 11878] [client 51.107.222.225:35022] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/beerd.php"] [unique_id "aeEzp9xJCSIaqP1XSdao3QAAAlU"]
[Fri Apr 17 03:08:25.741209 2026] [:error] [pid 43386:tid 43424] [client 51.107.222.225:35023] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/beerd.php"] [unique_id "aeEzqe91GAVgUfhPVDH0OwAAAEQ"]
[Fri Apr 17 03:08:26.681200 2026] [:error] [pid 43386:tid 43427] [client 51.107.222.225:32624] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/beerd.php"] [unique_id "aeEzqu91GAVgUfhPVDH0PwAAAEc"]
[Fri Apr 17 03:08:28.292441 2026] [:error] [pid 43482:tid 43494] [client 51.107.222.225:35070] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/beerd.php"] [unique_id "aeEzrD9SZnuKxlHrct3FTwAAAMo"]
[Fri Apr 17 03:08:32.438584 2026] [:error] [pid 11692:tid 11701] [client 51.107.222.225:44777] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hhxc.php"] [unique_id "aeEzsM1AYuhm4BZwKNotFwAAAgQ"]
[Fri Apr 17 03:08:34.160432 2026] [:error] [pid 43482:tid 43486] [client 51.107.222.225:1594] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hhxc.php"] [unique_id "aeEzsj9SZnuKxlHrct3FXAAAAMI"]
[Fri Apr 17 03:08:37.450835 2026] [:error] [pid 43386:tid 43441] [client 51.107.222.225:1560] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hhxc.php"] [unique_id "aeEzte91GAVgUfhPVDH0TQAAAFQ"]
[Fri Apr 17 03:08:39.229339 2026] [:error] [pid 43387:tid 43456] [client 51.107.222.225:1571] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hhxc.php"] [unique_id "aeEztyBNsONqHxWTakVizgAAAIU"]
[Fri Apr 17 03:08:40.885303 2026] [:error] [pid 43387:tid 43472] [client 51.107.222.225:34305] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/161dfd072f.php"] [unique_id "aeEzuCBNsONqHxWTakVi6AAAAJM"]
[Fri Apr 17 03:08:47.270191 2026] [:error] [pid 43386:tid 43422] [client 51.107.222.225:27466] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/161dfd072f.php"] [unique_id "aeEzv-91GAVgUfhPVDH0gwAAAEI"]
[Fri Apr 17 03:08:48.186722 2026] [:error] [pid 43482:tid 43487] [client 51.107.222.225:27654] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/161dfd072f.php"] [unique_id "aeEzwD9SZnuKxlHrct3FvAAAAMM"]
[Fri Apr 17 03:08:49.735424 2026] [:error] [pid 43387:tid 43457] [client 51.107.222.225:40036] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/161dfd072f.php"] [unique_id "aeEzwSBNsONqHxWTakVjgAAAAIY"]
[Fri Apr 17 03:08:55.461312 2026] [:error] [pid 43387:tid 43476] [client 51.107.222.225:32697] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aeEzxyBNsONqHxWTakVjmQAAAJc"]
[Fri Apr 17 03:08:56.509524 2026] [:error] [pid 11692:tid 11718] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Fri Apr 17 03:08:56.774453 2026] [:error] [pid 11692:tid 11697] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/ylzed0twj8l9drdbchc1oocfCdefault.php
[Fri Apr 17 03:08:57.036941 2026] [:error] [pid 11692:tid 11705] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/RIP.php
[Fri Apr 17 03:08:57.317994 2026] [:error] [pid 11692:tid 11720] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Fri Apr 17 03:08:57.581992 2026] [:error] [pid 11692:tid 11714] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/blqjs.php
[Fri Apr 17 03:08:57.993556 2026] [:error] [pid 11692:tid 11714] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/sk25_1.php
[Fri Apr 17 03:08:58.272530 2026] [:error] [pid 11692:tid 11711] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/fetch.php
[Fri Apr 17 03:08:58.613064 2026] [:error] [pid 11692:tid 11707] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Fri Apr 17 03:08:58.876490 2026] [:error] [pid 11692:tid 11702] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/2nzyHnOkEg.php
[Fri Apr 17 03:08:59.153346 2026] [:error] [pid 11692:tid 11708] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/oircv.php
[Fri Apr 17 03:08:59.415997 2026] [:error] [pid 11692:tid 11709] [client 51.107.222.225:34157] File does not exist: /usr/local/apache/htdocs/suspended-page/blnux.php
[Fri Apr 17 03:08:59.676209 2026] [:error] [pid 11692:tid 11703] [client 51.107.222.225:34157] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeEzy81AYuhm4BZwKNotPAAAAgY"]
[Fri Apr 17 03:09:05.260199 2026] [:error] [pid 11692:tid 11704] [client 51.107.222.225:32702] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeEz0c1AYuhm4BZwKNotPwAAAgc"]
[Fri Apr 17 03:09:07.192674 2026] [:error] [pid 43386:tid 43430] [client 51.107.222.225:27684] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeEz0-91GAVgUfhPVDH0swAAAEo"]
[Fri Apr 17 03:09:10.350822 2026] [:error] [pid 43387:tid 43466] [client 51.107.222.225:28992] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeEz1iBNsONqHxWTakVjtQAAAI0"]
[Fri Apr 17 03:09:11.375422 2026] [:error] [pid 43385:tid 43398] [client 51.107.222.225:31910] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Spow_SRw.php"] [unique_id "aeEz18nIxkJaUI8KNs45UAAAAAk"]
[Fri Apr 17 03:09:14.644226 2026] [:error] [pid 43387:tid 43476] [client 51.107.222.225:57431] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Spow_SRw.php"] [unique_id "aeEz2iBNsONqHxWTakVjxgAAAJc"]
[Fri Apr 17 03:09:17.065495 2026] [:error] [pid 43482:tid 43504] [client 51.107.222.225:27704] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Spow_SRw.php"] [unique_id "aeEz3T9SZnuKxlHrct3F4AAAANQ"]
[Fri Apr 17 03:09:18.793723 2026] [:error] [pid 43482:tid 43485] [client 51.107.222.225:32665] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Spow_SRw.php"] [unique_id "aeEz3j9SZnuKxlHrct3F4gAAAME"]
[Fri Apr 17 03:09:19.639760 2026] [:error] [pid 43386:tid 43426] [client 51.107.222.225:27470] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/albrt.php"] [unique_id "aeEz3-91GAVgUfhPVDH0uAAAAEY"]
[Fri Apr 17 03:09:21.920354 2026] [:error] [pid 43482:tid 43497] [client 51.107.222.225:27693] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/albrt.php"] [unique_id "aeEz4T9SZnuKxlHrct3F5wAAAM0"]
[Fri Apr 17 03:09:24.159607 2026] [:error] [pid 43482:tid 43494] [client 51.107.222.225:27501] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/albrt.php"] [unique_id "aeEz5D9SZnuKxlHrct3F6wAAAMo"]
[Fri Apr 17 03:09:25.258900 2026] [:error] [pid 43387:tid 43458] [client 51.107.222.225:26735] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/albrt.php"] [unique_id "aeEz5SBNsONqHxWTakVj2QAAAIc"]
[Fri Apr 17 03:09:29.611751 2026] [:error] [pid 43482:tid 43493] [client 51.107.222.225:27073] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxivicLhot.php"] [unique_id "aeEz6T9SZnuKxlHrct3F8wAAAMk"]
[Fri Apr 17 03:09:32.828576 2026] [:error] [pid 43482:tid 43500] [client 51.107.222.225:27679] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxivicLhot.php"] [unique_id "aeEz7D9SZnuKxlHrct3F_QAAANA"]
[Fri Apr 17 03:09:34.092449 2026] [:error] [pid 43482:tid 43484] [client 51.107.222.225:31623] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxivicLhot.php"] [unique_id "aeEz7j9SZnuKxlHrct3GAAAAAMA"]
[Fri Apr 17 03:09:36.927195 2026] [:error] [pid 43386:tid 43431] [client 51.107.222.225:26647] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xxivicLhot.php"] [unique_id "aeEz8O91GAVgUfhPVDH0zwAAAEs"]
[Fri Apr 17 03:09:39.651416 2026] [:error] [pid 43387:tid 43473] [client 51.107.222.225:1533] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeEz8yBNsONqHxWTakVj4gAAAJQ"]
[Fri Apr 17 03:09:47.087155 2026] [:error] [pid 43386:tid 43429] [client 51.107.222.225:26682] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeEz--91GAVgUfhPVDH08gAAAEk"]
[Fri Apr 17 03:09:49.158159 2026] [:error] [pid 43385:tid 43406] [client 51.107.222.225:28255] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeEz_cnIxkJaUI8KNs45bQAAABE"]
[Fri Apr 17 03:09:51.232705 2026] [:error] [pid 26480:tid 26504] [client 51.107.222.225:1497] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeEz_wwLDJKTQNfarA2YJAAAAdY"]
[Fri Apr 17 03:09:54.294282 2026] [:error] [pid 43386:tid 43437] [client 51.107.222.225:26727] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acc.php"] [unique_id "aeE0Au91GAVgUfhPVDH1DgAAAFE"]
[Fri Apr 17 03:09:58.780448 2026] [:error] [pid 26480:tid 26506] [client 51.107.222.225:26626] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acc.php"] [unique_id "aeE0BgwLDJKTQNfarA2YKwAAAdg"]
[Fri Apr 17 03:09:59.609008 2026] [:error] [pid 43385:tid 43401] [client 51.107.222.225:32675] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Fri Apr 17 03:09:59.871836 2026] [:error] [pid 43385:tid 43406] [client 51.107.222.225:32675] File does not exist: /usr/local/apache/htdocs/suspended-page/wxeyc.php
[Fri Apr 17 03:10:00.134506 2026] [:error] [pid 43385:tid 43392] [client 51.107.222.225:32675] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Fri Apr 17 03:10:10.273829 2026] [:error] [pid 11854:tid 11862] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Fri Apr 17 03:10:10.535913 2026] [:error] [pid 11854:tid 11860] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/fyflv.php
[Fri Apr 17 03:10:10.797916 2026] [:error] [pid 11854:tid 11877] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-942.php
[Fri Apr 17 03:10:11.076095 2026] [:error] [pid 11854:tid 11857] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/sde.php
[Fri Apr 17 03:10:11.355614 2026] [:error] [pid 11854:tid 11870] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/wpb.php
[Fri Apr 17 03:10:11.618533 2026] [:error] [pid 11854:tid 11864] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Fri Apr 17 03:10:11.881821 2026] [:error] [pid 11854:tid 11868] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/9EaklzMysJ.php
[Fri Apr 17 03:10:12.143086 2026] [:error] [pid 11854:tid 11867] [client 51.107.222.225:32874] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxl.php
[Fri Apr 17 03:10:12.402693 2026] [:error] [pid 11854:tid 11871] [client 51.107.222.225:32874] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeE0FNxJCSIaqP1XSdapAgAAAk4"]
[Fri Apr 17 03:10:13.129715 2026] [:error] [pid 4086:tid 4107] [client 51.107.222.225:26364] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeE0FVlz7gxl_exM0FpUFgAAAVM"]
[Fri Apr 17 03:10:14.177940 2026] [:error] [pid 3245:tid 3285] [client 51.107.222.225:28610] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeE0FqESOMTHVLs-uFDhtAAAARc"]
[Fri Apr 17 03:10:16.250747 2026] [:error] [pid 43387:tid 43470] [client 51.107.222.225:33505] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "aeE0GCBNsONqHxWTakVkEQAAAJE"]
[Fri Apr 17 03:10:17.800091 2026] [:error] [pid 43482:tid 43500] [client 51.107.222.225:1495] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bfil.php"] [unique_id "aeE0GT9SZnuKxlHrct3GLgAAANA"]
[Fri Apr 17 03:10:18.610697 2026] [:error] [pid 11854:tid 11869] [client 51.107.222.225:33491] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bfil.php"] [unique_id "aeE0GtxJCSIaqP1XSdapBQAAAkw"]
[Fri Apr 17 03:10:19.430077 2026] [:error] [pid 43387:tid 43449] [client 51.107.222.225:33437] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bfil.php"] [unique_id "aeE0GyBNsONqHxWTakVkFAAAAIE"]
[Fri Apr 17 03:10:20.717665 2026] [:error] [pid 43386:tid 43429] [client 51.107.222.225:26638] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bfil.php"] [unique_id "aeE0HO91GAVgUfhPVDH1PgAAAEk"]
[Fri Apr 17 03:10:22.271956 2026] [:error] [pid 43482:tid 43491] [client 51.107.222.225:26315] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeE0Hj9SZnuKxlHrct3GNAAAAMc"]
[Fri Apr 17 03:10:25.901122 2026] [:error] [pid 43387:tid 43466] [client 51.107.222.225:28244] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeE0ISBNsONqHxWTakVkIgAAAI0"]
[Fri Apr 17 03:10:28.162360 2026] [:error] [pid 26480:tid 26501] [client 51.107.222.225:26693] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeE0JAwLDJKTQNfarA2YWAAAAdM"]
[Fri Apr 17 03:10:29.954285 2026] [:error] [pid 43387:tid 43472] [client 51.107.222.225:28652] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeE0JSBNsONqHxWTakVkRwAAAJM"]
[Fri Apr 17 03:10:30.967458 2026] [:error] [pid 43482:tid 43497] [client 51.107.222.225:33490] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aeE0Jj9SZnuKxlHrct3GPQAAAM0"]
[Fri Apr 17 03:10:31.668558 2026] [:error] [pid 43482:tid 43491] [client 51.107.222.225:26347] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aeE0Jz9SZnuKxlHrct3GQQAAAMc"]
[Fri Apr 17 03:10:32.872799 2026] [:error] [pid 26480:tid 26491] [client 51.107.222.225:1490] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aeE0KAwLDJKTQNfarA2YYgAAAck"]
[Fri Apr 17 03:10:35.031737 2026] [:error] [pid 43385:tid 43415] [client 51.107.222.225:56975] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aeE0K8nIxkJaUI8KNs45ggAAABg"]
[Fri Apr 17 03:10:42.124633 2026] [:error] [pid 43386:tid 43421] [client 51.107.222.225:33452] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aeE0Mu91GAVgUfhPVDH1VAAAAEE"]
[Fri Apr 17 03:10:48.990022 2026] [:error] [pid 43386:tid 43429] [client 51.107.222.225:32873] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aeE0OO91GAVgUfhPVDH1XAAAAEk"]
[Fri Apr 17 03:10:50.073150 2026] [:error] [pid 26102:tid 26128] [client 51.107.222.225:33880] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aeE0Ov127aFqw6ALdngleQAAAZc"]
[Fri Apr 17 03:10:51.457604 2026] [:error] [pid 11692:tid 11701] [client 51.107.222.225:39540] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeE0O81AYuhm4BZwKNotdQAAAgQ"]
[Fri Apr 17 03:10:52.763706 2026] [:error] [pid 3245:tid 3272] [client 51.107.222.225:31635] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeE0PKESOMTHVLs-uFDhuwAAAQo"]
[Fri Apr 17 03:10:55.057385 2026] [:error] [pid 43385:tid 43391] [client 51.107.222.225:33907] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeE0P8nIxkJaUI8KNs45pwAAAAI"]
[Fri Apr 17 03:10:56.989225 2026] [:error] [pid 43482:tid 43508] [client 51.107.222.225:33903] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "aeE0QD9SZnuKxlHrct3GdQAAANg"]
[Fri Apr 17 03:11:04.178050 2026] [:error] [pid 43387:tid 43466] [client 51.107.222.225:33446] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/iindv.php"] [unique_id "aeE0SCBNsONqHxWTakVkeAAAAI0"]
[Fri Apr 17 03:11:22.207085 2026] [:error] [pid 26480:tid 26491] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/maintura.php
[Fri Apr 17 03:11:22.469564 2026] [:error] [pid 26480:tid 26485] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/iee52ruz0s81ndrdefault.php
[Fri Apr 17 03:11:22.731857 2026] [:error] [pid 26480:tid 26486] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/nvwf4svpvqohxdjtbjCdefault.php
[Fri Apr 17 03:11:22.998542 2026] [:error] [pid 26480:tid 26484] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-220.php
[Fri Apr 17 03:11:23.387707 2026] [:error] [pid 26480:tid 26495] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/r9pbhistk1lifhnjadpCdefault.php
[Fri Apr 17 03:11:23.650249 2026] [:error] [pid 26480:tid 26498] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Fri Apr 17 03:11:23.930567 2026] [:error] [pid 26480:tid 26482] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/xxiviLDIot.php
[Fri Apr 17 03:11:24.193852 2026] [:error] [pid 26480:tid 26487] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/hanyatersenyum.php
[Fri Apr 17 03:11:24.471471 2026] [:error] [pid 26480:tid 26489] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php
[Fri Apr 17 03:11:24.733764 2026] [:error] [pid 26480:tid 26501] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/upll22.php
[Fri Apr 17 03:11:25.009706 2026] [:error] [pid 26480:tid 26506] [client 51.107.222.225:36044] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 17 03:11:25.281795 2026] [:error] [pid 26480:tid 26488] [client 51.107.222.225:36044] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aeE0XQwLDJKTQNfarA2Y5wAAAcY"]
[Fri Apr 17 03:11:32.097141 2026] [:error] [pid 26480:tid 26486] [client 51.107.222.225:49683] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aeE0ZAwLDJKTQNfarA2Y8gAAAcQ"]
[Fri Apr 17 03:11:32.928544 2026] [:error] [pid 26480:tid 26490] [client 51.107.222.225:28634] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aeE0ZAwLDJKTQNfarA2Y9QAAAcg"]
[Fri Apr 17 03:11:34.864699 2026] [:error] [pid 43386:tid 43423] [client 51.107.222.225:41439] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aeE0Zu91GAVgUfhPVDH1lwAAAEM"]
[Fri Apr 17 03:11:35.849970 2026] [:error] [pid 43386:tid 43433] [client 51.107.222.225:41458] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-243.php"] [unique_id "aeE0Z-91GAVgUfhPVDH1mAAAAE0"]
[Fri Apr 17 03:11:37.742493 2026] [:error] [pid 43385:tid 43400] [client 51.107.222.225:30246] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-243.php"] [unique_id "aeE0acnIxkJaUI8KNs45zwAAAAs"]
[Fri Apr 17 03:11:40.924852 2026] [:error] [pid 43387:tid 43462] [client 51.107.222.225:33232] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-243.php"] [unique_id "aeE0bCBNsONqHxWTakVkrwAAAIs"]
[Fri Apr 17 03:11:42.562279 2026] [:error] [pid 43387:tid 43471] [client 51.107.222.225:34627] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zc-243.php"] [unique_id "aeE0biBNsONqHxWTakVktQAAAJI"]
[Fri Apr 17 03:11:44.408551 2026] [:error] [pid 11854:tid 11878] [client 51.107.222.225:2011] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeE0cNxJCSIaqP1XSdapSQAAAlU"]
[Fri Apr 17 03:11:46.595184 2026] [:error] [pid 11692:tid 11713] [client 51.107.222.225:32124] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeE0cs1AYuhm4BZwKNotpgAAAhA"]
[Fri Apr 17 03:11:51.049936 2026] [:error] [pid 4086:tid 4095] [client 51.107.222.225:32061] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeE0d1lz7gxl_exM0FpUHwAAAUc"]
[Fri Apr 17 03:11:52.765124 2026] [:error] [pid 43387:tid 43457] [client 51.107.222.225:40923] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pm90apbv3v5fvgkbguyiCdefault.php"] [unique_id "aeE0eCBNsONqHxWTakVk5AAAAIY"]
[Fri Apr 17 03:11:54.186291 2026] [:error] [pid 11854:tid 11862] [client 51.107.222.225:40903] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CDX1.php"] [unique_id "aeE0etxJCSIaqP1XSdapUAAAAkU"]
[Fri Apr 17 03:11:55.908837 2026] [:error] [pid 43482:tid 43486] [client 51.107.222.225:41873] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CDX1.php"] [unique_id "aeE0ez9SZnuKxlHrct3GlgAAAMI"]
[Fri Apr 17 03:11:57.807490 2026] [:error] [pid 43387:tid 43467] [client 51.107.222.225:41879] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/CDX1.php"] [unique_id "aeE0fSBNsONqHxWTakVk8AAAAI4"]
[Fri Apr 17 03:12:19.818715 2026] [:error] [pid 26480:tid 26503] [client 51.107.222.225:45767] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "aeE0kwwLDJKTQNfarA2ZDgAAAdU"]
[Fri Apr 17 03:12:25.932185 2026] [:error] [pid 11854:tid 11863] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/6xBAm3vODE05BSzkJZRAws.php
[Fri Apr 17 03:12:26.198289 2026] [:error] [pid 11854:tid 11873] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Fri Apr 17 03:12:26.475276 2026] [:error] [pid 11854:tid 11864] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Fri Apr 17 03:12:26.965298 2026] [:error] [pid 11854:tid 11881] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Fri Apr 17 03:12:27.246303 2026] [:error] [pid 11854:tid 11879] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Fri Apr 17 03:12:27.522857 2026] [:error] [pid 11854:tid 11877] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Fri Apr 17 03:12:28.027434 2026] [:error] [pid 11854:tid 11866] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Fri Apr 17 03:12:28.297050 2026] [:error] [pid 11854:tid 11876] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/wtiiy.php
[Fri Apr 17 03:12:28.563424 2026] [:error] [pid 11854:tid 11878] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Fri Apr 17 03:12:29.018854 2026] [:error] [pid 11854:tid 11860] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 17 03:12:29.342850 2026] [:error] [pid 11854:tid 11864] [client 51.107.222.225:46261] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Fri Apr 17 03:12:29.610072 2026] [:error] [pid 11854:tid 11857] [client 51.107.222.225:46261] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE0ndxJCSIaqP1XSdapdgAAAkA"]
[Fri Apr 17 03:12:30.785115 2026] [:error] [pid 26480:tid 26502] [client 51.107.222.225:39946] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE0ngwLDJKTQNfarA2ZEwAAAdQ"]
[Fri Apr 17 03:12:33.255416 2026] [:error] [pid 11692:tid 11706] [client 51.107.222.225:45803] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE0oc1AYuhm4BZwKNotvAAAAgk"]
[Fri Apr 17 03:12:34.603649 2026] [:error] [pid 43387:tid 43448] [client 51.107.222.225:36776] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE0oiBNsONqHxWTakVlQQAAAIA"]
[Fri Apr 17 03:12:35.977833 2026] [:error] [pid 11692:tid 11714] [client 51.107.222.225:36738] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aeE0o81AYuhm4BZwKNotyAAAAhE"]
[Fri Apr 17 03:12:37.240756 2026] [:error] [pid 43387:tid 43462] [client 51.107.222.225:30493] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aeE0pSBNsONqHxWTakVlSgAAAIs"]
[Fri Apr 17 03:12:38.227299 2026] [:error] [pid 43482:tid 43487] [client 51.107.222.225:36799] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aeE0pj9SZnuKxlHrct3GvAAAAMM"]
[Fri Apr 17 03:12:39.936442 2026] [:error] [pid 43386:tid 43420] [client 51.107.222.225:31586] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aeE0p-91GAVgUfhPVDH2KAAAAEA"]
[Fri Apr 17 03:12:41.494726 2026] [:error] [pid 43386:tid 43444] [client 51.107.222.225:32570] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeE0qe91GAVgUfhPVDH2MAAAAFc"]
[Fri Apr 17 03:12:44.090844 2026] [:error] [pid 43386:tid 43437] [client 51.107.222.225:32027] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeE0rO91GAVgUfhPVDH2OgAAAFE"]
[Fri Apr 17 03:12:45.212588 2026] [:error] [pid 43387:tid 43449] [client 51.107.222.225:31601] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeE0rSBNsONqHxWTakVlawAAAIE"]
[Fri Apr 17 03:12:49.515295 2026] [:error] [pid 43387:tid 43459] [client 51.107.222.225:57966] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeE0sSBNsONqHxWTakVldwAAAIg"]
[Fri Apr 17 03:12:54.047564 2026] [:error] [pid 4086:tid 4093] [client 51.107.222.225:35607] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeE0tllz7gxl_exM0FpUNQAAAUU"]
[Fri Apr 17 03:12:55.831289 2026] [:error] [pid 43482:tid 43489] [client 51.107.222.225:1199] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeE0tz9SZnuKxlHrct3G1QAAAMU"]
[Fri Apr 17 03:12:57.049590 2026] [:error] [pid 26480:tid 26482] [client 51.107.222.225:31591] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeE0uQwLDJKTQNfarA2ZKQAAAcA"]
[Fri Apr 17 03:13:00.066392 2026] [:error] [pid 43386:tid 43435] [client 51.107.222.225:27972] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeE0vO91GAVgUfhPVDH2YwAAAE8"]
[Fri Apr 17 03:13:02.287144 2026] [:error] [pid 26480:tid 26485] [client 51.107.222.225:29218] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aeE0vgwLDJKTQNfarA2ZOQAAAcM"]
[Fri Apr 17 03:13:03.487834 2026] [:error] [pid 26102:tid 26110] [client 51.107.222.225:29239] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aeE0v_127aFqw6ALdnglrQAAAYU"]
[Fri Apr 17 03:13:06.032752 2026] [:error] [pid 43387:tid 43462] [client 51.107.222.225:30482] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aeE0wiBNsONqHxWTakVlqwAAAIs"]
[Fri Apr 17 03:13:07.672303 2026] [:error] [pid 43387:tid 43449] [client 51.107.222.225:28001] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aeE0wyBNsONqHxWTakVlugAAAIE"]
[Fri Apr 17 03:13:08.908306 2026] [:error] [pid 26480:tid 26488] [client 51.107.222.225:35623] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aeE0xAwLDJKTQNfarA2ZRAAAAcY"]
[Fri Apr 17 03:13:10.163218 2026] [:error] [pid 43387:tid 43471] [client 51.107.222.225:1635] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aeE0xiBNsONqHxWTakVlzAAAAJI"]
[Fri Apr 17 03:13:11.628895 2026] [:error] [pid 43387:tid 43457] [client 51.107.222.225:29203] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aeE0xyBNsONqHxWTakVlzQAAAIY"]
[Fri Apr 17 03:13:15.203164 2026] [:error] [pid 43386:tid 43442] [client 51.107.222.225:28010] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jp.php"] [unique_id "aeE0y-91GAVgUfhPVDH2hwAAAFU"]
[Fri Apr 17 03:13:23.929951 2026] [:error] [pid 43387:tid 43461] [client 51.107.222.225:28030] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aeE00yBNsONqHxWTakVl_AAAAIo"]
[Fri Apr 17 03:13:26.260262 2026] [:error] [pid 26480:tid 26482] [client 51.107.222.225:57958] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "aeE01gwLDJKTQNfarA2ZYwAAAcA"]
[Fri Apr 17 03:13:31.065799 2026] [:error] [pid 43385:tid 43398] [client 51.107.222.225:28013] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Fri Apr 17 03:13:32.292657 2026] [:error] [pid 43387:tid 43473] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Fri Apr 17 03:13:32.554846 2026] [:error] [pid 43387:tid 43468] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 17 03:13:32.817123 2026] [:error] [pid 43387:tid 43460] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Fri Apr 17 03:13:33.089991 2026] [:error] [pid 43387:tid 43472] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Fri Apr 17 03:13:33.352048 2026] [:error] [pid 43387:tid 43449] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Fri Apr 17 03:13:33.623924 2026] [:error] [pid 43387:tid 43474] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 17 03:13:33.886646 2026] [:error] [pid 43387:tid 43450] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Fri Apr 17 03:13:34.163020 2026] [:error] [pid 43387:tid 43476] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Fri Apr 17 03:13:34.425055 2026] [:error] [pid 43387:tid 43466] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Apr 17 03:13:34.687503 2026] [:error] [pid 43387:tid 43460] [client 51.107.222.225:34952] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Fri Apr 17 03:13:34.955293 2026] [:error] [pid 43387:tid 43471] [client 51.107.222.225:34952] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aeE03iBNsONqHxWTakVmLwAAAJI"]
[Fri Apr 17 03:13:35.845055 2026] [:error] [pid 43386:tid 43441] [client 51.107.222.225:1180] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aeE03-91GAVgUfhPVDH2ngAAAFQ"]
[Fri Apr 17 03:13:37.000090 2026] [:error] [pid 26480:tid 26489] [client 51.107.222.225:27970] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aeE04AwLDJKTQNfarA2ZawAAAcc"]
[Fri Apr 17 03:13:39.374772 2026] [:error] [pid 3245:tid 3274] [client 51.107.222.225:35987] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aeE046ESOMTHVLs-uFDh_AAAAQw"]
[Fri Apr 17 03:13:41.217389 2026] [:error] [pid 43387:tid 43457] [client 51.107.222.225:36826] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file61.php"] [unique_id "aeE05SBNsONqHxWTakVmUAAAAIY"]
[Fri Apr 17 03:13:42.185998 2026] [:error] [pid 26480:tid 26482] [client 51.107.222.225:44046] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file61.php"] [unique_id "aeE05gwLDJKTQNfarA2ZdQAAAcA"]
[Fri Apr 17 03:13:43.665568 2026] [:error] [pid 43387:tid 43468] [client 51.107.222.225:34996] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file61.php"] [unique_id "aeE05yBNsONqHxWTakVmVQAAAI8"]
[Fri Apr 17 03:13:45.811375 2026] [:error] [pid 43386:tid 43437] [client 51.107.222.225:1152] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file61.php"] [unique_id "aeE06e91GAVgUfhPVDH2tAAAAFE"]
[Fri Apr 17 03:13:51.829254 2026] [:error] [pid 43386:tid 43431] [client 51.107.222.225:36006] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aeE07-91GAVgUfhPVDH2zQAAAEs"]
[Fri Apr 17 03:13:53.902955 2026] [:error] [pid 43386:tid 43444] [client 51.107.222.225:31370] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aeE08e91GAVgUfhPVDH21AAAAFc"]
[Fri Apr 17 03:13:54.775440 2026] [:error] [pid 26480:tid 26491] [client 51.107.222.225:31360] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aeE08gwLDJKTQNfarA2ZggAAAck"]
[Fri Apr 17 03:13:55.711808 2026] [:error] [pid 43386:tid 43438] [client 51.107.222.225:44073] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aeE08-91GAVgUfhPVDH22QAAAFI"]
[Fri Apr 17 03:13:57.239933 2026] [:error] [pid 43482:tid 43484] [client 51.107.222.225:27987] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gptsh.php"] [unique_id "aeE09T9SZnuKxlHrct3HPwAAAMA"]
[Fri Apr 17 03:13:59.147395 2026] [:error] [pid 43387:tid 43457] [client 51.107.222.225:32488] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gptsh.php"] [unique_id "aeE09yBNsONqHxWTakVmfgAAAIY"]
[Fri Apr 17 03:14:00.448582 2026] [:error] [pid 11692:tid 11708] [client 51.107.222.225:31407] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gptsh.php"] [unique_id "aeE0-M1AYuhm4BZwKNouRwAAAgs"]
[Fri Apr 17 03:14:02.805079 2026] [:error] [pid 43482:tid 43502] [client 51.107.222.225:36804] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gptsh.php"] [unique_id "aeE0-j9SZnuKxlHrct3HRQAAANI"]
[Fri Apr 17 03:14:09.352480 2026] [:error] [pid 43386:tid 43434] [client 51.107.222.225:31769] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE1Ae91GAVgUfhPVDH27QAAAE4"]
[Fri Apr 17 03:14:12.378316 2026] [:error] [pid 43386:tid 43420] [client 51.107.222.225:30066] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE1BO91GAVgUfhPVDH29gAAAEA"]
[Fri Apr 17 03:14:13.566435 2026] [:error] [pid 26102:tid 26127] [client 51.107.222.225:34101] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE1Bf127aFqw6ALdngl1gAAAZY"]
[Fri Apr 17 03:14:15.084312 2026] [:error] [pid 43386:tid 43439] [client 51.107.222.225:36824] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeE1B-91GAVgUfhPVDH3AwAAAFM"]
[Fri Apr 17 03:14:21.745413 2026] [:error] [pid 11692:tid 11703] [client 51.107.222.225:44077] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "aeE1Dc1AYuhm4BZwKNouYAAAAgY"]
[Fri Apr 17 03:14:34.910986 2026] [:error] [pid 26480:tid 26484] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/ogifomnzqnlvwh5womfjirvaCdefault.php
[Fri Apr 17 03:14:35.174001 2026] [:error] [pid 26480:tid 26491] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Fri Apr 17 03:14:35.829422 2026] [:error] [pid 26480:tid 26493] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/lmutxdvyp7u5yksqke8ozbjgCdefault.php
[Fri Apr 17 03:14:36.456613 2026] [:error] [pid 26480:tid 26492] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Fri Apr 17 03:14:36.731917 2026] [:error] [pid 26480:tid 26487] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Fri Apr 17 03:14:36.995266 2026] [:error] [pid 26480:tid 26496] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Fri Apr 17 03:14:37.308023 2026] [:error] [pid 26480:tid 26499] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Fri Apr 17 03:14:37.570437 2026] [:error] [pid 26480:tid 26493] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Apr 17 03:14:37.832494 2026] [:error] [pid 26480:tid 26492] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Fri Apr 17 03:14:38.093765 2026] [:error] [pid 26480:tid 26498] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/new3.php
[Fri Apr 17 03:14:38.356075 2026] [:error] [pid 26480:tid 26491] [client 51.107.222.225:30544] File does not exist: /usr/local/apache/htdocs/suspended-page/nw.php
[Fri Apr 17 03:14:38.626435 2026] [:error] [pid 26480:tid 26494] [client 51.107.222.225:30544] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "aeE1HgwLDJKTQNfarA2Z4wAAAcw"]
[Fri Apr 17 03:14:39.920592 2026] [:error] [pid 26480:tid 26490] [client 51.107.222.225:44756] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "aeE1HwwLDJKTQNfarA2Z6QAAAcg"]
[Fri Apr 17 03:14:46.075348 2026] [:error] [pid 43387:tid 43458] [client 51.107.222.225:34677] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "aeE1JiBNsONqHxWTakVnKgAAAIc"]
[Fri Apr 17 03:14:52.295504 2026] [:error] [pid 43482:tid 43506] [client 51.107.222.225:28587] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byypas.php"] [unique_id "aeE1LD9SZnuKxlHrct3HigAAANY"]
[Fri Apr 17 03:14:53.294988 2026] [:error] [pid 4086:tid 4102] [client 51.107.222.225:1083] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rithin.php"] [unique_id "aeE1LVlz7gxl_exM0FpUSgAAAU4"]
[Fri Apr 17 03:14:59.140196 2026] [:error] [pid 43386:tid 43425] [client 51.107.222.225:29534] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rithin.php"] [unique_id "aeE1M-91GAVgUfhPVDH3jQAAAEU"]
[Fri Apr 17 03:15:01.241394 2026] [:error] [pid 43387:tid 43449] [client 51.107.222.225:27917] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rithin.php"] [unique_id "aeE1NSBNsONqHxWTakVnXAAAAIE"]
[Fri Apr 17 03:15:03.740443 2026] [:error] [pid 43387:tid 43475] [client 51.107.222.225:1033] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rithin.php"] [unique_id "aeE1NyBNsONqHxWTakVnZAAAAJY"]
[Fri Apr 17 03:15:05.770013 2026] [:error] [pid 43482:tid 43495] [client 51.107.222.225:49374] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "aeE1OT9SZnuKxlHrct3HtAAAAMs"]
[Fri Apr 17 03:15:07.558890 2026] [:error] [pid 11692:tid 11706] [client 51.107.222.225:44737] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "aeE1O81AYuhm4BZwKNouhwAAAgk"]
[Fri Apr 17 03:15:09.440377 2026] [:error] [pid 43482:tid 43488] [client 51.107.222.225:28399] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "aeE1PT9SZnuKxlHrct3HvAAAAMQ"]
[Fri Apr 17 03:15:11.088036 2026] [:error] [pid 43387:tid 43477] [client 51.107.222.225:39470] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "aeE1PyBNsONqHxWTakVnjQAAAJg"]
[Fri Apr 17 03:15:12.919308 2026] [:error] [pid 43385:tid 43404] [client 51.107.222.225:1063] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "aeE1QMnIxkJaUI8KNs46oAAAAA8"]
[Fri Apr 17 03:15:15.935651 2026] [:error] [pid 43386:tid 43439] [client 51.107.222.225:28168] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "aeE1Q-91GAVgUfhPVDH31wAAAFM"]
[Fri Apr 17 03:15:17.509290 2026] [:error] [pid 43387:tid 43476] [client 51.107.222.225:32784] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "aeE1RSBNsONqHxWTakVnlQAAAJc"]
[Fri Apr 17 03:15:22.511981 2026] [:error] [pid 26480:tid 26489] [client 51.107.222.225:32679] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jlex.php"] [unique_id "aeE1SgwLDJKTQNfarA2aOQAAAcc"]
[Fri Apr 17 03:15:25.851022 2026] [:error] [pid 4086:tid 4099] [client 51.107.222.225:40892] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xsas.php"] [unique_id "aeE1TVlz7gxl_exM0FpUYAAAAUs"]
[Fri Apr 17 03:15:27.457727 2026] [:error] [pid 3245:tid 3284] [client 51.107.222.225:29025] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xsas.php"] [unique_id "aeE1T6ESOMTHVLs-uFDiIgAAARY"]
[Fri Apr 17 03:15:29.937103 2026] [:error] [pid 26480:tid 26491] [client 51.107.222.225:26271] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xsas.php"] [unique_id "aeE1UQwLDJKTQNfarA2aPwAAAck"]
[Fri Apr 17 03:15:30.868480 2026] [:error] [pid 26480:tid 26503] [client 51.107.222.225:35025] [client 51.107.222.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xsas.php"] [unique_id "aeE1UgwLDJKTQNfarA2aQwAAAdU"]
[Fri Apr 17 03:15:45.032005 2026] [:error] [pid 43387:tid 43471] [client 51.107.222.225:32669] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Fri Apr 17 03:15:45.296070 2026] [:error] [pid 43387:tid 43477] [client 51.107.222.225:32669] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Fri Apr 17 03:15:45.563714 2026] [:error] [pid 43387:tid 43459] [client 51.107.222.225:32669] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Fri Apr 17 03:15:45.832959 2026] [:error] [pid 43387:tid 43475] [client 51.107.222.225:32669] File does not exist: /usr/local/apache/htdocs/suspended-page/ws88.php
[Fri Apr 17 03:15:46.095099 2026] [:error] [pid 43387:tid 43449] [client 51.107.222.225:32669] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 17 03:15:46.378679 2026] [:error] [pid 43387:tid 43474] [client 51.107.222.225:32669] File does not exist: /usr/local/apache/htdocs/suspended-page/ibcqocdtu3eovdx2hwj7Cdefault.php
[Fri Apr 17 03:34:35.270640 2026] [:error] [pid 43837:tid 43860] [client 43.164.197.177:55710] [client 43.164.197.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeE5ywYd1hsOG9YcXIA2YgAAANU"]
[Fri Apr 17 04:02:54.840677 2026] [:error] [pid 9151:tid 9181] [client 209.38.89.62:57460] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/install.php"] [unique_id "aeFAbshTVuRPkua22vRiVwAAABQ"]
[Fri Apr 17 04:02:54.911747 2026] [:error] [pid 9152:tid 9190] [client 209.38.89.62:57472] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp/wp-admin/install.php"] [unique_id "aeFAbpJYca8I3TNCwIfNXgAAAEA"]
[Fri Apr 17 04:02:54.986867 2026] [:error] [pid 9152:tid 9203] [client 209.38.89.62:57474] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new/wp-admin/install.php"] [unique_id "aeFAbpJYca8I3TNCwIfNXwAAAE0"]
[Fri Apr 17 04:02:55.782811 2026] [:error] [pid 9151:tid 9177] [client 209.38.89.62:57482] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/old/wp-admin/install.php"] [unique_id "aeFAb8hTVuRPkua22vRiXAAAABA"]
[Fri Apr 17 04:02:55.891913 2026] [:error] [pid 9152:tid 9198] [client 209.38.89.62:57490] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-admin/install.php"] [unique_id "aeFAb5JYca8I3TNCwIfNYgAAAEg"]
[Fri Apr 17 04:02:56.368667 2026] [:error] [pid 9151:tid 9162] [client 209.38.89.62:57496] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-admin/install.php"] [unique_id "aeFAcMhTVuRPkua22vRiXwAAAAE"]
[Fri Apr 17 04:02:56.557349 2026] [:error] [pid 9263:tid 9279] [client 209.38.89.62:57500] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/wp-admin/install.php"] [unique_id "aeFAcBP68VyHNvj1e56NsgAAAM4"]
[Fri Apr 17 04:02:56.708925 2026] [:error] [pid 9263:tid 9276] [client 209.38.89.62:57504] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-admin/install.php"] [unique_id "aeFAcBP68VyHNvj1e56NtAAAAMs"]
[Fri Apr 17 04:02:56.763212 2026] [:error] [pid 9152:tid 9194] [client 209.38.89.62:57518] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web/wp-admin/install.php"] [unique_id "aeFAcJJYca8I3TNCwIfNZQAAAEQ"]
[Fri Apr 17 04:02:57.087247 2026] [:error] [pid 9263:tid 9282] [client 209.38.89.62:57530] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/backup/wp-admin/install.php"] [unique_id "aeFAcRP68VyHNvj1e56NtgAAANE"]
[Fri Apr 17 04:02:57.149639 2026] [:error] [pid 9263:tid 9266] [client 209.38.89.62:57532] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-admin/install.php"] [unique_id "aeFAcRP68VyHNvj1e56NuAAAAME"]
[Fri Apr 17 04:02:58.113584 2026] [:error] [pid 9263:tid 9267] [client 209.38.89.62:57548] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oldsite/wp-admin/install.php"] [unique_id "aeFAchP68VyHNvj1e56NwAAAAMI"]
[Fri Apr 17 04:02:58.162114 2026] [:error] [pid 9263:tid 9281] [client 209.38.89.62:57560] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop/wp-admin/install.php"] [unique_id "aeFAchP68VyHNvj1e56NwQAAANA"]
[Fri Apr 17 06:05:10.450771 2026] [:error] [pid 51878:tid 51882] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Fri Apr 17 06:05:10.690673 2026] [:error] [pid 51878:tid 51896] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xme.php
[Fri Apr 17 06:05:10.930489 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/il.php
[Fri Apr 17 06:05:11.188504 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Fri Apr 17 06:05:11.689266 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/ypp.php
[Fri Apr 17 06:05:11.936132 2026] [:error] [pid 51878:tid 51891] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/2468.php
[Fri Apr 17 06:05:12.190550 2026] [:error] [pid 51878:tid 51895] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/eterezrezt.php
[Fri Apr 17 06:05:12.677674 2026] [:error] [pid 51878:tid 51889] [client 20.203.186.201:64050] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 17 06:05:12.914158 2026] [:error] [pid 51878:tid 51901] [client 20.203.186.201:64050] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "aeFdGEnQhUtMbw9EsgZ7pgAAARU"]
[Fri Apr 17 06:05:13.427428 2026] [:error] [pid 9263:tid 9271] [client 20.203.186.201:29940] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "aeFdGRP68VyHNvj1e54FxwAAAMY"]
[Fri Apr 17 06:05:14.038792 2026] [:error] [pid 9151:tid 9185] [client 20.203.186.201:64836] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "aeFdGshTVuRPkua22vSiKAAAABg"]
[Fri Apr 17 06:05:14.672820 2026] [:error] [pid 9153:tid 9235] [client 20.203.186.201:64027] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "aeFdGuMHGxkTZX3c45cI8wAAAJE"]
[Fri Apr 17 06:05:15.458732 2026] [:error] [pid 51878:tid 51903] [client 20.203.186.201:29936] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "aeFdG0nQhUtMbw9EsgZ7qgAAARc"]
[Fri Apr 17 06:05:16.026851 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:43896] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "aeFdHEnQhUtMbw9EsgZ7rwAAAQ4"]
[Fri Apr 17 06:05:16.635219 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:64854] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "aeFdHEnQhUtMbw9EsgZ7sgAAAQw"]
[Fri Apr 17 06:05:17.188161 2026] [:error] [pid 9153:tid 9222] [client 20.203.186.201:64037] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "aeFdHeMHGxkTZX3c45cI-AAAAIQ"]
[Fri Apr 17 06:05:17.791165 2026] [:error] [pid 9153:tid 9239] [client 20.203.186.201:61071] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "aeFdHeMHGxkTZX3c45cI-QAAAJU"]
[Fri Apr 17 06:05:18.462297 2026] [:error] [pid 51878:tid 51888] [client 20.203.186.201:64835] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "aeFdHknQhUtMbw9EsgZ7vgAAAQg"]
[Fri Apr 17 06:05:19.026966 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:60166] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "aeFdH0nQhUtMbw9EsgZ7xAAAAQ4"]
[Fri Apr 17 06:05:19.586291 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:64047] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "aeFdHxP68VyHNvj1e54F0QAAAM4"]
[Fri Apr 17 06:05:20.120583 2026] [:error] [pid 51878:tid 51901] [client 20.203.186.201:50401] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeFdIEnQhUtMbw9EsgZ7ywAAARU"]
[Fri Apr 17 06:05:20.712587 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:43875] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeFdIEnQhUtMbw9EsgZ7zgAAAQA"]
[Fri Apr 17 06:05:21.584912 2026] [:error] [pid 9152:tid 9192] [client 20.203.186.201:31559] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeFdIZJYca8I3TNCwIcW-wAAAEI"]
[Fri Apr 17 06:05:22.400607 2026] [:error] [pid 9263:tid 9268] [client 20.203.186.201:50408] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeFdIhP68VyHNvj1e54F1QAAAMM"]
[Fri Apr 17 06:05:23.299911 2026] [:error] [pid 9153:tid 9226] [client 20.203.186.201:61071] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeFdI-MHGxkTZX3c45cJBgAAAIg"]
[Fri Apr 17 06:05:23.987016 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:64040] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeFdI0nQhUtMbw9EsgZ71gAAARM"]
[Fri Apr 17 06:05:24.675002 2026] [:error] [pid 9263:tid 9275] [client 20.203.186.201:60192] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeFdJBP68VyHNvj1e54F2QAAAMo"]
[Fri Apr 17 06:05:25.350004 2026] [:error] [pid 51878:tid 51888] [client 20.203.186.201:29912] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeFdJUnQhUtMbw9EsgZ72QAAAQg"]
[Fri Apr 17 06:05:26.265802 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:50409] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeFdJknQhUtMbw9EsgZ73QAAAQc"]
[Fri Apr 17 06:05:27.162861 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:64884] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeFdJ0nQhUtMbw9EsgZ74wAAAQM"]
[Fri Apr 17 06:05:27.765158 2026] [:error] [pid 51878:tid 51904] [client 20.203.186.201:31560] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeFdJ0nQhUtMbw9EsgZ75QAAARg"]
[Fri Apr 17 06:05:28.412004 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:31598] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeFdKEnQhUtMbw9EsgZ75gAAARQ"]
[Fri Apr 17 06:05:29.024384 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:61078] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFdKUnQhUtMbw9EsgZ76AAAAQw"]
[Fri Apr 17 06:05:29.605104 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:61093] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFdKUnQhUtMbw9EsgZ76gAAAQM"]
[Fri Apr 17 06:05:30.094073 2026] [:error] [pid 9263:tid 9284] [client 20.203.186.201:64028] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFdKhP68VyHNvj1e54F5wAAANM"]
[Fri Apr 17 06:05:30.592531 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:64057] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFdKknQhUtMbw9EsgZ77gAAARM"]
[Fri Apr 17 06:05:31.249497 2026] [:error] [pid 51878:tid 51904] [client 20.203.186.201:50390] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFdK0nQhUtMbw9EsgZ77wAAARg"]
[Fri Apr 17 06:05:31.864140 2026] [:error] [pid 9153:tid 9236] [client 20.203.186.201:60198] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFdK-MHGxkTZX3c45cJEgAAAJI"]
[Fri Apr 17 06:05:32.401052 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:64870] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFdLEnQhUtMbw9EsgZ79AAAAQc"]
[Fri Apr 17 06:05:32.950571 2026] [:error] [pid 9152:tid 9207] [client 20.203.186.201:29924] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFdLJJYca8I3TNCwIcXGwAAAFE"]
[Fri Apr 17 06:05:33.474205 2026] [:error] [pid 9263:tid 9288] [client 20.203.186.201:31607] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFdLRP68VyHNvj1e54F8gAAANc"]
[Fri Apr 17 06:05:34.009854 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:64856] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFdLknQhUtMbw9EsgZ79wAAARM"]
[Fri Apr 17 06:05:34.556757 2026] [:error] [pid 9153:tid 9222] [client 20.203.186.201:31575] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFdLuMHGxkTZX3c45cJGgAAAIQ"]
[Fri Apr 17 06:05:35.115668 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:64878] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFdL0nQhUtMbw9EsgZ7-AAAAQA"]
[Fri Apr 17 06:05:35.675697 2026] [:error] [pid 9153:tid 9219] [client 20.203.186.201:43891] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFdL-MHGxkTZX3c45cJGwAAAIE"]
[Fri Apr 17 06:05:36.253375 2026] [:error] [pid 9151:tid 9161] [client 20.203.186.201:64038] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFdMMhTVuRPkua22vSiMgAAAAA"]
[Fri Apr 17 06:05:37.122302 2026] [:error] [pid 9263:tid 9273] [client 20.203.186.201:64868] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFdMRP68VyHNvj1e54F_AAAAMg"]
[Fri Apr 17 06:05:37.667628 2026] [:error] [pid 9263:tid 9282] [client 20.203.186.201:50384] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFdMRP68VyHNvj1e54GAAAAANE"]
[Fri Apr 17 06:05:38.186157 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:29904] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFdMknQhUtMbw9EsgZ7_wAAAQ4"]
[Fri Apr 17 06:05:38.851762 2026] [:error] [pid 9151:tid 9177] [client 20.203.186.201:50400] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFdMshTVuRPkua22vSiOwAAABA"]
[Fri Apr 17 06:05:39.404596 2026] [:error] [pid 9153:tid 9242] [client 20.203.186.201:43900] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFdM-MHGxkTZX3c45cJHwAAAJg"]
[Fri Apr 17 06:05:39.920614 2026] [:error] [pid 51878:tid 51903] [client 20.203.186.201:31579] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFdM0nQhUtMbw9EsgZ8BgAAARc"]
[Fri Apr 17 06:05:40.410932 2026] [:error] [pid 9151:tid 9171] [client 20.203.186.201:64003] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFdNMhTVuRPkua22vSiPQAAAAo"]
[Fri Apr 17 06:05:41.018667 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:29929] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFdNUnQhUtMbw9EsgZ8CwAAAQc"]
[Fri Apr 17 06:05:41.584774 2026] [:error] [pid 51878:tid 51881] [client 20.203.186.201:43853] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFdNUnQhUtMbw9EsgZ8DQAAAQE"]
[Fri Apr 17 06:05:42.368202 2026] [:error] [pid 9151:tid 9184] [client 20.203.186.201:60193] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFdNshTVuRPkua22vSiQQAAABc"]
[Fri Apr 17 06:05:42.866970 2026] [:error] [pid 9263:tid 9271] [client 20.203.186.201:50387] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFdNhP68VyHNvj1e54GCAAAAMY"]
[Fri Apr 17 06:05:43.354477 2026] [:error] [pid 9151:tid 9178] [client 20.203.186.201:61115] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFdN8hTVuRPkua22vSiQwAAABE"]
[Fri Apr 17 06:05:43.852334 2026] [:error] [pid 51878:tid 51893] [client 20.203.186.201:43881] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFdN0nQhUtMbw9EsgZ8FQAAAQ0"]
[Fri Apr 17 06:05:44.366661 2026] [:error] [pid 9263:tid 9283] [client 20.203.186.201:31595] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFdOBP68VyHNvj1e54GEwAAANI"]
[Fri Apr 17 06:05:44.922169 2026] [:error] [pid 9151:tid 9170] [client 20.203.186.201:31585] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFdOMhTVuRPkua22vSiRQAAAAk"]
[Fri Apr 17 06:05:45.477381 2026] [:error] [pid 9263:tid 9269] [client 20.203.186.201:31609] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFdORP68VyHNvj1e54GIgAAAMQ"]
[Fri Apr 17 06:05:46.028169 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:64044] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFdOhP68VyHNvj1e54GKQAAAMU"]
[Fri Apr 17 06:05:46.568309 2026] [:error] [pid 9153:tid 9222] [client 20.203.186.201:64017] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFdOuMHGxkTZX3c45cJLwAAAIQ"]
[Fri Apr 17 06:05:47.104243 2026] [:error] [pid 51878:tid 51881] [client 20.203.186.201:61094] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFdO0nQhUtMbw9EsgZ8HgAAAQE"]
[Fri Apr 17 06:05:47.613939 2026] [:error] [pid 51878:tid 51885] [client 20.203.186.201:60211] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFdO0nQhUtMbw9EsgZ8IAAAAQU"]
[Fri Apr 17 06:05:48.145277 2026] [:error] [pid 51878:tid 51886] [client 20.203.186.201:31583] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFdPEnQhUtMbw9EsgZ8IwAAAQY"]
[Fri Apr 17 06:05:48.621105 2026] [:error] [pid 51878:tid 51904] [client 20.203.186.201:61074] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFdPEnQhUtMbw9EsgZ8JAAAARg"]
[Fri Apr 17 06:05:49.145573 2026] [:error] [pid 51878:tid 51889] [client 20.203.186.201:50399] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeFdPUnQhUtMbw9EsgZ8JwAAAQk"]
[Fri Apr 17 06:05:49.659240 2026] [:error] [pid 9153:tid 9236] [client 20.203.186.201:64887] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeFdPeMHGxkTZX3c45cJNQAAAJI"]
[Fri Apr 17 06:05:50.146081 2026] [:error] [pid 51878:tid 51895] [client 20.203.186.201:43849] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeFdPknQhUtMbw9EsgZ8KgAAAQ8"]
[Fri Apr 17 06:05:50.711769 2026] [:error] [pid 9153:tid 9228] [client 20.203.186.201:60190] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeFdPuMHGxkTZX3c45cJOgAAAIo"]
[Fri Apr 17 06:05:51.195823 2026] [:error] [pid 9263:tid 9266] [client 20.203.186.201:61068] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFdPxP68VyHNvj1e54GMwAAAME"]
[Fri Apr 17 06:05:51.757011 2026] [:error] [pid 9263:tid 9289] [client 20.203.186.201:60176] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFdPxP68VyHNvj1e54GOAAAANg"]
[Fri Apr 17 06:05:52.334850 2026] [:error] [pid 51878:tid 51888] [client 20.203.186.201:64008] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFdQEnQhUtMbw9EsgZ8LAAAAQg"]
[Fri Apr 17 06:05:52.869946 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:60222] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFdQBP68VyHNvj1e54GPQAAAM4"]
[Fri Apr 17 06:05:53.411416 2026] [:error] [pid 9263:tid 9284] [client 20.203.186.201:61103] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeFdQRP68VyHNvj1e54GPwAAANM"]
[Fri Apr 17 06:05:53.935645 2026] [:error] [pid 9151:tid 9179] [client 20.203.186.201:47352] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeFdQchTVuRPkua22vSiSQAAABI"]
[Fri Apr 17 06:05:54.438454 2026] [:error] [pid 51878:tid 51896] [client 20.203.186.201:60188] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeFdQknQhUtMbw9EsgZ8LwAAARA"]
[Fri Apr 17 06:05:54.930745 2026] [:error] [pid 9263:tid 9269] [client 20.203.186.201:64049] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeFdQhP68VyHNvj1e54GQwAAAMQ"]
[Fri Apr 17 06:05:55.453484 2026] [:error] [pid 9151:tid 9176] [client 20.203.186.201:61056] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aeFdQ8hTVuRPkua22vSiUAAAAA8"]
[Fri Apr 17 06:05:55.985963 2026] [:error] [pid 9263:tid 9289] [client 20.203.186.201:61065] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aeFdQxP68VyHNvj1e54GSAAAANg"]
[Fri Apr 17 06:05:56.483508 2026] [:error] [pid 9263:tid 9282] [client 20.203.186.201:50371] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aeFdRBP68VyHNvj1e54GSgAAANE"]
[Fri Apr 17 06:05:56.964975 2026] [:error] [pid 51878:tid 51886] [client 20.203.186.201:60178] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aeFdREnQhUtMbw9EsgZ8MgAAAQY"]
[Fri Apr 17 06:05:57.466903 2026] [:error] [pid 9263:tid 9265] [client 20.203.186.201:60183] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aeFdRRP68VyHNvj1e54GTwAAAMA"]
[Fri Apr 17 06:05:57.961957 2026] [:error] [pid 9153:tid 9240] [client 20.203.186.201:31612] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aeFdReMHGxkTZX3c45cJQgAAAJY"]
[Fri Apr 17 06:05:58.452352 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:29947] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aeFdRknQhUtMbw9EsgZ8NwAAAQA"]
[Fri Apr 17 06:05:59.001870 2026] [:error] [pid 9152:tid 9194] [client 20.203.186.201:50406] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aeFdR5JYca8I3TNCwIcXRAAAAEQ"]
[Fri Apr 17 06:05:59.482738 2026] [:error] [pid 9153:tid 9233] [client 20.203.186.201:29927] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aeFdR-MHGxkTZX3c45cJRQAAAI8"]
[Fri Apr 17 06:06:00.047986 2026] [:error] [pid 9151:tid 9163] [client 20.203.186.201:64035] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aeFdSMhTVuRPkua22vSiWAAAAAI"]
[Fri Apr 17 06:06:00.652587 2026] [:error] [pid 9151:tid 9173] [client 20.203.186.201:61060] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aeFdSMhTVuRPkua22vSiXAAAAAw"]
[Fri Apr 17 06:06:01.202594 2026] [:error] [pid 9153:tid 9220] [client 20.203.186.201:61106] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aeFdSeMHGxkTZX3c45cJRgAAAII"]
[Fri Apr 17 06:06:01.736785 2026] [:error] [pid 9153:tid 9228] [client 20.203.186.201:43848] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aeFdSeMHGxkTZX3c45cJRwAAAIo"]
[Fri Apr 17 06:06:02.302526 2026] [:error] [pid 51878:tid 51881] [client 20.203.186.201:60215] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aeFdSknQhUtMbw9EsgZ8PQAAAQE"]
[Fri Apr 17 06:06:02.809371 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:31584] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aeFdSknQhUtMbw9EsgZ8PgAAAQM"]
[Fri Apr 17 06:06:03.303819 2026] [:error] [pid 9153:tid 9226] [client 20.203.186.201:61092] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aeFdS-MHGxkTZX3c45cJSwAAAIg"]
[Fri Apr 17 06:06:03.965732 2026] [:error] [pid 9151:tid 9180] [client 20.203.186.201:50394] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aeFdS8hTVuRPkua22vSiYAAAABM"]
[Fri Apr 17 06:06:04.498984 2026] [:error] [pid 9263:tid 9289] [client 20.203.186.201:61075] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aeFdTBP68VyHNvj1e54GVAAAANg"]
[Fri Apr 17 06:06:05.026039 2026] [:error] [pid 9151:tid 9170] [client 20.203.186.201:29892] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aeFdTchTVuRPkua22vSiYgAAAAk"]
[Fri Apr 17 06:06:05.844156 2026] [:error] [pid 9153:tid 9232] [client 20.203.186.201:31554] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aeFdTeMHGxkTZX3c45cJUQAAAI4"]
[Fri Apr 17 06:06:06.349034 2026] [:error] [pid 9152:tid 9206] [client 20.203.186.201:47312] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeFdTpJYca8I3TNCwIcXTgAAAFA"]
[Fri Apr 17 06:06:06.904682 2026] [:error] [pid 9153:tid 9230] [client 20.203.186.201:60165] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeFdTuMHGxkTZX3c45cJVwAAAIw"]
[Fri Apr 17 06:06:07.472718 2026] [:error] [pid 9153:tid 9234] [client 20.203.186.201:57993] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeFdT-MHGxkTZX3c45cJWQAAAJA"]
[Fri Apr 17 06:06:08.007148 2026] [:error] [pid 9263:tid 9265] [client 20.203.186.201:29889] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeFdUBP68VyHNvj1e54GXAAAAMA"]
[Fri Apr 17 06:06:08.575011 2026] [:error] [pid 9152:tid 9211] [client 20.203.186.201:61058] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aeFdUJJYca8I3TNCwIcXUwAAAFU"]
[Fri Apr 17 06:06:09.069624 2026] [:error] [pid 51878:tid 51898] [client 20.203.186.201:64032] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aeFdUUnQhUtMbw9EsgZ8RAAAARI"]
[Fri Apr 17 06:06:09.594964 2026] [:error] [pid 9153:tid 9222] [client 20.203.186.201:64026] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aeFdUeMHGxkTZX3c45cJYQAAAIQ"]
[Fri Apr 17 06:06:10.154293 2026] [:error] [pid 9263:tid 9285] [client 20.203.186.201:53309] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aeFdUhP68VyHNvj1e54GXwAAANQ"]
[Fri Apr 17 06:06:10.706692 2026] [:error] [pid 9153:tid 9227] [client 20.203.186.201:60209] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "aeFdUuMHGxkTZX3c45cJZAAAAIk"]
[Fri Apr 17 06:06:11.238315 2026] [:error] [pid 9263:tid 9281] [client 20.203.186.201:31555] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "aeFdUxP68VyHNvj1e54GYgAAANA"]
[Fri Apr 17 06:06:11.792961 2026] [:error] [pid 9263:tid 9276] [client 20.203.186.201:61081] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "aeFdUxP68VyHNvj1e54GZQAAAMs"]
[Fri Apr 17 06:06:12.347710 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Fri Apr 17 06:06:12.591075 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Fri Apr 17 06:06:12.837766 2026] [:error] [pid 51878:tid 51881] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Fri Apr 17 06:06:13.087899 2026] [:error] [pid 51878:tid 51890] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Fri Apr 17 06:06:13.326401 2026] [:error] [pid 51878:tid 51885] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Fri Apr 17 06:06:13.568317 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 17 06:06:14.121183 2026] [:error] [pid 51878:tid 51897] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_S.php
[Fri Apr 17 06:06:14.377223 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Fri Apr 17 06:06:14.631346 2026] [:error] [pid 51878:tid 51901] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Fri Apr 17 06:06:15.214387 2026] [:error] [pid 51878:tid 51903] [client 20.203.186.201:29901] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Fri Apr 17 06:06:15.464844 2026] [:error] [pid 51878:tid 51895] [client 20.203.186.201:29901] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFdV0nQhUtMbw9EsgZ8WQAAAQ8"]
[Fri Apr 17 06:06:15.950493 2026] [:error] [pid 9263:tid 9284] [client 20.203.186.201:31615] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFdVxP68VyHNvj1e54GcwAAANM"]
[Fri Apr 17 06:06:16.460174 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:50374] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFdWEnQhUtMbw9EsgZ8XgAAAQQ"]
[Fri Apr 17 06:06:17.009535 2026] [:error] [pid 51878:tid 51891] [client 20.203.186.201:50369] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFdWUnQhUtMbw9EsgZ8YwAAAQs"]
[Fri Apr 17 06:06:17.548891 2026] [:error] [pid 9263:tid 9267] [client 20.203.186.201:61062] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFdWRP68VyHNvj1e54GeAAAAMI"]
[Fri Apr 17 06:06:18.098585 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:47523] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFdWknQhUtMbw9EsgZ8aQAAAQA"]
[Fri Apr 17 06:06:18.672239 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:50389] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFdWhP68VyHNvj1e54GfAAAAMU"]
[Fri Apr 17 06:06:19.325785 2026] [:error] [pid 9152:tid 9207] [client 20.203.186.201:31572] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFdW5JYca8I3TNCwIcXWQAAAFE"]
[Fri Apr 17 06:06:19.970460 2026] [:error] [pid 9151:tid 9179] [client 20.203.186.201:43866] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFdW8hTVuRPkua22vSibAAAABI"]
[Fri Apr 17 06:06:20.501562 2026] [:error] [pid 51878:tid 51886] [client 20.203.186.201:58033] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFdXEnQhUtMbw9EsgZ8dwAAAQY"]
[Fri Apr 17 06:06:21.220133 2026] [:error] [pid 51878:tid 51890] [client 20.203.186.201:31592] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFdXUnQhUtMbw9EsgZ8fQAAAQo"]
[Fri Apr 17 06:06:21.791278 2026] [:error] [pid 9152:tid 9208] [client 20.203.186.201:60184] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFdXZJYca8I3TNCwIcXdAAAAFI"]
[Fri Apr 17 06:06:22.283165 2026] [:error] [pid 9263:tid 9281] [client 20.203.186.201:61064] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFdXhP68VyHNvj1e54GhgAAANA"]
[Fri Apr 17 06:06:22.879341 2026] [:error] [pid 9263:tid 9266] [client 20.203.186.201:64871] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFdXhP68VyHNvj1e54GiQAAAME"]
[Fri Apr 17 06:06:23.605412 2026] [:error] [pid 9153:tid 9239] [client 20.203.186.201:43859] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFdX-MHGxkTZX3c45cJbgAAAJU"]
[Fri Apr 17 06:06:24.326346 2026] [:error] [pid 9153:tid 9230] [client 20.203.186.201:43846] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFdYOMHGxkTZX3c45cJdAAAAIw"]
[Fri Apr 17 06:06:25.279944 2026] [:error] [pid 9263:tid 9284] [client 20.203.186.201:61070] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFdYRP68VyHNvj1e54GkwAAANM"]
[Fri Apr 17 06:06:26.330619 2026] [:error] [pid 9263:tid 9268] [client 20.203.186.201:64885] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFdYhP68VyHNvj1e54GoAAAAMM"]
[Fri Apr 17 06:06:27.093240 2026] [:error] [pid 51878:tid 51885] [client 20.203.186.201:64859] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFdY0nQhUtMbw9EsgZ8mwAAAQU"]
[Fri Apr 17 06:06:28.667176 2026] [:error] [pid 9151:tid 9181] [client 20.203.186.201:43873] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFdZMhTVuRPkua22vSigQAAABQ"]
[Fri Apr 17 06:06:30.074805 2026] [:error] [pid 9153:tid 9235] [client 20.203.186.201:64059] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFdZuMHGxkTZX3c45cJeQAAAJE"]
[Fri Apr 17 06:06:30.914884 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:29888] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFdZhP68VyHNvj1e54GuAAAAM4"]
[Fri Apr 17 06:06:32.295875 2026] [:error] [pid 9153:tid 9227] [client 20.203.186.201:31566] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFdaOMHGxkTZX3c45cJfQAAAIk"]
[Fri Apr 17 06:06:33.895771 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:47488] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFdaUnQhUtMbw9EsgZ8xgAAAQQ"]
[Fri Apr 17 06:06:34.680764 2026] [:error] [pid 9152:tid 9214] [client 20.203.186.201:61090] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFdapJYca8I3TNCwIcXgQAAAFg"]
[Fri Apr 17 06:06:35.785611 2026] [:error] [pid 9263:tid 9276] [client 20.203.186.201:64840] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFdaxP68VyHNvj1e54G2QAAAMs"]
[Fri Apr 17 06:06:36.492651 2026] [:error] [pid 51878:tid 51904] [client 20.203.186.201:57987] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFdbEnQhUtMbw9EsgZ9CQAAARg"]
[Fri Apr 17 06:06:37.735739 2026] [:error] [pid 51878:tid 51891] [client 20.203.186.201:31600] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFdbUnQhUtMbw9EsgZ9HgAAAQs"]
[Fri Apr 17 06:06:38.615618 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:64873] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFdbknQhUtMbw9EsgZ9KwAAAQw"]
[Fri Apr 17 06:06:39.189683 2026] [:error] [pid 9152:tid 9197] [client 20.203.186.201:29917] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFdb5JYca8I3TNCwIcXgwAAAEc"]
[Fri Apr 17 06:06:39.870409 2026] [:error] [pid 51878:tid 51888] [client 20.203.186.201:60179] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFdb0nQhUtMbw9EsgZ9OwAAAQg"]
[Fri Apr 17 06:06:40.515408 2026] [:error] [pid 51878:tid 51889] [client 20.203.186.201:64052] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFdcEnQhUtMbw9EsgZ9RwAAAQk"]
[Fri Apr 17 06:06:41.142257 2026] [:error] [pid 51878:tid 51882] [client 20.203.186.201:29916] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFdcUnQhUtMbw9EsgZ9TwAAAQI"]
[Fri Apr 17 06:06:42.034062 2026] [:error] [pid 9153:tid 9227] [client 20.203.186.201:64841] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFdcuMHGxkTZX3c45cJjgAAAIk"]
[Fri Apr 17 06:06:42.674533 2026] [:error] [pid 51878:tid 51895] [client 20.203.186.201:29896] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFdcknQhUtMbw9EsgZ9YAAAAQ8"]
[Fri Apr 17 06:06:43.337475 2026] [:error] [pid 51878:tid 51888] [client 20.203.186.201:64857] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFdc0nQhUtMbw9EsgZ9awAAAQg"]
[Fri Apr 17 06:06:43.874936 2026] [:error] [pid 9152:tid 9190] [client 20.203.186.201:43871] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFdc5JYca8I3TNCwIcXhwAAAEA"]
[Fri Apr 17 06:06:44.543748 2026] [:error] [pid 9152:tid 9207] [client 20.203.186.201:50391] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFddJJYca8I3TNCwIcXiQAAAFE"]
[Fri Apr 17 06:06:45.198965 2026] [:error] [pid 51878:tid 51901] [client 20.203.186.201:64045] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFddUnQhUtMbw9EsgZ9dgAAARU"]
[Fri Apr 17 06:06:45.722682 2026] [:error] [pid 9152:tid 9206] [client 20.203.186.201:31593] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFddZJYca8I3TNCwIcXjAAAAFA"]
[Fri Apr 17 06:06:46.404198 2026] [:error] [pid 9153:tid 9220] [client 20.203.186.201:61111] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aeFdduMHGxkTZX3c45cJnQAAAII"]
[Fri Apr 17 06:06:46.978579 2026] [:error] [pid 9152:tid 9191] [client 20.203.186.201:64888] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aeFddpJYca8I3TNCwIcXlAAAAEE"]
[Fri Apr 17 06:06:47.563173 2026] [:error] [pid 51878:tid 51882] [client 20.203.186.201:60203] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aeFdd0nQhUtMbw9EsgZ9ggAAAQI"]
[Fri Apr 17 06:06:48.296006 2026] [:error] [pid 9153:tid 9238] [client 20.203.186.201:64845] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aeFdeOMHGxkTZX3c45cJpgAAAJQ"]
[Fri Apr 17 06:06:48.867283 2026] [:error] [pid 9152:tid 9204] [client 20.203.186.201:64029] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFdeJJYca8I3TNCwIcXlwAAAE4"]
[Fri Apr 17 06:06:49.411707 2026] [:error] [pid 9153:tid 9224] [client 20.203.186.201:61061] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFdeeMHGxkTZX3c45cJrAAAAIY"]
[Fri Apr 17 06:06:50.451892 2026] [:error] [pid 9152:tid 9209] [client 20.203.186.201:53253] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFdepJYca8I3TNCwIcXnAAAAFM"]
[Fri Apr 17 06:06:51.057340 2026] [:error] [pid 9151:tid 9165] [client 20.203.186.201:29918] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFde8hTVuRPkua22vSijwAAAAQ"]
[Fri Apr 17 06:06:51.736975 2026] [:error] [pid 9152:tid 9207] [client 20.203.186.201:43876] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aeFde5JYca8I3TNCwIcXoQAAAFE"]
[Fri Apr 17 06:06:52.387449 2026] [:error] [pid 9151:tid 9181] [client 20.203.186.201:29891] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aeFdfMhTVuRPkua22vSikwAAABQ"]
[Fri Apr 17 06:06:53.327800 2026] [:error] [pid 9153:tid 9227] [client 20.203.186.201:43883] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aeFdfeMHGxkTZX3c45cJtQAAAIk"]
[Fri Apr 17 06:06:54.022422 2026] [:error] [pid 9151:tid 9176] [client 20.203.186.201:57879] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aeFdfshTVuRPkua22vSimwAAAA8"]
[Fri Apr 17 06:06:54.885021 2026] [:error] [pid 9263:tid 9278] [client 20.203.186.201:61084] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aeFdfhP68VyHNvj1e54HCAAAAM0"]
[Fri Apr 17 06:06:55.556629 2026] [:error] [pid 9153:tid 9225] [client 20.203.186.201:64842] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aeFdf-MHGxkTZX3c45cJuAAAAIc"]
[Fri Apr 17 06:06:56.086431 2026] [:error] [pid 51878:tid 51902] [client 20.203.186.201:29946] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aeFdgEnQhUtMbw9EsgZ9igAAARY"]
[Fri Apr 17 06:06:56.680245 2026] [:error] [pid 9263:tid 9285] [client 20.203.186.201:61097] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aeFdgBP68VyHNvj1e54HDwAAANQ"]
[Fri Apr 17 06:06:57.198638 2026] [:error] [pid 9153:tid 9230] [client 20.203.186.201:61110] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aeFdgeMHGxkTZX3c45cJvgAAAIw"]
[Fri Apr 17 06:06:57.805893 2026] [:error] [pid 9152:tid 9208] [client 20.203.186.201:29931] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aeFdgZJYca8I3TNCwIcXqQAAAFI"]
[Fri Apr 17 06:06:58.390201 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:58038] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aeFdgknQhUtMbw9EsgZ9jgAAAQ4"]
[Fri Apr 17 06:06:59.073212 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:43885] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aeFdg0nQhUtMbw9EsgZ9kgAAAQc"]
[Fri Apr 17 06:06:59.843475 2026] [:error] [pid 9152:tid 9209] [client 20.203.186.201:60216] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeFdg5JYca8I3TNCwIcXrAAAAFM"]
[Fri Apr 17 06:07:00.394699 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:64877] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeFdhEnQhUtMbw9EsgZ9lwAAAQA"]
[Fri Apr 17 06:07:01.000644 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:61087] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeFdhEnQhUtMbw9EsgZ9nAAAARQ"]
[Fri Apr 17 06:07:01.565604 2026] [:error] [pid 51878:tid 51904] [client 20.203.186.201:64860] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeFdhUnQhUtMbw9EsgZ9oQAAARg"]
[Fri Apr 17 06:07:02.082084 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:64020] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeFdhknQhUtMbw9EsgZ9pQAAAQc"]
[Fri Apr 17 06:07:02.820110 2026] [:error] [pid 51878:tid 51897] [client 20.203.186.201:31596] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeFdhknQhUtMbw9EsgZ9qAAAARE"]
[Fri Apr 17 06:07:03.513510 2026] [:error] [pid 9153:tid 9226] [client 20.203.186.201:57913] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeFdh-MHGxkTZX3c45cJyAAAAIg"]
[Fri Apr 17 06:07:04.176638 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:43863] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeFdiBP68VyHNvj1e54HFQAAAMU"]
[Fri Apr 17 06:07:04.824140 2026] [:error] [pid 9263:tid 9276] [client 20.203.186.201:43880] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeFdiBP68VyHNvj1e54HHAAAAMs"]
[Fri Apr 17 06:07:05.461178 2026] [:error] [pid 9263:tid 9285] [client 20.203.186.201:31587] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeFdiRP68VyHNvj1e54HHgAAANQ"]
[Fri Apr 17 06:07:06.032392 2026] [:error] [pid 9151:tid 9167] [client 20.203.186.201:57884] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeFdishTVuRPkua22vSitQAAAAY"]
[Fri Apr 17 06:07:06.554008 2026] [:error] [pid 9151:tid 9174] [client 20.203.186.201:57994] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeFdishTVuRPkua22vSitgAAAA0"]
[Fri Apr 17 06:07:07.359302 2026] [:error] [pid 9263:tid 9286] [client 20.203.186.201:43840] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeFdixP68VyHNvj1e54HIwAAANU"]
[Fri Apr 17 06:07:07.873696 2026] [:error] [pid 9263:tid 9274] [client 20.203.186.201:29923] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeFdixP68VyHNvj1e54HJAAAAMk"]
[Fri Apr 17 06:07:08.495993 2026] [:error] [pid 51878:tid 51889] [client 20.203.186.201:31613] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeFdjEnQhUtMbw9EsgZ9tAAAAQk"]
[Fri Apr 17 06:07:09.156790 2026] [:error] [pid 51878:tid 51893] [client 20.203.186.201:57986] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeFdjUnQhUtMbw9EsgZ9ugAAAQ0"]
[Fri Apr 17 06:07:10.074690 2026] [:error] [pid 9263:tid 9284] [client 20.203.186.201:50426] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdjhP68VyHNvj1e54HJwAAANM"]
[Fri Apr 17 06:07:11.172493 2026] [:error] [pid 51878:tid 51902] [client 20.203.186.201:60171] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdj0nQhUtMbw9EsgZ9wAAAARY"]
[Fri Apr 17 06:07:11.910075 2026] [:error] [pid 9151:tid 9175] [client 20.203.186.201:61096] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdj8hTVuRPkua22vSivAAAAA4"]
[Fri Apr 17 06:07:12.571069 2026] [:error] [pid 9151:tid 9163] [client 20.203.186.201:43874] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdkMhTVuRPkua22vSivwAAAAI"]
[Fri Apr 17 06:07:13.228078 2026] [:error] [pid 9151:tid 9169] [client 20.203.186.201:64055] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeFdkchTVuRPkua22vSiwgAAAAg"]
[Fri Apr 17 06:07:13.894016 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:57876] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeFdkRP68VyHNvj1e54HLAAAAM4"]
[Fri Apr 17 06:07:14.666930 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:57995] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeFdkknQhUtMbw9EsgZ9xQAAAQc"]
[Fri Apr 17 06:07:15.274504 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/66.php
[Fri Apr 17 06:07:15.519981 2026] [:error] [pid 51878:tid 51886] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 17 06:07:15.760167 2026] [:error] [pid 51878:tid 51897] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/ol.php
[Fri Apr 17 06:07:15.998659 2026] [:error] [pid 51878:tid 51901] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Apr 17 06:07:16.382323 2026] [:error] [pid 51878:tid 51903] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Apr 17 06:07:16.639281 2026] [:error] [pid 51878:tid 51882] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Fri Apr 17 06:07:16.903571 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Apr 17 06:07:17.161462 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Fri Apr 17 06:07:17.642961 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/bless4.php
[Fri Apr 17 06:07:17.881825 2026] [:error] [pid 51878:tid 51885] [client 20.203.186.201:43889] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Fri Apr 17 06:07:18.133218 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:43889] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFdlknQhUtMbw9EsgZ91wAAARM"]
[Fri Apr 17 06:07:18.756418 2026] [:error] [pid 9153:tid 9218] [client 20.203.186.201:61082] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFdluMHGxkTZX3c45cJ1wAAAIA"]
[Fri Apr 17 06:07:19.427760 2026] [:error] [pid 9263:tid 9287] [client 20.203.186.201:57862] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFdlxP68VyHNvj1e54HOQAAANY"]
[Fri Apr 17 06:07:20.346970 2026] [:error] [pid 9152:tid 9202] [client 20.203.186.201:64863] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFdmJJYca8I3TNCwIcXwgAAAEw"]
[Fri Apr 17 06:07:21.036841 2026] [:error] [pid 9263:tid 9276] [client 20.203.186.201:57862] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFdmRP68VyHNvj1e54HPQAAAMs"]
[Fri Apr 17 06:07:22.505530 2026] [:error] [pid 9152:tid 9203] [client 20.203.186.201:53268] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFdmpJYca8I3TNCwIcXyAAAAE0"]
[Fri Apr 17 06:07:23.577778 2026] [:error] [pid 9153:tid 9236] [client 20.203.186.201:43869] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFdm-MHGxkTZX3c45cJ3wAAAJI"]
[Fri Apr 17 06:07:24.665641 2026] [:error] [pid 51878:tid 51882] [client 20.203.186.201:64855] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFdnEnQhUtMbw9EsgZ94gAAAQI"]
[Fri Apr 17 06:07:25.708557 2026] [:error] [pid 9151:tid 9174] [client 20.203.186.201:50427] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFdnchTVuRPkua22vSi1gAAAA0"]
[Fri Apr 17 06:07:26.691074 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:53268] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFdnknQhUtMbw9EsgZ99gAAARQ"]
[Fri Apr 17 06:07:27.549786 2026] [:error] [pid 9263:tid 9282] [client 20.203.186.201:60214] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFdnxP68VyHNvj1e54HUAAAANE"]
[Fri Apr 17 06:07:29.384710 2026] [:error] [pid 9151:tid 9181] [client 20.203.186.201:58000] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFdochTVuRPkua22vSi3wAAABQ"]
[Fri Apr 17 06:07:30.605843 2026] [:error] [pid 9153:tid 9242] [client 20.203.186.201:60180] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFdouMHGxkTZX3c45cKAwAAAJg"]
[Fri Apr 17 06:07:31.415533 2026] [:error] [pid 9151:tid 9169] [client 20.203.186.201:29895] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFdo8hTVuRPkua22vSi4wAAAAg"]
[Fri Apr 17 06:07:32.094688 2026] [:error] [pid 9153:tid 9237] [client 20.203.186.201:60164] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFdpOMHGxkTZX3c45cKDAAAAJM"]
[Fri Apr 17 06:07:33.283885 2026] [:error] [pid 51878:tid 51885] [client 20.203.186.201:64852] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFdpUnQhUtMbw9EsgZ-CQAAAQU"]
[Fri Apr 17 06:07:35.046207 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:60210] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFdp0nQhUtMbw9EsgZ-FgAAAQM"]
[Fri Apr 17 06:07:35.859435 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:50378] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFdp0nQhUtMbw9EsgZ-GwAAAQQ"]
[Fri Apr 17 06:07:36.580124 2026] [:error] [pid 51878:tid 51903] [client 20.203.186.201:64056] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFdqEnQhUtMbw9EsgZ-IgAAARc"]
[Fri Apr 17 06:07:37.312128 2026] [:error] [pid 9263:tid 9265] [client 20.203.186.201:43890] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFdqRP68VyHNvj1e54HfAAAAMA"]
[Fri Apr 17 06:07:38.538162 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:58012] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFdqhP68VyHNvj1e54HgwAAAMU"]
[Fri Apr 17 06:07:40.577306 2026] [:error] [pid 51878:tid 51901] [client 20.203.186.201:31580] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFdrEnQhUtMbw9EsgZ-MgAAARU"]
[Fri Apr 17 06:07:41.571678 2026] [:error] [pid 51878:tid 51897] [client 20.203.186.201:53710] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFdrUnQhUtMbw9EsgZ-NwAAARE"]
[Fri Apr 17 06:07:42.572368 2026] [:error] [pid 9152:tid 9205] [client 20.203.186.201:50410] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFdrpJYca8I3TNCwIcX2gAAAE8"]
[Fri Apr 17 06:07:43.408359 2026] [:error] [pid 9263:tid 9266] [client 20.203.186.201:53304] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aeFdrxP68VyHNvj1e54HkwAAAME"]
[Fri Apr 17 06:07:45.181788 2026] [:error] [pid 9152:tid 9211] [client 20.203.186.201:64843] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aeFdsZJYca8I3TNCwIcX3QAAAFU"]
[Fri Apr 17 06:07:46.052594 2026] [:error] [pid 9151:tid 9165] [client 20.203.186.201:47309] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aeFdsshTVuRPkua22vSjAwAAAAQ"]
[Fri Apr 17 06:07:47.006539 2026] [:error] [pid 9151:tid 9182] [client 20.203.186.201:64009] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aeFds8hTVuRPkua22vSjCAAAABU"]
[Fri Apr 17 06:07:48.421653 2026] [:error] [pid 51878:tid 51881] [client 20.203.186.201:47540] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aeFdtEnQhUtMbw9EsgZ-SAAAAQE"]
[Fri Apr 17 06:07:49.953317 2026] [:error] [pid 51878:tid 51903] [client 20.203.186.201:29951] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aeFdtUnQhUtMbw9EsgZ-VAAAARc"]
[Fri Apr 17 06:07:50.557708 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:57998] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aeFdtknQhUtMbw9EsgZ-WwAAAQ4"]
[Fri Apr 17 06:07:51.718339 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:31573] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "aeFdt0nQhUtMbw9EsgZ-aQAAARQ"]
[Fri Apr 17 06:07:52.357463 2026] [:error] [pid 51878:tid 51898] [client 20.203.186.201:47351] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeFduEnQhUtMbw9EsgZ-cgAAARI"]
[Fri Apr 17 06:07:53.814758 2026] [:error] [pid 9263:tid 9276] [client 20.203.186.201:61080] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeFduRP68VyHNvj1e54HqQAAAMs"]
[Fri Apr 17 06:07:55.882684 2026] [:error] [pid 9153:tid 9218] [client 20.203.186.201:60205] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeFdu-MHGxkTZX3c45cKSAAAAIA"]
[Fri Apr 17 06:07:56.831760 2026] [:error] [pid 9153:tid 9220] [client 20.203.186.201:53263] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeFdvOMHGxkTZX3c45cKTAAAAII"]
[Fri Apr 17 06:07:57.947663 2026] [:error] [pid 9263:tid 9288] [client 20.203.186.201:50429] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeFdvRP68VyHNvj1e54HtwAAANc"]
[Fri Apr 17 06:07:59.345114 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:61057] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeFdv0nQhUtMbw9EsgZ-kgAAAQw"]
[Fri Apr 17 06:08:00.257416 2026] [:error] [pid 51878:tid 51890] [client 20.203.186.201:43877] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeFdwEnQhUtMbw9EsgZ-mQAAAQo"]
[Fri Apr 17 06:08:01.637414 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:31558] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeFdwUnQhUtMbw9EsgZ-oQAAARM"]
[Fri Apr 17 06:08:02.758855 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:64833] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdwhP68VyHNvj1e54HwwAAAM4"]
[Fri Apr 17 06:08:03.464970 2026] [:error] [pid 9153:tid 9236] [client 20.203.186.201:64890] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdw-MHGxkTZX3c45cKWAAAAJI"]
[Fri Apr 17 06:08:05.331914 2026] [:error] [pid 9153:tid 9239] [client 20.203.186.201:43888] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdxeMHGxkTZX3c45cKXwAAAJU"]
[Fri Apr 17 06:08:07.251781 2026] [:error] [pid 9151:tid 9169] [client 20.203.186.201:31553] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeFdx8hTVuRPkua22vSjJAAAAAg"]
[Fri Apr 17 06:08:08.438426 2026] [:error] [pid 9263:tid 9285] [client 20.203.186.201:53723] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeFdyBP68VyHNvj1e54H1wAAANQ"]
[Fri Apr 17 06:08:09.765965 2026] [:error] [pid 9263:tid 9280] [client 20.203.186.201:61109] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeFdyRP68VyHNvj1e54H2wAAAM8"]
[Fri Apr 17 06:08:11.051719 2026] [:error] [pid 9152:tid 9195] [client 20.203.186.201:43897] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeFdy5JYca8I3TNCwIcX-gAAAEU"]
[Fri Apr 17 06:08:12.130410 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:64853] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeFdzBP68VyHNvj1e54H4gAAAM4"]
[Fri Apr 17 06:08:12.995068 2026] [:error] [pid 9152:tid 9192] [client 20.203.186.201:53714] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFdzJJYca8I3TNCwIcX_wAAAEI"]
[Fri Apr 17 06:08:15.146175 2026] [:error] [pid 9152:tid 9205] [client 20.203.186.201:31576] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFdz5JYca8I3TNCwIcYBAAAAE8"]
[Fri Apr 17 06:08:15.762804 2026] [:error] [pid 9152:tid 9198] [client 20.203.186.201:29939] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFdz5JYca8I3TNCwIcYBgAAAEg"]
[Fri Apr 17 06:08:16.749830 2026] [:error] [pid 9153:tid 9236] [client 20.203.186.201:43872] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFd0OMHGxkTZX3c45cKnAAAAJI"]
[Fri Apr 17 06:08:17.683211 2026] [:error] [pid 9263:tid 9265] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Apr 17 06:08:18.096707 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Apr 17 06:08:18.335067 2026] [:error] [pid 9263:tid 9275] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Apr 17 06:08:18.970176 2026] [:error] [pid 9263:tid 9272] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Fri Apr 17 06:08:19.490300 2026] [:error] [pid 9263:tid 9271] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Fri Apr 17 06:08:19.731047 2026] [:error] [pid 9263:tid 9273] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Fri Apr 17 06:08:20.039032 2026] [:error] [pid 9263:tid 9277] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Fri Apr 17 06:08:20.280415 2026] [:error] [pid 9263:tid 9268] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-michan.php
[Fri Apr 17 06:08:20.603001 2026] [:error] [pid 9263:tid 9286] [client 20.203.186.201:43867] File does not exist: /usr/local/apache/htdocs/suspended-page/admin1.php
[Fri Apr 17 06:08:20.934036 2026] [:error] [pid 9263:tid 9286] [client 20.203.186.201:43867] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFd1BP68VyHNvj1e54H_AAAANU"]
[Fri Apr 17 06:08:21.903150 2026] [:error] [pid 51878:tid 51898] [client 20.203.186.201:64004] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFd1UnQhUtMbw9EsgZ-9wAAARI"]
[Fri Apr 17 06:08:23.059573 2026] [:error] [pid 9151:tid 9177] [client 20.203.186.201:64063] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFd18hTVuRPkua22vSjVAAAABA"]
[Fri Apr 17 06:08:24.099192 2026] [:error] [pid 9153:tid 9237] [client 20.203.186.201:64062] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFd2OMHGxkTZX3c45cKyQAAAJM"]
[Fri Apr 17 06:08:24.969963 2026] [:error] [pid 9152:tid 9211] [client 20.203.186.201:64839] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFd2JJYca8I3TNCwIcYFAAAAFU"]
[Fri Apr 17 06:08:25.907516 2026] [:error] [pid 9151:tid 9163] [client 20.203.186.201:43842] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFd2chTVuRPkua22vSjXAAAAAI"]
[Fri Apr 17 06:08:26.865696 2026] [:error] [pid 9263:tid 9289] [client 20.203.186.201:29943] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFd2hP68VyHNvj1e54H_gAAANg"]
[Fri Apr 17 06:08:27.744872 2026] [:error] [pid 9152:tid 9209] [client 20.203.186.201:50423] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFd25JYca8I3TNCwIcYFwAAAFM"]
[Fri Apr 17 06:08:28.581719 2026] [:error] [pid 9152:tid 9206] [client 20.203.186.201:64013] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFd3JJYca8I3TNCwIcYHgAAAFA"]
[Fri Apr 17 06:08:29.437603 2026] [:error] [pid 9151:tid 9168] [client 20.203.186.201:29910] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFd3chTVuRPkua22vSjagAAAAc"]
[Fri Apr 17 06:08:30.235108 2026] [:error] [pid 9152:tid 9212] [client 20.203.186.201:47324] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFd3pJYca8I3TNCwIcYKQAAAFY"]
[Fri Apr 17 06:08:31.148457 2026] [:error] [pid 9151:tid 9171] [client 20.203.186.201:50428] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFd38hTVuRPkua22vSjcQAAAAo"]
[Fri Apr 17 06:08:32.795322 2026] [:error] [pid 9151:tid 9165] [client 20.203.186.201:43879] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFd4MhTVuRPkua22vSjfAAAAAQ"]
[Fri Apr 17 06:08:33.479001 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:64002] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFd4UnQhUtMbw9EsgZ_CwAAARM"]
[Fri Apr 17 06:08:34.384436 2026] [:error] [pid 9263:tid 9271] [client 20.203.186.201:53262] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFd4hP68VyHNvj1e54IAgAAAMY"]
[Fri Apr 17 06:08:35.098554 2026] [:error] [pid 51878:tid 51895] [client 20.203.186.201:60185] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFd40nQhUtMbw9EsgZ_FQAAAQ8"]
[Fri Apr 17 06:08:36.528136 2026] [:error] [pid 9152:tid 9201] [client 20.203.186.201:64053] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFd5JJYca8I3TNCwIcYNwAAAEs"]
[Fri Apr 17 06:08:39.063145 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:47501] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFd50nQhUtMbw9EsgZ_LAAAAQw"]
[Fri Apr 17 06:08:40.791127 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:29907] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFd6EnQhUtMbw9EsgZ_MwAAAQQ"]
[Fri Apr 17 06:08:41.743796 2026] [:error] [pid 9152:tid 9205] [client 20.203.186.201:53727] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFd6ZJYca8I3TNCwIcYOgAAAE8"]
[Fri Apr 17 06:08:42.577806 2026] [:error] [pid 51878:tid 51893] [client 20.203.186.201:43886] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFd6knQhUtMbw9EsgZ_PAAAAQ0"]
[Fri Apr 17 06:08:43.319153 2026] [:error] [pid 9152:tid 9206] [client 20.203.186.201:29913] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFd65JYca8I3TNCwIcYOwAAAFA"]
[Fri Apr 17 06:08:44.015423 2026] [:error] [pid 9153:tid 9241] [client 20.203.186.201:64892] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFd7OMHGxkTZX3c45cK4AAAAJc"]
[Fri Apr 17 06:08:44.674883 2026] [:error] [pid 9153:tid 9226] [client 20.203.186.201:47296] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFd7OMHGxkTZX3c45cK4gAAAIg"]
[Fri Apr 17 06:08:45.326009 2026] [:error] [pid 9263:tid 9271] [client 20.203.186.201:64880] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFd7RP68VyHNvj1e54IDwAAAMY"]
[Fri Apr 17 06:08:45.912775 2026] [:error] [pid 9153:tid 9228] [client 20.203.186.201:61107] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFd7eMHGxkTZX3c45cK5QAAAIo"]
[Fri Apr 17 06:08:46.517729 2026] [:error] [pid 9151:tid 9175] [client 20.203.186.201:12566] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFd7shTVuRPkua22vSjgQAAAA4"]
[Fri Apr 17 06:08:47.548183 2026] [:error] [pid 9152:tid 9203] [client 20.203.186.201:60199] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFd75JYca8I3TNCwIcYPwAAAE0"]
[Fri Apr 17 06:08:48.356902 2026] [:error] [pid 9263:tid 9268] [client 20.203.186.201:31594] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFd8BP68VyHNvj1e54IEQAAAMM"]
[Fri Apr 17 06:08:49.547092 2026] [:error] [pid 9152:tid 9211] [client 20.203.186.201:31591] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFd8ZJYca8I3TNCwIcYQwAAAFU"]
[Fri Apr 17 06:08:50.296700 2026] [:error] [pid 9263:tid 9266] [client 20.203.186.201:61076] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFd8hP68VyHNvj1e54IEwAAAME"]
[Fri Apr 17 06:08:50.990494 2026] [:error] [pid 9263:tid 9275] [client 20.203.186.201:57917] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFd8hP68VyHNvj1e54IGAAAAMo"]
[Fri Apr 17 06:08:51.820988 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:53293] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFd8xP68VyHNvj1e54IGwAAAM4"]
[Fri Apr 17 06:08:53.025066 2026] [:error] [pid 9153:tid 9237] [client 20.203.186.201:34135] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFd9eMHGxkTZX3c45cK7QAAAJM"]
[Fri Apr 17 06:08:53.675605 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:64055] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFd9UnQhUtMbw9EsgZ_SAAAARQ"]
[Fri Apr 17 06:08:54.746130 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:47314] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFd9knQhUtMbw9EsgZ_TwAAAQ4"]
[Fri Apr 17 06:08:55.391896 2026] [:error] [pid 9263:tid 9286] [client 20.203.186.201:53754] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFd9xP68VyHNvj1e54IIQAAANU"]
[Fri Apr 17 06:08:56.215373 2026] [:error] [pid 9153:tid 9224] [client 20.203.186.201:43884] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFd-OMHGxkTZX3c45cK9AAAAIY"]
[Fri Apr 17 06:08:57.233345 2026] [:error] [pid 9151:tid 9162] [client 20.203.186.201:29920] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFd-chTVuRPkua22vSjkwAAAAE"]
[Fri Apr 17 06:08:58.181620 2026] [:error] [pid 51878:tid 51890] [client 20.203.186.201:50372] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFd-knQhUtMbw9EsgZ_WAAAAQo"]
[Fri Apr 17 06:08:58.935708 2026] [:error] [pid 9152:tid 9198] [client 20.203.186.201:43857] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFd-pJYca8I3TNCwIcYRwAAAEg"]
[Fri Apr 17 06:08:59.533555 2026] [:error] [pid 9263:tid 9268] [client 20.203.186.201:61095] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFd-xP68VyHNvj1e54IKQAAAMM"]
[Fri Apr 17 06:09:00.234220 2026] [:error] [pid 9263:tid 9272] [client 20.203.186.201:53722] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFd_BP68VyHNvj1e54ILAAAAMc"]
[Fri Apr 17 06:09:01.155680 2026] [:error] [pid 9263:tid 9265] [client 20.203.186.201:60191] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFd_RP68VyHNvj1e54IMAAAAMA"]
[Fri Apr 17 06:09:01.878168 2026] [:error] [pid 9152:tid 9201] [client 20.203.186.201:31590] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFd_ZJYca8I3TNCwIcYSQAAAEs"]
[Fri Apr 17 06:09:02.532152 2026] [:error] [pid 9151:tid 9165] [client 20.203.186.201:50422] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFd_shTVuRPkua22vSjmwAAAAQ"]
[Fri Apr 17 06:09:03.392534 2026] [:error] [pid 9153:tid 9224] [client 20.203.186.201:57886] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFd_-MHGxkTZX3c45cLAAAAAIY"]
[Fri Apr 17 06:09:04.136265 2026] [:error] [pid 9263:tid 9266] [client 20.203.186.201:20761] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFeABP68VyHNvj1e54IMQAAAME"]
[Fri Apr 17 06:09:04.871563 2026] [:error] [pid 9151:tid 9179] [client 20.203.186.201:60172] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFeAMhTVuRPkua22vSjngAAABI"]
[Fri Apr 17 06:09:05.665316 2026] [:error] [pid 9263:tid 9271] [client 20.203.186.201:58014] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFeARP68VyHNvj1e54IMwAAAMY"]
[Fri Apr 17 06:09:06.632459 2026] [:error] [pid 9263:tid 9273] [client 20.203.186.201:34174] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFeAhP68VyHNvj1e54INAAAAMg"]
[Fri Apr 17 06:09:07.247959 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:58002] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFeA0nQhUtMbw9EsgZ_XwAAARQ"]
[Fri Apr 17 06:09:08.106947 2026] [:error] [pid 51878:tid 51890] [client 20.203.186.201:57892] [client 20.203.186.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeFeBEnQhUtMbw9EsgZ_YQAAAQo"]
[Fri Apr 17 06:09:08.697853 2026] [:error] [pid 51878:tid 51902] [client 20.203.186.201:31611] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeFeBEnQhUtMbw9EsgZ_YwAAARY"]
[Fri Apr 17 06:09:09.405648 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:50402] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeFeBUnQhUtMbw9EsgZ_ZAAAAQ4"]
[Fri Apr 17 06:09:10.353025 2026] [:error] [pid 51878:tid 51886] [client 20.203.186.201:64007] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeFeBknQhUtMbw9EsgZ_aAAAAQY"]
[Fri Apr 17 06:09:10.923235 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:53280] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFeBknQhUtMbw9EsgZ_agAAARM"]
[Fri Apr 17 06:09:11.571966 2026] [:error] [pid 9153:tid 9233] [client 20.203.186.201:64862] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFeB-MHGxkTZX3c45cLDgAAAI8"]
[Fri Apr 17 06:09:12.468785 2026] [:error] [pid 9263:tid 9276] [client 20.203.186.201:57903] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFeCBP68VyHNvj1e54IPAAAAMs"]
[Fri Apr 17 06:09:13.063514 2026] [:error] [pid 9263:tid 9265] [client 20.203.186.201:31556] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeFeCRP68VyHNvj1e54IPQAAAMA"]
[Fri Apr 17 06:09:13.943035 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:47542] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFeCUnQhUtMbw9EsgZ_bgAAARQ"]
[Fri Apr 17 06:09:14.556250 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:61119] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFeChP68VyHNvj1e54IQAAAAMU"]
[Fri Apr 17 06:09:15.267181 2026] [:error] [pid 9153:tid 9218] [client 20.203.186.201:60187] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFeC-MHGxkTZX3c45cLHAAAAIA"]
[Fri Apr 17 06:09:15.979397 2026] [:error] [pid 9153:tid 9231] [client 20.203.186.201:61085] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeFeC-MHGxkTZX3c45cLHgAAAI0"]
[Fri Apr 17 06:09:16.618927 2026] [:error] [pid 9263:tid 9281] [client 20.203.186.201:64834] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeFeDBP68VyHNvj1e54IQgAAANA"]
[Fri Apr 17 06:09:17.433337 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:53249] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeFeDUnQhUtMbw9EsgZ_egAAAQM"]
[Fri Apr 17 06:09:18.030532 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:31579] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeFeDknQhUtMbw9EsgZ_fgAAAQw"]
[Fri Apr 17 06:09:18.933356 2026] [:error] [pid 9152:tid 9200] [client 20.203.186.201:64019] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeFeDpJYca8I3TNCwIcYWQAAAEo"]
[Fri Apr 17 06:09:19.767396 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:53707] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aeFeD0nQhUtMbw9EsgZ_jwAAARM"]
[Fri Apr 17 06:09:20.288038 2026] [:error] [pid 51878:tid 51893] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Apr 17 06:09:20.610054 2026] [:error] [pid 51878:tid 51896] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Fri Apr 17 06:09:20.922937 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Fri Apr 17 06:09:21.250683 2026] [:error] [pid 51878:tid 51892] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Apr 17 06:09:21.590276 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Fri Apr 17 06:09:22.141127 2026] [:error] [pid 51878:tid 51890] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Apr 17 06:09:22.418379 2026] [:error] [pid 51878:tid 51902] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Fri Apr 17 06:09:23.033804 2026] [:error] [pid 51878:tid 51896] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Fri Apr 17 06:09:23.308515 2026] [:error] [pid 51878:tid 51904] [client 20.203.186.201:64002] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Fri Apr 17 06:09:23.580492 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:64002] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFeE0nQhUtMbw9EsgZ_xgAAAQA"]
[Fri Apr 17 06:09:24.128318 2026] [:error] [pid 51878:tid 51895] [client 20.203.186.201:43847] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFeFEnQhUtMbw9EsgZ_yAAAAQ8"]
[Fri Apr 17 06:09:24.844590 2026] [:error] [pid 51878:tid 51900] [client 20.203.186.201:50375] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFeFEnQhUtMbw9EsgZ_zwAAARQ"]
[Fri Apr 17 06:09:25.741104 2026] [:error] [pid 9263:tid 9273] [client 20.203.186.201:53297] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFeFRP68VyHNvj1e54ITgAAAMg"]
[Fri Apr 17 06:09:26.547931 2026] [:error] [pid 51878:tid 51885] [client 20.203.186.201:43858] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFeFknQhUtMbw9EsgZ_5gAAAQU"]
[Fri Apr 17 06:09:28.239949 2026] [:error] [pid 9153:tid 9238] [client 20.203.186.201:29899] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFeGOMHGxkTZX3c45cLOQAAAJQ"]
[Fri Apr 17 06:09:29.002160 2026] [:error] [pid 51878:tid 51881] [client 20.203.186.201:29940] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFeGUnQhUtMbw9EsgZ__AAAAQE"]
[Fri Apr 17 06:09:29.689154 2026] [:error] [pid 9152:tid 9195] [client 20.203.186.201:29919] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFeGZJYca8I3TNCwIcYZAAAAEU"]
[Fri Apr 17 06:09:30.511517 2026] [:error] [pid 51878:tid 51894] [client 20.203.186.201:47543] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFeGknQhUtMbw9EsgaACQAAAQ4"]
[Fri Apr 17 06:09:31.170498 2026] [:error] [pid 9263:tid 9283] [client 20.203.186.201:53741] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFeGxP68VyHNvj1e54IVgAAANI"]
[Fri Apr 17 06:09:31.753356 2026] [:error] [pid 51878:tid 51890] [client 20.203.186.201:43850] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFeG0nQhUtMbw9EsgaAEgAAAQo"]
[Fri Apr 17 06:09:32.691119 2026] [:error] [pid 51878:tid 51888] [client 20.203.186.201:53735] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFeHEnQhUtMbw9EsgaAGAAAAQg"]
[Fri Apr 17 06:09:33.503352 2026] [:error] [pid 9153:tid 9223] [client 20.203.186.201:61088] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFeHeMHGxkTZX3c45cLPwAAAIU"]
[Fri Apr 17 06:09:34.280575 2026] [:error] [pid 9153:tid 9226] [client 20.203.186.201:47356] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFeHuMHGxkTZX3c45cLRAAAAIg"]
[Fri Apr 17 06:09:34.797383 2026] [:error] [pid 9152:tid 9199] [client 20.203.186.201:50401] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFeHpJYca8I3TNCwIcYZwAAAEk"]
[Fri Apr 17 06:09:35.967978 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:50393] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFeHxP68VyHNvj1e54IYgAAAM4"]
[Fri Apr 17 06:09:36.785308 2026] [:error] [pid 9152:tid 9190] [client 20.203.186.201:64832] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFeIJJYca8I3TNCwIcYaAAAAEA"]
[Fri Apr 17 06:09:37.389080 2026] [:error] [pid 9263:tid 9289] [client 20.203.186.201:23989] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFeIRP68VyHNvj1e54IaAAAANg"]
[Fri Apr 17 06:09:37.995146 2026] [:error] [pid 51878:tid 51891] [client 20.203.186.201:31570] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFeIUnQhUtMbw9EsgaALQAAAQs"]
[Fri Apr 17 06:09:38.563182 2026] [:error] [pid 51878:tid 51903] [client 20.203.186.201:33643] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFeIknQhUtMbw9EsgaAMAAAARc"]
[Fri Apr 17 06:09:39.424458 2026] [:error] [pid 9151:tid 9167] [client 20.203.186.201:61067] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFeI8hTVuRPkua22vSj0gAAAAY"]
[Fri Apr 17 06:09:40.025093 2026] [:error] [pid 9263:tid 9275] [client 20.203.186.201:64891] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFeJBP68VyHNvj1e54IbwAAAMo"]
[Fri Apr 17 06:09:40.647462 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:57893] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFeJBP68VyHNvj1e54IcAAAAMU"]
[Fri Apr 17 06:09:41.283640 2026] [:error] [pid 51878:tid 51882] [client 20.203.186.201:50373] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFeJUnQhUtMbw9EsgaARQAAAQI"]
[Fri Apr 17 06:09:41.874032 2026] [:error] [pid 51878:tid 51881] [client 20.203.186.201:64018] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFeJUnQhUtMbw9EsgaARwAAAQE"]
[Fri Apr 17 06:09:42.577731 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:57991] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFeJknQhUtMbw9EsgaASwAAARM"]
[Fri Apr 17 06:09:43.182475 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:64029] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFeJ0nQhUtMbw9EsgaATAAAAQM"]
[Fri Apr 17 06:09:43.786899 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:47319] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFeJ0nQhUtMbw9EsgaAUAAAAQQ"]
[Fri Apr 17 06:09:44.384370 2026] [:error] [pid 9263:tid 9270] [client 20.203.186.201:64025] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFeKBP68VyHNvj1e54IdwAAAMU"]
[Fri Apr 17 06:09:45.365567 2026] [:error] [pid 9151:tid 9169] [client 20.203.186.201:61083] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFeKchTVuRPkua22vSj1AAAAAg"]
[Fri Apr 17 06:09:45.955324 2026] [:error] [pid 9151:tid 9179] [client 20.203.186.201:64881] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFeKchTVuRPkua22vSj1QAAABI"]
[Fri Apr 17 06:09:46.855777 2026] [:error] [pid 9152:tid 9196] [client 20.203.186.201:60198] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFeKpJYca8I3TNCwIcYcwAAAEY"]
[Fri Apr 17 06:09:47.651910 2026] [:error] [pid 9151:tid 9161] [client 20.203.186.201:31581] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aeFeK8hTVuRPkua22vSj1wAAAAA"]
[Fri Apr 17 06:09:48.239962 2026] [:error] [pid 9151:tid 9184] [client 20.203.186.201:31559] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aeFeLMhTVuRPkua22vSj2QAAABc"]
[Fri Apr 17 06:09:49.122936 2026] [:error] [pid 9263:tid 9279] [client 20.203.186.201:60218] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aeFeLRP68VyHNvj1e54IfwAAAM4"]
[Fri Apr 17 06:09:50.030631 2026] [:error] [pid 9151:tid 9182] [client 20.203.186.201:64058] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aeFeLshTVuRPkua22vSj4gAAABU"]
[Fri Apr 17 06:09:51.034959 2026] [:error] [pid 9152:tid 9212] [client 20.203.186.201:53749] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFeL5JYca8I3TNCwIcYfAAAAFY"]
[Fri Apr 17 06:09:51.719411 2026] [:error] [pid 9263:tid 9284] [client 20.203.186.201:60168] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFeLxP68VyHNvj1e54IgwAAANM"]
[Fri Apr 17 06:09:52.450041 2026] [:error] [pid 9152:tid 9206] [client 20.203.186.201:60212] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFeMJJYca8I3TNCwIcYgwAAAFA"]
[Fri Apr 17 06:09:53.616702 2026] [:error] [pid 9152:tid 9202] [client 20.203.186.201:64043] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFeMZJYca8I3TNCwIcYhQAAAEw"]
[Fri Apr 17 06:09:54.309446 2026] [:error] [pid 9152:tid 9192] [client 20.203.186.201:64054] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFeMpJYca8I3TNCwIcYigAAAEI"]
[Fri Apr 17 06:09:54.809765 2026] [:error] [pid 9153:tid 9219] [client 20.203.186.201:58001] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFeMuMHGxkTZX3c45cLYwAAAIE"]
[Fri Apr 17 06:09:55.555610 2026] [:error] [pid 51878:tid 51880] [client 20.203.186.201:43893] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFeM0nQhUtMbw9EsgaAWQAAAQA"]
[Fri Apr 17 06:09:56.087690 2026] [:error] [pid 9152:tid 9209] [client 20.203.186.201:47342] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFeNJJYca8I3TNCwIcYkgAAAFM"]
[Fri Apr 17 06:09:56.681604 2026] [:error] [pid 9151:tid 9185] [client 20.203.186.201:57912] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFeNMhTVuRPkua22vSj6gAAABg"]
[Fri Apr 17 06:09:57.234014 2026] [:error] [pid 9152:tid 9202] [client 20.203.186.201:50415] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFeNZJYca8I3TNCwIcYmgAAAEw"]
[Fri Apr 17 06:09:57.909684 2026] [:error] [pid 51878:tid 51883] [client 20.203.186.201:43875] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFeNUnQhUtMbw9EsgaAWwAAAQM"]
[Fri Apr 17 06:09:58.528129 2026] [:error] [pid 51878:tid 51884] [client 20.203.186.201:61069] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFeNknQhUtMbw9EsgaAXgAAAQQ"]
[Fri Apr 17 06:09:59.315243 2026] [:error] [pid 51878:tid 51889] [client 20.203.186.201:64050] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFeN0nQhUtMbw9EsgaAYwAAAQk"]
[Fri Apr 17 06:09:59.865853 2026] [:error] [pid 51878:tid 51887] [client 20.203.186.201:58047] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFeN0nQhUtMbw9EsgaAZAAAAQc"]
[Fri Apr 17 06:10:00.390412 2026] [:error] [pid 51878:tid 51902] [client 20.203.186.201:31607] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFeOEnQhUtMbw9EsgaAaQAAARY"]
[Fri Apr 17 06:10:01.021284 2026] [:error] [pid 51878:tid 51897] [client 20.203.186.201:50399] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFeOUnQhUtMbw9EsgaAagAAARE"]
[Fri Apr 17 06:10:01.946293 2026] [:error] [pid 51878:tid 51904] [client 20.203.186.201:29924] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "aeFeOUnQhUtMbw9EsgaAbAAAARg"]
[Fri Apr 17 06:10:02.538365 2026] [:error] [pid 9263:tid 9278] [client 20.203.186.201:53252] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "aeFeOhP68VyHNvj1e54IiwAAAM0"]
[Fri Apr 17 06:10:03.084797 2026] [:error] [pid 51878:tid 51898] [client 20.203.186.201:47546] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "aeFeO0nQhUtMbw9EsgaAcAAAARI"]
[Fri Apr 17 06:10:03.642783 2026] [:error] [pid 9153:tid 9239] [client 20.203.186.201:61105] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "aeFeO-MHGxkTZX3c45cLhQAAAJU"]
[Fri Apr 17 06:10:04.328606 2026] [:error] [pid 51878:tid 51896] [client 20.203.186.201:53283] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aeFePEnQhUtMbw9EsgaAcwAAARA"]
[Fri Apr 17 06:10:04.869641 2026] [:error] [pid 9153:tid 9235] [client 20.203.186.201:29926] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aeFePOMHGxkTZX3c45cLiwAAAJE"]
[Fri Apr 17 06:10:05.392471 2026] [:error] [pid 51878:tid 51888] [client 20.203.186.201:64034] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aeFePUnQhUtMbw9EsgaAdQAAAQg"]
[Fri Apr 17 06:10:06.275598 2026] [:error] [pid 51878:tid 51899] [client 20.203.186.201:43882] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aeFePknQhUtMbw9EsgaAdgAAARM"]
[Fri Apr 17 06:10:06.754832 2026] [:error] [pid 9153:tid 9230] [client 20.203.186.201:29937] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeFePuMHGxkTZX3c45cLlQAAAIw"]
[Fri Apr 17 06:10:07.230292 2026] [:error] [pid 9153:tid 9224] [client 20.203.186.201:58013] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeFeP-MHGxkTZX3c45cLmwAAAIY"]
[Fri Apr 17 06:10:07.729036 2026] [:error] [pid 9153:tid 9235] [client 20.203.186.201:57911] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeFeP-MHGxkTZX3c45cLoAAAAJE"]
[Fri Apr 17 06:10:08.276580 2026] [:error] [pid 9152:tid 9209] [client 20.203.186.201:50387] [client 20.203.186.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeFeQJJYca8I3TNCwIcYqgAAAFM"]
[Fri Apr 17 06:21:58.965282 2026] [:error] [pid 9263:tid 9280] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Fri Apr 17 06:21:59.256858 2026] [:error] [pid 9263:tid 9267] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Fri Apr 17 06:21:59.547359 2026] [:error] [pid 9263:tid 9273] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/flox.php
[Fri Apr 17 06:21:59.882727 2026] [:error] [pid 9263:tid 9283] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/mff.php
[Fri Apr 17 06:22:00.219575 2026] [:error] [pid 9263:tid 9288] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/aq.php
[Fri Apr 17 06:22:00.510252 2026] [:error] [pid 9263:tid 9284] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/filemanger2.php
[Fri Apr 17 06:22:00.809119 2026] [:error] [pid 9263:tid 9268] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 17 06:22:01.130825 2026] [:error] [pid 9263:tid 9266] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-vn1.php
[Fri Apr 17 06:22:01.423697 2026] [:error] [pid 9263:tid 9287] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Fri Apr 17 06:22:01.715971 2026] [:error] [pid 9263:tid 9285] [client 20.240.41.65:23635] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Fri Apr 17 06:22:02.045014 2026] [:error] [pid 9263:tid 9274] [client 20.240.41.65:23635] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFhChP68VyHNvj1e54QPwAAAMk"]
[Fri Apr 17 06:22:03.360942 2026] [:error] [pid 9151:tid 9173] [client 20.240.41.65:23636] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFhC8hTVuRPkua22vSnrQAAAAw"]
[Fri Apr 17 06:22:04.496729 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:18207] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFhDEnQhUtMbw9EsgaL7AAAAQU"]
[Fri Apr 17 06:22:05.534181 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:18187] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeFhDUnQhUtMbw9EsgaL9AAAAQc"]
[Fri Apr 17 06:22:06.676329 2026] [:error] [pid 9153:tid 9218] [client 20.240.41.65:18211] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFhDuMHGxkTZX3c45cRKwAAAIA"]
[Fri Apr 17 06:22:07.737801 2026] [:error] [pid 51878:tid 51886] [client 20.240.41.65:18178] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFhD0nQhUtMbw9EsgaMAAAAAQY"]
[Fri Apr 17 06:22:08.942488 2026] [:error] [pid 51878:tid 51889] [client 20.240.41.65:23643] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFhEEnQhUtMbw9EsgaMCgAAAQk"]
[Fri Apr 17 06:22:09.818060 2026] [:error] [pid 51878:tid 51898] [client 20.240.41.65:18205] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeFhEUnQhUtMbw9EsgaMDAAAARI"]
[Fri Apr 17 06:22:10.449047 2026] [:error] [pid 51878:tid 51904] [client 20.240.41.65:18189] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFhEknQhUtMbw9EsgaMEQAAARg"]
[Fri Apr 17 06:22:11.096425 2026] [:error] [pid 51878:tid 51903] [client 20.240.41.65:18184] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFhE0nQhUtMbw9EsgaMFgAAARc"]
[Fri Apr 17 06:22:11.732513 2026] [:error] [pid 9263:tid 9273] [client 20.240.41.65:23657] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFhExP68VyHNvj1e54QWwAAAMg"]
[Fri Apr 17 06:22:12.624678 2026] [:error] [pid 9263:tid 9276] [client 20.240.41.65:18190] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeFhFBP68VyHNvj1e54QYAAAAMs"]
[Fri Apr 17 06:22:13.450359 2026] [:error] [pid 51878:tid 51890] [client 20.240.41.65:23627] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFhFUnQhUtMbw9EsgaMPgAAAQo"]
[Fri Apr 17 06:22:14.794809 2026] [:error] [pid 9153:tid 9226] [client 20.240.41.65:23644] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFhFuMHGxkTZX3c45cRRQAAAIg"]
[Fri Apr 17 06:22:15.507954 2026] [:error] [pid 9263:tid 9270] [client 20.240.41.65:18208] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFhFxP68VyHNvj1e54QaQAAAMU"]
[Fri Apr 17 06:22:16.449468 2026] [:error] [pid 51878:tid 51889] [client 20.240.41.65:18209] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeFhGEnQhUtMbw9EsgaMYwAAAQk"]
[Fri Apr 17 06:22:17.203499 2026] [:error] [pid 9153:tid 9236] [client 20.240.41.65:23649] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFhGeMHGxkTZX3c45cRTgAAAJI"]
[Fri Apr 17 06:22:17.923558 2026] [:error] [pid 9263:tid 9284] [client 20.240.41.65:23639] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFhGRP68VyHNvj1e54QegAAANM"]
[Fri Apr 17 06:22:18.853677 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:23642] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFhGuMHGxkTZX3c45cRWAAAAIk"]
[Fri Apr 17 06:22:19.609867 2026] [:error] [pid 9151:tid 9178] [client 20.240.41.65:23655] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeFhG8hTVuRPkua22vSntwAAABE"]
[Fri Apr 17 06:22:20.294374 2026] [:error] [pid 9152:tid 9207] [client 20.240.41.65:18210] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeFhHJJYca8I3TNCwIcc2wAAAFE"]
[Fri Apr 17 06:22:20.977029 2026] [:error] [pid 9153:tid 9241] [client 20.240.41.65:18212] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeFhHOMHGxkTZX3c45cRcQAAAJc"]
[Fri Apr 17 06:22:21.542891 2026] [:error] [pid 9263:tid 9278] [client 20.240.41.65:23624] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeFhHRP68VyHNvj1e54QmgAAAM0"]
[Fri Apr 17 06:22:22.631845 2026] [:error] [pid 9152:tid 9204] [client 20.240.41.65:18203] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeFhHpJYca8I3TNCwIcc5AAAAE4"]
[Fri Apr 17 06:22:23.183435 2026] [:error] [pid 9153:tid 9237] [client 20.240.41.65:36975] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFhH-MHGxkTZX3c45cRfgAAAJM"]
[Fri Apr 17 06:22:23.837593 2026] [:error] [pid 9152:tid 9197] [client 20.240.41.65:23679] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFhH5JYca8I3TNCwIcc6QAAAEc"]
[Fri Apr 17 06:22:24.822310 2026] [:error] [pid 51878:tid 51898] [client 20.240.41.65:18220] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFhIEnQhUtMbw9EsgaMdwAAARI"]
[Fri Apr 17 06:22:27.096623 2026] [:error] [pid 9263:tid 9275] [client 20.240.41.65:23663] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeFhIxP68VyHNvj1e54QwAAAAMo"]
[Fri Apr 17 06:22:27.896387 2026] [:error] [pid 9151:tid 9165] [client 20.240.41.65:23654] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "aeFhI8hTVuRPkua22vSn3QAAAAQ"]
[Fri Apr 17 06:22:29.327154 2026] [:error] [pid 9263:tid 9276] [client 20.240.41.65:23641] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "aeFhJRP68VyHNvj1e54Q1QAAAMs"]
[Fri Apr 17 06:22:30.833600 2026] [:error] [pid 9153:tid 9239] [client 20.240.41.65:23667] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "aeFhJuMHGxkTZX3c45cRnQAAAJU"]
[Fri Apr 17 06:22:31.944246 2026] [:error] [pid 9153:tid 9233] [client 20.240.41.65:23677] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/water.php"] [unique_id "aeFhJ-MHGxkTZX3c45cRpQAAAI8"]
[Fri Apr 17 06:22:32.836535 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:18234] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "aeFhKEnQhUtMbw9EsgaMqAAAAQc"]
[Fri Apr 17 06:22:33.834504 2026] [:error] [pid 9263:tid 9274] [client 20.240.41.65:23638] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "aeFhKRP68VyHNvj1e54Q9wAAAMk"]
[Fri Apr 17 06:22:35.173022 2026] [:error] [pid 9151:tid 9181] [client 20.240.41.65:23626] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "aeFhK8hTVuRPkua22vSn_wAAABQ"]
[Fri Apr 17 06:22:36.137017 2026] [:error] [pid 51878:tid 51899] [client 20.240.41.65:18202] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "aeFhLEnQhUtMbw9EsgaMyAAAARM"]
[Fri Apr 17 06:22:36.911432 2026] [:error] [pid 9151:tid 9175] [client 20.240.41.65:23625] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFhLMhTVuRPkua22vSoAAAAAA4"]
[Fri Apr 17 06:22:38.614362 2026] [:error] [pid 9152:tid 9199] [client 20.240.41.65:23640] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFhLpJYca8I3TNCwIcdCQAAAEk"]
[Fri Apr 17 06:22:40.442866 2026] [:error] [pid 9152:tid 9214] [client 20.240.41.65:23672] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFhMJJYca8I3TNCwIcdFgAAAFg"]
[Fri Apr 17 06:22:41.229102 2026] [:error] [pid 51878:tid 51902] [client 20.240.41.65:23628] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeFhMUnQhUtMbw9EsgaM5wAAARY"]
[Fri Apr 17 06:22:41.871973 2026] [:error] [pid 9263:tid 9267] [client 20.240.41.65:23675] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "aeFhMRP68VyHNvj1e54RKgAAAMI"]
[Fri Apr 17 06:22:42.626087 2026] [:error] [pid 9153:tid 9241] [client 20.240.41.65:18217] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "aeFhMuMHGxkTZX3c45cR7QAAAJc"]
[Fri Apr 17 06:22:43.842493 2026] [:error] [pid 9151:tid 9168] [client 20.240.41.65:18185] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "aeFhM8hTVuRPkua22vSoEAAAAAc"]
[Fri Apr 17 06:22:44.487298 2026] [:error] [pid 9152:tid 9203] [client 20.240.41.65:18183] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wert.php"] [unique_id "aeFhNJJYca8I3TNCwIcdJAAAAE0"]
[Fri Apr 17 06:22:45.217627 2026] [:error] [pid 9152:tid 9209] [client 20.240.41.65:18221] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFhNZJYca8I3TNCwIcdKAAAAFM"]
[Fri Apr 17 06:22:46.164363 2026] [:error] [pid 9153:tid 9229] [client 20.240.41.65:23617] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFhNuMHGxkTZX3c45cR9AAAAIs"]
[Fri Apr 17 06:22:46.851229 2026] [:error] [pid 9152:tid 9191] [client 20.240.41.65:23632] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFhNpJYca8I3TNCwIcdQwAAAEE"]
[Fri Apr 17 06:22:47.953359 2026] [:error] [pid 51878:tid 51892] [client 20.240.41.65:18204] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeFhN0nQhUtMbw9EsgaNDgAAAQw"]
[Fri Apr 17 06:22:48.969637 2026] [:error] [pid 9263:tid 9267] [client 20.240.41.65:23660] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFhOBP68VyHNvj1e54RPAAAAMI"]
[Fri Apr 17 06:22:49.933143 2026] [:error] [pid 9151:tid 9181] [client 20.240.41.65:23676] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFhOchTVuRPkua22vSoJwAAABQ"]
[Fri Apr 17 06:22:51.006402 2026] [:error] [pid 9153:tid 9242] [client 20.240.41.65:23651] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFhO-MHGxkTZX3c45cSCgAAAJg"]
[Fri Apr 17 06:22:51.755285 2026] [:error] [pid 51878:tid 51900] [client 20.240.41.65:18196] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeFhO0nQhUtMbw9EsgaNIgAAARQ"]
[Fri Apr 17 06:22:52.418818 2026] [:error] [pid 9151:tid 9166] [client 20.240.41.65:18176] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "aeFhPMhTVuRPkua22vSoNwAAAAU"]
[Fri Apr 17 06:22:53.004152 2026] [:error] [pid 9263:tid 9289] [client 20.240.41.65:18230] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "aeFhPRP68VyHNvj1e54RSQAAANg"]
[Fri Apr 17 06:22:53.888666 2026] [:error] [pid 51878:tid 51904] [client 20.240.41.65:36977] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "aeFhPUnQhUtMbw9EsgaNMAAAARg"]
[Fri Apr 17 06:22:54.575783 2026] [:error] [pid 51878:tid 51883] [client 20.240.41.65:36971] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/oij98gy.php"] [unique_id "aeFhPknQhUtMbw9EsgaNNgAAAQM"]
[Fri Apr 17 06:22:55.222622 2026] [:error] [pid 51878:tid 51882] [client 20.240.41.65:23633] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFhP0nQhUtMbw9EsgaNOwAAAQI"]
[Fri Apr 17 06:22:55.985592 2026] [:error] [pid 9152:tid 9195] [client 20.240.41.65:23674] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFhP5JYca8I3TNCwIcdZgAAAEU"]
[Fri Apr 17 06:22:56.701452 2026] [:error] [pid 9152:tid 9198] [client 20.240.41.65:18188] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFhQJJYca8I3TNCwIcdaAAAAEg"]
[Fri Apr 17 06:22:57.459266 2026] [:error] [pid 9153:tid 9236] [client 20.240.41.65:23650] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeFhQeMHGxkTZX3c45cSKQAAAJI"]
[Fri Apr 17 06:22:58.333797 2026] [:error] [pid 51878:tid 51883] [client 20.240.41.65:18191] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "aeFhQknQhUtMbw9EsgaNTAAAAQM"]
[Fri Apr 17 06:22:59.119684 2026] [:error] [pid 51878:tid 51892] [client 20.240.41.65:36945] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "aeFhQ0nQhUtMbw9EsgaNUAAAAQw"]
[Fri Apr 17 06:22:59.855636 2026] [:error] [pid 9152:tid 9208] [client 20.240.41.65:23678] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "aeFhQ5JYca8I3TNCwIcdcwAAAFI"]
[Fri Apr 17 06:23:00.562510 2026] [:error] [pid 9152:tid 9214] [client 20.240.41.65:23666] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/turkshell.php"] [unique_id "aeFhRJJYca8I3TNCwIcdegAAAFg"]
[Fri Apr 17 06:23:01.413613 2026] [:error] [pid 9152:tid 9198] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Fri Apr 17 06:23:01.681333 2026] [:error] [pid 9152:tid 9213] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Fri Apr 17 06:23:01.968090 2026] [:error] [pid 9152:tid 9196] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Fri Apr 17 06:23:02.234593 2026] [:error] [pid 9152:tid 9192] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 17 06:23:02.503294 2026] [:error] [pid 9152:tid 9191] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Apr 17 06:23:02.770603 2026] [:error] [pid 9152:tid 9194] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Apr 17 06:23:03.036836 2026] [:error] [pid 9152:tid 9190] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Fri Apr 17 06:23:03.304458 2026] [:error] [pid 9152:tid 9200] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Fri Apr 17 06:23:03.575911 2026] [:error] [pid 9152:tid 9210] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Fri Apr 17 06:23:03.909771 2026] [:error] [pid 9152:tid 9202] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Fri Apr 17 06:23:04.192996 2026] [:error] [pid 9152:tid 9207] [client 20.240.41.65:36957] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Fri Apr 17 06:23:04.456049 2026] [:error] [pid 9152:tid 9195] [client 20.240.41.65:36957] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeFhSJJYca8I3TNCwIcdlQAAAEU"]
[Fri Apr 17 06:23:05.663824 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:23637] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeFhSUnQhUtMbw9EsgaNigAAARA"]
[Fri Apr 17 06:23:06.377094 2026] [:error] [pid 51878:tid 51888] [client 20.240.41.65:18216] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeFhSknQhUtMbw9EsgaNngAAAQg"]
[Fri Apr 17 06:23:07.308527 2026] [:error] [pid 51878:tid 51900] [client 20.240.41.65:23618] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeFhS0nQhUtMbw9EsgaNsAAAARQ"]
[Fri Apr 17 06:23:08.066817 2026] [:error] [pid 51878:tid 51899] [client 20.240.41.65:18186] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "aeFhTEnQhUtMbw9EsgaNvgAAARM"]
[Fri Apr 17 06:23:08.860054 2026] [:error] [pid 9151:tid 9172] [client 20.240.41.65:7134] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "aeFhTMhTVuRPkua22vSoagAAAAs"]
[Fri Apr 17 06:23:09.886558 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:23646] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "aeFhTeMHGxkTZX3c45cSVAAAAIk"]
[Fri Apr 17 06:23:10.777252 2026] [:error] [pid 9153:tid 9237] [client 20.240.41.65:23659] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.mopj.php"] [unique_id "aeFhTuMHGxkTZX3c45cSXgAAAJM"]
[Fri Apr 17 06:23:11.426897 2026] [:error] [pid 51878:tid 51904] [client 20.240.41.65:23620] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeFhT0nQhUtMbw9EsgaNzwAAARg"]
[Fri Apr 17 06:23:12.052393 2026] [:error] [pid 51878:tid 51880] [client 20.240.41.65:36961] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeFhUEnQhUtMbw9EsgaN3QAAAQA"]
[Fri Apr 17 06:23:12.958401 2026] [:error] [pid 9263:tid 9285] [client 20.240.41.65:18194] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeFhUBP68VyHNvj1e54RsQAAANQ"]
[Fri Apr 17 06:23:13.801597 2026] [:error] [pid 51878:tid 51897] [client 20.240.41.65:18197] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeFhUUnQhUtMbw9EsgaN6AAAARE"]
[Fri Apr 17 06:23:14.479439 2026] [:error] [pid 9153:tid 9238] [client 20.240.41.65:36967] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "aeFhUuMHGxkTZX3c45cSZwAAAJQ"]
[Fri Apr 17 06:23:15.123675 2026] [:error] [pid 9153:tid 9219] [client 20.240.41.65:18198] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "aeFhU-MHGxkTZX3c45cSaAAAAIE"]
[Fri Apr 17 06:23:15.662858 2026] [:error] [pid 9263:tid 9277] [client 20.240.41.65:7117] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "aeFhUxP68VyHNvj1e54RwAAAAMw"]
[Fri Apr 17 06:23:16.367758 2026] [:error] [pid 9153:tid 9240] [client 20.240.41.65:36951] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nano.php"] [unique_id "aeFhVOMHGxkTZX3c45cSawAAAJY"]
[Fri Apr 17 06:23:17.191643 2026] [:error] [pid 9152:tid 9197] [client 20.240.41.65:18182] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeFhVZJYca8I3TNCwIcdsgAAAEc"]
[Fri Apr 17 06:23:17.872882 2026] [:error] [pid 9263:tid 9271] [client 20.240.41.65:36930] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeFhVRP68VyHNvj1e54RwwAAAMY"]
[Fri Apr 17 06:23:18.588824 2026] [:error] [pid 51878:tid 51893] [client 20.240.41.65:7104] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeFhVknQhUtMbw9EsgaOBwAAAQ0"]
[Fri Apr 17 06:23:19.212881 2026] [:error] [pid 9152:tid 9191] [client 20.240.41.65:18214] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeFhV5JYca8I3TNCwIcdtAAAAEE"]
[Fri Apr 17 06:23:19.785835 2026] [:error] [pid 9263:tid 9272] [client 20.240.41.65:18193] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeFhVxP68VyHNvj1e54RzQAAAMc"]
[Fri Apr 17 06:23:21.006024 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:36978] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeFhWUnQhUtMbw9EsgaOGwAAAQc"]
[Fri Apr 17 06:23:21.611668 2026] [:error] [pid 51878:tid 51903] [client 20.240.41.65:23616] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeFhWUnQhUtMbw9EsgaOJQAAARc"]
[Fri Apr 17 06:23:22.327060 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:18192] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeFhWknQhUtMbw9EsgaOKgAAAQ8"]
[Fri Apr 17 06:23:23.019272 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:23665] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeFhW0nQhUtMbw9EsgaONgAAARA"]
[Fri Apr 17 06:23:23.565372 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:18201] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeFhW-MHGxkTZX3c45cSiwAAAIk"]
[Fri Apr 17 06:23:24.113172 2026] [:error] [pid 9152:tid 9211] [client 20.240.41.65:18181] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeFhXJJYca8I3TNCwIcdzQAAAFU"]
[Fri Apr 17 06:23:24.668154 2026] [:error] [pid 51878:tid 51891] [client 20.240.41.65:36934] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeFhXEnQhUtMbw9EsgaOPwAAAQs"]
[Fri Apr 17 06:23:25.425934 2026] [:error] [pid 9152:tid 9202] [client 20.240.41.65:36942] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeFhXZJYca8I3TNCwIcd0wAAAEw"]
[Fri Apr 17 06:23:25.956192 2026] [:error] [pid 9263:tid 9271] [client 20.240.41.65:23664] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeFhXRP68VyHNvj1e54SBQAAAMY"]
[Fri Apr 17 06:23:26.583413 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:23673] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeFhXknQhUtMbw9EsgaOZwAAAQc"]
[Fri Apr 17 06:23:27.111189 2026] [:error] [pid 9263:tid 9268] [client 20.240.41.65:18200] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeFhXxP68VyHNvj1e54SDQAAAMM"]
[Fri Apr 17 06:23:27.745402 2026] [:error] [pid 9263:tid 9279] [client 20.240.41.65:36959] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFhXxP68VyHNvj1e54SFAAAAM4"]
[Fri Apr 17 06:23:28.342963 2026] [:error] [pid 9263:tid 9267] [client 20.240.41.65:23634] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFhYBP68VyHNvj1e54SGwAAAMI"]
[Fri Apr 17 06:23:29.077806 2026] [:error] [pid 9151:tid 9174] [client 20.240.41.65:23623] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFhYchTVuRPkua22vSohAAAAA0"]
[Fri Apr 17 06:23:29.781813 2026] [:error] [pid 9153:tid 9232] [client 20.240.41.65:18229] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeFhYeMHGxkTZX3c45cSogAAAI4"]
[Fri Apr 17 06:23:30.361450 2026] [:error] [pid 9263:tid 9277] [client 20.240.41.65:36955] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFhYhP68VyHNvj1e54SLgAAAMw"]
[Fri Apr 17 06:23:30.913892 2026] [:error] [pid 9152:tid 9193] [client 20.240.41.65:18213] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFhYpJYca8I3TNCwIcd4QAAAEM"]
[Fri Apr 17 06:23:31.651461 2026] [:error] [pid 9263:tid 9273] [client 20.240.41.65:23630] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFhYxP68VyHNvj1e54SOAAAAMg"]
[Fri Apr 17 06:23:32.382443 2026] [:error] [pid 51878:tid 51900] [client 20.240.41.65:36949] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeFhZEnQhUtMbw9EsgaOpwAAARQ"]
[Fri Apr 17 06:23:33.819292 2026] [:error] [pid 9263:tid 9272] [client 20.240.41.65:7105] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFhZRP68VyHNvj1e54SWgAAAMc"]
[Fri Apr 17 06:23:34.489823 2026] [:error] [pid 9152:tid 9210] [client 20.240.41.65:23621] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFhZpJYca8I3TNCwIcd7gAAAFQ"]
[Fri Apr 17 06:23:35.380572 2026] [:error] [pid 9263:tid 9278] [client 20.240.41.65:23670] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFhZxP68VyHNvj1e54SagAAAM0"]
[Fri Apr 17 06:23:35.923676 2026] [:error] [pid 9263:tid 9269] [client 20.240.41.65:36937] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeFhZxP68VyHNvj1e54ScQAAAMQ"]
[Fri Apr 17 06:23:36.682518 2026] [:error] [pid 51878:tid 51889] [client 20.240.41.65:23656] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFhaEnQhUtMbw9EsgaOywAAAQk"]
[Fri Apr 17 06:23:37.293051 2026] [:error] [pid 9152:tid 9193] [client 20.240.41.65:18225] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFhaZJYca8I3TNCwIceCAAAAEM"]
[Fri Apr 17 06:23:37.954528 2026] [:error] [pid 51878:tid 51902] [client 20.240.41.65:36936] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFhaUnQhUtMbw9EsgaO1QAAARY"]
[Fri Apr 17 06:23:38.515467 2026] [:error] [pid 9263:tid 9276] [client 20.240.41.65:18231] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeFhahP68VyHNvj1e54SjwAAAMs"]
[Fri Apr 17 06:23:39.404457 2026] [:error] [pid 9152:tid 9192] [client 20.240.41.65:36990] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFha5JYca8I3TNCwIceFgAAAEI"]
[Fri Apr 17 06:23:40.405294 2026] [:error] [pid 9151:tid 9162] [client 20.240.41.65:18223] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFhbMhTVuRPkua22vSo5wAAAAE"]
[Fri Apr 17 06:23:41.061195 2026] [:error] [pid 9263:tid 9271] [client 20.240.41.65:7132] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFhbRP68VyHNvj1e54SoAAAAMY"]
[Fri Apr 17 06:23:42.321684 2026] [:error] [pid 51878:tid 51886] [client 20.240.41.65:36983] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeFhbknQhUtMbw9EsgaO-wAAAQY"]
[Fri Apr 17 06:23:43.433946 2026] [:error] [pid 9263:tid 9269] [client 20.240.41.65:36964] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFhbxP68VyHNvj1e54SsQAAAMQ"]
[Fri Apr 17 06:23:44.011846 2026] [:error] [pid 9153:tid 9238] [client 20.240.41.65:36931] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFhcOMHGxkTZX3c45cS3AAAAJQ"]
[Fri Apr 17 06:23:44.635573 2026] [:error] [pid 9152:tid 9190] [client 20.240.41.65:18222] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFhcJJYca8I3TNCwIcePQAAAEA"]
[Fri Apr 17 06:23:45.241915 2026] [:error] [pid 9263:tid 9280] [client 20.240.41.65:18239] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aeFhcRP68VyHNvj1e54SvQAAAM8"]
[Fri Apr 17 06:23:45.796198 2026] [:error] [pid 51878:tid 51890] [client 20.240.41.65:18199] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFhcUnQhUtMbw9EsgaPEQAAAQo"]
[Fri Apr 17 06:23:46.392376 2026] [:error] [pid 9153:tid 9224] [client 20.240.41.65:23622] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFhcuMHGxkTZX3c45cS6QAAAIY"]
[Fri Apr 17 06:23:47.041783 2026] [:error] [pid 9152:tid 9192] [client 20.240.41.65:23671] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFhc5JYca8I3TNCwIceVwAAAEI"]
[Fri Apr 17 06:23:47.645484 2026] [:error] [pid 9263:tid 9281] [client 20.240.41.65:36943] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aeFhcxP68VyHNvj1e54SyQAAANA"]
[Fri Apr 17 06:23:48.288967 2026] [:error] [pid 9152:tid 9204] [client 20.240.41.65:36938] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "aeFhdJJYca8I3TNCwIceWwAAAE4"]
[Fri Apr 17 06:23:48.980520 2026] [:error] [pid 9152:tid 9196] [client 20.240.41.65:23648] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "aeFhdJJYca8I3TNCwIceXQAAAEY"]
[Fri Apr 17 06:23:49.600924 2026] [:error] [pid 9263:tid 9266] [client 20.240.41.65:36987] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "aeFhdRP68VyHNvj1e54S3QAAAME"]
[Fri Apr 17 06:23:50.250909 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:36963] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zample.php"] [unique_id "aeFhdknQhUtMbw9EsgaPKAAAAQ8"]
[Fri Apr 17 06:23:50.793573 2026] [:error] [pid 51878:tid 51881] [client 20.240.41.65:36946] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFhdknQhUtMbw9EsgaPNQAAAQE"]
[Fri Apr 17 06:23:51.448378 2026] [:error] [pid 9153:tid 9228] [client 20.240.41.65:36972] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFhd-MHGxkTZX3c45cTEAAAAIo"]
[Fri Apr 17 06:23:52.017223 2026] [:error] [pid 9151:tid 9172] [client 20.240.41.65:23653] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFheMhTVuRPkua22vSpHAAAAAs"]
[Fri Apr 17 06:23:52.578598 2026] [:error] [pid 9152:tid 9210] [client 20.240.41.65:23647] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeFheJJYca8I3TNCwIceZgAAAFQ"]
[Fri Apr 17 06:23:53.188251 2026] [:error] [pid 51878:tid 51880] [client 20.240.41.65:36976] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFheUnQhUtMbw9EsgaPVQAAAQA"]
[Fri Apr 17 06:23:53.916074 2026] [:error] [pid 51878:tid 51902] [client 20.240.41.65:36950] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFheUnQhUtMbw9EsgaPXQAAARY"]
[Fri Apr 17 06:23:54.645881 2026] [:error] [pid 9153:tid 9219] [client 20.240.41.65:36939] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFheuMHGxkTZX3c45cTHQAAAIE"]
[Fri Apr 17 06:23:55.254273 2026] [:error] [pid 9153:tid 9226] [client 20.240.41.65:23652] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aeFhe-MHGxkTZX3c45cTIgAAAIg"]
[Fri Apr 17 06:23:55.910539 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:7149] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFhe0nQhUtMbw9EsgaPegAAAQU"]
[Fri Apr 17 06:23:56.594759 2026] [:error] [pid 51878:tid 51886] [client 20.240.41.65:23658] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFhfEnQhUtMbw9EsgaPfwAAAQY"]
[Fri Apr 17 06:23:57.199867 2026] [:error] [pid 9263:tid 9270] [client 20.240.41.65:23623] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFhfRP68VyHNvj1e54TDwAAAMU"]
[Fri Apr 17 06:23:58.042356 2026] [:error] [pid 9263:tid 9269] [client 20.240.41.65:18237] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aeFhfhP68VyHNvj1e54TFQAAAMQ"]
[Fri Apr 17 06:23:59.987515 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:36984] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aeFhf0nQhUtMbw9EsgaPtAAAAQ8"]
[Fri Apr 17 06:24:01.166426 2026] [:error] [pid 51878:tid 51893] [client 20.240.41.65:36933] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aeFhgUnQhUtMbw9EsgaP5gAAAQ0"]
[Fri Apr 17 06:24:03.130365 2026] [:error] [pid 9151:tid 9183] [client 20.240.41.65:18215] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aeFhg8hTVuRPkua22vSpSQAAABY"]
[Fri Apr 17 06:24:05.362281 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Fri Apr 17 06:24:05.626847 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Fri Apr 17 06:24:05.892509 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Fri Apr 17 06:24:06.159743 2026] [:error] [pid 51878:tid 51890] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Fri Apr 17 06:24:06.424879 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Fri Apr 17 06:24:07.341264 2026] [:error] [pid 51878:tid 51889] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Fri Apr 17 06:24:08.284112 2026] [:error] [pid 51878:tid 51884] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Fri Apr 17 06:24:09.024589 2026] [:error] [pid 51878:tid 51902] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Fri Apr 17 06:24:09.291992 2026] [:error] [pid 51878:tid 51882] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Apr 17 06:24:09.561107 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:18219] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Apr 17 06:24:10.088699 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:18219] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeFhiknQhUtMbw9EsgaQXAAAARA"]
[Fri Apr 17 06:24:10.995539 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:7156] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeFhiknQhUtMbw9EsgaQZwAAARA"]
[Fri Apr 17 06:24:12.822394 2026] [:error] [pid 9263:tid 9265] [client 20.240.41.65:18224] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeFhjBP68VyHNvj1e54TawAAAMA"]
[Fri Apr 17 06:24:13.412828 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:36954] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeFhjUnQhUtMbw9EsgaQjgAAARA"]
[Fri Apr 17 06:24:14.103392 2026] [:error] [pid 9263:tid 9279] [client 20.240.41.65:18238] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeFhjhP68VyHNvj1e54TcgAAAM4"]
[Fri Apr 17 06:24:14.813009 2026] [:error] [pid 51878:tid 51888] [client 20.240.41.65:7130] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeFhjknQhUtMbw9EsgaQngAAAQg"]
[Fri Apr 17 06:24:15.712264 2026] [:error] [pid 9152:tid 9209] [client 20.240.41.65:36928] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeFhj5JYca8I3TNCwIce0gAAAFM"]
[Fri Apr 17 06:24:17.007467 2026] [:error] [pid 9153:tid 9224] [client 20.240.41.65:36952] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeFhkeMHGxkTZX3c45cTvwAAAIY"]
[Fri Apr 17 06:24:17.737138 2026] [:error] [pid 51878:tid 51889] [client 20.240.41.65:18226] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeFhkUnQhUtMbw9EsgaQrAAAAQk"]
[Fri Apr 17 06:24:18.280538 2026] [:error] [pid 9151:tid 9184] [client 20.240.41.65:7050] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeFhkshTVuRPkua22vSpwwAAABc"]
[Fri Apr 17 06:24:18.824213 2026] [:error] [pid 9151:tid 9178] [client 20.240.41.65:7107] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeFhkshTVuRPkua22vSpxQAAABE"]
[Fri Apr 17 06:24:19.477250 2026] [:error] [pid 9153:tid 9238] [client 20.240.41.65:7062] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeFhk-MHGxkTZX3c45cT0gAAAJQ"]
[Fri Apr 17 06:24:20.035010 2026] [:error] [pid 9263:tid 9282] [client 20.240.41.65:7116] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeFhlBP68VyHNvj1e54TkwAAANE"]
[Fri Apr 17 06:24:20.564357 2026] [:error] [pid 51878:tid 51890] [client 20.240.41.65:18195] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeFhlEnQhUtMbw9EsgaQtwAAAQo"]
[Fri Apr 17 06:24:21.136749 2026] [:error] [pid 51878:tid 51891] [client 20.240.41.65:7111] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeFhlUnQhUtMbw9EsgaQvAAAAQs"]
[Fri Apr 17 06:24:21.722124 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:7145] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeFhleMHGxkTZX3c45cT2gAAAIk"]
[Fri Apr 17 06:24:22.264752 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:7143] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeFhlknQhUtMbw9EsgaQygAAAQ8"]
[Fri Apr 17 06:24:22.974107 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:7131] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeFhlknQhUtMbw9EsgaQ1QAAAQU"]
[Fri Apr 17 06:24:23.963071 2026] [:error] [pid 9152:tid 9207] [client 20.240.41.65:7124] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeFhl5JYca8I3TNCwIce6gAAAFE"]
[Fri Apr 17 06:24:24.560482 2026] [:error] [pid 51878:tid 51880] [client 20.240.41.65:36965] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeFhmEnQhUtMbw9EsgaQ7wAAAQA"]
[Fri Apr 17 06:24:25.713471 2026] [:error] [pid 51878:tid 51904] [client 20.240.41.65:7142] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeFhmUnQhUtMbw9EsgaRAwAAARg"]
[Fri Apr 17 06:24:26.409423 2026] [:error] [pid 9153:tid 9233] [client 20.240.41.65:18227] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeFhmuMHGxkTZX3c45cT3wAAAI8"]
[Fri Apr 17 06:24:27.218358 2026] [:error] [pid 9263:tid 9277] [client 20.240.41.65:23645] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeFhmxP68VyHNvj1e54T0gAAAMw"]
[Fri Apr 17 06:24:27.741517 2026] [:error] [pid 9153:tid 9235] [client 20.240.41.65:18235] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeFhm-MHGxkTZX3c45cT5QAAAJE"]
[Fri Apr 17 06:24:28.440072 2026] [:error] [pid 9263:tid 9278] [client 20.240.41.65:18203] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeFhnBP68VyHNvj1e54T5gAAAM0"]
[Fri Apr 17 06:24:29.162753 2026] [:error] [pid 9151:tid 9180] [client 20.240.41.65:7162] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeFhnchTVuRPkua22vSp4QAAABM"]
[Fri Apr 17 06:24:29.716161 2026] [:error] [pid 9263:tid 9269] [client 20.240.41.65:36960] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeFhnRP68VyHNvj1e54T-AAAAMQ"]
[Fri Apr 17 06:24:30.442331 2026] [:error] [pid 51878:tid 51897] [client 20.240.41.65:36947] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeFhnknQhUtMbw9EsgaRVQAAARE"]
[Fri Apr 17 06:24:31.369534 2026] [:error] [pid 9263:tid 9267] [client 20.240.41.65:7148] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFhnxP68VyHNvj1e54UBQAAAMI"]
[Fri Apr 17 06:24:31.961499 2026] [:error] [pid 9151:tid 9185] [client 20.240.41.65:36935] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFhn8hTVuRPkua22vSp7wAAABg"]
[Fri Apr 17 06:24:33.474958 2026] [:error] [pid 51878:tid 51890] [client 20.240.41.65:18180] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFhoUnQhUtMbw9EsgaRcQAAAQo"]
[Fri Apr 17 06:24:34.694343 2026] [:error] [pid 51878:tid 51880] [client 20.240.41.65:7044] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFhoknQhUtMbw9EsgaRfAAAAQA"]
[Fri Apr 17 06:24:35.458748 2026] [:error] [pid 9153:tid 9223] [client 20.240.41.65:18206] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFho-MHGxkTZX3c45cUEwAAAIU"]
[Fri Apr 17 06:24:36.310712 2026] [:error] [pid 9152:tid 9199] [client 20.240.41.65:36968] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFhpJJYca8I3TNCwIcfFAAAAEk"]
[Fri Apr 17 06:24:36.847022 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:7112] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFhpEnQhUtMbw9EsgaRkwAAAQU"]
[Fri Apr 17 06:24:37.421924 2026] [:error] [pid 51878:tid 51894] [client 20.240.41.65:36953] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeFhpUnQhUtMbw9EsgaRnAAAAQ4"]
[Fri Apr 17 06:24:37.999745 2026] [:error] [pid 51878:tid 51901] [client 20.240.41.65:7128] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aeFhpUnQhUtMbw9EsgaRqgAAARU"]
[Fri Apr 17 06:24:38.524437 2026] [:error] [pid 9152:tid 9210] [client 20.240.41.65:36969] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aeFhppJYca8I3TNCwIcfJwAAAFQ"]
[Fri Apr 17 06:24:39.056934 2026] [:error] [pid 51878:tid 51892] [client 20.240.41.65:7106] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aeFhp0nQhUtMbw9EsgaRugAAAQw"]
[Fri Apr 17 06:24:39.788658 2026] [:error] [pid 9263:tid 9276] [client 20.240.41.65:36974] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless4.php"] [unique_id "aeFhpxP68VyHNvj1e54UNgAAAMs"]
[Fri Apr 17 06:24:40.628793 2026] [:error] [pid 9152:tid 9192] [client 20.240.41.65:23669] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aeFhqJJYca8I3TNCwIcfLgAAAEI"]
[Fri Apr 17 06:24:41.686923 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:7129] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aeFhqUnQhUtMbw9EsgaR4wAAAQ8"]
[Fri Apr 17 06:24:42.694316 2026] [:error] [pid 51878:tid 51882] [client 20.240.41.65:36979] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aeFhqknQhUtMbw9EsgaR8gAAAQI"]
[Fri Apr 17 06:24:43.806504 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:7119] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "aeFhq0nQhUtMbw9EsgaSAQAAAQ8"]
[Fri Apr 17 06:24:45.955433 2026] [:error] [pid 9153:tid 9225] [client 20.240.41.65:7061] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFhreMHGxkTZX3c45cUTQAAAIc"]
[Fri Apr 17 06:24:47.319417 2026] [:error] [pid 9263:tid 9280] [client 20.240.41.65:7051] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFhrxP68VyHNvj1e54UVAAAAM8"]
[Fri Apr 17 06:24:48.017306 2026] [:error] [pid 9151:tid 9171] [client 20.240.41.65:7120] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFhsMhTVuRPkua22vSqHQAAAAo"]
[Fri Apr 17 06:24:48.651635 2026] [:error] [pid 9263:tid 9287] [client 20.240.41.65:18228] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xqq.php"] [unique_id "aeFhsBP68VyHNvj1e54UWgAAANY"]
[Fri Apr 17 06:24:49.314009 2026] [:error] [pid 51878:tid 51886] [client 20.240.41.65:7126] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFhsUnQhUtMbw9EsgaSQwAAAQY"]
[Fri Apr 17 06:24:50.263941 2026] [:error] [pid 9263:tid 9279] [client 20.240.41.65:7083] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFhshP68VyHNvj1e54UZwAAAM4"]
[Fri Apr 17 06:24:51.012851 2026] [:error] [pid 9263:tid 9270] [client 20.240.41.65:7076] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFhsxP68VyHNvj1e54UbwAAAMU"]
[Fri Apr 17 06:24:51.689493 2026] [:error] [pid 9153:tid 9223] [client 20.240.41.65:7153] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plss3.php"] [unique_id "aeFhs-MHGxkTZX3c45cUbQAAAIU"]
[Fri Apr 17 06:24:52.615267 2026] [:error] [pid 9153:tid 9231] [client 20.240.41.65:6981] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFhtOMHGxkTZX3c45cUfQAAAI0"]
[Fri Apr 17 06:24:53.250127 2026] [:error] [pid 51878:tid 51895] [client 20.240.41.65:7056] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFhtUnQhUtMbw9EsgaSYQAAAQ8"]
[Fri Apr 17 06:24:54.134992 2026] [:error] [pid 9152:tid 9191] [client 20.240.41.65:7068] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFhtpJYca8I3TNCwIcfTQAAAEE"]
[Fri Apr 17 06:24:55.292986 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:7040] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "aeFht0nQhUtMbw9EsgaSbQAAARA"]
[Fri Apr 17 06:24:56.274398 2026] [:error] [pid 51878:tid 51899] [client 20.240.41.65:36966] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFhuEnQhUtMbw9EsgaSeQAAARM"]
[Fri Apr 17 06:24:57.251387 2026] [:error] [pid 9152:tid 9193] [client 20.240.41.65:7097] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFhuZJYca8I3TNCwIcfXgAAAEM"]
[Fri Apr 17 06:24:57.819310 2026] [:error] [pid 9153:tid 9239] [client 20.240.41.65:36982] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFhueMHGxkTZX3c45cUkwAAAJU"]
[Fri Apr 17 06:24:58.450560 2026] [:error] [pid 51878:tid 51881] [client 20.240.41.65:23656] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeFhuknQhUtMbw9EsgaSkAAAAQE"]
[Fri Apr 17 06:24:59.137612 2026] [:error] [pid 9151:tid 9176] [client 20.240.41.65:7155] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFhu8hTVuRPkua22vSqNAAAAA8"]
[Fri Apr 17 06:24:59.835845 2026] [:error] [pid 51878:tid 51891] [client 20.240.41.65:7118] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFhu0nQhUtMbw9EsgaSnAAAAQs"]
[Fri Apr 17 06:25:00.507653 2026] [:error] [pid 9152:tid 9200] [client 20.240.41.65:23631] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFhvJJYca8I3TNCwIcfZgAAAEo"]
[Fri Apr 17 06:25:01.352198 2026] [:error] [pid 9152:tid 9194] [client 20.240.41.65:18233] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aeFhvZJYca8I3TNCwIcfaQAAAEQ"]
[Fri Apr 17 06:25:02.040389 2026] [:error] [pid 9263:tid 9276] [client 20.240.41.65:36986] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFhvhP68VyHNvj1e54UsgAAAMs"]
[Fri Apr 17 06:25:02.685747 2026] [:error] [pid 51878:tid 51897] [client 20.240.41.65:36958] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFhvknQhUtMbw9EsgaSwgAAARE"]
[Fri Apr 17 06:25:03.285166 2026] [:error] [pid 9153:tid 9228] [client 20.240.41.65:7135] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFhv-MHGxkTZX3c45cUpgAAAIo"]
[Fri Apr 17 06:25:03.934229 2026] [:error] [pid 9153:tid 9236] [client 20.240.41.65:7053] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeFhv-MHGxkTZX3c45cUrQAAAJI"]
[Fri Apr 17 06:25:05.068144 2026] [:error] [pid 9263:tid 9269] [client 20.240.41.65:7127] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aeFhwRP68VyHNvj1e54U1wAAAMQ"]
[Fri Apr 17 06:25:06.013471 2026] [:error] [pid 9263:tid 9285] [client 20.240.41.65:7098] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aeFhwhP68VyHNvj1e54U6QAAANQ"]
[Fri Apr 17 06:25:07.750868 2026] [:error] [pid 9263:tid 9274] [client 20.240.41.65:7099] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-update.php"] [unique_id "aeFhwxP68VyHNvj1e54VBgAAAMk"]
[Fri Apr 17 06:25:09.291056 2026] [:error] [pid 9153:tid 9233] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Fri Apr 17 06:25:09.574117 2026] [:error] [pid 9153:tid 9239] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Fri Apr 17 06:25:09.865086 2026] [:error] [pid 9153:tid 9238] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Apr 17 06:25:10.700395 2026] [:error] [pid 9153:tid 9223] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Apr 17 06:25:10.972387 2026] [:error] [pid 9153:tid 9240] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Apr 17 06:25:11.240036 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Fri Apr 17 06:25:11.531646 2026] [:error] [pid 9153:tid 9242] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Apr 17 06:25:11.796994 2026] [:error] [pid 9153:tid 9232] [client 20.240.41.65:36941] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Apr 17 06:25:12.391571 2026] [:error] [pid 9153:tid 9229] [client 20.240.41.65:36941] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeFhyOMHGxkTZX3c45cUzAAAAIs"]
[Fri Apr 17 06:25:14.007599 2026] [:error] [pid 9153:tid 9230] [client 20.240.41.65:23661] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeFhyuMHGxkTZX3c45cU3wAAAIw"]
[Fri Apr 17 06:25:15.151710 2026] [:error] [pid 9153:tid 9236] [client 20.240.41.65:36980] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeFhy-MHGxkTZX3c45cU6gAAAJI"]
[Fri Apr 17 06:25:15.899382 2026] [:error] [pid 9152:tid 9197] [client 20.240.41.65:18236] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeFhy5JYca8I3TNCwIcfogAAAEc"]
[Fri Apr 17 06:25:16.487878 2026] [:error] [pid 9263:tid 9277] [client 20.240.41.65:7152] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFhzBP68VyHNvj1e54VVQAAAMw"]
[Fri Apr 17 06:25:17.035253 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:36932] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFhzUnQhUtMbw9EsgaS8gAAAQU"]
[Fri Apr 17 06:25:17.619497 2026] [:error] [pid 9152:tid 9196] [client 20.240.41.65:36973] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFhzZJYca8I3TNCwIcfpwAAAEY"]
[Fri Apr 17 06:25:18.215015 2026] [:error] [pid 9152:tid 9199] [client 20.240.41.65:7102] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFhzpJYca8I3TNCwIcfqwAAAEk"]
[Fri Apr 17 06:25:18.804115 2026] [:error] [pid 9263:tid 9289] [client 20.240.41.65:7115] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeFhzhP68VyHNvj1e54VXQAAANg"]
[Fri Apr 17 06:25:19.415045 2026] [:error] [pid 9152:tid 9213] [client 20.240.41.65:36981] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeFhz5JYca8I3TNCwIcfrgAAAFc"]
[Fri Apr 17 06:25:20.078976 2026] [:error] [pid 51878:tid 51892] [client 20.240.41.65:7121] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeFh0EnQhUtMbw9EsgaTCAAAAQw"]
[Fri Apr 17 06:25:20.639710 2026] [:error] [pid 9263:tid 9278] [client 20.240.41.65:23668] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeFh0BP68VyHNvj1e54VZQAAAM0"]
[Fri Apr 17 06:25:22.712580 2026] [:error] [pid 9153:tid 9233] [client 20.240.41.65:36933] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeFh0uMHGxkTZX3c45cVBAAAAI8"]
[Fri Apr 17 06:25:23.311279 2026] [:error] [pid 9152:tid 9212] [client 20.240.41.65:7147] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeFh05JYca8I3TNCwIcfsQAAAFY"]
[Fri Apr 17 06:25:23.835509 2026] [:error] [pid 9152:tid 9197] [client 20.240.41.65:7108] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeFh05JYca8I3TNCwIcftQAAAEc"]
[Fri Apr 17 06:25:24.572003 2026] [:error] [pid 9153:tid 9239] [client 20.240.41.65:7049] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeFh1OMHGxkTZX3c45cVCgAAAJU"]
[Fri Apr 17 06:25:25.138104 2026] [:error] [pid 9152:tid 9196] [client 20.240.41.65:36989] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeFh1ZJYca8I3TNCwIcfvAAAAEY"]
[Fri Apr 17 06:25:25.757769 2026] [:error] [pid 51878:tid 51902] [client 20.240.41.65:18232] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeFh1UnQhUtMbw9EsgaTHwAAARY"]
[Fri Apr 17 06:25:26.545003 2026] [:error] [pid 51878:tid 51881] [client 20.240.41.65:36985] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeFh1knQhUtMbw9EsgaTLQAAAQE"]
[Fri Apr 17 06:25:27.442035 2026] [:error] [pid 9263:tid 9275] [client 20.240.41.65:23629] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeFh1xP68VyHNvj1e54VfAAAAMo"]
[Fri Apr 17 06:25:27.984128 2026] [:error] [pid 51878:tid 51898] [client 20.240.41.65:7095] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeFh10nQhUtMbw9EsgaTQQAAARI"]
[Fri Apr 17 06:25:28.519775 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:7063] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeFh2OMHGxkTZX3c45cVFgAAAIk"]
[Fri Apr 17 06:25:29.194035 2026] [:error] [pid 51878:tid 51899] [client 20.240.41.65:7141] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeFh2UnQhUtMbw9EsgaTWQAAARM"]
[Fri Apr 17 06:25:30.273349 2026] [:error] [pid 51878:tid 51880] [client 20.240.41.65:7157] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeFh2knQhUtMbw9EsgaTaQAAAQA"]
[Fri Apr 17 06:25:30.959520 2026] [:error] [pid 51878:tid 51883] [client 20.240.41.65:6989] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeFh2knQhUtMbw9EsgaTcgAAAQM"]
[Fri Apr 17 06:25:31.636491 2026] [:error] [pid 9151:tid 9183] [client 20.240.41.65:6983] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeFh28hTVuRPkua22vSqhgAAABY"]
[Fri Apr 17 06:25:32.203780 2026] [:error] [pid 51878:tid 51892] [client 20.240.41.65:7058] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeFh3EnQhUtMbw9EsgaTeAAAAQw"]
[Fri Apr 17 06:25:33.038769 2026] [:error] [pid 9153:tid 9220] [client 20.240.41.65:7146] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeFh3eMHGxkTZX3c45cVHgAAAII"]
[Fri Apr 17 06:25:33.797909 2026] [:error] [pid 9263:tid 9270] [client 20.240.41.65:7114] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFh3RP68VyHNvj1e54VlgAAAMU"]
[Fri Apr 17 06:25:34.658384 2026] [:error] [pid 9263:tid 9277] [client 20.240.41.65:36962] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFh3hP68VyHNvj1e54VowAAAMw"]
[Fri Apr 17 06:25:35.273708 2026] [:error] [pid 51878:tid 51897] [client 20.240.41.65:36970] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFh30nQhUtMbw9EsgaToAAAARE"]
[Fri Apr 17 06:25:35.806033 2026] [:error] [pid 51878:tid 51894] [client 20.240.41.65:7161] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeFh30nQhUtMbw9EsgaTqQAAAQ4"]
[Fri Apr 17 06:25:36.364051 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:7139] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFh4EnQhUtMbw9EsgaTrQAAAQU"]
[Fri Apr 17 06:25:37.142632 2026] [:error] [pid 9263:tid 9265] [client 20.240.41.65:7057] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFh4RP68VyHNvj1e54VsAAAAMA"]
[Fri Apr 17 06:25:37.738556 2026] [:error] [pid 9152:tid 9192] [client 20.240.41.65:7059] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFh4ZJYca8I3TNCwIcf2gAAAEI"]
[Fri Apr 17 06:25:38.556447 2026] [:error] [pid 9263:tid 9280] [client 20.240.41.65:6978] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeFh4hP68VyHNvj1e54VtwAAAM8"]
[Fri Apr 17 06:25:39.467245 2026] [:error] [pid 9263:tid 9266] [client 20.240.41.65:7007] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFh4xP68VyHNvj1e54VwwAAAME"]
[Fri Apr 17 06:25:41.526650 2026] [:error] [pid 9151:tid 9174] [client 20.240.41.65:7045] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFh5chTVuRPkua22vSqpQAAAA0"]
[Fri Apr 17 06:25:42.209579 2026] [:error] [pid 9153:tid 9234] [client 20.240.41.65:7140] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFh5uMHGxkTZX3c45cVMAAAAJA"]
[Fri Apr 17 06:25:43.106322 2026] [:error] [pid 51878:tid 51893] [client 20.240.41.65:36940] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aeFh50nQhUtMbw9EsgaT9QAAAQ0"]
[Fri Apr 17 06:25:43.982359 2026] [:error] [pid 9153:tid 9220] [client 20.240.41.65:7136] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFh5-MHGxkTZX3c45cVNAAAAII"]
[Fri Apr 17 06:25:44.519265 2026] [:error] [pid 9152:tid 9206] [client 20.240.41.65:7101] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFh6JJYca8I3TNCwIcf6QAAAFA"]
[Fri Apr 17 06:25:45.258686 2026] [:error] [pid 51878:tid 51886] [client 20.240.41.65:7100] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFh6UnQhUtMbw9EsgaUIQAAAQY"]
[Fri Apr 17 06:25:45.877298 2026] [:error] [pid 9263:tid 9265] [client 20.240.41.65:7060] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeFh6RP68VyHNvj1e54V0AAAAMA"]
[Fri Apr 17 06:25:46.446556 2026] [:error] [pid 9263:tid 9289] [client 20.240.41.65:7072] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFh6hP68VyHNvj1e54V1gAAANg"]
[Fri Apr 17 06:25:47.007367 2026] [:error] [pid 51878:tid 51881] [client 20.240.41.65:7133] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFh60nQhUtMbw9EsgaUOAAAAQE"]
[Fri Apr 17 06:25:47.558972 2026] [:error] [pid 9263:tid 9271] [client 20.240.41.65:7052] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFh6xP68VyHNvj1e54V3AAAAMY"]
[Fri Apr 17 06:25:48.188517 2026] [:error] [pid 9263:tid 9278] [client 20.240.41.65:23645] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aeFh7BP68VyHNvj1e54V5AAAAM0"]
[Fri Apr 17 06:25:48.895762 2026] [:error] [pid 51878:tid 51889] [client 20.240.41.65:7065] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFh7EnQhUtMbw9EsgaUQgAAAQk"]
[Fri Apr 17 06:25:49.448847 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:7151] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFh7UnQhUtMbw9EsgaUSAAAARA"]
[Fri Apr 17 06:25:50.172363 2026] [:error] [pid 51878:tid 51902] [client 20.240.41.65:7080] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFh7knQhUtMbw9EsgaUUQAAARY"]
[Fri Apr 17 06:25:50.865521 2026] [:error] [pid 9152:tid 9205] [client 20.240.41.65:7085] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aeFh7pJYca8I3TNCwIcf_QAAAE8"]
[Fri Apr 17 06:25:51.578764 2026] [:error] [pid 9152:tid 9213] [client 20.240.41.65:7123] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFh75JYca8I3TNCwIcf_wAAAFc"]
[Fri Apr 17 06:25:52.267962 2026] [:error] [pid 9263:tid 9286] [client 20.240.41.65:6985] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFh8BP68VyHNvj1e54WBgAAANU"]
[Fri Apr 17 06:25:52.890848 2026] [:error] [pid 9263:tid 9265] [client 20.240.41.65:36956] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFh8BP68VyHNvj1e54WDgAAAMA"]
[Fri Apr 17 06:25:53.508598 2026] [:error] [pid 51878:tid 51882] [client 20.240.41.65:7144] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aeFh8UnQhUtMbw9EsgaUbAAAAQI"]
[Fri Apr 17 06:25:54.544184 2026] [:error] [pid 9151:tid 9162] [client 20.240.41.65:18177] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFh8shTVuRPkua22vSqtgAAAAE"]
[Fri Apr 17 06:25:55.117922 2026] [:error] [pid 51878:tid 51903] [client 20.240.41.65:36988] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFh80nQhUtMbw9EsgaUdgAAARc"]
[Fri Apr 17 06:25:56.160551 2026] [:error] [pid 9151:tid 9172] [client 20.240.41.65:7048] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFh9MhTVuRPkua22vSqvwAAAAs"]
[Fri Apr 17 06:25:56.794407 2026] [:error] [pid 9263:tid 9281] [client 20.240.41.65:7088] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeFh9BP68VyHNvj1e54WHgAAANA"]
[Fri Apr 17 06:25:57.457775 2026] [:error] [pid 51878:tid 51897] [client 20.240.41.65:36932] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFh9UnQhUtMbw9EsgaUhAAAARE"]
[Fri Apr 17 06:25:57.988769 2026] [:error] [pid 9153:tid 9226] [client 20.240.41.65:7079] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFh9eMHGxkTZX3c45cVVgAAAIg"]
[Fri Apr 17 06:25:58.591371 2026] [:error] [pid 9263:tid 9285] [client 20.240.41.65:7087] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFh9hP68VyHNvj1e54WKAAAANQ"]
[Fri Apr 17 06:25:59.174096 2026] [:error] [pid 9152:tid 9195] [client 20.240.41.65:7055] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeFh95JYca8I3TNCwIcgFAAAAEU"]
[Fri Apr 17 06:25:59.752793 2026] [:error] [pid 9263:tid 9288] [client 20.240.41.65:7086] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFh9xP68VyHNvj1e54WLAAAANc"]
[Fri Apr 17 06:26:00.324163 2026] [:error] [pid 51878:tid 51884] [client 20.240.41.65:7064] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFh-EnQhUtMbw9EsgaUngAAAQQ"]
[Fri Apr 17 06:26:00.878112 2026] [:error] [pid 51878:tid 51898] [client 20.240.41.65:7154] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFh-EnQhUtMbw9EsgaUoQAAARI"]
[Fri Apr 17 06:26:01.449735 2026] [:error] [pid 9152:tid 9200] [client 20.240.41.65:7004] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aeFh-ZJYca8I3TNCwIcgHQAAAEo"]
[Fri Apr 17 06:26:01.995512 2026] [:error] [pid 9263:tid 9279] [client 20.240.41.65:18218] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFh-RP68VyHNvj1e54WPgAAAM4"]
[Fri Apr 17 06:26:02.549640 2026] [:error] [pid 9151:tid 9174] [client 20.240.41.65:7158] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFh-shTVuRPkua22vSq0wAAAA0"]
[Fri Apr 17 06:26:03.209250 2026] [:error] [pid 9153:tid 9218] [client 20.240.41.65:23619] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFh--MHGxkTZX3c45cVcQAAAIA"]
[Fri Apr 17 06:26:03.748900 2026] [:error] [pid 9151:tid 9178] [client 20.240.41.65:36948] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aeFh-8hTVuRPkua22vSq2wAAABE"]
[Fri Apr 17 06:26:04.374555 2026] [:error] [pid 9263:tid 9266] [client 20.240.41.65:7042] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFh_BP68VyHNvj1e54WRgAAAME"]
[Fri Apr 17 06:26:05.717721 2026] [:error] [pid 9153:tid 9240] [client 20.240.41.65:7019] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFh_eMHGxkTZX3c45cVfwAAAJY"]
[Fri Apr 17 06:26:06.278556 2026] [:error] [pid 9152:tid 9190] [client 20.240.41.65:7054] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFh_pJYca8I3TNCwIcgLAAAAEA"]
[Fri Apr 17 06:26:06.817531 2026] [:error] [pid 9152:tid 9200] [client 20.240.41.65:6999] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aeFh_pJYca8I3TNCwIcgMQAAAEo"]
[Fri Apr 17 06:26:07.376721 2026] [:error] [pid 9152:tid 9191] [client 20.240.41.65:7089] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFh_5JYca8I3TNCwIcgNwAAAEE"]
[Fri Apr 17 06:26:07.907573 2026] [:error] [pid 9263:tid 9286] [client 20.240.41.65:6990] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFh_xP68VyHNvj1e54WaQAAANU"]
[Fri Apr 17 06:26:08.616499 2026] [:error] [pid 9152:tid 9193] [client 20.240.41.65:7020] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFiAJJYca8I3TNCwIcgRQAAAEM"]
[Fri Apr 17 06:26:09.175708 2026] [:error] [pid 9153:tid 9235] [client 20.240.41.65:7040] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeFiAeMHGxkTZX3c45cVkwAAAJE"]
[Fri Apr 17 06:26:09.871330 2026] [:error] [pid 51878:tid 51902] [client 20.240.41.65:6976] [client 20.240.41.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeFiAUnQhUtMbw9EsgaUuAAAARY"]
[Fri Apr 17 06:26:10.594791 2026] [:error] [pid 51878:tid 51891] [client 20.240.41.65:7014] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeFiAknQhUtMbw9EsgaUvAAAAQs"]
[Fri Apr 17 06:26:11.290809 2026] [:error] [pid 9152:tid 9200] [client 20.240.41.65:23678] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeFiA5JYca8I3TNCwIcgWAAAAEo"]
[Fri Apr 17 06:26:11.908432 2026] [:error] [pid 51878:tid 51897] [client 20.240.41.65:18207] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeFiA0nQhUtMbw9EsgaUvwAAARE"]
[Fri Apr 17 06:26:12.510978 2026] [:error] [pid 9153:tid 9220] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Apr 17 06:26:13.374002 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/prv8.php
[Fri Apr 17 06:26:13.666111 2026] [:error] [pid 9153:tid 9239] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Apr 17 06:26:13.967423 2026] [:error] [pid 9153:tid 9232] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Fri Apr 17 06:26:14.231757 2026] [:error] [pid 9153:tid 9227] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Fri Apr 17 06:26:14.500156 2026] [:error] [pid 9153:tid 9230] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Apr 17 06:26:14.765268 2026] [:error] [pid 9153:tid 9218] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Fri Apr 17 06:26:15.031873 2026] [:error] [pid 9153:tid 9225] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Fri Apr 17 06:26:15.309592 2026] [:error] [pid 9153:tid 9231] [client 20.240.41.65:6931] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Apr 17 06:26:15.571799 2026] [:error] [pid 9153:tid 9241] [client 20.240.41.65:6931] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "aeFiB-MHGxkTZX3c45cVyQAAAJc"]
[Fri Apr 17 06:26:16.380944 2026] [:error] [pid 51878:tid 51888] [client 20.240.41.65:18211] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "aeFiCEnQhUtMbw9EsgaU2wAAAQg"]
[Fri Apr 17 06:26:17.007274 2026] [:error] [pid 9152:tid 9205] [client 20.240.41.65:18190] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "aeFiCZJYca8I3TNCwIcgbAAAAE8"]
[Fri Apr 17 06:26:17.882183 2026] [:error] [pid 9152:tid 9197] [client 20.240.41.65:18189] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bengi.php"] [unique_id "aeFiCZJYca8I3TNCwIcgcAAAAEc"]
[Fri Apr 17 06:26:18.570646 2026] [:error] [pid 9152:tid 9195] [client 20.240.41.65:6955] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFiCpJYca8I3TNCwIcgdgAAAEU"]
[Fri Apr 17 06:26:19.366328 2026] [:error] [pid 51878:tid 51890] [client 20.240.41.65:6937] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFiC0nQhUtMbw9EsgaU-AAAAQo"]
[Fri Apr 17 06:26:19.959245 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:7137] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFiC0nQhUtMbw9EsgaVAgAAAQc"]
[Fri Apr 17 06:26:20.584477 2026] [:error] [pid 9151:tid 9166] [client 20.240.41.65:7110] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeFiDMhTVuRPkua22vSrBgAAAAU"]
[Fri Apr 17 06:26:21.196057 2026] [:error] [pid 9151:tid 9183] [client 20.240.41.65:7006] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeFiDchTVuRPkua22vSrEAAAABY"]
[Fri Apr 17 06:26:21.963569 2026] [:error] [pid 9263:tid 9280] [client 20.240.41.65:7138] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeFiDRP68VyHNvj1e54WpwAAAM8"]
[Fri Apr 17 06:26:23.225406 2026] [:error] [pid 9153:tid 9230] [client 20.240.41.65:23639] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeFiD-MHGxkTZX3c45cV0wAAAIw"]
[Fri Apr 17 06:26:23.929949 2026] [:error] [pid 9153:tid 9218] [client 20.240.41.65:7067] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeFiD-MHGxkTZX3c45cV1AAAAIA"]
[Fri Apr 17 06:26:24.767485 2026] [:error] [pid 9153:tid 9225] [client 20.240.41.65:6930] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeFiEOMHGxkTZX3c45cV1wAAAIc"]
[Fri Apr 17 06:26:25.300498 2026] [:error] [pid 51878:tid 51891] [client 20.240.41.65:7092] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeFiEUnQhUtMbw9EsgaVDwAAAQs"]
[Fri Apr 17 06:26:26.399070 2026] [:error] [pid 9263:tid 9272] [client 20.240.41.65:7122] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeFiEhP68VyHNvj1e54WtwAAAMc"]
[Fri Apr 17 06:26:27.398974 2026] [:error] [pid 9153:tid 9235] [client 20.240.41.65:7012] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeFiE-MHGxkTZX3c45cV3AAAAJE"]
[Fri Apr 17 06:26:28.097655 2026] [:error] [pid 9152:tid 9193] [client 20.240.41.65:6995] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFiFJJYca8I3TNCwIcghwAAAEM"]
[Fri Apr 17 06:26:29.963400 2026] [:error] [pid 9153:tid 9237] [client 20.240.41.65:6952] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFiFeMHGxkTZX3c45cV4wAAAJM"]
[Fri Apr 17 06:26:31.655109 2026] [:error] [pid 9153:tid 9219] [client 20.240.41.65:6929] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFiF-MHGxkTZX3c45cV6AAAAIE"]
[Fri Apr 17 06:26:32.897521 2026] [:error] [pid 9151:tid 9168] [client 20.240.41.65:7015] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeFiGMhTVuRPkua22vSrPwAAAAc"]
[Fri Apr 17 06:26:34.314508 2026] [:error] [pid 9151:tid 9180] [client 20.240.41.65:18208] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFiGshTVuRPkua22vSrSQAAABM"]
[Fri Apr 17 06:26:35.466831 2026] [:error] [pid 9152:tid 9192] [client 20.240.41.65:7159] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFiG5JYca8I3TNCwIcgyQAAAEI"]
[Fri Apr 17 06:26:36.619850 2026] [:error] [pid 9151:tid 9173] [client 20.240.41.65:18179] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFiHMhTVuRPkua22vSrawAAAAw"]
[Fri Apr 17 06:26:37.888685 2026] [:error] [pid 9263:tid 9288] [client 20.240.41.65:6913] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeFiHRP68VyHNvj1e54WzgAAANc"]
[Fri Apr 17 06:26:38.532185 2026] [:error] [pid 9263:tid 9282] [client 20.240.41.65:18209] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFiHhP68VyHNvj1e54W2AAAANE"]
[Fri Apr 17 06:26:39.239735 2026] [:error] [pid 9263:tid 9285] [client 20.240.41.65:36929] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFiHxP68VyHNvj1e54W3wAAANQ"]
[Fri Apr 17 06:26:40.543698 2026] [:error] [pid 9263:tid 9265] [client 20.240.41.65:7001] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFiIBP68VyHNvj1e54W5wAAAMA"]
[Fri Apr 17 06:26:41.135667 2026] [:error] [pid 51878:tid 51882] [client 20.240.41.65:23655] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aeFiIUnQhUtMbw9EsgaVlwAAAQI"]
[Fri Apr 17 06:26:41.864277 2026] [:error] [pid 51878:tid 51880] [client 20.240.41.65:7073] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFiIUnQhUtMbw9EsgaVqwAAAQA"]
[Fri Apr 17 06:26:42.600910 2026] [:error] [pid 9152:tid 9200] [client 20.240.41.65:7163] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFiIpJYca8I3TNCwIcg2QAAAEo"]
[Fri Apr 17 06:26:43.175016 2026] [:error] [pid 51878:tid 51892] [client 20.240.41.65:23663] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFiI0nQhUtMbw9EsgaVvwAAAQw"]
[Fri Apr 17 06:26:43.803805 2026] [:error] [pid 9152:tid 9193] [client 20.240.41.65:23641] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aeFiI5JYca8I3TNCwIcg4gAAAEM"]
[Fri Apr 17 06:26:44.381308 2026] [:error] [pid 9263:tid 9285] [client 20.240.41.65:6977] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFiJBP68VyHNvj1e54W9AAAANQ"]
[Fri Apr 17 06:26:45.488614 2026] [:error] [pid 9153:tid 9237] [client 20.240.41.65:23649] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFiJeMHGxkTZX3c45cWJgAAAJM"]
[Fri Apr 17 06:26:46.307455 2026] [:error] [pid 9151:tid 9166] [client 20.240.41.65:7069] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFiJshTVuRPkua22vSrfgAAAAU"]
[Fri Apr 17 06:26:47.771691 2026] [:error] [pid 9263:tid 9277] [client 20.240.41.65:18220] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeFiJxP68VyHNvj1e54W_wAAAMw"]
[Fri Apr 17 06:26:48.751459 2026] [:error] [pid 9263:tid 9276] [client 20.240.41.65:7047] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFiKBP68VyHNvj1e54XCQAAAMs"]
[Fri Apr 17 06:26:49.306538 2026] [:error] [pid 9153:tid 9222] [client 20.240.41.65:7010] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFiKeMHGxkTZX3c45cWQwAAAIQ"]
[Fri Apr 17 06:26:49.945840 2026] [:error] [pid 9151:tid 9185] [client 20.240.41.65:7037] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFiKchTVuRPkua22vSrmQAAABg"]
[Fri Apr 17 06:26:50.506711 2026] [:error] [pid 9153:tid 9232] [client 20.240.41.65:6982] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aeFiKuMHGxkTZX3c45cWSwAAAI4"]
[Fri Apr 17 06:26:51.273505 2026] [:error] [pid 9151:tid 9163] [client 20.240.41.65:7165] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFiK8hTVuRPkua22vSrpwAAAAI"]
[Fri Apr 17 06:26:51.822586 2026] [:error] [pid 9151:tid 9166] [client 20.240.41.65:7018] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFiK8hTVuRPkua22vSrqQAAAAU"]
[Fri Apr 17 06:26:52.837205 2026] [:error] [pid 9151:tid 9180] [client 20.240.41.65:7084] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFiLMhTVuRPkua22vSrrwAAABM"]
[Fri Apr 17 06:26:53.829297 2026] [:error] [pid 51878:tid 51896] [client 20.240.41.65:23624] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aeFiLUnQhUtMbw9EsgaV8gAAARA"]
[Fri Apr 17 06:26:54.535437 2026] [:error] [pid 51878:tid 51885] [client 20.240.41.65:7167] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFiLknQhUtMbw9EsgaV_AAAAQU"]
[Fri Apr 17 06:26:55.591861 2026] [:error] [pid 51878:tid 51886] [client 20.240.41.65:23679] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFiL0nQhUtMbw9EsgaWCwAAAQY"]
[Fri Apr 17 06:26:56.474418 2026] [:error] [pid 9263:tid 9268] [client 20.240.41.65:36975] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFiMBP68VyHNvj1e54XOQAAAMM"]
[Fri Apr 17 06:26:57.001621 2026] [:error] [pid 9263:tid 9273] [client 20.240.41.65:7160] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aeFiMRP68VyHNvj1e54XPQAAAMg"]
[Fri Apr 17 06:26:57.594289 2026] [:error] [pid 9263:tid 9275] [client 20.240.41.65:18185] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aeFiMRP68VyHNvj1e54XPwAAAMo"]
[Fri Apr 17 06:26:58.139974 2026] [:error] [pid 9263:tid 9287] [client 20.240.41.65:7030] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aeFiMhP68VyHNvj1e54XRQAAANY"]
[Fri Apr 17 06:26:58.717624 2026] [:error] [pid 9153:tid 9241] [client 20.240.41.65:23672] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aeFiMuMHGxkTZX3c45cWfQAAAJc"]
[Fri Apr 17 06:26:59.349981 2026] [:error] [pid 9153:tid 9224] [client 20.240.41.65:23660] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class19.php"] [unique_id "aeFiM-MHGxkTZX3c45cWhgAAAIY"]
[Fri Apr 17 06:26:59.906321 2026] [:error] [pid 9153:tid 9241] [client 20.240.41.65:36991] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aeFiM-MHGxkTZX3c45cWjwAAAJc"]
[Fri Apr 17 06:27:00.460593 2026] [:error] [pid 9153:tid 9239] [client 20.240.41.65:23626] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aeFiNOMHGxkTZX3c45cWmgAAAJU"]
[Fri Apr 17 06:27:01.057342 2026] [:error] [pid 9263:tid 9289] [client 20.240.41.65:7091] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aeFiNRP68VyHNvj1e54XVQAAANg"]
[Fri Apr 17 06:27:01.588195 2026] [:error] [pid 51878:tid 51894] [client 20.240.41.65:18202] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class20.php"] [unique_id "aeFiNUnQhUtMbw9EsgaWIAAAAQ4"]
[Fri Apr 17 06:27:02.262770 2026] [:error] [pid 9151:tid 9168] [client 20.240.41.65:6984] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFiNshTVuRPkua22vSr3QAAAAc"]
[Fri Apr 17 06:27:02.815341 2026] [:error] [pid 51878:tid 51889] [client 20.240.41.65:18176] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFiNknQhUtMbw9EsgaWLwAAAQk"]
[Fri Apr 17 06:27:03.400178 2026] [:error] [pid 9153:tid 9218] [client 20.240.41.65:7109] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFiN-MHGxkTZX3c45cWrAAAAIA"]
[Fri Apr 17 06:27:04.309531 2026] [:error] [pid 9263:tid 9280] [client 20.240.41.65:23642] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aeFiOBP68VyHNvj1e54XaAAAAM8"]
[Fri Apr 17 06:27:04.837331 2026] [:error] [pid 9263:tid 9274] [client 20.240.41.65:7025] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFiOBP68VyHNvj1e54XcgAAAMk"]
[Fri Apr 17 06:27:05.597652 2026] [:error] [pid 9263:tid 9289] [client 20.240.41.65:6987] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFiORP68VyHNvj1e54XfwAAANg"]
[Fri Apr 17 06:27:06.449177 2026] [:error] [pid 51878:tid 51882] [client 20.240.41.65:23667] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFiOknQhUtMbw9EsgaWQQAAAQI"]
[Fri Apr 17 06:27:07.006895 2026] [:error] [pid 51878:tid 51899] [client 20.240.41.65:6979] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vee.php"] [unique_id "aeFiO0nQhUtMbw9EsgaWRgAAARM"]
[Fri Apr 17 06:27:08.169807 2026] [:error] [pid 51878:tid 51887] [client 20.240.41.65:7016] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFiPEnQhUtMbw9EsgaWTAAAAQc"]
[Fri Apr 17 06:27:08.807149 2026] [:error] [pid 9151:tid 9172] [client 20.240.41.65:7027] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFiPMhTVuRPkua22vSr6AAAAAs"]
[Fri Apr 17 06:27:09.335813 2026] [:error] [pid 9263:tid 9281] [client 20.240.41.65:23628] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFiPRP68VyHNvj1e54XrQAAANA"]
[Fri Apr 17 06:27:10.401320 2026] [:error] [pid 9151:tid 9167] [client 20.240.41.65:23628] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cabs.php"] [unique_id "aeFiPshTVuRPkua22vSr7AAAAAY"]
[Fri Apr 17 06:27:10.957280 2026] [:error] [pid 9151:tid 9174] [client 20.240.41.65:7074] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFiPshTVuRPkua22vSr7wAAAA0"]
[Fri Apr 17 06:27:11.683840 2026] [:error] [pid 9153:tid 9238] [client 20.240.41.65:18187] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFiP-MHGxkTZX3c45cWwAAAAJQ"]
[Fri Apr 17 06:27:12.509780 2026] [:error] [pid 9152:tid 9199] [client 20.240.41.65:18183] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFiQJJYca8I3TNCwIchTAAAAEk"]
[Fri Apr 17 06:27:13.064086 2026] [:error] [pid 9263:tid 9281] [client 20.240.41.65:23657] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFiQRP68VyHNvj1e54X1gAAANA"]
[Fri Apr 17 06:27:13.804253 2026] [:error] [pid 9152:tid 9194] [client 20.240.41.65:7071] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "aeFiQZJYca8I3TNCwIchWAAAAEQ"]
[Fri Apr 17 06:27:14.357141 2026] [:error] [pid 9151:tid 9177] [client 20.240.41.65:18217] [client 20.240.41.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x1da.php"] [unique_id "aeFiQshTVuRPkua22vSr-QAAABA"]
[Fri Apr 17 06:27:15.163010 2026] [:error] [pid 9263:tid 9271] [client 20.240.41.65:18234] File does not exist: /usr/local/apache/htdocs/suspended-page/x1da.php
[Fri Apr 17 06:27:15.677138 2026] [:error] [pid 9263:tid 9269] [client 20.240.41.65:18234] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Apr 17 06:27:15.942297 2026] [:error] [pid 9263:tid 9280] [client 20.240.41.65:18234] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Apr 17 06:40:23.720180 2026] [:error] [pid 9153:tid 9240] [client 182.44.10.67:39992] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeFlV-MHGxkTZX3c45cq0gAAAJY"]
[Fri Apr 17 07:08:54.173148 2026] [:error] [pid 9152:tid 9201] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Fri Apr 17 07:08:54.610922 2026] [:error] [pid 9152:tid 9203] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Fri Apr 17 07:08:54.896504 2026] [:error] [pid 9152:tid 9195] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Apr 17 07:08:55.182007 2026] [:error] [pid 9152:tid 9207] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Fri Apr 17 07:08:55.474054 2026] [:error] [pid 9152:tid 9205] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/Geforce.php
[Fri Apr 17 07:08:55.894487 2026] [:error] [pid 9152:tid 9212] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Fri Apr 17 07:08:56.185956 2026] [:error] [pid 9152:tid 9190] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Fri Apr 17 07:08:56.481908 2026] [:error] [pid 9152:tid 9193] [client 74.234.86.1:13321] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Fri Apr 17 07:08:56.766682 2026] [:error] [pid 9152:tid 9211] [client 74.234.86.1:13321] [client 74.234.86.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeFsCJJYca8I3TNCwIdBfwAAAFU"]
[Fri Apr 17 07:08:58.079055 2026] [:error] [pid 9153:tid 9228] [client 74.234.86.1:13862] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Fri Apr 17 07:08:58.361083 2026] [:error] [pid 9153:tid 9241] [client 74.234.86.1:13862] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Fri Apr 17 07:08:58.640002 2026] [:error] [pid 9153:tid 9223] [client 74.234.86.1:13862] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ng.php"] [unique_id "aeFsCuMHGxkTZX3c45dS_wAAAIU"]
[Fri Apr 17 07:09:01.040337 2026] [:error] [pid 9263:tid 9276] [client 74.234.86.1:22250] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ng.php"] [unique_id "aeFsDRP68VyHNvj1e54-nwAAAMs"]
[Fri Apr 17 07:09:02.330176 2026] [:error] [pid 9153:tid 9225] [client 74.234.86.1:31999] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ng.php"] [unique_id "aeFsDuMHGxkTZX3c45dTEgAAAIc"]
[Fri Apr 17 07:09:03.412633 2026] [:error] [pid 9153:tid 9221] [client 74.234.86.1:15817] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ng.php"] [unique_id "aeFsD-MHGxkTZX3c45dTFQAAAIM"]
[Fri Apr 17 07:09:04.820759 2026] [:error] [pid 9151:tid 9169] [client 74.234.86.1:31793] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tiny2.php"] [unique_id "aeFsEMhTVuRPkua22vTGlAAAAAg"]
[Fri Apr 17 07:09:06.257570 2026] [:error] [pid 9153:tid 9224] [client 74.234.86.1:13824] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tiny2.php"] [unique_id "aeFsEuMHGxkTZX3c45dTKwAAAIY"]
[Fri Apr 17 07:09:07.916706 2026] [:error] [pid 51878:tid 51890] [client 74.234.86.1:31979] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tiny2.php"] [unique_id "aeFsE0nQhUtMbw9EsgbISgAAAQo"]
[Fri Apr 17 07:09:08.667432 2026] [:error] [pid 9263:tid 9267] [client 74.234.86.1:22226] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tiny2.php"] [unique_id "aeFsFBP68VyHNvj1e54-owAAAMI"]
[Fri Apr 17 07:09:10.156830 2026] [:error] [pid 51878:tid 51884] [client 74.234.86.1:31764] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/state.php"] [unique_id "aeFsFknQhUtMbw9EsgbIUQAAAQQ"]
[Fri Apr 17 07:09:10.818627 2026] [:error] [pid 9153:tid 9238] [client 74.234.86.1:15036] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/state.php"] [unique_id "aeFsFuMHGxkTZX3c45dTPwAAAJQ"]
[Fri Apr 17 07:09:12.533801 2026] [:error] [pid 25010:tid 25028] [client 74.234.86.1:22591] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/state.php"] [unique_id "aeFsGI-7kkf42RarqQ3hswAAAU8"]
[Fri Apr 17 07:09:16.393290 2026] [:error] [pid 25010:tid 25013] [client 74.234.86.1:15845] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/state.php"] [unique_id "aeFsHI-7kkf42RarqQ3hygAAAUA"]
[Fri Apr 17 07:09:17.177129 2026] [:error] [pid 9152:tid 9214] [client 74.234.86.1:31774] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aeFsHZJYca8I3TNCwIdB1gAAAFg"]
[Fri Apr 17 07:09:18.757430 2026] [:error] [pid 25010:tid 25028] [client 74.234.86.1:22944] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aeFsHo-7kkf42RarqQ3hzgAAAU8"]
[Fri Apr 17 07:09:19.834913 2026] [:error] [pid 25010:tid 25029] [client 74.234.86.1:15810] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aeFsH4-7kkf42RarqQ3h1gAAAVA"]
[Fri Apr 17 07:09:20.629440 2026] [:error] [pid 25010:tid 25034] [client 74.234.86.1:13340] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aeFsII-7kkf42RarqQ3h2QAAAVU"]
[Fri Apr 17 07:09:21.350630 2026] [:error] [pid 9152:tid 9199] [client 74.234.86.1:18460] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wps.php"] [unique_id "aeFsIZJYca8I3TNCwIdB7gAAAEk"]
[Fri Apr 17 07:09:22.166757 2026] [:error] [pid 9153:tid 9227] [client 74.234.86.1:18492] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wps.php"] [unique_id "aeFsIuMHGxkTZX3c45dTSAAAAIk"]
[Fri Apr 17 07:09:22.843115 2026] [:error] [pid 51878:tid 51898] [client 74.234.86.1:18068] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wps.php"] [unique_id "aeFsIknQhUtMbw9EsgbIWgAAARI"]
[Fri Apr 17 07:09:24.294006 2026] [:error] [pid 9153:tid 9223] [client 74.234.86.1:18102] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wps.php"] [unique_id "aeFsJOMHGxkTZX3c45dTSwAAAIU"]
[Fri Apr 17 07:09:25.104544 2026] [:error] [pid 9263:tid 9283] [client 74.234.86.1:15430] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ayk.php"] [unique_id "aeFsJRP68VyHNvj1e54-xgAAANI"]
[Fri Apr 17 07:09:25.871557 2026] [:error] [pid 51878:tid 51891] [client 74.234.86.1:30234] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ayk.php"] [unique_id "aeFsJUnQhUtMbw9EsgbIXwAAAQs"]
[Fri Apr 17 07:09:27.713491 2026] [:error] [pid 9152:tid 9197] [client 74.234.86.1:15859] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ayk.php"] [unique_id "aeFsJ5JYca8I3TNCwIdB8gAAAEc"]
[Fri Apr 17 07:09:29.529746 2026] [:error] [pid 51878:tid 51890] [client 74.234.86.1:18433] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ayk.php"] [unique_id "aeFsKUnQhUtMbw9EsgbIYwAAAQo"]
[Fri Apr 17 07:09:31.223579 2026] [:error] [pid 25010:tid 25027] [client 74.234.86.1:16564] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wgift1.php"] [unique_id "aeFsK4-7kkf42RarqQ3h5gAAAU4"]
[Fri Apr 17 07:09:32.191538 2026] [:error] [pid 51878:tid 51880] [client 74.234.86.1:30233] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wgift1.php"] [unique_id "aeFsLEnQhUtMbw9EsgbIaAAAAQA"]
[Fri Apr 17 07:09:33.783381 2026] [:error] [pid 9151:tid 9171] [client 74.234.86.1:31765] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wgift1.php"] [unique_id "aeFsLchTVuRPkua22vTGtAAAAAo"]
[Fri Apr 17 07:09:35.735165 2026] [:error] [pid 9152:tid 9204] [client 74.234.86.1:22914] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wgift1.php"] [unique_id "aeFsL5JYca8I3TNCwIdCHQAAAE4"]
[Fri Apr 17 07:09:37.343858 2026] [:error] [pid 25010:tid 25030] [client 74.234.86.1:18434] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ss.php"] [unique_id "aeFsMY-7kkf42RarqQ3h6gAAAVE"]
[Fri Apr 17 07:09:38.176170 2026] [:error] [pid 9153:tid 9241] [client 74.234.86.1:19307] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ss.php"] [unique_id "aeFsMuMHGxkTZX3c45dTXAAAAJc"]
[Fri Apr 17 07:09:39.520685 2026] [:error] [pid 25010:tid 25020] [client 74.234.86.1:21746] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ss.php"] [unique_id "aeFsM4-7kkf42RarqQ3h8gAAAUc"]
[Fri Apr 17 07:09:41.458454 2026] [:error] [pid 25010:tid 25020] [client 74.234.86.1:16519] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ss.php"] [unique_id "aeFsNY-7kkf42RarqQ3iCQAAAUc"]
[Fri Apr 17 07:09:42.145760 2026] [:error] [pid 9263:tid 9287] [client 74.234.86.1:31798] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx79.php"] [unique_id "aeFsNhP68VyHNvj1e54-6QAAANY"]
[Fri Apr 17 07:09:43.050196 2026] [:error] [pid 9153:tid 9224] [client 74.234.86.1:30237] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx79.php"] [unique_id "aeFsN-MHGxkTZX3c45dTYAAAAIY"]
[Fri Apr 17 07:09:46.115627 2026] [:error] [pid 9152:tid 9196] [client 74.234.86.1:22929] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx79.php"] [unique_id "aeFsOpJYca8I3TNCwIdCMAAAAEY"]
[Fri Apr 17 07:09:48.630415 2026] [:error] [pid 9263:tid 9268] [client 74.234.86.1:18455] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tx79.php"] [unique_id "aeFsPBP68VyHNvj1e54--gAAAMM"]
[Fri Apr 17 07:09:50.694500 2026] [:error] [pid 9151:tid 9184] [client 74.234.86.1:15872] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aeFsPshTVuRPkua22vTGzwAAABc"]
[Fri Apr 17 07:09:51.810817 2026] [:error] [pid 9263:tid 9284] [client 74.234.86.1:15893] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aeFsPxP68VyHNvj1e54_AgAAANM"]
[Fri Apr 17 07:09:55.786221 2026] [:error] [pid 51878:tid 51900] [client 74.234.86.1:14036] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aeFsQ0nQhUtMbw9EsgbIfwAAARQ"]
[Fri Apr 17 07:09:58.048149 2026] [:error] [pid 25010:tid 25035] [client 74.234.86.1:15308] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Fri Apr 17 07:09:58.588415 2026] [:error] [pid 25010:tid 25025] [client 74.234.86.1:15308] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Apr 17 07:09:58.856914 2026] [:error] [pid 25010:tid 25023] [client 74.234.86.1:15308] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Fri Apr 17 07:09:59.404868 2026] [:error] [pid 25010:tid 25020] [client 74.234.86.1:15308] [client 74.234.86.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.rejuva.au"] [uri "/tiny.php"] [unique_id "aeFsR4-7kkf42RarqQ3icQAAAUc"]
[Fri Apr 17 07:10:01.085278 2026] [:error] [pid 9153:tid 9225] [client 74.234.86.1:19307] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Fri Apr 17 07:10:01.911668 2026] [:error] [pid 9153:tid 9225] [client 74.234.86.1:19307] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Fri Apr 17 07:10:02.209497 2026] [:error] [pid 9153:tid 9222] [client 74.234.86.1:19307] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 17 07:10:02.507606 2026] [:error] [pid 9153:tid 9224] [client 74.234.86.1:19307] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Fri Apr 17 07:10:02.794521 2026] [:error] [pid 9153:tid 9237] [client 74.234.86.1:19307] File does not exist: /usr/local/apache/htdocs/suspended-page/footer.php
[Fri Apr 17 07:10:03.975066 2026] [:error] [pid 9153:tid 9233] [client 74.234.86.1:19307] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Fri Apr 17 07:10:04.259166 2026] [:error] [pid 9153:tid 9229] [client 74.234.86.1:19307] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aeFsTOMHGxkTZX3c45dTeAAAAIs"]
[Fri Apr 17 07:10:07.693311 2026] [:error] [pid 9263:tid 9269] [client 74.234.86.1:14589] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aeFsTxP68VyHNvj1e54_JwAAAMQ"]
[Fri Apr 17 07:10:10.085582 2026] [:error] [pid 9151:tid 9181] [client 74.234.86.1:30229] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aeFsUshTVuRPkua22vTG4QAAABQ"]
[Fri Apr 17 07:10:11.966482 2026] [:error] [pid 9263:tid 9272] [client 74.234.86.1:15896] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/12.php"] [unique_id "aeFsUxP68VyHNvj1e54_PwAAAMc"]
[Fri Apr 17 07:10:14.216495 2026] [:error] [pid 25010:tid 25034] [client 74.234.86.1:14077] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFsVo-7kkf42RarqQ3inwAAAVU"]
[Fri Apr 17 07:10:15.830499 2026] [:error] [pid 9263:tid 9273] [client 74.234.86.1:14557] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFsVxP68VyHNvj1e54_UgAAAMg"]
[Fri Apr 17 07:10:17.828741 2026] [:error] [pid 9153:tid 9222] [client 74.234.86.1:14079] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFsWeMHGxkTZX3c45dTmAAAAIQ"]
[Fri Apr 17 07:10:18.681202 2026] [:error] [pid 9153:tid 9225] [client 74.234.86.1:22958] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aeFsWuMHGxkTZX3c45dTnAAAAIc"]
[Fri Apr 17 07:10:19.697766 2026] [:error] [pid 9153:tid 9221] [client 74.234.86.1:30257] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xff.php"] [unique_id "aeFsW-MHGxkTZX3c45dTnwAAAIM"]
[Fri Apr 17 07:10:22.435032 2026] [:error] [pid 9153:tid 9234] [client 74.234.86.1:22924] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xff.php"] [unique_id "aeFsXuMHGxkTZX3c45dTpgAAAJA"]
[Fri Apr 17 07:10:24.561845 2026] [:error] [pid 51878:tid 51894] [client 74.234.86.1:14027] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xff.php"] [unique_id "aeFsYEnQhUtMbw9EsgbIpQAAAQ4"]
[Fri Apr 17 07:10:28.790873 2026] [:error] [pid 51878:tid 51885] [client 74.234.86.1:23441] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xff.php"] [unique_id "aeFsZEnQhUtMbw9EsgbIsAAAAQU"]
[Fri Apr 17 07:10:30.081506 2026] [:error] [pid 51878:tid 51887] [client 74.234.86.1:22926] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aeFsZknQhUtMbw9EsgbIsgAAAQc"]
[Fri Apr 17 07:10:30.816027 2026] [:error] [pid 9151:tid 9161] [client 74.234.86.1:23447] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aeFsZshTVuRPkua22vTG6gAAAAA"]
[Fri Apr 17 07:10:31.532434 2026] [:error] [pid 51878:tid 51889] [client 74.234.86.1:19271] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aeFsZ0nQhUtMbw9EsgbItAAAAQk"]
[Fri Apr 17 07:10:32.437996 2026] [:error] [pid 51878:tid 51904] [client 74.234.86.1:13358] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lib.php"] [unique_id "aeFsaEnQhUtMbw9EsgbItwAAARg"]
[Fri Apr 17 07:10:33.320447 2026] [:error] [pid 9153:tid 9229] [client 74.234.86.1:19294] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/roksad1.php"] [unique_id "aeFsaeMHGxkTZX3c45dTwAAAAIs"]
[Fri Apr 17 07:10:34.863999 2026] [:error] [pid 51878:tid 51887] [client 74.234.86.1:18440] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/roksad1.php"] [unique_id "aeFsaknQhUtMbw9EsgbIxAAAAQc"]
[Fri Apr 17 07:10:36.175379 2026] [:error] [pid 9263:tid 9280] [client 74.234.86.1:31776] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/roksad1.php"] [unique_id "aeFsbBP68VyHNvj1e54_cAAAAM8"]
[Fri Apr 17 07:10:38.563046 2026] [:error] [pid 9153:tid 9220] [client 74.234.86.1:22270] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/roksad1.php"] [unique_id "aeFsbuMHGxkTZX3c45dT0wAAAII"]
[Fri Apr 17 07:10:41.556217 2026] [:error] [pid 9152:tid 9199] [client 74.234.86.1:23120] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeFscZJYca8I3TNCwIdCeAAAAEk"]
[Fri Apr 17 07:10:44.577631 2026] [:error] [pid 9153:tid 9242] [client 74.234.86.1:20384] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeFsdOMHGxkTZX3c45dT3wAAAJg"]
[Fri Apr 17 07:10:45.757950 2026] [:error] [pid 9152:tid 9214] [client 74.234.86.1:15581] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeFsdZJYca8I3TNCwIdCfAAAAFg"]
[Fri Apr 17 07:10:47.935878 2026] [:error] [pid 25010:tid 25020] [client 74.234.86.1:19459] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeFsd4-7kkf42RarqQ3iswAAAUc"]
[Fri Apr 17 07:10:48.529374 2026] [:error] [pid 25010:tid 25029] [client 74.234.86.1:16722] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFseI-7kkf42RarqQ3itgAAAVA"]
[Fri Apr 17 07:10:49.374701 2026] [:error] [pid 9263:tid 9269] [client 74.234.86.1:15607] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFseRP68VyHNvj1e54_cQAAAMQ"]
[Fri Apr 17 07:10:50.571314 2026] [:error] [pid 25010:tid 25018] [client 74.234.86.1:17710] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFseo-7kkf42RarqQ3iuwAAAUU"]
[Fri Apr 17 07:10:51.367250 2026] [:error] [pid 9153:tid 9236] [client 74.234.86.1:15226] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeFse-MHGxkTZX3c45dT6QAAAJI"]
[Fri Apr 17 07:10:52.753047 2026] [:error] [pid 25010:tid 25031] [client 74.234.86.1:13738] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aeFsfI-7kkf42RarqQ3iwAAAAVI"]
[Fri Apr 17 07:10:53.629250 2026] [:error] [pid 25010:tid 25029] [client 74.234.86.1:32866] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aeFsfY-7kkf42RarqQ3ixQAAAVA"]
[Fri Apr 17 07:10:55.986548 2026] [:error] [pid 51878:tid 51899] [client 74.234.86.1:20547] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aeFsf0nQhUtMbw9EsgbI0AAAARM"]
[Fri Apr 17 07:10:57.016557 2026] [:error] [pid 25010:tid 25014] [client 74.234.86.1:22497] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aeFsgY-7kkf42RarqQ3izgAAAUE"]
[Fri Apr 17 07:10:59.385988 2026] [:error] [pid 25010:tid 25015] [client 74.234.86.1:33216] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dass.php"] [unique_id "aeFsg4-7kkf42RarqQ3i1gAAAUI"]
[Fri Apr 17 07:11:01.121293 2026] [:error] [pid 25010:tid 25029] [client 74.234.86.1:25628] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dass.php"] [unique_id "aeFshY-7kkf42RarqQ3i3AAAAVA"]
[Fri Apr 17 07:11:03.333540 2026] [:error] [pid 9151:tid 9174] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Fri Apr 17 07:11:03.603867 2026] [:error] [pid 9151:tid 9185] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Apr 17 07:11:05.138479 2026] [:error] [pid 9151:tid 9185] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/less.php
[Fri Apr 17 07:11:05.409989 2026] [:error] [pid 9151:tid 9162] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Fri Apr 17 07:11:05.680004 2026] [:error] [pid 9151:tid 9183] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Fri Apr 17 07:11:05.949814 2026] [:error] [pid 9151:tid 9169] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 17 07:11:06.220066 2026] [:error] [pid 9151:tid 9176] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/1s7y8wt9dz.php
[Fri Apr 17 07:11:06.502838 2026] [:error] [pid 9151:tid 9161] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/bdktk.php
[Fri Apr 17 07:11:06.775142 2026] [:error] [pid 9151:tid 9165] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/v5.php
[Fri Apr 17 07:11:07.046996 2026] [:error] [pid 9151:tid 9179] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Fri Apr 17 07:11:07.426608 2026] [:error] [pid 9151:tid 9163] [client 74.234.86.1:5691] File does not exist: /usr/local/apache/htdocs/suspended-page/ws87.php
[Fri Apr 17 07:11:07.705928 2026] [:error] [pid 9151:tid 9173] [client 74.234.86.1:5691] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/layout.php"] [unique_id "aeFsi8hTVuRPkua22vTG_wAAAAw"]
[Fri Apr 17 07:11:09.107454 2026] [:error] [pid 9153:tid 9242] [client 74.234.86.1:21266] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/layout.php"] [unique_id "aeFsjeMHGxkTZX3c45dUDgAAAJg"]
[Fri Apr 17 07:11:09.834356 2026] [:error] [pid 25010:tid 25018] [client 74.234.86.1:16180] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/layout.php"] [unique_id "aeFsjY-7kkf42RarqQ3i9QAAAUU"]
[Fri Apr 17 07:11:10.790806 2026] [:error] [pid 9263:tid 9278] [client 74.234.86.1:19806] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/layout.php"] [unique_id "aeFsjhP68VyHNvj1e54_fgAAAM0"]
[Fri Apr 17 07:11:11.808724 2026] [:error] [pid 51878:tid 51886] [client 74.234.86.1:24365] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r2.php"] [unique_id "aeFsj0nQhUtMbw9EsgbI5AAAAQY"]
[Fri Apr 17 07:11:12.881966 2026] [:error] [pid 51878:tid 51885] [client 74.234.86.1:19546] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r2.php"] [unique_id "aeFskEnQhUtMbw9EsgbI7AAAAQU"]
[Fri Apr 17 07:11:14.837294 2026] [:error] [pid 25010:tid 25020] [client 74.234.86.1:20144] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r2.php"] [unique_id "aeFsko-7kkf42RarqQ3jAwAAAUc"]
[Fri Apr 17 07:11:16.057077 2026] [:error] [pid 25010:tid 25030] [client 74.234.86.1:13506] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/r2.php"] [unique_id "aeFslI-7kkf42RarqQ3jBwAAAVE"]
[Fri Apr 17 07:11:18.022276 2026] [:error] [pid 25010:tid 25015] [client 74.234.86.1:13137] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ah25.php"] [unique_id "aeFslo-7kkf42RarqQ3jDgAAAUI"]
[Fri Apr 17 07:11:20.292917 2026] [:error] [pid 25010:tid 25030] [client 74.234.86.1:33044] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ah25.php"] [unique_id "aeFsmI-7kkf42RarqQ3jGgAAAVE"]
[Fri Apr 17 07:11:34.753428 2026] [:error] [pid 51878:tid 51902] [client 74.234.86.1:13509] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/006.php"] [unique_id "aeFspknQhUtMbw9EsgbJMAAAARY"]
[Fri Apr 17 07:11:38.690292 2026] [:error] [pid 25010:tid 25035] [client 74.234.86.1:14846] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/006.php"] [unique_id "aeFsqo-7kkf42RarqQ3jMQAAAVY"]
[Fri Apr 17 07:11:40.000061 2026] [:error] [pid 9153:tid 9241] [client 74.234.86.1:32579] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/006.php"] [unique_id "aeFsq-MHGxkTZX3c45dUUAAAAJc"]
[Fri Apr 17 07:11:42.124918 2026] [:error] [pid 9152:tid 9196] [client 74.234.86.1:5597] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/006.php"] [unique_id "aeFsrpJYca8I3TNCwIdCsAAAAEY"]
[Fri Apr 17 07:11:43.095833 2026] [:error] [pid 25010:tid 25017] [client 74.234.86.1:19951] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samll.php"] [unique_id "aeFsr4-7kkf42RarqQ3jOgAAAUQ"]
[Fri Apr 17 07:11:44.281694 2026] [:error] [pid 51878:tid 51898] [client 74.234.86.1:32180] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samll.php"] [unique_id "aeFssEnQhUtMbw9EsgbJSwAAARI"]
[Fri Apr 17 07:11:45.219795 2026] [:error] [pid 9153:tid 9219] [client 74.234.86.1:32613] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samll.php"] [unique_id "aeFsseMHGxkTZX3c45dUZQAAAIE"]
[Fri Apr 17 07:11:46.197694 2026] [:error] [pid 51878:tid 51883] [client 74.234.86.1:14787] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/samll.php"] [unique_id "aeFssknQhUtMbw9EsgbJTAAAAQM"]
[Fri Apr 17 07:11:46.959790 2026] [:error] [pid 9153:tid 9233] [client 74.234.86.1:21426] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zogy1.php"] [unique_id "aeFssuMHGxkTZX3c45dUagAAAI8"]
[Fri Apr 17 07:11:47.740352 2026] [:error] [pid 9153:tid 9220] [client 74.234.86.1:21475] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zogy1.php"] [unique_id "aeFss-MHGxkTZX3c45dUbQAAAII"]
[Fri Apr 17 07:11:48.647005 2026] [:error] [pid 9152:tid 9193] [client 74.234.86.1:18300] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zogy1.php"] [unique_id "aeFstJJYca8I3TNCwIdCtQAAAEM"]
[Fri Apr 17 07:11:49.896735 2026] [:error] [pid 9153:tid 9221] [client 74.234.86.1:15629] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zogy1.php"] [unique_id "aeFsteMHGxkTZX3c45dUdwAAAIM"]
[Fri Apr 17 07:11:51.773770 2026] [:error] [pid 9153:tid 9232] [client 74.234.86.1:23400] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeFst-MHGxkTZX3c45dUhwAAAI4"]
[Fri Apr 17 07:11:53.584642 2026] [:error] [pid 9263:tid 9278] [client 74.234.86.1:32176] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeFsuRP68VyHNvj1e54_sAAAAM0"]
[Fri Apr 17 07:11:54.648587 2026] [:error] [pid 9153:tid 9219] [client 74.234.86.1:22855] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeFsuuMHGxkTZX3c45dUkQAAAIE"]
[Fri Apr 17 07:12:04.561676 2026] [:error] [pid 9152:tid 9200] [client 74.234.86.1:32181] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "aeFsxJJYca8I3TNCwIdCugAAAEo"]
[Fri Apr 17 07:12:06.468634 2026] [:error] [pid 25010:tid 25027] [client 74.234.86.1:20420] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/rh.php"] [unique_id "aeFsxo-7kkf42RarqQ3jdQAAAU4"]
[Fri Apr 17 07:12:09.331308 2026] [:error] [pid 9153:tid 9228] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Fri Apr 17 07:12:09.602078 2026] [:error] [pid 9153:tid 9221] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/gz.php
[Fri Apr 17 07:12:09.874570 2026] [:error] [pid 9153:tid 9229] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Fri Apr 17 07:12:10.232004 2026] [:error] [pid 9153:tid 9235] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/areak1.php
[Fri Apr 17 07:12:10.508681 2026] [:error] [pid 9153:tid 9236] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/qqa.php
[Fri Apr 17 07:12:10.795155 2026] [:error] [pid 9153:tid 9222] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 17 07:12:11.429325 2026] [:error] [pid 9153:tid 9233] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/ga.php
[Fri Apr 17 07:12:11.699934 2026] [:error] [pid 9153:tid 9225] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/xozx.php
[Fri Apr 17 07:12:11.972771 2026] [:error] [pid 9153:tid 9237] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Fri Apr 17 07:12:12.254588 2026] [:error] [pid 9153:tid 9241] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Fri Apr 17 07:12:12.531653 2026] [:error] [pid 9153:tid 9223] [client 74.234.86.1:17341] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Fri Apr 17 07:12:14.165305 2026] [:error] [pid 9153:tid 9223] [client 74.234.86.1:17341] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeFszuMHGxkTZX3c45dU7AAAAIU"]
[Fri Apr 17 07:12:14.978220 2026] [:error] [pid 9153:tid 9225] [client 74.234.86.1:17307] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeFszuMHGxkTZX3c45dU8QAAAIc"]
[Fri Apr 17 07:12:16.332324 2026] [:error] [pid 25010:tid 25033] [client 74.234.86.1:14967] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeFs0I-7kkf42RarqQ3jhwAAAVQ"]
[Fri Apr 17 07:12:18.631284 2026] [:error] [pid 51878:tid 51882] [client 74.234.86.1:14823] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeFs0knQhUtMbw9EsgbJbwAAAQI"]
[Fri Apr 17 07:12:19.986394 2026] [:error] [pid 9151:tid 9169] [client 74.234.86.1:5910] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-lo.php"] [unique_id "aeFs08hTVuRPkua22vTHMAAAAAg"]
[Fri Apr 17 07:12:21.224435 2026] [:error] [pid 9263:tid 9269] [client 74.234.86.1:29528] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-lo.php"] [unique_id "aeFs1RP68VyHNvj1e54_3QAAAMQ"]
[Fri Apr 17 07:12:22.637661 2026] [:error] [pid 25010:tid 25035] [client 74.234.86.1:18252] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-lo.php"] [unique_id "aeFs1o-7kkf42RarqQ3jkgAAAVY"]
[Fri Apr 17 07:12:23.659262 2026] [:error] [pid 9151:tid 9173] [client 74.234.86.1:17530] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-lo.php"] [unique_id "aeFs18hTVuRPkua22vTHNQAAAAw"]
[Fri Apr 17 07:12:24.611546 2026] [:error] [pid 9152:tid 9192] [client 74.234.86.1:15991] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fone1.php"] [unique_id "aeFs2JJYca8I3TNCwIdCywAAAEI"]
[Fri Apr 17 07:12:25.485384 2026] [:error] [pid 9152:tid 9200] [client 74.234.86.1:32168] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fone1.php"] [unique_id "aeFs2ZJYca8I3TNCwIdCzAAAAEo"]
[Fri Apr 17 07:12:26.393724 2026] [:error] [pid 9153:tid 9221] [client 74.234.86.1:15083] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fone1.php"] [unique_id "aeFs2uMHGxkTZX3c45dVEwAAAIM"]
[Fri Apr 17 07:12:28.322768 2026] [:error] [pid 9151:tid 9175] [client 74.234.86.1:15968] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fone1.php"] [unique_id "aeFs3MhTVuRPkua22vTHOgAAAA4"]
[Fri Apr 17 07:12:29.760557 2026] [:error] [pid 25010:tid 25014] [client 74.234.86.1:16427] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ipv6.php"] [unique_id "aeFs3Y-7kkf42RarqQ3jogAAAUE"]
[Fri Apr 17 07:12:31.849698 2026] [:error] [pid 25010:tid 25017] [client 74.234.86.1:15946] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ipv6.php"] [unique_id "aeFs34-7kkf42RarqQ3jqwAAAUQ"]
[Fri Apr 17 07:12:34.455561 2026] [:error] [pid 9153:tid 9238] [client 74.234.86.1:15261] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ipv6.php"] [unique_id "aeFs4uMHGxkTZX3c45dVTwAAAJQ"]
[Fri Apr 17 07:12:35.455290 2026] [:error] [pid 9152:tid 9214] [client 74.234.86.1:32210] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Ipv6.php"] [unique_id "aeFs45JYca8I3TNCwIdC0AAAAFg"]
[Fri Apr 17 07:12:36.882374 2026] [:error] [pid 9153:tid 9231] [client 74.234.86.1:22408] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "aeFs5OMHGxkTZX3c45dVWwAAAI0"]
[Fri Apr 17 07:12:38.517136 2026] [:error] [pid 51878:tid 51887] [client 74.234.86.1:14913] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "aeFs5knQhUtMbw9EsgbJkAAAAQc"]
[Fri Apr 17 07:12:39.657588 2026] [:error] [pid 9153:tid 9225] [client 74.234.86.1:5844] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "aeFs5-MHGxkTZX3c45dVawAAAIc"]
[Fri Apr 17 07:12:43.738372 2026] [:error] [pid 51878:tid 51891] [client 74.234.86.1:32986] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file-gertdxz.php"] [unique_id "aeFs60nQhUtMbw9EsgbJnwAAAQs"]
[Fri Apr 17 07:12:45.177199 2026] [:error] [pid 9152:tid 9204] [client 74.234.86.1:29530] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xper1.php"] [unique_id "aeFs7ZJYca8I3TNCwIdC4AAAAE4"]
[Fri Apr 17 07:12:46.022905 2026] [:error] [pid 9151:tid 9175] [client 74.234.86.1:17293] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xper1.php"] [unique_id "aeFs7shTVuRPkua22vTHTgAAAA4"]
[Fri Apr 17 07:12:46.730137 2026] [:error] [pid 9263:tid 9267] [client 74.234.86.1:32152] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xper1.php"] [unique_id "aeFs7hP68VyHNvj1e55ADgAAAMI"]
[Fri Apr 17 07:12:47.747921 2026] [:error] [pid 9263:tid 9289] [client 74.234.86.1:17474] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xper1.php"] [unique_id "aeFs7xP68VyHNvj1e55AEgAAANg"]
[Fri Apr 17 07:12:48.667504 2026] [:error] [pid 9153:tid 9228] [client 74.234.86.1:19759] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeFs8OMHGxkTZX3c45dVhwAAAIo"]
[Fri Apr 17 07:12:49.971408 2026] [:error] [pid 25010:tid 25036] [client 74.234.86.1:14962] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeFs8Y-7kkf42RarqQ3jxQAAAVc"]
[Fri Apr 17 07:12:54.737425 2026] [:error] [pid 9153:tid 9240] [client 74.234.86.1:17947] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeFs9uMHGxkTZX3c45dVlwAAAJY"]
[Fri Apr 17 07:12:56.541106 2026] [:error] [pid 9263:tid 9289] [client 74.234.86.1:17288] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeFs-BP68VyHNvj1e55AIgAAANg"]
[Fri Apr 17 07:12:58.735008 2026] [:error] [pid 9153:tid 9241] [client 74.234.86.1:16421] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wglum1.php"] [unique_id "aeFs-uMHGxkTZX3c45dVsgAAAJc"]
[Fri Apr 17 07:13:00.134112 2026] [:error] [pid 9153:tid 9219] [client 74.234.86.1:18273] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wglum1.php"] [unique_id "aeFs_OMHGxkTZX3c45dVuAAAAIE"]
[Fri Apr 17 07:13:01.803170 2026] [:error] [pid 9263:tid 9274] [client 74.234.86.1:22414] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wglum1.php"] [unique_id "aeFs_RP68VyHNvj1e55ALgAAAMk"]
[Fri Apr 17 07:13:03.852280 2026] [:error] [pid 25010:tid 25026] [client 74.234.86.1:16889] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wglum1.php"] [unique_id "aeFs_4-7kkf42RarqQ3j3QAAAU0"]
[Fri Apr 17 07:13:05.846347 2026] [:error] [pid 25010:tid 25023] [client 74.234.86.1:29529] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/saorix1.php"] [unique_id "aeFtAY-7kkf42RarqQ3j8AAAAUo"]
[Fri Apr 17 07:13:07.066844 2026] [:error] [pid 25010:tid 25013] [client 74.234.86.1:21399] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/saorix1.php"] [unique_id "aeFtA4-7kkf42RarqQ3kAgAAAUA"]
[Fri Apr 17 07:13:08.000361 2026] [:error] [pid 25010:tid 25029] [client 74.234.86.1:17312] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/saorix1.php"] [unique_id "aeFtA4-7kkf42RarqQ3kCQAAAVA"]
[Fri Apr 17 07:13:09.002134 2026] [:error] [pid 9151:tid 9178] [client 74.234.86.1:14934] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/saorix1.php"] [unique_id "aeFtBchTVuRPkua22vTHYQAAABE"]
[Fri Apr 17 07:13:10.483997 2026] [:error] [pid 51878:tid 51882] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/xper.php
[Fri Apr 17 07:13:10.745433 2026] [:error] [pid 51878:tid 51885] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/wxpass.php
[Fri Apr 17 07:13:11.010607 2026] [:error] [pid 51878:tid 51886] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Fri Apr 17 07:13:11.266712 2026] [:error] [pid 51878:tid 51902] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Apr 17 07:13:11.529662 2026] [:error] [pid 51878:tid 51883] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/x3x.php
[Fri Apr 17 07:13:11.786690 2026] [:error] [pid 51878:tid 51904] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Fri Apr 17 07:13:12.047135 2026] [:error] [pid 51878:tid 51893] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/global.php
[Fri Apr 17 07:13:12.302726 2026] [:error] [pid 51878:tid 51887] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Apr 17 07:13:12.570847 2026] [:error] [pid 51878:tid 51897] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Fri Apr 17 07:13:12.825340 2026] [:error] [pid 51878:tid 51899] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Fri Apr 17 07:13:13.080497 2026] [:error] [pid 51878:tid 51881] [client 74.234.86.1:15808] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Fri Apr 17 07:13:13.391142 2026] [:error] [pid 51878:tid 51885] [client 74.234.86.1:15808] [client 74.234.86.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/wincust.php"] [unique_id "aeFtCUnQhUtMbw9EsgbKBwAAAQU"]
[Fri Apr 17 07:13:15.911158 2026] [:error] [pid 9263:tid 9268] [client 74.234.86.1:18257] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aeFtCxP68VyHNvj1e55AOwAAAMM"]
[Fri Apr 17 07:13:17.222265 2026] [:error] [pid 9151:tid 9176] [client 74.234.86.1:18240] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aeFtDchTVuRPkua22vTHZgAAAA8"]
[Fri Apr 17 07:13:19.240713 2026] [:error] [pid 51878:tid 51896] [client 74.234.86.1:22774] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aeFtD0nQhUtMbw9EsgbKEQAAARA"]
[Fri Apr 17 07:13:20.062085 2026] [:error] [pid 51878:tid 51895] [client 74.234.86.1:15818] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aeFtEEnQhUtMbw9EsgbKFQAAAQ8"]
[Fri Apr 17 07:13:21.592072 2026] [:error] [pid 9152:tid 9193] [client 74.234.86.1:22766] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aeFtEZJYca8I3TNCwIdC-QAAAEM"]
[Fri Apr 17 07:13:22.920093 2026] [:error] [pid 9153:tid 9232] [client 74.234.86.1:17309] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aeFtEuMHGxkTZX3c45dV-QAAAI4"]
[Fri Apr 17 07:13:23.787975 2026] [:error] [pid 51878:tid 51904] [client 74.234.86.1:16508] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aeFtE0nQhUtMbw9EsgbKHAAAARg"]
[Fri Apr 17 07:13:25.078145 2026] [:error] [pid 51878:tid 51897] [client 74.234.86.1:22887] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aeFtFUnQhUtMbw9EsgbKJQAAARE"]
[Fri Apr 17 07:13:25.770657 2026] [:error] [pid 9151:tid 9171] [client 74.234.86.1:16474] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xltt.php"] [unique_id "aeFtFchTVuRPkua22vTHbQAAAAo"]
[Fri Apr 17 07:13:26.473360 2026] [:error] [pid 9151:tid 9169] [client 74.234.86.1:16420] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xltt.php"] [unique_id "aeFtFshTVuRPkua22vTHcQAAAAg"]
[Fri Apr 17 07:13:27.753041 2026] [:error] [pid 9152:tid 9198] [client 74.234.86.1:5751] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xltt.php"] [unique_id "aeFtF5JYca8I3TNCwIdDBAAAAEg"]
[Fri Apr 17 07:13:28.346561 2026] [:error] [pid 9151:tid 9178] [client 74.234.86.1:5625] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xltt.php"] [unique_id "aeFtGMhTVuRPkua22vTHfQAAABE"]
[Fri Apr 17 07:13:30.564840 2026] [:error] [pid 51878:tid 51895] [client 74.234.86.1:20615] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws57.php"] [unique_id "aeFtGknQhUtMbw9EsgbKKgAAAQ8"]
[Fri Apr 17 07:13:31.272285 2026] [:error] [pid 9153:tid 9224] [client 74.234.86.1:5960] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws57.php"] [unique_id "aeFtG-MHGxkTZX3c45dV_AAAAIY"]
[Fri Apr 17 07:13:32.081034 2026] [:error] [pid 9152:tid 9190] [client 74.234.86.1:15817] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws57.php"] [unique_id "aeFtHJJYca8I3TNCwIdDCgAAAEA"]
[Fri Apr 17 07:13:33.310671 2026] [:error] [pid 9153:tid 9236] [client 74.234.86.1:15415] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws57.php"] [unique_id "aeFtHeMHGxkTZX3c45dWBgAAAJI"]
[Fri Apr 17 07:13:34.226113 2026] [:error] [pid 25010:tid 25015] [client 74.234.86.1:14808] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws61.php"] [unique_id "aeFtHo-7kkf42RarqQ3kcAAAAUI"]
[Fri Apr 17 07:13:35.311127 2026] [:error] [pid 9153:tid 9237] [client 74.234.86.1:22729] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws61.php"] [unique_id "aeFtH-MHGxkTZX3c45dWDgAAAJM"]
[Fri Apr 17 07:13:36.347030 2026] [:error] [pid 51878:tid 51885] [client 74.234.86.1:22909] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws61.php"] [unique_id "aeFtIEnQhUtMbw9EsgbKOQAAAQU"]
[Fri Apr 17 07:13:37.222850 2026] [:error] [pid 9153:tid 9240] [client 74.234.86.1:26164] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws61.php"] [unique_id "aeFtIeMHGxkTZX3c45dWEgAAAJY"]
[Fri Apr 17 07:13:37.910798 2026] [:error] [pid 9151:tid 9182] [client 74.234.86.1:26128] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws66.php"] [unique_id "aeFtIchTVuRPkua22vTHfwAAABU"]
[Fri Apr 17 07:13:39.126794 2026] [:error] [pid 9152:tid 9200] [client 74.234.86.1:19227] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws66.php"] [unique_id "aeFtI5JYca8I3TNCwIdDEgAAAEo"]
[Fri Apr 17 07:13:39.936133 2026] [:error] [pid 51878:tid 51880] [client 74.234.86.1:17287] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws66.php"] [unique_id "aeFtI0nQhUtMbw9EsgbKPwAAAQA"]
[Fri Apr 17 07:13:40.737582 2026] [:error] [pid 9151:tid 9185] [client 74.234.86.1:22405] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws66.php"] [unique_id "aeFtJMhTVuRPkua22vTHggAAABg"]
[Fri Apr 17 07:13:41.831078 2026] [:error] [pid 25010:tid 25021] [client 74.234.86.1:33390] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aeFtJY-7kkf42RarqQ3kfgAAAUg"]
[Fri Apr 17 07:13:42.410984 2026] [:error] [pid 9151:tid 9167] [client 74.234.86.1:22907] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aeFtJshTVuRPkua22vTHiAAAAAY"]
[Fri Apr 17 07:13:44.164896 2026] [:error] [pid 9152:tid 9205] [client 74.234.86.1:17341] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aeFtKJJYca8I3TNCwIdDFwAAAE8"]
[Fri Apr 17 07:13:45.342167 2026] [:error] [pid 51878:tid 51897] [client 74.234.86.1:13746] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aeFtKUnQhUtMbw9EsgbKSgAAARE"]
[Fri Apr 17 07:13:46.303135 2026] [:error] [pid 25010:tid 25020] [client 74.234.86.1:21387] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xynz.php"] [unique_id "aeFtKo-7kkf42RarqQ3khQAAAUc"]
[Fri Apr 17 07:13:47.197984 2026] [:error] [pid 9152:tid 9202] [client 74.234.86.1:21483] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xynz.php"] [unique_id "aeFtK5JYca8I3TNCwIdDGgAAAEw"]
[Fri Apr 17 07:13:48.236028 2026] [:error] [pid 9152:tid 9193] [client 74.234.86.1:5941] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xynz.php"] [unique_id "aeFtLJJYca8I3TNCwIdDHQAAAEM"]
[Fri Apr 17 07:13:49.421227 2026] [:error] [pid 9152:tid 9209] [client 74.234.86.1:26169] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xynz.php"] [unique_id "aeFtLZJYca8I3TNCwIdDHgAAAFM"]
[Fri Apr 17 07:13:51.272775 2026] [:error] [pid 9152:tid 9205] [client 74.234.86.1:29549] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-01ul.php"] [unique_id "aeFtL5JYca8I3TNCwIdDKgAAAE8"]
[Fri Apr 17 07:13:56.978773 2026] [:error] [pid 9151:tid 9167] [client 74.234.86.1:32029] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-01ul.php"] [unique_id "aeFtNMhTVuRPkua22vTHmAAAAAY"]
[Fri Apr 17 07:13:58.659293 2026] [:error] [pid 25010:tid 25031] [client 74.234.86.1:23366] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-01ul.php"] [unique_id "aeFtNo-7kkf42RarqQ3kpAAAAVI"]
[Fri Apr 17 07:13:59.759199 2026] [:error] [pid 9151:tid 9161] [client 74.234.86.1:16472] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-01ul.php"] [unique_id "aeFtN8hTVuRPkua22vTHnAAAAAA"]
[Fri Apr 17 07:14:00.494138 2026] [:error] [pid 9153:tid 9239] [client 74.234.86.1:13711] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e7.php"] [unique_id "aeFtOOMHGxkTZX3c45dWLQAAAJU"]
[Fri Apr 17 07:14:01.432253 2026] [:error] [pid 51878:tid 51897] [client 74.234.86.1:13702] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e7.php"] [unique_id "aeFtOUnQhUtMbw9EsgbKbgAAARE"]
[Fri Apr 17 07:14:02.913955 2026] [:error] [pid 25010:tid 25026] [client 74.234.86.1:22707] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e7.php"] [unique_id "aeFtOo-7kkf42RarqQ3kqQAAAU0"]
[Fri Apr 17 07:14:03.826389 2026] [:error] [pid 9153:tid 9229] [client 74.234.86.1:32558] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e7.php"] [unique_id "aeFtO-MHGxkTZX3c45dWNQAAAIs"]
[Fri Apr 17 07:14:04.779447 2026] [:error] [pid 25010:tid 25037] [client 74.234.86.1:32536] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e3.php"] [unique_id "aeFtPI-7kkf42RarqQ3kqgAAAVg"]
[Fri Apr 17 07:14:05.597961 2026] [:error] [pid 9151:tid 9167] [client 74.234.86.1:26116] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e3.php"] [unique_id "aeFtPchTVuRPkua22vTHrwAAAAY"]
[Fri Apr 17 07:14:06.344066 2026] [:error] [pid 9263:tid 9271] [client 74.234.86.1:16409] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e3.php"] [unique_id "aeFtPhP68VyHNvj1e55AhQAAAMY"]
[Fri Apr 17 07:14:07.347887 2026] [:error] [pid 9153:tid 9232] [client 74.234.86.1:33368] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/e3.php"] [unique_id "aeFtP-MHGxkTZX3c45dWQAAAAI4"]
[Fri Apr 17 07:14:08.117474 2026] [:error] [pid 9153:tid 9219] [client 74.234.86.1:22434] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aevly.php"] [unique_id "aeFtQOMHGxkTZX3c45dWQQAAAIE"]
[Fri Apr 17 07:14:09.830623 2026] [:error] [pid 9153:tid 9229] [client 74.234.86.1:14826] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aevly.php"] [unique_id "aeFtQeMHGxkTZX3c45dWSQAAAIs"]
[Fri Apr 17 07:14:11.258029 2026] [:error] [pid 25010:tid 25023] [client 74.234.86.1:14415] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aevly.php"] [unique_id "aeFtQ4-7kkf42RarqQ3ktgAAAUo"]
[Fri Apr 17 07:14:13.125009 2026] [:error] [pid 9151:tid 9180] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Fri Apr 17 07:14:13.396447 2026] [:error] [pid 9151:tid 9184] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Fri Apr 17 07:14:13.667852 2026] [:error] [pid 9151:tid 9177] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Apr 17 07:14:13.939411 2026] [:error] [pid 9151:tid 9171] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Fri Apr 17 07:14:14.253146 2026] [:error] [pid 9151:tid 9185] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Fri Apr 17 07:14:14.523013 2026] [:error] [pid 9151:tid 9163] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Fri Apr 17 07:14:14.798750 2026] [:error] [pid 9151:tid 9167] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/Ov-Simple1.php
[Fri Apr 17 07:14:15.083621 2026] [:error] [pid 9151:tid 9161] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/curl.php
[Fri Apr 17 07:14:15.364911 2026] [:error] [pid 9151:tid 9164] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/sallu.php
[Fri Apr 17 07:14:15.637040 2026] [:error] [pid 9151:tid 9180] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Apr 17 07:14:15.907939 2026] [:error] [pid 9151:tid 9184] [client 74.234.86.1:21395] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Apr 17 07:14:16.185106 2026] [:error] [pid 9151:tid 9178] [client 74.234.86.1:21395] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aeFtSMhTVuRPkua22vTHywAAABE"]
[Fri Apr 17 07:14:17.140100 2026] [:error] [pid 9151:tid 9168] [client 74.234.86.1:22489] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aeFtSchTVuRPkua22vTHzAAAAAc"]
[Fri Apr 17 07:14:18.060934 2026] [:error] [pid 25010:tid 25029] [client 74.234.86.1:32025] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aeFtSo-7kkf42RarqQ3kyAAAAVA"]
[Fri Apr 17 07:14:18.901204 2026] [:error] [pid 9152:tid 9197] [client 74.234.86.1:21473] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aeFtSpJYca8I3TNCwIdDlAAAAEc"]
[Fri Apr 17 07:14:20.201942 2026] [:error] [pid 9153:tid 9230] [client 74.234.86.1:22463] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "aeFtTOMHGxkTZX3c45dWXAAAAIw"]
[Fri Apr 17 07:14:21.198073 2026] [:error] [pid 9263:tid 9287] [client 74.234.86.1:21429] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "aeFtTRP68VyHNvj1e55AlwAAANY"]
[Fri Apr 17 07:14:22.222744 2026] [:error] [pid 25010:tid 25028] [client 74.234.86.1:22512] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "aeFtTo-7kkf42RarqQ3k0wAAAU8"]
[Fri Apr 17 07:14:23.232912 2026] [:error] [pid 25010:tid 25031] [client 74.234.86.1:23375] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260325043000.php"] [unique_id "aeFtT4-7kkf42RarqQ3k2QAAAVI"]
[Fri Apr 17 07:14:24.068705 2026] [:error] [pid 25010:tid 25022] [client 74.234.86.1:16198] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "aeFtUI-7kkf42RarqQ3k3wAAAUk"]
[Fri Apr 17 07:14:25.101295 2026] [:error] [pid 25010:tid 25025] [client 74.234.86.1:15454] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "aeFtUY-7kkf42RarqQ3k4wAAAUw"]
[Fri Apr 17 07:14:25.745834 2026] [:error] [pid 25010:tid 25028] [client 74.234.86.1:22411] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "aeFtUY-7kkf42RarqQ3k5wAAAU8"]
[Fri Apr 17 07:14:27.405706 2026] [:error] [pid 9152:tid 9204] [client 74.234.86.1:18711] [client 74.234.86.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods_260401065719.php"] [unique_id "aeFtU5JYca8I3TNCwIdDmgAAAE4"]
[Fri Apr 17 14:44:36.985323 2026] [:error] [pid 25010:tid 25024] [client 136.109.188.98:49934] [client 136.109.188.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.production"] [unique_id "aeHW1I-7kkf42RarqQ1G4QAAAUs"]
[Fri Apr 17 14:45:20.582789 2026] [:error] [pid 9153:tid 9222] [client 136.109.188.98:36554] [client 136.109.188.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.old"] [unique_id "aeHXAOMHGxkTZX3c45fRCAAAAIQ"]
[Fri Apr 17 14:46:03.190925 2026] [:error] [pid 25010:tid 25014] [client 136.109.188.98:44648] [client 136.109.188.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/backend/.env"] [unique_id "aeHXK4-7kkf42RarqQ1HAwAAAUE"]
[Fri Apr 17 14:46:46.155041 2026] [:error] [pid 51878:tid 51887] [client 136.109.188.98:33228] [client 136.109.188.98] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/server/.env"] [unique_id "aeHXVknQhUtMbw9EsgYdVwAAAQc"]
[Fri Apr 17 16:19:31.374206 2026] [:error] [pid 61523:tid 61557] [client 43.166.129.247:44746] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeHtE8OaH-Pgc7WEf4Nq5QAAAc8"]
[Fri Apr 17 19:54:36.373830 2026] [:error] [pid 34273:tid 34289] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Fri Apr 17 19:54:36.639886 2026] [:error] [pid 34273:tid 34295] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Fri Apr 17 19:54:36.917135 2026] [:error] [pid 34273:tid 34291] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Fri Apr 17 19:54:37.450035 2026] [:error] [pid 34273:tid 34293] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 17 19:54:37.717133 2026] [:error] [pid 34273:tid 34292] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Fri Apr 17 19:54:38.330093 2026] [:error] [pid 34273:tid 34284] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Fri Apr 17 19:54:38.757843 2026] [:error] [pid 34273:tid 34296] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Fri Apr 17 19:54:39.039709 2026] [:error] [pid 34273:tid 34275] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Fri Apr 17 19:54:39.306012 2026] [:error] [pid 34273:tid 34282] [client 135.225.27.101:31143] File does not exist: /usr/local/apache/htdocs/suspended-page/admlo.php
[Fri Apr 17 19:54:45.583119 2026] [:error] [pid 51878:tid 51900] [client 135.225.27.101:13036] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aeIfhUnQhUtMbw9EsgZv4AAAARQ"]
[Fri Apr 17 19:54:46.508590 2026] [:error] [pid 51878:tid 51884] [client 135.225.27.101:17842] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aeIfhknQhUtMbw9EsgZv4wAAAQQ"]
[Fri Apr 17 19:54:47.197642 2026] [:error] [pid 51878:tid 51889] [client 135.225.27.101:13023] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aeIfh0nQhUtMbw9EsgZv5wAAAQk"]
[Fri Apr 17 19:54:49.093075 2026] [:error] [pid 51878:tid 51887] [client 135.225.27.101:17841] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeIfiUnQhUtMbw9EsgZv8AAAAQc"]
[Fri Apr 17 19:54:51.759960 2026] [:error] [pid 9152:tid 9211] [client 135.225.27.101:10243] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeIfi5JYca8I3TNCwIdMhwAAAFU"]
[Fri Apr 17 19:54:54.206750 2026] [:error] [pid 9152:tid 9190] [client 135.225.27.101:17598] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeIfjpJYca8I3TNCwIdMkwAAAEA"]
[Fri Apr 17 19:54:56.423280 2026] [:error] [pid 51878:tid 51899] [client 135.225.27.101:13001] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeIfkEnQhUtMbw9EsgZv-AAAARM"]
[Fri Apr 17 19:54:57.403386 2026] [:error] [pid 9151:tid 9166] [client 135.225.27.101:13118] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aeIfkchTVuRPkua22vQ0pwAAAAU"]
[Fri Apr 17 19:54:58.502940 2026] [:error] [pid 9153:tid 9239] [client 135.225.27.101:21298] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aeIfkuMHGxkTZX3c45f9_wAAAJU"]
[Fri Apr 17 19:54:59.875450 2026] [:error] [pid 51878:tid 51882] [client 135.225.27.101:17814] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aeIfk0nQhUtMbw9EsgZv-QAAAQI"]
[Fri Apr 17 19:55:01.010731 2026] [:error] [pid 25010:tid 25029] [client 135.225.27.101:5215] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "aeIflY-7kkf42RarqQ1rmAAAAVA"]
[Fri Apr 17 19:55:02.003037 2026] [:error] [pid 9153:tid 9229] [client 135.225.27.101:21249] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aeIfluMHGxkTZX3c45f-AgAAAIs"]
[Fri Apr 17 19:55:03.649522 2026] [:error] [pid 9151:tid 9175] [client 135.225.27.101:1961] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aeIfl8hTVuRPkua22vQ0sgAAAA4"]
[Fri Apr 17 19:55:04.518057 2026] [:error] [pid 9151:tid 9177] [client 135.225.27.101:17592] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aeIfmMhTVuRPkua22vQ0swAAABA"]
[Fri Apr 17 19:55:05.788562 2026] [:error] [pid 9153:tid 9225] [client 135.225.27.101:13076] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "aeIfmeMHGxkTZX3c45f-BgAAAIc"]
[Fri Apr 17 19:55:06.511647 2026] [:error] [pid 9153:tid 9223] [client 135.225.27.101:17808] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeIfmuMHGxkTZX3c45f-BwAAAIU"]
[Fri Apr 17 19:55:08.133623 2026] [:error] [pid 61523:tid 61558] [client 135.225.27.101:12422] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeIfnMOaH-Pgc7WEf4OxqwAAAdA"]
[Fri Apr 17 19:55:09.465910 2026] [:error] [pid 61523:tid 61556] [client 135.225.27.101:8374] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeIfncOaH-Pgc7WEf4OxsAAAAc4"]
[Fri Apr 17 19:55:10.829280 2026] [:error] [pid 51878:tid 51895] [client 135.225.27.101:21253] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeIfnknQhUtMbw9EsgZwAgAAAQ8"]
[Fri Apr 17 19:55:12.353154 2026] [:error] [pid 61523:tid 61557] [client 135.225.27.101:13009] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeIfoMOaH-Pgc7WEf4OxvQAAAc8"]
[Fri Apr 17 19:55:13.132130 2026] [:error] [pid 61523:tid 61558] [client 135.225.27.101:12992] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeIfocOaH-Pgc7WEf4OxwAAAAdA"]
[Fri Apr 17 19:55:14.326685 2026] [:error] [pid 61523:tid 61544] [client 135.225.27.101:13029] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeIfosOaH-Pgc7WEf4OxxQAAAcI"]
[Fri Apr 17 19:55:15.345989 2026] [:error] [pid 61523:tid 61545] [client 135.225.27.101:17553] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeIfo8OaH-Pgc7WEf4OxzAAAAcM"]
[Fri Apr 17 19:55:17.339495 2026] [:error] [pid 61523:tid 61555] [client 135.225.27.101:1972] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeIfpcOaH-Pgc7WEf4Ox1wAAAc0"]
[Fri Apr 17 19:55:18.428572 2026] [:error] [pid 9153:tid 9227] [client 135.225.27.101:31878] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeIfpuMHGxkTZX3c45f-CQAAAIk"]
[Fri Apr 17 19:55:19.147536 2026] [:error] [pid 9152:tid 9202] [client 135.225.27.101:10658] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeIfp5JYca8I3TNCwIdMuAAAAEw"]
[Fri Apr 17 19:55:19.971199 2026] [:error] [pid 9153:tid 9233] [client 135.225.27.101:1964] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeIfp-MHGxkTZX3c45f-CgAAAI8"]
[Fri Apr 17 19:55:20.730385 2026] [:error] [pid 9152:tid 9206] [client 135.225.27.101:31918] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aeIfqJJYca8I3TNCwIdMugAAAFA"]
[Fri Apr 17 19:55:21.492761 2026] [:error] [pid 9152:tid 9192] [client 135.225.27.101:1965] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aeIfqZJYca8I3TNCwIdMvAAAAEI"]
[Fri Apr 17 19:55:22.429056 2026] [:error] [pid 34273:tid 34290] [client 135.225.27.101:17543] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aeIfqmuQDW686mK3dgH31wAAAY8"]
[Fri Apr 17 19:55:23.753925 2026] [:error] [pid 25010:tid 25023] [client 135.225.27.101:24364] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tool.php"] [unique_id "aeIfq4-7kkf42RarqQ1rowAAAUo"]
[Fri Apr 17 19:55:25.253398 2026] [:error] [pid 9151:tid 9181] [client 135.225.27.101:16017] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aeIfrchTVuRPkua22vQ0ugAAABQ"]
[Fri Apr 17 19:55:26.132813 2026] [:error] [pid 9152:tid 9194] [client 135.225.27.101:31882] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aeIfrpJYca8I3TNCwIdMwgAAAEQ"]
[Fri Apr 17 19:55:27.666174 2026] [:error] [pid 34273:tid 34275] [client 135.225.27.101:1961] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aeIfr2uQDW686mK3dgH33gAAAYA"]
[Fri Apr 17 19:55:29.502108 2026] [:error] [pid 61523:tid 61544] [client 135.225.27.101:25963] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blogs.php"] [unique_id "aeIfscOaH-Pgc7WEf4OyBwAAAcI"]
[Fri Apr 17 19:55:30.771474 2026] [:error] [pid 9263:tid 9281] [client 135.225.27.101:5465] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aeIfshP68VyHNvj1e54jjAAAANA"]
[Fri Apr 17 19:55:32.310005 2026] [:error] [pid 34273:tid 34297] [client 135.225.27.101:23456] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aeIftGuQDW686mK3dgH34wAAAZY"]
[Fri Apr 17 19:55:33.611285 2026] [:error] [pid 9151:tid 9180] [client 135.225.27.101:5495] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aeIftchTVuRPkua22vQ0wgAAABM"]
[Fri Apr 17 19:55:34.840846 2026] [:error] [pid 34273:tid 34289] [client 135.225.27.101:10953] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aeIftmuQDW686mK3dgH35wAAAY4"]
[Fri Apr 17 19:55:36.165851 2026] [:error] [pid 61523:tid 61550] [client 135.225.27.101:5484] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aeIfuMOaH-Pgc7WEf4OyEAAAAcg"]
[Fri Apr 17 19:55:37.264748 2026] [:error] [pid 51878:tid 51881] [client 135.225.27.101:31892] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aeIfuUnQhUtMbw9EsgZwHQAAAQE"]
[Fri Apr 17 19:55:38.328003 2026] [:error] [pid 51878:tid 51889] [client 135.225.27.101:25923] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aeIfuknQhUtMbw9EsgZwIgAAAQk"]
[Fri Apr 17 19:55:39.613911 2026] [:error] [pid 51878:tid 51901] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Fri Apr 17 19:55:39.921323 2026] [:error] [pid 51878:tid 51886] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Fri Apr 17 19:55:40.189765 2026] [:error] [pid 51878:tid 51893] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Fri Apr 17 19:55:40.463908 2026] [:error] [pid 51878:tid 51885] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Fri Apr 17 19:55:40.741274 2026] [:error] [pid 51878:tid 51884] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/166.php
[Fri Apr 17 19:55:41.156798 2026] [:error] [pid 51878:tid 51890] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/bmi.php
[Fri Apr 17 19:55:41.435413 2026] [:error] [pid 51878:tid 51883] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Apr 17 19:55:41.901161 2026] [:error] [pid 51878:tid 51899] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Fri Apr 17 19:55:42.167148 2026] [:error] [pid 51878:tid 51903] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/dass.php
[Fri Apr 17 19:55:42.439056 2026] [:error] [pid 51878:tid 51885] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Fri Apr 17 19:55:42.704603 2026] [:error] [pid 51878:tid 51892] [client 135.225.27.101:5456] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Fri Apr 17 19:55:42.967439 2026] [:error] [pid 51878:tid 51888] [client 135.225.27.101:5456] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "aeIfvknQhUtMbw9EsgZwRwAAAQg"]
[Fri Apr 17 19:55:44.219470 2026] [:error] [pid 34273:tid 34298] [client 135.225.27.101:17325] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "aeIfwGuQDW686mK3dgH3-AAAAZc"]
[Fri Apr 17 19:55:46.152917 2026] [:error] [pid 34273:tid 34275] [client 135.225.27.101:5209] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "aeIfwmuQDW686mK3dgH3_gAAAYA"]
[Fri Apr 17 19:55:47.538602 2026] [:error] [pid 9152:tid 9192] [client 135.225.27.101:17543] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "aeIfw5JYca8I3TNCwIdM1QAAAEI"]
[Fri Apr 17 19:55:48.690516 2026] [:error] [pid 51878:tid 51890] [client 135.225.27.101:13103] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aeIfxEnQhUtMbw9EsgZwUgAAAQo"]
[Fri Apr 17 19:55:49.788735 2026] [:error] [pid 51878:tid 51893] [client 135.225.27.101:5475] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aeIfxUnQhUtMbw9EsgZwWgAAAQ0"]
[Fri Apr 17 19:55:50.887849 2026] [:error] [pid 9263:tid 9286] [client 135.225.27.101:25440] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aeIfxhP68VyHNvj1e54jqAAAANU"]
[Fri Apr 17 19:55:51.750103 2026] [:error] [pid 9263:tid 9282] [client 135.225.27.101:1048] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s.php"] [unique_id "aeIfxxP68VyHNvj1e54jrwAAANE"]
[Fri Apr 17 19:55:52.560572 2026] [:error] [pid 9263:tid 9269] [client 135.225.27.101:17327] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aeIfyBP68VyHNvj1e54jtgAAAMQ"]
[Fri Apr 17 19:55:53.224992 2026] [:error] [pid 9263:tid 9268] [client 135.225.27.101:17564] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aeIfyRP68VyHNvj1e54juQAAAMM"]
[Fri Apr 17 19:55:54.154244 2026] [:error] [pid 9263:tid 9287] [client 135.225.27.101:1063] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aeIfyhP68VyHNvj1e54juwAAANY"]
[Fri Apr 17 19:55:55.066932 2026] [:error] [pid 9263:tid 9267] [client 135.225.27.101:16010] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/first.php"] [unique_id "aeIfyxP68VyHNvj1e54jwAAAAMI"]
[Fri Apr 17 19:55:56.036175 2026] [:error] [pid 9263:tid 9278] [client 135.225.27.101:5447] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "aeIfzBP68VyHNvj1e54jxgAAAM0"]
[Fri Apr 17 19:55:57.402871 2026] [:error] [pid 9153:tid 9237] [client 135.225.27.101:17290] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "aeIfzeMHGxkTZX3c45f-MgAAAJM"]
[Fri Apr 17 19:55:58.462141 2026] [:error] [pid 61523:tid 61552] [client 135.225.27.101:31879] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "aeIfzsOaH-Pgc7WEf4OyIgAAAco"]
[Fri Apr 17 19:56:00.708667 2026] [:error] [pid 9153:tid 9240] [client 135.225.27.101:21853] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "aeIf0OMHGxkTZX3c45f-OAAAAJY"]
[Fri Apr 17 19:56:02.801421 2026] [:error] [pid 34273:tid 34282] [client 135.225.27.101:31909] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeIf0muQDW686mK3dgH4BQAAAYc"]
[Fri Apr 17 19:56:06.177248 2026] [:error] [pid 9151:tid 9172] [client 135.225.27.101:17341] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeIf1shTVuRPkua22vQ00AAAAAs"]
[Fri Apr 17 19:56:07.188192 2026] [:error] [pid 9151:tid 9165] [client 135.225.27.101:25466] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeIf18hTVuRPkua22vQ01AAAAAQ"]
[Fri Apr 17 19:56:08.709869 2026] [:error] [pid 34273:tid 34295] [client 135.225.27.101:12856] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeIf2GuQDW686mK3dgH4DQAAAZQ"]
[Fri Apr 17 19:56:10.141514 2026] [:error] [pid 9152:tid 9197] [client 135.225.27.101:23939] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeIf2pJYca8I3TNCwIdM5gAAAEc"]
[Fri Apr 17 19:56:11.738781 2026] [:error] [pid 9153:tid 9234] [client 135.225.27.101:21850] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeIf2-MHGxkTZX3c45f-TQAAAJA"]
[Fri Apr 17 19:56:12.987593 2026] [:error] [pid 34273:tid 34289] [client 135.225.27.101:60708] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeIf3GuQDW686mK3dgH4DgAAAY4"]
[Fri Apr 17 19:56:14.108371 2026] [:error] [pid 61523:tid 61546] [client 135.225.27.101:23758] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeIf3sOaH-Pgc7WEf4OyLQAAAcQ"]
[Fri Apr 17 19:56:15.658381 2026] [:error] [pid 51878:tid 51894] [client 135.225.27.101:39676] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aeIf30nQhUtMbw9EsgZwagAAAQ4"]
[Fri Apr 17 19:56:16.847977 2026] [:error] [pid 9151:tid 9162] [client 135.225.27.101:12862] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aeIf4MhTVuRPkua22vQ03QAAAAE"]
[Fri Apr 17 19:56:17.691701 2026] [:error] [pid 34273:tid 34290] [client 135.225.27.101:13638] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aeIf4WuQDW686mK3dgH4FQAAAY8"]
[Fri Apr 17 19:56:19.804187 2026] [:error] [pid 9263:tid 9279] [client 135.225.27.101:13164] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/vx.php"] [unique_id "aeIf4xP68VyHNvj1e54j5gAAAM4"]
[Fri Apr 17 19:56:22.005813 2026] [:error] [pid 9152:tid 9201] [client 135.225.27.101:13132] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeIf5pJYca8I3TNCwIdM9gAAAEs"]
[Fri Apr 17 19:56:26.647979 2026] [:error] [pid 61523:tid 61553] [client 135.225.27.101:26192] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeIf6sOaH-Pgc7WEf4OyOQAAAcs"]
[Fri Apr 17 19:56:28.463114 2026] [:error] [pid 61523:tid 61543] [client 135.225.27.101:11184] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeIf7MOaH-Pgc7WEf4OyPQAAAcE"]
[Fri Apr 17 19:56:30.315702 2026] [:error] [pid 61523:tid 61552] [client 135.225.27.101:9676] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeIf7sOaH-Pgc7WEf4OyTAAAAco"]
[Fri Apr 17 19:56:31.911047 2026] [:error] [pid 51878:tid 51884] [client 135.225.27.101:28355] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeIf70nQhUtMbw9EsgZwfQAAAQQ"]
[Fri Apr 17 19:56:32.852750 2026] [:error] [pid 9263:tid 9265] [client 135.225.27.101:5344] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeIf8BP68VyHNvj1e54j7wAAAMA"]
[Fri Apr 17 19:56:33.955873 2026] [:error] [pid 9263:tid 9288] [client 135.225.27.101:5182] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeIf8RP68VyHNvj1e54j8wAAANc"]
[Fri Apr 17 19:56:35.111948 2026] [:error] [pid 9152:tid 9206] [client 135.225.27.101:13398] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeIf85JYca8I3TNCwIdNFwAAAFA"]
[Fri Apr 17 19:56:35.965706 2026] [:error] [pid 61523:tid 61559] [client 135.225.27.101:1568] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeIf88OaH-Pgc7WEf4OyUQAAAdE"]
[Fri Apr 17 19:56:36.987197 2026] [:error] [pid 51878:tid 51883] [client 135.225.27.101:8625] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeIf9EnQhUtMbw9EsgZwgwAAAQM"]
[Fri Apr 17 19:56:37.867344 2026] [:error] [pid 61523:tid 61550] [client 135.225.27.101:20218] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeIf9cOaH-Pgc7WEf4OyVgAAAcg"]
[Fri Apr 17 19:56:38.771753 2026] [:error] [pid 61523:tid 61561] [client 135.225.27.101:26379] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeIf9sOaH-Pgc7WEf4OyWAAAAdM"]
[Fri Apr 17 19:56:40.353975 2026] [:error] [pid 9152:tid 9210] [client 135.225.27.101:10720] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aeIf-JJYca8I3TNCwIdNIAAAAFQ"]
[Fri Apr 17 19:56:41.083626 2026] [:error] [pid 61523:tid 61549] [client 135.225.27.101:39589] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "aeIf-cOaH-Pgc7WEf4OyXwAAAcc"]
[Fri Apr 17 19:56:42.236850 2026] [:error] [pid 34273:tid 34297] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Fri Apr 17 19:56:42.522734 2026] [:error] [pid 34273:tid 34288] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Apr 17 19:56:42.828897 2026] [:error] [pid 34273:tid 34298] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/900.php
[Fri Apr 17 19:56:43.113594 2026] [:error] [pid 34273:tid 34285] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 17 19:56:43.398900 2026] [:error] [pid 34273:tid 34293] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Fri Apr 17 19:56:44.011864 2026] [:error] [pid 34273:tid 34292] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Fri Apr 17 19:56:44.501322 2026] [:error] [pid 34273:tid 34280] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/sid3.php
[Fri Apr 17 19:56:46.260859 2026] [:error] [pid 34273:tid 34284] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Fri Apr 17 19:56:46.564370 2026] [:error] [pid 34273:tid 34296] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Fri Apr 17 19:56:46.845830 2026] [:error] [pid 34273:tid 34294] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Fri Apr 17 19:56:47.222467 2026] [:error] [pid 34273:tid 34281] [client 135.225.27.101:25638] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Fri Apr 17 19:56:47.515388 2026] [:error] [pid 34273:tid 34278] [client 135.225.27.101:25638] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeIf_2uQDW686mK3dgH4UwAAAYM"]
[Fri Apr 17 19:56:48.437928 2026] [:error] [pid 9151:tid 9185] [client 135.225.27.101:10907] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeIgAMhTVuRPkua22vQ05AAAABg"]
[Fri Apr 17 19:56:49.439469 2026] [:error] [pid 9263:tid 9281] [client 135.225.27.101:10389] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeIgARP68VyHNvj1e54kHwAAANA"]
[Fri Apr 17 19:56:51.028359 2026] [:error] [pid 61523:tid 61558] [client 135.225.27.101:14298] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aeIgA8OaH-Pgc7WEf4OygQAAAdA"]
[Fri Apr 17 19:56:51.997059 2026] [:error] [pid 34273:tid 34297] [client 135.225.27.101:10428] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws48.php"] [unique_id "aeIgA2uQDW686mK3dgH4WQAAAZY"]
[Fri Apr 17 19:56:53.323026 2026] [:error] [pid 34273:tid 34280] [client 135.225.27.101:1902] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws48.php"] [unique_id "aeIgBWuQDW686mK3dgH4XQAAAYU"]
[Fri Apr 17 19:56:54.099576 2026] [:error] [pid 34273:tid 34296] [client 135.225.27.101:25615] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws48.php"] [unique_id "aeIgBmuQDW686mK3dgH4YAAAAZU"]
[Fri Apr 17 19:56:55.213264 2026] [:error] [pid 25010:tid 25035] [client 135.225.27.101:10601] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws48.php"] [unique_id "aeIgB4-7kkf42RarqQ1r4AAAAVY"]
[Fri Apr 17 19:56:57.010180 2026] [:error] [pid 9263:tid 9266] [client 135.225.27.101:1871] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeIgCRP68VyHNvj1e54kQAAAAME"]
[Fri Apr 17 19:56:58.545074 2026] [:error] [pid 34273:tid 34277] [client 135.225.27.101:10747] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeIgCmuQDW686mK3dgH4aAAAAYI"]
[Fri Apr 17 19:57:00.061711 2026] [:error] [pid 9263:tid 9283] [client 135.225.27.101:14286] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeIgDBP68VyHNvj1e54kUQAAANI"]
[Fri Apr 17 19:57:01.407827 2026] [:error] [pid 9151:tid 9167] [client 135.225.27.101:1858] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeIgDchTVuRPkua22vQ05wAAAAY"]
[Fri Apr 17 19:57:04.746387 2026] [:error] [pid 34273:tid 34285] [client 135.225.27.101:19962] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeIgEGuQDW686mK3dgH4bwAAAYo"]
[Fri Apr 17 19:57:06.667696 2026] [:error] [pid 34273:tid 34280] [client 135.225.27.101:23529] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeIgEmuQDW686mK3dgH4dAAAAYU"]
[Fri Apr 17 19:57:09.057280 2026] [:error] [pid 61523:tid 61558] [client 135.225.27.101:25661] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeIgFcOaH-Pgc7WEf4OyiwAAAdA"]
[Fri Apr 17 19:57:11.198683 2026] [:error] [pid 51878:tid 51901] [client 135.225.27.101:8576] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeIgF0nQhUtMbw9EsgZwmAAAARU"]
[Fri Apr 17 19:57:12.481989 2026] [:error] [pid 9152:tid 9198] [client 135.225.27.101:12250] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aeIgGJJYca8I3TNCwIdNJQAAAEg"]
[Fri Apr 17 19:57:13.482493 2026] [:error] [pid 9152:tid 9210] [client 135.225.27.101:57046] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aeIgGZJYca8I3TNCwIdNJwAAAFQ"]
[Fri Apr 17 19:57:14.752786 2026] [:error] [pid 9151:tid 9165] [client 135.225.27.101:31918] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aeIgGshTVuRPkua22vQ07gAAAAQ"]
[Fri Apr 17 19:57:16.339049 2026] [:error] [pid 25010:tid 25035] [client 135.225.27.101:10917] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aeIgHI-7kkf42RarqQ1r6wAAAVY"]
[Fri Apr 17 19:57:17.187158 2026] [:error] [pid 9152:tid 9198] [client 135.225.27.101:21546] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeIgHZJYca8I3TNCwIdNPAAAAEg"]
[Fri Apr 17 19:57:19.195181 2026] [:error] [pid 9263:tid 9285] [client 135.225.27.101:1589] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeIgHxP68VyHNvj1e54kfwAAANQ"]
[Fri Apr 17 19:57:20.498008 2026] [:error] [pid 51878:tid 51894] [client 135.225.27.101:1570] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeIgIEnQhUtMbw9EsgZwsAAAAQ4"]
[Fri Apr 17 19:57:22.858664 2026] [:error] [pid 61523:tid 61551] [client 135.225.27.101:19075] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wen.php"] [unique_id "aeIgIsOaH-Pgc7WEf4OymwAAAck"]
[Fri Apr 17 19:57:24.597916 2026] [:error] [pid 51878:tid 51895] [client 135.225.27.101:10307] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aeIgJEnQhUtMbw9EsgZwtgAAAQ8"]
[Fri Apr 17 19:57:26.309125 2026] [:error] [pid 9152:tid 9199] [client 135.225.27.101:9726] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aeIgJpJYca8I3TNCwIdNUQAAAEk"]
[Fri Apr 17 19:57:27.856335 2026] [:error] [pid 9152:tid 9196] [client 135.225.27.101:15804] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aeIgJ5JYca8I3TNCwIdNVQAAAEY"]
[Fri Apr 17 19:57:29.128167 2026] [:error] [pid 51878:tid 51898] [client 135.225.27.101:56960] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bnm.php"] [unique_id "aeIgKUnQhUtMbw9EsgZwxQAAARI"]
[Fri Apr 17 19:57:30.597635 2026] [:error] [pid 9263:tid 9272] [client 135.225.27.101:12502] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeIgKhP68VyHNvj1e54khwAAAMc"]
[Fri Apr 17 19:57:33.577324 2026] [:error] [pid 9153:tid 9240] [client 135.225.27.101:13624] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeIgLeMHGxkTZX3c45f-bAAAAJY"]
[Fri Apr 17 19:57:35.868298 2026] [:error] [pid 9263:tid 9287] [client 135.225.27.101:23253] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeIgLxP68VyHNvj1e54kjQAAANY"]
[Fri Apr 17 19:57:36.735877 2026] [:error] [pid 34273:tid 34288] [client 135.225.27.101:7833] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeIgMGuQDW686mK3dgH4jgAAAY0"]
[Fri Apr 17 19:57:37.705633 2026] [:error] [pid 9263:tid 9270] [client 135.225.27.101:17369] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeIgMRP68VyHNvj1e54kkAAAAMU"]
[Fri Apr 17 19:57:38.497131 2026] [:error] [pid 9263:tid 9274] [client 135.225.27.101:9549] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeIgMhP68VyHNvj1e54klgAAAMk"]
[Fri Apr 17 19:57:40.052392 2026] [:error] [pid 51878:tid 51887] [client 135.225.27.101:28825] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeIgNEnQhUtMbw9EsgZw1gAAAQc"]
[Fri Apr 17 19:57:42.954887 2026] [:error] [pid 9263:tid 9285] [client 135.225.27.101:23479] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeIgNhP68VyHNvj1e54kngAAANQ"]
[Fri Apr 17 19:57:45.337102 2026] [:error] [pid 34273:tid 34282] [client 135.225.27.101:5240] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeIgOWuQDW686mK3dgH4lQAAAYc"]
[Fri Apr 17 19:57:46.970108 2026] [:error] [pid 9263:tid 9276] [client 135.225.27.101:21265] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeIgOhP68VyHNvj1e54kogAAAMs"]
[Fri Apr 17 19:57:48.035862 2026] [:error] [pid 51878:tid 51898] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Fri Apr 17 19:57:48.454552 2026] [:error] [pid 51878:tid 51892] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Fri Apr 17 19:57:48.736081 2026] [:error] [pid 51878:tid 51902] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Fri Apr 17 19:57:49.067188 2026] [:error] [pid 51878:tid 51887] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Fri Apr 17 19:57:49.336868 2026] [:error] [pid 51878:tid 51891] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Fri Apr 17 19:57:49.603210 2026] [:error] [pid 51878:tid 51889] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/tt.php
[Fri Apr 17 19:57:49.881803 2026] [:error] [pid 51878:tid 51900] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Fri Apr 17 19:57:50.148444 2026] [:error] [pid 51878:tid 51881] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/yw5bi63u.php
[Fri Apr 17 19:57:50.448839 2026] [:error] [pid 51878:tid 51892] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Fri Apr 17 19:57:50.774970 2026] [:error] [pid 51878:tid 51902] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Fri Apr 17 19:57:51.042385 2026] [:error] [pid 51878:tid 51882] [client 135.225.27.101:8436] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Fri Apr 17 19:57:51.303360 2026] [:error] [pid 51878:tid 51891] [client 135.225.27.101:8436] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeIgP0nQhUtMbw9EsgZw_wAAAQs"]
[Fri Apr 17 19:57:52.093796 2026] [:error] [pid 34273:tid 34289] [client 135.225.27.101:14196] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeIgQGuQDW686mK3dgH4pwAAAY4"]
[Fri Apr 17 19:57:52.980200 2026] [:error] [pid 25010:tid 25027] [client 135.225.27.101:10494] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeIgQI-7kkf42RarqQ1r-wAAAU4"]
[Fri Apr 17 19:57:54.056192 2026] [:error] [pid 51878:tid 51899] [client 135.225.27.101:47403] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeIgQknQhUtMbw9EsgZxAwAAARM"]
[Fri Apr 17 19:57:55.074891 2026] [:error] [pid 9263:tid 9285] [client 135.225.27.101:25398] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeIgQxP68VyHNvj1e54kqAAAANQ"]
[Fri Apr 17 19:57:56.149858 2026] [:error] [pid 9153:tid 9232] [client 135.225.27.101:19334] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeIgROMHGxkTZX3c45f-dQAAAI4"]
[Fri Apr 17 19:57:57.063318 2026] [:error] [pid 9263:tid 9276] [client 135.225.27.101:16635] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeIgRRP68VyHNvj1e54krwAAAMs"]
[Fri Apr 17 19:57:59.327364 2026] [:error] [pid 61523:tid 61557] [client 135.225.27.101:18830] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeIgR8OaH-Pgc7WEf4OytQAAAc8"]
[Fri Apr 17 19:58:00.637850 2026] [:error] [pid 34273:tid 34293] [client 135.225.27.101:7620] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeIgSGuQDW686mK3dgH4qwAAAZI"]
[Fri Apr 17 19:58:02.006214 2026] [:error] [pid 9153:tid 9242] [client 135.225.27.101:24599] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeIgSuMHGxkTZX3c45f-dwAAAJg"]
[Fri Apr 17 19:58:03.302134 2026] [:error] [pid 9263:tid 9269] [client 135.225.27.101:15612] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeIgSxP68VyHNvj1e54ktQAAAMQ"]
[Fri Apr 17 19:58:04.137568 2026] [:error] [pid 9263:tid 9275] [client 135.225.27.101:20099] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeIgTBP68VyHNvj1e54kuAAAAMo"]
[Fri Apr 17 19:58:05.204698 2026] [:error] [pid 51878:tid 51898] [client 135.225.27.101:15504] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeIgTUnQhUtMbw9EsgZxGwAAARI"]
[Fri Apr 17 19:58:06.009380 2026] [:error] [pid 34273:tid 34276] [client 135.225.27.101:15544] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeIgTmuQDW686mK3dgH4rgAAAYE"]
[Fri Apr 17 19:58:06.864411 2026] [:error] [pid 9153:tid 9234] [client 135.225.27.101:20142] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeIgTuMHGxkTZX3c45f-fAAAAJA"]
[Fri Apr 17 19:58:07.970546 2026] [:error] [pid 9152:tid 9200] [client 135.225.27.101:8649] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeIgT5JYca8I3TNCwIdNZwAAAEo"]
[Fri Apr 17 19:58:09.191994 2026] [:error] [pid 9152:tid 9213] [client 135.225.27.101:21504] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aeIgUZJYca8I3TNCwIdNbAAAAFc"]
[Fri Apr 17 19:58:11.111384 2026] [:error] [pid 51878:tid 51904] [client 135.225.27.101:61247] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aeIgU0nQhUtMbw9EsgZxIwAAARg"]
[Fri Apr 17 19:58:12.147565 2026] [:error] [pid 9263:tid 9276] [client 135.225.27.101:10521] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aeIgVBP68VyHNvj1e54kzAAAAMs"]
[Fri Apr 17 19:58:13.118284 2026] [:error] [pid 61523:tid 61559] [client 135.225.27.101:6387] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aeIgVcOaH-Pgc7WEf4OyxQAAAdE"]
[Fri Apr 17 19:58:13.917538 2026] [:error] [pid 9153:tid 9221] [client 135.225.27.101:5277] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/set.php"] [unique_id "aeIgVeMHGxkTZX3c45f-fgAAAIM"]
[Fri Apr 17 19:58:14.781307 2026] [:error] [pid 51878:tid 51891] [client 135.225.27.101:24433] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/set.php"] [unique_id "aeIgVknQhUtMbw9EsgZxKwAAAQs"]
[Fri Apr 17 19:58:15.737744 2026] [:error] [pid 51878:tid 51900] [client 135.225.27.101:14101] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/set.php"] [unique_id "aeIgV0nQhUtMbw9EsgZxLQAAARQ"]
[Fri Apr 17 19:58:16.465127 2026] [:error] [pid 51878:tid 51892] [client 135.225.27.101:25857] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/set.php"] [unique_id "aeIgWEnQhUtMbw9EsgZxMQAAAQw"]
[Fri Apr 17 19:58:17.430583 2026] [:error] [pid 9152:tid 9198] [client 135.225.27.101:6378] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hroxw.php"] [unique_id "aeIgWZJYca8I3TNCwIdNdAAAAEg"]
[Fri Apr 17 19:58:18.502330 2026] [:error] [pid 9152:tid 9203] [client 135.225.27.101:21524] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hroxw.php"] [unique_id "aeIgWpJYca8I3TNCwIdNdQAAAE0"]
[Fri Apr 17 19:58:20.228113 2026] [:error] [pid 61523:tid 61548] [client 135.225.27.101:12745] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hroxw.php"] [unique_id "aeIgXMOaH-Pgc7WEf4Oy0QAAAcY"]
[Fri Apr 17 19:58:20.994666 2026] [:error] [pid 9152:tid 9204] [client 135.225.27.101:22271] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hroxw.php"] [unique_id "aeIgXJJYca8I3TNCwIdNeQAAAE4"]
[Fri Apr 17 19:58:22.468823 2026] [:error] [pid 61523:tid 61552] [client 135.225.27.101:6399] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeIgXsOaH-Pgc7WEf4Oy1QAAAco"]
[Fri Apr 17 19:58:23.474592 2026] [:error] [pid 61523:tid 61565] [client 135.225.27.101:53215] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeIgX8OaH-Pgc7WEf4Oy3QAAAdc"]
[Fri Apr 17 19:58:24.368059 2026] [:error] [pid 9151:tid 9184] [client 135.225.27.101:53240] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeIgYMhTVuRPkua22vQ1BgAAABc"]
[Fri Apr 17 19:58:25.115787 2026] [:error] [pid 34273:tid 34299] [client 135.225.27.101:2022] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeIgYWuQDW686mK3dgH4wwAAAZg"]
[Fri Apr 17 19:58:26.180873 2026] [:error] [pid 9152:tid 9208] [client 135.225.27.101:22258] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeIgYpJYca8I3TNCwIdNggAAAFI"]
[Fri Apr 17 19:58:27.406909 2026] [:error] [pid 34273:tid 34286] [client 135.225.27.101:7246] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeIgY2uQDW686mK3dgH4xQAAAYs"]
[Fri Apr 17 19:58:28.930191 2026] [:error] [pid 34273:tid 34292] [client 135.225.27.101:12740] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeIgZGuQDW686mK3dgH4yAAAAZE"]
[Fri Apr 17 19:58:29.924619 2026] [:error] [pid 51878:tid 51884] [client 135.225.27.101:61185] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeIgZUnQhUtMbw9EsgZxXQAAAQQ"]
[Fri Apr 17 19:58:30.647007 2026] [:error] [pid 61523:tid 61559] [client 135.225.27.101:15831] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aeIgZsOaH-Pgc7WEf4Oy6AAAAdE"]
[Fri Apr 17 19:58:31.881613 2026] [:error] [pid 61523:tid 61558] [client 135.225.27.101:12684] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aeIgZ8OaH-Pgc7WEf4Oy7AAAAdA"]
[Fri Apr 17 19:58:32.662356 2026] [:error] [pid 34273:tid 34293] [client 135.225.27.101:5253] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aeIgaGuQDW686mK3dgH4ygAAAZI"]
[Fri Apr 17 19:58:33.426733 2026] [:error] [pid 34273:tid 34294] [client 135.225.27.101:26467] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gaza.php"] [unique_id "aeIgaWuQDW686mK3dgH4zAAAAZM"]
[Fri Apr 17 19:58:35.171007 2026] [:error] [pid 9152:tid 9212] [client 135.225.27.101:5306] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeIga5JYca8I3TNCwIdNjQAAAFY"]
[Fri Apr 17 19:58:35.909511 2026] [:error] [pid 61523:tid 61546] [client 135.225.27.101:1993] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeIga8OaH-Pgc7WEf4Oy8gAAAcQ"]
[Fri Apr 17 19:58:37.820354 2026] [:error] [pid 61523:tid 61560] [client 135.225.27.101:7245] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeIgbcOaH-Pgc7WEf4Oy9wAAAdI"]
[Fri Apr 17 19:58:39.291633 2026] [:error] [pid 51878:tid 51884] [client 135.225.27.101:53232] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeIgb0nQhUtMbw9EsgZxbAAAAQQ"]
[Fri Apr 17 19:58:39.983008 2026] [:error] [pid 9152:tid 9200] [client 135.225.27.101:6429] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "aeIgb5JYca8I3TNCwIdNlAAAAEo"]
[Fri Apr 17 19:58:40.706608 2026] [:error] [pid 9152:tid 9190] [client 135.225.27.101:1442] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "aeIgcJJYca8I3TNCwIdNlwAAAEA"]
[Fri Apr 17 19:58:41.388897 2026] [:error] [pid 61523:tid 61552] [client 135.225.27.101:60741] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "aeIgccOaH-Pgc7WEf4Oy_wAAAco"]
[Fri Apr 17 19:58:42.043290 2026] [:error] [pid 61523:tid 61562] [client 135.225.27.101:7236] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi001.PhP7"] [unique_id "aeIgcsOaH-Pgc7WEf4OzAgAAAdQ"]
[Fri Apr 17 19:58:42.995071 2026] [:error] [pid 61523:tid 61551] [client 135.225.27.101:6439] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeIgcsOaH-Pgc7WEf4OzBgAAAck"]
[Fri Apr 17 19:58:44.081736 2026] [:error] [pid 9263:tid 9269] [client 135.225.27.101:28891] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeIgdBP68VyHNvj1e54k5AAAAMQ"]
[Fri Apr 17 19:58:46.055418 2026] [:error] [pid 9263:tid 9284] [client 135.225.27.101:7261] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeIgdhP68VyHNvj1e54k6AAAANM"]
[Fri Apr 17 19:58:50.622376 2026] [:error] [pid 51878:tid 51900] [client 135.225.27.101:47329] [client 135.225.27.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeIgeknQhUtMbw9EsgZxfgAAARQ"]
[Fri Apr 17 19:58:51.392747 2026] [:error] [pid 51878:tid 51897] [client 135.225.27.101:10601] [client 135.225.27.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aeIge0nQhUtMbw9EsgZxgAAAARE"]
[Sat Apr 18 00:08:57.270180 2026] [:error] [pid 59136:tid 59142] [client 43.165.65.75:44494] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeJbGSaoiUyiIR3EhLWVuwAAAMM"]
[Sat Apr 18 01:48:55.811956 2026] [:error] [pid 59044:tid 59104] [client 88.151.33.232:20380] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aeJyhwFamkFyEtD_SMHEiQAAAIM"]
[Sat Apr 18 01:49:17.147564 2026] [:error] [pid 59043:tid 59093] [client 88.151.33.232:52564] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aeJynYRtUGE9SfUh2wwX9QAAAFM"]
[Sat Apr 18 01:49:39.209506 2026] [:error] [pid 59043:tid 59086] [client 88.151.33.232:60588] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aeJys4RtUGE9SfUh2wwYCwAAAEw"]
[Sat Apr 18 01:50:05.668316 2026] [:error] [pid 59044:tid 59112] [client 88.151.33.232:39814] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "aeJyzQFamkFyEtD_SMHE5QAAAIs"]
[Sat Apr 18 01:50:41.423860 2026] [:error] [pid 59136:tid 59155] [client 88.151.33.232:33672] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "aeJy8SaoiUyiIR3EhLXBMQAAANA"]
[Sat Apr 18 01:51:01.214110 2026] [:error] [pid 42442:tid 42445] [client 88.151.33.232:44538] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aeJzBT4PBGqL_yqPJ8k5iAAAAQE"]
[Sat Apr 18 01:54:49.226571 2026] [:error] [pid 42442:tid 42461] [client 88.151.33.232:38956] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/HEAD"] [unique_id "aeJz6T4PBGqL_yqPJ8k7VgAAARE"]
[Sat Apr 18 01:55:18.125262 2026] [:error] [pid 59043:tid 59080] [client 88.151.33.232:48460] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.git/HEAD"] [unique_id "aeJ0BoRtUGE9SfUh2wwYvAAAAEY"]
[Sat Apr 18 01:55:54.226066 2026] [:error] [pid 59044:tid 59124] [client 88.151.33.232:6828] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.git/HEAD"] [unique_id "aeJ0KgFamkFyEtD_SMHF0wAAAJc"]
[Sat Apr 18 01:56:13.756725 2026] [:error] [pid 59136:tid 59146] [client 88.151.33.232:24730] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/src/.git/HEAD"] [unique_id "aeJ0PSaoiUyiIR3EhLXCSwAAAMc"]
[Sat Apr 18 01:56:37.549219 2026] [:error] [pid 59136:tid 59147] [client 88.151.33.232:49736] [client 88.151.33.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backend/.git/HEAD"] [unique_id "aeJ0VSaoiUyiIR3EhLXCVwAAAMg"]
[Sat Apr 18 03:16:16.559623 2026] [:error] [pid 7181:tid 7191] [client 43.133.14.237:53272] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeKHAIEOj_oGYqvsyOL3igAAAAU"]
[Sat Apr 18 07:39:09.461111 2026] [:error] [pid 9864:tid 9924] [client 182.44.12.37:54780] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeLEnYCFeowknfXHM7lTNgAAAFI"]
[Sat Apr 18 08:53:31.947773 2026] [:error] [pid 34237:tid 34261] [client 43.135.135.57:35746] [client 43.135.135.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeLWCxBmX4Wq5a6rxfbvNAAAAVY"]
[Sat Apr 18 12:50:23.108747 2026] [:error] [pid 9864:tid 9905] [client 43.165.65.75:51832] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeMNj4CFeowknfXHM7mbAwAAAEA"]
[Sat Apr 18 13:47:55.000521 2026] [:error] [pid 9864:tid 9926] [client 106.54.62.156:55222] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeMbCoCFeowknfXHM7mnXwAAAFQ"]
[Sat Apr 18 15:45:35.429066 2026] [:error] [pid 9865:tid 9953] [client 101.33.81.73:34534] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeM2n6zb5knECIY-C-hODgAAAJA"]
[Sat Apr 18 16:55:52.753779 2026] [:error] [pid 13023:tid 13044] [client 59.126.168.24:54761] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Sat Apr 18 16:55:59.770205 2026] [:error] [pid 9865:tid 9938] [client 59.126.168.24:54840] File does not exist: /usr/local/apache/htdocs/suspended-page/luuf.php
[Sat Apr 18 18:03:09.496386 2026] [:error] [pid 13023:tid 13043] [client 43.155.129.131:53566] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeNW3f1e7hG8DAeABB_ncwAAARI"]
[Sat Apr 18 20:58:45.138625 2026] [:error] [pid 32677:tid 32690] [client 43.135.133.241:34946] [client 43.135.133.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeOABRngmUE3LdC-wP7dzQAAAko"]
[Sat Apr 18 22:56:42.771617 2026] [:error] [pid 9970:tid 9991] [client 43.167.236.228:53346] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeObqiYdRLRhVmaIMx3lMwAAANE"]
[Sun Apr 19 00:11:32.828682 2026] [:error] [pid 32252:tid 32278] [client 43.165.70.220:36064] [client 43.165.70.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeOtNOXl4Yc-Lt5fJ9h_3gAAARg"]
[Sun Apr 19 03:17:03.907020 2026] [:error] [pid 32166:tid 32204] [client 45.132.115.87:60655] [client 45.132.115.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.87, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aePYr5CHNkWwdiZnafLdZQAAAEY"]
[Sun Apr 19 03:17:03.910792 2026] [:error] [pid 32166:tid 32204] [client 45.132.115.87:60655] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sun Apr 19 06:06:16.054495 2026] [:error] [pid 47775:tid 47867] [client 13.38.53.225:54816] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aeQAWLmztjlk9tsmoex7aQAAAJg"]
[Sun Apr 19 06:06:17.321104 2026] [:error] [pid 47775:tid 47844] [client 13.38.53.225:54820] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aeQAWbmztjlk9tsmoex7bgAAAIE"]
[Sun Apr 19 06:06:18.321370 2026] [:error] [pid 15760:tid 15790] [client 13.38.53.225:54834] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aeQAWvSdD_XHQMJ_ISsczAAAAdY"]
[Sun Apr 19 06:06:19.321774 2026] [:error] [pid 15763:tid 15797] [client 13.38.53.225:54838] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aeQAW7MXv1Y1THOoxaAoFgAAAgE"]
[Sun Apr 19 06:06:20.327640 2026] [:error] [pid 47886:tid 47911] [client 13.38.53.225:54840] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "aeQAXESe8yiyuPrD7yPzWwAAANc"]
[Sun Apr 19 06:06:21.338117 2026] [:error] [pid 47772:tid 47800] [client 13.38.53.225:38454] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "aeQAXYc0L16cb4smAz-uKgAAAAs"]
[Sun Apr 19 06:06:22.350991 2026] [:error] [pid 15764:tid 15827] [client 13.38.53.225:38470] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "aeQAXmLL_sqdSHoVp-TvzQAAAkE"]
[Sun Apr 19 06:06:23.353764 2026] [:error] [pid 47886:tid 47890] [client 13.38.53.225:38474] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.remote"] [unique_id "aeQAX0Se8yiyuPrD7yPzYwAAAMI"]
[Sun Apr 19 06:06:24.362786 2026] [:error] [pid 15764:tid 15843] [client 13.38.53.225:38480] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "aeQAYGLL_sqdSHoVp-Tv1AAAAlE"]
[Sun Apr 19 06:06:25.372330 2026] [:error] [pid 47775:tid 47855] [client 13.38.53.225:38484] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aeQAYbmztjlk9tsmoex7fAAAAIw"]
[Sun Apr 19 06:06:26.381515 2026] [:error] [pid 15765:tid 15866] [client 13.38.53.225:38494] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.save"] [unique_id "aeQAYvRqinw-W5EwQ76KdQAAAo0"]
[Sun Apr 19 06:06:27.378028 2026] [:error] [pid 47886:tid 47912] [client 13.38.53.225:38510] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "aeQAY0Se8yiyuPrD7yPzbwAAANg"]
[Sun Apr 19 06:06:28.391057 2026] [:error] [pid 47772:tid 47800] [client 13.38.53.225:38516] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.sample"] [unique_id "aeQAZIc0L16cb4smAz-uNQAAAAs"]
[Sun Apr 19 06:06:29.399207 2026] [:error] [pid 47772:tid 47795] [client 13.38.53.225:38532] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.example"] [unique_id "aeQAZYc0L16cb4smAz-uPgAAAAY"]
[Sun Apr 19 06:06:30.410996 2026] [:error] [pid 47775:tid 47859] [client 13.38.53.225:38536] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev"] [unique_id "aeQAZrmztjlk9tsmoex7gwAAAJA"]
[Sun Apr 19 06:06:31.414625 2026] [:error] [pid 47886:tid 47891] [client 13.38.53.225:38500] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.prod"] [unique_id "aeQAZ0Se8yiyuPrD7yPzcgAAAMM"]
[Sun Apr 19 06:06:32.419533 2026] [:error] [pid 47886:tid 47899] [client 13.38.53.225:38512] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.stage"] [unique_id "aeQAaESe8yiyuPrD7yPzdgAAAMs"]
[Sun Apr 19 06:06:33.428594 2026] [:error] [pid 47772:tid 47810] [client 13.38.53.225:38528] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.ci"] [unique_id "aeQAaYc0L16cb4smAz-uSgAAABU"]
[Sun Apr 19 06:06:34.434771 2026] [:error] [pid 15764:tid 15838] [client 13.38.53.225:38542] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.docker"] [unique_id "aeQAamLL_sqdSHoVp-Tv3QAAAkw"]
[Sun Apr 19 06:06:35.438229 2026] [:error] [pid 15694:tid 15742] [client 13.38.53.225:38550] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.live"] [unique_id "aeQAa7imB-jol1fwqAq91gAAAZA"]
[Sun Apr 19 06:06:36.443735 2026] [:error] [pid 15694:tid 15749] [client 13.38.53.225:38560] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.preprod"] [unique_id "aeQAbLimB-jol1fwqAq92gAAAZc"]
[Sun Apr 19 06:06:37.450490 2026] [:error] [pid 15694:tid 15748] [client 13.38.53.225:38570] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.uat"] [unique_id "aeQAbbimB-jol1fwqAq93gAAAZY"]
[Sun Apr 19 06:06:38.452919 2026] [:error] [pid 15694:tid 15740] [client 13.38.53.225:38582] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dist"] [unique_id "aeQAbrimB-jol1fwqAq94wAAAY4"]
[Sun Apr 19 06:06:39.461045 2026] [:error] [pid 15764:tid 15841] [client 13.38.53.225:38592] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.swp"] [unique_id "aeQAb2LL_sqdSHoVp-Tv4AAAAk8"]
[Sun Apr 19 06:06:40.475438 2026] [:error] [pid 47886:tid 47904] [client 13.38.53.225:38604] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env~"] [unique_id "aeQAcESe8yiyuPrD7yPzgQAAANA"]
[Sun Apr 19 06:06:41.482195 2026] [:error] [pid 15760:tid 15771] [client 13.38.53.225:43508] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "aeQAcfSdD_XHQMJ_ISsc2gAAAcM"]
[Sun Apr 19 06:06:42.487825 2026] [:error] [pid 15764:tid 15829] [client 13.38.53.225:43514] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/apps/.env"] [unique_id "aeQAcmLL_sqdSHoVp-Tv5QAAAkM"]
[Sun Apr 19 06:06:43.518544 2026] [:error] [pid 47773:tid 47821] [client 13.38.53.225:43520] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "aeQAc-iBHdnCJDuPq9BmngAAAEU"]
[Sun Apr 19 06:06:44.543291 2026] [:error] [pid 47773:tid 47834] [client 13.38.53.225:43524] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/web/.env"] [unique_id "aeQAdOiBHdnCJDuPq9BmpgAAAFI"]
[Sun Apr 19 06:06:45.555394 2026] [:error] [pid 47773:tid 47820] [client 13.38.53.225:43536] [client 13.38.53.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/site/.env"] [unique_id "aeQAdeiBHdnCJDuPq9BmqgAAAEQ"]
[Sun Apr 19 09:59:24.211707 2026] [:error] [pid 47886:tid 47900] [client 43.131.253.14:55896] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeQ2_ESe8yiyuPrD7yMf7wAAAMw"]
[Sun Apr 19 11:36:18.723643 2026] [:error] [pid 47773:tid 47818] [client 2.24.212.135:59436] [client 2.24.212.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aeRNsuiBHdnCJDuPq9DadAAAAEI"]
[Sun Apr 19 12:33:47.614782 2026] [:error] [pid 47775:tid 47865] [client 43.165.65.75:38316] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeRbK7mztjlk9tsmoezI6gAAAJY"]
[Sun Apr 19 14:51:38.249847 2026] [:error] [pid 47772:tid 47804] [client 182.44.12.37:34165] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeR7eoc0L16cb4smAz9V2gAAAA8"]
[Sun Apr 19 19:45:01.717007 2026] [:error] [pid 47886:tid 47900] [client 192.99.71.37:45208] [client 192.99.71.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aeTAPUSe8yiyuPrD7yNpDQAAAMw"]
[Sun Apr 19 19:45:03.661295 2026] [:error] [pid 15760:tid 15768] [client 192.99.71.37:52550] [client 192.99.71.37] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aeTAP_SdD_XHQMJ_ISv2CwAAAcA"]
[Sun Apr 19 21:05:51.505167 2026] [:error] [pid 15763:tid 15820] [client 43.130.74.193:49610] [client 43.130.74.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeTTL7MXv1Y1THOoxaD0BwAAAhg"]
[Sun Apr 19 21:23:49.222651 2026] [:error] [pid 47772:tid 47801] [client 203.2.64.59:57472] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeTXZYc0L16cb4smAz--FgAAAAw"]
[Sun Apr 19 22:04:16.711153 2026] [:error] [pid 15764:tid 15842] [client 138.68.5.226:51055] [client 138.68.5.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeTg4GLL_sqdSHoVp-QpCQAAAlA"]
[Sun Apr 19 22:50:48.970296 2026] [:error] [pid 15763:tid 15801] [client 146.70.194.222:44394] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeTryLMXv1Y1THOoxaATBQAAAgU"]
[Sun Apr 19 22:50:49.487969 2026] [:error] [pid 15764:tid 15832] [client 146.70.194.222:44920] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeTryWLL_sqdSHoVp-Q6RAAAAkY"]
[Sun Apr 19 22:50:50.023485 2026] [:error] [pid 15760:tid 15771] [client 146.70.194.222:45718] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aeTryvSdD_XHQMJ_IStfvgAAAcM"]
[Sun Apr 19 23:12:42.346283 2026] [:error] [pid 47773:tid 47826] [client 43.130.3.120:33862] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeTw6uiBHdnCJDuPq9BangAAAEo"]
[Sun Apr 19 23:37:00.463271 2026] [:error] [pid 47772:tid 47802] [client 43.165.69.68:33432] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeT2nIc0L16cb4smAz_mtwAAAA0"]
[Mon Apr 20 02:11:56.223903 2026] [:error] [pid 15763:tid 15804] [client 43.157.50.58:36116] [client 43.157.50.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeUa7LMXv1Y1THOoxaA8SAAAAgg"]
[Mon Apr 20 03:46:58.604203 2026] [:error] [pid 64332:tid 64347] [client 182.44.8.254:54228] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeUxMsAQ57uMKAVSYEnb9gAAAAU"]
[Mon Apr 20 03:55:42.003087 2026] [:error] [pid 64440:tid 64458] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Mon Apr 20 03:55:42.266526 2026] [:error] [pid 64440:tid 64462] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/kcs.php
[Mon Apr 20 03:55:42.532777 2026] [:error] [pid 64440:tid 64452] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-post-data.php
[Mon Apr 20 03:55:42.810489 2026] [:error] [pid 64440:tid 64461] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211022.php
[Mon Apr 20 03:55:43.089210 2026] [:error] [pid 64440:tid 64459] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Mon Apr 20 03:55:43.352799 2026] [:error] [pid 64440:tid 64457] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Mon Apr 20 03:55:43.619188 2026] [:error] [pid 64440:tid 64464] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/cs.php
[Mon Apr 20 03:55:43.889803 2026] [:error] [pid 64440:tid 64454] [client 20.100.174.202:2164] File does not exist: /usr/local/apache/htdocs/suspended-page/1index.php
[Mon Apr 20 07:48:18.221375 2026] [:error] [pid 64334:tid 64414] [client 49.51.33.159:59496] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeVpwsNh9IxxDqsrPyOyAwAAAIs"]
[Mon Apr 20 09:40:32.787115 2026] [:error] [pid 48101:tid 48128] [client 182.44.2.148:60296] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeWEEPIgenNbs2bVQGsv_gAAAZg"]
[Mon Apr 20 10:12:04.548101 2026] [:error] [pid 11350:tid 11376] [client 43.153.35.128:42504] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeWLdP4EoMBgOJuJnT39OwAAABE"]
[Mon Apr 20 10:13:34.135987 2026] [:error] [pid 11441:tid 11453] [client 20.203.139.33:25962] File does not exist: /usr/local/apache/htdocs/suspended-page/golden.php
[Mon Apr 20 10:13:34.453808 2026] [:error] [pid 11441:tid 11444] [client 20.203.139.33:25962] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Mon Apr 20 10:13:35.686705 2026] [:error] [pid 11441:tid 11455] [client 20.203.139.33:25962] File does not exist: /usr/local/apache/htdocs/suspended-page/m57.php
[Mon Apr 20 10:13:35.942691 2026] [:error] [pid 11441:tid 11450] [client 20.203.139.33:25962] File does not exist: /usr/local/apache/htdocs/suspended-page/sw.php
[Mon Apr 20 10:13:36.191790 2026] [:error] [pid 11441:tid 11467] [client 20.203.139.33:25962] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-m57.php
[Mon Apr 20 10:13:36.432425 2026] [:error] [pid 11441:tid 11447] [client 20.203.139.33:25962] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Mon Apr 20 10:13:36.684566 2026] [:error] [pid 11441:tid 11444] [client 20.203.139.33:25962] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aeWL0MixByFUvmh319CDEQAAAME"]
[Mon Apr 20 10:13:37.597680 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:52934] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aeWL0cixByFUvmh319CDFQAAANE"]
[Mon Apr 20 10:13:39.624490 2026] [:error] [pid 11351:tid 11388] [client 20.203.139.33:22807] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aeWL0wN8Z1-vktaI_tNLEQAAAEE"]
[Mon Apr 20 10:13:41.146536 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:42810] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aeWL1cixByFUvmh319CDGgAAANU"]
[Mon Apr 20 10:13:42.244296 2026] [:error] [pid 11441:tid 11458] [client 20.203.139.33:28671] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "aeWL1sixByFUvmh319CDHwAAAM8"]
[Mon Apr 20 10:13:43.517860 2026] [:error] [pid 11352:tid 11438] [client 20.203.139.33:55563] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "aeWL12l10mhMSfJ7ir8iwAAAAJg"]
[Mon Apr 20 10:13:44.896860 2026] [:error] [pid 11350:tid 11373] [client 20.203.139.33:42767] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "aeWL2P4EoMBgOJuJnT398gAAAA4"]
[Mon Apr 20 10:13:46.199159 2026] [:error] [pid 11350:tid 11367] [client 20.203.139.33:22839] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "aeWL2v4EoMBgOJuJnT398wAAAAg"]
[Mon Apr 20 10:13:46.900300 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:37896] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "aeWL2sixByFUvmh319CDKQAAAM4"]
[Mon Apr 20 10:13:47.746939 2026] [:error] [pid 11350:tid 11359] [client 20.203.139.33:37921] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "aeWL2_4EoMBgOJuJnT399gAAAAA"]
[Mon Apr 20 10:13:49.356876 2026] [:error] [pid 11441:tid 11445] [client 20.203.139.33:37927] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "aeWL3cixByFUvmh319CDMQAAAMI"]
[Mon Apr 20 10:13:51.590081 2026] [:error] [pid 11350:tid 11373] [client 20.203.139.33:29403] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX2.php"] [unique_id "aeWL3_4EoMBgOJuJnT39_gAAAA4"]
[Mon Apr 20 10:13:53.627834 2026] [:error] [pid 11352:tid 11438] [client 20.203.139.33:42802] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aeWL4Wl10mhMSfJ7ir8i1wAAAJg"]
[Mon Apr 20 10:13:54.685785 2026] [:error] [pid 11351:tid 11396] [client 20.203.139.33:35206] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aeWL4gN8Z1-vktaI_tNLHwAAAEk"]
[Mon Apr 20 10:13:55.499337 2026] [:error] [pid 11351:tid 11408] [client 20.203.139.33:35241] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aeWL4wN8Z1-vktaI_tNLIwAAAFU"]
[Mon Apr 20 10:13:56.144736 2026] [:error] [pid 11351:tid 11398] [client 20.203.139.33:34790] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aeWL5AN8Z1-vktaI_tNLJQAAAEs"]
[Mon Apr 20 10:13:57.037312 2026] [:error] [pid 11352:tid 11433] [client 20.203.139.33:3143] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "aeWL5Wl10mhMSfJ7ir8i4QAAAJM"]
[Mon Apr 20 10:13:57.639576 2026] [:error] [pid 11352:tid 11423] [client 20.203.139.33:9443] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "aeWL5Wl10mhMSfJ7ir8i4gAAAIk"]
[Mon Apr 20 10:13:58.241918 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:58101] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "aeWL5sixByFUvmh319CDRwAAANE"]
[Mon Apr 20 10:13:58.920847 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:37200] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/CDX1.php"] [unique_id "aeWL5sixByFUvmh319CDSgAAAMk"]
[Mon Apr 20 10:13:59.511141 2026] [:error] [pid 11441:tid 11463] [client 20.203.139.33:56399] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aeWL58ixByFUvmh319CDTwAAANQ"]
[Mon Apr 20 10:14:00.153956 2026] [:error] [pid 11350:tid 11372] [client 20.203.139.33:12874] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aeWL6P4EoMBgOJuJnT3-DwAAAA0"]
[Mon Apr 20 10:14:00.916194 2026] [:error] [pid 11351:tid 11391] [client 20.203.139.33:12909] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aeWL6AN8Z1-vktaI_tNLMAAAAEQ"]
[Mon Apr 20 10:14:01.785105 2026] [:error] [pid 11352:tid 11419] [client 20.203.139.33:56946] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aeWL6Wl10mhMSfJ7ir8i6QAAAIU"]
[Mon Apr 20 10:14:02.727996 2026] [:error] [pid 11352:tid 11422] [client 20.203.139.33:46258] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aeWL6ml10mhMSfJ7ir8i7wAAAIg"]
[Mon Apr 20 10:14:04.641846 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:58073] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aeWL7MixByFUvmh319CDXAAAAM4"]
[Mon Apr 20 10:14:05.359402 2026] [:error] [pid 11350:tid 11372] [client 20.203.139.33:9434] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aeWL7f4EoMBgOJuJnT3-GQAAAA0"]
[Mon Apr 20 10:14:06.118415 2026] [:error] [pid 11441:tid 11445] [client 20.203.139.33:25496] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aeWL7sixByFUvmh319CDYwAAAMI"]
[Mon Apr 20 10:14:06.845397 2026] [:error] [pid 11351:tid 11403] [client 20.203.139.33:9431] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aeWL7gN8Z1-vktaI_tNLPAAAAFA"]
[Mon Apr 20 10:14:07.807703 2026] [:error] [pid 11350:tid 11376] [client 20.203.139.33:3193] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aeWL7_4EoMBgOJuJnT3-HAAAABE"]
[Mon Apr 20 10:14:08.562655 2026] [:error] [pid 11441:tid 11444] [client 20.203.139.33:3179] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aeWL8MixByFUvmh319CDaAAAAME"]
[Mon Apr 20 10:14:09.569715 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:56909] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aeWL8cixByFUvmh319CDbQAAANE"]
[Mon Apr 20 10:14:10.270812 2026] [:error] [pid 11352:tid 11416] [client 20.203.139.33:12915] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aeWL8ml10mhMSfJ7ir8jAAAAAII"]
[Mon Apr 20 10:14:11.577675 2026] [:error] [pid 11441:tid 11465] [client 20.203.139.33:23854] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aeWL88ixByFUvmh319CDcgAAANY"]
[Mon Apr 20 10:14:12.227732 2026] [:error] [pid 11441:tid 11462] [client 20.203.139.33:35782] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aeWL9MixByFUvmh319CDdQAAANM"]
[Mon Apr 20 10:14:12.968982 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:11618] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aeWL9MixByFUvmh319CDeAAAAMk"]
[Mon Apr 20 10:14:13.746461 2026] [:error] [pid 11352:tid 11436] [client 20.203.139.33:20903] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "aeWL9Wl10mhMSfJ7ir8jCQAAAJY"]
[Mon Apr 20 10:14:14.498076 2026] [:error] [pid 11441:tid 11456] [client 20.203.139.33:29734] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "aeWL9sixByFUvmh319CDfQAAAM0"]
[Mon Apr 20 10:14:15.150099 2026] [:error] [pid 11441:tid 11467] [client 20.203.139.33:37229] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "aeWL98ixByFUvmh319CDgAAAANg"]
[Mon Apr 20 10:14:15.879579 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:28237] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xozx.php"] [unique_id "aeWL98ixByFUvmh319CDhQAAAMk"]
[Mon Apr 20 10:14:16.600999 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:29745] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-Blogs.php"] [unique_id "aeWL-MixByFUvmh319CDhwAAAM4"]
[Mon Apr 20 10:14:17.176637 2026] [:error] [pid 11441:tid 11455] [client 20.203.139.33:42859] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-Blogs.php"] [unique_id "aeWL-cixByFUvmh319CDiQAAAMw"]
[Mon Apr 20 10:14:17.806935 2026] [:error] [pid 11441:tid 11446] [client 20.203.139.33:42834] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-Blogs.php"] [unique_id "aeWL-cixByFUvmh319CDjgAAAMM"]
[Mon Apr 20 10:14:18.929354 2026] [:error] [pid 11352:tid 11420] [client 20.203.139.33:20181] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-Blogs.php"] [unique_id "aeWL-ml10mhMSfJ7ir8jEAAAAIY"]
[Mon Apr 20 10:14:20.315396 2026] [:error] [pid 11441:tid 11444] [client 20.203.139.33:29697] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aeWL_MixByFUvmh319CDlwAAAME"]
[Mon Apr 20 10:14:21.442922 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:37211] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aeWL_cixByFUvmh319CDmwAAAMk"]
[Mon Apr 20 10:14:22.294849 2026] [:error] [pid 11352:tid 11423] [client 20.203.139.33:56913] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aeWL_ml10mhMSfJ7ir8jEgAAAIk"]
[Mon Apr 20 10:14:22.999851 2026] [:error] [pid 11352:tid 11430] [client 20.203.139.33:56945] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aeWL_ml10mhMSfJ7ir8jFAAAAJA"]
[Mon Apr 20 10:14:23.710475 2026] [:error] [pid 11352:tid 11422] [client 20.203.139.33:15660] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aeWL_2l10mhMSfJ7ir8jFwAAAIg"]
[Mon Apr 20 10:14:24.516493 2026] [:error] [pid 11441:tid 11458] [client 20.203.139.33:37197] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aeWMAMixByFUvmh319CDpQAAAM8"]
[Mon Apr 20 10:14:25.185851 2026] [:error] [pid 11350:tid 11364] [client 20.203.139.33:20879] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aeWMAf4EoMBgOJuJnT3-LwAAAAU"]
[Mon Apr 20 10:14:26.319554 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:12873] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aeWMAsixByFUvmh319CDrgAAAMU"]
[Mon Apr 20 10:14:27.267140 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:37222] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aeWMA8ixByFUvmh319CDtAAAANU"]
[Mon Apr 20 10:14:27.808306 2026] [:error] [pid 11441:tid 11450] [client 20.203.139.33:28634] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aeWMA8ixByFUvmh319CDugAAAMc"]
[Mon Apr 20 10:14:28.590975 2026] [:error] [pid 11351:tid 11397] [client 20.203.139.33:29369] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aeWMBAN8Z1-vktaI_tNLYQAAAEo"]
[Mon Apr 20 10:14:29.819761 2026] [:error] [pid 11441:tid 11467] [client 20.203.139.33:28661] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aeWMBcixByFUvmh319CDvgAAANg"]
[Mon Apr 20 10:14:31.389963 2026] [:error] [pid 11350:tid 11371] [client 20.203.139.33:28666] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aeWMB_4EoMBgOJuJnT3-OwAAAAw"]
[Mon Apr 20 10:14:32.419023 2026] [:error] [pid 11350:tid 11364] [client 20.203.139.33:54972] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aeWMCP4EoMBgOJuJnT3-PwAAAAU"]
[Mon Apr 20 10:14:33.257960 2026] [:error] [pid 11351:tid 11406] [client 20.203.139.33:15628] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aeWMCQN8Z1-vktaI_tNLZwAAAFM"]
[Mon Apr 20 10:14:34.401678 2026] [:error] [pid 11351:tid 11404] [client 20.203.139.33:12926] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aeWMCgN8Z1-vktaI_tNLbAAAAFE"]
[Mon Apr 20 10:14:35.763055 2026] [:error] [pid 11352:tid 11417] [client 20.203.139.33:54947] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "aeWMC2l10mhMSfJ7ir8jJAAAAIM"]
[Mon Apr 20 10:14:36.490007 2026] [:error] [pid 11351:tid 11403] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/ktfow.php
[Mon Apr 20 10:14:36.732660 2026] [:error] [pid 11351:tid 11387] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Mon Apr 20 10:14:36.973043 2026] [:error] [pid 11351:tid 11395] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/Xx.php
[Mon Apr 20 10:14:37.379204 2026] [:error] [pid 11351:tid 11399] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/xmini.php
[Mon Apr 20 10:14:37.694998 2026] [:error] [pid 11351:tid 11411] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/2468.php
[Mon Apr 20 10:14:38.297800 2026] [:error] [pid 11351:tid 11402] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Mon Apr 20 10:14:38.544474 2026] [:error] [pid 11351:tid 11398] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/amdin.php
[Mon Apr 20 10:14:38.799917 2026] [:error] [pid 11351:tid 11407] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/huya.php
[Mon Apr 20 10:14:39.052040 2026] [:error] [pid 11351:tid 11410] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/puc.php
[Mon Apr 20 10:14:39.292824 2026] [:error] [pid 11351:tid 11406] [client 20.203.139.33:11626] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon Apr 20 10:14:39.536727 2026] [:error] [pid 11351:tid 11401] [client 20.203.139.33:11626] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeWMDwN8Z1-vktaI_tNLggAAAE4"]
[Mon Apr 20 10:14:40.108424 2026] [:error] [pid 11441:tid 11463] [client 20.203.139.33:20864] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeWMEMixByFUvmh319CD1wAAANQ"]
[Mon Apr 20 10:14:41.071164 2026] [:error] [pid 11352:tid 11433] [client 20.203.139.33:34776] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeWMEWl10mhMSfJ7ir8jLgAAAJM"]
[Mon Apr 20 10:14:42.336893 2026] [:error] [pid 11441:tid 11449] [client 20.203.139.33:29333] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "aeWMEsixByFUvmh319CD6QAAAMY"]
[Mon Apr 20 10:14:43.568777 2026] [:error] [pid 11351:tid 11404] [client 20.203.139.33:55509] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeWMEwN8Z1-vktaI_tNLhgAAAFE"]
[Mon Apr 20 10:14:44.251758 2026] [:error] [pid 11352:tid 11430] [client 20.203.139.33:29806] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeWMFGl10mhMSfJ7ir8jNgAAAJA"]
[Mon Apr 20 10:14:45.107881 2026] [:error] [pid 11441:tid 11461] [client 20.203.139.33:15664] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeWMFcixByFUvmh319CD9wAAANI"]
[Mon Apr 20 10:14:46.929290 2026] [:error] [pid 11441:tid 11447] [client 20.203.139.33:28995] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kikikoko.php"] [unique_id "aeWMFsixByFUvmh319CEBwAAAMQ"]
[Mon Apr 20 10:14:47.736505 2026] [:error] [pid 11352:tid 11432] [client 20.203.139.33:20165] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeWMF2l10mhMSfJ7ir8jPQAAAJI"]
[Mon Apr 20 10:14:48.245482 2026] [:error] [pid 11441:tid 11466] [client 20.203.139.33:29315] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeWMGMixByFUvmh319CEEAAAANc"]
[Mon Apr 20 10:14:49.000136 2026] [:error] [pid 11441:tid 11449] [client 20.203.139.33:28612] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeWMGMixByFUvmh319CEFwAAAMY"]
[Mon Apr 20 10:14:49.777427 2026] [:error] [pid 11350:tid 11364] [client 20.203.139.33:20188] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/nwflm.php"] [unique_id "aeWMGf4EoMBgOJuJnT3-VgAAAAU"]
[Mon Apr 20 10:14:50.501713 2026] [:error] [pid 11351:tid 11410] [client 20.203.139.33:20186] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeWMGgN8Z1-vktaI_tNLkwAAAFc"]
[Mon Apr 20 10:14:51.274521 2026] [:error] [pid 11352:tid 11421] [client 20.203.139.33:20219] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeWMG2l10mhMSfJ7ir8jQQAAAIc"]
[Mon Apr 20 10:14:51.936136 2026] [:error] [pid 11351:tid 11398] [client 20.203.139.33:55541] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeWMGwN8Z1-vktaI_tNLmAAAAEs"]
[Mon Apr 20 10:14:52.729373 2026] [:error] [pid 11350:tid 11380] [client 20.203.139.33:28243] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aeWMHP4EoMBgOJuJnT3-YwAAABU"]
[Mon Apr 20 10:14:53.693294 2026] [:error] [pid 11350:tid 11374] [client 20.203.139.33:53664] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeWMHf4EoMBgOJuJnT3-ZwAAAA8"]
[Mon Apr 20 10:14:54.581135 2026] [:error] [pid 11441:tid 11458] [client 20.203.139.33:11602] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeWMHsixByFUvmh319CENgAAAM8"]
[Mon Apr 20 10:14:55.320804 2026] [:error] [pid 11352:tid 11425] [client 20.203.139.33:47504] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeWMH2l10mhMSfJ7ir8jSwAAAIs"]
[Mon Apr 20 10:14:56.010297 2026] [:error] [pid 11441:tid 11447] [client 20.203.139.33:3350] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aeWMIMixByFUvmh319CEPAAAAMQ"]
[Mon Apr 20 10:14:56.543008 2026] [:error] [pid 11352:tid 11430] [client 20.203.139.33:28613] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeWMIGl10mhMSfJ7ir8jTwAAAJA"]
[Mon Apr 20 10:14:57.349448 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:54920] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeWMIcixByFUvmh319CEQgAAAMU"]
[Mon Apr 20 10:14:57.973341 2026] [:error] [pid 11352:tid 11419] [client 20.203.139.33:20154] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeWMIWl10mhMSfJ7ir8jVAAAAIU"]
[Mon Apr 20 10:14:58.988343 2026] [:error] [pid 11351:tid 11401] [client 20.203.139.33:3388] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "aeWMIgN8Z1-vktaI_tNLowAAAE4"]
[Mon Apr 20 10:14:59.742327 2026] [:error] [pid 11351:tid 11393] [client 20.203.139.33:15676] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeWMIwN8Z1-vktaI_tNLqAAAAEY"]
[Mon Apr 20 10:15:00.567293 2026] [:error] [pid 11352:tid 11416] [client 20.203.139.33:12921] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeWMJGl10mhMSfJ7ir8jWwAAAII"]
[Mon Apr 20 10:15:01.111766 2026] [:error] [pid 11351:tid 11397] [client 20.203.139.33:28627] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeWMJQN8Z1-vktaI_tNLrQAAAEo"]
[Mon Apr 20 10:15:01.758512 2026] [:error] [pid 11352:tid 11429] [client 20.203.139.33:12005] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aeWMJWl10mhMSfJ7ir8jXwAAAI8"]
[Mon Apr 20 10:15:02.601595 2026] [:error] [pid 11441:tid 11453] [client 20.203.139.33:27164] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeWMJsixByFUvmh319CEVwAAAMo"]
[Mon Apr 20 10:15:03.283589 2026] [:error] [pid 11352:tid 11426] [client 20.203.139.33:54941] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeWMJ2l10mhMSfJ7ir8jYgAAAIw"]
[Mon Apr 20 10:15:04.024905 2026] [:error] [pid 11352:tid 11415] [client 20.203.139.33:42490] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeWMKGl10mhMSfJ7ir8jZgAAAIE"]
[Mon Apr 20 10:15:04.782972 2026] [:error] [pid 11352:tid 11433] [client 20.203.139.33:28624] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aeWMKGl10mhMSfJ7ir8jaAAAAJM"]
[Mon Apr 20 10:15:05.426438 2026] [:error] [pid 11352:tid 11422] [client 20.203.139.33:12031] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeWMKWl10mhMSfJ7ir8jawAAAIg"]
[Mon Apr 20 10:15:06.541269 2026] [:error] [pid 11350:tid 11361] [client 20.203.139.33:20096] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeWMKv4EoMBgOJuJnT3-egAAAAI"]
[Mon Apr 20 10:15:07.876938 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:29760] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeWMK8ixByFUvmh319CEXAAAANE"]
[Mon Apr 20 10:15:09.175136 2026] [:error] [pid 11352:tid 11427] [client 20.203.139.33:55490] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aeWMLWl10mhMSfJ7ir8jdwAAAI0"]
[Mon Apr 20 10:15:10.348934 2026] [:error] [pid 11350:tid 11372] [client 20.203.139.33:29772] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeWMLv4EoMBgOJuJnT3-fwAAAA0"]
[Mon Apr 20 10:15:11.113987 2026] [:error] [pid 11441:tid 11458] [client 20.203.139.33:55528] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeWML8ixByFUvmh319CEYQAAAM8"]
[Mon Apr 20 10:15:12.054021 2026] [:error] [pid 11351:tid 11396] [client 20.203.139.33:29786] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeWMMAN8Z1-vktaI_tNLywAAAEk"]
[Mon Apr 20 10:15:13.159304 2026] [:error] [pid 11441:tid 11450] [client 20.203.139.33:28648] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aeWMMcixByFUvmh319CEagAAAMc"]
[Mon Apr 20 10:15:14.666347 2026] [:error] [pid 11352:tid 11419] [client 20.203.139.33:41399] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeWMMml10mhMSfJ7ir8jiAAAAIU"]
[Mon Apr 20 10:15:15.597710 2026] [:error] [pid 11351:tid 11405] [client 20.203.139.33:42443] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeWMMwN8Z1-vktaI_tNL1AAAAFI"]
[Mon Apr 20 10:15:16.826211 2026] [:error] [pid 11441:tid 11459] [client 20.203.139.33:29822] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeWMNMixByFUvmh319CEbwAAANA"]
[Mon Apr 20 10:15:18.194592 2026] [:error] [pid 11350:tid 11381] [client 20.203.139.33:12886] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aeWMNv4EoMBgOJuJnT3-iAAAABY"]
[Mon Apr 20 10:15:20.893943 2026] [:error] [pid 11441:tid 11463] [client 20.203.139.33:42052] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeWMOMixByFUvmh319CEfgAAANQ"]
[Mon Apr 20 10:15:22.319204 2026] [:error] [pid 11351:tid 11411] [client 20.203.139.33:41407] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeWMOgN8Z1-vktaI_tNL5QAAAFg"]
[Mon Apr 20 10:15:23.870177 2026] [:error] [pid 11352:tid 11433] [client 20.203.139.33:3589] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeWMO2l10mhMSfJ7ir8jnAAAAJM"]
[Mon Apr 20 10:15:24.851560 2026] [:error] [pid 11352:tid 11436] [client 20.203.139.33:3438] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aeWMPGl10mhMSfJ7ir8jpAAAAJY"]
[Mon Apr 20 10:15:25.783604 2026] [:error] [pid 11350:tid 11359] [client 20.203.139.33:26991] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeWMPf4EoMBgOJuJnT3-jgAAAAA"]
[Mon Apr 20 10:15:27.126837 2026] [:error] [pid 11441:tid 11456] [client 20.203.139.33:33868] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeWMP8ixByFUvmh319CEuAAAAM0"]
[Mon Apr 20 10:15:28.412442 2026] [:error] [pid 11351:tid 11402] [client 20.203.139.33:25152] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeWMQAN8Z1-vktaI_tNMAAAAAE8"]
[Mon Apr 20 10:15:31.427095 2026] [:error] [pid 11350:tid 11369] [client 20.203.139.33:38338] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aeWMQ_4EoMBgOJuJnT3-mwAAAAo"]
[Mon Apr 20 10:15:32.783349 2026] [:error] [pid 11441:tid 11463] [client 20.203.139.33:33859] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeWMRMixByFUvmh319CE5AAAANQ"]
[Mon Apr 20 10:15:33.806611 2026] [:error] [pid 11441:tid 11453] [client 20.203.139.33:25129] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeWMRcixByFUvmh319CE5wAAAMo"]
[Mon Apr 20 10:15:35.139275 2026] [:error] [pid 11352:tid 11418] [client 20.203.139.33:39438] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeWMR2l10mhMSfJ7ir8jyQAAAIQ"]
[Mon Apr 20 10:15:36.418929 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:30906] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aeWMSMixByFUvmh319CE9AAAAMk"]
[Mon Apr 20 10:15:37.120068 2026] [:error] [pid 11351:tid 11408] [client 20.203.139.33:3350] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aeWMSQN8Z1-vktaI_tNMDQAAAFU"]
[Mon Apr 20 10:15:39.227194 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/tea.php
[Mon Apr 20 10:15:39.469068 2026] [:error] [pid 11441:tid 11461] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Mon Apr 20 10:15:39.723388 2026] [:error] [pid 11441:tid 11443] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Mon Apr 20 10:15:39.964495 2026] [:error] [pid 11441:tid 11449] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Mon Apr 20 10:15:40.218578 2026] [:error] [pid 11441:tid 11453] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Mon Apr 20 10:15:40.458720 2026] [:error] [pid 11441:tid 11459] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Mon Apr 20 10:15:40.702535 2026] [:error] [pid 11441:tid 11454] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Mon Apr 20 10:15:40.943369 2026] [:error] [pid 11441:tid 11463] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Mon Apr 20 10:15:41.194832 2026] [:error] [pid 11441:tid 11444] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Mon Apr 20 10:15:41.437340 2026] [:error] [pid 11441:tid 11443] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Mon Apr 20 10:15:41.679862 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:30854] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Mon Apr 20 10:15:41.918256 2026] [:error] [pid 11441:tid 11451] [client 20.203.139.33:30854] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeWMTcixByFUvmh319CFEgAAAMg"]
[Mon Apr 20 10:15:44.669175 2026] [:error] [pid 11352:tid 11435] [client 20.203.139.33:16771] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeWMUGl10mhMSfJ7ir8j0gAAAJU"]
[Mon Apr 20 10:15:46.414910 2026] [:error] [pid 11351:tid 11389] [client 20.203.139.33:54288] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeWMUgN8Z1-vktaI_tNMIwAAAEI"]
[Mon Apr 20 10:15:47.150517 2026] [:error] [pid 11352:tid 11432] [client 20.203.139.33:10246] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aeWMU2l10mhMSfJ7ir8j1wAAAJI"]
[Mon Apr 20 10:15:48.277142 2026] [:error] [pid 11350:tid 11376] [client 20.203.139.33:53707] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeWMVP4EoMBgOJuJnT3-rAAAABE"]
[Mon Apr 20 10:15:49.178626 2026] [:error] [pid 11352:tid 11418] [client 20.203.139.33:10299] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeWMVWl10mhMSfJ7ir8j2gAAAIQ"]
[Mon Apr 20 10:15:50.253712 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:18211] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeWMVsixByFUvmh319CFNQAAAMk"]
[Mon Apr 20 10:15:52.155179 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:30603] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aeWMWMixByFUvmh319CFSAAAAMk"]
[Mon Apr 20 10:15:53.482153 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:46695] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aeWMWcixByFUvmh319CFTgAAAM4"]
[Mon Apr 20 10:15:54.840934 2026] [:error] [pid 11352:tid 11437] [client 20.203.139.33:18260] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aeWMWml10mhMSfJ7ir8j6gAAAJc"]
[Mon Apr 20 10:15:55.950778 2026] [:error] [pid 11350:tid 11369] [client 20.203.139.33:46690] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aeWMW_4EoMBgOJuJnT3-uQAAAAo"]
[Mon Apr 20 10:15:56.629352 2026] [:error] [pid 11352:tid 11426] [client 20.203.139.33:37511] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aeWMXGl10mhMSfJ7ir8j8gAAAIw"]
[Mon Apr 20 10:15:58.325708 2026] [:error] [pid 11351:tid 11409] [client 20.203.139.33:4032] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeWMXgN8Z1-vktaI_tNMLgAAAFY"]
[Mon Apr 20 10:15:59.653176 2026] [:error] [pid 11441:tid 11458] [client 20.203.139.33:21335] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeWMX8ixByFUvmh319CFVwAAAM8"]
[Mon Apr 20 10:16:00.820031 2026] [:error] [pid 11352:tid 11437] [client 20.203.139.33:33287] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeWMYGl10mhMSfJ7ir8j_AAAAJc"]
[Mon Apr 20 10:16:02.253678 2026] [:error] [pid 11351:tid 11390] [client 20.203.139.33:3916] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35_S.php"] [unique_id "aeWMYgN8Z1-vktaI_tNMNAAAAEM"]
[Mon Apr 20 10:16:03.230435 2026] [:error] [pid 11352:tid 11418] [client 20.203.139.33:3699] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeWMY2l10mhMSfJ7ir8kAQAAAIQ"]
[Mon Apr 20 10:16:04.268573 2026] [:error] [pid 11441:tid 11465] [client 20.203.139.33:3929] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeWMZMixByFUvmh319CFYwAAANY"]
[Mon Apr 20 10:16:05.883183 2026] [:error] [pid 11352:tid 11431] [client 20.203.139.33:63565] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeWMZWl10mhMSfJ7ir8kCwAAAJE"]
[Mon Apr 20 10:16:07.555559 2026] [:error] [pid 11441:tid 11443] [client 20.203.139.33:33280] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "aeWMZ8ixByFUvmh319CFagAAAMA"]
[Mon Apr 20 10:16:08.344718 2026] [:error] [pid 11441:tid 11465] [client 20.203.139.33:27885] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeWMaMixByFUvmh319CFbQAAANY"]
[Mon Apr 20 10:16:09.182279 2026] [:error] [pid 11441:tid 11446] [client 20.203.139.33:23214] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeWMacixByFUvmh319CFcAAAAMM"]
[Mon Apr 20 10:16:10.518131 2026] [:error] [pid 11350:tid 11371] [client 20.203.139.33:51697] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeWMav4EoMBgOJuJnT3-xwAAAAw"]
[Mon Apr 20 10:16:12.013351 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:30340] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/111.php"] [unique_id "aeWMbMixByFUvmh319CFdAAAAM4"]
[Mon Apr 20 10:16:13.679451 2026] [:error] [pid 11352:tid 11418] [client 20.203.139.33:47610] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeWMbWl10mhMSfJ7ir8kEAAAAIQ"]
[Mon Apr 20 10:16:14.867682 2026] [:error] [pid 11352:tid 11420] [client 20.203.139.33:47604] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeWMbml10mhMSfJ7ir8kFAAAAIY"]
[Mon Apr 20 10:16:16.709893 2026] [:error] [pid 11351:tid 11395] [client 20.203.139.33:51659] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeWMcAN8Z1-vktaI_tNMQwAAAEg"]
[Mon Apr 20 10:16:17.991045 2026] [:error] [pid 11352:tid 11425] [client 20.203.139.33:30362] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1.php"] [unique_id "aeWMcWl10mhMSfJ7ir8kHAAAAIs"]
[Mon Apr 20 10:16:18.734171 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:33845] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeWMcsixByFUvmh319CFhAAAANE"]
[Mon Apr 20 10:16:19.478537 2026] [:error] [pid 11441:tid 11461] [client 20.203.139.33:33306] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeWMc8ixByFUvmh319CFhgAAANI"]
[Mon Apr 20 10:16:20.217788 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:33831] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeWMdMixByFUvmh319CFiwAAAMU"]
[Mon Apr 20 10:16:20.928595 2026] [:error] [pid 11350:tid 11378] [client 20.203.139.33:51708] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aeWMdP4EoMBgOJuJnT3-1gAAABM"]
[Mon Apr 20 10:16:22.605248 2026] [:error] [pid 11350:tid 11369] [client 20.203.139.33:54947] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeWMdv4EoMBgOJuJnT3-2AAAAAo"]
[Mon Apr 20 10:16:23.623510 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:21315] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeWMd8ixByFUvmh319CFlAAAAM4"]
[Mon Apr 20 10:16:24.704504 2026] [:error] [pid 11352:tid 11426] [client 20.203.139.33:21357] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeWMeGl10mhMSfJ7ir8kIgAAAIw"]
[Mon Apr 20 10:16:25.580655 2026] [:error] [pid 11441:tid 11447] [client 20.203.139.33:33838] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byrgo.php"] [unique_id "aeWMecixByFUvmh319CFmgAAAMQ"]
[Mon Apr 20 10:16:26.300643 2026] [:error] [pid 11441:tid 11461] [client 20.203.139.33:30358] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeWMesixByFUvmh319CFnQAAANI"]
[Mon Apr 20 10:16:27.002160 2026] [:error] [pid 11352:tid 11435] [client 20.203.139.33:13842] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeWMe2l10mhMSfJ7ir8kJAAAAJU"]
[Mon Apr 20 10:16:28.406141 2026] [:error] [pid 11441:tid 11450] [client 20.203.139.33:24057] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeWMfMixByFUvmh319CFpgAAAMc"]
[Mon Apr 20 10:16:29.822283 2026] [:error] [pid 11352:tid 11422] [client 20.203.139.33:51669] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "aeWMfWl10mhMSfJ7ir8kLgAAAIg"]
[Mon Apr 20 10:16:30.757404 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:63613] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeWMfsixByFUvmh319CFrQAAAMU"]
[Mon Apr 20 10:16:32.871399 2026] [:error] [pid 11352:tid 11429] [client 20.203.139.33:51660] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeWMgGl10mhMSfJ7ir8kMwAAAI8"]
[Mon Apr 20 10:16:33.767027 2026] [:error] [pid 11350:tid 11368] [client 20.203.139.33:51665] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeWMgf4EoMBgOJuJnT3-5AAAAAk"]
[Mon Apr 20 10:16:35.284669 2026] [:error] [pid 11351:tid 11389] [client 20.203.139.33:31841] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ass.php"] [unique_id "aeWMgwN8Z1-vktaI_tNMWQAAAEI"]
[Mon Apr 20 10:16:37.217834 2026] [:error] [pid 11352:tid 11430] [client 20.203.139.33:57410] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aeWMhWl10mhMSfJ7ir8kOQAAAJA"]
[Mon Apr 20 10:16:41.799890 2026] [:error] [pid 11351:tid 11399] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Apr 20 10:16:42.037729 2026] [:error] [pid 11351:tid 11404] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/no18.php
[Mon Apr 20 10:16:42.276719 2026] [:error] [pid 11351:tid 11411] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/fine.php
[Mon Apr 20 10:16:42.527092 2026] [:error] [pid 11351:tid 11393] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Mon Apr 20 10:16:42.772936 2026] [:error] [pid 11351:tid 11409] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Mon Apr 20 10:16:43.012818 2026] [:error] [pid 11351:tid 11408] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 20 10:16:43.251933 2026] [:error] [pid 11351:tid 11403] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Mon Apr 20 10:16:43.492974 2026] [:error] [pid 11351:tid 11397] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Mon Apr 20 10:16:43.731319 2026] [:error] [pid 11351:tid 11395] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Mon Apr 20 10:16:43.975779 2026] [:error] [pid 11351:tid 11410] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Mon Apr 20 10:16:44.578375 2026] [:error] [pid 11351:tid 11404] [client 20.203.139.33:31850] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Mon Apr 20 10:16:44.813883 2026] [:error] [pid 11351:tid 11391] [client 20.203.139.33:31850] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeWMjAN8Z1-vktaI_tNMgAAAAEQ"]
[Mon Apr 20 10:16:45.862343 2026] [:error] [pid 11350:tid 11367] [client 20.203.139.33:23291] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeWMjf4EoMBgOJuJnT3-9QAAAAg"]
[Mon Apr 20 10:16:47.209672 2026] [:error] [pid 11441:tid 11446] [client 20.203.139.33:25893] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeWMj8ixByFUvmh319CF8wAAAMM"]
[Mon Apr 20 10:16:48.252741 2026] [:error] [pid 11441:tid 11450] [client 20.203.139.33:13874] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aeWMkMixByFUvmh319CF-QAAAMc"]
[Mon Apr 20 10:16:49.377379 2026] [:error] [pid 11351:tid 11405] [client 20.203.139.33:33342] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeWMkQN8Z1-vktaI_tNMggAAAFI"]
[Mon Apr 20 10:16:50.678802 2026] [:error] [pid 11351:tid 11410] [client 20.203.139.33:51625] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeWMkgN8Z1-vktaI_tNMiAAAAFc"]
[Mon Apr 20 10:16:52.708812 2026] [:error] [pid 11351:tid 11390] [client 20.203.139.33:51635] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeWMlAN8Z1-vktaI_tNMjwAAAEM"]
[Mon Apr 20 10:16:53.586524 2026] [:error] [pid 11350:tid 11359] [client 20.203.139.33:23239] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aeWMlf4EoMBgOJuJnT3_BAAAAAA"]
[Mon Apr 20 10:16:54.492735 2026] [:error] [pid 11351:tid 11408] [client 20.203.139.33:24046] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeWMlgN8Z1-vktaI_tNMlQAAAFU"]
[Mon Apr 20 10:16:55.488557 2026] [:error] [pid 11351:tid 11409] [client 20.203.139.33:63595] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeWMlwN8Z1-vktaI_tNMmAAAAFY"]
[Mon Apr 20 10:16:56.181914 2026] [:error] [pid 11352:tid 11436] [client 20.203.139.33:21372] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeWMmGl10mhMSfJ7ir8kcwAAAJY"]
[Mon Apr 20 10:16:57.308780 2026] [:error] [pid 11441:tid 11458] [client 20.203.139.33:3963] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aeWMmcixByFUvmh319CGEAAAAM8"]
[Mon Apr 20 10:16:58.664176 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:24038] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeWMmsixByFUvmh319CGFgAAAM4"]
[Mon Apr 20 10:16:59.821503 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:27900] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeWMm8ixByFUvmh319CGGQAAANE"]
[Mon Apr 20 10:17:00.942308 2026] [:error] [pid 11352:tid 11438] [client 20.203.139.33:3096] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeWMnGl10mhMSfJ7ir8kfQAAAJg"]
[Mon Apr 20 10:17:01.902371 2026] [:error] [pid 11351:tid 11398] [client 20.203.139.33:21374] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeWMnQN8Z1-vktaI_tNMnwAAAEs"]
[Mon Apr 20 10:17:03.317825 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:51658] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWMn8ixByFUvmh319CGIgAAAMk"]
[Mon Apr 20 10:17:04.006894 2026] [:error] [pid 11441:tid 11451] [client 20.203.139.33:23280] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWMoMixByFUvmh319CGJgAAAMg"]
[Mon Apr 20 10:17:04.921607 2026] [:error] [pid 11351:tid 11392] [client 20.203.139.33:3926] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWMoAN8Z1-vktaI_tNMpAAAAEU"]
[Mon Apr 20 10:17:05.835871 2026] [:error] [pid 11351:tid 11406] [client 20.203.139.33:21316] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWMoQN8Z1-vktaI_tNMpgAAAFM"]
[Mon Apr 20 10:17:07.777801 2026] [:error] [pid 11350:tid 11359] [client 20.203.139.33:3958] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeWMo_4EoMBgOJuJnT3_FwAAAAA"]
[Mon Apr 20 10:17:08.554753 2026] [:error] [pid 11350:tid 11375] [client 20.203.139.33:3317] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeWMpP4EoMBgOJuJnT3_GQAAABA"]
[Mon Apr 20 10:17:09.446464 2026] [:error] [pid 11352:tid 11435] [client 20.203.139.33:23231] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeWMpWl10mhMSfJ7ir8kjQAAAJU"]
[Mon Apr 20 10:17:10.086528 2026] [:error] [pid 11351:tid 11389] [client 20.203.139.33:39064] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeWMpgN8Z1-vktaI_tNMrQAAAEI"]
[Mon Apr 20 10:17:18.130496 2026] [:error] [pid 11441:tid 11466] [client 20.203.139.33:3835] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeWMrsixByFUvmh319CGOQAAANc"]
[Mon Apr 20 10:17:19.366793 2026] [:error] [pid 11351:tid 11400] [client 20.203.139.33:3818] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeWMrwN8Z1-vktaI_tNMtwAAAE0"]
[Mon Apr 20 10:17:20.072929 2026] [:error] [pid 11441:tid 11449] [client 20.203.139.33:16824] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeWMsMixByFUvmh319CGPgAAAMY"]
[Mon Apr 20 10:17:21.024779 2026] [:error] [pid 11352:tid 11417] [client 20.203.139.33:25212] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeWMsWl10mhMSfJ7ir8ksAAAAIM"]
[Mon Apr 20 10:17:21.909885 2026] [:error] [pid 11441:tid 11462] [client 20.203.139.33:53652] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeWMscixByFUvmh319CGQQAAANM"]
[Mon Apr 20 10:17:22.616224 2026] [:error] [pid 11350:tid 11367] [client 20.203.139.33:20125] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeWMsv4EoMBgOJuJnT3_XAAAAAg"]
[Mon Apr 20 10:17:23.731731 2026] [:error] [pid 11441:tid 11444] [client 20.203.139.33:55549] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeWMs8ixByFUvmh319CGSQAAAME"]
[Mon Apr 20 10:17:24.930937 2026] [:error] [pid 11441:tid 11454] [client 20.203.139.33:11589] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aeWMtMixByFUvmh319CGTgAAAMs"]
[Mon Apr 20 10:17:25.803318 2026] [:error] [pid 11352:tid 11414] [client 20.203.139.33:15632] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeWMtWl10mhMSfJ7ir8ktgAAAIA"]
[Mon Apr 20 10:17:26.625664 2026] [:error] [pid 11352:tid 11426] [client 20.203.139.33:11630] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeWMtml10mhMSfJ7ir8kugAAAIw"]
[Mon Apr 20 10:17:27.824865 2026] [:error] [pid 11351:tid 11406] [client 20.203.139.33:37969] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeWMtwN8Z1-vktaI_tNMvwAAAFM"]
[Mon Apr 20 10:17:28.973678 2026] [:error] [pid 11350:tid 11377] [client 20.203.139.33:20871] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aeWMuP4EoMBgOJuJnT3_YgAAABI"]
[Mon Apr 20 10:17:30.649483 2026] [:error] [pid 11351:tid 11401] [client 20.203.139.33:41417] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeWMugN8Z1-vktaI_tNMwgAAAE4"]
[Mon Apr 20 10:17:32.149688 2026] [:error] [pid 11352:tid 11418] [client 20.203.139.33:21301] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeWMvGl10mhMSfJ7ir8kxgAAAIQ"]
[Mon Apr 20 10:17:33.357742 2026] [:error] [pid 11350:tid 11381] [client 20.203.139.33:37957] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeWMvf4EoMBgOJuJnT3_bAAAABY"]
[Mon Apr 20 10:17:34.833223 2026] [:error] [pid 11441:tid 11456] [client 20.203.139.33:21661] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aeWMvsixByFUvmh319CGWQAAAM0"]
[Mon Apr 20 10:17:35.900050 2026] [:error] [pid 11441:tid 11447] [client 20.203.139.33:21266] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeWMv8ixByFUvmh319CGXAAAAMQ"]
[Mon Apr 20 10:17:36.882301 2026] [:error] [pid 11350:tid 11364] [client 20.203.139.33:3559] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeWMwP4EoMBgOJuJnT3_cQAAAAU"]
[Mon Apr 20 10:17:37.609564 2026] [:error] [pid 11352:tid 11427] [client 20.203.139.33:41413] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeWMwWl10mhMSfJ7ir8k0gAAAI0"]
[Mon Apr 20 10:17:38.169955 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:32318] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aeWMwsixByFUvmh319CGYQAAAM4"]
[Mon Apr 20 10:17:38.835432 2026] [:error] [pid 11350:tid 11373] [client 20.203.139.33:47528] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeWMwv4EoMBgOJuJnT3_cwAAAA4"]
[Mon Apr 20 10:17:39.543554 2026] [:error] [pid 11350:tid 11366] [client 20.203.139.33:3524] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeWMw_4EoMBgOJuJnT3_dgAAAAc"]
[Mon Apr 20 10:17:40.102420 2026] [:error] [pid 11352:tid 11434] [client 20.203.139.33:19439] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeWMxGl10mhMSfJ7ir8k1gAAAJQ"]
[Mon Apr 20 10:17:41.001524 2026] [:error] [pid 11352:tid 11427] [client 20.203.139.33:41453] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeWMxWl10mhMSfJ7ir8k2AAAAI0"]
[Mon Apr 20 10:17:41.771265 2026] [:error] [pid 11351:tid 11405] [client 20.203.139.33:34306] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeWMxQN8Z1-vktaI_tNMzQAAAFI"]
[Mon Apr 20 10:17:42.585155 2026] [:error] [pid 11351:tid 11410] [client 20.203.139.33:37956] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeWMxgN8Z1-vktaI_tNMzwAAAFc"]
[Mon Apr 20 10:17:43.389485 2026] [:error] [pid 11351:tid 11398] [client 20.203.139.33:20129] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aeWMxwN8Z1-vktaI_tNM0AAAAEs"]
[Mon Apr 20 10:17:44.257209 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon Apr 20 10:17:44.935851 2026] [:error] [pid 11441:tid 11443] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Mon Apr 20 10:17:45.303167 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/xqq.php
[Mon Apr 20 10:17:45.637488 2026] [:error] [pid 11441:tid 11460] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/plss3.php
[Mon Apr 20 10:17:46.037070 2026] [:error] [pid 11441:tid 11465] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Mon Apr 20 10:17:46.383475 2026] [:error] [pid 11441:tid 11462] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Apr 20 10:17:47.108397 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/tinyfilemanager.php
[Mon Apr 20 10:17:47.441870 2026] [:error] [pid 11441:tid 11467] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-update.php
[Mon Apr 20 10:17:47.776214 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:32879] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Mon Apr 20 10:17:48.106857 2026] [:error] [pid 11441:tid 11445] [client 20.203.139.33:32879] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeWMzMixByFUvmh319CGkQAAAMI"]
[Mon Apr 20 10:17:48.897175 2026] [:error] [pid 11441:tid 11459] [client 20.203.139.33:19393] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeWMzMixByFUvmh319CGlQAAANA"]
[Mon Apr 20 10:17:49.629295 2026] [:error] [pid 11441:tid 11462] [client 20.203.139.33:46636] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeWMzcixByFUvmh319CGlwAAANM"]
[Mon Apr 20 10:17:50.135057 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:34131] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "aeWMzsixByFUvmh319CGmAAAAMU"]
[Mon Apr 20 10:17:50.835363 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:3556] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeWMzsixByFUvmh319CGnAAAANU"]
[Mon Apr 20 10:17:51.734370 2026] [:error] [pid 11352:tid 11415] [client 20.203.139.33:3548] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeWMz2l10mhMSfJ7ir8k6QAAAIE"]
[Mon Apr 20 10:17:52.323074 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:34331] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeWM0MixByFUvmh319CGowAAAMk"]
[Mon Apr 20 10:17:52.996168 2026] [:error] [pid 11350:tid 11379] [client 20.203.139.33:19408] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aeWM0P4EoMBgOJuJnT3_egAAABQ"]
[Mon Apr 20 10:17:53.943659 2026] [:error] [pid 11351:tid 11389] [client 20.203.139.33:37988] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWM0QN8Z1-vktaI_tNNAAAAAEI"]
[Mon Apr 20 10:17:54.738265 2026] [:error] [pid 11351:tid 11395] [client 20.203.139.33:21675] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWM0gN8Z1-vktaI_tNNAgAAAEg"]
[Mon Apr 20 10:17:55.701897 2026] [:error] [pid 11350:tid 11366] [client 20.203.139.33:26257] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWM0_4EoMBgOJuJnT3_fQAAAAc"]
[Mon Apr 20 10:17:56.467557 2026] [:error] [pid 11350:tid 11361] [client 20.203.139.33:34124] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aeWM1P4EoMBgOJuJnT3_fgAAAAI"]
[Mon Apr 20 10:17:57.315422 2026] [:error] [pid 11351:tid 11409] [client 20.203.139.33:34361] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM1QN8Z1-vktaI_tNNBAAAAFY"]
[Mon Apr 20 10:17:58.072243 2026] [:error] [pid 11350:tid 11383] [client 20.203.139.33:35736] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM1v4EoMBgOJuJnT3_gQAAABg"]
[Mon Apr 20 10:17:58.983688 2026] [:error] [pid 11351:tid 11404] [client 20.203.139.33:46608] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM1gN8Z1-vktaI_tNNBgAAAFE"]
[Mon Apr 20 10:18:00.719637 2026] [:error] [pid 11350:tid 11376] [client 20.203.139.33:54973] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM2P4EoMBgOJuJnT3_gwAAABE"]
[Mon Apr 20 10:18:01.555680 2026] [:error] [pid 11352:tid 11426] [client 20.203.139.33:21307] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeWM2Wl10mhMSfJ7ir8k8wAAAIw"]
[Mon Apr 20 10:18:02.634552 2026] [:error] [pid 11441:tid 11445] [client 20.203.139.33:20886] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeWM2sixByFUvmh319CGtQAAAMI"]
[Mon Apr 20 10:18:03.767629 2026] [:error] [pid 11352:tid 11436] [client 20.203.139.33:54973] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeWM22l10mhMSfJ7ir8k9wAAAJY"]
[Mon Apr 20 10:18:04.321698 2026] [:error] [pid 11352:tid 11420] [client 20.203.139.33:37986] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "aeWM3Gl10mhMSfJ7ir8k_AAAAIY"]
[Mon Apr 20 10:18:04.983004 2026] [:error] [pid 11441:tid 11453] [client 20.203.139.33:3764] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aeWM3MixByFUvmh319CGvAAAAMo"]
[Mon Apr 20 10:18:05.717140 2026] [:error] [pid 11441:tid 11454] [client 20.203.139.33:32294] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aeWM3cixByFUvmh319CGwAAAAMs"]
[Mon Apr 20 10:18:06.362043 2026] [:error] [pid 11441:tid 11461] [client 20.203.139.33:27394] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aeWM3sixByFUvmh319CGwwAAANI"]
[Mon Apr 20 10:18:07.072357 2026] [:error] [pid 11441:tid 11466] [client 20.203.139.33:3572] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "aeWM38ixByFUvmh319CGxwAAANc"]
[Mon Apr 20 10:18:08.014311 2026] [:error] [pid 11351:tid 11411] [client 20.203.139.33:3571] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM4AN8Z1-vktaI_tNNCgAAAFg"]
[Mon Apr 20 10:18:08.597292 2026] [:error] [pid 11350:tid 11361] [client 20.203.139.33:35716] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM4P4EoMBgOJuJnT3_hwAAAAI"]
[Mon Apr 20 10:18:09.112304 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:3750] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM4cixByFUvmh319CGzAAAAMU"]
[Mon Apr 20 10:18:09.770663 2026] [:error] [pid 11352:tid 11415] [client 20.203.139.33:32256] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeWM4Wl10mhMSfJ7ir8lBQAAAIE"]
[Mon Apr 20 10:18:10.525146 2026] [:error] [pid 11350:tid 11363] [client 20.203.139.33:32316] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aeWM4v4EoMBgOJuJnT3_iwAAAAQ"]
[Mon Apr 20 10:18:11.262578 2026] [:error] [pid 11350:tid 11372] [client 20.203.139.33:34309] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aeWM4_4EoMBgOJuJnT3_jgAAAA0"]
[Mon Apr 20 10:18:11.922434 2026] [:error] [pid 11350:tid 11375] [client 20.203.139.33:37978] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aeWM4_4EoMBgOJuJnT3_kQAAABA"]
[Mon Apr 20 10:18:12.467232 2026] [:error] [pid 11350:tid 11364] [client 20.203.139.33:34122] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aeWM5P4EoMBgOJuJnT3_kwAAAAU"]
[Mon Apr 20 10:18:13.277800 2026] [:error] [pid 11352:tid 11422] [client 20.203.139.33:34343] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aeWM5Wl10mhMSfJ7ir8lCAAAAIg"]
[Mon Apr 20 10:18:14.071950 2026] [:error] [pid 11351:tid 11394] [client 20.203.139.33:46610] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aeWM5gN8Z1-vktaI_tNNDAAAAEc"]
[Mon Apr 20 10:18:14.937564 2026] [:error] [pid 11351:tid 11392] [client 20.203.139.33:21286] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aeWM5gN8Z1-vktaI_tNNDgAAAEU"]
[Mon Apr 20 10:18:16.229566 2026] [:error] [pid 11352:tid 11414] [client 20.203.139.33:3739] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aeWM6Gl10mhMSfJ7ir8lEwAAAIA"]
[Mon Apr 20 10:18:17.143749 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:35766] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeWM6cixByFUvmh319CG0gAAAMk"]
[Mon Apr 20 10:18:18.132312 2026] [:error] [pid 11441:tid 11463] [client 20.203.139.33:3721] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeWM6sixByFUvmh319CG1QAAANQ"]
[Mon Apr 20 10:18:18.898631 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:34401] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeWM6sixByFUvmh319CG2AAAANU"]
[Mon Apr 20 10:18:19.753801 2026] [:error] [pid 11441:tid 11447] [client 20.203.139.33:34392] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aeWM68ixByFUvmh319CG3AAAAMQ"]
[Mon Apr 20 10:18:20.873676 2026] [:error] [pid 11352:tid 11421] [client 20.203.139.33:3728] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeWM7Gl10mhMSfJ7ir8lIQAAAIc"]
[Mon Apr 20 10:18:21.778857 2026] [:error] [pid 11352:tid 11424] [client 20.203.139.33:19414] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeWM7Wl10mhMSfJ7ir8lJQAAAIo"]
[Mon Apr 20 10:18:22.717326 2026] [:error] [pid 11441:tid 11467] [client 20.203.139.33:34308] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeWM7sixByFUvmh319CG5gAAANg"]
[Mon Apr 20 10:18:23.433945 2026] [:error] [pid 11352:tid 11436] [client 20.203.139.33:37948] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aeWM72l10mhMSfJ7ir8lKgAAAJY"]
[Mon Apr 20 10:18:24.035071 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:42767] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeWM8MixByFUvmh319CG8wAAANU"]
[Mon Apr 20 10:18:24.758767 2026] [:error] [pid 11351:tid 11390] [client 20.203.139.33:42785] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeWM8AN8Z1-vktaI_tNNEQAAAEM"]
[Mon Apr 20 10:18:25.340081 2026] [:error] [pid 11352:tid 11432] [client 20.203.139.33:34425] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeWM8Wl10mhMSfJ7ir8lLgAAAJI"]
[Mon Apr 20 10:18:26.174926 2026] [:error] [pid 11350:tid 11361] [client 20.203.139.33:23551] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aeWM8v4EoMBgOJuJnT3_nAAAAAI"]
[Mon Apr 20 10:18:27.102179 2026] [:error] [pid 11350:tid 11363] [client 20.203.139.33:34067] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeWM8_4EoMBgOJuJnT3_ngAAAAQ"]
[Mon Apr 20 10:18:28.652957 2026] [:error] [pid 11351:tid 11408] [client 20.203.139.33:35259] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeWM9AN8Z1-vktaI_tNNFAAAAFU"]
[Mon Apr 20 10:18:29.431460 2026] [:error] [pid 11352:tid 11419] [client 20.203.139.33:34079] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeWM9Wl10mhMSfJ7ir8lMQAAAIU"]
[Mon Apr 20 10:18:30.331502 2026] [:error] [pid 11351:tid 11401] [client 20.203.139.33:34428] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "aeWM9gN8Z1-vktaI_tNNGwAAAE4"]
[Mon Apr 20 10:18:31.032501 2026] [:error] [pid 11352:tid 11426] [client 20.203.139.33:55578] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeWM92l10mhMSfJ7ir8lMwAAAIw"]
[Mon Apr 20 10:18:31.751039 2026] [:error] [pid 11441:tid 11454] [client 20.203.139.33:34086] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeWM98ixByFUvmh319CHCAAAAMs"]
[Mon Apr 20 10:18:32.415609 2026] [:error] [pid 11352:tid 11416] [client 20.203.139.33:26652] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeWM-Gl10mhMSfJ7ir8lNQAAAII"]
[Mon Apr 20 10:18:33.277607 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:35244] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aeWM-cixByFUvmh319CHDQAAAMU"]
[Mon Apr 20 10:18:33.969999 2026] [:error] [pid 11352:tid 11414] [client 20.203.139.33:52989] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeWM-Wl10mhMSfJ7ir8lNgAAAIA"]
[Mon Apr 20 10:18:34.699453 2026] [:error] [pid 11351:tid 11403] [client 20.203.139.33:35235] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeWM-gN8Z1-vktaI_tNNJQAAAFA"]
[Mon Apr 20 10:18:35.496228 2026] [:error] [pid 11351:tid 11400] [client 20.203.139.33:42769] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeWM-wN8Z1-vktaI_tNNKQAAAE0"]
[Mon Apr 20 10:18:36.671835 2026] [:error] [pid 11441:tid 11456] [client 20.203.139.33:23503] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-michan.php"] [unique_id "aeWM_MixByFUvmh319CHEQAAAM0"]
[Mon Apr 20 10:18:37.845349 2026] [:error] [pid 11441:tid 11462] [client 20.203.139.33:55614] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aeWM_cixByFUvmh319CHFQAAANM"]
[Mon Apr 20 10:18:38.604060 2026] [:error] [pid 11352:tid 11431] [client 20.203.139.33:35200] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aeWM_ml10mhMSfJ7ir8lQAAAAJE"]
[Mon Apr 20 10:18:39.553573 2026] [:error] [pid 11352:tid 11426] [client 20.203.139.33:11924] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aeWM_2l10mhMSfJ7ir8lQQAAAIw"]
[Mon Apr 20 10:18:40.780791 2026] [:error] [pid 11352:tid 11414] [client 20.203.139.33:56462] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aeWNAGl10mhMSfJ7ir8lRQAAAIA"]
[Mon Apr 20 10:18:42.130122 2026] [:error] [pid 11441:tid 11466] [client 20.203.139.33:29400] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeWNAsixByFUvmh319CHGgAAANc"]
[Mon Apr 20 10:18:43.345134 2026] [:error] [pid 11441:tid 11459] [client 20.203.139.33:25569] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeWNA8ixByFUvmh319CHHgAAANA"]
[Mon Apr 20 10:18:44.654113 2026] [:error] [pid 11352:tid 11415] [client 20.203.139.33:26911] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeWNBGl10mhMSfJ7ir8lSwAAAIE"]
[Mon Apr 20 10:18:45.355398 2026] [:error] [pid 11441:tid 11454] [client 20.203.139.33:26660] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aeWNBcixByFUvmh319CHIAAAAMs"]
[Mon Apr 20 10:18:46.010755 2026] [:error] [pid 11350:tid 11367] [client 20.203.139.33:46242] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeWNBv4EoMBgOJuJnT0ABAAAAAg"]
[Mon Apr 20 10:18:46.850339 2026] [:error] [pid 11441:tid 11443] [client 20.203.139.33:34810] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeWNBsixByFUvmh319CHIQAAAMA"]
[Mon Apr 20 10:18:47.634614 2026] [:error] [pid 11441:tid 11466] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Mon Apr 20 10:18:48.118132 2026] [:error] [pid 11441:tid 11464] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Mon Apr 20 10:18:48.362027 2026] [:error] [pid 11441:tid 11459] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Mon Apr 20 10:18:48.837471 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Mon Apr 20 10:18:49.314784 2026] [:error] [pid 11441:tid 11454] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon Apr 20 10:18:49.589304 2026] [:error] [pid 11441:tid 11445] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Mon Apr 20 10:18:49.826532 2026] [:error] [pid 11441:tid 11443] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Mon Apr 20 10:18:50.066302 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:30686] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Mon Apr 20 10:18:50.300803 2026] [:error] [pid 11441:tid 11455] [client 20.203.139.33:30686] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeWNCsixByFUvmh319CHNAAAAMw"]
[Mon Apr 20 10:18:51.390532 2026] [:error] [pid 11350:tid 11372] [client 20.203.139.33:46269] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeWNC_4EoMBgOJuJnT0ACgAAAA0"]
[Mon Apr 20 10:18:52.330073 2026] [:error] [pid 11352:tid 11433] [client 20.203.139.33:63656] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeWNDGl10mhMSfJ7ir8lXAAAAJM"]
[Mon Apr 20 10:18:53.177586 2026] [:error] [pid 11352:tid 11415] [client 20.203.139.33:34607] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aeWNDWl10mhMSfJ7ir8lXwAAAIE"]
[Mon Apr 20 10:18:54.159789 2026] [:error] [pid 11352:tid 11419] [client 20.203.139.33:28601] [client 20.203.139.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeWNDml10mhMSfJ7ir8lZAAAAIU"]
[Mon Apr 20 10:18:55.220796 2026] [:error] [pid 11351:tid 11390] [client 20.203.139.33:30400] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeWNDwN8Z1-vktaI_tNNRAAAAEM"]
[Mon Apr 20 10:18:56.267250 2026] [:error] [pid 11350:tid 11366] [client 20.203.139.33:28559] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeWNEP4EoMBgOJuJnT0ADwAAAAc"]
[Mon Apr 20 10:18:57.052729 2026] [:error] [pid 11350:tid 11380] [client 20.203.139.33:63643] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeWNEf4EoMBgOJuJnT0AEQAAABU"]
[Mon Apr 20 10:18:57.864401 2026] [:error] [pid 11352:tid 11428] [client 20.203.139.33:28564] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aeWNEWl10mhMSfJ7ir8lawAAAI4"]
[Mon Apr 20 10:18:58.388643 2026] [:error] [pid 11352:tid 11432] [client 20.203.139.33:35788] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeWNEml10mhMSfJ7ir8lbgAAAJI"]
[Mon Apr 20 10:18:59.075402 2026] [:error] [pid 11441:tid 11456] [client 20.203.139.33:54341] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeWNE8ixByFUvmh319CHPgAAAM0"]
[Mon Apr 20 10:18:59.687815 2026] [:error] [pid 11350:tid 11362] [client 20.203.139.33:29749] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeWNE_4EoMBgOJuJnT0AFwAAAAM"]
[Mon Apr 20 10:19:00.525859 2026] [:error] [pid 11352:tid 11416] [client 20.203.139.33:28596] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeWNFGl10mhMSfJ7ir8lcQAAAII"]
[Mon Apr 20 10:19:01.078958 2026] [:error] [pid 11350:tid 11378] [client 20.203.139.33:41749] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeWNFf4EoMBgOJuJnT0AGAAAABM"]
[Mon Apr 20 10:19:01.758748 2026] [:error] [pid 11352:tid 11420] [client 20.203.139.33:30952] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeWNFWl10mhMSfJ7ir8lcwAAAIY"]
[Mon Apr 20 10:19:02.448453 2026] [:error] [pid 11351:tid 11396] [client 20.203.139.33:23657] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeWNFgN8Z1-vktaI_tNNTgAAAEk"]
[Mon Apr 20 10:19:03.139453 2026] [:error] [pid 11351:tid 11409] [client 20.203.139.33:57020] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aeWNFwN8Z1-vktaI_tNNTwAAAFY"]
[Mon Apr 20 10:19:04.062634 2026] [:error] [pid 11350:tid 11373] [client 20.203.139.33:30164] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeWNGP4EoMBgOJuJnT0AGwAAAA4"]
[Mon Apr 20 10:19:04.654286 2026] [:error] [pid 11352:tid 11435] [client 20.203.139.33:23632] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeWNGGl10mhMSfJ7ir8leQAAAJU"]
[Mon Apr 20 10:19:05.272472 2026] [:error] [pid 11352:tid 11429] [client 20.203.139.33:35814] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeWNGWl10mhMSfJ7ir8legAAAI8"]
[Mon Apr 20 10:19:06.060613 2026] [:error] [pid 11350:tid 11367] [client 20.203.139.33:35821] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeWNGv4EoMBgOJuJnT0AHAAAAAg"]
[Mon Apr 20 10:19:06.714957 2026] [:error] [pid 11352:tid 11428] [client 20.203.139.33:19822] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aeWNGml10mhMSfJ7ir8lfAAAAI4"]
[Mon Apr 20 10:19:07.304109 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:38300] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aeWNG8ixByFUvmh319CHTQAAAM4"]
[Mon Apr 20 10:19:08.060295 2026] [:error] [pid 11351:tid 11392] [client 20.203.139.33:54368] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aeWNHAN8Z1-vktaI_tNNUwAAAEU"]
[Mon Apr 20 10:19:08.675738 2026] [:error] [pid 11350:tid 11362] [client 20.203.139.33:56994] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "aeWNHP4EoMBgOJuJnT0AHwAAAAM"]
[Mon Apr 20 10:19:09.266534 2026] [:error] [pid 11350:tid 11378] [client 20.203.139.33:57008] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aeWNHf4EoMBgOJuJnT0AIQAAABM"]
[Mon Apr 20 10:19:09.969911 2026] [:error] [pid 11351:tid 11410] [client 20.203.139.33:38294] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aeWNHQN8Z1-vktaI_tNNVAAAAFc"]
[Mon Apr 20 10:19:10.829456 2026] [:error] [pid 11351:tid 11387] [client 20.203.139.33:41762] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aeWNHgN8Z1-vktaI_tNNVwAAAEA"]
[Mon Apr 20 10:19:11.844029 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:54336] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev.php"] [unique_id "aeWNH8ixByFUvmh319CHXAAAAMU"]
[Mon Apr 20 10:19:12.657773 2026] [:error] [pid 11441:tid 11458] [client 20.203.139.33:24443] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "aeWNIMixByFUvmh319CHXgAAAM8"]
[Mon Apr 20 10:19:13.630473 2026] [:error] [pid 11350:tid 11363] [client 20.203.139.33:3228] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "aeWNIf4EoMBgOJuJnT0ALAAAAAQ"]
[Mon Apr 20 10:19:15.238977 2026] [:error] [pid 11350:tid 11364] [client 20.203.139.33:56981] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "aeWNI_4EoMBgOJuJnT0AMAAAAAU"]
[Mon Apr 20 10:19:16.322003 2026] [:error] [pid 11441:tid 11456] [client 20.203.139.33:24381] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "aeWNJMixByFUvmh319CHagAAAM0"]
[Mon Apr 20 10:19:17.413101 2026] [:error] [pid 11441:tid 11467] [client 20.203.139.33:20561] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aeWNJcixByFUvmh319CHcAAAANg"]
[Mon Apr 20 10:19:18.108178 2026] [:error] [pid 11441:tid 11459] [client 20.203.139.33:24755] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aeWNJsixByFUvmh319CHdAAAANA"]
[Mon Apr 20 10:19:19.966902 2026] [:error] [pid 11351:tid 11391] [client 20.203.139.33:3143] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aeWNJwN8Z1-vktaI_tNNXgAAAEQ"]
[Mon Apr 20 10:19:21.390558 2026] [:error] [pid 11350:tid 11374] [client 20.203.139.33:24348] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "aeWNKf4EoMBgOJuJnT0ANAAAAA8"]
[Mon Apr 20 10:19:22.271848 2026] [:error] [pid 11351:tid 11399] [client 20.203.139.33:23554] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aeWNKgN8Z1-vktaI_tNNZAAAAEw"]
[Mon Apr 20 10:19:23.019897 2026] [:error] [pid 11350:tid 11368] [client 20.203.139.33:24358] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aeWNK_4EoMBgOJuJnT0AOAAAAAk"]
[Mon Apr 20 10:19:23.768297 2026] [:error] [pid 11352:tid 11433] [client 20.203.139.33:27490] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aeWNK2l10mhMSfJ7ir8llAAAAJM"]
[Mon Apr 20 10:19:24.822940 2026] [:error] [pid 11441:tid 11452] [client 20.203.139.33:24727] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gssdd.php"] [unique_id "aeWNLMixByFUvmh319CHfAAAAMk"]
[Mon Apr 20 10:19:25.417658 2026] [:error] [pid 11352:tid 11414] [client 20.203.139.33:39127] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aeWNLWl10mhMSfJ7ir8llwAAAIA"]
[Mon Apr 20 10:19:26.117063 2026] [:error] [pid 11352:tid 11429] [client 20.203.139.33:37225] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aeWNLml10mhMSfJ7ir8lmQAAAI8"]
[Mon Apr 20 10:19:26.923101 2026] [:error] [pid 11352:tid 11432] [client 20.203.139.33:3169] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aeWNLml10mhMSfJ7ir8lnwAAAJI"]
[Mon Apr 20 10:19:27.727888 2026] [:error] [pid 11351:tid 11391] [client 20.203.139.33:51635] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aeWNLwN8Z1-vktaI_tNNcAAAAEQ"]
[Mon Apr 20 10:19:28.515363 2026] [:error] [pid 11441:tid 11445] [client 20.203.139.33:37212] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aeWNMMixByFUvmh319CHjQAAAMI"]
[Mon Apr 20 10:19:29.434867 2026] [:error] [pid 11352:tid 11421] [client 20.203.139.33:24432] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aeWNMWl10mhMSfJ7ir8lqwAAAIc"]
[Mon Apr 20 10:19:30.398924 2026] [:error] [pid 11441:tid 11451] [client 20.203.139.33:37223] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aeWNMsixByFUvmh319CHogAAAMg"]
[Mon Apr 20 10:19:31.325553 2026] [:error] [pid 11441:tid 11463] [client 20.203.139.33:24322] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "aeWNM8ixByFUvmh319CHrwAAANQ"]
[Mon Apr 20 10:19:31.925731 2026] [:error] [pid 11350:tid 11365] [client 20.203.139.33:23612] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeWNM_4EoMBgOJuJnT0APQAAAAY"]
[Mon Apr 20 10:19:32.711969 2026] [:error] [pid 11350:tid 11376] [client 20.203.139.33:3177] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeWNNP4EoMBgOJuJnT0APgAAABE"]
[Mon Apr 20 10:19:33.411985 2026] [:error] [pid 11351:tid 11405] [client 20.203.139.33:56426] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeWNNQN8Z1-vktaI_tNNeQAAAFI"]
[Mon Apr 20 10:19:34.402042 2026] [:error] [pid 11351:tid 11403] [client 20.203.139.33:42824] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeWNNgN8Z1-vktaI_tNNewAAAFA"]
[Mon Apr 20 10:19:34.877673 2026] [:error] [pid 11350:tid 11382] [client 20.203.139.33:56418] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeWNNv4EoMBgOJuJnT0APwAAABc"]
[Mon Apr 20 10:19:35.512459 2026] [:error] [pid 11351:tid 11408] [client 20.203.139.33:39158] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeWNNwN8Z1-vktaI_tNNfgAAAFU"]
[Mon Apr 20 10:19:36.262776 2026] [:error] [pid 11350:tid 11366] [client 20.203.139.33:3191] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeWNOP4EoMBgOJuJnT0AQQAAAAc"]
[Mon Apr 20 10:19:37.146416 2026] [:error] [pid 11352:tid 11432] [client 20.203.139.33:25489] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axx.php"] [unique_id "aeWNOWl10mhMSfJ7ir8l4QAAAJI"]
[Mon Apr 20 10:19:37.932672 2026] [:error] [pid 11441:tid 11461] [client 20.203.139.33:39157] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeWNOcixByFUvmh319CH1wAAANI"]
[Mon Apr 20 10:19:38.805390 2026] [:error] [pid 11441:tid 11453] [client 20.203.139.33:56403] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeWNOsixByFUvmh319CH2QAAAMo"]
[Mon Apr 20 10:19:39.709049 2026] [:error] [pid 11441:tid 11465] [client 20.203.139.33:24347] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeWNO8ixByFUvmh319CH2wAAANY"]
[Mon Apr 20 10:19:40.903843 2026] [:error] [pid 11351:tid 11392] [client 20.203.139.33:24350] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfashell.php"] [unique_id "aeWNPAN8Z1-vktaI_tNNhAAAAEU"]
[Mon Apr 20 10:19:41.787078 2026] [:error] [pid 11441:tid 11448] [client 20.203.139.33:12002] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeWNPcixByFUvmh319CH4wAAAMU"]
[Mon Apr 20 10:19:43.094993 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:42470] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeWNP8ixByFUvmh319CH7gAAAM4"]
[Mon Apr 20 10:19:44.124462 2026] [:error] [pid 11351:tid 11399] [client 20.203.139.33:24379] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeWNQAN8Z1-vktaI_tNNiAAAAEw"]
[Mon Apr 20 10:19:45.346824 2026] [:error] [pid 11441:tid 11456] [client 20.203.139.33:23975] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeWNQcixByFUvmh319CH-gAAAM0"]
[Mon Apr 20 10:19:46.384658 2026] [:error] [pid 11352:tid 11415] [client 20.203.139.33:12009] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeWNQml10mhMSfJ7ir8mAAAAAIE"]
[Mon Apr 20 10:19:48.070908 2026] [:error] [pid 11350:tid 11381] [client 20.203.139.33:41841] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeWNRP4EoMBgOJuJnT0ATAAAABY"]
[Mon Apr 20 10:19:49.816725 2026] [:error] [pid 11350:tid 11374] [client 20.203.139.33:56923] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeWNRf4EoMBgOJuJnT0AUQAAAA8"]
[Mon Apr 20 10:19:50.834406 2026] [:error] [pid 11350:tid 11373] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Mon Apr 20 10:19:51.159252 2026] [:error] [pid 11350:tid 11375] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Mon Apr 20 10:19:51.598282 2026] [:error] [pid 11350:tid 11363] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Mon Apr 20 10:19:52.269654 2026] [:error] [pid 11350:tid 11378] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Apr 20 10:19:52.593927 2026] [:error] [pid 11350:tid 11359] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Mon Apr 20 10:19:52.956085 2026] [:error] [pid 11350:tid 11361] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Mon Apr 20 10:19:53.282627 2026] [:error] [pid 11350:tid 11360] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/hypo.php
[Mon Apr 20 10:19:53.619342 2026] [:error] [pid 11350:tid 11365] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Mon Apr 20 10:19:53.945127 2026] [:error] [pid 11350:tid 11371] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Mon Apr 20 10:19:54.305670 2026] [:error] [pid 11350:tid 11382] [client 20.203.139.33:25157] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Mon Apr 20 10:19:54.627058 2026] [:error] [pid 11350:tid 11368] [client 20.203.139.33:25157] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeWNSv4EoMBgOJuJnT0AZAAAAAk"]
[Mon Apr 20 10:19:55.216442 2026] [:error] [pid 11351:tid 11405] [client 20.203.139.33:41345] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeWNSwN8Z1-vktaI_tNNlQAAAFI"]
[Mon Apr 20 10:19:55.761889 2026] [:error] [pid 11441:tid 11457] [client 20.203.139.33:16816] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeWNS8ixByFUvmh319CICwAAAM4"]
[Mon Apr 20 10:19:56.405719 2026] [:error] [pid 11351:tid 11398] [client 20.203.139.33:27142] [client 20.203.139.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeWNTAN8Z1-vktaI_tNNmgAAAEs"]
[Mon Apr 20 11:25:43.252647 2026] [:error] [pid 11441:tid 11456] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Mon Apr 20 11:25:43.552440 2026] [:error] [pid 11441:tid 11463] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/oh.php
[Mon Apr 20 11:25:43.842606 2026] [:error] [pid 11441:tid 11454] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/lim.php
[Mon Apr 20 11:25:44.133187 2026] [:error] [pid 11441:tid 11449] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/hex.php
[Mon Apr 20 11:25:44.740364 2026] [:error] [pid 11441:tid 11457] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/gezdjgie.php
[Mon Apr 20 11:25:45.031171 2026] [:error] [pid 11441:tid 11446] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Mon Apr 20 11:25:45.327970 2026] [:error] [pid 11441:tid 11455] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon Apr 20 11:25:45.618154 2026] [:error] [pid 11441:tid 11451] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Mon Apr 20 11:25:45.923026 2026] [:error] [pid 11441:tid 11466] [client 4.223.64.52:1223] File does not exist: /usr/local/apache/htdocs/suspended-page/just2.php
[Mon Apr 20 11:25:46.220091 2026] [:error] [pid 11441:tid 11463] [client 4.223.64.52:1223] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aeWcusixByFUvmh319Cx6QAAANQ"]
[Mon Apr 20 11:25:55.129788 2026] [:error] [pid 11351:tid 11396] [client 4.223.64.52:8463] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aeWcwwN8Z1-vktaI_tNk4QAAAEk"]
[Mon Apr 20 11:25:56.176567 2026] [:error] [pid 11441:tid 11448] [client 4.223.64.52:17412] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aeWcxMixByFUvmh319CyAgAAAMU"]
[Mon Apr 20 11:25:57.870561 2026] [:error] [pid 11350:tid 11371] [client 4.223.64.52:1739] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aeWcxf4EoMBgOJuJnT0SngAAAAw"]
[Mon Apr 20 11:26:00.998735 2026] [:error] [pid 11351:tid 11409] [client 4.223.64.52:3659] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aeWcyAN8Z1-vktaI_tNk7AAAAFY"]
[Mon Apr 20 11:26:03.813991 2026] [:error] [pid 11441:tid 11467] [client 4.223.64.52:8549] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aeWcy8ixByFUvmh319CyEQAAANg"]
[Mon Apr 20 11:26:22.797580 2026] [:error] [pid 11351:tid 11408] [client 4.223.64.52:12052] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ihodcrk.php"] [unique_id "aeWc3gN8Z1-vktaI_tNlDAAAAFU"]
[Mon Apr 20 11:26:35.562563 2026] [:error] [pid 11441:tid 11458] [client 4.223.64.52:11573] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aeWc68ixByFUvmh319CyWAAAAM8"]
[Mon Apr 20 11:26:39.133458 2026] [:error] [pid 11351:tid 11393] [client 4.223.64.52:12301] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aeWc7wN8Z1-vktaI_tNlLwAAAEY"]
[Mon Apr 20 11:26:43.818126 2026] [:error] [pid 11441:tid 11447] [client 4.223.64.52:19803] [client 4.223.64.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mini.php"] [unique_id "aeWc88ixByFUvmh319CyXwAAAMQ"]
[Mon Apr 20 11:26:58.225928 2026] [:error] [pid 11441:tid 11444] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/owrlfoa.php
[Mon Apr 20 11:26:58.573732 2026] [:error] [pid 11441:tid 11463] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Mon Apr 20 11:26:59.062052 2026] [:error] [pid 11441:tid 11467] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/sim.php
[Mon Apr 20 11:26:59.374300 2026] [:error] [pid 11441:tid 11445] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/bx.php
[Mon Apr 20 11:26:59.664131 2026] [:error] [pid 11441:tid 11451] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Apr 20 11:26:59.953678 2026] [:error] [pid 11441:tid 11460] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Mon Apr 20 11:27:00.263014 2026] [:error] [pid 11441:tid 11457] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/afggdg.php
[Mon Apr 20 11:27:00.553077 2026] [:error] [pid 11441:tid 11456] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Mon Apr 20 11:27:00.855398 2026] [:error] [pid 11441:tid 11447] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the1.php
[Mon Apr 20 11:27:01.154269 2026] [:error] [pid 11441:tid 11444] [client 4.223.64.52:17643] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Mon Apr 20 12:01:11.753529 2026] [:error] [pid 11351:tid 11401] [client 43.165.69.68:59838] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeWlBwN8Z1-vktaI_tNwmwAAAE4"]
[Mon Apr 20 13:12:00.285437 2026] [:error] [pid 11352:tid 11438] [client 170.106.73.216:42486] [client 170.106.73.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeW1oGl10mhMSfJ7ir9toQAAAJg"]
[Mon Apr 20 13:36:22.142617 2026] [:error] [pid 11351:tid 11388] [client 103.65.237.216:54519] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "aeW7VgN8Z1-vktaI_tOGcgAAAEE"]
[Mon Apr 20 13:36:22.459065 2026] [:error] [pid 11352:tid 11414] [client 103.65.237.216:54645] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "aeW7Vml10mhMSfJ7ir90TgAAAIA"]
[Mon Apr 20 15:43:57.945624 2026] [:error] [pid 11441:tid 11461] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Mon Apr 20 15:43:58.199876 2026] [:error] [pid 11441:tid 11467] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Mon Apr 20 15:43:58.443126 2026] [:error] [pid 11441:tid 11456] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/xminie.php
[Mon Apr 20 15:43:58.682733 2026] [:error] [pid 11441:tid 11459] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/x=34.php
[Mon Apr 20 15:43:58.930915 2026] [:error] [pid 11441:tid 11446] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/insta.php
[Mon Apr 20 15:43:59.169733 2026] [:error] [pid 11441:tid 11463] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Mon Apr 20 15:43:59.410686 2026] [:error] [pid 11441:tid 11455] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/xxa.php
[Mon Apr 20 15:43:59.671714 2026] [:error] [pid 11441:tid 11457] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Mon Apr 20 15:43:59.983972 2026] [:error] [pid 11441:tid 11465] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/zxcs.php
[Mon Apr 20 15:44:00.223850 2026] [:error] [pid 11441:tid 11448] [client 20.203.199.44:5577] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Mon Apr 20 15:44:00.459929 2026] [:error] [pid 11441:tid 11466] [client 20.203.199.44:5577] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeXZQMixByFUvmh319AkeQAAANc"]
[Mon Apr 20 15:44:01.813430 2026] [:error] [pid 6928:tid 6948] [client 20.203.199.44:46041] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeXZQR3y7MHq1iB0qYo-4AAAAVI"]
[Mon Apr 20 15:44:02.713820 2026] [:error] [pid 11441:tid 11443] [client 20.203.199.44:62639] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeXZQsixByFUvmh319AkfwAAAMA"]
[Mon Apr 20 15:44:03.468005 2026] [:error] [pid 11350:tid 11364] [client 20.203.199.44:56938] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aeXZQ_4EoMBgOJuJnT1D8wAAAAU"]
[Mon Apr 20 15:44:09.155509 2026] [:error] [pid 6928:tid 6940] [client 20.203.199.44:61603] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aeXZSR3y7MHq1iB0qYo-6wAAAUo"]
[Mon Apr 20 15:44:11.000784 2026] [:error] [pid 11441:tid 11449] [client 20.203.199.44:54997] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aeXZSsixByFUvmh319AkiAAAAMY"]
[Mon Apr 20 15:44:14.259116 2026] [:error] [pid 11351:tid 11401] [client 20.203.199.44:48080] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aeXZTgN8Z1-vktaI_tOd4wAAAE4"]
[Mon Apr 20 15:44:19.883122 2026] [:error] [pid 11351:tid 11392] [client 20.203.199.44:54082] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeXZUwN8Z1-vktaI_tOd6wAAAEU"]
[Mon Apr 20 15:44:20.902649 2026] [:error] [pid 6928:tid 6942] [client 20.203.199.44:55509] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeXZVB3y7MHq1iB0qYo_AgAAAUw"]
[Mon Apr 20 15:44:24.247786 2026] [:error] [pid 11441:tid 11467] [client 20.203.199.44:48910] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeXZWMixByFUvmh319AkkgAAANg"]
[Mon Apr 20 15:44:24.977927 2026] [:error] [pid 11441:tid 11446] [client 20.203.199.44:59498] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aeXZWMixByFUvmh319AklQAAAMM"]
[Mon Apr 20 15:44:25.851323 2026] [:error] [pid 6928:tid 6952] [client 20.203.199.44:53386] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeXZWR3y7MHq1iB0qYo_BgAAAVY"]
[Mon Apr 20 15:44:26.730085 2026] [:error] [pid 11352:tid 11424] [client 20.203.199.44:53666] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeXZWml10mhMSfJ7ir-V3gAAAIo"]
[Mon Apr 20 15:44:27.684393 2026] [:error] [pid 6928:tid 6947] [client 20.203.199.44:58072] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeXZWx3y7MHq1iB0qYo_DAAAAVE"]
[Mon Apr 20 15:44:30.157520 2026] [:error] [pid 42014:tid 42037] [client 20.203.199.44:57035] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "aeXZXsek-00-ZI0f1NoqRQAAARU"]
[Mon Apr 20 15:44:31.932729 2026] [:error] [pid 11441:tid 11467] [client 20.203.199.44:58124] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeXZX8ixByFUvmh319AknAAAANg"]
[Mon Apr 20 15:44:34.292992 2026] [:error] [pid 11351:tid 11390] [client 20.203.199.44:53634] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeXZYgN8Z1-vktaI_tOd9QAAAEM"]
[Mon Apr 20 15:44:39.954343 2026] [:error] [pid 11351:tid 11403] [client 20.203.199.44:59016] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeXZZwN8Z1-vktaI_tOd-AAAAFA"]
[Mon Apr 20 15:44:40.775484 2026] [:error] [pid 6928:tid 6943] [client 20.203.199.44:54457] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "aeXZaB3y7MHq1iB0qYo_JAAAAU0"]
[Mon Apr 20 15:44:43.343483 2026] [:error] [pid 11350:tid 11381] [client 20.203.199.44:55058] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-kikikoko.php"] [unique_id "aeXZa_4EoMBgOJuJnT1EEAAAABY"]
[Mon Apr 20 15:44:45.013493 2026] [:error] [pid 42014:tid 42037] [client 20.203.199.44:47148] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-kikikoko.php"] [unique_id "aeXZbcek-00-ZI0f1NoqVQAAARU"]
[Mon Apr 20 15:44:45.754169 2026] [:error] [pid 42014:tid 42023] [client 20.203.199.44:47118] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-kikikoko.php"] [unique_id "aeXZbcek-00-ZI0f1NoqWgAAAQc"]
[Mon Apr 20 15:44:47.343456 2026] [:error] [pid 42014:tid 42038] [client 20.203.199.44:5219] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file-kikikoko.php"] [unique_id "aeXZb8ek-00-ZI0f1NoqXwAAARY"]
[Mon Apr 20 15:44:49.647662 2026] [:error] [pid 6928:tid 6934] [client 20.203.199.44:54579] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kikikoko.php"] [unique_id "aeXZcR3y7MHq1iB0qYo_MwAAAUQ"]
[Mon Apr 20 15:44:56.611687 2026] [:error] [pid 11441:tid 11466] [client 20.203.199.44:54546] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kikikoko.php"] [unique_id "aeXZeMixByFUvmh319AkqwAAANc"]
[Mon Apr 20 15:44:57.935935 2026] [:error] [pid 11350:tid 11367] [client 20.203.199.44:5762] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kikikoko.php"] [unique_id "aeXZef4EoMBgOJuJnT1EIgAAAAg"]
[Mon Apr 20 15:44:59.106306 2026] [:error] [pid 11350:tid 11380] [client 20.203.199.44:47146] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kikikoko.php"] [unique_id "aeXZe_4EoMBgOJuJnT1EJAAAABU"]
[Mon Apr 20 15:45:03.373896 2026] [:error] [pid 11351:tid 11394] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Mon Apr 20 15:45:03.620847 2026] [:error] [pid 11351:tid 11407] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Mon Apr 20 15:45:04.921621 2026] [:error] [pid 11351:tid 11407] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/sad821.php
[Mon Apr 20 15:45:05.286527 2026] [:error] [pid 11351:tid 11401] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8210.php
[Mon Apr 20 15:45:05.539905 2026] [:error] [pid 11351:tid 11395] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Mon Apr 20 15:45:05.776889 2026] [:error] [pid 11351:tid 11404] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/man.php
[Mon Apr 20 15:45:06.030175 2026] [:error] [pid 11351:tid 11388] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Mon Apr 20 15:45:06.368983 2026] [:error] [pid 11351:tid 11399] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Mon Apr 20 15:45:06.624014 2026] [:error] [pid 11351:tid 11405] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Mon Apr 20 15:45:06.865101 2026] [:error] [pid 11351:tid 11406] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Apr 20 15:45:07.471658 2026] [:error] [pid 11351:tid 11389] [client 20.203.199.44:55106] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Mon Apr 20 15:45:07.711642 2026] [:error] [pid 11351:tid 11411] [client 20.203.199.44:55106] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeXZgwN8Z1-vktaI_tOeTQAAAFg"]
[Mon Apr 20 15:45:16.968561 2026] [:error] [pid 6928:tid 6942] [client 20.203.199.44:55436] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeXZjB3y7MHq1iB0qYo_YQAAAUw"]
[Mon Apr 20 15:45:21.221902 2026] [:error] [pid 11441:tid 11458] [client 20.203.199.44:54171] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aeXZkcixByFUvmh319Ak0QAAAM8"]
[Mon Apr 20 15:45:24.867441 2026] [:error] [pid 6928:tid 6951] [client 20.203.199.44:53840] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aeXZlB3y7MHq1iB0qYo_cQAAAVU"]
[Mon Apr 20 15:45:25.723658 2026] [:error] [pid 11441:tid 11452] [client 20.203.199.44:58379] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aeXZlcixByFUvmh319Ak1QAAAMk"]
[Mon Apr 20 15:45:27.146850 2026] [:error] [pid 42014:tid 42030] [client 20.203.199.44:60153] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aeXZl8ek-00-ZI0f1NoqmgAAAQ4"]
[Mon Apr 20 15:45:32.971083 2026] [:error] [pid 11351:tid 11402] [client 20.203.199.44:61772] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aeXZnAN8Z1-vktaI_tOeYAAAAE8"]
[Mon Apr 20 15:45:36.768296 2026] [:error] [pid 11352:tid 11435] [client 36.41.75.167:38292] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeXZoGl10mhMSfJ7ir-WkAAAAJU"]
[Mon Apr 20 15:45:39.550295 2026] [:error] [pid 42014:tid 42037] [client 20.203.199.44:58911] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeXZo8ek-00-ZI0f1NoqpwAAARU"]
[Mon Apr 20 15:45:41.813445 2026] [:error] [pid 6928:tid 6932] [client 20.203.199.44:45984] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeXZpR3y7MHq1iB0qYo_kwAAAUI"]
[Mon Apr 20 15:45:42.688884 2026] [:error] [pid 6928:tid 6937] [client 20.203.199.44:61964] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeXZph3y7MHq1iB0qYo_mgAAAUc"]
[Mon Apr 20 15:45:43.740573 2026] [:error] [pid 6928:tid 6952] [client 20.203.199.44:50632] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeXZpx3y7MHq1iB0qYo_oAAAAVY"]
[Mon Apr 20 15:45:44.486587 2026] [:error] [pid 6928:tid 6947] [client 20.203.199.44:56224] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeXZqB3y7MHq1iB0qYo_pgAAAVE"]
[Mon Apr 20 15:45:45.176931 2026] [:error] [pid 6928:tid 6939] [client 20.203.199.44:56993] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeXZqR3y7MHq1iB0qYo_rAAAAUk"]
[Mon Apr 20 15:45:46.821050 2026] [:error] [pid 42014:tid 42029] [client 20.203.199.44:61437] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeXZqsek-00-ZI0f1NoqqgAAAQ0"]
[Mon Apr 20 15:45:47.558267 2026] [:error] [pid 6928:tid 6947] [client 20.203.199.44:61962] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeXZqx3y7MHq1iB0qYo_uQAAAVE"]
[Mon Apr 20 15:45:48.261323 2026] [:error] [pid 42014:tid 42018] [client 20.203.199.44:58814] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aeXZrMek-00-ZI0f1NoqsAAAAQI"]
[Mon Apr 20 15:45:49.382403 2026] [:error] [pid 11441:tid 11455] [client 20.203.199.44:54262] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aeXZrcixByFUvmh319Ak4QAAAMw"]
[Mon Apr 20 15:45:50.238725 2026] [:error] [pid 6928:tid 6933] [client 20.203.199.44:54216] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aeXZrh3y7MHq1iB0qYo_yAAAAUM"]
[Mon Apr 20 15:45:51.117309 2026] [:error] [pid 11352:tid 11417] [client 20.203.199.44:58543] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aeXZr2l10mhMSfJ7ir-WlgAAAIM"]
[Mon Apr 20 15:45:51.664567 2026] [:error] [pid 6928:tid 6948] [client 20.203.199.44:45953] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aeXZrx3y7MHq1iB0qYo_0QAAAVI"]
[Mon Apr 20 15:45:52.395333 2026] [:error] [pid 6928:tid 6949] [client 20.203.199.44:55263] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aeXZsB3y7MHq1iB0qYo_2QAAAVM"]
[Mon Apr 20 15:45:53.662519 2026] [:error] [pid 6928:tid 6951] [client 20.203.199.44:59260] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aeXZsR3y7MHq1iB0qYo_5AAAAVU"]
[Mon Apr 20 15:45:55.073065 2026] [:error] [pid 11352:tid 11434] [client 20.203.199.44:61343] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws81.php"] [unique_id "aeXZs2l10mhMSfJ7ir-WmQAAAJQ"]
[Mon Apr 20 15:45:57.656687 2026] [:error] [pid 6928:tid 6937] [client 20.203.199.44:49707] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/r2.php"] [unique_id "aeXZtR3y7MHq1iB0qYpAAQAAAUc"]
[Mon Apr 20 15:46:08.843373 2026] [:error] [pid 11441:tid 11458] [client 20.203.199.44:58690] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Mon Apr 20 15:46:09.079904 2026] [:error] [pid 11441:tid 11457] [client 20.203.199.44:58690] [client 20.203.199.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aeXZwcixByFUvmh319AlAwAAAM4"]
[Mon Apr 20 15:46:19.733937 2026] [:error] [pid 42014:tid 42029] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Mon Apr 20 15:46:19.988930 2026] [:error] [pid 42014:tid 42040] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Mon Apr 20 15:46:20.246119 2026] [:error] [pid 42014:tid 42024] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Mon Apr 20 15:46:20.485982 2026] [:error] [pid 42014:tid 42034] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Mon Apr 20 15:46:20.749210 2026] [:error] [pid 42014:tid 42032] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Mon Apr 20 15:46:20.999761 2026] [:error] [pid 42014:tid 42037] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Mon Apr 20 15:46:21.617456 2026] [:error] [pid 42014:tid 42019] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Mon Apr 20 15:46:21.858540 2026] [:error] [pid 42014:tid 42028] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Mon Apr 20 15:46:22.116891 2026] [:error] [pid 42014:tid 42022] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Mon Apr 20 15:46:22.368485 2026] [:error] [pid 42014:tid 42016] [client 20.203.199.44:53606] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Mon Apr 20 15:46:22.604363 2026] [:error] [pid 42014:tid 42035] [client 20.203.199.44:53606] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeXZzsek-00-ZI0f1Noq3gAAARM"]
[Mon Apr 20 15:46:25.552928 2026] [:error] [pid 42014:tid 42028] [client 20.203.199.44:56832] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeXZ0cek-00-ZI0f1Noq5wAAAQw"]
[Mon Apr 20 15:46:28.286164 2026] [:error] [pid 11352:tid 11417] [client 20.203.199.44:59659] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeXZ1Gl10mhMSfJ7ir-WrgAAAIM"]
[Mon Apr 20 15:46:32.108915 2026] [:error] [pid 11352:tid 11428] [client 20.203.199.44:46839] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aeXZ2Gl10mhMSfJ7ir-WtgAAAI4"]
[Mon Apr 20 15:46:35.100363 2026] [:error] [pid 6928:tid 6953] [client 20.203.199.44:53290] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aeXZ2x3y7MHq1iB0qYpAbQAAAVc"]
[Mon Apr 20 15:46:47.273600 2026] [:error] [pid 6928:tid 6935] [client 20.203.199.44:59378] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aeXZ5x3y7MHq1iB0qYpAlQAAAUU"]
[Mon Apr 20 15:46:52.429173 2026] [:error] [pid 42014:tid 42039] [client 20.203.199.44:59095] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeXZ7Mek-00-ZI0f1Noq_AAAARc"]
[Mon Apr 20 15:46:53.691360 2026] [:error] [pid 11350:tid 11362] [client 20.203.199.44:62462] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeXZ7f4EoMBgOJuJnT1EzQAAAAM"]
[Mon Apr 20 15:46:55.334029 2026] [:error] [pid 11350:tid 11377] [client 20.203.199.44:56799] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeXZ7_4EoMBgOJuJnT1EzwAAABI"]
[Mon Apr 20 15:46:57.500017 2026] [:error] [pid 42014:tid 42040] [client 20.203.199.44:62450] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aeXZ8cek-00-ZI0f1NorBwAAARg"]
[Mon Apr 20 15:47:00.200856 2026] [:error] [pid 11441:tid 11454] [client 20.203.199.44:57772] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aeXZ9MixByFUvmh319AlNAAAAMs"]
[Mon Apr 20 15:47:03.527983 2026] [:error] [pid 42014:tid 42026] [client 20.203.199.44:49248] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aeXZ98ek-00-ZI0f1NorFwAAAQo"]
[Mon Apr 20 15:47:09.128624 2026] [:error] [pid 6928:tid 6951] [client 20.203.199.44:59106] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aeXZ_R3y7MHq1iB0qYpA0AAAAVU"]
[Mon Apr 20 15:47:13.772745 2026] [:error] [pid 6928:tid 6954] [client 20.203.199.44:62704] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aeXaAR3y7MHq1iB0qYpA3AAAAVg"]
[Mon Apr 20 15:47:15.518650 2026] [:error] [pid 6928:tid 6948] [client 20.203.199.44:52155] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aeXaAx3y7MHq1iB0qYpA5QAAAVI"]
[Mon Apr 20 15:47:16.395887 2026] [:error] [pid 6928:tid 6947] [client 20.203.199.44:52145] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aeXaBB3y7MHq1iB0qYpA5gAAAVE"]
[Mon Apr 20 15:47:26.929567 2026] [:error] [pid 11352:tid 11423] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Mon Apr 20 15:47:27.174796 2026] [:error] [pid 11352:tid 11433] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Mon Apr 20 15:47:27.413292 2026] [:error] [pid 11352:tid 11430] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Mon Apr 20 15:47:27.652533 2026] [:error] [pid 11352:tid 11419] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Mon Apr 20 15:47:27.903061 2026] [:error] [pid 11352:tid 11434] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Apr 20 15:47:28.141397 2026] [:error] [pid 11352:tid 11418] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/view.php
[Mon Apr 20 15:47:28.396287 2026] [:error] [pid 11352:tid 11425] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Mon Apr 20 15:47:28.635009 2026] [:error] [pid 11352:tid 11437] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Mon Apr 20 15:47:28.881855 2026] [:error] [pid 11352:tid 11432] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Mon Apr 20 15:47:29.124656 2026] [:error] [pid 11352:tid 11417] [client 20.203.199.44:5512] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Mon Apr 20 15:47:29.648512 2026] [:error] [pid 11352:tid 11422] [client 20.203.199.44:5512] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeXaEWl10mhMSfJ7ir-XHQAAAIg"]
[Mon Apr 20 15:47:33.635820 2026] [:error] [pid 11351:tid 11387] [client 20.203.199.44:59864] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeXaFQN8Z1-vktaI_tOeqgAAAEA"]
[Mon Apr 20 15:47:35.135194 2026] [:error] [pid 11352:tid 11427] [client 20.203.199.44:58602] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeXaF2l10mhMSfJ7ir-XIgAAAI0"]
[Mon Apr 20 15:47:38.745602 2026] [:error] [pid 42014:tid 42039] [client 20.203.199.44:48524] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeXaGsek-00-ZI0f1NorLQAAARc"]
[Mon Apr 20 15:47:46.402365 2026] [:error] [pid 6928:tid 6937] [client 20.203.199.44:61853] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeXaIh3y7MHq1iB0qYpBTAAAAUc"]
[Mon Apr 20 15:47:48.030794 2026] [:error] [pid 11441:tid 11448] [client 20.203.199.44:62044] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeXaJMixByFUvmh319AlfQAAAMU"]
[Mon Apr 20 15:47:52.481911 2026] [:error] [pid 42014:tid 42023] [client 20.203.199.44:56020] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeXaKMek-00-ZI0f1NorSAAAAQc"]
[Mon Apr 20 15:47:55.303350 2026] [:error] [pid 11441:tid 11460] [client 20.203.199.44:62040] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "aeXaK8ixByFUvmh319AlgQAAANE"]
[Mon Apr 20 15:47:57.734283 2026] [:error] [pid 11352:tid 11432] [client 20.203.199.44:51147] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "aeXaLWl10mhMSfJ7ir-XOwAAAJI"]
[Mon Apr 20 15:47:58.869371 2026] [:error] [pid 6928:tid 6948] [client 20.203.199.44:62539] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "aeXaLh3y7MHq1iB0qYpBbgAAAVI"]
[Mon Apr 20 15:48:00.459088 2026] [:error] [pid 11441:tid 11451] [client 20.203.199.44:56170] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "aeXaMMixByFUvmh319AliQAAAMg"]
[Mon Apr 20 15:48:02.872394 2026] [:error] [pid 11352:tid 11426] [client 20.203.199.44:62100] [client 20.203.199.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeXaMml10mhMSfJ7ir-XPgAAAIw"]
[Mon Apr 20 15:48:10.465025 2026] [:error] [pid 6928:tid 6947] [client 20.203.199.44:57228] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeXaOh3y7MHq1iB0qYpBmQAAAVE"]
[Mon Apr 20 15:48:11.686628 2026] [:error] [pid 6928:tid 6949] [client 20.203.199.44:57267] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeXaOx3y7MHq1iB0qYpBpAAAAVM"]
[Mon Apr 20 15:48:13.788040 2026] [:error] [pid 11441:tid 11459] [client 20.203.199.44:59273] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeXaPcixByFUvmh319AlmAAAANA"]
[Mon Apr 20 15:48:14.794552 2026] [:error] [pid 6928:tid 6941] [client 20.203.199.44:5578] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeXaPh3y7MHq1iB0qYpBugAAAUs"]
[Mon Apr 20 15:48:17.154411 2026] [:error] [pid 11352:tid 11425] [client 20.203.199.44:52832] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeXaQWl10mhMSfJ7ir-XUAAAAIs"]
[Mon Apr 20 15:48:20.949959 2026] [:error] [pid 11351:tid 11404] [client 20.203.199.44:59736] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeXaRAN8Z1-vktaI_tOezgAAAFE"]
[Mon Apr 20 15:48:25.686842 2026] [:error] [pid 11351:tid 11411] [client 20.203.199.44:48468] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeXaSQN8Z1-vktaI_tOe0AAAAFg"]
[Mon Apr 20 15:48:28.109127 2026] [:error] [pid 11441:tid 11445] [client 20.203.199.44:55515] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeXaTMixByFUvmh319AlqwAAAMI"]
[Mon Apr 20 15:48:29.887737 2026] [:error] [pid 6928:tid 6948] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Mon Apr 20 15:48:30.140463 2026] [:error] [pid 6928:tid 6945] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Mon Apr 20 15:48:30.398202 2026] [:error] [pid 6928:tid 6944] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/state.php
[Mon Apr 20 15:48:30.657534 2026] [:error] [pid 6928:tid 6953] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Mon Apr 20 15:48:30.916657 2026] [:error] [pid 6928:tid 6942] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Mon Apr 20 15:48:31.184650 2026] [:error] [pid 6928:tid 6939] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Mon Apr 20 15:48:31.443360 2026] [:error] [pid 6928:tid 6934] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Mon Apr 20 15:48:31.682789 2026] [:error] [pid 6928:tid 6942] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Mon Apr 20 15:48:31.923546 2026] [:error] [pid 6928:tid 6938] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Mon Apr 20 15:48:32.183225 2026] [:error] [pid 6928:tid 6939] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Mon Apr 20 15:48:32.428706 2026] [:error] [pid 6928:tid 6949] [client 20.203.199.44:46418] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Mon Apr 20 15:48:32.816422 2026] [:error] [pid 6928:tid 6935] [client 20.203.199.44:46418] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "aeXaUB3y7MHq1iB0qYpCJQAAAUU"]
[Mon Apr 20 15:48:45.631469 2026] [:error] [pid 6928:tid 6947] [client 20.203.199.44:54129] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "aeXaXR3y7MHq1iB0qYpCdQAAAVE"]
[Mon Apr 20 15:48:48.347309 2026] [:error] [pid 11352:tid 11420] [client 20.203.199.44:52425] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeXaYGl10mhMSfJ7ir-XaAAAAIY"]
[Mon Apr 20 15:48:49.157191 2026] [:error] [pid 11441:tid 11453] [client 20.203.199.44:51259] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeXaYcixByFUvmh319AlwQAAAMo"]
[Mon Apr 20 15:48:54.131048 2026] [:error] [pid 6928:tid 6941] [client 20.203.199.44:5826] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeXaZh3y7MHq1iB0qYpCiQAAAUs"]
[Mon Apr 20 15:48:54.922012 2026] [:error] [pid 11351:tid 11411] [client 20.203.199.44:54622] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aeXaZgN8Z1-vktaI_tOe5QAAAFg"]
[Mon Apr 20 15:48:55.650066 2026] [:error] [pid 11352:tid 11428] [client 20.203.199.44:62796] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aeXaZ2l10mhMSfJ7ir-XcwAAAI4"]
[Mon Apr 20 15:48:56.604102 2026] [:error] [pid 11352:tid 11431] [client 20.203.199.44:59199] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aeXaaGl10mhMSfJ7ir-XdQAAAJE"]
[Mon Apr 20 15:48:57.422588 2026] [:error] [pid 11350:tid 11364] [client 20.203.199.44:51251] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aeXaaf4EoMBgOJuJnT1FFwAAAAU"]
[Mon Apr 20 15:48:58.453186 2026] [:error] [pid 42014:tid 42034] [client 20.203.199.44:56316] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aeXaasek-00-ZI0f1NorsAAAARI"]
[Mon Apr 20 15:48:59.401635 2026] [:error] [pid 6928:tid 6954] [client 20.203.199.44:56314] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aeXaax3y7MHq1iB0qYpCoQAAAVg"]
[Mon Apr 20 15:49:00.583949 2026] [:error] [pid 42014:tid 42037] [client 20.203.199.44:52051] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aeXabMek-00-ZI0f1NoruQAAARU"]
[Mon Apr 20 15:49:04.644212 2026] [:error] [pid 11351:tid 11394] [client 20.203.199.44:48890] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aeXacAN8Z1-vktaI_tOe6wAAAEc"]
[Mon Apr 20 15:49:05.334596 2026] [:error] [pid 11351:tid 11408] [client 20.203.199.44:5843] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aeXacQN8Z1-vktaI_tOe7QAAAFU"]
[Mon Apr 20 15:49:06.267408 2026] [:error] [pid 42014:tid 42035] [client 20.203.199.44:59037] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeXacsek-00-ZI0f1NorzAAAARM"]
[Mon Apr 20 15:49:08.527626 2026] [:error] [pid 42014:tid 42021] [client 20.203.199.44:59040] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeXadMek-00-ZI0f1Nor1QAAAQU"]
[Mon Apr 20 15:49:11.107501 2026] [:error] [pid 11441:tid 11464] [client 20.203.199.44:5980] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeXad8ixByFUvmh319Al3gAAANU"]
[Mon Apr 20 15:49:13.267782 2026] [:error] [pid 42014:tid 42031] [client 20.203.199.44:52056] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeXaecek-00-ZI0f1Nor6gAAAQ8"]
[Mon Apr 20 15:49:15.420944 2026] [:error] [pid 6928:tid 6945] [client 20.203.199.44:53927] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeXaex3y7MHq1iB0qYpCuAAAAU8"]
[Mon Apr 20 15:49:19.282525 2026] [:error] [pid 42014:tid 42031] [client 20.203.199.44:51727] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeXaf8ek-00-ZI0f1NosAwAAAQ8"]
[Mon Apr 20 15:49:20.333596 2026] [:error] [pid 11350:tid 11374] [client 20.203.199.44:55645] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeXagP4EoMBgOJuJnT1FKgAAAA8"]
[Mon Apr 20 15:49:22.018427 2026] [:error] [pid 11351:tid 11408] [client 20.203.199.44:54475] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aeXaggN8Z1-vktaI_tOe9wAAAFU"]
[Mon Apr 20 15:49:23.741043 2026] [:error] [pid 11351:tid 11392] [client 20.203.199.44:55139] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeXagwN8Z1-vktaI_tOe-QAAAEU"]
[Mon Apr 20 15:49:26.184336 2026] [:error] [pid 11352:tid 11418] [client 20.203.199.44:57293] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeXahml10mhMSfJ7ir-XogAAAIQ"]
[Mon Apr 20 15:49:27.353180 2026] [:error] [pid 6928:tid 6953] [client 20.203.199.44:54489] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeXahx3y7MHq1iB0qYpCxQAAAVc"]
[Mon Apr 20 15:49:28.171081 2026] [:error] [pid 11441:tid 11465] [client 20.203.199.44:53902] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/areak1.php"] [unique_id "aeXaiMixByFUvmh319Al5gAAANY"]
[Mon Apr 20 15:49:29.940067 2026] [:error] [pid 11441:tid 11456] [client 20.203.199.44:54157] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aeXaicixByFUvmh319Al5wAAAM0"]
[Mon Apr 20 15:49:38.224456 2026] [:error] [pid 11351:tid 11399] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/sallu.php
[Mon Apr 20 15:49:38.472918 2026] [:error] [pid 11351:tid 11387] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny2.php
[Mon Apr 20 15:49:38.713698 2026] [:error] [pid 11351:tid 11391] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Mon Apr 20 15:49:38.954167 2026] [:error] [pid 11351:tid 11407] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/gz.php
[Mon Apr 20 15:49:39.209249 2026] [:error] [pid 11351:tid 11411] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Mon Apr 20 15:49:39.450006 2026] [:error] [pid 11351:tid 11404] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Mon Apr 20 15:49:39.698973 2026] [:error] [pid 11351:tid 11388] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Mon Apr 20 15:49:39.938652 2026] [:error] [pid 11351:tid 11390] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/ws68.php
[Mon Apr 20 15:49:40.192319 2026] [:error] [pid 11351:tid 11400] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Mon Apr 20 15:49:40.434268 2026] [:error] [pid 11351:tid 11398] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Mon Apr 20 15:49:40.686196 2026] [:error] [pid 11351:tid 11402] [client 20.203.199.44:61633] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Mon Apr 20 15:49:40.939573 2026] [:error] [pid 11351:tid 11389] [client 20.203.199.44:61633] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeXalAN8Z1-vktaI_tOfDQAAAEI"]
[Mon Apr 20 15:49:42.005848 2026] [:error] [pid 11351:tid 11392] [client 20.203.199.44:54068] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeXalgN8Z1-vktaI_tOfDgAAAEU"]
[Mon Apr 20 15:49:43.467817 2026] [:error] [pid 11351:tid 11401] [client 20.203.199.44:54827] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeXalwN8Z1-vktaI_tOfDwAAAE4"]
[Mon Apr 20 15:49:44.442079 2026] [:error] [pid 11350:tid 11376] [client 20.203.199.44:61788] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aeXamP4EoMBgOJuJnT1FcgAAABE"]
[Mon Apr 20 15:49:50.091070 2026] [:error] [pid 42014:tid 42016] [client 20.203.199.44:54963] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aeXansek-00-ZI0f1NosQwAAAQA"]
[Mon Apr 20 15:49:50.877019 2026] [:error] [pid 42014:tid 42038] [client 20.203.199.44:50217] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aeXansek-00-ZI0f1NosRwAAARY"]
[Mon Apr 20 15:49:51.666272 2026] [:error] [pid 11352:tid 11415] [client 20.203.199.44:61812] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aeXan2l10mhMSfJ7ir-XwQAAAIE"]
[Mon Apr 20 15:49:56.397804 2026] [:error] [pid 11441:tid 11456] [client 20.203.199.44:61027] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aeXapMixByFUvmh319Al_gAAAM0"]
[Mon Apr 20 15:49:59.792130 2026] [:error] [pid 6928:tid 6934] [client 20.203.199.44:61780] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aeXapx3y7MHq1iB0qYpDCQAAAUQ"]
[Mon Apr 20 15:50:04.477931 2026] [:error] [pid 11352:tid 11434] [client 20.203.199.44:59005] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aeXarGl10mhMSfJ7ir-X0wAAAJQ"]
[Mon Apr 20 15:50:06.864320 2026] [:error] [pid 11441:tid 11447] [client 20.203.199.44:5137] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aeXarsixByFUvmh319AmDQAAAMQ"]
[Mon Apr 20 15:50:11.009082 2026] [:error] [pid 6928:tid 6938] [client 20.203.199.44:53876] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aeXasx3y7MHq1iB0qYpDGwAAAUg"]
[Mon Apr 20 15:50:17.698952 2026] [:error] [pid 11441:tid 11449] [client 20.203.199.44:56205] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aeXaucixByFUvmh319AmJAAAAMY"]
[Mon Apr 20 15:50:19.001912 2026] [:error] [pid 6928:tid 6942] [client 20.203.199.44:50638] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aeXaux3y7MHq1iB0qYpDJAAAAUw"]
[Mon Apr 20 15:50:20.048830 2026] [:error] [pid 11441:tid 11463] [client 20.203.199.44:62002] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aeXavMixByFUvmh319AmLAAAANQ"]
[Mon Apr 20 15:50:22.076628 2026] [:error] [pid 6928:tid 6949] [client 20.203.199.44:59237] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws61.php"] [unique_id "aeXavh3y7MHq1iB0qYpDLQAAAVM"]
[Mon Apr 20 15:50:23.186519 2026] [:error] [pid 11441:tid 11458] [client 20.203.199.44:59263] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "aeXav8ixByFUvmh319AmMwAAAM8"]
[Mon Apr 20 15:50:24.315725 2026] [:error] [pid 11441:tid 11464] [client 20.203.199.44:59507] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "aeXawMixByFUvmh319AmOAAAANU"]
[Mon Apr 20 15:50:25.266684 2026] [:error] [pid 11352:tid 11426] [client 20.203.199.44:58980] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "aeXawWl10mhMSfJ7ir-X-AAAAIw"]
[Mon Apr 20 15:50:26.630132 2026] [:error] [pid 6928:tid 6944] [client 20.203.199.44:57011] [client 20.203.199.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp-image.php"] [unique_id "aeXawh3y7MHq1iB0qYpDMwAAAU4"]
[Mon Apr 20 15:52:39.913442 2026] [:error] [pid 11352:tid 11428] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Mon Apr 20 15:52:40.152513 2026] [:error] [pid 11352:tid 11425] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Mon Apr 20 15:52:40.382643 2026] [:error] [pid 11352:tid 11426] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Mon Apr 20 15:52:40.605617 2026] [:error] [pid 11352:tid 11421] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Mon Apr 20 15:52:40.921917 2026] [:error] [pid 11352:tid 11427] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Mon Apr 20 15:52:41.156119 2026] [:error] [pid 11352:tid 11420] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Mon Apr 20 15:52:41.382946 2026] [:error] [pid 11352:tid 11414] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon Apr 20 15:52:41.624906 2026] [:error] [pid 11352:tid 11430] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Mon Apr 20 15:52:42.093951 2026] [:error] [pid 11352:tid 11423] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Mon Apr 20 15:52:42.335359 2026] [:error] [pid 11352:tid 11426] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Mon Apr 20 15:52:42.561881 2026] [:error] [pid 11352:tid 11419] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon Apr 20 15:52:42.792519 2026] [:error] [pid 11352:tid 11432] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Mon Apr 20 15:52:43.017391 2026] [:error] [pid 11352:tid 11431] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Mon Apr 20 15:52:43.301610 2026] [:error] [pid 11352:tid 11427] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Mon Apr 20 15:52:43.541199 2026] [:error] [pid 11352:tid 11418] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Mon Apr 20 15:52:43.758549 2026] [:error] [pid 11352:tid 11422] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Mon Apr 20 15:52:43.990467 2026] [:error] [pid 11352:tid 11434] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon Apr 20 15:52:44.237965 2026] [:error] [pid 11352:tid 11423] [client 89.251.0.57:37473] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Mon Apr 20 15:52:54.317970 2026] [:error] [pid 11352:tid 11424] [client 89.251.0.57:37473] [client 89.251.0.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeXbVml10mhMSfJ7ir-YtgAAAIo"]
[Mon Apr 20 15:52:57.674804 2026] [:error] [pid 11441:tid 11445] [client 89.251.0.71:45811] [client 89.251.0.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeXbWcixByFUvmh319AnbgAAAMI"]
[Mon Apr 20 15:52:59.164793 2026] [:error] [pid 6928:tid 6930] [client 89.251.0.66:54163] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Mon Apr 20 15:52:59.939508 2026] [:error] [pid 6928:tid 6933] [client 89.251.0.66:54163] [client 89.251.0.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeXbWx3y7MHq1iB0qYpE2AAAAUM"]
[Mon Apr 20 15:53:01.147195 2026] [:error] [pid 11441:tid 11464] [client 89.251.0.65:60299] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Mon Apr 20 15:53:01.361808 2026] [:error] [pid 11441:tid 11444] [client 89.251.0.65:60299] [client 89.251.0.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aeXbXcixByFUvmh319AnfAAAAME"]
[Mon Apr 20 15:53:02.042360 2026] [:error] [pid 11441:tid 11449] [client 89.251.0.50:38301] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Mon Apr 20 15:53:03.222836 2026] [:error] [pid 11441:tid 11457] [client 89.251.0.50:38301] [client 89.251.0.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeXbX8ixByFUvmh319AnhwAAAM4"]
[Mon Apr 20 15:53:03.928114 2026] [:error] [pid 6928:tid 6937] [client 89.251.0.50:50865] [client 89.251.0.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeXbXx3y7MHq1iB0qYpE4QAAAUc"]
[Mon Apr 20 15:53:04.370738 2026] [:error] [pid 6928:tid 6936] [client 89.251.0.65:51043] [client 89.251.0.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeXbYB3y7MHq1iB0qYpE4wAAAUY"]
[Mon Apr 20 15:53:36.337149 2026] [autoindex:error] [pid 11441:tid 11449] [client 89.251.0.56:47989] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 23:38:36.607786 2026] [:error] [pid 42014:tid 42032] [client 43.130.131.18:43248] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeZIfMek-00-ZI0f1NqXwgAAARA"]
[Tue Apr 21 00:54:59.894280 2026] [:error] [pid 11441:tid 11457] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Tue Apr 21 00:55:00.135041 2026] [:error] [pid 11441:tid 11451] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Tue Apr 21 00:55:01.717562 2026] [:error] [pid 11441:tid 11451] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/hroxw.php
[Tue Apr 21 00:55:01.954881 2026] [:error] [pid 11441:tid 11455] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Tue Apr 21 00:55:02.192514 2026] [:error] [pid 11441:tid 11446] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Tue Apr 21 00:55:02.430450 2026] [:error] [pid 11441:tid 11465] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Tue Apr 21 00:55:03.577344 2026] [:error] [pid 11441:tid 11459] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Tue Apr 21 00:55:03.814356 2026] [:error] [pid 11441:tid 11461] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Tue Apr 21 00:55:04.067197 2026] [:error] [pid 11441:tid 11443] [client 172.213.224.85:55820] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Apr 21 00:55:04.727933 2026] [:error] [pid 11441:tid 11457] [client 172.213.224.85:55820] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aeZaaMixByFUvmh319DUjAAAAM4"]
[Tue Apr 21 00:55:05.495529 2026] [:error] [pid 42014:tid 42036] [client 172.213.224.85:5462] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aeZaacek-00-ZI0f1NqleAAAARQ"]
[Tue Apr 21 00:55:06.466391 2026] [:error] [pid 11351:tid 11389] [client 172.213.224.85:5745] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aeZaagN8Z1-vktaI_tN-pAAAAEI"]
[Tue Apr 21 00:55:07.826175 2026] [:error] [pid 11351:tid 11390] [client 172.213.224.85:45724] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "aeZaawN8Z1-vktaI_tN-rAAAAEM"]
[Tue Apr 21 00:55:08.696330 2026] [:error] [pid 11351:tid 11392] [client 172.213.224.85:31320] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "aeZabAN8Z1-vktaI_tN-sgAAAEU"]
[Tue Apr 21 00:55:09.624418 2026] [:error] [pid 11441:tid 11450] [client 172.213.224.85:37135] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "aeZabcixByFUvmh319DUjQAAAMc"]
[Tue Apr 21 00:55:10.587054 2026] [:error] [pid 11441:tid 11459] [client 172.213.224.85:5733] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "aeZabsixByFUvmh319DUlQAAANA"]
[Tue Apr 21 00:55:11.314122 2026] [:error] [pid 11494:tid 11518] [client 172.213.224.85:31303] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "aeZab8gko5iFiE8YoyQpqgAAAZY"]
[Tue Apr 21 00:55:12.260435 2026] [:error] [pid 11351:tid 11392] [client 172.213.224.85:45713] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeZacAN8Z1-vktaI_tN-xAAAAEU"]
[Tue Apr 21 00:55:12.979649 2026] [:error] [pid 11351:tid 11387] [client 172.213.224.85:5456] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeZacAN8Z1-vktaI_tN-zQAAAEA"]
[Tue Apr 21 00:55:14.150954 2026] [:error] [pid 11494:tid 11516] [client 172.213.224.85:43863] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeZacsgko5iFiE8YoyQpsgAAAZQ"]
[Tue Apr 21 00:55:15.315894 2026] [:error] [pid 11494:tid 11509] [client 172.213.224.85:5463] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aeZac8gko5iFiE8YoyQpswAAAY0"]
[Tue Apr 21 00:55:16.192557 2026] [:error] [pid 11350:tid 11360] [client 172.213.224.85:5701] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aeZadP4EoMBgOJuJnT0UBwAAAAE"]
[Tue Apr 21 00:55:17.172941 2026] [:error] [pid 11441:tid 11459] [client 172.213.224.85:5483] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aeZadcixByFUvmh319DUoQAAANA"]
[Tue Apr 21 00:55:19.079082 2026] [:error] [pid 11350:tid 11382] [client 172.213.224.85:36529] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aeZad_4EoMBgOJuJnT0UFAAAABc"]
[Tue Apr 21 00:55:20.475584 2026] [:error] [pid 42014:tid 42031] [client 172.213.224.85:5474] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tt.php"] [unique_id "aeZaeMek-00-ZI0f1NqlhwAAAQ8"]
[Tue Apr 21 00:55:22.807902 2026] [:error] [pid 11441:tid 11447] [client 172.213.224.85:45738] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aeZaesixByFUvmh319DUsAAAAMQ"]
[Tue Apr 21 00:55:25.102812 2026] [:error] [pid 42014:tid 42021] [client 172.213.224.85:31331] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aeZafcek-00-ZI0f1NqligAAAQU"]
[Tue Apr 21 00:55:26.273880 2026] [:error] [pid 11350:tid 11378] [client 172.213.224.85:65212] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aeZafv4EoMBgOJuJnT0UJwAAABM"]
[Tue Apr 21 00:55:27.201159 2026] [:error] [pid 11351:tid 11405] [client 172.213.224.85:5487] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "aeZafwN8Z1-vktaI_tN_BgAAAFI"]
[Tue Apr 21 00:55:28.072129 2026] [:error] [pid 11350:tid 11374] [client 172.213.224.85:46572] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeZagP4EoMBgOJuJnT0UMwAAAA8"]
[Tue Apr 21 00:55:28.884326 2026] [:error] [pid 11350:tid 11381] [client 172.213.224.85:54514] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeZagP4EoMBgOJuJnT0UNwAAABY"]
[Tue Apr 21 00:55:29.751893 2026] [:error] [pid 11441:tid 11448] [client 172.213.224.85:45699] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeZagcixByFUvmh319DUwAAAAMU"]
[Tue Apr 21 00:55:30.380992 2026] [:error] [pid 6928:tid 6931] [client 172.213.224.85:36480] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aeZagh3y7MHq1iB0qYrhMgAAAUE"]
[Tue Apr 21 00:55:30.951985 2026] [:error] [pid 11352:tid 11433] [client 172.213.224.85:46582] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeZagml10mhMSfJ7ir_6ZQAAAJM"]
[Tue Apr 21 00:55:31.651205 2026] [:error] [pid 11494:tid 11515] [client 172.213.224.85:31313] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeZag8gko5iFiE8YoyQp8wAAAZM"]
[Tue Apr 21 00:55:32.444126 2026] [:error] [pid 42014:tid 42036] [client 172.213.224.85:36505] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeZahMek-00-ZI0f1NqlkgAAARQ"]
[Tue Apr 21 00:55:33.298018 2026] [:error] [pid 11351:tid 11410] [client 172.213.224.85:37154] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aeZahQN8Z1-vktaI_tN_HgAAAFc"]
[Tue Apr 21 00:55:34.242394 2026] [:error] [pid 11350:tid 11360] [client 172.213.224.85:46534] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aeZahv4EoMBgOJuJnT0UTAAAAAE"]
[Tue Apr 21 00:55:35.065563 2026] [:error] [pid 11351:tid 11409] [client 172.213.224.85:36521] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aeZahwN8Z1-vktaI_tN_IwAAAFY"]
[Tue Apr 21 00:55:36.266588 2026] [:error] [pid 11351:tid 11400] [client 172.213.224.85:5709] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aeZaiAN8Z1-vktaI_tN_KwAAAE0"]
[Tue Apr 21 00:55:37.504052 2026] [:error] [pid 11351:tid 11391] [client 172.213.224.85:5496] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aeZaiQN8Z1-vktaI_tN_NwAAAEQ"]
[Tue Apr 21 00:55:38.317967 2026] [:error] [pid 11351:tid 11394] [client 172.213.224.85:5734] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aeZaigN8Z1-vktaI_tN_PAAAAEc"]
[Tue Apr 21 00:55:39.210741 2026] [:error] [pid 11441:tid 11464] [client 172.213.224.85:36483] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aeZai8ixByFUvmh319DUyAAAANU"]
[Tue Apr 21 00:55:39.926053 2026] [:error] [pid 6928:tid 6949] [client 172.213.224.85:5818] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aeZaix3y7MHq1iB0qYrhRwAAAVM"]
[Tue Apr 21 00:55:40.769390 2026] [:error] [pid 6928:tid 6953] [client 172.213.224.85:36506] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog-header.php"] [unique_id "aeZajB3y7MHq1iB0qYrhSQAAAVc"]
[Tue Apr 21 00:55:42.099525 2026] [:error] [pid 11441:tid 11462] [client 172.213.224.85:55831] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "aeZajsixByFUvmh319DU1gAAANM"]
[Tue Apr 21 00:55:43.100424 2026] [:error] [pid 11351:tid 11402] [client 172.213.224.85:31304] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "aeZajwN8Z1-vktaI_tN_QwAAAE8"]
[Tue Apr 21 00:55:44.502428 2026] [:error] [pid 11351:tid 11396] [client 172.213.224.85:46581] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "aeZakAN8Z1-vktaI_tN_RQAAAEk"]
[Tue Apr 21 00:55:45.851676 2026] [:error] [pid 11351:tid 11405] [client 172.213.224.85:55830] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bmi.php"] [unique_id "aeZakQN8Z1-vktaI_tN_SwAAAFI"]
[Tue Apr 21 00:55:46.918060 2026] [:error] [pid 11351:tid 11396] [client 172.213.224.85:55864] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeZakgN8Z1-vktaI_tN_UQAAAEk"]
[Tue Apr 21 00:55:48.115467 2026] [:error] [pid 11351:tid 11388] [client 172.213.224.85:5807] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeZalAN8Z1-vktaI_tN_WwAAAEE"]
[Tue Apr 21 00:55:50.220166 2026] [:error] [pid 11351:tid 11400] [client 172.213.224.85:46563] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeZalgN8Z1-vktaI_tN_YgAAAE0"]
[Tue Apr 21 00:55:51.929024 2026] [:error] [pid 11494:tid 11513] [client 172.213.224.85:55821] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aeZal8gko5iFiE8YoyQqCgAAAZE"]
[Tue Apr 21 00:55:54.543409 2026] [:error] [pid 11494:tid 11513] [client 172.213.224.85:43873] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeZamsgko5iFiE8YoyQqGwAAAZE"]
[Tue Apr 21 00:55:58.403802 2026] [:error] [pid 11494:tid 11499] [client 172.213.224.85:5750] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeZansgko5iFiE8YoyQqKwAAAYM"]
[Tue Apr 21 00:55:59.279553 2026] [:error] [pid 11350:tid 11379] [client 172.213.224.85:37122] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeZan_4EoMBgOJuJnT0UbgAAABQ"]
[Tue Apr 21 00:56:00.664041 2026] [:error] [pid 11351:tid 11398] [client 172.213.224.85:37144] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/radio.php"] [unique_id "aeZaoAN8Z1-vktaI_tN_jgAAAEs"]
[Tue Apr 21 00:56:01.772281 2026] [:error] [pid 11494:tid 11507] [client 172.213.224.85:30796] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "aeZaocgko5iFiE8YoyQqMAAAAYs"]
[Tue Apr 21 00:56:03.232169 2026] [:error] [pid 11350:tid 11359] [client 172.213.224.85:5735] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "aeZao_4EoMBgOJuJnT0UdQAAAAA"]
[Tue Apr 21 00:56:04.222685 2026] [:error] [pid 11351:tid 11387] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Tue Apr 21 00:56:04.459989 2026] [:error] [pid 11351:tid 11404] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Tue Apr 21 00:56:04.706683 2026] [:error] [pid 11351:tid 11393] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Tue Apr 21 00:56:05.732717 2026] [:error] [pid 11351:tid 11394] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Tue Apr 21 00:56:05.988779 2026] [:error] [pid 11351:tid 11403] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 00:56:06.234953 2026] [:error] [pid 11351:tid 11405] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Tue Apr 21 00:56:06.482326 2026] [:error] [pid 11351:tid 11407] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Apr 21 00:56:07.081517 2026] [:error] [pid 11351:tid 11396] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/ws48.php
[Tue Apr 21 00:56:07.398097 2026] [:error] [pid 11351:tid 11393] [client 172.213.224.85:51590] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue Apr 21 00:56:07.637431 2026] [:error] [pid 11351:tid 11399] [client 172.213.224.85:51590] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeZapwN8Z1-vktaI_tN_wwAAAEw"]
[Tue Apr 21 00:56:09.647507 2026] [:error] [pid 11350:tid 11375] [client 172.213.224.85:9735] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeZaqf4EoMBgOJuJnT0UggAAABA"]
[Tue Apr 21 00:56:11.781862 2026] [:error] [pid 11351:tid 11404] [client 172.213.224.85:54480] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeZaqwN8Z1-vktaI_tN_2gAAAFE"]
[Tue Apr 21 00:56:14.911333 2026] [:error] [pid 11494:tid 11512] [client 172.213.224.85:45718] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aeZarsgko5iFiE8YoyQqQgAAAZA"]
[Tue Apr 21 00:56:16.876133 2026] [:error] [pid 11494:tid 11513] [client 172.213.224.85:65179] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeZasMgko5iFiE8YoyQqRgAAAZE"]
[Tue Apr 21 00:56:18.643772 2026] [:error] [pid 11351:tid 11398] [client 172.213.224.85:31300] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeZasgN8Z1-vktaI_tN_-wAAAEs"]
[Tue Apr 21 00:56:20.199477 2026] [:error] [pid 11351:tid 11398] [client 172.213.224.85:5699] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeZatAN8Z1-vktaI_tOABgAAAEs"]
[Tue Apr 21 00:56:21.850800 2026] [:error] [pid 11350:tid 11375] [client 172.213.224.85:54492] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aeZatf4EoMBgOJuJnT0UjQAAABA"]
[Tue Apr 21 00:56:24.032526 2026] [:error] [pid 11352:tid 11415] [client 172.213.224.85:65164] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeZauGl10mhMSfJ7ir_63QAAAIE"]
[Tue Apr 21 00:56:25.801700 2026] [:error] [pid 11350:tid 11367] [client 172.213.224.85:31337] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeZauf4EoMBgOJuJnT0UmgAAAAg"]
[Tue Apr 21 00:56:28.589768 2026] [:error] [pid 11352:tid 11426] [client 172.213.224.85:9766] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeZavGl10mhMSfJ7ir_64gAAAIw"]
[Tue Apr 21 00:56:31.531190 2026] [:error] [pid 11441:tid 11450] [client 172.213.224.85:5703] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ok.php"] [unique_id "aeZav8ixByFUvmh319DVUAAAAMc"]
[Tue Apr 21 00:56:33.315318 2026] [:error] [pid 11441:tid 11458] [client 172.213.224.85:30807] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aeZawcixByFUvmh319DVWQAAAM8"]
[Tue Apr 21 00:56:34.096450 2026] [:error] [pid 11350:tid 11373] [client 172.213.224.85:55858] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aeZawv4EoMBgOJuJnT0UuwAAAA4"]
[Tue Apr 21 00:56:34.855854 2026] [:error] [pid 11350:tid 11364] [client 172.213.224.85:54489] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aeZawv4EoMBgOJuJnT0UwQAAAAU"]
[Tue Apr 21 00:56:35.961968 2026] [:error] [pid 11494:tid 11508] [client 172.213.224.85:30843] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aeZaw8gko5iFiE8YoyQqZAAAAYw"]
[Tue Apr 21 00:56:37.526891 2026] [:error] [pid 11351:tid 11403] [client 172.213.224.85:5790] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeZaxQN8Z1-vktaI_tOAOQAAAFA"]
[Tue Apr 21 00:56:39.593092 2026] [:error] [pid 11352:tid 11425] [client 172.213.224.85:5749] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeZax2l10mhMSfJ7ir_68QAAAIs"]
[Tue Apr 21 00:56:42.093525 2026] [:error] [pid 11441:tid 11457] [client 172.213.224.85:53514] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeZaysixByFUvmh319DVXgAAAM4"]
[Tue Apr 21 00:56:44.213137 2026] [:error] [pid 11351:tid 11388] [client 172.213.224.85:44258] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aeZazAN8Z1-vktaI_tOAaQAAAEE"]
[Tue Apr 21 00:56:45.496676 2026] [:error] [pid 11351:tid 11393] [client 172.213.224.85:65199] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aeZazQN8Z1-vktaI_tOAcgAAAEY"]
[Tue Apr 21 00:56:46.403415 2026] [:error] [pid 11351:tid 11396] [client 172.213.224.85:42348] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aeZazgN8Z1-vktaI_tOAewAAAEk"]
[Tue Apr 21 00:56:47.910275 2026] [:error] [pid 11351:tid 11397] [client 172.213.224.85:6045] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aeZazwN8Z1-vktaI_tOAkAAAAEo"]
[Tue Apr 21 00:56:48.867965 2026] [:error] [pid 11350:tid 11364] [client 172.213.224.85:54864] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aeZa0P4EoMBgOJuJnT0U6gAAAAU"]
[Tue Apr 21 00:56:51.206155 2026] [:error] [pid 11352:tid 11420] [client 172.213.224.85:5672] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeZa02l10mhMSfJ7ir_69gAAAIY"]
[Tue Apr 21 00:56:51.682397 2026] [:error] [pid 6928:tid 6941] [client 172.213.224.85:41214] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeZa0x3y7MHq1iB0qYrhjgAAAUs"]
[Tue Apr 21 00:56:53.578668 2026] [:error] [pid 11494:tid 11518] [client 172.213.224.85:52890] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeZa1cgko5iFiE8YoyQqiwAAAZY"]
[Tue Apr 21 00:56:54.956586 2026] [:error] [pid 11350:tid 11366] [client 172.213.224.85:41183] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asd.php"] [unique_id "aeZa1v4EoMBgOJuJnT0VEwAAAAc"]
[Tue Apr 21 00:56:56.476844 2026] [:error] [pid 11350:tid 11382] [client 172.213.224.85:52990] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aeZa2P4EoMBgOJuJnT0VIwAAABc"]
[Tue Apr 21 00:56:57.936143 2026] [:error] [pid 11350:tid 11360] [client 172.213.224.85:5662] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aeZa2f4EoMBgOJuJnT0VKgAAAAE"]
[Tue Apr 21 00:56:58.713787 2026] [:error] [pid 11494:tid 11513] [client 172.213.224.85:54094] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aeZa2sgko5iFiE8YoyQqkQAAAZE"]
[Tue Apr 21 00:57:00.085516 2026] [:error] [pid 11350:tid 11377] [client 172.213.224.85:31974] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xx.php"] [unique_id "aeZa3P4EoMBgOJuJnT0VNAAAABI"]
[Tue Apr 21 00:57:04.035346 2026] [:error] [pid 11494:tid 11516] [client 172.213.224.85:38682] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aeZa4Mgko5iFiE8YoyQqogAAAZQ"]
[Tue Apr 21 00:57:08.908963 2026] [:error] [pid 11350:tid 11372] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue Apr 21 00:57:09.151325 2026] [:error] [pid 11350:tid 11375] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Tue Apr 21 00:57:09.387104 2026] [:error] [pid 11350:tid 11383] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 00:57:09.624293 2026] [:error] [pid 11350:tid 11382] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Apr 21 00:57:09.858979 2026] [:error] [pid 11350:tid 11377] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Tue Apr 21 00:57:10.094973 2026] [:error] [pid 11350:tid 11370] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/abc.php
[Tue Apr 21 00:57:10.350819 2026] [:error] [pid 11350:tid 11367] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 21 00:57:10.592057 2026] [:error] [pid 11350:tid 11375] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/bnm.php
[Tue Apr 21 00:57:10.838407 2026] [:error] [pid 11350:tid 11378] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Tue Apr 21 00:57:11.707250 2026] [:error] [pid 11350:tid 11370] [client 172.213.224.85:38326] File does not exist: /usr/local/apache/htdocs/suspended-page/s.php
[Tue Apr 21 00:57:11.940203 2026] [:error] [pid 11350:tid 11375] [client 172.213.224.85:38326] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tymn.php"] [unique_id "aeZa5_4EoMBgOJuJnT0VfwAAABA"]
[Tue Apr 21 00:57:13.320347 2026] [:error] [pid 11351:tid 11388] [client 172.213.224.85:44891] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tymn.php"] [unique_id "aeZa6QN8Z1-vktaI_tOA0wAAAEE"]
[Tue Apr 21 00:57:17.677084 2026] [:error] [pid 6928:tid 6939] [client 172.213.224.85:9826] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tymn.php"] [unique_id "aeZa7R3y7MHq1iB0qYrhqAAAAUk"]
[Tue Apr 21 00:57:21.752894 2026] [:error] [pid 11350:tid 11380] [client 172.213.224.85:9688] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tymn.php"] [unique_id "aeZa8f4EoMBgOJuJnT0VlgAAABU"]
[Tue Apr 21 00:57:25.329978 2026] [:error] [pid 11351:tid 11404] [client 172.213.224.85:34420] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "aeZa9QN8Z1-vktaI_tOBIgAAAFE"]
[Tue Apr 21 00:57:31.367666 2026] [:error] [pid 11351:tid 11399] [client 172.213.224.85:39039] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "aeZa-wN8Z1-vktaI_tOBOQAAAEw"]
[Tue Apr 21 00:57:33.781368 2026] [:error] [pid 11351:tid 11391] [client 172.213.224.85:52440] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links-opml.php"] [unique_id "aeZa_QN8Z1-vktaI_tOBVgAAAEQ"]
[Tue Apr 21 00:57:38.783652 2026] [:error] [pid 42014:tid 42035] [client 172.213.224.85:33591] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeZbAsek-00-ZI0f1Nql6wAAARM"]
[Tue Apr 21 00:57:41.146466 2026] [:error] [pid 6928:tid 6949] [client 172.213.224.85:37776] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeZbBR3y7MHq1iB0qYrh0wAAAVM"]
[Tue Apr 21 00:57:44.418537 2026] [:error] [pid 11441:tid 11446] [client 172.213.224.85:47883] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeZbCMixByFUvmh319DVjQAAAMM"]
[Tue Apr 21 00:57:47.235039 2026] [:error] [pid 11351:tid 11398] [client 172.213.224.85:43337] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aeZbCwN8Z1-vktaI_tOBiAAAAEs"]
[Tue Apr 21 00:57:49.751893 2026] [:error] [pid 11351:tid 11403] [client 172.213.224.85:60859] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aeZbDQN8Z1-vktaI_tOBnQAAAFA"]
[Tue Apr 21 00:57:52.275984 2026] [:error] [pid 11351:tid 11392] [client 172.213.224.85:63386] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aeZbEAN8Z1-vktaI_tOBuQAAAEU"]
[Tue Apr 21 00:57:53.517182 2026] [:error] [pid 11351:tid 11410] [client 172.213.224.85:45148] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aeZbEQN8Z1-vktaI_tOBxwAAAFc"]
[Tue Apr 21 00:57:54.207843 2026] [:error] [pid 11350:tid 11375] [client 172.213.224.85:43341] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms.php"] [unique_id "aeZbEv4EoMBgOJuJnT0V4gAAABA"]
[Tue Apr 21 00:57:55.800057 2026] [:error] [pid 11441:tid 11443] [client 172.213.224.85:47898] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeZbE8ixByFUvmh319DVmwAAAMA"]
[Tue Apr 21 00:57:59.655980 2026] [:error] [pid 11350:tid 11372] [client 172.213.224.85:47978] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeZbF_4EoMBgOJuJnT0V_AAAAA0"]
[Tue Apr 21 00:58:01.365427 2026] [:error] [pid 11351:tid 11399] [client 172.213.224.85:47897] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeZbGQN8Z1-vktaI_tOB7gAAAEw"]
[Tue Apr 21 00:58:03.146822 2026] [:error] [pid 42014:tid 42021] [client 172.213.224.85:56302] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "aeZbG8ek-00-ZI0f1Nql_gAAAQU"]
[Tue Apr 21 00:58:05.277975 2026] [:error] [pid 11352:tid 11427] [client 172.213.224.85:43382] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-atom.php"] [unique_id "aeZbHWl10mhMSfJ7ir_7QwAAAI0"]
[Tue Apr 21 00:58:06.369138 2026] [:error] [pid 11441:tid 11459] [client 172.213.224.85:56257] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-atom.php"] [unique_id "aeZbHsixByFUvmh319DVrQAAANA"]
[Tue Apr 21 00:58:07.651148 2026] [:error] [pid 42014:tid 42040] [client 172.213.224.85:64803] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-atom.php"] [unique_id "aeZbH8ek-00-ZI0f1NqmCgAAARg"]
[Tue Apr 21 00:58:08.981089 2026] [:error] [pid 11352:tid 11414] [client 172.213.224.85:47898] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class-atom.php"] [unique_id "aeZbIGl10mhMSfJ7ir_7UAAAAIA"]
[Tue Apr 21 00:58:10.065915 2026] [:error] [pid 11350:tid 11382] [client 172.213.224.85:50606] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aeZbIv4EoMBgOJuJnT0WFQAAABc"]
[Tue Apr 21 00:58:11.635385 2026] [:error] [pid 11441:tid 11459] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 21 00:58:11.873679 2026] [:error] [pid 11441:tid 11462] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Tue Apr 21 00:58:12.111099 2026] [:error] [pid 11441:tid 11463] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/900.php
[Tue Apr 21 00:58:12.348776 2026] [:error] [pid 11441:tid 11466] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Apr 21 00:58:12.585130 2026] [:error] [pid 11441:tid 11452] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/jk.php
[Tue Apr 21 00:58:13.322859 2026] [:error] [pid 11441:tid 11446] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Tue Apr 21 00:58:13.566870 2026] [:error] [pid 11441:tid 11456] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 21 00:58:13.805829 2026] [:error] [pid 11441:tid 11443] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 21 00:58:14.058837 2026] [:error] [pid 11441:tid 11447] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Tue Apr 21 00:58:14.296811 2026] [:error] [pid 11441:tid 11462] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Tue Apr 21 00:58:14.538094 2026] [:error] [pid 11441:tid 11461] [client 172.213.224.85:47292] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 21 00:58:14.773817 2026] [:error] [pid 11441:tid 11448] [client 172.213.224.85:47292] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeZbJsixByFUvmh319DV0gAAAMU"]
[Tue Apr 21 00:58:15.941139 2026] [:error] [pid 11494:tid 11517] [client 172.213.224.85:63397] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeZbJ8gko5iFiE8YoyQrVAAAAZU"]
[Tue Apr 21 00:58:17.150420 2026] [:error] [pid 11350:tid 11370] [client 172.213.224.85:47237] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeZbKf4EoMBgOJuJnT0WMgAAAAs"]
[Tue Apr 21 00:58:18.979271 2026] [:error] [pid 11351:tid 11390] [client 172.213.224.85:45119] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeZbKgN8Z1-vktaI_tOCEAAAAEM"]
[Tue Apr 21 00:58:19.811139 2026] [:error] [pid 42014:tid 42022] [client 172.213.224.85:63334] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeZbK8ek-00-ZI0f1NqmFwAAAQY"]
[Tue Apr 21 00:58:21.444858 2026] [:error] [pid 42014:tid 42037] [client 172.213.224.85:35355] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeZbLcek-00-ZI0f1NqmGwAAARU"]
[Tue Apr 21 00:58:23.825438 2026] [:error] [pid 42014:tid 42023] [client 172.213.224.85:63306] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeZbL8ek-00-ZI0f1NqmIAAAAQc"]
[Tue Apr 21 00:58:25.487308 2026] [:error] [pid 11350:tid 11366] [client 172.213.224.85:56749] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws88.php"] [unique_id "aeZbMf4EoMBgOJuJnT0WTAAAAAc"]
[Tue Apr 21 00:58:27.904095 2026] [:error] [pid 11351:tid 11407] [client 172.213.224.85:45082] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adoms.php"] [unique_id "aeZbMwN8Z1-vktaI_tOCNQAAAFQ"]
[Tue Apr 21 00:58:29.440411 2026] [:error] [pid 11351:tid 11408] [client 172.213.224.85:5531] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adoms.php"] [unique_id "aeZbNQN8Z1-vktaI_tOCPAAAAFU"]
[Tue Apr 21 00:58:31.903366 2026] [:error] [pid 11350:tid 11362] [client 172.213.224.85:51117] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adoms.php"] [unique_id "aeZbN_4EoMBgOJuJnT0WaQAAAAM"]
[Tue Apr 21 00:58:35.025718 2026] [:error] [pid 42014:tid 42016] [client 172.213.224.85:38319] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adoms.php"] [unique_id "aeZbO8ek-00-ZI0f1NqmJQAAAQA"]
[Tue Apr 21 00:58:38.438114 2026] [:error] [pid 42014:tid 42018] [client 172.213.224.85:35297] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin-editor.php"] [unique_id "aeZbPsek-00-ZI0f1NqmKgAAAQI"]
[Tue Apr 21 00:58:41.475832 2026] [:error] [pid 42014:tid 42029] [client 172.213.224.85:57700] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin-editor.php"] [unique_id "aeZbQcek-00-ZI0f1NqmMAAAAQ0"]
[Tue Apr 21 00:58:42.725940 2026] [:error] [pid 42014:tid 42035] [client 172.213.224.85:49068] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin-editor.php"] [unique_id "aeZbQsek-00-ZI0f1NqmMgAAARM"]
[Tue Apr 21 00:58:44.191474 2026] [:error] [pid 6928:tid 6947] [client 172.213.224.85:5546] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin-editor.php"] [unique_id "aeZbRB3y7MHq1iB0qYriFAAAAVE"]
[Tue Apr 21 00:58:45.888369 2026] [:error] [pid 11350:tid 11377] [client 172.213.224.85:49067] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aeZbRf4EoMBgOJuJnT0WpAAAABI"]
[Tue Apr 21 00:58:47.357699 2026] [:error] [pid 11441:tid 11465] [client 172.213.224.85:46478] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aeZbR8ixByFUvmh319DV8QAAANY"]
[Tue Apr 21 00:58:50.890230 2026] [:error] [pid 11441:tid 11453] [client 172.213.224.85:47309] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aeZbSsixByFUvmh319DV9QAAAMo"]
[Tue Apr 21 00:58:54.554308 2026] [:error] [pid 11351:tid 11407] [client 172.213.224.85:54038] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aeZbTgN8Z1-vktaI_tOCpgAAAFQ"]
[Tue Apr 21 00:58:57.853471 2026] [:error] [pid 42014:tid 42029] [client 172.213.224.85:34092] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aeZbUcek-00-ZI0f1NqmPQAAAQ0"]
[Tue Apr 21 00:59:00.873759 2026] [:error] [pid 42014:tid 42018] [client 172.213.224.85:47297] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aeZbVMek-00-ZI0f1NqmRwAAAQI"]
[Tue Apr 21 00:59:05.587956 2026] [:error] [pid 11351:tid 11391] [client 172.213.224.85:38614] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aeZbWQN8Z1-vktaI_tOC1AAAAEQ"]
[Tue Apr 21 00:59:08.889947 2026] [:error] [pid 42014:tid 42017] [client 172.213.224.85:57672] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/an.php"] [unique_id "aeZbXMek-00-ZI0f1NqmUwAAAQE"]
[Tue Apr 21 00:59:11.373184 2026] [:error] [pid 11494:tid 11515] [client 172.213.224.85:51704] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t.php"] [unique_id "aeZbX8gko5iFiE8YoyQrxgAAAZM"]
[Tue Apr 21 00:59:14.277166 2026] [:error] [pid 11352:tid 11418] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Tue Apr 21 00:59:14.761013 2026] [:error] [pid 11352:tid 11422] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Tue Apr 21 00:59:15.002941 2026] [:error] [pid 11352:tid 11416] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/gaza.php
[Tue Apr 21 00:59:15.238056 2026] [:error] [pid 11352:tid 11426] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Tue Apr 21 00:59:15.472975 2026] [:error] [pid 11352:tid 11423] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Tue Apr 21 00:59:15.709665 2026] [:error] [pid 11352:tid 11421] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Tue Apr 21 00:59:15.945369 2026] [:error] [pid 11352:tid 11431] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 21 00:59:16.184395 2026] [:error] [pid 11352:tid 11429] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/yw5bi63u.php
[Tue Apr 21 00:59:16.421702 2026] [:error] [pid 11352:tid 11427] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/tool.php
[Tue Apr 21 00:59:16.672577 2026] [:error] [pid 11352:tid 11433] [client 172.213.224.85:36475] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Tue Apr 21 00:59:16.931354 2026] [:error] [pid 11352:tid 11418] [client 172.213.224.85:36475] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aeZbZGl10mhMSfJ7ir_7nAAAAIQ"]
[Tue Apr 21 00:59:18.724365 2026] [:error] [pid 11494:tid 11502] [client 172.213.224.85:54885] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aeZbZsgko5iFiE8YoyQr8QAAAYY"]
[Tue Apr 21 00:59:21.979753 2026] [:error] [pid 6928:tid 6940] [client 172.213.224.85:51706] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aeZbaR3y7MHq1iB0qYriUwAAAUo"]
[Tue Apr 21 00:59:23.245541 2026] [:error] [pid 11494:tid 11503] [client 172.213.224.85:42987] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aeZba8gko5iFiE8YoyQsEAAAAYc"]
[Tue Apr 21 00:59:24.483706 2026] [:error] [pid 11350:tid 11371] [client 172.213.224.85:55393] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aeZbbP4EoMBgOJuJnT0XLwAAAAw"]
[Tue Apr 21 00:59:25.507544 2026] [:error] [pid 6928:tid 6930] [client 172.213.224.85:40203] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aeZbbR3y7MHq1iB0qYriWgAAAUA"]
[Tue Apr 21 00:59:26.323729 2026] [:error] [pid 11350:tid 11377] [client 172.213.224.85:9654] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aeZbbv4EoMBgOJuJnT0XNgAAABI"]
[Tue Apr 21 00:59:27.943654 2026] [:error] [pid 42014:tid 42029] [client 172.213.224.85:51672] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "aeZbb8ek-00-ZI0f1NqmaAAAAQ0"]
[Tue Apr 21 00:59:28.890589 2026] [:error] [pid 11441:tid 11452] [client 172.213.224.85:38634] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeZbcMixByFUvmh319DWRgAAAMk"]
[Tue Apr 21 00:59:30.800468 2026] [:error] [pid 6928:tid 6933] [client 172.213.224.85:51690] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeZbch3y7MHq1iB0qYriZQAAAUM"]
[Tue Apr 21 00:59:32.554272 2026] [:error] [pid 11351:tid 11389] [client 172.213.224.85:9634] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeZbdAN8Z1-vktaI_tOC-QAAAEI"]
[Tue Apr 21 00:59:33.709534 2026] [:error] [pid 11441:tid 11455] [client 172.213.224.85:39613] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mk.php"] [unique_id "aeZbdcixByFUvmh319DWTwAAAMw"]
[Tue Apr 21 00:59:34.882788 2026] [:error] [pid 11351:tid 11400] [client 172.213.224.85:39554] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeZbdgN8Z1-vktaI_tODAwAAAE0"]
[Tue Apr 21 00:59:36.374315 2026] [:error] [pid 11352:tid 11423] [client 172.213.224.85:42972] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeZbeGl10mhMSfJ7ir_7swAAAIk"]
[Tue Apr 21 00:59:38.414178 2026] [:error] [pid 11494:tid 11514] [client 172.213.224.85:55394] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeZbesgko5iFiE8YoyQsMwAAAZI"]
[Tue Apr 21 00:59:39.795069 2026] [:error] [pid 6928:tid 6935] [client 172.213.224.85:42973] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aeZbex3y7MHq1iB0qYrigQAAAUU"]
[Tue Apr 21 00:59:41.615829 2026] [:error] [pid 42014:tid 42032] [client 172.213.224.85:62170] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aeZbfcek-00-ZI0f1NqmgwAAARA"]
[Tue Apr 21 00:59:43.228308 2026] [:error] [pid 11351:tid 11394] [client 172.213.224.85:54852] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aeZbfwN8Z1-vktaI_tODMQAAAEc"]
[Tue Apr 21 00:59:44.706826 2026] [:error] [pid 11494:tid 11516] [client 172.213.224.85:9604] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aeZbgMgko5iFiE8YoyQsRQAAAZQ"]
[Tue Apr 21 00:59:46.567421 2026] [:error] [pid 42014:tid 42030] [client 172.213.224.85:62207] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a4.php"] [unique_id "aeZbgsek-00-ZI0f1NqmjwAAAQ4"]
[Tue Apr 21 00:59:48.925841 2026] [:error] [pid 11351:tid 11402] [client 172.213.224.85:39590] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeZbhAN8Z1-vktaI_tODTQAAAE8"]
[Tue Apr 21 00:59:49.848375 2026] [:error] [pid 11350:tid 11382] [client 172.213.224.85:42984] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeZbhf4EoMBgOJuJnT0XXAAAABc"]
[Tue Apr 21 00:59:50.975756 2026] [:error] [pid 11351:tid 11392] [client 172.213.224.85:42989] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeZbhgN8Z1-vktaI_tODUQAAAEU"]
[Tue Apr 21 00:59:51.667497 2026] [:error] [pid 11351:tid 11411] [client 172.213.224.85:51640] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/retu11.PhP7"] [unique_id "aeZbhwN8Z1-vktaI_tODUwAAAFg"]
[Tue Apr 21 00:59:52.705553 2026] [:error] [pid 11350:tid 11382] [client 172.213.224.85:62169] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aeZbiP4EoMBgOJuJnT0XZwAAABc"]
[Tue Apr 21 00:59:53.473730 2026] [:error] [pid 6928:tid 6939] [client 172.213.224.85:6052] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aeZbiR3y7MHq1iB0qYrijgAAAUk"]
[Tue Apr 21 00:59:54.060131 2026] [:error] [pid 11494:tid 11498] [client 172.213.224.85:41981] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aeZbisgko5iFiE8YoyQsUQAAAYI"]
[Tue Apr 21 00:59:55.063094 2026] [:error] [pid 6928:tid 6933] [client 172.213.224.85:41262] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aeZbix3y7MHq1iB0qYrikQAAAUM"]
[Tue Apr 21 00:59:56.004250 2026] [:error] [pid 11352:tid 11422] [client 172.213.224.85:40864] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeZbjGl10mhMSfJ7ir_73AAAAIg"]
[Tue Apr 21 00:59:56.634177 2026] [:error] [pid 11351:tid 11393] [client 172.213.224.85:6035] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeZbjAN8Z1-vktaI_tODcQAAAEY"]
[Tue Apr 21 00:59:57.631733 2026] [:error] [pid 11352:tid 11430] [client 172.213.224.85:39561] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeZbjWl10mhMSfJ7ir_74QAAAJA"]
[Tue Apr 21 00:59:58.952458 2026] [:error] [pid 11350:tid 11378] [client 172.213.224.85:62190] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aeZbjv4EoMBgOJuJnT0XcwAAABM"]
[Tue Apr 21 00:59:59.584681 2026] [:error] [pid 6928:tid 6952] [client 172.213.224.85:62183] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeZbjx3y7MHq1iB0qYrinwAAAVY"]
[Tue Apr 21 01:00:00.219408 2026] [:error] [pid 11494:tid 11509] [client 172.213.224.85:41951] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeZbkMgko5iFiE8YoyQsVwAAAY0"]
[Tue Apr 21 01:00:00.754415 2026] [:error] [pid 11494:tid 11513] [client 172.213.224.85:62179] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeZbkMgko5iFiE8YoyQsXwAAAZE"]
[Tue Apr 21 01:00:01.499286 2026] [:error] [pid 11350:tid 11368] [client 172.213.224.85:6006] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "aeZbkf4EoMBgOJuJnT0XhAAAAAk"]
[Tue Apr 21 01:00:02.428134 2026] [:error] [pid 11350:tid 11382] [client 172.213.224.85:41899] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "aeZbkv4EoMBgOJuJnT0XiwAAABc"]
[Tue Apr 21 01:00:03.964734 2026] [:error] [pid 11351:tid 11387] [client 172.213.224.85:50678] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "aeZbkwN8Z1-vktaI_tODjAAAAEA"]
[Tue Apr 21 01:00:05.599582 2026] [:error] [pid 11441:tid 11459] [client 172.213.224.85:51629] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "aeZblcixByFUvmh319DWjQAAANA"]
[Tue Apr 21 01:00:07.092105 2026] [:error] [pid 42014:tid 42034] [client 172.213.224.85:40860] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admlo.php"] [unique_id "aeZbl8ek-00-ZI0f1NqmqwAAARI"]
[Tue Apr 21 01:00:08.488062 2026] [:error] [pid 6928:tid 6934] [client 172.213.224.85:62150] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gcqoa.php"] [unique_id "aeZbmB3y7MHq1iB0qYrirgAAAUQ"]
[Tue Apr 21 01:00:09.581828 2026] [:error] [pid 6928:tid 6940] [client 172.213.224.85:50642] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gcqoa.php"] [unique_id "aeZbmR3y7MHq1iB0qYriuQAAAUo"]
[Tue Apr 21 01:00:10.946863 2026] [:error] [pid 6928:tid 6952] [client 172.213.224.85:50677] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gcqoa.php"] [unique_id "aeZbmh3y7MHq1iB0qYrivgAAAVY"]
[Tue Apr 21 01:00:14.433006 2026] [:error] [pid 11352:tid 11419] [client 172.213.224.85:43865] [client 172.213.224.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gcqoa.php"] [unique_id "aeZbnml10mhMSfJ7ir_7-AAAAIU"]
[Tue Apr 21 01:00:16.319608 2026] [:error] [pid 11494:tid 11520] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Tue Apr 21 01:00:16.559933 2026] [:error] [pid 11494:tid 11517] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Tue Apr 21 01:00:16.800420 2026] [:error] [pid 11494:tid 11510] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Tue Apr 21 01:00:17.385993 2026] [:error] [pid 11494:tid 11519] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-api.php
[Tue Apr 21 01:00:17.639545 2026] [:error] [pid 11494:tid 11505] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Apr 21 01:00:17.876101 2026] [:error] [pid 11494:tid 11506] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Apr 21 01:00:18.160233 2026] [:error] [pid 11494:tid 11513] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/ccs.php
[Tue Apr 21 01:00:18.619374 2026] [:error] [pid 11494:tid 11518] [client 172.213.224.85:6024] File does not exist: /usr/local/apache/htdocs/suspended-page/first.php
[Tue Apr 21 04:00:23.766303 2026] [:error] [pid 4822:tid 4837] [client 185.194.178.7:27161] [client 185.194.178.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.7, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aeaF1yAteFQFwS_23Jl_TwAAAUs"]
[Tue Apr 21 04:00:23.772537 2026] [:error] [pid 4822:tid 4837] [client 185.194.178.7:27161] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 21 04:14:30.403739 2026] [:error] [pid 35320:tid 35331] [client 36.41.75.167:41216] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeaJJoJW6fdXWO6agMFjQwAAAAE"]
[Tue Apr 21 05:46:26.087509 2026] [:error] [pid 35320:tid 35336] [client 43.156.168.214:43016] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeaesoJW6fdXWO6agMGAaQAAAAY"]
[Tue Apr 21 05:46:41.704199 2026] [:error] [pid 4823:tid 4859] [client 95.154.200.42:46904] [client 95.154.200.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aeaewfc8mke3PfHqsxGLAAAAAYY"]
[Tue Apr 21 05:46:42.669122 2026] [:error] [pid 4822:tid 4829] [client 95.154.200.42:51458] [client 95.154.200.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "aeaewiAteFQFwS_23Jma6QAAAUM"]
[Tue Apr 21 05:46:43.632150 2026] [:error] [pid 4823:tid 4870] [client 95.154.200.42:51460] [client 95.154.200.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/tools.js"] [unique_id "aeaew_c8mke3PfHqsxGLAQAAAZE"]
[Tue Apr 21 05:46:44.600756 2026] [:error] [pid 35322:tid 35364] [client 95.154.200.42:51466] [client 95.154.200.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/translate_inline.js"] [unique_id "aeaexKPoAfV40BTfVKx4MgAAAIc"]
[Tue Apr 21 05:46:45.563081 2026] [:error] [pid 4822:tid 4842] [client 95.154.200.42:51470] [client 95.154.200.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skin/adminhtml/default/default/boxes.css"] [unique_id "aeaexSAteFQFwS_23Jma6gAAAVA"]
[Tue Apr 21 05:46:46.528325 2026] [:error] [pid 35320:tid 35338] [client 95.154.200.42:51486] [client 95.154.200.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/prototype/validation.js"] [unique_id "aeaexoJW6fdXWO6agMGAbwAAAAg"]
[Tue Apr 21 05:46:47.489836 2026] [:error] [pid 35415:tid 35439] [client 95.154.200.42:51490] [client 95.154.200.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RELEASE_NOTES.txt"] [unique_id "aeaex0iqDinI4_22zzj4zwAAAMw"]
[Tue Apr 21 11:22:19.329239 2026] [:error] [pid 4777:tid 4799] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 11:22:19.548268 2026] [:error] [pid 4777:tid 4806] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Apr 21 11:22:19.811000 2026] [:error] [pid 4777:tid 4812] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 21 11:22:20.032049 2026] [:error] [pid 4777:tid 4809] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Apr 21 11:22:20.254706 2026] [:error] [pid 4777:tid 4807] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 21 11:22:20.478764 2026] [:error] [pid 4777:tid 4797] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 11:22:20.714106 2026] [:error] [pid 4777:tid 4798] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 21 11:22:20.969307 2026] [:error] [pid 4777:tid 4810] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 21 11:22:21.437590 2026] [:error] [pid 4777:tid 4789] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Apr 21 11:22:21.694786 2026] [:error] [pid 4777:tid 4802] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 21 11:22:21.918073 2026] [:error] [pid 4777:tid 4801] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 21 11:22:22.174279 2026] [:error] [pid 4777:tid 4795] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 21 11:22:22.404996 2026] [:error] [pid 4777:tid 4803] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 21 11:22:22.631423 2026] [:error] [pid 4777:tid 4800] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Apr 21 11:22:22.851017 2026] [:error] [pid 4777:tid 4792] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Apr 21 11:22:23.070469 2026] [:error] [pid 4777:tid 4793] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 21 11:22:23.357759 2026] [:error] [pid 4777:tid 4796] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 21 11:22:23.578664 2026] [:error] [pid 4777:tid 4804] [client 89.251.0.109:54663] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 11:22:26.706585 2026] [:error] [pid 4777:tid 4810] [client 89.251.0.109:54663] [client 89.251.0.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aebtcqxXur6bykKyLZRHPQAAARY"]
[Tue Apr 21 11:22:28.814106 2026] [:error] [pid 5377:tid 5389] [client 89.251.0.102:61995] [client 89.251.0.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aebtdLBKychFlrHBdvt3ZQAAAcM"]
[Tue Apr 21 11:22:29.953806 2026] [:error] [pid 5377:tid 5393] [client 89.251.0.107:54559] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 21 11:22:30.616034 2026] [:error] [pid 5377:tid 5392] [client 89.251.0.107:54559] [client 89.251.0.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aebtdrBKychFlrHBdvt3bQAAAcY"]
[Tue Apr 21 12:24:52.712733 2026] [:error] [pid 35320:tid 35350] [client 43.153.48.240:60922] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeb8FIJW6fdXWO6agMHYpQAAABQ"]
[Tue Apr 21 15:09:47.709762 2026] [:error] [pid 5377:tid 5395] [client 170.106.179.68:51068] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeciu7BKychFlrHBdvvLsgAAAck"]
[Tue Apr 21 15:31:33.302610 2026] [:error] [pid 4777:tid 4799] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 21 15:31:34.235449 2026] [:error] [pid 4777:tid 4799] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Apr 21 15:31:34.508076 2026] [:error] [pid 4777:tid 4804] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 21 15:31:34.780429 2026] [:error] [pid 4777:tid 4796] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Apr 21 15:31:35.057245 2026] [:error] [pid 4777:tid 4811] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/log.php
[Tue Apr 21 15:31:35.339549 2026] [:error] [pid 4777:tid 4792] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Apr 21 15:31:35.608551 2026] [:error] [pid 4777:tid 4807] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 21 15:31:35.886709 2026] [:error] [pid 4777:tid 4805] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Apr 21 15:31:36.183801 2026] [:error] [pid 4777:tid 4803] [client 45.86.200.234:49085] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 15:31:36.455017 2026] [:error] [pid 4777:tid 4796] [client 45.86.200.234:49085] [client 45.86.200.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aecn2KxXur6bykKyLZR-BQAAAQg"]
[Tue Apr 21 15:31:37.021905 2026] [:error] [pid 53832:tid 53848] [client 45.86.200.227:57351] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 21 15:31:37.301702 2026] [:error] [pid 53832:tid 53848] [client 45.86.200.227:57351] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aecn2dzkuxsE_OhM9UIIqwAAAk0"]
[Tue Apr 21 15:31:37.838259 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.217:44431] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue Apr 21 15:31:38.108542 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.217:44431] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Tue Apr 21 15:31:38.379885 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.217:44431] File does not exist: /usr/local/apache/htdocs/suspended-page/bak.php
[Tue Apr 21 15:31:38.656494 2026] [:error] [pid 5377:tid 5403] [client 45.86.200.217:44431] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 21 15:31:38.928703 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.217:44431] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Apr 21 15:31:39.197103 2026] [:error] [pid 5377:tid 5404] [client 45.86.200.217:44431] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aecn27BKychFlrHBdvvbpQAAAdI"]
[Tue Apr 21 15:31:39.761253 2026] [:error] [pid 35321:tid 35405] [client 185.82.72.179:35587] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Apr 21 15:31:40.041113 2026] [:error] [pid 35321:tid 35405] [client 185.82.72.179:35587] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 21 15:31:40.324008 2026] [:error] [pid 35321:tid 35405] [client 185.82.72.179:35587] File does not exist: /usr/local/apache/htdocs/suspended-page/term.php
[Tue Apr 21 15:31:40.607033 2026] [:error] [pid 35321:tid 35405] [client 185.82.72.179:35587] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 15:31:40.895005 2026] [:error] [pid 35321:tid 35405] [client 185.82.72.179:35587] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Apr 21 15:31:41.194429 2026] [:error] [pid 35321:tid 35405] [client 185.82.72.179:35587] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 21 15:31:41.493733 2026] [:error] [pid 35321:tid 35386] [client 185.82.72.179:35587] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue Apr 21 15:31:41.772458 2026] [:error] [pid 35321:tid 35386] [client 185.82.72.179:35587] [client 185.82.72.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aecn3TeHLhVUuu8cVXyRGgAAAEI"]
[Tue Apr 21 15:31:42.315867 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 15:31:42.588567 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Apr 21 15:31:42.877113 2026] [:error] [pid 53731:tid 53740] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Apr 21 15:31:43.190533 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/readme.php
[Tue Apr 21 15:31:43.468336 2026] [:error] [pid 53731:tid 53748] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-file.php
[Tue Apr 21 15:31:43.752057 2026] [:error] [pid 53731:tid 53737] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/marijuana.php
[Tue Apr 21 15:31:44.024177 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 21 15:31:44.332300 2026] [:error] [pid 53731:tid 53740] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/bk.php
[Tue Apr 21 15:31:44.614074 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue Apr 21 15:31:44.893488 2026] [:error] [pid 53731:tid 53748] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 21 15:31:45.181536 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 21 15:31:45.462816 2026] [:error] [pid 53731:tid 53739] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sigunq.php
[Tue Apr 21 15:31:45.746446 2026] [:error] [pid 53731:tid 53740] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Apr 21 15:31:46.026803 2026] [:error] [pid 53731:tid 53748] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/alfanew.php
[Tue Apr 21 15:31:46.325268 2026] [:error] [pid 53731:tid 53739] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue Apr 21 15:31:46.599909 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/fw.php
[Tue Apr 21 15:31:46.875529 2026] [:error] [pid 53731:tid 53741] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Apr 21 15:31:47.155672 2026] [:error] [pid 53731:tid 53758] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/sym.php
[Tue Apr 21 15:31:47.430496 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/sys.php
[Tue Apr 21 15:31:47.715766 2026] [:error] [pid 53731:tid 53748] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Apr 21 15:31:47.988782 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Tue Apr 21 15:31:48.263343 2026] [:error] [pid 53731:tid 53758] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Apr 21 15:31:48.536862 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-settings.php
[Tue Apr 21 15:31:48.820950 2026] [:error] [pid 53731:tid 53754] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Apr 21 15:31:49.094984 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue Apr 21 15:31:49.383186 2026] [:error] [pid 53731:tid 53742] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-db.php
[Tue Apr 21 15:31:49.662398 2026] [:error] [pid 53731:tid 53758] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Tue Apr 21 15:31:49.930327 2026] [:error] [pid 53731:tid 53739] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Apr 21 15:31:50.210454 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/cmd.php
[Tue Apr 21 15:31:50.488878 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Apr 21 15:31:50.767454 2026] [:error] [pid 53731:tid 53748] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Apr 21 15:31:51.044829 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Tue Apr 21 15:31:51.315097 2026] [:error] [pid 53731:tid 53760] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Apr 21 15:31:51.585767 2026] [:error] [pid 53731:tid 53754] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 21 15:31:51.856014 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Apr 21 15:31:52.142565 2026] [:error] [pid 53731:tid 53758] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Apr 21 15:31:52.417775 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Tue Apr 21 15:31:52.698814 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/geju.php
[Tue Apr 21 15:31:52.968665 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 21 15:31:53.238961 2026] [:error] [pid 53731:tid 53742] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Apr 21 15:31:53.519470 2026] [:error] [pid 53731:tid 53740] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Apr 21 15:31:53.789491 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-activate.php
[Tue Apr 21 15:31:54.060889 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/a.php
[Tue Apr 21 15:31:54.339666 2026] [:error] [pid 53731:tid 53754] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/randkeyword.php
[Tue Apr 21 15:31:54.612603 2026] [:error] [pid 53731:tid 53741] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Apr 21 15:31:54.883140 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 15:31:55.167486 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-cron.php
[Tue Apr 21 15:31:55.443840 2026] [:error] [pid 53731:tid 53740] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 15:31:55.714254 2026] [:error] [pid 53731:tid 53739] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 21 15:31:55.984535 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue Apr 21 15:31:56.273159 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-config-sample.php
[Tue Apr 21 15:31:56.546827 2026] [:error] [pid 53731:tid 53760] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/manager.php
[Tue Apr 21 15:31:56.816585 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Tue Apr 21 15:31:57.094133 2026] [:error] [pid 53731:tid 53740] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Apr 21 15:31:57.368643 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 21 15:31:57.649124 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Tue Apr 21 15:31:57.964247 2026] [:error] [pid 53731:tid 53754] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Apr 21 15:31:58.236312 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-set.php
[Tue Apr 21 15:31:58.505843 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Apr 21 15:31:58.782183 2026] [:error] [pid 53731:tid 53749] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/header.php
[Tue Apr 21 15:31:59.063150 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Tue Apr 21 15:31:59.343635 2026] [:error] [pid 53731:tid 53758] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/upload.php
[Tue Apr 21 15:31:59.619697 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Apr 21 15:31:59.904613 2026] [:error] [pid 53731:tid 53739] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 21 15:32:00.233618 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 21 15:32:00.528250 2026] [:error] [pid 53731:tid 53749] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Apr 21 15:32:00.820996 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_info.php
[Tue Apr 21 15:32:01.095480 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/xml.php
[Tue Apr 21 15:32:01.376169 2026] [:error] [pid 53731:tid 53739] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/by.php
[Tue Apr 21 15:32:01.651273 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Apr 21 15:32:01.928829 2026] [:error] [pid 53731:tid 53742] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 21 15:32:02.206134 2026] [:error] [pid 53731:tid 53737] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 21 15:32:02.493433 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Tue Apr 21 15:32:02.768047 2026] [:error] [pid 53731:tid 53749] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Tue Apr 21 15:32:03.042773 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/thoms.php
[Tue Apr 21 15:32:03.317322 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Tue Apr 21 15:32:03.611463 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/media.php
[Tue Apr 21 15:32:04.160918 2026] [:error] [pid 53731:tid 53756] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/bs.php
[Tue Apr 21 15:32:04.454489 2026] [:error] [pid 53731:tid 53758] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/checkbox.php
[Tue Apr 21 15:32:04.758951 2026] [:error] [pid 53731:tid 53738] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/export.php
[Tue Apr 21 15:32:05.030285 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/privacy.php
[Tue Apr 21 15:32:05.319821 2026] [:error] [pid 53731:tid 53741] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/tools.php
[Tue Apr 21 15:32:05.594261 2026] [:error] [pid 53731:tid 53742] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Apr 21 15:32:05.870976 2026] [:error] [pid 53731:tid 53737] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Apr 21 15:32:06.151283 2026] [:error] [pid 53731:tid 53749] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/sts.php
[Tue Apr 21 15:32:06.427944 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/st.php
[Tue Apr 21 15:32:12.426864 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/GA13.php
[Tue Apr 21 15:32:12.980029 2026] [:error] [pid 53731:tid 53759] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Apr 21 15:32:13.258632 2026] [:error] [pid 53731:tid 53736] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/locks.php
[Tue Apr 21 15:32:14.560560 2026] [:error] [pid 53731:tid 53759] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Tue Apr 21 15:32:14.834401 2026] [:error] [pid 53731:tid 53753] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-uploads.php
[Tue Apr 21 15:32:15.111181 2026] [:error] [pid 53731:tid 53752] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Tue Apr 21 15:32:15.406026 2026] [:error] [pid 53731:tid 53736] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Tue Apr 21 15:32:15.681014 2026] [:error] [pid 53731:tid 53740] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Tue Apr 21 15:32:15.952162 2026] [:error] [pid 53731:tid 53757] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue Apr 21 15:32:16.249588 2026] [:error] [pid 53731:tid 53760] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue Apr 21 15:32:16.523106 2026] [:error] [pid 53731:tid 53735] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa.php
[Tue Apr 21 15:32:16.793008 2026] [:error] [pid 53731:tid 53738] [client 185.82.72.108:29979] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-zx.php
[Tue Apr 21 15:32:17.348880 2026] [:error] [pid 35320:tid 35348] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Apr 21 15:32:17.629954 2026] [:error] [pid 35320:tid 35340] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/fiyhxaae.php
[Tue Apr 21 15:32:17.912595 2026] [:error] [pid 35320:tid 35352] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/gfd.php
[Tue Apr 21 15:32:18.198564 2026] [:error] [pid 35320:tid 35338] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Tue Apr 21 15:32:18.484721 2026] [:error] [pid 35320:tid 35346] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-temp.php
[Tue Apr 21 15:32:18.766462 2026] [:error] [pid 35320:tid 35340] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/Okxob.php
[Tue Apr 21 15:32:19.053543 2026] [:error] [pid 35320:tid 35341] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/x123x.php
[Tue Apr 21 15:32:19.333033 2026] [:error] [pid 35320:tid 35338] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 15:32:19.619966 2026] [:error] [pid 35320:tid 35348] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Tue Apr 21 15:32:19.916813 2026] [:error] [pid 35320:tid 35336] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Tue Apr 21 15:32:20.495792 2026] [:error] [pid 35320:tid 35332] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/finami.php
[Tue Apr 21 15:32:20.795342 2026] [:error] [pid 35320:tid 35352] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/htto.php
[Tue Apr 21 15:32:21.110839 2026] [:error] [pid 35320:tid 35337] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/options-head.php
[Tue Apr 21 15:32:21.389957 2026] [:error] [pid 35320:tid 35336] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/rithin.php
[Tue Apr 21 15:32:21.678147 2026] [:error] [pid 35320:tid 35331] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Apr 21 15:32:21.969631 2026] [:error] [pid 35320:tid 35332] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Tue Apr 21 15:32:22.247920 2026] [:error] [pid 35320:tid 35338] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Tue Apr 21 15:32:22.822560 2026] [:error] [pid 35320:tid 35344] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Apr 21 15:32:23.101654 2026] [:error] [pid 35320:tid 35330] [client 185.82.72.102:28113] File does not exist: /usr/local/apache/htdocs/suspended-page/asf.php
[Tue Apr 21 15:32:23.379340 2026] [:error] [pid 35320:tid 35332] [client 185.82.72.102:28113] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/execute.php"] [unique_id "aecoB4JW6fdXWO6agMETlQAAAAI"]
[Tue Apr 21 15:32:24.487584 2026] [:error] [pid 35321:tid 35393] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/bengi.php
[Tue Apr 21 15:32:24.771386 2026] [:error] [pid 35321:tid 35384] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/0xD.php
[Tue Apr 21 15:32:25.045997 2026] [:error] [pid 35321:tid 35407] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-upload.php
[Tue Apr 21 15:32:25.325004 2026] [:error] [pid 35321:tid 35399] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Tue Apr 21 15:32:25.609385 2026] [:error] [pid 35321:tid 35392] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-aa.php
[Tue Apr 21 15:32:25.891634 2026] [:error] [pid 35321:tid 35396] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-freya.php
[Tue Apr 21 15:32:26.254095 2026] [:error] [pid 35321:tid 35401] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Tue Apr 21 15:32:26.530838 2026] [:error] [pid 35321:tid 35386] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 15:32:26.802809 2026] [:error] [pid 35321:tid 35393] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/src_api.php
[Tue Apr 21 15:32:27.090953 2026] [:error] [pid 35321:tid 35392] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/aves.php
[Tue Apr 21 15:32:27.660138 2026] [:error] [pid 35321:tid 35402] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Tue Apr 21 15:32:27.938260 2026] [:error] [pid 35321:tid 35407] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 21 15:32:28.224803 2026] [:error] [pid 35321:tid 35398] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/vanda.php
[Tue Apr 21 15:32:28.498919 2026] [:error] [pid 35321:tid 35402] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/clss.php
[Tue Apr 21 15:32:29.057316 2026] [:error] [pid 35321:tid 35384] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/torsa1.php
[Tue Apr 21 15:32:29.336415 2026] [:error] [pid 35321:tid 35389] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fclass.php
[Tue Apr 21 15:32:29.614629 2026] [:error] [pid 35321:tid 35392] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ccv.php
[Tue Apr 21 15:32:29.924452 2026] [:error] [pid 35321:tid 35396] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/xoot.php
[Tue Apr 21 15:32:30.218842 2026] [:error] [pid 35321:tid 35386] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/w-a.php
[Tue Apr 21 15:32:30.505145 2026] [:error] [pid 35321:tid 35384] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/toine.php
[Tue Apr 21 15:32:30.798518 2026] [:error] [pid 35321:tid 35398] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/fault.php
[Tue Apr 21 15:32:31.073782 2026] [:error] [pid 35321:tid 35406] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/x2x.php
[Tue Apr 21 15:32:31.357991 2026] [:error] [pid 35321:tid 35386] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/h02ugyh.php
[Tue Apr 21 15:32:31.636063 2026] [:error] [pid 35321:tid 35384] [client 45.86.200.250:51909] File does not exist: /usr/local/apache/htdocs/suspended-page/ftp.php
[Tue Apr 21 15:32:32.201459 2026] [:error] [pid 35321:tid 35395] [client 45.86.200.250:51909] [client 45.86.200.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aecoEDeHLhVUuu8cVXyTLgAAAEs"]
[Tue Apr 21 15:32:32.739508 2026] [:error] [pid 4823:tid 4862] [client 45.86.200.236:20131] [client 45.86.200.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aecoEPc8mke3PfHqsxGvXAAAAYk"]
[Tue Apr 21 15:32:34.068560 2026] [:error] [pid 35415:tid 35431] [client 45.86.200.214:22617] [client 45.86.200.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aecoEkiqDinI4_22zzhPdgAAAMQ"]
[Tue Apr 21 15:32:34.605004 2026] [:error] [pid 35321:tid 35388] [client 45.86.200.217:61399] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aecoEjeHLhVUuu8cVXyTRQAAAEQ"]
[Tue Apr 21 15:32:35.432533 2026] [:error] [pid 35321:tid 35397] [client 45.86.200.241:52419] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aecoEzeHLhVUuu8cVXyTUQAAAE0"]
[Tue Apr 21 15:32:37.200769 2026] [:error] [pid 53978:tid 53980] [client 45.86.200.233:60901] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aecoFZ1ivsR4hcOSQbaoIgAAAoA"]
[Tue Apr 21 15:32:37.752167 2026] [:error] [pid 35320:tid 35331] [client 45.86.200.237:30897] [client 45.86.200.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aecoFYJW6fdXWO6agMET_wAAAAE"]
[Tue Apr 21 15:32:39.137414 2026] [:error] [pid 53978:tid 53994] [client 45.86.200.230:60121] [client 45.86.200.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aecoF51ivsR4hcOSQbaoOAAAAo4"]
[Tue Apr 21 15:32:40.820376 2026] [:error] [pid 35320:tid 35353] [client 45.86.200.241:62941] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecoGIJW6fdXWO6agMEUGQAAABc"]
[Tue Apr 21 15:32:41.369073 2026] [:error] [pid 54080:tid 54089] [client 45.86.200.242:48035] [client 45.86.200.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aecoGYzEbQHHxtmWbaZHpgAAAsc"]
[Tue Apr 21 15:32:41.940700 2026] [:error] [pid 54080:tid 54106] [client 45.86.200.229:52323] [client 45.86.200.229] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aecoGYzEbQHHxtmWbaZHrwAAAtg"]
[Tue Apr 21 15:32:42.506431 2026] [:error] [pid 35320:tid 35339] [client 45.86.200.239:37363] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aecoGoJW6fdXWO6agMEULQAAAAk"]
[Tue Apr 21 15:33:03.395331 2026] [:error] [pid 54080:tid 54082] [client 45.86.200.229:53491] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 21 15:34:23.011382 2026] [:error] [pid 35415:tid 35430] [client 45.86.200.229:26655] [client 45.86.200.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/media/"] [unique_id "aecof0iqDinI4_22zzhR9AAAAMM"]
[Tue Apr 21 15:36:09.155157 2026] [:error] [pid 4777:tid 4794] [client 20.91.250.199:2194] File does not exist: /usr/local/apache/htdocs/suspended-page/gold.php
[Tue Apr 21 15:36:09.175574 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:25889] File does not exist: /usr/local/apache/htdocs/suspended-page/gold.php
[Tue Apr 21 15:36:09.455737 2026] [:error] [pid 4777:tid 4788] [client 20.91.250.199:2194] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Tue Apr 21 15:36:09.488195 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:25889] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Tue Apr 21 15:36:09.770456 2026] [:error] [pid 4777:tid 4794] [client 20.91.250.199:2194] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Tue Apr 21 15:36:10.112933 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:25889] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Tue Apr 21 15:36:10.127986 2026] [:error] [pid 4777:tid 4810] [client 20.91.250.199:2194] File does not exist: /usr/local/apache/htdocs/suspended-page/.sghb.php
[Tue Apr 21 15:36:10.409547 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:25889] File does not exist: /usr/local/apache/htdocs/suspended-page/.sghb.php
[Tue Apr 21 15:36:10.414751 2026] [:error] [pid 4777:tid 4789] [client 20.91.250.199:2194] File does not exist: /usr/local/apache/htdocs/suspended-page/z3ki.php
[Tue Apr 21 15:36:10.706657 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:25889] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z3ki.php"] [unique_id "aeco6jeHLhVUuu8cVXykUgAAAFg"]
[Tue Apr 21 15:36:10.989100 2026] [:error] [pid 4777:tid 4800] [client 20.91.250.199:2194] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco6qxXur6bykKyLZSFUAAAAQw"]
[Tue Apr 21 15:36:11.561253 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:33484] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z3ki.php"] [unique_id "aeco6zeHLhVUuu8cVXykaAAAAFg"]
[Tue Apr 21 15:36:11.903057 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:32027] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco6zeHLhVUuu8cVXykbwAAAFg"]
[Tue Apr 21 15:36:13.015761 2026] [:error] [pid 4823:tid 4861] [client 20.91.250.199:2584] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z3ki.php"] [unique_id "aeco7Pc8mke3PfHqsxG3jAAAAYg"]
[Tue Apr 21 15:36:13.122473 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:57027] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco7fc8mke3PfHqsxG3jgAAAYE"]
[Tue Apr 21 15:36:14.116476 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:2768] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco7jeHLhVUuu8cVXykmwAAAFA"]
[Tue Apr 21 15:36:14.128107 2026] [:error] [pid 35321:tid 35384] [client 20.91.250.199:47727] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/z3ki.php"] [unique_id "aeco7jeHLhVUuu8cVXyknAAAAEA"]
[Tue Apr 21 15:36:14.828383 2026] [:error] [pid 4777:tid 4795] [client 20.91.250.199:51281] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco7qxXur6bykKyLZSFjQAAAQc"]
[Tue Apr 21 15:36:15.165464 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:52557] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco7zeHLhVUuu8cVXykswAAAE8"]
[Tue Apr 21 15:36:16.098855 2026] [:error] [pid 53832:tid 53856] [client 20.91.250.199:57077] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco8NzkuxsE_OhM9UISggAAAlU"]
[Tue Apr 21 15:36:16.756568 2026] [:error] [pid 5377:tid 5395] [client 20.91.250.199:39901] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco8LBKychFlrHBdvvi2AAAAck"]
[Tue Apr 21 15:36:17.339463 2026] [:error] [pid 4823:tid 4866] [client 20.91.250.199:32055] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco8fc8mke3PfHqsxG3tgAAAY0"]
[Tue Apr 21 15:36:17.613689 2026] [:error] [pid 54080:tid 54088] [client 20.91.250.199:47728] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/zr-828.php"] [unique_id "aeco8YzEbQHHxtmWbaZRvAAAAsY"]
[Tue Apr 21 15:36:18.117149 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:32028] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco8tzkuxsE_OhM9UISjAAAAkc"]
[Tue Apr 21 15:36:18.555357 2026] [:error] [pid 53978:tid 53987] [client 20.91.250.199:60344] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco8p1ivsR4hcOSQbauLgAAAoc"]
[Tue Apr 21 15:36:18.869288 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:2611] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco8tzkuxsE_OhM9UISkAAAAlQ"]
[Tue Apr 21 15:36:19.207608 2026] [:error] [pid 53832:tid 53851] [client 20.91.250.199:61162] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco89zkuxsE_OhM9UISkgAAAlA"]
[Tue Apr 21 15:36:19.532582 2026] [:error] [pid 35320:tid 35340] [client 20.91.250.199:47722] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco84JW6fdXWO6agMEaVgAAAAo"]
[Tue Apr 21 15:36:19.872297 2026] [:error] [pid 53978:tid 53993] [client 20.91.250.199:51295] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco851ivsR4hcOSQbauOgAAAo0"]
[Tue Apr 21 15:36:20.442438 2026] [:error] [pid 53832:tid 53854] [client 20.91.250.199:51936] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco9NzkuxsE_OhM9UISmgAAAlM"]
[Tue Apr 21 15:36:20.546588 2026] [:error] [pid 53832:tid 53843] [client 20.91.250.199:61122] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uwa.php"] [unique_id "aeco9NzkuxsE_OhM9UISmwAAAkg"]
[Tue Apr 21 15:36:21.207417 2026] [:error] [pid 4823:tid 4859] [client 20.91.250.199:50818] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco9fc8mke3PfHqsxG30AAAAYY"]
[Tue Apr 21 15:36:21.349839 2026] [:error] [pid 4823:tid 4872] [client 20.91.250.199:60311] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco9fc8mke3PfHqsxG30QAAAZM"]
[Tue Apr 21 15:36:21.911655 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:39920] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco9dzkuxsE_OhM9UISpAAAAk0"]
[Tue Apr 21 15:36:22.087313 2026] [:error] [pid 4777:tid 4797] [client 20.91.250.199:51298] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco9qxXur6bykKyLZSFwAAAAQk"]
[Tue Apr 21 15:36:22.564839 2026] [:error] [pid 4777:tid 4791] [client 20.91.250.199:47693] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco9qxXur6bykKyLZSFwwAAAQM"]
[Tue Apr 21 15:36:22.856352 2026] [:error] [pid 53978:tid 53991] [client 20.91.250.199:52583] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco9p1ivsR4hcOSQbauXQAAAos"]
[Tue Apr 21 15:36:23.121715 2026] [:error] [pid 53832:tid 53856] [client 20.91.250.199:61150] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco99zkuxsE_OhM9UISsAAAAlU"]
[Tue Apr 21 15:36:23.695806 2026] [:error] [pid 35321:tid 35391] [client 20.91.250.199:61346] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ckk.php"] [unique_id "aeco9zeHLhVUuu8cVXylKAAAAEc"]
[Tue Apr 21 15:36:24.004457 2026] [:error] [pid 4777:tid 4794] [client 20.91.250.199:50787] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco-KxXur6bykKyLZSFyAAAAQY"]
[Tue Apr 21 15:36:24.448611 2026] [:error] [pid 4823:tid 4862] [client 20.91.250.199:51916] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco-Pc8mke3PfHqsxG34QAAAYk"]
[Tue Apr 21 15:36:24.911245 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:50853] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco-DeHLhVUuu8cVXylOgAAAFg"]
[Tue Apr 21 15:36:25.323737 2026] [:error] [pid 35415:tid 35433] [client 20.91.250.199:52584] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco-UiqDinI4_22zzhVRQAAAMY"]
[Tue Apr 21 15:36:25.661863 2026] [:error] [pid 4777:tid 4807] [client 20.91.250.199:50829] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aeco-axXur6bykKyLZSF0AAAARM"]
[Tue Apr 21 15:36:26.120874 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:19873] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco-vc8mke3PfHqsxG37QAAAZY"]
[Tue Apr 21 15:36:26.662894 2026] [:error] [pid 5377:tid 5405] [client 20.91.250.199:52580] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aeco-rBKychFlrHBdvvi9wAAAdM"]
[Tue Apr 21 15:36:26.887921 2026] [:error] [pid 54080:tid 54090] [client 20.91.250.199:61354] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/pucci.php"] [unique_id "aeco-ozEbQHHxtmWbaZSBwAAAsg"]
[Tue Apr 21 15:36:27.462586 2026] [:error] [pid 53731:tid 53743] [client 20.91.250.199:60342] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aeco-12I9THUR-bRVGzZWAAAAgg"]
[Tue Apr 21 15:36:28.516607 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:51912] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aeco_DeHLhVUuu8cVXyldAAAAEs"]
[Tue Apr 21 15:36:28.809535 2026] [:error] [pid 4777:tid 4795] [client 20.91.250.199:2563] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aeco_KxXur6bykKyLZSF3gAAAQc"]
[Tue Apr 21 15:36:30.271592 2026] [:error] [pid 53978:tid 53991] [client 20.91.250.199:60337] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aeco_p1ivsR4hcOSQbausAAAAos"]
[Tue Apr 21 15:36:30.687781 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:51286] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aeco_jeHLhVUuu8cVXylngAAAFg"]
[Tue Apr 21 15:36:31.613499 2026] [:error] [pid 35321:tid 35385] [client 20.91.250.199:19862] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aeco_zeHLhVUuu8cVXyluAAAAEE"]
[Tue Apr 21 15:36:31.868602 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:19887] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aeco_zeHLhVUuu8cVXylvQAAAEw"]
[Tue Apr 21 15:36:32.642062 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:23717] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "aecpADeHLhVUuu8cVXyl1gAAAFU"]
[Tue Apr 21 15:36:33.056186 2026] [:error] [pid 35321:tid 35389] [client 20.91.250.199:39931] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aecpATeHLhVUuu8cVXyl5AAAAEU"]
[Tue Apr 21 15:36:33.473422 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:41286] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aecpATeHLhVUuu8cVXyl8QAAAEw"]
[Tue Apr 21 15:36:34.246044 2026] [:error] [pid 35321:tid 35391] [client 20.91.250.199:49455] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aecpAjeHLhVUuu8cVXymBwAAAEc"]
[Tue Apr 21 15:36:34.641718 2026] [:error] [pid 4777:tid 4802] [client 20.91.250.199:28661] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aecpAqxXur6bykKyLZSGAAAAAQ4"]
[Tue Apr 21 15:36:34.974425 2026] [:error] [pid 54080:tid 54089] [client 20.91.250.199:23692] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpAozEbQHHxtmWbaZSNgAAAsc"]
[Tue Apr 21 15:36:35.258421 2026] [:error] [pid 53832:tid 53841] [client 20.91.250.199:23731] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aecpA9zkuxsE_OhM9UITRgAAAkY"]
[Tue Apr 21 15:36:35.659349 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:60290] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpAzeHLhVUuu8cVXymLgAAAFA"]
[Tue Apr 21 15:36:35.963118 2026] [:error] [pid 5377:tid 5390] [client 20.91.250.199:49834] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.dj/index.php"] [unique_id "aecpA7BKychFlrHBdvvjRQAAAcQ"]
[Tue Apr 21 15:36:36.496207 2026] [:error] [pid 4823:tid 4867] [client 20.91.250.199:51995] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpBPc8mke3PfHqsxG4IgAAAY4"]
[Tue Apr 21 15:36:36.792383 2026] [:error] [pid 4823:tid 4871] [client 20.91.250.199:51985] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpBPc8mke3PfHqsxG4JQAAAZI"]
[Tue Apr 21 15:36:37.211365 2026] [:error] [pid 53832:tid 53857] [client 20.91.250.199:61318] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpBdzkuxsE_OhM9UITagAAAlY"]
[Tue Apr 21 15:36:37.478322 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:23709] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpBdzkuxsE_OhM9UITbwAAAkE"]
[Tue Apr 21 15:36:37.838273 2026] [:error] [pid 35321:tid 35402] [client 20.91.250.199:2739] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpBTeHLhVUuu8cVXymeQAAAFI"]
[Tue Apr 21 15:36:38.195031 2026] [:error] [pid 4823:tid 4857] [client 20.91.250.199:19941] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpBvc8mke3PfHqsxG4LQAAAYQ"]
[Tue Apr 21 15:36:38.526333 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:61367] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpBvc8mke3PfHqsxG4LgAAAYE"]
[Tue Apr 21 15:36:38.877447 2026] [:error] [pid 35322:tid 35375] [client 20.91.250.199:22170] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aecpBqPoAfV40BTfVKzBlwAAAJI"]
[Tue Apr 21 15:36:39.244482 2026] [:error] [pid 4823:tid 4872] [client 20.91.250.199:24180] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpB_c8mke3PfHqsxG4OAAAAZM"]
[Tue Apr 21 15:36:39.633713 2026] [:error] [pid 53731:tid 53749] [client 20.91.250.199:23720] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpB12I9THUR-bRVGzZyQAAAg4"]
[Tue Apr 21 15:36:39.941074 2026] [:error] [pid 35415:tid 35441] [client 20.91.250.199:49438] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpB0iqDinI4_22zzhVlQAAAM4"]
[Tue Apr 21 15:36:40.329785 2026] [:error] [pid 4823:tid 4857] [client 20.91.250.199:48531] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpCPc8mke3PfHqsxG4SQAAAYQ"]
[Tue Apr 21 15:36:40.509417 2026] [:error] [pid 53731:tid 53754] [client 20.91.250.199:44586] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpCF2I9THUR-bRVGzZ0QAAAhI"]
[Tue Apr 21 15:36:40.934335 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:2363] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpCDeHLhVUuu8cVXymygAAAEQ"]
[Tue Apr 21 15:36:41.245464 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:29443] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpCfc8mke3PfHqsxG4VwAAAYE"]
[Tue Apr 21 15:36:41.643365 2026] [:error] [pid 35415:tid 35431] [client 20.91.250.199:22174] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.tmb/"] [unique_id "aecpCUiqDinI4_22zzhVmAAAAMQ"]
[Tue Apr 21 15:36:41.953853 2026] [:error] [pid 54080:tid 54099] [client 20.91.250.199:2749] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpCYzEbQHHxtmWbaZSYwAAAtE"]
[Tue Apr 21 15:36:42.305415 2026] [:error] [pid 53832:tid 53854] [client 20.91.250.199:24183] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpCtzkuxsE_OhM9UITuAAAAlM"]
[Tue Apr 21 15:36:42.683248 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:19961] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpCtzkuxsE_OhM9UITvgAAAlQ"]
[Tue Apr 21 15:36:42.919290 2026] [:error] [pid 35415:tid 35430] [client 20.91.250.199:23199] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpCkiqDinI4_22zzhVogAAAMM"]
[Tue Apr 21 15:36:43.539799 2026] [:error] [pid 54080:tid 54101] [client 20.91.250.199:32711] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpC4zEbQHHxtmWbaZScQAAAtM"]
[Tue Apr 21 15:36:43.772219 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:44552] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpC4zEbQHHxtmWbaZScwAAAs8"]
[Tue Apr 21 15:36:44.187188 2026] [:error] [pid 35320:tid 35333] [client 20.91.250.199:25244] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpDIJW6fdXWO6agMEbDgAAAAM"]
[Tue Apr 21 15:36:44.422061 2026] [:error] [pid 35415:tid 35447] [client 20.91.250.199:2311] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.admin.php"] [unique_id "aecpDEiqDinI4_22zzhVsAAAANQ"]
[Tue Apr 21 15:36:44.967463 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:49419] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpDIJW6fdXWO6agMEbGAAAAAw"]
[Tue Apr 21 15:36:45.075915 2026] [:error] [pid 54080:tid 54084] [client 20.91.250.199:2074] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpDYzEbQHHxtmWbaZSegAAAsI"]
[Tue Apr 21 15:36:45.837672 2026] [:error] [pid 35320:tid 35353] [client 20.91.250.199:22147] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpDYJW6fdXWO6agMEbIAAAABc"]
[Tue Apr 21 15:36:46.107210 2026] [:error] [pid 5377:tid 5394] [client 20.91.250.199:48528] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpDrBKychFlrHBdvvjbQAAAcg"]
[Tue Apr 21 15:36:46.684667 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:23222] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpDjeHLhVUuu8cVXynOwAAAFU"]
[Tue Apr 21 15:36:46.976489 2026] [:error] [pid 35321:tid 35391] [client 20.91.250.199:23218] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpDjeHLhVUuu8cVXynPwAAAEc"]
[Tue Apr 21 15:36:47.311840 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:48530] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpDzeHLhVUuu8cVXynRAAAAFY"]
[Tue Apr 21 15:36:47.644590 2026] [:error] [pid 54080:tid 54086] [client 20.91.250.199:22176] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sw.php"] [unique_id "aecpD4zEbQHHxtmWbaZSjwAAAsQ"]
[Tue Apr 21 15:36:47.901951 2026] [:error] [pid 5377:tid 5400] [client 20.91.250.199:22150] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpD7BKychFlrHBdvvjdwAAAc4"]
[Tue Apr 21 15:36:48.278450 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:2699] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpEDeHLhVUuu8cVXynVAAAAEM"]
[Tue Apr 21 15:36:48.559041 2026] [:error] [pid 5377:tid 5394] [client 20.91.250.199:42067] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpELBKychFlrHBdvvjfQAAAcg"]
[Tue Apr 21 15:36:48.962549 2026] [:error] [pid 35321:tid 35386] [client 20.91.250.199:48518] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpEDeHLhVUuu8cVXynYQAAAEI"]
[Tue Apr 21 15:36:49.947678 2026] [:error] [pid 4823:tid 4868] [client 20.91.250.199:49422] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpEfc8mke3PfHqsxG4tAAAAY8"]
[Tue Apr 21 15:36:50.259651 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:22171] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpEvc8mke3PfHqsxG4uAAAAYs"]
[Tue Apr 21 15:36:50.905805 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:42053] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/vuln.php"] [unique_id "aecpEvc8mke3PfHqsxG4wAAAAZA"]
[Tue Apr 21 15:36:51.227859 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:2341] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpE_c8mke3PfHqsxG4xQAAAZU"]
[Tue Apr 21 15:36:51.962442 2026] [:error] [pid 4823:tid 4856] [client 20.91.250.199:25244] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpE_c8mke3PfHqsxG4zwAAAYM"]
[Tue Apr 21 15:36:52.022335 2026] [:error] [pid 4777:tid 4807] [client 20.91.250.199:32710] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpFKxXur6bykKyLZSGbwAAARM"]
[Tue Apr 21 15:36:52.642537 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:23208] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpFDeHLhVUuu8cVXynugAAAEs"]
[Tue Apr 21 15:36:52.756880 2026] [:error] [pid 54080:tid 54101] [client 20.91.250.199:22190] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpFIzEbQHHxtmWbaZSqwAAAtM"]
[Tue Apr 21 15:36:53.556118 2026] [:error] [pid 4823:tid 4859] [client 20.91.250.199:42054] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpFfc8mke3PfHqsxG47wAAAYY"]
[Tue Apr 21 15:36:53.700876 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:2063] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpFTeHLhVUuu8cVXyn2gAAAEw"]
[Tue Apr 21 15:36:54.298017 2026] [:error] [pid 35322:tid 35358] [client 20.91.250.199:52335] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-temp.php"] [unique_id "aecpFqPoAfV40BTfVKzB7QAAAIE"]
[Tue Apr 21 15:36:54.431042 2026] [:error] [pid 5377:tid 5397] [client 20.91.250.199:20873] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpFrBKychFlrHBdvvjugAAAcs"]
[Tue Apr 21 15:36:55.385750 2026] [:error] [pid 35321:tid 35391] [client 20.91.250.199:52311] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpFzeHLhVUuu8cVXyoDAAAAEc"]
[Tue Apr 21 15:36:55.404378 2026] [:error] [pid 53832:tid 53850] [client 20.91.250.199:20904] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpF9zkuxsE_OhM9UIUbgAAAk8"]
[Tue Apr 21 15:36:56.107727 2026] [:error] [pid 35415:tid 35440] [client 20.91.250.199:50131] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpGEiqDinI4_22zzhV4gAAAM0"]
[Tue Apr 21 15:36:56.175563 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:61397] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpGDeHLhVUuu8cVXyoKAAAAEw"]
[Tue Apr 21 15:36:56.943348 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:2054] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpGDeHLhVUuu8cVXyoQwAAAEs"]
[Tue Apr 21 15:36:57.629059 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:2347] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpGdzkuxsE_OhM9UIUnAAAAlI"]
[Tue Apr 21 15:36:57.766320 2026] [:error] [pid 35322:tid 35376] [client 20.91.250.199:50169] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpGaPoAfV40BTfVKzB9gAAAJM"]
[Tue Apr 21 15:36:58.642901 2026] [:error] [pid 53731:tid 53747] [client 20.91.250.199:2308] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpGl2I9THUR-bRVGzaMwAAAgw"]
[Tue Apr 21 15:36:58.645934 2026] [:error] [pid 35322:tid 35377] [client 20.91.250.199:24131] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aecpGqPoAfV40BTfVKzB-gAAAJQ"]
[Tue Apr 21 15:36:59.318569 2026] [:error] [pid 35415:tid 35427] [client 20.91.250.199:32746] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpG0iqDinI4_22zzhV9gAAAMA"]
[Tue Apr 21 15:36:59.702311 2026] [:error] [pid 35322:tid 35375] [client 20.91.250.199:2714] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpG6PoAfV40BTfVKzCBgAAAJI"]
[Tue Apr 21 15:37:00.149742 2026] [:error] [pid 4823:tid 4866] [client 20.91.250.199:25943] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpHPc8mke3PfHqsxG5SQAAAY0"]
[Tue Apr 21 15:37:00.553521 2026] [:error] [pid 54080:tid 54094] [client 20.91.250.199:24097] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpHIzEbQHHxtmWbaZS6wAAAsw"]
[Tue Apr 21 15:37:01.461631 2026] [:error] [pid 35320:tid 35339] [client 20.91.250.199:52327] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpHYJW6fdXWO6agMEbgwAAAAk"]
[Tue Apr 21 15:37:01.980924 2026] [:error] [pid 54080:tid 54087] [client 20.91.250.199:39822] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpHYzEbQHHxtmWbaZS9wAAAsU"]
[Tue Apr 21 15:37:02.395583 2026] [:error] [pid 35322:tid 35379] [client 20.91.250.199:46104] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aecpHqPoAfV40BTfVKzCHgAAAJY"]
[Tue Apr 21 15:37:02.614772 2026] [:error] [pid 53832:tid 53838] [client 20.91.250.199:40995] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpHtzkuxsE_OhM9UIU-wAAAkM"]
[Tue Apr 21 15:37:03.256155 2026] [:error] [pid 4777:tid 4806] [client 20.91.250.199:45344] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpH6xXur6bykKyLZSGngAAARI"]
[Tue Apr 21 15:37:03.374251 2026] [:error] [pid 4777:tid 4812] [client 20.91.250.199:52337] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpH6xXur6bykKyLZSGoAAAARg"]
[Tue Apr 21 15:37:03.928615 2026] [:error] [pid 5377:tid 5405] [client 20.91.250.199:32762] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-bda.php"] [unique_id "aecpH7BKychFlrHBdvvkHwAAAdM"]
[Tue Apr 21 15:37:04.308469 2026] [:error] [pid 35321:tid 35407] [client 20.91.250.199:39823] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpIDeHLhVUuu8cVXyo-AAAAFc"]
[Tue Apr 21 15:37:04.646510 2026] [:error] [pid 35321:tid 35407] [client 20.91.250.199:25928] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-bda.php"] [unique_id "aecpIDeHLhVUuu8cVXyo_gAAAFc"]
[Tue Apr 21 15:37:05.338063 2026] [:error] [pid 53832:tid 53845] [client 20.91.250.199:45324] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpIdzkuxsE_OhM9UIVFwAAAko"]
[Tue Apr 21 15:37:05.444038 2026] [:error] [pid 4777:tid 4792] [client 20.91.250.199:20872] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-bda.php"] [unique_id "aecpIaxXur6bykKyLZSGqwAAAQQ"]
[Tue Apr 21 15:37:06.354689 2026] [:error] [pid 53731:tid 53750] [client 20.91.250.199:52321] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aecpIl2I9THUR-bRVGzaXwAAAg8"]
[Tue Apr 21 15:37:06.454652 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:24072] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-bda.php"] [unique_id "aecpIjeHLhVUuu8cVXypMAAAAFE"]
[Tue Apr 21 15:37:07.212019 2026] [:error] [pid 53832:tid 53843] [client 20.91.250.199:46086] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bhm.php"] [unique_id "aecpI9zkuxsE_OhM9UIVLAAAAkg"]
[Tue Apr 21 15:37:07.489718 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:45373] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-bda.php"] [unique_id "aecpIzeHLhVUuu8cVXypUQAAAFE"]
[Tue Apr 21 15:37:08.188751 2026] [:error] [pid 53731:tid 53738] [client 20.91.250.199:49043] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bhm.php"] [unique_id "aecpJF2I9THUR-bRVGzaZgAAAgM"]
[Tue Apr 21 15:37:08.820838 2026] [:error] [pid 4777:tid 4798] [client 20.91.250.199:46108] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-bda.php"] [unique_id "aecpJKxXur6bykKyLZSGxgAAAQo"]
[Tue Apr 21 15:37:08.993214 2026] [:error] [pid 4777:tid 4793] [client 20.91.250.199:29177] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bhm.php"] [unique_id "aecpJKxXur6bykKyLZSGyQAAAQU"]
[Tue Apr 21 15:37:10.428165 2026] [:error] [pid 54080:tid 54090] [client 20.91.250.199:25940] File does not exist: /usr/local/apache/htdocs/suspended-page/class-bda.php
[Tue Apr 21 15:37:10.708362 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:25940] File does not exist: /usr/local/apache/htdocs/suspended-page/bhm.php
[Tue Apr 21 15:37:10.979911 2026] [:error] [pid 54080:tid 54091] [client 20.91.250.199:25940] File does not exist: /usr/local/apache/htdocs/suspended-page/xmu.php
[Tue Apr 21 15:37:11.258688 2026] [:error] [pid 54080:tid 54098] [client 20.91.250.199:25940] File does not exist: /usr/local/apache/htdocs/suspended-page/ref.php
[Tue Apr 21 15:37:11.649227 2026] [:error] [pid 4777:tid 4791] [client 20.91.250.199:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/bhm.php
[Tue Apr 21 15:37:11.694034 2026] [:error] [pid 54080:tid 54090] [client 20.91.250.199:25940] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xme.php
[Tue Apr 21 15:37:11.918733 2026] [:error] [pid 4777:tid 4812] [client 20.91.250.199:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/xmu.php
[Tue Apr 21 15:37:12.043426 2026] [:error] [pid 54080:tid 54104] [client 20.91.250.199:25940] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Tue Apr 21 15:37:12.198452 2026] [:error] [pid 4777:tid 4792] [client 20.91.250.199:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/ref.php
[Tue Apr 21 15:37:12.329790 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:25940] File does not exist: /usr/local/apache/htdocs/suspended-page/ktfow.php
[Tue Apr 21 15:37:12.487254 2026] [:error] [pid 4777:tid 4804] [client 20.91.250.199:61393] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xme.php
[Tue Apr 21 15:37:12.754173 2026] [:error] [pid 4777:tid 4794] [client 20.91.250.199:61393] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer.php"] [unique_id "aecpKKxXur6bykKyLZSG5AAAAQY"]
[Tue Apr 21 15:37:12.942991 2026] [:error] [pid 54080:tid 54091] [client 20.91.250.199:25940] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpKIzEbQHHxtmWbaZTSAAAAsk"]
[Tue Apr 21 15:37:13.333878 2026] [:error] [pid 4777:tid 4793] [client 20.91.250.199:42100] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer.php"] [unique_id "aecpKaxXur6bykKyLZSG6QAAAQU"]
[Tue Apr 21 15:37:14.035376 2026] [:error] [pid 4823:tid 4873] [client 20.91.250.199:42105] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpKvc8mke3PfHqsxG5wQAAAZQ"]
[Tue Apr 21 15:37:14.369106 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:20866] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer.php"] [unique_id "aecpKjeHLhVUuu8cVXyp8gAAAFg"]
[Tue Apr 21 15:37:15.285487 2026] [:error] [pid 5377:tid 5408] [client 20.91.250.199:45340] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminer.php"] [unique_id "aecpK7BKychFlrHBdvvkYwAAAdY"]
[Tue Apr 21 15:37:15.317953 2026] [:error] [pid 5377:tid 5404] [client 20.91.250.199:24107] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpK7BKychFlrHBdvvkZAAAAdI"]
[Tue Apr 21 15:37:16.128703 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:20876] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpLDeHLhVUuu8cVXyqGAAAAFE"]
[Tue Apr 21 15:37:16.233848 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:29176] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ktfow.php"] [unique_id "aecpLDeHLhVUuu8cVXyqGQAAAEQ"]
[Tue Apr 21 15:37:17.233139 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:29152] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpLTeHLhVUuu8cVXyqNAAAAEQ"]
[Tue Apr 21 15:37:17.475663 2026] [:error] [pid 5377:tid 5410] [client 20.91.250.199:2902] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ktfow.php"] [unique_id "aecpLbBKychFlrHBdvvkfwAAAdg"]
[Tue Apr 21 15:37:18.344833 2026] [:error] [pid 4777:tid 4801] [client 20.91.250.199:39852] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpLqxXur6bykKyLZSHBAAAAQ0"]
[Tue Apr 21 15:37:18.351307 2026] [:error] [pid 4777:tid 4806] [client 20.91.250.199:25929] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ktfow.php"] [unique_id "aecpLqxXur6bykKyLZSHBQAAARI"]
[Tue Apr 21 15:37:19.326549 2026] [:error] [pid 35321:tid 35392] [client 20.91.250.199:39870] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpLzeHLhVUuu8cVXyqZQAAAEg"]
[Tue Apr 21 15:37:19.811072 2026] [:error] [pid 35322:tid 35369] [client 20.91.250.199:25970] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ktfow.php"] [unique_id "aecpL6PoAfV40BTfVKzCawAAAIw"]
[Tue Apr 21 15:37:20.442720 2026] [:error] [pid 35320:tid 35354] [client 20.91.250.199:27738] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpMIJW6fdXWO6agMEcHAAAABg"]
[Tue Apr 21 15:37:20.853894 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:39854] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpMDeHLhVUuu8cVXyqjwAAAFQ"]
[Tue Apr 21 15:37:21.301892 2026] [:error] [pid 35321:tid 35394] [client 20.91.250.199:24082] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpMTeHLhVUuu8cVXyqmwAAAEo"]
[Tue Apr 21 15:37:21.733563 2026] [:error] [pid 53978:tid 53987] [client 20.91.250.199:25957] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpMZ1ivsR4hcOSQbaw-wAAAoc"]
[Tue Apr 21 15:37:21.997250 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:42063] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpMdzkuxsE_OhM9UIWBwAAAkE"]
[Tue Apr 21 15:37:22.515039 2026] [:error] [pid 35415:tid 35450] [client 20.91.250.199:42106] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpMkiqDinI4_22zzhWowAAANc"]
[Tue Apr 21 15:37:23.279473 2026] [:error] [pid 53978:tid 53980] [client 20.91.250.199:39817] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aecpM51ivsR4hcOSQbaxCgAAAoA"]
[Tue Apr 21 15:37:23.785764 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:29175] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpM4JW6fdXWO6agMEcNgAAAAw"]
[Tue Apr 21 15:37:24.778325 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:41010] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpNDeHLhVUuu8cVXyq6QAAAEM"]
[Tue Apr 21 15:37:24.893426 2026] [:error] [pid 35322:tid 35374] [client 20.91.250.199:42108] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpNKPoAfV40BTfVKzCgwAAAJE"]
[Tue Apr 21 15:37:25.449386 2026] [:error] [pid 4777:tid 4794] [client 20.91.250.199:41383] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpNaxXur6bykKyLZSHPQAAAQY"]
[Tue Apr 21 15:37:26.474509 2026] [:error] [pid 4777:tid 4811] [client 20.91.250.199:41023] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpNqxXur6bykKyLZSHUAAAARc"]
[Tue Apr 21 15:37:26.873645 2026] [:error] [pid 53832:tid 53845] [client 20.91.250.199:50175] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpNtzkuxsE_OhM9UIWSAAAAko"]
[Tue Apr 21 15:37:27.336178 2026] [:error] [pid 53832:tid 53847] [client 20.91.250.199:46126] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/Xx.php"] [unique_id "aecpN9zkuxsE_OhM9UIWUgAAAkw"]
[Tue Apr 21 15:37:28.288293 2026] [:error] [pid 53832:tid 53846] [client 20.91.250.199:46099] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpONzkuxsE_OhM9UIWZgAAAks"]
[Tue Apr 21 15:37:28.455846 2026] [:error] [pid 53832:tid 53841] [client 20.91.250.199:29149] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpONzkuxsE_OhM9UIWagAAAkY"]
[Tue Apr 21 15:37:29.132654 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:2904] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpOTeHLhVUuu8cVXyrdwAAAFE"]
[Tue Apr 21 15:37:29.273046 2026] [:error] [pid 53832:tid 53840] [client 20.91.250.199:45721] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpOdzkuxsE_OhM9UIWfAAAAkU"]
[Tue Apr 21 15:37:30.362392 2026] [:error] [pid 53832:tid 53846] [client 20.91.250.199:45717] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpOtzkuxsE_OhM9UIWkAAAAks"]
[Tue Apr 21 15:37:30.367130 2026] [:error] [pid 4823:tid 4877] [client 20.91.250.199:2936] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpOvc8mke3PfHqsxG6KQAAAZg"]
[Tue Apr 21 15:37:31.086802 2026] [:error] [pid 35322:tid 35381] [client 20.91.250.199:55090] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xmini.php"] [unique_id "aecpO6PoAfV40BTfVKzClwAAAJg"]
[Tue Apr 21 15:37:31.321942 2026] [:error] [pid 35322:tid 35372] [client 20.91.250.199:2922] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpO6PoAfV40BTfVKzCmQAAAI8"]
[Tue Apr 21 15:37:32.293733 2026] [:error] [pid 35322:tid 35357] [client 20.91.250.199:24108] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpPKPoAfV40BTfVKzCoQAAAIA"]
[Tue Apr 21 15:37:32.537151 2026] [:error] [pid 35322:tid 35378] [client 20.91.250.199:25977] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpPKPoAfV40BTfVKzCpQAAAJU"]
[Tue Apr 21 15:37:33.068296 2026] [:error] [pid 35322:tid 35380] [client 20.91.250.199:40997] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpPaPoAfV40BTfVKzCqgAAAJc"]
[Tue Apr 21 15:37:33.512363 2026] [:error] [pid 35321:tid 35402] [client 20.91.250.199:39829] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpPTeHLhVUuu8cVXysAgAAAFI"]
[Tue Apr 21 15:37:34.111817 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:2920] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpPjeHLhVUuu8cVXysHAAAAFA"]
[Tue Apr 21 15:37:34.306712 2026] [:error] [pid 35320:tid 35347] [client 20.91.250.199:46098] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpPoJW6fdXWO6agMEccgAAABE"]
[Tue Apr 21 15:37:35.589319 2026] [:error] [pid 53978:tid 53996] [client 20.91.250.199:55076] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpP51ivsR4hcOSQbaxcwAAApA"]
[Tue Apr 21 15:37:35.620453 2026] [:error] [pid 53731:tid 53754] [client 20.91.250.199:41407] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2468.php"] [unique_id "aecpP12I9THUR-bRVGzbVAAAAhI"]
[Tue Apr 21 15:37:36.410104 2026] [:error] [pid 53978:tid 54002] [client 20.91.250.199:49035] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpQJ1ivsR4hcOSQbaxewAAApY"]
[Tue Apr 21 15:37:37.242699 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:61412] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpQTeHLhVUuu8cVXysbAAAAE8"]
[Tue Apr 21 15:37:37.391538 2026] [:error] [pid 5377:tid 5407] [client 20.91.250.199:40983] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpQbBKychFlrHBdvvlOgAAAdU"]
[Tue Apr 21 15:37:38.018322 2026] [:error] [pid 53978:tid 53990] [client 20.91.250.199:41378] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpQp1ivsR4hcOSQbaxjwAAAoo"]
[Tue Apr 21 15:37:38.483530 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:36980] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpQjeHLhVUuu8cVXysmAAAAEw"]
[Tue Apr 21 15:37:39.056921 2026] [:error] [pid 53978:tid 53984] [client 20.91.250.199:45716] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aecpQ51ivsR4hcOSQbaxmgAAAoQ"]
[Tue Apr 21 15:37:39.582851 2026] [:error] [pid 54080:tid 54084] [client 20.91.250.199:2888] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpQ4zEbQHHxtmWbaZULQAAAsI"]
[Tue Apr 21 15:37:39.873557 2026] [:error] [pid 53832:tid 53837] [client 20.91.250.199:29150] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpQ9zkuxsE_OhM9UIXSAAAAkI"]
[Tue Apr 21 15:37:40.656888 2026] [:error] [pid 54080:tid 54089] [client 20.91.250.199:55068] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpRIzEbQHHxtmWbaZUMwAAAsc"]
[Tue Apr 21 15:37:40.730175 2026] [:error] [pid 53731:tid 53753] [client 20.91.250.199:36930] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpRF2I9THUR-bRVGzbagAAAhE"]
[Tue Apr 21 15:37:41.294432 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:41748] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpRYzEbQHHxtmWbaZUQAAAAs8"]
[Tue Apr 21 15:37:41.669318 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:61427] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpRTeHLhVUuu8cVXys7gAAAE4"]
[Tue Apr 21 15:37:42.877302 2026] [:error] [pid 4823:tid 4873] [client 20.91.250.199:27760] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpRvc8mke3PfHqsxG6YgAAAZQ"]
[Tue Apr 21 15:37:42.914011 2026] [:error] [pid 4823:tid 4867] [client 20.91.250.199:33871] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpRvc8mke3PfHqsxG6YwAAAY4"]
[Tue Apr 21 15:37:43.985777 2026] [:error] [pid 4823:tid 4863] [client 20.91.250.199:33139] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpR_c8mke3PfHqsxG6cAAAAYo"]
[Tue Apr 21 15:37:44.794938 2026] [:error] [pid 5377:tid 5402] [client 20.91.250.199:33893] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpSLBKychFlrHBdvvliAAAAdA"]
[Tue Apr 21 15:37:45.133975 2026] [:error] [pid 53731:tid 53759] [client 20.91.250.199:45724] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpSV2I9THUR-bRVGzbeQAAAhc"]
[Tue Apr 21 15:37:45.915755 2026] [:error] [pid 53832:tid 53845] [client 20.91.250.199:49031] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpSdzkuxsE_OhM9UIXrwAAAko"]
[Tue Apr 21 15:37:46.289508 2026] [:error] [pid 53731:tid 53750] [client 20.91.250.199:61429] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpSl2I9THUR-bRVGzbgQAAAg8"]
[Tue Apr 21 15:37:47.224146 2026] [:error] [pid 54080:tid 54083] [client 20.91.250.199:33056] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpS4zEbQHHxtmWbaZUeAAAAsE"]
[Tue Apr 21 15:37:47.225429 2026] [:error] [pid 54080:tid 54083] [client 20.91.250.199:61435] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amdin.php"] [unique_id "aecpS4zEbQHHxtmWbaZUeQAAAsE"]
[Tue Apr 21 15:37:48.109812 2026] [:error] [pid 5377:tid 5398] [client 20.91.250.199:33096] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpTLBKychFlrHBdvvlmAAAAcw"]
[Tue Apr 21 15:37:48.168755 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:41777] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpTPc8mke3PfHqsxG6qAAAAYs"]
[Tue Apr 21 15:37:48.960447 2026] [:error] [pid 53731:tid 53752] [client 20.91.250.199:27691] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpTF2I9THUR-bRVGzblgAAAhA"]
[Tue Apr 21 15:37:49.342475 2026] [:error] [pid 53978:tid 53986] [client 20.91.250.199:33043] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpTZ1ivsR4hcOSQbax6wAAAoY"]
[Tue Apr 21 15:37:49.784351 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:33110] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpTYzEbQHHxtmWbaZUiAAAAs8"]
[Tue Apr 21 15:37:50.394094 2026] [:error] [pid 54080:tid 54088] [client 20.91.250.199:33905] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/huya.php"] [unique_id "aecpTozEbQHHxtmWbaZUjAAAAsY"]
[Tue Apr 21 15:37:51.064253 2026] [:error] [pid 54080:tid 54098] [client 20.91.250.199:20418] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpT4zEbQHHxtmWbaZUkAAAAtA"]
[Tue Apr 21 15:37:51.759161 2026] [:error] [pid 35320:tid 35332] [client 20.91.250.199:20387] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpT4JW6fdXWO6agMEc5gAAAAI"]
[Tue Apr 21 15:37:52.306508 2026] [:error] [pid 53731:tid 53750] [client 20.91.250.199:55085] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpUF2I9THUR-bRVGzbpQAAAg8"]
[Tue Apr 21 15:37:53.037335 2026] [:error] [pid 53978:tid 53988] [client 20.91.250.199:32377] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpUZ1ivsR4hcOSQbax_gAAAog"]
[Tue Apr 21 15:37:53.094635 2026] [:error] [pid 53978:tid 53997] [client 20.91.250.199:45702] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpUZ1ivsR4hcOSQbax_wAAApE"]
[Tue Apr 21 15:37:54.370940 2026] [:error] [pid 5377:tid 5394] [client 20.91.250.199:20439] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpUrBKychFlrHBdvvl8wAAAcg"]
[Tue Apr 21 15:37:55.173686 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:33087] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpUzeHLhVUuu8cVXyt_gAAAEQ"]
[Tue Apr 21 15:37:55.420853 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:20434] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/puc.php"] [unique_id "aecpU4zEbQHHxtmWbaZUrwAAAs8"]
[Tue Apr 21 15:37:56.237367 2026] [:error] [pid 35320:tid 35351] [client 20.91.250.199:44532] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpVIJW6fdXWO6agMEdDwAAABU"]
[Tue Apr 21 15:37:57.243334 2026] [:error] [pid 35322:tid 35358] [client 20.91.250.199:29553] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpVaPoAfV40BTfVKzDfAAAAIE"]
[Tue Apr 21 15:37:57.331755 2026] [:error] [pid 35321:tid 35402] [client 20.91.250.199:61466] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpVTeHLhVUuu8cVXyuIwAAAFI"]
[Tue Apr 21 15:37:58.415884 2026] [:error] [pid 35320:tid 35346] [client 20.91.250.199:33080] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpVoJW6fdXWO6agMEdJgAAABA"]
[Tue Apr 21 15:37:58.580676 2026] [:error] [pid 35320:tid 35339] [client 20.91.250.199:33026] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpVoJW6fdXWO6agMEdKQAAAAk"]
[Tue Apr 21 15:37:59.211744 2026] [:error] [pid 4823:tid 4867] [client 20.91.250.199:2864] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpV_c8mke3PfHqsxG7MwAAAY4"]
[Tue Apr 21 15:37:59.520311 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:37960] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpV4JW6fdXWO6agMEdMwAAAAw"]
[Tue Apr 21 15:38:00.031592 2026] [:error] [pid 35321:tid 35385] [client 20.91.250.199:41784] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpWDeHLhVUuu8cVXyuSwAAAEE"]
[Tue Apr 21 15:38:00.697605 2026] [:error] [pid 4777:tid 4801] [client 20.91.250.199:2853] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpWKxXur6bykKyLZSIPwAAAQ0"]
[Tue Apr 21 15:38:00.900753 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:39414] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/themes.php"] [unique_id "aecpWPc8mke3PfHqsxG7RwAAAYs"]
[Tue Apr 21 15:38:01.469867 2026] [:error] [pid 4823:tid 4860] [client 20.91.250.199:33108] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpWfc8mke3PfHqsxG7UgAAAYc"]
[Tue Apr 21 15:38:01.542091 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:2412] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpWTeHLhVUuu8cVXyuXAAAAE4"]
[Tue Apr 21 15:38:02.187865 2026] [:error] [pid 4823:tid 4868] [client 20.91.250.199:39402] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpWvc8mke3PfHqsxG7XwAAAY8"]
[Tue Apr 21 15:38:02.194350 2026] [:error] [pid 35322:tid 35371] [client 20.91.250.199:52992] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpWqPoAfV40BTfVKzDtQAAAI4"]
[Tue Apr 21 15:38:02.858366 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:55813] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpWjeHLhVUuu8cVXyubwAAAE4"]
[Tue Apr 21 15:38:03.223836 2026] [:error] [pid 4823:tid 4857] [client 20.91.250.199:27689] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpW_c8mke3PfHqsxG7cAAAAYQ"]
[Tue Apr 21 15:38:03.821440 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:26387] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpW_c8mke3PfHqsxG7fAAAAZY"]
[Tue Apr 21 15:38:04.296605 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:29556] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ewp.php"] [unique_id "aecpXDeHLhVUuu8cVXyuigAAAEQ"]
[Tue Apr 21 15:38:04.953351 2026] [:error] [pid 35320:tid 35343] [client 20.91.250.199:24082] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpXIJW6fdXWO6agMEdWwAAAA0"]
[Tue Apr 21 15:38:05.082775 2026] [:error] [pid 4823:tid 4872] [client 20.91.250.199:2391] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpXfc8mke3PfHqsxG7lQAAAZM"]
[Tue Apr 21 15:38:05.774464 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:36075] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpXTeHLhVUuu8cVXyunQAAAE8"]
[Tue Apr 21 15:38:05.777287 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:2401] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpXTeHLhVUuu8cVXyungAAAE8"]
[Tue Apr 21 15:38:06.456573 2026] [:error] [pid 53978:tid 53984] [client 20.91.250.199:53024] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpXp1ivsR4hcOSQbaygwAAAoQ"]
[Tue Apr 21 15:38:06.761800 2026] [:error] [pid 53832:tid 53844] [client 20.91.250.199:43555] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpXtzkuxsE_OhM9UIYRwAAAkk"]
[Tue Apr 21 15:38:07.054437 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:36060] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/kikikoko.php"] [unique_id "aecpXzeHLhVUuu8cVXyuswAAAFU"]
[Tue Apr 21 15:38:07.977138 2026] [:error] [pid 5377:tid 5403] [client 20.91.250.199:23772] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpX7BKychFlrHBdvvmpgAAAdE"]
[Tue Apr 21 15:38:08.018912 2026] [:error] [pid 35415:tid 35436] [client 20.91.250.199:51350] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpYEiqDinI4_22zzhYegAAAMk"]
[Tue Apr 21 15:38:08.638618 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:53039] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpYDeHLhVUuu8cVXyuyQAAAEs"]
[Tue Apr 21 15:38:08.833488 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:49422] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpYDeHLhVUuu8cVXyuzQAAAE8"]
[Tue Apr 21 15:38:09.510409 2026] [:error] [pid 53832:tid 53859] [client 20.91.250.199:23749] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpYdzkuxsE_OhM9UIYZQAAAlg"]
[Tue Apr 21 15:38:09.575201 2026] [:error] [pid 35321:tid 35390] [client 20.91.250.199:59621] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpYTeHLhVUuu8cVXyu2wAAAEY"]
[Tue Apr 21 15:38:10.572218 2026] [:error] [pid 35322:tid 35369] [client 20.91.250.199:42434] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aecpYqPoAfV40BTfVKzEDAAAAIw"]
[Tue Apr 21 15:38:10.758681 2026] [:error] [pid 35321:tid 35385] [client 20.91.250.199:51386] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xff.php"] [unique_id "aecpYjeHLhVUuu8cVXyu8AAAAEE"]
[Tue Apr 21 15:38:11.323646 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:53050] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xff.php"] [unique_id "aecpY_c8mke3PfHqsxG8CgAAAZY"]
[Tue Apr 21 15:38:11.591810 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:42433] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xff.php"] [unique_id "aecpYzeHLhVUuu8cVXyu-wAAAFY"]
[Tue Apr 21 15:38:12.383588 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:36049] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Tue Apr 21 15:38:12.676693 2026] [:error] [pid 35321:tid 35390] [client 20.91.250.199:36066] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Tue Apr 21 15:38:12.683075 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:36049] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Tue Apr 21 15:38:12.952954 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:36049] File does not exist: /usr/local/apache/htdocs/suspended-page/awa.php
[Tue Apr 21 15:38:12.985640 2026] [:error] [pid 35321:tid 35403] [client 20.91.250.199:36066] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Tue Apr 21 15:38:13.285879 2026] [:error] [pid 35321:tid 35407] [client 20.91.250.199:36049] File does not exist: /usr/local/apache/htdocs/suspended-page/popo.php
[Tue Apr 21 15:38:13.303423 2026] [:error] [pid 35321:tid 35403] [client 20.91.250.199:36066] File does not exist: /usr/local/apache/htdocs/suspended-page/awa.php
[Tue Apr 21 15:38:13.573464 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:36049] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Tue Apr 21 15:38:13.601951 2026] [:error] [pid 35321:tid 35386] [client 20.91.250.199:36066] File does not exist: /usr/local/apache/htdocs/suspended-page/popo.php
[Tue Apr 21 15:38:13.856627 2026] [:error] [pid 35321:tid 35397] [client 20.91.250.199:36049] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Tue Apr 21 15:38:13.960326 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:36066] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Tue Apr 21 15:38:14.141954 2026] [:error] [pid 35321:tid 35403] [client 20.91.250.199:36049] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Tue Apr 21 15:38:14.244376 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:36066] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/11.php"] [unique_id "aecpZjeHLhVUuu8cVXyvLAAAAEs"]
[Tue Apr 21 15:38:14.473859 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:36049] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpZjeHLhVUuu8cVXyvMgAAAEw"]
[Tue Apr 21 15:38:15.182394 2026] [:error] [pid 35321:tid 35390] [client 20.91.250.199:31504] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/11.php"] [unique_id "aecpZzeHLhVUuu8cVXyvPgAAAEY"]
[Tue Apr 21 15:38:15.446139 2026] [:error] [pid 35415:tid 35445] [client 20.91.250.199:55369] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpZ0iqDinI4_22zzhYjAAAANI"]
[Tue Apr 21 15:38:16.231925 2026] [:error] [pid 4777:tid 4803] [client 20.91.250.199:41085] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/11.php"] [unique_id "aecpaKxXur6bykKyLZSIagAAAQ8"]
[Tue Apr 21 15:38:16.609947 2026] [:error] [pid 35415:tid 35430] [client 20.91.250.199:50713] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpaEiqDinI4_22zzhYjQAAAMM"]
[Tue Apr 21 15:38:17.524983 2026] [:error] [pid 35322:tid 35379] [client 20.91.250.199:31519] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpaaPoAfV40BTfVKzESwAAAJY"]
[Tue Apr 21 15:38:17.667095 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:22270] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/11.php"] [unique_id "aecpaTeHLhVUuu8cVXyvYAAAAE8"]
[Tue Apr 21 15:38:18.268908 2026] [:error] [pid 53731:tid 53758] [client 20.91.250.199:51362] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpal2I9THUR-bRVGzcnAAAAhY"]
[Tue Apr 21 15:38:19.387669 2026] [:error] [pid 5377:tid 5403] [client 20.91.250.199:50239] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpa7BKychFlrHBdvvnPgAAAdE"]
[Tue Apr 21 15:38:19.628805 2026] [:error] [pid 5377:tid 5409] [client 20.91.250.199:22251] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aecpa7BKychFlrHBdvvnQQAAAdc"]
[Tue Apr 21 15:38:20.311424 2026] [:error] [pid 35415:tid 35436] [client 20.91.250.199:51352] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpbEiqDinI4_22zzhYmwAAAMk"]
[Tue Apr 21 15:38:21.431115 2026] [:error] [pid 53978:tid 53994] [client 20.91.250.199:47333] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpbZ1ivsR4hcOSQbay8QAAAo4"]
[Tue Apr 21 15:38:21.980874 2026] [:error] [pid 35415:tid 35440] [client 20.91.250.199:22236] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aecpbUiqDinI4_22zzhYngAAAM0"]
[Tue Apr 21 15:38:22.111111 2026] [:error] [pid 35415:tid 35447] [client 20.91.250.199:2472] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpbkiqDinI4_22zzhYnwAAANQ"]
[Tue Apr 21 15:38:22.726308 2026] [:error] [pid 4823:tid 4877] [client 20.91.250.199:47359] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aecpbvc8mke3PfHqsxG8oAAAAZg"]
[Tue Apr 21 15:38:22.806124 2026] [:error] [pid 35321:tid 35403] [client 20.91.250.199:22850] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpbjeHLhVUuu8cVXyvzwAAAFM"]
[Tue Apr 21 15:38:23.452188 2026] [:error] [pid 53978:tid 54003] [client 20.91.250.199:38868] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpb51ivsR4hcOSQbay_gAAApc"]
[Tue Apr 21 15:38:23.705101 2026] [:error] [pid 35320:tid 35345] [client 20.91.250.199:22859] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/p.php"] [unique_id "aecpb4JW6fdXWO6agMEdsAAAAA8"]
[Tue Apr 21 15:38:24.206047 2026] [:error] [pid 53731:tid 53757] [client 20.91.250.199:22208] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpcF2I9THUR-bRVGzctAAAAhU"]
[Tue Apr 21 15:38:24.653428 2026] [:error] [pid 53978:tid 53992] [client 20.91.250.199:48174] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpcJ1ivsR4hcOSQbazDAAAAow"]
[Tue Apr 21 15:38:24.842319 2026] [:error] [pid 4777:tid 4793] [client 20.91.250.199:38898] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpcKxXur6bykKyLZSIfgAAAQU"]
[Tue Apr 21 15:38:25.436253 2026] [:error] [pid 4777:tid 4811] [client 20.91.250.199:48113] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpcaxXur6bykKyLZSIfwAAARc"]
[Tue Apr 21 15:38:25.597446 2026] [:error] [pid 53832:tid 53856] [client 20.91.250.199:31064] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpcdzkuxsE_OhM9UIZHQAAAlU"]
[Tue Apr 21 15:38:26.213339 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:22219] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpcozEbQHHxtmWbaZVJAAAAtQ"]
[Tue Apr 21 15:38:26.247859 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:55001] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpcozEbQHHxtmWbaZVJQAAAs8"]
[Tue Apr 21 15:38:26.858955 2026] [:error] [pid 54080:tid 54089] [client 20.91.250.199:48144] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aecpcozEbQHHxtmWbaZVKgAAAsc"]
[Tue Apr 21 15:38:26.985975 2026] [:error] [pid 54080:tid 54084] [client 20.91.250.199:30466] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpcozEbQHHxtmWbaZVLQAAAsI"]
[Tue Apr 21 15:38:27.646007 2026] [:error] [pid 53731:tid 53736] [client 20.91.250.199:31083] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpc12I9THUR-bRVGzcygAAAgE"]
[Tue Apr 21 15:38:27.671971 2026] [:error] [pid 53978:tid 53992] [client 20.91.250.199:20963] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpc51ivsR4hcOSQbazMAAAAow"]
[Tue Apr 21 15:38:28.407441 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:44990] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpdNzkuxsE_OhM9UIZXwAAAlQ"]
[Tue Apr 21 15:38:28.719651 2026] [:error] [pid 5377:tid 5387] [client 20.91.250.199:48116] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpdLBKychFlrHBdvvnpAAAAcE"]
[Tue Apr 21 15:38:29.587581 2026] [:error] [pid 53731:tid 53757] [client 20.91.250.199:55025] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpdV2I9THUR-bRVGzc1QAAAhU"]
[Tue Apr 21 15:38:29.680802 2026] [:error] [pid 53832:tid 53838] [client 20.91.250.199:22269] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpddzkuxsE_OhM9UIZewAAAkM"]
[Tue Apr 21 15:38:30.555361 2026] [:error] [pid 54080:tid 54082] [client 20.91.250.199:38379] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aecpdozEbQHHxtmWbaZVXAAAAsA"]
[Tue Apr 21 15:38:30.743973 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:48079] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpdjeHLhVUuu8cVXywZwAAAEQ"]
[Tue Apr 21 15:38:31.531731 2026] [:error] [pid 5377:tid 5388] [client 20.91.250.199:2679] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpd7BKychFlrHBdvvnuAAAAcI"]
[Tue Apr 21 15:38:31.950550 2026] [:error] [pid 5377:tid 5390] [client 20.91.250.199:37940] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecpd7BKychFlrHBdvvnuwAAAcQ"]
[Tue Apr 21 15:38:32.628119 2026] [:error] [pid 35320:tid 35350] [client 20.91.250.199:44964] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpeIJW6fdXWO6agMEeAQAAABQ"]
[Tue Apr 21 15:38:33.075548 2026] [:error] [pid 5377:tid 5399] [client 20.91.250.199:2150] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecpebBKychFlrHBdvvnwwAAAc0"]
[Tue Apr 21 15:38:33.464726 2026] [:error] [pid 4823:tid 4871] [client 20.91.250.199:20962] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpefc8mke3PfHqsxG9VAAAAZI"]
[Tue Apr 21 15:38:33.975561 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:24779] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecpefc8mke3PfHqsxG9WgAAAYs"]
[Tue Apr 21 15:38:34.959683 2026] [:error] [pid 53731:tid 53738] [client 20.91.250.199:48119] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aecpel2I9THUR-bRVGzc-QAAAgM"]
[Tue Apr 21 15:38:35.416760 2026] [:error] [pid 4777:tid 4796] [client 20.91.250.199:32675] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecpe6xXur6bykKyLZSIjQAAAQg"]
[Tue Apr 21 15:38:35.911355 2026] [:error] [pid 53832:tid 53847] [client 20.91.250.199:44989] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpe9zkuxsE_OhM9UIZ2AAAAkw"]
[Tue Apr 21 15:38:36.224897 2026] [:error] [pid 35321:tid 35384] [client 20.91.250.199:32083] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecpfDeHLhVUuu8cVXywsQAAAEA"]
[Tue Apr 21 15:38:36.636432 2026] [:error] [pid 35320:tid 35349] [client 20.91.250.199:37950] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpfIJW6fdXWO6agMEeMQAAABM"]
[Tue Apr 21 15:38:37.040270 2026] [:error] [pid 5377:tid 5393] [client 20.91.250.199:53106] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecpfbBKychFlrHBdvvn2gAAAcc"]
[Tue Apr 21 15:38:37.543813 2026] [:error] [pid 4777:tid 4800] [client 20.91.250.199:37907] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpfaxXur6bykKyLZSIlQAAAQw"]
[Tue Apr 21 15:38:37.960202 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:32066] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecpffc8mke3PfHqsxG9ewAAAYs"]
[Tue Apr 21 15:38:38.257431 2026] [:error] [pid 53978:tid 53995] [client 20.91.250.199:2649] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tea.php"] [unique_id "aecpfp1ivsR4hcOSQbazqgAAAo8"]
[Tue Apr 21 15:38:39.282135 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:48145] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpfzeHLhVUuu8cVXyw5gAAAFY"]
[Tue Apr 21 15:38:39.920420 2026] [:error] [pid 35415:tid 35443] [client 20.91.250.199:48076] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecpf0iqDinI4_22zzhZIAAAANA"]
[Tue Apr 21 15:38:40.486379 2026] [:error] [pid 53832:tid 53851] [client 20.91.250.199:59841] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpgNzkuxsE_OhM9UIaFwAAAlA"]
[Tue Apr 21 15:38:40.746849 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:32065] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpgIJW6fdXWO6agMEeWAAAAA4"]
[Tue Apr 21 15:38:41.249684 2026] [:error] [pid 4823:tid 4855] [client 20.91.250.199:38347] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpgfc8mke3PfHqsxG9kQAAAYI"]
[Tue Apr 21 15:38:41.540735 2026] [:error] [pid 4823:tid 4870] [client 20.91.250.199:48072] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpgfc8mke3PfHqsxG9lAAAAZE"]
[Tue Apr 21 15:38:42.065331 2026] [:error] [pid 53832:tid 53850] [client 20.91.250.199:31525] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/seo.php"] [unique_id "aecpgtzkuxsE_OhM9UIaJgAAAk8"]
[Tue Apr 21 15:38:42.245113 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:2648] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpgoJW6fdXWO6agMEeagAAAA4"]
[Tue Apr 21 15:38:42.764738 2026] [:error] [pid 54080:tid 54100] [client 20.91.250.199:44975] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecpgozEbQHHxtmWbaZV1QAAAtI"]
[Tue Apr 21 15:38:42.899591 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:44952] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpgtzkuxsE_OhM9UIaMAAAAlQ"]
[Tue Apr 21 15:38:43.435196 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:48108] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecpg9zkuxsE_OhM9UIaOQAAAkc"]
[Tue Apr 21 15:38:43.850664 2026] [:error] [pid 5377:tid 5393] [client 20.91.250.199:55037] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecpg7BKychFlrHBdvvoFQAAAcc"]
[Tue Apr 21 15:38:43.990622 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:20933] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecpg9zkuxsE_OhM9UIaQAAAAlI"]
[Tue Apr 21 15:38:44.529595 2026] [:error] [pid 5377:tid 5397] [client 20.91.250.199:24798] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecphLBKychFlrHBdvvoGgAAAcs"]
[Tue Apr 21 15:38:45.129667 2026] [:error] [pid 35320:tid 35352] [client 20.91.250.199:48189] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7.php"] [unique_id "aecphYJW6fdXWO6agMEeegAAABY"]
[Tue Apr 21 15:38:45.427390 2026] [:error] [pid 53832:tid 53858] [client 20.91.250.199:37917] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecphdzkuxsE_OhM9UIaVAAAAlc"]
[Tue Apr 21 15:38:46.086721 2026] [:error] [pid 54080:tid 54099] [client 20.91.250.199:58041] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecphozEbQHHxtmWbaZWCgAAAtE"]
[Tue Apr 21 15:38:46.133466 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:52797] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecphjeHLhVUuu8cVXyxXAAAAFE"]
[Tue Apr 21 15:38:46.868697 2026] [:error] [pid 54080:tid 54101] [client 20.91.250.199:2656] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecphozEbQHHxtmWbaZWFQAAAtM"]
[Tue Apr 21 15:38:46.874255 2026] [:error] [pid 4777:tid 4801] [client 20.91.250.199:48091] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecphqxXur6bykKyLZSIswAAAQ0"]
[Tue Apr 21 15:38:47.613385 2026] [:error] [pid 35320:tid 35332] [client 20.91.250.199:24777] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecph4JW6fdXWO6agMEeiQAAAAI"]
[Tue Apr 21 15:38:47.621940 2026] [:error] [pid 35320:tid 35352] [client 20.91.250.199:40534] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecph4JW6fdXWO6agMEeigAAABY"]
[Tue Apr 21 15:38:48.505898 2026] [:error] [pid 53731:tid 53742] [client 20.91.250.199:53085] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecpiF2I9THUR-bRVGzdVAAAAgc"]
[Tue Apr 21 15:38:48.549766 2026] [:error] [pid 53731:tid 53748] [client 20.91.250.199:24827] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aecpiF2I9THUR-bRVGzdVQAAAg0"]
[Tue Apr 21 15:38:49.147302 2026] [:error] [pid 35320:tid 35333] [client 20.91.250.199:52788] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpiYJW6fdXWO6agMEelQAAAAM"]
[Tue Apr 21 15:38:49.174132 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:48101] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecpiYzEbQHHxtmWbaZWLQAAAs8"]
[Tue Apr 21 15:38:49.864555 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:2659] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpiYzEbQHHxtmWbaZWNgAAAtQ"]
[Tue Apr 21 15:38:50.208559 2026] [:error] [pid 53978:tid 53980] [client 20.91.250.199:53108] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpip1ivsR4hcOSQba0EQAAAoA"]
[Tue Apr 21 15:38:50.686628 2026] [:error] [pid 35415:tid 35445] [client 20.91.250.199:20953] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpikiqDinI4_22zzhZVQAAANI"]
[Tue Apr 21 15:38:50.898473 2026] [:error] [pid 35320:tid 35331] [client 20.91.250.199:57997] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpioJW6fdXWO6agMEeoAAAAAE"]
[Tue Apr 21 15:38:51.496971 2026] [:error] [pid 35320:tid 35333] [client 20.91.250.199:25280] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpi4JW6fdXWO6agMEepQAAAAM"]
[Tue Apr 21 15:38:52.111102 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:37912] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aecpjDeHLhVUuu8cVXyxxAAAAFY"]
[Tue Apr 21 15:38:52.360408 2026] [:error] [pid 35320:tid 35352] [client 20.91.250.199:31532] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpjIJW6fdXWO6agMEerQAAABY"]
[Tue Apr 21 15:38:52.771872 2026] [:error] [pid 53832:tid 53839] [client 20.91.250.199:25343] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecpjNzkuxsE_OhM9UIavAAAAkQ"]
[Tue Apr 21 15:38:53.380877 2026] [:error] [pid 53832:tid 53858] [client 20.91.250.199:31048] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5.php"] [unique_id "aecpjdzkuxsE_OhM9UIawgAAAlc"]
[Tue Apr 21 15:38:53.403535 2026] [:error] [pid 53832:tid 53850] [client 20.91.250.199:25304] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecpjdzkuxsE_OhM9UIawwAAAk8"]
[Tue Apr 21 15:38:54.041275 2026] [:error] [pid 35415:tid 35438] [client 20.91.250.199:31070] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5.php"] [unique_id "aecpjkiqDinI4_22zzhZXQAAAMs"]
[Tue Apr 21 15:38:54.385539 2026] [:error] [pid 35322:tid 35364] [client 20.91.250.199:37946] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecpjqPoAfV40BTfVKzFLwAAAIc"]
[Tue Apr 21 15:38:54.890162 2026] [:error] [pid 53978:tid 54004] [client 20.91.250.199:31549] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5.php"] [unique_id "aecpjp1ivsR4hcOSQba0MAAAApg"]
[Tue Apr 21 15:38:55.044911 2026] [:error] [pid 5377:tid 5404] [client 20.91.250.199:53069] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2.php"] [unique_id "aecpj7BKychFlrHBdvvoXQAAAdI"]
[Tue Apr 21 15:38:55.911388 2026] [:error] [pid 4823:tid 4862] [client 20.91.250.199:58015] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5.php"] [unique_id "aecpj_c8mke3PfHqsxG9-QAAAYk"]
[Tue Apr 21 15:38:57.182328 2026] [:error] [pid 35322:tid 35366] [client 20.91.250.199:22900] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecpkaPoAfV40BTfVKzFPgAAAIk"]
[Tue Apr 21 15:38:57.348851 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:20970] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6.php"] [unique_id "aecpkYzEbQHHxtmWbaZWgQAAAss"]
[Tue Apr 21 15:38:58.234460 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:52739] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6.php"] [unique_id "aecpkvc8mke3PfHqsxG-EQAAAYE"]
[Tue Apr 21 15:38:59.699619 2026] [:error] [pid 53832:tid 53841] [client 20.91.250.199:31506] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecpk9zkuxsE_OhM9UIa_AAAAkY"]
[Tue Apr 21 15:39:01.327823 2026] [:error] [pid 35320:tid 35330] [client 20.91.250.199:35368] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecplYJW6fdXWO6agMEfGAAAAAA"]
[Tue Apr 21 15:39:01.727642 2026] [:error] [pid 5377:tid 5390] [client 20.91.250.199:2647] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6.php"] [unique_id "aecplbBKychFlrHBdvvoiQAAAcQ"]
[Tue Apr 21 15:39:03.418462 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:32070] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/6.php"] [unique_id "aecplzeHLhVUuu8cVXyyRAAAAFg"]
[Tue Apr 21 15:39:03.948938 2026] [:error] [pid 35322:tid 35361] [client 20.91.250.199:20985] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/3.php"] [unique_id "aecpl6PoAfV40BTfVKzFWwAAAIQ"]
[Tue Apr 21 15:39:04.735879 2026] [:error] [pid 4777:tid 4797] [client 20.91.250.199:32088] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/9.php"] [unique_id "aecpmKxXur6bykKyLZSJKwAAAQk"]
[Tue Apr 21 15:39:05.005645 2026] [:error] [pid 5377:tid 5403] [client 20.91.250.199:2272] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpmbBKychFlrHBdvvopgAAAdE"]
[Tue Apr 21 15:39:05.676526 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:28567] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/9.php"] [unique_id "aecpmTeHLhVUuu8cVXyyYgAAAEs"]
[Tue Apr 21 15:39:05.922332 2026] [:error] [pid 4823:tid 4862] [client 20.91.250.199:31490] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpmfc8mke3PfHqsxG-UgAAAYk"]
[Tue Apr 21 15:39:06.623645 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:2300] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpmjeHLhVUuu8cVXyycwAAAFY"]
[Tue Apr 21 15:39:07.803310 2026] [:error] [pid 35321:tid 35385] [client 20.91.250.199:2240] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/4.php"] [unique_id "aecpmzeHLhVUuu8cVXyyiwAAAEE"]
[Tue Apr 21 15:39:07.838597 2026] [:error] [pid 35320:tid 35336] [client 20.91.250.199:52795] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/9.php"] [unique_id "aecpm4JW6fdXWO6agMEfbwAAAAY"]
[Tue Apr 21 15:39:08.974559 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:28605] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/9.php"] [unique_id "aecpnIJW6fdXWO6agMEfdwAAAA4"]
[Tue Apr 21 15:39:09.835660 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:28577] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5.php"] [unique_id "aecpnTeHLhVUuu8cVXyytwAAAEs"]
[Tue Apr 21 15:39:10.557596 2026] [:error] [pid 35321:tid 35394] [client 20.91.250.199:53093] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/10.php"] [unique_id "aecpnjeHLhVUuu8cVXyyzgAAAEo"]
[Tue Apr 21 15:39:11.006068 2026] [:error] [pid 35320:tid 35351] [client 20.91.250.199:28573] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5.php"] [unique_id "aecpn4JW6fdXWO6agMEfhAAAABU"]
[Tue Apr 21 15:39:11.550160 2026] [:error] [pid 35415:tid 35431] [client 20.91.250.199:47410] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/10.php"] [unique_id "aecpn0iqDinI4_22zzhZ2AAAAMQ"]
[Tue Apr 21 15:39:12.700266 2026] [:error] [pid 4777:tid 4802] [client 20.91.250.199:2670] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/10.php"] [unique_id "aecpoKxXur6bykKyLZSJiwAAAQ4"]
[Tue Apr 21 15:39:13.365303 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:29087] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/5.php"] [unique_id "aecpofc8mke3PfHqsxG-igAAAYE"]
[Tue Apr 21 15:39:14.658732 2026] [:error] [pid 4823:tid 4862] [client 20.91.250.199:47368] File does not exist: /usr/local/apache/htdocs/suspended-page/10.php
[Tue Apr 21 15:39:14.969139 2026] [:error] [pid 4823:tid 4855] [client 20.91.250.199:47368] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Tue Apr 21 15:39:15.558968 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:47368] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_S.php
[Tue Apr 21 15:39:15.812999 2026] [:error] [pid 54080:tid 54104] [client 20.91.250.199:53058] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Tue Apr 21 15:39:15.854308 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:47368] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Tue Apr 21 15:39:16.155593 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:47368] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Tue Apr 21 15:39:16.453650 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:53058] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Tue Apr 21 15:39:16.527939 2026] [:error] [pid 4823:tid 4868] [client 20.91.250.199:47368] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Tue Apr 21 15:39:16.724359 2026] [:error] [pid 54080:tid 54103] [client 20.91.250.199:53058] File does not exist: /usr/local/apache/htdocs/suspended-page/9.php
[Tue Apr 21 15:39:16.843920 2026] [:error] [pid 4823:tid 4853] [client 20.91.250.199:47368] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 21 15:39:17.141297 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:47368] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecppfc8mke3PfHqsxG-uwAAAZA"]
[Tue Apr 21 15:39:17.799606 2026] [:error] [pid 54080:tid 54083] [client 20.91.250.199:53058] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/10.php"] [unique_id "aecppYzEbQHHxtmWbaZXjAAAAsE"]
[Tue Apr 21 15:39:18.515307 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:60845] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecpptzkuxsE_OhM9UIboAAAAkc"]
[Tue Apr 21 15:39:18.916758 2026] [:error] [pid 5377:tid 5396] [client 20.91.250.199:21643] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/10.php"] [unique_id "aecpprBKychFlrHBdvvpDAAAAco"]
[Tue Apr 21 15:39:19.458653 2026] [:error] [pid 53832:tid 53852] [client 20.91.250.199:24731] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecpp9zkuxsE_OhM9UIbqgAAAlE"]
[Tue Apr 21 15:39:19.763852 2026] [:error] [pid 35320:tid 35341] [client 20.91.250.199:60824] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/10.php"] [unique_id "aecpp4JW6fdXWO6agMEf4AAAAAs"]
[Tue Apr 21 15:39:20.329615 2026] [:error] [pid 4823:tid 4859] [client 20.91.250.199:2271] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/10.php"] [unique_id "aecpqPc8mke3PfHqsxG-yQAAAYY"]
[Tue Apr 21 15:39:21.457415 2026] [:error] [pid 53978:tid 54001] [client 20.91.250.199:29057] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.php"] [unique_id "aecpqZ1ivsR4hcOSQba1MQAAApU"]
[Tue Apr 21 15:39:21.558508 2026] [:error] [pid 53978:tid 54002] [client 20.91.250.199:37393] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecpqZ1ivsR4hcOSQba1MwAAApY"]
[Tue Apr 21 15:39:22.291962 2026] [:error] [pid 53731:tid 53747] [client 20.91.250.199:35376] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.php"] [unique_id "aecpql2I9THUR-bRVGzeUQAAAgw"]
[Tue Apr 21 15:39:22.899399 2026] [:error] [pid 53978:tid 53990] [client 20.91.250.199:47420] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.php"] [unique_id "aecpqp1ivsR4hcOSQba1RQAAAoo"]
[Tue Apr 21 15:39:22.948004 2026] [:error] [pid 53978:tid 53989] [client 20.91.250.199:37395] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecpqp1ivsR4hcOSQba1RgAAAok"]
[Tue Apr 21 15:39:23.638357 2026] [:error] [pid 35415:tid 35450] [client 20.91.250.199:35432] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/100.php"] [unique_id "aecpq0iqDinI4_22zzhaHgAAANc"]
[Tue Apr 21 15:39:24.167331 2026] [:error] [pid 35321:tid 35392] [client 20.91.250.199:37407] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecprDeHLhVUuu8cVXyzpgAAAEg"]
[Tue Apr 21 15:39:24.794253 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:39357] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aecprDeHLhVUuu8cVXyzqQAAAEQ"]
[Tue Apr 21 15:39:25.051788 2026] [:error] [pid 35322:tid 35361] [client 20.91.250.199:42988] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecpraPoAfV40BTfVKzGIAAAAIQ"]
[Tue Apr 21 15:39:25.549800 2026] [:error] [pid 4777:tid 4808] [client 20.91.250.199:2521] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aecpraxXur6bykKyLZSJxgAAARQ"]
[Tue Apr 21 15:39:26.312640 2026] [:error] [pid 4777:tid 4797] [client 20.91.250.199:31574] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aecprqxXur6bykKyLZSJxwAAAQk"]
[Tue Apr 21 15:39:26.323016 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:21719] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecprjeHLhVUuu8cVXyztAAAAFg"]
[Tue Apr 21 15:39:27.020924 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:60827] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "aecprzeHLhVUuu8cVXyzugAAAEs"]
[Tue Apr 21 15:39:27.976183 2026] [:error] [pid 53978:tid 53993] [client 20.91.250.199:24719] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35_S.php"] [unique_id "aecpr51ivsR4hcOSQba1fAAAAo0"]
[Tue Apr 21 15:39:28.700178 2026] [:error] [pid 35321:tid 35384] [client 20.91.250.199:35379] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35_S.php"] [unique_id "aecpsDeHLhVUuu8cVXyzzwAAAEA"]
[Tue Apr 21 15:39:29.088267 2026] [:error] [pid 53978:tid 53988] [client 20.91.250.199:29056] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecpsZ1ivsR4hcOSQba1hgAAAog"]
[Tue Apr 21 15:39:29.369763 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:29065] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35_S.php"] [unique_id "aecpsTeHLhVUuu8cVXyz2wAAAE4"]
[Tue Apr 21 15:39:30.416310 2026] [:error] [pid 53731:tid 53747] [client 20.91.250.199:60884] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35_S.php"] [unique_id "aecpsl2I9THUR-bRVGzefAAAAgw"]
[Tue Apr 21 15:39:30.893383 2026] [:error] [pid 4823:tid 4857] [client 20.91.250.199:60902] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecpsvc8mke3PfHqsxG-7AAAAYQ"]
[Tue Apr 21 15:39:31.116496 2026] [:error] [pid 54080:tid 54101] [client 20.91.250.199:60074] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2026w.php"] [unique_id "aecps4zEbQHHxtmWbaZX3wAAAtM"]
[Tue Apr 21 15:39:31.763429 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:39304] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecps4JW6fdXWO6agMEgfQAAAA4"]
[Tue Apr 21 15:39:31.813577 2026] [:error] [pid 35320:tid 35343] [client 20.91.250.199:59858] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2026w.php"] [unique_id "aecps4JW6fdXWO6agMEgfgAAAA0"]
[Tue Apr 21 15:39:32.418635 2026] [:error] [pid 4823:tid 4860] [client 20.91.250.199:60066] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2026w.php"] [unique_id "aecptPc8mke3PfHqsxG-9QAAAYc"]
[Tue Apr 21 15:39:33.118518 2026] [:error] [pid 4823:tid 4859] [client 20.91.250.199:28128] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/2026w.php"] [unique_id "aecptfc8mke3PfHqsxG--gAAAYY"]
[Tue Apr 21 15:39:33.147571 2026] [:error] [pid 4823:tid 4872] [client 20.91.250.199:39306] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecptfc8mke3PfHqsxG--wAAAZM"]
[Tue Apr 21 15:39:33.895467 2026] [:error] [pid 53731:tid 53744] [client 20.91.250.199:28141] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/111.php"] [unique_id "aecptV2I9THUR-bRVGzejQAAAgk"]
[Tue Apr 21 15:39:34.515196 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:24725] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecptvc8mke3PfHqsxG_CQAAAZY"]
[Tue Apr 21 15:39:34.538804 2026] [:error] [pid 4823:tid 4860] [client 20.91.250.199:60875] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/111.php"] [unique_id "aecptvc8mke3PfHqsxG_CgAAAYc"]
[Tue Apr 21 15:39:35.188314 2026] [:error] [pid 4823:tid 4862] [client 20.91.250.199:59875] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/111.php"] [unique_id "aecpt_c8mke3PfHqsxG_EQAAAYk"]
[Tue Apr 21 15:39:36.261049 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:31571] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/111.php"] [unique_id "aecpuPc8mke3PfHqsxG_KAAAAZA"]
[Tue Apr 21 15:39:36.280773 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:37410] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecpuPc8mke3PfHqsxG_KgAAAZU"]
[Tue Apr 21 15:39:36.949136 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:2499] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecpuPc8mke3PfHqsxG_NAAAAZU"]
[Tue Apr 21 15:39:37.568210 2026] [:error] [pid 35321:tid 35393] [client 20.91.250.199:47416] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aecpuTeHLhVUuu8cVXy0LgAAAEk"]
[Tue Apr 21 15:39:38.276006 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:35451] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aecpuozEbQHHxtmWbaZYBwAAAs8"]
[Tue Apr 21 15:39:38.860649 2026] [:error] [pid 4777:tid 4790] [client 20.91.250.199:37385] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecpuqxXur6bykKyLZSJ2QAAAQI"]
[Tue Apr 21 15:39:39.437987 2026] [:error] [pid 54080:tid 54087] [client 20.91.250.199:37402] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aecpu4zEbQHHxtmWbaZYDwAAAsU"]
[Tue Apr 21 15:39:40.614095 2026] [:error] [pid 35415:tid 35444] [client 20.91.250.199:31565] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp1.php"] [unique_id "aecpvEiqDinI4_22zzhaNAAAANE"]
[Tue Apr 21 15:39:40.648317 2026] [:error] [pid 5377:tid 5396] [client 20.91.250.199:60849] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecpvLBKychFlrHBdvvpZQAAAco"]
[Tue Apr 21 15:39:41.447459 2026] [:error] [pid 35322:tid 35378] [client 20.91.250.199:60832] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "aecpvaPoAfV40BTfVKzGqAAAAJU"]
[Tue Apr 21 15:39:42.381407 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:28122] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecpvvc8mke3PfHqsxG_ewAAAZY"]
[Tue Apr 21 15:39:42.451597 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:28115] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "aecpvvc8mke3PfHqsxG_fAAAAZA"]
[Tue Apr 21 15:39:43.410687 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:49355] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "aecpvzeHLhVUuu8cVXy0egAAAFg"]
[Tue Apr 21 15:39:43.896386 2026] [:error] [pid 4777:tid 4792] [client 20.91.250.199:59902] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecpv6xXur6bykKyLZSJ4gAAAQQ"]
[Tue Apr 21 15:39:44.588177 2026] [:error] [pid 35321:tid 35385] [client 20.91.250.199:60083] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecpwDeHLhVUuu8cVXy0hwAAAEE"]
[Tue Apr 21 15:39:44.655344 2026] [:error] [pid 54080:tid 54087] [client 20.91.250.199:48487] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aligk.php"] [unique_id "aecpwIzEbQHHxtmWbaZYNAAAAsU"]
[Tue Apr 21 15:39:45.318254 2026] [:error] [pid 5377:tid 5405] [client 20.91.250.199:45294] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecpwbBKychFlrHBdvvpdAAAAdM"]
[Tue Apr 21 15:39:46.050728 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:60087] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecpwtzkuxsE_OhM9UIcqAAAAkE"]
[Tue Apr 21 15:39:46.255804 2026] [:error] [pid 4823:tid 4861] [client 20.91.250.199:49348] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecpwvc8mke3PfHqsxG_pgAAAYg"]
[Tue Apr 21 15:39:47.232262 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:48456] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecpwzeHLhVUuu8cVXy0pQAAAEQ"]
[Tue Apr 21 15:39:47.301866 2026] [:error] [pid 35320:tid 35350] [client 20.91.250.199:60041] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecpw4JW6fdXWO6agMEg3QAAABQ"]
[Tue Apr 21 15:39:48.319270 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:61008] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecpxIzEbQHHxtmWbaZYWAAAAs8"]
[Tue Apr 21 15:39:48.930075 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:43492] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecpxNzkuxsE_OhM9UIcvwAAAk0"]
[Tue Apr 21 15:39:49.276434 2026] [:error] [pid 53731:tid 53739] [client 20.91.250.199:35368] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aecpxV2I9THUR-bRVGze6gAAAgQ"]
[Tue Apr 21 15:39:50.157268 2026] [:error] [pid 53978:tid 53990] [client 20.91.250.199:28137] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aecpxp1ivsR4hcOSQba19wAAAoo"]
[Tue Apr 21 15:39:50.615166 2026] [:error] [pid 4777:tid 4803] [client 20.91.250.199:28036] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/byrgo.php"] [unique_id "aecpxqxXur6bykKyLZSJ7gAAAQ8"]
[Tue Apr 21 15:39:51.137383 2026] [:error] [pid 54080:tid 54087] [client 20.91.250.199:43508] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aecpx4zEbQHHxtmWbaZYagAAAsU"]
[Tue Apr 21 15:39:52.184663 2026] [:error] [pid 35322:tid 35379] [client 20.91.250.199:28088] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecpyKPoAfV40BTfVKzG5gAAAJY"]
[Tue Apr 21 15:39:52.269984 2026] [:error] [pid 35415:tid 35444] [client 20.91.250.199:36618] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aecpyEiqDinI4_22zzhagwAAANE"]
[Tue Apr 21 15:39:53.309662 2026] [:error] [pid 53978:tid 53993] [client 20.91.250.199:37960] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aecpyZ1ivsR4hcOSQba1_gAAAo0"]
[Tue Apr 21 15:39:53.419763 2026] [:error] [pid 53978:tid 54001] [client 20.91.250.199:44168] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecpyZ1ivsR4hcOSQba2AAAAApU"]
[Tue Apr 21 15:39:54.083982 2026] [:error] [pid 53832:tid 53843] [client 20.91.250.199:28083] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aecpytzkuxsE_OhM9UIc3QAAAkg"]
[Tue Apr 21 15:39:54.717009 2026] [:error] [pid 53978:tid 53980] [client 20.91.250.199:44203] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecpyp1ivsR4hcOSQba2CAAAAoA"]
[Tue Apr 21 15:39:54.777311 2026] [:error] [pid 5377:tid 5391] [client 20.91.250.199:28040] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aecpyrBKychFlrHBdvvpmwAAAcU"]
[Tue Apr 21 15:39:55.875136 2026] [:error] [pid 4823:tid 4865] [client 20.91.250.199:61318] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aecpy_c8mke3PfHqsxG_9AAAAYw"]
[Tue Apr 21 15:39:56.147832 2026] [:error] [pid 54080:tid 54103] [client 20.91.250.199:30547] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwpg.php"] [unique_id "aecpzIzEbQHHxtmWbaZYigAAAtU"]
[Tue Apr 21 15:39:56.907011 2026] [:error] [pid 54080:tid 54105] [client 20.91.250.199:30546] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aecpzIzEbQHHxtmWbaZYkQAAAtc"]
[Tue Apr 21 15:39:57.344352 2026] [:error] [pid 35320:tid 35331] [client 20.91.250.199:61011] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecpzYJW6fdXWO6agMEhAgAAAAE"]
[Tue Apr 21 15:39:57.711837 2026] [:error] [pid 35320:tid 35333] [client 20.91.250.199:40461] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aecpzYJW6fdXWO6agMEhBwAAAAM"]
[Tue Apr 21 15:39:58.238421 2026] [:error] [pid 4823:tid 4861] [client 20.91.250.199:34882] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecpzvc8mke3PfHqsxHADwAAAYg"]
[Tue Apr 21 15:39:58.429461 2026] [:error] [pid 4823:tid 4867] [client 20.91.250.199:26469] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aecpzvc8mke3PfHqsxHAEgAAAY4"]
[Tue Apr 21 15:39:59.184191 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:60884] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecpz_c8mke3PfHqsxHAGwAAAZY"]
[Tue Apr 21 15:39:59.368006 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:52372] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin.php"] [unique_id "aecpzzeHLhVUuu8cVXy1NwAAAFY"]
[Tue Apr 21 15:39:59.984655 2026] [:error] [pid 54080:tid 54094] [client 20.91.250.199:56661] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ass.php"] [unique_id "aecpz4zEbQHHxtmWbaZYoAAAAsw"]
[Tue Apr 21 15:40:00.206187 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:45655] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inege.php"] [unique_id "aecp0Pc8mke3PfHqsxHAKQAAAZU"]
[Tue Apr 21 15:40:00.901514 2026] [:error] [pid 53731:tid 53750] [client 20.91.250.199:33462] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecp0F2I9THUR-bRVGzfMQAAAg8"]
[Tue Apr 21 15:40:01.360128 2026] [:error] [pid 53731:tid 53756] [client 20.91.250.199:44160] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inege.php"] [unique_id "aecp0V2I9THUR-bRVGzfMwAAAhQ"]
[Tue Apr 21 15:40:02.011346 2026] [:error] [pid 53731:tid 53755] [client 20.91.250.199:61070] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inege.php"] [unique_id "aecp0l2I9THUR-bRVGzfNgAAAhM"]
[Tue Apr 21 15:40:02.060813 2026] [:error] [pid 53832:tid 53852] [client 20.91.250.199:52394] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecp0tzkuxsE_OhM9UIc-AAAAlE"]
[Tue Apr 21 15:40:03.045884 2026] [:error] [pid 53978:tid 53980] [client 20.91.250.199:51651] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inege.php"] [unique_id "aecp051ivsR4hcOSQba2JQAAAoA"]
[Tue Apr 21 15:40:03.819193 2026] [:error] [pid 53978:tid 53998] [client 20.91.250.199:38329] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecp051ivsR4hcOSQba2KAAAApI"]
[Tue Apr 21 15:40:04.197787 2026] [:error] [pid 4823:tid 4871] [client 20.91.250.199:52366] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecp1Pc8mke3PfHqsxHAawAAAZI"]
[Tue Apr 21 15:40:04.451118 2026] [:error] [pid 4823:tid 4859] [client 20.91.250.199:50743] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecp1Pc8mke3PfHqsxHAcAAAAYY"]
[Tue Apr 21 15:40:04.815724 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:19369] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/about.php"] [unique_id "aecp1NzkuxsE_OhM9UIdAwAAAlQ"]
[Tue Apr 21 15:40:05.252659 2026] [:error] [pid 53832:tid 53835] [client 20.91.250.199:55760] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecp1dzkuxsE_OhM9UIdBwAAAkA"]
[Tue Apr 21 15:40:05.550918 2026] [:error] [pid 53832:tid 53858] [client 20.91.250.199:51691] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecp1dzkuxsE_OhM9UIdCAAAAlc"]
[Tue Apr 21 15:40:06.099771 2026] [:error] [pid 53832:tid 53846] [client 20.91.250.199:45671] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecp1tzkuxsE_OhM9UIdDwAAAks"]
[Tue Apr 21 15:40:06.287002 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:60129] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecp1tzkuxsE_OhM9UIdEAAAAlI"]
[Tue Apr 21 15:40:06.947816 2026] [:error] [pid 53832:tid 53841] [client 20.91.250.199:33437] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aecp1tzkuxsE_OhM9UIdFgAAAkY"]
[Tue Apr 21 15:40:07.025104 2026] [:error] [pid 4777:tid 4809] [client 20.91.250.199:53416] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecp16xXur6bykKyLZSKBgAAARU"]
[Tue Apr 21 15:40:07.770362 2026] [:error] [pid 4777:tid 4799] [client 20.91.250.199:55774] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aecp16xXur6bykKyLZSKCwAAAQs"]
[Tue Apr 21 15:40:08.163610 2026] [:error] [pid 4777:tid 4798] [client 20.91.250.199:46068] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no18.php"] [unique_id "aecp2KxXur6bykKyLZSKDAAAAQo"]
[Tue Apr 21 15:40:09.041055 2026] [:error] [pid 35321:tid 35386] [client 20.91.250.199:37458] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aecp2TeHLhVUuu8cVXy1igAAAEI"]
[Tue Apr 21 15:40:09.551899 2026] [:error] [pid 5377:tid 5388] [client 20.91.250.199:61098] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecp2bBKychFlrHBdvvpzgAAAcI"]
[Tue Apr 21 15:40:10.715740 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:46060] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecp2jeHLhVUuu8cVXy1kAAAAEw"]
[Tue Apr 21 15:40:10.902606 2026] [:error] [pid 4777:tid 4805] [client 20.91.250.199:61066] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uuu.php"] [unique_id "aecp2qxXur6bykKyLZSKDwAAARE"]
[Tue Apr 21 15:40:11.406572 2026] [:error] [pid 54080:tid 54099] [client 20.91.250.199:34864] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecp24zEbQHHxtmWbaZY4QAAAtE"]
[Tue Apr 21 15:40:11.917149 2026] [:error] [pid 54080:tid 54085] [client 20.91.250.199:34822] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp24zEbQHHxtmWbaZY5AAAAsM"]
[Tue Apr 21 15:40:12.791411 2026] [:error] [pid 53978:tid 53989] [client 20.91.250.199:46077] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp3J1ivsR4hcOSQba2PwAAAok"]
[Tue Apr 21 15:40:12.899875 2026] [:error] [pid 5377:tid 5408] [client 20.91.250.199:42506] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fine.php"] [unique_id "aecp3LBKychFlrHBdvvp3QAAAdY"]
[Tue Apr 21 15:40:13.759670 2026] [:error] [pid 35320:tid 35353] [client 20.91.250.199:37488] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp3YJW6fdXWO6agMEhKQAAABc"]
[Tue Apr 21 15:40:14.092835 2026] [:error] [pid 4823:tid 4863] [client 20.91.250.199:31031] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aecp3vc8mke3PfHqsxHA4AAAAYo"]
[Tue Apr 21 15:40:14.543921 2026] [:error] [pid 53832:tid 53858] [client 20.91.250.199:2201] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp3tzkuxsE_OhM9UIdXwAAAlc"]
[Tue Apr 21 15:40:15.258246 2026] [:error] [pid 53731:tid 53741] [client 20.91.250.199:56582] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w2025.php"] [unique_id "aecp312I9THUR-bRVGzfSwAAAgY"]
[Tue Apr 21 15:40:15.635334 2026] [:error] [pid 53978:tid 53983] [client 20.91.250.199:61092] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aecp351ivsR4hcOSQba2RwAAAoM"]
[Tue Apr 21 15:40:15.944761 2026] [:error] [pid 35320:tid 35331] [client 20.91.250.199:22236] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w2025.php"] [unique_id "aecp34JW6fdXWO6agMEhOAAAAAE"]
[Tue Apr 21 15:40:16.566292 2026] [:error] [pid 53731:tid 53736] [client 20.91.250.199:3004] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 15:40:16.865522 2026] [:error] [pid 53731:tid 53738] [client 20.91.250.199:3004] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Tue Apr 21 15:40:17.053162 2026] [:error] [pid 35320:tid 35336] [client 20.91.250.199:36914] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Tue Apr 21 15:40:17.178622 2026] [:error] [pid 53731:tid 53756] [client 20.91.250.199:3004] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 21 15:40:17.348050 2026] [:error] [pid 35320:tid 35350] [client 20.91.250.199:36914] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Tue Apr 21 15:40:17.675145 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:36914] File does not exist: /usr/local/apache/htdocs/suspended-page/a2.php
[Tue Apr 21 15:40:17.824459 2026] [:error] [pid 53731:tid 53757] [client 20.91.250.199:3004] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Tue Apr 21 15:40:17.970559 2026] [:error] [pid 35320:tid 35331] [client 20.91.250.199:36914] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 21 15:40:18.114918 2026] [:error] [pid 53731:tid 53760] [client 20.91.250.199:3004] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Tue Apr 21 15:40:18.405962 2026] [:error] [pid 53731:tid 53752] [client 20.91.250.199:3004] File does not exist: /usr/local/apache/htdocs/suspended-page/uuu.php
[Tue Apr 21 15:40:18.432325 2026] [:error] [pid 35320:tid 35353] [client 20.91.250.199:36914] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Apr 21 15:40:18.696279 2026] [:error] [pid 53731:tid 53753] [client 20.91.250.199:3004] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp4l2I9THUR-bRVGzfWgAAAhE"]
[Tue Apr 21 15:40:18.722463 2026] [:error] [pid 35320:tid 35339] [client 20.91.250.199:36914] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp4oJW6fdXWO6agMEhTgAAAAk"]
[Tue Apr 21 15:40:20.064404 2026] [:error] [pid 35415:tid 35429] [client 20.91.250.199:31003] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp5EiqDinI4_22zzhaoAAAAMI"]
[Tue Apr 21 15:40:20.195724 2026] [:error] [pid 4777:tid 4792] [client 20.91.250.199:44149] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp5KxXur6bykKyLZSKJgAAAQQ"]
[Tue Apr 21 15:40:21.673256 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:49018] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp5TeHLhVUuu8cVXy1vgAAAFg"]
[Tue Apr 21 15:40:22.276485 2026] [:error] [pid 54080:tid 54094] [client 20.91.250.199:27233] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp5ozEbQHHxtmWbaZZHQAAAsw"]
[Tue Apr 21 15:40:22.933010 2026] [:error] [pid 5377:tid 5400] [client 20.91.250.199:61011] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp5rBKychFlrHBdvvp_QAAAc4"]
[Tue Apr 21 15:40:23.190387 2026] [:error] [pid 53978:tid 54004] [client 20.91.250.199:33505] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/no1.php"] [unique_id "aecp551ivsR4hcOSQba2aAAAApg"]
[Tue Apr 21 15:40:24.133027 2026] [:error] [pid 54080:tid 54098] [client 20.91.250.199:36915] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecp6IzEbQHHxtmWbaZZKgAAAtA"]
[Tue Apr 21 15:40:24.592549 2026] [:error] [pid 54080:tid 54092] [client 20.91.250.199:42556] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w2025.php"] [unique_id "aecp6IzEbQHHxtmWbaZZLwAAAso"]
[Tue Apr 21 15:40:24.937689 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:25873] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecp6IzEbQHHxtmWbaZZMwAAAss"]
[Tue Apr 21 15:40:25.850540 2026] [:error] [pid 53731:tid 53756] [client 20.91.250.199:34838] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w2025.php"] [unique_id "aecp6V2I9THUR-bRVGzfYQAAAhQ"]
[Tue Apr 21 15:40:26.523491 2026] [:error] [pid 53832:tid 53840] [client 20.91.250.199:33507] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w2025.php"] [unique_id "aecp6tzkuxsE_OhM9UId0QAAAkU"]
[Tue Apr 21 15:40:26.710382 2026] [:error] [pid 35322:tid 35367] [client 20.91.250.199:2182] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecp6qPoAfV40BTfVKzHFgAAAIo"]
[Tue Apr 21 15:40:27.229575 2026] [:error] [pid 5377:tid 5397] [client 20.91.250.199:48964] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/w2025.php"] [unique_id "aecp67BKychFlrHBdvvqAwAAAcs"]
[Tue Apr 21 15:40:27.813480 2026] [:error] [pid 35320:tid 35336] [client 20.91.250.199:37489] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecp64JW6fdXWO6agMEhdQAAAAY"]
[Tue Apr 21 15:40:28.145920 2026] [:error] [pid 4777:tid 4796] [client 20.91.250.199:33522] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fvvff.php"] [unique_id "aecp7KxXur6bykKyLZSKPgAAAQg"]
[Tue Apr 21 15:40:28.896629 2026] [:error] [pid 53978:tid 53992] [client 20.91.250.199:42545] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecp7J1ivsR4hcOSQba2fwAAAow"]
[Tue Apr 21 15:40:29.739152 2026] [:error] [pid 53978:tid 53987] [client 20.91.250.199:30979] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecp7Z1ivsR4hcOSQba2hgAAAoc"]
[Tue Apr 21 15:40:29.810739 2026] [:error] [pid 53731:tid 53741] [client 20.91.250.199:27260] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fvvff.php"] [unique_id "aecp7V2I9THUR-bRVGzfawAAAgY"]
[Tue Apr 21 15:40:30.689272 2026] [:error] [pid 53978:tid 53990] [client 20.91.250.199:37455] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecp7p1ivsR4hcOSQba2jgAAAoo"]
[Tue Apr 21 15:40:31.100364 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:2188] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fvvff.php"] [unique_id "aecp79zkuxsE_OhM9UId-wAAAkE"]
[Tue Apr 21 15:40:31.522332 2026] [:error] [pid 53832:tid 53850] [client 20.91.250.199:2784] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecp79zkuxsE_OhM9UIeAAAAAk8"]
[Tue Apr 21 15:40:32.077393 2026] [:error] [pid 53978:tid 53981] [client 20.91.250.199:33534] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fvvff.php"] [unique_id "aecp8J1ivsR4hcOSQba2mAAAAoE"]
[Tue Apr 21 15:40:32.616427 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:34831] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecp8Pc8mke3PfHqsxHBRQAAAZU"]
[Tue Apr 21 15:40:32.817506 2026] [:error] [pid 4823:tid 4866] [client 20.91.250.199:2954] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aecp8Pc8mke3PfHqsxHBSQAAAY0"]
[Tue Apr 21 15:40:33.817973 2026] [:error] [pid 53978:tid 53988] [client 20.91.250.199:2178] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aecp8Z1ivsR4hcOSQba2pAAAAog"]
[Tue Apr 21 15:40:34.169348 2026] [:error] [pid 53731:tid 53742] [client 20.91.250.199:32017] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecp8l2I9THUR-bRVGzfcQAAAgc"]
[Tue Apr 21 15:40:34.826377 2026] [:error] [pid 35415:tid 35440] [client 20.91.250.199:3000] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aecp8kiqDinI4_22zzhargAAAM0"]
[Tue Apr 21 15:40:35.129757 2026] [:error] [pid 5377:tid 5409] [client 20.91.250.199:34859] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecp87BKychFlrHBdvvqDgAAAdc"]
[Tue Apr 21 15:40:35.571687 2026] [:error] [pid 54080:tid 54083] [client 20.91.250.199:2755] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a2.php"] [unique_id "aecp84zEbQHHxtmWbaZZaAAAAsE"]
[Tue Apr 21 15:40:36.117628 2026] [:error] [pid 53731:tid 53759] [client 20.91.250.199:2591] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecp9F2I9THUR-bRVGzfdgAAAhc"]
[Tue Apr 21 15:40:36.310535 2026] [:error] [pid 35321:tid 35391] [client 20.91.250.199:57084] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aecp9DeHLhVUuu8cVXy2LQAAAEc"]
[Tue Apr 21 15:40:37.120831 2026] [:error] [pid 35321:tid 35386] [client 20.91.250.199:19902] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aecp9TeHLhVUuu8cVXy2MwAAAEI"]
[Tue Apr 21 15:40:37.650259 2026] [:error] [pid 5377:tid 5390] [client 20.91.250.199:33526] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecp9bBKychFlrHBdvvqEgAAAcQ"]
[Tue Apr 21 15:40:38.236031 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:2563] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aecp9oJW6fdXWO6agMEh5gAAAAw"]
[Tue Apr 21 15:40:38.443154 2026] [:error] [pid 35320:tid 35354] [client 20.91.250.199:49015] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecp9oJW6fdXWO6agMEh7AAAABg"]
[Tue Apr 21 15:40:39.044716 2026] [:error] [pid 35320:tid 35352] [client 20.91.250.199:50786] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aecp94JW6fdXWO6agMEh-AAAABY"]
[Tue Apr 21 15:40:39.262119 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:33511] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecp94JW6fdXWO6agMEh_AAAAA4"]
[Tue Apr 21 15:40:39.800432 2026] [:error] [pid 53731:tid 53744] [client 20.91.250.199:2614] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aecp912I9THUR-bRVGzfiQAAAgk"]
[Tue Apr 21 15:40:40.127657 2026] [:error] [pid 35321:tid 35403] [client 20.91.250.199:48986] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecp-DeHLhVUuu8cVXy2SwAAAFM"]
[Tue Apr 21 15:40:40.450972 2026] [:error] [pid 53731:tid 53757] [client 20.91.250.199:52601] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aecp-F2I9THUR-bRVGzfiwAAAhU"]
[Tue Apr 21 15:40:40.937900 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:51940] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecp-DeHLhVUuu8cVXy2VAAAAFQ"]
[Tue Apr 21 15:40:41.205192 2026] [:error] [pid 35321:tid 35393] [client 20.91.250.199:50838] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aecp-TeHLhVUuu8cVXy2WQAAAEk"]
[Tue Apr 21 15:40:41.661736 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:2597] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecp-TeHLhVUuu8cVXy2YAAAAEM"]
[Tue Apr 21 15:40:41.967829 2026] [:error] [pid 53731:tid 53750] [client 20.91.250.199:25888] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aecp-V2I9THUR-bRVGzfkgAAAg8"]
[Tue Apr 21 15:40:42.568424 2026] [:error] [pid 53731:tid 53742] [client 20.91.250.199:2567] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecp-l2I9THUR-bRVGzflAAAAgc"]
[Tue Apr 21 15:40:42.968557 2026] [:error] [pid 4777:tid 4796] [client 20.91.250.199:32033] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp-qxXur6bykKyLZSKSgAAAQg"]
[Tue Apr 21 15:40:43.328493 2026] [:error] [pid 5377:tid 5386] [client 20.91.250.199:51919] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecp-7BKychFlrHBdvvqGwAAAcA"]
[Tue Apr 21 15:40:43.693691 2026] [:error] [pid 35320:tid 35331] [client 20.91.250.199:61133] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp-4JW6fdXWO6agMEiMgAAAAE"]
[Tue Apr 21 15:40:44.104554 2026] [:error] [pid 35320:tid 35334] [client 20.91.250.199:52549] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecp_IJW6fdXWO6agMEiOgAAAAQ"]
[Tue Apr 21 15:40:44.671467 2026] [:error] [pid 35322:tid 35381] [client 20.91.250.199:49772] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp_KPoAfV40BTfVKzHIgAAAJg"]
[Tue Apr 21 15:40:45.148995 2026] [:error] [pid 35320:tid 35331] [client 20.91.250.199:2572] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecp_YJW6fdXWO6agMEiRwAAAAE"]
[Tue Apr 21 15:40:45.772566 2026] [:error] [pid 53731:tid 53749] [client 20.91.250.199:39913] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecp_V2I9THUR-bRVGzfnAAAAg4"]
[Tue Apr 21 15:40:47.301727 2026] [:error] [pid 35320:tid 35336] [client 20.91.250.199:51303] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecp_4JW6fdXWO6agMEiZgAAAAY"]
[Tue Apr 21 15:40:47.465967 2026] [:error] [pid 53731:tid 53740] [client 20.91.250.199:61155] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecp_12I9THUR-bRVGzfogAAAgU"]
[Tue Apr 21 15:40:48.295284 2026] [:error] [pid 53731:tid 53739] [client 20.91.250.199:61338] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecqAF2I9THUR-bRVGzfpAAAAgQ"]
[Tue Apr 21 15:40:48.728845 2026] [:error] [pid 4777:tid 4798] [client 20.91.250.199:41329] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecqAKxXur6bykKyLZSKTwAAAQo"]
[Tue Apr 21 15:40:49.007735 2026] [:error] [pid 35320:tid 35352] [client 20.91.250.199:23702] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqAYJW6fdXWO6agMEihAAAABY"]
[Tue Apr 21 15:40:49.708423 2026] [:error] [pid 53731:tid 53753] [client 20.91.250.199:36720] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecqAV2I9THUR-bRVGzfpwAAAhE"]
[Tue Apr 21 15:40:50.012847 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:52588] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqAoJW6fdXWO6agMEilgAAAA4"]
[Tue Apr 21 15:40:50.869872 2026] [:error] [pid 53731:tid 53736] [client 20.91.250.199:61129] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqAl2I9THUR-bRVGzfsQAAAgE"]
[Tue Apr 21 15:40:51.136285 2026] [:error] [pid 35320:tid 35337] [client 20.91.250.199:23683] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aecqA4JW6fdXWO6agMEirQAAAAc"]
[Tue Apr 21 15:40:51.707745 2026] [:error] [pid 35320:tid 35332] [client 20.91.250.199:61135] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqA4JW6fdXWO6agMEivQAAAAI"]
[Tue Apr 21 15:40:52.062685 2026] [:error] [pid 35320:tid 35332] [client 20.91.250.199:36686] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecqBIJW6fdXWO6agMEixgAAAAI"]
[Tue Apr 21 15:40:52.803205 2026] [:error] [pid 53731:tid 53752] [client 20.91.250.199:50781] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecqBF2I9THUR-bRVGzfvQAAAhA"]
[Tue Apr 21 15:40:52.845343 2026] [:error] [pid 53731:tid 53750] [client 20.91.250.199:60335] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqBF2I9THUR-bRVGzfvgAAAg8"]
[Tue Apr 21 15:40:54.004359 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:50860] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecqBjeHLhVUuu8cVXy2mQAAAEs"]
[Tue Apr 21 15:40:54.203525 2026] [:error] [pid 4777:tid 4794] [client 20.91.250.199:52605] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqBqxXur6bykKyLZSKUwAAAQY"]
[Tue Apr 21 15:40:55.083707 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:47715] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a5.php"] [unique_id "aecqBzeHLhVUuu8cVXy2nAAAAEw"]
[Tue Apr 21 15:40:55.443793 2026] [:error] [pid 4777:tid 4795] [client 20.91.250.199:36715] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqB6xXur6bykKyLZSKVAAAAQc"]
[Tue Apr 21 15:40:55.916307 2026] [:error] [pid 53731:tid 53742] [client 20.91.250.199:61124] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecqB12I9THUR-bRVGzfzAAAAgc"]
[Tue Apr 21 15:40:56.098651 2026] [:error] [pid 35321:tid 35384] [client 20.91.250.199:52604] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqCDeHLhVUuu8cVXy2owAAAEA"]
[Tue Apr 21 15:40:56.585489 2026] [:error] [pid 53832:tid 53847] [client 20.91.250.199:52011] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecqCNzkuxsE_OhM9UIeqwAAAkw"]
[Tue Apr 21 15:40:56.907983 2026] [:error] [pid 53832:tid 53838] [client 20.91.250.199:44552] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aecqCNzkuxsE_OhM9UIergAAAkM"]
[Tue Apr 21 15:40:57.237796 2026] [:error] [pid 35321:tid 35389] [client 20.91.250.199:47681] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecqCTeHLhVUuu8cVXy2rgAAAEU"]
[Tue Apr 21 15:40:57.853165 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:39890] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aecqCTeHLhVUuu8cVXy2swAAAFA"]
[Tue Apr 21 15:40:58.019422 2026] [:error] [pid 53978:tid 53989] [client 20.91.250.199:61179] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ol.php"] [unique_id "aecqCp1ivsR4hcOSQba3AAAAAok"]
[Tue Apr 21 15:40:58.658451 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:23682] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aecqCvc8mke3PfHqsxHBbwAAAZA"]
[Tue Apr 21 15:40:58.945532 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:53106] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecqCjeHLhVUuu8cVXy2uQAAAFQ"]
[Tue Apr 21 15:40:59.780117 2026] [:error] [pid 4823:tid 4872] [client 20.91.250.199:39876] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecqC_c8mke3PfHqsxHBdAAAAZM"]
[Tue Apr 21 15:41:00.928295 2026] [:error] [pid 53832:tid 53843] [client 20.91.250.199:51989] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecqDNzkuxsE_OhM9UIewwAAAkg"]
[Tue Apr 21 15:41:00.983303 2026] [:error] [pid 53832:tid 53859] [client 20.91.250.199:47708] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-act.php"] [unique_id "aecqDNzkuxsE_OhM9UIexAAAAlg"]
[Tue Apr 21 15:41:02.041889 2026] [:error] [pid 4823:tid 4861] [client 20.91.250.199:49468] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aaa.php"] [unique_id "aecqDvc8mke3PfHqsxHBfgAAAYg"]
[Tue Apr 21 15:41:02.301583 2026] [:error] [pid 35321:tid 35385] [client 20.91.250.199:47719] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f6.php"] [unique_id "aecqDjeHLhVUuu8cVXy23QAAAEE"]
[Tue Apr 21 15:41:02.867865 2026] [:error] [pid 4823:tid 4876] [client 20.91.250.199:29468] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aaa.php"] [unique_id "aecqDvc8mke3PfHqsxHBhQAAAZc"]
[Tue Apr 21 15:41:03.552614 2026] [:error] [pid 35320:tid 35346] [client 20.91.250.199:47682] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecqD4JW6fdXWO6agMEjWgAAABA"]
[Tue Apr 21 15:41:03.872698 2026] [:error] [pid 53978:tid 54001] [client 20.91.250.199:61351] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aaa.php"] [unique_id "aecqD51ivsR4hcOSQba3FAAAApU"]
[Tue Apr 21 15:41:04.842596 2026] [:error] [pid 35320:tid 35335] [client 20.91.250.199:19913] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecqEIJW6fdXWO6agMEjXgAAAAU"]
[Tue Apr 21 15:41:05.126688 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:61343] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aaa.php"] [unique_id "aecqETeHLhVUuu8cVXy29wAAAE4"]
[Tue Apr 21 15:41:06.353788 2026] [:error] [pid 53832:tid 53841] [client 20.91.250.199:42545] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqEtzkuxsE_OhM9UIe3QAAAkY"]
[Tue Apr 21 15:41:07.161567 2026] [:error] [pid 35321:tid 35393] [client 20.91.250.199:49732] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecqEzeHLhVUuu8cVXy3DQAAAEk"]
[Tue Apr 21 15:41:07.738745 2026] [:error] [pid 35320:tid 35349] [client 20.91.250.199:48524] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqE4JW6fdXWO6agMEjaAAAABM"]
[Tue Apr 21 15:41:07.884192 2026] [:error] [pid 53978:tid 53984] [client 20.91.250.199:61393] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aecqE51ivsR4hcOSQba3KAAAAoQ"]
[Tue Apr 21 15:41:08.646026 2026] [:error] [pid 54080:tid 54098] [client 20.91.250.199:2365] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecqFIzEbQHHxtmWbaZZowAAAtA"]
[Tue Apr 21 15:41:09.085511 2026] [:error] [pid 54080:tid 54104] [client 20.91.250.199:49417] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqFYzEbQHHxtmWbaZZpgAAAtY"]
[Tue Apr 21 15:41:09.898088 2026] [:error] [pid 54080:tid 54086] [client 20.91.250.199:22174] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecqFYzEbQHHxtmWbaZZqQAAAsQ"]
[Tue Apr 21 15:41:10.035133 2026] [:error] [pid 35320:tid 35331] [client 20.91.250.199:29499] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqFoJW6fdXWO6agMEjdgAAAAE"]
[Tue Apr 21 15:41:10.761261 2026] [:error] [pid 54080:tid 54099] [client 20.91.250.199:51981] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecqFozEbQHHxtmWbaZZrwAAAtE"]
[Tue Apr 21 15:41:11.041664 2026] [:error] [pid 53978:tid 53989] [client 20.91.250.199:44558] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqF51ivsR4hcOSQba3NQAAAok"]
[Tue Apr 21 15:41:11.515811 2026] [:error] [pid 35320:tid 35352] [client 20.91.250.199:25251] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/style.php"] [unique_id "aecqF4JW6fdXWO6agMEjewAAABY"]
[Tue Apr 21 15:41:12.185616 2026] [:error] [pid 4823:tid 4873] [client 20.91.250.199:30068] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqGPc8mke3PfHqsxHBvgAAAZQ"]
[Tue Apr 21 15:41:12.228756 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:51991] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqGNzkuxsE_OhM9UIe9wAAAk0"]
[Tue Apr 21 15:41:12.825498 2026] [:error] [pid 4823:tid 4876] [client 20.91.250.199:24159] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqGPc8mke3PfHqsxHBwwAAAZc"]
[Tue Apr 21 15:41:12.874519 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:2077] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqGNzkuxsE_OhM9UIe_wAAAlI"]
[Tue Apr 21 15:41:13.655044 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:29500] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqGdzkuxsE_OhM9UIfCAAAAkE"]
[Tue Apr 21 15:41:13.667030 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:22203] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqGdzkuxsE_OhM9UIfCQAAAkc"]
[Tue Apr 21 15:41:14.401391 2026] [:error] [pid 4823:tid 4859] [client 20.91.250.199:44566] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqGvc8mke3PfHqsxHByQAAAYY"]
[Tue Apr 21 15:41:14.705851 2026] [:error] [pid 4823:tid 4858] [client 20.91.250.199:25224] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqGvc8mke3PfHqsxHBywAAAYU"]
[Tue Apr 21 15:41:15.285813 2026] [:error] [pid 4823:tid 4853] [client 20.91.250.199:44989] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqG_c8mke3PfHqsxHBzwAAAYA"]
[Tue Apr 21 15:41:15.512546 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:2090] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqG9zkuxsE_OhM9UIfFwAAAkc"]
[Tue Apr 21 15:41:15.987785 2026] [:error] [pid 53832:tid 53843] [client 20.91.250.199:24171] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqG9zkuxsE_OhM9UIfGgAAAkg"]
[Tue Apr 21 15:41:16.287727 2026] [:error] [pid 4823:tid 4861] [client 20.91.250.199:22200] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqHPc8mke3PfHqsxHB1AAAAYg"]
[Tue Apr 21 15:41:17.038689 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:32743] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqHdzkuxsE_OhM9UIfJAAAAlQ"]
[Tue Apr 21 15:41:17.331218 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:24174] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqHTeHLhVUuu8cVXy3UwAAAFU"]
[Tue Apr 21 15:41:17.947285 2026] [:error] [pid 53832:tid 53839] [client 20.91.250.199:25303] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "aecqHdzkuxsE_OhM9UIfKQAAAkQ"]
[Tue Apr 21 15:41:18.197204 2026] [:error] [pid 54080:tid 54092] [client 20.91.250.199:2348] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 21 15:41:19.017442 2026] [:error] [pid 54080:tid 54090] [client 20.91.250.199:2348] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 21 15:41:19.560508 2026] [:error] [pid 54080:tid 54104] [client 20.91.250.199:2348] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 21 15:41:19.829762 2026] [:error] [pid 54080:tid 54085] [client 20.91.250.199:2348] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 21 15:41:20.096120 2026] [:error] [pid 54080:tid 54106] [client 20.91.250.199:2348] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue Apr 21 15:41:20.362651 2026] [:error] [pid 54080:tid 54094] [client 20.91.250.199:2348] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue Apr 21 15:41:20.518952 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:25258] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Tue Apr 21 15:41:20.787992 2026] [:error] [pid 35321:tid 35397] [client 20.91.250.199:25258] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Tue Apr 21 15:41:20.890765 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:2348] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqIIzEbQHHxtmWbaZZ0AAAAss"]
[Tue Apr 21 15:41:21.053291 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:25258] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqITeHLhVUuu8cVXy3eAAAAEw"]
[Tue Apr 21 15:41:21.783670 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:29460] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqITeHLhVUuu8cVXy3fwAAAEM"]
[Tue Apr 21 15:41:22.637813 2026] [:error] [pid 54080:tid 54084] [client 20.91.250.199:29489] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqIozEbQHHxtmWbaZZ1wAAAsI"]
[Tue Apr 21 15:41:22.981724 2026] [:error] [pid 53832:tid 53849] [client 20.91.250.199:32706] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqItzkuxsE_OhM9UIfSQAAAk4"]
[Tue Apr 21 15:41:24.127117 2026] [:error] [pid 53832:tid 53839] [client 20.91.250.199:24133] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqJNzkuxsE_OhM9UIfUAAAAkQ"]
[Tue Apr 21 15:41:25.027379 2026] [:error] [pid 4823:tid 4876] [client 20.91.250.199:57007] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqJfc8mke3PfHqsxHB9QAAAZc"]
[Tue Apr 21 15:41:25.734660 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:23753] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqJdzkuxsE_OhM9UIfXAAAAkc"]
[Tue Apr 21 15:41:26.179358 2026] [:error] [pid 53832:tid 53838] [client 20.91.250.199:23212] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqJtzkuxsE_OhM9UIfYAAAAkM"]
[Tue Apr 21 15:41:27.772311 2026] [:error] [pid 54080:tid 54106] [client 20.91.250.199:23786] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqJ4zEbQHHxtmWbaZZ8AAAAtg"]
[Tue Apr 21 15:41:27.787884 2026] [:error] [pid 4823:tid 4856] [client 20.91.250.199:2693] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aecqJ_c8mke3PfHqsxHCBQAAAYM"]
[Tue Apr 21 15:41:28.638040 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:22167] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqKDeHLhVUuu8cVXy3rAAAAFA"]
[Tue Apr 21 15:41:29.072636 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:2705] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqKYzEbQHHxtmWbaZZ-gAAAs8"]
[Tue Apr 21 15:41:29.534958 2026] [:error] [pid 35321:tid 35384] [client 20.91.250.199:49426] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqKTeHLhVUuu8cVXy3rwAAAEA"]
[Tue Apr 21 15:41:30.038121 2026] [:error] [pid 35321:tid 35403] [client 20.91.250.199:23177] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqKjeHLhVUuu8cVXy3swAAAFM"]
[Tue Apr 21 15:41:30.539284 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:56964] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqKjeHLhVUuu8cVXy3tgAAAFE"]
[Tue Apr 21 15:41:31.268245 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:2338] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "aecqK_c8mke3PfHqsxHCEwAAAYs"]
[Tue Apr 21 15:41:31.549156 2026] [:error] [pid 54080:tid 54086] [client 20.91.250.199:48522] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqK4zEbQHHxtmWbaZaBQAAAsQ"]
[Tue Apr 21 15:41:32.264798 2026] [:error] [pid 4823:tid 4862] [client 20.91.250.199:2689] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqLPc8mke3PfHqsxHCFgAAAYk"]
[Tue Apr 21 15:41:32.310768 2026] [:error] [pid 4823:tid 4871] [client 20.91.250.199:2714] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqLPc8mke3PfHqsxHCFwAAAZI"]
[Tue Apr 21 15:41:33.057286 2026] [:error] [pid 4823:tid 4861] [client 20.91.250.199:24163] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqLfc8mke3PfHqsxHCGAAAAYg"]
[Tue Apr 21 15:41:33.090378 2026] [:error] [pid 53731:tid 53747] [client 20.91.250.199:42062] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqLV2I9THUR-bRVGzf_wAAAgw"]
[Tue Apr 21 15:41:33.979296 2026] [:error] [pid 53731:tid 53757] [client 20.91.250.199:29494] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqLV2I9THUR-bRVGzgAQAAAhU"]
[Tue Apr 21 15:41:34.044717 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:24136] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqLtzkuxsE_OhM9UIflwAAAkc"]
[Tue Apr 21 15:41:34.520084 2026] [:error] [pid 35320:tid 35330] [client 54.196.192.156:35412] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aecqLoJW6fdXWO6agMEjyQAAAAA"]
[Tue Apr 21 15:41:34.674703 2026] [:error] [pid 35320:tid 35352] [client 20.91.250.199:25290] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sbhu.php"] [unique_id "aecqLoJW6fdXWO6agMEjygAAABY"]
[Tue Apr 21 15:41:34.991456 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:52305] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqLtzkuxsE_OhM9UIfnwAAAlQ"]
[Tue Apr 21 15:41:35.357432 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:25288] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aecqLzeHLhVUuu8cVXy3xAAAAEQ"]
[Tue Apr 21 15:41:35.560336 2026] [:error] [pid 53832:tid 53842] [client 54.196.192.156:55904] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aecqL9zkuxsE_OhM9UIfpgAAAkc"]
[Tue Apr 21 15:41:35.966138 2026] [:error] [pid 35321:tid 35393] [client 20.91.250.199:30034] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aecqLzeHLhVUuu8cVXy3xgAAAEk"]
[Tue Apr 21 15:41:36.389881 2026] [:error] [pid 35321:tid 35387] [client 54.196.192.156:55920] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "aecqMDeHLhVUuu8cVXy3yQAAAEM"]
[Tue Apr 21 15:41:36.622305 2026] [:error] [pid 35321:tid 35390] [client 20.91.250.199:29475] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aecqMDeHLhVUuu8cVXy3ygAAAEY"]
[Tue Apr 21 15:41:37.056593 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:30048] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqMTeHLhVUuu8cVXy3zQAAAEQ"]
[Tue Apr 21 15:41:37.219824 2026] [:error] [pid 53832:tid 53847] [client 54.196.192.156:55930] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "aecqMdzkuxsE_OhM9UIfsgAAAkw"]
[Tue Apr 21 15:41:37.233053 2026] [:error] [pid 35321:tid 35397] [client 20.91.250.199:25242] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-blog.php"] [unique_id "aecqMTeHLhVUuu8cVXy30AAAAE0"]
[Tue Apr 21 15:41:38.044458 2026] [:error] [pid 54080:tid 54090] [client 20.91.250.199:2097] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aecqMozEbQHHxtmWbaZaLAAAAsg"]
[Tue Apr 21 15:41:38.045811 2026] [:error] [pid 4823:tid 4877] [client 54.196.192.156:55942] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "aecqMvc8mke3PfHqsxHCJwAAAZg"]
[Tue Apr 21 15:41:38.279724 2026] [:error] [pid 54080:tid 54100] [client 20.91.250.199:32735] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqMozEbQHHxtmWbaZaMAAAAtI"]
[Tue Apr 21 15:41:38.802833 2026] [:error] [pid 54080:tid 54096] [client 20.91.250.199:23190] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aecqMozEbQHHxtmWbaZaNQAAAs4"]
[Tue Apr 21 15:41:38.879403 2026] [:error] [pid 4823:tid 4869] [client 54.196.192.156:55944] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "aecqMvc8mke3PfHqsxHCKwAAAZA"]
[Tue Apr 21 15:41:39.549591 2026] [:error] [pid 4823:tid 4871] [client 20.91.250.199:30040] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aecqM_c8mke3PfHqsxHCMgAAAZI"]
[Tue Apr 21 15:41:39.706672 2026] [:error] [pid 54080:tid 54093] [client 54.196.192.156:55952] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "aecqM4zEbQHHxtmWbaZaOwAAAss"]
[Tue Apr 21 15:41:39.793286 2026] [:error] [pid 4823:tid 4855] [client 20.91.250.199:42075] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqM_c8mke3PfHqsxHCNAAAAYI"]
[Tue Apr 21 15:41:40.244748 2026] [:error] [pid 4823:tid 4877] [client 20.91.250.199:52314] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "aecqNPc8mke3PfHqsxHCNwAAAZg"]
[Tue Apr 21 15:41:40.536490 2026] [:error] [pid 54080:tid 54103] [client 54.196.192.156:55960] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.remote"] [unique_id "aecqNIzEbQHHxtmWbaZaQgAAAtU"]
[Tue Apr 21 15:41:41.051069 2026] [:error] [pid 54080:tid 54106] [client 20.91.250.199:2110] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecqNYzEbQHHxtmWbaZaRQAAAtg"]
[Tue Apr 21 15:41:41.091086 2026] [:error] [pid 4823:tid 4871] [client 20.91.250.199:23762] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqNfc8mke3PfHqsxHCPQAAAZI"]
[Tue Apr 21 15:41:41.373505 2026] [:error] [pid 4823:tid 4861] [client 54.196.192.156:55966] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "aecqNfc8mke3PfHqsxHCQAAAAYg"]
[Tue Apr 21 15:41:41.676442 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:20865] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecqNfc8mke3PfHqsxHCRAAAAZY"]
[Tue Apr 21 15:41:42.111919 2026] [:error] [pid 53731:tid 53743] [client 20.91.250.199:24173] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqNl2I9THUR-bRVGzgCQAAAgg"]
[Tue Apr 21 15:41:42.207583 2026] [:error] [pid 54080:tid 54090] [client 54.196.192.156:55974] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "aecqNozEbQHHxtmWbaZaTQAAAsg"]
[Tue Apr 21 15:41:42.480725 2026] [:error] [pid 54080:tid 54094] [client 20.91.250.199:2750] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecqNozEbQHHxtmWbaZaUQAAAsw"]
[Tue Apr 21 15:41:42.963250 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:2751] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqNtzkuxsE_OhM9UIfyQAAAk0"]
[Tue Apr 21 15:41:43.040898 2026] [:error] [pid 54080:tid 54083] [client 54.196.192.156:55980] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.save"] [unique_id "aecqN4zEbQHHxtmWbaZaVAAAAsE"]
[Tue Apr 21 15:41:43.140943 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:2722] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aecqN_c8mke3PfHqsxHCTwAAAZY"]
[Tue Apr 21 15:41:43.792846 2026] [:error] [pid 54080:tid 54091] [client 20.91.250.199:24129] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aecqN4zEbQHHxtmWbaZaVwAAAsk"]
[Tue Apr 21 15:41:43.856738 2026] [:error] [pid 54080:tid 54103] [client 20.91.250.199:20887] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqN4zEbQHHxtmWbaZaWAAAAtU"]
[Tue Apr 21 15:41:43.868574 2026] [:error] [pid 54080:tid 54082] [client 54.196.192.156:55988] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "aecqN4zEbQHHxtmWbaZaWQAAAsA"]
[Tue Apr 21 15:41:44.460753 2026] [:error] [pid 54080:tid 54083] [client 20.91.250.199:39819] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqOIzEbQHHxtmWbaZaXQAAAsE"]
[Tue Apr 21 15:41:44.697563 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:2729] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aecqOPc8mke3PfHqsxHCVQAAAZU"]
[Tue Apr 21 15:41:44.710478 2026] [:error] [pid 54080:tid 54095] [client 54.196.192.156:45708] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.sample"] [unique_id "aecqOIzEbQHHxtmWbaZaYAAAAs0"]
[Tue Apr 21 15:41:45.139174 2026] [:error] [pid 53832:tid 53849] [client 20.91.250.199:2749] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqOdzkuxsE_OhM9UIf0AAAAk4"]
[Tue Apr 21 15:41:45.356874 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:30063] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aecqOfc8mke3PfHqsxHCVwAAAZY"]
[Tue Apr 21 15:41:45.539302 2026] [:error] [pid 4823:tid 4859] [client 54.196.192.156:45718] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.example"] [unique_id "aecqOfc8mke3PfHqsxHCWAAAAYY"]
[Tue Apr 21 15:41:45.735658 2026] [:error] [pid 4823:tid 4853] [client 20.91.250.199:20914] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqOfc8mke3PfHqsxHCWQAAAYA"]
[Tue Apr 21 15:41:46.140643 2026] [:error] [pid 53731:tid 53742] [client 20.91.250.199:52326] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aecqOl2I9THUR-bRVGzgCwAAAgc"]
[Tue Apr 21 15:41:46.377154 2026] [:error] [pid 4823:tid 4858] [client 54.196.192.156:45722] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev"] [unique_id "aecqOvc8mke3PfHqsxHCXgAAAYU"]
[Tue Apr 21 15:41:46.398514 2026] [:error] [pid 4823:tid 4871] [client 20.91.250.199:24070] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aecqOvc8mke3PfHqsxHCXwAAAZI"]
[Tue Apr 21 15:41:46.928955 2026] [:error] [pid 35320:tid 35333] [client 20.91.250.199:56976] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aecqOoJW6fdXWO6agMEj8gAAAAM"]
[Tue Apr 21 15:41:46.970336 2026] [:error] [pid 4823:tid 4859] [client 20.91.250.199:56969] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aecqOvc8mke3PfHqsxHCYQAAAYY"]
[Tue Apr 21 15:41:47.206454 2026] [:error] [pid 35320:tid 35330] [client 54.196.192.156:45736] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.prod"] [unique_id "aecqO4JW6fdXWO6agMEj9QAAAAA"]
[Tue Apr 21 15:41:47.510522 2026] [:error] [pid 35320:tid 35347] [client 20.91.250.199:42070] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aecqO4JW6fdXWO6agMEj-AAAABE"]
[Tue Apr 21 15:41:47.732582 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:46117] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aecqO_c8mke3PfHqsxHCZgAAAZY"]
[Tue Apr 21 15:41:48.038843 2026] [:error] [pid 4823:tid 4865] [client 54.196.192.156:45752] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.stage"] [unique_id "aecqPPc8mke3PfHqsxHCaQAAAYw"]
[Tue Apr 21 15:41:48.126022 2026] [:error] [pid 53731:tid 53748] [client 20.91.250.199:30058] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adminfuns.php"] [unique_id "aecqPF2I9THUR-bRVGzgDQAAAg0"]
[Tue Apr 21 15:41:48.663468 2026] [:error] [pid 54080:tid 54082] [client 20.91.250.199:23228] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aecqPIzEbQHHxtmWbaZadQAAAsA"]
[Tue Apr 21 15:41:48.794589 2026] [:error] [pid 54080:tid 54105] [client 20.91.250.199:50237] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aecqPIzEbQHHxtmWbaZadwAAAtc"]
[Tue Apr 21 15:41:48.870430 2026] [:error] [pid 35320:tid 35341] [client 54.196.192.156:45764] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.ci"] [unique_id "aecqPIJW6fdXWO6agMEkAQAAAAs"]
[Tue Apr 21 15:41:49.493514 2026] [:error] [pid 4823:tid 4862] [client 20.91.250.199:41006] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aecqPfc8mke3PfHqsxHCcwAAAYk"]
[Tue Apr 21 15:41:49.625638 2026] [:error] [pid 54080:tid 54087] [client 20.91.250.199:52795] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aecqPYzEbQHHxtmWbaZafAAAAsU"]
[Tue Apr 21 15:41:49.698042 2026] [:error] [pid 35320:tid 35330] [client 54.196.192.156:45772] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.docker"] [unique_id "aecqPYJW6fdXWO6agMEkBAAAAAA"]
[Tue Apr 21 15:41:50.053561 2026] [:error] [pid 54080:tid 54085] [client 20.91.250.199:42060] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aecqPozEbQHHxtmWbaZafQAAAsM"]
[Tue Apr 21 15:41:50.373952 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:24105] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aecqPoJW6fdXWO6agMEkBQAAAA4"]
[Tue Apr 21 15:41:50.529846 2026] [:error] [pid 35320:tid 35347] [client 54.196.192.156:45774] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.live"] [unique_id "aecqPoJW6fdXWO6agMEkBwAAABE"]
[Tue Apr 21 15:41:50.684114 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:46143] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/goods.php"] [unique_id "aecqPozEbQHHxtmWbaZaggAAAss"]
[Tue Apr 21 15:41:51.062111 2026] [:error] [pid 54080:tid 54087] [client 20.91.250.199:52319] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aecqP4zEbQHHxtmWbaZahwAAAsU"]
[Tue Apr 21 15:41:51.359792 2026] [:error] [pid 35320:tid 35354] [client 54.196.192.156:45782] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.preprod"] [unique_id "aecqP4JW6fdXWO6agMEkDwAAABg"]
[Tue Apr 21 15:41:51.362688 2026] [:error] [pid 54080:tid 54083] [client 20.91.250.199:39833] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqP4zEbQHHxtmWbaZajAAAAsE"]
[Tue Apr 21 15:41:51.720199 2026] [:error] [pid 54080:tid 54091] [client 20.91.250.199:42101] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aecqP4zEbQHHxtmWbaZajQAAAsk"]
[Tue Apr 21 15:41:52.186824 2026] [:error] [pid 54080:tid 54094] [client 54.196.192.156:45788] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.uat"] [unique_id "aecqQIzEbQHHxtmWbaZalAAAAsw"]
[Tue Apr 21 15:41:52.240831 2026] [:error] [pid 53832:tid 53854] [client 20.91.250.199:25319] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqQNzkuxsE_OhM9UIf_AAAAlM"]
[Tue Apr 21 15:41:52.543543 2026] [:error] [pid 35320:tid 35346] [client 20.91.250.199:25315] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aecqQIJW6fdXWO6agMEkGAAAABA"]
[Tue Apr 21 15:41:53.015334 2026] [:error] [pid 53832:tid 53845] [client 54.196.192.156:45792] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dist"] [unique_id "aecqQdzkuxsE_OhM9UIf_gAAAko"]
[Tue Apr 21 15:41:53.114352 2026] [:error] [pid 54080:tid 54098] [client 20.91.250.199:50189] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqQYzEbQHHxtmWbaZamwAAAtA"]
[Tue Apr 21 15:41:53.119786 2026] [:error] [pid 54080:tid 54095] [client 20.91.250.199:49070] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aecqQYzEbQHHxtmWbaZanAAAAs0"]
[Tue Apr 21 15:41:53.782651 2026] [:error] [pid 35321:tid 35384] [client 20.91.250.199:25928] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ms-edit.php"] [unique_id "aecqQTeHLhVUuu8cVXy36AAAAEA"]
[Tue Apr 21 15:41:53.847865 2026] [:error] [pid 53832:tid 53849] [client 54.196.192.156:45804] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.swp"] [unique_id "aecqQdzkuxsE_OhM9UIgAwAAAk4"]
[Tue Apr 21 15:41:53.906367 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:39871] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aecqQTeHLhVUuu8cVXy36QAAAFY"]
[Tue Apr 21 15:41:54.644459 2026] [:error] [pid 35321:tid 35397] [client 20.91.250.199:46083] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aecqQjeHLhVUuu8cVXy37wAAAE0"]
[Tue Apr 21 15:41:54.677303 2026] [:error] [pid 35321:tid 35390] [client 54.196.192.156:35494] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env~"] [unique_id "aecqQjeHLhVUuu8cVXy38QAAAEY"]
[Tue Apr 21 15:41:54.698155 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:27744] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aecqQjeHLhVUuu8cVXy38gAAAFQ"]
[Tue Apr 21 15:41:55.354898 2026] [:error] [pid 35321:tid 35394] [client 20.91.250.199:39862] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aecqQzeHLhVUuu8cVXy39QAAAEo"]
[Tue Apr 21 15:41:55.512117 2026] [:error] [pid 35321:tid 35393] [client 54.196.192.156:35498] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "aecqQzeHLhVUuu8cVXy39gAAAEk"]
[Tue Apr 21 15:41:55.928356 2026] [:error] [pid 35321:tid 35389] [client 20.91.250.199:24092] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aecqQzeHLhVUuu8cVXy3-wAAAEU"]
[Tue Apr 21 15:41:56.279460 2026] [:error] [pid 54080:tid 54094] [client 20.91.250.199:61426] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aecqRIzEbQHHxtmWbaZarQAAAsw"]
[Tue Apr 21 15:41:56.347268 2026] [:error] [pid 54080:tid 54085] [client 54.196.192.156:35512] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/apps/.env"] [unique_id "aecqRIzEbQHHxtmWbaZargAAAsM"]
[Tue Apr 21 15:41:56.747244 2026] [:error] [pid 4823:tid 4863] [client 20.91.250.199:27729] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aecqRPc8mke3PfHqsxHCiQAAAYo"]
[Tue Apr 21 15:41:57.011890 2026] [:error] [pid 4823:tid 4868] [client 20.91.250.199:45728] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aecqRfc8mke3PfHqsxHCiwAAAY8"]
[Tue Apr 21 15:41:57.178848 2026] [:error] [pid 54080:tid 54099] [client 54.196.192.156:35514] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "aecqRYzEbQHHxtmWbaZatQAAAtE"]
[Tue Apr 21 15:41:57.519113 2026] [:error] [pid 54080:tid 54085] [client 20.91.250.199:48487] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/222.php"] [unique_id "aecqRYzEbQHHxtmWbaZauAAAAsM"]
[Tue Apr 21 15:41:57.740007 2026] [:error] [pid 4823:tid 4866] [client 20.91.250.199:61417] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aecqRfc8mke3PfHqsxHCjgAAAY0"]
[Tue Apr 21 15:41:58.018104 2026] [:error] [pid 54080:tid 54082] [client 54.196.192.156:35528] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/web/.env"] [unique_id "aecqRozEbQHHxtmWbaZauwAAAsA"]
[Tue Apr 21 15:41:58.339343 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:27766] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aecqRvc8mke3PfHqsxHCkQAAAZA"]
[Tue Apr 21 15:41:58.392250 2026] [:error] [pid 54080:tid 54086] [client 20.91.250.199:27767] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp.php"] [unique_id "aecqRozEbQHHxtmWbaZavgAAAsQ"]
[Tue Apr 21 15:41:58.845849 2026] [:error] [pid 54080:tid 54092] [client 54.196.192.156:35542] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/site/.env"] [unique_id "aecqRozEbQHHxtmWbaZaxAAAAso"]
[Tue Apr 21 15:41:59.128495 2026] [:error] [pid 54080:tid 54100] [client 20.91.250.199:25976] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aecqR4zEbQHHxtmWbaZaxwAAAtI"]
[Tue Apr 21 15:41:59.176187 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:50234] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aecqR4zEbQHHxtmWbaZayQAAAtQ"]
[Tue Apr 21 15:41:59.673871 2026] [:error] [pid 35320:tid 35335] [client 54.196.192.156:35554] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.env"] [unique_id "aecqR4JW6fdXWO6agMEkQQAAAAU"]
[Tue Apr 21 15:41:59.828732 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:33060] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aecqR_c8mke3PfHqsxHCnQAAAZU"]
[Tue Apr 21 15:41:59.840859 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:45716] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aecqR4JW6fdXWO6agMEkQwAAAA4"]
[Tue Apr 21 15:42:00.447552 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:32332] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aecqSIzEbQHHxtmWbaZa1gAAAtQ"]
[Tue Apr 21 15:42:00.513715 2026] [:error] [pid 54080:tid 54094] [client 54.196.192.156:35562] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env"] [unique_id "aecqSIzEbQHHxtmWbaZa2AAAAsw"]
[Tue Apr 21 15:42:00.767892 2026] [:error] [pid 54080:tid 54096] [client 20.91.250.199:2913] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aecqSIzEbQHHxtmWbaZa2QAAAs4"]
[Tue Apr 21 15:42:01.086561 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:45372] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aecqSfc8mke3PfHqsxHCogAAAYs"]
[Tue Apr 21 15:42:01.348940 2026] [:error] [pid 35320:tid 35335] [client 54.196.192.156:35572] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backend/.env"] [unique_id "aecqSYJW6fdXWO6agMEkWAAAAAU"]
[Tue Apr 21 15:42:01.653847 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:32366] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqSYJW6fdXWO6agMEkXQAAAAw"]
[Tue Apr 21 15:42:01.871034 2026] [:error] [pid 35320:tid 35348] [client 20.91.250.199:61425] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecqSYJW6fdXWO6agMEkYAAAABI"]
[Tue Apr 21 15:42:02.185989 2026] [:error] [pid 4823:tid 4855] [client 54.196.192.156:35584] [client 54.196.192.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/server/.env"] [unique_id "aecqSvc8mke3PfHqsxHCpgAAAYI"]
[Tue Apr 21 15:42:02.642987 2026] [:error] [pid 35320:tid 35351] [client 20.91.250.199:50197] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecqSoJW6fdXWO6agMEkbAAAABU"]
[Tue Apr 21 15:42:02.732024 2026] [:error] [pid 35320:tid 35330] [client 20.91.250.199:55093] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqSoJW6fdXWO6agMEkbQAAAAA"]
[Tue Apr 21 15:42:03.605759 2026] [:error] [pid 35320:tid 35351] [client 20.91.250.199:45337] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqS4JW6fdXWO6agMEkegAAABU"]
[Tue Apr 21 15:42:03.613971 2026] [:error] [pid 35320:tid 35346] [client 20.91.250.199:36940] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecqS4JW6fdXWO6agMEkewAAABA"]
[Tue Apr 21 15:42:04.400403 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:55045] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fe5.php"] [unique_id "aecqTIJW6fdXWO6agMEkhgAAAAw"]
[Tue Apr 21 15:42:04.720026 2026] [:error] [pid 35320:tid 35343] [client 20.91.250.199:33038] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fff.php"] [unique_id "aecqTIJW6fdXWO6agMEkiwAAAA0"]
[Tue Apr 21 15:42:05.158384 2026] [:error] [pid 35321:tid 35392] [client 20.91.250.199:33144] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aecqTTeHLhVUuu8cVXy4CQAAAEg"]
[Tue Apr 21 15:42:06.255115 2026] [:error] [pid 35320:tid 35342] [client 20.91.250.199:32270] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aecqToJW6fdXWO6agMEkmAAAAAw"]
[Tue Apr 21 15:42:06.766397 2026] [:error] [pid 53731:tid 53737] [client 20.91.250.199:36991] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqTl2I9THUR-bRVGzgFAAAAgI"]
[Tue Apr 21 15:42:07.002655 2026] [:error] [pid 35320:tid 35336] [client 20.91.250.199:61409] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aecqT4JW6fdXWO6agMEkngAAAAY"]
[Tue Apr 21 15:42:07.781568 2026] [:error] [pid 53731:tid 53745] [client 20.91.250.199:33148] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aecqT12I9THUR-bRVGzgFwAAAgo"]
[Tue Apr 21 15:42:07.907621 2026] [:error] [pid 35320:tid 35354] [client 20.91.250.199:32346] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqT4JW6fdXWO6agMEkpQAAABg"]
[Tue Apr 21 15:42:08.730866 2026] [:error] [pid 35320:tid 35332] [client 20.91.250.199:33075] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqUIJW6fdXWO6agMEkrAAAAAI"]
[Tue Apr 21 15:42:08.813215 2026] [:error] [pid 35320:tid 35345] [client 20.91.250.199:33899] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqUIJW6fdXWO6agMEkrgAAAA8"]
[Tue Apr 21 15:42:09.482185 2026] [:error] [pid 35320:tid 35332] [client 20.91.250.199:20409] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqUYJW6fdXWO6agMEksgAAAAI"]
[Tue Apr 21 15:42:09.486736 2026] [:error] [pid 54080:tid 54095] [client 20.91.250.199:55814] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqUYzEbQHHxtmWbaZbBwAAAs0"]
[Tue Apr 21 15:42:10.294049 2026] [:error] [pid 35320:tid 35346] [client 20.91.250.199:20462] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqUoJW6fdXWO6agMEkvAAAABA"]
[Tue Apr 21 15:42:11.193813 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:55850] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqUzeHLhVUuu8cVXy4DgAAAEw"]
[Tue Apr 21 15:42:11.233785 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:2825] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/av.php"] [unique_id "aecqUzeHLhVUuu8cVXy4DwAAAE4"]
[Tue Apr 21 15:42:11.944780 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:55843] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqU_c8mke3PfHqsxHC0AAAAZA"]
[Tue Apr 21 15:42:12.188428 2026] [:error] [pid 35320:tid 35341] [client 20.91.250.199:37982] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqVIJW6fdXWO6agMEkwQAAAAs"]
[Tue Apr 21 15:42:12.613918 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:2167] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqVPc8mke3PfHqsxHC2QAAAZU"]
[Tue Apr 21 15:42:13.008627 2026] [:error] [pid 4777:tid 4812] [client 20.91.250.199:52802] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqVaxXur6bykKyLZSKWQAAARg"]
[Tue Apr 21 15:42:13.299566 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:37992] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqVTeHLhVUuu8cVXy4FgAAAFU"]
[Tue Apr 21 15:42:14.193802 2026] [:error] [pid 54080:tid 54091] [client 20.91.250.199:20405] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqVozEbQHHxtmWbaZbHQAAAsk"]
[Tue Apr 21 15:42:14.323121 2026] [:error] [pid 53832:tid 53849] [client 20.91.250.199:2842] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/we.php"] [unique_id "aecqVtzkuxsE_OhM9UIgOgAAAk4"]
[Tue Apr 21 15:42:14.983707 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:29531] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqVjeHLhVUuu8cVXy4HwAAAE8"]
[Tue Apr 21 15:42:15.325024 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:2420] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqVzeHLhVUuu8cVXy4IQAAAEQ"]
[Tue Apr 21 15:42:15.866461 2026] [:error] [pid 35321:tid 35393] [client 20.91.250.199:44490] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqVzeHLhVUuu8cVXy4JAAAAEk"]
[Tue Apr 21 15:42:15.988440 2026] [:error] [pid 53832:tid 53847] [client 20.91.250.199:47761] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqV9zkuxsE_OhM9UIgQQAAAkw"]
[Tue Apr 21 15:42:16.539450 2026] [:error] [pid 54080:tid 54083] [client 20.91.250.199:20352] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqWIzEbQHHxtmWbaZbIgAAAsE"]
[Tue Apr 21 15:42:16.746654 2026] [:error] [pid 53731:tid 53746] [client 20.91.250.199:2402] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqWF2I9THUR-bRVGzgHQAAAgs"]
[Tue Apr 21 15:42:17.153434 2026] [:error] [pid 53832:tid 53849] [client 20.91.250.199:47804] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aecqWdzkuxsE_OhM9UIgRgAAAk4"]
[Tue Apr 21 15:42:17.551205 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:27655] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqWdzkuxsE_OhM9UIgSQAAAk0"]
[Tue Apr 21 15:42:17.687700 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:29527] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqWdzkuxsE_OhM9UIgSwAAAkc"]
[Tue Apr 21 15:42:18.352324 2026] [:error] [pid 53832:tid 53840] [client 20.91.250.199:52863] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1.php"] [unique_id "aecqWtzkuxsE_OhM9UIgVAAAAkU"]
[Tue Apr 21 15:42:18.366400 2026] [:error] [pid 35320:tid 35343] [client 20.91.250.199:2121] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqWoJW6fdXWO6agMEk4gAAAA0"]
[Tue Apr 21 15:42:19.091190 2026] [:error] [pid 54080:tid 54098] [client 20.91.250.199:20399] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqW4zEbQHHxtmWbaZbLgAAAtA"]
[Tue Apr 21 15:42:19.223309 2026] [:error] [pid 54080:tid 54095] [client 20.91.250.199:2139] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1.php"] [unique_id "aecqW4zEbQHHxtmWbaZbMAAAAs0"]
[Tue Apr 21 15:42:19.898282 2026] [:error] [pid 5377:tid 5407] [client 20.91.250.199:2113] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/admin1.php"] [unique_id "aecqW7BKychFlrHBdvvqIgAAAdU"]
[Tue Apr 21 15:42:20.167831 2026] [:error] [pid 54080:tid 54089] [client 20.91.250.199:33871] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Tue Apr 21 15:42:21.293338 2026] [:error] [pid 54080:tid 54086] [client 20.91.250.199:33871] [client 20.91.250.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aecqXYzEbQHHxtmWbaZbPwAAAsQ"]
[Tue Apr 21 15:42:21.373370 2026] [:error] [pid 54080:tid 54101] [client 20.91.250.199:55462] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Tue Apr 21 15:42:22.352126 2026] [:error] [pid 54080:tid 54087] [client 20.91.250.199:55462] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 21 15:42:22.952253 2026] [:error] [pid 54080:tid 54104] [client 20.91.250.199:55462] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Tue Apr 21 15:42:23.554113 2026] [:error] [pid 54080:tid 54084] [client 20.91.250.199:55462] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue Apr 21 15:42:23.750942 2026] [:error] [pid 53978:tid 53988] [client 20.91.250.199:29520] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aecqX51ivsR4hcOSQba39AAAAog"]
[Tue Apr 21 15:42:23.843354 2026] [:error] [pid 54080:tid 54082] [client 20.91.250.199:55462] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqX4zEbQHHxtmWbaZbUwAAAsA"]
[Tue Apr 21 15:42:24.889087 2026] [:error] [pid 54080:tid 54092] [client 20.91.250.199:44529] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aecqYIzEbQHHxtmWbaZbYQAAAso"]
[Tue Apr 21 15:42:25.412922 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:60360] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqYYzEbQHHxtmWbaZbaAAAAss"]
[Tue Apr 21 15:42:25.768592 2026] [:error] [pid 54080:tid 54088] [client 20.91.250.199:52826] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aecqYYzEbQHHxtmWbaZbbQAAAsY"]
[Tue Apr 21 15:42:26.372119 2026] [:error] [pid 53832:tid 53835] [client 20.91.250.199:52805] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqYtzkuxsE_OhM9UIgcwAAAkA"]
[Tue Apr 21 15:42:26.793698 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:44504] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aecqYtzkuxsE_OhM9UIgewAAAk0"]
[Tue Apr 21 15:42:28.176608 2026] [:error] [pid 53832:tid 53837] [client 20.91.250.199:20355] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqZNzkuxsE_OhM9UIgiwAAAkI"]
[Tue Apr 21 15:42:28.213715 2026] [:error] [pid 53832:tid 53858] [client 20.91.250.199:37979] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abcd.php"] [unique_id "aecqZNzkuxsE_OhM9UIgjAAAAlc"]
[Tue Apr 21 15:42:29.224787 2026] [:error] [pid 53832:tid 53859] [client 20.91.250.199:29504] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqZdzkuxsE_OhM9UIglwAAAlg"]
[Tue Apr 21 15:42:29.545251 2026] [:error] [pid 53832:tid 53845] [client 20.91.250.199:42435] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqZdzkuxsE_OhM9UIgmwAAAko"]
[Tue Apr 21 15:42:30.099444 2026] [:error] [pid 53978:tid 53984] [client 20.91.250.199:55390] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqZp1ivsR4hcOSQba4DgAAAoQ"]
[Tue Apr 21 15:42:30.268858 2026] [:error] [pid 53832:tid 53835] [client 20.91.250.199:20384] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqZtzkuxsE_OhM9UIgogAAAkA"]
[Tue Apr 21 15:42:31.050402 2026] [:error] [pid 53832:tid 53838] [client 20.91.250.199:44502] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqZ9zkuxsE_OhM9UIgqQAAAkM"]
[Tue Apr 21 15:42:31.118245 2026] [:error] [pid 53832:tid 53850] [client 20.91.250.199:29505] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqZ9zkuxsE_OhM9UIgqgAAAk8"]
[Tue Apr 21 15:42:31.896273 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:55440] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqZzeHLhVUuu8cVXy4SwAAAFU"]
[Tue Apr 21 15:42:32.131133 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:52838] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fi.php"] [unique_id "aecqaDeHLhVUuu8cVXy4TQAAAEw"]
[Tue Apr 21 15:42:32.642930 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:26400] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqaDeHLhVUuu8cVXy4UgAAAEM"]
[Tue Apr 21 15:42:33.288680 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:52811] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1.php"] [unique_id "aecqadzkuxsE_OhM9UIgwgAAAkc"]
[Tue Apr 21 15:42:33.740578 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:29975] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqaYzEbQHHxtmWbaZbkAAAAs8"]
[Tue Apr 21 15:42:34.152082 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:41025] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1.php"] [unique_id "aecqatzkuxsE_OhM9UIgzwAAAkE"]
[Tue Apr 21 15:42:34.406511 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:38007] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqajeHLhVUuu8cVXy4XAAAAE4"]
[Tue Apr 21 15:42:34.886177 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:47802] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1.php"] [unique_id "aecqajeHLhVUuu8cVXy4YQAAAEM"]
[Tue Apr 21 15:42:35.075683 2026] [:error] [pid 53832:tid 53847] [client 20.91.250.199:20387] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqa9zkuxsE_OhM9UIg1AAAAkw"]
[Tue Apr 21 15:42:35.792165 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:52806] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a1.php"] [unique_id "aecqa9zkuxsE_OhM9UIg2AAAAkE"]
[Tue Apr 21 15:42:35.862024 2026] [:error] [pid 53832:tid 53849] [client 20.91.250.199:30010] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqa9zkuxsE_OhM9UIg2QAAAk4"]
[Tue Apr 21 15:42:36.570144 2026] [:error] [pid 4823:tid 4865] [client 20.91.250.199:29524] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aecqbPc8mke3PfHqsxHDOwAAAYw"]
[Tue Apr 21 15:42:36.700563 2026] [:error] [pid 53832:tid 53841] [client 20.91.250.199:2131] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqbNzkuxsE_OhM9UIg4QAAAkY"]
[Tue Apr 21 15:42:37.425842 2026] [:error] [pid 53832:tid 53844] [client 20.91.250.199:20373] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqbdzkuxsE_OhM9UIg5QAAAkk"]
[Tue Apr 21 15:42:37.609828 2026] [:error] [pid 53731:tid 53758] [client 20.91.250.199:37996] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aecqbV2I9THUR-bRVGzgNQAAAhY"]
[Tue Apr 21 15:42:38.526157 2026] [:error] [pid 53978:tid 53982] [client 20.91.250.199:60374] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aecqbp1ivsR4hcOSQba4HAAAAoI"]
[Tue Apr 21 15:42:38.660653 2026] [:error] [pid 4823:tid 4873] [client 20.91.250.199:41728] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqbvc8mke3PfHqsxHDQgAAAZQ"]
[Tue Apr 21 15:42:39.262154 2026] [:error] [pid 53832:tid 53851] [client 20.91.250.199:33437] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/update/f35.php"] [unique_id "aecqb9zkuxsE_OhM9UIg-QAAAlA"]
[Tue Apr 21 15:42:39.794542 2026] [:error] [pid 53832:tid 53844] [client 20.91.250.199:42458] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqb9zkuxsE_OhM9UIhCgAAAkk"]
[Tue Apr 21 15:42:40.002945 2026] [:error] [pid 35321:tid 35384] [client 20.91.250.199:55472] [client 20.91.250.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aecqcDeHLhVUuu8cVXy4ggAAAEA"]
[Tue Apr 21 15:42:40.837572 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:26386] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aecqcDeHLhVUuu8cVXy4jAAAAFg"]
[Tue Apr 21 15:42:40.905468 2026] [:error] [pid 5377:tid 5398] [client 20.91.250.199:52805] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqcLBKychFlrHBdvvqOAAAAcw"]
[Tue Apr 21 15:42:41.790892 2026] [:error] [pid 53731:tid 53754] [client 20.91.250.199:26380] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqcV2I9THUR-bRVGzgPgAAAhI"]
[Tue Apr 21 15:42:41.877170 2026] [:error] [pid 53731:tid 53749] [client 20.91.250.199:47786] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aecqcV2I9THUR-bRVGzgPwAAAg4"]
[Tue Apr 21 15:42:42.573326 2026] [:error] [pid 35320:tid 35330] [client 20.91.250.199:41073] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqcoJW6fdXWO6agMElPgAAAAA"]
[Tue Apr 21 15:42:42.688184 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:20352] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/f35.php"] [unique_id "aecqcjeHLhVUuu8cVXy4mwAAAFA"]
[Tue Apr 21 15:42:43.422510 2026] [:error] [pid 35321:tid 35393] [client 20.91.250.199:29566] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqczeHLhVUuu8cVXy4oQAAAEk"]
[Tue Apr 21 15:42:43.446889 2026] [:error] [pid 5377:tid 5397] [client 20.91.250.199:2171] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqc7BKychFlrHBdvvqOwAAAcs"]
[Tue Apr 21 15:42:44.116071 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:52813] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqdDeHLhVUuu8cVXy4pwAAAFE"]
[Tue Apr 21 15:42:44.379137 2026] [:error] [pid 35321:tid 35399] [client 20.91.250.199:42469] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqdDeHLhVUuu8cVXy4qwAAAE8"]
[Tue Apr 21 15:42:44.963067 2026] [:error] [pid 35321:tid 35392] [client 20.91.250.199:47752] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqdDeHLhVUuu8cVXy4sQAAAEg"]
[Tue Apr 21 15:42:45.194837 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:29961] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqdTeHLhVUuu8cVXy4tAAAAEw"]
[Tue Apr 21 15:42:45.860073 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:37959] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqdTeHLhVUuu8cVXy4tgAAAFE"]
[Tue Apr 21 15:42:45.956465 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:52801] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecqdTeHLhVUuu8cVXy4twAAAFQ"]
[Tue Apr 21 15:42:46.712055 2026] [:error] [pid 53731:tid 53747] [client 20.91.250.199:2829] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqdl2I9THUR-bRVGzgTQAAAgw"]
[Tue Apr 21 15:42:47.252884 2026] [:error] [pid 5377:tid 5386] [client 20.91.250.199:55448] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqd7BKychFlrHBdvvqPwAAAcA"]
[Tue Apr 21 15:42:47.789329 2026] [:error] [pid 53731:tid 53743] [client 20.91.250.199:26405] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqd12I9THUR-bRVGzgVgAAAgg"]
[Tue Apr 21 15:42:48.645873 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:20368] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqeDeHLhVUuu8cVXy4zQAAAEs"]
[Tue Apr 21 15:42:49.197738 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:39398] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqeTeHLhVUuu8cVXy4zwAAAEQ"]
[Tue Apr 21 15:42:49.818152 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:38001] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqeTeHLhVUuu8cVXy42QAAAEs"]
[Tue Apr 21 15:42:49.932466 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:32646] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqeYzEbQHHxtmWbaZbsQAAAss"]
[Tue Apr 21 15:42:50.937608 2026] [:error] [pid 35320:tid 35339] [client 20.91.250.199:37985] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqeoJW6fdXWO6agMElXQAAAAk"]
[Tue Apr 21 15:42:51.060482 2026] [:error] [pid 35321:tid 35394] [client 20.91.250.199:32662] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-includes/SimplePie/"] [unique_id "aecqezeHLhVUuu8cVXy46wAAAEo"]
[Tue Apr 21 15:42:52.096426 2026] [:error] [pid 54080:tid 54092] [client 20.91.250.199:2830] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqfIzEbQHHxtmWbaZbuwAAAso"]
[Tue Apr 21 15:42:52.341313 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:26389] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqfDeHLhVUuu8cVXy49wAAAFg"]
[Tue Apr 21 15:42:53.001435 2026] [:error] [pid 4823:tid 4865] [client 20.91.250.199:2116] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqffc8mke3PfHqsxHDYgAAAYw"]
[Tue Apr 21 15:42:53.516565 2026] [:error] [pid 54080:tid 54105] [client 20.91.250.199:37952] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqfYzEbQHHxtmWbaZbwAAAAtc"]
[Tue Apr 21 15:42:54.234735 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:32679] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqfozEbQHHxtmWbaZbwwAAAtQ"]
[Tue Apr 21 15:42:54.543388 2026] [:error] [pid 53832:tid 53835] [client 20.91.250.199:26410] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqftzkuxsE_OhM9UIhQQAAAkA"]
[Tue Apr 21 15:42:55.437566 2026] [:error] [pid 54080:tid 54093] [client 20.91.250.199:2855] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/k.php"] [unique_id "aecqf4zEbQHHxtmWbaZbxwAAAss"]
[Tue Apr 21 15:42:55.819626 2026] [:error] [pid 53731:tid 53749] [client 20.91.250.199:32681] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqf12I9THUR-bRVGzgagAAAg4"]
[Tue Apr 21 15:42:56.290250 2026] [:error] [pid 54080:tid 54097] [client 20.91.250.199:52817] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqgIzEbQHHxtmWbaZbyQAAAs8"]
[Tue Apr 21 15:42:56.829255 2026] [:error] [pid 54080:tid 54085] [client 20.91.250.199:55473] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqgIzEbQHHxtmWbaZbygAAAsM"]
[Tue Apr 21 15:42:57.265913 2026] [:error] [pid 54080:tid 54096] [client 20.91.250.199:42482] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqgYzEbQHHxtmWbaZbzAAAAs4"]
[Tue Apr 21 15:42:57.793345 2026] [:error] [pid 5377:tid 5407] [client 20.91.250.199:2841] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqgbBKychFlrHBdvvqTAAAAdU"]
[Tue Apr 21 15:42:58.252575 2026] [:error] [pid 53832:tid 53840] [client 20.91.250.199:29998] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqgtzkuxsE_OhM9UIhUQAAAkU"]
[Tue Apr 21 15:42:59.114545 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:55368] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqgzeHLhVUuu8cVXy5JgAAAE4"]
[Tue Apr 21 15:42:59.395454 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:60378] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev.php"] [unique_id "aecqgzeHLhVUuu8cVXy5KgAAAFU"]
[Tue Apr 21 15:42:59.802509 2026] [:error] [pid 53832:tid 53856] [client 20.91.250.199:30013] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqg9zkuxsE_OhM9UIhWgAAAlU"]
[Tue Apr 21 15:43:00.158845 2026] [:error] [pid 53832:tid 53843] [client 20.91.250.199:29507] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqhNzkuxsE_OhM9UIhXAAAAkg"]
[Tue Apr 21 15:43:00.741823 2026] [:error] [pid 54080:tid 54102] [client 20.91.250.199:26415] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqhIzEbQHHxtmWbaZb3wAAAtQ"]
[Tue Apr 21 15:43:00.844174 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:26370] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqhDeHLhVUuu8cVXy5NgAAAFU"]
[Tue Apr 21 15:43:01.549451 2026] [:error] [pid 4823:tid 4857] [client 20.91.250.199:2843] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqhfc8mke3PfHqsxHDgAAAAYQ"]
[Tue Apr 21 15:43:01.628973 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:29989] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqhfc8mke3PfHqsxHDggAAAZU"]
[Tue Apr 21 15:43:02.180180 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:52810] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqhjeHLhVUuu8cVXy5QQAAAE4"]
[Tue Apr 21 15:43:02.309567 2026] [:error] [pid 4823:tid 4858] [client 20.91.250.199:60389] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bal.php"] [unique_id "aecqhvc8mke3PfHqsxHDiAAAAYU"]
[Tue Apr 21 15:43:02.957672 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:2848] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqhjeHLhVUuu8cVXy5SAAAAFE"]
[Tue Apr 21 15:43:03.100383 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:29990] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqhzeHLhVUuu8cVXy5SQAAAFQ"]
[Tue Apr 21 15:43:03.749783 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:29519] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqhzeHLhVUuu8cVXy5UAAAAFg"]
[Tue Apr 21 15:43:03.820404 2026] [:error] [pid 53832:tid 53846] [client 20.91.250.199:41041] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqh9zkuxsE_OhM9UIhbwAAAks"]
[Tue Apr 21 15:43:04.501939 2026] [:error] [pid 53978:tid 53990] [client 20.91.250.199:38813] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqiJ1ivsR4hcOSQba4VgAAAoo"]
[Tue Apr 21 15:43:04.788185 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:26423] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqiNzkuxsE_OhM9UIhdgAAAlQ"]
[Tue Apr 21 15:43:05.257025 2026] [:error] [pid 4823:tid 4869] [client 20.91.250.199:30014] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/in.php"] [unique_id "aecqifc8mke3PfHqsxHDoAAAAZA"]
[Tue Apr 21 15:43:05.443022 2026] [:error] [pid 53832:tid 53857] [client 20.91.250.199:29517] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqidzkuxsE_OhM9UIhewAAAlY"]
[Tue Apr 21 15:43:05.994658 2026] [:error] [pid 54080:tid 54088] [client 20.91.250.199:29979] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqiYzEbQHHxtmWbaZb8gAAAsY"]
[Tue Apr 21 15:43:06.312463 2026] [:error] [pid 35321:tid 35391] [client 20.91.250.199:29993] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqijeHLhVUuu8cVXy5YwAAAEc"]
[Tue Apr 21 15:43:06.645350 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:2174] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqitzkuxsE_OhM9UIhggAAAlI"]
[Tue Apr 21 15:43:07.083389 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:26398] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqizeHLhVUuu8cVXy5awAAAFA"]
[Tue Apr 21 15:43:07.310946 2026] [:error] [pid 35321:tid 35393] [client 20.91.250.199:55478] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqizeHLhVUuu8cVXy5bwAAAEk"]
[Tue Apr 21 15:43:07.783937 2026] [:error] [pid 35321:tid 35392] [client 20.91.250.199:29563] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqizeHLhVUuu8cVXy5dwAAAEg"]
[Tue Apr 21 15:43:07.995285 2026] [:error] [pid 35321:tid 35391] [client 20.91.250.199:20361] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gssdd.php"] [unique_id "aecqizeHLhVUuu8cVXy5eQAAAEc"]
[Tue Apr 21 15:43:08.645282 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:55482] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfashell.php"] [unique_id "aecqjDeHLhVUuu8cVXy5fwAAAEw"]
[Tue Apr 21 15:43:08.698092 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:52839] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqjDeHLhVUuu8cVXy5gAAAAFQ"]
[Tue Apr 21 15:43:09.359147 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:55421] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfashell.php"] [unique_id "aecqjTeHLhVUuu8cVXy5jQAAAEw"]
[Tue Apr 21 15:43:09.392173 2026] [:error] [pid 35321:tid 35388] [client 20.91.250.199:55447] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqjTeHLhVUuu8cVXy5jgAAAEQ"]
[Tue Apr 21 15:43:10.335893 2026] [:error] [pid 54080:tid 54096] [client 20.91.250.199:37957] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfashell.php"] [unique_id "aecqjozEbQHHxtmWbaZcCgAAAs4"]
[Tue Apr 21 15:43:11.038255 2026] [:error] [pid 35321:tid 35392] [client 20.91.250.199:52857] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqjzeHLhVUuu8cVXy5mQAAAEg"]
[Tue Apr 21 15:43:11.144298 2026] [:error] [pid 54080:tid 54085] [client 20.91.250.199:55435] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/alfashell.php"] [unique_id "aecqj4zEbQHHxtmWbaZcFQAAAsM"]
[Tue Apr 21 15:43:11.798448 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:2141] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aecqjzeHLhVUuu8cVXy5nwAAAFg"]
[Tue Apr 21 15:43:11.839472 2026] [:error] [pid 54080:tid 54100] [client 20.91.250.199:38800] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "aecqj4zEbQHHxtmWbaZcHQAAAtI"]
[Tue Apr 21 15:43:12.641651 2026] [:error] [pid 4823:tid 4868] [client 20.91.250.199:59609] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqkPc8mke3PfHqsxHDzgAAAY8"]
[Tue Apr 21 15:43:12.922534 2026] [:error] [pid 53832:tid 53857] [client 20.91.250.199:38011] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aecqkNzkuxsE_OhM9UIhpAAAAlY"]
[Tue Apr 21 15:43:13.610599 2026] [:error] [pid 35321:tid 35386] [client 20.91.250.199:2154] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aecqkTeHLhVUuu8cVXy5qQAAAEI"]
[Tue Apr 21 15:43:13.628118 2026] [:error] [pid 35321:tid 35404] [client 20.91.250.199:2858] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqkTeHLhVUuu8cVXy5qgAAAFQ"]
[Tue Apr 21 15:43:14.406821 2026] [:error] [pid 4823:tid 4864] [client 20.91.250.199:39406] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aecqkvc8mke3PfHqsxHD2AAAAYs"]
[Tue Apr 21 15:43:14.613253 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:42441] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqkvc8mke3PfHqsxHD2QAAAYE"]
[Tue Apr 21 15:43:15.462328 2026] [:error] [pid 4823:tid 4868] [client 20.91.250.199:29953] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bs1.php"] [unique_id "aecqk_c8mke3PfHqsxHD4QAAAY8"]
[Tue Apr 21 15:43:15.500297 2026] [:error] [pid 4823:tid 4856] [client 20.91.250.199:37975] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aecqk_c8mke3PfHqsxHD4wAAAYM"]
[Tue Apr 21 15:43:16.272496 2026] [:error] [pid 54080:tid 54095] [client 20.91.250.199:55383] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aecqlIzEbQHHxtmWbaZcOQAAAs0"]
[Tue Apr 21 15:43:16.300549 2026] [:error] [pid 35321:tid 35400] [client 20.91.250.199:2826] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqlDeHLhVUuu8cVXy5wAAAAFA"]
[Tue Apr 21 15:43:17.254088 2026] [:error] [pid 35320:tid 35340] [client 20.91.250.199:27137] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aecqlYJW6fdXWO6agMElsAAAAAo"]
[Tue Apr 21 15:43:17.337746 2026] [:error] [pid 54080:tid 54096] [client 20.91.250.199:59644] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqlYzEbQHHxtmWbaZcPwAAAs4"]
[Tue Apr 21 15:43:17.937939 2026] [:error] [pid 4823:tid 4865] [client 20.91.250.199:29994] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/acp.php"] [unique_id "aecqlfc8mke3PfHqsxHD6gAAAYw"]
[Tue Apr 21 15:43:18.033035 2026] [:error] [pid 4823:tid 4854] [client 20.91.250.199:29977] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqlvc8mke3PfHqsxHD7QAAAYE"]
[Tue Apr 21 15:43:19.045389 2026] [:error] [pid 4823:tid 4876] [client 20.91.250.199:41064] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aecql_c8mke3PfHqsxHD9AAAAZc"]
[Tue Apr 21 15:43:19.355825 2026] [:error] [pid 35321:tid 35395] [client 20.91.250.199:52842] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aecqlzeHLhVUuu8cVXy50wAAAEs"]
[Tue Apr 21 15:43:19.773443 2026] [:error] [pid 4777:tid 4790] [client 20.91.250.199:55402] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aecql6xXur6bykKyLZSKawAAAQI"]
[Tue Apr 21 15:43:20.111378 2026] [:error] [pid 35321:tid 35389] [client 20.91.250.199:2838] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqmDeHLhVUuu8cVXy51gAAAEU"]
[Tue Apr 21 15:43:21.301635 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:52854] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqmTeHLhVUuu8cVXy54gAAAFg"]
[Tue Apr 21 15:43:21.863401 2026] [:error] [pid 53832:tid 53857] [client 20.91.250.199:32700] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aecqmdzkuxsE_OhM9UIh2wAAAlY"]
[Tue Apr 21 15:43:22.097142 2026] [:error] [pid 53832:tid 53850] [client 20.91.250.199:37984] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqmtzkuxsE_OhM9UIh3AAAAk8"]
[Tue Apr 21 15:43:22.772548 2026] [:error] [pid 53832:tid 53856] [client 20.91.250.199:55486] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file48.php"] [unique_id "aecqmtzkuxsE_OhM9UIh4QAAAlU"]
[Tue Apr 21 15:43:22.779296 2026] [:error] [pid 53832:tid 53851] [client 20.91.250.199:38828] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/axx.php"] [unique_id "aecqmtzkuxsE_OhM9UIh4gAAAlA"]
[Tue Apr 21 15:43:23.471677 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:27198] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Apr 21 15:43:23.670544 2026] [:error] [pid 53832:tid 53855] [client 20.91.250.199:37967] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Tue Apr 21 15:43:24.039968 2026] [:error] [pid 53832:tid 53847] [client 20.91.250.199:37967] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue Apr 21 15:43:24.197579 2026] [:error] [pid 53832:tid 53837] [client 20.91.250.199:27198] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 21 15:43:24.339120 2026] [:error] [pid 53832:tid 53854] [client 20.91.250.199:37967] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Tue Apr 21 15:43:24.596662 2026] [:error] [pid 53832:tid 53856] [client 20.91.250.199:27198] File does not exist: /usr/local/apache/htdocs/suspended-page/ew.php
[Tue Apr 21 15:43:24.642409 2026] [:error] [pid 53832:tid 53841] [client 20.91.250.199:37967] File does not exist: /usr/local/apache/htdocs/suspended-page/file48.php
[Tue Apr 21 15:43:24.868301 2026] [:error] [pid 53832:tid 53836] [client 20.91.250.199:27198] File does not exist: /usr/local/apache/htdocs/suspended-page/file21.php
[Tue Apr 21 15:43:24.935751 2026] [:error] [pid 53832:tid 53859] [client 20.91.250.199:37967] File does not exist: /usr/local/apache/htdocs/suspended-page/g.php
[Tue Apr 21 15:43:25.269098 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:27198] File does not exist: /usr/local/apache/htdocs/suspended-page/hypo.php
[Tue Apr 21 15:43:25.277605 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:37967] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqndzkuxsE_OhM9UIh_AAAAlI"]
[Tue Apr 21 15:43:26.082695 2026] [:error] [pid 53832:tid 53849] [client 20.91.250.199:2128] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqntzkuxsE_OhM9UIiAAAAAk4"]
[Tue Apr 21 15:43:26.939181 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:27198] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqntzkuxsE_OhM9UIiDAAAAk0"]
[Tue Apr 21 15:43:27.184609 2026] [:error] [pid 53832:tid 53845] [client 20.91.250.199:29999] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqn9zkuxsE_OhM9UIiDwAAAko"]
[Tue Apr 21 15:43:27.587299 2026] [:error] [pid 53832:tid 53853] [client 20.91.250.199:41049] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqn9zkuxsE_OhM9UIiEwAAAlI"]
[Tue Apr 21 15:43:28.153730 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:41075] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-content/"] [unique_id "aecqoPc8mke3PfHqsxHEJwAAAZY"]
[Tue Apr 21 15:43:28.818524 2026] [:error] [pid 53832:tid 53850] [client 20.91.250.199:41070] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqoNzkuxsE_OhM9UIiJwAAAk8"]
[Tue Apr 21 15:43:28.980407 2026] [:error] [pid 53832:tid 53845] [client 20.91.250.199:38807] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aecqoNzkuxsE_OhM9UIiKwAAAko"]
[Tue Apr 21 15:43:29.517113 2026] [:error] [pid 4823:tid 4873] [client 20.91.250.199:41048] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqofc8mke3PfHqsxHENAAAAZQ"]
[Tue Apr 21 15:43:29.858784 2026] [:error] [pid 53832:tid 53838] [client 20.91.250.199:32696] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aecqodzkuxsE_OhM9UIiNQAAAkM"]
[Tue Apr 21 15:43:30.202888 2026] [:error] [pid 53832:tid 53840] [client 20.91.250.199:29552] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecqotzkuxsE_OhM9UIiOgAAAkU"]
[Tue Apr 21 15:43:30.588015 2026] [:error] [pid 53832:tid 53857] [client 20.91.250.199:39871] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aecqotzkuxsE_OhM9UIiQgAAAlY"]
[Tue Apr 21 15:43:31.122860 2026] [:error] [pid 53832:tid 53845] [client 20.91.250.199:29997] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecqo9zkuxsE_OhM9UIiTQAAAko"]
[Tue Apr 21 15:43:31.500558 2026] [:error] [pid 4823:tid 4874] [client 20.91.250.199:59590] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/simple.php"] [unique_id "aecqo_c8mke3PfHqsxHERQAAAZU"]
[Tue Apr 21 15:43:32.340941 2026] [:error] [pid 4823:tid 4858] [client 20.91.250.199:42467] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ew.php"] [unique_id "aecqpPc8mke3PfHqsxHEUQAAAYU"]
[Tue Apr 21 15:43:32.440091 2026] [:error] [pid 4823:tid 4876] [client 20.91.250.199:55475] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecqpPc8mke3PfHqsxHEVQAAAZc"]
[Tue Apr 21 15:43:33.235271 2026] [:error] [pid 4823:tid 4857] [client 20.91.250.199:39366] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ew.php"] [unique_id "aecqpfc8mke3PfHqsxHEYQAAAYQ"]
[Tue Apr 21 15:43:33.252504 2026] [:error] [pid 4823:tid 4858] [client 20.91.250.199:29533] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecqpfc8mke3PfHqsxHEYgAAAYU"]
[Tue Apr 21 15:43:34.121906 2026] [:error] [pid 4823:tid 4875] [client 20.91.250.199:29560] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqpvc8mke3PfHqsxHEbwAAAZY"]
[Tue Apr 21 15:43:34.825086 2026] [:error] [pid 54080:tid 54101] [client 20.91.250.199:42463] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqpozEbQHHxtmWbaZccwAAAtM"]
[Tue Apr 21 15:43:34.878753 2026] [:error] [pid 54080:tid 54096] [client 20.91.250.199:20385] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ew.php"] [unique_id "aecqpozEbQHHxtmWbaZcdAAAAs4"]
[Tue Apr 21 15:43:35.441634 2026] [:error] [pid 35321:tid 35389] [client 20.91.250.199:2845] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqpzeHLhVUuu8cVXy6IwAAAEU"]
[Tue Apr 21 15:43:36.252705 2026] [:error] [pid 35321:tid 35407] [client 20.91.250.199:52808] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ew.php"] [unique_id "aecqqDeHLhVUuu8cVXy6KAAAAFc"]
[Tue Apr 21 15:43:36.402617 2026] [:error] [pid 4823:tid 4870] [client 20.91.250.199:26421] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqqPc8mke3PfHqsxHEhAAAAZE"]
[Tue Apr 21 15:43:37.131631 2026] [:error] [pid 35320:tid 35344] [client 20.91.250.199:37994] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aecqqYJW6fdXWO6agMEl5wAAAA4"]
[Tue Apr 21 15:43:38.017954 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:52827] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aecqqtzkuxsE_OhM9UIiawAAAk0"]
[Tue Apr 21 15:43:38.874296 2026] [:error] [pid 4823:tid 4873] [client 20.91.250.199:52837] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aecqqvc8mke3PfHqsxHEowAAAZQ"]
[Tue Apr 21 15:43:39.684337 2026] [:error] [pid 53832:tid 53851] [client 20.91.250.199:29518] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file21.php"] [unique_id "aecqq9zkuxsE_OhM9UIifwAAAlA"]
[Tue Apr 21 15:43:40.290100 2026] [:error] [pid 35321:tid 35401] [client 20.91.250.199:52815] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqrDeHLhVUuu8cVXy6PAAAAFE"]
[Tue Apr 21 15:43:40.396004 2026] [:error] [pid 35321:tid 35398] [client 20.91.250.199:47777] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hypo.php"] [unique_id "aecqrDeHLhVUuu8cVXy6PgAAAE4"]
[Tue Apr 21 15:43:41.730969 2026] [:error] [pid 4823:tid 4877] [client 20.91.250.199:2827] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqrfc8mke3PfHqsxHEtwAAAZg"]
[Tue Apr 21 15:43:41.799341 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:55365] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hypo.php"] [unique_id "aecqrTeHLhVUuu8cVXy6TwAAAFY"]
[Tue Apr 21 15:43:42.377028 2026] [:error] [pid 53832:tid 53849] [client 20.91.250.199:60384] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hypo.php"] [unique_id "aecqrtzkuxsE_OhM9UIilwAAAk4"]
[Tue Apr 21 15:43:42.840644 2026] [:error] [pid 53832:tid 53838] [client 20.91.250.199:47756] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqrtzkuxsE_OhM9UIimQAAAkM"]
[Tue Apr 21 15:43:43.455475 2026] [:error] [pid 35321:tid 35386] [client 20.91.250.199:2120] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hypo.php"] [unique_id "aecqrzeHLhVUuu8cVXy6XQAAAEI"]
[Tue Apr 21 15:43:43.794726 2026] [:error] [pid 53978:tid 53987] [client 20.91.250.199:2118] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqr51ivsR4hcOSQba4cgAAAoc"]
[Tue Apr 21 15:43:45.409549 2026] [:error] [pid 35321:tid 35408] [client 20.91.250.199:60393] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqsTeHLhVUuu8cVXy6cQAAAFg"]
[Tue Apr 21 15:43:47.325634 2026] [:error] [pid 54080:tid 54100] [client 20.91.250.199:33865] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqs4zEbQHHxtmWbaZcoAAAAtI"]
[Tue Apr 21 15:43:48.194387 2026] [:error] [pid 4823:tid 4873] [client 20.91.250.199:44503] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqtPc8mke3PfHqsxHE7wAAAZQ"]
[Tue Apr 21 15:43:49.266886 2026] [:error] [pid 35321:tid 35396] [client 20.91.250.199:26414] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/file18.php"] [unique_id "aecqtTeHLhVUuu8cVXy6kwAAAEw"]
[Tue Apr 21 15:43:50.785137 2026] [:error] [pid 53832:tid 53837] [client 20.91.250.199:37993] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecqttzkuxsE_OhM9UIiqQAAAkI"]
[Tue Apr 21 15:43:51.919326 2026] [:error] [pid 35321:tid 35407] [client 20.91.250.199:36965] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecqtzeHLhVUuu8cVXy6owAAAFc"]
[Tue Apr 21 15:43:52.828333 2026] [:error] [pid 54080:tid 54085] [client 20.91.250.199:33099] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecquIzEbQHHxtmWbaZcuwAAAsM"]
[Tue Apr 21 15:43:54.347957 2026] [:error] [pid 53832:tid 53842] [client 20.91.250.199:41752] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aecqutzkuxsE_OhM9UIixAAAAkc"]
[Tue Apr 21 15:43:55.204362 2026] [:error] [pid 53832:tid 53851] [client 20.91.250.199:41735] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqu9zkuxsE_OhM9UIiyQAAAlA"]
[Tue Apr 21 15:43:56.413176 2026] [:error] [pid 53832:tid 53848] [client 20.91.250.199:33876] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqvNzkuxsE_OhM9UIi1AAAAk0"]
[Tue Apr 21 15:43:57.710325 2026] [:error] [pid 53832:tid 53856] [client 20.91.250.199:41764] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqvdzkuxsE_OhM9UIi4wAAAlU"]
[Tue Apr 21 15:43:58.928093 2026] [:error] [pid 35320:tid 35351] [client 20.91.250.199:50206] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aecqvoJW6fdXWO6agMEmMwAAABU"]
[Tue Apr 21 15:44:00.067528 2026] [:error] [pid 35321:tid 35405] [client 20.91.250.199:50217] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqwDeHLhVUuu8cVXy6xQAAAFU"]
[Tue Apr 21 15:44:01.645135 2026] [:error] [pid 35321:tid 35406] [client 20.91.250.199:50178] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqwTeHLhVUuu8cVXy61AAAAFY"]
[Tue Apr 21 15:44:02.751464 2026] [:error] [pid 35321:tid 35403] [client 20.91.250.199:23201] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqwjeHLhVUuu8cVXy63AAAAFM"]
[Tue Apr 21 15:44:03.795829 2026] [:error] [pid 35321:tid 35387] [client 20.91.250.199:25250] [client 20.91.250.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/chosen.php"] [unique_id "aecqwzeHLhVUuu8cVXy66wAAAEM"]
[Tue Apr 21 16:38:23.187514 2026] [:error] [pid 4823:tid 4862] [client 172.213.24.111:39898] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Tue Apr 21 16:38:23.429829 2026] [:error] [pid 4823:tid 4877] [client 172.213.24.111:39898] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 16:38:23.665821 2026] [:error] [pid 4823:tid 4859] [client 172.213.24.111:39898] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Tue Apr 21 16:38:23.902196 2026] [:error] [pid 4823:tid 4868] [client 172.213.24.111:39898] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Tue Apr 21 16:38:24.155662 2026] [:error] [pid 4823:tid 4866] [client 172.213.24.111:39898] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 21 16:38:24.392483 2026] [:error] [pid 4823:tid 4858] [client 172.213.24.111:39898] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Tue Apr 21 16:38:24.778570 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:48935] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Tue Apr 21 16:38:24.877562 2026] [:error] [pid 4823:tid 4863] [client 172.213.24.111:39898] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 16:38:25.012437 2026] [:error] [pid 54080:tid 54084] [client 172.213.24.111:48935] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aec3gYzEbQHHxtmWbaZ3KAAAAsI"]
[Tue Apr 21 16:38:25.120644 2026] [:error] [pid 4823:tid 4865] [client 172.213.24.111:39898] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "aec3gfc8mke3PfHqsxHamwAAAYw"]
[Tue Apr 21 16:38:28.043124 2026] [:error] [pid 54080:tid 54101] [client 172.213.24.111:52713] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aec3hIzEbQHHxtmWbaZ3MgAAAtM"]
[Tue Apr 21 16:38:28.070752 2026] [:error] [pid 54080:tid 54084] [client 172.213.24.111:60051] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "aec3hIzEbQHHxtmWbaZ3NQAAAsI"]
[Tue Apr 21 16:38:29.937272 2026] [:error] [pid 35320:tid 35340] [client 172.213.24.111:60084] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "aec3hYJW6fdXWO6agMFCMwAAAAo"]
[Tue Apr 21 16:38:31.725049 2026] [:error] [pid 35415:tid 35433] [client 172.213.24.111:36626] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aec3h0iqDinI4_22zzhfpQAAAMY"]
[Tue Apr 21 16:38:32.186526 2026] [:error] [pid 35320:tid 35350] [client 172.213.24.111:61748] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "aec3iIJW6fdXWO6agMFCTgAAABQ"]
[Tue Apr 21 16:38:33.259867 2026] [:error] [pid 35320:tid 35344] [client 172.213.24.111:10537] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "aec3iYJW6fdXWO6agMFCXAAAAA4"]
[Tue Apr 21 16:38:33.427567 2026] [:error] [pid 54080:tid 54087] [client 172.213.24.111:38216] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "aec3iYzEbQHHxtmWbaZ3WgAAAsU"]
[Tue Apr 21 16:38:34.466820 2026] [:error] [pid 54080:tid 54082] [client 172.213.24.111:36637] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "aec3iozEbQHHxtmWbaZ3ZgAAAsA"]
[Tue Apr 21 16:38:35.575751 2026] [:error] [pid 54080:tid 54095] [client 172.213.24.111:48932] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "aec3i4zEbQHHxtmWbaZ3aAAAAs0"]
[Tue Apr 21 16:38:36.347886 2026] [:error] [pid 35320:tid 35343] [client 172.213.24.111:60100] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "aec3jIJW6fdXWO6agMFCZQAAAA0"]
[Tue Apr 21 16:38:36.948516 2026] [:error] [pid 35320:tid 35351] [client 172.213.24.111:36625] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "aec3jIJW6fdXWO6agMFCagAAABU"]
[Tue Apr 21 16:38:38.452339 2026] [:error] [pid 53731:tid 53746] [client 172.213.24.111:48921] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec3jl2I9THUR-bRVGzoKgAAAgs"]
[Tue Apr 21 16:38:41.313911 2026] [:error] [pid 53832:tid 53838] [client 172.213.24.111:40476] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec3kdzkuxsE_OhM9UI-8gAAAkM"]
[Tue Apr 21 16:38:44.487561 2026] [:error] [pid 54080:tid 54101] [client 172.213.24.111:36635] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec3lIzEbQHHxtmWbaZ3lQAAAtM"]
[Tue Apr 21 16:38:45.019432 2026] [:error] [pid 4777:tid 4803] [client 172.213.24.111:61706] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "aec3laxXur6bykKyLZSP-gAAAQ8"]
[Tue Apr 21 16:38:49.482515 2026] [:error] [pid 4823:tid 4868] [client 172.213.24.111:60084] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec3mfc8mke3PfHqsxHayAAAAY8"]
[Tue Apr 21 16:38:51.347299 2026] [:error] [pid 35320:tid 35349] [client 172.213.24.111:44096] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec3m4JW6fdXWO6agMFCnQAAABM"]
[Tue Apr 21 16:38:55.626688 2026] [:error] [pid 35320:tid 35339] [client 172.213.24.111:61064] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec3n4JW6fdXWO6agMFCpgAAAAk"]
[Tue Apr 21 16:39:05.705715 2026] [:error] [pid 35320:tid 35335] [client 172.213.24.111:48006] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ta0ol.php"] [unique_id "aec3qYJW6fdXWO6agMFCtAAAAAU"]
[Tue Apr 21 16:39:10.555003 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:61079] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec3roJW6fdXWO6agMFCxwAAAAI"]
[Tue Apr 21 16:39:13.389572 2026] [:error] [pid 35320:tid 35340] [client 172.213.24.111:36671] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aec3sYJW6fdXWO6agMFC2AAAAAo"]
[Tue Apr 21 16:39:14.940075 2026] [:error] [pid 35320:tid 35333] [client 172.213.24.111:41235] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aec3soJW6fdXWO6agMFC3wAAAAM"]
[Tue Apr 21 16:39:16.193758 2026] [:error] [pid 35320:tid 35348] [client 172.213.24.111:8627] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aec3tIJW6fdXWO6agMFC5AAAABI"]
[Tue Apr 21 16:39:17.052712 2026] [:error] [pid 54080:tid 54084] [client 172.213.24.111:42808] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec3tYzEbQHHxtmWbaZ39wAAAsI"]
[Tue Apr 21 16:39:17.221821 2026] [:error] [pid 54080:tid 54101] [client 172.213.24.111:44976] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aligk.php"] [unique_id "aec3tYzEbQHHxtmWbaZ3-AAAAtM"]
[Tue Apr 21 16:39:18.267996 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:53392] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aec3tozEbQHHxtmWbaZ3_QAAAtQ"]
[Tue Apr 21 16:39:19.169619 2026] [:error] [pid 4777:tid 4812] [client 172.213.24.111:40882] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aec3t6xXur6bykKyLZSQBgAAARg"]
[Tue Apr 21 16:39:19.227184 2026] [:error] [pid 4823:tid 4866] [client 172.213.24.111:53395] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec3t_c8mke3PfHqsxHa6QAAAY0"]
[Tue Apr 21 16:39:20.417873 2026] [:error] [pid 54080:tid 54092] [client 172.213.24.111:55360] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aec3uIzEbQHHxtmWbaZ4BAAAAso"]
[Tue Apr 21 16:39:22.144700 2026] [:error] [pid 54080:tid 54085] [client 172.213.24.111:44978] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/users.php"] [unique_id "aec3uozEbQHHxtmWbaZ4CwAAAsM"]
[Tue Apr 21 16:39:22.730982 2026] [:error] [pid 54080:tid 54095] [client 172.213.24.111:41182] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec3uozEbQHHxtmWbaZ4DwAAAs0"]
[Tue Apr 21 16:39:24.570886 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:57216] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 16:39:24.809333 2026] [:error] [pid 54080:tid 54099] [client 172.213.24.111:57216] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Tue Apr 21 16:39:25.048011 2026] [:error] [pid 54080:tid 54095] [client 172.213.24.111:57216] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Tue Apr 21 16:39:25.284581 2026] [:error] [pid 54080:tid 54100] [client 172.213.24.111:57216] File does not exist: /usr/local/apache/htdocs/suspended-page/wziar1.php
[Tue Apr 21 16:39:25.359558 2026] [:error] [pid 35321:tid 35402] [client 172.213.24.111:40853] File does not exist: /usr/local/apache/htdocs/suspended-page/n3yUmQ6Q9xwQ8ocdefault.php
[Tue Apr 21 16:39:25.607056 2026] [:error] [pid 35321:tid 35389] [client 172.213.24.111:40853] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 21 16:39:25.879001 2026] [:error] [pid 35321:tid 35407] [client 172.213.24.111:40853] File does not exist: /usr/local/apache/htdocs/suspended-page/ctex1.php
[Tue Apr 21 16:39:26.138443 2026] [:error] [pid 35321:tid 35406] [client 172.213.24.111:40853] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Tue Apr 21 16:39:26.157438 2026] [:error] [pid 54080:tid 54096] [client 172.213.24.111:57216] File does not exist: /usr/local/apache/htdocs/suspended-page/7logs.php
[Tue Apr 21 16:39:26.372474 2026] [:error] [pid 35321:tid 35400] [client 172.213.24.111:40853] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec3vjeHLhVUuu8cVXzhgwAAAFA"]
[Tue Apr 21 16:39:26.558721 2026] [:error] [pid 54080:tid 54101] [client 172.213.24.111:57216] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec3vozEbQHHxtmWbaZ4HwAAAtM"]
[Tue Apr 21 16:39:27.505222 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:57263] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec3v4JW6fdXWO6agMFDBgAAAAI"]
[Tue Apr 21 16:39:28.234140 2026] [:error] [pid 35320:tid 35338] [client 172.213.24.111:47169] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec3wIJW6fdXWO6agMFDBwAAAAg"]
[Tue Apr 21 16:39:28.718963 2026] [:error] [pid 35320:tid 35330] [client 172.213.24.111:57235] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec3wIJW6fdXWO6agMFDCwAAAAA"]
[Tue Apr 21 16:39:29.053508 2026] [:error] [pid 54080:tid 54082] [client 172.213.24.111:61796] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec3wYzEbQHHxtmWbaZ4IQAAAsA"]
[Tue Apr 21 16:39:29.753667 2026] [:error] [pid 35320:tid 35343] [client 172.213.24.111:48042] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec3wYJW6fdXWO6agMFDEAAAAA0"]
[Tue Apr 21 16:39:30.350513 2026] [:error] [pid 53832:tid 53858] [client 172.213.24.111:48044] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec3wtzkuxsE_OhM9UI_IwAAAlc"]
[Tue Apr 21 16:39:31.447468 2026] [:error] [pid 35320:tid 35330] [client 172.213.24.111:55375] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec3w4JW6fdXWO6agMFDFQAAAAA"]
[Tue Apr 21 16:39:32.267451 2026] [:error] [pid 53832:tid 53837] [client 172.213.24.111:41155] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec3xNzkuxsE_OhM9UI_JQAAAkI"]
[Tue Apr 21 16:39:32.558682 2026] [:error] [pid 4823:tid 4872] [client 172.213.24.111:53389] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec3xPc8mke3PfHqsxHa6gAAAZM"]
[Tue Apr 21 16:39:33.525937 2026] [:error] [pid 35415:tid 35445] [client 172.213.24.111:47197] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec3xUiqDinI4_22zzhftgAAANI"]
[Tue Apr 21 16:39:33.808354 2026] [:error] [pid 35320:tid 35346] [client 172.213.24.111:48024] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec3xYJW6fdXWO6agMFDGQAAABA"]
[Tue Apr 21 16:39:34.302977 2026] [:error] [pid 53978:tid 53990] [client 172.213.24.111:48018] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec3xp1ivsR4hcOSQbbCzQAAAoo"]
[Tue Apr 21 16:39:35.340083 2026] [:error] [pid 53832:tid 53836] [client 172.213.24.111:42794] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec3x9zkuxsE_OhM9UI_JwAAAkE"]
[Tue Apr 21 16:39:35.640399 2026] [:error] [pid 35320:tid 35348] [client 172.213.24.111:42795] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec3x4JW6fdXWO6agMFDGwAAABI"]
[Tue Apr 21 16:39:36.691117 2026] [:error] [pid 35320:tid 35347] [client 172.213.24.111:40881] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec3yIJW6fdXWO6agMFDHAAAABE"]
[Tue Apr 21 16:39:37.133846 2026] [:error] [pid 35320:tid 35334] [client 172.213.24.111:41207] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec3yYJW6fdXWO6agMFDHwAAAAQ"]
[Tue Apr 21 16:39:37.894908 2026] [:error] [pid 4777:tid 4799] [client 172.213.24.111:55381] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "aec3yaxXur6bykKyLZSQCQAAAQs"]
[Tue Apr 21 16:39:38.556743 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:48954] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "aec3yl2I9THUR-bRVGzoVAAAAhA"]
[Tue Apr 21 16:39:39.751618 2026] [:error] [pid 53731:tid 53741] [client 172.213.24.111:41192] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "aec3y12I9THUR-bRVGzoVgAAAgY"]
[Tue Apr 21 16:39:40.280459 2026] [:error] [pid 35320:tid 35353] [client 172.213.24.111:47179] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec3zIJW6fdXWO6agMFDIgAAABc"]
[Tue Apr 21 16:39:40.654721 2026] [:error] [pid 4823:tid 4869] [client 172.213.24.111:47207] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "aec3zPc8mke3PfHqsxHa8AAAAZA"]
[Tue Apr 21 16:39:41.400692 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:41185] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec3zZ1ivsR4hcOSQbbC0wAAApY"]
[Tue Apr 21 16:39:41.631484 2026] [:error] [pid 54080:tid 54085] [client 172.213.24.111:47217] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec3zYzEbQHHxtmWbaZ4JwAAAsM"]
[Tue Apr 21 16:39:42.200756 2026] [:error] [pid 54080:tid 54106] [client 172.213.24.111:41153] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec3zozEbQHHxtmWbaZ4KQAAAtg"]
[Tue Apr 21 16:39:42.873848 2026] [:error] [pid 53832:tid 53843] [client 172.213.24.111:41159] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec3ztzkuxsE_OhM9UI_LAAAAkg"]
[Tue Apr 21 16:39:43.029375 2026] [:error] [pid 54080:tid 54086] [client 172.213.24.111:61822] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec3z4zEbQHHxtmWbaZ4MAAAAsQ"]
[Tue Apr 21 16:39:44.275530 2026] [:error] [pid 54080:tid 54088] [client 172.213.24.111:47196] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "aec30IzEbQHHxtmWbaZ4NQAAAsY"]
[Tue Apr 21 16:39:45.381511 2026] [:error] [pid 4777:tid 4803] [client 172.213.24.111:47180] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec30axXur6bykKyLZSQDwAAAQ8"]
[Tue Apr 21 16:39:46.163314 2026] [:error] [pid 53731:tid 53756] [client 172.213.24.111:47202] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec30l2I9THUR-bRVGzoWwAAAhQ"]
[Tue Apr 21 16:39:46.382729 2026] [:error] [pid 35320:tid 35348] [client 172.213.24.111:44959] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec30oJW6fdXWO6agMFDMgAAABI"]
[Tue Apr 21 16:39:47.131094 2026] [:error] [pid 4823:tid 4863] [client 172.213.24.111:57226] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec30_c8mke3PfHqsxHa-AAAAYo"]
[Tue Apr 21 16:39:48.164977 2026] [:error] [pid 53731:tid 53738] [client 172.213.24.111:61767] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "aec31F2I9THUR-bRVGzoXwAAAgM"]
[Tue Apr 21 16:39:48.349352 2026] [:error] [pid 4777:tid 4793] [client 172.213.24.111:57274] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec31KxXur6bykKyLZSQEAAAAQU"]
[Tue Apr 21 16:39:48.982281 2026] [:error] [pid 35320:tid 35346] [client 172.213.24.111:48063] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec31IJW6fdXWO6agMFDNgAAABA"]
[Tue Apr 21 16:39:50.839334 2026] [:error] [pid 4823:tid 4855] [client 172.213.24.111:44967] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec31vc8mke3PfHqsxHa_QAAAYI"]
[Tue Apr 21 16:39:51.244174 2026] [:error] [pid 4777:tid 4807] [client 172.213.24.111:44945] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec316xXur6bykKyLZSQEQAAARM"]
[Tue Apr 21 16:39:52.166223 2026] [:error] [pid 35320:tid 35341] [client 172.213.24.111:42792] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec32IJW6fdXWO6agMFDRgAAAAs"]
[Tue Apr 21 16:39:53.165154 2026] [:error] [pid 53978:tid 53986] [client 172.213.24.111:61798] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aec32Z1ivsR4hcOSQbbC1AAAAoY"]
[Tue Apr 21 16:39:54.582449 2026] [:error] [pid 35415:tid 35445] [client 172.213.24.111:57251] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec32kiqDinI4_22zzhfxAAAANI"]
[Tue Apr 21 16:39:56.013091 2026] [:error] [pid 4777:tid 4796] [client 172.213.24.111:44973] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec33KxXur6bykKyLZSQEwAAAQg"]
[Tue Apr 21 16:39:58.676566 2026] [:error] [pid 54080:tid 54095] [client 172.213.24.111:42806] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec33ozEbQHHxtmWbaZ4QQAAAs0"]
[Tue Apr 21 16:39:59.150587 2026] [:error] [pid 35321:tid 35403] [client 172.213.24.111:40889] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec33zeHLhVUuu8cVXzhjgAAAFM"]
[Tue Apr 21 16:40:00.340994 2026] [:error] [pid 54080:tid 54100] [client 172.213.24.111:8587] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec34IzEbQHHxtmWbaZ4RAAAAtI"]
[Tue Apr 21 16:40:01.973707 2026] [:error] [pid 53731:tid 53740] [client 172.213.24.111:55418] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec34V2I9THUR-bRVGzobQAAAgU"]
[Tue Apr 21 16:40:02.639815 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:55401] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec34jeHLhVUuu8cVXzhkgAAAEw"]
[Tue Apr 21 16:40:03.909932 2026] [:error] [pid 4823:tid 4864] [client 172.213.24.111:55364] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "aec34_c8mke3PfHqsxHbBAAAAYs"]
[Tue Apr 21 16:40:04.824644 2026] [:error] [pid 54080:tid 54103] [client 172.213.24.111:55418] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec35IzEbQHHxtmWbaZ4SwAAAtU"]
[Tue Apr 21 16:40:05.088735 2026] [:error] [pid 35322:tid 35360] [client 172.213.24.111:47201] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec35aPoAfV40BTfVKzLagAAAIM"]
[Tue Apr 21 16:40:06.009880 2026] [:error] [pid 53978:tid 53992] [client 172.213.24.111:36930] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec35p1ivsR4hcOSQbbC3wAAAow"]
[Tue Apr 21 16:40:06.128789 2026] [:error] [pid 54080:tid 54099] [client 172.213.24.111:36963] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec35ozEbQHHxtmWbaZ4TgAAAtE"]
[Tue Apr 21 16:40:06.710526 2026] [:error] [pid 4777:tid 4802] [client 172.213.24.111:8592] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec35qxXur6bykKyLZSQFgAAAQ4"]
[Tue Apr 21 16:40:07.258493 2026] [:error] [pid 35321:tid 35402] [client 172.213.24.111:57245] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec35zeHLhVUuu8cVXzhmAAAAFI"]
[Tue Apr 21 16:40:08.022651 2026] [:error] [pid 35320:tid 35340] [client 172.213.24.111:47230] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec36IJW6fdXWO6agMFDZwAAAAo"]
[Tue Apr 21 16:40:08.255910 2026] [:error] [pid 35320:tid 35343] [client 172.213.24.111:60581] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec36IJW6fdXWO6agMFDaAAAAA0"]
[Tue Apr 21 16:40:09.161306 2026] [:error] [pid 35320:tid 35352] [client 172.213.24.111:47170] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec36YJW6fdXWO6agMFDbAAAABY"]
[Tue Apr 21 16:40:09.689655 2026] [:error] [pid 35320:tid 35331] [client 172.213.24.111:44958] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "aec36YJW6fdXWO6agMFDbgAAAAE"]
[Tue Apr 21 16:40:09.870018 2026] [:error] [pid 53978:tid 53981] [client 172.213.24.111:40885] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec36Z1ivsR4hcOSQbbC5QAAAoE"]
[Tue Apr 21 16:40:10.591688 2026] [:error] [pid 35320:tid 35347] [client 172.213.24.111:42235] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec36oJW6fdXWO6agMFDcQAAABE"]
[Tue Apr 21 16:40:10.825625 2026] [:error] [pid 35321:tid 35390] [client 172.213.24.111:61782] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec36jeHLhVUuu8cVXzhnQAAAEY"]
[Tue Apr 21 16:40:11.834043 2026] [:error] [pid 35321:tid 35392] [client 172.213.24.111:57231] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec36zeHLhVUuu8cVXzhoAAAAEg"]
[Tue Apr 21 16:40:12.378173 2026] [:error] [pid 53832:tid 53854] [client 172.213.24.111:60590] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec37NzkuxsE_OhM9UI_PQAAAlM"]
[Tue Apr 21 16:40:13.616282 2026] [:error] [pid 35321:tid 35393] [client 172.213.24.111:60602] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec37TeHLhVUuu8cVXzhpAAAAEk"]
[Tue Apr 21 16:40:15.020029 2026] [:error] [pid 35320:tid 35335] [client 172.213.24.111:39463] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec374JW6fdXWO6agMFDgAAAAAU"]
[Tue Apr 21 16:40:15.393291 2026] [:error] [pid 54080:tid 54086] [client 172.213.24.111:36946] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec374zEbQHHxtmWbaZ4VwAAAsQ"]
[Tue Apr 21 16:40:16.280345 2026] [:error] [pid 54080:tid 54093] [client 172.213.24.111:41211] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "aec38IzEbQHHxtmWbaZ4XAAAAss"]
[Tue Apr 21 16:40:17.127439 2026] [:error] [pid 4823:tid 4856] [client 172.213.24.111:40854] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec38fc8mke3PfHqsxHbDQAAAYM"]
[Tue Apr 21 16:40:17.264909 2026] [:error] [pid 4823:tid 4860] [client 172.213.24.111:39436] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec38fc8mke3PfHqsxHbDgAAAYc"]
[Tue Apr 21 16:40:18.509314 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:48013] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec38oJW6fdXWO6agMFDhAAAAAc"]
[Tue Apr 21 16:40:18.762055 2026] [:error] [pid 53978:tid 53986] [client 172.213.24.111:36961] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "aec38p1ivsR4hcOSQbbC6wAAAoY"]
[Tue Apr 21 16:40:20.472426 2026] [:error] [pid 53978:tid 53996] [client 172.213.24.111:8628] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec39J1ivsR4hcOSQbbC7gAAApA"]
[Tue Apr 21 16:40:21.227923 2026] [:error] [pid 4823:tid 4858] [client 172.213.24.111:55377] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "aec39fc8mke3PfHqsxHbEwAAAYU"]
[Tue Apr 21 16:40:21.761014 2026] [:error] [pid 35320:tid 35334] [client 172.213.24.111:41163] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/click.php"] [unique_id "aec39YJW6fdXWO6agMFDiAAAAAQ"]
[Tue Apr 21 16:40:25.418852 2026] [:error] [pid 4777:tid 4789] [client 172.213.24.111:42225] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "aec3-axXur6bykKyLZSQHgAAAQE"]
[Tue Apr 21 16:40:25.600887 2026] [:error] [pid 35320:tid 35336] [client 172.213.24.111:41198] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gpt-sh.php"] [unique_id "aec3-YJW6fdXWO6agMFDkwAAAAY"]
[Tue Apr 21 16:40:28.364689 2026] [:error] [pid 53832:tid 53853] [client 172.213.24.111:42202] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Tue Apr 21 16:40:28.619318 2026] [:error] [pid 53832:tid 53854] [client 172.213.24.111:42202] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Tue Apr 21 16:40:28.857422 2026] [:error] [pid 53832:tid 53839] [client 172.213.24.111:42202] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Tue Apr 21 16:40:29.117038 2026] [:error] [pid 53832:tid 53857] [client 172.213.24.111:42202] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue Apr 21 16:40:29.580107 2026] [:error] [pid 35321:tid 35399] [client 172.213.24.111:42190] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Tue Apr 21 16:40:29.596662 2026] [:error] [pid 53832:tid 53844] [client 172.213.24.111:42202] File does not exist: /usr/local/apache/htdocs/suspended-page/bfil.php
[Tue Apr 21 16:40:29.822778 2026] [:error] [pid 35321:tid 35384] [client 172.213.24.111:42190] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Tue Apr 21 16:40:29.835247 2026] [:error] [pid 53832:tid 53838] [client 172.213.24.111:42202] File does not exist: /usr/local/apache/htdocs/suspended-page/abrand.php
[Tue Apr 21 16:40:30.071100 2026] [:error] [pid 35321:tid 35393] [client 172.213.24.111:42190] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Tue Apr 21 16:40:30.071980 2026] [:error] [pid 53832:tid 53856] [client 172.213.24.111:42202] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 16:40:30.324988 2026] [:error] [pid 35321:tid 35407] [client 172.213.24.111:42190] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec3_jeHLhVUuu8cVXzhuwAAAFc"]
[Tue Apr 21 16:40:30.889352 2026] [:error] [pid 53832:tid 53835] [client 172.213.24.111:42202] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec3_tzkuxsE_OhM9UI_YgAAAkA"]
[Tue Apr 21 16:40:33.003906 2026] [:error] [pid 53832:tid 53843] [client 172.213.24.111:59536] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec4AdzkuxsE_OhM9UI_YwAAAkg"]
[Tue Apr 21 16:40:35.427156 2026] [:error] [pid 35320:tid 35350] [client 172.213.24.111:36970] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec4A4JW6fdXWO6agMFDogAAABQ"]
[Tue Apr 21 16:40:36.752761 2026] [:error] [pid 54080:tid 54101] [client 172.213.24.111:38298] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec4BIzEbQHHxtmWbaZ4cgAAAtM"]
[Tue Apr 21 16:40:38.429100 2026] [:error] [pid 35320:tid 35348] [client 172.213.24.111:64864] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec4BoJW6fdXWO6agMFDpQAAABI"]
[Tue Apr 21 16:40:38.831835 2026] [:error] [pid 35321:tid 35388] [client 172.213.24.111:10321] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec4BjeHLhVUuu8cVXzh1wAAAEQ"]
[Tue Apr 21 16:40:40.416042 2026] [:error] [pid 53832:tid 53838] [client 172.213.24.111:55740] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4CNzkuxsE_OhM9UI_egAAAkM"]
[Tue Apr 21 16:40:42.237624 2026] [:error] [pid 35415:tid 35446] [client 172.213.24.111:44662] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4CkiqDinI4_22zzhfywAAANM"]
[Tue Apr 21 16:40:43.319601 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:64281] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4C4JW6fdXWO6agMFDrAAAAAI"]
[Tue Apr 21 16:40:44.139491 2026] [:error] [pid 53832:tid 53855] [client 172.213.24.111:52636] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4DNzkuxsE_OhM9UI_fAAAAlQ"]
[Tue Apr 21 16:40:44.306446 2026] [:error] [pid 53832:tid 53857] [client 172.213.24.111:64305] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec4DNzkuxsE_OhM9UI_fQAAAlY"]
[Tue Apr 21 16:40:44.789549 2026] [:error] [pid 35321:tid 35387] [client 172.213.24.111:37376] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4DDeHLhVUuu8cVXzh5gAAAEM"]
[Tue Apr 21 16:40:45.368450 2026] [:error] [pid 35320:tid 35330] [client 172.213.24.111:44648] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4DYJW6fdXWO6agMFDsAAAAAA"]
[Tue Apr 21 16:40:45.778339 2026] [:error] [pid 35320:tid 35352] [client 172.213.24.111:49859] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec4DYJW6fdXWO6agMFDuAAAABY"]
[Tue Apr 21 16:40:45.983203 2026] [:error] [pid 53832:tid 53856] [client 172.213.24.111:56095] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4DdzkuxsE_OhM9UI_gAAAAlU"]
[Tue Apr 21 16:40:46.601437 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:48258] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4DoJW6fdXWO6agMFDvQAAAAw"]
[Tue Apr 21 16:40:47.264373 2026] [:error] [pid 35320:tid 35334] [client 172.213.24.111:63919] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4D4JW6fdXWO6agMFDxQAAAAQ"]
[Tue Apr 21 16:40:47.794282 2026] [:error] [pid 35320:tid 35341] [client 172.213.24.111:43358] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec4D4JW6fdXWO6agMFDzwAAAAs"]
[Tue Apr 21 16:40:48.093192 2026] [:error] [pid 35321:tid 35400] [client 172.213.24.111:56096] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4EDeHLhVUuu8cVXzh8gAAAFA"]
[Tue Apr 21 16:40:48.699751 2026] [:error] [pid 35321:tid 35386] [client 172.213.24.111:43363] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4EDeHLhVUuu8cVXzh-QAAAEI"]
[Tue Apr 21 16:40:49.736828 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:37429] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4ETeHLhVUuu8cVXzh_wAAAEw"]
[Tue Apr 21 16:40:50.327595 2026] [:error] [pid 4823:tid 4862] [client 172.213.24.111:49871] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec4Evc8mke3PfHqsxHbVgAAAYk"]
[Tue Apr 21 16:40:50.471414 2026] [:error] [pid 54080:tid 54089] [client 172.213.24.111:48281] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4EozEbQHHxtmWbaZ4gQAAAsc"]
[Tue Apr 21 16:40:51.191218 2026] [:error] [pid 54080:tid 54104] [client 172.213.24.111:43355] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4E4zEbQHHxtmWbaZ4hQAAAtY"]
[Tue Apr 21 16:40:51.464662 2026] [:error] [pid 54080:tid 54085] [client 172.213.24.111:37387] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec4E4zEbQHHxtmWbaZ4iAAAAsM"]
[Tue Apr 21 16:40:52.153498 2026] [:error] [pid 54080:tid 54098] [client 172.213.24.111:37431] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4FIzEbQHHxtmWbaZ4jAAAAtA"]
[Tue Apr 21 16:40:52.272860 2026] [:error] [pid 4823:tid 4866] [client 172.213.24.111:37751] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec4FPc8mke3PfHqsxHbWAAAAY0"]
[Tue Apr 21 16:40:53.008019 2026] [:error] [pid 54080:tid 54086] [client 172.213.24.111:37759] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4FYzEbQHHxtmWbaZ4jwAAAsQ"]
[Tue Apr 21 16:40:53.626007 2026] [:error] [pid 35321:tid 35399] [client 172.213.24.111:62310] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec4FTeHLhVUuu8cVXziEQAAAE8"]
[Tue Apr 21 16:40:53.745010 2026] [:error] [pid 35321:tid 35390] [client 172.213.24.111:44864] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aec4FTeHLhVUuu8cVXziEwAAAEY"]
[Tue Apr 21 16:40:54.775123 2026] [:error] [pid 4823:tid 4857] [client 172.213.24.111:37729] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec4Fvc8mke3PfHqsxHbWgAAAYQ"]
[Tue Apr 21 16:40:54.823873 2026] [:error] [pid 35322:tid 35369] [client 172.213.24.111:62302] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aec4FqPoAfV40BTfVKzLeQAAAIw"]
[Tue Apr 21 16:40:55.699545 2026] [:error] [pid 4823:tid 4869] [client 172.213.24.111:43382] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec4F_c8mke3PfHqsxHbWwAAAZA"]
[Tue Apr 21 16:40:56.025598 2026] [:error] [pid 4823:tid 4864] [client 172.213.24.111:49886] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aec4GPc8mke3PfHqsxHbXAAAAYs"]
[Tue Apr 21 16:40:57.585206 2026] [:error] [pid 35320:tid 35347] [client 170.64.221.16:61560] [client 170.64.221.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.221.16, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aec4GYJW6fdXWO6agMFEAgAAABE"]
[Tue Apr 21 16:40:57.589315 2026] [:error] [pid 35320:tid 35347] [client 170.64.221.16:61560] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 21 16:40:57.613356 2026] [:error] [pid 53978:tid 53990] [client 172.213.24.111:49848] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec4GZ1ivsR4hcOSQbbDAAAAAoo"]
[Tue Apr 21 16:40:57.742496 2026] [:error] [pid 35320:tid 35331] [client 172.213.24.111:49817] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "aec4GYJW6fdXWO6agMFEBAAAAAE"]
[Tue Apr 21 16:40:58.766841 2026] [:error] [pid 35320:tid 35346] [client 172.213.24.111:37728] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aec4GoJW6fdXWO6agMFECgAAABA"]
[Tue Apr 21 16:40:59.387663 2026] [:error] [pid 35320:tid 35333] [client 172.213.24.111:45546] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec4G4JW6fdXWO6agMFEDgAAAAM"]
[Tue Apr 21 16:40:59.564436 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:37728] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aec4G4JW6fdXWO6agMFEEAAAAAc"]
[Tue Apr 21 16:41:00.262161 2026] [:error] [pid 53978:tid 53980] [client 172.213.24.111:38869] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aec4HJ1ivsR4hcOSQbbDAQAAAoA"]
[Tue Apr 21 16:41:00.809480 2026] [:error] [pid 4823:tid 4858] [client 172.213.24.111:49503] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec4HPc8mke3PfHqsxHbYQAAAYU"]
[Tue Apr 21 16:41:01.813436 2026] [:error] [pid 53731:tid 53736] [client 172.213.24.111:49828] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec4HV2I9THUR-bRVGzofQAAAgE"]
[Tue Apr 21 16:41:02.669980 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:53454] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "aec4HjeHLhVUuu8cVXziGwAAAFE"]
[Tue Apr 21 16:41:02.887034 2026] [:error] [pid 35320:tid 35350] [client 172.213.24.111:10291] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec4HoJW6fdXWO6agMFEIwAAABQ"]
[Tue Apr 21 16:41:04.126147 2026] [:error] [pid 53832:tid 53849] [client 172.213.24.111:37756] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aec4INzkuxsE_OhM9UI_jQAAAk4"]
[Tue Apr 21 16:41:05.775962 2026] [:error] [pid 54080:tid 54090] [client 172.213.24.111:10259] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aec4IYzEbQHHxtmWbaZ4pAAAAsg"]
[Tue Apr 21 16:41:05.818321 2026] [:error] [pid 35321:tid 35385] [client 172.213.24.111:49523] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec4ITeHLhVUuu8cVXziHgAAAEE"]
[Tue Apr 21 16:41:06.656999 2026] [:error] [pid 35321:tid 35407] [client 172.213.24.111:53468] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec4IjeHLhVUuu8cVXziIQAAAFc"]
[Tue Apr 21 16:41:06.757964 2026] [:error] [pid 54080:tid 54104] [client 172.213.24.111:61146] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aec4IozEbQHHxtmWbaZ4pgAAAtY"]
[Tue Apr 21 16:41:07.390949 2026] [:error] [pid 35321:tid 35398] [client 172.213.24.111:38885] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec4IzeHLhVUuu8cVXziIwAAAE4"]
[Tue Apr 21 16:41:07.540802 2026] [:error] [pid 53832:tid 53853] [client 172.213.24.111:62319] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "aec4I9zkuxsE_OhM9UI_kwAAAlI"]
[Tue Apr 21 16:41:08.203727 2026] [:error] [pid 35321:tid 35402] [client 172.213.24.111:44212] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aec4JDeHLhVUuu8cVXziJQAAAFI"]
[Tue Apr 21 16:41:08.215463 2026] [:error] [pid 35321:tid 35389] [client 172.213.24.111:62330] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec4JDeHLhVUuu8cVXziJgAAAEU"]
[Tue Apr 21 16:41:08.972148 2026] [:error] [pid 35415:tid 35440] [client 172.213.24.111:61173] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec4JEiqDinI4_22zzhfzgAAAM0"]
[Tue Apr 21 16:41:09.437160 2026] [:error] [pid 53832:tid 53841] [client 172.213.24.111:36625] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aec4JdzkuxsE_OhM9UI_lQAAAkY"]
[Tue Apr 21 16:41:09.730406 2026] [:error] [pid 53832:tid 53842] [client 172.213.24.111:53475] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec4JdzkuxsE_OhM9UI_mAAAAkc"]
[Tue Apr 21 16:41:10.037059 2026] [:error] [pid 53832:tid 53838] [client 172.213.24.111:45567] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aec4JtzkuxsE_OhM9UI_mQAAAkM"]
[Tue Apr 21 16:41:10.628215 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:37353] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec4JjeHLhVUuu8cVXziLAAAAFE"]
[Tue Apr 21 16:41:10.924021 2026] [:error] [pid 4823:tid 4855] [client 172.213.24.111:37748] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "aec4Jvc8mke3PfHqsxHbcAAAAYI"]
[Tue Apr 21 16:41:11.296492 2026] [:error] [pid 54080:tid 54092] [client 172.213.24.111:49825] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4J4zEbQHHxtmWbaZ4rQAAAso"]
[Tue Apr 21 16:41:11.937648 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:53470] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aec4J12I9THUR-bRVGzofwAAAhE"]
[Tue Apr 21 16:41:11.994325 2026] [:error] [pid 54080:tid 54099] [client 172.213.24.111:44181] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4J4zEbQHHxtmWbaZ4rwAAAtE"]
[Tue Apr 21 16:41:12.761588 2026] [:error] [pid 54080:tid 54090] [client 172.213.24.111:37719] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4KIzEbQHHxtmWbaZ4tQAAAsg"]
[Tue Apr 21 16:41:12.939044 2026] [:error] [pid 35321:tid 35406] [client 172.213.24.111:49796] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aec4KDeHLhVUuu8cVXziMAAAAFY"]
[Tue Apr 21 16:41:13.593552 2026] [:error] [pid 54080:tid 54092] [client 172.213.24.111:9165] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "aec4KYzEbQHHxtmWbaZ4vQAAAso"]
[Tue Apr 21 16:41:13.960627 2026] [:error] [pid 54080:tid 54084] [client 172.213.24.111:53474] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aec4KYzEbQHHxtmWbaZ4wgAAAsI"]
[Tue Apr 21 16:41:14.310101 2026] [:error] [pid 35320:tid 35345] [client 172.213.24.111:49851] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4KoJW6fdXWO6agMFEUAAAAA8"]
[Tue Apr 21 16:41:14.818700 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:37741] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "aec4KoJW6fdXWO6agMFEUwAAAAI"]
[Tue Apr 21 16:41:14.989431 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:53496] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4KoJW6fdXWO6agMFEVAAAAAc"]
[Tue Apr 21 16:41:16.062696 2026] [:error] [pid 53978:tid 54002] [client 172.213.24.111:49822] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4LJ1ivsR4hcOSQbbDBQAAApY"]
[Tue Apr 21 16:41:16.498183 2026] [:error] [pid 54080:tid 54091] [client 172.213.24.111:50179] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aec4LIzEbQHHxtmWbaZ4zgAAAsk"]
[Tue Apr 21 16:41:17.427285 2026] [:error] [pid 35322:tid 35362] [client 172.213.24.111:37328] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aec4LaPoAfV40BTfVKzLggAAAIU"]
[Tue Apr 21 16:41:17.817310 2026] [:error] [pid 54080:tid 54086] [client 172.213.24.111:9202] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aec4LYzEbQHHxtmWbaZ41gAAAsQ"]
[Tue Apr 21 16:41:19.193680 2026] [:error] [pid 35415:tid 35430] [client 172.213.24.111:53478] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aec4L0iqDinI4_22zzhf0AAAAMM"]
[Tue Apr 21 16:41:19.249913 2026] [:error] [pid 35415:tid 35445] [client 172.213.24.111:37358] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4L0iqDinI4_22zzhf0QAAANI"]
[Tue Apr 21 16:41:20.833647 2026] [:error] [pid 4823:tid 4877] [client 172.213.24.111:9190] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4MPc8mke3PfHqsxHbdwAAAZg"]
[Tue Apr 21 16:41:20.886846 2026] [:error] [pid 35320:tid 35348] [client 172.213.24.111:10250] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "aec4MIJW6fdXWO6agMFEcgAAABI"]
[Tue Apr 21 16:41:21.971709 2026] [:error] [pid 35320:tid 35347] [client 172.213.24.111:45555] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4MYJW6fdXWO6agMFEeAAAABE"]
[Tue Apr 21 16:41:22.117597 2026] [:error] [pid 53731:tid 53754] [client 172.213.24.111:10252] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4Ml2I9THUR-bRVGzohgAAAhI"]
[Tue Apr 21 16:41:23.250718 2026] [:error] [pid 54080:tid 54082] [client 172.213.24.111:49845] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "aec4M4zEbQHHxtmWbaZ47gAAAsA"]
[Tue Apr 21 16:41:23.618044 2026] [:error] [pid 54080:tid 54084] [client 172.213.24.111:49842] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4M4zEbQHHxtmWbaZ48gAAAsI"]
[Tue Apr 21 16:41:24.515634 2026] [:error] [pid 35321:tid 35405] [client 172.213.24.111:10277] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4NDeHLhVUuu8cVXziOgAAAFU"]
[Tue Apr 21 16:41:25.909156 2026] [:error] [pid 35321:tid 35392] [client 172.213.24.111:49843] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4NTeHLhVUuu8cVXziQAAAAEg"]
[Tue Apr 21 16:41:27.438584 2026] [:error] [pid 53731:tid 53756] [client 172.213.24.111:53444] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4N12I9THUR-bRVGzoiAAAAhQ"]
[Tue Apr 21 16:41:28.319395 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:50204] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4ODeHLhVUuu8cVXziRgAAAFE"]
[Tue Apr 21 16:41:29.687283 2026] [:error] [pid 35320:tid 35339] [client 172.213.24.111:62326] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4OYJW6fdXWO6agMFEgQAAAAk"]
[Tue Apr 21 16:41:29.721135 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:45518] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "aec4OYJW6fdXWO6agMFEggAAAAw"]
[Tue Apr 21 16:41:30.840308 2026] [:error] [pid 54080:tid 54086] [client 172.213.24.111:10276] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 16:41:31.052909 2026] [:error] [pid 53731:tid 53735] [client 172.213.24.111:49809] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Tue Apr 21 16:41:31.077528 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:10276] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Tue Apr 21 16:41:31.291301 2026] [:error] [pid 53731:tid 53748] [client 172.213.24.111:49809] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Tue Apr 21 16:41:31.328436 2026] [:error] [pid 54080:tid 54089] [client 172.213.24.111:10276] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Tue Apr 21 16:41:31.535705 2026] [:error] [pid 53731:tid 53744] [client 172.213.24.111:49809] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 16:41:31.565424 2026] [:error] [pid 54080:tid 54090] [client 172.213.24.111:10276] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Apr 21 16:41:31.784201 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:49809] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Tue Apr 21 16:41:31.803091 2026] [:error] [pid 54080:tid 54095] [client 172.213.24.111:10276] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Tue Apr 21 16:41:32.025462 2026] [:error] [pid 53731:tid 53741] [client 172.213.24.111:49809] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Tue Apr 21 16:41:32.047385 2026] [:error] [pid 54080:tid 54103] [client 172.213.24.111:10276] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Apr 21 16:41:32.259876 2026] [:error] [pid 53731:tid 53755] [client 172.213.24.111:49809] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4PF2I9THUR-bRVGzolQAAAhM"]
[Tue Apr 21 16:41:32.281370 2026] [:error] [pid 54080:tid 54082] [client 172.213.24.111:10276] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4PIzEbQHHxtmWbaZ5EwAAAsA"]
[Tue Apr 21 16:41:33.892196 2026] [:error] [pid 53731:tid 53757] [client 172.213.24.111:49855] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4PV2I9THUR-bRVGzolgAAAhU"]
[Tue Apr 21 16:41:34.162360 2026] [:error] [pid 53731:tid 53745] [client 172.213.24.111:50186] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4Pl2I9THUR-bRVGzolwAAAgo"]
[Tue Apr 21 16:41:35.355597 2026] [:error] [pid 4777:tid 4799] [client 172.213.24.111:10293] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4P6xXur6bykKyLZSQNQAAAQs"]
[Tue Apr 21 16:41:35.852980 2026] [:error] [pid 53731:tid 53739] [client 172.213.24.111:38850] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4P12I9THUR-bRVGzonAAAAgQ"]
[Tue Apr 21 16:41:36.115661 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:62309] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec4QIJW6fdXWO6agMFEkgAAAAI"]
[Tue Apr 21 16:41:37.394024 2026] [:error] [pid 35320:tid 35333] [client 172.213.24.111:53490] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec4QYJW6fdXWO6agMFElwAAAAM"]
[Tue Apr 21 16:41:37.889613 2026] [:error] [pid 35321:tid 35408] [client 172.213.24.111:37327] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4QTeHLhVUuu8cVXziVAAAAFg"]
[Tue Apr 21 16:41:40.370055 2026] [:error] [pid 54080:tid 54095] [client 172.213.24.111:37359] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4RIzEbQHHxtmWbaZ5JgAAAs0"]
[Tue Apr 21 16:41:40.508096 2026] [:error] [pid 54080:tid 54103] [client 172.213.24.111:45513] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec4RIzEbQHHxtmWbaZ5JwAAAtU"]
[Tue Apr 21 16:41:42.060510 2026] [:error] [pid 4823:tid 4871] [client 172.213.24.111:38904] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec4Rvc8mke3PfHqsxHbhAAAAZI"]
[Tue Apr 21 16:41:43.088375 2026] [:error] [pid 53832:tid 53844] [client 172.213.24.111:62283] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4R9zkuxsE_OhM9UI_sgAAAkk"]
[Tue Apr 21 16:41:43.148469 2026] [:error] [pid 4823:tid 4868] [client 106.54.62.156:48504] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aec4R_c8mke3PfHqsxHbiwAAAY8"]
[Tue Apr 21 16:41:43.518935 2026] [:error] [pid 35321:tid 35387] [client 172.213.24.111:36581] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec4RzeHLhVUuu8cVXziXwAAAEM"]
[Tue Apr 21 16:41:44.857492 2026] [:error] [pid 35320:tid 35349] [client 172.213.24.111:39371] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec4SIJW6fdXWO6agMFEnQAAABM"]
[Tue Apr 21 16:41:45.851619 2026] [:error] [pid 53832:tid 53852] [client 172.213.24.111:56173] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4SdzkuxsE_OhM9UI_tAAAAlE"]
[Tue Apr 21 16:41:46.069354 2026] [:error] [pid 53832:tid 53859] [client 172.213.24.111:61122] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec4StzkuxsE_OhM9UI_tQAAAlg"]
[Tue Apr 21 16:41:47.310647 2026] [:error] [pid 35321:tid 35388] [client 172.213.24.111:10300] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4SzeHLhVUuu8cVXziaAAAAEQ"]
[Tue Apr 21 16:41:47.474293 2026] [:error] [pid 35321:tid 35385] [client 172.213.24.111:42716] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec4SzeHLhVUuu8cVXziaQAAAEE"]
[Tue Apr 21 16:41:48.640206 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:37346] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec4TIJW6fdXWO6agMFEogAAAAc"]
[Tue Apr 21 16:41:48.834450 2026] [:error] [pid 35320:tid 35344] [client 172.213.24.111:56188] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4TIJW6fdXWO6agMFEpAAAAA4"]
[Tue Apr 21 16:41:49.723893 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:61176] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec4TTeHLhVUuu8cVXzibgAAAEw"]
[Tue Apr 21 16:41:50.212666 2026] [:error] [pid 54080:tid 54089] [client 172.213.24.111:53442] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4TozEbQHHxtmWbaZ5OQAAAsc"]
[Tue Apr 21 16:41:51.387876 2026] [:error] [pid 53731:tid 53742] [client 172.213.24.111:9174] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec4T12I9THUR-bRVGzooAAAAgc"]
[Tue Apr 21 16:41:51.964537 2026] [:error] [pid 35415:tid 35443] [client 172.213.24.111:50188] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4T0iqDinI4_22zzhf2AAAANA"]
[Tue Apr 21 16:41:52.261309 2026] [:error] [pid 35321:tid 35395] [client 172.213.24.111:50232] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec4UDeHLhVUuu8cVXzidgAAAEs"]
[Tue Apr 21 16:41:53.500306 2026] [:error] [pid 35320:tid 35335] [client 172.213.24.111:36590] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec4UYJW6fdXWO6agMFEqgAAAAU"]
[Tue Apr 21 16:41:53.789566 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:53494] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4UYJW6fdXWO6agMFErQAAAAw"]
[Tue Apr 21 16:41:54.418102 2026] [:error] [pid 54080:tid 54085] [client 172.213.24.111:53486] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec4UozEbQHHxtmWbaZ5PwAAAsM"]
[Tue Apr 21 16:41:55.515370 2026] [:error] [pid 53731:tid 53746] [client 172.213.24.111:56136] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec4U12I9THUR-bRVGzopAAAAgs"]
[Tue Apr 21 16:41:56.131721 2026] [:error] [pid 35322:tid 35369] [client 172.213.24.111:50185] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4VKPoAfV40BTfVKzLiwAAAIw"]
[Tue Apr 21 16:41:56.441533 2026] [:error] [pid 35415:tid 35433] [client 172.213.24.111:10265] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec4VEiqDinI4_22zzhf2QAAAMY"]
[Tue Apr 21 16:41:58.256826 2026] [:error] [pid 35321:tid 35402] [client 172.213.24.111:10288] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4VjeHLhVUuu8cVXziggAAAFI"]
[Tue Apr 21 16:41:58.446887 2026] [:error] [pid 35322:tid 35360] [client 172.213.24.111:42692] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec4VqPoAfV40BTfVKzLjgAAAIM"]
[Tue Apr 21 16:41:59.393726 2026] [:error] [pid 35322:tid 35363] [client 172.213.24.111:10471] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec4V6PoAfV40BTfVKzLkAAAAIY"]
[Tue Apr 21 16:42:00.111929 2026] [:error] [pid 4823:tid 4864] [client 172.213.24.111:36555] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4WPc8mke3PfHqsxHbowAAAYs"]
[Tue Apr 21 16:42:01.294461 2026] [:error] [pid 35321:tid 35391] [client 172.213.24.111:10264] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec4WTeHLhVUuu8cVXziiAAAAEc"]
[Tue Apr 21 16:42:01.633433 2026] [:error] [pid 4823:tid 4875] [client 172.213.24.111:10466] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4Wfc8mke3PfHqsxHbpgAAAZY"]
[Tue Apr 21 16:42:02.300766 2026] [:error] [pid 54080:tid 54087] [client 172.213.24.111:36605] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec4WozEbQHHxtmWbaZ5RwAAAsU"]
[Tue Apr 21 16:42:02.708033 2026] [:error] [pid 54080:tid 54085] [client 172.213.24.111:36584] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4WozEbQHHxtmWbaZ5SgAAAsM"]
[Tue Apr 21 16:42:03.463593 2026] [:error] [pid 54080:tid 54093] [client 172.213.24.111:50212] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec4W4zEbQHHxtmWbaZ5UAAAAss"]
[Tue Apr 21 16:42:04.058709 2026] [:error] [pid 54080:tid 54083] [client 172.213.24.111:45553] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4XIzEbQHHxtmWbaZ5VQAAAsE"]
[Tue Apr 21 16:42:04.776081 2026] [:error] [pid 54080:tid 54086] [client 172.213.24.111:56169] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4XIzEbQHHxtmWbaZ5WwAAAsQ"]
[Tue Apr 21 16:42:04.867974 2026] [:error] [pid 53832:tid 53851] [client 172.213.24.111:51513] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4XNzkuxsE_OhM9UI_xAAAAlA"]
[Tue Apr 21 16:42:05.870672 2026] [:error] [pid 53832:tid 53841] [client 172.213.24.111:51495] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4XdzkuxsE_OhM9UI_xgAAAkY"]
[Tue Apr 21 16:42:06.130416 2026] [:error] [pid 53731:tid 53747] [client 172.213.24.111:55758] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4Xl2I9THUR-bRVGzoqgAAAgw"]
[Tue Apr 21 16:42:06.703862 2026] [:error] [pid 53978:tid 53980] [client 172.213.24.111:55780] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4Xp1ivsR4hcOSQbbDEwAAAoA"]
[Tue Apr 21 16:42:06.948840 2026] [:error] [pid 53832:tid 53838] [client 172.213.24.111:8890] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4XtzkuxsE_OhM9UI_yQAAAkM"]
[Tue Apr 21 16:42:07.871854 2026] [:error] [pid 53832:tid 53842] [client 172.213.24.111:55771] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sa.php7"] [unique_id "aec4X9zkuxsE_OhM9UI_zQAAAkc"]
[Tue Apr 21 16:42:08.260473 2026] [:error] [pid 53731:tid 53756] [client 172.213.24.111:42701] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4YF2I9THUR-bRVGzorgAAAhQ"]
[Tue Apr 21 16:42:08.579202 2026] [:error] [pid 54080:tid 54094] [client 172.213.24.111:56187] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4YIzEbQHHxtmWbaZ5XQAAAsw"]
[Tue Apr 21 16:42:09.143613 2026] [:error] [pid 53832:tid 53858] [client 172.213.24.111:56161] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4YdzkuxsE_OhM9UI_0AAAAlc"]
[Tue Apr 21 16:42:09.381033 2026] [:error] [pid 35320:tid 35341] [client 172.213.24.111:55763] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4YYJW6fdXWO6agMFEuAAAAAs"]
[Tue Apr 21 16:42:09.674246 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:47986] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4YYJW6fdXWO6agMFEuQAAAAI"]
[Tue Apr 21 16:42:10.140001 2026] [:error] [pid 35320:tid 35347] [client 172.213.24.111:8865] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4YoJW6fdXWO6agMFEugAAABE"]
[Tue Apr 21 16:42:10.329703 2026] [:error] [pid 35415:tid 35437] [client 172.213.24.111:45815] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aec4YkiqDinI4_22zzhf3wAAAMo"]
[Tue Apr 21 16:42:10.910486 2026] [:error] [pid 53731:tid 53740] [client 172.213.24.111:48221] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aec4Yl2I9THUR-bRVGzouQAAAgU"]
[Tue Apr 21 16:42:11.070536 2026] [:error] [pid 35320:tid 35349] [client 172.213.24.111:45058] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aec4Y4JW6fdXWO6agMFEuwAAABM"]
[Tue Apr 21 16:42:11.726103 2026] [:error] [pid 35320:tid 35354] [client 172.213.24.111:47158] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4Y4JW6fdXWO6agMFEvgAAABg"]
[Tue Apr 21 16:42:11.907838 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:37015] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aec4Y4JW6fdXWO6agMFEwAAAAAw"]
[Tue Apr 21 16:42:12.703156 2026] [:error] [pid 35415:tid 35450] [client 172.213.24.111:53882] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4ZEiqDinI4_22zzhf4AAAANc"]
[Tue Apr 21 16:42:12.809085 2026] [:error] [pid 4777:tid 4809] [client 172.213.24.111:47115] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file61.php"] [unique_id "aec4ZKxXur6bykKyLZSQSAAAARU"]
[Tue Apr 21 16:42:13.782183 2026] [:error] [pid 53832:tid 53844] [client 172.213.24.111:8744] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aec4ZdzkuxsE_OhM9UI_0wAAAkk"]
[Tue Apr 21 16:42:13.842292 2026] [:error] [pid 53832:tid 53836] [client 172.213.24.111:36399] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4ZdzkuxsE_OhM9UI_1QAAAkE"]
[Tue Apr 21 16:42:14.796390 2026] [:error] [pid 53832:tid 53856] [client 172.213.24.111:37001] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aec4ZtzkuxsE_OhM9UI_2gAAAlU"]
[Tue Apr 21 16:42:15.094034 2026] [:error] [pid 53832:tid 53850] [client 172.213.24.111:42288] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp9.php"] [unique_id "aec4Z9zkuxsE_OhM9UI_2wAAAk8"]
[Tue Apr 21 16:42:15.473574 2026] [:error] [pid 53832:tid 53846] [client 172.213.24.111:38955] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aec4Z9zkuxsE_OhM9UI_3gAAAks"]
[Tue Apr 21 16:42:16.072375 2026] [:error] [pid 35320:tid 35341] [client 172.213.24.111:53068] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Cap.php"] [unique_id "aec4aIJW6fdXWO6agMFExwAAAAs"]
[Tue Apr 21 16:42:16.187395 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:45703] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4aIJW6fdXWO6agMFEyQAAAAc"]
[Tue Apr 21 16:42:16.710733 2026] [:error] [pid 53731:tid 53745] [client 172.213.24.111:38966] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4aF2I9THUR-bRVGzovwAAAgo"]
[Tue Apr 21 16:42:16.903705 2026] [:error] [pid 54080:tid 54101] [client 172.213.24.111:49202] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aec4aIzEbQHHxtmWbaZ5YAAAAtM"]
[Tue Apr 21 16:42:17.357177 2026] [:error] [pid 54080:tid 54094] [client 172.213.24.111:10426] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4aYzEbQHHxtmWbaZ5YwAAAsw"]
[Tue Apr 21 16:42:17.542618 2026] [:error] [pid 4823:tid 4870] [client 172.213.24.111:49200] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aec4afc8mke3PfHqsxHbrAAAAZE"]
[Tue Apr 21 16:42:18.470377 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:37003] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aec4al2I9THUR-bRVGzowAAAAhE"]
[Tue Apr 21 16:42:18.598846 2026] [:error] [pid 53978:tid 53987] [client 172.213.24.111:48249] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aec4ap1ivsR4hcOSQbbDHwAAAoc"]
[Tue Apr 21 16:42:19.881198 2026] [:error] [pid 35321:tid 35387] [client 172.213.24.111:39996] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4azeHLhVUuu8cVXzilAAAAEM"]
[Tue Apr 21 16:42:20.046295 2026] [:error] [pid 35321:tid 35402] [client 172.213.24.111:45733] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tfm.php"] [unique_id "aec4bDeHLhVUuu8cVXzilQAAAFI"]
[Tue Apr 21 16:42:20.546466 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:49179] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4bIJW6fdXWO6agMFE1QAAAAI"]
[Tue Apr 21 16:42:21.959854 2026] [:error] [pid 35415:tid 35440] [client 172.213.24.111:8706] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aec4bUiqDinI4_22zzhf4wAAAM0"]
[Tue Apr 21 16:42:22.002681 2026] [:error] [pid 35415:tid 35433] [client 172.213.24.111:10383] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4bkiqDinI4_22zzhf5QAAAMY"]
[Tue Apr 21 16:42:22.812682 2026] [:error] [pid 35320:tid 35351] [client 172.213.24.111:10387] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp5.php"] [unique_id "aec4boJW6fdXWO6agMFE2QAAABU"]
[Tue Apr 21 16:42:23.113272 2026] [:error] [pid 54080:tid 54103] [client 172.213.24.111:39966] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aec4b4zEbQHHxtmWbaZ5bwAAAtU"]
[Tue Apr 21 16:42:24.367291 2026] [:error] [pid 35320:tid 35345] [client 172.213.24.111:46190] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4cIJW6fdXWO6agMFE2wAAAA8"]
[Tue Apr 21 16:42:25.459028 2026] [:error] [pid 4777:tid 4794] [client 172.213.24.111:52998] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aec4caxXur6bykKyLZSQWQAAAQY"]
[Tue Apr 21 16:42:27.545630 2026] [:error] [pid 54080:tid 54084] [client 172.213.24.111:39975] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4c4zEbQHHxtmWbaZ5fgAAAsI"]
[Tue Apr 21 16:42:27.729092 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:39946] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aec4c4zEbQHHxtmWbaZ5ggAAAtQ"]
[Tue Apr 21 16:42:28.586431 2026] [:error] [pid 53978:tid 54000] [client 172.213.24.111:63585] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4dJ1ivsR4hcOSQbbDJAAAApQ"]
[Tue Apr 21 16:42:30.619464 2026] [:error] [pid 4777:tid 4812] [client 172.213.24.111:65476] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t00l.php"] [unique_id "aec4dqxXur6bykKyLZSQXAAAARg"]
[Tue Apr 21 16:42:31.912799 2026] [:error] [pid 4823:tid 4853] [client 172.213.24.111:41760] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aec4d_c8mke3PfHqsxHbwQAAAYA"]
[Tue Apr 21 16:42:33.582180 2026] [:error] [pid 35415:tid 35427] [client 172.213.24.111:41756] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Tue Apr 21 16:42:33.780033 2026] [:error] [pid 35320:tid 35333] [client 172.213.24.111:41736] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Tue Apr 21 16:42:33.850921 2026] [:error] [pid 35415:tid 35442] [client 172.213.24.111:41756] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Apr 21 16:42:34.017248 2026] [:error] [pid 35320:tid 35346] [client 172.213.24.111:41736] File does not exist: /usr/local/apache/htdocs/suspended-page/casp1.php
[Tue Apr 21 16:42:34.120920 2026] [:error] [pid 35415:tid 35435] [client 172.213.24.111:41756] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Apr 21 16:42:34.255387 2026] [:error] [pid 35320:tid 35344] [client 172.213.24.111:41736] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Tue Apr 21 16:42:34.582753 2026] [:error] [pid 35415:tid 35449] [client 172.213.24.111:41756] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Tue Apr 21 16:42:34.763711 2026] [:error] [pid 35320:tid 35349] [client 172.213.24.111:41736] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Tue Apr 21 16:42:34.824746 2026] [:error] [pid 35415:tid 35451] [client 172.213.24.111:41756] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Tue Apr 21 16:42:35.000281 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:41736] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Tue Apr 21 16:42:35.078841 2026] [:error] [pid 35415:tid 35443] [client 172.213.24.111:41756] File does not exist: /usr/local/apache/htdocs/suspended-page/casp1.php
[Tue Apr 21 16:42:35.326493 2026] [:error] [pid 35415:tid 35436] [client 172.213.24.111:41756] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "aec4e0iqDinI4_22zzhf9AAAAMk"]
[Tue Apr 21 16:42:35.423510 2026] [:error] [pid 35320:tid 35354] [client 172.213.24.111:41736] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4e4JW6fdXWO6agMFE6gAAABg"]
[Tue Apr 21 16:42:37.775169 2026] [:error] [pid 54080:tid 54106] [client 172.213.24.111:46198] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4fYzEbQHHxtmWbaZ5kwAAAtg"]
[Tue Apr 21 16:42:38.609007 2026] [:error] [pid 35321:tid 35402] [client 172.213.24.111:46144] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4fjeHLhVUuu8cVXzioQAAAFI"]
[Tue Apr 21 16:42:39.324765 2026] [:error] [pid 35320:tid 35341] [client 172.213.24.111:43714] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "aec4f4JW6fdXWO6agMFE-wAAAAs"]
[Tue Apr 21 16:42:40.315755 2026] [:error] [pid 54080:tid 54095] [client 172.213.24.111:36590] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4gIzEbQHHxtmWbaZ5lgAAAs0"]
[Tue Apr 21 16:42:42.426337 2026] [:error] [pid 53832:tid 53835] [client 172.213.24.111:43774] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "aec4gtzkuxsE_OhM9UI_6AAAAkA"]
[Tue Apr 21 16:42:43.390766 2026] [:error] [pid 35415:tid 35439] [client 172.213.24.111:48989] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4g0iqDinI4_22zzhf9QAAAMw"]
[Tue Apr 21 16:42:44.088010 2026] [:error] [pid 4777:tid 4788] [client 172.213.24.111:46638] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "aec4hKxXur6bykKyLZSQawAAAQA"]
[Tue Apr 21 16:42:44.855735 2026] [:error] [pid 35321:tid 35402] [client 172.213.24.111:51895] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec4hDeHLhVUuu8cVXzipwAAAFI"]
[Tue Apr 21 16:42:45.576244 2026] [:error] [pid 4777:tid 4800] [client 172.213.24.111:46614] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4haxXur6bykKyLZSQdQAAAQw"]
[Tue Apr 21 16:42:45.938502 2026] [:error] [pid 35321:tid 35390] [client 172.213.24.111:59612] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec4hTeHLhVUuu8cVXziqgAAAEY"]
[Tue Apr 21 16:42:46.885688 2026] [:error] [pid 35320:tid 35334] [client 172.213.24.111:43821] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4hoJW6fdXWO6agMFFCQAAAAQ"]
[Tue Apr 21 16:42:48.035797 2026] [:error] [pid 35321:tid 35408] [client 172.213.24.111:50678] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec4iDeHLhVUuu8cVXzirQAAAFg"]
[Tue Apr 21 16:42:48.590686 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:45478] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4iIzEbQHHxtmWbaZ5sgAAAtQ"]
[Tue Apr 21 16:42:49.181529 2026] [:error] [pid 54080:tid 54097] [client 172.213.24.111:56864] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec4iYzEbQHHxtmWbaZ5uQAAAs8"]
[Tue Apr 21 16:42:50.953811 2026] [:error] [pid 35320:tid 35353] [client 172.213.24.111:37811] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec4ioJW6fdXWO6agMFFFAAAABc"]
[Tue Apr 21 16:42:51.732815 2026] [:error] [pid 54080:tid 54087] [client 172.213.24.111:43829] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4i4zEbQHHxtmWbaZ5yQAAAsU"]
[Tue Apr 21 16:42:52.578255 2026] [:error] [pid 54080:tid 54098] [client 172.213.24.111:45490] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4jIzEbQHHxtmWbaZ5zgAAAtA"]
[Tue Apr 21 16:42:52.835202 2026] [:error] [pid 35320:tid 35334] [client 172.213.24.111:37809] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec4jIJW6fdXWO6agMFFGgAAAAQ"]
[Tue Apr 21 16:42:54.026414 2026] [:error] [pid 35320:tid 35333] [client 172.213.24.111:56840] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4joJW6fdXWO6agMFFHAAAAAM"]
[Tue Apr 21 16:42:54.609806 2026] [:error] [pid 35320:tid 35338] [client 172.213.24.111:56479] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4joJW6fdXWO6agMFFHgAAAAg"]
[Tue Apr 21 16:42:55.461523 2026] [:error] [pid 35320:tid 35336] [client 172.213.24.111:50657] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec4j4JW6fdXWO6agMFFJAAAAAY"]
[Tue Apr 21 16:42:57.202499 2026] [:error] [pid 35321:tid 35400] [client 172.213.24.111:37817] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4kTeHLhVUuu8cVXzixQAAAFA"]
[Tue Apr 21 16:42:58.917675 2026] [:error] [pid 35320:tid 35336] [client 172.213.24.111:64809] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec4koJW6fdXWO6agMFFMAAAAAY"]
[Tue Apr 21 16:42:59.427588 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:45485] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4k4zEbQHHxtmWbaZ56wAAAtQ"]
[Tue Apr 21 16:43:01.781592 2026] [:error] [pid 53731:tid 53748] [client 172.213.24.111:55309] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4lV2I9THUR-bRVGzo1QAAAg0"]
[Tue Apr 21 16:43:02.834593 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:40441] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4loJW6fdXWO6agMFFMgAAAAw"]
[Tue Apr 21 16:43:04.159834 2026] [:error] [pid 35321:tid 35405] [client 172.213.24.111:51570] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4mDeHLhVUuu8cVXzizgAAAFU"]
[Tue Apr 21 16:43:05.022200 2026] [:error] [pid 54080:tid 54092] [client 172.213.24.111:55348] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4mYzEbQHHxtmWbaZ58AAAAso"]
[Tue Apr 21 16:43:06.289547 2026] [:error] [pid 54080:tid 54102] [client 172.213.24.111:53860] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4mozEbQHHxtmWbaZ58gAAAtQ"]
[Tue Apr 21 16:43:08.112285 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:56850] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4nDeHLhVUuu8cVXzi1gAAAEw"]
[Tue Apr 21 16:43:09.213687 2026] [:error] [pid 53832:tid 53856] [client 172.213.24.111:64816] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4ndzkuxsE_OhM9UI__QAAAlU"]
[Tue Apr 21 16:43:09.495439 2026] [:error] [pid 53832:tid 53847] [client 172.213.24.111:64775] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4ndzkuxsE_OhM9UI__wAAAkw"]
[Tue Apr 21 16:43:09.923338 2026] [:error] [pid 54080:tid 54099] [client 172.213.24.111:51530] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec4nYzEbQHHxtmWbaZ5_QAAAtE"]
[Tue Apr 21 16:43:10.872269 2026] [:error] [pid 35320:tid 35333] [client 172.213.24.111:40431] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4noJW6fdXWO6agMFFRAAAAAM"]
[Tue Apr 21 16:43:10.927864 2026] [:error] [pid 54080:tid 54092] [client 172.213.24.111:53841] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4nozEbQHHxtmWbaZ5_wAAAso"]
[Tue Apr 21 16:43:11.506686 2026] [:error] [pid 4823:tid 4863] [client 172.213.24.111:40403] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4n_c8mke3PfHqsxHb8QAAAYo"]
[Tue Apr 21 16:43:11.927589 2026] [:error] [pid 35320:tid 35334] [client 172.213.24.111:60093] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aec4n4JW6fdXWO6agMFFTQAAAAQ"]
[Tue Apr 21 16:43:12.602178 2026] [:error] [pid 35321:tid 35392] [client 172.213.24.111:60073] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4oDeHLhVUuu8cVXzi2wAAAEg"]
[Tue Apr 21 16:43:13.271912 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:41711] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec4oTeHLhVUuu8cVXzi3wAAAEw"]
[Tue Apr 21 16:43:14.180541 2026] [:error] [pid 35322:tid 35364] [client 172.213.24.111:53881] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4oqPoAfV40BTfVKzLoAAAAIc"]
[Tue Apr 21 16:43:14.494169 2026] [:error] [pid 54080:tid 54089] [client 172.213.24.111:37814] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aec4oozEbQHHxtmWbaZ6AAAAAsc"]
[Tue Apr 21 16:43:15.391668 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:51533] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4ozeHLhVUuu8cVXzi8AAAAEw"]
[Tue Apr 21 16:43:15.929527 2026] [:error] [pid 35321:tid 35399] [client 172.213.24.111:8941] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aec4ozeHLhVUuu8cVXzi9AAAAE8"]
[Tue Apr 21 16:43:16.028716 2026] [:error] [pid 54080:tid 54100] [client 172.213.24.111:55338] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4pIzEbQHHxtmWbaZ6CAAAAtI"]
[Tue Apr 21 16:43:16.675683 2026] [:error] [pid 54080:tid 54103] [client 172.213.24.111:56537] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aec4pIzEbQHHxtmWbaZ6CgAAAtU"]
[Tue Apr 21 16:43:16.861041 2026] [:error] [pid 35321:tid 35401] [client 172.213.24.111:64820] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "aec4pDeHLhVUuu8cVXzi-QAAAFE"]
[Tue Apr 21 16:43:17.387501 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:9006] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4pYJW6fdXWO6agMFFYAAAAAI"]
[Tue Apr 21 16:43:17.407599 2026] [:error] [pid 35320:tid 35350] [client 172.213.24.111:53847] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aec4pYJW6fdXWO6agMFFYQAAABQ"]
[Tue Apr 21 16:43:18.348142 2026] [:error] [pid 54080:tid 54084] [client 172.213.24.111:53853] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4pozEbQHHxtmWbaZ6GAAAAsI"]
[Tue Apr 21 16:43:19.692153 2026] [:error] [pid 35415:tid 35431] [client 172.213.24.111:60044] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4p0iqDinI4_22zzhgAgAAAMQ"]
[Tue Apr 21 16:43:20.988195 2026] [:error] [pid 35320:tid 35332] [client 172.213.24.111:50595] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "aec4qIJW6fdXWO6agMFFagAAAAI"]
[Tue Apr 21 16:43:21.356346 2026] [:error] [pid 35320:tid 35339] [client 172.213.24.111:8910] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aec4qYJW6fdXWO6agMFFawAAAAk"]
[Tue Apr 21 16:43:22.654670 2026] [:error] [pid 35321:tid 35398] [client 172.213.24.111:8974] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aec4qjeHLhVUuu8cVXzjDwAAAE4"]
[Tue Apr 21 16:43:23.370506 2026] [:error] [pid 35321:tid 35389] [client 172.213.24.111:8906] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4qzeHLhVUuu8cVXzjGAAAAEU"]
[Tue Apr 21 16:43:24.061226 2026] [:error] [pid 35321:tid 35384] [client 172.213.24.111:56877] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "aec4rDeHLhVUuu8cVXzjHgAAAEA"]
[Tue Apr 21 16:43:24.119622 2026] [:error] [pid 35321:tid 35386] [client 172.213.24.111:8958] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4rDeHLhVUuu8cVXzjIAAAAEI"]
[Tue Apr 21 16:43:24.834204 2026] [:error] [pid 35322:tid 35359] [client 172.213.24.111:55349] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aec4rKPoAfV40BTfVKzLrQAAAII"]
[Tue Apr 21 16:43:25.247136 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:50599] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4rYJW6fdXWO6agMFFfAAAAAw"]
[Tue Apr 21 16:43:25.636416 2026] [:error] [pid 4823:tid 4858] [client 172.213.24.111:8949] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aec4rfc8mke3PfHqsxHb_QAAAYU"]
[Tue Apr 21 16:43:26.979372 2026] [:error] [pid 53832:tid 53839] [client 172.213.24.111:8917] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aec4rtzkuxsE_OhM9UJAGgAAAkQ"]
[Tue Apr 21 16:43:27.161321 2026] [:error] [pid 53832:tid 53836] [client 172.213.24.111:55333] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aec4r9zkuxsE_OhM9UJAGwAAAkE"]
[Tue Apr 21 16:43:28.298156 2026] [:error] [pid 35320:tid 35344] [client 172.213.24.111:60037] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aec4sIJW6fdXWO6agMFFjwAAAA4"]
[Tue Apr 21 16:43:28.984310 2026] [:error] [pid 35321:tid 35392] [client 172.213.24.111:41726] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aec4sDeHLhVUuu8cVXzjSQAAAEg"]
[Tue Apr 21 16:43:30.217524 2026] [:error] [pid 53978:tid 53988] [client 172.213.24.111:55337] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aec4sp1ivsR4hcOSQbbDYgAAAog"]
[Tue Apr 21 16:43:31.286131 2026] [:error] [pid 4777:tid 4791] [client 172.213.24.111:51561] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aec4s6xXur6bykKyLZSQ-wAAAQM"]
[Tue Apr 21 16:43:32.310667 2026] [:error] [pid 35320:tid 35330] [client 172.213.24.111:8995] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aec4tIJW6fdXWO6agMFFrAAAAAA"]
[Tue Apr 21 16:43:33.698567 2026] [:error] [pid 35321:tid 35396] [client 172.213.24.111:60074] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aec4tTeHLhVUuu8cVXzjeQAAAEw"]
[Tue Apr 21 16:43:34.694867 2026] [:error] [pid 35321:tid 35403] [client 172.213.24.111:8911] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "aec4tjeHLhVUuu8cVXzjggAAAFM"]
[Tue Apr 21 16:43:35.825469 2026] [:error] [pid 53978:tid 53992] [client 172.213.24.111:9022] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Tue Apr 21 16:43:36.062863 2026] [:error] [pid 53978:tid 53986] [client 172.213.24.111:9022] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Apr 21 16:43:36.144087 2026] [:error] [pid 53731:tid 53755] [client 172.213.24.111:40465] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Tue Apr 21 16:43:36.300249 2026] [:error] [pid 53978:tid 53988] [client 172.213.24.111:9022] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Tue Apr 21 16:43:36.383404 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:40465] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Tue Apr 21 16:43:36.620642 2026] [:error] [pid 53731:tid 53745] [client 172.213.24.111:40465] File does not exist: /usr/local/apache/htdocs/suspended-page/prosellers8.php
[Tue Apr 21 16:43:36.859112 2026] [:error] [pid 53731:tid 53758] [client 172.213.24.111:40465] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Tue Apr 21 16:43:37.094438 2026] [:error] [pid 53731:tid 53746] [client 172.213.24.111:40465] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Tue Apr 21 16:43:37.340688 2026] [:error] [pid 53731:tid 53740] [client 172.213.24.111:40465] File does not exist: /usr/local/apache/htdocs/suspended-page/fsjzs.php
[Tue Apr 21 16:43:37.785982 2026] [:error] [pid 53978:tid 53993] [client 172.213.24.111:9022] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Tue Apr 21 16:43:37.937746 2026] [:error] [pid 53731:tid 53743] [client 172.213.24.111:40465] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Tue Apr 21 16:43:38.020739 2026] [:error] [pid 53978:tid 53981] [client 172.213.24.111:9022] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aec4up1ivsR4hcOSQbbDdgAAAoE"]
[Tue Apr 21 16:43:38.171180 2026] [:error] [pid 53731:tid 53755] [client 172.213.24.111:40465] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec4ul2I9THUR-bRVGzpIgAAAhM"]
[Tue Apr 21 16:43:40.535380 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:53836] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aec4vF2I9THUR-bRVGzpNAAAAg4"]
[Tue Apr 21 16:43:40.651447 2026] [:error] [pid 53978:tid 53986] [client 172.213.24.111:55340] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec4vJ1ivsR4hcOSQbbDeAAAAoY"]
[Tue Apr 21 16:43:41.613518 2026] [:error] [pid 53731:tid 53745] [client 172.213.24.111:51567] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aec4vV2I9THUR-bRVGzpPgAAAgo"]
[Tue Apr 21 16:43:42.056483 2026] [:error] [pid 53731:tid 53741] [client 172.213.24.111:53869] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec4vl2I9THUR-bRVGzpQAAAAgY"]
[Tue Apr 21 16:43:43.575342 2026] [:error] [pid 35320:tid 35354] [client 172.213.24.111:41691] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aec4v4JW6fdXWO6agMFF2wAAABg"]
[Tue Apr 21 16:43:44.506418 2026] [:error] [pid 53731:tid 53742] [client 172.213.24.111:50579] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "aec4wF2I9THUR-bRVGzpTwAAAgc"]
[Tue Apr 21 16:43:44.732177 2026] [:error] [pid 53731:tid 53744] [client 172.213.24.111:40451] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec4wF2I9THUR-bRVGzpVAAAAgk"]
[Tue Apr 21 16:43:45.301418 2026] [:error] [pid 53731:tid 53746] [client 172.213.24.111:41673] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "aec4wV2I9THUR-bRVGzpWwAAAgs"]
[Tue Apr 21 16:43:45.843075 2026] [:error] [pid 35321:tid 35399] [client 172.213.24.111:8924] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec4wTeHLhVUuu8cVXzjrAAAAE8"]
[Tue Apr 21 16:43:46.893184 2026] [:error] [pid 53978:tid 53981] [client 172.213.24.111:56572] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec4wp1ivsR4hcOSQbbDhAAAAoE"]
[Tue Apr 21 16:43:47.167605 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:8982] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "aec4w4JW6fdXWO6agMFF3QAAAAc"]
[Tue Apr 21 16:43:48.269931 2026] [:error] [pid 53978:tid 53998] [client 172.213.24.111:52719] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec4xJ1ivsR4hcOSQbbDiAAAApI"]
[Tue Apr 21 16:43:49.000536 2026] [:error] [pid 53731:tid 53753] [client 172.213.24.111:50611] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "aec4xF2I9THUR-bRVGzpcAAAAhE"]
[Tue Apr 21 16:43:49.167114 2026] [:error] [pid 35320:tid 35346] [client 172.213.24.111:41723] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec4xYJW6fdXWO6agMFF4QAAABA"]
[Tue Apr 21 16:43:50.123924 2026] [:error] [pid 53731:tid 53755] [client 172.213.24.111:37794] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec4xl2I9THUR-bRVGzpdwAAAhM"]
[Tue Apr 21 16:43:51.304960 2026] [:error] [pid 35320:tid 35337] [client 172.213.24.111:52687] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aec4x4JW6fdXWO6agMFF6wAAAAc"]
[Tue Apr 21 16:43:51.444154 2026] [:error] [pid 53978:tid 53985] [client 172.213.24.111:52710] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec4x51ivsR4hcOSQbbDlAAAAoU"]
[Tue Apr 21 16:43:52.989857 2026] [:error] [pid 53978:tid 54004] [client 172.213.24.111:52689] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aec4yJ1ivsR4hcOSQbbDoQAAApg"]
[Tue Apr 21 16:43:54.355558 2026] [:error] [pid 53978:tid 53993] [client 172.213.24.111:61739] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec4yp1ivsR4hcOSQbbDrgAAAo0"]
[Tue Apr 21 16:43:54.671703 2026] [:error] [pid 53978:tid 53991] [client 172.213.24.111:60057] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aec4yp1ivsR4hcOSQbbDswAAAos"]
[Tue Apr 21 16:43:55.545863 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:61697] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec4y12I9THUR-bRVGzphQAAAg4"]
[Tue Apr 21 16:43:56.128857 2026] [:error] [pid 53731:tid 53744] [client 172.213.24.111:60060] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "aec4zF2I9THUR-bRVGzpjwAAAgk"]
[Tue Apr 21 16:43:57.019591 2026] [:error] [pid 53731:tid 53742] [client 172.213.24.111:50589] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec4zV2I9THUR-bRVGzpmQAAAgc"]
[Tue Apr 21 16:43:58.025768 2026] [:error] [pid 53731:tid 53745] [client 172.213.24.111:55742] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aec4zl2I9THUR-bRVGzpogAAAgo"]
[Tue Apr 21 16:43:58.664807 2026] [:error] [pid 35320:tid 35342] [client 172.213.24.111:55314] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec4zoJW6fdXWO6agMFGAAAAAAw"]
[Tue Apr 21 16:43:59.027997 2026] [:error] [pid 53731:tid 53755] [client 172.213.24.111:57245] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aec4z12I9THUR-bRVGzpqAAAAhM"]
[Tue Apr 21 16:43:59.380558 2026] [:error] [pid 53731:tid 53759] [client 172.213.24.111:8963] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec4z12I9THUR-bRVGzpqgAAAhc"]
[Tue Apr 21 16:43:59.994133 2026] [:error] [pid 53978:tid 53986] [client 172.213.24.111:50592] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aec4z51ivsR4hcOSQbbDvQAAAoY"]
[Tue Apr 21 16:44:00.131502 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:46123] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec40F2I9THUR-bRVGzprQAAAhA"]
[Tue Apr 21 16:44:00.859597 2026] [:error] [pid 53731:tid 53749] [client 172.213.24.111:56574] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "aec40F2I9THUR-bRVGzpsgAAAg4"]
[Tue Apr 21 16:44:01.510330 2026] [:error] [pid 53731:tid 53741] [client 172.213.24.111:61699] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "aec40V2I9THUR-bRVGzptQAAAgY"]
[Tue Apr 21 16:44:02.392406 2026] [:error] [pid 53731:tid 53754] [client 172.213.24.111:60121] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "aec40l2I9THUR-bRVGzpugAAAhI"]
[Tue Apr 21 16:44:02.418616 2026] [:error] [pid 53978:tid 53987] [client 172.213.24.111:56568] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec40p1ivsR4hcOSQbbDwQAAAoc"]
[Tue Apr 21 16:44:03.253821 2026] [:error] [pid 53978:tid 53990] [client 172.213.24.111:55692] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "aec4051ivsR4hcOSQbbDxAAAAoo"]
[Tue Apr 21 16:44:03.471775 2026] [:error] [pid 53731:tid 53757] [client 172.213.24.111:61752] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec4012I9THUR-bRVGzpvgAAAhU"]
[Tue Apr 21 16:44:04.295125 2026] [:error] [pid 53978:tid 53999] [client 172.213.24.111:50590] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec41J1ivsR4hcOSQbbDyAAAApM"]
[Tue Apr 21 16:44:04.695936 2026] [:error] [pid 4823:tid 4873] [client 172.213.24.111:8931] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "aec41Pc8mke3PfHqsxHcLQAAAZQ"]
[Tue Apr 21 16:44:05.679494 2026] [:error] [pid 4823:tid 4875] [client 172.213.24.111:55686] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec41fc8mke3PfHqsxHcLgAAAZY"]
[Tue Apr 21 16:44:06.120329 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:8976] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aec41l2I9THUR-bRVGzpxQAAAhA"]
[Tue Apr 21 16:44:06.736629 2026] [:error] [pid 53731:tid 53755] [client 172.213.24.111:46130] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aec41l2I9THUR-bRVGzpyAAAAhM"]
[Tue Apr 21 16:44:07.174348 2026] [:error] [pid 53731:tid 53742] [client 172.213.24.111:40482] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aec4112I9THUR-bRVGzpzAAAAgc"]
[Tue Apr 21 16:44:09.340610 2026] [:error] [pid 53978:tid 53984] [client 172.213.24.111:40471] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aec42Z1ivsR4hcOSQbbDzgAAAoQ"]
[Tue Apr 21 16:44:11.479536 2026] [:error] [pid 53978:tid 54000] [client 172.213.24.111:52685] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aec4251ivsR4hcOSQbbD1wAAApQ"]
[Tue Apr 21 16:44:13.199546 2026] [:error] [pid 53731:tid 53743] [client 172.213.24.111:55717] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aec43V2I9THUR-bRVGzp5wAAAgg"]
[Tue Apr 21 16:44:14.528989 2026] [:error] [pid 53731:tid 53737] [client 172.213.24.111:56556] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aec43l2I9THUR-bRVGzp8wAAAgI"]
[Tue Apr 21 16:44:15.363975 2026] [:error] [pid 54080:tid 54089] [client 172.213.24.111:52676] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "aec434zEbQHHxtmWbaZ60QAAAsc"]
[Tue Apr 21 16:44:16.535962 2026] [:error] [pid 4823:tid 4874] [client 172.213.24.111:38220] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec44Pc8mke3PfHqsxHcMwAAAZU"]
[Tue Apr 21 16:44:18.778679 2026] [:error] [pid 53731:tid 53739] [client 172.213.24.111:52723] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec44l2I9THUR-bRVGzqDgAAAgQ"]
[Tue Apr 21 16:44:21.102700 2026] [:error] [pid 53731:tid 53752] [client 172.213.24.111:44108] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec45V2I9THUR-bRVGzqHgAAAhA"]
[Tue Apr 21 16:44:22.083916 2026] [:error] [pid 35321:tid 35384] [client 172.213.24.111:38208] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec45jeHLhVUuu8cVXzkAQAAAEA"]
[Tue Apr 21 16:44:23.689083 2026] [:error] [pid 53978:tid 53981] [client 172.213.24.111:44142] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec4551ivsR4hcOSQbbEFwAAAoE"]
[Tue Apr 21 16:44:25.178449 2026] [:error] [pid 35320:tid 35343] [client 172.213.24.111:41220] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec46YJW6fdXWO6agMFGFQAAAA0"]
[Tue Apr 21 16:44:27.706967 2026] [:error] [pid 53978:tid 53981] [client 172.213.24.111:36654] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec4651ivsR4hcOSQbbEIgAAAoE"]
[Tue Apr 21 16:44:28.993216 2026] [:error] [pid 53832:tid 53858] [client 172.213.24.111:41242] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec47NzkuxsE_OhM9UJARQAAAlc"]
[Tue Apr 21 16:44:29.770683 2026] [:error] [pid 53978:tid 54000] [client 172.213.24.111:48006] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec47Z1ivsR4hcOSQbbEKgAAApQ"]
[Tue Apr 21 16:44:31.038838 2026] [:error] [pid 53731:tid 53741] [client 172.213.24.111:8771] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec4712I9THUR-bRVGzqRAAAAgY"]
[Tue Apr 21 16:44:32.150787 2026] [:error] [pid 53978:tid 53984] [client 172.213.24.111:10620] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec48J1ivsR4hcOSQbbEMAAAAoQ"]
[Tue Apr 21 16:44:33.018459 2026] [:error] [pid 53978:tid 54001] [client 172.213.24.111:10597] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec48Z1ivsR4hcOSQbbENwAAApU"]
[Tue Apr 21 16:44:33.891678 2026] [:error] [pid 53978:tid 53994] [client 172.213.24.111:48954] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec48Z1ivsR4hcOSQbbEPwAAAo4"]
[Tue Apr 21 16:44:34.795162 2026] [:error] [pid 53978:tid 53990] [client 172.213.24.111:38246] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec48p1ivsR4hcOSQbbESQAAAoo"]
[Tue Apr 21 16:44:35.737984 2026] [:error] [pid 53832:tid 53839] [client 172.213.24.111:48954] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec489zkuxsE_OhM9UJASwAAAkQ"]
[Tue Apr 21 16:44:36.867972 2026] [:error] [pid 4777:tid 4804] [client 172.213.24.111:57246] [client 172.213.24.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec49KxXur6bykKyLZSRIgAAARA"]
[Tue Apr 21 16:44:38.243402 2026] [:error] [pid 4823:tid 4863] [client 172.213.24.111:8769] File does not exist: /usr/local/apache/htdocs/suspended-page/ai.php
[Tue Apr 21 16:44:38.501093 2026] [:error] [pid 4823:tid 4861] [client 172.213.24.111:8769] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Apr 21 16:58:30.219122 2026] [:error] [pid 4823:tid 4876] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Tue Apr 21 16:58:30.514206 2026] [:error] [pid 4823:tid 4857] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 16:58:30.800813 2026] [:error] [pid 4823:tid 4862] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Tue Apr 21 16:58:31.087871 2026] [:error] [pid 4823:tid 4866] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Tue Apr 21 16:58:31.374689 2026] [:error] [pid 4823:tid 4861] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Tue Apr 21 16:58:31.661579 2026] [:error] [pid 4823:tid 4869] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Tue Apr 21 16:58:32.250608 2026] [:error] [pid 4823:tid 4872] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 16:58:32.551516 2026] [:error] [pid 4823:tid 4856] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Tue Apr 21 16:58:32.838114 2026] [:error] [pid 4823:tid 4855] [client 20.238.81.198:21424] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Tue Apr 21 16:58:33.121985 2026] [:error] [pid 4823:tid 4871] [client 20.238.81.198:21424] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec8Ofc8mke3PfHqsxHeJAAAAZI"]
[Tue Apr 21 16:58:34.430958 2026] [:error] [pid 53978:tid 53980] [client 20.238.81.198:43350] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec8Op1ivsR4hcOSQbbM2gAAAoA"]
[Tue Apr 21 16:58:35.493335 2026] [:error] [pid 35415:tid 35434] [client 20.238.81.198:27855] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec8O0iqDinI4_22zzhhHgAAAMc"]
[Tue Apr 21 16:58:38.189701 2026] [:error] [pid 53832:tid 53839] [client 20.238.81.198:52073] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "aec8PtzkuxsE_OhM9UJCzAAAAkQ"]
[Tue Apr 21 16:58:39.187931 2026] [:error] [pid 53731:tid 53740] [client 20.238.81.198:32092] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec8P12I9THUR-bRVGz0NAAAAgU"]
[Tue Apr 21 16:58:41.091857 2026] [:error] [pid 35321:tid 35390] [client 20.238.81.198:42687] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec8QTeHLhVUuu8cVXzsRgAAAEY"]
[Tue Apr 21 16:58:42.830418 2026] [:error] [pid 53978:tid 53985] [client 20.238.81.198:52080] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec8Qp1ivsR4hcOSQbbM7wAAAoU"]
[Tue Apr 21 16:58:44.191115 2026] [:error] [pid 53731:tid 53760] [client 20.238.81.198:21389] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aec8RF2I9THUR-bRVGz0SAAAAhg"]
[Tue Apr 21 16:58:45.887958 2026] [:error] [pid 53978:tid 53981] [client 20.238.81.198:11632] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec8RZ1ivsR4hcOSQbbM9AAAAoE"]
[Tue Apr 21 16:58:47.694500 2026] [:error] [pid 35320:tid 35330] [client 20.238.81.198:56351] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec8R4JW6fdXWO6agMFKhgAAAAA"]
[Tue Apr 21 16:58:49.434556 2026] [:error] [pid 53978:tid 53998] [client 20.238.81.198:27851] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec8SZ1ivsR4hcOSQbbM_QAAApI"]
[Tue Apr 21 16:58:50.560569 2026] [:error] [pid 54080:tid 54086] [client 20.238.81.198:56382] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "aec8SozEbQHHxtmWbaZ-aQAAAsQ"]
[Tue Apr 21 16:58:52.504299 2026] [:error] [pid 53978:tid 53987] [client 20.238.81.198:8705] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec8TJ1ivsR4hcOSQbbNAwAAAoc"]
[Tue Apr 21 16:58:55.661189 2026] [:error] [pid 35321:tid 35406] [client 20.238.81.198:32107] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec8TzeHLhVUuu8cVXzsUgAAAFY"]
[Tue Apr 21 16:58:57.068165 2026] [:error] [pid 35321:tid 35389] [client 20.238.81.198:36757] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec8UTeHLhVUuu8cVXzsWAAAAEU"]
[Tue Apr 21 16:59:02.586985 2026] [:error] [pid 53731:tid 53745] [client 20.238.81.198:26637] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aec8Vl2I9THUR-bRVGz0mwAAAgo"]
[Tue Apr 21 16:59:05.416696 2026] [:error] [pid 53731:tid 53737] [client 20.238.81.198:29726] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec8WV2I9THUR-bRVGz0pAAAAgI"]
[Tue Apr 21 16:59:07.867977 2026] [:error] [pid 54080:tid 54097] [client 20.238.81.198:38218] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec8W4zEbQHHxtmWbaZ-cwAAAs8"]
[Tue Apr 21 16:59:09.903137 2026] [:error] [pid 53731:tid 53757] [client 20.238.81.198:38213] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec8XV2I9THUR-bRVGz0sAAAAhU"]
[Tue Apr 21 16:59:12.374008 2026] [:error] [pid 35321:tid 35386] [client 20.238.81.198:47234] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "aec8YDeHLhVUuu8cVXzshQAAAEI"]
[Tue Apr 21 16:59:14.367769 2026] [:error] [pid 53832:tid 53849] [client 20.238.81.198:56432] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec8YtzkuxsE_OhM9UJC8QAAAk4"]
[Tue Apr 21 16:59:17.011775 2026] [:error] [pid 35322:tid 35361] [client 20.238.81.198:47794] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec8ZaPoAfV40BTfVKzMtQAAAIQ"]
[Tue Apr 21 16:59:19.831161 2026] [:error] [pid 35320:tid 35331] [client 20.238.81.198:27917] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec8Z4JW6fdXWO6agMFK7QAAAAE"]
[Tue Apr 21 16:59:22.131122 2026] [:error] [pid 53731:tid 53756] [client 20.238.81.198:11687] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "aec8al2I9THUR-bRVGz01QAAAhQ"]
[Tue Apr 21 16:59:25.130371 2026] [:error] [pid 53731:tid 53743] [client 20.238.81.198:9163] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "aec8bV2I9THUR-bRVGz05wAAAgg"]
[Tue Apr 21 16:59:26.931357 2026] [:error] [pid 53731:tid 53754] [client 20.238.81.198:47805] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "aec8bl2I9THUR-bRVGz09AAAAhI"]
[Tue Apr 21 16:59:28.858889 2026] [:error] [pid 53978:tid 53993] [client 20.238.81.198:51399] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "aec8cJ1ivsR4hcOSQbbNHwAAAo0"]
[Tue Apr 21 16:59:33.172856 2026] [:error] [pid 54080:tid 54094] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/lb.php
[Tue Apr 21 16:59:33.483042 2026] [:error] [pid 54080:tid 54089] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Tue Apr 21 16:59:33.785171 2026] [:error] [pid 54080:tid 54102] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Tue Apr 21 16:59:34.148651 2026] [:error] [pid 54080:tid 54097] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Tue Apr 21 16:59:34.452778 2026] [:error] [pid 54080:tid 54085] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Tue Apr 21 16:59:34.762406 2026] [:error] [pid 54080:tid 54105] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Tue Apr 21 16:59:35.064882 2026] [:error] [pid 54080:tid 54104] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 16:59:35.383121 2026] [:error] [pid 54080:tid 54106] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Apr 21 16:59:35.700808 2026] [:error] [pid 54080:tid 54092] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Tue Apr 21 16:59:36.484726 2026] [:error] [pid 54080:tid 54090] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Tue Apr 21 16:59:36.787461 2026] [:error] [pid 54080:tid 54091] [client 20.238.81.198:26966] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Tue Apr 21 16:59:37.097528 2026] [:error] [pid 54080:tid 54098] [client 20.238.81.198:26966] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec8eYzEbQHHxtmWbaZ-kQAAAtA"]
[Tue Apr 21 16:59:39.896153 2026] [:error] [pid 53832:tid 53842] [client 20.238.81.198:34187] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec8e9zkuxsE_OhM9UJC-gAAAkc"]
[Tue Apr 21 16:59:44.350390 2026] [:error] [pid 53832:tid 53839] [client 20.238.81.198:33720] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec8gNzkuxsE_OhM9UJC_QAAAkQ"]
[Tue Apr 21 16:59:50.536928 2026] [:error] [pid 54080:tid 54084] [client 20.238.81.198:46285] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aec8hozEbQHHxtmWbaZ-oQAAAsI"]
[Tue Apr 21 16:59:57.426489 2026] [:error] [pid 53978:tid 53980] [client 20.238.81.198:28026] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec8jZ1ivsR4hcOSQbbNUwAAAoA"]
[Tue Apr 21 17:00:00.238317 2026] [:error] [pid 53731:tid 53737] [client 20.238.81.198:63183] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec8kF2I9THUR-bRVGz1hQAAAgI"]
[Tue Apr 21 17:00:01.379874 2026] [:error] [pid 53978:tid 54001] [client 20.238.81.198:27397] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec8kZ1ivsR4hcOSQbbNXQAAApU"]
[Tue Apr 21 17:00:03.001520 2026] [:error] [pid 35321:tid 35389] [client 20.238.81.198:41391] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aec8kzeHLhVUuu8cVXzs1QAAAEU"]
[Tue Apr 21 17:00:04.362802 2026] [:error] [pid 35321:tid 35392] [client 20.238.81.198:57680] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec8lDeHLhVUuu8cVXzs3gAAAEg"]
[Tue Apr 21 17:00:06.146861 2026] [:error] [pid 54080:tid 54090] [client 20.238.81.198:55776] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec8lozEbQHHxtmWbaZ-uAAAAsg"]
[Tue Apr 21 17:00:08.058197 2026] [:error] [pid 4777:tid 4807] [client 20.238.81.198:35339] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec8mKxXur6bykKyLZSS5QAAARM"]
[Tue Apr 21 17:00:10.086790 2026] [:error] [pid 4777:tid 4808] [client 20.238.81.198:41406] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "aec8mqxXur6bykKyLZSS5wAAARQ"]
[Tue Apr 21 17:00:13.000193 2026] [:error] [pid 53731:tid 53738] [client 20.238.81.198:35376] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec8nF2I9THUR-bRVGz2AgAAAgM"]
[Tue Apr 21 17:00:15.387745 2026] [:error] [pid 53731:tid 53742] [client 20.238.81.198:54639] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec8n12I9THUR-bRVGz2LAAAAgc"]
[Tue Apr 21 17:00:17.923191 2026] [:error] [pid 53978:tid 54003] [client 20.238.81.198:57656] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec8oZ1ivsR4hcOSQbbNuwAAApc"]
[Tue Apr 21 17:00:20.952931 2026] [:error] [pid 53978:tid 53988] [client 20.238.81.198:57695] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "aec8pJ1ivsR4hcOSQbbNwgAAAog"]
[Tue Apr 21 17:00:22.427412 2026] [:error] [pid 53731:tid 53736] [client 20.238.81.198:58223] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec8pl2I9THUR-bRVGz2YAAAAgE"]
[Tue Apr 21 17:00:25.791891 2026] [:error] [pid 35320:tid 35352] [client 20.238.81.198:27451] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec8qYJW6fdXWO6agMFLWAAAABY"]
[Tue Apr 21 17:00:28.139904 2026] [:error] [pid 35320:tid 35333] [client 20.238.81.198:37010] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec8rIJW6fdXWO6agMFLWwAAAAM"]
[Tue Apr 21 17:00:31.340515 2026] [:error] [pid 35321:tid 35399] [client 20.238.81.198:30266] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "aec8rzeHLhVUuu8cVXztFgAAAE8"]
[Tue Apr 21 17:00:32.962990 2026] [:error] [pid 53978:tid 53987] [client 20.238.81.198:27407] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aec8sJ1ivsR4hcOSQbbN4QAAAoc"]
[Tue Apr 21 17:00:41.294501 2026] [:error] [pid 53731:tid 53744] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 21 17:00:41.635705 2026] [:error] [pid 53731:tid 53756] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/amwxl.php
[Tue Apr 21 17:00:41.973790 2026] [:error] [pid 53731:tid 53747] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Tue Apr 21 17:00:42.312771 2026] [:error] [pid 53731:tid 53759] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/userfuns.php
[Tue Apr 21 17:00:42.652517 2026] [:error] [pid 53731:tid 53752] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/menu.php
[Tue Apr 21 17:00:42.992205 2026] [:error] [pid 53731:tid 53744] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 17:00:43.342308 2026] [:error] [pid 53731:tid 53756] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Tue Apr 21 17:00:43.681460 2026] [:error] [pid 53731:tid 53736] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Tue Apr 21 17:00:44.019121 2026] [:error] [pid 53731:tid 53740] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue Apr 21 17:00:44.358160 2026] [:error] [pid 53731:tid 53746] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Tue Apr 21 17:00:44.698171 2026] [:error] [pid 53731:tid 53743] [client 20.238.81.198:56998] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Tue Apr 21 17:00:45.033728 2026] [:error] [pid 53731:tid 53735] [client 20.238.81.198:56998] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec8vV2I9THUR-bRVGz26gAAAgA"]
[Tue Apr 21 17:00:47.523564 2026] [:error] [pid 35321:tid 35406] [client 20.238.81.198:27916] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec8vzeHLhVUuu8cVXztKAAAAFY"]
[Tue Apr 21 17:00:49.781970 2026] [:error] [pid 53978:tid 53990] [client 20.238.81.198:11775] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec8wZ1ivsR4hcOSQbbN-QAAAoo"]
[Tue Apr 21 17:00:52.133675 2026] [:error] [pid 53731:tid 53736] [client 20.238.81.198:30756] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "aec8xF2I9THUR-bRVGz28gAAAgE"]
[Tue Apr 21 17:00:55.184115 2026] [:error] [pid 35320:tid 35346] [client 20.238.81.198:42628] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec8x4JW6fdXWO6agMFLdQAAABA"]
[Tue Apr 21 17:00:58.825551 2026] [:error] [pid 53731:tid 53748] [client 20.238.81.198:32530] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec8yl2I9THUR-bRVGz3AQAAAg0"]
[Tue Apr 21 17:01:01.838543 2026] [:error] [pid 53978:tid 53994] [client 20.238.81.198:33863] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec8zZ1ivsR4hcOSQbbOEwAAAo4"]
[Tue Apr 21 17:01:03.441274 2026] [:error] [pid 53978:tid 54000] [client 20.238.81.198:40067] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aec8z51ivsR4hcOSQbbOGAAAApQ"]
[Tue Apr 21 17:01:05.594312 2026] [:error] [pid 4777:tid 4802] [client 20.238.81.198:36800] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec80axXur6bykKyLZSS7wAAAQ4"]
[Tue Apr 21 17:01:07.073078 2026] [:error] [pid 54080:tid 54098] [client 20.238.81.198:8778] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec804zEbQHHxtmWbaZ-8AAAAtA"]
[Tue Apr 21 17:01:09.067941 2026] [:error] [pid 53731:tid 53757] [client 20.238.81.198:40069] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec81V2I9THUR-bRVGz3FgAAAhU"]
[Tue Apr 21 17:01:10.635666 2026] [:error] [pid 53832:tid 53841] [client 20.238.81.198:50761] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "aec81tzkuxsE_OhM9UJDNwAAAkY"]
[Tue Apr 21 17:01:12.883373 2026] [:error] [pid 53731:tid 53741] [client 20.238.81.198:8782] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec82F2I9THUR-bRVGz3IQAAAgY"]
[Tue Apr 21 17:01:17.575550 2026] [:error] [pid 35321:tid 35406] [client 20.238.81.198:40071] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec83TeHLhVUuu8cVXztTQAAAFY"]
[Tue Apr 21 17:01:21.007957 2026] [:error] [pid 53832:tid 53855] [client 20.238.81.198:8945] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec84dzkuxsE_OhM9UJDRAAAAlQ"]
[Tue Apr 21 17:01:23.286408 2026] [:error] [pid 53978:tid 53991] [client 20.238.81.198:33241] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "aec8451ivsR4hcOSQbbOMwAAAos"]
[Tue Apr 21 17:01:24.861505 2026] [:error] [pid 54080:tid 54093] [client 20.238.81.198:52023] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec85IzEbQHHxtmWbaZ_AgAAAss"]
[Tue Apr 21 17:01:27.302548 2026] [:error] [pid 53978:tid 53983] [client 20.238.81.198:37590] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec8551ivsR4hcOSQbbOPwAAAoM"]
[Tue Apr 21 17:01:29.036851 2026] [:error] [pid 53978:tid 53994] [client 20.238.81.198:33264] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec86Z1ivsR4hcOSQbbOSQAAAo4"]
[Tue Apr 21 17:01:31.132909 2026] [:error] [pid 53978:tid 53997] [client 20.238.81.198:33256] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "aec8651ivsR4hcOSQbbOWwAAApE"]
[Tue Apr 21 17:01:34.949534 2026] [:error] [pid 53731:tid 53757] [client 20.238.81.198:53980] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec87l2I9THUR-bRVGz3PwAAAhU"]
[Tue Apr 21 17:01:37.857122 2026] [:error] [pid 53731:tid 53753] [client 20.238.81.198:53233] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec88V2I9THUR-bRVGz3WgAAAhE"]
[Tue Apr 21 17:01:41.403616 2026] [:error] [pid 54080:tid 54103] [client 20.238.81.198:46737] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec89YzEbQHHxtmWbaZ_EQAAAtU"]
[Tue Apr 21 17:01:43.200839 2026] [:error] [pid 35321:tid 35391] [client 20.238.81.198:31106] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "aec89zeHLhVUuu8cVXztgQAAAEc"]
[Tue Apr 21 17:01:48.819459 2026] [:error] [pid 53978:tid 53980] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Tue Apr 21 17:01:49.124273 2026] [:error] [pid 53978:tid 54004] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Tue Apr 21 17:01:49.427132 2026] [:error] [pid 53978:tid 53988] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue Apr 21 17:01:49.735713 2026] [:error] [pid 53978:tid 54003] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Tue Apr 21 17:01:50.497060 2026] [:error] [pid 53978:tid 54003] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Tue Apr 21 17:01:51.170426 2026] [:error] [pid 53978:tid 53981] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Tue Apr 21 17:01:51.473072 2026] [:error] [pid 53978:tid 53995] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue Apr 21 17:01:52.752643 2026] [:error] [pid 53978:tid 53980] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Tue Apr 21 17:01:53.055480 2026] [:error] [pid 53978:tid 53996] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Tue Apr 21 17:01:53.358938 2026] [:error] [pid 53978:tid 53984] [client 20.238.81.198:9112] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Tue Apr 21 17:01:53.658366 2026] [:error] [pid 53978:tid 53994] [client 20.238.81.198:9112] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "aec9AZ1ivsR4hcOSQbbOoQAAAo4"]
[Tue Apr 21 17:01:58.058987 2026] [:error] [pid 53731:tid 53757] [client 20.238.81.198:41997] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "aec9Bl2I9THUR-bRVGz30AAAAhU"]
[Tue Apr 21 17:02:01.748743 2026] [:error] [pid 53978:tid 53991] [client 20.238.81.198:30204] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "aec9CZ1ivsR4hcOSQbbOrQAAAos"]
[Tue Apr 21 17:02:03.772792 2026] [:error] [pid 35415:tid 35427] [client 20.238.81.198:29677] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "aec9C0iqDinI4_22zzhhZwAAAMA"]
[Tue Apr 21 17:02:08.141865 2026] [:error] [pid 35321:tid 35387] [client 20.238.81.198:29656] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "aec9EDeHLhVUuu8cVXzt0wAAAEM"]
[Tue Apr 21 17:02:12.491455 2026] [:error] [pid 4777:tid 4797] [client 20.238.81.198:32864] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "aec9FKxXur6bykKyLZSTDAAAAQk"]
[Tue Apr 21 17:02:15.576419 2026] [:error] [pid 53978:tid 53995] [client 20.238.81.198:51341] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "aec9F51ivsR4hcOSQbbO1QAAAo8"]
[Tue Apr 21 17:02:22.059118 2026] [:error] [pid 53731:tid 53750] [client 20.238.81.198:53925] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec9Hl2I9THUR-bRVGz4owAAAg8"]
[Tue Apr 21 17:02:23.224433 2026] [:error] [pid 53731:tid 53754] [client 20.238.81.198:30453] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec9H12I9THUR-bRVGz4rQAAAhI"]
[Tue Apr 21 17:02:25.547085 2026] [:error] [pid 35320:tid 35336] [client 20.238.81.198:26583] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec9IYJW6fdXWO6agMFL2QAAAAY"]
[Tue Apr 21 17:02:28.199017 2026] [:error] [pid 53731:tid 53755] [client 20.238.81.198:38170] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "aec9JF2I9THUR-bRVGz4yAAAAhM"]
[Tue Apr 21 17:02:31.425829 2026] [:error] [pid 53731:tid 53743] [client 20.238.81.198:33878] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec9J12I9THUR-bRVGz41AAAAgg"]
[Tue Apr 21 17:02:33.176564 2026] [:error] [pid 53978:tid 54004] [client 20.238.81.198:26566] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec9KZ1ivsR4hcOSQbbPDAAAApg"]
[Tue Apr 21 17:02:35.188150 2026] [:error] [pid 53978:tid 53988] [client 20.238.81.198:46819] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec9K51ivsR4hcOSQbbPIQAAAog"]
[Tue Apr 21 17:02:36.736694 2026] [:error] [pid 53978:tid 53992] [client 20.238.81.198:26574] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aec9LJ1ivsR4hcOSQbbPKAAAAow"]
[Tue Apr 21 17:02:38.771781 2026] [:error] [pid 35415:tid 35433] [client 20.238.81.198:36190] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec9LkiqDinI4_22zzhhcAAAAMY"]
[Tue Apr 21 17:02:39.870818 2026] [:error] [pid 53731:tid 53757] [client 20.238.81.198:39351] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec9L12I9THUR-bRVGz5MAAAAhU"]
[Tue Apr 21 17:02:40.812908 2026] [:error] [pid 35321:tid 35405] [client 20.238.81.198:46818] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec9MDeHLhVUuu8cVXzuPQAAAFU"]
[Tue Apr 21 17:02:41.925913 2026] [:error] [pid 35321:tid 35386] [client 20.238.81.198:46793] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "aec9MTeHLhVUuu8cVXzuQQAAAEI"]
[Tue Apr 21 17:02:43.579945 2026] [:error] [pid 53978:tid 53990] [client 20.238.81.198:37509] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec9M51ivsR4hcOSQbbPSwAAAoo"]
[Tue Apr 21 17:02:46.388960 2026] [:error] [pid 53731:tid 53736] [client 20.238.81.198:32565] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec9Nl2I9THUR-bRVGz5SAAAAgE"]
[Tue Apr 21 17:02:47.623084 2026] [:error] [pid 53731:tid 53739] [client 20.238.81.198:36116] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec9N12I9THUR-bRVGz5TAAAAgQ"]
[Tue Apr 21 17:02:49.361819 2026] [:error] [pid 53978:tid 53980] [client 20.238.81.198:56432] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aec9OZ1ivsR4hcOSQbbPXgAAAoA"]
[Tue Apr 21 17:02:53.007839 2026] [:error] [pid 53731:tid 53758] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Tue Apr 21 17:02:53.347553 2026] [:error] [pid 53731:tid 53753] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/motu.php
[Tue Apr 21 17:02:53.702626 2026] [:error] [pid 53731:tid 53752] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Tue Apr 21 17:02:54.043632 2026] [:error] [pid 53731:tid 53735] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/xa.php
[Tue Apr 21 17:02:54.409019 2026] [:error] [pid 53731:tid 53750] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Tue Apr 21 17:02:54.768594 2026] [:error] [pid 53731:tid 53759] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Tue Apr 21 17:02:55.122184 2026] [:error] [pid 53731:tid 53748] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/666.php
[Tue Apr 21 17:02:55.463744 2026] [:error] [pid 53731:tid 53743] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Tue Apr 21 17:02:55.803560 2026] [:error] [pid 53731:tid 53755] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/prosellers8.php
[Tue Apr 21 17:02:56.165890 2026] [:error] [pid 53731:tid 53737] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Tue Apr 21 17:02:56.505008 2026] [:error] [pid 53731:tid 53745] [client 20.238.81.198:33956] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Tue Apr 21 17:02:57.028831 2026] [:error] [pid 53731:tid 53758] [client 20.238.81.198:33956] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec9QV2I9THUR-bRVGz5fQAAAhY"]
[Tue Apr 21 17:02:59.432712 2026] [:error] [pid 53978:tid 53986] [client 20.238.81.198:31632] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec9Q51ivsR4hcOSQbbPfgAAAoY"]
[Tue Apr 21 17:03:00.959369 2026] [:error] [pid 35321:tid 35400] [client 20.238.81.198:31620] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec9RDeHLhVUuu8cVXzuZQAAAFA"]
[Tue Apr 21 17:03:04.117107 2026] [:error] [pid 35321:tid 35402] [client 20.238.81.198:11604] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "aec9SDeHLhVUuu8cVXzubQAAAFI"]
[Tue Apr 21 17:03:06.575983 2026] [:error] [pid 35321:tid 35404] [client 20.238.81.198:27049] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aec9SjeHLhVUuu8cVXzubgAAAFQ"]
[Tue Apr 21 17:03:11.873511 2026] [:error] [pid 35321:tid 35398] [client 20.238.81.198:36364] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "aec9TzeHLhVUuu8cVXzudwAAAE4"]
[Tue Apr 21 17:03:20.389734 2026] [:error] [pid 53978:tid 53986] [client 20.238.81.198:57051] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec9WJ1ivsR4hcOSQbbPkAAAAoY"]
[Tue Apr 21 17:03:23.280373 2026] [:error] [pid 53731:tid 53740] [client 20.238.81.198:52090] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec9W12I9THUR-bRVGz6HQAAAgU"]
[Tue Apr 21 17:03:28.577147 2026] [:error] [pid 53978:tid 54004] [client 20.238.81.198:62648] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec9YJ1ivsR4hcOSQbbPpQAAApg"]
[Tue Apr 21 17:03:30.247466 2026] [:error] [pid 53731:tid 53735] [client 20.238.81.198:56350] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "aec9Yl2I9THUR-bRVGz6VgAAAgA"]
[Tue Apr 21 17:03:31.644677 2026] [:error] [pid 53731:tid 53745] [client 20.238.81.198:36776] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec9Y12I9THUR-bRVGz6YgAAAgo"]
[Tue Apr 21 17:03:34.125097 2026] [:error] [pid 53731:tid 53757] [client 20.238.81.198:42097] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec9Zl2I9THUR-bRVGz6dQAAAhU"]
[Tue Apr 21 17:03:36.013695 2026] [:error] [pid 35321:tid 35408] [client 20.238.81.198:42102] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec9aDeHLhVUuu8cVXzu3gAAAFg"]
[Tue Apr 21 17:03:37.533043 2026] [:error] [pid 35321:tid 35399] [client 20.238.81.198:42111] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "aec9aTeHLhVUuu8cVXzu7AAAAE8"]
[Tue Apr 21 17:03:38.379417 2026] [:error] [pid 35321:tid 35386] [client 20.238.81.198:28055] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec9ajeHLhVUuu8cVXzu8AAAAEI"]
[Tue Apr 21 17:03:39.997420 2026] [:error] [pid 35320:tid 35339] [client 20.238.81.198:38239] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec9a4JW6fdXWO6agMFMNgAAAAk"]
[Tue Apr 21 17:03:42.274868 2026] [:error] [pid 35321:tid 35386] [client 20.238.81.198:53120] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec9bjeHLhVUuu8cVXzu-QAAAEI"]
[Tue Apr 21 17:03:44.046130 2026] [:error] [pid 54080:tid 54106] [client 20.238.81.198:56330] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "aec9cIzEbQHHxtmWbaZ_bQAAAtg"]
[Tue Apr 21 17:03:45.699477 2026] [:error] [pid 53731:tid 53745] [client 20.238.81.198:42668] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec9cV2I9THUR-bRVGz6sgAAAgo"]
[Tue Apr 21 17:03:46.596053 2026] [:error] [pid 53978:tid 53999] [client 20.238.81.198:38225] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec9cp1ivsR4hcOSQbbPzQAAApM"]
[Tue Apr 21 17:03:47.613125 2026] [:error] [pid 53978:tid 54000] [client 20.238.81.198:42684] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec9c51ivsR4hcOSQbbP0QAAApQ"]
[Tue Apr 21 17:03:50.590987 2026] [:error] [pid 35321:tid 35389] [client 20.238.81.198:56368] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aec9djeHLhVUuu8cVXzvCAAAAEU"]
[Tue Apr 21 17:03:53.152909 2026] [:error] [pid 35320:tid 35351] [client 20.238.81.198:63106] [client 20.238.81.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "aec9eYJW6fdXWO6agMFMQAAAABU"]
[Tue Apr 21 17:03:56.241908 2026] [:error] [pid 35322:tid 35363] [client 20.238.81.198:28032] File does not exist: /usr/local/apache/htdocs/suspended-page/ai.php
[Tue Apr 21 17:03:56.522944 2026] [:error] [pid 35322:tid 35378] [client 20.238.81.198:28032] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Tue Apr 21 17:25:50.670954 2026] [:error] [pid 54080:tid 54092] [client 18.181.86.107:55782] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "aedCnozEbQHHxtmWbaaE_gAAAso"]
[Tue Apr 21 17:25:51.380469 2026] [:error] [pid 54080:tid 54095] [client 18.181.86.107:55798] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "aedCn4zEbQHHxtmWbaaFAAAAAs0"]
[Tue Apr 21 17:25:51.947993 2026] [:error] [pid 53832:tid 53843] [client 18.181.86.107:55812] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.local"] [unique_id "aedCn9zkuxsE_OhM9UJHtwAAAkg"]
[Tue Apr 21 17:25:52.510756 2026] [:error] [pid 53978:tid 54000] [client 18.181.86.107:55826] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.production"] [unique_id "aedCoJ1ivsR4hcOSQbbbjgAAApQ"]
[Tue Apr 21 17:25:53.067071 2026] [:error] [pid 35415:tid 35436] [client 18.181.86.107:55832] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.staging"] [unique_id "aedCoUiqDinI4_22zzhjfAAAAMk"]
[Tue Apr 21 17:25:53.630333 2026] [:error] [pid 53832:tid 53859] [client 18.181.86.107:55840] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.development"] [unique_id "aedCodzkuxsE_OhM9UJHugAAAlg"]
[Tue Apr 21 17:25:54.192600 2026] [:error] [pid 53731:tid 53737] [client 18.181.86.107:55856] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.test"] [unique_id "aedCol2I9THUR-bRVGwNSwAAAgI"]
[Tue Apr 21 17:25:54.750722 2026] [:error] [pid 53978:tid 54004] [client 18.181.86.107:55872] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.remote"] [unique_id "aedCop1ivsR4hcOSQbbblwAAApg"]
[Tue Apr 21 17:25:55.307985 2026] [:error] [pid 53978:tid 53999] [client 18.181.86.107:55878] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.bak"] [unique_id "aedCo51ivsR4hcOSQbbbmwAAApM"]
[Tue Apr 21 17:25:55.899861 2026] [:error] [pid 53978:tid 53989] [client 18.181.86.107:33042] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.backup"] [unique_id "aedCo51ivsR4hcOSQbbbowAAAok"]
[Tue Apr 21 17:25:56.457750 2026] [:error] [pid 35321:tid 35393] [client 18.181.86.107:33050] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.save"] [unique_id "aedCpDeHLhVUuu8cVXz3-wAAAEk"]
[Tue Apr 21 17:25:57.011882 2026] [:error] [pid 35321:tid 35384] [client 18.181.86.107:33064] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.old"] [unique_id "aedCpTeHLhVUuu8cVXz3_gAAAEA"]
[Tue Apr 21 17:25:57.570574 2026] [:error] [pid 53731:tid 53749] [client 18.181.86.107:33074] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.sample"] [unique_id "aedCpV2I9THUR-bRVGwNWAAAAg4"]
[Tue Apr 21 17:25:58.135024 2026] [:error] [pid 53731:tid 53736] [client 18.181.86.107:33082] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.example"] [unique_id "aedCpl2I9THUR-bRVGwNWwAAAgE"]
[Tue Apr 21 17:25:58.700283 2026] [:error] [pid 35321:tid 35391] [client 18.181.86.107:33088] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.dev"] [unique_id "aedCpjeHLhVUuu8cVXz4BQAAAEc"]
[Tue Apr 21 17:25:59.260486 2026] [:error] [pid 53731:tid 53748] [client 18.181.86.107:33102] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.prod"] [unique_id "aedCp12I9THUR-bRVGwNZwAAAg0"]
[Tue Apr 21 17:25:59.823616 2026] [:error] [pid 35320:tid 35345] [client 18.181.86.107:33112] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.stage"] [unique_id "aedCp4JW6fdXWO6agMFTigAAAA8"]
[Tue Apr 21 17:26:00.386840 2026] [:error] [pid 4777:tid 4796] [client 18.181.86.107:33124] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.ci"] [unique_id "aedCqKxXur6bykKyLZSVZQAAAQg"]
[Tue Apr 21 17:26:00.946529 2026] [:error] [pid 53978:tid 53992] [client 18.181.86.107:33130] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.docker"] [unique_id "aedCqJ1ivsR4hcOSQbbbrQAAAow"]
[Tue Apr 21 17:26:01.506157 2026] [:error] [pid 53731:tid 53760] [client 18.181.86.107:33132] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.live"] [unique_id "aedCqV2I9THUR-bRVGwNcgAAAhg"]
[Tue Apr 21 17:26:02.065250 2026] [:error] [pid 53731:tid 53759] [client 18.181.86.107:33146] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.preprod"] [unique_id "aedCql2I9THUR-bRVGwNdwAAAhc"]
[Tue Apr 21 17:26:02.627279 2026] [:error] [pid 35320:tid 35336] [client 18.181.86.107:33152] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.uat"] [unique_id "aedCqoJW6fdXWO6agMFTkAAAAAY"]
[Tue Apr 21 17:26:03.190852 2026] [:error] [pid 35320:tid 35350] [client 18.181.86.107:33162] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.dist"] [unique_id "aedCq4JW6fdXWO6agMFTkwAAABQ"]
[Tue Apr 21 17:26:03.750131 2026] [:error] [pid 53731:tid 53735] [client 18.181.86.107:33178] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.swp"] [unique_id "aedCq12I9THUR-bRVGwNggAAAgA"]
[Tue Apr 21 17:26:04.303976 2026] [:error] [pid 53731:tid 53741] [client 18.181.86.107:33190] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env~"] [unique_id "aedCrF2I9THUR-bRVGwNhgAAAgY"]
[Tue Apr 21 17:26:04.859697 2026] [:error] [pid 35320:tid 35351] [client 18.181.86.107:33198] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/app/.env"] [unique_id "aedCrIJW6fdXWO6agMFTnAAAABU"]
[Tue Apr 21 17:26:05.423977 2026] [:error] [pid 53731:tid 53745] [client 18.181.86.107:58878] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/apps/.env"] [unique_id "aedCrV2I9THUR-bRVGwNjwAAAgo"]
[Tue Apr 21 17:26:07.893774 2026] [:error] [pid 53731:tid 53741] [client 18.181.86.107:58890] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/web/.env"] [unique_id "aedCr12I9THUR-bRVGwNnwAAAgY"]
[Tue Apr 21 17:26:08.452433 2026] [:error] [pid 53731:tid 53739] [client 18.181.86.107:58894] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/site/.env"] [unique_id "aedCsF2I9THUR-bRVGwNpgAAAgQ"]
[Tue Apr 21 17:26:09.006895 2026] [:error] [pid 53731:tid 53749] [client 18.181.86.107:58902] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/public/.env"] [unique_id "aedCsV2I9THUR-bRVGwNrAAAAg4"]
[Tue Apr 21 17:26:09.568716 2026] [:error] [pid 53731:tid 53745] [client 18.181.86.107:58916] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/admin/.env"] [unique_id "aedCsV2I9THUR-bRVGwNsQAAAgo"]
[Tue Apr 21 17:26:10.129171 2026] [:error] [pid 53731:tid 53744] [client 18.181.86.107:58922] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/backend/.env"] [unique_id "aedCsl2I9THUR-bRVGwNtgAAAgk"]
[Tue Apr 21 17:26:10.683328 2026] [:error] [pid 35321:tid 35388] [client 18.181.86.107:58924] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/server/.env"] [unique_id "aedCsjeHLhVUuu8cVXz4CgAAAEQ"]
[Tue Apr 21 17:26:11.236748 2026] [:error] [pid 53731:tid 53740] [client 18.181.86.107:58934] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/frontend/.env"] [unique_id "aedCs12I9THUR-bRVGwNvAAAAgU"]
[Tue Apr 21 17:26:11.796675 2026] [:error] [pid 35320:tid 35354] [client 18.181.86.107:58938] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/src/.env"] [unique_id "aedCs4JW6fdXWO6agMFTrQAAABg"]
[Tue Apr 21 17:26:12.355524 2026] [:error] [pid 53978:tid 53984] [client 18.181.86.107:58944] [client 18.181.86.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/core/.env"] [unique_id "aedCtJ1ivsR4hcOSQbbbvwAAAoQ"]
[Tue Apr 21 19:10:48.079060 2026] [:error] [pid 35322:tid 35377] [client 34.72.28.67:53794] [client 34.72.28.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.28.67, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aedbOKPoAfV40BTfVKzVFAAAAJQ"]
[Tue Apr 21 19:10:48.082013 2026] [:error] [pid 35322:tid 35377] [client 34.72.28.67:53794] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Tue Apr 21 19:10:50.519956 2026] [:error] [pid 35322:tid 35363] [client 34.72.28.67:53794] [client 34.72.28.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aedbOqPoAfV40BTfVKzVHwAAAIY"]
[Tue Apr 21 19:10:53.284735 2026] [:error] [pid 4823:tid 4874] [client 34.72.28.67:61811] [client 34.72.28.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aedbPfc8mke3PfHqsxHvVQAAAZU"]
[Tue Apr 21 19:10:54.477701 2026] [:error] [pid 53731:tid 53758] [client 34.72.28.67:53221] [client 34.72.28.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aedbPl2I9THUR-bRVGw6tAAAAhY"]
[Tue Apr 21 19:10:56.069558 2026] [:error] [pid 53832:tid 53854] [client 34.72.28.67:53530] [client 34.72.28.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aedbQNzkuxsE_OhM9UJaEwAAAlM"]
[Tue Apr 21 19:10:57.583880 2026] [:error] [pid 35321:tid 35387] [client 34.72.28.67:64610] [client 34.72.28.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aedbQTeHLhVUuu8cVXxH_AAAAEM"]
[Tue Apr 21 19:10:59.148044 2026] [:error] [pid 4823:tid 4871] [client 34.72.28.67:50398] [client 34.72.28.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aedbQ_c8mke3PfHqsxHvbwAAAZI"]
[Tue Apr 21 19:11:00.401782 2026] [:error] [pid 35321:tid 35384] [client 34.72.28.67:51908] [client 34.72.28.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aedbRDeHLhVUuu8cVXxICAAAAEA"]
[Tue Apr 21 19:14:42.276191 2026] [:error] [pid 35321:tid 35395] [client 138.197.165.12:52384] [client 138.197.165.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.165.12, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aedcIjeHLhVUuu8cVXxK-gAAAEs"]
[Tue Apr 21 19:14:42.279868 2026] [:error] [pid 35321:tid 35395] [client 138.197.165.12:52384] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 21 21:16:48.419616 2026] [:error] [pid 53731:tid 53750] [client 43.128.103.68:53808] [client 43.128.103.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aed4wF2I9THUR-bRVGxs2QAAAg8"]
[Tue Apr 21 23:04:43.413561 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Tue Apr 21 23:04:43.903090 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Tue Apr 21 23:04:44.393519 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue Apr 21 23:04:44.896572 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Tue Apr 21 23:04:45.402088 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue Apr 21 23:04:45.907852 2026] [:error] [pid 35320:tid 35351] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Tue Apr 21 23:04:46.398783 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue Apr 21 23:04:46.889472 2026] [:error] [pid 35320:tid 35348] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Tue Apr 21 23:04:47.936141 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue Apr 21 23:04:48.449808 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Tue Apr 21 23:04:48.938761 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue Apr 21 23:04:49.431140 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Tue Apr 21 23:04:49.935637 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue Apr 21 23:04:50.458658 2026] [:error] [pid 35320:tid 35330] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Tue Apr 21 23:04:50.950190 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue Apr 21 23:04:51.459533 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Tue Apr 21 23:04:51.961200 2026] [:error] [pid 35320:tid 35338] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue Apr 21 23:04:52.454010 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.13:39443] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Tue Apr 21 23:04:59.378812 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.13:39443] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeeSG4JW6fdXWO6agMEJ8wAAABE"]
[Tue Apr 21 23:05:01.981660 2026] [:error] [pid 35415:tid 35427] [client 45.137.126.7:62781] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeeSHUiqDinI4_22zzh_tgAAAMA"]
[Tue Apr 21 23:05:04.450479 2026] [:error] [pid 35415:tid 35446] [client 45.137.126.36:39241] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue Apr 21 23:05:05.930928 2026] [:error] [pid 35415:tid 35443] [client 45.137.126.36:39241] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeeSIUiqDinI4_22zzh_vQAAANA"]
[Tue Apr 21 23:05:07.919568 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.32:53857] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Tue Apr 21 23:05:08.412585 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.32:53857] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aeeSJIJW6fdXWO6agMEKCQAAAA4"]
[Tue Apr 21 23:05:09.915542 2026] [:error] [pid 53978:tid 53986] [client 45.137.126.30:48663] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue Apr 21 23:05:12.398867 2026] [:error] [pid 53978:tid 54002] [client 45.137.126.30:48663] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeeSKJ1ivsR4hcOSQbZG9gAAApY"]
[Tue Apr 21 23:05:15.490269 2026] [:error] [pid 35321:tid 35388] [client 45.137.126.34:54391] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeeSKzeHLhVUuu8cVXwDEwAAAEQ"]
[Tue Apr 21 23:05:16.478109 2026] [:error] [pid 35321:tid 35400] [client 45.137.126.21:36773] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeeSLDeHLhVUuu8cVXwDFQAAAFA"]
[Tue Apr 21 23:05:17.450953 2026] [:error] [pid 4823:tid 4868] [client 45.137.126.52:22795] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeeSLfc8mke3PfHqsxEOyAAAAY8"]
[Tue Apr 21 23:05:18.422103 2026] [:error] [pid 35321:tid 35393] [client 45.137.126.20:38837] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeeSLjeHLhVUuu8cVXwDHQAAAEk"]
[Tue Apr 21 23:05:19.400737 2026] [:error] [pid 53731:tid 53740] [client 45.137.126.52:31109] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeeSL12I9THUR-bRVGyZNQAAAgU"]
[Tue Apr 21 23:05:20.894754 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.17:36957] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aeeSMIJW6fdXWO6agMEKHQAAAAo"]
[Tue Apr 21 23:05:21.889479 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.50:60929] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Tue Apr 21 23:05:22.886473 2026] [:error] [pid 35320:tid 35354] [client 45.137.126.50:60929] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aeeSMoJW6fdXWO6agMEKKwAAABg"]
[Tue Apr 21 23:05:24.864575 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.45:47617] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aeeSNIJW6fdXWO6agMEKNAAAAA4"]
[Tue Apr 21 23:05:26.332204 2026] [:error] [pid 35321:tid 35396] [client 45.137.126.13:28791] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aeeSNjeHLhVUuu8cVXwDMwAAAEw"]
[Tue Apr 21 23:05:27.308305 2026] [:error] [pid 53978:tid 53998] [client 45.137.126.33:63455] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Tue Apr 21 23:05:27.806380 2026] [:error] [pid 53978:tid 53988] [client 45.137.126.33:63455] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aeeSN51ivsR4hcOSQbZHAAAAAog"]
[Tue Apr 21 23:05:28.827840 2026] [:error] [pid 35321:tid 35388] [client 45.137.126.37:52083] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Tue Apr 21 23:05:30.308605 2026] [:error] [pid 35321:tid 35400] [client 45.137.126.37:52083] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue Apr 21 23:05:32.018284 2026] [:error] [pid 35321:tid 35403] [client 45.137.126.37:52083] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aeeSPDeHLhVUuu8cVXwDSQAAAFM"]
[Tue Apr 21 23:05:33.000755 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.24:36397] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Tue Apr 21 23:05:33.488649 2026] [:error] [pid 35321:tid 35401] [client 45.137.126.24:36397] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aeeSPTeHLhVUuu8cVXwDTQAAAFE"]
[Tue Apr 21 23:05:34.507299 2026] [:error] [pid 54080:tid 54099] [client 45.137.126.22:39299] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Tue Apr 21 23:05:36.065998 2026] [:error] [pid 54080:tid 54086] [client 45.137.126.22:39299] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aeeSQIzEbQHHxtmWbabYBgAAAsQ"]
[Tue Apr 21 23:05:37.545800 2026] [:error] [pid 4823:tid 4863] [client 45.137.126.44:40027] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aeeSQfc8mke3PfHqsxEO3AAAAYo"]
[Tue Apr 21 23:05:39.019149 2026] [:error] [pid 4823:tid 4854] [client 45.137.126.20:43291] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Tue Apr 21 23:05:39.520484 2026] [:error] [pid 4823:tid 4853] [client 45.137.126.20:43291] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Tue Apr 21 23:05:40.503847 2026] [:error] [pid 4823:tid 4876] [client 45.137.126.20:43291] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aeeSRPc8mke3PfHqsxEO4wAAAZc"]
[Tue Apr 21 23:05:41.968443 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.23:29437] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aeeSRYJW6fdXWO6agMEKWAAAAAU"]
[Tue Apr 21 23:05:43.453343 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.17:33655] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aeeSR4JW6fdXWO6agMEKaAAAAAU"]
[Tue Apr 21 23:05:44.430301 2026] [:error] [pid 53731:tid 53739] [client 45.137.126.38:29337] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aeeSSF2I9THUR-bRVGyZOwAAAgQ"]
[Tue Apr 21 23:05:45.401936 2026] [:error] [pid 53731:tid 53741] [client 45.137.126.14:58949] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aeeSSV2I9THUR-bRVGyZRAAAAgY"]
[Tue Apr 21 23:05:47.351228 2026] [:error] [pid 35320:tid 35330] [client 45.137.126.17:27551] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Tue Apr 21 23:05:47.840072 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.17:27551] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aeeSS4JW6fdXWO6agMEKkQAAAAE"]
[Tue Apr 21 23:05:48.819824 2026] [:error] [pid 35320:tid 35348] [client 45.137.126.31:56339] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aeeSTIJW6fdXWO6agMEKlAAAABI"]
[Tue Apr 21 23:05:49.828582 2026] [:error] [pid 54080:tid 54084] [client 45.137.126.30:50545] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aeeSTYzEbQHHxtmWbabYHwAAAsI"]
[Tue Apr 21 23:05:51.847789 2026] [:error] [pid 35321:tid 35407] [client 45.137.126.19:51901] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue Apr 21 23:05:52.933552 2026] [:error] [pid 35321:tid 35390] [client 45.137.126.19:51901] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Tue Apr 21 23:05:54.890473 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.19:51901] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aeeSUjeHLhVUuu8cVXwDcwAAAEg"]
[Tue Apr 21 23:05:57.371465 2026] [:error] [pid 4823:tid 4872] [client 45.137.126.52:29271] [client 45.137.126.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.52, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aeeSVfc8mke3PfHqsxEO7gAAAZM"]
[Tue Apr 21 23:05:57.866435 2026] [:error] [pid 4823:tid 4853] [client 45.137.126.52:29271] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Tue Apr 21 23:06:00.338716 2026] [:error] [pid 4823:tid 4862] [client 45.137.126.52:29271] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Tue Apr 21 23:06:01.032943 2026] [:error] [pid 4823:tid 4874] [client 45.137.126.52:29271] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Tue Apr 21 23:06:03.504520 2026] [:error] [pid 4823:tid 4861] [client 45.137.126.52:29271] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aeeSW_c8mke3PfHqsxEO-gAAAYg"]
[Tue Apr 21 23:06:04.989843 2026] [:error] [pid 4823:tid 4875] [client 45.137.126.48:20315] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue Apr 21 23:06:05.478197 2026] [:error] [pid 4823:tid 4865] [client 45.137.126.48:20315] [client 45.137.126.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.48, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aeeSXfc8mke3PfHqsxEO_gAAAYw"]
[Tue Apr 21 23:06:06.461054 2026] [:error] [pid 4823:tid 4858] [client 45.137.126.48:20315] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aeeSXvc8mke3PfHqsxEPAAAAAYU"]
[Tue Apr 21 23:06:09.463666 2026] [:error] [pid 35320:tid 35337] [client 45.137.126.8:52055] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue Apr 21 23:06:10.450667 2026] [:error] [pid 35320:tid 35336] [client 45.137.126.8:52055] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Tue Apr 21 23:06:11.438766 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.8:52055] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aeeSY4JW6fdXWO6agMELAwAAAAI"]
[Tue Apr 21 23:06:12.458259 2026] [:error] [pid 53731:tid 53746] [client 45.137.126.5:33075] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue Apr 21 23:06:13.956598 2026] [:error] [pid 53731:tid 53738] [client 45.137.126.5:33075] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Tue Apr 21 23:06:14.934637 2026] [:error] [pid 53731:tid 53735] [client 45.137.126.5:33075] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Tue Apr 21 23:06:16.929382 2026] [:error] [pid 53731:tid 53758] [client 45.137.126.5:33075] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Tue Apr 21 23:06:17.415587 2026] [:error] [pid 53731:tid 53740] [client 45.137.126.5:33075] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aeeSaV2I9THUR-bRVGyZkgAAAgU"]
[Tue Apr 21 23:06:18.397427 2026] [:error] [pid 54080:tid 54099] [client 45.137.126.14:29285] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Tue Apr 21 23:06:18.888712 2026] [:error] [pid 54080:tid 54093] [client 45.137.126.14:29285] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Tue Apr 21 23:06:19.377289 2026] [:error] [pid 54080:tid 54085] [client 45.137.126.14:29285] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aeeSa4zEbQHHxtmWbabYOAAAAsM"]
[Tue Apr 21 23:06:20.855871 2026] [:error] [pid 54080:tid 54100] [client 45.137.126.25:26717] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Tue Apr 21 23:06:21.837655 2026] [:error] [pid 54080:tid 54083] [client 45.137.126.25:26717] [client 45.137.126.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.25, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aeeSbYzEbQHHxtmWbabYQAAAAsE"]
[Tue Apr 21 23:06:22.336514 2026] [:error] [pid 54080:tid 54101] [client 45.137.126.25:26717] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aeeSbozEbQHHxtmWbabYQQAAAtM"]
[Tue Apr 21 23:06:28.288135 2026] [:error] [pid 35322:tid 35365] [client 45.137.126.35:22023] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Tue Apr 21 23:06:31.336070 2026] [:error] [pid 35322:tid 35362] [client 45.137.126.35:22023] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Tue Apr 21 23:06:31.823453 2026] [:error] [pid 35322:tid 35368] [client 45.137.126.35:22023] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aeeSd6PoAfV40BTfVKzlEQAAAIs"]
[Tue Apr 21 23:06:32.806865 2026] [:error] [pid 35320:tid 35351] [client 45.137.126.27:23115] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Tue Apr 21 23:06:34.292420 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.27:23115] [client 45.137.126.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.27, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aeeSeoJW6fdXWO6agMELUwAAAAU"]
[Tue Apr 21 23:06:34.821358 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.27:23115] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Tue Apr 21 23:06:35.330544 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.27:23115] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Tue Apr 21 23:06:35.885833 2026] [:error] [pid 35320:tid 35348] [client 45.137.126.27:23115] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Tue Apr 21 23:06:36.379738 2026] [:error] [pid 35320:tid 35351] [client 45.137.126.27:23115] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aeeSfIJW6fdXWO6agMELXAAAABU"]
[Tue Apr 21 23:06:37.359416 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.17:56581] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Tue Apr 21 23:06:37.846316 2026] [:error] [pid 35321:tid 35390] [client 45.137.126.17:56581] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aeeSfTeHLhVUuu8cVXwDtgAAAEY"]
[Tue Apr 21 23:06:39.319517 2026] [:error] [pid 35321:tid 35402] [client 45.137.126.11:62417] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue Apr 21 23:06:39.810067 2026] [:error] [pid 35321:tid 35389] [client 45.137.126.11:62417] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aeeSfzeHLhVUuu8cVXwDugAAAEU"]
[Tue Apr 21 23:06:41.784186 2026] [:error] [pid 35321:tid 35399] [client 45.137.126.24:35621] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Tue Apr 21 23:06:42.271321 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.24:35621] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aeeSgjeHLhVUuu8cVXwDwwAAAEM"]
[Tue Apr 21 23:06:43.241009 2026] [:error] [pid 4823:tid 4870] [client 45.137.126.47:64115] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aeeSg_c8mke3PfHqsxEPDQAAAZE"]
[Tue Apr 21 23:06:44.225608 2026] [:error] [pid 53731:tid 53738] [client 45.137.126.28:52719] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Tue Apr 21 23:06:44.720541 2026] [:error] [pid 53731:tid 53756] [client 45.137.126.28:52719] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Tue Apr 21 23:06:46.683819 2026] [:error] [pid 53731:tid 53752] [client 45.137.126.28:52719] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aeeShl2I9THUR-bRVGyZrQAAAhA"]
[Tue Apr 21 23:06:48.157820 2026] [:error] [pid 4777:tid 4795] [client 45.137.126.32:38669] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aeeSiKxXur6bykKyLZS5MgAAAQc"]
[Tue Apr 21 23:06:50.648377 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.48:47709] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aeeSijeHLhVUuu8cVXwD7QAAAFY"]
[Tue Apr 21 23:06:51.627361 2026] [:error] [pid 35320:tid 35350] [client 45.137.126.38:49421] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Tue Apr 21 23:06:52.613061 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.38:49421] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Tue Apr 21 23:06:53.105286 2026] [:error] [pid 35320:tid 35330] [client 45.137.126.38:49421] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aeeSjYJW6fdXWO6agMELfgAAAAA"]
[Tue Apr 21 23:06:54.083423 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.28:48239] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Tue Apr 21 23:06:55.065363 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.28:48239] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "aeeSj4JW6fdXWO6agMELigAAAAQ"]
[Tue Apr 21 23:06:57.562158 2026] [:error] [pid 35321:tid 35399] [client 45.137.126.40:49581] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aeeSkTeHLhVUuu8cVXwEFAAAAE8"]
[Tue Apr 21 23:06:59.030118 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.3:41049] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue Apr 21 23:07:00.524960 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.3:41049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Tue Apr 21 23:07:01.647194 2026] [:error] [pid 35320:tid 35338] [client 45.137.126.3:41049] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Tue Apr 21 23:07:02.132884 2026] [:error] [pid 35320:tid 35354] [client 45.137.126.3:41049] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aeeSloJW6fdXWO6agMELrgAAABg"]
[Tue Apr 21 23:07:03.109984 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.29:44223] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aeeSl4JW6fdXWO6agMELvgAAAAU"]
[Tue Apr 21 23:07:04.098988 2026] [:error] [pid 53731:tid 53737] [client 45.137.126.11:35441] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aeeSmF2I9THUR-bRVGyZtAAAAgI"]
[Tue Apr 21 23:07:05.097743 2026] [:error] [pid 53978:tid 54000] [client 45.137.126.39:46613] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aeeSmZ1ivsR4hcOSQbZHUgAAApQ"]
[Tue Apr 21 23:07:06.076493 2026] [:error] [pid 35320:tid 35338] [client 45.137.126.13:29473] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Tue Apr 21 23:07:06.580682 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.13:29473] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aeeSmoJW6fdXWO6agMEL5AAAABY"]
[Tue Apr 21 23:07:07.638051 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.41:26371] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aeeSm4JW6fdXWO6agMEL7gAAAAw"]
[Tue Apr 21 23:07:08.665607 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.28:45197] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Tue Apr 21 23:07:09.688039 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.28:45197] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeeSnYJW6fdXWO6agMEL_QAAAAs"]
[Tue Apr 21 23:07:10.661424 2026] [:error] [pid 53731:tid 53742] [client 45.137.126.36:34407] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aeeSnl2I9THUR-bRVGyZuAAAAgc"]
[Tue Apr 21 23:07:11.631481 2026] [:error] [pid 4777:tid 4808] [client 45.137.126.40:61083] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aeeSn6xXur6bykKyLZS5OAAAARQ"]
[Tue Apr 21 23:07:12.603022 2026] [:error] [pid 53731:tid 53757] [client 45.137.126.46:45837] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aeeSoF2I9THUR-bRVGyZwQAAAhU"]
[Tue Apr 21 23:07:14.069751 2026] [:error] [pid 53731:tid 53748] [client 45.137.126.44:45995] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aeeSol2I9THUR-bRVGyZxwAAAg0"]
[Tue Apr 21 23:07:16.040058 2026] [:error] [pid 4823:tid 4858] [client 45.137.126.9:25861] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aeeSpPc8mke3PfHqsxEPHAAAAYU"]
[Tue Apr 21 23:07:17.019569 2026] [:error] [pid 53731:tid 53747] [client 45.137.126.22:48633] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Tue Apr 21 23:07:18.494393 2026] [:error] [pid 53731:tid 53739] [client 45.137.126.22:48633] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Tue Apr 21 23:07:18.983724 2026] [:error] [pid 53731:tid 53741] [client 45.137.126.22:48633] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aeeSpl2I9THUR-bRVGyZ0AAAAgY"]
[Tue Apr 21 23:07:20.447088 2026] [:error] [pid 35415:tid 35443] [client 45.137.126.8:20223] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Tue Apr 21 23:07:21.018697 2026] [:error] [pid 35415:tid 35439] [client 45.137.126.8:20223] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Tue Apr 21 23:07:23.485726 2026] [:error] [pid 35415:tid 35428] [client 45.137.126.8:20223] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aeeSq0iqDinI4_22zzh_3QAAAME"]
[Tue Apr 21 23:07:25.998862 2026] [:error] [pid 4823:tid 4867] [client 45.137.126.5:34185] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aeeSrfc8mke3PfHqsxEPJwAAAY4"]
[Tue Apr 21 23:07:26.973296 2026] [:error] [pid 53731:tid 53737] [client 45.137.126.23:21665] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aeeSrl2I9THUR-bRVGyZ3AAAAgI"]
[Tue Apr 21 23:07:29.948109 2026] [:error] [pid 35322:tid 35369] [client 45.137.126.34:63321] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aeeSsaPoAfV40BTfVKzlIQAAAIw"]
[Tue Apr 21 23:07:32.041990 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.4:58137] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Tue Apr 21 23:07:32.535636 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.4:58137] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Tue Apr 21 23:07:33.038828 2026] [:error] [pid 35320:tid 35338] [client 45.137.126.4:58137] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Tue Apr 21 23:07:33.530064 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.4:58137] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Tue Apr 21 23:07:35.984798 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.4:58137] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aeeSt4JW6fdXWO6agMEMaAAAAAE"]
[Tue Apr 21 23:07:36.959362 2026] [:error] [pid 53978:tid 54000] [client 45.137.126.16:63801] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aeeSuJ1ivsR4hcOSQbZHbwAAApQ"]
[Tue Apr 21 23:07:37.936101 2026] [:error] [pid 54080:tid 54094] [client 45.137.126.30:53069] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aeeSuYzEbQHHxtmWbabYxQAAAsw"]
[Tue Apr 21 23:07:38.909486 2026] [:error] [pid 35321:tid 35408] [client 45.137.126.23:63179] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aeeSujeHLhVUuu8cVXwEMQAAAFg"]
[Tue Apr 21 23:07:39.893711 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.22:25485] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aeeSu4JW6fdXWO6agMEMcAAAAAU"]
[Tue Apr 21 23:07:40.870549 2026] [:error] [pid 35322:tid 35378] [client 45.137.126.10:52339] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aeeSvKPoAfV40BTfVKzlLgAAAJU"]
[Tue Apr 21 23:07:42.343845 2026] [:error] [pid 4777:tid 4805] [client 45.137.126.46:42723] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aeeSvqxXur6bykKyLZS5WAAAARE"]
[Tue Apr 21 23:07:43.316302 2026] [:error] [pid 4777:tid 4807] [client 45.137.126.12:30627] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aeeSv6xXur6bykKyLZS5XAAAARM"]
[Tue Apr 21 23:07:44.340451 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.15:64389] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aeeSwIJW6fdXWO6agMEMdAAAAAo"]
[Tue Apr 21 23:07:45.313654 2026] [:error] [pid 53731:tid 53755] [client 45.137.126.12:30213] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aeeSwV2I9THUR-bRVGyZ5gAAAhM"]
[Tue Apr 21 23:07:47.300986 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.3:33259] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aeeSw4JW6fdXWO6agMEMeQAAAAs"]
[Tue Apr 21 23:07:48.767686 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.33:61389] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aeeSxIJW6fdXWO6agMEMewAAABc"]
[Tue Apr 21 23:07:49.770289 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.19:26491] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Tue Apr 21 23:07:50.753384 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.19:26491] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aeeSxoJW6fdXWO6agMEMgQAAAAU"]
[Tue Apr 21 23:07:52.718791 2026] [:error] [pid 35321:tid 35384] [client 45.137.126.40:40363] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aeeSyDeHLhVUuu8cVXwEQgAAAEA"]
[Tue Apr 21 23:07:54.689893 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.29:32575] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Tue Apr 21 23:07:55.181906 2026] [:error] [pid 35320:tid 35354] [client 45.137.126.29:32575] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aeeSy4JW6fdXWO6agMEMkgAAABg"]
[Tue Apr 21 23:07:56.658405 2026] [:error] [pid 53832:tid 53858] [client 45.137.126.27:33919] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Tue Apr 21 23:07:57.157770 2026] [:error] [pid 53832:tid 53837] [client 45.137.126.27:33919] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Tue Apr 21 23:07:57.656424 2026] [:error] [pid 53832:tid 53843] [client 45.137.126.27:33919] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Tue Apr 21 23:07:58.144977 2026] [:error] [pid 53832:tid 53856] [client 45.137.126.27:33919] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aeeSztzkuxsE_OhM9UKBeAAAAlU"]
[Tue Apr 21 23:07:59.121731 2026] [:error] [pid 35320:tid 35336] [client 45.137.126.9:37913] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Tue Apr 21 23:07:59.609820 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.9:37913] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aeeSz4JW6fdXWO6agMEMowAAAA8"]
[Tue Apr 21 23:08:01.701957 2026] [:error] [pid 53978:tid 53991] [client 45.137.126.39:28567] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue Apr 21 23:08:02.193842 2026] [:error] [pid 53978:tid 54002] [client 45.137.126.39:28567] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Tue Apr 21 23:08:02.682867 2026] [:error] [pid 53978:tid 53994] [client 45.137.126.39:28567] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Tue Apr 21 23:08:05.174443 2026] [:error] [pid 53978:tid 53998] [client 45.137.126.39:28567] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Tue Apr 21 23:08:05.666784 2026] [:error] [pid 53978:tid 53984] [client 45.137.126.39:28567] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Tue Apr 21 23:08:06.646620 2026] [:error] [pid 53978:tid 53987] [client 45.137.126.39:28567] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Tue Apr 21 23:08:08.151749 2026] [:error] [pid 53978:tid 54000] [client 45.137.126.39:28567] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue Apr 21 23:08:08.638931 2026] [:error] [pid 53978:tid 53983] [client 45.137.126.39:28567] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aeeS2J1ivsR4hcOSQbZHkQAAAoM"]
[Tue Apr 21 23:08:09.623022 2026] [:error] [pid 4823:tid 4866] [client 45.137.126.2:62607] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aeeS2fc8mke3PfHqsxEPNQAAAY0"]
[Tue Apr 21 23:08:10.615653 2026] [:error] [pid 35321:tid 35401] [client 45.137.126.19:42931] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Tue Apr 21 23:08:11.102078 2026] [:error] [pid 35321:tid 35389] [client 45.137.126.19:42931] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aeeS2zeHLhVUuu8cVXwEYAAAAEU"]
[Tue Apr 21 23:08:12.582507 2026] [:error] [pid 53978:tid 54001] [client 45.137.126.52:48441] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue Apr 21 23:08:13.077000 2026] [:error] [pid 53978:tid 53985] [client 45.137.126.52:48441] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aeeS3Z1ivsR4hcOSQbZHlAAAAoU"]
[Tue Apr 21 23:08:14.049953 2026] [:error] [pid 35321:tid 35403] [client 45.137.126.9:44909] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aeeS3jeHLhVUuu8cVXwEawAAAFM"]
[Tue Apr 21 23:08:17.084943 2026] [:error] [pid 35321:tid 35396] [client 45.137.126.48:51707] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeeS4TeHLhVUuu8cVXwEeQAAAEw"]
[Tue Apr 21 23:08:18.069618 2026] [:error] [pid 35321:tid 35404] [client 45.137.126.34:28009] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aeeS4jeHLhVUuu8cVXwEegAAAFQ"]
[Tue Apr 21 23:08:20.540946 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.24:50693] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue Apr 21 23:08:21.530487 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.24:50693] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aeeS5YJW6fdXWO6agMEM_gAAAAE"]
[Tue Apr 21 23:08:22.997399 2026] [:error] [pid 53832:tid 53836] [client 45.137.126.34:47209] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Tue Apr 21 23:08:23.987097 2026] [:error] [pid 53832:tid 53849] [client 45.137.126.34:47209] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aeeS59zkuxsE_OhM9UKBkwAAAk4"]
[Tue Apr 21 23:08:24.989822 2026] [:error] [pid 35321:tid 35397] [client 45.137.126.12:41697] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "aeeS6DeHLhVUuu8cVXwEgAAAAE0"]
[Tue Apr 21 23:08:26.470594 2026] [:error] [pid 35321:tid 35396] [client 45.137.126.22:40993] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Tue Apr 21 23:08:26.960677 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.22:40993] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aeeS6jeHLhVUuu8cVXwEhgAAAEg"]
[Tue Apr 21 23:08:27.933486 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.52:41217] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aeeS64JW6fdXWO6agMENFgAAABc"]
[Tue Apr 21 23:08:29.924045 2026] [:error] [pid 53731:tid 53747] [client 45.137.126.26:45205] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Tue Apr 21 23:08:30.414408 2026] [:error] [pid 53731:tid 53745] [client 45.137.126.26:45205] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Tue Apr 21 23:08:31.494486 2026] [:error] [pid 53731:tid 53760] [client 45.137.126.26:45205] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Tue Apr 21 23:08:32.616003 2026] [:error] [pid 53731:tid 53737] [client 45.137.126.26:45205] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aeeS8F2I9THUR-bRVGyaKAAAAgI"]
[Tue Apr 21 23:08:33.605751 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.19:56657] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aeeS8YJW6fdXWO6agMENJgAAAAQ"]
[Tue Apr 21 23:08:36.115700 2026] [:error] [pid 35321:tid 35395] [client 45.137.126.23:21747] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Tue Apr 21 23:08:36.602386 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.23:21747] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aeeS9DeHLhVUuu8cVXwEkQAAAEM"]
[Tue Apr 21 23:08:37.577874 2026] [:error] [pid 53978:tid 53987] [client 45.137.126.32:59517] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aeeS9Z1ivsR4hcOSQbZHnwAAAoc"]
[Tue Apr 21 23:08:40.253188 2026] [:error] [pid 53731:tid 53749] [client 45.137.126.22:58205] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aeeS-F2I9THUR-bRVGyaMAAAAg4"]
[Tue Apr 21 23:08:43.192869 2026] [:error] [pid 35322:tid 35380] [client 45.137.126.22:25801] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Tue Apr 21 23:08:43.680988 2026] [:error] [pid 35322:tid 35377] [client 45.137.126.22:25801] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aeeS-6PoAfV40BTfVKzlQQAAAJQ"]
[Tue Apr 21 23:08:45.153457 2026] [:error] [pid 53832:tid 53855] [client 45.137.126.8:62071] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aeeS_dzkuxsE_OhM9UKBngAAAlQ"]
[Tue Apr 21 23:08:46.125483 2026] [:error] [pid 54080:tid 54087] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Tue Apr 21 23:08:46.625985 2026] [:error] [pid 54080:tid 54103] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Tue Apr 21 23:08:47.606841 2026] [:error] [pid 54080:tid 54098] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Tue Apr 21 23:08:49.694384 2026] [:error] [pid 54080:tid 54106] [client 45.137.126.3:57623] [client 45.137.126.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.3, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "aeeTAYzEbQHHxtmWbabY_wAAAtg"]
[Tue Apr 21 23:08:50.688615 2026] [:error] [pid 54080:tid 54098] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Tue Apr 21 23:08:51.177692 2026] [:error] [pid 54080:tid 54091] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Tue Apr 21 23:08:51.691472 2026] [:error] [pid 54080:tid 54093] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Tue Apr 21 23:08:52.668088 2026] [:error] [pid 54080:tid 54101] [client 45.137.126.3:57623] [client 45.137.126.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.3, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aeeTBIzEbQHHxtmWbabZCgAAAtM"]
[Tue Apr 21 23:08:54.142817 2026] [:error] [pid 54080:tid 54082] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Tue Apr 21 23:08:54.632861 2026] [:error] [pid 54080:tid 54094] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Tue Apr 21 23:08:55.616420 2026] [:error] [pid 54080:tid 54090] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Tue Apr 21 23:08:56.604403 2026] [:error] [pid 54080:tid 54100] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Tue Apr 21 23:08:58.082834 2026] [:error] [pid 54080:tid 54095] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Tue Apr 21 23:09:01.596565 2026] [:error] [pid 54080:tid 54087] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue Apr 21 23:09:02.085928 2026] [:error] [pid 54080:tid 54085] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Tue Apr 21 23:09:04.554199 2026] [:error] [pid 54080:tid 54091] [client 45.137.126.3:57623] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Tue Apr 21 23:09:05.532788 2026] [:error] [pid 54080:tid 54105] [client 45.137.126.3:57623] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aeeTEYzEbQHHxtmWbabZOQAAAtc"]
[Tue Apr 21 23:09:07.495681 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.26:62649] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Tue Apr 21 23:09:07.983483 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.26:62649] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aeeTE4JW6fdXWO6agMENggAAAAw"]
[Tue Apr 21 23:09:09.467789 2026] [:error] [pid 53978:tid 53988] [client 45.137.126.45:38563] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Tue Apr 21 23:09:09.954421 2026] [:error] [pid 53978:tid 54000] [client 45.137.126.45:38563] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aeeTFZ1ivsR4hcOSQbZHxQAAApQ"]
[Tue Apr 21 23:09:12.198482 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.40:56595] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Tue Apr 21 23:09:13.185549 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.40:56595] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Tue Apr 21 23:09:14.163031 2026] [:error] [pid 35320:tid 35351] [client 45.137.126.40:56595] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Tue Apr 21 23:09:14.655017 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.40:56595] File does not exist: /usr/local/apache/htdocs/suspended-page/repeater.php
[Tue Apr 21 23:09:15.634161 2026] [:error] [pid 35320:tid 35330] [client 45.137.126.40:56595] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aeeTG4JW6fdXWO6agMENtAAAAAA"]
[Tue Apr 21 23:09:16.620271 2026] [:error] [pid 35415:tid 35449] [client 45.137.126.29:64575] File does not exist: /usr/local/apache/htdocs/suspended-page/contacts.php
[Tue Apr 21 23:09:17.114550 2026] [:error] [pid 35415:tid 35447] [client 45.137.126.29:64575] File does not exist: /usr/local/apache/htdocs/suspended-page/wsa.php
[Tue Apr 21 23:09:17.602076 2026] [:error] [pid 35415:tid 35429] [client 45.137.126.29:64575] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aeeTHUiqDinI4_22zzh__wAAAMI"]
[Tue Apr 21 23:09:19.069468 2026] [:error] [pid 35321:tid 35398] [client 45.137.126.41:27543] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aeeTHzeHLhVUuu8cVXwEpwAAAE4"]
[Tue Apr 21 23:09:20.542480 2026] [:error] [pid 54080:tid 54096] [client 45.137.126.38:42627] File does not exist: /usr/local/apache/htdocs/suspended-page/lv.php
[Tue Apr 21 23:09:22.017531 2026] [:error] [pid 54080:tid 54094] [client 45.137.126.38:42627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/file.php
[Tue Apr 21 23:09:22.509272 2026] [:error] [pid 54080:tid 54090] [client 45.137.126.38:42627] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/admin.php
[Tue Apr 21 23:09:22.999050 2026] [:error] [pid 54080:tid 54085] [client 45.137.126.38:42627] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aeeTIozEbQHHxtmWbabZTgAAAsM"]
[Tue Apr 21 23:09:23.974991 2026] [:error] [pid 35321:tid 35384] [client 45.137.126.36:32537] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aeeTIzeHLhVUuu8cVXwEuAAAAEA"]
[Tue Apr 21 23:09:27.470080 2026] [:error] [pid 53978:tid 53980] [client 45.137.126.9:53747] File does not exist: /usr/local/apache/htdocs/suspended-page/tox.php
[Tue Apr 21 23:09:28.445198 2026] [:error] [pid 53978:tid 54004] [client 45.137.126.9:53747] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aeeTKJ1ivsR4hcOSQbZH6AAAApg"]
[Tue Apr 21 23:09:29.918869 2026] [:error] [pid 53731:tid 53754] [client 45.137.126.27:45647] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aeeTKV2I9THUR-bRVGyafgAAAhI"]
[Tue Apr 21 23:09:31.422712 2026] [:error] [pid 53731:tid 53759] [client 45.137.126.29:37429] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue Apr 21 23:09:33.157828 2026] [:error] [pid 53731:tid 53759] [client 45.137.126.29:37429] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-themes.php
[Tue Apr 21 23:09:33.645033 2026] [:error] [pid 53731:tid 53739] [client 45.137.126.29:37429] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aeeTLV2I9THUR-bRVGyamQAAAgQ"]
[Tue Apr 21 23:09:35.125653 2026] [:error] [pid 35321:tid 35389] [client 45.137.126.41:65199] File does not exist: /usr/local/apache/htdocs/suspended-page/mariju.php
[Tue Apr 21 23:09:35.614603 2026] [:error] [pid 35321:tid 35405] [client 45.137.126.41:65199] File does not exist: /usr/local/apache/htdocs/suspended-page/waf_defender.php
[Tue Apr 21 23:09:36.600181 2026] [:error] [pid 35321:tid 35394] [client 45.137.126.41:65199] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue Apr 21 23:09:38.069361 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.41:65199] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aeeTMjeHLhVUuu8cVXwE_wAAAEg"]
[Tue Apr 21 23:09:39.045716 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.7:62751] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/about.php
[Tue Apr 21 23:09:40.525799 2026] [:error] [pid 35320:tid 35348] [client 45.137.126.7:62751] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aeeTNIJW6fdXWO6agMEOUgAAABI"]
[Tue Apr 21 23:09:41.988903 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.24:30223] File does not exist: /usr/local/apache/htdocs/suspended-page/theme.php
[Tue Apr 21 23:09:43.484066 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.24:30223] File does not exist: /usr/local/apache/htdocs/suspended-page/Simple.php
[Tue Apr 21 23:09:43.975071 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.24:30223] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/index.php
[Tue Apr 21 23:09:44.950172 2026] [:error] [pid 35320:tid 35336] [client 45.137.126.24:30223] [client 45.137.126.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.24, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aeeTOIJW6fdXWO6agMEOfgAAAAY"]
[Tue Apr 21 23:09:47.421340 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.24:30223] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aeeTO4JW6fdXWO6agMEOmgAAABc"]
[Tue Apr 21 23:09:48.416929 2026] [:error] [pid 35322:tid 35371] [client 45.137.126.30:58287] File does not exist: /usr/local/apache/htdocs/suspended-page/small.php
[Tue Apr 21 23:09:48.904674 2026] [:error] [pid 35322:tid 35376] [client 45.137.126.30:58287] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aeeTPKPoAfV40BTfVKzlaAAAAJM"]
[Tue Apr 21 23:09:49.886716 2026] [:error] [pid 53832:tid 53850] [client 45.137.126.19:44467] File does not exist: /usr/local/apache/htdocs/suspended-page/NewFile.php
[Tue Apr 21 23:09:50.862896 2026] [:error] [pid 53832:tid 53848] [client 45.137.126.19:44467] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Tue Apr 21 23:09:51.836422 2026] [:error] [pid 53832:tid 53856] [client 45.137.126.19:44467] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aeeTP9zkuxsE_OhM9UKCDAAAAlU"]
[Tue Apr 21 23:09:53.316304 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.52:51661] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-files.php
[Tue Apr 21 23:09:53.804131 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.52:51661] File does not exist: /usr/local/apache/htdocs/suspended-page/functions.php
[Tue Apr 21 23:09:54.290794 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.52:51661] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aeeTQoJW6fdXWO6agMEOzwAAAAM"]
[Tue Apr 21 23:09:55.279504 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.30:55127] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aeeTQ4JW6fdXWO6agMEO0gAAAA0"]
[Tue Apr 21 23:09:56.309676 2026] [:error] [pid 53731:tid 53735] [client 45.137.126.2:42207] File does not exist: /usr/local/apache/htdocs/suspended-page/aks.php
[Tue Apr 21 23:09:56.826138 2026] [:error] [pid 53731:tid 53738] [client 45.137.126.2:42207] File does not exist: /usr/local/apache/htdocs/suspended-page/litespeed.php
[Tue Apr 21 23:09:57.857481 2026] [:error] [pid 53731:tid 53754] [client 45.137.126.2:42207] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aeeTRV2I9THUR-bRVGya6gAAAhI"]
[Tue Apr 21 23:09:58.900599 2026] [:error] [pid 53832:tid 53857] [client 45.137.126.21:63343] File does not exist: /usr/local/apache/htdocs/suspended-page/wpn.php
[Tue Apr 21 23:09:59.927121 2026] [:error] [pid 53832:tid 53842] [client 45.137.126.21:63343] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/iR7SzrsOUEP.php
[Tue Apr 21 23:10:00.423786 2026] [:error] [pid 53832:tid 53851] [client 45.137.126.21:63343] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aeeTSNzkuxsE_OhM9UKCFQAAAlA"]
[Tue Apr 21 23:10:02.202535 2026] [:error] [pid 53978:tid 53996] [client 45.137.126.47:37733] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/db.php"] [unique_id "aeeTSp1ivsR4hcOSQbZIEgAAApA"]
[Tue Apr 21 23:10:03.182871 2026] [:error] [pid 54080:tid 54090] [client 45.137.126.11:26559] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aeeTS4zEbQHHxtmWbabZdQAAAsg"]
[Tue Apr 21 23:10:04.166550 2026] [:error] [pid 35321:tid 35399] [client 45.137.126.30:23827] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aeeTTDeHLhVUuu8cVXwFQgAAAE8"]
[Tue Apr 21 23:10:05.146895 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.47:31879] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aeeTTYJW6fdXWO6agMEO7wAAABY"]
[Tue Apr 21 23:10:06.120359 2026] [:error] [pid 4823:tid 4865] [client 45.137.126.21:44141] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aeeTTvc8mke3PfHqsxEPewAAAYw"]
[Tue Apr 21 23:10:07.116476 2026] [:error] [pid 35322:tid 35378] [client 45.137.126.39:55257] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aeeTT6PoAfV40BTfVKzlcgAAAJU"]
[Tue Apr 21 23:10:09.535843 2026] [:error] [pid 54080:tid 54096] [client 45.137.126.19:24177] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aeeTUYzEbQHHxtmWbabZgAAAAs4"]
[Tue Apr 21 23:10:10.516495 2026] [:error] [pid 53832:tid 53835] [client 45.137.126.5:41981] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aeeTUtzkuxsE_OhM9UKCKwAAAkA"]
[Tue Apr 21 23:10:11.497525 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.30:32365] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aeeTU4JW6fdXWO6agMEPAQAAABM"]
[Tue Apr 21 23:10:12.469710 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.2:42553] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aeeTVIJW6fdXWO6agMEPBwAAABA"]
[Tue Apr 21 23:10:13.445924 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.21:49425] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aeeTVYJW6fdXWO6agMEPEAAAABM"]
[Tue Apr 21 23:10:14.426348 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.24:38931] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-load.php
[Tue Apr 21 23:10:15.900848 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.24:38931] [client 45.137.126.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.24, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aeeTV4JW6fdXWO6agMEPIgAAAAE"]
[Tue Apr 21 23:10:18.365775 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.24:38931] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aeeTWoJW6fdXWO6agMEPKgAAAAU"]
[Tue Apr 21 23:10:20.317285 2026] [:error] [pid 53832:tid 53857] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Tue Apr 21 23:10:20.807166 2026] [:error] [pid 53832:tid 53836] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-fmfile.php
[Tue Apr 21 23:10:22.763101 2026] [:error] [pid 53832:tid 53835] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/memberfuns.php
[Tue Apr 21 23:10:23.255994 2026] [:error] [pid 53832:tid 53853] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/infos.php
[Tue Apr 21 23:10:25.220636 2026] [:error] [pid 53832:tid 53844] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/options-writing.php
[Tue Apr 21 23:10:25.708938 2026] [:error] [pid 53832:tid 53841] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/options-reading.php
[Tue Apr 21 23:10:26.209848 2026] [:error] [pid 53832:tid 53847] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/wsad.php
[Tue Apr 21 23:10:26.697900 2026] [:error] [pid 53832:tid 53854] [client 45.137.126.47:38221] File does not exist: /usr/local/apache/htdocs/suspended-page/nation.php
[Tue Apr 21 23:10:27.182046 2026] [:error] [pid 53832:tid 53856] [client 45.137.126.47:38221] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aeeTY9zkuxsE_OhM9UKCRQAAAlU"]
[Tue Apr 21 23:10:28.156111 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.37:29859] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aeeTZIJW6fdXWO6agMEPVwAAAA8"]
[Tue Apr 21 23:10:29.138186 2026] [:error] [pid 53731:tid 53742] [client 45.137.126.13:37429] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aeeTZV2I9THUR-bRVGybFQAAAgc"]
[Tue Apr 21 23:10:30.610093 2026] [:error] [pid 53978:tid 53990] [client 45.137.126.53:63801] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atomx.php
[Tue Apr 21 23:10:31.103343 2026] [:error] [pid 53978:tid 53993] [client 45.137.126.53:63801] File does not exist: /usr/local/apache/htdocs/suspended-page/admin-footer.php
[Tue Apr 21 23:10:32.088308 2026] [:error] [pid 53978:tid 54004] [client 45.137.126.53:63801] File does not exist: /usr/local/apache/htdocs/suspended-page/XxX.php
[Tue Apr 21 23:10:33.069794 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.53:63801] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aeeTaZ1ivsR4hcOSQbZIVwAAAow"]
[Tue Apr 21 23:10:34.054832 2026] [:error] [pid 53731:tid 53750] [client 45.137.126.5:26607] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aeeTal2I9THUR-bRVGybIAAAAg8"]
[Tue Apr 21 23:10:35.030322 2026] [:error] [pid 4777:tid 4794] [client 45.137.126.23:42119] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aeeTa6xXur6bykKyLZS5sQAAAQY"]
[Tue Apr 21 23:10:37.971706 2026] [:error] [pid 53731:tid 53736] [client 45.137.126.22:48017] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aeeTbV2I9THUR-bRVGybKAAAAgE"]
[Tue Apr 21 23:10:39.435699 2026] [:error] [pid 54080:tid 54101] [client 45.137.126.45:21623] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aeeTb4zEbQHHxtmWbabZlwAAAtM"]
[Tue Apr 21 23:10:41.394874 2026] [:error] [pid 35321:tid 35401] [client 45.137.126.11:56571] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aeeTcTeHLhVUuu8cVXwFtQAAAFE"]
[Tue Apr 21 23:10:47.808460 2026] [:error] [pid 4823:tid 4862] [client 45.137.126.14:25045] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aeeTd_c8mke3PfHqsxEPmAAAAYk"]
[Tue Apr 21 23:10:48.783660 2026] [:error] [pid 35415:tid 35434] [client 45.137.126.5:47177] File does not exist: /usr/local/apache/htdocs/suspended-page/xex.php
[Tue Apr 21 23:10:49.268841 2026] [:error] [pid 35415:tid 35446] [client 45.137.126.5:47177] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/about.php"] [unique_id "aeeTeUiqDinI4_22zziAMgAAANM"]
[Tue Apr 21 23:10:51.238802 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.9:56387] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-head.php
[Tue Apr 21 23:10:52.709204 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.9:56387] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Tue Apr 21 23:10:53.200073 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.9:56387] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aeeTfYJW6fdXWO6agMEP-QAAABM"]
[Tue Apr 21 23:10:55.155578 2026] [:error] [pid 53978:tid 54002] [client 45.137.126.49:26835] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aeeTf51ivsR4hcOSQbZIhAAAApY"]
[Tue Apr 21 23:10:58.097174 2026] [:error] [pid 54080:tid 54089] [client 45.137.126.35:26229] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aeeTgozEbQHHxtmWbabZxgAAAsc"]
[Tue Apr 21 23:11:01.047400 2026] [:error] [pid 35320:tid 35337] [client 45.137.126.52:33361] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aeeThYJW6fdXWO6agMEQLAAAAAc"]
[Tue Apr 21 23:11:02.526208 2026] [:error] [pid 4777:tid 4801] [client 45.137.126.9:47391] File does not exist: /usr/local/apache/htdocs/suspended-page/click.php
[Tue Apr 21 23:11:03.010055 2026] [:error] [pid 4777:tid 4808] [client 45.137.126.9:47391] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aeeTh6xXur6bykKyLZS50wAAARQ"]
[Tue Apr 21 23:11:03.982042 2026] [:error] [pid 53731:tid 53742] [client 45.137.126.28:49295] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aeeTh12I9THUR-bRVGybWwAAAgc"]
[Tue Apr 21 23:11:08.652172 2026] [:error] [pid 53731:tid 53735] [client 45.137.126.13:29197] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aeeTjF2I9THUR-bRVGybbgAAAgA"]
[Tue Apr 21 23:11:09.628713 2026] [:error] [pid 35321:tid 35395] [client 45.137.126.11:26955] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-admin.php
[Tue Apr 21 23:11:11.625199 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.11:26955] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-editor.php
[Tue Apr 21 23:11:12.114322 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.11:26955] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aeeTkDeHLhVUuu8cVXwGHgAAAEE"]
[Tue Apr 21 23:11:14.077157 2026] [:error] [pid 4777:tid 4789] [client 45.137.126.11:34985] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfusm.php
[Tue Apr 21 23:11:15.054878 2026] [:error] [pid 4777:tid 4811] [client 45.137.126.11:34985] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeeTk6xXur6bykKyLZS54QAAARc"]
[Tue Apr 21 23:11:16.038814 2026] [:error] [pid 53731:tid 53754] [client 45.137.126.11:52841] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aeeTlF2I9THUR-bRVGybgAAAAhI"]
[Tue Apr 21 23:11:17.501102 2026] [:error] [pid 35321:tid 35394] [client 45.137.126.27:46963] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aeeTlTeHLhVUuu8cVXwGMQAAAEo"]
[Tue Apr 21 23:11:20.879872 2026] [:error] [pid 4823:tid 4859] [client 45.137.126.53:55795] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/install.php"] [unique_id "aeeTmPc8mke3PfHqsxEPwwAAAYY"]
[Tue Apr 21 23:11:21.861720 2026] [:error] [pid 4823:tid 4873] [client 45.137.126.45:25957] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aeeTmfc8mke3PfHqsxEPxAAAAZQ"]
[Tue Apr 21 23:11:23.329020 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.39:31097] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_SpaceTn.php
[Tue Apr 21 23:11:25.774009 2026] [:error] [pid 35321:tid 35401] [client 45.137.126.39:31097] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/category-double.php"] [unique_id "aeeTnTeHLhVUuu8cVXwGYAAAAFE"]
[Tue Apr 21 23:11:27.739068 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.14:64665] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aeeTn4JW6fdXWO6agMEQpQAAABc"]
[Tue Apr 21 23:11:28.719900 2026] [:error] [pid 4777:tid 4802] [client 45.137.126.20:58693] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aeeToKxXur6bykKyLZS58AAAAQ4"]
[Tue Apr 21 23:11:30.184937 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.20:57307] File does not exist: /usr/local/apache/htdocs/suspended-page/gm.php
[Tue Apr 21 23:11:30.680020 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.20:57307] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aeeTooJW6fdXWO6agMEQvgAAAAw"]
[Tue Apr 21 23:11:32.170957 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.45:24391] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aeeTpIJW6fdXWO6agMEQyQAAABM"]
[Tue Apr 21 23:11:35.598968 2026] [:error] [pid 35415:tid 35437] [client 45.137.126.37:62631] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aeeTp0iqDinI4_22zziAXAAAAMo"]
[Tue Apr 21 23:11:37.121874 2026] [:error] [pid 35321:tid 35394] [client 45.137.126.34:34299] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Tue Apr 21 23:11:37.610776 2026] [:error] [pid 35321:tid 35400] [client 45.137.126.34:34299] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aeeTqTeHLhVUuu8cVXwGmgAAAFA"]
[Tue Apr 21 23:11:39.565942 2026] [:error] [pid 53978:tid 53984] [client 45.137.126.23:30653] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aeeTq51ivsR4hcOSQbZI2wAAAoQ"]
[Tue Apr 21 23:11:41.038212 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.23:35371] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/as.php"] [unique_id "aeeTrYJW6fdXWO6agMEQ5AAAAAI"]
[Tue Apr 21 23:11:42.500522 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.47:37289] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aeeTroJW6fdXWO6agMEQ9AAAAA4"]
[Tue Apr 21 23:11:43.487623 2026] [:error] [pid 54080:tid 54086] [client 45.137.126.29:55603] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/install.php"] [unique_id "aeeTr4zEbQHHxtmWbabaSwAAAsQ"]
[Tue Apr 21 23:11:44.457501 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.40:31043] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aeeTsDeHLhVUuu8cVXwGtgAAAEM"]
[Tue Apr 21 23:11:48.379038 2026] [:error] [pid 35415:tid 35441] [client 45.137.126.34:20763] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aeeTtEiqDinI4_22zziAaQAAAM4"]
[Tue Apr 21 23:11:50.880673 2026] [:error] [pid 35320:tid 35348] [client 45.137.126.31:49105] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rk2.php"] [unique_id "aeeTtoJW6fdXWO6agMEREwAAABI"]
[Tue Apr 21 23:11:52.352986 2026] [:error] [pid 53731:tid 53750] [client 45.137.126.35:45783] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Tue Apr 21 23:11:52.842363 2026] [:error] [pid 53731:tid 53760] [client 45.137.126.35:45783] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aeeTuF2I9THUR-bRVGyb7AAAAhg"]
[Tue Apr 21 23:11:54.809558 2026] [:error] [pid 35415:tid 35431] [client 45.137.126.6:55221] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aeeTukiqDinI4_22zziAewAAAMQ"]
[Tue Apr 21 23:11:55.798407 2026] [:error] [pid 35321:tid 35402] [client 45.137.126.17:27107] File does not exist: /usr/local/apache/htdocs/suspended-page/wsax.php
[Tue Apr 21 23:11:58.249550 2026] [:error] [pid 35321:tid 35384] [client 45.137.126.17:27107] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aeeTvjeHLhVUuu8cVXwG8gAAAEA"]
[Tue Apr 21 23:11:59.715592 2026] [:error] [pid 53731:tid 53755] [client 45.137.126.33:58893] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aeeTv12I9THUR-bRVGycAgAAAhM"]
[Tue Apr 21 23:12:01.203454 2026] [:error] [pid 53731:tid 53742] [client 45.137.126.22:57621] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aeeTwV2I9THUR-bRVGycGAAAAgc"]
[Tue Apr 21 23:12:03.172287 2026] [:error] [pid 4823:tid 4857] [client 45.137.126.4:55387] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aeeTw_c8mke3PfHqsxEP7QAAAYQ"]
[Tue Apr 21 23:12:08.114753 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.13:52995] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aeeTyDeHLhVUuu8cVXwHGAAAAEM"]
[Tue Apr 21 23:12:09.085861 2026] [:error] [pid 53832:tid 53857] [client 45.137.126.36:37297] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aeeTydzkuxsE_OhM9UKCuwAAAlY"]
[Tue Apr 21 23:12:11.547347 2026] [:error] [pid 4777:tid 4799] [client 45.137.126.33:61083] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aeeTy6xXur6bykKyLZS6CgAAAQs"]
[Tue Apr 21 23:12:12.526047 2026] [:error] [pid 54080:tid 54103] [client 45.137.126.24:24825] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeeTzIzEbQHHxtmWbabacwAAAtU"]
[Tue Apr 21 23:12:14.505229 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.16:28507] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aeeTzoJW6fdXWO6agMERSwAAABA"]
[Tue Apr 21 23:12:15.479426 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.13:42727] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aeeTz4JW6fdXWO6agMERTQAAABc"]
[Tue Apr 21 23:12:16.454584 2026] [:error] [pid 35322:tid 35362] [client 45.137.126.53:42983] [client 45.137.126.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.53, incrementing brute counter"] [hostname "rejuva.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aeeT0KPoAfV40BTfVKzl1wAAAIU"]
[Tue Apr 21 23:12:16.458978 2026] [:error] [pid 35322:tid 35362] [client 45.137.126.53:42983] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/wp-login.php
[Tue Apr 21 23:12:16.947301 2026] [:error] [pid 35322:tid 35369] [client 45.137.126.53:42983] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aeeT0KPoAfV40BTfVKzl2gAAAIw"]
[Tue Apr 21 23:12:18.421008 2026] [:error] [pid 54080:tid 54089] [client 45.137.126.2:25031] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Tue Apr 21 23:12:18.906369 2026] [:error] [pid 54080:tid 54083] [client 45.137.126.2:25031] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aeeT0ozEbQHHxtmWbabahQAAAsE"]
[Tue Apr 21 23:12:19.883363 2026] [:error] [pid 54080:tid 54095] [client 45.137.126.2:44587] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/network.php"] [unique_id "aeeT04zEbQHHxtmWbabaiAAAAs0"]
[Tue Apr 21 23:12:20.872093 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.3:36889] File does not exist: /usr/local/apache/htdocs/suspended-page/page.php
[Tue Apr 21 23:12:24.350438 2026] [:error] [pid 53978:tid 53998] [client 45.137.126.3:36889] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aeeT2J1ivsR4hcOSQbZJdwAAApI"]
[Tue Apr 21 23:12:25.330971 2026] [:error] [pid 54080:tid 54092] [client 45.137.126.47:60747] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aeeT2YzEbQHHxtmWbabakQAAAso"]
[Tue Apr 21 23:12:27.286571 2026] [:error] [pid 4777:tid 4797] [client 45.137.126.39:38863] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aeeT26xXur6bykKyLZS6JgAAAQk"]
[Tue Apr 21 23:12:28.269365 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.21:26791] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aeeT3IJW6fdXWO6agMERcAAAAA0"]
[Tue Apr 21 23:12:29.252632 2026] [:error] [pid 54080:tid 54102] [client 45.137.126.6:43807] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/gecko-old.php
[Tue Apr 21 23:12:29.749184 2026] [:error] [pid 54080:tid 54106] [client 45.137.126.6:43807] [client 45.137.126.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.6, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aeeT3YzEbQHHxtmWbabaoQAAAtg"]
[Tue Apr 21 23:12:30.846790 2026] [:error] [pid 54080:tid 54086] [client 45.137.126.6:43807] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aeeT3ozEbQHHxtmWbabaowAAAsQ"]
[Tue Apr 21 23:12:33.571391 2026] [:error] [pid 53731:tid 53746] [client 45.137.126.46:24319] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aeeT4V2I9THUR-bRVGycTwAAAgs"]
[Tue Apr 21 23:12:34.549635 2026] [:error] [pid 35321:tid 35402] [client 45.137.126.33:39775] File does not exist: /usr/local/apache/htdocs/suspended-page/ws.php
[Tue Apr 21 23:12:35.037338 2026] [:error] [pid 35321:tid 35399] [client 45.137.126.33:39775] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aeeT4zeHLhVUuu8cVXwHawAAAE8"]
[Tue Apr 21 23:12:36.035685 2026] [:error] [pid 35322:tid 35360] [client 45.137.126.24:54423] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aeeT5KPoAfV40BTfVKzl5wAAAIM"]
[Tue Apr 21 23:12:37.019887 2026] [:error] [pid 53978:tid 54003] [client 45.137.126.50:63611] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Tue Apr 21 23:12:38.500540 2026] [:error] [pid 53978:tid 53991] [client 45.137.126.50:63611] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aeeT5p1ivsR4hcOSQbZJigAAAos"]
[Tue Apr 21 23:12:40.449993 2026] [:error] [pid 35320:tid 35348] [client 45.137.126.21:64001] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aeeT6IJW6fdXWO6agMERsgAAABI"]
[Tue Apr 21 23:12:41.439520 2026] [:error] [pid 54080:tid 54100] [client 45.137.126.52:26923] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-api.php
[Tue Apr 21 23:12:42.418520 2026] [:error] [pid 54080:tid 54086] [client 45.137.126.52:26923] File does not exist: /usr/local/apache/htdocs/suspended-page/css.php
[Tue Apr 21 23:12:43.404166 2026] [:error] [pid 54080:tid 54103] [client 45.137.126.52:26923] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aeeT64zEbQHHxtmWbaba0AAAAtU"]
[Tue Apr 21 23:12:44.375972 2026] [:error] [pid 35321:tid 35394] [client 45.137.126.19:22143] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/bypass.php"] [unique_id "aeeT7DeHLhVUuu8cVXwHfwAAAEo"]
[Tue Apr 21 23:12:45.837925 2026] [:error] [pid 35415:tid 35434] [client 45.137.126.10:52869] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/count.php"] [unique_id "aeeT7UiqDinI4_22zziAnwAAAMc"]
[Tue Apr 21 23:12:46.816377 2026] [:error] [pid 35321:tid 35386] [client 45.137.126.12:40807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-error_log.php
[Tue Apr 21 23:12:49.770387 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.12:40807] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aeeT8TeHLhVUuu8cVXwHkQAAAEg"]
[Tue Apr 21 23:12:51.756876 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.11:25123] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||rejuva.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "rejuva.au"] [uri "/images/stories/themes.php"] [unique_id "aeeT84JW6fdXWO6agMER7AAAAAU"]
[Tue Apr 21 23:12:52.250433 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.11:25123] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aeeT9IJW6fdXWO6agMER7QAAAAk"]
[Tue Apr 21 23:12:54.195876 2026] [:error] [pid 35415:tid 35441] [client 45.137.126.24:31889] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aeeT9kiqDinI4_22zziArwAAAM4"]
[Tue Apr 21 23:12:55.170354 2026] [:error] [pid 4777:tid 4803] [client 45.137.126.37:40467] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aeeT96xXur6bykKyLZS6PAAAAQ8"]
[Tue Apr 21 23:12:57.131008 2026] [:error] [pid 35321:tid 35397] [client 45.137.126.37:45021] File does not exist: /usr/local/apache/htdocs/suspended-page/files.php
[Tue Apr 21 23:12:59.086538 2026] [:error] [pid 35321:tid 35399] [client 45.137.126.37:45021] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aeeT-zeHLhVUuu8cVXwHtAAAAE8"]
[Tue Apr 21 23:13:01.099157 2026] [:error] [pid 54080:tid 54087] [client 45.137.126.52:45185] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aeeT_YzEbQHHxtmWbaba3wAAAsU"]
[Tue Apr 21 23:13:02.560215 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.33:22895] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aeeT_oJW6fdXWO6agMESKgAAAAk"]
[Tue Apr 21 23:13:03.539754 2026] [:error] [pid 53731:tid 53743] [client 45.137.126.9:53331] File does not exist: /usr/local/apache/htdocs/suspended-page/blog.php
[Tue Apr 21 23:13:06.013683 2026] [:error] [pid 53731:tid 53746] [client 45.137.126.9:53331] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aeeUAl2I9THUR-bRVGyckwAAAgs"]
[Tue Apr 21 23:13:08.842489 2026] [:error] [pid 54080:tid 54082] [client 45.137.126.15:31395] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/colour.php"] [unique_id "aeeUBIzEbQHHxtmWbaba9AAAAsA"]
[Tue Apr 21 23:13:09.823996 2026] [:error] [pid 4823:tid 4859] [client 45.137.126.38:60933] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Tue Apr 21 23:13:10.311712 2026] [:error] [pid 4823:tid 4864] [client 45.137.126.38:60933] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aeeUBvc8mke3PfHqsxEQGAAAAYs"]
[Tue Apr 21 23:13:11.286739 2026] [:error] [pid 54080:tid 54089] [client 45.137.126.22:53853] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/include.php"] [unique_id "aeeUB4zEbQHHxtmWbaba_AAAAsc"]
[Tue Apr 21 23:13:14.392430 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.51:21835] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aeeUCoJW6fdXWO6agMESWwAAAA4"]
[Tue Apr 21 23:13:16.350967 2026] [:error] [pid 53978:tid 53994] [client 45.137.126.31:30825] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aeeUDJ1ivsR4hcOSQbZJvwAAAo4"]
[Tue Apr 21 23:13:17.328170 2026] [:error] [pid 54080:tid 54087] [client 45.137.126.19:60335] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aeeUDYzEbQHHxtmWbabbBgAAAsU"]
[Tue Apr 21 23:13:20.252775 2026] [:error] [pid 4777:tid 4790] [client 45.137.126.8:62977] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aeeUEKxXur6bykKyLZS6WQAAAQI"]
[Tue Apr 21 23:13:22.210402 2026] [:error] [pid 4777:tid 4797] [client 45.137.126.42:28633] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aeeUEqxXur6bykKyLZS6XgAAAQk"]
[Tue Apr 21 23:13:23.187138 2026] [:error] [pid 53978:tid 54003] [client 45.137.126.11:25445] File does not exist: /usr/local/apache/htdocs/suspended-page/testt.php
[Tue Apr 21 23:13:24.651466 2026] [:error] [pid 53978:tid 53982] [client 45.137.126.11:25445] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aeeUFJ1ivsR4hcOSQbZJ8AAAAoI"]
[Tue Apr 21 23:13:25.627385 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.50:23313] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aeeUFYJW6fdXWO6agMESfAAAABY"]
[Tue Apr 21 23:13:26.606834 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.7:40493] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aeeUFoJW6fdXWO6agMESiQAAAAk"]
[Tue Apr 21 23:13:27.593024 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.47:58115] File does not exist: /usr/local/apache/htdocs/suspended-page/network.php
[Tue Apr 21 23:13:28.575435 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.47:58115] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aeeUGIJW6fdXWO6agMESngAAAA8"]
[Tue Apr 21 23:13:29.560760 2026] [:error] [pid 35321:tid 35402] [client 45.137.126.46:27441] File does not exist: /usr/local/apache/htdocs/suspended-page/wikindex.php
[Tue Apr 21 23:13:30.539674 2026] [:error] [pid 35321:tid 35403] [client 45.137.126.46:27441] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aeeUGjeHLhVUuu8cVXwIAQAAAFM"]
[Tue Apr 21 23:13:31.563956 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.52:52351] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aeeUGzeHLhVUuu8cVXwICgAAAFY"]
[Tue Apr 21 23:13:33.057466 2026] [:error] [pid 4823:tid 4874] [client 45.137.126.27:56283] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aeeUHfc8mke3PfHqsxEQPgAAAZU"]
[Tue Apr 21 23:13:34.032487 2026] [:error] [pid 35321:tid 35389] [client 45.137.126.6:60095] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aeeUHjeHLhVUuu8cVXwIGQAAAEU"]
[Tue Apr 21 23:13:35.983676 2026] [:error] [pid 53731:tid 53755] [client 45.137.126.50:64473] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aeeUH12I9THUR-bRVGycxwAAAhM"]
[Tue Apr 21 23:13:37.453033 2026] [:error] [pid 53731:tid 53756] [client 45.137.126.25:33793] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aeeUIV2I9THUR-bRVGyc0gAAAhQ"]
[Tue Apr 21 23:13:38.436593 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.22:36827] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aeeUIoJW6fdXWO6agMESxQAAAA0"]
[Tue Apr 21 23:13:39.411685 2026] [:error] [pid 53978:tid 53989] [client 45.137.126.2:56935] [client 45.137.126.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aeeUI51ivsR4hcOSQbZKDAAAAok"]
[Tue Apr 21 23:13:41.441380 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.20:20325] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aeeUJYJW6fdXWO6agMES-QAAAA8"]
[Tue Apr 21 23:13:43.398354 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.24:26419] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aeeUJ4JW6fdXWO6agMETDwAAAAQ"]
[Tue Apr 21 23:13:44.865332 2026] [:error] [pid 4777:tid 4789] [client 45.137.126.24:55699] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aeeUKKxXur6bykKyLZS6dAAAAQE"]
[Tue Apr 21 23:13:46.362069 2026] [:error] [pid 53731:tid 53747] [client 45.137.126.30:43565] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aeeUKl2I9THUR-bRVGyc6gAAAgw"]
[Tue Apr 21 23:13:48.337509 2026] [:error] [pid 53978:tid 53991] [client 45.137.126.25:50461] File does not exist: /usr/local/apache/htdocs/suspended-page/media-new.php
[Tue Apr 21 23:13:50.297439 2026] [:error] [pid 53978:tid 53985] [client 45.137.126.25:50461] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugin.php"] [unique_id "aeeULp1ivsR4hcOSQbZKSgAAAoU"]
[Tue Apr 21 23:13:51.271713 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.43:65167] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aeeUL4JW6fdXWO6agMETYwAAAAw"]
[Tue Apr 21 23:13:52.742868 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.39:39287] File does not exist: /usr/local/apache/htdocs/suspended-page/pages.php
[Tue Apr 21 23:13:53.228560 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.39:39287] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aeeUMYJW6fdXWO6agMETegAAAAo"]
[Tue Apr 21 23:13:56.178815 2026] [:error] [pid 35321:tid 35403] [client 45.137.126.11:39219] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aeeUNDeHLhVUuu8cVXwInAAAAFM"]
[Tue Apr 21 23:13:57.648772 2026] [:error] [pid 35321:tid 35390] [client 45.137.126.39:25847] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfus.php
[Tue Apr 21 23:13:58.137858 2026] [:error] [pid 35321:tid 35399] [client 45.137.126.39:25847] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aeeUNjeHLhVUuu8cVXwIqgAAAE8"]
[Tue Apr 21 23:14:00.964841 2026] [:error] [pid 35321:tid 35393] [client 45.137.126.47:51355] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aeeUODeHLhVUuu8cVXwIxQAAAEk"]
[Tue Apr 21 23:14:01.942477 2026] [:error] [pid 35415:tid 35435] [client 45.137.126.26:44963] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Tue Apr 21 23:14:02.430875 2026] [:error] [pid 35415:tid 35447] [client 45.137.126.26:44963] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aeeUOkiqDinI4_22zziA8AAAANQ"]
[Tue Apr 21 23:14:03.896117 2026] [:error] [pid 53978:tid 53982] [client 45.137.126.3:24021] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aeeUO51ivsR4hcOSQbZKYgAAAoI"]
[Tue Apr 21 23:14:06.361951 2026] [:error] [pid 35321:tid 35404] [client 45.137.126.50:49583] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-configs.php
[Tue Apr 21 23:14:06.850279 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.50:49583] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aeeUPjeHLhVUuu8cVXwI5AAAAEM"]
[Tue Apr 21 23:14:09.357504 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.35:60345] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aeeUQYJW6fdXWO6agMET-QAAAAQ"]
[Tue Apr 21 23:14:10.344324 2026] [:error] [pid 53731:tid 53756] [client 45.137.126.4:27381] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/mah.php
[Tue Apr 21 23:14:10.835057 2026] [:error] [pid 53731:tid 53755] [client 45.137.126.4:27381] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aeeUQl2I9THUR-bRVGydOAAAAhM"]
[Tue Apr 21 23:14:11.806379 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.3:20293] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aeeUQ4JW6fdXWO6agMEUGQAAAA0"]
[Tue Apr 21 23:14:12.785953 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.53:60357] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-users.php
[Tue Apr 21 23:14:13.762834 2026] [:error] [pid 53978:tid 53988] [client 45.137.126.53:60357] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aeeURZ1ivsR4hcOSQbZKhAAAAog"]
[Tue Apr 21 23:14:14.731360 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.30:28425] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aeeURjeHLhVUuu8cVXwJCwAAAFY"]
[Tue Apr 21 23:14:18.678124 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.52:62751] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aeeUSoJW6fdXWO6agMEUQQAAABA"]
[Tue Apr 21 23:14:19.654121 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.16:59139] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aeeUS4JW6fdXWO6agMEUSwAAAAk"]
[Tue Apr 21 23:14:21.123302 2026] [:error] [pid 35322:tid 35362] [client 45.137.126.17:59471] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/log.php"] [unique_id "aeeUTaPoAfV40BTfVKzmVQAAAIU"]
[Tue Apr 21 23:14:22.095350 2026] [:error] [pid 53731:tid 53755] [client 45.137.126.16:52951] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aeeUTl2I9THUR-bRVGydSAAAAhM"]
[Tue Apr 21 23:14:23.072018 2026] [:error] [pid 53978:tid 53998] [client 45.137.126.9:31251] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aeeUT51ivsR4hcOSQbZKlAAAApI"]
[Tue Apr 21 23:14:24.048577 2026] [:error] [pid 53731:tid 53750] [client 45.137.126.21:36041] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/aw.php"] [unique_id "aeeUUF2I9THUR-bRVGydWwAAAg8"]
[Tue Apr 21 23:14:27.099292 2026] [:error] [pid 53832:tid 53844] [client 45.137.126.23:42251] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aeeUU9zkuxsE_OhM9UKDaAAAAkk"]
[Tue Apr 21 23:14:28.073136 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.9:28097] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/install.php"] [unique_id "aeeUVDeHLhVUuu8cVXwJUgAAAEM"]
[Tue Apr 21 23:14:29.557467 2026] [:error] [pid 53978:tid 53996] [client 45.137.126.32:51085] File does not exist: /usr/local/apache/htdocs/suspended-page/top.php
[Tue Apr 21 23:14:30.044909 2026] [:error] [pid 53978:tid 53994] [client 45.137.126.32:51085] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aeeUVp1ivsR4hcOSQbZKpQAAAo4"]
[Tue Apr 21 23:14:31.185008 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.46:21941] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aeeUVzeHLhVUuu8cVXwJbgAAAEM"]
[Tue Apr 21 23:14:33.136813 2026] [:error] [pid 35320:tid 35350] [client 45.137.126.51:27869] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/template-less.php"] [unique_id "aeeUWYJW6fdXWO6agMEUZAAAABQ"]
[Tue Apr 21 23:14:34.108349 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.14:46003] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aeeUWoJW6fdXWO6agMEUagAAABc"]
[Tue Apr 21 23:14:38.533019 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.13:59805] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aeeUXoJW6fdXWO6agMEUkAAAAAQ"]
[Tue Apr 21 23:14:39.503943 2026] [:error] [pid 35321:tid 35394] [client 45.137.126.51:44357] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aeeUXzeHLhVUuu8cVXwJgAAAAEo"]
[Tue Apr 21 23:14:41.463798 2026] [:error] [pid 35321:tid 35396] [client 45.137.126.36:39433] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/file.php"] [unique_id "aeeUYTeHLhVUuu8cVXwJlQAAAEw"]
[Tue Apr 21 23:14:42.928590 2026] [:error] [pid 54080:tid 54095] [client 45.137.126.8:57225] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aeeUYozEbQHHxtmWbabbYAAAAs0"]
[Tue Apr 21 23:14:44.397268 2026] [:error] [pid 4823:tid 4863] [client 45.137.126.53:29737] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/load.php"] [unique_id "aeeUZPc8mke3PfHqsxEQnwAAAYo"]
[Tue Apr 21 23:14:45.373317 2026] [:error] [pid 54080:tid 54103] [client 45.137.126.31:44301] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aeeUZYzEbQHHxtmWbabbZQAAAtU"]
[Tue Apr 21 23:14:46.350454 2026] [:error] [pid 53978:tid 53994] [client 45.137.126.31:49679] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aeeUZp1ivsR4hcOSQbZKxwAAAo4"]
[Tue Apr 21 23:14:48.794926 2026] [:error] [pid 53731:tid 53739] [client 45.137.126.35:60285] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aeeUaF2I9THUR-bRVGydlwAAAgQ"]
[Tue Apr 21 23:14:49.775842 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.4:53941] File does not exist: /usr/local/apache/htdocs/suspended-page/setup-config.php
[Tue Apr 21 23:14:50.264887 2026] [:error] [pid 35321:tid 35400] [client 45.137.126.4:53941] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aeeUajeHLhVUuu8cVXwJqwAAAFA"]
[Tue Apr 21 23:14:51.727464 2026] [:error] [pid 4823:tid 4875] [client 45.137.126.49:22795] File does not exist: /usr/local/apache/htdocs/suspended-page/type.php
[Tue Apr 21 23:14:52.214688 2026] [:error] [pid 4823:tid 4876] [client 45.137.126.49:22795] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aeeUbPc8mke3PfHqsxEQqAAAAZc"]
[Tue Apr 21 23:14:53.186467 2026] [:error] [pid 53731:tid 53742] [client 45.137.126.33:48419] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aeeUbV2I9THUR-bRVGydmwAAAgc"]
[Tue Apr 21 23:14:54.162446 2026] [:error] [pid 4823:tid 4877] [client 45.137.126.41:30807] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aeeUbvc8mke3PfHqsxEQqQAAAZg"]
[Tue Apr 21 23:14:58.237455 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.16:47805] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Tue Apr 21 23:15:00.750533 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.16:47805] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aeeUdIJW6fdXWO6agMEUxwAAAAw"]
[Tue Apr 21 23:15:02.351118 2026] [:error] [pid 53731:tid 53743] [client 45.137.126.10:40113] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aeeUdl2I9THUR-bRVGydwwAAAgg"]
[Tue Apr 21 23:15:04.312251 2026] [:error] [pid 35320:tid 35330] [client 45.137.126.39:61147] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aeeUeIJW6fdXWO6agMEU5wAAAAA"]
[Tue Apr 21 23:15:05.290394 2026] [:error] [pid 53978:tid 53989] [client 45.137.126.19:37679] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aeeUeZ1ivsR4hcOSQbZK5gAAAok"]
[Tue Apr 21 23:15:06.266483 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.41:39073] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aeeUeoJW6fdXWO6agMEU8gAAABE"]
[Tue Apr 21 23:15:08.238330 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.14:59085] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeeUfIJW6fdXWO6agMEVBAAAABE"]
[Tue Apr 21 23:15:12.700883 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.46:20563] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "aeeUgDeHLhVUuu8cVXwKBAAAAEg"]
[Tue Apr 21 23:15:15.658713 2026] [:error] [pid 4777:tid 4796] [client 45.137.126.28:35415] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aeeUg6xXur6bykKyLZS61QAAAQg"]
[Tue Apr 21 23:15:17.609913 2026] [:error] [pid 35320:tid 35337] [client 45.137.126.3:40253] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "aeeUhYJW6fdXWO6agMEVOwAAAAc"]
[Tue Apr 21 23:15:18.586736 2026] [:error] [pid 35320:tid 35350] [client 45.137.126.36:20137] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aeeUhoJW6fdXWO6agMEVRwAAABQ"]
[Tue Apr 21 23:15:25.019372 2026] [:error] [pid 53978:tid 53997] [client 45.137.126.47:20411] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aeeUjZ1ivsR4hcOSQbZLPwAAApE"]
[Tue Apr 21 23:15:26.011860 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.3:38499] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aeeUjjeHLhVUuu8cVXwKIwAAAEg"]
[Tue Apr 21 23:15:27.043041 2026] [:error] [pid 53731:tid 53745] [client 45.137.126.13:39741] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aeeUj12I9THUR-bRVGyeAgAAAgo"]
[Tue Apr 21 23:15:28.514031 2026] [:error] [pid 53731:tid 53743] [client 45.137.126.21:65239] [client 45.137.126.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.21, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aeeUkF2I9THUR-bRVGyeDQAAAgg"]
[Tue Apr 21 23:15:29.492316 2026] [:error] [pid 53731:tid 53737] [client 45.137.126.21:65239] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aeeUkV2I9THUR-bRVGyeEAAAAgI"]
[Tue Apr 21 23:15:30.468494 2026] [:error] [pid 54080:tid 54086] [client 45.137.126.33:21043] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aeeUkozEbQHHxtmWbabbyAAAAsQ"]
[Tue Apr 21 23:15:31.617975 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.10:25173] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aeeUk4JW6fdXWO6agMEVjQAAAAw"]
[Tue Apr 21 23:15:36.786379 2026] [:error] [pid 54080:tid 54084] [client 45.137.126.40:52299] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aeeUmIzEbQHHxtmWbabb5gAAAsI"]
[Tue Apr 21 23:15:42.466720 2026] [:error] [pid 4823:tid 4873] [client 45.137.126.48:25015] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aeeUnvc8mke3PfHqsxEQ2AAAAZQ"]
[Tue Apr 21 23:15:44.426949 2026] [:error] [pid 35321:tid 35398] [client 45.137.126.11:39037] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aeeUoDeHLhVUuu8cVXwKYgAAAE4"]
[Tue Apr 21 23:15:53.378960 2026] [:error] [pid 35322:tid 35361] [client 45.137.126.25:21731] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aeeUqaPoAfV40BTfVKzmiAAAAIQ"]
[Tue Apr 21 23:15:54.361757 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.36:40453] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aeeUqoJW6fdXWO6agMEV4gAAAAQ"]
[Tue Apr 21 23:15:55.334113 2026] [:error] [pid 35320:tid 35338] [client 45.137.126.52:64345] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aeeUq4JW6fdXWO6agMEV6QAAAAg"]
[Tue Apr 21 23:15:56.305709 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.43:41985] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aeeUrIJW6fdXWO6agMEV7gAAAAw"]
[Tue Apr 21 23:15:58.752268 2026] [:error] [pid 35320:tid 35338] [client 45.137.126.53:54787] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aeeUroJW6fdXWO6agMEWBQAAAAg"]
[Tue Apr 21 23:15:59.728162 2026] [:error] [pid 53731:tid 53740] [client 45.137.126.23:34691] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aeeUr12I9THUR-bRVGyeOQAAAgU"]
[Tue Apr 21 23:16:03.189482 2026] [:error] [pid 53731:tid 53758] [client 45.137.126.46:51745] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aeeUs12I9THUR-bRVGyeSAAAAhY"]
[Tue Apr 21 23:16:06.152208 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.34:34233] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aeeUtjeHLhVUuu8cVXwKjgAAAEM"]
[Tue Apr 21 23:16:07.130698 2026] [:error] [pid 54080:tid 54099] [client 45.137.126.50:63139] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aeeUt4zEbQHHxtmWbabb_QAAAtE"]
[Tue Apr 21 23:16:54.743857 2026] [autoindex:error] [pid 53978:tid 54000] [client 45.137.126.2:40295] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 00:16:28.188227 2026] [:error] [pid 35321:tid 35388] [client 43.154.140.188:56808] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeei3DeHLhVUuu8cVXwuSAAAAEQ"]
[Wed Apr 22 02:54:02.904796 2026] [:error] [pid 35320:tid 35333] [client 43.130.67.51:59342] [client 43.130.67.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aefHyoJW6fdXWO6agMGlMgAAAAM"]
[Wed Apr 22 03:11:54.055327 2026] [:error] [pid 19311:tid 19324] [client 2.58.56.211:57563] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Wed Apr 22 03:11:55.076019 2026] [:error] [pid 19311:tid 19329] [client 2.58.56.211:58146] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aefL-zHue3GDqn5CMJsQGQAAARA"]
[Wed Apr 22 03:11:55.594717 2026] [:error] [pid 18795:tid 18821] [client 2.58.56.211:58312] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aefL-_pmfB6aIfcKgXcPGwAAANc"]
[Wed Apr 22 03:11:56.101716 2026] [:error] [pid 18709:tid 18714] [client 2.58.56.211:58541] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aefL_F-dKXNZS78lONjmJQAAAAA"]
[Wed Apr 22 03:11:57.114526 2026] [:error] [pid 18795:tid 18822] [client 2.58.56.211:58980] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "aefL_fpmfB6aIfcKgXcPIQAAANg"]
[Wed Apr 22 03:11:57.621004 2026] [:error] [pid 19311:tid 19335] [client 2.58.56.211:62192] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Wed Apr 22 03:11:58.132147 2026] [:error] [pid 18795:tid 18817] [client 2.58.56.211:62379] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Wed Apr 22 06:15:06.269883 2026] [:error] [pid 21788:tid 21812] [client 101.33.80.42:48778] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aef26n7OM27rzVpef26iSwAAANY"]
[Wed Apr 22 08:50:04.560277 2026] [:error] [pid 21683:tid 21766] [client 43.130.26.3:58466] [client 43.130.26.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aegbPFZBWT-0diZyYyar9wAAAJA"]
[Wed Apr 22 11:08:35.688811 2026] [:error] [pid 31756:tid 31807] [client 1.15.52.154:52610] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeg7s9_WbkXbHaEfhd0S-QAAAk8"]
[Wed Apr 22 12:12:38.550640 2026] [:error] [pid 31755:tid 31785] [client 43.157.22.57:36946] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aehKtgz2mYMkg3X8q1sAigAAAhY"]
[Wed Apr 22 14:48:55.003715 2026] [:error] [pid 9085:tid 9099] [client 43.130.49.80:39860] [client 43.130.49.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aehvV9-_-or9vQnlWnqJowAAAUw"]
[Wed Apr 22 18:08:30.695891 2026] [:error] [pid 6384:tid 6390] [client 49.51.233.46:36814] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeieHj58M3t15ICeWHXkVgAAAMM"]
[Wed Apr 22 20:27:10.456598 2026] [:error] [pid 9085:tid 9110] [client 43.130.15.147:40846] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aei-nt-_-or9vQnlWnpcJQAAAVc"]
[Wed Apr 22 20:49:20.441904 2026] [:error] [pid 23776:tid 23796] [client 43.130.58.44:37290] [client 43.130.58.44] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aejD0LRExf-1pAbSeJvtrgAAAZI"]
[Wed Apr 22 23:46:41.401603 2026] [:error] [pid 6252:tid 6335] [client 43.157.188.74:41424] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aejtYetGYuiYb1nWBpRtBwAAARc"]
[Thu Apr 23 01:14:19.596986 2026] [:error] [pid 6344:tid 6356] [client 168.144.72.162:60941] [client 168.144.72.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.144.72.162, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "aekB60DOTF-pkQnDeUk25wAAAAc"]
[Thu Apr 23 01:14:19.600457 2026] [:error] [pid 6344:tid 6356] [client 168.144.72.162:60941] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu Apr 23 01:14:21.439623 2026] [:error] [pid 6344:tid 6355] [client 168.144.72.162:60941] [client 168.144.72.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "aekB7UDOTF-pkQnDeUk29wAAAAY"]
[Thu Apr 23 01:14:21.769290 2026] [:error] [pid 6252:tid 6333] [client 168.144.72.162:61583] [client 168.144.72.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "aekB7etGYuiYb1nWBpR95QAAARU"]
[Thu Apr 23 01:14:22.053103 2026] [:error] [pid 9085:tid 9091] [client 168.144.72.162:61646] [client 168.144.72.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "aekB7t-_-or9vQnlWnofAQAAAUQ"]
[Thu Apr 23 01:14:22.336304 2026] [:error] [pid 9085:tid 9087] [client 168.144.72.162:61706] [client 168.144.72.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "aekB7t-_-or9vQnlWnofBQAAAUA"]
[Thu Apr 23 01:14:22.622961 2026] [:error] [pid 9085:tid 9096] [client 168.144.72.162:61776] [client 168.144.72.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "aekB7t-_-or9vQnlWnofBwAAAUk"]
[Thu Apr 23 01:14:22.921932 2026] [:error] [pid 9085:tid 9103] [client 168.144.72.162:61829] [client 168.144.72.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "aekB7t-_-or9vQnlWnofCQAAAVA"]
[Thu Apr 23 01:14:23.220997 2026] [:error] [pid 6252:tid 6334] [client 168.144.72.162:61890] [client 168.144.72.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "aekB7-tGYuiYb1nWBpR95wAAARY"]
[Thu Apr 23 02:38:38.180260 2026] [:error] [pid 6384:tid 6403] [client 43.130.154.157:44376] [client 43.130.154.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aekVrj58M3t15ICeWHXnzgAAANA"]
[Thu Apr 23 03:36:48.513896 2026] [:error] [pid 43083:tid 43103] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Apr 23 03:36:48.801491 2026] [:error] [pid 43083:tid 43098] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-post-data.php
[Thu Apr 23 03:36:49.087036 2026] [:error] [pid 43083:tid 43106] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Apr 23 03:36:49.370606 2026] [:error] [pid 43083:tid 43107] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/1index.php
[Thu Apr 23 03:36:49.654621 2026] [:error] [pid 43083:tid 43085] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/kcs.php
[Thu Apr 23 03:36:49.937457 2026] [:error] [pid 43083:tid 43095] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Apr 23 03:36:50.220848 2026] [:error] [pid 43083:tid 43091] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 03:36:50.504068 2026] [:error] [pid 43083:tid 43089] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Apr 23 03:36:50.786914 2026] [:error] [pid 43083:tid 43102] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 03:36:51.070894 2026] [:error] [pid 43083:tid 43087] [client 74.248.132.226:16649] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 03:36:51.351481 2026] [:error] [pid 43083:tid 43085] [client 74.248.132.226:16649] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjUzC5hrvNXosL83JDjgAAAMA"]
[Thu Apr 23 03:36:51.887600 2026] [:error] [pid 43083:tid 43088] [client 74.248.132.226:9995] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjUzC5hrvNXosL83JDjwAAAMM"]
[Thu Apr 23 03:36:52.404321 2026] [:error] [pid 42971:tid 42989] [client 74.248.132.226:11163] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjVDEP2_5RswrH8bFeLQAAAAM"]
[Thu Apr 23 03:36:52.917547 2026] [:error] [pid 43083:tid 43086] [client 74.248.132.226:10421] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjVDC5hrvNXosL83JDkQAAAME"]
[Thu Apr 23 03:36:53.079167 2026] [:error] [pid 43083:tid 43109] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Apr 23 03:36:53.340903 2026] [:error] [pid 43083:tid 43105] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-post-data.php
[Thu Apr 23 03:36:53.430961 2026] [:error] [pid 42972:tid 43036] [client 74.248.132.226:9059] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjVcOAb-3sOknsk4fJvAAAAFQ"]
[Thu Apr 23 03:36:53.602499 2026] [:error] [pid 43083:tid 43089] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Apr 23 03:36:53.864613 2026] [:error] [pid 43083:tid 43096] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/1index.php
[Thu Apr 23 03:36:53.967737 2026] [:error] [pid 43083:tid 43104] [client 74.248.132.226:8477] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjVTC5hrvNXosL83JDlgAAANM"]
[Thu Apr 23 03:36:54.126771 2026] [:error] [pid 43083:tid 43108] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/kcs.php
[Thu Apr 23 03:36:54.392313 2026] [:error] [pid 43083:tid 43100] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Apr 23 03:36:54.525563 2026] [:error] [pid 43083:tid 43088] [client 74.248.132.226:10016] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjVjC5hrvNXosL83JDnQAAAMM"]
[Thu Apr 23 03:36:54.656591 2026] [:error] [pid 43083:tid 43106] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 03:36:54.919708 2026] [:error] [pid 43083:tid 43103] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Apr 23 03:36:55.090760 2026] [:error] [pid 42972:tid 43028] [client 74.248.132.226:16272] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjV8OAb-3sOknsk4fJvwAAAEw"]
[Thu Apr 23 03:36:55.182207 2026] [:error] [pid 43083:tid 43109] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 03:36:55.444433 2026] [:error] [pid 43083:tid 43089] [client 20.100.170.189:21049] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 03:36:55.651119 2026] [:error] [pid 43083:tid 43093] [client 74.248.132.226:22391] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjVzC5hrvNXosL83JDowAAAMg"]
[Thu Apr 23 03:36:55.703201 2026] [:error] [pid 43083:tid 43092] [client 20.100.170.189:21049] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjVzC5hrvNXosL83JDpAAAAMc"]
[Thu Apr 23 03:36:56.185015 2026] [:error] [pid 43083:tid 43100] [client 74.248.132.226:16278] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjWDC5hrvNXosL83JDpgAAAM8"]
[Thu Apr 23 03:36:56.219592 2026] [:error] [pid 42973:tid 43063] [client 20.100.170.189:21043] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjWG6I0QqmmmLTHE1xNgAAAJQ"]
[Thu Apr 23 03:36:56.723146 2026] [:error] [pid 42972:tid 43021] [client 74.248.132.226:16316] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjWMOAb-3sOknsk4fJwAAAAEU"]
[Thu Apr 23 03:36:56.737499 2026] [:error] [pid 42971:tid 42994] [client 20.100.170.189:21029] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjWDEP2_5RswrH8bFeMgAAAAg"]
[Thu Apr 23 03:36:57.261587 2026] [:error] [pid 42972:tid 43024] [client 74.248.132.226:10043] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjWcOAb-3sOknsk4fJwQAAAEg"]
[Thu Apr 23 03:36:57.283473 2026] [:error] [pid 42972:tid 43040] [client 20.100.170.189:13648] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjWcOAb-3sOknsk4fJwgAAAFg"]
[Thu Apr 23 03:36:57.803677 2026] [:error] [pid 42973:tid 43055] [client 20.100.170.189:18685] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjWW6I0QqmmmLTHE1xNwAAAIw"]
[Thu Apr 23 03:36:57.851251 2026] [:error] [pid 43083:tid 43091] [client 74.248.132.226:13607] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjWTC5hrvNXosL83JDqgAAAMY"]
[Thu Apr 23 03:36:58.324160 2026] [:error] [pid 43083:tid 43090] [client 20.100.170.189:18732] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjWjC5hrvNXosL83JDqwAAAMU"]
[Thu Apr 23 03:36:58.388340 2026] [:error] [pid 43083:tid 43103] [client 74.248.132.226:16376] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjWjC5hrvNXosL83JDrAAAANI"]
[Thu Apr 23 03:36:58.841457 2026] [:error] [pid 43083:tid 43093] [client 20.100.170.189:20996] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjWjC5hrvNXosL83JDsAAAAMg"]
[Thu Apr 23 03:36:58.964014 2026] [:error] [pid 42972:tid 43017] [client 74.248.132.226:9053] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjWsOAb-3sOknsk4fJxQAAAEE"]
[Thu Apr 23 03:36:59.362512 2026] [:error] [pid 43083:tid 43096] [client 20.100.170.189:14340] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjWzC5hrvNXosL83JDsQAAAMs"]
[Thu Apr 23 03:36:59.539666 2026] [:error] [pid 42972:tid 43032] [client 74.248.132.226:16295] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjW8OAb-3sOknsk4fJxwAAAFA"]
[Thu Apr 23 03:36:59.880399 2026] [:error] [pid 43083:tid 43085] [client 20.100.170.189:21045] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjWzC5hrvNXosL83JDtAAAAMA"]
[Thu Apr 23 03:37:00.174386 2026] [:error] [pid 43083:tid 43099] [client 74.248.132.226:17376] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjXDC5hrvNXosL83JDtQAAAM4"]
[Thu Apr 23 03:37:00.402626 2026] [:error] [pid 43083:tid 43088] [client 20.100.170.189:3312] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjXDC5hrvNXosL83JDtgAAAMM"]
[Thu Apr 23 03:37:00.715068 2026] [:error] [pid 42971:tid 42993] [client 74.248.132.226:9057] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjXDEP2_5RswrH8bFeOwAAAAc"]
[Thu Apr 23 03:37:00.925899 2026] [:error] [pid 42971:tid 43008] [client 20.100.170.189:13923] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjXDEP2_5RswrH8bFeQQAAABY"]
[Thu Apr 23 03:37:01.231602 2026] [:error] [pid 42972:tid 43034] [client 74.248.132.226:11186] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjXcOAb-3sOknsk4fJyAAAAFI"]
[Thu Apr 23 03:37:01.446657 2026] [:error] [pid 42972:tid 43037] [client 20.100.170.189:13940] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjXcOAb-3sOknsk4fJyQAAAFU"]
[Thu Apr 23 03:37:01.771739 2026] [:error] [pid 42973:tid 43053] [client 74.248.132.226:16343] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjXW6I0QqmmmLTHE1xPAAAAIo"]
[Thu Apr 23 03:37:01.966297 2026] [:error] [pid 42973:tid 43059] [client 20.100.170.189:21023] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjXW6I0QqmmmLTHE1xPQAAAJA"]
[Thu Apr 23 03:37:02.310770 2026] [:error] [pid 42973:tid 43045] [client 74.248.132.226:22364] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjXm6I0QqmmmLTHE1xQAAAAII"]
[Thu Apr 23 03:37:02.489683 2026] [:error] [pid 42972:tid 43025] [client 20.100.170.189:18655] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjXsOAb-3sOknsk4fJzgAAAEk"]
[Thu Apr 23 03:37:02.842052 2026] [:error] [pid 42971:tid 42987] [client 74.248.132.226:17356] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjXjEP2_5RswrH8bFeRwAAAAE"]
[Thu Apr 23 03:37:03.019402 2026] [:error] [pid 42973:tid 43046] [client 20.100.170.189:18188] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjX26I0QqmmmLTHE1xQQAAAIM"]
[Thu Apr 23 03:37:03.391022 2026] [:error] [pid 42973:tid 43049] [client 74.248.132.226:2282] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjX26I0QqmmmLTHE1xQgAAAIY"]
[Thu Apr 23 03:37:03.546371 2026] [:error] [pid 42973:tid 43050] [client 20.100.170.189:17544] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjX26I0QqmmmLTHE1xQwAAAIc"]
[Thu Apr 23 03:37:03.926925 2026] [:error] [pid 43083:tid 43089] [client 74.248.132.226:11187] [client 74.248.132.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjXzC5hrvNXosL83JDvQAAAMQ"]
[Thu Apr 23 03:37:04.065446 2026] [:error] [pid 43083:tid 43085] [client 20.100.170.189:13735] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjYDC5hrvNXosL83JDvgAAAMA"]
[Thu Apr 23 03:37:04.598589 2026] [:error] [pid 42972:tid 43021] [client 20.100.170.189:13748] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjYMOAb-3sOknsk4fJ0AAAAEU"]
[Thu Apr 23 03:37:05.117713 2026] [:error] [pid 43083:tid 43106] [client 20.100.170.189:21034] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjYTC5hrvNXosL83JDwgAAANU"]
[Thu Apr 23 03:37:05.636562 2026] [:error] [pid 43083:tid 43108] [client 20.100.170.189:21028] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjYTC5hrvNXosL83JDxAAAANc"]
[Thu Apr 23 03:37:06.156461 2026] [:error] [pid 43083:tid 43103] [client 20.100.170.189:13750] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjYjC5hrvNXosL83JDxgAAANI"]
[Thu Apr 23 03:37:06.669444 2026] [:error] [pid 43083:tid 43094] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Apr 23 03:37:06.682408 2026] [:error] [pid 42971:tid 43010] [client 20.100.170.189:13926] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjYjEP2_5RswrH8bFeTAAAABg"]
[Thu Apr 23 03:37:06.953109 2026] [:error] [pid 43083:tid 43093] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-post-data.php
[Thu Apr 23 03:37:07.206965 2026] [:error] [pid 43083:tid 43096] [client 20.100.170.189:17531] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjYzC5hrvNXosL83JDzgAAAMs"]
[Thu Apr 23 03:37:07.237534 2026] [:error] [pid 43083:tid 43104] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Thu Apr 23 03:37:07.522879 2026] [:error] [pid 43083:tid 43106] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/1index.php
[Thu Apr 23 03:37:07.738697 2026] [:error] [pid 42973:tid 43051] [client 20.100.170.189:17525] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjY26I0QqmmmLTHE1xSAAAAIg"]
[Thu Apr 23 03:37:07.807366 2026] [:error] [pid 43083:tid 43101] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/kcs.php
[Thu Apr 23 03:37:08.090901 2026] [:error] [pid 43083:tid 43107] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Thu Apr 23 03:37:08.375916 2026] [:error] [pid 43083:tid 43095] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 03:37:08.659297 2026] [:error] [pid 43083:tid 43108] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Apr 23 03:37:08.943837 2026] [:error] [pid 43083:tid 43103] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 03:37:09.229018 2026] [:error] [pid 43083:tid 43109] [client 4.223.68.227:14713] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 03:37:09.512062 2026] [:error] [pid 43083:tid 43094] [client 4.223.68.227:14713] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjZTC5hrvNXosL83JD2wAAAMk"]
[Thu Apr 23 03:37:09.902472 2026] [:error] [pid 43083:tid 43098] [client 20.100.170.189:19553] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aekjZTC5hrvNXosL83JD3gAAAM0"]
[Thu Apr 23 03:37:10.056182 2026] [:error] [pid 43083:tid 43104] [client 4.223.68.227:19525] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjZjC5hrvNXosL83JD4AAAANM"]
[Thu Apr 23 03:37:10.420391 2026] [:error] [pid 42971:tid 43006] [client 20.100.170.189:17998] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aekjZjEP2_5RswrH8bFeTQAAABQ"]
[Thu Apr 23 03:37:10.646534 2026] [:error] [pid 42972:tid 43023] [client 4.223.68.227:14680] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjZsOAb-3sOknsk4fJ1gAAAEc"]
[Thu Apr 23 03:37:10.942646 2026] [:error] [pid 42971:tid 42994] [client 20.100.170.189:17283] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aekjZjEP2_5RswrH8bFeTgAAAAg"]
[Thu Apr 23 03:37:11.191382 2026] [:error] [pid 42973:tid 43061] [client 4.223.68.227:23927] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aekjZ26I0QqmmmLTHE1xTgAAAJI"]
[Thu Apr 23 03:37:11.467522 2026] [:error] [pid 42973:tid 43046] [client 20.100.170.189:17315] [client 20.100.170.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aekjZ26I0QqmmmLTHE1xTwAAAIM"]
[Thu Apr 23 03:37:11.776039 2026] [:error] [pid 42973:tid 43047] [client 4.223.68.227:13075] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjZ26I0QqmmmLTHE1xUQAAAIQ"]
[Thu Apr 23 03:37:12.322613 2026] [:error] [pid 43083:tid 43103] [client 4.223.68.227:14706] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjaDC5hrvNXosL83JD5QAAANI"]
[Thu Apr 23 03:37:12.927060 2026] [:error] [pid 42972:tid 43037] [client 4.223.68.227:2470] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjaMOAb-3sOknsk4fJ2AAAAFU"]
[Thu Apr 23 03:37:13.507201 2026] [:error] [pid 42972:tid 43025] [client 4.223.68.227:2321] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "aekjacOAb-3sOknsk4fJ2gAAAEk"]
[Thu Apr 23 03:37:14.068681 2026] [:error] [pid 42972:tid 43029] [client 4.223.68.227:2434] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjasOAb-3sOknsk4fJ3AAAAE0"]
[Thu Apr 23 03:37:14.633753 2026] [:error] [pid 42972:tid 43039] [client 4.223.68.227:2639] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjasOAb-3sOknsk4fJ3gAAAFc"]
[Thu Apr 23 03:37:15.189981 2026] [:error] [pid 42972:tid 43028] [client 4.223.68.227:14662] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekja8OAb-3sOknsk4fJ3wAAAEw"]
[Thu Apr 23 03:37:15.796616 2026] [:error] [pid 43083:tid 43098] [client 4.223.68.227:2681] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/system_log.php"] [unique_id "aekjazC5hrvNXosL83JD6QAAAM0"]
[Thu Apr 23 03:37:16.358527 2026] [:error] [pid 43083:tid 43089] [client 4.223.68.227:23882] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjbDC5hrvNXosL83JD7AAAAMQ"]
[Thu Apr 23 03:37:16.907760 2026] [:error] [pid 42971:tid 43005] [client 4.223.68.227:2454] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjbDEP2_5RswrH8bFeUgAAABM"]
[Thu Apr 23 03:37:17.450443 2026] [:error] [pid 42972:tid 43032] [client 4.223.68.227:13088] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjbcOAb-3sOknsk4fJ5QAAAFA"]
[Thu Apr 23 03:37:18.009355 2026] [:error] [pid 42973:tid 43062] [client 4.223.68.227:23881] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aekjbm6I0QqmmmLTHE1xUwAAAJM"]
[Thu Apr 23 03:37:18.554775 2026] [:error] [pid 42973:tid 43065] [client 4.223.68.227:2666] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjbm6I0QqmmmLTHE1xVAAAAJY"]
[Thu Apr 23 03:37:19.100576 2026] [:error] [pid 42973:tid 43063] [client 4.223.68.227:19608] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjb26I0QqmmmLTHE1xVgAAAJQ"]
[Thu Apr 23 03:37:19.646898 2026] [:error] [pid 43083:tid 43095] [client 4.223.68.227:19541] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjbzC5hrvNXosL83JD8gAAAMo"]
[Thu Apr 23 03:37:20.209549 2026] [:error] [pid 43083:tid 43103] [client 4.223.68.227:2353] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "aekjcDC5hrvNXosL83JD9AAAANI"]
[Thu Apr 23 03:37:20.833247 2026] [:error] [pid 43083:tid 43094] [client 4.223.68.227:13077] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjcDC5hrvNXosL83JD9QAAAMk"]
[Thu Apr 23 03:37:21.436096 2026] [:error] [pid 43083:tid 43090] [client 4.223.68.227:23889] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjcTC5hrvNXosL83JD9gAAAMU"]
[Thu Apr 23 03:37:21.987015 2026] [:error] [pid 43083:tid 43098] [client 4.223.68.227:12911] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjcTC5hrvNXosL83JD-QAAAM0"]
[Thu Apr 23 03:37:22.534489 2026] [:error] [pid 42971:tid 42989] [client 4.223.68.227:23872] [client 4.223.68.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/radio.php"] [unique_id "aekjcjEP2_5RswrH8bFeWgAAAAM"]
[Thu Apr 23 07:14:01.280033 2026] [:error] [pid 43083:tid 43085] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Apr 23 07:14:01.662684 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Apr 23 07:14:01.984109 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 23 07:14:02.325846 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 23 07:14:02.715412 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 23 07:14:03.040953 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 07:14:05.976419 2026] [:error] [pid 43083:tid 43095] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 23 07:14:06.303568 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Apr 23 07:14:06.960950 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Apr 23 07:14:07.331795 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Apr 23 07:14:07.688349 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 07:14:08.035656 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Apr 23 07:14:08.337186 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 23 07:14:08.675679 2026] [:error] [pid 43083:tid 43102] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Apr 23 07:14:09.047218 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 23 07:14:09.761601 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 23 07:14:10.859868 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 23 07:14:11.170454 2026] [:error] [pid 43083:tid 43102] [client 89.251.0.124:63743] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 23 07:14:21.043066 2026] [:error] [pid 43083:tid 43103] [client 89.251.0.124:63743] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aelWTTC5hrvNXosL83KpnAAAANI"]
[Thu Apr 23 07:14:22.772744 2026] [:error] [pid 42972:tid 43019] [client 89.251.0.150:60381] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aelWTsOAb-3sOknsk4cCOAAAAEM"]
[Thu Apr 23 07:14:24.679760 2026] [:error] [pid 42973:tid 43062] [client 89.251.0.113:32947] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 23 07:14:26.294497 2026] [:error] [pid 42973:tid 43058] [client 89.251.0.113:32947] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aelWUm6I0QqmmmLTHE2_sgAAAI8"]
[Thu Apr 23 07:14:27.468969 2026] [:error] [pid 42973:tid 43067] [client 89.251.0.117:59303] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 23 07:14:27.753474 2026] [:error] [pid 42973:tid 43051] [client 89.251.0.117:59303] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aelWU26I0QqmmmLTHE2_xgAAAIg"]
[Thu Apr 23 07:14:28.730384 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.138:23893] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Apr 23 07:14:30.973011 2026] [:error] [pid 42972:tid 43019] [client 89.251.0.138:23893] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aelWVsOAb-3sOknsk4cC8QAAAEM"]
[Thu Apr 23 07:14:32.146635 2026] [:error] [pid 59700:tid 59713] [client 89.251.0.136:30137] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aelWWJXyGZJFeAIDWtk7PQAAAUs"]
[Thu Apr 23 07:14:32.734636 2026] [:error] [pid 42973:tid 43047] [client 89.251.0.116:37169] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aelWWG6I0QqmmmLTHE2_4QAAAIQ"]
[Thu Apr 23 07:14:33.422742 2026] [:error] [pid 59700:tid 59718] [client 89.251.0.127:56847] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aelWWZXyGZJFeAIDWtk7TAAAAVA"]
[Thu Apr 23 07:14:34.019832 2026] [:error] [pid 25635:tid 25645] [client 89.251.0.132:36391] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aelWWsRxv6UsgRGKB3LHswAAAQY"]
[Thu Apr 23 07:14:34.636550 2026] [:error] [pid 25635:tid 25641] [client 89.251.0.142:30495] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aelWWsRxv6UsgRGKB3LHvQAAAQI"]
[Thu Apr 23 07:14:36.262569 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.145:22257] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aelWXDC5hrvNXosL83KqNQAAAM4"]
[Thu Apr 23 07:14:36.965864 2026] [:error] [pid 25635:tid 25644] [client 89.251.0.120:42369] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Apr 23 07:14:37.623384 2026] [:error] [pid 25635:tid 25659] [client 89.251.0.120:42369] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "aelWXcRxv6UsgRGKB3LH7QAAARQ"]
[Thu Apr 23 07:14:38.952109 2026] [:error] [pid 43083:tid 43101] [client 89.251.0.138:55539] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aelWXjC5hrvNXosL83KqUgAAANA"]
[Thu Apr 23 07:14:39.825250 2026] [:error] [pid 42972:tid 43036] [client 89.251.0.146:23671] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aelWX8OAb-3sOknsk4cDawAAAFQ"]
[Thu Apr 23 07:14:40.433166 2026] [:error] [pid 42971:tid 43001] [client 89.251.0.116:24175] File does not exist: /usr/local/apache/htdocs/suspended-page/function.php
[Thu Apr 23 07:14:40.788664 2026] [:error] [pid 42971:tid 42995] [client 89.251.0.116:24175] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aelWYDEP2_5RswrH8bGLAgAAAAk"]
[Thu Apr 23 07:14:41.444307 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.143:32473] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signup.php
[Thu Apr 23 07:14:42.490201 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.143:32473] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Thu Apr 23 07:14:43.413821 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.143:32473] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aelWY5XyGZJFeAIDWtk7ygAAAUA"]
[Thu Apr 23 07:14:44.054044 2026] [:error] [pid 25635:tid 25653] [client 89.251.0.131:31557] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-l0gin.php
[Thu Apr 23 07:14:44.361042 2026] [:error] [pid 25635:tid 25650] [client 89.251.0.131:31557] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aelWZMRxv6UsgRGKB3LIVQAAAQs"]
[Thu Apr 23 07:14:44.938008 2026] [:error] [pid 42971:tid 43008] [client 89.251.0.150:56821] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Thu Apr 23 07:14:45.517517 2026] [:error] [pid 42971:tid 43003] [client 89.251.0.150:56821] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/defaults.php"] [unique_id "aelWZTEP2_5RswrH8bGLPQAAABE"]
[Thu Apr 23 07:14:46.969627 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.120:56015] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aelWZr6vRb9j6psK2ZZi2gAAAgI"]
[Thu Apr 23 07:14:48.010042 2026] [:error] [pid 42972:tid 43033] [client 89.251.0.133:42521] File does not exist: /usr/local/apache/htdocs/suspended-page/natural.php
[Thu Apr 23 07:14:48.341775 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.133:42521] File does not exist: /usr/local/apache/htdocs/suspended-page/item.php
[Thu Apr 23 07:14:49.163716 2026] [:error] [pid 42972:tid 43019] [client 89.251.0.133:42521] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aelWacOAb-3sOknsk4cEKgAAAEM"]
[Thu Apr 23 07:14:50.199961 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.123:40573] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aelWar6vRb9j6psK2ZZi8QAAAgE"]
[Thu Apr 23 07:14:51.248679 2026] [:error] [pid 59700:tid 59702] [client 89.251.0.132:54193] [client 89.251.0.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aelWa5XyGZJFeAIDWtk8QgAAAUA"]
[Thu Apr 23 07:14:51.895096 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.129:54973] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aelWazEP2_5RswrH8bGLkwAAAAU"]
[Thu Apr 23 07:14:52.616809 2026] [:error] [pid 25635:tid 25658] [client 89.251.0.143:31383] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aelWbMRxv6UsgRGKB3LIlQAAARM"]
[Thu Apr 23 07:14:54.505380 2026] [:error] [pid 25635:tid 25662] [client 89.251.0.147:55363] File does not exist: /usr/local/apache/htdocs/suspended-page/default.php
[Thu Apr 23 07:14:54.876864 2026] [:error] [pid 25635:tid 25663] [client 89.251.0.147:55363] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aelWbsRxv6UsgRGKB3LIpgAAARg"]
[Thu Apr 23 07:14:56.168047 2026] [:error] [pid 59700:tid 59703] [client 89.251.0.113:56881] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/class.api.php"] [unique_id "aelWcJXyGZJFeAIDWtk8pQAAAUE"]
[Thu Apr 23 07:14:57.266490 2026] [:error] [pid 42971:tid 43003] [client 89.251.0.151:64725] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aelWcTEP2_5RswrH8bGLwQAAABE"]
[Thu Apr 23 07:14:58.574885 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.135:20959] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Thu Apr 23 07:14:59.463369 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.135:20959] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu Apr 23 07:15:01.246754 2026] [:error] [pid 43083:tid 43106] [client 89.251.0.135:20959] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/admin.php"] [unique_id "aelWdTC5hrvNXosL83KrVwAAANU"]
[Thu Apr 23 07:15:03.164820 2026] [:error] [pid 59700:tid 59723] [client 89.251.0.135:53901] [client 89.251.0.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.135, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aelWd5XyGZJFeAIDWtk8-AAAAVU"]
[Thu Apr 23 07:15:03.527321 2026] [:error] [pid 59700:tid 59711] [client 89.251.0.135:53901] File does not exist: /usr/local/apache/htdocs/suspended-page/install.php
[Thu Apr 23 07:15:05.497960 2026] [:error] [pid 59700:tid 59711] [client 89.251.0.135:53901] File does not exist: /usr/local/apache/htdocs/suspended-page/bypass.php
[Thu Apr 23 07:15:05.826530 2026] [:error] [pid 59700:tid 59722] [client 89.251.0.135:53901] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu Apr 23 07:15:08.334811 2026] [:error] [pid 59700:tid 59708] [client 89.251.0.135:53901] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aelWfJXyGZJFeAIDWtk9RQAAAUY"]
[Thu Apr 23 07:15:09.465254 2026] [:error] [pid 42971:tid 42994] [client 89.251.0.120:56033] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Thu Apr 23 07:15:09.808433 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.120:56033] [client 89.251.0.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.120, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aelWfTEP2_5RswrH8bGMGgAAABQ"]
[Thu Apr 23 07:15:10.524165 2026] [:error] [pid 42971:tid 42999] [client 89.251.0.120:56033] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/item.php"] [unique_id "aelWfjEP2_5RswrH8bGMJgAAAA0"]
[Thu Apr 23 07:15:13.768406 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.116:50375] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Apr 23 07:15:14.513301 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.116:50375] File does not exist: /usr/local/apache/htdocs/suspended-page/wp_wlx.php
[Thu Apr 23 07:15:15.153506 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.116:50375] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aelWg76vRb9j6psK2ZZjtgAAAgM"]
[Thu Apr 23 07:15:15.937817 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.135:64749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu Apr 23 07:15:17.480689 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.135:64749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-header.php
[Thu Apr 23 07:15:18.378146 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.135:64749] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Thu Apr 23 07:15:19.046345 2026] [:error] [pid 65000:tid 65037] [client 89.251.0.135:64749] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Thu Apr 23 07:15:20.117433 2026] [:error] [pid 65000:tid 65037] [client 89.251.0.135:64749] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aelWiL6vRb9j6psK2ZZj4gAAAgQ"]
[Thu Apr 23 07:15:20.815833 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.151:64039] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Thu Apr 23 07:15:21.130620 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.151:64039] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Thu Apr 23 07:15:21.493186 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.151:64039] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aelWib6vRb9j6psK2ZZj8wAAAg0"]
[Thu Apr 23 07:15:22.434259 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.148:60245] File does not exist: /usr/local/apache/htdocs/suspended-page/content.php
[Thu Apr 23 07:15:23.267817 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.148:60245] [client 89.251.0.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.148, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aelWi76vRb9j6psK2ZZkGQAAAgk"]
[Thu Apr 23 07:15:28.143037 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.148:60245] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aelWkL6vRb9j6psK2ZZkdgAAAgk"]
[Thu Apr 23 07:15:32.572600 2026] [:error] [pid 42972:tid 43027] [client 89.251.0.136:29189] File does not exist: /usr/local/apache/htdocs/suspended-page/web.php
[Thu Apr 23 07:15:34.489262 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.136:29189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Thu Apr 23 07:15:34.794338 2026] [:error] [pid 42972:tid 43027] [client 89.251.0.136:29189] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aelWlsOAb-3sOknsk4cF5wAAAEs"]
[Thu Apr 23 07:15:35.454033 2026] [:error] [pid 64967:tid 64972] [client 89.251.0.148:24699] File does not exist: /usr/local/apache/htdocs/suspended-page/radio.php
[Thu Apr 23 07:15:36.559860 2026] [:error] [pid 64967:tid 64981] [client 89.251.0.148:24699] [client 89.251.0.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.148, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aelWmIAV4GfOOdX8Qzr4SwAAAYw"]
[Thu Apr 23 07:15:36.911027 2026] [:error] [pid 64967:tid 64983] [client 89.251.0.148:24699] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-conflg.php
[Thu Apr 23 07:15:37.247942 2026] [:error] [pid 64967:tid 64984] [client 89.251.0.148:24699] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-setup.php
[Thu Apr 23 07:15:37.579814 2026] [:error] [pid 64967:tid 64981] [client 89.251.0.148:24699] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-themes.php
[Thu Apr 23 07:15:38.023691 2026] [:error] [pid 64967:tid 64989] [client 89.251.0.148:24699] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aelWmoAV4GfOOdX8Qzr4XwAAAZQ"]
[Thu Apr 23 07:15:38.912997 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.150:58005] File does not exist: /usr/local/apache/htdocs/suspended-page/style.php
[Thu Apr 23 07:15:39.238554 2026] [:error] [pid 65000:tid 65049] [client 89.251.0.150:58005] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/infi.php"] [unique_id "aelWm76vRb9j6psK2ZZlHgAAAhA"]
[Thu Apr 23 07:15:41.171129 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.127:62947] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Thu Apr 23 07:15:41.425421 2026] [:error] [pid 43083:tid 43108] [client 89.251.0.127:62947] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aelWnTC5hrvNXosL83KtTAAAANc"]
[Thu Apr 23 07:15:43.852714 2026] [:error] [pid 25635:tid 25657] [client 89.251.0.140:35181] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-user.php
[Thu Apr 23 07:15:44.171520 2026] [:error] [pid 25635:tid 25641] [client 89.251.0.140:35181] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aelWoMRxv6UsgRGKB3LJ4gAAAQI"]
[Thu Apr 23 07:15:44.771464 2026] [:error] [pid 43083:tid 43086] [client 89.251.0.116:49587] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aelWoDC5hrvNXosL83KtfAAAAME"]
[Thu Apr 23 07:15:45.399753 2026] [:error] [pid 43083:tid 43087] [client 89.251.0.150:62171] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Thu Apr 23 07:15:45.738031 2026] [:error] [pid 43083:tid 43109] [client 89.251.0.150:62171] File does not exist: /usr/local/apache/htdocs/suspended-page/special.php
[Thu Apr 23 07:15:47.095778 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.150:62171] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aelWozC5hrvNXosL83KtlwAAAM0"]
[Thu Apr 23 07:15:48.141663 2026] [:error] [pid 64998:tid 65017] [client 89.251.0.129:51183] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aelWpIV5EysYcTLjmwjWwgAAAc8"]
[Thu Apr 23 07:15:50.405305 2026] [:error] [pid 43083:tid 43098] [client 89.251.0.142:63147] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/edit.php"] [unique_id "aelWpjC5hrvNXosL83KtpgAAAM0"]
[Thu Apr 23 07:15:51.073029 2026] [:error] [pid 64967:tid 64969] [client 89.251.0.139:32665] File does not exist: /usr/local/apache/htdocs/suspended-page/webdb.php
[Thu Apr 23 07:15:51.816393 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.139:32665] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Thu Apr 23 07:15:52.182546 2026] [:error] [pid 64967:tid 64969] [client 89.251.0.139:32665] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aelWqIAV4GfOOdX8Qzr48wAAAYA"]
[Thu Apr 23 07:15:52.907839 2026] [:error] [pid 25635:tid 25641] [client 89.251.0.142:54629] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa.php
[Thu Apr 23 07:15:53.569276 2026] [:error] [pid 25635:tid 25639] [client 89.251.0.142:54629] [client 89.251.0.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/click.php"] [unique_id "aelWqcRxv6UsgRGKB3LKMAAAAQA"]
[Thu Apr 23 07:15:55.364943 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.143:29219] [client 89.251.0.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aelWq4V5EysYcTLjmwjXVAAAAdM"]
[Thu Apr 23 07:15:56.466972 2026] [:error] [pid 42973:tid 43056] [client 89.251.0.151:45845] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 23 07:15:57.534388 2026] [:error] [pid 42973:tid 43045] [client 89.251.0.151:45845] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Thu Apr 23 07:15:58.163422 2026] [:error] [pid 42973:tid 43053] [client 89.251.0.151:45845] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Thu Apr 23 07:15:58.476885 2026] [:error] [pid 42973:tid 43056] [client 89.251.0.151:45845] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aelWrm6I0QqmmmLTHE3CrgAAAI0"]
[Thu Apr 23 07:16:00.132277 2026] [:error] [pid 42971:tid 42995] [client 89.251.0.140:50371] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aelWsDEP2_5RswrH8bGOMAAAAAk"]
[Thu Apr 23 07:16:01.295995 2026] [:error] [pid 64967:tid 64990] [client 89.251.0.117:45233] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aelWsYAV4GfOOdX8Qzr5TQAAAZU"]
[Thu Apr 23 07:16:01.902608 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.138:36881] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aelWsYV5EysYcTLjmwjXlAAAAcU"]
[Thu Apr 23 07:16:04.171806 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.120:47851] File does not exist: /usr/local/apache/htdocs/suspended-page/xp.php
[Thu Apr 23 07:16:04.626875 2026] [:error] [pid 42972:tid 43036] [client 89.251.0.120:47851] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aelWtMOAb-3sOknsk4cG7QAAAFQ"]
[Thu Apr 23 07:16:05.324706 2026] [:error] [pid 59700:tid 59703] [client 89.251.0.123:29551] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aelWtZXyGZJFeAIDWtk_2AAAAUE"]
[Thu Apr 23 07:16:06.283318 2026] [:error] [pid 64998:tid 65010] [client 89.251.0.119:23275] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links.php
[Thu Apr 23 07:16:06.948354 2026] [:error] [pid 64998:tid 65026] [client 89.251.0.119:23275] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aelWtoV5EysYcTLjmwjXxwAAAdg"]
[Thu Apr 23 07:16:07.519553 2026] [:error] [pid 59700:tid 59716] [client 89.251.0.138:56559] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aelWt5XyGZJFeAIDWtk_9gAAAU4"]
[Thu Apr 23 07:16:08.144131 2026] [:error] [pid 42972:tid 43036] [client 89.251.0.113:63745] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aelWuMOAb-3sOknsk4cHEgAAAFQ"]
[Thu Apr 23 07:16:08.840951 2026] [:error] [pid 64998:tid 65013] [client 89.251.0.119:41843] [client 89.251.0.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aelWuIV5EysYcTLjmwjX7gAAAcs"]
[Thu Apr 23 07:16:09.877189 2026] [:error] [pid 42972:tid 43023] [client 89.251.0.113:47087] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aelWucOAb-3sOknsk4cHOQAAAEc"]
[Thu Apr 23 07:16:11.912612 2026] [:error] [pid 64998:tid 65018] [client 89.251.0.113:55161] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aelWu4V5EysYcTLjmwjYEgAAAdA"]
[Thu Apr 23 07:16:12.774277 2026] [:error] [pid 42971:tid 43005] [client 89.251.0.131:31759] File does not exist: /usr/local/apache/htdocs/suspended-page/moon.php
[Thu Apr 23 07:16:13.951572 2026] [:error] [pid 42971:tid 43000] [client 89.251.0.131:31759] File does not exist: /usr/local/apache/htdocs/suspended-page/webadmin.php
[Thu Apr 23 07:16:14.273338 2026] [:error] [pid 42971:tid 43002] [client 89.251.0.131:31759] [client 89.251.0.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aelWvjEP2_5RswrH8bGPFQAAABA"]
[Thu Apr 23 07:16:15.265863 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.121:39259] File does not exist: /usr/local/apache/htdocs/suspended-page/xl2023.php
[Thu Apr 23 07:16:15.566790 2026] [:error] [pid 65000:tid 65041] [client 89.251.0.121:39259] File does not exist: /usr/local/apache/htdocs/suspended-page/go.php
[Thu Apr 23 07:16:17.192310 2026] [:error] [pid 65000:tid 65052] [client 89.251.0.121:39259] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aelWwb6vRb9j6psK2ZZm8QAAAhM"]
[Thu Apr 23 07:16:18.887734 2026] [:error] [pid 43083:tid 43107] [client 89.251.0.123:60777] [client 89.251.0.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aelWwjC5hrvNXosL83Ku7wAAANY"]
[Thu Apr 23 07:16:20.604785 2026] [:error] [pid 43083:tid 43104] [client 89.251.0.127:56563] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aelWxDC5hrvNXosL83KvGgAAANM"]
[Thu Apr 23 07:16:22.739387 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.148:60505] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aelWxr6vRb9j6psK2ZZnGAAAAhI"]
[Thu Apr 23 07:16:24.050380 2026] [:error] [pid 65000:tid 65048] [client 89.251.0.135:38909] File does not exist: /usr/local/apache/htdocs/suspended-page/hehehehe.php
[Thu Apr 23 07:16:24.416587 2026] [:error] [pid 65000:tid 65029] [client 89.251.0.135:38909] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/install.php
[Thu Apr 23 07:16:24.795099 2026] [:error] [pid 65000:tid 65032] [client 89.251.0.135:38909] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/plugins.php
[Thu Apr 23 07:16:25.113366 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.135:38909] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/license.php
[Thu Apr 23 07:16:26.933969 2026] [:error] [pid 65000:tid 65053] [client 89.251.0.135:38909] [client 89.251.0.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aelWyr6vRb9j6psK2ZZnWQAAAhQ"]
[Thu Apr 23 07:16:27.599475 2026] [:error] [pid 65000:tid 65039] [client 89.251.0.128:23005] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aelWy76vRb9j6psK2ZZnXwAAAgY"]
[Thu Apr 23 07:16:28.334153 2026] [:error] [pid 64998:tid 65008] [client 89.251.0.136:29549] [client 89.251.0.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aelWzIV5EysYcTLjmwjYzQAAAcY"]
[Thu Apr 23 07:16:28.924921 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.148:62933] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aelWzL6vRb9j6psK2ZZnfQAAAgE"]
[Thu Apr 23 07:16:29.626757 2026] [:error] [pid 65000:tid 65046] [client 89.251.0.124:38077] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aelWzb6vRb9j6psK2ZZnlAAAAg0"]
[Thu Apr 23 07:16:30.328932 2026] [:error] [pid 59700:tid 59712] [client 89.251.0.121:29831] [client 89.251.0.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aelWzpXyGZJFeAIDWtlBOAAAAUo"]
[Thu Apr 23 07:16:33.333767 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.127:39039] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aelW0b6vRb9j6psK2ZZn-AAAAgU"]
[Thu Apr 23 07:16:33.909706 2026] [:error] [pid 42972:tid 43029] [client 89.251.0.126:32715] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aelW0cOAb-3sOknsk4cIEAAAAE0"]
[Thu Apr 23 07:16:34.522401 2026] [:error] [pid 64967:tid 64971] [client 89.251.0.141:41915] [client 89.251.0.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aelW0oAV4GfOOdX8Qzr6IAAAAYI"]
[Thu Apr 23 07:16:35.335021 2026] [:error] [pid 64998:tid 65016] [client 89.251.0.147:63427] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aelW04V5EysYcTLjmwjZFAAAAc4"]
[Thu Apr 23 07:16:36.893890 2026] [:error] [pid 65000:tid 65051] [client 89.251.0.139:54973] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aelW1L6vRb9j6psK2ZZoKgAAAhI"]
[Thu Apr 23 07:16:38.334289 2026] [:error] [pid 42973:tid 43064] [client 89.251.0.148:44287] [client 89.251.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aelW1m6I0QqmmmLTHE3ESQAAAJU"]
[Thu Apr 23 07:16:38.951766 2026] [:error] [pid 42972:tid 43040] [client 89.251.0.115:25977] File does not exist: /usr/local/apache/htdocs/suspended-page/byp.php
[Thu Apr 23 07:16:39.624459 2026] [:error] [pid 42972:tid 43031] [client 89.251.0.115:25977] [client 89.251.0.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aelW18OAb-3sOknsk4cIQQAAAE8"]
[Thu Apr 23 07:16:42.252091 2026] [:error] [pid 42972:tid 43033] [client 89.251.0.117:46935] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/about.php"] [unique_id "aelW2sOAb-3sOknsk4cIZQAAAFE"]
[Thu Apr 23 07:16:43.545965 2026] [:error] [pid 42971:tid 43001] [client 89.251.0.137:28931] File does not exist: /usr/local/apache/htdocs/suspended-page/class.api.php
[Thu Apr 23 07:16:43.876204 2026] [:error] [pid 42971:tid 42990] [client 89.251.0.137:28931] [client 89.251.0.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aelW2zEP2_5RswrH8bGQHwAAAAQ"]
[Thu Apr 23 07:16:44.786745 2026] [:error] [pid 42972:tid 43031] [client 89.251.0.126:57625] File does not exist: /usr/local/apache/htdocs/suspended-page/system_log.php
[Thu Apr 23 07:16:45.081778 2026] [:error] [pid 42972:tid 43028] [client 89.251.0.126:57625] File does not exist: /usr/local/apache/htdocs/suspended-page/.alf.php
[Thu Apr 23 07:16:45.425907 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.126:57625] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Thu Apr 23 07:16:45.742447 2026] [:error] [pid 42972:tid 43021] [client 89.251.0.126:57625] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aelW3cOAb-3sOknsk4cI0AAAAEU"]
[Thu Apr 23 07:16:46.386193 2026] [:error] [pid 59700:tid 59719] [client 89.251.0.133:42373] File does not exist: /usr/local/apache/htdocs/suspended-page/flower.php
[Thu Apr 23 07:16:46.680675 2026] [:error] [pid 59700:tid 59707] [client 89.251.0.133:42373] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aelW3pXyGZJFeAIDWtlBmAAAAUU"]
[Thu Apr 23 07:16:47.936868 2026] [:error] [pid 42972:tid 43032] [client 89.251.0.138:26703] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Thu Apr 23 07:16:48.345227 2026] [:error] [pid 42972:tid 43016] [client 89.251.0.138:26703] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Thu Apr 23 07:16:48.709672 2026] [:error] [pid 42972:tid 43020] [client 89.251.0.138:26703] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Thu Apr 23 07:16:54.122357 2026] [:error] [pid 42972:tid 43033] [client 89.251.0.138:26703] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Thu Apr 23 07:16:54.801841 2026] [:error] [pid 42972:tid 43034] [client 89.251.0.138:26703] File does not exist: /usr/local/apache/htdocs/suspended-page/cc.php
[Thu Apr 23 07:16:55.795181 2026] [:error] [pid 42972:tid 43024] [client 89.251.0.138:26703] File does not exist: /usr/local/apache/htdocs/suspended-page/ab.php
[Thu Apr 23 07:16:58.788015 2026] [:error] [pid 42972:tid 43029] [client 89.251.0.138:26703] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 07:16:59.941345 2026] [:error] [pid 42972:tid 43026] [client 89.251.0.138:26703] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aelW68OAb-3sOknsk4cJVAAAAEo"]
[Thu Apr 23 07:17:00.570710 2026] [:error] [pid 59700:tid 59704] [client 89.251.0.138:47657] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aelW7JXyGZJFeAIDWtlB1gAAAUI"]
[Thu Apr 23 07:17:01.266520 2026] [:error] [pid 64967:tid 64972] [client 89.251.0.145:46951] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Thu Apr 23 07:17:01.584690 2026] [:error] [pid 64967:tid 64986] [client 89.251.0.145:46951] [client 89.251.0.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aelW7YAV4GfOOdX8Qzr6vQAAAZE"]
[Thu Apr 23 07:17:02.545893 2026] [:error] [pid 25635:tid 25661] [client 89.251.0.150:55097] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Thu Apr 23 07:17:02.876248 2026] [:error] [pid 25635:tid 25649] [client 89.251.0.150:55097] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aelW7sRxv6UsgRGKB3LMzQAAAQo"]
[Thu Apr 23 07:17:03.497773 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.139:58101] [client 89.251.0.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aelW776vRb9j6psK2ZZpigAAAgo"]
[Thu Apr 23 07:17:05.612402 2026] [:error] [pid 64998:tid 65007] [client 89.251.0.127:48487] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aelW8YV5EysYcTLjmwjaaAAAAcU"]
[Thu Apr 23 07:17:06.224649 2026] [:error] [pid 25635:tid 25660] [client 89.251.0.147:20481] [client 89.251.0.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "aelW8sRxv6UsgRGKB3LM9wAAARU"]
[Thu Apr 23 07:17:07.837251 2026] [:error] [pid 42973:tid 43062] [client 89.251.0.151:37725] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Thu Apr 23 07:17:08.459359 2026] [:error] [pid 42973:tid 43060] [client 89.251.0.151:37725] [client 89.251.0.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aelW9G6I0QqmmmLTHE3FUgAAAJE"]
[Thu Apr 23 07:17:09.556796 2026] [:error] [pid 64967:tid 64972] [client 89.251.0.117:35551] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/atomlib.php
[Thu Apr 23 07:17:10.206353 2026] [:error] [pid 64967:tid 64970] [client 89.251.0.117:35551] [client 89.251.0.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/function.php"] [unique_id "aelW9oAV4GfOOdX8Qzr7KQAAAYE"]
[Thu Apr 23 07:17:10.853170 2026] [:error] [pid 59700:tid 59703] [client 89.251.0.138:51815] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/plugins.php"] [unique_id "aelW9pXyGZJFeAIDWtlCUAAAAUE"]
[Thu Apr 23 07:17:11.834849 2026] [:error] [pid 64967:tid 64976] [client 89.251.0.116:46603] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-content.php
[Thu Apr 23 07:17:12.138363 2026] [:error] [pid 64967:tid 64970] [client 89.251.0.116:46603] [client 89.251.0.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aelW-IAV4GfOOdX8Qzr7RAAAAYE"]
[Thu Apr 23 07:17:13.238879 2026] [:error] [pid 64998:tid 65013] [client 89.251.0.144:63031] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aelW-YV5EysYcTLjmwjapgAAAcs"]
[Thu Apr 23 07:17:14.642805 2026] [:error] [pid 65000:tid 65052] [client 89.251.0.140:48571] File does not exist: /usr/local/apache/htdocs/suspended-page/customize.php
[Thu Apr 23 07:17:14.972676 2026] [:error] [pid 65000:tid 65037] [client 89.251.0.140:48571] File does not exist: /usr/local/apache/htdocs/suspended-page/license.php
[Thu Apr 23 07:17:15.622737 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.140:48571] File does not exist: /usr/local/apache/htdocs/suspended-page/lock.php
[Thu Apr 23 07:17:16.340533 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.140:48571] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aelW_L6vRb9j6psK2ZZqegAAAg4"]
[Thu Apr 23 07:17:16.956365 2026] [:error] [pid 42973:tid 43058] [client 89.251.0.124:61131] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aelW_G6I0QqmmmLTHE3FuwAAAI8"]
[Thu Apr 23 07:17:18.627055 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.127:21499] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu Apr 23 07:17:19.584884 2026] [:error] [pid 65000:tid 65042] [client 89.251.0.127:21499] [client 89.251.0.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/index.php"] [unique_id "aelW_76vRb9j6psK2ZZqogAAAgk"]
[Thu Apr 23 07:17:20.206150 2026] [:error] [pid 42971:tid 43006] [client 89.251.0.144:54293] [client 89.251.0.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aelXADEP2_5RswrH8bGRjQAAABQ"]
[Thu Apr 23 07:17:20.782178 2026] [:error] [pid 43083:tid 43092] [client 89.251.0.133:28239] [client 89.251.0.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aelXADC5hrvNXosL83KyGAAAAMc"]
[Thu Apr 23 07:17:23.693486 2026] [:error] [pid 59700:tid 59725] [client 89.251.0.126:64923] File does not exist: /usr/local/apache/htdocs/suspended-page/ff2.php
[Thu Apr 23 07:17:23.989735 2026] [:error] [pid 59700:tid 59724] [client 89.251.0.126:64923] [client 89.251.0.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aelXA5XyGZJFeAIDWtlDAwAAAVY"]
[Thu Apr 23 07:17:25.054212 2026] [:error] [pid 25635:tid 25661] [client 89.251.0.140:57927] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aelXBcRxv6UsgRGKB3LN6AAAARY"]
[Thu Apr 23 07:17:25.708929 2026] [:error] [pid 42973:tid 43064] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu Apr 23 07:17:26.041071 2026] [:error] [pid 42973:tid 43048] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-atom.php
[Thu Apr 23 07:17:26.704560 2026] [:error] [pid 42973:tid 43050] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/up.php
[Thu Apr 23 07:17:27.974433 2026] [:error] [pid 42973:tid 43057] [client 89.251.0.134:59895] [client 89.251.0.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.134, incrementing brute counter"] [hostname "rejuva.au"] [uri "/js/wp-login.php"] [unique_id "aelXB26I0QqmmmLTHE3GPAAAAI4"]
[Thu Apr 23 07:17:28.712582 2026] [:error] [pid 42973:tid 43059] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/worm.PhP
[Thu Apr 23 07:17:29.062401 2026] [:error] [pid 42973:tid 43058] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/ext.php
[Thu Apr 23 07:17:29.431563 2026] [:error] [pid 42973:tid 43065] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/delpaths.php
[Thu Apr 23 07:17:30.066689 2026] [:error] [pid 42973:tid 43051] [client 89.251.0.134:59895] [client 89.251.0.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.251.0.134, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aelXCm6I0QqmmmLTHE3GWAAAAIg"]
[Thu Apr 23 07:17:31.463368 2026] [:error] [pid 42973:tid 43046] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/gifclass.php
[Thu Apr 23 07:17:31.784625 2026] [:error] [pid 42973:tid 43064] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin.php
[Thu Apr 23 07:17:32.342879 2026] [:error] [pid 42973:tid 43060] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/update-core.php
[Thu Apr 23 07:17:32.958494 2026] [:error] [pid 42973:tid 43048] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Thu Apr 23 07:17:33.952443 2026] [:error] [pid 42973:tid 43051] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/autossl_tmp/.well-known/acme-challenge/content.php
[Thu Apr 23 07:17:36.156140 2026] [:error] [pid 42973:tid 43044] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 23 07:17:36.503822 2026] [:error] [pid 42973:tid 43054] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/index2.php
[Thu Apr 23 07:17:38.231716 2026] [:error] [pid 42973:tid 43043] [client 89.251.0.134:59895] File does not exist: /usr/local/apache/htdocs/suspended-page/shell.php
[Thu Apr 23 07:17:38.921190 2026] [:error] [pid 42973:tid 43060] [client 89.251.0.134:59895] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aelXEm6I0QqmmmLTHE3GwAAAAJE"]
[Thu Apr 23 07:17:40.175020 2026] [:error] [pid 42971:tid 43003] [client 89.251.0.150:46079] File does not exist: /usr/local/apache/htdocs/suspended-page/hehe.php
[Thu Apr 23 07:17:40.501385 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.150:46079] [client 89.251.0.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aelXFDEP2_5RswrH8bGSkAAAAAU"]
[Thu Apr 23 07:17:41.677895 2026] [:error] [pid 64967:tid 64981] [client 89.251.0.120:22871] File does not exist: /usr/local/apache/htdocs/suspended-page/dir.php
[Thu Apr 23 07:17:42.018727 2026] [:error] [pid 64967:tid 64993] [client 89.251.0.120:22871] [client 89.251.0.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aelXFoAV4GfOOdX8Qzr8rAAAAZg"]
[Thu Apr 23 07:17:43.411688 2026] [:error] [pid 42971:tid 42991] [client 89.251.0.125:56221] File does not exist: /usr/local/apache/htdocs/suspended-page/nf_tracking.php
[Thu Apr 23 07:17:54.059287 2026] [:error] [pid 42971:tid 42992] [client 89.251.0.125:56221] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Thu Apr 23 07:18:25.082641 2026] [:error] [pid 43083:tid 43105] [client 89.251.0.139:30297] [client 89.251.0.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "aelXQTC5hrvNXosL83K1agAAANQ"]
[Thu Apr 23 07:18:29.899999 2026] [autoindex:error] [pid 59700:tid 59708] [client 89.251.0.137:41359] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:44:41.601876 2026] [:error] [pid 59700:tid 59720] [client 43.159.170.81:40472] [client 43.159.170.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeldaZXyGZJFeAIDWtltSAAAAVI"]
[Thu Apr 23 09:52:21.186055 2026] [:error] [pid 43083:tid 43085] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Apr 23 09:52:21.486660 2026] [:error] [pid 43083:tid 43096] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Apr 23 09:52:21.760007 2026] [:error] [pid 43083:tid 43099] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 23 09:52:22.071323 2026] [:error] [pid 43083:tid 43104] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 23 09:52:22.349902 2026] [:error] [pid 43083:tid 43085] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 23 09:52:22.633797 2026] [:error] [pid 43083:tid 43094] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 09:52:22.933624 2026] [:error] [pid 43083:tid 43106] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 23 09:52:23.226383 2026] [:error] [pid 43083:tid 43085] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Apr 23 09:52:23.939681 2026] [:error] [pid 43083:tid 43101] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Apr 23 09:52:24.223748 2026] [:error] [pid 43083:tid 43094] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Apr 23 09:52:24.508097 2026] [:error] [pid 43083:tid 43091] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 09:52:24.815665 2026] [:error] [pid 43083:tid 43106] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Apr 23 09:52:25.142458 2026] [:error] [pid 43083:tid 43109] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 23 09:52:25.474617 2026] [:error] [pid 43083:tid 43100] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Apr 23 09:52:25.768025 2026] [:error] [pid 43083:tid 43089] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 23 09:52:26.045872 2026] [:error] [pid 43083:tid 43097] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 23 09:52:26.338454 2026] [:error] [pid 43083:tid 43087] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 23 09:52:27.050548 2026] [:error] [pid 43083:tid 43087] [client 185.192.71.34:50159] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 23 09:52:31.069357 2026] [:error] [pid 43083:tid 43105] [client 185.192.71.34:50159] [client 185.192.71.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ael7XzC5hrvNXosL83IO5AAAANQ"]
[Thu Apr 23 09:52:35.583663 2026] [:error] [pid 59700:tid 59721] [client 91.230.225.198:46783] [client 91.230.225.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ael7Y5XyGZJFeAIDWtmM0AAAAVM"]
[Thu Apr 23 09:52:36.990140 2026] [:error] [pid 43083:tid 43107] [client 91.230.225.196:28141] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 23 09:52:37.817779 2026] [:error] [pid 43083:tid 43101] [client 91.230.225.196:28141] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "ael7ZTC5hrvNXosL83IPFwAAANA"]
[Thu Apr 23 09:52:39.006956 2026] [:error] [pid 59700:tid 59710] [client 185.192.71.36:44205] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 23 09:52:39.286672 2026] [:error] [pid 59700:tid 59708] [client 185.192.71.36:44205] [client 185.192.71.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "ael7Z5XyGZJFeAIDWtmM7AAAAUY"]
[Thu Apr 23 09:52:40.197048 2026] [:error] [pid 43083:tid 43106] [client 185.192.71.40:52761] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Thu Apr 23 09:52:41.654372 2026] [:error] [pid 43083:tid 43101] [client 185.192.71.40:52761] [client 185.192.71.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ael7aTC5hrvNXosL83IPWwAAANA"]
[Thu Apr 23 09:52:42.541293 2026] [:error] [pid 65000:tid 65046] [client 91.230.225.18:38963] [client 91.230.225.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ael7ar6vRb9j6psK2Zb17gAAAg0"]
[Thu Apr 23 09:52:43.086539 2026] [:error] [pid 43083:tid 43085] [client 91.230.225.199:60209] [client 91.230.225.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ael7azC5hrvNXosL83IPcwAAAMA"]
[Thu Apr 23 09:52:43.627522 2026] [:error] [pid 43083:tid 43090] [client 185.192.71.35:34681] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ael7azC5hrvNXosL83IPfQAAAMU"]
[Thu Apr 23 09:52:44.191904 2026] [:error] [pid 59700:tid 59712] [client 185.192.71.31:25235] [client 185.192.71.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ael7bJXyGZJFeAIDWtmNDwAAAUo"]
[Thu Apr 23 09:52:44.852125 2026] [:error] [pid 64998:tid 65026] [client 91.230.225.24:59421] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ael7bIV5EysYcTLjmwhvxAAAAdg"]
[Thu Apr 23 09:52:45.703666 2026] [:error] [pid 42973:tid 43065] [client 185.192.71.25:30041] [client 185.192.71.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ael7bW6I0QqmmmLTHE3r7wAAAJY"]
[Thu Apr 23 09:52:46.276618 2026] [:error] [pid 43083:tid 43093] [client 91.230.225.16:24803] File does not exist: /usr/local/apache/htdocs/suspended-page/inc.php
[Thu Apr 23 09:52:46.908801 2026] [:error] [pid 43083:tid 43088] [client 91.230.225.16:24803] [client 91.230.225.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/filemanager.php"] [unique_id "ael7bjC5hrvNXosL83IPpQAAAMM"]
[Thu Apr 23 09:53:34.512366 2026] [autoindex:error] [pid 42971:tid 43006] [client 185.192.71.24:57765] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 13:22:38.068149 2026] [:error] [pid 46953:tid 46980] [client 43.130.116.87:60886] [client 43.130.116.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aemsnknlpdHh-P6wKbrvAgAAAlc"]
[Thu Apr 23 15:39:48.673195 2026] [:error] [pid 65000:tid 65049] [client 43.153.73.200:47854] [client 43.153.73.200] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aenMxL6vRb9j6psK2ZazFAAAAhA"]
[Thu Apr 23 17:04:39.571439 2026] [:error] [pid 65000:tid 65057] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Thu Apr 23 17:04:39.890479 2026] [:error] [pid 65000:tid 65048] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/485.php
[Thu Apr 23 17:04:40.208094 2026] [:error] [pid 65000:tid 65044] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Thu Apr 23 17:04:40.520429 2026] [:error] [pid 65000:tid 65056] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Thu Apr 23 17:04:40.832724 2026] [:error] [pid 65000:tid 65047] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Thu Apr 23 17:04:41.147714 2026] [:error] [pid 65000:tid 65053] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/xminie.php
[Thu Apr 23 17:04:41.461558 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu Apr 23 17:04:41.782679 2026] [:error] [pid 65000:tid 65039] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/x=34.php
[Thu Apr 23 17:04:42.094651 2026] [:error] [pid 65000:tid 65041] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/insta.php
[Thu Apr 23 17:04:42.417141 2026] [:error] [pid 65000:tid 65043] [client 72.146.10.201:21615] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Thu Apr 23 17:04:42.726611 2026] [:error] [pid 65000:tid 65042] [client 72.146.10.201:21615] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aengqr6vRb9j6psK2ZbV6gAAAgk"]
[Thu Apr 23 17:04:49.224218 2026] [:error] [pid 64998:tid 65026] [client 72.146.10.201:57795] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aengsYV5EysYcTLjmwj9egAAAdg"]
[Thu Apr 23 17:04:50.407732 2026] [:error] [pid 42972:tid 43016] [client 72.146.10.201:1489] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aengssOAb-3sOknsk4fbVwAAAEA"]
[Thu Apr 23 17:04:51.364796 2026] [:error] [pid 42973:tid 43055] [client 72.146.10.201:1522] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aengs26I0QqmmmLTHE3TCQAAAIw"]
[Thu Apr 23 17:04:54.288656 2026] [:error] [pid 65000:tid 65052] [client 72.146.10.201:44489] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aengtr6vRb9j6psK2ZbWUAAAAhM"]
[Thu Apr 23 17:04:56.693884 2026] [:error] [pid 43083:tid 43091] [client 72.146.10.201:41921] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aenguDC5hrvNXosL83JX-QAAAMY"]
[Thu Apr 23 17:04:59.901495 2026] [:error] [pid 43083:tid 43105] [client 72.146.10.201:49029] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aenguzC5hrvNXosL83JX-gAAANQ"]
[Thu Apr 23 17:05:04.835441 2026] [:error] [pid 64998:tid 65010] [client 72.146.10.201:51956] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aengwIV5EysYcTLjmwj9kwAAAcg"]
[Thu Apr 23 17:05:09.978072 2026] [:error] [pid 65000:tid 65030] [client 72.146.10.201:62321] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aengxb6vRb9j6psK2ZbWfwAAAgE"]
[Thu Apr 23 17:05:16.087004 2026] [:error] [pid 42972:tid 43018] [client 72.146.10.201:60057] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aengzMOAb-3sOknsk4fbdAAAAEI"]
[Thu Apr 23 17:05:16.919327 2026] [:error] [pid 42973:tid 43047] [client 72.146.10.201:30876] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aengzG6I0QqmmmLTHE3TMgAAAIQ"]
[Thu Apr 23 17:05:17.932544 2026] [:error] [pid 42972:tid 43039] [client 72.146.10.201:37269] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aengzcOAb-3sOknsk4fbdgAAAFc"]
[Thu Apr 23 17:05:18.905259 2026] [:error] [pid 42973:tid 43044] [client 72.146.10.201:21083] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aengzm6I0QqmmmLTHE3TNQAAAIE"]
[Thu Apr 23 17:05:24.062079 2026] [:error] [pid 42972:tid 43028] [client 72.146.10.201:23056] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aeng1MOAb-3sOknsk4fbfgAAAEw"]
[Thu Apr 23 17:05:25.863088 2026] [:error] [pid 65000:tid 65047] [client 72.146.10.201:40476] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aeng1b6vRb9j6psK2ZbWyQAAAg4"]
[Thu Apr 23 17:05:49.082944 2026] [:error] [pid 42972:tid 43033] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kz.php
[Thu Apr 23 17:05:49.393545 2026] [:error] [pid 42972:tid 43026] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Thu Apr 23 17:05:49.706599 2026] [:error] [pid 42972:tid 43038] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Thu Apr 23 17:05:50.017401 2026] [:error] [pid 42972:tid 43036] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Thu Apr 23 17:05:51.951868 2026] [:error] [pid 42972:tid 43036] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Thu Apr 23 17:05:52.270872 2026] [:error] [pid 42972:tid 43016] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/file-kikikoko.php
[Thu Apr 23 17:05:52.583082 2026] [:error] [pid 42972:tid 43032] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Thu Apr 23 17:05:52.895299 2026] [:error] [pid 42972:tid 43017] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Thu Apr 23 17:05:53.209566 2026] [:error] [pid 42972:tid 43028] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Thu Apr 23 17:05:53.526368 2026] [:error] [pid 42972:tid 43019] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/sad821.php
[Thu Apr 23 17:05:53.838606 2026] [:error] [pid 42972:tid 43033] [client 72.146.10.201:30894] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8210.php
[Thu Apr 23 17:05:55.528379 2026] [:error] [pid 42972:tid 43033] [client 72.146.10.201:30894] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeng88OAb-3sOknsk4fbzAAAAFE"]
[Thu Apr 23 17:05:57.225688 2026] [:error] [pid 42973:tid 43057] [client 72.146.10.201:21099] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeng9W6I0QqmmmLTHE3TWAAAAI4"]
[Thu Apr 23 17:05:58.388493 2026] [:error] [pid 42972:tid 43025] [client 72.146.10.201:43837] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeng9sOAb-3sOknsk4fb2QAAAEk"]
[Thu Apr 23 17:06:03.440010 2026] [:error] [pid 59700:tid 59724] [client 72.146.10.201:43785] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aeng-5XyGZJFeAIDWtny8gAAAVY"]
[Thu Apr 23 17:06:04.090581 2026] [:error] [pid 64998:tid 65021] [client 72.146.10.201:59540] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aeng_IV5EysYcTLjmwj-LgAAAdM"]
[Thu Apr 23 17:06:05.056896 2026] [:error] [pid 65000:tid 65041] [client 72.146.10.201:42559] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aeng_b6vRb9j6psK2ZbXPQAAAgg"]
[Thu Apr 23 17:06:08.580388 2026] [:error] [pid 43083:tid 43087] [client 72.146.10.201:40459] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aenhADC5hrvNXosL83JYFgAAAMI"]
[Thu Apr 23 17:06:09.825908 2026] [:error] [pid 64998:tid 65006] [client 72.146.10.201:45142] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aenhAYV5EysYcTLjmwj-VAAAAcQ"]
[Thu Apr 23 17:06:12.123884 2026] [:error] [pid 64998:tid 65022] [client 72.146.10.201:20999] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aenhBIV5EysYcTLjmwj-YwAAAdQ"]
[Thu Apr 23 17:06:14.629701 2026] [:error] [pid 42972:tid 43027] [client 72.146.10.201:43799] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aenhBsOAb-3sOknsk4fb-AAAAEs"]
[Thu Apr 23 17:06:16.541966 2026] [:error] [pid 64998:tid 65004] [client 72.146.10.201:59551] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aenhCIV5EysYcTLjmwj-gwAAAcI"]
[Thu Apr 23 17:06:19.130792 2026] [:error] [pid 42973:tid 43066] [client 72.146.10.201:32995] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aenhC26I0QqmmmLTHE3TbAAAAJc"]
[Thu Apr 23 17:06:30.982117 2026] [:error] [pid 42973:tid 43046] [client 72.146.10.201:45183] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aenhFm6I0QqmmmLTHE3TfQAAAIM"]
[Thu Apr 23 17:06:31.908845 2026] [:error] [pid 42972:tid 43021] [client 72.146.10.201:32983] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aenhF8OAb-3sOknsk4fcKAAAAEU"]
[Thu Apr 23 17:06:36.852846 2026] [:error] [pid 64998:tid 65019] [client 72.146.10.201:63037] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aenhHIV5EysYcTLjmwj_BgAAAdE"]
[Thu Apr 23 17:06:38.149367 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:43832] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aenhHr6vRb9j6psK2ZbXjAAAAgw"]
[Thu Apr 23 17:06:44.433079 2026] [:error] [pid 42972:tid 43024] [client 72.146.10.201:62348] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aenhJMOAb-3sOknsk4fcPQAAAEg"]
[Thu Apr 23 17:06:45.388672 2026] [:error] [pid 42971:tid 43008] [client 72.146.10.201:62980] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aenhJTEP2_5RswrH8bEPvgAAABY"]
[Thu Apr 23 17:06:51.868074 2026] [:error] [pid 65000:tid 65037] [client 72.146.10.201:20992] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aenhK76vRb9j6psK2ZbXrwAAAgQ"]
[Thu Apr 23 17:06:58.240269 2026] [:error] [pid 65000:tid 65051] [client 72.146.10.201:45144] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 23 17:06:58.481725 2026] [:error] [pid 65000:tid 65056] [client 72.146.10.201:45144] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Thu Apr 23 17:06:58.720820 2026] [:error] [pid 65000:tid 65031] [client 72.146.10.201:45144] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aenhMr6vRb9j6psK2ZbX3gAAAgI"]
[Thu Apr 23 17:07:06.171394 2026] [:error] [pid 46953:tid 46964] [client 72.146.10.201:42551] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aenhOknlpdHh-P6wKboO6wAAAkg"]
[Thu Apr 23 17:07:07.196473 2026] [:error] [pid 46953:tid 46979] [client 72.146.10.201:62918] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aenhO0nlpdHh-P6wKboO7QAAAlY"]
[Thu Apr 23 17:07:08.079914 2026] [:error] [pid 59700:tid 59726] [client 72.146.10.201:22086] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aenhPJXyGZJFeAIDWtnzJAAAAVg"]
[Thu Apr 23 17:07:09.538594 2026] [:error] [pid 42972:tid 43028] [client 72.146.10.201:43814] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aenhPcOAb-3sOknsk4fcUwAAAEw"]
[Thu Apr 23 17:07:11.177442 2026] [:error] [pid 64998:tid 65021] [client 72.146.10.201:63000] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aenhP4V5EysYcTLjmwj_OQAAAdM"]
[Thu Apr 23 17:07:12.735164 2026] [:error] [pid 59700:tid 59722] [client 72.146.10.201:23568] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aenhQJXyGZJFeAIDWtnzJwAAAVQ"]
[Thu Apr 23 17:07:13.594320 2026] [:error] [pid 64998:tid 65002] [client 72.146.10.201:62963] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aenhQYV5EysYcTLjmwj_PwAAAcA"]
[Thu Apr 23 17:07:17.524767 2026] [:error] [pid 64998:tid 65004] [client 72.146.10.201:43835] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aenhRYV5EysYcTLjmwj_SAAAAcI"]
[Thu Apr 23 17:07:18.486473 2026] [:error] [pid 64998:tid 65014] [client 72.146.10.201:42538] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aenhRoV5EysYcTLjmwj_SwAAAcw"]
[Thu Apr 23 17:07:22.365645 2026] [:error] [pid 42973:tid 43060] [client 72.146.10.201:62920] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aenhSm6I0QqmmmLTHE3TtwAAAJE"]
[Thu Apr 23 17:07:25.286572 2026] [:error] [pid 46953:tid 46978] [client 72.146.10.201:22553] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aenhTUnlpdHh-P6wKboO_QAAAlU"]
[Thu Apr 23 17:07:32.701465 2026] [:error] [pid 42972:tid 43031] [client 72.146.10.201:59573] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aenhVMOAb-3sOknsk4fcZgAAAE8"]
[Thu Apr 23 17:07:47.391223 2026] [:error] [pid 65000:tid 65040] [client 72.146.10.201:25543] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aenhY76vRb9j6psK2ZbYLgAAAgc"]
[Thu Apr 23 17:07:48.679817 2026] [:error] [pid 46953:tid 46978] [client 72.146.10.201:28205] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aenhZEnlpdHh-P6wKboPDwAAAlU"]
[Thu Apr 23 17:07:51.088394 2026] [:error] [pid 64967:tid 64970] [client 72.146.10.201:37324] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aenhZ4AV4GfOOdX8QzpcgwAAAYE"]
[Thu Apr 23 17:07:53.396708 2026] [:error] [pid 42971:tid 42997] [client 72.146.10.201:25599] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aenhaTEP2_5RswrH8bEPzgAAAAs"]
[Thu Apr 23 17:07:58.151480 2026] [:error] [pid 42972:tid 43028] [client 72.146.10.201:61906] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Thu Apr 23 17:07:58.393399 2026] [:error] [pid 42972:tid 43039] [client 72.146.10.201:61906] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Thu Apr 23 17:07:58.632143 2026] [:error] [pid 42972:tid 43019] [client 72.146.10.201:61906] [client 72.146.10.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aenhbsOAb-3sOknsk4fcsAAAAEM"]
[Thu Apr 23 17:08:01.083755 2026] [:error] [pid 64998:tid 65014] [client 72.146.10.201:37362] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu Apr 23 17:08:01.531467 2026] [:error] [pid 64998:tid 65017] [client 72.146.10.201:37362] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenhcYV5EysYcTLjmwj_bgAAAc8"]
[Thu Apr 23 17:08:03.238292 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:1719] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenhc76vRb9j6psK2ZbYTgAAAgw"]
[Thu Apr 23 17:08:05.133853 2026] [:error] [pid 65000:tid 65046] [client 72.146.10.201:23106] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenhdb6vRb9j6psK2ZbYXgAAAg0"]
[Thu Apr 23 17:08:09.067555 2026] [:error] [pid 46953:tid 46972] [client 72.146.10.201:54344] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenheUnlpdHh-P6wKboPFgAAAlA"]
[Thu Apr 23 17:08:11.471406 2026] [:error] [pid 59700:tid 59708] [client 72.146.10.201:53698] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aenhe5XyGZJFeAIDWtnzUwAAAUY"]
[Thu Apr 23 17:08:14.707591 2026] [:error] [pid 64998:tid 65006] [client 72.146.10.201:59068] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aenhfoV5EysYcTLjmwj_ggAAAcQ"]
[Thu Apr 23 17:08:24.000311 2026] [:error] [pid 59700:tid 59703] [client 72.146.10.201:58372] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aenhh5XyGZJFeAIDWtnzYAAAAUE"]
[Thu Apr 23 17:08:25.457153 2026] [:error] [pid 42971:tid 43010] [client 72.146.10.201:1077] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aenhiTEP2_5RswrH8bEP1AAAABg"]
[Thu Apr 23 17:08:26.175046 2026] [:error] [pid 46953:tid 46959] [client 72.146.10.201:1180] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aenhiknlpdHh-P6wKboPHQAAAkM"]
[Thu Apr 23 17:08:28.618715 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:1377] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aenhjL6vRb9j6psK2ZbYlAAAAgw"]
[Thu Apr 23 17:08:30.263902 2026] [:error] [pid 59700:tid 59716] [client 72.146.10.201:38072] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/roksad1.php"] [unique_id "aenhjpXyGZJFeAIDWtnzZQAAAU4"]
[Thu Apr 23 17:08:33.117883 2026] [:error] [pid 64998:tid 65009] [client 72.146.10.201:1050] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aenhkYV5EysYcTLjmwj_ogAAAcc"]
[Thu Apr 23 17:08:34.756288 2026] [:error] [pid 42972:tid 43039] [client 72.146.10.201:36240] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aenhksOAb-3sOknsk4fc7QAAAFc"]
[Thu Apr 23 17:08:36.848111 2026] [:error] [pid 59700:tid 59725] [client 72.146.10.201:38085] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aenhlJXyGZJFeAIDWtnzeQAAAVc"]
[Thu Apr 23 17:08:38.815486 2026] [:error] [pid 43083:tid 43097] [client 72.146.10.201:24636] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "aenhljC5hrvNXosL83JYUQAAAMw"]
[Thu Apr 23 17:08:41.829108 2026] [:error] [pid 42972:tid 43017] [client 72.146.10.201:49688] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aenhmcOAb-3sOknsk4fc8gAAAEE"]
[Thu Apr 23 17:08:47.548573 2026] [:error] [pid 42972:tid 43030] [client 72.146.10.201:25061] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aenhn8OAb-3sOknsk4fc9wAAAE4"]
[Thu Apr 23 17:08:50.245970 2026] [:error] [pid 59700:tid 59715] [client 72.146.10.201:26371] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aenhopXyGZJFeAIDWtnzjQAAAU0"]
[Thu Apr 23 17:08:54.048596 2026] [:error] [pid 59700:tid 59715] [client 72.146.10.201:49709] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.php"] [unique_id "aenhppXyGZJFeAIDWtnzlwAAAU0"]
[Thu Apr 23 17:08:55.593480 2026] [:error] [pid 46953:tid 46972] [client 72.146.10.201:31679] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aenhp0nlpdHh-P6wKboPSAAAAlA"]
[Thu Apr 23 17:08:58.546570 2026] [:error] [pid 42973:tid 43061] [client 72.146.10.201:49677] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aenhqm6I0QqmmmLTHE3UOQAAAJI"]
[Thu Apr 23 17:09:00.393960 2026] [:error] [pid 42973:tid 43047] [client 72.146.10.201:32291] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aenhrG6I0QqmmmLTHE3UPQAAAIQ"]
[Thu Apr 23 17:09:08.684148 2026] [:error] [pid 64998:tid 65024] [client 72.146.10.201:30928] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "aenhtIV5EysYcTLjmwj_6wAAAdY"]
[Thu Apr 23 17:09:12.000050 2026] [:error] [pid 65000:tid 65040] [client 72.146.10.201:26378] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aenht76vRb9j6psK2ZbY7wAAAgc"]
[Thu Apr 23 17:09:21.627270 2026] [:error] [pid 42972:tid 43038] [client 72.146.10.201:44438] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aenhwcOAb-3sOknsk4fdNQAAAFY"]
[Thu Apr 23 17:09:24.540271 2026] [:error] [pid 42971:tid 42992] [client 72.146.10.201:24135] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "aenhxDEP2_5RswrH8bEP4gAAAAY"]
[Thu Apr 23 17:09:25.977006 2026] [:error] [pid 65000:tid 65042] [client 72.146.10.201:1777] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aenhxb6vRb9j6psK2ZbZGAAAAgk"]
[Thu Apr 23 17:09:27.718148 2026] [:error] [pid 65000:tid 65046] [client 72.146.10.201:59126] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aenhx76vRb9j6psK2ZbZGgAAAg0"]
[Thu Apr 23 17:09:29.968692 2026] [:error] [pid 65000:tid 65049] [client 72.146.10.201:1755] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aenhyb6vRb9j6psK2ZbZHAAAAhA"]
[Thu Apr 23 17:09:30.693061 2026] [:error] [pid 65000:tid 65041] [client 72.146.10.201:1132] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aenhyr6vRb9j6psK2ZbZIQAAAgg"]
[Thu Apr 23 17:09:31.979437 2026] [:error] [pid 43083:tid 43102] [client 72.146.10.201:25995] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aenhyzC5hrvNXosL83JYbQAAANE"]
[Thu Apr 23 17:09:33.445914 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:44458] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aenhzb6vRb9j6psK2ZbZJwAAAgw"]
[Thu Apr 23 17:09:34.839543 2026] [:error] [pid 42971:tid 42995] [client 72.146.10.201:65507] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aenhzjEP2_5RswrH8bEP6QAAAAk"]
[Thu Apr 23 17:09:35.842468 2026] [:error] [pid 65000:tid 65044] [client 72.146.10.201:49013] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aenhz76vRb9j6psK2ZbZKwAAAgs"]
[Thu Apr 23 17:09:42.580491 2026] [:error] [pid 64998:tid 65006] [client 72.146.10.201:1139] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aenh1oV5EysYcTLjmwgAIQAAAcQ"]
[Thu Apr 23 17:09:48.206881 2026] [:error] [pid 64998:tid 65016] [client 72.146.10.201:20519] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aenh3IV5EysYcTLjmwgALgAAAc4"]
[Thu Apr 23 17:09:54.005540 2026] [:error] [pid 42973:tid 43052] [client 72.146.10.201:47472] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aenh4m6I0QqmmmLTHE3UhQAAAIk"]
[Thu Apr 23 17:09:56.136778 2026] [:error] [pid 64998:tid 65009] [client 72.146.10.201:26435] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aenh5IV5EysYcTLjmwgAPAAAAcc"]
[Thu Apr 23 17:09:59.058289 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:48982] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aenh576vRb9j6psK2ZbZQAAAAgw"]
[Thu Apr 23 17:10:03.337141 2026] [:error] [pid 64998:tid 65006] [client 72.146.10.201:20542] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aenh64V5EysYcTLjmwgASAAAAcQ"]
[Thu Apr 23 17:10:10.232733 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/wgift1.php
[Thu Apr 23 17:10:10.486669 2026] [:error] [pid 65000:tid 65050] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/xynz.php
[Thu Apr 23 17:10:10.982657 2026] [:error] [pid 65000:tid 65038] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Thu Apr 23 17:10:11.249120 2026] [:error] [pid 65000:tid 65056] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Thu Apr 23 17:10:11.503273 2026] [:error] [pid 65000:tid 65032] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Thu Apr 23 17:10:11.744730 2026] [:error] [pid 65000:tid 65043] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Thu Apr 23 17:10:13.269549 2026] [:error] [pid 65000:tid 65043] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 23 17:10:13.510679 2026] [:error] [pid 65000:tid 65031] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/view.php
[Thu Apr 23 17:10:13.754721 2026] [:error] [pid 65000:tid 65045] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Thu Apr 23 17:10:13.997679 2026] [:error] [pid 65000:tid 65046] [client 72.146.10.201:29524] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Thu Apr 23 17:10:14.391287 2026] [:error] [pid 65000:tid 65039] [client 72.146.10.201:29524] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aenh9r6vRb9j6psK2ZbZdgAAAgY"]
[Thu Apr 23 17:10:17.646674 2026] [:error] [pid 65000:tid 65039] [client 72.146.10.201:29549] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aenh-b6vRb9j6psK2ZbZggAAAgY"]
[Thu Apr 23 17:10:19.095306 2026] [:error] [pid 59700:tid 59708] [client 72.146.10.201:25503] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aenh-5XyGZJFeAIDWtnz3gAAAUY"]
[Thu Apr 23 17:10:20.250035 2026] [:error] [pid 64998:tid 65016] [client 72.146.10.201:26995] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/doc.php"] [unique_id "aenh_IV5EysYcTLjmwgAcAAAAc4"]
[Thu Apr 23 17:10:24.421522 2026] [:error] [pid 64998:tid 65026] [client 72.146.10.201:28875] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeniAIV5EysYcTLjmwgAeQAAAdg"]
[Thu Apr 23 17:10:26.452313 2026] [:error] [pid 65000:tid 65044] [client 72.146.10.201:48965] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeniAr6vRb9j6psK2ZbZjgAAAgs"]
[Thu Apr 23 17:10:28.844582 2026] [:error] [pid 65000:tid 65053] [client 72.146.10.201:26485] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeniBL6vRb9j6psK2ZbZkQAAAhQ"]
[Thu Apr 23 17:10:32.515771 2026] [:error] [pid 42972:tid 43016] [client 72.146.10.201:20487] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xper1.php"] [unique_id "aeniCMOAb-3sOknsk4fdewAAAEA"]
[Thu Apr 23 17:10:44.441249 2026] [:error] [pid 59700:tid 59715] [client 72.146.10.201:28262] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeniFJXyGZJFeAIDWtn0DAAAAU0"]
[Thu Apr 23 17:10:45.791059 2026] [:error] [pid 65000:tid 65044] [client 72.146.10.201:43889] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aeniFb6vRb9j6psK2ZbZzwAAAgs"]
[Thu Apr 23 17:10:48.558743 2026] [:error] [pid 65000:tid 65047] [client 72.146.10.201:39272] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeniGL6vRb9j6psK2ZbZ2QAAAg4"]
[Thu Apr 23 17:10:50.022766 2026] [:error] [pid 42973:tid 43044] [client 72.146.10.201:2005] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeniGm6I0QqmmmLTHE3UtAAAAIE"]
[Thu Apr 23 17:11:02.347487 2026] [:error] [pid 65000:tid 65056] [client 72.146.10.201:2036] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelio1.php"] [unique_id "aeniJr6vRb9j6psK2ZbaAwAAAhc"]
[Thu Apr 23 17:11:10.895014 2026] [:error] [pid 65000:tid 65054] [client 72.146.10.201:63511] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws82.php"] [unique_id "aeniLr6vRb9j6psK2ZbaHQAAAhU"]
[Thu Apr 23 17:11:24.839077 2026] [:error] [pid 64967:tid 64971] [client 72.146.10.201:21537] [client 72.146.10.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeniPIAV4GfOOdX8Qzpc1wAAAYI"]
[Thu Apr 23 17:11:35.177633 2026] [:error] [pid 42971:tid 43002] [client 72.146.10.201:51912] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeniRzEP2_5RswrH8bEQLAAAABA"]
[Thu Apr 23 17:11:37.667142 2026] [:error] [pid 65000:tid 65048] [client 72.146.10.201:21577] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "aeniSb6vRb9j6psK2ZbaXgAAAg8"]
[Thu Apr 23 17:11:41.099117 2026] [:error] [pid 65000:tid 65041] [client 72.146.10.201:55013] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeniTb6vRb9j6psK2ZbacAAAAgg"]
[Thu Apr 23 17:11:43.132753 2026] [:error] [pid 64998:tid 65022] [client 72.146.10.201:54279] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeniT4V5EysYcTLjmwgBZAAAAdQ"]
[Thu Apr 23 17:11:46.208765 2026] [:error] [pid 42971:tid 43006] [client 72.146.10.201:31736] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/layout.php"] [unique_id "aeniUjEP2_5RswrH8bEQMgAAABQ"]
[Thu Apr 23 17:12:14.668322 2026] [:error] [pid 65000:tid 65031] [client 72.146.10.201:56172] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aenibr6vRb9j6psK2Zba8gAAAgI"]
[Thu Apr 23 17:12:16.648859 2026] [:error] [pid 65000:tid 65037] [client 72.146.10.201:56074] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aenicL6vRb9j6psK2Zba-wAAAgQ"]
[Thu Apr 23 17:12:19.223383 2026] [:error] [pid 42971:tid 43004] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/ws85.php
[Thu Apr 23 17:12:19.547186 2026] [:error] [pid 42971:tid 43001] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/zogy1.php
[Thu Apr 23 17:12:19.865263 2026] [:error] [pid 42971:tid 43006] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/state.php
[Thu Apr 23 17:12:20.184360 2026] [:error] [pid 42971:tid 42995] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Thu Apr 23 17:12:20.503407 2026] [:error] [pid 42971:tid 42988] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Thu Apr 23 17:12:20.818688 2026] [:error] [pid 42971:tid 43005] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/mifta.php
[Thu Apr 23 17:12:21.131656 2026] [:error] [pid 42971:tid 43009] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Thu Apr 23 17:12:21.441388 2026] [:error] [pid 42971:tid 42997] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Thu Apr 23 17:12:21.757494 2026] [:error] [pid 42971:tid 42998] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Thu Apr 23 17:12:22.069738 2026] [:error] [pid 42971:tid 42989] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Thu Apr 23 17:12:22.386771 2026] [:error] [pid 42971:tid 43002] [client 72.146.10.201:20531] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Thu Apr 23 17:12:22.693391 2026] [:error] [pid 42971:tid 42986] [client 72.146.10.201:20531] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "aenidjEP2_5RswrH8bEQTgAAAAA"]
[Thu Apr 23 17:12:35.567270 2026] [:error] [pid 42973:tid 43063] [client 72.146.10.201:20517] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "aenig26I0QqmmmLTHE3U8gAAAJQ"]
[Thu Apr 23 17:12:50.694401 2026] [:error] [pid 64998:tid 65013] [client 72.146.10.201:56077] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aenikoV5EysYcTLjmwgB5gAAAcs"]
[Thu Apr 23 17:12:52.775182 2026] [:error] [pid 64998:tid 65011] [client 72.146.10.201:62568] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aenilIV5EysYcTLjmwgB7gAAAck"]
[Thu Apr 23 17:12:53.786057 2026] [:error] [pid 65000:tid 65056] [client 72.146.10.201:59575] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aenilb6vRb9j6psK2ZbbWQAAAhc"]
[Thu Apr 23 17:12:54.433540 2026] [:error] [pid 65000:tid 65037] [client 72.146.10.201:49632] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aenilr6vRb9j6psK2ZbbXgAAAgQ"]
[Thu Apr 23 17:12:55.741809 2026] [:error] [pid 65000:tid 65052] [client 72.146.10.201:62557] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aenil76vRb9j6psK2ZbbYwAAAhM"]
[Thu Apr 23 17:12:56.533397 2026] [:error] [pid 65000:tid 65053] [client 72.146.10.201:40492] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aenimL6vRb9j6psK2ZbbZgAAAhQ"]
[Thu Apr 23 17:13:00.965883 2026] [:error] [pid 65000:tid 65040] [client 72.146.10.201:26456] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/maxro.php"] [unique_id "aeninL6vRb9j6psK2ZbbdgAAAgc"]
[Thu Apr 23 17:13:04.396480 2026] [:error] [pid 25635:tid 25648] [client 72.146.10.201:20543] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aenioMRxv6UsgRGKB3IhYAAAAQk"]
[Thu Apr 23 17:13:05.122376 2026] [:error] [pid 43083:tid 43098] [client 72.146.10.201:57284] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aenioTC5hrvNXosL83JYwAAAAM0"]
[Thu Apr 23 17:13:06.840705 2026] [:error] [pid 65000:tid 65054] [client 72.146.10.201:23570] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aenior6vRb9j6psK2ZbboQAAAhU"]
[Thu Apr 23 17:13:08.203072 2026] [:error] [pid 42972:tid 43035] [client 72.146.10.201:46150] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "aenipMOAb-3sOknsk4feJwAAAFM"]
[Thu Apr 23 17:13:10.408787 2026] [:error] [pid 65000:tid 65031] [client 72.146.10.201:26432] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aenipr6vRb9j6psK2ZbbsQAAAgI"]
[Thu Apr 23 17:13:11.414353 2026] [:error] [pid 64998:tid 65010] [client 72.146.10.201:62551] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aenip4V5EysYcTLjmwgCBAAAAcg"]
[Thu Apr 23 17:13:14.111031 2026] [:error] [pid 65000:tid 65054] [client 72.146.10.201:26955] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aeniqr6vRb9j6psK2ZbbwQAAAhU"]
[Thu Apr 23 17:13:16.035966 2026] [:error] [pid 59700:tid 59726] [client 72.146.10.201:20528] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "aenirJXyGZJFeAIDWtn0XQAAAVg"]
[Thu Apr 23 17:13:16.910795 2026] [:error] [pid 65000:tid 65043] [client 72.146.10.201:62555] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aenirL6vRb9j6psK2ZbbxAAAAgo"]
[Thu Apr 23 17:13:19.358799 2026] [:error] [pid 65000:tid 65050] [client 72.146.10.201:56173] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "aenir76vRb9j6psK2Zbb0QAAAhE"]
[Thu Apr 23 17:13:22.142692 2026] [:error] [pid 42973:tid 43064] [client 72.146.10.201:26977] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Thu Apr 23 17:13:22.382665 2026] [:error] [pid 42973:tid 43048] [client 72.146.10.201:26977] File does not exist: /usr/local/apache/htdocs/suspended-page/areak1.php
[Thu Apr 23 17:13:22.654283 2026] [:error] [pid 42973:tid 43063] [client 72.146.10.201:26977] File does not exist: /usr/local/apache/htdocs/suspended-page/sallu.php
[Thu Apr 23 17:13:23.104904 2026] [:error] [pid 42973:tid 43046] [client 72.146.10.201:26977] File does not exist: /usr/local/apache/htdocs/suspended-page/tiny2.php
[Thu Apr 23 17:13:23.592710 2026] [:error] [pid 42973:tid 43059] [client 72.146.10.201:26977] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Thu Apr 23 17:13:23.887953 2026] [:error] [pid 42973:tid 43049] [client 72.146.10.201:26977] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aenis26I0QqmmmLTHE3VPAAAAIY"]
[Thu Apr 23 17:13:27.986997 2026] [:error] [pid 64998:tid 65019] [client 72.146.10.201:25526] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aenit4V5EysYcTLjmwgCLQAAAdE"]
[Thu Apr 23 17:13:28.801833 2026] [:error] [pid 64998:tid 65026] [client 72.146.10.201:45131] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aeniuIV5EysYcTLjmwgCMAAAAdg"]
[Thu Apr 23 17:13:30.812880 2026] [:error] [pid 43083:tid 43086] [client 72.146.10.201:40494] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aeniujC5hrvNXosL83JYzQAAAME"]
[Thu Apr 23 17:13:32.631987 2026] [:error] [pid 64998:tid 65022] [client 72.146.10.201:40474] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aenivIV5EysYcTLjmwgCOQAAAdQ"]
[Thu Apr 23 17:13:33.954408 2026] [:error] [pid 59700:tid 59716] [client 72.146.10.201:26999] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aenivZXyGZJFeAIDWtn0ewAAAU4"]
[Thu Apr 23 17:13:38.315864 2026] [:error] [pid 46953:tid 46973] [client 72.146.10.201:57334] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aeniwknlpdHh-P6wKboP6wAAAlE"]
[Thu Apr 23 17:13:39.876094 2026] [:error] [pid 59700:tid 59724] [client 72.146.10.201:52539] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aeniw5XyGZJFeAIDWtn0hAAAAVY"]
[Thu Apr 23 17:13:43.081311 2026] [:error] [pid 46953:tid 46961] [client 72.146.10.201:52530] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aenix0nlpdHh-P6wKboP8gAAAkU"]
[Thu Apr 23 17:13:45.584396 2026] [:error] [pid 42973:tid 43052] [client 72.146.10.201:49656] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aeniyW6I0QqmmmLTHE3VaQAAAIk"]
[Thu Apr 23 17:13:46.866998 2026] [:error] [pid 42971:tid 42996] [client 72.146.10.201:52485] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aeniyjEP2_5RswrH8bEQbQAAAAo"]
[Thu Apr 23 17:13:51.010992 2026] [:error] [pid 64998:tid 65002] [client 72.146.10.201:45170] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aeniz4V5EysYcTLjmwgCTQAAAcA"]
[Thu Apr 23 17:13:55.937279 2026] [:error] [pid 42973:tid 43049] [client 72.146.10.201:40475] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "aeni026I0QqmmmLTHE3VfQAAAIY"]
[Thu Apr 23 17:13:57.616643 2026] [:error] [pid 59700:tid 59703] [client 72.146.10.201:23614] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "aeni1ZXyGZJFeAIDWtn0mQAAAUE"]
[Thu Apr 23 17:13:58.493956 2026] [:error] [pid 42973:tid 43044] [client 72.146.10.201:49615] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "aeni1m6I0QqmmmLTHE3VhAAAAIE"]
[Thu Apr 23 17:14:00.401149 2026] [:error] [pid 42971:tid 43001] [client 72.146.10.201:23574] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "aeni2DEP2_5RswrH8bEQbwAAAA8"]
[Thu Apr 23 17:14:01.433758 2026] [:error] [pid 42971:tid 42999] [client 72.146.10.201:30379] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws68.php"] [unique_id "aeni2TEP2_5RswrH8bEQdQAAAA0"]
[Thu Apr 23 17:14:03.060474 2026] [:error] [pid 64998:tid 65015] [client 72.146.10.201:30353] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws68.php"] [unique_id "aeni24V5EysYcTLjmwgCVwAAAc0"]
[Thu Apr 23 17:14:35.521299 2026] [:error] [pid 43083:tid 43089] [client 72.146.10.201:61946] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "aeni-zC5hrvNXosL83JY7AAAAMQ"]
[Thu Apr 23 17:14:36.356957 2026] [:error] [pid 42973:tid 43060] [client 72.146.10.201:1342] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeni_G6I0QqmmmLTHE3VtQAAAJE"]
[Thu Apr 23 17:14:39.957743 2026] [:error] [pid 46953:tid 46964] [client 72.146.10.201:45675] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeni_0nlpdHh-P6wKboQGAAAAkg"]
[Thu Apr 23 17:14:40.905205 2026] [:error] [pid 42973:tid 43053] [client 72.146.10.201:25571] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aenjAG6I0QqmmmLTHE3VvAAAAIo"]
[Thu Apr 23 17:14:41.925918 2026] [:error] [pid 64967:tid 64977] [client 72.146.10.201:23139] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aenjAYAV4GfOOdX8QzpdEwAAAYg"]
[Thu Apr 23 17:14:44.163215 2026] [:error] [pid 42972:tid 43026] [client 72.146.10.201:42595] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/son1.php"] [unique_id "aenjBMOAb-3sOknsk4feiwAAAEo"]
[Thu Apr 23 17:14:45.275902 2026] [:error] [pid 59700:tid 59726] [client 72.146.10.201:42578] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/son1.php"] [unique_id "aenjBZXyGZJFeAIDWtn0sQAAAVg"]
[Thu Apr 23 17:14:46.992092 2026] [:error] [pid 43083:tid 43108] [client 72.146.10.201:62918] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/son1.php"] [unique_id "aenjBjC5hrvNXosL83JY8AAAANc"]
[Thu Apr 23 17:14:53.194531 2026] [:error] [pid 25635:tid 25647] [client 72.146.10.201:22564] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/son1.php"] [unique_id "aenjDcRxv6UsgRGKB3IhfgAAAQg"]
[Thu Apr 23 17:14:58.935565 2026] [:error] [pid 65000:tid 65032] [client 72.146.10.201:44474] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aenjEr6vRb9j6psK2ZbcqQAAAgM"]
[Thu Apr 23 17:15:08.290908 2026] [:error] [pid 65000:tid 65048] [client 72.146.10.201:50215] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "aenjHL6vRb9j6psK2ZbcuAAAAg8"]
[Thu Apr 23 17:15:09.345961 2026] [:error] [pid 65000:tid 65055] [client 72.146.10.201:43790] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenjHb6vRb9j6psK2ZbcugAAAhY"]
[Thu Apr 23 17:15:16.763395 2026] [:error] [pid 65000:tid 65057] [client 72.146.10.201:30935] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenjJL6vRb9j6psK2ZbcyAAAAhg"]
[Thu Apr 23 17:15:18.279013 2026] [:error] [pid 59700:tid 59707] [client 72.146.10.201:1752] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenjJpXyGZJFeAIDWtn0xwAAAUU"]
[Thu Apr 23 17:15:20.733754 2026] [:error] [pid 64998:tid 65017] [client 72.146.10.201:31627] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "aenjKIV5EysYcTLjmwgCvwAAAc8"]
[Thu Apr 23 17:15:21.830237 2026] [:error] [pid 65000:tid 65049] [client 72.146.10.201:43792] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aenjKb6vRb9j6psK2Zbc6QAAAhA"]
[Thu Apr 23 17:15:23.761091 2026] [:error] [pid 65000:tid 65041] [client 72.146.10.201:60687] [client 72.146.10.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws84.php"] [unique_id "aenjK76vRb9j6psK2Zbc9QAAAgg"]
[Thu Apr 23 17:15:30.112543 2026] [:error] [pid 65000:tid 65042] [client 72.146.10.201:60720] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Thu Apr 23 17:15:30.355882 2026] [:error] [pid 65000:tid 65054] [client 72.146.10.201:60720] File does not exist: /usr/local/apache/htdocs/suspended-page/ws61.php
[Thu Apr 23 17:15:30.616488 2026] [:error] [pid 65000:tid 65040] [client 72.146.10.201:60720] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Thu Apr 23 18:27:07.329375 2026] [:error] [pid 65000:tid 65057] [client 43.156.47.42:43254] [client 43.156.47.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aenz-76vRb9j6psK2ZYHmwAAAhg"]
[Thu Apr 23 19:15:51.102916 2026] [:error] [pid 65000:tid 65054] [client 182.44.8.254:48034] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aen_Z76vRb9j6psK2ZYoMwAAAhU"]
[Thu Apr 23 20:12:49.177938 2026] [:error] [pid 42972:tid 43035] [client 43.159.47.35:51130] [client 43.159.47.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeoMwcOAb-3sOknsk4cclAAAAFM"]
[Thu Apr 23 20:59:55.504000 2026] [:error] [pid 65000:tid 65037] [client 170.106.163.155:54632] [client 170.106.163.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeoXy76vRb9j6psK2ZZy1wAAAgQ"]
[Thu Apr 23 21:32:51.652556 2026] [:error] [pid 64998:tid 65006] [client 43.156.44.207:47350] [client 43.156.44.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeofg4V5EysYcTLjmwiDEAAAAcQ"]
[Thu Apr 23 23:45:58.112317 2026] [:error] [pid 59700:tid 59715] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Thu Apr 23 23:45:58.274854 2026] [:error] [pid 59700:tid 59718] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Thu Apr 23 23:45:58.436553 2026] [:error] [pid 59700:tid 59722] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Thu Apr 23 23:45:58.597143 2026] [:error] [pid 59700:tid 59702] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Thu Apr 23 23:45:58.757536 2026] [:error] [pid 59700:tid 59710] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Thu Apr 23 23:45:58.918373 2026] [:error] [pid 59700:tid 59720] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu Apr 23 23:45:59.079974 2026] [:error] [pid 59700:tid 59724] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Thu Apr 23 23:45:59.241084 2026] [:error] [pid 59700:tid 59704] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Thu Apr 23 23:45:59.777876 2026] [:error] [pid 59700:tid 59709] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Thu Apr 23 23:45:59.941303 2026] [:error] [pid 59700:tid 59721] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Thu Apr 23 23:46:00.123599 2026] [:error] [pid 59700:tid 59712] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Thu Apr 23 23:46:00.296461 2026] [:error] [pid 59700:tid 59705] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Thu Apr 23 23:46:00.528165 2026] [:error] [pid 59700:tid 59705] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Thu Apr 23 23:46:00.791615 2026] [:error] [pid 59700:tid 59714] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Thu Apr 23 23:46:00.953770 2026] [:error] [pid 59700:tid 59723] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Thu Apr 23 23:46:01.119607 2026] [:error] [pid 59700:tid 59726] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu Apr 23 23:46:01.301900 2026] [:error] [pid 59700:tid 59719] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Thu Apr 23 23:46:01.464318 2026] [:error] [pid 59700:tid 59715] [client 173.239.218.73:60325] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Thu Apr 23 23:46:03.753709 2026] [:error] [pid 59700:tid 59717] [client 173.239.218.73:60325] [client 173.239.218.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeo-u5XyGZJFeAIDWtlJxAAAAU8"]
[Thu Apr 23 23:46:04.566774 2026] [:error] [pid 65000:tid 65043] [client 173.239.218.60:46793] [client 173.239.218.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeo-vL6vRb9j6psK2Zbu9gAAAgo"]
[Thu Apr 23 23:46:07.691612 2026] [:error] [pid 65000:tid 65053] [client 173.239.218.56:28547] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu Apr 23 23:46:08.183093 2026] [:error] [pid 65000:tid 65038] [client 173.239.218.56:28547] [client 173.239.218.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aeo-wL6vRb9j6psK2ZbvUQAAAgU"]
[Thu Apr 23 23:46:08.830273 2026] [:error] [pid 59700:tid 59709] [client 173.239.218.25:45147] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Thu Apr 23 23:46:08.987172 2026] [:error] [pid 59700:tid 59718] [client 173.239.218.25:45147] [client 173.239.218.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aeo-wJXyGZJFeAIDWtlKFgAAAVA"]
[Thu Apr 23 23:46:33.861914 2026] [autoindex:error] [pid 64998:tid 65012] [client 173.239.218.46:41279] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 00:52:26.571609 2026] [:error] [pid 59700:tid 59712] [client 43.157.38.228:47856] [client 43.157.38.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aepOSpXyGZJFeAIDWtlpOwAAAUo"]
[Fri Apr 24 02:05:34.183783 2026] [:error] [pid 42971:tid 42993] [client 114.96.103.33:38808] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aepfbjEP2_5RswrH8bFS8AAAAAc"]
[Fri Apr 24 03:25:56.441394 2026] [:error] [pid 25635:tid 25657] [client 51.120.70.44:32478] File does not exist: /usr/local/apache/htdocs/suspended-page/eFpU3yHnriNNLtvdefault.php
[Fri Apr 24 03:25:56.706251 2026] [:error] [pid 25635:tid 25639] [client 51.120.70.44:32478] File does not exist: /usr/local/apache/htdocs/suspended-page/485.php
[Fri Apr 24 03:25:56.979791 2026] [:error] [pid 25635:tid 25651] [client 51.120.70.44:32478] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Fri Apr 24 03:25:57.238673 2026] [:error] [pid 25635:tid 25642] [client 51.120.70.44:32478] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aepyRcRxv6UsgRGKB3JaEgAAAQM"]
[Fri Apr 24 03:25:58.976682 2026] [:error] [pid 42971:tid 42998] [client 51.120.70.44:43905] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aepyRjEP2_5RswrH8bFc7AAAAAw"]
[Fri Apr 24 03:26:01.101385 2026] [:error] [pid 64998:tid 65019] [client 51.120.70.44:32424] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aepySYV5EysYcTLjmwhg-wAAAdE"]
[Fri Apr 24 03:26:02.188251 2026] [:error] [pid 25635:tid 25659] [client 51.120.70.44:45391] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "aepySsRxv6UsgRGKB3JaHQAAARQ"]
[Fri Apr 24 03:26:03.549790 2026] [:error] [pid 65000:tid 65042] [client 51.120.70.44:32986] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aepyS76vRb9j6psK2Za5rAAAAgk"]
[Fri Apr 24 03:26:05.168837 2026] [:error] [pid 64967:tid 64993] [client 51.120.70.44:30100] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aepyTYAV4GfOOdX8QzqlIAAAAZg"]
[Fri Apr 24 03:26:05.994703 2026] [:error] [pid 64998:tid 65015] [client 51.120.70.44:30138] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aepyTYV5EysYcTLjmwhhBQAAAc0"]
[Fri Apr 24 03:26:06.845511 2026] [:error] [pid 42972:tid 43037] [client 51.120.70.44:57099] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aepyTsOAb-3sOknsk4fkkAAAAFU"]
[Fri Apr 24 03:26:08.719891 2026] [:error] [pid 42973:tid 43056] [client 51.120.70.44:41715] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "aepyUG6I0QqmmmLTHE2bwQAAAI0"]
[Fri Apr 24 03:26:09.443307 2026] [:error] [pid 65000:tid 65055] [client 51.120.70.44:50210] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "aepyUb6vRb9j6psK2Za5tQAAAhY"]
[Fri Apr 24 03:26:10.687325 2026] [:error] [pid 46953:tid 46972] [client 51.120.70.44:39780] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "aepyUknlpdHh-P6wKbqK_gAAAlA"]
[Fri Apr 24 03:26:11.536601 2026] [:error] [pid 59700:tid 59711] [client 51.120.70.44:31486] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "aepyU5XyGZJFeAIDWtmLnwAAAUk"]
[Fri Apr 24 03:26:13.219309 2026] [:error] [pid 43083:tid 43094] [client 51.120.70.44:41360] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aepyVTC5hrvNXosL83K7qwAAAMk"]
[Fri Apr 24 03:26:14.485773 2026] [:error] [pid 25635:tid 25639] [client 51.120.70.44:27604] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aepyVsRxv6UsgRGKB3JaJgAAAQA"]
[Fri Apr 24 03:26:15.367014 2026] [:error] [pid 59700:tid 59708] [client 51.120.70.44:3872] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aepyV5XyGZJFeAIDWtmLqQAAAUY"]
[Fri Apr 24 03:26:16.046201 2026] [:error] [pid 64998:tid 65016] [client 51.120.70.44:26257] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aepyWIV5EysYcTLjmwhhGQAAAc4"]
[Fri Apr 24 03:26:16.996923 2026] [:error] [pid 64998:tid 65002] [client 51.120.70.44:3267] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x=34.php"] [unique_id "aepyWIV5EysYcTLjmwhhIAAAAcA"]
[Fri Apr 24 03:26:17.716885 2026] [:error] [pid 43083:tid 43099] [client 51.120.70.44:37697] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x=34.php"] [unique_id "aepyWTC5hrvNXosL83K7uQAAAM4"]
[Fri Apr 24 03:26:18.678041 2026] [:error] [pid 42973:tid 43061] [client 51.120.70.44:53842] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x=34.php"] [unique_id "aepyWm6I0QqmmmLTHE2bxQAAAJI"]
[Fri Apr 24 03:26:19.542842 2026] [:error] [pid 59700:tid 59722] [client 51.120.70.44:24226] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x=34.php"] [unique_id "aepyW5XyGZJFeAIDWtmLsQAAAVQ"]
[Fri Apr 24 03:26:20.470522 2026] [:error] [pid 59700:tid 59712] [client 51.120.70.44:34866] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "aepyXJXyGZJFeAIDWtmLvAAAAUo"]
[Fri Apr 24 03:26:21.265839 2026] [:error] [pid 64998:tid 65013] [client 51.120.70.44:36329] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "aepyXYV5EysYcTLjmwhhJAAAAcs"]
[Fri Apr 24 03:26:22.226587 2026] [:error] [pid 64998:tid 65024] [client 51.120.70.44:53816] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "aepyXoV5EysYcTLjmwhhJgAAAdY"]
[Fri Apr 24 03:26:23.510980 2026] [:error] [pid 59700:tid 59726] [client 51.120.70.44:27155] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "aepyX5XyGZJFeAIDWtmLwwAAAVg"]
[Fri Apr 24 03:26:24.951771 2026] [:error] [pid 42972:tid 43022] [client 51.120.70.44:50740] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aepyYMOAb-3sOknsk4fknQAAAEY"]
[Fri Apr 24 03:26:26.098153 2026] [:error] [pid 42972:tid 43036] [client 51.120.70.44:40725] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aepyYsOAb-3sOknsk4fkpwAAAFQ"]
[Fri Apr 24 03:26:27.399043 2026] [:error] [pid 42973:tid 43061] [client 51.120.70.44:52478] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aepyY26I0QqmmmLTHE2b0wAAAJI"]
[Fri Apr 24 03:26:28.658994 2026] [:error] [pid 25635:tid 25641] [client 51.120.70.44:53168] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eetu.php"] [unique_id "aepyZMRxv6UsgRGKB3JaPAAAAQI"]
[Fri Apr 24 03:26:29.734098 2026] [:error] [pid 25635:tid 25643] [client 51.120.70.44:3491] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aepyZcRxv6UsgRGKB3JaQAAAAQQ"]
[Fri Apr 24 03:26:31.499333 2026] [:error] [pid 64998:tid 65002] [client 51.120.70.44:29609] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aepyZ4V5EysYcTLjmwhhKQAAAcA"]
[Fri Apr 24 03:26:32.589127 2026] [:error] [pid 64998:tid 65023] [client 51.120.70.44:41995] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aepyaIV5EysYcTLjmwhhLAAAAdU"]
[Fri Apr 24 03:26:33.875879 2026] [:error] [pid 65000:tid 65047] [client 51.120.70.44:56644] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "aepyab6vRb9j6psK2Za5ygAAAg4"]
[Fri Apr 24 03:26:34.642496 2026] [:error] [pid 65000:tid 65038] [client 51.120.70.44:24750] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aepyar6vRb9j6psK2Za5zwAAAgU"]
[Fri Apr 24 03:26:35.757620 2026] [:error] [pid 65000:tid 65039] [client 51.120.70.44:24727] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aepya76vRb9j6psK2Za51wAAAgY"]
[Fri Apr 24 03:26:37.037081 2026] [:error] [pid 42972:tid 43019] [client 51.120.70.44:60324] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aepybcOAb-3sOknsk4fksAAAAEM"]
[Fri Apr 24 03:26:38.004311 2026] [:error] [pid 42972:tid 43024] [client 51.120.70.44:60338] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aepybsOAb-3sOknsk4fktQAAAEg"]
[Fri Apr 24 03:26:39.286206 2026] [:error] [pid 42972:tid 43019] [client 51.120.70.44:4073] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aepyb8OAb-3sOknsk4fkwAAAAEM"]
[Fri Apr 24 03:26:40.537252 2026] [:error] [pid 42971:tid 43010] [client 51.120.70.44:42013] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aepycDEP2_5RswrH8bFdBAAAABg"]
[Fri Apr 24 03:26:42.055561 2026] [:error] [pid 46953:tid 46978] [client 51.120.70.44:30181] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aepycknlpdHh-P6wKbqLGgAAAlU"]
[Fri Apr 24 03:26:42.609772 2026] [:error] [pid 65000:tid 65031] [client 51.120.70.44:60304] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zxcs.php"] [unique_id "aepycr6vRb9j6psK2Za57wAAAgI"]
[Fri Apr 24 03:26:43.767477 2026] [:error] [pid 43083:tid 43109] [client 51.120.70.44:60323] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aepyczC5hrvNXosL83K74QAAANg"]
[Fri Apr 24 03:26:44.900639 2026] [:error] [pid 46953:tid 46979] [client 51.120.70.44:55275] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aepydEnlpdHh-P6wKbqLHwAAAlY"]
[Fri Apr 24 03:26:45.948928 2026] [:error] [pid 65000:tid 65030] [client 51.120.70.44:42826] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aepydb6vRb9j6psK2Za6AwAAAgE"]
[Fri Apr 24 03:26:46.941899 2026] [:error] [pid 42973:tid 43059] [client 51.120.70.44:29644] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/s1.php"] [unique_id "aepydm6I0QqmmmLTHE2b3AAAAJA"]
[Fri Apr 24 03:26:48.293569 2026] [:error] [pid 59700:tid 59707] [client 51.120.70.44:3434] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aepyeJXyGZJFeAIDWtmL3QAAAUU"]
[Fri Apr 24 03:26:50.576706 2026] [:error] [pid 65000:tid 65040] [client 51.120.70.44:47738] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aepyer6vRb9j6psK2Za6HAAAAgc"]
[Fri Apr 24 03:26:52.284293 2026] [:error] [pid 65000:tid 65052] [client 51.120.70.44:42816] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aepyfL6vRb9j6psK2Za6JwAAAhM"]
[Fri Apr 24 03:26:53.647421 2026] [:error] [pid 65000:tid 65051] [client 51.120.70.44:29657] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "aepyfb6vRb9j6psK2Za6KwAAAhI"]
[Fri Apr 24 03:26:54.516745 2026] [:error] [pid 65000:tid 65031] [client 51.120.70.44:48303] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aepyfr6vRb9j6psK2Za6MAAAAgI"]
[Fri Apr 24 03:26:55.913900 2026] [:error] [pid 64967:tid 64976] [client 51.120.70.44:41008] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "aepyf4AV4GfOOdX8QzqlKwAAAYc"]
[Fri Apr 24 03:26:57.047428 2026] [:error] [pid 46953:tid 46967] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/wmore1.php
[Fri Apr 24 03:26:57.377798 2026] [:error] [pid 46953:tid 46956] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Fri Apr 24 03:26:57.671794 2026] [:error] [pid 46953:tid 46966] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Apr 24 03:26:57.933268 2026] [:error] [pid 46953:tid 46979] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Fri Apr 24 03:26:58.193204 2026] [:error] [pid 46953:tid 46970] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/file-kikikoko.php
[Fri Apr 24 03:26:58.519243 2026] [:error] [pid 46953:tid 46980] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Fri Apr 24 03:26:58.780480 2026] [:error] [pid 46953:tid 46960] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Fri Apr 24 03:26:59.048342 2026] [:error] [pid 46953:tid 46964] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Apr 24 03:26:59.316079 2026] [:error] [pid 46953:tid 46981] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/sad821.php
[Fri Apr 24 03:26:59.576638 2026] [:error] [pid 46953:tid 46968] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/sad8210.php
[Fri Apr 24 03:26:59.839526 2026] [:error] [pid 46953:tid 46958] [client 51.120.70.44:30165] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Fri Apr 24 03:27:00.101834 2026] [:error] [pid 46953:tid 46957] [client 51.120.70.44:30165] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aepyhEnlpdHh-P6wKbqLNwAAAkE"]
[Fri Apr 24 03:27:01.779223 2026] [:error] [pid 65000:tid 65056] [client 51.120.70.44:42082] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aepyhb6vRb9j6psK2Za6SgAAAhc"]
[Fri Apr 24 03:27:02.613115 2026] [:error] [pid 65000:tid 65050] [client 51.120.70.44:3388] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aepyhr6vRb9j6psK2Za6TgAAAhE"]
[Fri Apr 24 03:27:04.302879 2026] [:error] [pid 65000:tid 65056] [client 51.120.70.44:3384] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "aepyiL6vRb9j6psK2Za6WgAAAhc"]
[Fri Apr 24 03:27:05.230446 2026] [:error] [pid 64998:tid 65022] [client 51.120.70.44:55553] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aepyiYV5EysYcTLjmwhhRwAAAdQ"]
[Fri Apr 24 03:27:06.296716 2026] [:error] [pid 64998:tid 65025] [client 51.120.70.44:36267] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aepyioV5EysYcTLjmwhhTQAAAdc"]
[Fri Apr 24 03:27:07.533966 2026] [:error] [pid 42971:tid 42996] [client 51.120.70.44:55570] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aepyizEP2_5RswrH8bFdFQAAAAo"]
[Fri Apr 24 03:27:08.802590 2026] [:error] [pid 64998:tid 65022] [client 51.120.70.44:53778] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "aepyjIV5EysYcTLjmwhhWQAAAdQ"]
[Fri Apr 24 03:27:09.915193 2026] [:error] [pid 42973:tid 43049] [client 51.120.70.44:25968] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aepyjW6I0QqmmmLTHE2b5QAAAIY"]
[Fri Apr 24 03:27:12.790380 2026] [:error] [pid 42972:tid 43040] [client 51.120.70.44:36285] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aepykMOAb-3sOknsk4fkygAAAFg"]
[Fri Apr 24 03:27:14.928794 2026] [:error] [pid 46953:tid 46968] [client 51.120.70.44:35892] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aepykknlpdHh-P6wKbqLPwAAAkw"]
[Fri Apr 24 03:27:16.846355 2026] [:error] [pid 64998:tid 65002] [client 51.120.70.44:37647] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aepylIV5EysYcTLjmwhhbwAAAcA"]
[Fri Apr 24 03:27:17.950983 2026] [:error] [pid 42972:tid 43017] [client 51.120.70.44:47748] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aepylcOAb-3sOknsk4fk1gAAAEE"]
[Fri Apr 24 03:27:18.902946 2026] [:error] [pid 64998:tid 65004] [client 51.120.70.44:53806] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aepyloV5EysYcTLjmwhhdQAAAcI"]
[Fri Apr 24 03:27:19.706595 2026] [:error] [pid 43083:tid 43107] [client 51.120.70.44:37688] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aepylzC5hrvNXosL83K78AAAANY"]
[Fri Apr 24 03:27:20.996783 2026] [:error] [pid 65000:tid 65046] [client 51.120.70.44:31386] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wps.php"] [unique_id "aepymL6vRb9j6psK2Za6eQAAAg0"]
[Fri Apr 24 03:27:22.204661 2026] [:error] [pid 65000:tid 65048] [client 51.120.70.44:35870] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aepymr6vRb9j6psK2Za6fAAAAg8"]
[Fri Apr 24 03:27:23.254262 2026] [:error] [pid 43083:tid 43103] [client 51.120.70.44:59769] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aepymzC5hrvNXosL83K79wAAANI"]
[Fri Apr 24 03:27:24.266197 2026] [:error] [pid 65000:tid 65041] [client 51.120.70.44:59721] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aepynL6vRb9j6psK2Za6ggAAAgg"]
[Fri Apr 24 03:27:25.130887 2026] [:error] [pid 65000:tid 65040] [client 51.120.70.44:59686] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aepynb6vRb9j6psK2Za6gwAAAgc"]
[Fri Apr 24 03:27:26.910692 2026] [:error] [pid 59700:tid 59708] [client 51.120.70.44:59703] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aepynpXyGZJFeAIDWtmMBwAAAUY"]
[Fri Apr 24 03:27:27.969670 2026] [:error] [pid 42973:tid 43048] [client 51.120.70.44:41037] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aepyn26I0QqmmmLTHE2cAAAAAIU"]
[Fri Apr 24 03:27:28.785994 2026] [:error] [pid 59700:tid 59723] [client 51.120.70.44:37683] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aepyoJXyGZJFeAIDWtmMCwAAAVU"]
[Fri Apr 24 03:27:29.806999 2026] [:error] [pid 42971:tid 42996] [client 51.120.70.44:33628] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "aepyoTEP2_5RswrH8bFdHQAAAAo"]
[Fri Apr 24 03:27:30.702075 2026] [:error] [pid 25635:tid 25649] [client 51.120.70.44:52442] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aepyosRxv6UsgRGKB3JaawAAAQo"]
[Fri Apr 24 03:27:31.476309 2026] [:error] [pid 64998:tid 65013] [client 51.120.70.44:50707] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aepyo4V5EysYcTLjmwhhhQAAAcs"]
[Fri Apr 24 03:27:32.505761 2026] [:error] [pid 64998:tid 65002] [client 51.120.70.44:51245] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aepypIV5EysYcTLjmwhhjQAAAcA"]
[Fri Apr 24 03:27:33.589299 2026] [:error] [pid 42972:tid 43033] [client 51.120.70.44:41080] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aepypcOAb-3sOknsk4fk9wAAAFE"]
[Fri Apr 24 03:27:37.820516 2026] [:error] [pid 46953:tid 46973] [client 51.120.70.44:31376] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aepyqUnlpdHh-P6wKbqLSAAAAlE"]
[Fri Apr 24 03:27:39.653217 2026] [:error] [pid 42972:tid 43036] [client 51.120.70.44:57140] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aepyq8OAb-3sOknsk4flBAAAAFQ"]
[Fri Apr 24 03:27:41.164920 2026] [:error] [pid 64998:tid 65004] [client 51.120.70.44:3384] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aepyrYV5EysYcTLjmwhhogAAAcI"]
[Fri Apr 24 03:27:42.941556 2026] [:error] [pid 65000:tid 65048] [client 51.120.70.44:38931] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "aepyrr6vRb9j6psK2Za6mgAAAg8"]
[Fri Apr 24 03:27:45.534864 2026] [:error] [pid 43083:tid 43086] [client 51.120.70.44:38189] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aepysTC5hrvNXosL83K8BAAAAME"]
[Fri Apr 24 03:27:47.644164 2026] [:error] [pid 64998:tid 65008] [client 51.120.70.44:3583] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aepys4V5EysYcTLjmwhhtAAAAcY"]
[Fri Apr 24 03:27:48.953322 2026] [:error] [pid 59700:tid 59716] [client 51.120.70.44:42448] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aepytJXyGZJFeAIDWtmMGwAAAU4"]
[Fri Apr 24 03:27:50.466464 2026] [:error] [pid 65000:tid 65056] [client 51.120.70.44:36797] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dass.php"] [unique_id "aepytr6vRb9j6psK2Za6swAAAhc"]
[Fri Apr 24 03:27:51.238325 2026] [:error] [pid 64967:tid 64969] [client 51.120.70.44:3556] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aepyt4AV4GfOOdX8QzqlPgAAAYA"]
[Fri Apr 24 03:27:52.474284 2026] [:error] [pid 43083:tid 43093] [client 51.120.70.44:39708] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aepyuDC5hrvNXosL83K8EgAAAMg"]
[Fri Apr 24 03:27:54.531940 2026] [:error] [pid 25635:tid 25654] [client 51.120.70.44:34880] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aepyusRxv6UsgRGKB3JadgAAAQ8"]
[Fri Apr 24 03:27:55.981838 2026] [:error] [pid 64998:tid 65003] [client 51.120.70.44:38960] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws66.php"] [unique_id "aepyu4V5EysYcTLjmwhhxwAAAcE"]
[Fri Apr 24 03:27:56.985966 2026] [:error] [pid 42973:tid 43062] [client 51.120.70.44:35178] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aepyvG6I0QqmmmLTHE2cEAAAAJM"]
[Fri Apr 24 03:27:58.370507 2026] [:error] [pid 46953:tid 46981] [client 51.120.70.44:34919] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "aepyvknlpdHh-P6wKbqLUwAAAlg"]
[Fri Apr 24 03:28:00.336829 2026] [:error] [pid 64998:tid 65020] [client 51.120.70.44:27625] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Fri Apr 24 03:28:00.600049 2026] [:error] [pid 64998:tid 65024] [client 51.120.70.44:27625] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Fri Apr 24 03:28:00.861606 2026] [:error] [pid 64998:tid 65019] [client 51.120.70.44:27625] File does not exist: /usr/local/apache/htdocs/suspended-page/r2.php
[Fri Apr 24 03:28:01.120333 2026] [:error] [pid 64998:tid 65003] [client 51.120.70.44:27625] [client 51.120.70.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "aepywYV5EysYcTLjmwhh2QAAAcE"]
[Fri Apr 24 03:28:02.021096 2026] [:error] [pid 65000:tid 65043] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Fri Apr 24 03:28:02.282522 2026] [:error] [pid 65000:tid 65039] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Fri Apr 24 03:28:02.546591 2026] [:error] [pid 65000:tid 65042] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Fri Apr 24 03:28:02.813154 2026] [:error] [pid 65000:tid 65045] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Fri Apr 24 03:28:03.085331 2026] [:error] [pid 65000:tid 65040] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Fri Apr 24 03:28:03.346897 2026] [:error] [pid 65000:tid 65055] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/config.php
[Fri Apr 24 03:28:03.609591 2026] [:error] [pid 65000:tid 65031] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Fri Apr 24 03:28:03.884297 2026] [:error] [pid 65000:tid 65043] [client 51.120.70.44:35175] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Fri Apr 24 03:28:04.164545 2026] [:error] [pid 65000:tid 65050] [client 51.120.70.44:35175] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aepyxL6vRb9j6psK2Za61wAAAhE"]
[Fri Apr 24 03:28:04.797146 2026] [:error] [pid 42972:tid 43035] [client 51.120.70.44:27647] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aepyxMOAb-3sOknsk4flNAAAAFM"]
[Fri Apr 24 03:28:05.747833 2026] [:error] [pid 65000:tid 65047] [client 51.120.70.44:27628] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aepyxb6vRb9j6psK2Za62QAAAg4"]
[Fri Apr 24 03:28:06.830001 2026] [:error] [pid 42973:tid 43067] [client 51.120.70.44:3562] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "aepyxm6I0QqmmmLTHE2cGwAAAJg"]
[Fri Apr 24 03:28:08.069471 2026] [:error] [pid 59700:tid 59712] [client 51.120.70.44:27193] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aepyyJXyGZJFeAIDWtmMKQAAAUo"]
[Fri Apr 24 03:28:09.276337 2026] [:error] [pid 65000:tid 65041] [client 51.120.70.44:53873] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aepyyb6vRb9j6psK2Za64QAAAgg"]
[Fri Apr 24 03:28:10.705121 2026] [:error] [pid 64998:tid 65008] [client 51.120.70.44:3843] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aepyyoV5EysYcTLjmwhh6QAAAcY"]
[Fri Apr 24 03:28:12.349249 2026] [:error] [pid 42973:tid 43052] [client 51.120.70.44:27629] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "aepyzG6I0QqmmmLTHE2cHAAAAIk"]
[Fri Apr 24 03:28:13.589451 2026] [:error] [pid 25635:tid 25662] [client 51.120.70.44:3310] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aepyzcRxv6UsgRGKB3JagQAAARc"]
[Fri Apr 24 03:28:14.882399 2026] [:error] [pid 64998:tid 65024] [client 51.120.70.44:53861] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aepyzoV5EysYcTLjmwhh9gAAAdY"]
[Fri Apr 24 03:28:15.599201 2026] [:error] [pid 64998:tid 65017] [client 51.120.70.44:39713] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aepyz4V5EysYcTLjmwhh_AAAAc8"]
[Fri Apr 24 03:28:16.625826 2026] [:error] [pid 64998:tid 65005] [client 51.120.70.44:27926] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wglum1.php"] [unique_id "aepy0IV5EysYcTLjmwhiBQAAAcM"]
[Fri Apr 24 03:28:17.752631 2026] [:error] [pid 46953:tid 46963] [client 51.120.70.44:27180] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aepy0UnlpdHh-P6wKbqLYAAAAkc"]
[Fri Apr 24 03:28:18.572327 2026] [:error] [pid 42972:tid 43032] [client 51.120.70.44:27162] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aepy0sOAb-3sOknsk4flTgAAAFA"]
[Fri Apr 24 03:28:19.569477 2026] [:error] [pid 65000:tid 65039] [client 51.120.70.44:34924] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aepy076vRb9j6psK2Za69QAAAgY"]
[Fri Apr 24 03:28:20.584898 2026] [:error] [pid 42972:tid 43018] [client 51.120.70.44:53832] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "aepy1MOAb-3sOknsk4flVAAAAEI"]
[Fri Apr 24 03:28:23.756700 2026] [:error] [pid 65000:tid 65038] [client 51.120.70.44:53854] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aepy176vRb9j6psK2Za7DQAAAgU"]
[Fri Apr 24 03:28:24.604366 2026] [:error] [pid 59700:tid 59702] [client 51.120.70.44:52726] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aepy2JXyGZJFeAIDWtmMPwAAAUA"]
[Fri Apr 24 03:28:25.923866 2026] [:error] [pid 42973:tid 43048] [client 51.120.70.44:39714] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aepy2W6I0QqmmmLTHE2cJgAAAIU"]
[Fri Apr 24 03:28:27.805522 2026] [:error] [pid 42972:tid 43029] [client 51.120.70.44:41352] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wgift1.php"] [unique_id "aepy28OAb-3sOknsk4flXwAAAE0"]
[Fri Apr 24 03:28:28.616683 2026] [:error] [pid 42972:tid 43017] [client 51.120.70.44:56062] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aepy3MOAb-3sOknsk4flYgAAAEE"]
[Fri Apr 24 03:28:30.364771 2026] [:error] [pid 64967:tid 64975] [client 51.120.70.44:39698] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aepy3oAV4GfOOdX8QzqlYgAAAYY"]
[Fri Apr 24 03:28:32.555739 2026] [:error] [pid 42973:tid 43049] [client 51.120.70.44:35143] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aepy4G6I0QqmmmLTHE2cNwAAAIY"]
[Fri Apr 24 03:28:33.753406 2026] [:error] [pid 43083:tid 43106] [client 51.120.70.44:34904] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xynz.php"] [unique_id "aepy4TC5hrvNXosL83K8OAAAANU"]
[Fri Apr 24 03:28:35.332752 2026] [:error] [pid 65000:tid 65039] [client 51.120.70.44:27140] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepy476vRb9j6psK2Za7bgAAAgY"]
[Fri Apr 24 03:28:36.847624 2026] [:error] [pid 42972:tid 43024] [client 51.120.70.44:37722] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepy5MOAb-3sOknsk4flaAAAAEg"]
[Fri Apr 24 03:28:37.532356 2026] [:error] [pid 43083:tid 43107] [client 51.120.70.44:3885] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepy5TC5hrvNXosL83K8PgAAANY"]
[Fri Apr 24 03:28:38.507175 2026] [:error] [pid 42973:tid 43065] [client 51.120.70.44:41406] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/admin.php"] [unique_id "aepy5m6I0QqmmmLTHE2cPgAAAJY"]
[Fri Apr 24 03:28:39.974905 2026] [:error] [pid 42972:tid 43020] [client 51.120.70.44:24237] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aepy58OAb-3sOknsk4flcQAAAEQ"]
[Fri Apr 24 03:28:40.746021 2026] [:error] [pid 43083:tid 43101] [client 51.120.70.44:39726] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aepy6DC5hrvNXosL83K8QQAAANA"]
[Fri Apr 24 03:28:41.874030 2026] [:error] [pid 59700:tid 59715] [client 51.120.70.44:40764] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aepy6ZXyGZJFeAIDWtmMUgAAAU0"]
[Fri Apr 24 03:28:44.134181 2026] [:error] [pid 42973:tid 43066] [client 51.120.70.44:40735] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "aepy7G6I0QqmmmLTHE2cSAAAAJc"]
[Fri Apr 24 03:28:45.699071 2026] [:error] [pid 59700:tid 59725] [client 51.120.70.44:39743] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aepy7ZXyGZJFeAIDWtmMVAAAAVc"]
[Fri Apr 24 03:28:46.928543 2026] [:error] [pid 42972:tid 43038] [client 51.120.70.44:35150] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aepy7sOAb-3sOknsk4fleQAAAFY"]
[Fri Apr 24 03:28:48.406135 2026] [:error] [pid 42973:tid 43064] [client 51.120.70.44:24236] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aepy8G6I0QqmmmLTHE2cWAAAAJU"]
[Fri Apr 24 03:28:51.172033 2026] [:error] [pid 65000:tid 65041] [client 51.120.70.44:37732] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aepy876vRb9j6psK2Za7xgAAAgg"]
[Fri Apr 24 03:28:52.669714 2026] [:error] [pid 46953:tid 46968] [client 51.120.70.44:24245] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aepy9EnlpdHh-P6wKbqLiwAAAkw"]
[Fri Apr 24 03:28:54.046777 2026] [:error] [pid 59700:tid 59724] [client 51.120.70.44:27934] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aepy9pXyGZJFeAIDWtmMWgAAAVY"]
[Fri Apr 24 03:28:55.016040 2026] [:error] [pid 42972:tid 43022] [client 51.120.70.44:34911] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aepy98OAb-3sOknsk4fliAAAAEY"]
[Fri Apr 24 03:28:56.282703 2026] [:error] [pid 42971:tid 42989] [client 51.120.70.44:27156] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rh.php"] [unique_id "aepy-DEP2_5RswrH8bFdYQAAAAM"]
[Fri Apr 24 03:28:57.387336 2026] [:error] [pid 64998:tid 65015] [client 51.120.70.44:27165] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aepy-YV5EysYcTLjmwhiPwAAAc0"]
[Fri Apr 24 03:28:58.381732 2026] [:error] [pid 65000:tid 65055] [client 51.120.70.44:27590] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aepy-r6vRb9j6psK2Za76gAAAhY"]
[Fri Apr 24 03:28:59.655135 2026] [:error] [pid 65000:tid 65054] [client 51.120.70.44:24222] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aepy-76vRb9j6psK2Za79AAAAhU"]
[Fri Apr 24 03:29:00.453371 2026] [:error] [pid 59700:tid 59712] [client 51.120.70.44:27152] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "aepy_JXyGZJFeAIDWtmMXgAAAUo"]
[Fri Apr 24 03:29:02.077485 2026] [:error] [pid 43083:tid 43095] [client 51.120.70.44:27646] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aepy_jC5hrvNXosL83K8TwAAAMo"]
[Fri Apr 24 03:29:03.303045 2026] [:error] [pid 64998:tid 65012] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 24 03:29:03.623626 2026] [:error] [pid 64998:tid 65019] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/view.php
[Fri Apr 24 03:29:03.903051 2026] [:error] [pid 64998:tid 65016] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Fri Apr 24 03:29:04.173773 2026] [:error] [pid 64998:tid 65026] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Apr 24 03:29:04.441981 2026] [:error] [pid 64998:tid 65009] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Fri Apr 24 03:29:04.712835 2026] [:error] [pid 64998:tid 65013] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Fri Apr 24 03:29:04.974688 2026] [:error] [pid 64998:tid 65005] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Fri Apr 24 03:29:05.238955 2026] [:error] [pid 64998:tid 65014] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Fri Apr 24 03:29:05.603845 2026] [:error] [pid 64998:tid 65024] [client 51.120.70.44:23750] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Fri Apr 24 03:29:05.864440 2026] [:error] [pid 64998:tid 65011] [client 51.120.70.44:23750] [client 51.120.70.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aepzAYV5EysYcTLjmwhiXgAAAck"]
[Fri Apr 24 03:29:07.129731 2026] [:error] [pid 64967:tid 64970] [client 51.120.70.44:37696] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class.php
[Fri Apr 24 03:29:07.398480 2026] [:error] [pid 64967:tid 64978] [client 51.120.70.44:37696] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Fri Apr 24 03:29:07.657686 2026] [:error] [pid 64967:tid 64983] [client 51.120.70.44:37696] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aepzA4AV4GfOOdX8QzqldQAAAY4"]
[Fri Apr 24 03:29:09.106089 2026] [:error] [pid 65000:tid 65040] [client 51.120.70.44:27190] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aepzBb6vRb9j6psK2Za8IAAAAgc"]
[Fri Apr 24 03:29:11.385436 2026] [:error] [pid 64998:tid 65020] [client 51.120.70.44:53880] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aepzB4V5EysYcTLjmwhidQAAAdI"]
[Fri Apr 24 03:29:12.758997 2026] [:error] [pid 43083:tid 43106] [client 51.120.70.44:37701] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws85.php"] [unique_id "aepzCDC5hrvNXosL83K8UwAAANU"]
[Fri Apr 24 03:29:24.968940 2026] [:error] [pid 43083:tid 43094] [client 51.120.70.44:41348] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "aepzFDC5hrvNXosL83K8VgAAAMk"]
[Fri Apr 24 03:29:26.312726 2026] [:error] [pid 64998:tid 65006] [client 51.120.70.44:27946] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "aepzFoV5EysYcTLjmwhikwAAAcQ"]
[Fri Apr 24 03:29:29.437136 2026] [:error] [pid 42972:tid 43027] [client 51.120.70.44:53816] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aepzGcOAb-3sOknsk4fltgAAAEs"]
[Fri Apr 24 03:29:30.214173 2026] [:error] [pid 42972:tid 43037] [client 51.120.70.44:40743] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aepzGsOAb-3sOknsk4fluAAAAFU"]
[Fri Apr 24 03:29:30.989966 2026] [:error] [pid 25635:tid 25639] [client 51.120.70.44:41363] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aepzGsRxv6UsgRGKB3JanAAAAQA"]
[Fri Apr 24 03:29:33.623312 2026] [:error] [pid 25635:tid 25640] [client 51.120.70.44:53858] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/state.php"] [unique_id "aepzHcRxv6UsgRGKB3JapwAAAQE"]
[Fri Apr 24 03:29:35.504970 2026] [:error] [pid 42972:tid 43029] [client 51.120.70.44:40744] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aepzH8OAb-3sOknsk4flwQAAAE0"]
[Fri Apr 24 03:29:37.277881 2026] [:error] [pid 42972:tid 43033] [client 51.120.70.44:23792] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aepzIcOAb-3sOknsk4flzQAAAFE"]
[Fri Apr 24 03:29:38.357907 2026] [:error] [pid 42973:tid 43058] [client 51.120.70.44:27940] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aepzIm6I0QqmmmLTHE2cfwAAAI8"]
[Fri Apr 24 03:29:39.989958 2026] [:error] [pid 64967:tid 64982] [client 51.120.70.44:3963] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "aepzI4AV4GfOOdX8QzqliQAAAY0"]
[Fri Apr 24 03:29:41.708179 2026] [:error] [pid 64967:tid 64985] [client 51.120.70.44:23762] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aepzJYAV4GfOOdX8QzqlkgAAAZA"]
[Fri Apr 24 03:29:42.725138 2026] [:error] [pid 65000:tid 65029] [client 51.120.70.44:40557] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aepzJr6vRb9j6psK2Za8VAAAAgA"]
[Fri Apr 24 03:29:44.552808 2026] [:error] [pid 64998:tid 65013] [client 51.120.70.44:49041] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aepzKIV5EysYcTLjmwhirwAAAcs"]
[Fri Apr 24 03:29:46.250828 2026] [:error] [pid 59700:tid 59716] [client 51.120.70.44:33000] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/error_log.php"] [unique_id "aepzKpXyGZJFeAIDWtmMgQAAAU4"]
[Fri Apr 24 03:29:47.115505 2026] [:error] [pid 65000:tid 65047] [client 51.120.70.44:27149] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "aepzK76vRb9j6psK2Za8bAAAAg4"]
[Fri Apr 24 03:29:51.444779 2026] [:error] [pid 46953:tid 46962] [client 51.120.70.44:34591] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "aepzL0nlpdHh-P6wKbqLrwAAAkY"]
[Fri Apr 24 03:29:56.223293 2026] [:error] [pid 42971:tid 43010] [client 51.120.70.44:41660] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "aepzNDEP2_5RswrH8bFdhQAAABg"]
[Fri Apr 24 03:29:58.730889 2026] [:error] [pid 42972:tid 43031] [client 51.120.70.44:41655] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "aepzNsOAb-3sOknsk4fmKwAAAE8"]
[Fri Apr 24 03:29:59.743398 2026] [:error] [pid 64998:tid 65002] [client 51.120.70.44:46517] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "aepzN4V5EysYcTLjmwhiugAAAcA"]
[Fri Apr 24 03:30:01.284575 2026] [:error] [pid 42972:tid 43036] [client 51.120.70.44:27246] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "aepzOcOAb-3sOknsk4fmOQAAAFQ"]
[Fri Apr 24 03:30:03.241771 2026] [:error] [pid 42971:tid 42986] [client 51.120.70.44:32486] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "aepzOzEP2_5RswrH8bFdjAAAAAA"]
[Fri Apr 24 03:30:04.709129 2026] [:error] [pid 42972:tid 43039] [client 51.120.70.44:28426] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws57.php"] [unique_id "aepzPMOAb-3sOknsk4fmQwAAAFc"]
[Fri Apr 24 03:30:07.175940 2026] [:error] [pid 42973:tid 43059] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/ws86.php
[Fri Apr 24 03:30:07.449130 2026] [:error] [pid 42973:tid 43045] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Fri Apr 24 03:30:07.710149 2026] [:error] [pid 42973:tid 43057] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Fri Apr 24 03:30:07.972474 2026] [:error] [pid 42973:tid 43056] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Fri Apr 24 03:30:08.253453 2026] [:error] [pid 42973:tid 43048] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Fri Apr 24 03:30:08.514902 2026] [:error] [pid 42973:tid 43050] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Fri Apr 24 03:30:09.218285 2026] [:error] [pid 42973:tid 43046] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/maxro.php
[Fri Apr 24 03:30:09.579349 2026] [:error] [pid 42973:tid 43046] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Fri Apr 24 03:30:09.840911 2026] [:error] [pid 42973:tid 43065] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Fri Apr 24 03:30:10.217608 2026] [:error] [pid 42973:tid 43063] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Fri Apr 24 03:30:10.504765 2026] [:error] [pid 42973:tid 43054] [client 51.120.70.44:35113] File does not exist: /usr/local/apache/htdocs/suspended-page/areak1.php
[Fri Apr 24 03:30:10.916918 2026] [:error] [pid 42973:tid 43055] [client 51.120.70.44:35113] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aepzQm6I0QqmmmLTHE2cngAAAIw"]
[Fri Apr 24 03:30:11.821084 2026] [:error] [pid 42972:tid 43039] [client 51.120.70.44:28452] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aepzQ8OAb-3sOknsk4fmXQAAAFc"]
[Fri Apr 24 03:30:14.419339 2026] [:error] [pid 65000:tid 65054] [client 51.120.70.44:50234] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aepzRr6vRb9j6psK2Za8vwAAAhU"]
[Fri Apr 24 03:30:15.442325 2026] [:error] [pid 25635:tid 25644] [client 51.120.70.44:47180] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "aepzR8Rxv6UsgRGKB3JavAAAAQU"]
[Fri Apr 24 03:30:17.025170 2026] [:error] [pid 42972:tid 43039] [client 51.120.70.44:47255] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "aepzScOAb-3sOknsk4fmegAAAFc"]
[Fri Apr 24 03:30:23.821916 2026] [:error] [pid 64998:tid 65007] [client 51.120.70.44:41424] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "aepzT4V5EysYcTLjmwhi0gAAAcU"]
[Fri Apr 24 03:30:28.583721 2026] [:error] [pid 64998:tid 65006] [client 51.120.70.44:3208] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tiny2.php"] [unique_id "aepzVIV5EysYcTLjmwhi2wAAAcQ"]
[Fri Apr 24 03:30:33.876901 2026] [:error] [pid 42972:tid 43036] [client 51.120.70.44:47185] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aepzWcOAb-3sOknsk4fmnwAAAFQ"]
[Fri Apr 24 03:30:35.079846 2026] [:error] [pid 65000:tid 65039] [client 51.120.70.44:44007] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aepzW76vRb9j6psK2Za9EAAAAgY"]
[Fri Apr 24 03:30:38.045085 2026] [:error] [pid 65000:tid 65054] [client 51.120.70.44:45431] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aepzXr6vRb9j6psK2Za9GAAAAhU"]
[Fri Apr 24 03:30:43.494387 2026] [:error] [pid 42971:tid 42993] [client 51.120.70.44:45428] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aepzYzEP2_5RswrH8bFdugAAAAc"]
[Fri Apr 24 03:30:44.799885 2026] [:error] [pid 42972:tid 43035] [client 51.120.70.44:3680] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aepzZMOAb-3sOknsk4fmvwAAAFM"]
[Fri Apr 24 03:30:45.668416 2026] [:error] [pid 46953:tid 46980] [client 51.120.70.44:53207] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aepzZUnlpdHh-P6wKbqMJwAAAlc"]
[Fri Apr 24 03:30:47.817629 2026] [:error] [pid 64998:tid 65021] [client 51.120.70.44:43966] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aepzZ4V5EysYcTLjmwhjJwAAAdM"]
[Fri Apr 24 03:30:48.698770 2026] [:error] [pid 59700:tid 59707] [client 51.120.70.44:50655] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gz.php"] [unique_id "aepzaJXyGZJFeAIDWtmMygAAAUU"]
[Fri Apr 24 03:30:49.661528 2026] [:error] [pid 65000:tid 65031] [client 51.120.70.44:3649] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aepzab6vRb9j6psK2Za9LgAAAgI"]
[Fri Apr 24 03:30:52.424175 2026] [:error] [pid 64998:tid 65006] [client 51.120.70.44:3756] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aepzbIV5EysYcTLjmwhjQwAAAcQ"]
[Fri Apr 24 03:30:54.199944 2026] [:error] [pid 42972:tid 43017] [client 51.120.70.44:50672] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aepzbsOAb-3sOknsk4fmzgAAAEE"]
[Fri Apr 24 03:30:56.234833 2026] [:error] [pid 65000:tid 65057] [client 51.120.70.44:46525] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aepzcL6vRb9j6psK2Za9MQAAAhg"]
[Fri Apr 24 03:30:59.157133 2026] [:error] [pid 64967:tid 64993] [client 51.120.70.44:46587] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aepzc4AV4GfOOdX8QzqlvQAAAZg"]
[Fri Apr 24 03:31:00.700417 2026] [:error] [pid 42972:tid 43030] [client 51.120.70.44:31045] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aepzdMOAb-3sOknsk4fm7QAAAE4"]
[Fri Apr 24 03:31:02.850848 2026] [:error] [pid 59700:tid 59705] [client 51.120.70.44:3952] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aepzdpXyGZJFeAIDWtmM2QAAAUM"]
[Fri Apr 24 03:31:05.700223 2026] [:error] [pid 59700:tid 59719] [client 51.120.70.44:34635] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gecko.php"] [unique_id "aepzeZXyGZJFeAIDWtmM3QAAAVE"]
[Fri Apr 24 03:31:07.408412 2026] [:error] [pid 25635:tid 25640] [client 51.120.70.44:27185] [client 51.120.70.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "aepze8Rxv6UsgRGKB3JazQAAAQE"]
[Fri Apr 24 03:31:11.710544 2026] [:error] [pid 42971:tid 42993] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Fri Apr 24 03:31:11.975008 2026] [:error] [pid 42971:tid 42990] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/ws68.php
[Fri Apr 24 03:31:12.241509 2026] [:error] [pid 42971:tid 42987] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Fri Apr 24 03:31:12.506720 2026] [:error] [pid 42971:tid 42998] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Fri Apr 24 03:31:13.169473 2026] [:error] [pid 42971:tid 42994] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Fri Apr 24 03:31:13.434232 2026] [:error] [pid 42971:tid 43010] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Fri Apr 24 03:31:13.709815 2026] [:error] [pid 42971:tid 43004] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Fri Apr 24 03:31:14.027777 2026] [:error] [pid 42971:tid 42995] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/ws84.php
[Fri Apr 24 03:31:14.296514 2026] [:error] [pid 42971:tid 42997] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/ws61.php
[Fri Apr 24 03:31:14.578473 2026] [:error] [pid 42971:tid 42996] [client 51.120.70.44:53825] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp-image.php
[Fri Apr 24 04:15:47.717541 2026] [:error] [pid 52129:tid 52137] [client 43.157.22.109:56492] [client 43.157.22.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aep98-KCZKf8_u2LKiANNQAAAQQ"]
[Fri Apr 24 04:46:37.483875 2026] [:error] [pid 19101:tid 19147] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Fri Apr 24 04:46:37.746302 2026] [:error] [pid 19101:tid 19160] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Fri Apr 24 04:46:38.008420 2026] [:error] [pid 19101:tid 19155] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Fri Apr 24 04:46:38.273202 2026] [:error] [pid 19101:tid 19139] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Fri Apr 24 04:46:38.537340 2026] [:error] [pid 19101:tid 19154] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Fri Apr 24 04:46:39.883009 2026] [:error] [pid 19101:tid 19154] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Fri Apr 24 04:46:40.422536 2026] [:error] [pid 19101:tid 19145] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/elp.php
[Fri Apr 24 04:46:40.686474 2026] [:error] [pid 19101:tid 19137] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/zc-243.php
[Fri Apr 24 04:46:40.955617 2026] [:error] [pid 19101:tid 19151] [client 158.158.109.204:8305] File does not exist: /usr/local/apache/htdocs/suspended-page/bkyac.php
[Fri Apr 24 04:46:41.215523 2026] [:error] [pid 19101:tid 19141] [client 158.158.109.204:8305] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "aeqFMWAHj9bEvrTgbO21yAAAAEQ"]
[Fri Apr 24 04:46:42.393369 2026] [:error] [pid 19200:tid 19223] [client 158.158.109.204:15918] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "aeqFMjQ--M3-tsKAnhFynwAAAM8"]
[Fri Apr 24 04:46:43.708329 2026] [:error] [pid 19200:tid 19209] [client 158.158.109.204:15166] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "aeqFMzQ--M3-tsKAnhFyqQAAAME"]
[Fri Apr 24 04:46:45.575099 2026] [:error] [pid 19100:tid 19122] [client 158.158.109.204:15889] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wziar1.php"] [unique_id "aeqFNbF_hzQs4CqbiffyWgAAAAw"]
[Fri Apr 24 04:46:48.604806 2026] [:error] [pid 19200:tid 19216] [client 158.158.109.204:11515] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aeqFODQ--M3-tsKAnhFyuwAAAMg"]
[Fri Apr 24 04:46:51.196848 2026] [:error] [pid 19102:tid 19164] [client 158.158.109.204:43842] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aeqFOwDSgrbLEZbkqD6geQAAAIA"]
[Fri Apr 24 04:46:52.113734 2026] [:error] [pid 19200:tid 19227] [client 158.158.109.204:30176] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aeqFPDQ--M3-tsKAnhFyxwAAANM"]
[Fri Apr 24 04:46:52.812751 2026] [:error] [pid 52129:tid 52153] [client 158.158.109.204:12724] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aeqFPOKCZKf8_u2LKiAlTAAAARQ"]
[Fri Apr 24 04:46:55.615126 2026] [:error] [pid 52129:tid 52145] [client 158.158.109.204:23297] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeqFP-KCZKf8_u2LKiAlVQAAAQw"]
[Fri Apr 24 04:46:57.273869 2026] [:error] [pid 52129:tid 52148] [client 158.158.109.204:11476] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeqFQeKCZKf8_u2LKiAlWQAAAQ8"]
[Fri Apr 24 04:46:58.918570 2026] [:error] [pid 19101:tid 19138] [client 158.158.109.204:21970] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeqFQmAHj9bEvrTgbO214gAAAEE"]
[Fri Apr 24 04:47:01.992870 2026] [:error] [pid 19101:tid 19148] [client 158.158.109.204:35791] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/7logs.php"] [unique_id "aeqFRWAHj9bEvrTgbO216AAAAEs"]
[Fri Apr 24 04:47:03.967161 2026] [:error] [pid 19101:tid 19140] [client 158.158.109.204:26523] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeqFR2AHj9bEvrTgbO218wAAAEM"]
[Fri Apr 24 04:47:05.777646 2026] [:error] [pid 52129:tid 52151] [client 158.158.109.204:26555] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeqFSeKCZKf8_u2LKiAlkgAAARI"]
[Fri Apr 24 04:47:07.295673 2026] [:error] [pid 19100:tid 19115] [client 158.158.109.204:22280] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeqFS7F_hzQs4CqbiffygwAAAAY"]
[Fri Apr 24 04:47:09.526803 2026] [:error] [pid 19200:tid 19209] [client 158.158.109.204:13481] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aeqFTTQ--M3-tsKAnhFzCQAAAME"]
[Fri Apr 24 04:47:11.737010 2026] [:error] [pid 19101:tid 19138] [client 158.158.109.204:35815] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aeqFT2AHj9bEvrTgbO22AQAAAEE"]
[Fri Apr 24 04:47:14.374194 2026] [:error] [pid 19102:tid 19184] [client 158.158.109.204:20956] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aeqFUgDSgrbLEZbkqD6gzgAAAJQ"]
[Fri Apr 24 04:47:16.751322 2026] [:error] [pid 19102:tid 19169] [client 158.158.109.204:12519] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aeqFVADSgrbLEZbkqD6g0gAAAIU"]
[Fri Apr 24 04:47:20.525316 2026] [:error] [pid 19102:tid 19170] [client 158.158.109.204:2304] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/as.php"] [unique_id "aeqFWADSgrbLEZbkqD6g2gAAAIY"]
[Fri Apr 24 04:47:26.446625 2026] [:error] [pid 52129:tid 52138] [client 158.158.109.204:2286] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ctex1.php"] [unique_id "aeqFXuKCZKf8_u2LKiAl8wAAAQU"]
[Fri Apr 24 04:47:28.670943 2026] [:error] [pid 19200:tid 19216] [client 158.158.109.204:2182] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ctex1.php"] [unique_id "aeqFYDQ--M3-tsKAnhFzPwAAAMg"]
[Fri Apr 24 04:47:32.991892 2026] [:error] [pid 52129:tid 52157] [client 158.158.109.204:20989] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ctex1.php"] [unique_id "aeqFZOKCZKf8_u2LKiAmFwAAARg"]
[Fri Apr 24 04:47:34.203630 2026] [:error] [pid 52129:tid 52153] [client 158.158.109.204:2215] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ctex1.php"] [unique_id "aeqFZuKCZKf8_u2LKiAmIAAAARQ"]
[Fri Apr 24 04:47:35.410762 2026] [:error] [pid 52129:tid 52157] [client 158.158.109.204:14479] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeqFZ-KCZKf8_u2LKiAmKAAAARg"]
[Fri Apr 24 04:47:36.945211 2026] [:error] [pid 19200:tid 19219] [client 158.158.109.204:2194] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeqFaDQ--M3-tsKAnhFzYAAAAMs"]
[Fri Apr 24 04:47:39.040369 2026] [:error] [pid 19200:tid 19213] [client 158.158.109.204:13485] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeqFazQ--M3-tsKAnhFzawAAAMU"]
[Fri Apr 24 04:47:39.855949 2026] [:error] [pid 52129:tid 52141] [client 158.158.109.204:12539] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/lb.php"] [unique_id "aeqFa-KCZKf8_u2LKiAmNgAAAQg"]
[Fri Apr 24 04:47:44.134629 2026] [:error] [pid 19200:tid 19223] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Fri Apr 24 04:47:44.380040 2026] [:error] [pid 19200:tid 19229] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Fri Apr 24 04:47:44.622534 2026] [:error] [pid 19200:tid 19213] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/fone1.php
[Fri Apr 24 04:47:44.863592 2026] [:error] [pid 19200:tid 19224] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/auth.php
[Fri Apr 24 04:47:45.108656 2026] [:error] [pid 19200:tid 19214] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Fri Apr 24 04:47:45.351478 2026] [:error] [pid 19200:tid 19221] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Apr 24 04:47:45.594117 2026] [:error] [pid 19200:tid 19232] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Fri Apr 24 04:47:46.170157 2026] [:error] [pid 19200:tid 19222] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Fri Apr 24 04:47:46.749005 2026] [:error] [pid 19200:tid 19227] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Fri Apr 24 04:47:47.442131 2026] [:error] [pid 19200:tid 19210] [client 158.158.109.204:14481] File does not exist: /usr/local/apache/htdocs/suspended-page/bfil.php
[Fri Apr 24 04:47:47.684425 2026] [:error] [pid 19200:tid 19209] [client 158.158.109.204:14481] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abrand.php"] [unique_id "aeqFczQ--M3-tsKAnhFzmQAAAME"]
[Fri Apr 24 04:47:48.915930 2026] [:error] [pid 52129:tid 52157] [client 158.158.109.204:24606] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abrand.php"] [unique_id "aeqFdOKCZKf8_u2LKiAmTAAAARg"]
[Fri Apr 24 04:47:50.110012 2026] [:error] [pid 19200:tid 19218] [client 158.158.109.204:23692] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abrand.php"] [unique_id "aeqFdjQ--M3-tsKAnhFzngAAAMo"]
[Fri Apr 24 04:47:52.960031 2026] [:error] [pid 19200:tid 19225] [client 158.158.109.204:25577] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abrand.php"] [unique_id "aeqFeDQ--M3-tsKAnhFzrgAAANE"]
[Fri Apr 24 04:47:54.693822 2026] [:error] [pid 19102:tid 19186] [client 158.158.109.204:2382] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "aeqFegDSgrbLEZbkqD6hMQAAAJY"]
[Fri Apr 24 04:47:56.645276 2026] [:error] [pid 19100:tid 19121] [client 158.158.109.204:24805] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "aeqFfLF_hzQs4CqbiffyzQAAAAs"]
[Fri Apr 24 04:47:59.072125 2026] [:error] [pid 19100:tid 19124] [client 158.158.109.204:26244] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "aeqFf7F_hzQs4Cqbiffy1gAAAA4"]
[Fri Apr 24 04:48:03.447149 2026] [:error] [pid 52129:tid 52134] [client 158.158.109.204:26296] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amax.php"] [unique_id "aeqFg-KCZKf8_u2LKiAmawAAAQE"]
[Fri Apr 24 04:48:05.499869 2026] [:error] [pid 19100:tid 19120] [client 158.158.109.204:12791] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeqFhbF_hzQs4Cqbiffy6gAAAAo"]
[Fri Apr 24 04:48:07.877068 2026] [:error] [pid 19100:tid 19125] [client 158.158.109.204:10634] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeqFh7F_hzQs4Cqbiffy8wAAAA8"]
[Fri Apr 24 04:48:09.804437 2026] [:error] [pid 52129:tid 52153] [client 158.158.109.204:17414] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeqFieKCZKf8_u2LKiAmggAAARQ"]
[Fri Apr 24 04:48:10.979570 2026] [:error] [pid 52129:tid 52156] [client 158.158.109.204:20384] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/classwithtostring.php"] [unique_id "aeqFiuKCZKf8_u2LKiAmjQAAARc"]
[Fri Apr 24 04:48:12.617172 2026] [:error] [pid 19101:tid 19161] [client 158.158.109.204:26240] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amwxl.php"] [unique_id "aeqFjGAHj9bEvrTgbO22YAAAAFg"]
[Fri Apr 24 04:48:13.684684 2026] [:error] [pid 19101:tid 19141] [client 158.158.109.204:29126] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amwxl.php"] [unique_id "aeqFjWAHj9bEvrTgbO22aQAAAEQ"]
[Fri Apr 24 04:48:14.979762 2026] [:error] [pid 52129:tid 52146] [client 158.158.109.204:15714] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amwxl.php"] [unique_id "aeqFjuKCZKf8_u2LKiAmqQAAAQ0"]
[Fri Apr 24 04:48:16.645003 2026] [:error] [pid 52129:tid 52156] [client 158.158.109.204:13816] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/amwxl.php"] [unique_id "aeqFkOKCZKf8_u2LKiAmtAAAARc"]
[Fri Apr 24 04:48:18.616101 2026] [:error] [pid 52129:tid 52138] [client 158.158.109.204:15705] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeqFkuKCZKf8_u2LKiAmygAAAQU"]
[Fri Apr 24 04:48:19.648319 2026] [:error] [pid 19102:tid 19167] [client 158.158.109.204:17411] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeqFkwDSgrbLEZbkqD6haQAAAIM"]
[Fri Apr 24 04:48:20.614276 2026] [:error] [pid 19100:tid 19111] [client 158.158.109.204:13208] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeqFlLF_hzQs4CqbiffzDQAAAAI"]
[Fri Apr 24 04:48:21.934604 2026] [:error] [pid 19100:tid 19125] [client 158.158.109.204:20099] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wmore1.php"] [unique_id "aeqFlbF_hzQs4CqbiffzEAAAAA8"]
[Fri Apr 24 04:48:23.990618 2026] [:error] [pid 19101:tid 19154] [client 158.158.109.204:17920] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/userfuns.php"] [unique_id "aeqFl2AHj9bEvrTgbO22eQAAAFE"]
[Fri Apr 24 04:48:24.949728 2026] [:error] [pid 19102:tid 19174] [client 158.158.109.204:28856] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/userfuns.php"] [unique_id "aeqFmADSgrbLEZbkqD6hcwAAAIo"]
[Fri Apr 24 04:48:27.320152 2026] [:error] [pid 52129:tid 52150] [client 158.158.109.204:15363] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/userfuns.php"] [unique_id "aeqFm-KCZKf8_u2LKiAm9wAAARE"]
[Fri Apr 24 04:48:30.895141 2026] [:error] [pid 19101:tid 19145] [client 158.158.109.204:22597] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/userfuns.php"] [unique_id "aeqFnmAHj9bEvrTgbO22fgAAAEg"]
[Fri Apr 24 04:48:33.302983 2026] [:error] [pid 19200:tid 19215] [client 158.158.109.204:23363] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aeqFoTQ--M3-tsKAnhF0KAAAAMc"]
[Fri Apr 24 04:48:36.738190 2026] [:error] [pid 52129:tid 52150] [client 158.158.109.204:23608] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aeqFpOKCZKf8_u2LKiAnIAAAARE"]
[Fri Apr 24 04:48:38.542645 2026] [:error] [pid 19200:tid 19208] [client 158.158.109.204:43830] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aeqFpjQ--M3-tsKAnhF0VQAAAMA"]
[Fri Apr 24 04:48:40.013468 2026] [:error] [pid 52129:tid 52156] [client 158.158.109.204:63810] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/menu.php"] [unique_id "aeqFqOKCZKf8_u2LKiAnKQAAARc"]
[Fri Apr 24 04:48:42.290152 2026] [:error] [pid 19101:tid 19155] [client 158.158.109.204:43824] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aeqFqmAHj9bEvrTgbO22lwAAAFI"]
[Fri Apr 24 04:48:44.010145 2026] [:error] [pid 52129:tid 52135] [client 158.158.109.204:22374] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aeqFrOKCZKf8_u2LKiAnOgAAAQI"]
[Fri Apr 24 04:48:45.692038 2026] [:error] [pid 19200:tid 19232] [client 158.158.109.204:21496] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aeqFrTQ--M3-tsKAnhF0hQAAANg"]
[Fri Apr 24 04:48:53.504867 2026] [:error] [pid 19101:tid 19142] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Fri Apr 24 04:48:53.787068 2026] [:error] [pid 19101:tid 19137] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/saorix1.php
[Fri Apr 24 04:48:54.052936 2026] [:error] [pid 19101:tid 19145] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Fri Apr 24 04:48:54.320554 2026] [:error] [pid 19101:tid 19158] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Fri Apr 24 04:48:54.587479 2026] [:error] [pid 19101:tid 19154] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/gptsh.php
[Fri Apr 24 04:48:55.312434 2026] [:error] [pid 19101:tid 19156] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Fri Apr 24 04:48:55.576159 2026] [:error] [pid 19101:tid 19155] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Apr 24 04:48:55.845966 2026] [:error] [pid 19101:tid 19149] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 24 04:48:56.110289 2026] [:error] [pid 19101:tid 19148] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/bolt.php
[Fri Apr 24 04:48:56.374389 2026] [:error] [pid 19101:tid 19151] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/koiy.php
[Fri Apr 24 04:48:56.642172 2026] [:error] [pid 19101:tid 19160] [client 158.158.109.204:43807] File does not exist: /usr/local/apache/htdocs/suspended-page/albin.php
[Fri Apr 24 04:48:56.914277 2026] [:error] [pid 19101:tid 19161] [client 158.158.109.204:43807] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeqFuGAHj9bEvrTgbO22tgAAAFg"]
[Fri Apr 24 04:48:59.840771 2026] [:error] [pid 19100:tid 19116] [client 158.158.109.204:22386] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeqFu7F_hzQs4CqbiffzVQAAAAc"]
[Fri Apr 24 04:49:03.123984 2026] [:error] [pid 19100:tid 19124] [client 158.158.109.204:22134] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeqFv7F_hzQs4CqbiffzWQAAAA4"]
[Fri Apr 24 04:49:05.693990 2026] [:error] [pid 52129:tid 52157] [client 158.158.109.204:23557] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeqFweKCZKf8_u2LKiAnlwAAARg"]
[Fri Apr 24 04:49:07.937444 2026] [:error] [pid 19100:tid 19133] [client 158.158.109.204:23605] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sa.php7"] [unique_id "aeqFw7F_hzQs4CqbiffzZgAAABc"]
[Fri Apr 24 04:49:09.830323 2026] [:error] [pid 19200:tid 19217] [client 158.158.109.204:12455] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sa.php7"] [unique_id "aeqFxTQ--M3-tsKAnhF03wAAAMk"]
[Fri Apr 24 04:49:11.498340 2026] [:error] [pid 19102:tid 19186] [client 158.158.109.204:15375] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sa.php7"] [unique_id "aeqFxwDSgrbLEZbkqD6h4gAAAJY"]
[Fri Apr 24 04:49:12.482300 2026] [:error] [pid 19100:tid 19111] [client 158.158.109.204:23384] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sa.php7"] [unique_id "aeqFyLF_hzQs4CqbiffzbAAAAAI"]
[Fri Apr 24 04:49:13.834339 2026] [:error] [pid 19102:tid 19173] [client 158.158.109.204:29521] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "aeqFyQDSgrbLEZbkqD6h7QAAAIk"]
[Fri Apr 24 04:49:14.680958 2026] [:error] [pid 19200:tid 19224] [client 158.158.109.204:23402] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "aeqFyjQ--M3-tsKAnhF08gAAANA"]
[Fri Apr 24 04:49:16.158738 2026] [:error] [pid 19100:tid 19125] [client 158.158.109.204:8548] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "aeqFzLF_hzQs4CqbiffzdAAAAA8"]
[Fri Apr 24 04:49:19.535404 2026] [:error] [pid 19100:tid 19113] [client 158.158.109.204:13190] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a7.php"] [unique_id "aeqFz7F_hzQs4CqbiffzfQAAAAQ"]
[Fri Apr 24 04:49:22.212312 2026] [:error] [pid 52129:tid 52139] [client 158.158.109.204:13800] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "aeqF0uKCZKf8_u2LKiAn0wAAAQY"]
[Fri Apr 24 04:49:25.196732 2026] [:error] [pid 52129:tid 52140] [client 158.158.109.204:22494] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "aeqF1eKCZKf8_u2LKiAn4QAAAQc"]
[Fri Apr 24 04:49:26.762622 2026] [:error] [pid 52129:tid 52145] [client 158.158.109.204:23723] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "aeqF1uKCZKf8_u2LKiAn8gAAAQw"]
[Fri Apr 24 04:49:29.681830 2026] [:error] [pid 52129:tid 52155] [client 158.158.109.204:14937] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp9.php"] [unique_id "aeqF2eKCZKf8_u2LKiAoDwAAARY"]
[Fri Apr 24 04:49:31.817003 2026] [:error] [pid 19101:tid 19140] [client 158.158.109.204:15895] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aeqF22AHj9bEvrTgbO23AQAAAEM"]
[Fri Apr 24 04:49:34.455296 2026] [:error] [pid 19100:tid 19130] [client 158.158.109.204:24882] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aeqF3rF_hzQs4CqbiffztAAAABQ"]
[Fri Apr 24 04:49:36.009227 2026] [:error] [pid 19200:tid 19226] [client 158.158.109.204:19922] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aeqF4DQ--M3-tsKAnhF1JwAAANI"]
[Fri Apr 24 04:49:36.583296 2026] [:error] [pid 19102:tid 19168] [client 158.158.109.204:24882] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bthil.php"] [unique_id "aeqF4ADSgrbLEZbkqD6iGQAAAIQ"]
[Fri Apr 24 04:49:39.143822 2026] [:error] [pid 19100:tid 19116] [client 158.158.109.204:20440] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp5.php"] [unique_id "aeqF47F_hzQs4CqbiffzwgAAAAc"]
[Fri Apr 24 04:49:40.795351 2026] [:error] [pid 19101:tid 19150] [client 158.158.109.204:24843] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp5.php"] [unique_id "aeqF5GAHj9bEvrTgbO23HAAAAE0"]
[Fri Apr 24 04:49:42.838057 2026] [:error] [pid 19101:tid 19138] [client 158.158.109.204:18195] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp5.php"] [unique_id "aeqF5mAHj9bEvrTgbO23JgAAAEE"]
[Fri Apr 24 04:49:44.396437 2026] [:error] [pid 19101:tid 19153] [client 158.158.109.204:12171] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp5.php"] [unique_id "aeqF6GAHj9bEvrTgbO23KwAAAFA"]
[Fri Apr 24 04:49:46.461206 2026] [:error] [pid 52129:tid 52133] [client 158.158.109.204:18224] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeqF6uKCZKf8_u2LKiAobAAAAQA"]
[Fri Apr 24 04:49:49.263737 2026] [:error] [pid 52129:tid 52133] [client 158.158.109.204:13703] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeqF7eKCZKf8_u2LKiAoiwAAAQA"]
[Fri Apr 24 04:49:53.365129 2026] [:error] [pid 19101:tid 19144] [client 158.158.109.204:20434] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yuzuru1.php"] [unique_id "aeqF8WAHj9bEvrTgbO23TAAAAEc"]
[Fri Apr 24 04:49:56.912708 2026] [:error] [pid 19102:tid 19175] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Fri Apr 24 04:49:58.119562 2026] [:error] [pid 19102:tid 19169] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Fri Apr 24 04:49:58.391091 2026] [:error] [pid 19102:tid 19168] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Fri Apr 24 04:49:58.665526 2026] [:error] [pid 19102:tid 19180] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Fri Apr 24 04:49:58.930669 2026] [:error] [pid 19102:tid 19185] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Fri Apr 24 04:49:59.193872 2026] [:error] [pid 19102:tid 19176] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Fri Apr 24 04:49:59.468998 2026] [:error] [pid 19102:tid 19187] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/casp1.php
[Fri Apr 24 04:49:59.740017 2026] [:error] [pid 19102:tid 19178] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/acc.php
[Fri Apr 24 04:50:00.003427 2026] [:error] [pid 19102:tid 19184] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/asasx.php
[Fri Apr 24 04:50:00.276356 2026] [:error] [pid 19102:tid 19167] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Fri Apr 24 04:50:00.562937 2026] [:error] [pid 19102:tid 19171] [client 158.158.109.204:18720] File does not exist: /usr/local/apache/htdocs/suspended-page/packsin1.php
[Fri Apr 24 04:50:00.837702 2026] [:error] [pid 19102:tid 19175] [client 158.158.109.204:18720] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "aeqF-ADSgrbLEZbkqD6ibwAAAIs"]
[Fri Apr 24 04:50:03.908270 2026] [:error] [pid 52129:tid 52138] [client 158.158.109.204:12166] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "aeqF--KCZKf8_u2LKiAo8gAAAQU"]
[Fri Apr 24 04:50:04.966939 2026] [:error] [pid 19101:tid 19161] [client 158.158.109.204:19681] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "aeqF_GAHj9bEvrTgbO23sQAAAFg"]
[Fri Apr 24 04:50:05.993716 2026] [:error] [pid 19102:tid 19173] [client 158.158.109.204:24363] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/press.php"] [unique_id "aeqF_QDSgrbLEZbkqD6ifgAAAIk"]
[Fri Apr 24 04:50:07.134683 2026] [:error] [pid 19100:tid 19125] [client 158.158.109.204:19659] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws78.php"] [unique_id "aeqF_7F_hzQs4Cqbiffz9gAAAA8"]
[Fri Apr 24 04:50:08.349145 2026] [:error] [pid 19200:tid 19208] [client 158.158.109.204:8459] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws78.php"] [unique_id "aeqGADQ--M3-tsKAnhF1rQAAAMA"]
[Fri Apr 24 04:50:09.666927 2026] [:error] [pid 52129:tid 52148] [client 158.158.109.204:24361] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws78.php"] [unique_id "aeqGAeKCZKf8_u2LKiApGwAAAQ8"]
[Fri Apr 24 04:50:13.909525 2026] [:error] [pid 19200:tid 19218] [client 158.158.109.204:19652] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws78.php"] [unique_id "aeqGBTQ--M3-tsKAnhF1zAAAAMo"]
[Fri Apr 24 04:50:16.283707 2026] [:error] [pid 52129:tid 52143] [client 158.158.109.204:23167] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/motu.php"] [unique_id "aeqGCOKCZKf8_u2LKiApPQAAAQo"]
[Fri Apr 24 04:50:17.141719 2026] [:error] [pid 19200:tid 19214] [client 158.158.109.204:10689] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/motu.php"] [unique_id "aeqGCTQ--M3-tsKAnhF14wAAAMY"]
[Fri Apr 24 04:50:20.980719 2026] [:error] [pid 19101:tid 19143] [client 158.158.109.204:18526] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/motu.php"] [unique_id "aeqGDGAHj9bEvrTgbO24HwAAAEY"]
[Fri Apr 24 04:50:22.413431 2026] [:error] [pid 19101:tid 19159] [client 158.158.109.204:2865] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/motu.php"] [unique_id "aeqGDmAHj9bEvrTgbO24IQAAAFY"]
[Fri Apr 24 04:50:23.771617 2026] [:error] [pid 19200:tid 19229] [client 158.158.109.204:7432] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeqGDzQ--M3-tsKAnhF2HAAAANU"]
[Fri Apr 24 04:50:24.754573 2026] [:error] [pid 19102:tid 19169] [client 158.158.109.204:13513] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeqGEADSgrbLEZbkqD6ivwAAAIU"]
[Fri Apr 24 04:50:26.802950 2026] [:error] [pid 19102:tid 19164] [client 158.158.109.204:10714] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeqGEgDSgrbLEZbkqD6izgAAAIA"]
[Fri Apr 24 04:50:28.952731 2026] [:error] [pid 19200:tid 19215] [client 158.158.109.204:16950] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hplfuns.php"] [unique_id "aeqGFDQ--M3-tsKAnhF2NQAAAMc"]
[Fri Apr 24 04:50:30.357167 2026] [:error] [pid 19101:tid 19156] [client 158.158.109.204:2819] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aeqGFmAHj9bEvrTgbO24NQAAAFM"]
[Fri Apr 24 04:50:31.840554 2026] [:error] [pid 19200:tid 19217] [client 158.158.109.204:10398] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aeqGFzQ--M3-tsKAnhF2TAAAAMk"]
[Fri Apr 24 04:50:33.610052 2026] [:error] [pid 52129:tid 52133] [client 158.158.109.204:22407] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aeqGGeKCZKf8_u2LKiApewAAAQA"]
[Fri Apr 24 04:50:36.072428 2026] [:error] [pid 19102:tid 19180] [client 158.158.109.204:22431] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xa.php"] [unique_id "aeqGHADSgrbLEZbkqD6i-gAAAJA"]
[Fri Apr 24 04:50:38.578754 2026] [:error] [pid 19200:tid 19221] [client 158.158.109.204:22448] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8573.php"] [unique_id "aeqGHjQ--M3-tsKAnhF2awAAAM0"]
[Fri Apr 24 04:50:39.781221 2026] [:error] [pid 19101:tid 19149] [client 158.158.109.204:2473] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8573.php"] [unique_id "aeqGH2AHj9bEvrTgbO24SgAAAEw"]
[Fri Apr 24 04:50:40.625914 2026] [:error] [pid 19101:tid 19151] [client 158.158.109.204:25620] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8573.php"] [unique_id "aeqGIGAHj9bEvrTgbO24TQAAAE4"]
[Fri Apr 24 04:50:42.348911 2026] [:error] [pid 19200:tid 19211] [client 158.158.109.204:25611] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8573.php"] [unique_id "aeqGIjQ--M3-tsKAnhF2dQAAAMM"]
[Fri Apr 24 04:50:43.622067 2026] [:error] [pid 52129:tid 52141] [client 158.158.109.204:34806] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeqGI-KCZKf8_u2LKiApoQAAAQg"]
[Fri Apr 24 04:50:45.795939 2026] [:error] [pid 19200:tid 19224] [client 158.158.109.204:17012] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeqGJTQ--M3-tsKAnhF2jAAAANA"]
[Fri Apr 24 04:50:47.826794 2026] [:error] [pid 19200:tid 19210] [client 158.158.109.204:16960] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeqGJzQ--M3-tsKAnhF2mgAAAMI"]
[Fri Apr 24 04:50:48.744410 2026] [:error] [pid 52129:tid 52154] [client 158.158.109.204:21137] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sadcut1.php"] [unique_id "aeqGKOKCZKf8_u2LKiApqwAAARU"]
[Fri Apr 24 04:50:49.904424 2026] [:error] [pid 52129:tid 52136] [client 158.158.109.204:2632] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aeqGKeKCZKf8_u2LKiAprwAAAQM"]
[Fri Apr 24 04:50:51.844533 2026] [:error] [pid 19102:tid 19177] [client 158.158.109.204:18813] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aeqGKwDSgrbLEZbkqD6jDQAAAI0"]
[Fri Apr 24 04:50:53.653807 2026] [:error] [pid 19200:tid 19213] [client 158.158.109.204:2455] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aeqGLTQ--M3-tsKAnhF2qgAAAMU"]
[Fri Apr 24 04:50:55.214394 2026] [:error] [pid 19200:tid 19219] [client 158.158.109.204:20907] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aeqGLzQ--M3-tsKAnhF2tAAAAMs"]
[Fri Apr 24 04:50:56.615640 2026] [:error] [pid 19102:tid 19170] [client 158.158.109.204:18805] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aeqGMADSgrbLEZbkqD6jGAAAAIY"]
[Fri Apr 24 04:50:58.487198 2026] [:error] [pid 19200:tid 19213] [client 158.158.109.204:34764] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/xwx1.php"] [unique_id "aeqGMjQ--M3-tsKAnhF2xAAAAMU"]
[Fri Apr 24 04:51:01.971640 2026] [:error] [pid 19102:tid 19181] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/xwx1.php
[Fri Apr 24 04:51:02.236984 2026] [:error] [pid 19102:tid 19169] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/prosellers8.php
[Fri Apr 24 04:51:02.500443 2026] [:error] [pid 19102:tid 19171] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/shop.php
[Fri Apr 24 04:51:02.797572 2026] [:error] [pid 19102:tid 19166] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/ww.php
[Fri Apr 24 04:51:03.062366 2026] [:error] [pid 19102:tid 19182] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/fsjzs.php
[Fri Apr 24 04:51:03.329836 2026] [:error] [pid 19102:tid 19168] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/cwclass.php
[Fri Apr 24 04:51:03.670317 2026] [:error] [pid 19102:tid 19184] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/edit-tags.php
[Fri Apr 24 04:51:03.969864 2026] [:error] [pid 19102:tid 19187] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri Apr 24 04:51:04.234803 2026] [:error] [pid 19102:tid 19176] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Fri Apr 24 04:51:04.500009 2026] [:error] [pid 19102:tid 19173] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Fri Apr 24 04:51:04.764208 2026] [:error] [pid 19102:tid 19170] [client 158.158.109.204:25610] File does not exist: /usr/local/apache/htdocs/suspended-page/ai.php
[Fri Apr 24 04:51:05.040687 2026] [:error] [pid 19102:tid 19177] [client 158.158.109.204:25610] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeqGOQDSgrbLEZbkqD6jPAAAAI0"]
[Fri Apr 24 04:51:07.240219 2026] [:error] [pid 19100:tid 19112] [client 158.158.109.204:7515] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeqGO7F_hzQs4Cqbiff0OgAAAAM"]
[Fri Apr 24 04:51:10.367123 2026] [:error] [pid 19102:tid 19174] [client 158.158.109.204:25616] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeqGPgDSgrbLEZbkqD6jTAAAAIo"]
[Fri Apr 24 04:51:11.939409 2026] [:error] [pid 52129:tid 52134] [client 158.158.109.204:21181] [client 158.158.109.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeqGP-KCZKf8_u2LKiAp9AAAAQE"]
[Fri Apr 24 08:45:54.303788 2026] [:error] [pid 52129:tid 52151] [client 43.166.244.192:43270] [client 43.166.244.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aeq9QuKCZKf8_u2LKiAbzgAAARI"]
[Fri Apr 24 10:02:33.939501 2026] [:error] [pid 19101:tid 19154] [client 101.32.239.179:51618] [client 101.32.239.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aerPOWAHj9bEvrTgbO0_swAAAFE"]
[Fri Apr 24 10:32:04.481836 2026] [:error] [pid 17721:tid 17802] [client 194.26.192.182:59421] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aerWJOFXXkLeyDnfk_96uwAAABU"]
[Fri Apr 24 10:32:04.985811 2026] [:error] [pid 17808:tid 17833] [client 194.26.192.182:59525] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aerWJOarbOEFI8qshvI74wAAAFc"]
[Fri Apr 24 10:32:05.489850 2026] [:error] [pid 17719:tid 17749] [client 194.26.192.182:59662] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aerWJcTZ9gzEyL1BkPrHOAAAAJY"]
[Fri Apr 24 10:32:05.995125 2026] [:error] [pid 22114:tid 22117] [client 194.26.192.182:59963] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aerWJYAuWGz3WlMQjodp9QAAAQA"]
[Fri Apr 24 10:32:06.498888 2026] [:error] [pid 17808:tid 17828] [client 194.26.192.182:60278] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "aerWJuarbOEFI8qshvI8TgAAAFI"]
[Fri Apr 24 10:37:40.985077 2026] [:error] [pid 17721:tid 17804] [client 43.163.4.179:59076] [client 43.163.4.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aerXdOFXXkLeyDnfk_99HgAAABc"]
[Fri Apr 24 11:10:42.070344 2026] [:error] [pid 17720:tid 17770] [client 43.156.34.42:59600] [client 43.156.34.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aerfMuhlUs6BS3Ng7_W8kwAAANA"]
[Fri Apr 24 11:41:12.876673 2026] [:error] [pid 17721:tid 17800] [client 150.109.21.93:39816] [client 150.109.21.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aermWOFXXkLeyDnfk_-RaAAAABM"]
[Fri Apr 24 11:53:02.050678 2026] [:error] [pid 17719:tid 17727] [client 43.153.7.191:50540] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aerpHsTZ9gzEyL1BkPr4fwAAAIA"]
[Fri Apr 24 12:10:33.275211 2026] [:error] [pid 17719:tid 17727] [client 43.134.98.88:55682] [client 43.134.98.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aertOcTZ9gzEyL1BkPoK6wAAAIA"]
[Fri Apr 24 12:42:37.976643 2026] [:error] [pid 17720:tid 17767] [client 43.159.57.144:40250] [client 43.159.57.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aer0vehlUs6BS3Ng7_XeaQAAAM0"]
[Fri Apr 24 13:14:39.407363 2026] [:error] [pid 17808:tid 17821] [client 43.163.5.216:41498] [client 43.163.5.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aer8P-arbOEFI8qshvKLhwAAAEs"]
[Fri Apr 24 14:41:51.228642 2026] [:error] [pid 14531:tid 14546] [client 43.128.89.111:50700] [client 43.128.89.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aesQr3fLU2gw-6KR-GZObwAAAU0"]
[Fri Apr 24 15:12:37.286693 2026] [:error] [pid 17721:tid 17782] [client 43.166.165.124:48306] [client 43.166.165.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aesX5eFXXkLeyDnfk__jJwAAAAE"]
[Fri Apr 24 15:41:51.741921 2026] [:error] [pid 17808:tid 17827] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/error.php
[Fri Apr 24 15:41:52.011276 2026] [:error] [pid 17808:tid 17816] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Fri Apr 24 15:41:52.356299 2026] [:error] [pid 17808:tid 17813] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Fri Apr 24 15:41:52.626433 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/.sghb.php
[Fri Apr 24 15:41:52.894890 2026] [:error] [pid 17808:tid 17833] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/zoko.php
[Fri Apr 24 15:41:53.163569 2026] [:error] [pid 17808:tid 17815] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/solo1.php
[Fri Apr 24 15:41:53.431964 2026] [:error] [pid 17808:tid 17819] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/locales.php
[Fri Apr 24 15:41:53.701435 2026] [:error] [pid 17808:tid 17832] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Fri Apr 24 15:41:53.972471 2026] [:error] [pid 17808:tid 17831] [client 20.240.45.42:51093] File does not exist: /usr/local/apache/htdocs/suspended-page/pucci.php
[Fri Apr 24 15:41:54.558599 2026] [:error] [pid 17808:tid 17829] [client 20.240.45.42:51093] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "aesewuarbOEFI8qshvK-RQAAAFM"]
[Fri Apr 24 15:41:55.155973 2026] [:error] [pid 14531:tid 14533] [client 20.240.45.42:61212] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "aesew3fLU2gw-6KR-GZonwAAAUA"]
[Fri Apr 24 15:41:55.690050 2026] [:error] [pid 17720:tid 17754] [client 20.240.45.42:64174] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "aesew-hlUs6BS3Ng7_UMLAAAAMA"]
[Fri Apr 24 15:41:56.321066 2026] [:error] [pid 17720:tid 17767] [client 20.240.45.42:51839] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "aesexOhlUs6BS3Ng7_UMMgAAAM0"]
[Fri Apr 24 15:41:56.952730 2026] [:error] [pid 17719:tid 17728] [client 20.240.45.42:60436] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aesexMTZ9gzEyL1BkPpo4QAAAIE"]
[Fri Apr 24 15:41:57.620115 2026] [:error] [pid 22114:tid 22135] [client 20.240.45.42:44986] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aesexYAuWGz3WlMQjoe2ugAAARI"]
[Fri Apr 24 15:41:58.234060 2026] [:error] [pid 22114:tid 22118] [client 20.240.45.42:44088] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aesexoAuWGz3WlMQjoe2uwAAAQE"]
[Fri Apr 24 15:41:58.772016 2026] [:error] [pid 22114:tid 22136] [client 20.240.45.42:4804] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "aesexoAuWGz3WlMQjoe2wAAAARM"]
[Fri Apr 24 15:41:59.306309 2026] [:error] [pid 14531:tid 14538] [client 20.240.45.42:44094] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "aesex3fLU2gw-6KR-GZooQAAAUU"]
[Fri Apr 24 15:42:00.029508 2026] [:error] [pid 17719:tid 17745] [client 20.240.45.42:61190] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "aeseyMTZ9gzEyL1BkPpo7QAAAJI"]
[Fri Apr 24 15:42:00.589572 2026] [:error] [pid 17719:tid 17728] [client 20.240.45.42:60456] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "aeseyMTZ9gzEyL1BkPpo8AAAAIE"]
[Fri Apr 24 15:42:01.166343 2026] [:error] [pid 22114:tid 22141] [client 20.240.45.42:4819] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "aeseyYAuWGz3WlMQjoe2xQAAARg"]
[Fri Apr 24 15:42:01.732170 2026] [:error] [pid 17721:tid 17795] [client 20.240.45.42:54556] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.admin.php"] [unique_id "aeseyeFXXkLeyDnfk__twgAAAA4"]
[Fri Apr 24 15:42:02.295371 2026] [:error] [pid 17720:tid 17762] [client 20.240.45.42:51804] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.admin.php"] [unique_id "aeseyuhlUs6BS3Ng7_UMNQAAAMg"]
[Fri Apr 24 15:42:02.973818 2026] [:error] [pid 17721:tid 17800] [client 20.240.45.42:61222] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.admin.php"] [unique_id "aeseyuFXXkLeyDnfk__txwAAABM"]
[Fri Apr 24 15:42:03.725495 2026] [:error] [pid 17721:tid 17801] [client 20.240.45.42:44087] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.admin.php"] [unique_id "aesey-FXXkLeyDnfk__tyQAAABQ"]
[Fri Apr 24 15:42:04.313419 2026] [:error] [pid 17721:tid 17805] [client 20.240.45.42:56805] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sw.php"] [unique_id "aesezOFXXkLeyDnfk__tygAAABg"]
[Fri Apr 24 15:42:04.876077 2026] [:error] [pid 14531:tid 14555] [client 20.240.45.42:56092] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sw.php"] [unique_id "aesezHfLU2gw-6KR-GZosgAAAVY"]
[Fri Apr 24 15:42:05.515437 2026] [:error] [pid 17808:tid 17830] [client 20.240.45.42:44958] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sw.php"] [unique_id "aesezearbOEFI8qshvK-SgAAAFQ"]
[Fri Apr 24 15:42:06.147554 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:56778] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sw.php"] [unique_id "aesezuhlUs6BS3Ng7_UMPgAAAMw"]
[Fri Apr 24 15:42:06.862112 2026] [:error] [pid 17721:tid 17799] [client 20.240.45.42:51812] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vuln.php"] [unique_id "aesezuFXXkLeyDnfk__tzwAAABI"]
[Fri Apr 24 15:42:07.638246 2026] [:error] [pid 17720:tid 17772] [client 20.240.45.42:61227] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vuln.php"] [unique_id "aesez-hlUs6BS3Ng7_UMRAAAANI"]
[Fri Apr 24 15:42:08.378675 2026] [:error] [pid 17720:tid 17761] [client 20.240.45.42:44962] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vuln.php"] [unique_id "aese0OhlUs6BS3Ng7_UMSAAAAMc"]
[Fri Apr 24 15:42:09.252828 2026] [:error] [pid 17720:tid 17777] [client 20.240.45.42:4947] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vuln.php"] [unique_id "aese0ehlUs6BS3Ng7_UMSwAAANc"]
[Fri Apr 24 15:42:09.952884 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:56818] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aese0ehlUs6BS3Ng7_UMTgAAAMw"]
[Fri Apr 24 15:42:10.649876 2026] [:error] [pid 17720:tid 17774] [client 20.240.45.42:44075] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aese0uhlUs6BS3Ng7_UMUwAAANQ"]
[Fri Apr 24 15:42:11.239300 2026] [:error] [pid 17720:tid 17761] [client 20.240.45.42:44968] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aese0-hlUs6BS3Ng7_UMWAAAAMc"]
[Fri Apr 24 15:42:11.836378 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:56104] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "aese0-hlUs6BS3Ng7_UMXQAAAMw"]
[Fri Apr 24 15:42:12.432851 2026] [:error] [pid 17720:tid 17755] [client 20.240.45.42:64134] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aese1OhlUs6BS3Ng7_UMYAAAAME"]
[Fri Apr 24 15:42:13.088865 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:61185] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aese1ehlUs6BS3Ng7_UMYwAAAMw"]
[Fri Apr 24 15:42:13.623469 2026] [:error] [pid 17720:tid 17772] [client 20.240.45.42:4985] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aese1ehlUs6BS3Ng7_UMaAAAANI"]
[Fri Apr 24 15:42:14.309171 2026] [:error] [pid 17721:tid 17804] [client 20.240.45.42:51084] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sxdfrt.php"] [unique_id "aese1uFXXkLeyDnfk__t2QAAABc"]
[Fri Apr 24 15:42:15.068378 2026] [:error] [pid 17808:tid 17819] [client 20.240.45.42:64155] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aese1-arbOEFI8qshvK-VwAAAEk"]
[Fri Apr 24 15:42:15.680681 2026] [:error] [pid 17808:tid 17831] [client 20.240.45.42:54540] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aese1-arbOEFI8qshvK-WAAAAFU"]
[Fri Apr 24 15:42:16.347819 2026] [:error] [pid 17721:tid 17791] [client 20.240.45.42:54531] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aese2OFXXkLeyDnfk__t3wAAAAo"]
[Fri Apr 24 15:42:16.912904 2026] [:error] [pid 17720:tid 17774] [client 20.240.45.42:44985] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aese2OhlUs6BS3Ng7_UMawAAANQ"]
[Fri Apr 24 15:42:17.507488 2026] [:error] [pid 17720:tid 17761] [client 20.240.45.42:53813] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aese2ehlUs6BS3Ng7_UMcQAAAMc"]
[Fri Apr 24 15:42:18.101354 2026] [:error] [pid 17720:tid 17756] [client 20.240.45.42:4852] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aese2uhlUs6BS3Ng7_UMdAAAAMI"]
[Fri Apr 24 15:42:18.771855 2026] [:error] [pid 14531:tid 14557] [client 20.240.45.42:64148] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aese2nfLU2gw-6KR-GZozgAAAVg"]
[Fri Apr 24 15:42:19.355973 2026] [:error] [pid 22114:tid 22134] [client 20.240.45.42:52303] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aese24AuWGz3WlMQjoe24AAAARE"]
[Fri Apr 24 15:42:19.938861 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:56769] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aese2-hlUs6BS3Ng7_UMhQAAAMw"]
[Fri Apr 24 15:42:20.526213 2026] [:error] [pid 17720:tid 17776] [client 20.240.45.42:52329] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aese3OhlUs6BS3Ng7_UMhgAAANY"]
[Fri Apr 24 15:42:21.245064 2026] [:error] [pid 22114:tid 22132] [client 20.240.45.42:52349] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aese3YAuWGz3WlMQjoe25AAAAQ8"]
[Fri Apr 24 15:42:21.835673 2026] [:error] [pid 17720:tid 17769] [client 20.240.45.42:51796] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-bda.php"] [unique_id "aese3ehlUs6BS3Ng7_UMigAAAM8"]
[Fri Apr 24 15:42:24.176111 2026] [:error] [pid 17720:tid 17756] [client 20.240.45.42:53761] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aese4OhlUs6BS3Ng7_UMlQAAAMI"]
[Fri Apr 24 15:42:24.810639 2026] [:error] [pid 17720:tid 17756] [client 20.240.45.42:53727] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aese4OhlUs6BS3Ng7_UMmwAAAMI"]
[Fri Apr 24 15:42:26.194319 2026] [:error] [pid 17721:tid 17802] [client 20.240.45.42:45875] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aese4uFXXkLeyDnfk__t4gAAABU"]
[Fri Apr 24 15:42:26.902798 2026] [:error] [pid 17721:tid 17804] [client 20.240.45.42:52292] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bhm.php"] [unique_id "aese4uFXXkLeyDnfk__t4wAAABc"]
[Fri Apr 24 15:42:27.643933 2026] [:error] [pid 17808:tid 17828] [client 20.240.45.42:58814] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aese4-arbOEFI8qshvK-cAAAAFI"]
[Fri Apr 24 15:42:28.242827 2026] [:error] [pid 17719:tid 17732] [client 20.240.45.42:58793] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aese5MTZ9gzEyL1BkPpo_gAAAIU"]
[Fri Apr 24 15:42:28.878561 2026] [:error] [pid 17808:tid 17831] [client 20.240.45.42:49198] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aese5OarbOEFI8qshvK-dgAAAFU"]
[Fri Apr 24 15:42:29.545790 2026] [:error] [pid 17721:tid 17796] [client 20.240.45.42:58786] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "aese5eFXXkLeyDnfk__t5AAAAA8"]
[Fri Apr 24 15:42:30.104140 2026] [:error] [pid 17721:tid 17798] [client 20.240.45.42:58720] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aese5uFXXkLeyDnfk__t5QAAABE"]
[Fri Apr 24 15:42:30.750961 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:50338] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aese5uarbOEFI8qshvK-fAAAAFA"]
[Fri Apr 24 15:42:31.306508 2026] [:error] [pid 17720:tid 17770] [client 20.240.45.42:55827] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aese5-hlUs6BS3Ng7_UMpQAAANA"]
[Fri Apr 24 15:42:31.898880 2026] [:error] [pid 17721:tid 17791] [client 20.240.45.42:58732] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ref.php"] [unique_id "aese5-FXXkLeyDnfk__t6AAAAAo"]
[Fri Apr 24 15:42:32.427022 2026] [:error] [pid 17721:tid 17790] [client 20.240.45.42:55835] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aese6OFXXkLeyDnfk__t6wAAAAk"]
[Fri Apr 24 15:42:33.101351 2026] [:error] [pid 14531:tid 14535] [client 20.240.45.42:58405] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aese6XfLU2gw-6KR-GZo3AAAAUI"]
[Fri Apr 24 15:42:33.890309 2026] [:error] [pid 14531:tid 14555] [client 20.240.45.42:58413] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aese6XfLU2gw-6KR-GZo4AAAAVY"]
[Fri Apr 24 15:42:34.615484 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:4514] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "aese6uarbOEFI8qshvK-ggAAAFA"]
[Fri Apr 24 15:42:35.348728 2026] [:error] [pid 14531:tid 14534] [client 20.240.45.42:5000] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aese63fLU2gw-6KR-GZo4gAAAUE"]
[Fri Apr 24 15:42:36.099650 2026] [:error] [pid 17808:tid 17816] [client 20.240.45.42:58376] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aese7OarbOEFI8qshvK-iQAAAEY"]
[Fri Apr 24 15:42:36.699927 2026] [:error] [pid 17808:tid 17828] [client 20.240.45.42:55259] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aese7OarbOEFI8qshvK-iwAAAFI"]
[Fri Apr 24 15:42:37.249430 2026] [:error] [pid 17719:tid 17742] [client 20.240.45.42:53021] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "aese7cTZ9gzEyL1BkPppBwAAAI8"]
[Fri Apr 24 15:42:37.926987 2026] [:error] [pid 17808:tid 17825] [client 20.240.45.42:61290] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "aese7earbOEFI8qshvK-kAAAAE8"]
[Fri Apr 24 15:42:38.671075 2026] [:error] [pid 22114:tid 22120] [client 20.240.45.42:53043] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "aese7oAuWGz3WlMQjoe26gAAAQM"]
[Fri Apr 24 15:42:39.587692 2026] [:error] [pid 17721:tid 17781] [client 20.240.45.42:50321] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "aese7-FXXkLeyDnfk__t8gAAAAA"]
[Fri Apr 24 15:42:40.325250 2026] [:error] [pid 17720:tid 17778] [client 20.240.45.42:51866] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "aese8OhlUs6BS3Ng7_UMtQAAANg"]
[Fri Apr 24 15:42:40.988916 2026] [:error] [pid 17808:tid 17823] [client 20.240.45.42:51897] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aese8OarbOEFI8qshvK-mAAAAE0"]
[Fri Apr 24 15:42:41.655400 2026] [:error] [pid 17719:tid 17747] [client 20.240.45.42:65384] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aese8cTZ9gzEyL1BkPppCwAAAJQ"]
[Fri Apr 24 15:42:42.286841 2026] [:error] [pid 17719:tid 17732] [client 20.240.45.42:55294] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aese8sTZ9gzEyL1BkPppDQAAAIU"]
[Fri Apr 24 15:42:42.986834 2026] [:error] [pid 17721:tid 17787] [client 20.240.45.42:61297] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "aese8uFXXkLeyDnfk__t9AAAAAY"]
[Fri Apr 24 15:42:43.708396 2026] [:error] [pid 17808:tid 17817] [client 20.240.45.42:4260] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Xx.php"] [unique_id "aese8-arbOEFI8qshvK-owAAAEc"]
[Fri Apr 24 15:42:44.392319 2026] [:error] [pid 17808:tid 17819] [client 20.240.45.42:64832] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Xx.php"] [unique_id "aese9OarbOEFI8qshvK-pwAAAEk"]
[Fri Apr 24 15:42:45.036842 2026] [:error] [pid 17808:tid 17833] [client 20.240.45.42:51894] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Xx.php"] [unique_id "aese9earbOEFI8qshvK-qQAAAFc"]
[Fri Apr 24 15:42:45.704760 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:45023] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Xx.php"] [unique_id "aese9earbOEFI8qshvK-qwAAAFA"]
[Fri Apr 24 15:42:46.392306 2026] [:error] [pid 17720:tid 17772] [client 20.240.45.42:47690] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmini.php"] [unique_id "aese9uhlUs6BS3Ng7_UMugAAANI"]
[Fri Apr 24 15:42:47.203446 2026] [:error] [pid 14531:tid 14539] [client 20.240.45.42:48485] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmini.php"] [unique_id "aese93fLU2gw-6KR-GZo9gAAAUY"]
[Fri Apr 24 15:42:47.923135 2026] [:error] [pid 17808:tid 17813] [client 20.240.45.42:56045] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmini.php"] [unique_id "aese9-arbOEFI8qshvK-wgAAAEM"]
[Fri Apr 24 15:42:48.803224 2026] [:error] [pid 14531:tid 14533] [client 20.240.45.42:56044] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmini.php"] [unique_id "aese-HfLU2gw-6KR-GZo-QAAAUA"]
[Fri Apr 24 15:42:49.774532 2026] [:error] [pid 22114:tid 22140] [client 20.240.45.42:51875] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "aese-YAuWGz3WlMQjoe2-QAAARc"]
[Fri Apr 24 15:42:50.366461 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:56000] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "aese-uarbOEFI8qshvK-yQAAAFA"]
[Fri Apr 24 15:42:51.181839 2026] [:error] [pid 17808:tid 17825] [client 20.240.45.42:47716] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "aese--arbOEFI8qshvK-zwAAAE8"]
[Fri Apr 24 15:42:51.780401 2026] [:error] [pid 17808:tid 17812] [client 20.240.45.42:56041] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "aese--arbOEFI8qshvK-0gAAAEI"]
[Fri Apr 24 15:42:52.445914 2026] [:error] [pid 17808:tid 17811] [client 20.240.45.42:64826] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aese_OarbOEFI8qshvK-0wAAAEE"]
[Fri Apr 24 15:42:53.147446 2026] [:error] [pid 17808:tid 17814] [client 20.240.45.42:4227] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "aese_earbOEFI8qshvK-1wAAAEQ"]
[Fri Apr 24 15:42:54.375713 2026] [:error] [pid 17720:tid 17774] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 24 15:42:54.701810 2026] [:error] [pid 17720:tid 17775] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/amdin.php
[Fri Apr 24 15:42:56.086029 2026] [:error] [pid 17720:tid 17775] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/huya.php
[Fri Apr 24 15:42:56.445814 2026] [:error] [pid 17720:tid 17763] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/puc.php
[Fri Apr 24 15:42:56.798736 2026] [:error] [pid 17720:tid 17764] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Fri Apr 24 15:42:57.184814 2026] [:error] [pid 17720:tid 17774] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Fri Apr 24 15:42:57.510862 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Fri Apr 24 15:42:57.855002 2026] [:error] [pid 17720:tid 17772] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Fri Apr 24 15:42:58.183667 2026] [:error] [pid 17720:tid 17773] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Fri Apr 24 15:42:58.657015 2026] [:error] [pid 17720:tid 17765] [client 20.240.45.42:56057] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Fri Apr 24 15:42:59.452362 2026] [:error] [pid 17720:tid 17777] [client 20.240.45.42:56057] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aesfA-hlUs6BS3Ng7_UM4QAAANc"]
[Fri Apr 24 15:43:00.249602 2026] [:error] [pid 17721:tid 17795] [client 20.240.45.42:47306] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aesfBOFXXkLeyDnfk__t_AAAAA4"]
[Fri Apr 24 15:43:01.081454 2026] [:error] [pid 17721:tid 17796] [client 20.240.45.42:56002] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aesfBeFXXkLeyDnfk__t_gAAAA8"]
[Fri Apr 24 15:43:01.719269 2026] [:error] [pid 17719:tid 17734] [client 20.240.45.42:64784] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "aesfBcTZ9gzEyL1BkPppGwAAAIc"]
[Fri Apr 24 15:43:02.706632 2026] [:error] [pid 17719:tid 17729] [client 20.240.45.42:54179] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aesfBsTZ9gzEyL1BkPppHgAAAII"]
[Fri Apr 24 15:43:03.643172 2026] [:error] [pid 22114:tid 22133] [client 20.240.45.42:4346] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aesfB4AuWGz3WlMQjoe3CwAAARA"]
[Fri Apr 24 15:43:04.381584 2026] [:error] [pid 22114:tid 22126] [client 20.240.45.42:4706] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aesfCIAuWGz3WlMQjoe3DQAAAQk"]
[Fri Apr 24 15:43:05.198823 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:54181] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "aesfCearbOEFI8qshvK-7AAAAFA"]
[Fri Apr 24 15:43:05.882914 2026] [:error] [pid 17721:tid 17788] [client 20.240.45.42:47327] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aesfCeFXXkLeyDnfk__uBgAAAAc"]
[Fri Apr 24 15:43:06.555600 2026] [:error] [pid 17719:tid 17736] [client 20.240.45.42:51398] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aesfCsTZ9gzEyL1BkPppHwAAAIk"]
[Fri Apr 24 15:43:07.145840 2026] [:error] [pid 22114:tid 22117] [client 20.240.45.42:49516] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aesfC4AuWGz3WlMQjoe3EwAAAQA"]
[Fri Apr 24 15:43:09.182437 2026] [:error] [pid 17719:tid 17742] [client 20.240.45.42:65100] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "aesfDcTZ9gzEyL1BkPppKQAAAI8"]
[Fri Apr 24 15:43:10.031714 2026] [:error] [pid 17720:tid 17769] [client 20.240.45.42:51425] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aesfDuhlUs6BS3Ng7_UM9gAAAM8"]
[Fri Apr 24 15:43:10.711629 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:65128] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aesfDuhlUs6BS3Ng7_UM-QAAANE"]
[Fri Apr 24 15:43:11.380107 2026] [:error] [pid 17720:tid 17762] [client 20.240.45.42:43604] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aesfD-hlUs6BS3Ng7_UM-wAAAMg"]
[Fri Apr 24 15:43:11.969147 2026] [:error] [pid 17721:tid 17803] [client 20.240.45.42:55311] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "aesfD-FXXkLeyDnfk__uCwAAABY"]
[Fri Apr 24 15:43:12.536969 2026] [:error] [pid 17720:tid 17777] [client 20.240.45.42:51431] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aesfEOhlUs6BS3Ng7_UNAQAAANc"]
[Fri Apr 24 15:43:13.269828 2026] [:error] [pid 17808:tid 17834] [client 20.240.45.42:54198] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aesfEearbOEFI8qshvK_AQAAAFg"]
[Fri Apr 24 15:43:14.242230 2026] [:error] [pid 17719:tid 17734] [client 20.240.45.42:52970] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aesfEsTZ9gzEyL1BkPppMAAAAIc"]
[Fri Apr 24 15:43:14.935552 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:43594] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "aesfEuhlUs6BS3Ng7_UNAwAAAMQ"]
[Fri Apr 24 15:43:15.471354 2026] [:error] [pid 17720:tid 17776] [client 20.240.45.42:48436] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aesfE-hlUs6BS3Ng7_UNBQAAANY"]
[Fri Apr 24 15:43:16.216464 2026] [:error] [pid 17720:tid 17778] [client 20.240.45.42:65146] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aesfFOhlUs6BS3Ng7_UNBwAAANg"]
[Fri Apr 24 15:43:16.869808 2026] [:error] [pid 17808:tid 17819] [client 20.240.45.42:4698] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aesfFOarbOEFI8qshvK_FQAAAEk"]
[Fri Apr 24 15:43:17.584206 2026] [:error] [pid 17719:tid 17749] [client 20.240.45.42:54949] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "aesfFcTZ9gzEyL1BkPppMgAAAJY"]
[Fri Apr 24 15:43:18.334658 2026] [:error] [pid 14531:tid 14541] [client 20.240.45.42:43605] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aesfFnfLU2gw-6KR-GZpCAAAAUg"]
[Fri Apr 24 15:43:19.537742 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:55298] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aesfF-hlUs6BS3Ng7_UNFwAAANE"]
[Fri Apr 24 15:43:20.309040 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:47307] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aesfGOhlUs6BS3Ng7_UNHAAAAMw"]
[Fri Apr 24 15:43:21.058704 2026] [:error] [pid 17720:tid 17767] [client 20.240.45.42:43590] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "aesfGehlUs6BS3Ng7_UNJQAAAM0"]
[Fri Apr 24 15:43:21.854357 2026] [:error] [pid 14531:tid 14548] [client 20.240.45.42:49473] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aesfGXfLU2gw-6KR-GZpCwAAAU8"]
[Fri Apr 24 15:43:22.795854 2026] [:error] [pid 14531:tid 14554] [client 20.240.45.42:65095] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aesfGnfLU2gw-6KR-GZpDAAAAVU"]
[Fri Apr 24 15:43:23.450527 2026] [:error] [pid 17719:tid 17751] [client 20.240.45.42:51427] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aesfG8TZ9gzEyL1BkPppOAAAAJg"]
[Fri Apr 24 15:43:24.062530 2026] [:error] [pid 17721:tid 17803] [client 20.240.45.42:4694] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "aesfHOFXXkLeyDnfk__uGQAAABY"]
[Fri Apr 24 15:43:24.590260 2026] [:error] [pid 17720:tid 17770] [client 20.240.45.42:45474] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aesfHOhlUs6BS3Ng7_UNKAAAANA"]
[Fri Apr 24 15:43:25.199869 2026] [:error] [pid 17720:tid 17773] [client 20.240.45.42:4725] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aesfHehlUs6BS3Ng7_UNKQAAANM"]
[Fri Apr 24 15:43:25.863636 2026] [:error] [pid 17721:tid 17802] [client 20.240.45.42:54174] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aesfHeFXXkLeyDnfk__uIQAAABU"]
[Fri Apr 24 15:43:26.672308 2026] [:error] [pid 17719:tid 17742] [client 20.240.45.42:45485] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "aesfHsTZ9gzEyL1BkPppOgAAAI8"]
[Fri Apr 24 15:43:27.364669 2026] [:error] [pid 17720:tid 17756] [client 20.240.45.42:4691] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aesfH-hlUs6BS3Ng7_UNLQAAAMI"]
[Fri Apr 24 15:43:28.125871 2026] [:error] [pid 14531:tid 14547] [client 20.240.45.42:55335] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aesfIHfLU2gw-6KR-GZpDgAAAU4"]
[Fri Apr 24 15:43:28.802358 2026] [:error] [pid 14531:tid 14550] [client 20.240.45.42:51424] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aesfIHfLU2gw-6KR-GZpEwAAAVE"]
[Fri Apr 24 15:43:29.636363 2026] [:error] [pid 17721:tid 17805] [client 20.240.45.42:4728] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "aesfIeFXXkLeyDnfk__uKQAAABg"]
[Fri Apr 24 15:43:30.237230 2026] [:error] [pid 17808:tid 17813] [client 20.240.45.42:54196] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aesfIuarbOEFI8qshvK_LgAAAEM"]
[Fri Apr 24 15:43:30.900150 2026] [:error] [pid 17719:tid 17733] [client 20.240.45.42:65088] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aesfIsTZ9gzEyL1BkPppPgAAAIY"]
[Fri Apr 24 15:43:31.688940 2026] [:error] [pid 17719:tid 17740] [client 20.240.45.42:45479] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aesfI8TZ9gzEyL1BkPppQAAAAI0"]
[Fri Apr 24 15:43:32.278694 2026] [:error] [pid 22114:tid 22123] [client 20.240.45.42:54936] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "aesfJIAuWGz3WlMQjoe3HgAAAQY"]
[Fri Apr 24 15:43:32.868481 2026] [:error] [pid 17721:tid 17790] [client 20.240.45.42:54186] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aesfJOFXXkLeyDnfk__uLwAAAAk"]
[Fri Apr 24 15:43:33.563970 2026] [:error] [pid 17720:tid 17772] [client 20.240.45.42:43646] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aesfJehlUs6BS3Ng7_UNOwAAANI"]
[Fri Apr 24 15:43:34.241957 2026] [:error] [pid 17808:tid 17821] [client 20.240.45.42:55321] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aesfJuarbOEFI8qshvK_NQAAAEs"]
[Fri Apr 24 15:43:34.939875 2026] [:error] [pid 14531:tid 14551] [client 20.240.45.42:43585] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "aesfJnfLU2gw-6KR-GZpFwAAAVI"]
[Fri Apr 24 15:43:35.562644 2026] [:error] [pid 14531:tid 14542] [client 20.240.45.42:45469] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aesfJ3fLU2gw-6KR-GZpGgAAAUk"]
[Fri Apr 24 15:43:36.237404 2026] [:error] [pid 17720:tid 17759] [client 20.240.45.42:52949] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aesfKOhlUs6BS3Ng7_UNQQAAAMU"]
[Fri Apr 24 15:43:36.852446 2026] [:error] [pid 17721:tid 17803] [client 20.240.45.42:49926] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aesfKOFXXkLeyDnfk__uNgAAABY"]
[Fri Apr 24 15:43:37.384938 2026] [:error] [pid 17719:tid 17738] [client 20.240.45.42:54176] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "aesfKcTZ9gzEyL1BkPppTAAAAIs"]
[Fri Apr 24 15:43:38.007413 2026] [:error] [pid 17808:tid 17822] [client 20.240.45.42:54912] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aesfKuarbOEFI8qshvK_OgAAAEw"]
[Fri Apr 24 15:43:38.710828 2026] [:error] [pid 17720:tid 17765] [client 20.240.45.42:64799] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aesfKuhlUs6BS3Ng7_UNSAAAAMs"]
[Fri Apr 24 15:43:39.485157 2026] [:error] [pid 17720:tid 17769] [client 20.240.45.42:52976] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aesfK-hlUs6BS3Ng7_UNTAAAAM8"]
[Fri Apr 24 15:43:40.227034 2026] [:error] [pid 17808:tid 17823] [client 20.240.45.42:49983] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "aesfLOarbOEFI8qshvK_QgAAAE0"]
[Fri Apr 24 15:43:40.865879 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:54938] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aesfLOhlUs6BS3Ng7_UNUAAAAMQ"]
[Fri Apr 24 15:43:41.534695 2026] [:error] [pid 17721:tid 17790] [client 20.240.45.42:52947] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aesfLeFXXkLeyDnfk__uOgAAAAk"]
[Fri Apr 24 15:43:42.256840 2026] [:error] [pid 22114:tid 22124] [client 20.240.45.42:52379] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aesfLoAuWGz3WlMQjoe3KAAAAQc"]
[Fri Apr 24 15:43:42.860412 2026] [:error] [pid 17720:tid 17773] [client 20.240.45.42:55310] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/3.php"] [unique_id "aesfLuhlUs6BS3Ng7_UNWAAAANM"]
[Fri Apr 24 15:43:43.442363 2026] [:error] [pid 17719:tid 17739] [client 20.240.45.42:48430] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "aesfL8TZ9gzEyL1BkPppUgAAAIw"]
[Fri Apr 24 15:43:44.148507 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:54938] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "aesfMOhlUs6BS3Ng7_UNXAAAANE"]
[Fri Apr 24 15:43:44.855310 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:54926] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "aesfMOhlUs6BS3Ng7_UNXQAAAMQ"]
[Fri Apr 24 15:43:45.572252 2026] [:error] [pid 17720:tid 17778] [client 20.240.45.42:54155] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4.php"] [unique_id "aesfMehlUs6BS3Ng7_UNYAAAANg"]
[Fri Apr 24 15:43:46.341802 2026] [:error] [pid 17721:tid 17783] [client 20.240.45.42:54961] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "aesfMuFXXkLeyDnfk__uPwAAAAI"]
[Fri Apr 24 15:43:47.097668 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:48408] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "aesfM-hlUs6BS3Ng7_UNYwAAAMw"]
[Fri Apr 24 15:43:47.789019 2026] [:error] [pid 17721:tid 17803] [client 20.240.45.42:4689] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "aesfM-FXXkLeyDnfk__uQgAAABY"]
[Fri Apr 24 15:43:48.576320 2026] [:error] [pid 14531:tid 14535] [client 20.240.45.42:48397] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5.php"] [unique_id "aesfNHfLU2gw-6KR-GZpHgAAAUI"]
[Fri Apr 24 15:43:49.193040 2026] [:error] [pid 14531:tid 14548] [client 20.240.45.42:43640] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "aesfNXfLU2gw-6KR-GZpIwAAAU8"]
[Fri Apr 24 15:43:49.813183 2026] [:error] [pid 17808:tid 17817] [client 20.240.45.42:4735] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "aesfNearbOEFI8qshvK_RgAAAEc"]
[Fri Apr 24 15:43:50.486917 2026] [:error] [pid 17721:tid 17786] [client 20.240.45.42:43627] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "aesfNuFXXkLeyDnfk__uRQAAAAU"]
[Fri Apr 24 15:43:51.468841 2026] [:error] [pid 17720:tid 17754] [client 20.240.45.42:54188] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/6.php"] [unique_id "aesfN-hlUs6BS3Ng7_UNawAAAMA"]
[Fri Apr 24 15:43:52.282588 2026] [:error] [pid 17720:tid 17762] [client 20.240.45.42:52981] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "aesfOOhlUs6BS3Ng7_UNcQAAAMg"]
[Fri Apr 24 15:43:53.003940 2026] [:error] [pid 17721:tid 17804] [client 20.240.45.42:52971] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "aesfOeFXXkLeyDnfk__uRwAAABc"]
[Fri Apr 24 15:43:53.707314 2026] [:error] [pid 17808:tid 17827] [client 20.240.45.42:52945] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "aesfOearbOEFI8qshvK_SAAAAFE"]
[Fri Apr 24 15:43:54.512116 2026] [:error] [pid 17808:tid 17821] [client 20.240.45.42:4695] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/9.php"] [unique_id "aesfOuarbOEFI8qshvK_SQAAAEs"]
[Fri Apr 24 15:43:55.132567 2026] [:error] [pid 17720:tid 17755] [client 20.240.45.42:54920] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aesfO-hlUs6BS3Ng7_UNegAAAME"]
[Fri Apr 24 15:43:55.805707 2026] [:error] [pid 14531:tid 14536] [client 20.240.45.42:65102] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aesfO3fLU2gw-6KR-GZpKgAAAUM"]
[Fri Apr 24 15:43:56.450067 2026] [:error] [pid 17808:tid 17828] [client 20.240.45.42:45449] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aesfPOarbOEFI8qshvK_TAAAAFI"]
[Fri Apr 24 15:43:57.065027 2026] [:error] [pid 14531:tid 14535] [client 20.240.45.42:60884] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/10.php"] [unique_id "aesfPXfLU2gw-6KR-GZpLAAAAUI"]
[Fri Apr 24 15:43:57.665457 2026] [:error] [pid 17721:tid 17791] [client 20.240.45.42:60876] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "aesfPeFXXkLeyDnfk__uSQAAAAo"]
[Fri Apr 24 15:43:58.331915 2026] [:error] [pid 17808:tid 17825] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Fri Apr 24 15:43:59.029554 2026] [:error] [pid 17808:tid 17833] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/f35_S.php
[Fri Apr 24 15:43:59.352465 2026] [:error] [pid 17808:tid 17812] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Fri Apr 24 15:43:59.674401 2026] [:error] [pid 17808:tid 17827] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/111.php
[Fri Apr 24 15:43:59.995324 2026] [:error] [pid 17808:tid 17823] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/wp1.php
[Fri Apr 24 15:44:00.319485 2026] [:error] [pid 17808:tid 17829] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Fri Apr 24 15:44:00.640853 2026] [:error] [pid 17808:tid 17811] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/byrgo.php
[Fri Apr 24 15:44:01.049301 2026] [:error] [pid 17808:tid 17814] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/xwpg.php
[Fri Apr 24 15:44:01.371867 2026] [:error] [pid 17808:tid 17834] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/ass.php
[Fri Apr 24 15:44:01.700949 2026] [:error] [pid 17808:tid 17828] [client 20.240.45.42:45456] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Fri Apr 24 15:44:02.023474 2026] [:error] [pid 17808:tid 17831] [client 20.240.45.42:45456] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aesfQuarbOEFI8qshvK_ZgAAAFU"]
[Fri Apr 24 15:44:02.695434 2026] [:error] [pid 17721:tid 17781] [client 20.240.45.42:49962] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aesfQuFXXkLeyDnfk__uTAAAAAA"]
[Fri Apr 24 15:44:03.480584 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:48495] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aesfQ-arbOEFI8qshvK_aAAAAFA"]
[Fri Apr 24 15:44:04.080827 2026] [:error] [pid 17808:tid 17832] [client 20.240.45.42:48846] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "aesfROarbOEFI8qshvK_aQAAAFY"]
[Fri Apr 24 15:44:04.819315 2026] [:error] [pid 17720:tid 17776] [client 20.240.45.42:60915] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aesfROhlUs6BS3Ng7_UNiAAAANY"]
[Fri Apr 24 15:44:05.473753 2026] [:error] [pid 17808:tid 17811] [client 20.240.45.42:54950] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aesfRearbOEFI8qshvK_awAAAEE"]
[Fri Apr 24 15:44:06.101582 2026] [:error] [pid 17808:tid 17814] [client 20.240.45.42:48876] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aesfRuarbOEFI8qshvK_cAAAAEQ"]
[Fri Apr 24 15:44:06.813361 2026] [:error] [pid 17808:tid 17830] [client 20.240.45.42:54934] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "aesfRuarbOEFI8qshvK_cQAAAFQ"]
[Fri Apr 24 15:44:07.503037 2026] [:error] [pid 17808:tid 17833] [client 20.240.45.42:56494] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aesfR-arbOEFI8qshvK_dQAAAFc"]
[Fri Apr 24 15:44:08.201531 2026] [:error] [pid 17719:tid 17733] [client 20.240.45.42:54947] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aesfSMTZ9gzEyL1BkPppXgAAAIY"]
[Fri Apr 24 15:44:08.879831 2026] [:error] [pid 14531:tid 14533] [client 20.240.45.42:54933] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aesfSHfLU2gw-6KR-GZpQwAAAUA"]
[Fri Apr 24 15:44:09.417738 2026] [:error] [pid 17808:tid 17821] [client 20.240.45.42:4735] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "aesfSearbOEFI8qshvK_ewAAAEs"]
[Fri Apr 24 15:44:10.053522 2026] [:error] [pid 17719:tid 17735] [client 20.240.45.42:48424] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aesfSsTZ9gzEyL1BkPppYAAAAIg"]
[Fri Apr 24 15:44:10.760049 2026] [:error] [pid 14531:tid 14543] [client 20.240.45.42:48417] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aesfSnfLU2gw-6KR-GZpRgAAAUo"]
[Fri Apr 24 15:44:11.344210 2026] [:error] [pid 14531:tid 14542] [client 20.240.45.42:54969] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aesfS3fLU2gw-6KR-GZpSgAAAUk"]
[Fri Apr 24 15:44:11.979506 2026] [:error] [pid 22114:tid 22127] [client 20.240.45.42:56477] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "aesfS4AuWGz3WlMQjoe3LAAAAQo"]
[Fri Apr 24 15:44:12.775517 2026] [:error] [pid 17808:tid 17815] [client 20.240.45.42:4331] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aesfTOarbOEFI8qshvK_fwAAAEU"]
[Fri Apr 24 15:44:13.306947 2026] [:error] [pid 17808:tid 17820] [client 20.240.45.42:55777] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aesfTearbOEFI8qshvK_gQAAAEo"]
[Fri Apr 24 15:44:13.975686 2026] [:error] [pid 17720:tid 17774] [client 20.240.45.42:60899] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aesfTehlUs6BS3Ng7_UNlAAAANQ"]
[Fri Apr 24 15:44:14.566515 2026] [:error] [pid 14531:tid 14535] [client 20.240.45.42:54922] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "aesfTnfLU2gw-6KR-GZpVwAAAUI"]
[Fri Apr 24 15:44:15.151272 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:4716] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aesfT-hlUs6BS3Ng7_UNmQAAANE"]
[Fri Apr 24 15:44:15.906112 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:56462] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aesfT-hlUs6BS3Ng7_UNnAAAAMQ"]
[Fri Apr 24 15:44:16.640261 2026] [:error] [pid 17720:tid 17768] [client 20.240.45.42:60540] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aesfUOhlUs6BS3Ng7_UNoQAAAM4"]
[Fri Apr 24 15:44:17.287135 2026] [:error] [pid 22114:tid 22125] [client 20.240.45.42:55342] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "aesfUYAuWGz3WlMQjoe3LgAAAQg"]
[Fri Apr 24 15:44:17.840452 2026] [:error] [pid 22114:tid 22124] [client 20.240.45.42:54937] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfUYAuWGz3WlMQjoe3MQAAAQc"]
[Fri Apr 24 15:44:18.437962 2026] [:error] [pid 17720:tid 17757] [client 20.240.45.42:51434] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfUuhlUs6BS3Ng7_UNpgAAAMM"]
[Fri Apr 24 15:44:19.029790 2026] [:error] [pid 22114:tid 22131] [client 20.240.45.42:60527] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfU4AuWGz3WlMQjoe3NAAAAQ4"]
[Fri Apr 24 15:44:19.581346 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:48872] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfU-hlUs6BS3Ng7_UNqgAAANE"]
[Fri Apr 24 15:44:20.109276 2026] [:error] [pid 17721:tid 17802] [client 20.240.45.42:51426] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aesfVOFXXkLeyDnfk__uWQAAABU"]
[Fri Apr 24 15:44:20.664833 2026] [:error] [pid 17720:tid 17760] [client 20.240.45.42:49965] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aesfVOhlUs6BS3Ng7_UNrgAAAMY"]
[Fri Apr 24 15:44:21.219701 2026] [:error] [pid 17719:tid 17744] [client 20.240.45.42:48848] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aesfVcTZ9gzEyL1BkPppZQAAAJE"]
[Fri Apr 24 15:44:21.913774 2026] [:error] [pid 17721:tid 17784] [client 20.240.45.42:55788] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uuu.php"] [unique_id "aesfVeFXXkLeyDnfk__uXQAAAAM"]
[Fri Apr 24 15:44:22.721423 2026] [:error] [pid 17720:tid 17778] [client 20.240.45.42:4731] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aesfVuhlUs6BS3Ng7_UNtgAAANg"]
[Fri Apr 24 15:44:23.434983 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:60484] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aesfV-hlUs6BS3Ng7_UNuQAAAMQ"]
[Fri Apr 24 15:44:24.078778 2026] [:error] [pid 17721:tid 17789] [client 20.240.45.42:55564] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aesfWOFXXkLeyDnfk__uYgAAAAg"]
[Fri Apr 24 15:44:24.796158 2026] [:error] [pid 17808:tid 17823] [client 20.240.45.42:55572] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "aesfWOarbOEFI8qshvK_hQAAAE0"]
[Fri Apr 24 15:44:25.406973 2026] [:error] [pid 17808:tid 17814] [client 20.240.45.42:60516] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aesfWearbOEFI8qshvK_hwAAAEQ"]
[Fri Apr 24 15:44:26.124850 2026] [:error] [pid 17719:tid 17730] [client 20.240.45.42:4672] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aesfWsTZ9gzEyL1BkPppZgAAAIM"]
[Fri Apr 24 15:44:26.733015 2026] [:error] [pid 17719:tid 17750] [client 20.240.45.42:45488] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aesfWsTZ9gzEyL1BkPppaAAAAJc"]
[Fri Apr 24 15:44:27.355335 2026] [:error] [pid 17808:tid 17824] [client 20.240.45.42:55318] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "aesfW-arbOEFI8qshvK_jgAAAE4"]
[Fri Apr 24 15:44:28.024388 2026] [:error] [pid 17720:tid 17767] [client 20.240.45.42:65141] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aesfXOhlUs6BS3Ng7_UNwAAAAM0"]
[Fri Apr 24 15:44:28.553373 2026] [:error] [pid 22114:tid 22132] [client 20.240.45.42:56470] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aesfXIAuWGz3WlMQjoe3QAAAAQ8"]
[Fri Apr 24 15:44:29.205781 2026] [:error] [pid 17721:tid 17804] [client 20.240.45.42:45446] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aesfXeFXXkLeyDnfk__uawAAABc"]
[Fri Apr 24 15:44:29.854674 2026] [:error] [pid 17721:tid 17791] [client 20.240.45.42:56507] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "aesfXeFXXkLeyDnfk__ubAAAAAo"]
[Fri Apr 24 15:44:30.432379 2026] [:error] [pid 17808:tid 17820] [client 20.240.45.42:60885] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aesfXuarbOEFI8qshvK_kwAAAEo"]
[Fri Apr 24 15:44:31.016456 2026] [:error] [pid 17720:tid 17767] [client 20.240.45.42:49973] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aesfX-hlUs6BS3Ng7_UNyQAAAM0"]
[Fri Apr 24 15:44:31.695723 2026] [:error] [pid 17721:tid 17794] [client 20.240.45.42:48833] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aesfX-FXXkLeyDnfk__ubgAAAA0"]
[Fri Apr 24 15:44:32.804041 2026] [:error] [pid 17808:tid 17824] [client 20.240.45.42:55768] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a2.php"] [unique_id "aesfYOarbOEFI8qshvK_lwAAAE4"]
[Fri Apr 24 15:44:33.455365 2026] [:error] [pid 17720:tid 17772] [client 20.240.45.42:52989] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aesfYehlUs6BS3Ng7_UN1wAAANI"]
[Fri Apr 24 15:44:34.113841 2026] [:error] [pid 17719:tid 17747] [client 20.240.45.42:55609] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aesfYsTZ9gzEyL1BkPppbwAAAJQ"]
[Fri Apr 24 15:44:34.843412 2026] [:error] [pid 17720:tid 17769] [client 20.240.45.42:55336] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aesfYuhlUs6BS3Ng7_UN2wAAAM8"]
[Fri Apr 24 15:44:35.887269 2026] [:error] [pid 22114:tid 22127] [client 20.240.45.42:48387] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "aesfY4AuWGz3WlMQjoe3RAAAAQo"]
[Fri Apr 24 15:44:36.738193 2026] [:error] [pid 17808:tid 17818] [client 20.240.45.42:55760] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aesfZOarbOEFI8qshvK_oAAAAEg"]
[Fri Apr 24 15:44:37.523891 2026] [:error] [pid 17808:tid 17824] [client 20.240.45.42:56509] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aesfZearbOEFI8qshvK_pAAAAE4"]
[Fri Apr 24 15:44:38.152311 2026] [:error] [pid 17720:tid 17769] [client 20.240.45.42:55614] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aesfZuhlUs6BS3Ng7_UN4AAAAM8"]
[Fri Apr 24 15:44:38.792400 2026] [:error] [pid 17720:tid 17777] [client 20.240.45.42:65147] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "aesfZuhlUs6BS3Ng7_UN6wAAANc"]
[Fri Apr 24 15:44:39.451653 2026] [:error] [pid 17721:tid 17787] [client 20.240.45.42:48881] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aesfZ-FXXkLeyDnfk__uegAAAAY"]
[Fri Apr 24 15:44:40.039130 2026] [:error] [pid 17721:tid 17795] [client 20.240.45.42:55312] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aesfaOFXXkLeyDnfk__uewAAAA4"]
[Fri Apr 24 15:44:40.628523 2026] [:error] [pid 14531:tid 14537] [client 20.240.45.42:55322] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aesfaHfLU2gw-6KR-GZpcQAAAUQ"]
[Fri Apr 24 15:44:42.345752 2026] [:error] [pid 17808:tid 17819] [client 20.240.45.42:45495] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "aesfauarbOEFI8qshvK_sQAAAEk"]
[Fri Apr 24 15:44:42.944310 2026] [:error] [pid 14531:tid 14536] [client 20.240.45.42:60487] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aesfanfLU2gw-6KR-GZpdwAAAUM"]
[Fri Apr 24 15:44:43.563382 2026] [:error] [pid 17721:tid 17794] [client 20.240.45.42:4679] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aesfa-FXXkLeyDnfk__ufQAAAA0"]
[Fri Apr 24 15:44:44.145619 2026] [:error] [pid 17808:tid 17816] [client 20.240.45.42:55776] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aesfbOarbOEFI8qshvK_twAAAEY"]
[Fri Apr 24 15:44:44.747705 2026] [:error] [pid 17808:tid 17826] [client 20.240.45.42:60514] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/66.php"] [unique_id "aesfbOarbOEFI8qshvK_vAAAAFA"]
[Fri Apr 24 15:44:45.370949 2026] [:error] [pid 22114:tid 22117] [client 20.240.45.42:54918] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aesfbYAuWGz3WlMQjoe3SgAAAQA"]
[Fri Apr 24 15:44:46.141077 2026] [:error] [pid 17720:tid 17765] [client 20.240.45.42:51437] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aesfbuhlUs6BS3Ng7_UOAwAAAMs"]
[Fri Apr 24 15:44:46.840833 2026] [:error] [pid 17721:tid 17798] [client 20.240.45.42:56501] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aesfbuFXXkLeyDnfk__ugwAAABE"]
[Fri Apr 24 15:44:47.548125 2026] [:error] [pid 17721:tid 17795] [client 20.240.45.42:45497] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "aesfb-FXXkLeyDnfk__uhQAAAA4"]
[Fri Apr 24 15:44:48.569153 2026] [:error] [pid 17808:tid 17827] [client 20.240.45.42:49956] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aesfcOarbOEFI8qshvK_wQAAAFE"]
[Fri Apr 24 15:44:49.143882 2026] [:error] [pid 17808:tid 17817] [client 20.240.45.42:56487] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aesfcearbOEFI8qshvK_xgAAAEc"]
[Fri Apr 24 15:44:49.688764 2026] [:error] [pid 14531:tid 14555] [client 20.240.45.42:54971] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aesfcXfLU2gw-6KR-GZpewAAAVY"]
[Fri Apr 24 15:44:50.261190 2026] [:error] [pid 17808:tid 17823] [client 20.240.45.42:60880] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ol.php"] [unique_id "aesfcuarbOEFI8qshvK_zQAAAE0"]
[Fri Apr 24 15:44:50.873800 2026] [:error] [pid 14531:tid 14546] [client 20.240.45.42:55334] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aesfcnfLU2gw-6KR-GZpfAAAAU0"]
[Fri Apr 24 15:44:51.510833 2026] [:error] [pid 22114:tid 22135] [client 20.240.45.42:55800] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aesfc4AuWGz3WlMQjoe3TgAAARI"]
[Fri Apr 24 15:44:52.199181 2026] [:error] [pid 17720:tid 17773] [client 20.240.45.42:45461] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aesfdOhlUs6BS3Ng7_UOCwAAANM"]
[Fri Apr 24 15:44:52.814624 2026] [:error] [pid 14531:tid 14543] [client 20.240.45.42:4292] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "aesfdHfLU2gw-6KR-GZpfwAAAUo"]
[Fri Apr 24 15:44:53.433528 2026] [:error] [pid 14531:tid 14545] [client 20.240.45.42:48873] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aesfdXfLU2gw-6KR-GZpgwAAAUw"]
[Fri Apr 24 15:44:54.022615 2026] [:error] [pid 14531:tid 14540] [client 20.240.45.42:43601] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aesfdnfLU2gw-6KR-GZphwAAAUc"]
[Fri Apr 24 15:44:54.781526 2026] [:error] [pid 17720:tid 17768] [client 20.240.45.42:47305] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aesfduhlUs6BS3Ng7_UOEgAAAM4"]
[Fri Apr 24 15:44:55.365461 2026] [:error] [pid 14531:tid 14546] [client 20.240.45.42:4681] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "aesfd3fLU2gw-6KR-GZpigAAAU0"]
[Fri Apr 24 15:44:55.989529 2026] [:error] [pid 17720:tid 17760] [client 20.240.45.42:60911] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aesfd-hlUs6BS3Ng7_UOFAAAAMY"]
[Fri Apr 24 15:44:56.630177 2026] [:error] [pid 17808:tid 17813] [client 20.240.45.42:47305] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aesfeOarbOEFI8qshvK_1wAAAEM"]
[Fri Apr 24 15:44:57.290360 2026] [:error] [pid 17721:tid 17789] [client 20.240.45.42:55356] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aesfeeFXXkLeyDnfk__ukwAAAAg"]
[Fri Apr 24 15:44:58.050622 2026] [:error] [pid 17720:tid 17754] [client 20.240.45.42:55804] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "aesfeuhlUs6BS3Ng7_UOFQAAAMA"]
[Fri Apr 24 15:44:58.695277 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:56480] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesfeuhlUs6BS3Ng7_UOLAAAANE"]
[Fri Apr 24 15:44:59.285360 2026] [:error] [pid 22114:tid 22125] [client 20.240.45.42:4675] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesfe4AuWGz3WlMQjoe3VQAAAQg"]
[Fri Apr 24 15:44:59.955577 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:54494] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesfe-hlUs6BS3Ng7_UOlQAAANE"]
[Fri Apr 24 15:45:00.547905 2026] [:error] [pid 17720:tid 17759] [client 20.240.45.42:55340] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesffOhlUs6BS3Ng7_UOmgAAAMU"]
[Fri Apr 24 15:45:01.549435 2026] [:error] [pid 17721:tid 17795] [client 20.240.45.42:48863] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-act.php
[Fri Apr 24 15:45:01.815043 2026] [:error] [pid 17721:tid 17785] [client 20.240.45.42:48863] File does not exist: /usr/local/apache/htdocs/suspended-page/aaa.php
[Fri Apr 24 15:45:02.083675 2026] [:error] [pid 17721:tid 17784] [client 20.240.45.42:48863] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Fri Apr 24 15:45:02.615103 2026] [:error] [pid 17721:tid 17789] [client 20.240.45.42:48863] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Fri Apr 24 15:45:02.879100 2026] [:error] [pid 17721:tid 17791] [client 20.240.45.42:48863] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Fri Apr 24 15:45:03.678738 2026] [:error] [pid 17721:tid 17803] [client 20.240.45.42:48863] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Fri Apr 24 15:45:03.947118 2026] [:error] [pid 17721:tid 17792] [client 20.240.45.42:48863] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Fri Apr 24 15:45:04.223184 2026] [:error] [pid 17721:tid 17793] [client 20.240.45.42:48863] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aesfgOFXXkLeyDnfk__uqgAAAAw"]
[Fri Apr 24 15:45:04.834090 2026] [:error] [pid 17719:tid 17730] [client 20.240.45.42:4675] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aesfgMTZ9gzEyL1BkPppkgAAAIM"]
[Fri Apr 24 15:45:05.608953 2026] [:error] [pid 17719:tid 17749] [client 20.240.45.42:54514] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aesfgcTZ9gzEyL1BkPppmQAAAJY"]
[Fri Apr 24 15:45:06.331734 2026] [:error] [pid 17721:tid 17796] [client 20.240.45.42:60529] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "aesfguFXXkLeyDnfk__urAAAAA8"]
[Fri Apr 24 15:45:06.962566 2026] [:error] [pid 17719:tid 17743] [client 20.240.45.42:55347] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aesfgsTZ9gzEyL1BkPppnAAAAJA"]
[Fri Apr 24 15:45:07.536787 2026] [:error] [pid 22114:tid 22120] [client 20.240.45.42:55601] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aesfg4AuWGz3WlMQjoe3XAAAAQM"]
[Fri Apr 24 15:45:08.133414 2026] [:error] [pid 17720:tid 17775] [client 20.240.45.42:55560] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aesfhOhlUs6BS3Ng7_UOrAAAANU"]
[Fri Apr 24 15:45:08.803425 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:60865] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "aesfhOhlUs6BS3Ng7_UOrwAAAMQ"]
[Fri Apr 24 15:45:09.618775 2026] [:error] [pid 14531:tid 14553] [client 20.240.45.42:54966] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aesfhXfLU2gw-6KR-GZpoQAAAVQ"]
[Fri Apr 24 15:45:10.209270 2026] [:error] [pid 17721:tid 17794] [client 20.240.45.42:51393] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aesfhuFXXkLeyDnfk__utwAAAA0"]
[Fri Apr 24 15:45:10.876301 2026] [:error] [pid 14531:tid 14550] [client 20.240.45.42:55779] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aesfhnfLU2gw-6KR-GZpqQAAAVE"]
[Fri Apr 24 15:45:11.540689 2026] [:error] [pid 14531:tid 14548] [client 20.240.45.42:56495] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "aesfh3fLU2gw-6KR-GZpqgAAAU8"]
[Fri Apr 24 15:45:12.252840 2026] [:error] [pid 17808:tid 17829] [client 20.240.45.42:55319] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aesfiOarbOEFI8qshvK_7wAAAFM"]
[Fri Apr 24 15:45:12.892071 2026] [:error] [pid 17721:tid 17781] [client 20.240.45.42:4720] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aesfiOFXXkLeyDnfk__uwwAAAAA"]
[Fri Apr 24 15:45:13.499176 2026] [:error] [pid 14531:tid 14536] [client 20.240.45.42:51084] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aesfiXfLU2gw-6KR-GZptAAAAUM"]
[Fri Apr 24 15:45:14.205355 2026] [:error] [pid 17720:tid 17762] [client 20.240.45.42:52988] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "aesfiuhlUs6BS3Ng7_UOvQAAAMg"]
[Fri Apr 24 15:45:14.931940 2026] [:error] [pid 17721:tid 17782] [client 20.240.45.42:45467] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfiuFXXkLeyDnfk__uyQAAAAE"]
[Fri Apr 24 15:45:15.606152 2026] [:error] [pid 17721:tid 17798] [client 20.240.45.42:4723] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfi-FXXkLeyDnfk__uzAAAABE"]
[Fri Apr 24 15:45:16.381834 2026] [:error] [pid 17720:tid 17773] [client 20.240.45.42:65096] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfjOhlUs6BS3Ng7_UOwwAAANM"]
[Fri Apr 24 15:45:16.977321 2026] [:error] [pid 14531:tid 14547] [client 20.240.45.42:45495] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfjHfLU2gw-6KR-GZptgAAAU4"]
[Fri Apr 24 15:45:18.119894 2026] [:error] [pid 14531:tid 14542] [client 20.240.45.42:54486] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aesfjnfLU2gw-6KR-GZptwAAAUk"]
[Fri Apr 24 15:45:18.705537 2026] [:error] [pid 17808:tid 17830] [client 20.240.45.42:56463] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aesfjuarbOEFI8qshvK_-QAAAFQ"]
[Fri Apr 24 15:45:19.307009 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:60924] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aesfj-hlUs6BS3Ng7_UOzQAAANE"]
[Fri Apr 24 15:45:19.910165 2026] [:error] [pid 14531:tid 14551] [client 20.240.45.42:55791] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/we.php"] [unique_id "aesfj3fLU2gw-6KR-GZpvAAAAVI"]
[Fri Apr 24 15:45:20.682446 2026] [:error] [pid 17808:tid 17831] [client 20.240.45.42:48887] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aesfkOarbOEFI8qshvK__AAAAFU"]
[Fri Apr 24 15:45:21.448753 2026] [:error] [pid 17720:tid 17770] [client 20.240.45.42:4721] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aesfkehlUs6BS3Ng7_UO1gAAANA"]
[Fri Apr 24 15:45:22.152419 2026] [:error] [pid 17720:tid 17762] [client 20.240.45.42:55746] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aesfkuhlUs6BS3Ng7_UO2QAAAMg"]
[Fri Apr 24 15:45:22.723612 2026] [:error] [pid 17808:tid 17823] [client 20.240.45.42:52110] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "aesfkuarbOEFI8qshvLABgAAAE0"]
[Fri Apr 24 15:45:23.352903 2026] [:error] [pid 17721:tid 17801] [client 20.240.45.42:52125] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aesfk-FXXkLeyDnfk__u5wAAABQ"]
[Fri Apr 24 15:45:24.031051 2026] [:error] [pid 17721:tid 17804] [client 20.240.45.42:50619] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aesflOFXXkLeyDnfk__u6QAAABc"]
[Fri Apr 24 15:45:24.649304 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:52126] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aesflOhlUs6BS3Ng7_UO3gAAAMQ"]
[Fri Apr 24 15:45:25.173918 2026] [:error] [pid 14531:tid 14543] [client 20.240.45.42:50616] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin1.php"] [unique_id "aesflXfLU2gw-6KR-GZpwAAAAUo"]
[Fri Apr 24 15:45:25.738872 2026] [:error] [pid 14531:tid 14549] [client 20.240.45.42:54489] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aesflXfLU2gw-6KR-GZpwgAAAVA"]
[Fri Apr 24 15:45:26.288073 2026] [:error] [pid 14531:tid 14542] [client 20.240.45.42:48865] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aesflnfLU2gw-6KR-GZpwwAAAUk"]
[Fri Apr 24 15:45:26.836053 2026] [:error] [pid 17719:tid 17734] [client 20.240.45.42:54464] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aesflsTZ9gzEyL1BkPpptwAAAIc"]
[Fri Apr 24 15:45:27.595832 2026] [:error] [pid 17721:tid 17804] [client 20.240.45.42:54523] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "aesfl-FXXkLeyDnfk__u-wAAABc"]
[Fri Apr 24 15:45:28.285737 2026] [:error] [pid 14531:tid 14544] [client 20.240.45.42:56459] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aesfmHfLU2gw-6KR-GZpxQAAAUs"]
[Fri Apr 24 15:45:28.938867 2026] [:error] [pid 17720:tid 17762] [client 20.240.45.42:49955] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aesfmOhlUs6BS3Ng7_UO7QAAAMg"]
[Fri Apr 24 15:45:29.682375 2026] [:error] [pid 17720:tid 17776] [client 20.240.45.42:50618] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aesfmehlUs6BS3Ng7_UO8QAAANY"]
[Fri Apr 24 15:45:30.341356 2026] [:error] [pid 17720:tid 17769] [client 20.240.45.42:56511] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "aesfmuhlUs6BS3Ng7_UO9gAAAM8"]
[Fri Apr 24 15:45:31.038962 2026] [:error] [pid 17808:tid 17824] [client 20.240.45.42:56457] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aesfm-arbOEFI8qshvLADAAAAE4"]
[Fri Apr 24 15:45:31.759034 2026] [:error] [pid 17808:tid 17829] [client 20.240.45.42:60921] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aesfm-arbOEFI8qshvLAEwAAAFM"]
[Fri Apr 24 15:45:32.444421 2026] [:error] [pid 17721:tid 17796] [client 20.240.45.42:48856] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aesfnOFXXkLeyDnfk__vEAAAAA8"]
[Fri Apr 24 15:45:33.083158 2026] [:error] [pid 17719:tid 17741] [client 20.240.45.42:4628] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "aesfncTZ9gzEyL1BkPppuwAAAI4"]
[Fri Apr 24 15:45:33.770504 2026] [:error] [pid 17721:tid 17792] [client 20.240.45.42:49948] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aesfneFXXkLeyDnfk__vFQAAAAs"]
[Fri Apr 24 15:45:34.406898 2026] [:error] [pid 14531:tid 14541] [client 20.240.45.42:4130] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aesfnnfLU2gw-6KR-GZp1AAAAUg"]
[Fri Apr 24 15:45:34.936347 2026] [:error] [pid 14531:tid 14539] [client 20.240.45.42:52962] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aesfnnfLU2gw-6KR-GZp1gAAAUY"]
[Fri Apr 24 15:45:35.463611 2026] [:error] [pid 14531:tid 14535] [client 20.240.45.42:45440] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "aesfn3fLU2gw-6KR-GZp2QAAAUI"]
[Fri Apr 24 15:45:36.103664 2026] [:error] [pid 22114:tid 22118] [client 20.240.45.42:4627] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aesfoIAuWGz3WlMQjoe3aAAAAQE"]
[Fri Apr 24 15:45:36.697930 2026] [:error] [pid 14531:tid 14554] [client 20.240.45.42:54487] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aesfoHfLU2gw-6KR-GZp2wAAAVU"]
[Fri Apr 24 15:45:37.293650 2026] [:error] [pid 17808:tid 17830] [client 20.240.45.42:55773] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aesfoearbOEFI8qshvLAHwAAAFQ"]
[Fri Apr 24 15:45:37.938322 2026] [:error] [pid 17808:tid 17818] [client 20.240.45.42:49937] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "aesfoearbOEFI8qshvLAIQAAAEg"]
[Fri Apr 24 15:45:38.588369 2026] [:error] [pid 17808:tid 17816] [client 20.240.45.42:52101] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aesfouarbOEFI8qshvLAJQAAAEY"]
[Fri Apr 24 15:45:39.167252 2026] [:error] [pid 17808:tid 17820] [client 20.240.45.42:49961] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aesfo-arbOEFI8qshvLAKAAAAEo"]
[Fri Apr 24 15:45:39.693786 2026] [:error] [pid 17720:tid 17757] [client 20.240.45.42:55559] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aesfo-hlUs6BS3Ng7_UPBQAAAMM"]
[Fri Apr 24 15:45:40.344892 2026] [:error] [pid 14531:tid 14549] [client 20.240.45.42:4637] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "aesfpHfLU2gw-6KR-GZp4gAAAVA"]
[Fri Apr 24 15:45:40.943914 2026] [:error] [pid 17719:tid 17732] [client 20.240.45.42:50550] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfpMTZ9gzEyL1BkPppvgAAAIU"]
[Fri Apr 24 15:45:41.695090 2026] [:error] [pid 22114:tid 22138] [client 20.240.45.42:55772] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfpYAuWGz3WlMQjoe3awAAARU"]
[Fri Apr 24 15:45:42.389130 2026] [:error] [pid 22114:tid 22131] [client 20.240.45.42:60536] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfpoAuWGz3WlMQjoe3bgAAAQ4"]
[Fri Apr 24 15:45:42.967136 2026] [:error] [pid 22114:tid 22122] [client 20.240.45.42:56452] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "aesfpoAuWGz3WlMQjoe3cQAAAQU"]
[Fri Apr 24 15:45:43.550917 2026] [:error] [pid 22114:tid 22132] [client 20.240.45.42:56456] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aesfp4AuWGz3WlMQjoe3dAAAAQ8"]
[Fri Apr 24 15:45:44.460158 2026] [:error] [pid 22114:tid 22133] [client 20.240.45.42:50620] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aesfqIAuWGz3WlMQjoe3dwAAARA"]
[Fri Apr 24 15:45:45.022669 2026] [:error] [pid 22114:tid 22137] [client 20.240.45.42:56451] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aesfqYAuWGz3WlMQjoe3egAAARQ"]
[Fri Apr 24 15:45:45.692566 2026] [:error] [pid 17720:tid 17761] [client 20.240.45.42:50605] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aesfqehlUs6BS3Ng7_UPDAAAAMc"]
[Fri Apr 24 15:45:46.266289 2026] [:error] [pid 17719:tid 17728] [client 20.240.45.42:4101] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesfqsTZ9gzEyL1BkPppwwAAAIE"]
[Fri Apr 24 15:45:46.858039 2026] [:error] [pid 17721:tid 17805] [client 20.240.45.42:52117] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesfquFXXkLeyDnfk__vNgAAABg"]
[Fri Apr 24 15:45:47.728386 2026] [:error] [pid 17720:tid 17763] [client 20.240.45.42:52986] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesfq-hlUs6BS3Ng7_UPEgAAAMk"]
[Fri Apr 24 15:45:48.299127 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:48840] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "aesfrOhlUs6BS3Ng7_UPFAAAAMw"]
[Fri Apr 24 15:45:48.957106 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:52141] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aesfrOhlUs6BS3Ng7_UPGAAAAMQ"]
[Fri Apr 24 15:45:49.580535 2026] [:error] [pid 17719:tid 17734] [client 20.240.45.42:4107] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aesfrcTZ9gzEyL1BkPppxAAAAIc"]
[Fri Apr 24 15:45:50.126948 2026] [:error] [pid 17720:tid 17770] [client 20.240.45.42:50608] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aesfruhlUs6BS3Ng7_UPHwAAANA"]
[Fri Apr 24 15:45:50.715047 2026] [:error] [pid 22114:tid 22133] [client 20.240.45.42:50539] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "aesfroAuWGz3WlMQjoe3fgAAARA"]
[Fri Apr 24 15:45:51.353919 2026] [:error] [pid 14531:tid 14549] [client 20.240.45.42:45910] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aesfr3fLU2gw-6KR-GZp-gAAAVA"]
[Fri Apr 24 15:45:51.947629 2026] [:error] [pid 17808:tid 17834] [client 20.240.45.42:60520] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aesfr-arbOEFI8qshvLANgAAAFg"]
[Fri Apr 24 15:45:52.490865 2026] [:error] [pid 14531:tid 14544] [client 20.240.45.42:41937] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aesfsHfLU2gw-6KR-GZp_gAAAUs"]
[Fri Apr 24 15:45:53.127970 2026] [:error] [pid 14531:tid 14542] [client 20.240.45.42:55762] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fi.php"] [unique_id "aesfsXfLU2gw-6KR-GZp_wAAAUk"]
[Fri Apr 24 15:45:53.808031 2026] [:error] [pid 14531:tid 14550] [client 20.240.45.42:55615] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aesfsXfLU2gw-6KR-GZqBQAAAVE"]
[Fri Apr 24 15:45:54.401528 2026] [:error] [pid 14531:tid 14533] [client 20.240.45.42:43551] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aesfsnfLU2gw-6KR-GZqCAAAAUA"]
[Fri Apr 24 15:45:54.991744 2026] [:error] [pid 17720:tid 17757] [client 20.240.45.42:43568] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aesfsuhlUs6BS3Ng7_UPKAAAAMM"]
[Fri Apr 24 15:45:55.591729 2026] [:error] [pid 14531:tid 14541] [client 20.240.45.42:43567] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "aesfs3fLU2gw-6KR-GZqDgAAAUg"]
[Fri Apr 24 15:45:56.243458 2026] [:error] [pid 17720:tid 17775] [client 20.240.45.42:50542] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aesftOhlUs6BS3Ng7_UPLQAAANU"]
[Fri Apr 24 15:45:56.783206 2026] [:error] [pid 17719:tid 17744] [client 20.240.45.42:50570] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aesftMTZ9gzEyL1BkPppxgAAAJE"]
[Fri Apr 24 15:45:57.398736 2026] [:error] [pid 17720:tid 17777] [client 20.240.45.42:4626] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aesftehlUs6BS3Ng7_UPMAAAANc"]
[Fri Apr 24 15:45:58.004524 2026] [:error] [pid 17808:tid 17833] [client 20.240.45.42:56841] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/update/f35.php"] [unique_id "aesftuarbOEFI8qshvLAPwAAAFc"]
[Fri Apr 24 15:45:58.582858 2026] [:error] [pid 17720:tid 17778] [client 20.240.45.42:52135] [client 20.240.45.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aesftuhlUs6BS3Ng7_UPMgAAANg"]
[Fri Apr 24 15:45:59.167750 2026] [:error] [pid 14531:tid 14554] [client 20.240.45.42:56854] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aesft3fLU2gw-6KR-GZqEgAAAVU"]
[Fri Apr 24 15:45:59.865146 2026] [:error] [pid 17719:tid 17751] [client 20.240.45.42:41946] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aesft8TZ9gzEyL1BkPppyQAAAJg"]
[Fri Apr 24 15:46:00.411832 2026] [:error] [pid 14531:tid 14550] [client 20.240.45.42:45908] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "aesfuHfLU2gw-6KR-GZqEwAAAVE"]
[Fri Apr 24 15:46:00.947347 2026] [:error] [pid 14531:tid 14543] [client 20.240.45.42:4670] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aesfuHfLU2gw-6KR-GZqFgAAAUo"]
[Fri Apr 24 15:46:01.609055 2026] [:error] [pid 17721:tid 17800] [client 20.240.45.42:50549] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aesfueFXXkLeyDnfk__vTAAAABM"]
[Fri Apr 24 15:46:02.286975 2026] [:error] [pid 22114:tid 22131] [client 20.240.45.42:4420] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aesfuoAuWGz3WlMQjoe3gwAAAQ4"]
[Fri Apr 24 15:46:02.869941 2026] [:error] [pid 22114:tid 22128] [client 20.240.45.42:41940] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/index.php"] [unique_id "aesfuoAuWGz3WlMQjoe3hAAAAQs"]
[Fri Apr 24 15:46:03.726073 2026] [:error] [pid 22114:tid 22123] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Fri Apr 24 15:46:03.991371 2026] [:error] [pid 22114:tid 22140] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/dev.php
[Fri Apr 24 15:46:04.259005 2026] [:error] [pid 22114:tid 22135] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Fri Apr 24 15:46:04.523822 2026] [:error] [pid 22114:tid 22132] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Fri Apr 24 15:46:04.824414 2026] [:error] [pid 22114:tid 22134] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Fri Apr 24 15:46:05.368504 2026] [:error] [pid 22114:tid 22133] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/bs1.php
[Fri Apr 24 15:46:05.917940 2026] [:error] [pid 22114:tid 22127] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/axx.php
[Fri Apr 24 15:46:06.189990 2026] [:error] [pid 22114:tid 22141] [client 20.240.45.42:41963] File does not exist: /usr/local/apache/htdocs/suspended-page/alfashell.php
[Fri Apr 24 15:46:06.453142 2026] [:error] [pid 22114:tid 22118] [client 20.240.45.42:41963] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aesfvoAuWGz3WlMQjoe3kAAAAQE"]
[Fri Apr 24 15:46:06.989854 2026] [:error] [pid 17719:tid 17750] [client 20.240.45.42:43574] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aesfvsTZ9gzEyL1BkPpp0QAAAJc"]
[Fri Apr 24 15:46:07.639784 2026] [:error] [pid 17808:tid 17823] [client 20.240.45.42:55545] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aesfv-arbOEFI8qshvLARQAAAE0"]
[Fri Apr 24 15:46:08.288899 2026] [:error] [pid 17720:tid 17762] [client 20.240.45.42:57996] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "aesfwOhlUs6BS3Ng7_UPOAAAAMg"]
[Fri Apr 24 15:46:08.987112 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:63807] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aesfwOhlUs6BS3Ng7_UPPAAAANE"]
[Fri Apr 24 15:46:09.717168 2026] [:error] [pid 17720:tid 17767] [client 20.240.45.42:49089] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aesfwehlUs6BS3Ng7_UPPwAAAM0"]
[Fri Apr 24 15:46:10.448845 2026] [:error] [pid 17720:tid 17777] [client 20.240.45.42:43548] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aesfwuhlUs6BS3Ng7_UPQgAAANc"]
[Fri Apr 24 15:46:11.061201 2026] [:error] [pid 17808:tid 17815] [client 20.240.45.42:55509] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "aesfw-arbOEFI8qshvLASQAAAEU"]
[Fri Apr 24 15:46:11.591686 2026] [:error] [pid 22114:tid 22119] [client 20.240.45.42:51796] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aesfw4AuWGz3WlMQjoe3lQAAAQI"]
[Fri Apr 24 15:46:12.245696 2026] [:error] [pid 17719:tid 17749] [client 20.240.45.42:55505] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aesfxMTZ9gzEyL1BkPpp1QAAAJY"]
[Fri Apr 24 15:46:12.886822 2026] [:error] [pid 17720:tid 17765] [client 20.240.45.42:65042] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aesfxOhlUs6BS3Ng7_UPSAAAAMs"]
[Fri Apr 24 15:46:13.576804 2026] [:error] [pid 17719:tid 17740] [client 20.240.45.42:55521] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "aesfxcTZ9gzEyL1BkPpp2QAAAI0"]
[Fri Apr 24 15:46:14.238856 2026] [:error] [pid 14531:tid 14552] [client 20.240.45.42:55548] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aesfxnfLU2gw-6KR-GZqIAAAAVM"]
[Fri Apr 24 15:46:14.768389 2026] [:error] [pid 17720:tid 17770] [client 20.240.45.42:4447] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aesfxuhlUs6BS3Ng7_UPTwAAANA"]
[Fri Apr 24 15:46:18.846320 2026] [:error] [pid 17719:tid 17750] [client 20.240.45.42:43565] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aesfysTZ9gzEyL1BkPpp3gAAAJc"]
[Fri Apr 24 15:46:19.699029 2026] [:error] [pid 17808:tid 17828] [client 20.240.45.42:55539] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/g.php"] [unique_id "aesfy-arbOEFI8qshvLAUAAAAFI"]
[Fri Apr 24 15:46:20.328433 2026] [:error] [pid 14531:tid 14546] [client 20.240.45.42:55491] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfzHfLU2gw-6KR-GZqIQAAAU0"]
[Fri Apr 24 15:46:20.952318 2026] [:error] [pid 17719:tid 17738] [client 20.240.45.42:63797] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfzMTZ9gzEyL1BkPpp4AAAAIs"]
[Fri Apr 24 15:46:21.496377 2026] [:error] [pid 14531:tid 14535] [client 20.240.45.42:56861] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfzXfLU2gw-6KR-GZqIwAAAUI"]
[Fri Apr 24 15:46:22.039615 2026] [:error] [pid 17721:tid 17785] [client 20.240.45.42:65069] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "aesfzuFXXkLeyDnfk__vWgAAAAQ"]
[Fri Apr 24 15:46:22.744373 2026] [:error] [pid 17719:tid 17740] [client 20.240.45.42:63802] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aesfzsTZ9gzEyL1BkPpp4QAAAI0"]
[Fri Apr 24 15:46:23.473117 2026] [:error] [pid 17720:tid 17773] [client 20.240.45.42:46606] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aesfz-hlUs6BS3Ng7_UPZQAAANM"]
[Fri Apr 24 15:46:24.255558 2026] [:error] [pid 17720:tid 17757] [client 20.240.45.42:46605] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aesf0OhlUs6BS3Ng7_UPaQAAAMM"]
[Fri Apr 24 15:46:24.866576 2026] [:error] [pid 17721:tid 17781] [client 20.240.45.42:65031] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "aesf0OFXXkLeyDnfk__vXQAAAAA"]
[Fri Apr 24 15:46:26.136541 2026] [:error] [pid 17808:tid 17827] [client 20.240.45.42:52084] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aesf0uarbOEFI8qshvLAXAAAAFE"]
[Fri Apr 24 15:46:26.945931 2026] [:error] [pid 17721:tid 17792] [client 20.240.45.42:60049] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aesf0uFXXkLeyDnfk__vYAAAAAs"]
[Fri Apr 24 15:46:27.510812 2026] [:error] [pid 17721:tid 17783] [client 20.240.45.42:57255] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aesf0-FXXkLeyDnfk__vZQAAAAI"]
[Fri Apr 24 15:46:28.072664 2026] [:error] [pid 17808:tid 17822] [client 20.240.45.42:63356] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ew.php"] [unique_id "aesf1OarbOEFI8qshvLAYwAAAEw"]
[Fri Apr 24 15:46:28.318537 2026] [:error] [pid 17719:tid 17736] [client 170.106.8.192:35880] [client 170.106.8.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aesf1MTZ9gzEyL1BkPpp5wAAAIk"]
[Fri Apr 24 15:46:28.660437 2026] [:error] [pid 17719:tid 17733] [client 20.240.45.42:60062] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aesf1MTZ9gzEyL1BkPpp6AAAAIY"]
[Fri Apr 24 15:46:29.271750 2026] [:error] [pid 17720:tid 17771] [client 20.240.45.42:58040] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aesf1ehlUs6BS3Ng7_UPbwAAANE"]
[Fri Apr 24 15:46:30.021558 2026] [:error] [pid 17720:tid 17777] [client 20.240.45.42:60052] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aesf1uhlUs6BS3Ng7_UPcgAAANc"]
[Fri Apr 24 15:46:30.723688 2026] [:error] [pid 14531:tid 14538] [client 20.240.45.42:60070] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file21.php"] [unique_id "aesf1nfLU2gw-6KR-GZqLAAAAUU"]
[Fri Apr 24 15:46:31.397304 2026] [:error] [pid 17720:tid 17765] [client 20.240.45.42:60054] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aesf1-hlUs6BS3Ng7_UPdwAAAMs"]
[Fri Apr 24 15:46:32.072845 2026] [:error] [pid 14531:tid 14552] [client 20.240.45.42:60834] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aesf2HfLU2gw-6KR-GZqLgAAAVM"]
[Fri Apr 24 15:46:32.838177 2026] [:error] [pid 17719:tid 17735] [client 20.240.45.42:4548] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aesf2MTZ9gzEyL1BkPpp7gAAAIg"]
[Fri Apr 24 15:46:33.452316 2026] [:error] [pid 17719:tid 17751] [client 20.240.45.42:4606] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "aesf2cTZ9gzEyL1BkPpp8AAAAJg"]
[Fri Apr 24 15:46:34.041216 2026] [:error] [pid 22114:tid 22138] [client 20.240.45.42:41897] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aesf2oAuWGz3WlMQjoe3nAAAARU"]
[Fri Apr 24 15:46:34.669196 2026] [:error] [pid 17720:tid 17761] [client 20.240.45.42:44586] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aesf2uhlUs6BS3Ng7_UPfAAAAMc"]
[Fri Apr 24 15:46:35.256340 2026] [:error] [pid 17808:tid 17825] [client 20.240.45.42:63851] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aesf2-arbOEFI8qshvLAaAAAAE8"]
[Fri Apr 24 15:46:35.782980 2026] [:error] [pid 14531:tid 14544] [client 20.240.45.42:64232] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "aesf23fLU2gw-6KR-GZqMwAAAUs"]
[Fri Apr 24 15:46:36.595342 2026] [:error] [pid 22114:tid 22136] [client 20.240.45.42:63301] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aesf3IAuWGz3WlMQjoe3ngAAARM"]
[Fri Apr 24 15:46:37.248893 2026] [:error] [pid 17720:tid 17766] [client 20.240.45.42:60064] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aesf3ehlUs6BS3Ng7_UPfwAAAMw"]
[Fri Apr 24 15:46:37.783874 2026] [:error] [pid 17720:tid 17756] [client 20.240.45.42:46251] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aesf3ehlUs6BS3Ng7_UPgAAAAMI"]
[Fri Apr 24 15:46:38.425642 2026] [:error] [pid 22114:tid 22123] [client 20.240.45.42:60804] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "aesf3oAuWGz3WlMQjoe3owAAAQY"]
[Fri Apr 24 15:46:39.064090 2026] [:error] [pid 17721:tid 17803] [client 20.240.45.42:64210] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aesf3-FXXkLeyDnfk__vbAAAABY"]
[Fri Apr 24 15:46:39.856532 2026] [:error] [pid 17720:tid 17758] [client 20.240.45.42:42945] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aesf3-hlUs6BS3Ng7_UPgwAAAMQ"]
[Fri Apr 24 15:46:40.492129 2026] [:error] [pid 17720:tid 17754] [client 20.240.45.42:4590] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aesf4OhlUs6BS3Ng7_UPhwAAAMA"]
[Fri Apr 24 15:46:41.320101 2026] [:error] [pid 17720:tid 17760] [client 20.240.45.42:63832] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aesf4ehlUs6BS3Ng7_UPjAAAAMY"]
[Fri Apr 24 15:46:41.854268 2026] [:error] [pid 17720:tid 17776] [client 20.240.45.42:59833] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aesf4ehlUs6BS3Ng7_UPjwAAANY"]
[Fri Apr 24 15:46:42.523095 2026] [:error] [pid 17721:tid 17798] [client 20.240.45.42:59802] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aesf4uFXXkLeyDnfk__vbwAAABE"]
[Fri Apr 24 15:46:43.239068 2026] [:error] [pid 17720:tid 17769] [client 20.240.45.42:47617] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aesf4-hlUs6BS3Ng7_UPkgAAAM8"]
[Fri Apr 24 15:46:43.915338 2026] [:error] [pid 17719:tid 17730] [client 20.240.45.42:4902] [client 20.240.45.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "aesf48TZ9gzEyL1BkPpp9gAAAIM"]
[Fri Apr 24 15:59:48.052748 2026] [:error] [pid 17719:tid 17735] [client 43.166.136.202:48574] [client 43.166.136.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aesi9MTZ9gzEyL1BkPprmgAAAIg"]
[Fri Apr 24 16:18:26.985324 2026] [:error] [pid 22114:tid 22123] [client 43.156.50.197:56000] [client 43.156.50.197] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aesnUoAuWGz3WlMQjoe8jwAAAQY"]
[Fri Apr 24 17:58:37.712500 2026] [:error] [pid 17719:tid 17737] [client 34.58.239.158:64391] [client 34.58.239.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aes-zcTZ9gzEyL1BkPqHOAAAAIo"]
[Fri Apr 24 18:09:28.660580 2026] [:error] [pid 14531:tid 14556] [client 129.226.209.117:50454] [client 129.226.209.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aetBWHfLU2gw-6KR-GacJAAAAVc"]
[Fri Apr 24 18:33:38.824469 2026] [:error] [pid 22114:tid 22131] [client 46.202.159.45:41084] [client 46.202.159.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aetHAoAuWGz3WlMQjofWlgAAAQ4"]
[Fri Apr 24 18:50:43.468532 2026] [:error] [pid 17720:tid 17778] [client 43.153.85.46:46232] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aetLA-hlUs6BS3Ng7_V0PwAAANg"]
[Fri Apr 24 22:34:23.552673 2026] [:error] [pid 14531:tid 14538] [client 43.163.206.70:59264] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aet_b3fLU2gw-6KR-GblowAAAUU"]
[Sat Apr 25 02:34:19.067137 2026] [:error] [pid 42852:tid 42868] [client 43.157.168.43:41328] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aeu3qzMEwxhhak_EhMK1MAAAAk0"]
[Sat Apr 25 04:50:09.274803 2026] [:error] [pid 44425:tid 44429] [client 121.229.185.160:46662] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aevXgSUl-VlItvY2tR_lUgAAAMI"]
[Sat Apr 25 05:20:49.758970 2026] [:error] [pid 46083:tid 46102] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/aboutc.php
[Sat Apr 25 05:20:50.025545 2026] [:error] [pid 46083:tid 46100] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/new4.php
[Sat Apr 25 05:20:50.264446 2026] [:error] [pid 46083:tid 46093] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/hroxw.php
[Sat Apr 25 05:20:50.514966 2026] [:error] [pid 46083:tid 46099] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blogs.php
[Sat Apr 25 05:20:50.750635 2026] [:error] [pid 46083:tid 46101] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/set.php
[Sat Apr 25 05:20:50.985499 2026] [:error] [pid 46083:tid 46104] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sat Apr 25 05:20:51.459896 2026] [:error] [pid 46083:tid 46096] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/ws57.php
[Sat Apr 25 05:20:51.705098 2026] [:error] [pid 46083:tid 46088] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/domains.php
[Sat Apr 25 05:20:51.941870 2026] [:error] [pid 46083:tid 46111] [client 4.232.189.4:12994] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sat Apr 25 05:20:52.174651 2026] [:error] [pid 46083:tid 46095] [client 4.232.189.4:12994] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/166.php"] [unique_id "aevetDxw_Zq74vWdjmkXbwAAAQg"]
[Sat Apr 25 05:20:54.380050 2026] [:error] [pid 44321:tid 44398] [client 4.232.189.4:15579] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/166.php"] [unique_id "aeveto1b5lV-asWa_Y4bXQAAAI8"]
[Sat Apr 25 05:20:58.064846 2026] [:error] [pid 44425:tid 44442] [client 4.232.189.4:33336] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/166.php"] [unique_id "aeveuiUl-VlItvY2tR_xLgAAAM8"]
[Sat Apr 25 05:20:59.598045 2026] [:error] [pid 44425:tid 44446] [client 4.232.189.4:18744] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/166.php"] [unique_id "aeveuyUl-VlItvY2tR_xMQAAANM"]
[Sat Apr 25 05:21:00.870571 2026] [:error] [pid 44425:tid 44437] [client 4.232.189.4:15307] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aevevCUl-VlItvY2tR_xMwAAAMo"]
[Sat Apr 25 05:21:02.064427 2026] [:error] [pid 46083:tid 46096] [client 4.232.189.4:15347] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aevevjxw_Zq74vWdjmkXfgAAAQk"]
[Sat Apr 25 05:21:04.188619 2026] [:error] [pid 44320:tid 44357] [client 4.232.189.4:12735] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aevewDmFqSpku_dij8hpAAAAAEE"]
[Sat Apr 25 05:21:05.957508 2026] [:error] [pid 44321:tid 44400] [client 4.232.189.4:11592] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/term.php"] [unique_id "aevewY1b5lV-asWa_Y4bYQAAAJE"]
[Sat Apr 25 05:21:08.077442 2026] [:error] [pid 44321:tid 44385] [client 4.232.189.4:15301] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aevexI1b5lV-asWa_Y4bZgAAAII"]
[Sat Apr 25 05:21:10.411085 2026] [:error] [pid 46083:tid 46104] [client 4.232.189.4:12687] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aevexjxw_Zq74vWdjmkXjwAAARE"]
[Sat Apr 25 05:21:11.401797 2026] [:error] [pid 46083:tid 46099] [client 4.232.189.4:11589] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aevexzxw_Zq74vWdjmkXkgAAAQw"]
[Sat Apr 25 05:21:12.593077 2026] [:error] [pid 44321:tid 44391] [client 4.232.189.4:13020] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/666.php"] [unique_id "aeveyI1b5lV-asWa_Y4bagAAAIg"]
[Sat Apr 25 05:21:13.614682 2026] [:error] [pid 44320:tid 44372] [client 4.232.189.4:20280] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aeveyTmFqSpku_dij8hpBAAAAFA"]
[Sat Apr 25 05:21:15.416359 2026] [:error] [pid 44319:tid 44346] [client 4.232.189.4:18522] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aevey8zJPAVLUb2pWtJHMAAAABE"]
[Sat Apr 25 05:21:16.836656 2026] [:error] [pid 44320:tid 44366] [client 4.232.189.4:31402] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aevezDmFqSpku_dij8hpCwAAAEo"]
[Sat Apr 25 05:21:18.749549 2026] [:error] [pid 44321:tid 44383] [client 4.232.189.4:19762] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tt.php"] [unique_id "aevezo1b5lV-asWa_Y4bcgAAAIA"]
[Sat Apr 25 05:21:21.103998 2026] [:error] [pid 44320:tid 44361] [client 4.232.189.4:18715] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "aeve0TmFqSpku_dij8hpDQAAAEU"]
[Sat Apr 25 05:21:24.800277 2026] [:error] [pid 46083:tid 46100] [client 4.232.189.4:31420] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "aeve1Dxw_Zq74vWdjmkX2wAAAQ0"]
[Sat Apr 25 05:21:27.115497 2026] [:error] [pid 44321:tid 44398] [client 4.232.189.4:15599] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "aeve141b5lV-asWa_Y4buAAAAI8"]
[Sat Apr 25 05:21:30.000826 2026] [:error] [pid 46083:tid 46101] [client 4.232.189.4:13770] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/sid3.php"] [unique_id "aeve2Txw_Zq74vWdjmkX6QAAAQ4"]
[Sat Apr 25 05:21:32.785951 2026] [:error] [pid 44319:tid 44339] [client 4.232.189.4:15604] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aeve3MzJPAVLUb2pWtJHOwAAAAo"]
[Sat Apr 25 05:21:34.975996 2026] [:error] [pid 44320:tid 44373] [client 4.232.189.4:60311] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aeve3jmFqSpku_dij8hpHgAAAFE"]
[Sat Apr 25 05:21:36.468302 2026] [:error] [pid 44320:tid 44372] [client 4.232.189.4:15359] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aeve4DmFqSpku_dij8hpJAAAAFA"]
[Sat Apr 25 05:21:37.500341 2026] [:error] [pid 46083:tid 46095] [client 4.232.189.4:15589] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/66.php"] [unique_id "aeve4Txw_Zq74vWdjmkX_AAAAQg"]
[Sat Apr 25 05:21:39.634307 2026] [:error] [pid 46083:tid 46112] [client 4.232.189.4:18702] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeve4zxw_Zq74vWdjmkYAgAAARg"]
[Sat Apr 25 05:21:41.234258 2026] [:error] [pid 46083:tid 46097] [client 4.232.189.4:1573] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeve5Txw_Zq74vWdjmkYBgAAAQo"]
[Sat Apr 25 05:21:43.053644 2026] [:error] [pid 46083:tid 46098] [client 4.232.189.4:13767] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeve5zxw_Zq74vWdjmkYCQAAAQs"]
[Sat Apr 25 05:21:45.567691 2026] [:error] [pid 46083:tid 46092] [client 4.232.189.4:19725] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-the.php"] [unique_id "aeve6Txw_Zq74vWdjmkYEQAAAQU"]
[Sat Apr 25 05:21:47.642168 2026] [:error] [pid 44321:tid 44396] [client 4.232.189.4:60293] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeve641b5lV-asWa_Y4bxgAAAI0"]
[Sat Apr 25 05:21:48.767512 2026] [:error] [pid 44425:tid 44450] [client 4.232.189.4:15612] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeve7CUl-VlItvY2tR_xZAAAANc"]
[Sat Apr 25 05:21:50.070732 2026] [:error] [pid 46083:tid 46099] [client 4.232.189.4:12714] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/jga.php"] [unique_id "aeve7jxw_Zq74vWdjmkYGQAAAQw"]
[Sat Apr 25 05:21:51.294835 2026] [:error] [pid 46083:tid 46108] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/jga.php
[Sat Apr 25 05:21:52.151754 2026] [:error] [pid 46083:tid 46108] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog-header.php
[Sat Apr 25 05:21:52.389797 2026] [:error] [pid 46083:tid 46101] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/bmi.php
[Sat Apr 25 05:21:52.625381 2026] [:error] [pid 46083:tid 46091] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/byypas.php
[Sat Apr 25 05:21:53.100141 2026] [:error] [pid 46083:tid 46107] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-png.php
[Sat Apr 25 05:21:53.335958 2026] [:error] [pid 46083:tid 46109] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/wen.php
[Sat Apr 25 05:21:53.571885 2026] [:error] [pid 46083:tid 46092] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-install.php
[Sat Apr 25 05:21:54.056635 2026] [:error] [pid 46083:tid 46097] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Sat Apr 25 05:21:54.293129 2026] [:error] [pid 46083:tid 46105] [client 4.232.189.4:25173] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Sat Apr 25 05:21:54.543058 2026] [:error] [pid 46083:tid 46100] [client 4.232.189.4:25173] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aeve8jxw_Zq74vWdjmkYLgAAAQ0"]
[Sat Apr 25 05:21:56.119950 2026] [:error] [pid 44425:tid 44434] [client 4.232.189.4:15576] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aeve9CUl-VlItvY2tR_xcQAAAMc"]
[Sat Apr 25 05:21:58.947041 2026] [:error] [pid 46083:tid 46105] [client 4.232.189.4:15351] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aeve9jxw_Zq74vWdjmkYOQAAARI"]
[Sat Apr 25 05:22:05.435456 2026] [:error] [pid 44319:tid 44348] [client 4.232.189.4:15326] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/shell.php"] [unique_id "aeve_czJPAVLUb2pWtJHgQAAABM"]
[Sat Apr 25 05:22:06.776164 2026] [:error] [pid 44320:tid 44364] [client 4.232.189.4:16633] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aeve_jmFqSpku_dij8hpRwAAAEg"]
[Sat Apr 25 05:22:08.410188 2026] [:error] [pid 44321:tid 44384] [client 4.232.189.4:56108] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aevfAI1b5lV-asWa_Y4b4wAAAIE"]
[Sat Apr 25 05:22:10.421518 2026] [:error] [pid 44425:tid 44432] [client 4.232.189.4:58728] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aevfAiUl-VlItvY2tR_xiAAAAMU"]
[Sat Apr 25 05:22:11.181831 2026] [:error] [pid 46083:tid 46094] [client 4.232.189.4:1081] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/new.php"] [unique_id "aevfAzxw_Zq74vWdjmkYSAAAAQc"]
[Sat Apr 25 05:22:11.903453 2026] [:error] [pid 44320:tid 44371] [client 4.232.189.4:57446] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aevfAzmFqSpku_dij8hpTAAAAE8"]
[Sat Apr 25 05:22:14.230581 2026] [:error] [pid 44425:tid 44433] [client 4.232.189.4:56067] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aevfBiUl-VlItvY2tR_xjAAAAMY"]
[Sat Apr 25 05:22:16.546215 2026] [:error] [pid 44321:tid 44384] [client 4.232.189.4:14978] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aevfCI1b5lV-asWa_Y4b7wAAAIE"]
[Sat Apr 25 05:22:18.342282 2026] [:error] [pid 46083:tid 46104] [client 4.232.189.4:45370] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/edit.php"] [unique_id "aevfCjxw_Zq74vWdjmkYUAAAARE"]
[Sat Apr 25 05:22:21.066323 2026] [:error] [pid 46083:tid 46087] [client 4.232.189.4:45361] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws48.php"] [unique_id "aevfDTxw_Zq74vWdjmkYVAAAAQA"]
[Sat Apr 25 05:22:22.372472 2026] [:error] [pid 44321:tid 44390] [client 4.232.189.4:15009] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws48.php"] [unique_id "aevfDo1b5lV-asWa_Y4b8wAAAIc"]
[Sat Apr 25 05:22:25.091300 2026] [:error] [pid 44425:tid 44450] [client 4.232.189.4:12379] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws48.php"] [unique_id "aevfESUl-VlItvY2tR_xlgAAANc"]
[Sat Apr 25 05:22:27.310983 2026] [:error] [pid 44321:tid 44393] [client 4.232.189.4:45323] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws48.php"] [unique_id "aevfE41b5lV-asWa_Y4b_QAAAIo"]
[Sat Apr 25 05:22:28.103083 2026] [:error] [pid 44321:tid 44388] [client 4.232.189.4:23068] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aevfFI1b5lV-asWa_Y4cAgAAAIU"]
[Sat Apr 25 05:22:29.959008 2026] [:error] [pid 46083:tid 46110] [client 4.232.189.4:14983] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aevfFTxw_Zq74vWdjmkYWQAAARY"]
[Sat Apr 25 05:22:31.534222 2026] [:error] [pid 44425:tid 44436] [client 4.232.189.4:12375] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aevfFyUl-VlItvY2tR_xpQAAAMk"]
[Sat Apr 25 05:22:32.109944 2026] [:error] [pid 46083:tid 46092] [client 4.232.189.4:18966] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/8.php"] [unique_id "aevfGDxw_Zq74vWdjmkYXAAAAQU"]
[Sat Apr 25 05:22:34.921289 2026] [:error] [pid 46083:tid 46100] [client 4.232.189.4:23080] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dass.php"] [unique_id "aevfGjxw_Zq74vWdjmkYYQAAAQ0"]
[Sat Apr 25 05:22:37.205484 2026] [:error] [pid 44319:tid 44339] [client 4.232.189.4:16304] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dass.php"] [unique_id "aevfHczJPAVLUb2pWtJHqwAAAAo"]
[Sat Apr 25 05:22:40.490379 2026] [:error] [pid 44320:tid 44373] [client 4.232.189.4:16820] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dass.php"] [unique_id "aevfIDmFqSpku_dij8hpYwAAAFE"]
[Sat Apr 25 05:22:43.654627 2026] [:error] [pid 44425:tid 44437] [client 4.232.189.4:41120] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dass.php"] [unique_id "aevfIyUl-VlItvY2tR_xswAAAMo"]
[Sat Apr 25 05:22:46.362414 2026] [:error] [pid 44321:tid 44392] [client 4.232.189.4:12076] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aevfJo1b5lV-asWa_Y4cEgAAAIk"]
[Sat Apr 25 05:22:48.549856 2026] [:error] [pid 44320:tid 44356] [client 4.232.189.4:14816] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aevfKDmFqSpku_dij8hpbQAAAEA"]
[Sat Apr 25 05:22:50.008702 2026] [:error] [pid 44321:tid 44391] [client 4.232.189.4:45369] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aevfKo1b5lV-asWa_Y4cGwAAAIg"]
[Sat Apr 25 05:22:53.497702 2026] [:error] [pid 46083:tid 46091] [client 4.232.189.4:12046] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aevfLTxw_Zq74vWdjmkYegAAAQQ"]
[Sat Apr 25 05:22:59.860312 2026] [:error] [pid 44320:tid 44371] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sat Apr 25 05:23:00.098998 2026] [:error] [pid 44320:tid 44360] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Sat Apr 25 05:23:00.338400 2026] [:error] [pid 44320:tid 44361] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/ws66.php
[Sat Apr 25 05:23:00.575762 2026] [:error] [pid 44320:tid 44370] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Sat Apr 25 05:23:00.817675 2026] [:error] [pid 44320:tid 44372] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/asd.php
[Sat Apr 25 05:23:01.054035 2026] [:error] [pid 44320:tid 44364] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/xx.php
[Sat Apr 25 05:23:01.292638 2026] [:error] [pid 44320:tid 44359] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Sat Apr 25 05:23:01.536017 2026] [:error] [pid 44320:tid 44368] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Sat Apr 25 05:23:01.776508 2026] [:error] [pid 44320:tid 44357] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sat Apr 25 05:23:02.013388 2026] [:error] [pid 44320:tid 44376] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/mh.php
[Sat Apr 25 05:23:02.256323 2026] [:error] [pid 44320:tid 44378] [client 4.232.189.4:9350] File does not exist: /usr/local/apache/htdocs/suspended-page/Jcrop.php
[Sat Apr 25 05:23:02.490381 2026] [:error] [pid 44320:tid 44374] [client 4.232.189.4:9350] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aevfNjmFqSpku_dij8hpgQAAAFI"]
[Sat Apr 25 05:23:03.652950 2026] [:error] [pid 44321:tid 44404] [client 4.232.189.4:18777] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aevfN41b5lV-asWa_Y4cKAAAAJU"]
[Sat Apr 25 05:23:05.314115 2026] [:error] [pid 44319:tid 44331] [client 4.232.189.4:58094] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aevfOczJPAVLUb2pWtJHvAAAAAI"]
[Sat Apr 25 05:23:07.243907 2026] [:error] [pid 44425:tid 44440] [client 4.232.189.4:54940] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/abc.php"] [unique_id "aevfOyUl-VlItvY2tR_xwwAAAM0"]
[Sat Apr 25 05:23:08.732085 2026] [:error] [pid 46083:tid 46087] [client 4.232.189.4:9174] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aevfPDxw_Zq74vWdjmkYjQAAAQA"]
[Sat Apr 25 05:23:12.331149 2026] [:error] [pid 44321:tid 44383] [client 4.232.189.4:9187] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aevfQI1b5lV-asWa_Y4cNAAAAIA"]
[Sat Apr 25 05:23:13.678698 2026] [:error] [pid 44425:tid 44435] [client 4.232.189.4:12047] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aevfQSUl-VlItvY2tR_xxAAAAMg"]
[Sat Apr 25 05:23:16.059473 2026] [:error] [pid 44321:tid 44397] [client 4.232.189.4:20320] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/inputs.php"] [unique_id "aevfRI1b5lV-asWa_Y4cOgAAAI4"]
[Sat Apr 25 05:23:18.845322 2026] [:error] [pid 44319:tid 44343] [client 4.232.189.4:23520] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnm.php"] [unique_id "aevfRszJPAVLUb2pWtJHygAAAA4"]
[Sat Apr 25 05:23:21.867077 2026] [:error] [pid 44425:tid 44446] [client 4.232.189.4:11366] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnm.php"] [unique_id "aevfSSUl-VlItvY2tR_xzAAAANM"]
[Sat Apr 25 05:23:23.576964 2026] [:error] [pid 44320:tid 44372] [client 4.232.189.4:1816] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnm.php"] [unique_id "aevfSzmFqSpku_dij8hpmgAAAFA"]
[Sat Apr 25 05:23:27.311839 2026] [:error] [pid 46083:tid 46099] [client 4.232.189.4:33407] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bnm.php"] [unique_id "aevfTzxw_Zq74vWdjmkYmQAAAQw"]
[Sat Apr 25 05:23:36.035679 2026] [:error] [pid 44320:tid 44359] [client 4.232.189.4:19027] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aevfWDmFqSpku_dij8hpoQAAAEM"]
[Sat Apr 25 05:23:39.685664 2026] [:error] [pid 44425:tid 44449] [client 4.232.189.4:19535] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aevfWyUl-VlItvY2tR_x5wAAANY"]
[Sat Apr 25 05:23:40.936690 2026] [:error] [pid 44425:tid 44437] [client 4.232.189.4:40606] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws80.php"] [unique_id "aevfXCUl-VlItvY2tR_x7QAAAMo"]
[Sat Apr 25 05:23:43.703419 2026] [:error] [pid 44425:tid 44438] [client 4.232.189.4:30253] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "aevfXyUl-VlItvY2tR_x9AAAAMs"]
[Sat Apr 25 05:23:47.535537 2026] [:error] [pid 44321:tid 44400] [client 4.232.189.4:26177] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "aevfY41b5lV-asWa_Y4cUQAAAJE"]
[Sat Apr 25 05:23:49.584118 2026] [:error] [pid 46083:tid 46095] [client 4.232.189.4:12138] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "aevfZTxw_Zq74vWdjmkYzQAAAQg"]
[Sat Apr 25 05:23:50.398593 2026] [:error] [pid 44425:tid 44445] [client 4.232.189.4:32666] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/network/users.php"] [unique_id "aevfZiUl-VlItvY2tR_x_QAAANI"]
[Sat Apr 25 05:23:53.616026 2026] [:error] [pid 44319:tid 44352] [client 4.232.189.4:33382] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "aevfaczJPAVLUb2pWtJH6QAAABc"]
[Sat Apr 25 05:23:54.757275 2026] [:error] [pid 46083:tid 46097] [client 4.232.189.4:1846] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "aevfajxw_Zq74vWdjmkY2wAAAQo"]
[Sat Apr 25 05:23:56.854684 2026] [:error] [pid 44319:tid 44333] [client 4.232.189.4:32686] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "aevfbMzJPAVLUb2pWtJH6wAAAAQ"]
[Sat Apr 25 05:23:58.946653 2026] [:error] [pid 46083:tid 46094] [client 4.232.189.4:20544] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/s.php"] [unique_id "aevfbjxw_Zq74vWdjmkY6AAAAQc"]
[Sat Apr 25 05:24:00.883829 2026] [:error] [pid 46083:tid 46097] [client 4.232.189.4:19569] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tymn.php"] [unique_id "aevfcDxw_Zq74vWdjmkY7wAAAQo"]
[Sat Apr 25 05:24:04.170983 2026] [:error] [pid 44425:tid 44430] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/tymn.php
[Sat Apr 25 05:24:04.407314 2026] [:error] [pid 44425:tid 44437] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sat Apr 25 05:24:04.644719 2026] [:error] [pid 44425:tid 44445] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Sat Apr 25 05:24:04.890865 2026] [:error] [pid 44425:tid 44433] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/ms.php
[Sat Apr 25 05:24:05.135089 2026] [:error] [pid 44425:tid 44444] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-access.php
[Sat Apr 25 05:24:05.374317 2026] [:error] [pid 44425:tid 44438] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-atom.php
[Sat Apr 25 05:24:05.613355 2026] [:error] [pid 44425:tid 44451] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sat Apr 25 05:24:05.858955 2026] [:error] [pid 44425:tid 44431] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Sat Apr 25 05:24:06.096417 2026] [:error] [pid 44425:tid 44450] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/900.php
[Sat Apr 25 05:24:06.333886 2026] [:error] [pid 44425:tid 44435] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-links-opml.php
[Sat Apr 25 05:24:06.574476 2026] [:error] [pid 44425:tid 44432] [client 4.232.189.4:41177] File does not exist: /usr/local/apache/htdocs/suspended-page/jk.php
[Sat Apr 25 05:24:06.808524 2026] [:error] [pid 44425:tid 44427] [client 4.232.189.4:41177] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aevfdiUl-VlItvY2tR_yEAAAAMA"]
[Sat Apr 25 05:24:09.122683 2026] [:error] [pid 44425:tid 44429] [client 4.232.189.4:29644] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aevfeSUl-VlItvY2tR_yFQAAAMI"]
[Sat Apr 25 05:24:11.493632 2026] [:error] [pid 44320:tid 44379] [client 4.232.189.4:1165] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aevfezmFqSpku_dij8hpwAAAAFc"]
[Sat Apr 25 05:24:13.656390 2026] [:error] [pid 46083:tid 46094] [client 4.232.189.4:17120] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dx.php"] [unique_id "aevffTxw_Zq74vWdjmkY_gAAAQc"]
[Sat Apr 25 05:24:15.189327 2026] [:error] [pid 46083:tid 46107] [client 4.232.189.4:20010] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aevffzxw_Zq74vWdjmkZAwAAARM"]
[Sat Apr 25 05:24:16.736938 2026] [:error] [pid 46083:tid 46097] [client 4.232.189.4:27192] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aevfgDxw_Zq74vWdjmkZBgAAAQo"]
[Sat Apr 25 05:24:18.374694 2026] [:error] [pid 46083:tid 46103] [client 4.232.189.4:15843] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aevfgjxw_Zq74vWdjmkZDAAAARA"]
[Sat Apr 25 05:24:19.745935 2026] [:error] [pid 46083:tid 46100] [client 4.232.189.4:9666] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/aa.php"] [unique_id "aevfgzxw_Zq74vWdjmkZDgAAAQ0"]
[Sat Apr 25 05:24:24.239363 2026] [:error] [pid 44320:tid 44369] [client 4.232.189.4:19569] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mini.php"] [unique_id "aevfiDmFqSpku_dij8hpyQAAAE0"]
[Sat Apr 25 05:24:26.597871 2026] [:error] [pid 44320:tid 44376] [client 4.232.189.4:33934] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mini.php"] [unique_id "aevfijmFqSpku_dij8hp1QAAAFQ"]
[Sat Apr 25 05:24:27.623380 2026] [:error] [pid 44320:tid 44372] [client 4.232.189.4:22487] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mini.php"] [unique_id "aevfizmFqSpku_dij8hp2AAAAFA"]
[Sat Apr 25 05:24:28.645822 2026] [:error] [pid 44425:tid 44443] [client 4.232.189.4:13274] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mini.php"] [unique_id "aevfjCUl-VlItvY2tR_yLgAAANA"]
[Sat Apr 25 05:24:29.999655 2026] [:error] [pid 44321:tid 44383] [client 4.232.189.4:16101] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aevfjY1b5lV-asWa_Y4cggAAAIA"]
[Sat Apr 25 05:24:31.887945 2026] [:error] [pid 44425:tid 44434] [client 4.232.189.4:13263] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aevfjyUl-VlItvY2tR_yNQAAAMc"]
[Sat Apr 25 05:24:33.084429 2026] [:error] [pid 44320:tid 44361] [client 4.232.189.4:32080] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aevfkTmFqSpku_dij8hp-AAAAEU"]
[Sat Apr 25 05:24:35.089654 2026] [:error] [pid 44320:tid 44371] [client 4.232.189.4:17301] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/fs.php"] [unique_id "aevfkzmFqSpku_dij8hp_AAAAE8"]
[Sat Apr 25 05:24:37.438183 2026] [:error] [pid 44425:tid 44441] [client 4.232.189.4:44642] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aevflSUl-VlItvY2tR_yQwAAAM4"]
[Sat Apr 25 05:24:39.696732 2026] [:error] [pid 44425:tid 44435] [client 4.232.189.4:17537] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aevflyUl-VlItvY2tR_ySQAAAMg"]
[Sat Apr 25 05:24:43.255747 2026] [:error] [pid 44320:tid 44359] [client 4.232.189.4:14020] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aevfmzmFqSpku_dij8hqBwAAAEM"]
[Sat Apr 25 05:24:45.061540 2026] [:error] [pid 44321:tid 44391] [client 4.232.189.4:14079] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mode.php"] [unique_id "aevfnY1b5lV-asWa_Y4cmAAAAIg"]
[Sat Apr 25 05:24:48.042723 2026] [:error] [pid 44319:tid 44329] [client 4.232.189.4:13465] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aevfoMzJPAVLUb2pWtJIBgAAAAA"]
[Sat Apr 25 05:24:49.661742 2026] [:error] [pid 44425:tid 44443] [client 4.232.189.4:16363] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aevfoSUl-VlItvY2tR_ybwAAANA"]
[Sat Apr 25 05:24:50.604318 2026] [:error] [pid 46083:tid 46102] [client 4.232.189.4:1312] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aevfojxw_Zq74vWdjmkZOwAAAQ8"]
[Sat Apr 25 05:24:51.653871 2026] [:error] [pid 46083:tid 46109] [client 4.232.189.4:13475] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/1.php"] [unique_id "aevfozxw_Zq74vWdjmkZQgAAARU"]
[Sat Apr 25 05:24:52.423370 2026] [:error] [pid 44320:tid 44356] [client 4.232.189.4:15040] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-block.php"] [unique_id "aevfpDmFqSpku_dij8hqHwAAAEA"]
[Sat Apr 25 05:24:54.434862 2026] [:error] [pid 44425:tid 44445] [client 4.232.189.4:22421] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-block.php"] [unique_id "aevfpiUl-VlItvY2tR_ykgAAANI"]
[Sat Apr 25 05:24:55.474058 2026] [:error] [pid 44425:tid 44450] [client 4.232.189.4:45949] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-block.php"] [unique_id "aevfpyUl-VlItvY2tR_ymwAAANc"]
[Sat Apr 25 05:24:56.738292 2026] [:error] [pid 44319:tid 44348] [client 4.232.189.4:45946] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-block.php"] [unique_id "aevfqMzJPAVLUb2pWtJIJAAAABM"]
[Sat Apr 25 05:24:59.304102 2026] [:error] [pid 46083:tid 46107] [client 4.232.189.4:16538] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws88.php"] [unique_id "aevfqzxw_Zq74vWdjmkZWAAAARM"]
[Sat Apr 25 05:25:01.838883 2026] [:error] [pid 44320:tid 44362] [client 4.232.189.4:31431] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws88.php"] [unique_id "aevfrTmFqSpku_dij8hqJAAAAEY"]
[Sat Apr 25 05:25:02.810941 2026] [:error] [pid 46083:tid 46098] [client 4.232.189.4:1309] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws88.php"] [unique_id "aevfrjxw_Zq74vWdjmkZZwAAAQs"]
[Sat Apr 25 05:25:04.383587 2026] [:error] [pid 44319:tid 44336] [client 4.232.189.4:15042] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ws88.php"] [unique_id "aevfsMzJPAVLUb2pWtJILQAAAAc"]
[Sat Apr 25 05:25:05.413401 2026] [:error] [pid 44319:tid 44334] [client 4.232.189.4:32002] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/adoms.php"] [unique_id "aevfsczJPAVLUb2pWtJIMgAAAAU"]
[Sat Apr 25 05:25:07.106722 2026] [:error] [pid 44319:tid 44339] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/adoms.php
[Sat Apr 25 05:25:07.350420 2026] [:error] [pid 44319:tid 44347] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/plugin-editor.php
[Sat Apr 25 05:25:09.029966 2026] [:error] [pid 44319:tid 44347] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/8573.php
[Sat Apr 25 05:25:09.265758 2026] [:error] [pid 44319:tid 44338] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat Apr 25 05:25:09.502203 2026] [:error] [pid 44319:tid 44334] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/t.php
[Sat Apr 25 05:25:09.981150 2026] [:error] [pid 44319:tid 44348] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Sat Apr 25 05:25:10.224420 2026] [:error] [pid 44319:tid 44343] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/gaza.php
[Sat Apr 25 05:25:10.461404 2026] [:error] [pid 44319:tid 44341] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/kj.php
[Sat Apr 25 05:25:10.699199 2026] [:error] [pid 44319:tid 44330] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/aboute.php
[Sat Apr 25 05:25:10.946501 2026] [:error] [pid 44319:tid 44351] [client 4.232.189.4:1310] File does not exist: /usr/local/apache/htdocs/suspended-page/ws82.php
[Sat Apr 25 05:25:11.179970 2026] [:error] [pid 44319:tid 44340] [client 4.232.189.4:1310] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aevft8zJPAVLUb2pWtJITAAAAAs"]
[Sat Apr 25 05:25:14.078324 2026] [:error] [pid 44320:tid 44362] [client 4.232.189.4:22405] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aevfujmFqSpku_dij8hqUwAAAEY"]
[Sat Apr 25 05:25:16.141782 2026] [:error] [pid 44319:tid 44339] [client 4.232.189.4:14591] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aevfvMzJPAVLUb2pWtJIUgAAAAo"]
[Sat Apr 25 05:25:19.451110 2026] [:error] [pid 46083:tid 46092] [client 4.232.189.4:44609] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/edit.php"] [unique_id "aevfvzxw_Zq74vWdjmkZjAAAAQU"]
[Sat Apr 25 05:25:21.309429 2026] [:error] [pid 46083:tid 46112] [client 4.232.189.4:44662] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "aevfwTxw_Zq74vWdjmkZlwAAARg"]
[Sat Apr 25 05:25:22.728916 2026] [:error] [pid 44425:tid 44451] [client 4.232.189.4:20879] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "aevfwiUl-VlItvY2tR_y0gAAANg"]
[Sat Apr 25 05:25:24.555631 2026] [:error] [pid 46083:tid 46092] [client 4.232.189.4:56812] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "aevfxDxw_Zq74vWdjmkZogAAAQU"]
[Sat Apr 25 05:25:26.499764 2026] [:error] [pid 44425:tid 44427] [client 4.232.189.4:10586] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/yw5bi63u.php"] [unique_id "aevfxiUl-VlItvY2tR_y4QAAAMA"]
[Sat Apr 25 05:25:28.830497 2026] [:error] [pid 44321:tid 44389] [client 4.232.189.4:9900] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tool.php"] [unique_id "aevfyI1b5lV-asWa_Y4czQAAAIY"]
[Sat Apr 25 05:25:30.057093 2026] [:error] [pid 44321:tid 44395] [client 4.232.189.4:1375] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tool.php"] [unique_id "aevfyo1b5lV-asWa_Y4c0wAAAIw"]
[Sat Apr 25 05:25:31.900629 2026] [:error] [pid 44321:tid 44404] [client 4.232.189.4:1362] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tool.php"] [unique_id "aevfy41b5lV-asWa_Y4c1gAAAJU"]
[Sat Apr 25 05:25:33.028371 2026] [:error] [pid 44321:tid 44396] [client 4.232.189.4:9873] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tool.php"] [unique_id "aevfzY1b5lV-asWa_Y4c2gAAAI0"]
[Sat Apr 25 05:25:34.754226 2026] [:error] [pid 46083:tid 46104] [client 4.232.189.4:18093] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bgymj.php"] [unique_id "aevfzjxw_Zq74vWdjmkZxwAAARE"]
[Sat Apr 25 05:25:35.465090 2026] [:error] [pid 44425:tid 44437] [client 4.232.189.4:11059] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bgymj.php"] [unique_id "aevfzyUl-VlItvY2tR_zBQAAAMo"]
[Sat Apr 25 05:25:36.865848 2026] [:error] [pid 46083:tid 46096] [client 4.232.189.4:17340] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bgymj.php"] [unique_id "aevf0Dxw_Zq74vWdjmkZygAAAQk"]
[Sat Apr 25 05:25:39.811033 2026] [:error] [pid 44425:tid 44431] [client 4.232.189.4:46819] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bgymj.php"] [unique_id "aevf0yUl-VlItvY2tR_zEQAAAMQ"]
[Sat Apr 25 05:25:41.072248 2026] [:error] [pid 44319:tid 44346] [client 4.232.189.4:1272] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aevf1czJPAVLUb2pWtJIbAAAABE"]
[Sat Apr 25 05:25:43.402190 2026] [:error] [pid 44425:tid 44444] [client 4.232.189.4:1268] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aevf1yUl-VlItvY2tR_zGwAAANE"]
[Sat Apr 25 05:25:44.085192 2026] [:error] [pid 44425:tid 44429] [client 4.232.189.4:59537] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aevf2CUl-VlItvY2tR_zHgAAAMI"]
[Sat Apr 25 05:25:45.561900 2026] [:error] [pid 46083:tid 46093] [client 4.232.189.4:22507] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-good.php"] [unique_id "aevf2Txw_Zq74vWdjmkZ5AAAAQY"]
[Sat Apr 25 05:25:48.121878 2026] [:error] [pid 44425:tid 44451] [client 4.232.189.4:54996] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-t.api.php"] [unique_id "aevf3CUl-VlItvY2tR_zJAAAANg"]
[Sat Apr 25 05:25:49.388588 2026] [:error] [pid 46083:tid 46105] [client 4.232.189.4:13302] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-t.api.php"] [unique_id "aevf3Txw_Zq74vWdjmkZ6gAAARI"]
[Sat Apr 25 05:25:50.110603 2026] [:error] [pid 46083:tid 46092] [client 4.232.189.4:26663] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-t.api.php"] [unique_id "aevf3jxw_Zq74vWdjmkZ7AAAAQU"]
[Sat Apr 25 05:25:52.920035 2026] [:error] [pid 44425:tid 44446] [client 4.232.189.4:2036] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/class-t.api.php"] [unique_id "aevf4CUl-VlItvY2tR_zLQAAANM"]
[Sat Apr 25 05:25:53.922838 2026] [:error] [pid 44321:tid 44403] [client 4.232.189.4:33936] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mk.php"] [unique_id "aevf4Y1b5lV-asWa_Y4c-AAAAJQ"]
[Sat Apr 25 05:25:55.509052 2026] [:error] [pid 44425:tid 44436] [client 4.232.189.4:53746] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mk.php"] [unique_id "aevf4yUl-VlItvY2tR_zNQAAAMk"]
[Sat Apr 25 05:25:56.508653 2026] [:error] [pid 46083:tid 46109] [client 4.232.189.4:21952] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mk.php"] [unique_id "aevf5Dxw_Zq74vWdjmkZ-QAAARU"]
[Sat Apr 25 05:26:01.001355 2026] [:error] [pid 44319:tid 44330] [client 4.232.189.4:30236] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mk.php"] [unique_id "aevf6czJPAVLUb2pWtJIjgAAAAE"]
[Sat Apr 25 05:26:04.136855 2026] [:error] [pid 46083:tid 46091] [client 4.232.189.4:23431] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aevf7Dxw_Zq74vWdjmkaGgAAAQQ"]
[Sat Apr 25 05:26:05.441142 2026] [:error] [pid 46083:tid 46093] [client 4.232.189.4:20350] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aevf7Txw_Zq74vWdjmkaIgAAAQY"]
[Sat Apr 25 05:26:06.447863 2026] [:error] [pid 46083:tid 46105] [client 4.232.189.4:1699] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aevf7jxw_Zq74vWdjmkaKgAAARI"]
[Sat Apr 25 05:26:07.459193 2026] [:error] [pid 44321:tid 44394] [client 4.232.189.4:12146] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gettest.php"] [unique_id "aevf741b5lV-asWa_Y4dDQAAAIs"]
[Sat Apr 25 05:26:09.401219 2026] [:error] [pid 44321:tid 44383] [client 4.232.189.4:20347] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/a4.php"] [unique_id "aevf8Y1b5lV-asWa_Y4dDwAAAIA"]
[Sat Apr 25 05:26:11.971087 2026] [:error] [pid 44320:tid 44356] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Sat Apr 25 05:26:12.452822 2026] [:error] [pid 44320:tid 44372] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat Apr 25 05:26:12.699012 2026] [:error] [pid 44320:tid 44364] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat Apr 25 05:26:12.948025 2026] [:error] [pid 44320:tid 44366] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/zoo.php
[Sat Apr 25 05:26:13.193997 2026] [:error] [pid 44320:tid 44374] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/admlo.php
[Sat Apr 25 05:26:13.430431 2026] [:error] [pid 44320:tid 44362] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/gcqoa.php
[Sat Apr 25 05:26:13.667211 2026] [:error] [pid 44320:tid 44363] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Sat Apr 25 05:26:13.911904 2026] [:error] [pid 44320:tid 44373] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/b.php
[Sat Apr 25 05:26:14.151436 2026] [:error] [pid 44320:tid 44370] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/grsiuk.php
[Sat Apr 25 05:26:14.388535 2026] [:error] [pid 44320:tid 44361] [client 4.232.189.4:12130] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-class-api.php
[Sat Apr 25 05:26:15.128988 2026] [:error] [pid 44320:tid 44361] [client 4.232.189.4:12130] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aevf9zmFqSpku_dij8hqkQAAAEU"]
[Sat Apr 25 05:26:16.977958 2026] [:error] [pid 46083:tid 46089] [client 4.232.189.4:15807] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aevf-Dxw_Zq74vWdjmkaTQAAAQI"]
[Sat Apr 25 05:26:19.064148 2026] [:error] [pid 44425:tid 44437] [client 4.232.189.4:15504] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aevf-yUl-VlItvY2tR_zbgAAAMo"]
[Sat Apr 25 05:26:23.710740 2026] [:error] [pid 44425:tid 44451] [client 4.232.189.4:26155] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/bolt.php"] [unique_id "aevf_yUl-VlItvY2tR_zfgAAANg"]
[Sat Apr 25 05:26:27.300305 2026] [:error] [pid 44321:tid 44402] [client 4.232.189.4:33371] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aevgA41b5lV-asWa_Y4dIwAAAJM"]
[Sat Apr 25 05:26:29.174088 2026] [:error] [pid 44425:tid 44439] [client 4.232.189.4:33387] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aevgBSUl-VlItvY2tR_ziAAAAMw"]
[Sat Apr 25 05:26:30.990268 2026] [:error] [pid 44319:tid 44348] [client 4.232.189.4:1458] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aevgBszJPAVLUb2pWtJIowAAABM"]
[Sat Apr 25 05:26:32.502581 2026] [:error] [pid 44425:tid 44450] [client 4.232.189.4:19048] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/gifclass.php"] [unique_id "aevgCCUl-VlItvY2tR_zmQAAANc"]
[Sat Apr 25 05:26:35.185034 2026] [:error] [pid 44321:tid 44390] [client 4.232.189.4:58064] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "aevgC41b5lV-asWa_Y4dKgAAAIc"]
[Sat Apr 25 05:26:36.531054 2026] [:error] [pid 44320:tid 44361] [client 4.232.189.4:33396] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "aevgDDmFqSpku_dij8hqmgAAAEU"]
[Sat Apr 25 05:26:37.617630 2026] [:error] [pid 44320:tid 44378] [client 4.232.189.4:26133] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "aevgDTmFqSpku_dij8hqngAAAFY"]
[Sat Apr 25 05:26:38.325516 2026] [:error] [pid 44425:tid 44441] [client 4.232.189.4:13759] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/ccs.php"] [unique_id "aevgDiUl-VlItvY2tR_zowAAAM4"]
[Sat Apr 25 05:26:41.082485 2026] [:error] [pid 44321:tid 44405] [client 4.232.189.4:24666] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/first.php"] [unique_id "aevgEY1b5lV-asWa_Y4dOQAAAJY"]
[Sat Apr 25 05:26:44.896123 2026] [:error] [pid 44425:tid 44443] [client 4.232.189.4:39835] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/first.php"] [unique_id "aevgFCUl-VlItvY2tR_zqAAAANA"]
[Sat Apr 25 05:26:46.155265 2026] [:error] [pid 44321:tid 44406] [client 4.232.189.4:15524] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/first.php"] [unique_id "aevgFo1b5lV-asWa_Y4dRgAAAJc"]
[Sat Apr 25 05:26:47.552828 2026] [:error] [pid 44320:tid 44362] [client 4.232.189.4:39857] [client 4.232.189.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/first.php"] [unique_id "aevgFzmFqSpku_dij8hqogAAAEY"]
[Sat Apr 25 06:22:51.117015 2026] [:error] [pid 44425:tid 44427] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-post-data.php
[Sat Apr 25 06:22:51.435628 2026] [:error] [pid 44425:tid 44442] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Sat Apr 25 06:22:51.693567 2026] [:error] [pid 44425:tid 44440] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/1index.php
[Sat Apr 25 06:22:51.979784 2026] [:error] [pid 44425:tid 44450] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/kcs.php
[Sat Apr 25 06:22:52.269619 2026] [:error] [pid 44425:tid 44449] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/Marvins.php
[Sat Apr 25 06:22:52.530079 2026] [:error] [pid 44425:tid 44435] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat Apr 25 06:22:52.823366 2026] [:error] [pid 44425:tid 44432] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sat Apr 25 06:22:53.084989 2026] [:error] [pid 44425:tid 44434] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/envs.php
[Sat Apr 25 06:22:53.343042 2026] [:error] [pid 44425:tid 44439] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-plugins.php
[Sat Apr 25 06:22:53.641846 2026] [:error] [pid 44425:tid 44451] [client 74.248.149.197:10546] File does not exist: /usr/local/apache/htdocs/suspended-page/keys.php
[Sat Apr 25 06:22:53.932721 2026] [:error] [pid 44425:tid 44446] [client 74.248.149.197:10546] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aevtPSUl-VlItvY2tR8KPwAAANM"]
[Sat Apr 25 06:22:56.927953 2026] [:error] [pid 46083:tid 46098] [client 74.248.149.197:16384] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aevtQDxw_Zq74vWdjmk1jAAAAQs"]
[Sat Apr 25 06:23:00.005327 2026] [:error] [pid 46083:tid 46091] [client 74.248.149.197:28331] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aevtRDxw_Zq74vWdjmk1mAAAAQQ"]
[Sat Apr 25 06:23:01.904985 2026] [:error] [pid 44320:tid 44361] [client 74.248.149.197:22010] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pinfo.php"] [unique_id "aevtRTmFqSpku_dij8h2NgAAAEU"]
[Sat Apr 25 06:23:03.723136 2026] [:error] [pid 46083:tid 46105] [client 74.248.149.197:9992] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litespeed.php"] [unique_id "aevtRzxw_Zq74vWdjmk1nQAAARI"]
[Sat Apr 25 06:23:05.860028 2026] [:error] [pid 44320:tid 44378] [client 74.248.149.197:10031] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litespeed.php"] [unique_id "aevtSTmFqSpku_dij8h2OgAAAFY"]
[Sat Apr 25 06:23:06.685446 2026] [:error] [pid 46083:tid 46093] [client 74.248.149.197:10089] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litespeed.php"] [unique_id "aevtSjxw_Zq74vWdjmk1oQAAAQY"]
[Sat Apr 25 06:23:08.904538 2026] [:error] [pid 44425:tid 44437] [client 74.248.149.197:1628] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/litespeed.php"] [unique_id "aevtTCUl-VlItvY2tR8KUwAAAMo"]
[Sat Apr 25 06:23:10.539085 2026] [:error] [pid 44425:tid 44428] [client 74.248.149.197:1639] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/environments.php"] [unique_id "aevtTiUl-VlItvY2tR8KVQAAAME"]
[Sat Apr 25 06:23:11.889601 2026] [:error] [pid 44319:tid 44338] [client 74.248.149.197:28351] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/environments.php"] [unique_id "aevtT8zJPAVLUb2pWtJT3AAAAAk"]
[Sat Apr 25 06:23:14.041210 2026] [:error] [pid 44425:tid 44436] [client 74.248.149.197:26738] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/environments.php"] [unique_id "aevtUiUl-VlItvY2tR8KXAAAAMk"]
[Sat Apr 25 06:23:15.174293 2026] [:error] [pid 44425:tid 44445] [client 74.248.149.197:13037] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/environments.php"] [unique_id "aevtUyUl-VlItvY2tR8KXwAAANI"]
[Sat Apr 25 06:23:16.627833 2026] [:error] [pid 44321:tid 44390] [client 74.248.149.197:9483] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/raf.php"] [unique_id "aevtVI1b5lV-asWa_Y4rkgAAAIc"]
[Sat Apr 25 06:23:18.115823 2026] [:error] [pid 44321:tid 44397] [client 74.248.149.197:16429] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/raf.php"] [unique_id "aevtVo1b5lV-asWa_Y4rlAAAAI4"]
[Sat Apr 25 06:23:20.881056 2026] [:error] [pid 44320:tid 44379] [client 74.248.149.197:13464] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/raf.php"] [unique_id "aevtWDmFqSpku_dij8h2TwAAAFc"]
[Sat Apr 25 06:23:22.715745 2026] [:error] [pid 44321:tid 44404] [client 74.248.149.197:26635] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/raf.php"] [unique_id "aevtWo1b5lV-asWa_Y4rmwAAAJU"]
[Sat Apr 25 06:23:23.613119 2026] [:error] [pid 44321:tid 44389] [client 74.248.149.197:1474] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aevtW41b5lV-asWa_Y4rnwAAAIY"]
[Sat Apr 25 06:23:25.412253 2026] [:error] [pid 44319:tid 44331] [client 74.248.149.197:30647] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aevtXczJPAVLUb2pWtJT-wAAAAI"]
[Sat Apr 25 06:23:27.069241 2026] [:error] [pid 46083:tid 46095] [client 74.248.149.197:8582] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aevtXzxw_Zq74vWdjmk1uQAAAQg"]
[Sat Apr 25 06:23:29.900482 2026] [:error] [pid 44319:tid 44352] [client 74.248.149.197:21232] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "aevtYczJPAVLUb2pWtJT_QAAABc"]
[Sat Apr 25 06:23:31.694939 2026] [:error] [pid 44320:tid 44373] [client 74.248.149.197:30630] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/infos.php"] [unique_id "aevtYzmFqSpku_dij8h2XgAAAFE"]
[Sat Apr 25 06:23:33.709072 2026] [:error] [pid 44321:tid 44385] [client 74.248.149.197:9493] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/infos.php"] [unique_id "aevtZY1b5lV-asWa_Y4rxAAAAII"]
[Sat Apr 25 06:23:35.553754 2026] [:error] [pid 44321:tid 44395] [client 74.248.149.197:21228] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/infos.php"] [unique_id "aevtZ41b5lV-asWa_Y4rzAAAAIw"]
[Sat Apr 25 06:23:37.616768 2026] [:error] [pid 44321:tid 44393] [client 74.248.149.197:30654] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/infos.php"] [unique_id "aevtaY1b5lV-asWa_Y4r1AAAAIo"]
[Sat Apr 25 06:23:39.112421 2026] [:error] [pid 46083:tid 46087] [client 74.248.149.197:25113] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aws.php"] [unique_id "aevtazxw_Zq74vWdjmk1vgAAAQA"]
[Sat Apr 25 06:23:40.083413 2026] [:error] [pid 44320:tid 44368] [client 74.248.149.197:25146] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aws.php"] [unique_id "aevtbDmFqSpku_dij8h2aAAAAEw"]
[Sat Apr 25 06:23:40.797341 2026] [:error] [pid 44321:tid 44401] [client 74.248.149.197:26724] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aws.php"] [unique_id "aevtbI1b5lV-asWa_Y4r4gAAAJI"]
[Sat Apr 25 06:23:41.610414 2026] [:error] [pid 44321:tid 44405] [client 74.248.149.197:20875] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aws.php"] [unique_id "aevtbY1b5lV-asWa_Y4r5wAAAJY"]
[Sat Apr 25 06:23:42.605893 2026] [:error] [pid 46083:tid 46088] [client 74.248.149.197:26639] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/embed.php"] [unique_id "aevtbjxw_Zq74vWdjmk1wQAAAQE"]
[Sat Apr 25 06:23:43.521809 2026] [:error] [pid 44319:tid 44336] [client 74.248.149.197:28636] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/embed.php"] [unique_id "aevtb8zJPAVLUb2pWtJUCQAAAAc"]
[Sat Apr 25 06:23:44.325808 2026] [:error] [pid 44321:tid 44397] [client 74.248.149.197:21229] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/embed.php"] [unique_id "aevtcI1b5lV-asWa_Y4r_gAAAI4"]
[Sat Apr 25 06:23:45.148129 2026] [:error] [pid 44320:tid 44380] [client 74.248.149.197:28669] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/embed.php"] [unique_id "aevtcTmFqSpku_dij8h2awAAAFg"]
[Sat Apr 25 06:23:45.977344 2026] [:error] [pid 44320:tid 44361] [client 74.248.149.197:20880] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/stat.php"] [unique_id "aevtcTmFqSpku_dij8h2bQAAAEU"]
[Sat Apr 25 06:23:46.590506 2026] [:error] [pid 46083:tid 46107] [client 74.248.149.197:12458] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/stat.php"] [unique_id "aevtcjxw_Zq74vWdjmk1xwAAARM"]
[Sat Apr 25 06:23:47.347519 2026] [:error] [pid 44425:tid 44438] [client 74.248.149.197:25109] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/stat.php"] [unique_id "aevtcyUl-VlItvY2tR8KgAAAAMs"]
[Sat Apr 25 06:23:48.572731 2026] [:error] [pid 44320:tid 44359] [client 74.248.149.197:12430] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/stat.php"] [unique_id "aevtdDmFqSpku_dij8h2cgAAAEM"]
[Sat Apr 25 06:23:49.510375 2026] [:error] [pid 44425:tid 44450] [client 74.248.149.197:8649] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/setup.php"] [unique_id "aevtdSUl-VlItvY2tR8KhQAAANc"]
[Sat Apr 25 06:23:50.635017 2026] [:error] [pid 44425:tid 44441] [client 74.248.149.197:17464] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/setup.php"] [unique_id "aevtdiUl-VlItvY2tR8KhgAAAM4"]
[Sat Apr 25 06:23:52.493036 2026] [:error] [pid 44319:tid 44332] [client 74.248.149.197:17481] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/setup.php"] [unique_id "aevteMzJPAVLUb2pWtJUDgAAAAM"]
[Sat Apr 25 06:23:54.326215 2026] [:error] [pid 46083:tid 46107] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sat Apr 25 06:23:54.612074 2026] [:error] [pid 46083:tid 46097] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/development.php
[Sat Apr 25 06:23:54.870037 2026] [:error] [pid 46083:tid 46111] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/environment.php
[Sat Apr 25 06:23:55.139073 2026] [:error] [pid 46083:tid 46101] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/db_config.php
[Sat Apr 25 06:23:55.399682 2026] [:error] [pid 46083:tid 46108] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/Get_Site_Info.php
[Sat Apr 25 06:23:55.661136 2026] [:error] [pid 46083:tid 46095] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/deploy.php
[Sat Apr 25 06:23:55.931061 2026] [:error] [pid 46083:tid 46099] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/apis.php
[Sat Apr 25 06:23:56.188663 2026] [:error] [pid 46083:tid 46102] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/asdf.php
[Sat Apr 25 06:23:56.450548 2026] [:error] [pid 46083:tid 46091] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/1100.php
[Sat Apr 25 06:23:56.725037 2026] [:error] [pid 46083:tid 46105] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/._info.php
[Sat Apr 25 06:23:56.982825 2026] [:error] [pid 46083:tid 46110] [client 74.248.149.197:29051] File does not exist: /usr/local/apache/htdocs/suspended-page/php_flag.php
[Sat Apr 25 06:23:57.238707 2026] [:error] [pid 46083:tid 46109] [client 74.248.149.197:29051] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_info4.php"] [unique_id "aevtfTxw_Zq74vWdjmk13QAAARU"]
[Sat Apr 25 06:24:01.646508 2026] [:error] [pid 44319:tid 44331] [client 74.248.149.197:17476] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_info4.php"] [unique_id "aevtgczJPAVLUb2pWtJUGQAAAAI"]
[Sat Apr 25 06:24:06.656748 2026] [:error] [pid 44321:tid 44405] [client 74.248.149.197:36425] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_info4.php"] [unique_id "aevtho1b5lV-asWa_Y4sDQAAAJY"]
[Sat Apr 25 06:24:08.772209 2026] [:error] [pid 44319:tid 44346] [client 74.248.149.197:28400] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_info4.php"] [unique_id "aevtiMzJPAVLUb2pWtJUIQAAABE"]
[Sat Apr 25 06:24:10.186150 2026] [:error] [pid 44321:tid 44394] [client 74.248.149.197:14451] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_phpinfo2.php"] [unique_id "aevtio1b5lV-asWa_Y4sEgAAAIs"]
[Sat Apr 25 06:24:11.374112 2026] [:error] [pid 44321:tid 44401] [client 74.248.149.197:10981] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_phpinfo2.php"] [unique_id "aevti41b5lV-asWa_Y4sFQAAAJI"]
[Sat Apr 25 06:24:12.555741 2026] [:error] [pid 46083:tid 46101] [client 74.248.149.197:20608] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_phpinfo2.php"] [unique_id "aevtjDxw_Zq74vWdjmk16wAAAQ4"]
[Sat Apr 25 06:24:14.057533 2026] [:error] [pid 46083:tid 46087] [client 74.248.149.197:23551] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test_phpinfo2.php"] [unique_id "aevtjjxw_Zq74vWdjmk17wAAAQA"]
[Sat Apr 25 06:24:17.996385 2026] [:error] [pid 44425:tid 44440] [client 74.248.149.197:20614] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HsFPDcD.php"] [unique_id "aevtkSUl-VlItvY2tR8KpgAAAM0"]
[Sat Apr 25 06:24:19.021158 2026] [:error] [pid 44319:tid 44344] [client 74.248.149.197:30690] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HsFPDcD.php"] [unique_id "aevtk8zJPAVLUb2pWtJUJwAAAA8"]
[Sat Apr 25 06:24:19.821178 2026] [:error] [pid 44319:tid 44337] [client 74.248.149.197:14172] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HsFPDcD.php"] [unique_id "aevtk8zJPAVLUb2pWtJUKQAAAAg"]
[Sat Apr 25 06:24:22.705772 2026] [:error] [pid 44321:tid 44391] [client 74.248.149.197:24622] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/HsFPDcD.php"] [unique_id "aevtlo1b5lV-asWa_Y4sHQAAAIg"]
[Sat Apr 25 06:24:24.916133 2026] [:error] [pid 44321:tid 44406] [client 74.248.149.197:20664] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.inc.php"] [unique_id "aevtmI1b5lV-asWa_Y4sHgAAAJc"]
[Sat Apr 25 06:24:26.259671 2026] [:error] [pid 46083:tid 46107] [client 74.248.149.197:14760] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.inc.php"] [unique_id "aevtmjxw_Zq74vWdjmk18wAAARM"]
[Sat Apr 25 06:24:28.027410 2026] [:error] [pid 46083:tid 46100] [client 74.248.149.197:8901] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.inc.php"] [unique_id "aevtnDxw_Zq74vWdjmk1-gAAAQ0"]
[Sat Apr 25 06:24:29.632615 2026] [:error] [pid 46083:tid 46090] [client 74.248.149.197:8937] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/config.inc.php"] [unique_id "aevtnTxw_Zq74vWdjmk2AgAAAQM"]
[Sat Apr 25 06:24:30.748623 2026] [:error] [pid 44425:tid 44435] [client 74.248.149.197:24582] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpversion.php"] [unique_id "aevtniUl-VlItvY2tR8KrwAAAMg"]
[Sat Apr 25 06:24:32.829632 2026] [:error] [pid 44319:tid 44331] [client 74.248.149.197:37654] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpversion.php"] [unique_id "aevtoMzJPAVLUb2pWtJUMgAAAAI"]
[Sat Apr 25 06:24:33.785504 2026] [:error] [pid 44319:tid 44345] [client 74.248.149.197:20645] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpversion.php"] [unique_id "aevtoczJPAVLUb2pWtJUNAAAABA"]
[Sat Apr 25 06:24:35.259426 2026] [:error] [pid 44425:tid 44444] [client 74.248.149.197:17157] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpversion.php"] [unique_id "aevtoyUl-VlItvY2tR8KtAAAANE"]
[Sat Apr 25 06:24:37.271898 2026] [:error] [pid 46083:tid 46103] [client 74.248.149.197:24592] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asus.php"] [unique_id "aevtpTxw_Zq74vWdjmk2EQAAARA"]
[Sat Apr 25 06:24:38.647140 2026] [:error] [pid 44321:tid 44406] [client 74.248.149.197:17162] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asus.php"] [unique_id "aevtpo1b5lV-asWa_Y4sKAAAAJc"]
[Sat Apr 25 06:24:39.722495 2026] [:error] [pid 44320:tid 44359] [client 74.248.149.197:63910] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asus.php"] [unique_id "aevtpzmFqSpku_dij8h2sgAAAEM"]
[Sat Apr 25 06:24:42.019806 2026] [:error] [pid 44425:tid 44441] [client 74.248.149.197:29647] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asus.php"] [unique_id "aevtqiUl-VlItvY2tR8KuwAAAM4"]
[Sat Apr 25 06:24:44.294390 2026] [:error] [pid 44319:tid 44339] [client 74.248.149.197:20148] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php_version.php"] [unique_id "aevtrMzJPAVLUb2pWtJUQwAAAAo"]
[Sat Apr 25 06:24:45.469437 2026] [:error] [pid 44425:tid 44431] [client 74.248.149.197:28690] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php_version.php"] [unique_id "aevtrSUl-VlItvY2tR8KvgAAAMQ"]
[Sat Apr 25 06:24:46.362205 2026] [:error] [pid 44320:tid 44361] [client 74.248.149.197:19228] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php_version.php"] [unique_id "aevtrjmFqSpku_dij8h2vgAAAEU"]
[Sat Apr 25 06:24:48.466306 2026] [:error] [pid 44425:tid 44432] [client 74.248.149.197:19252] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php_version.php"] [unique_id "aevtsCUl-VlItvY2tR8KygAAAMU"]
[Sat Apr 25 06:24:52.261344 2026] [:error] [pid 44319:tid 44335] [client 74.248.149.197:1315] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouts.php"] [unique_id "aevttMzJPAVLUb2pWtJUTgAAAAY"]
[Sat Apr 25 06:24:53.336810 2026] [:error] [pid 46083:tid 46087] [client 74.248.149.197:16744] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouts.php"] [unique_id "aevttTxw_Zq74vWdjmk2LgAAAQA"]
[Sat Apr 25 06:24:54.302126 2026] [:error] [pid 46083:tid 46097] [client 74.248.149.197:28699] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouts.php"] [unique_id "aevttjxw_Zq74vWdjmk2MAAAAQo"]
[Sat Apr 25 06:24:55.902917 2026] [:error] [pid 44425:tid 44448] [client 74.248.149.197:21456] [client 74.248.149.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abouts.php"] [unique_id "aevttyUl-VlItvY2tR8KzgAAANU"]
[Sat Apr 25 06:24:57.061478 2026] [:error] [pid 44319:tid 44342] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/profmanage.php
[Sat Apr 25 06:24:57.675532 2026] [:error] [pid 44319:tid 44342] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/makecvs.php
[Sat Apr 25 06:24:57.959447 2026] [:error] [pid 44319:tid 44349] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/phpreleaseinfo.php
[Sat Apr 25 06:24:58.242687 2026] [:error] [pid 44319:tid 44345] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/configuration.php
[Sat Apr 25 06:24:58.526572 2026] [:error] [pid 44319:tid 44347] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Sat Apr 25 06:24:58.876703 2026] [:error] [pid 44319:tid 44336] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/hkvkjguw.php
[Sat Apr 25 06:24:59.411716 2026] [:error] [pid 44319:tid 44352] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/Black.php
[Sat Apr 25 06:24:59.694802 2026] [:error] [pid 44319:tid 44341] [client 74.248.149.197:1670] File does not exist: /usr/local/apache/htdocs/suspended-page/infoinfo.php
[Sat Apr 25 10:12:35.207561 2026] [:error] [pid 44425:tid 44447] [client 43.153.36.110:60194] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aewjEyUl-VlItvY2tR9UMwAAANQ"]
[Sat Apr 25 11:02:06.063296 2026] [:error] [pid 46083:tid 46092] [client 203.2.64.59:40140] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aewurjxw_Zq74vWdjmmxfwAAAQU"]
[Sat Apr 25 21:28:11.267916 2026] [:error] [pid 3212:tid 3217] [client 43.167.241.46:42650] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aezBa_g-28TY8_YLtUc2owAAAQM"]
[Sun Apr 26 01:25:22.987844 2026] [:error] [pid 59896:tid 59917] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/bless.php
[Sun Apr 26 01:25:23.152841 2026] [:error] [pid 59896:tid 59916] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/O-Simple.php
[Sun Apr 26 01:25:23.320844 2026] [:error] [pid 59896:tid 59911] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Sun Apr 26 01:25:23.488947 2026] [:error] [pid 59896:tid 59906] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/zwso.php
[Sun Apr 26 01:25:23.651551 2026] [:error] [pid 59896:tid 59909] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun Apr 26 01:25:23.819132 2026] [:error] [pid 59896:tid 59913] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun Apr 26 01:25:24.025958 2026] [:error] [pid 59896:tid 59905] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun Apr 26 01:25:24.187396 2026] [:error] [pid 59896:tid 59907] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/mah.php
[Sun Apr 26 01:25:24.520914 2026] [:error] [pid 59896:tid 59902] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Sun Apr 26 01:25:24.696962 2026] [:error] [pid 59896:tid 59923] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/robots.php
[Sun Apr 26 01:25:24.861545 2026] [:error] [pid 59896:tid 59924] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun Apr 26 01:25:25.027937 2026] [:error] [pid 59896:tid 59910] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/mini.php
[Sun Apr 26 01:25:25.190692 2026] [:error] [pid 59896:tid 59903] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun Apr 26 01:25:25.358521 2026] [:error] [pid 59896:tid 59920] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/file5.php
[Sun Apr 26 01:25:25.526842 2026] [:error] [pid 59896:tid 59911] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Sun Apr 26 01:25:25.688771 2026] [:error] [pid 59896:tid 59915] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun Apr 26 01:25:25.857794 2026] [:error] [pid 59896:tid 59922] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sun Apr 26 01:25:26.019779 2026] [:error] [pid 59896:tid 59904] [client 173.239.218.149:40565] File does not exist: /usr/local/apache/htdocs/suspended-page/amax.php
[Sun Apr 26 01:25:28.343566 2026] [:error] [pid 59896:tid 59914] [client 173.239.218.149:40565] [client 173.239.218.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aez5CLLLzhtkd-OXUgBRoQAAAE4"]
[Sun Apr 26 01:25:29.189282 2026] [:error] [pid 3212:tid 3222] [client 98.159.37.104:50273] [client 98.159.37.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aez5Cfg-28TY8_YLtUe5HgAAAQg"]
[Sun Apr 26 01:25:30.027264 2026] [:error] [pid 3212:tid 3229] [client 216.24.210.187:28261] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Sun Apr 26 01:25:30.515693 2026] [:error] [pid 3212:tid 3230] [client 216.24.210.187:28261] [client 216.24.210.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tinyfilemanager.php"] [unique_id "aez5Cvg-28TY8_YLtUe5KAAAARA"]
[Sun Apr 26 01:25:31.222027 2026] [:error] [pid 59896:tid 59910] [client 216.24.210.187:41891] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Sun Apr 26 01:25:31.381871 2026] [:error] [pid 59896:tid 59911] [client 216.24.210.187:41891] [client 216.24.210.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/index.php"] [unique_id "aez5C7LLzhtkd-OXUgBRvQAAAEs"]
[Sun Apr 26 01:25:31.880070 2026] [:error] [pid 3212:tid 3234] [client 216.24.210.191:33901] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Sun Apr 26 01:25:32.717708 2026] [:error] [pid 3212:tid 3235] [client 216.24.210.191:33901] [client 216.24.210.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aez5DPg-28TY8_YLtUe5RQAAARU"]
[Sun Apr 26 01:25:33.223379 2026] [:error] [pid 59896:tid 59906] [client 216.24.210.183:45951] [client 216.24.210.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aez5DbLLzhtkd-OXUgBR1gAAAEY"]
[Sun Apr 26 01:25:58.231136 2026] [autoindex:error] [pid 59985:tid 59998] [client 98.159.37.104:55931] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 05:35:44.109328 2026] [:error] [pid 8491:tid 8501] [client 43.157.153.236:58010] [client 43.157.153.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ae0zsCq7I7e6CJooQM2GWQAAAMI"]
[Sun Apr 26 06:15:47.259386 2026] [:error] [pid 8385:tid 8441] [client 158.158.52.225:30735] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae09EzOy7_J84Wx3-oxlPwAAAFE"]
[Sun Apr 26 06:15:47.830457 2026] [:error] [pid 8491:tid 8502] [client 158.158.52.225:61736] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae09Eyq7I7e6CJooQM2YPgAAAMM"]
[Sun Apr 26 06:15:48.776447 2026] [:error] [pid 10315:tid 10322] [client 158.158.52.225:37406] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae09FKJIw2vjkleLIaCmkgAAAQU"]
[Sun Apr 26 06:15:49.611363 2026] [:error] [pid 10315:tid 10323] [client 158.158.52.225:13926] [client 158.158.52.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae09FaJIw2vjkleLIaCmmAAAAQY"]
[Sun Apr 26 06:23:52.172362 2026] [:error] [pid 8390:tid 8457] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/file2.php
[Sun Apr 26 06:23:52.438351 2026] [:error] [pid 8390:tid 8455] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/asus.php
[Sun Apr 26 06:23:52.703813 2026] [:error] [pid 8390:tid 8451] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/environment.php
[Sun Apr 26 06:23:52.970676 2026] [:error] [pid 8390:tid 8458] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Sun Apr 26 06:23:53.237073 2026] [:error] [pid 8390:tid 8462] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/aws.php
[Sun Apr 26 06:23:53.503530 2026] [:error] [pid 8390:tid 8466] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Sun Apr 26 06:23:53.770210 2026] [:error] [pid 8390:tid 8454] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/kcs.php
[Sun Apr 26 06:23:54.039390 2026] [:error] [pid 8390:tid 8460] [client 20.111.53.4:15514] File does not exist: /usr/local/apache/htdocs/suspended-page/setup.php
[Sun Apr 26 07:20:04.654839 2026] [:error] [pid 16573:tid 16598] [client 74.249.155.150:8933] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun Apr 26 07:20:05.057155 2026] [:error] [pid 16573:tid 16599] [client 74.249.155.150:8933] [client 74.249.155.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.249.155.150, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae1MJQXNFaYgl_cuEbju3gAAAxY"]
[Sun Apr 26 07:20:05.251081 2026] [:error] [pid 16573:tid 16578] [client 74.249.155.150:8933] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-corn-sample.php
[Sun Apr 26 07:20:06.046966 2026] [:error] [pid 16573:tid 16583] [client 74.249.155.150:8933] File does not exist: /usr/local/apache/htdocs/suspended-page/server.php
[Sun Apr 26 07:20:06.650808 2026] [:error] [pid 16573:tid 16591] [client 74.249.155.150:8933] File does not exist: /usr/local/apache/htdocs/suspended-page/wso.php
[Sun Apr 26 07:20:06.837071 2026] [:error] [pid 16573:tid 16594] [client 74.249.155.150:8933] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae1MJgXNFaYgl_cuEbju6QAAAxE"]
[Sun Apr 26 07:20:07.712481 2026] [:error] [pid 8491:tid 8507] [client 74.249.155.150:8338] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae1MJyq7I7e6CJooQM2pCwAAAMg"]
[Sun Apr 26 07:20:08.649391 2026] [:error] [pid 13137:tid 13161] [client 74.249.155.150:8910] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae1MKN0RB4J0o4h5neHjQwAAAhQ"]
[Sun Apr 26 07:20:09.577354 2026] [:error] [pid 8385:tid 8435] [client 74.249.155.150:8915] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/crystal/"] [unique_id "ae1MKTOy7_J84Wx3-oxxMgAAAEs"]
[Sun Apr 26 08:16:22.533655 2026] [:error] [pid 8385:tid 8424] [client 51.12.95.31:16543] [client 51.12.95.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1ZVjOy7_J84Wx3-ox4RwAAAEA"]
[Sun Apr 26 08:16:23.387255 2026] [:error] [pid 8390:tid 8471] [client 51.12.95.31:34009] [client 51.12.95.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1ZV4GPtFK_i9p5yxQ63gAAAJQ"]
[Sun Apr 26 08:16:24.671491 2026] [:error] [pid 22572:tid 22578] [client 51.12.95.31:23878] [client 51.12.95.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1ZWNXOViWCFU-pZzB_VQAAAUA"]
[Sun Apr 26 08:16:25.859587 2026] [:error] [pid 13197:tid 13238] [client 51.12.95.31:17335] [client 51.12.95.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1ZWd3kktFKdSxTrBuYNgAAAsc"]
[Sun Apr 26 09:20:09.145679 2026] [:error] [pid 16515:tid 16527] [client 20.203.162.164:37034] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1oSVtDrUmgHSvpuLzfQwAAAkk"]
[Sun Apr 26 09:20:09.696004 2026] [:error] [pid 8390:tid 8475] [client 20.203.162.164:44251] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1oSYGPtFK_i9p5yxRbNAAAAJg"]
[Sun Apr 26 09:20:10.236948 2026] [:error] [pid 22573:tid 22627] [client 20.203.162.164:63558] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1oSnB3EmQlD4yKUt9GEgAAAZQ"]
[Sun Apr 26 09:20:10.790524 2026] [:error] [pid 8390:tid 8458] [client 20.203.162.164:56282] [client 20.203.162.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae1oSoGPtFK_i9p5yxRbOgAAAIc"]
[Sun Apr 26 10:59:51.131150 2026] [:error] [pid 8491:tid 8518] [client 43.157.174.69:38762] [client 43.157.174.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ae1_pyq7I7e6CJooQM3JmgAAANM"]
[Sun Apr 26 14:10:31.471989 2026] [:error] [pid 8390:tid 8469] [client 45.45.237.21:39270] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "ae2sV4GPtFK_i9p5yxTiGAAAAJI"]
[Sun Apr 26 14:10:33.071885 2026] [:error] [pid 22572:tid 22588] [client 45.45.237.21:39306] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-config.php"] [unique_id "ae2sWdXOViWCFU-pZzDgYQAAAUo"]
[Sun Apr 26 14:10:33.106437 2026] [:error] [pid 22572:tid 22590] [client 45.45.237.21:39272] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/wp-config.php.bak"] [unique_id "ae2sWdXOViWCFU-pZzDgYwAAAUw"]
[Sun Apr 26 14:10:33.106746 2026] [:error] [pid 8390:tid 8452] [client 45.45.237.21:39282] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "ae2sWYGPtFK_i9p5yxTiHgAAAIE"]
[Sun Apr 26 14:10:33.118740 2026] [:error] [pid 13137:tid 13163] [client 45.45.237.21:39290] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "ae2sWd0RB4J0o4h5neE6wAAAAhY"]
[Sun Apr 26 14:10:33.120422 2026] [:error] [pid 13137:tid 13143] [client 45.45.237.21:39328] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "ae2sWd0RB4J0o4h5neE6wwAAAgM"]
[Sun Apr 26 14:10:33.386157 2026] [:error] [pid 13137:tid 13156] [client 45.45.237.21:39302] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "ae2sWd0RB4J0o4h5neE6xQAAAg8"]
[Sun Apr 26 14:10:33.585689 2026] [:error] [pid 13197:tid 13244] [client 45.45.237.21:39354] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/settings.py"] [unique_id "ae2sWd3kktFKdSxTrBu69gAAAsw"]
[Sun Apr 26 14:10:33.589302 2026] [:error] [pid 22572:tid 22594] [client 45.45.237.21:39324] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/config"] [unique_id "ae2sWdXOViWCFU-pZzDgZwAAAVA"]
[Sun Apr 26 14:10:33.650586 2026] [:error] [pid 8385:tid 8438] [client 45.45.237.21:39312] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aws-exports.js"] [unique_id "ae2sWTOy7_J84Wx3-oyqIwAAAE4"]
[Sun Apr 26 14:10:33.650845 2026] [:error] [pid 13137:tid 13151] [client 45.45.237.21:39292] [client 45.45.237.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ae2sWd0RB4J0o4h5neE6xwAAAgo"]
[Sun Apr 26 14:10:33.829033 2026] [:error] [pid 22572:tid 22583] [client 45.45.237.21:39344] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.aws/credentials"] [unique_id "ae2sWdXOViWCFU-pZzDgaQAAAUU"]
[Sun Apr 26 14:10:34.920596 2026] [:error] [pid 8390:tid 8469] [client 45.45.237.21:39502] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aws-exports.js"] [unique_id "ae2sWoGPtFK_i9p5yxTiIgAAAJI"]
[Sun Apr 26 14:10:34.921974 2026] [:error] [pid 8390:tid 8462] [client 45.45.237.21:39492] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.npmrc"] [unique_id "ae2sWoGPtFK_i9p5yxTiIwAAAIs"]
[Sun Apr 26 14:10:34.923176 2026] [:error] [pid 8390:tid 8463] [client 45.45.237.21:39468] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/config"] [unique_id "ae2sWoGPtFK_i9p5yxTiJAAAAIw"]
[Sun Apr 26 14:10:34.930796 2026] [:error] [pid 8390:tid 8453] [client 45.45.237.21:39448] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/settings.py"] [unique_id "ae2sWoGPtFK_i9p5yxTiJQAAAII"]
[Sun Apr 26 14:10:34.933006 2026] [:error] [pid 8390:tid 8460] [client 45.45.237.21:39394] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/application.properties"] [unique_id "ae2sWoGPtFK_i9p5yxTiJgAAAIk"]
[Sun Apr 26 14:10:34.933227 2026] [:error] [pid 8390:tid 8468] [client 45.45.237.21:39388] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.aws/credentials"] [unique_id "ae2sWoGPtFK_i9p5yxTiJwAAAJE"]
[Sun Apr 26 14:10:35.167782 2026] [:error] [pid 16515:tid 16531] [client 45.45.237.21:39476] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/config"] [unique_id "ae2sW1tDrUmgHSvpuLwPyQAAAk0"]
[Sun Apr 26 14:10:35.167938 2026] [:error] [pid 22572:tid 22599] [client 45.45.237.21:39460] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.npmrc"] [unique_id "ae2sW9XOViWCFU-pZzDgagAAAVU"]
[Sun Apr 26 14:10:35.175856 2026] [:error] [pid 16515:tid 16528] [client 45.45.237.21:39432] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/settings.py"] [unique_id "ae2sW1tDrUmgHSvpuLwPygAAAko"]
[Sun Apr 26 14:10:35.178771 2026] [:error] [pid 22573:tid 22612] [client 45.45.237.21:39378] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/application.properties"] [unique_id "ae2sW3B3EmQlD4yKUt-lhgAAAYY"]
[Sun Apr 26 14:10:35.182651 2026] [:error] [pid 8390:tid 8467] [client 45.45.237.21:39426] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.aws/credentials"] [unique_id "ae2sW4GPtFK_i9p5yxTiKAAAAJA"]
[Sun Apr 26 14:10:35.426945 2026] [:error] [pid 16515:tid 16518] [client 45.45.237.21:39506] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.npmrc"] [unique_id "ae2sW1tDrUmgHSvpuLwPywAAAkA"]
[Sun Apr 26 14:10:35.427294 2026] [:error] [pid 8390:tid 8475] [client 45.45.237.21:39478] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/config"] [unique_id "ae2sW4GPtFK_i9p5yxTiKgAAAJg"]
[Sun Apr 26 14:10:35.434408 2026] [:error] [pid 22572:tid 22581] [client 45.45.237.21:39404] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/settings.py"] [unique_id "ae2sW9XOViWCFU-pZzDgawAAAUM"]
[Sun Apr 26 14:10:35.436708 2026] [:error] [pid 22572:tid 22591] [client 45.45.237.21:39358] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/application.properties"] [unique_id "ae2sW9XOViWCFU-pZzDgbAAAAU0"]
[Sun Apr 26 14:10:35.440034 2026] [:error] [pid 13137:tid 13146] [client 45.45.237.21:39366] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.aws/credentials"] [unique_id "ae2sW90RB4J0o4h5neE6yQAAAgY"]
[Sun Apr 26 14:10:35.685588 2026] [:error] [pid 22572:tid 22589] [client 45.45.237.21:39420] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/api/config"] [unique_id "ae2sW9XOViWCFU-pZzDgbgAAAUs"]
[Sun Apr 26 14:10:35.685622 2026] [:error] [pid 22572:tid 22585] [client 45.45.237.21:39512] [client 45.45.237.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.npmrc"] [unique_id "ae2sW9XOViWCFU-pZzDgbQAAAUc"]
[Sun Apr 26 14:15:59.830139 2026] [:error] [pid 22573:tid 22610] [client 43.130.37.243:42228] [client 43.130.37.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ae2tn3B3EmQlD4yKUt-nCQAAAYQ"]
[Sun Apr 26 21:05:37.021682 2026] [:error] [pid 22573:tid 22624] [client 120.71.59.24:34536] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ae4NoXB3EmQlD4yKUt8HAgAAAZE"]
[Mon Apr 27 00:41:57.188304 2026] [:error] [pid 13137:tid 13159] [client 185.198.240.153:56401] [client 185.198.240.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae5AVd0RB4J0o4h5neGzawAAAhI"]
[Mon Apr 27 08:23:17.280500 2026] [:error] [pid 50951:tid 50964] [client 43.159.143.187:43572] [client 43.159.143.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ae6sdV2pquA9BEfFXTgwDQAAAUs"]
[Mon Apr 27 11:31:21.681568 2026] [:error] [pid 6972:tid 7044] [client 170.106.197.109:40076] [client 170.106.197.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ae7YieJniPbCiT6NuKfXzwAAAVA"]
[Mon Apr 27 16:16:30.602727 2026] [:error] [pid 61339:tid 61347] [client 43.131.243.61:42420] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ae8bXiHHVuv2RN6lIrgGFgAAAEY"]
[Mon Apr 27 23:18:22.711026 2026] [:error] [pid 13554:tid 13558] [client 125.75.66.97:41875] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ae9-PnJx87Dl-xMmL920NwAAAMI"]
[Tue Apr 28 03:08:00.625071 2026] [:error] [pid 13465:tid 13510] [client 185.194.178.83:21589] [client 185.194.178.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.83, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "ae-0EP19I-6GBJQxn_gPbAAAAE8"]
[Tue Apr 28 03:08:00.629574 2026] [:error] [pid 13465:tid 13510] [client 185.194.178.83:21589] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Tue Apr 28 13:23:52.658447 2026] [:error] [pid 2741:tid 2747] [client 43.153.7.191:59310] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afBEaPp92FeOz1h6ILx5pAAAAUE"]
[Tue Apr 28 16:18:36.631325 2026] [:error] [pid 33775:tid 33781] [client 43.157.142.101:36198] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afBtXJsYOcoQrq88YbUSyAAAAMI"]
[Tue Apr 28 18:36:53.178578 2026] [:error] [pid 33775:tid 33788] [client 43.134.178.104:39884] [client 43.134.178.104] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afCNxZsYOcoQrq88YbUhqQAAAMk"]
[Tue Apr 28 19:08:31.467415 2026] [:error] [pid 50889:tid 50905] [client 43.134.98.88:45904] [client 43.134.98.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afCVL4zszBr00txEzGg1OQAAAA0"]
[Tue Apr 28 19:39:51.094912 2026] [:error] [pid 33864:tid 33890] [client 43.134.127.70:60826] [client 43.134.127.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afCchzXchLGZ4QggCskYRQAAAJg"]
[Tue Apr 28 20:07:52.327060 2026] [:error] [pid 33777:tid 33836] [client 43.156.232.190:36142] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afCjGLXUCFWqmordGGLaaAAAAQE"]
[Tue Apr 28 20:10:12.629827 2026] [:error] [pid 2741:tid 2756] [client 43.134.178.104:35430] [client 43.134.178.104] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afCjpPp92FeOz1h6ILzuzQAAAUo"]
[Tue Apr 28 20:45:55.658206 2026] [:error] [pid 50889:tid 50906] [client 43.134.36.238:36742] [client 43.134.36.238] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afCsA4zszBr00txEzGhMCwAAAA4"]
[Tue Apr 28 21:15:43.247512 2026] [:error] [pid 33776:tid 33809] [client 43.130.72.150:44568] [client 43.130.72.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afCy_1-bEJ2CKP3iKAA6kgAAAEE"]
[Tue Apr 28 22:54:13.696826 2026] [:error] [pid 33777:tid 33856] [client 43.153.71.132:41314] [client 43.153.71.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afDKFbXUCFWqmordGGIZcQAAARU"]
[Wed Apr 29 01:31:10.313795 2026] [:error] [pid 2741:tid 2769] [client 49.234.192.248:54436] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afDu3vp92FeOz1h6ILxF9wAAAVc"]
[Wed Apr 29 03:02:42.674817 2026] [:error] [pid 33864:tid 33877] [client 43.133.91.48:48928] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afEEUjXchLGZ4QggCsld9QAAAIs"]
[Wed Apr 29 06:14:01.379197 2026] [:error] [pid 40344:tid 40375] [client 170.106.72.93:59908] [client 170.106.72.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afExKZ_iiwb4cHXz-Jr33wAAAcA"]
[Wed Apr 29 10:03:22.769959 2026] [:error] [pid 52292:tid 52322] [client 43.156.116.44:60140] [client 43.156.116.44] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afFm6hq6POOrkcVw80vcowAAAIA"]
[Wed Apr 29 10:25:29.677186 2026] [:error] [pid 61540:tid 61588] [client 45.3.40.88:62947] [client 45.3.40.88] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/s3cmd.ini"] [unique_id "afFsGeQ8cJB7pQslzIeYyAAAAI8"]
[Wed Apr 29 10:51:40.827321 2026] [:error] [pid 61541:tid 61616] [client 43.133.69.37:50650] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afFyPFoqNK1GZvjPpy5a4QAAAhA"]
[Wed Apr 29 13:15:36.985056 2026] [:error] [pid 61540:tid 61585] [client 43.166.232.4:57724] [client 43.166.232.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afGT-OQ8cJB7pQslzIe0IQAAAIw"]
[Wed Apr 29 13:17:21.323030 2026] [:error] [pid 45085:tid 45092] [client 209.50.177.238:55249] [client 209.50.177.238] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.rejuva.au|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.rejuva.au"] [uri "/s3cmd.ini"] [unique_id "afGUYdS7eNjgd8gD6ZziowAAAsU"]
[Wed Apr 29 15:36:31.451638 2026] [:error] [pid 45054:tid 45077] [client 45.119.85.39:53692] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wordpress/wp-login.php"] [unique_id "afG0_4tL6SUL31r23c-jaAAAApU"], referer: https://www.google.com
[Wed Apr 29 15:36:31.451713 2026] [:error] [pid 45054:tid 45077] [client 45.119.85.39:53692] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 131"] [hostname "rejuva.au"] [uri "/wordpress/wp-login.php"] [unique_id "afG0_4tL6SUL31r23c-jaAAAApU"], referer: https://www.google.com
[Wed Apr 29 15:46:04.484898 2026] [:error] [pid 61540:tid 61585] [client 43.159.61.24:36346] [client 43.159.61.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afG3POQ8cJB7pQslzIfW1wAAAIw"]
[Wed Apr 29 17:45:07.689287 2026] [:error] [pid 45054:tid 45074] [client 43.130.131.18:33568] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afHTI4tL6SUL31r23c-_AAAAApI"]
[Wed Apr 29 18:08:24.970671 2026] [:error] [pid 22901:tid 22904] [client 43.133.41.88:56312] [client 43.133.41.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afHYmBvfVEXI-f42iRRYwAAAAQE"]
[Wed Apr 29 20:31:26.792766 2026] [:error] [pid 21227:tid 21238] [client 43.157.98.187:34790] [client 43.157.98.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afH6HsB3c6U5AGPPsXqFnQAAAMU"]
[Wed Apr 29 20:50:52.590528 2026] [:error] [pid 21138:tid 21221] [client 1.12.70.96:47926] [client 1.12.70.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afH-rJuzwUiyMeUnp33c9gAAARg"]
[Wed Apr 29 21:59:21.819217 2026] [:error] [pid 21137:tid 21172] [client 74.249.162.224:30218] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed Apr 29 21:59:22.028990 2026] [:error] [pid 21137:tid 21181] [client 74.249.162.224:30218] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Wed Apr 29 21:59:22.455806 2026] [:error] [pid 21137:tid 21192] [client 74.249.162.224:30218] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Wed Apr 29 21:59:22.970645 2026] [:error] [pid 21137:tid 21170] [client 74.249.162.224:30218] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed Apr 29 21:59:23.471384 2026] [:error] [pid 21137:tid 21175] [client 74.249.162.224:30218] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Wed Apr 29 21:59:23.995996 2026] [:error] [pid 21137:tid 21174] [client 74.249.162.224:30218] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Wed Apr 29 21:59:24.257656 2026] [:error] [pid 21137:tid 21169] [client 74.249.162.224:30218] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Wed Apr 29 21:59:24.446083 2026] [:error] [pid 21137:tid 21188] [client 74.249.162.224:30218] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "afIOvPw-HnaioFPIurVm1wAAABM"]
[Wed Apr 29 21:59:24.824728 2026] [:error] [pid 21138:tid 21197] [client 74.249.162.224:30152] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "afIOvJuzwUiyMeUnp332KQAAAQE"]
[Wed Apr 29 21:59:25.356028 2026] [:error] [pid 21138:tid 21211] [client 74.249.162.224:30248] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "afIOvZuzwUiyMeUnp332KwAAAQ4"]
[Wed Apr 29 21:59:26.094724 2026] [:error] [pid 21136:tid 21147] [client 74.249.162.224:30234] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "afIOvilIfGGQdPVv8_PujAAAAEY"]
[Wed Apr 29 21:59:26.540637 2026] [:error] [pid 21137:tid 21183] [client 74.249.162.224:30244] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "afIOvvw-HnaioFPIurVm2AAAAA4"]
[Wed Apr 29 21:59:27.143645 2026] [:error] [pid 21227:tid 21235] [client 74.249.162.224:30149] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "afIOv8B3c6U5AGPPsXqZMgAAAMI"]
[Wed Apr 29 21:59:28.829638 2026] [:error] [pid 21137:tid 21180] [client 74.249.162.224:30165] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "afIOwPw-HnaioFPIurVm3AAAAAs"]
[Wed Apr 29 21:59:29.343714 2026] [:error] [pid 21137:tid 21186] [client 74.249.162.224:30231] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "afIOwfw-HnaioFPIurVm3QAAABE"]
[Wed Apr 29 21:59:29.804985 2026] [:error] [pid 47618:tid 47645] [client 74.249.162.224:30148] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "afIOwXHYUSxIrhce2OAqjAAAAVg"]
[Wed Apr 29 21:59:30.189031 2026] [:error] [pid 21137:tid 21190] [client 74.249.162.224:30252] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "afIOwvw-HnaioFPIurVm3wAAABU"]
[Wed Apr 29 21:59:30.938012 2026] [:error] [pid 21536:tid 21547] [client 74.249.162.224:30267] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "afIOwiREaVkH9P5H_LQupgAAAIk"]
[Wed Apr 29 21:59:31.332000 2026] [:error] [pid 21536:tid 21552] [client 74.249.162.224:30236] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws.php"] [unique_id "afIOwyREaVkH9P5H_LQuqAAAAI4"]
[Wed Apr 29 21:59:33.805171 2026] [:error] [pid 21136:tid 21148] [client 74.249.162.224:30210] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "afIOxSlIfGGQdPVv8_PujQAAAEc"]
[Wed Apr 29 21:59:35.193722 2026] [:error] [pid 21138:tid 21203] [client 74.249.162.224:30189] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "afIOx5uzwUiyMeUnp332MAAAAQY"]
[Wed Apr 29 21:59:36.825343 2026] [:error] [pid 21137:tid 21184] [client 74.249.162.224:30202] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "afIOyPw-HnaioFPIurVm5AAAAA8"]
[Wed Apr 29 21:59:37.311573 2026] [:error] [pid 21138:tid 21204] [client 74.249.162.224:30221] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/404.php"] [unique_id "afIOyZuzwUiyMeUnp332MwAAAQc"]
[Wed Apr 29 21:59:37.718659 2026] [:error] [pid 21138:tid 21202] [client 74.249.162.224:30229] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/index.php"] [unique_id "afIOyZuzwUiyMeUnp332NAAAAQU"]
[Wed Apr 29 21:59:38.096497 2026] [:error] [pid 21536:tid 21551] [client 74.249.162.224:30154] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/index.php"] [unique_id "afIOyiREaVkH9P5H_LQuqwAAAI0"]
[Wed Apr 29 21:59:38.485006 2026] [:error] [pid 21136:tid 21165] [client 74.249.162.224:30270] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/index.php"] [unique_id "afIOyilIfGGQdPVv8_PujwAAAFg"]
[Wed Apr 29 21:59:39.078819 2026] [:error] [pid 21227:tid 21249] [client 74.249.162.224:30208] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/user/index.php"] [unique_id "afIOy8B3c6U5AGPPsXqZMwAAANA"]
[Wed Apr 29 21:59:40.593227 2026] [:error] [pid 47618:tid 47631] [client 74.249.162.224:30253] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-conf.php"] [unique_id "afIOzHHYUSxIrhce2OAqkgAAAUo"]
[Wed Apr 29 21:59:42.357677 2026] [:error] [pid 21536:tid 21542] [client 74.249.162.224:30161] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-conf.php"] [unique_id "afIOziREaVkH9P5H_LQurwAAAIQ"]
[Wed Apr 29 21:59:43.024332 2026] [:error] [pid 21536:tid 21541] [client 74.249.162.224:30262] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-conf.php"] [unique_id "afIOzyREaVkH9P5H_LQusQAAAIM"]
[Wed Apr 29 21:59:43.439717 2026] [:error] [pid 21227:tid 21256] [client 74.249.162.224:30249] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-conf.php"] [unique_id "afIOz8B3c6U5AGPPsXqZNAAAANc"]
[Wed Apr 29 21:59:43.886854 2026] [:error] [pid 47618:tid 47629] [client 74.249.162.224:30147] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "afIOz3HYUSxIrhce2OAqlQAAAUg"]
[Wed Apr 29 21:59:44.408934 2026] [:error] [pid 21137:tid 21175] [client 74.249.162.224:30250] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "afIO0Pw-HnaioFPIurVm7AAAAAY"]
[Wed Apr 29 21:59:44.956886 2026] [:error] [pid 21137:tid 21174] [client 74.249.162.224:30159] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "afIO0Pw-HnaioFPIurVm7gAAAAU"]
[Wed Apr 29 21:59:46.357740 2026] [:error] [pid 21138:tid 21217] [client 74.249.162.224:30157] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/hideo/network.php"] [unique_id "afIO0puzwUiyMeUnp332OQAAARQ"]
[Wed Apr 29 21:59:48.410549 2026] [:error] [pid 21137:tid 21184] [client 74.249.162.224:30169] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "afIO1Pw-HnaioFPIurVm8AAAAA8"]
[Wed Apr 29 21:59:53.121591 2026] [:error] [pid 21138:tid 21203] [client 74.249.162.224:30243] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "afIO2ZuzwUiyMeUnp332RwAAAQY"]
[Wed Apr 29 21:59:53.638664 2026] [:error] [pid 21137:tid 21173] [client 74.249.162.224:30162] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "afIO2fw-HnaioFPIurVm8wAAAAQ"]
[Wed Apr 29 21:59:54.029699 2026] [:error] [pid 21137:tid 21172] [client 74.249.162.224:30227] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "afIO2vw-HnaioFPIurVm9AAAAAM"]
[Wed Apr 29 21:59:54.406868 2026] [:error] [pid 21136:tid 21141] [client 74.249.162.224:30156] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "afIO2ilIfGGQdPVv8_PukgAAAEA"]
[Wed Apr 29 21:59:54.909350 2026] [:error] [pid 21137:tid 21170] [client 74.249.162.224:30226] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "afIO2vw-HnaioFPIurVm9gAAAAE"]
[Wed Apr 29 21:59:55.288413 2026] [:error] [pid 21136:tid 21142] [client 74.249.162.224:30173] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "afIO2ylIfGGQdPVv8_PulAAAAEE"]
[Wed Apr 29 21:59:55.693339 2026] [:error] [pid 21536:tid 21560] [client 74.249.162.224:30265] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abc.php"] [unique_id "afIO2yREaVkH9P5H_LQuswAAAJY"]
[Wed Apr 29 21:59:56.069979 2026] [:error] [pid 21227:tid 21241] [client 74.249.162.224:30158] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "afIO3MB3c6U5AGPPsXqZNwAAAMg"]
[Wed Apr 29 21:59:56.584520 2026] [:error] [pid 21536:tid 21538] [client 74.249.162.224:30263] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "afIO3CREaVkH9P5H_LQutAAAAIA"]
[Wed Apr 29 21:59:56.962190 2026] [:error] [pid 21227:tid 21237] [client 74.249.162.224:30260] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "afIO3MB3c6U5AGPPsXqZOAAAAMQ"]
[Wed Apr 29 21:59:57.393886 2026] [:error] [pid 21536:tid 21546] [client 74.249.162.224:30144] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "afIO3SREaVkH9P5H_LQutQAAAIg"]
[Wed Apr 29 21:59:57.826496 2026] [:error] [pid 21136:tid 21152] [client 74.249.162.224:30153] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afIO3SlIfGGQdPVv8_PulQAAAEs"]
[Wed Apr 29 21:59:58.281054 2026] [:error] [pid 21227:tid 21257] [client 74.249.162.224:30223] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afIO3sB3c6U5AGPPsXqZOQAAANg"]
[Wed Apr 29 21:59:58.690661 2026] [:error] [pid 21136:tid 21144] [client 74.249.162.224:7110] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afIO3ilIfGGQdPVv8_PulgAAAEM"]
[Wed Apr 29 21:59:59.159426 2026] [:error] [pid 21536:tid 21551] [client 74.249.162.224:30171] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afIO3yREaVkH9P5H_LQutgAAAI0"]
[Wed Apr 29 21:59:59.575378 2026] [:error] [pid 21137:tid 21190] [client 74.249.162.224:30254] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afIO3_w-HnaioFPIurVm9wAAABU"]
[Wed Apr 29 21:59:59.966046 2026] [:error] [pid 21137:tid 21175] [client 74.249.162.224:30187] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afIO3_w-HnaioFPIurVm-AAAAAY"]
[Wed Apr 29 22:00:00.343593 2026] [:error] [pid 21536:tid 21553] [client 74.249.162.224:30160] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afIO4CREaVkH9P5H_LQutwAAAI8"]
[Wed Apr 29 22:00:01.750690 2026] [:error] [pid 21138:tid 21216] [client 74.249.162.224:30193] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afIO4ZuzwUiyMeUnp332SQAAARM"]
[Wed Apr 29 22:00:02.196718 2026] [:error] [pid 21536:tid 21561] [client 74.249.162.224:30246] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afIO4iREaVkH9P5H_LQuuAAAAJc"]
[Wed Apr 29 22:00:02.648908 2026] [:error] [pid 21536:tid 21555] [client 74.249.162.224:30178] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afIO4iREaVkH9P5H_LQuuwAAAJE"]
[Wed Apr 29 22:00:03.029697 2026] [:error] [pid 21138:tid 21208] [client 74.249.162.224:30228] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afIO45uzwUiyMeUnp332SwAAAQs"]
[Wed Apr 29 22:00:03.423794 2026] [:error] [pid 21227:tid 21233] [client 74.249.162.224:30257] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afIO48B3c6U5AGPPsXqZPQAAAMA"]
[Wed Apr 29 22:00:03.896386 2026] [:error] [pid 21227:tid 21251] [client 74.249.162.224:7145] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIO48B3c6U5AGPPsXqZQAAAANI"]
[Wed Apr 29 22:00:04.304347 2026] [:error] [pid 21227:tid 21235] [client 74.249.162.224:30233] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIO5MB3c6U5AGPPsXqZQwAAAMI"]
[Wed Apr 29 22:00:04.888615 2026] [:error] [pid 21136:tid 21162] [client 74.249.162.224:7111] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIO5ClIfGGQdPVv8_PumQAAAFU"]
[Wed Apr 29 22:00:05.461103 2026] [:error] [pid 21536:tid 21541] [client 74.249.162.224:30145] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIO5SREaVkH9P5H_LQuvgAAAIM"]
[Wed Apr 29 22:00:07.159694 2026] [:error] [pid 21536:tid 21558] [client 74.249.162.224:30186] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIO5yREaVkH9P5H_LQuvwAAAJQ"]
[Wed Apr 29 22:00:07.546740 2026] [:error] [pid 21227:tid 21243] [client 74.249.162.224:7125] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIO58B3c6U5AGPPsXqZRQAAAMo"]
[Wed Apr 29 22:00:07.993000 2026] [:error] [pid 21138:tid 21206] [client 74.249.162.224:30251] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIO55uzwUiyMeUnp332TgAAAQk"]
[Wed Apr 29 22:00:10.309290 2026] [:error] [pid 21536:tid 21546] [client 74.249.162.224:30174] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIO6iREaVkH9P5H_LQuxAAAAIg"]
[Wed Apr 29 22:00:10.731108 2026] [:error] [pid 21138:tid 21212] [client 74.249.162.224:30151] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIO6puzwUiyMeUnp332XAAAAQ8"]
[Wed Apr 29 22:00:11.141652 2026] [:error] [pid 21138:tid 21213] [client 74.249.162.224:30168] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIO65uzwUiyMeUnp332XwAAARA"]
[Wed Apr 29 22:00:11.659670 2026] [:error] [pid 21138:tid 21215] [client 74.249.162.224:30224] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIO65uzwUiyMeUnp332YQAAARI"]
[Wed Apr 29 22:00:12.035304 2026] [:error] [pid 21138:tid 21220] [client 74.249.162.224:30155] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIO7JuzwUiyMeUnp332ZAAAARc"]
[Wed Apr 29 22:00:14.814872 2026] [:error] [pid 21137:tid 21175] [client 74.249.162.224:30259] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "afIO7vw-HnaioFPIurVnCgAAAAY"]
[Wed Apr 29 22:00:15.873587 2026] [:error] [pid 47618:tid 47633] [client 74.249.162.224:30176] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "afIO73HYUSxIrhce2OAqnQAAAUw"]
[Wed Apr 29 22:00:16.257040 2026] [:error] [pid 47618:tid 47641] [client 74.249.162.224:30201] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "afIO8HHYUSxIrhce2OAqngAAAVQ"]
[Wed Apr 29 22:00:16.836232 2026] [:error] [pid 21138:tid 21196] [client 74.249.162.224:30219] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "afIO8JuzwUiyMeUnp332dAAAAQA"]
[Wed Apr 29 22:00:17.436355 2026] [:error] [pid 21138:tid 21213] [client 74.249.162.224:30256] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afIO8ZuzwUiyMeUnp332dgAAARA"]
[Wed Apr 29 22:00:18.383315 2026] [:error] [pid 47618:tid 47632] [client 74.249.162.224:30184] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afIO8nHYUSxIrhce2OAqoAAAAUs"]
[Wed Apr 29 22:00:19.199298 2026] [:error] [pid 21227:tid 21236] [client 74.249.162.224:30240] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afIO88B3c6U5AGPPsXqZWAAAAMM"]
[Wed Apr 29 22:00:19.584091 2026] [:error] [pid 21137:tid 21182] [client 74.249.162.224:30164] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afIO8_w-HnaioFPIurVnDwAAAA0"]
[Wed Apr 29 22:00:19.962517 2026] [:error] [pid 21227:tid 21238] [client 74.249.162.224:30191] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "afIO88B3c6U5AGPPsXqZWgAAAMU"]
[Wed Apr 29 22:00:20.362389 2026] [:error] [pid 21137:tid 21176] [client 74.249.162.224:30242] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "afIO9Pw-HnaioFPIurVnEgAAAAc"]
[Wed Apr 29 22:00:20.740023 2026] [:error] [pid 21227:tid 21254] [client 74.249.162.224:7057] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "afIO9MB3c6U5AGPPsXqZXAAAANU"]
[Wed Apr 29 22:00:22.185689 2026] [:error] [pid 21227:tid 21252] [client 74.249.162.224:7104] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-t.api.php"] [unique_id "afIO9sB3c6U5AGPPsXqZXgAAANM"]
[Wed Apr 29 22:00:22.583081 2026] [:error] [pid 21227:tid 21240] [client 74.249.162.224:30235] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "afIO9sB3c6U5AGPPsXqZXwAAAMc"]
[Wed Apr 29 22:00:23.061085 2026] [:error] [pid 47618:tid 47635] [client 74.249.162.224:30247] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "afIO93HYUSxIrhce2OAqpQAAAU4"]
[Wed Apr 29 22:00:23.603948 2026] [:error] [pid 21536:tid 21551] [client 74.249.162.224:30179] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "afIO9yREaVkH9P5H_LQuzwAAAI0"]
[Wed Apr 29 22:00:24.058551 2026] [:error] [pid 21536:tid 21553] [client 74.249.162.224:30211] File does not exist: /usr/local/apache/htdocs/suspended-page/sf.php
[Wed Apr 29 22:00:24.361454 2026] [:error] [pid 21536:tid 21561] [client 74.249.162.224:30211] File does not exist: /usr/local/apache/htdocs/suspended-page/kbfr.php
[Wed Apr 29 22:00:24.553178 2026] [:error] [pid 21536:tid 21555] [client 74.249.162.224:30211] File does not exist: /usr/local/apache/htdocs/suspended-page/autoload_classmap.php
[Wed Apr 29 22:00:24.921665 2026] [:error] [pid 21536:tid 21554] [client 74.249.162.224:30211] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Wed Apr 29 22:00:25.131568 2026] [:error] [pid 21536:tid 21545] [client 74.249.162.224:30211] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 29 22:00:25.323777 2026] [:error] [pid 21536:tid 21556] [client 74.249.162.224:30211] File does not exist: /usr/local/apache/htdocs/suspended-page/defaults.php
[Wed Apr 29 22:00:26.373741 2026] [:error] [pid 21536:tid 21541] [client 74.249.162.224:30211] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Apr 29 22:00:27.456955 2026] [:error] [pid 21536:tid 21544] [client 74.249.162.224:30211] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "afIO-yREaVkH9P5H_LQu3AAAAIY"]
[Wed Apr 29 22:00:27.848276 2026] [:error] [pid 21136:tid 21163] [client 74.249.162.224:7140] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "afIO-ylIfGGQdPVv8_PuyAAAAFY"]
[Wed Apr 29 22:00:28.236586 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:7138] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "afIO_JuzwUiyMeUnp332ewAAAQw"]
[Wed Apr 29 22:00:28.613756 2026] [:error] [pid 21138:tid 21204] [client 74.249.162.224:30239] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/images/"] [unique_id "afIO_JuzwUiyMeUnp332fAAAAQc"]
[Wed Apr 29 22:00:29.110667 2026] [:error] [pid 21138:tid 21196] [client 74.249.162.224:30181] [client 74.249.162.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "afIO_ZuzwUiyMeUnp332gAAAAQA"]
[Wed Apr 29 22:00:29.575679 2026] [:error] [pid 21138:tid 21212] [client 74.249.162.224:30266] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/"] [unique_id "afIO_ZuzwUiyMeUnp332gQAAAQ8"]
[Wed Apr 29 22:00:31.794732 2026] [:error] [pid 47618:tid 47621] [client 74.249.162.224:30238] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/"] [unique_id "afIO_3HYUSxIrhce2OAqsgAAAUA"]
[Wed Apr 29 22:00:32.415141 2026] [:error] [pid 47618:tid 47641] [client 74.249.162.224:30261] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/"] [unique_id "afIPAHHYUSxIrhce2OAqswAAAVQ"]
[Wed Apr 29 22:00:34.975042 2026] [:error] [pid 21227:tid 21250] [client 74.249.162.224:30172] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/html-api/"] [unique_id "afIPAsB3c6U5AGPPsXqZZwAAANE"]
[Wed Apr 29 22:00:38.269862 2026] [:error] [pid 21536:tid 21553] [client 74.249.162.224:30180] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPBiREaVkH9P5H_LQu3gAAAI8"]
[Wed Apr 29 22:00:39.633782 2026] [:error] [pid 47618:tid 47633] [client 74.249.162.224:30166] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPB3HYUSxIrhce2OAqvgAAAUw"]
[Wed Apr 29 22:00:40.023009 2026] [:error] [pid 21138:tid 21208] [client 74.249.162.224:7146] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPCJuzwUiyMeUnp332iAAAAQs"]
[Wed Apr 29 22:00:40.411766 2026] [:error] [pid 21138:tid 21221] [client 74.249.162.224:7121] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPCJuzwUiyMeUnp332igAAARg"]
[Wed Apr 29 22:00:40.888541 2026] [:error] [pid 21536:tid 21546] [client 74.249.162.224:30170] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "afIPCCREaVkH9P5H_LQu4AAAAIg"]
[Wed Apr 29 22:00:41.434692 2026] [:error] [pid 21138:tid 21219] [client 74.249.162.224:30204] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "afIPCZuzwUiyMeUnp332jAAAARY"]
[Wed Apr 29 22:00:42.068330 2026] [:error] [pid 47618:tid 47622] [client 74.249.162.224:30206] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "afIPCnHYUSxIrhce2OAqwQAAAUE"]
[Wed Apr 29 22:00:42.978515 2026] [:error] [pid 21536:tid 21561] [client 74.249.162.224:30150] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "afIPCiREaVkH9P5H_LQu4QAAAJc"]
[Wed Apr 29 22:00:43.432003 2026] [:error] [pid 21137:tid 21184] [client 74.249.162.224:30192] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afIPC_w-HnaioFPIurVnJQAAAA8"]
[Wed Apr 29 22:00:45.348743 2026] [:error] [pid 21137:tid 21176] [client 74.249.162.224:30146] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afIPDfw-HnaioFPIurVnJgAAAAc"]
[Wed Apr 29 22:00:45.831536 2026] [:error] [pid 21137:tid 21177] [client 74.249.162.224:30268] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afIPDfw-HnaioFPIurVnKQAAAAg"]
[Wed Apr 29 22:00:46.243956 2026] [:error] [pid 21137:tid 21186] [client 74.249.162.224:30241] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afIPDvw-HnaioFPIurVnKgAAABE"]
[Wed Apr 29 22:00:46.633577 2026] [:error] [pid 21137:tid 21170] [client 74.249.162.224:7041] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "afIPDvw-HnaioFPIurVnKwAAAAE"]
[Wed Apr 29 22:00:48.306701 2026] [:error] [pid 47618:tid 47629] [client 74.249.162.224:30222] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "afIPEHHYUSxIrhce2OAqwwAAAUg"]
[Wed Apr 29 22:00:49.318408 2026] [:error] [pid 47618:tid 47635] [client 74.249.162.224:30264] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "afIPEXHYUSxIrhce2OAqxQAAAU4"]
[Wed Apr 29 22:00:50.833787 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:30225] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/admin.php"] [unique_id "afIPEpuzwUiyMeUnp332jgAAAQw"]
[Wed Apr 29 22:00:51.333404 2026] [:error] [pid 47618:tid 47626] [client 74.249.162.224:7105] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afIPE3HYUSxIrhce2OAqyAAAAUU"]
[Wed Apr 29 22:00:51.742475 2026] [:error] [pid 21227:tid 21233] [client 74.249.162.224:30209] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afIPE8B3c6U5AGPPsXqZawAAAMA"]
[Wed Apr 29 22:00:52.173323 2026] [:error] [pid 21536:tid 21538] [client 74.249.162.224:7082] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afIPFCREaVkH9P5H_LQu4wAAAIA"]
[Wed Apr 29 22:00:53.622129 2026] [:error] [pid 21227:tid 21251] [client 74.249.162.224:30175] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afIPFcB3c6U5AGPPsXqZbAAAANI"]
[Wed Apr 29 22:00:54.156848 2026] [:error] [pid 21138:tid 21201] [client 74.249.162.224:7136] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "afIPFpuzwUiyMeUnp332kwAAAQQ"]
[Wed Apr 29 22:00:59.115026 2026] [:error] [pid 21138:tid 21217] [client 74.249.162.224:30205] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "afIPG5uzwUiyMeUnp332mQAAARQ"]
[Wed Apr 29 22:00:59.513207 2026] [:error] [pid 21136:tid 21148] [client 74.249.162.224:30220] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "afIPGylIfGGQdPVv8_PuzwAAAEc"]
[Wed Apr 29 22:00:59.949277 2026] [:error] [pid 21536:tid 21544] [client 74.249.162.224:7167] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/index.php"] [unique_id "afIPGyREaVkH9P5H_LQu6QAAAIY"]
[Wed Apr 29 22:01:01.573955 2026] [:error] [pid 21536:tid 21557] [client 74.249.162.224:30177] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "afIPHSREaVkH9P5H_LQu6gAAAJM"]
[Wed Apr 29 22:01:01.988585 2026] [:error] [pid 21138:tid 21203] [client 74.249.162.224:7156] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "afIPHZuzwUiyMeUnp332nQAAAQY"]
[Wed Apr 29 22:01:03.595920 2026] [:error] [pid 21536:tid 21559] [client 74.249.162.224:30258] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "afIPHyREaVkH9P5H_LQu7AAAAJU"]
[Wed Apr 29 22:01:04.003683 2026] [:error] [pid 47618:tid 47642] [client 74.249.162.224:30203] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "afIPIHHYUSxIrhce2OAqzwAAAVU"]
[Wed Apr 29 22:01:05.044328 2026] [:error] [pid 47618:tid 47628] [client 74.249.162.224:7049] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/"] [unique_id "afIPIXHYUSxIrhce2OAq0gAAAUc"]
[Wed Apr 29 22:01:05.442719 2026] [:error] [pid 21536:tid 21546] [client 74.249.162.224:7155] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/"] [unique_id "afIPISREaVkH9P5H_LQu7gAAAIg"]
[Wed Apr 29 22:01:06.312412 2026] [:error] [pid 47618:tid 47636] [client 74.249.162.224:7131] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/"] [unique_id "afIPInHYUSxIrhce2OAq0wAAAU8"]
[Wed Apr 29 22:01:06.706564 2026] [:error] [pid 47618:tid 47639] [client 74.249.162.224:7043] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/images/"] [unique_id "afIPInHYUSxIrhce2OAq1QAAAVI"]
[Wed Apr 29 22:01:07.129848 2026] [:error] [pid 47618:tid 47629] [client 74.249.162.224:30185] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "afIPI3HYUSxIrhce2OAq1gAAAUg"]
[Wed Apr 29 22:01:07.527716 2026] [:error] [pid 21536:tid 21561] [client 74.249.162.224:30207] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "afIPIyREaVkH9P5H_LQu7wAAAJc"]
[Wed Apr 29 22:01:08.912328 2026] [:error] [pid 21536:tid 21554] [client 74.249.162.224:30183] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "afIPJCREaVkH9P5H_LQu8QAAAJA"]
[Wed Apr 29 22:01:09.366168 2026] [:error] [pid 47618:tid 47641] [client 74.249.162.224:7124] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/WordPressCore/"] [unique_id "afIPJXHYUSxIrhce2OAq2gAAAVQ"]
[Wed Apr 29 22:01:09.752686 2026] [:error] [pid 21138:tid 21217] [client 74.249.162.224:7053] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIPJZuzwUiyMeUnp332pAAAARQ"]
[Wed Apr 29 22:01:10.243957 2026] [:error] [pid 21536:tid 21545] [client 74.249.162.224:30167] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIPJiREaVkH9P5H_LQu8wAAAIc"]
[Wed Apr 29 22:01:10.633325 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:7109] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIPJpuzwUiyMeUnp332qAAAAQw"]
[Wed Apr 29 22:01:11.042626 2026] [:error] [pid 21138:tid 21205] [client 74.249.162.224:30199] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afIPJ5uzwUiyMeUnp332qgAAAQg"]
[Wed Apr 29 22:01:12.558035 2026] [:error] [pid 21138:tid 21207] [client 74.249.162.224:7112] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIPKJuzwUiyMeUnp332rQAAAQo"]
[Wed Apr 29 22:01:12.963897 2026] [:error] [pid 21138:tid 21221] [client 74.249.162.224:7133] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIPKJuzwUiyMeUnp332tAAAARg"]
[Wed Apr 29 22:01:13.472898 2026] [:error] [pid 47618:tid 47642] [client 74.249.162.224:30190] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIPKXHYUSxIrhce2OAq3AAAAVU"]
[Wed Apr 29 22:01:13.875584 2026] [:error] [pid 47618:tid 47644] [client 74.249.162.224:7123] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "afIPKXHYUSxIrhce2OAq3QAAAVc"]
[Wed Apr 29 22:01:14.294781 2026] [:error] [pid 21138:tid 21211] [client 74.249.162.224:7166] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "afIPKpuzwUiyMeUnp332uAAAAQ4"]
[Wed Apr 29 22:01:15.190598 2026] [:error] [pid 21138:tid 21199] [client 74.249.162.224:30230] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "afIPK5uzwUiyMeUnp332uQAAAQI"]
[Wed Apr 29 22:01:15.946404 2026] [:error] [pid 21138:tid 21204] [client 74.249.162.224:30196] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "afIPK5uzwUiyMeUnp332uwAAAQc"]
[Wed Apr 29 22:01:16.389393 2026] [:error] [pid 47618:tid 47628] [client 74.249.162.224:7135] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "afIPLHHYUSxIrhce2OAq3gAAAUc"]
[Wed Apr 29 22:01:16.766865 2026] [:error] [pid 21536:tid 21540] [client 74.249.162.224:7163] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afIPLCREaVkH9P5H_LQu-QAAAII"]
[Wed Apr 29 22:01:17.199261 2026] [:error] [pid 21227:tid 21242] [client 74.249.162.224:7060] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afIPLcB3c6U5AGPPsXqZegAAAMk"]
[Wed Apr 29 22:01:17.612378 2026] [:error] [pid 21138:tid 21216] [client 74.249.162.224:30232] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afIPLZuzwUiyMeUnp332vwAAARM"]
[Wed Apr 29 22:01:18.824566 2026] [:error] [pid 21138:tid 21210] [client 74.249.162.224:30188] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afIPLpuzwUiyMeUnp332wQAAAQ0"]
[Wed Apr 29 22:01:19.302174 2026] [:error] [pid 21138:tid 21211] [client 74.249.162.224:7139] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afIPL5uzwUiyMeUnp332xQAAAQ4"]
[Wed Apr 29 22:01:19.762542 2026] [:error] [pid 21138:tid 21220] [client 74.249.162.224:30163] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afIPL5uzwUiyMeUnp332xwAAARc"]
[Wed Apr 29 22:01:20.239995 2026] [:error] [pid 21138:tid 21217] [client 74.249.162.224:7076] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afIPMJuzwUiyMeUnp332yAAAARQ"]
[Wed Apr 29 22:01:20.636774 2026] [:error] [pid 21536:tid 21547] [client 74.249.162.224:30216] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afIPMCREaVkH9P5H_LQu-wAAAIk"]
[Wed Apr 29 22:01:21.048276 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:7141] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIPMZuzwUiyMeUnp332yQAAAQw"]
[Wed Apr 29 22:01:21.472314 2026] [:error] [pid 21138:tid 21216] [client 74.249.162.224:7044] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIPMZuzwUiyMeUnp332ywAAARM"]
[Wed Apr 29 22:01:21.854943 2026] [:error] [pid 21138:tid 21221] [client 74.249.162.224:30182] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIPMZuzwUiyMeUnp3323AAAARg"]
[Wed Apr 29 22:01:22.320964 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:7137] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afIPMpuzwUiyMeUnp3329QAAAQw"]
[Wed Apr 29 22:01:22.736278 2026] [:error] [pid 21536:tid 21552] [client 74.249.162.224:30197] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPMiREaVkH9P5H_LQu_gAAAI4"]
[Wed Apr 29 22:01:23.175568 2026] [:error] [pid 21536:tid 21560] [client 74.249.162.224:7147] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPMyREaVkH9P5H_LQu_wAAAJY"]
[Wed Apr 29 22:01:23.593927 2026] [:error] [pid 21136:tid 21145] [client 74.249.162.224:7077] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPMylIfGGQdPVv8_Pu1wAAAEQ"]
[Wed Apr 29 22:01:24.233412 2026] [:error] [pid 47618:tid 47645] [client 74.249.162.224:30255] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afIPNHHYUSxIrhce2OAq3wAAAVg"]
[Wed Apr 29 22:01:24.616288 2026] [:error] [pid 47618:tid 47636] [client 74.249.162.224:7143] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "afIPNHHYUSxIrhce2OAq4AAAAU8"]
[Wed Apr 29 22:01:25.032910 2026] [:error] [pid 21137:tid 21178] [client 74.249.162.224:7047] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "afIPNfw-HnaioFPIurVnQgAAAAk"]
[Wed Apr 29 22:01:25.523828 2026] [:error] [pid 21536:tid 21555] [client 74.249.162.224:30195] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "afIPNSREaVkH9P5H_LQvBQAAAJE"]
[Wed Apr 29 22:01:25.902629 2026] [:error] [pid 21536:tid 21538] [client 74.249.162.224:7080] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "afIPNSREaVkH9P5H_LQvBgAAAIA"]
[Wed Apr 29 22:01:26.338524 2026] [:error] [pid 21137:tid 21189] [client 74.249.162.224:7075] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "afIPNvw-HnaioFPIurVnQwAAABQ"]
[Wed Apr 29 22:01:26.817569 2026] [:error] [pid 21137:tid 21171] [client 74.249.162.224:7045] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmrlpc.php"] [unique_id "afIPNvw-HnaioFPIurVnRAAAAAI"]
[Wed Apr 29 22:01:27.298218 2026] [:error] [pid 21136:tid 21146] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Wed Apr 29 22:01:27.568495 2026] [:error] [pid 21136:tid 21147] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Wed Apr 29 22:01:27.773984 2026] [:error] [pid 21136:tid 21156] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed Apr 29 22:01:27.974964 2026] [:error] [pid 21136:tid 21148] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Wed Apr 29 22:01:28.167575 2026] [:error] [pid 21136:tid 21157] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/as.php
[Wed Apr 29 22:01:28.364598 2026] [:error] [pid 21136:tid 21165] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/aw.php
[Wed Apr 29 22:01:28.566971 2026] [:error] [pid 21136:tid 21153] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/bb.php
[Wed Apr 29 22:01:28.776627 2026] [:error] [pid 21136:tid 21161] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Wed Apr 29 22:01:28.967887 2026] [:error] [pid 21136:tid 21141] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Wed Apr 29 22:01:29.159026 2026] [:error] [pid 21136:tid 21163] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Wed Apr 29 22:01:29.397900 2026] [:error] [pid 21136:tid 21149] [client 74.249.162.224:30271] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Wed Apr 29 22:01:30.833620 2026] [:error] [pid 21136:tid 21149] [client 74.249.162.224:30271] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/autoload_classmap.php"] [unique_id "afIPOilIfGGQdPVv8_Pu5gAAAEg"]
[Wed Apr 29 22:01:31.398863 2026] [:error] [pid 21138:tid 21218] [client 74.249.162.224:7061] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/autoload_classmap.php"] [unique_id "afIPO5uzwUiyMeUnp333NQAAARU"]
[Wed Apr 29 22:01:32.021551 2026] [:error] [pid 21138:tid 21196] [client 74.249.162.224:7115] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/autoload_classmap.php"] [unique_id "afIPPJuzwUiyMeUnp333NwAAAQA"]
[Wed Apr 29 22:01:32.471395 2026] [:error] [pid 47618:tid 47629] [client 74.249.162.224:7046] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/css/autoload_classmap.php"] [unique_id "afIPPHHYUSxIrhce2OAq4gAAAUg"]
[Wed Apr 29 22:01:32.985728 2026] [:error] [pid 21138:tid 21210] [client 74.249.162.224:7159] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fx.php"] [unique_id "afIPPJuzwUiyMeUnp333OAAAAQ0"]
[Wed Apr 29 22:01:33.363267 2026] [:error] [pid 21137:tid 21173] [client 74.249.162.224:7117] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fx.php"] [unique_id "afIPPfw-HnaioFPIurVnRwAAAAQ"]
[Wed Apr 29 22:01:33.804977 2026] [:error] [pid 21138:tid 21221] [client 74.249.162.224:7113] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fx.php"] [unique_id "afIPPZuzwUiyMeUnp333OgAAARg"]
[Wed Apr 29 22:01:34.210436 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:30200] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fx.php"] [unique_id "afIPPpuzwUiyMeUnp333OwAAAQw"]
[Wed Apr 29 22:01:34.590486 2026] [:error] [pid 21138:tid 21213] [client 74.249.162.224:7108] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "afIPPpuzwUiyMeUnp333PAAAARA"]
[Wed Apr 29 22:01:36.284213 2026] [:error] [pid 21138:tid 21208] [client 74.249.162.224:30213] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "afIPQJuzwUiyMeUnp333QQAAAQs"]
[Wed Apr 29 22:01:37.552762 2026] [:error] [pid 21536:tid 21552] [client 74.249.162.224:7067] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "afIPQSREaVkH9P5H_LQvDgAAAI4"]
[Wed Apr 29 22:01:37.979105 2026] [:error] [pid 21227:tid 21240] [client 74.249.162.224:7118] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gelay.php"] [unique_id "afIPQcB3c6U5AGPPsXqZfwAAAMc"]
[Wed Apr 29 22:01:39.446652 2026] [:error] [pid 21138:tid 21220] [client 74.249.162.224:30269] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god4m.php"] [unique_id "afIPQ5uzwUiyMeUnp333RQAAARc"]
[Wed Apr 29 22:01:39.862034 2026] [:error] [pid 21536:tid 21559] [client 74.249.162.224:7097] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god4m.php"] [unique_id "afIPQyREaVkH9P5H_LQvEAAAAJU"]
[Wed Apr 29 22:01:40.342776 2026] [:error] [pid 21227:tid 21247] [client 74.249.162.224:7068] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god4m.php"] [unique_id "afIPRMB3c6U5AGPPsXqZgAAAAM4"]
[Wed Apr 29 22:01:42.025975 2026] [:error] [pid 21138:tid 21207] [client 74.249.162.224:6999] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/god4m.php"] [unique_id "afIPRpuzwUiyMeUnp333WQAAAQo"]
[Wed Apr 29 22:01:42.428775 2026] [:error] [pid 21138:tid 21215] [client 74.249.162.224:7008] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mari.php"] [unique_id "afIPRpuzwUiyMeUnp333WwAAARI"]
[Wed Apr 29 22:01:42.810744 2026] [:error] [pid 21137:tid 21176] [client 74.249.162.224:7002] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mari.php"] [unique_id "afIPRvw-HnaioFPIurVnWQAAAAc"]
[Wed Apr 29 22:01:43.234861 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:6989] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mari.php"] [unique_id "afIPR5uzwUiyMeUnp333XAAAAQw"]
[Wed Apr 29 22:01:44.794963 2026] [:error] [pid 21137:tid 21193] [client 74.249.162.224:7122] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mari.php"] [unique_id "afIPSPw-HnaioFPIurVnXgAAABg"]
[Wed Apr 29 22:01:45.280700 2026] [:error] [pid 21138:tid 21207] [client 74.249.162.224:7102] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "afIPSZuzwUiyMeUnp333XgAAAQo"]
[Wed Apr 29 22:01:46.294605 2026] [:error] [pid 21138:tid 21220] [client 74.249.162.224:7149] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "afIPSpuzwUiyMeUnp333XwAAARc"]
[Wed Apr 29 22:01:46.687420 2026] [:error] [pid 21536:tid 21562] [client 74.249.162.224:7144] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "afIPSiREaVkH9P5H_LQvEQAAAJg"]
[Wed Apr 29 22:01:47.199637 2026] [:error] [pid 21536:tid 21538] [client 74.249.162.224:7151] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moon.php"] [unique_id "afIPSyREaVkH9P5H_LQvEgAAAIA"]
[Wed Apr 29 22:01:47.628726 2026] [:error] [pid 21227:tid 21257] [client 74.249.162.224:7160] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o.php"] [unique_id "afIPS8B3c6U5AGPPsXqZgwAAANg"]
[Wed Apr 29 22:01:48.035083 2026] [:error] [pid 21138:tid 21201] [client 74.249.162.224:7088] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o.php"] [unique_id "afIPTJuzwUiyMeUnp333YgAAAQQ"]
[Wed Apr 29 22:01:48.413664 2026] [:error] [pid 21138:tid 21217] [client 74.249.162.224:30198] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o.php"] [unique_id "afIPTJuzwUiyMeUnp333ZQAAARQ"]
[Wed Apr 29 22:01:49.349027 2026] [:error] [pid 21138:tid 21200] [client 74.249.162.224:7092] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/o.php"] [unique_id "afIPTZuzwUiyMeUnp333ZgAAAQM"]
[Wed Apr 29 22:01:53.453492 2026] [:error] [pid 21536:tid 21556] [client 74.249.162.224:7066] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmp.php"] [unique_id "afIPUSREaVkH9P5H_LQvEwAAAJI"]
[Wed Apr 29 22:01:58.389047 2026] [:error] [pid 21138:tid 21219] [client 74.249.162.224:7040] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmp.php"] [unique_id "afIPVpuzwUiyMeUnp333bwAAARY"]
[Wed Apr 29 22:01:59.339613 2026] [:error] [pid 21138:tid 21209] [client 74.249.162.224:7114] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmp.php"] [unique_id "afIPV5uzwUiyMeUnp333cQAAAQw"]
[Wed Apr 29 22:01:59.745448 2026] [:error] [pid 21138:tid 21214] [client 74.249.162.224:7018] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmp.php"] [unique_id "afIPV5uzwUiyMeUnp333cgAAARE"]
[Wed Apr 29 22:02:00.150330 2026] [:error] [pid 21137:tid 21181] [client 74.249.162.224:7063] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afIPWPw-HnaioFPIurVnYQAAAAw"]
[Wed Apr 29 22:02:00.617534 2026] [:error] [pid 21137:tid 21186] [client 74.249.162.224:7107] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afIPWPw-HnaioFPIurVnYgAAABE"]
[Wed Apr 29 22:02:03.400861 2026] [:error] [pid 21137:tid 21189] [client 74.249.162.224:7116] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afIPW_w-HnaioFPIurVnYwAAABQ"]
[Wed Apr 29 22:02:04.455921 2026] [:error] [pid 21136:tid 21159] [client 74.249.162.224:7142] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afIPXClIfGGQdPVv8_Pu8gAAAFI"]
[Wed Apr 29 22:02:04.970585 2026] [:error] [pid 21137:tid 21191] [client 74.249.162.224:7152] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/a.php"] [unique_id "afIPXPw-HnaioFPIurVnZwAAABY"]
[Wed Apr 29 22:02:05.368010 2026] [:error] [pid 21138:tid 21205] [client 74.249.162.224:7048] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/a.php"] [unique_id "afIPXZuzwUiyMeUnp333dAAAAQg"]
[Wed Apr 29 22:02:05.776486 2026] [:error] [pid 21138:tid 21216] [client 74.249.162.224:7129] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/a.php"] [unique_id "afIPXZuzwUiyMeUnp333dgAAARM"]
[Wed Apr 29 22:02:06.174499 2026] [:error] [pid 21138:tid 21199] [client 74.249.162.224:7106] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/a.php"] [unique_id "afIPXpuzwUiyMeUnp333egAAAQI"]
[Wed Apr 29 22:02:06.577711 2026] [:error] [pid 21136:tid 21164] [client 74.249.162.224:7072] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/alfa.php"] [unique_id "afIPXilIfGGQdPVv8_Pu9AAAAFc"]
[Wed Apr 29 22:02:07.024015 2026] [:error] [pid 21136:tid 21145] [client 74.249.162.224:7090] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/alfa.php"] [unique_id "afIPXylIfGGQdPVv8_Pu9QAAAEQ"]
[Wed Apr 29 22:02:08.009044 2026] [:error] [pid 21137:tid 21173] [client 74.249.162.224:7056] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/alfa.php"] [unique_id "afIPYPw-HnaioFPIurVnaAAAAAQ"]
[Wed Apr 29 22:02:11.528690 2026] [:error] [pid 21138:tid 21214] [client 74.249.162.224:30212] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/alfa.php"] [unique_id "afIPY5uzwUiyMeUnp333fwAAARE"]
[Wed Apr 29 22:02:12.132640 2026] [:error] [pid 21138:tid 21197] [client 74.249.162.224:30215] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors"] [unique_id "afIPZJuzwUiyMeUnp333gAAAAQE"]
[Wed Apr 29 22:02:13.766026 2026] [:error] [pid 21137:tid 21181] [client 74.249.162.224:30194] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors"] [unique_id "afIPZfw-HnaioFPIurVndQAAAAw"]
[Wed Apr 29 22:02:14.169047 2026] [:error] [pid 21138:tid 21212] [client 74.249.162.224:7099] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors"] [unique_id "afIPZpuzwUiyMeUnp333gQAAAQ8"]
[Wed Apr 29 22:02:15.113821 2026] [:error] [pid 21137:tid 21187] [client 74.249.162.224:7094] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors"] [unique_id "afIPZ_w-HnaioFPIurVnewAAABI"]
[Wed Apr 29 22:02:16.628792 2026] [:error] [pid 21137:tid 21180] [client 74.249.162.224:6977] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/"] [unique_id "afIPaPw-HnaioFPIurVngQAAAAs"]
[Wed Apr 29 22:02:17.543804 2026] [:error] [pid 21138:tid 21211] [client 74.249.162.224:7150] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/"] [unique_id "afIPaZuzwUiyMeUnp333hAAAAQ4"]
[Wed Apr 29 22:02:17.967814 2026] [:error] [pid 21138:tid 21199] [client 74.249.162.224:7032] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/"] [unique_id "afIPaZuzwUiyMeUnp333hQAAAQI"]
[Wed Apr 29 22:02:19.470937 2026] [:error] [pid 21138:tid 21207] [client 74.249.162.224:7132] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/widgets/"] [unique_id "afIPa5uzwUiyMeUnp333jgAAAQo"]
[Wed Apr 29 22:02:20.928260 2026] [:error] [pid 21136:tid 21156] [client 74.249.162.224:6976] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/index.php"] [unique_id "afIPbClIfGGQdPVv8_Pu-wAAAE8"]
[Wed Apr 29 22:02:21.303404 2026] [:error] [pid 21138:tid 21218] [client 74.249.162.224:7154] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/index.php"] [unique_id "afIPbZuzwUiyMeUnp333kwAAARU"]
[Wed Apr 29 22:02:24.702467 2026] [:error] [pid 21137:tid 21187] [client 74.249.162.224:7134] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/index.php"] [unique_id "afIPcPw-HnaioFPIurVniAAAABI"]
[Wed Apr 29 22:02:25.095332 2026] [:error] [pid 21138:tid 21204] [client 74.249.162.224:7162] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/network/index.php"] [unique_id "afIPcZuzwUiyMeUnp333mgAAAQc"]
[Wed Apr 29 22:02:25.515535 2026] [:error] [pid 21137:tid 21184] [client 74.249.162.224:7157] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "afIPcfw-HnaioFPIurVniwAAAA8"]
[Wed Apr 29 22:02:25.924274 2026] [:error] [pid 21138:tid 21211] [client 74.249.162.224:6990] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "afIPcZuzwUiyMeUnp333mwAAAQ4"]
[Wed Apr 29 22:02:26.312732 2026] [:error] [pid 21137:tid 21185] [client 74.249.162.224:7130] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "afIPcvw-HnaioFPIurVnjAAAABA"]
[Wed Apr 29 22:02:26.702864 2026] [:error] [pid 21136:tid 21160] [client 74.249.162.224:7059] [client 74.249.162.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "afIPcilIfGGQdPVv8_PvAQAAAFM"]
[Wed Apr 29 22:02:27.131249 2026] [:error] [pid 47618:tid 47626] [client 74.249.162.224:7003] [client 74.249.162.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "afIPc3HYUSxIrhce2OAq_gAAAUU"]
[Wed Apr 29 22:02:27.634626 2026] [:error] [pid 21138:tid 21199] [client 74.249.162.224:7034] [client 74.249.162.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/crop/cropper.php"] [unique_id "afIPc5uzwUiyMeUnp333nAAAAQI"]
[Wed Apr 29 22:52:57.811823 2026] [:error] [pid 21137:tid 21190] [client 43.131.23.154:48248] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afIbSfw-HnaioFPIurVyHQAAABU"]
[Thu Apr 30 02:35:52.802663 2026] [:error] [pid 21137:tid 21186] [client 34.139.71.176:39322] [client 34.139.71.176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "afJPiPw-HnaioFPIurWj1AAAABE"]
[Thu Apr 30 07:58:40.751698 2026] [:error] [pid 18111:tid 18123] [client 49.234.192.248:46288] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afKbMGctLbxB7Q1_oK2PpAAAAAE"]
[Thu Apr 30 08:56:36.475181 2026] [:error] [pid 53641:tid 53650] [client 43.153.113.127:58986] [client 43.153.113.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afKoxGC119wja3QGeAF-UwAAAYA"]
[Thu Apr 30 10:55:10.687322 2026] [:error] [pid 18111:tid 18134] [client 88.151.32.215:62272] [client 88.151.32.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "afLEjmctLbxB7Q1_oK3LuQAAAAw"]
[Thu Apr 30 10:55:10.717978 2026] [:error] [pid 52350:tid 52379] [client 88.151.32.215:62340] [client 88.151.32.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backend/.env"] [unique_id "afLEjv1j4GHE9hm7bfdwbAAAARU"]
[Thu Apr 30 10:55:10.717978 2026] [:error] [pid 18220:tid 18231] [client 88.151.32.215:62330] [client 88.151.32.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "afLEjsyESVSfAPebmxYRFwAAAMg"]
[Thu Apr 30 10:55:10.718736 2026] [:error] [pid 52436:tid 52459] [client 88.151.32.215:62298] [client 88.151.32.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "afLEjgLFWPk_P7AfE8cNwQAAAVQ"]
[Thu Apr 30 10:55:10.719947 2026] [:error] [pid 18112:tid 18162] [client 88.151.32.215:62316] [client 88.151.32.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "afLEjiUrJv3y8j6Lm1vXIQAAAEw"]
[Thu Apr 30 10:55:10.720599 2026] [:error] [pid 52350:tid 52374] [client 88.151.32.215:62314] [client 88.151.32.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "afLEjv1j4GHE9hm7bfdwbgAAARA"]
[Thu Apr 30 17:24:46.469746 2026] [:error] [pid 39912:tid 39976] [client 49.51.243.156:45226] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afMf3q8-s8fTICYp_cuFpwAAAIU"]
[Thu Apr 30 17:46:44.814762 2026] [:error] [pid 46062:tid 46080] [client 43.134.5.186:52506] [client 43.134.5.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afMlBI67WLjbPQfxr6zcgwAAAQ8"]
[Thu Apr 30 19:39:29.497155 2026] [:error] [pid 5820:tid 5846] [client 1.12.70.96:33708] [client 1.12.70.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afM_cQyrLh3-LgH3Xv9CDAAAABg"]
[Thu Apr 30 22:02:17.130215 2026] [:error] [pid 5820:tid 5831] [client 80.241.213.248:61451] [client 80.241.213.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uploads/"] [unique_id "afNg6QyrLh3-LgH3Xv9eLAAAAAk"], referer: binance.com
[Thu Apr 30 22:02:22.486198 2026] [:error] [pid 5732:tid 5772] [client 80.241.213.248:61000] [client 80.241.213.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/images/"] [unique_id "afNg7tuJ3iSd5GdjqlhMKQAAAMk"], referer: binance.com
[Thu Apr 30 22:02:27.280705 2026] [:error] [pid 5732:tid 5764] [client 80.241.213.248:49370] [client 80.241.213.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/files/"] [unique_id "afNg89uJ3iSd5GdjqlhMLgAAAME"], referer: binance.com
[Thu Apr 30 22:11:33.686841 2026] [:error] [pid 5732:tid 5774] [client 43.135.182.95:37920] [client 43.135.182.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afNjFduJ3iSd5GdjqlhNVQAAAMs"]
[Fri May 01 03:31:47.807712 2026] [:error] [pid 5733:tid 5799] [client 43.153.104.196:46724] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afOuI_T55_Ioa9J2OpItvAAAAQk"]
[Fri May 01 03:56:07.424877 2026] [:error] [pid 11852:tid 11926] [client 104.28.214.115:65504] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "afOz1_UF_Rpk1NrBiNtl4gAAAJA"]
[Fri May 01 04:04:55.990393 2026] [:error] [pid 15239:tid 15242] [client 34.143.237.155:53676] [client 34.143.237.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "afO1579xlzHGmxyw6W66cQAAAQE"]
[Fri May 01 04:56:41.039637 2026] [:error] [pid 38014:tid 38039] [client 92.53.64.155:58715] [client 92.53.64.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "afPCCVHplhcdzdndjk39fgAAABA"]
[Fri May 01 06:46:08.336868 2026] [:error] [pid 6045:tid 6078] [client 43.134.186.61:34428] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afPbsD4a1vLt_qHgXBSsPQAAAVc"]
[Fri May 01 07:53:23.247147 2026] [:error] [pid 6045:tid 6074] [client 146.56.199.139:60308] [client 146.56.199.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afPrcz4a1vLt_qHgXBS75AAAAVM"]
[Fri May 01 09:17:12.775251 2026] [:error] [pid 38016:tid 38092] [client 43.166.255.102:44630] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afP_GJFc1DCPy0LM72YGYQAAAI4"]
[Fri May 01 17:26:29.413856 2026] [:error] [pid 24995:tid 25001] [client 43.165.198.144:55268] [client 43.165.198.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afRxxedJG9WB_Q_ne0uaEAAAAEI"]
[Fri May 01 17:32:42.246812 2026] [:error] [pid 25085:tid 25101] [client 35.247.58.95:49417] [client 35.247.58.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.247.58.95, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "afRzOvuD8fWRiE0RX0HjjQAAAUo"]
[Fri May 01 17:32:42.250587 2026] [:error] [pid 25085:tid 25101] [client 35.247.58.95:49417] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Fri May 01 17:32:44.134013 2026] [:error] [pid 25085:tid 25100] [client 35.247.58.95:49417] [client 35.247.58.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "afRzPPuD8fWRiE0RX0HjngAAAUk"]
[Fri May 01 17:32:44.471338 2026] [:error] [pid 24995:tid 25002] [client 35.247.58.95:62106] [client 35.247.58.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "afRzPOdJG9WB_Q_ne0ua1QAAAEM"]
[Fri May 01 17:32:44.801035 2026] [:error] [pid 24997:tid 25077] [client 35.247.58.95:60556] [client 35.247.58.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "afRzPPOkHa4ScY5oo8yoLwAAANU"]
[Fri May 01 17:32:45.132957 2026] [:error] [pid 24996:tid 25029] [client 35.247.58.95:63158] [client 35.247.58.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "afRzPSDBq9mMfUWQQeo9wgAAAIE"]
[Fri May 01 17:32:45.484208 2026] [:error] [pid 24997:tid 25075] [client 35.247.58.95:61189] [client 35.247.58.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "afRzPfOkHa4ScY5oo8yoMwAAANM"]
[Fri May 01 17:32:45.815015 2026] [:error] [pid 24997:tid 25069] [client 35.247.58.95:63120] [client 35.247.58.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "afRzPfOkHa4ScY5oo8yoNAAAAM0"]
[Fri May 01 17:32:46.149946 2026] [:error] [pid 24996:tid 25037] [client 35.247.58.95:64127] [client 35.247.58.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "afRzPiDBq9mMfUWQQeo9xgAAAIk"]
[Fri May 01 20:41:42.727637 2026] [:error] [pid 24996:tid 25051] [client 192.144.148.122:41872] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afSfhiDBq9mMfUWQQepjwgAAAJQ"]
[Fri May 01 22:08:28.158352 2026] [:error] [pid 50214:tid 50236] [client 43.130.12.43:51782] [client 43.130.12.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afSz3Is0pgrtfZkbhjNwqwAAAZI"]
[Fri May 01 23:25:48.165038 2026] [:error] [pid 25320:tid 25337] [client 35.221.228.217:59270] [client 35.221.228.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "afTF_Fc3wJ-3-XaXB3oreQAAAQ4"]
[Sat May 02 06:49:32.044847 2026] [:error] [pid 53540:tid 53545] [client 43.165.127.205:54981] [client 43.165.127.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.127.205, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "afUt_NQYV6qJFftBNym28wAAAMM"]
[Sat May 02 06:49:32.050937 2026] [:error] [pid 53540:tid 53545] [client 43.165.127.205:54981] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat May 02 06:49:32.259402 2026] [:error] [pid 53540:tid 53555] [client 43.165.127.205:54981] [client 43.165.127.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.165.127.205, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "afUt_NQYV6qJFftBNym29AAAAM0"]
[Sat May 02 06:49:32.262947 2026] [:error] [pid 53540:tid 53555] [client 43.165.127.205:54981] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat May 02 08:48:20.545765 2026] [:error] [pid 53434:tid 53454] [client 43.161.217.205:43586] [client 43.161.217.205] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afVJ1O9BXmRQcbfsxlz82QAAAAs"]
[Sat May 02 12:40:32.238021 2026] [:error] [pid 51917:tid 51922] [client 49.51.233.46:56882] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afWAQK7wZviJ7BgcCi8OqQAAAcM"]
[Sat May 02 14:49:15.829511 2026] [:error] [pid 51917:tid 51938] [client 95.154.200.60:36418] [client 95.154.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "afWea67wZviJ7BgcCi8gZAAAAdM"]
[Sat May 02 14:49:16.786171 2026] [:error] [pid 52010:tid 52045] [client 95.154.200.60:36434] [client 95.154.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/sales.js"] [unique_id "afWebAiR6wohDtdeJMC7zwAAAsI"]
[Sat May 02 14:49:17.741890 2026] [:error] [pid 52010:tid 52059] [client 95.154.200.60:36436] [client 95.154.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/adminhtml/tools.js"] [unique_id "afWebQiR6wohDtdeJMC70gAAAtA"]
[Sat May 02 14:49:18.700336 2026] [:error] [pid 53435:tid 53475] [client 95.154.200.60:36440] [client 95.154.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/mage/translate_inline.js"] [unique_id "afWeboDmp7_z8QkjSzOEeAAAAEM"]
[Sat May 02 14:49:19.661079 2026] [:error] [pid 53435:tid 53485] [client 95.154.200.60:36446] [client 95.154.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/skin/adminhtml/default/default/boxes.css"] [unique_id "afWeb4Dmp7_z8QkjSzOEeQAAAE0"]
[Sat May 02 14:49:20.627432 2026] [:error] [pid 52010:tid 52047] [client 95.154.200.60:36460] [client 95.154.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/prototype/validation.js"] [unique_id "afWecAiR6wohDtdeJMC72QAAAsQ"]
[Sat May 02 14:49:21.581296 2026] [:error] [pid 51917:tid 51933] [client 95.154.200.60:36470] [client 95.154.200.60] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/RELEASE_NOTES.txt"] [unique_id "afWeca7wZviJ7BgcCi8gbQAAAc4"]
[Sat May 02 18:14:08.772749 2026] [:error] [pid 51917:tid 51933] [client 124.156.225.181:40108] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afXOcK7wZviJ7BgcCi8-ZQAAAc4"]
[Sat May 02 23:01:29.898063 2026] [:error] [pid 51950:tid 51994] [client 43.164.194.198:46788] [client 43.164.194.198] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afYRyYoBJzYZ3RKUhdhuugAAAk4"]
[Sun May 03 01:12:53.764775 2026] [:error] [pid 53435:tid 53487] [client 119.28.140.106:46558] [client 119.28.140.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afYwlYDmp7_z8QkjSzMPGgAAAE8"]
[Sun May 03 01:44:05.788052 2026] [:error] [pid 52012:tid 52080] [client 172.202.47.245:26611] File does not exist: /usr/local/apache/htdocs/suspended-page/file18.php
[Sun May 03 01:44:05.979740 2026] [:error] [pid 52012:tid 52083] [client 172.202.47.245:26611] File does not exist: /usr/local/apache/htdocs/suspended-page/bdroot.php
[Sun May 03 01:44:06.239645 2026] [:error] [pid 52012:tid 52086] [client 172.202.47.245:26611] File does not exist: /usr/local/apache/htdocs/suspended-page/olik.php
[Sun May 03 01:44:06.453964 2026] [:error] [pid 52012:tid 52094] [client 172.202.47.245:26611] File does not exist: /usr/local/apache/htdocs/suspended-page/h.php
[Sun May 03 01:44:06.740700 2026] [:error] [pid 52012:tid 52078] [client 172.202.47.245:26611] File does not exist: /usr/local/apache/htdocs/suspended-page/cong.php
[Sun May 03 01:44:07.246369 2026] [:error] [pid 52012:tid 52102] [client 172.202.47.245:26611] [client 172.202.47.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "afY350zSWr-8cpS83mgfGAAAA1g"]
[Sun May 03 01:44:09.184231 2026] [:error] [pid 52012:tid 52083] [client 172.202.47.245:26600] File does not exist: /usr/local/apache/htdocs/suspended-page/atika.php
[Sun May 03 01:44:09.379857 2026] [:error] [pid 52012:tid 52086] [client 172.202.47.245:26600] File does not exist: /usr/local/apache/htdocs/suspended-page/xxl.php
[Sun May 03 01:44:09.571633 2026] [:error] [pid 52012:tid 52094] [client 172.202.47.245:26600] File does not exist: /usr/local/apache/htdocs/suspended-page/uploat.php
[Sun May 03 01:44:09.762820 2026] [:error] [pid 52012:tid 52084] [client 172.202.47.245:26600] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxml.php
[Sun May 03 01:44:09.952150 2026] [:error] [pid 52012:tid 52091] [client 172.202.47.245:26600] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afY36UzSWr-8cpS83mgfIgAAA04"]
[Sun May 03 01:44:12.022360 2026] [:error] [pid 52010:tid 52047] [client 172.202.47.245:26560] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afY37AiR6wohDtdeJMBpRgAAAsQ"]
[Sun May 03 01:44:12.906634 2026] [:error] [pid 53435:tid 53472] [client 172.202.47.245:26563] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afY37IDmp7_z8QkjSzMXBAAAAEA"]
[Sun May 03 01:44:14.617469 2026] [:error] [pid 53434:tid 53459] [client 172.202.47.245:26604] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afY37u9BXmRQcbfsxly40gAAABA"]
[Sun May 03 01:44:16.031760 2026] [:error] [pid 11894:tid 11905] [client 172.202.47.245:26572] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afY38DHh6DQF1tkXIKz7XgAAAUg"]
[Sun May 03 01:44:17.899727 2026] [:error] [pid 53435:tid 53492] [client 172.202.47.245:26498] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afY38YDmp7_z8QkjSzMXFAAAAFQ"]
[Sun May 03 01:44:18.949676 2026] [:error] [pid 52010:tid 52049] [client 172.202.47.245:26605] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afY38giR6wohDtdeJMBpSAAAAsY"]
[Sun May 03 01:44:19.729191 2026] [:error] [pid 52010:tid 52048] [client 172.202.47.245:26566] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afY38wiR6wohDtdeJMBpSQAAAsU"]
[Sun May 03 01:44:20.841891 2026] [:error] [pid 51950:tid 51985] [client 172.202.47.245:26511] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afY39IoBJzYZ3RKUhdiMbQAAAkU"]
[Sun May 03 01:44:21.867675 2026] [:error] [pid 52012:tid 52089] [client 172.202.47.245:26586] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afY39UzSWr-8cpS83mgfSQAAA0w"]
[Sun May 03 01:44:23.390104 2026] [:error] [pid 51950:tid 51997] [client 172.202.47.245:26614] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afY394oBJzYZ3RKUhdiMbgAAAlE"]
[Sun May 03 01:44:24.988334 2026] [:error] [pid 52010:tid 52061] [client 172.202.47.245:26579] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afY3-AiR6wohDtdeJMBpTwAAAtI"]
[Sun May 03 01:44:26.566491 2026] [:error] [pid 52012:tid 52087] [client 172.202.47.245:26578] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afY3-kzSWr-8cpS83mgfYgAAA0o"]
[Sun May 03 01:44:27.528588 2026] [:error] [pid 52012:tid 52075] [client 172.202.47.245:26602] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afY3-0zSWr-8cpS83mgfZQAAA0A"]
[Sun May 03 01:44:30.414434 2026] [:error] [pid 52124:tid 52151] [client 172.202.47.245:26582] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afY3_jjabaZ9NMm8eQuerQAAA5Y"]
[Sun May 03 01:44:32.661134 2026] [:error] [pid 52010:tid 52046] [client 172.202.47.245:26525] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afY4AAiR6wohDtdeJMBpUwAAAsM"]
[Sun May 03 01:44:35.316943 2026] [:error] [pid 53435:tid 53495] [client 172.202.47.245:26575] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afY4A4Dmp7_z8QkjSzMXTAAAAFc"]
[Sun May 03 01:44:37.799893 2026] [:error] [pid 52012:tid 52080] [client 172.202.47.245:26607] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afY4BUzSWr-8cpS83mgfkQAAA0M"]
[Sun May 03 01:44:39.043308 2026] [:error] [pid 22846:tid 22867] [client 172.202.47.245:26623] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afY4B4m1Ms03Mfhp3aYVXAAAARM"]
[Sun May 03 01:44:41.871421 2026] [:error] [pid 51950:tid 51994] [client 172.202.47.245:26515] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afY4CYoBJzYZ3RKUhdiMggAAAk4"]
[Sun May 03 01:44:42.868090 2026] [:error] [pid 52010:tid 52059] [client 172.202.47.245:26512] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afY4CgiR6wohDtdeJMBpZAAAAtA"]
[Sun May 03 01:44:49.302523 2026] [:error] [pid 53435:tid 53493] [client 172.202.47.245:26622] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afY4EYDmp7_z8QkjSzMXcQAAAFU"]
[Sun May 03 01:44:52.152919 2026] [:error] [pid 52012:tid 52087] [client 172.202.47.245:26567] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afY4FEzSWr-8cpS83mgf2gAAA0o"]
[Sun May 03 01:44:53.712889 2026] [:error] [pid 52010:tid 52044] [client 172.202.47.245:26618] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afY4FQiR6wohDtdeJMBpeAAAAsE"]
[Sun May 03 01:44:56.084577 2026] [:error] [pid 53434:tid 53457] [client 172.202.47.245:26499] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afY4GO9BXmRQcbfsxly46wAAAA4"]
[Sun May 03 01:45:05.004936 2026] [:error] [pid 53435:tid 53496] [client 172.202.47.245:26620] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afY4IYDmp7_z8QkjSzMXpQAAAFg"]
[Sun May 03 01:45:05.800258 2026] [:error] [pid 53434:tid 53461] [client 172.202.47.245:26507] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afY4Ie9BXmRQcbfsxly47gAAABI"]
[Sun May 03 01:45:07.104288 2026] [:error] [pid 53435:tid 53480] [client 172.202.47.245:26433] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afY4I4Dmp7_z8QkjSzMXtAAAAEg"]
[Sun May 03 01:45:08.258996 2026] [:error] [pid 52124:tid 52129] [client 172.202.47.245:26574] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afY4JDjabaZ9NMm8eQuetAAAA4A"]
[Sun May 03 01:45:11.938358 2026] [:error] [pid 53435:tid 53475] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/uwu.php
[Sun May 03 01:45:12.153592 2026] [:error] [pid 53435:tid 53495] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/uwa.php
[Sun May 03 01:45:12.497715 2026] [:error] [pid 53435:tid 53476] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/crgio.php
[Sun May 03 01:45:12.690581 2026] [:error] [pid 53435:tid 53481] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/geforce.php
[Sun May 03 01:45:12.879733 2026] [:error] [pid 53435:tid 53494] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Sun May 03 01:45:13.068160 2026] [:error] [pid 53435:tid 53489] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Sun May 03 01:45:13.257457 2026] [:error] [pid 53435:tid 53487] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/.sghb.php
[Sun May 03 01:45:13.448035 2026] [:error] [pid 53435:tid 53483] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/zoko.php
[Sun May 03 01:45:13.854157 2026] [:error] [pid 53435:tid 53492] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/solo1.php
[Sun May 03 01:45:14.047637 2026] [:error] [pid 53435:tid 53480] [client 172.202.47.245:26559] File does not exist: /usr/local/apache/htdocs/suspended-page/locales.php
[Sun May 03 01:45:14.250193 2026] [:error] [pid 53435:tid 53486] [client 172.202.47.245:26559] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afY4KoDmp7_z8QkjSzMX0AAAAE4"]
[Sun May 03 01:45:16.560970 2026] [:error] [pid 51917:tid 51936] [client 172.202.47.245:26565] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afY4LK7wZviJ7BgcCi917AAAAdE"]
[Sun May 03 01:45:17.674012 2026] [:error] [pid 51917:tid 51920] [client 172.202.47.245:26502] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afY4La7wZviJ7BgcCi917QAAAcE"]
[Sun May 03 01:45:19.350402 2026] [:error] [pid 52010:tid 52066] [client 172.202.47.245:26588] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afY4LwiR6wohDtdeJMBprAAAAtc"]
[Sun May 03 01:45:20.020457 2026] [:error] [pid 53435:tid 53477] [client 172.202.47.245:26592] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "afY4MIDmp7_z8QkjSzMX3gAAAEU"]
[Sun May 03 01:45:21.132374 2026] [:error] [pid 53434:tid 53446] [client 172.202.47.245:26540] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "afY4Me9BXmRQcbfsxly4_AAAAAM"]
[Sun May 03 01:45:22.053024 2026] [:error] [pid 53436:tid 53509] [client 172.202.47.245:26500] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "afY4Mq9N0xp8fccVM0DuwgAAAIo"]
[Sun May 03 01:45:23.332653 2026] [:error] [pid 53435:tid 53472] [client 172.202.47.245:26593] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "afY4M4Dmp7_z8QkjSzMX4AAAAEA"]
[Sun May 03 01:45:24.776510 2026] [:error] [pid 52010:tid 52062] [client 172.202.47.245:26523] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "afY4NAiR6wohDtdeJMBptgAAAtM"]
[Sun May 03 01:45:26.230681 2026] [:error] [pid 52012:tid 52080] [client 172.202.47.245:26549] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "afY4NkzSWr-8cpS83mggBgAAA0M"]
[Sun May 03 01:45:27.824472 2026] [:error] [pid 52010:tid 52067] [client 172.202.47.245:26596] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "afY4NwiR6wohDtdeJMBpvQAAAtg"]
[Sun May 03 01:45:28.721083 2026] [:error] [pid 52012:tid 52089] [client 172.202.47.245:26545] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "afY4OEzSWr-8cpS83mggCgAAA0w"]
[Sun May 03 01:45:29.821466 2026] [:error] [pid 52012:tid 52092] [client 172.202.47.245:26561] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "afY4OUzSWr-8cpS83mggDgAAA08"]
[Sun May 03 01:45:31.329739 2026] [:error] [pid 52012:tid 52084] [client 172.202.47.245:26447] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "afY4O0zSWr-8cpS83mggFAAAA0c"]
[Sun May 03 01:45:32.192280 2026] [:error] [pid 51950:tid 51980] [client 172.202.47.245:26589] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "afY4PIoBJzYZ3RKUhdiMngAAAkA"]
[Sun May 03 01:45:33.893287 2026] [:error] [pid 11894:tid 11914] [client 172.202.47.245:26453] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.dj/index.php"] [unique_id "afY4PTHh6DQF1tkXIKz7dQAAAVE"]
[Sun May 03 01:45:34.974678 2026] [:error] [pid 51917:tid 51926] [client 172.202.47.245:26583] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "afY4Pq7wZviJ7BgcCi92CAAAAcc"]
[Sun May 03 01:45:36.182122 2026] [:error] [pid 52010:tid 52055] [client 172.202.47.245:26599] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "afY4QAiR6wohDtdeJMBpxgAAAsw"]
[Sun May 03 01:45:36.862334 2026] [:error] [pid 52010:tid 52046] [client 172.202.47.245:26580] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "afY4QAiR6wohDtdeJMBpyQAAAsM"]
[Sun May 03 01:45:38.526377 2026] [:error] [pid 51950:tid 51991] [client 172.202.47.245:26598] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "afY4QooBJzYZ3RKUhdiMpQAAAks"]
[Sun May 03 01:45:39.431898 2026] [:error] [pid 51917:tid 51919] [client 172.202.47.245:26616] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "afY4Q67wZviJ7BgcCi92CgAAAcA"]
[Sun May 03 01:45:41.926214 2026] [:error] [pid 11894:tid 11912] [client 172.202.47.245:26456] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "afY4RTHh6DQF1tkXIKz7fgAAAU8"]
[Sun May 03 01:45:45.005020 2026] [:error] [pid 22846:tid 22851] [client 172.202.47.245:26536] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "afY4SYm1Ms03Mfhp3aYVdAAAAQM"]
[Sun May 03 01:45:46.021805 2026] [:error] [pid 51950:tid 51987] [client 172.202.47.245:26530] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.tmb/"] [unique_id "afY4SooBJzYZ3RKUhdiMrgAAAkc"]
[Sun May 03 01:45:48.466081 2026] [:error] [pid 53434:tid 53461] [client 172.202.47.245:26505] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "afY4TO9BXmRQcbfsxly5BgAAABI"]
[Sun May 03 01:45:49.386637 2026] [:error] [pid 53436:tid 53510] [client 172.202.47.245:26516] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "afY4Ta9N0xp8fccVM0DuyQAAAIs"]
[Sun May 03 01:45:53.202748 2026] [:error] [pid 51950:tid 52002] [client 172.202.47.245:26619] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "afY4UYoBJzYZ3RKUhdiMtwAAAlY"]
[Sun May 03 01:45:54.881519 2026] [:error] [pid 11894:tid 11904] [client 172.202.47.245:26591] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "afY4UjHh6DQF1tkXIKz7gwAAAUc"]
[Sun May 03 01:45:56.733109 2026] [:error] [pid 52012:tid 52091] [client 172.202.47.245:26544] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no20.php"] [unique_id "afY4VEzSWr-8cpS83mggJgAAA04"]
[Sun May 03 01:45:58.286667 2026] [:error] [pid 51950:tid 51991] [client 172.202.47.245:26584] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no20.php"] [unique_id "afY4VooBJzYZ3RKUhdiMwgAAAks"]
[Sun May 03 01:45:59.290132 2026] [:error] [pid 22846:tid 22872] [client 172.202.47.245:26537] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no20.php"] [unique_id "afY4V4m1Ms03Mfhp3aYVegAAARg"]
[Sun May 03 01:46:00.523976 2026] [:error] [pid 53436:tid 53520] [client 172.202.47.245:26551] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no20.php"] [unique_id "afY4WK9N0xp8fccVM0DuzQAAAJU"]
[Sun May 03 01:46:03.000873 2026] [:error] [pid 52010:tid 52052] [client 172.202.47.245:26386] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yasnu.php"] [unique_id "afY4WgiR6wohDtdeJMBp4QAAAsk"]
[Sun May 03 01:46:03.791556 2026] [:error] [pid 52124:tid 52135] [client 172.202.47.245:26585] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yasnu.php"] [unique_id "afY4WzjabaZ9NMm8eQueyAAAA4Y"]
[Sun May 03 01:46:04.748278 2026] [:error] [pid 22846:tid 22850] [client 172.202.47.245:26509] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yasnu.php"] [unique_id "afY4XIm1Ms03Mfhp3aYVfgAAAQI"]
[Sun May 03 01:46:06.607486 2026] [:error] [pid 11894:tid 11905] [client 172.202.47.245:26503] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yasnu.php"] [unique_id "afY4XjHh6DQF1tkXIKz7iwAAAUg"]
[Sun May 03 01:46:12.820615 2026] [:error] [pid 51950:tid 51990] [client 172.202.47.245:26501] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sl.php"] [unique_id "afY4ZIoBJzYZ3RKUhdiM3QAAAko"]
[Sun May 03 01:46:14.594254 2026] [:error] [pid 53436:tid 53522] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/sl.php
[Sun May 03 01:46:14.870743 2026] [:error] [pid 53436:tid 53512] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/vuln.php
[Sun May 03 01:46:15.064706 2026] [:error] [pid 53436:tid 53511] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-temp.php
[Sun May 03 01:46:15.835142 2026] [:error] [pid 53436:tid 53506] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/class-bda.php
[Sun May 03 01:46:16.214978 2026] [:error] [pid 53436:tid 53503] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/bhm.php
[Sun May 03 01:46:16.406764 2026] [:error] [pid 53436:tid 53508] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/xmu.php
[Sun May 03 01:46:16.858844 2026] [:error] [pid 53436:tid 53516] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/goat.php
[Sun May 03 01:46:17.057918 2026] [:error] [pid 53436:tid 53505] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-xme.php
[Sun May 03 01:46:17.274675 2026] [:error] [pid 53436:tid 53519] [client 172.202.47.245:26570] File does not exist: /usr/local/apache/htdocs/suspended-page/adminer.php
[Sun May 03 01:46:17.614925 2026] [:error] [pid 53436:tid 53517] [client 172.202.47.245:26570] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afY4aa9N0xp8fccVM0Du5AAAAJI"]
[Sun May 03 01:46:19.747412 2026] [:error] [pid 53434:tid 53462] [client 172.202.47.245:26518] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afY4a-9BXmRQcbfsxly5FwAAABM"]
[Sun May 03 01:46:28.083130 2026] [:error] [pid 53435:tid 53490] [client 172.202.47.245:26445] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afY4dIDmp7_z8QkjSzMYEQAAAFI"]
[Sun May 03 01:46:28.921991 2026] [:error] [pid 52010:tid 52052] [client 172.202.47.245:26612] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afY4dAiR6wohDtdeJMBqCwAAAsk"]
[Sun May 03 01:46:29.893488 2026] [:error] [pid 53435:tid 53492] [client 172.202.47.245:26577] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afY4dYDmp7_z8QkjSzMYGAAAAFQ"]
[Sun May 03 01:46:31.486057 2026] [:error] [pid 53435:tid 53493] [client 172.202.47.245:26590] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afY4d4Dmp7_z8QkjSzMYHQAAAFU"]
[Sun May 03 01:46:32.888181 2026] [:error] [pid 53436:tid 53518] [client 172.202.47.245:26606] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afY4eK9N0xp8fccVM0Du5wAAAJM"]
[Sun May 03 01:46:34.423909 2026] [:error] [pid 53435:tid 53491] [client 172.202.47.245:26617] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afY4eoDmp7_z8QkjSzMYMwAAAFM"]
[Sun May 03 01:46:36.779030 2026] [:error] [pid 53435:tid 53472] [client 172.202.47.245:26597] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afY4fIDmp7_z8QkjSzMYRAAAAEA"]
[Sun May 03 01:46:45.213707 2026] [:error] [pid 51917:tid 51932] [client 172.202.47.245:26506] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afY4ha7wZviJ7BgcCi92LwAAAc0"]
[Sun May 03 01:46:46.376527 2026] [:error] [pid 53435:tid 53488] [client 172.202.47.245:26444] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afY4hoDmp7_z8QkjSzMYWwAAAFA"]
[Sun May 03 01:46:47.182947 2026] [:error] [pid 51917:tid 51939] [client 172.202.47.245:26587] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afY4h67wZviJ7BgcCi92QQAAAdQ"]
[Sun May 03 01:46:48.117959 2026] [:error] [pid 53435:tid 53474] [client 172.202.47.245:26481] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afY4iIDmp7_z8QkjSzMYYAAAAEI"]
[Sun May 03 01:46:49.205575 2026] [:error] [pid 52012:tid 52078] [client 172.202.47.245:26471] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afY4iUzSWr-8cpS83mggQQAAA0E"]
[Sun May 03 01:46:50.096688 2026] [:error] [pid 52012:tid 52098] [client 172.202.47.245:26514] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afY4ikzSWr-8cpS83mggSgAAA1U"]
[Sun May 03 01:46:55.004326 2026] [:error] [pid 52010:tid 52048] [client 172.202.47.245:26531] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afY4jwiR6wohDtdeJMBqUQAAAsU"]
[Sun May 03 01:46:56.543300 2026] [:error] [pid 52124:tid 52136] [client 172.202.47.245:26460] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afY4kDjabaZ9NMm8eQue8gAAA4c"]
[Sun May 03 01:46:58.654671 2026] [:error] [pid 52010:tid 52064] [client 172.202.47.245:26477] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afY4kgiR6wohDtdeJMBqVwAAAtU"]
[Sun May 03 01:47:04.099277 2026] [:error] [pid 22846:tid 22858] [client 172.202.47.245:26508] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afY4mIm1Ms03Mfhp3aYVjwAAAQo"]
[Sun May 03 01:47:06.768431 2026] [:error] [pid 52010:tid 52050] [client 172.202.47.245:26541] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afY4mgiR6wohDtdeJMBqaQAAAsc"]
[Sun May 03 01:47:08.925128 2026] [:error] [pid 52012:tid 52086] [client 172.202.47.245:26485] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afY4nEzSWr-8cpS83mggcAAAA0k"]
[Sun May 03 01:47:09.855491 2026] [:error] [pid 51917:tid 51929] [client 172.202.47.245:26491] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afY4na7wZviJ7BgcCi92UwAAAco"]
[Sun May 03 01:47:11.220070 2026] [:error] [pid 52010:tid 52062] [client 172.202.47.245:26535] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afY4nwiR6wohDtdeJMBqbQAAAtM"]
[Sun May 03 01:47:12.493744 2026] [:error] [pid 51917:tid 51940] [client 172.202.47.245:26490] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afY4oK7wZviJ7BgcCi92VgAAAdU"]
[Sun May 03 01:47:16.521223 2026] [:error] [pid 53435:tid 53488] [client 172.202.47.245:26438] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "afY4pIDmp7_z8QkjSzMYhQAAAFA"]
[Sun May 03 01:47:18.427317 2026] [:error] [pid 52010:tid 52063] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/huya.php
[Sun May 03 01:47:18.621386 2026] [:error] [pid 52010:tid 52047] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/puc.php
[Sun May 03 01:47:18.993301 2026] [:error] [pid 52010:tid 52045] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sun May 03 01:47:19.184624 2026] [:error] [pid 52010:tid 52066] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/ewp.php
[Sun May 03 01:47:19.380145 2026] [:error] [pid 52010:tid 52050] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Sun May 03 01:47:19.575183 2026] [:error] [pid 52010:tid 52052] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Sun May 03 01:47:19.769214 2026] [:error] [pid 52010:tid 52064] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/lupo.php
[Sun May 03 01:47:19.966348 2026] [:error] [pid 52010:tid 52065] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/awa.php
[Sun May 03 01:47:20.491811 2026] [:error] [pid 52010:tid 52048] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/popo.php
[Sun May 03 01:47:20.688410 2026] [:error] [pid 52010:tid 52046] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/13.php
[Sun May 03 01:47:20.880063 2026] [:error] [pid 52010:tid 52047] [client 172.202.47.245:26562] File does not exist: /usr/local/apache/htdocs/suspended-page/tews.php
[Sun May 03 01:47:21.084917 2026] [:error] [pid 52010:tid 52060] [client 172.202.47.245:26562] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afY4qQiR6wohDtdeJMBqlQAAAtE"]
[Sun May 03 01:47:22.593140 2026] [:error] [pid 51950:tid 51990] [client 172.202.47.245:26532] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afY4qooBJzYZ3RKUhdiNLwAAAko"]
[Sun May 03 01:47:24.633309 2026] [:error] [pid 51950:tid 51986] [client 172.202.47.245:26461] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afY4rIoBJzYZ3RKUhdiNMQAAAkY"]
[Sun May 03 01:47:26.368296 2026] [:error] [pid 53436:tid 53500] [client 172.202.47.245:26395] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afY4rq9N0xp8fccVM0DvBQAAAIE"]
[Sun May 03 01:47:27.683504 2026] [:error] [pid 53435:tid 53488] [client 172.202.47.245:26613] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeaq.php"] [unique_id "afY4r4Dmp7_z8QkjSzMYlgAAAFA"]
[Sun May 03 01:47:28.613158 2026] [:error] [pid 53435:tid 53496] [client 172.202.47.245:26552] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeaq.php"] [unique_id "afY4sIDmp7_z8QkjSzMYnAAAAFg"]
[Sun May 03 01:47:30.401304 2026] [:error] [pid 52012:tid 52078] [client 172.202.47.245:26576] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeaq.php"] [unique_id "afY4skzSWr-8cpS83mggmAAAA0E"]
[Sun May 03 01:47:34.900565 2026] [:error] [pid 52010:tid 52047] [client 172.202.47.245:26522] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xeaq.php"] [unique_id "afY4tgiR6wohDtdeJMBqqgAAAsQ"]
[Sun May 03 01:47:36.050560 2026] [:error] [pid 52010:tid 52050] [client 172.202.47.245:26502] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up2.php"] [unique_id "afY4uAiR6wohDtdeJMBqsgAAAsc"]
[Sun May 03 01:47:38.265067 2026] [:error] [pid 52010:tid 52067] [client 172.202.47.245:26538] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up2.php"] [unique_id "afY4ugiR6wohDtdeJMBqxgAAAtg"]
[Sun May 03 01:47:39.754354 2026] [:error] [pid 52010:tid 52055] [client 172.202.47.245:26571] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up2.php"] [unique_id "afY4uwiR6wohDtdeJMBqzgAAAsw"]
[Sun May 03 01:47:42.609171 2026] [:error] [pid 51950:tid 51992] [client 172.202.47.245:26520] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/up2.php"] [unique_id "afY4vooBJzYZ3RKUhdiNQwAAAkw"]
[Sun May 03 01:47:45.084303 2026] [:error] [pid 52010:tid 52066] [client 172.202.47.245:26543] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afY4wQiR6wohDtdeJMBq1QAAAtc"]
[Sun May 03 01:47:47.501884 2026] [:error] [pid 53436:tid 53506] [client 172.202.47.245:26621] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afY4w69N0xp8fccVM0DvEQAAAIc"]
[Sun May 03 01:47:48.761063 2026] [:error] [pid 52012:tid 52084] [client 172.202.47.245:26496] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afY4xEzSWr-8cpS83mggwwAAA0c"]
[Sun May 03 01:47:49.566861 2026] [:error] [pid 51917:tid 51933] [client 172.202.47.245:26432] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afY4xa7wZviJ7BgcCi92YQAAAc4"]
[Sun May 03 01:47:50.490672 2026] [:error] [pid 51917:tid 51927] [client 172.202.47.245:26513] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afY4xq7wZviJ7BgcCi92ZQAAAcg"]
[Sun May 03 01:47:51.902791 2026] [:error] [pid 52124:tid 52134] [client 172.202.47.245:26517] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afY4xzjabaZ9NMm8eQufCgAAA4U"]
[Sun May 03 01:47:53.796741 2026] [:error] [pid 53436:tid 53512] [client 172.202.47.245:26488] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afY4ya9N0xp8fccVM0DvHAAAAI0"]
[Sun May 03 01:47:56.018883 2026] [:error] [pid 22846:tid 22862] [client 172.202.47.245:26533] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afY4zIm1Ms03Mfhp3aYVnAAAAQ4"]
[Sun May 03 01:48:00.419956 2026] [:error] [pid 53434:tid 53446] [client 172.202.47.245:26556] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afY40O9BXmRQcbfsxly5SQAAAAM"]
[Sun May 03 01:48:02.903698 2026] [:error] [pid 52012:tid 52083] [client 172.202.47.245:26546] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afY40kzSWr-8cpS83mgg0AAAA0Y"]
[Sun May 03 01:48:04.228275 2026] [:error] [pid 52010:tid 52051] [client 172.202.47.245:26603] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afY41AiR6wohDtdeJMBq7gAAAsg"]
[Sun May 03 01:48:06.399549 2026] [:error] [pid 51950:tid 52004] [client 172.202.47.245:26569] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afY41ooBJzYZ3RKUhdiNgAAAAlg"]
[Sun May 03 01:48:07.679636 2026] [:error] [pid 52012:tid 52096] [client 172.202.47.245:26465] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afY410zSWr-8cpS83mgg2gAAA1M"]
[Sun May 03 01:48:08.964396 2026] [:error] [pid 52010:tid 52057] [client 172.202.47.245:26494] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afY42AiR6wohDtdeJMBq-AAAAs4"]
[Sun May 03 01:48:10.683427 2026] [:error] [pid 22846:tid 22849] [client 172.202.47.245:26550] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afY42om1Ms03Mfhp3aYVrgAAAQE"]
[Sun May 03 01:48:12.863228 2026] [:error] [pid 52012:tid 52080] [client 172.202.47.245:26564] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afY43EzSWr-8cpS83mgg3gAAA0M"]
[Sun May 03 01:48:13.543475 2026] [:error] [pid 52012:tid 52091] [client 172.202.47.245:26527] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afY43UzSWr-8cpS83mgg4wAAA04"]
[Sun May 03 01:48:15.447644 2026] [:error] [pid 52010:tid 52057] [client 172.202.47.245:26470] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afY43wiR6wohDtdeJMBrBgAAAs4"]
[Sun May 03 01:48:16.253042 2026] [:error] [pid 51950:tid 51991] [client 172.202.47.245:26437] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afY44IoBJzYZ3RKUhdiNkwAAAks"]
[Sun May 03 01:48:17.151858 2026] [:error] [pid 53435:tid 53482] [client 172.202.47.245:26436] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afY44YDmp7_z8QkjSzMY1gAAAEo"]
[Sun May 03 01:48:19.638309 2026] [:error] [pid 51950:tid 52003] [client 172.202.47.245:26558] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "afY444oBJzYZ3RKUhdiNpgAAAlc"]
[Sun May 03 01:48:22.312852 2026] [:error] [pid 53436:tid 53503] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/seo.php
[Sun May 03 01:48:22.502164 2026] [:error] [pid 53436:tid 53523] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sun May 03 01:48:22.693702 2026] [:error] [pid 53436:tid 53507] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Sun May 03 01:48:22.882146 2026] [:error] [pid 53436:tid 53516] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sun May 03 01:48:23.076136 2026] [:error] [pid 53436:tid 53519] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Sun May 03 01:48:23.267592 2026] [:error] [pid 53436:tid 53504] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Sun May 03 01:48:23.459117 2026] [:error] [pid 53436:tid 53505] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Sun May 03 01:48:23.649513 2026] [:error] [pid 53436:tid 53499] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Sun May 03 01:48:23.837722 2026] [:error] [pid 53436:tid 53515] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Sun May 03 01:48:24.761793 2026] [:error] [pid 53436:tid 53514] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/cjfuns.php
[Sun May 03 01:48:24.960967 2026] [:error] [pid 53436:tid 53517] [client 172.202.47.245:26380] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Sun May 03 01:48:25.150051 2026] [:error] [pid 53436:tid 53513] [client 172.202.47.245:26380] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afY46a9N0xp8fccVM0DvOQAAAI4"]
[Sun May 03 01:48:26.231176 2026] [:error] [pid 52012:tid 52086] [client 172.202.47.245:26388] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afY46kzSWr-8cpS83mgg-AAAA0k"]
[Sun May 03 01:48:27.912779 2026] [:error] [pid 52012:tid 52091] [client 172.202.47.245:26382] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afY460zSWr-8cpS83mghAAAAA04"]
[Sun May 03 01:48:28.734885 2026] [:error] [pid 52012:tid 52085] [client 172.202.47.245:26497] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afY47EzSWr-8cpS83mghAwAAA0g"]
[Sun May 03 01:48:29.713440 2026] [:error] [pid 53436:tid 53512] [client 172.202.47.245:26573] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "afY47a9N0xp8fccVM0DvOwAAAI0"]
[Sun May 03 01:48:31.360028 2026] [:error] [pid 11894:tid 11920] [client 172.202.47.245:26452] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "afY47zHh6DQF1tkXIKz7vwAAAVc"]
[Sun May 03 01:48:33.831200 2026] [:error] [pid 11894:tid 11901] [client 172.202.47.245:26314] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "afY48THh6DQF1tkXIKz7wQAAAUQ"]
[Sun May 03 01:48:34.871568 2026] [:error] [pid 53436:tid 53511] [client 172.202.47.245:26504] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "afY48q9N0xp8fccVM0DvPgAAAIw"]
[Sun May 03 01:48:35.389437 2026] [:error] [pid 52012:tid 52081] [client 172.202.47.245:26440] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "afY480zSWr-8cpS83mghDAAAA0Q"]
[Sun May 03 01:48:37.497299 2026] [:error] [pid 52124:tid 52139] [client 172.202.47.245:26608] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "afY49TjabaZ9NMm8eQufPAAAA4o"]
[Sun May 03 01:48:38.271293 2026] [:error] [pid 22846:tid 22856] [client 172.202.47.245:26457] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "afY49om1Ms03Mfhp3aYVvwAAAQg"]
[Sun May 03 01:48:40.148473 2026] [:error] [pid 52012:tid 52102] [client 172.202.47.245:26595] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "afY4-EzSWr-8cpS83mghFQAAA1g"]
[Sun May 03 01:48:41.908842 2026] [:error] [pid 52012:tid 52101] [client 172.202.47.245:26600] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afY4-UzSWr-8cpS83mghIQAAA1c"]
[Sun May 03 01:48:44.319210 2026] [:error] [pid 52012:tid 52089] [client 172.202.47.245:26411] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afY4_EzSWr-8cpS83mghLAAAA0w"]
[Sun May 03 01:48:45.732549 2026] [:error] [pid 52012:tid 52091] [client 172.202.47.245:26442] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afY4_UzSWr-8cpS83mghNgAAA04"]
[Sun May 03 01:48:47.846918 2026] [:error] [pid 52012:tid 52086] [client 172.202.47.245:26615] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afY4_0zSWr-8cpS83mghOgAAA0k"]
[Sun May 03 01:48:48.684275 2026] [:error] [pid 22846:tid 22856] [client 172.202.47.245:26519] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "afY5AIm1Ms03Mfhp3aYVzgAAAQg"]
[Sun May 03 01:48:49.651765 2026] [:error] [pid 52012:tid 52088] [client 172.202.47.245:26392] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "afY5AUzSWr-8cpS83mghQAAAA0s"]
[Sun May 03 01:48:51.921488 2026] [:error] [pid 11894:tid 11918] [client 172.202.47.245:26473] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "afY5AzHh6DQF1tkXIKz7zwAAAVU"]
[Sun May 03 01:48:52.606713 2026] [:error] [pid 52012:tid 52084] [client 172.202.47.245:26601] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no18.php"] [unique_id "afY5BEzSWr-8cpS83mghSAAAA0c"]
[Sun May 03 01:48:54.483246 2026] [:error] [pid 52010:tid 52047] [client 172.202.47.245:26434] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "afY5BgiR6wohDtdeJMBrLgAAAsQ"]
[Sun May 03 01:48:56.483080 2026] [:error] [pid 22846:tid 22862] [client 172.202.47.245:26398] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "afY5CIm1Ms03Mfhp3aYV5QAAAQ4"]
[Sun May 03 01:48:57.983783 2026] [:error] [pid 52012:tid 52099] [client 172.202.47.245:26586] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "afY5CUzSWr-8cpS83mghZQAAA1Y"]
[Sun May 03 01:48:59.873352 2026] [:error] [pid 51950:tid 51989] [client 172.202.47.245:26483] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fine.php"] [unique_id "afY5C4oBJzYZ3RKUhdiNtgAAAkk"]
[Sun May 03 01:49:01.214950 2026] [:error] [pid 53435:tid 53485] [client 172.202.47.245:26372] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afY5DYDmp7_z8QkjSzMY9QAAAE0"]
[Sun May 03 01:49:03.439481 2026] [:error] [pid 52012:tid 52084] [client 172.202.47.245:26579] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afY5D0zSWr-8cpS83mghawAAA0c"]
[Sun May 03 01:49:04.345153 2026] [:error] [pid 52012:tid 52087] [client 172.202.47.245:26563] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afY5EEzSWr-8cpS83mghcAAAA0o"]
[Sun May 03 01:49:07.268034 2026] [:error] [pid 52012:tid 52089] [client 172.202.47.245:26396] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afY5E0zSWr-8cpS83mghfAAAA0w"]
[Sun May 03 01:49:08.414322 2026] [:error] [pid 51950:tid 52000] [client 172.202.47.245:26435] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afY5FIoBJzYZ3RKUhdiNvQAAAlQ"]
[Sun May 03 01:49:09.848940 2026] [:error] [pid 53434:tid 53448] [client 172.202.47.245:26446] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afY5Fe9BXmRQcbfsxly5egAAAAU"]
[Sun May 03 01:49:10.683356 2026] [:error] [pid 51950:tid 51980] [client 172.202.47.245:26478] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afY5FooBJzYZ3RKUhdiNvwAAAkA"]
[Sun May 03 01:49:14.617897 2026] [:error] [pid 53434:tid 53446] [client 172.202.47.245:26581] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afY5Gu9BXmRQcbfsxly5hQAAAAM"]
[Sun May 03 01:49:17.772295 2026] [:error] [pid 53435:tid 53491] [client 172.202.47.245:26582] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afY5HYDmp7_z8QkjSzMZGAAAAFM"]
[Sun May 03 01:49:18.923328 2026] [:error] [pid 53434:tid 53465] [client 172.202.47.245:26607] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afY5Hu9BXmRQcbfsxly5iwAAABY"]
[Sun May 03 01:49:21.028612 2026] [:error] [pid 51950:tid 52002] [client 172.202.47.245:26605] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afY5IYoBJzYZ3RKUhdiN1QAAAlY"]
[Sun May 03 01:49:22.408429 2026] [:error] [pid 53435:tid 53488] [client 172.202.47.245:26489] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afY5IoDmp7_z8QkjSzMZJgAAAFA"]
[Sun May 03 01:49:23.605196 2026] [:error] [pid 51917:tid 51939] [client 172.202.47.245:26486] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "afY5I67wZviJ7BgcCi92mwAAAdQ"]
[Sun May 03 01:49:24.691637 2026] [:error] [pid 52010:tid 52058] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/inege.php
[Sun May 03 01:49:25.204393 2026] [:error] [pid 52010:tid 52059] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/classgoto24.php
[Sun May 03 01:49:25.435180 2026] [:error] [pid 52010:tid 52066] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/no1.php
[Sun May 03 01:49:25.625468 2026] [:error] [pid 52010:tid 52044] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/w2025.php
[Sun May 03 01:49:26.001340 2026] [:error] [pid 52010:tid 52048] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/fvvff.php
[Sun May 03 01:49:26.193341 2026] [:error] [pid 52010:tid 52064] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sun May 03 01:49:26.509746 2026] [:error] [pid 52010:tid 52053] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sun May 03 01:49:26.908843 2026] [:error] [pid 52010:tid 52050] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Sun May 03 01:49:27.099981 2026] [:error] [pid 52010:tid 52045] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/f6.php
[Sun May 03 01:49:27.295057 2026] [:error] [pid 52010:tid 52049] [client 172.202.47.245:26534] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sun May 03 01:49:27.625738 2026] [:error] [pid 52010:tid 52047] [client 172.202.47.245:26534] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "afY5JwiR6wohDtdeJMBrYQAAAsQ"]
[Sun May 03 01:49:28.593675 2026] [:error] [pid 52124:tid 52134] [client 172.202.47.245:26529] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "afY5KDjabaZ9NMm8eQufWQAAA4U"]
[Sun May 03 01:49:29.361357 2026] [:error] [pid 51917:tid 51943] [client 172.202.47.245:26610] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "afY5Ka7wZviJ7BgcCi92pgAAAdg"]
[Sun May 03 01:49:30.405807 2026] [:error] [pid 51917:tid 51924] [client 172.202.47.245:26379] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/style.php"] [unique_id "afY5Kq7wZviJ7BgcCi92qgAAAcU"]
[Sun May 03 01:49:31.400049 2026] [:error] [pid 51917:tid 51934] [client 172.202.47.245:26430] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afY5K67wZviJ7BgcCi92sQAAAc8"]
[Sun May 03 01:49:34.447146 2026] [:error] [pid 52012:tid 52099] [client 172.202.47.245:26377] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afY5LkzSWr-8cpS83mghiQAAA1Y"]
[Sun May 03 01:49:36.027486 2026] [:error] [pid 52124:tid 52153] [client 172.202.47.245:26554] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afY5MDjabaZ9NMm8eQufWwAAA5g"]
[Sun May 03 01:49:37.341877 2026] [:error] [pid 52012:tid 52082] [client 172.202.47.245:26428] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afY5MUzSWr-8cpS83mghkgAAA0U"]
[Sun May 03 01:49:38.878847 2026] [:error] [pid 51917:tid 51920] [client 172.202.47.245:26385] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afY5Mq7wZviJ7BgcCi92uQAAAcE"]
[Sun May 03 01:49:39.539289 2026] [:error] [pid 52010:tid 52061] [client 172.202.47.245:26548] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afY5MwiR6wohDtdeJMBrbwAAAtI"]
[Sun May 03 01:49:42.429172 2026] [:error] [pid 52124:tid 52139] [client 172.202.47.245:26443] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afY5NjjabaZ9NMm8eQufXwAAA4o"]
[Sun May 03 01:49:43.124110 2026] [:error] [pid 52012:tid 52086] [client 172.202.47.245:26555] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afY5N0zSWr-8cpS83mghqgAAA0k"]
[Sun May 03 01:49:44.033149 2026] [:error] [pid 52012:tid 52097] [client 172.202.47.245:26525] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afY5OEzSWr-8cpS83mghrgAAA1Q"]
[Sun May 03 01:49:45.486564 2026] [:error] [pid 51950:tid 51999] [client 172.202.47.245:26570] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afY5OYoBJzYZ3RKUhdiN4AAAAlM"]
[Sun May 03 01:49:47.562197 2026] [:error] [pid 51950:tid 51995] [client 172.202.47.245:26539] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afY5O4oBJzYZ3RKUhdiN5AAAAk8"]
[Sun May 03 01:49:48.780182 2026] [:error] [pid 22846:tid 22853] [client 172.202.47.245:26441] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afY5PIm1Ms03Mfhp3aYV9AAAAQU"]
[Sun May 03 01:49:50.098898 2026] [:error] [pid 53435:tid 53479] [client 172.202.47.245:26567] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afY5PoDmp7_z8QkjSzMZQQAAAEc"]
[Sun May 03 01:49:51.261420 2026] [:error] [pid 53435:tid 53478] [client 172.202.47.245:26459] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afY5P4Dmp7_z8QkjSzMZQwAAAEY"]
[Sun May 03 01:49:52.340860 2026] [:error] [pid 52010:tid 52061] [client 172.202.47.245:26498] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afY5QAiR6wohDtdeJMBrhQAAAtI"]
[Sun May 03 01:49:53.162470 2026] [:error] [pid 53435:tid 53481] [client 172.202.47.245:26566] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afY5QYDmp7_z8QkjSzMZXgAAAEk"]
[Sun May 03 01:49:54.631924 2026] [:error] [pid 52012:tid 52098] [client 172.202.47.245:26499] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afY5QkzSWr-8cpS83mghwgAAA1U"]
[Sun May 03 01:49:55.875024 2026] [:error] [pid 53435:tid 53478] [client 172.202.47.245:26565] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afY5Q4Dmp7_z8QkjSzMZhAAAAEY"]
[Sun May 03 01:50:03.171196 2026] [:error] [pid 52124:tid 52130] [client 172.202.47.245:26374] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afY5SzjabaZ9NMm8eQufbAAAA4E"]
[Sun May 03 01:50:04.501732 2026] [:error] [pid 11894:tid 11899] [client 172.202.47.245:26568] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afY5TDHh6DQF1tkXIKz72gAAAUI"]
[Sun May 03 01:50:07.124749 2026] [:error] [pid 22846:tid 22848] [client 172.202.47.245:26394] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afY5T4m1Ms03Mfhp3aYV_AAAAQA"]
[Sun May 03 01:50:08.692745 2026] [:error] [pid 22846:tid 22849] [client 172.202.47.245:26547] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afY5UIm1Ms03Mfhp3aYV_wAAAQE"]
[Sun May 03 01:50:10.013008 2026] [:error] [pid 52124:tid 52142] [client 172.202.47.245:26526] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afY5UjjabaZ9NMm8eQufcwAAA40"]
[Sun May 03 01:50:10.765507 2026] [:error] [pid 51917:tid 51943] [client 172.202.47.245:26557] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afY5Uq7wZviJ7BgcCi92wwAAAdg"]
[Sun May 03 01:50:12.886607 2026] [:error] [pid 52010:tid 52054] [client 172.202.47.245:26451] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afY5VAiR6wohDtdeJMBrpwAAAss"]
[Sun May 03 01:50:16.109283 2026] [:error] [pid 51950:tid 51988] [client 172.202.47.245:26574] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afY5WIoBJzYZ3RKUhdiN_AAAAkg"]
[Sun May 03 01:50:16.843281 2026] [:error] [pid 53435:tid 53493] [client 172.202.47.245:26472] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afY5WIDmp7_z8QkjSzMZrAAAAFU"]
[Sun May 03 01:50:17.986082 2026] [:error] [pid 53434:tid 53455] [client 172.202.47.245:26553] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afY5We9BXmRQcbfsxly5oQAAAAw"]
[Sun May 03 01:50:19.500059 2026] [:error] [pid 53435:tid 53489] [client 172.202.47.245:26604] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afY5W4Dmp7_z8QkjSzMZsgAAAFE"]
[Sun May 03 01:50:20.699420 2026] [:error] [pid 53435:tid 53474] [client 172.202.47.245:26616] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afY5XIDmp7_z8QkjSzMZuAAAAEI"]
[Sun May 03 01:50:21.562023 2026] [:error] [pid 52012:tid 52080] [client 172.202.47.245:26545] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afY5XUzSWr-8cpS83mgh2gAAA0M"]
[Sun May 03 01:50:22.753866 2026] [:error] [pid 22846:tid 22849] [client 172.202.47.245:26530] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afY5Xom1Ms03Mfhp3aYWCwAAAQE"]
[Sun May 03 01:50:24.736023 2026] [:error] [pid 53434:tid 53457] [client 172.202.47.245:26609] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afY5YO9BXmRQcbfsxly5qgAAAA4"]
[Sun May 03 01:50:25.869649 2026] [:error] [pid 53434:tid 53447] [client 172.202.47.245:26602] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afY5Ye9BXmRQcbfsxly5rwAAAAQ"]
[Sun May 03 01:50:27.692832 2026] [:error] [pid 52012:tid 52099] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/8xyz.php
[Sun May 03 01:50:27.883455 2026] [:error] [pid 52012:tid 52092] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sun May 03 01:50:28.072143 2026] [:error] [pid 52012:tid 52098] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Sun May 03 01:50:28.729431 2026] [:error] [pid 52012:tid 52082] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Sun May 03 01:50:28.939623 2026] [:error] [pid 52012:tid 52089] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Sun May 03 01:50:29.336730 2026] [:error] [pid 52012:tid 52078] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/fff.php
[Sun May 03 01:50:29.774116 2026] [:error] [pid 52012:tid 52085] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/makeasmtp.php
[Sun May 03 01:50:29.963543 2026] [:error] [pid 52012:tid 52101] [client 172.202.47.245:26482] File does not exist: /usr/local/apache/htdocs/suspended-page/admin1.php
[Sun May 03 01:50:30.389925 2026] [:error] [pid 52012:tid 52102] [client 172.202.47.245:26482] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afY5ZkzSWr-8cpS83mgiAgAAA1g"]
[Sun May 03 01:50:32.395244 2026] [:error] [pid 53434:tid 53461] [client 172.202.47.245:26580] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afY5aO9BXmRQcbfsxly5tQAAABI"]
[Sun May 03 01:50:33.249909 2026] [:error] [pid 53434:tid 53458] [client 172.202.47.245:26588] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afY5ae9BXmRQcbfsxly5uAAAAA8"]
[Sun May 03 01:50:34.119931 2026] [:error] [pid 53436:tid 53511] [client 172.202.47.245:26467] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afY5aq9N0xp8fccVM0DvaAAAAIw"]
[Sun May 03 01:50:35.895025 2026] [:error] [pid 51917:tid 51924] [client 172.202.47.245:26540] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afY5a67wZviJ7BgcCi920AAAAcU"]
[Sun May 03 01:50:37.160719 2026] [:error] [pid 51917:tid 51926] [client 172.202.47.245:26584] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afY5ba7wZviJ7BgcCi920gAAAcc"]
[Sun May 03 01:50:38.665500 2026] [:error] [pid 53434:tid 53444] [client 172.202.47.245:26593] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afY5bu9BXmRQcbfsxly5vgAAAAE"]
[Sun May 03 01:50:39.393617 2026] [:error] [pid 53434:tid 53467] [client 172.202.47.245:26622] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afY5b-9BXmRQcbfsxly5vwAAABg"]
[Sun May 03 01:50:41.049292 2026] [:error] [pid 52012:tid 52102] [client 172.202.47.245:26536] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afY5cUzSWr-8cpS83mgiFwAAA1g"]
[Sun May 03 01:50:42.121026 2026] [:error] [pid 52012:tid 52088] [client 172.202.47.245:26503] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afY5ckzSWr-8cpS83mgiHgAAA0s"]
[Sun May 03 01:50:44.810146 2026] [:error] [pid 53434:tid 53446] [client 172.202.47.245:26591] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afY5dO9BXmRQcbfsxly5wQAAAAM"]
[Sun May 03 01:50:45.997861 2026] [:error] [pid 52012:tid 52094] [client 172.202.47.245:26611] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afY5dUzSWr-8cpS83mgiJwAAA1E"]
[Sun May 03 01:50:47.546265 2026] [:error] [pid 52012:tid 52083] [client 172.202.47.245:26509] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afY5d0zSWr-8cpS83mgiKwAAA0Y"]
[Sun May 03 01:50:50.681155 2026] [:error] [pid 52012:tid 52089] [client 172.202.47.245:26599] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afY5ekzSWr-8cpS83mgiMgAAA0w"]
[Sun May 03 01:50:53.923381 2026] [:error] [pid 52012:tid 52088] [client 172.202.47.245:26456] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afY5fUzSWr-8cpS83mgiPAAAA0s"]
[Sun May 03 01:50:55.563093 2026] [:error] [pid 53436:tid 53516] [client 172.202.47.245:26560] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afY5f69N0xp8fccVM0DvbQAAAJE"]
[Sun May 03 01:50:56.654294 2026] [:error] [pid 51950:tid 52004] [client 172.202.47.245:26594] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afY5gIoBJzYZ3RKUhdiOFQAAAlg"]
[Sun May 03 01:50:58.806805 2026] [:error] [pid 51950:tid 51994] [client 172.202.47.245:26516] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afY5gooBJzYZ3RKUhdiOGQAAAk4"]
[Sun May 03 01:51:00.082644 2026] [:error] [pid 53434:tid 53447] [client 172.202.47.245:26511] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afY5hO9BXmRQcbfsxly5zwAAAAQ"]
[Sun May 03 01:51:01.058966 2026] [:error] [pid 51950:tid 51997] [client 172.202.47.245:26317] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afY5hYoBJzYZ3RKUhdiOHQAAAlE"]
[Sun May 03 01:51:05.602056 2026] [:error] [pid 52010:tid 52056] [client 172.202.47.245:26507] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "afY5iQiR6wohDtdeJMBryQAAAs0"]
[Sun May 03 01:51:07.685013 2026] [:error] [pid 11894:tid 11918] [client 172.202.47.245:26623] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "afY5izHh6DQF1tkXIKz76QAAAVU"]
[Sun May 03 01:51:09.477064 2026] [:error] [pid 52010:tid 52066] [client 172.202.47.245:26617] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "afY5jQiR6wohDtdeJMBrzQAAAtc"]
[Sun May 03 01:51:10.502400 2026] [:error] [pid 53434:tid 53444] [client 172.202.47.245:26510] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/fi.php"] [unique_id "afY5ju9BXmRQcbfsxly52wAAAAE"]
[Sun May 03 01:51:12.953811 2026] [:error] [pid 52012:tid 52078] [client 172.202.47.245:26542] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "afY5kEzSWr-8cpS83mgiQwAAA0E"]
[Sun May 03 01:51:14.007080 2026] [:error] [pid 53435:tid 53477] [client 172.202.47.245:26500] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "afY5koDmp7_z8QkjSzMZywAAAEU"]
[Sun May 03 01:51:16.596872 2026] [:error] [pid 52124:tid 52140] [client 172.202.47.245:26614] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "afY5lDjabaZ9NMm8eQufgwAAA4s"]
[Sun May 03 01:51:18.058671 2026] [:error] [pid 51950:tid 52003] [client 172.202.47.245:26528] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fe5.php"] [unique_id "afY5looBJzYZ3RKUhdiOLwAAAlc"]
[Sun May 03 01:51:21.602456 2026] [:error] [pid 53435:tid 53487] [client 172.202.47.245:26433] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY5mYDmp7_z8QkjSzMZ1QAAAE8"]
[Sun May 03 01:51:22.959678 2026] [:error] [pid 53435:tid 53494] [client 172.202.47.245:26590] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY5moDmp7_z8QkjSzMZ2wAAAFY"]
[Sun May 03 01:51:25.279851 2026] [:error] [pid 51950:tid 51999] [client 172.202.47.245:26462] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY5nYoBJzYZ3RKUhdiOSwAAAlM"]
[Sun May 03 01:51:26.004176 2026] [:error] [pid 52010:tid 52067] [client 172.202.47.245:26447] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afY5ngiR6wohDtdeJMBr2AAAAtg"]
[Sun May 03 01:51:26.538917 2026] [:error] [pid 52010:tid 52051] [client 172.202.47.245:26531] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afY5ngiR6wohDtdeJMBr2gAAAsg"]
[Sun May 03 01:51:28.898226 2026] [:error] [pid 53435:tid 53496] [client 172.202.47.245:26512] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afY5oIDmp7_z8QkjSzMZ4gAAAFg"]
[Sun May 03 01:51:30.253125 2026] [:error] [pid 52010:tid 52056] [client 172.202.47.245:26468] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sun May 03 01:51:30.456334 2026] [:error] [pid 52010:tid 52043] [client 172.202.47.245:26468] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Sun May 03 01:51:30.645414 2026] [:error] [pid 52010:tid 52047] [client 172.202.47.245:26468] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Sun May 03 01:51:31.022792 2026] [:error] [pid 52010:tid 52050] [client 172.202.47.245:26468] [client 172.202.47.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afY5owiR6wohDtdeJMBr4wAAAsc"]
[Sun May 03 01:51:32.833635 2026] [:error] [pid 11894:tid 11913] [client 172.202.47.245:26420] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Sun May 03 01:51:33.841456 2026] [:error] [pid 11894:tid 11916] [client 172.202.47.245:26420] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Sun May 03 01:51:34.057051 2026] [:error] [pid 11894:tid 11917] [client 172.202.47.245:26420] File does not exist: /usr/local/apache/htdocs/suspended-page/in.php
[Sun May 03 01:51:34.245646 2026] [:error] [pid 11894:tid 11919] [client 172.202.47.245:26420] File does not exist: /usr/local/apache/htdocs/suspended-page/gssdd.php
[Sun May 03 01:51:34.630691 2026] [:error] [pid 11894:tid 11904] [client 172.202.47.245:26420] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afY5pjHh6DQF1tkXIKz8AgAAAUc"]
[Sun May 03 01:51:35.639521 2026] [:error] [pid 22846:tid 22852] [client 172.202.47.245:26463] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afY5p4m1Ms03Mfhp3aYWMgAAAQQ"]
[Sun May 03 01:51:37.335291 2026] [:error] [pid 22846:tid 22859] [client 172.202.47.245:26618] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afY5qYm1Ms03Mfhp3aYWNgAAAQs"]
[Sun May 03 01:51:37.912383 2026] [:error] [pid 52010:tid 52046] [client 172.202.47.245:26578] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afY5qQiR6wohDtdeJMBr6gAAAsM"]
[Sun May 03 01:51:39.933843 2026] [:error] [pid 52012:tid 52099] [client 172.202.47.245:26518] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY5q0zSWr-8cpS83mgiUgAAA1Y"]
[Sun May 03 01:51:41.344518 2026] [:error] [pid 53436:tid 53515] [client 172.202.47.245:26384] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY5ra9N0xp8fccVM0DvewAAAJA"]
[Sun May 03 01:51:43.947526 2026] [:error] [pid 53435:tid 53486] [client 172.202.47.245:26585] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY5r4Dmp7_z8QkjSzMZ9gAAAE4"]
[Sun May 03 01:51:45.654536 2026] [:error] [pid 53435:tid 53476] [client 172.202.47.245:26479] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afY5sYDmp7_z8QkjSzMZ-gAAAEQ"]
[Sun May 03 01:51:46.488830 2026] [:error] [pid 52012:tid 52082] [client 172.202.47.245:26475] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afY5skzSWr-8cpS83mgiVQAAA0U"]
[Sun May 03 01:51:47.943330 2026] [:error] [pid 53435:tid 53482] [client 172.202.47.245:26458] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afY5s4Dmp7_z8QkjSzMaBAAAAEo"]
[Sun May 03 01:51:49.956327 2026] [:error] [pid 11894:tid 11898] [client 172.202.47.245:26596] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afY5tTHh6DQF1tkXIKz8BwAAAUE"]
[Sun May 03 01:51:50.941582 2026] [:error] [pid 53435:tid 53475] [client 172.202.47.245:26515] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afY5toDmp7_z8QkjSzMaDAAAAEM"]
[Sun May 03 01:51:51.567386 2026] [:error] [pid 52010:tid 52067] [client 172.202.47.245:26612] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "afY5twiR6wohDtdeJMBr9wAAAtg"]
[Sun May 03 01:51:52.458215 2026] [:error] [pid 52010:tid 52043] [client 172.202.47.245:26506] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "afY5uAiR6wohDtdeJMBr_AAAAsA"]
[Sun May 03 01:51:54.199449 2026] [:error] [pid 53436:tid 53512] [client 172.202.47.245:26490] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "afY5uq9N0xp8fccVM0DvfQAAAI0"]
[Sun May 03 01:51:55.143599 2026] [:error] [pid 53435:tid 53491] [client 172.202.47.245:26521] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file48.php"] [unique_id "afY5u4Dmp7_z8QkjSzMaFwAAAFM"]
[Sun May 03 01:51:56.137574 2026] [:error] [pid 52012:tid 52091] [client 172.202.47.245:26575] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afY5vEzSWr-8cpS83mgiYQAAA04"]
[Sun May 03 01:51:57.266150 2026] [:error] [pid 51917:tid 51925] [client 172.202.47.245:26454] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afY5va7wZviJ7BgcCi923QAAAcY"]
[Sun May 03 01:51:58.479249 2026] [:error] [pid 52124:tid 52132] [client 172.202.47.245:26405] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afY5vjjabaZ9NMm8eQuflwAAA4M"]
[Sun May 03 01:52:00.329470 2026] [:error] [pid 53436:tid 53502] [client 172.202.47.245:26439] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afY5wK9N0xp8fccVM0DvfgAAAIM"]
[Sun May 03 01:52:01.629694 2026] [:error] [pid 52124:tid 52138] [client 172.202.47.245:26501] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afY5wTjabaZ9NMm8eQufmwAAA4k"]
[Sun May 03 01:52:04.185861 2026] [:error] [pid 51950:tid 52000] [client 172.202.47.245:26505] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afY5xIoBJzYZ3RKUhdiOuAAAAlQ"]
[Sun May 03 01:52:05.251172 2026] [:error] [pid 11894:tid 11908] [client 172.202.47.245:26606] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afY5xTHh6DQF1tkXIKz8CwAAAUs"]
[Sun May 03 01:52:07.101211 2026] [:error] [pid 52012:tid 52082] [client 172.202.47.245:26384] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afY5x0zSWr-8cpS83mgieQAAA0U"]
[Sun May 03 01:52:09.490490 2026] [:error] [pid 52012:tid 52086] [client 172.202.47.245:26620] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "afY5yUzSWr-8cpS83mgiiQAAA0k"]
[Sun May 03 01:52:10.705202 2026] [:error] [pid 52012:tid 52088] [client 172.202.47.245:26487] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "afY5ykzSWr-8cpS83mgilQAAA0s"]
[Sun May 03 01:52:11.496983 2026] [:error] [pid 53435:tid 53487] [client 172.202.47.245:26514] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "afY5y4Dmp7_z8QkjSzMaHgAAAE8"]
[Sun May 03 01:52:12.443541 2026] [:error] [pid 52012:tid 52099] [client 172.202.47.245:26481] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "afY5zEzSWr-8cpS83mgiogAAA1Y"]
[Sun May 03 01:52:13.561314 2026] [:error] [pid 52010:tid 52063] [client 172.202.47.245:26408] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afY5zQiR6wohDtdeJMBsCgAAAtQ"]
[Sun May 03 01:52:14.824509 2026] [:error] [pid 53435:tid 53484] [client 172.202.47.245:26572] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afY5zoDmp7_z8QkjSzMaJwAAAEw"]
[Sun May 03 01:52:16.144118 2026] [:error] [pid 22846:tid 22872] [client 172.202.47.245:26438] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afY50Im1Ms03Mfhp3aYWSAAAARg"]
[Sun May 03 01:52:19.300828 2026] [:error] [pid 53435:tid 53473] [client 172.202.47.245:26613] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afY504Dmp7_z8QkjSzMaMgAAAEE"]
[Sun May 03 01:52:20.381506 2026] [:error] [pid 11894:tid 11913] [client 172.202.47.245:26561] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afY51DHh6DQF1tkXIKz8DgAAAVA"]
[Sun May 03 01:52:21.829760 2026] [:error] [pid 53435:tid 53487] [client 172.202.47.245:26450] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afY51YDmp7_z8QkjSzMaOAAAAE8"]
[Sun May 03 01:52:23.060906 2026] [:error] [pid 53435:tid 53495] [client 172.202.47.245:26502] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afY514Dmp7_z8QkjSzMaOwAAAFc"]
[Sun May 03 01:52:24.059430 2026] [:error] [pid 11894:tid 11914] [client 172.202.47.245:26583] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afY52DHh6DQF1tkXIKz8DwAAAVE"]
[Sun May 03 01:52:25.111774 2026] [:error] [pid 52012:tid 52102] [client 172.202.47.245:26397] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "afY52UzSWr-8cpS83mgisAAAA1g"]
[Sun May 03 01:52:26.904284 2026] [:error] [pid 11894:tid 11919] [client 172.202.47.245:26469] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "afY52jHh6DQF1tkXIKz8EQAAAVY"]
[Sun May 03 01:52:27.780736 2026] [:error] [pid 53434:tid 53460] [client 172.202.47.245:26549] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "afY52-9BXmRQcbfsxly6AQAAABE"]
[Sun May 03 01:52:28.763512 2026] [:error] [pid 53435:tid 53496] [client 172.202.47.245:26412] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file18.php"] [unique_id "afY53IDmp7_z8QkjSzMaRQAAAFg"]
[Sun May 03 01:52:30.149725 2026] [:error] [pid 53435:tid 53494] [client 172.202.47.245:26383] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afY53oDmp7_z8QkjSzMaRwAAAFY"]
[Sun May 03 01:52:31.271900 2026] [:error] [pid 53435:tid 53487] [client 172.202.47.245:26455] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afY534Dmp7_z8QkjSzMaSAAAAE8"]
[Sun May 03 01:52:32.028191 2026] [:error] [pid 51917:tid 51924] [client 172.202.47.245:26589] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afY54K7wZviJ7BgcCi924gAAAcU"]
[Sun May 03 01:52:33.895714 2026] [:error] [pid 51950:tid 51997] [client 172.202.47.245:26308] [client 172.202.47.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afY54YoBJzYZ3RKUhdiOxgAAAlE"]
[Sun May 03 01:52:34.829163 2026] [:error] [pid 53434:tid 53447] [client 172.202.47.245:26371] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Sun May 03 05:14:48.392556 2026] [:error] [pid 40637:tid 40651] [client 43.164.192.151:47834] [client 43.164.192.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afZpSJB-U30YNJ6CyVg4QwAAAAQ"]
[Sun May 03 07:55:31.751008 2026] [:error] [pid 40422:tid 40450] [client 43.166.134.47:44956] [client 43.166.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afaO80HBbBLrXh6PBut3YAAAAVg"]
[Sun May 03 13:57:55.455141 2026] [:error] [pid 40456:tid 40463] [client 170.106.181.163:43058] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afbj4zSujTvwdzEkjSckogAAAYU"]
[Sun May 03 15:17:43.580836 2026] [:error] [pid 37246:tid 37269] [client 34.171.247.38:51982] [client 34.171.247.38] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "afb2lzhvYFGNwhnPamrw2AAAARM"]
[Sun May 03 16:59:24.202597 2026] [:error] [pid 34432:tid 34440] [client 43.131.26.226:58022] [client 43.131.26.226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afcObJ73JKVQ0wlof4I3cAAAAcY"]
[Sun May 03 18:57:24.198478 2026] [:error] [pid 34432:tid 34452] [client 43.130.16.140:52516] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afcqFJ73JKVQ0wlof4JawQAAAdI"]
[Sun May 03 21:43:10.294558 2026] [:error] [pid 37246:tid 37268] [client 43.130.9.111:40486] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afdQ7jhvYFGNwhnPamo0NAAAARI"]
[Sun May 03 22:40:28.004866 2026] [:error] [pid 54535:tid 54537] [client 139.155.126.16:36282] [client 139.155.126.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afdeXPRyz79iR-ntJRIIvwAAAgA"]
[Mon May 04 02:41:59.153483 2026] [:error] [pid 54535:tid 54548] [client 124.156.157.91:33736] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afeW9_Ryz79iR-ntJRIwpQAAAgs"]
[Mon May 04 05:08:00.042719 2026] [:error] [pid 57047:tid 57095] [client 43.164.197.117:43954] [client 43.164.197.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afe5MFtCAxKLCAMkLV2RnwAAAEU"]
[Mon May 04 07:52:10.466745 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Mon May 04 07:52:10.656689 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/card.php
[Mon May 04 07:52:10.846857 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Mon May 04 07:52:11.120116 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-lacoto.php
[Mon May 04 07:52:11.311508 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kikikoko.php
[Mon May 04 07:52:11.647182 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/ganja.php
[Mon May 04 07:52:11.836718 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/eetu.php
[Mon May 04 07:52:12.229499 2026] [:error] [pid 12051:tid 12076] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-X1s2e6h3p7.php
[Mon May 04 07:52:12.432176 2026] [:error] [pid 12051:tid 12064] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/dragonshell.php
[Mon May 04 07:52:12.624958 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Mon May 04 07:52:12.915291 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:16331] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G-In.php"] [unique_id "afffrOrVB-w_PyOHK6kmcQAAAVg"]
[Mon May 04 07:52:15.726834 2026] [:error] [pid 11959:tid 12008] [client 20.9.82.33:15455] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G-In.php"] [unique_id "afffrwojk2nvxs7h5KvAOgAAANQ"]
[Mon May 04 07:52:17.771638 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:15451] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G-In.php"] [unique_id "afffserVB-w_PyOHK6kmeQAAAUk"]
[Mon May 04 07:52:19.590407 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:15444] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/G-In.php"] [unique_id "afffs0VhgvCNKBWnaTIb5AAAAJI"]
[Mon May 04 07:52:23.255045 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:15480] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj11.php"] [unique_id "affft0VhgvCNKBWnaTIb6QAAAIo"]
[Mon May 04 07:52:23.959974 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:16325] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj11.php"] [unique_id "affft-rVB-w_PyOHK6kmmwAAAVY"]
[Mon May 04 07:52:27.373930 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:15475] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj11.php"] [unique_id "afffuzAK_o2NLEdfAUki0wAAAE8"]
[Mon May 04 07:52:28.521616 2026] [:error] [pid 11958:tid 11970] [client 20.9.82.33:15457] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj11.php"] [unique_id "afffvDAK_o2NLEdfAUki2QAAAEk"]
[Mon May 04 07:52:30.226126 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:15452] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afffvkVhgvCNKBWnaTIcIAAAAI4"]
[Mon May 04 07:52:31.362852 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:15474] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afffvzAK_o2NLEdfAUki4gAAAE8"]
[Mon May 04 07:52:32.209450 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:15429] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afffwOrVB-w_PyOHK6knHAAAAVY"]
[Mon May 04 07:52:34.154562 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:15440] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afffwkVhgvCNKBWnaTIcJwAAAI8"]
[Mon May 04 07:52:36.000760 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:15461] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xroot.php"] [unique_id "afffw0VhgvCNKBWnaTIcKgAAAI4"]
[Mon May 04 07:52:38.341361 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:16324] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xroot.php"] [unique_id "afffxurVB-w_PyOHK6knKQAAAUM"]
[Mon May 04 07:52:39.646733 2026] [:error] [pid 11959:tid 12007] [client 20.9.82.33:16321] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xroot.php"] [unique_id "afffxwojk2nvxs7h5KvAcwAAANM"]
[Mon May 04 07:52:44.118836 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:15472] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xroot.php"] [unique_id "afffzOrVB-w_PyOHK6knOwAAAUI"]
[Mon May 04 07:52:45.086861 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:16332] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "afffzerVB-w_PyOHK6knPwAAAUo"]
[Mon May 04 07:52:46.779658 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:15484] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "afffzkVhgvCNKBWnaTIcOAAAAJM"]
[Mon May 04 07:52:47.675443 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:15446] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "afffz-rVB-w_PyOHK6knQgAAAUU"]
[Mon May 04 07:52:48.355205 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:15441] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tea.php"] [unique_id "afff0EVhgvCNKBWnaTIcOwAAAJg"]
[Mon May 04 07:52:50.066875 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:16327] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afff0urVB-w_PyOHK6knSQAAAVI"]
[Mon May 04 07:52:52.555910 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:16322] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afff1OrVB-w_PyOHK6knTwAAAVI"]
[Mon May 04 07:52:53.554183 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:16329] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afff1Qojk2nvxs7h5KvAfgAAAMQ"]
[Mon May 04 07:52:54.822964 2026] [:error] [pid 12051:tid 12076] [client 20.9.82.33:16358] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afff1urVB-w_PyOHK6knWQAAAVc"]
[Mon May 04 07:52:57.756673 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:15462] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "afff2UVhgvCNKBWnaTIcUAAAAIw"]
[Mon May 04 07:52:58.778496 2026] [:error] [pid 12022:tid 12041] [client 20.9.82.33:15459] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "afff2kVhgvCNKBWnaTIcVAAAAJE"]
[Mon May 04 07:53:00.148860 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:15427] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aios-bootstrap.php"] [unique_id "afff3OrVB-w_PyOHK6knbAAAAU8"]
[Mon May 04 07:53:14.582399 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/one.php
[Mon May 04 07:53:14.771710 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/006.php
[Mon May 04 07:53:14.961283 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/kikikoko.php
[Mon May 04 07:53:15.151691 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Mon May 04 07:53:15.339838 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Mon May 04 07:53:15.534096 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/amxloxxr.php
[Mon May 04 07:53:15.735360 2026] [:error] [pid 12051:tid 12072] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/qhupyoon.php
[Mon May 04 07:53:15.929020 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Mon May 04 07:53:16.119525 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Mon May 04 07:53:16.312680 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/6ap7e.php
[Mon May 04 07:53:16.517919 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:15466] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Mon May 04 07:53:16.703617 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:15466] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "afff7OrVB-w_PyOHK6knpgAAAUU"]
[Mon May 04 07:53:19.913497 2026] [:error] [pid 12022:tid 12044] [client 20.9.82.33:15432] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "afff70VhgvCNKBWnaTIcegAAAJQ"]
[Mon May 04 07:53:21.263371 2026] [:error] [pid 12051:tid 12068] [client 20.9.82.33:15445] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "afff8erVB-w_PyOHK6knsQAAAU8"]
[Mon May 04 07:53:22.742819 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:16371] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "afff8urVB-w_PyOHK6knuQAAAVY"]
[Mon May 04 07:53:26.129848 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:15470] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "afff9urVB-w_PyOHK6knyAAAAUw"]
[Mon May 04 07:53:30.960040 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:15460] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "afff-kVhgvCNKBWnaTIchAAAAJc"]
[Mon May 04 07:53:33.875885 2026] [:error] [pid 11958:tid 11980] [client 20.9.82.33:16340] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "afff_TAK_o2NLEdfAUkjDwAAAFM"]
[Mon May 04 07:53:37.041778 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:15458] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "affgAerVB-w_PyOHK6kn4AAAAUY"]
[Mon May 04 07:53:38.833411 2026] [:error] [pid 12022:tid 12030] [client 20.9.82.33:16336] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "affgAkVhgvCNKBWnaTIcjAAAAIY"]
[Mon May 04 07:53:40.084652 2026] [:error] [pid 11958:tid 11977] [client 20.9.82.33:15428] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "affgBDAK_o2NLEdfAUkjFAAAAFA"]
[Mon May 04 07:53:41.836651 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:15467] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "affgBUVhgvCNKBWnaTIckQAAAJc"]
[Mon May 04 07:53:43.212190 2026] [:error] [pid 11959:tid 12009] [client 20.9.82.33:16357] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zogy1.php"] [unique_id "affgBwojk2nvxs7h5KvArgAAANU"]
[Mon May 04 07:53:44.273796 2026] [:error] [pid 11959:tid 12012] [client 20.9.82.33:16333] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "affgCAojk2nvxs7h5KvAsgAAANg"]
[Mon May 04 07:53:45.258979 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:15438] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "affgCQojk2nvxs7h5KvAtAAAAMQ"]
[Mon May 04 07:53:57.665231 2026] [:error] [pid 11959:tid 11989] [client 20.9.82.33:16345] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "affgFQojk2nvxs7h5KvAxgAAAME"]
[Mon May 04 07:53:58.459033 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:16338] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "affgFurVB-w_PyOHK6koCAAAAU0"]
[Mon May 04 07:53:59.810425 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:15469] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atkno.php"] [unique_id "affgF0VhgvCNKBWnaTIdTwAAAIU"]
[Mon May 04 07:54:00.989149 2026] [:error] [pid 11958:tid 11984] [client 20.9.82.33:16356] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atkno.php"] [unique_id "affgGDAK_o2NLEdfAUkjigAAAFc"]
[Mon May 04 07:54:02.082381 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:15454] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atkno.php"] [unique_id "affgGkVhgvCNKBWnaTIdVAAAAIw"]
[Mon May 04 07:54:03.835374 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:16334] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atkno.php"] [unique_id "affgG0VhgvCNKBWnaTIdWAAAAIs"]
[Mon May 04 07:54:05.466913 2026] [:error] [pid 11958:tid 11971] [client 20.9.82.33:16342] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/de.php"] [unique_id "affgHTAK_o2NLEdfAUkjlQAAAEo"]
[Mon May 04 07:54:07.782674 2026] [:error] [pid 11959:tid 12000] [client 20.9.82.33:16344] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/de.php"] [unique_id "affgHwojk2nvxs7h5KvA4AAAAMw"]
[Mon May 04 07:54:16.121825 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/de.php
[Mon May 04 07:54:16.312426 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/insta.php
[Mon May 04 07:54:16.503506 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxl.php
[Mon May 04 07:54:16.849109 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/admlo.php
[Mon May 04 07:54:17.050265 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php
[Mon May 04 07:54:17.258034 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/ptanf.php
[Mon May 04 07:54:17.451669 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/ctex1.php
[Mon May 04 07:54:17.776613 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/gelio1.php
[Mon May 04 07:54:17.966724 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/ah25.php
[Mon May 04 07:54:18.162498 2026] [:error] [pid 12051:tid 12057] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Mon May 04 07:54:18.454503 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:15477] File does not exist: /usr/local/apache/htdocs/suspended-page/axe.php
[Mon May 04 07:54:18.641473 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:15477] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "affgKurVB-w_PyOHK6koQAAAAUM"]
[Mon May 04 07:54:19.387571 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:16380] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "affgK-rVB-w_PyOHK6koQwAAAUw"]
[Mon May 04 07:54:24.030137 2026] [:error] [pid 11959:tid 11999] [client 20.9.82.33:16369] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "affgMAojk2nvxs7h5KvA7gAAAMs"]
[Mon May 04 07:54:24.980485 2026] [:error] [pid 11958:tid 11970] [client 20.9.82.33:15430] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "affgMDAK_o2NLEdfAUkjnwAAAEk"]
[Mon May 04 07:54:28.510731 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:15453] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-01ul.php"] [unique_id "affgNOrVB-w_PyOHK6koTAAAAUY"]
[Mon May 04 07:54:31.426604 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:16352] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-01ul.php"] [unique_id "affgN-rVB-w_PyOHK6koUAAAAU0"]
[Mon May 04 07:54:33.797469 2026] [:error] [pid 11959:tid 12006] [client 20.9.82.33:16382] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-01ul.php"] [unique_id "affgOQojk2nvxs7h5KvA-gAAANI"]
[Mon May 04 07:54:34.993417 2026] [:error] [pid 12022:tid 12024] [client 20.9.82.33:15473] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-01ul.php"] [unique_id "affgOkVhgvCNKBWnaTIdigAAAIA"]
[Mon May 04 07:54:36.985707 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:16349] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e3.php"] [unique_id "affgPAojk2nvxs7h5KvA_QAAAMQ"]
[Mon May 04 07:54:38.184400 2026] [:error] [pid 12022:tid 12025] [client 20.9.82.33:16372] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e3.php"] [unique_id "affgPkVhgvCNKBWnaTIdjgAAAIE"]
[Mon May 04 07:54:40.358406 2026] [:error] [pid 11958:tid 11982] [client 20.9.82.33:16256] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e3.php"] [unique_id "affgQDAK_o2NLEdfAUkjqAAAAFU"]
[Mon May 04 07:54:44.218463 2026] [:error] [pid 11959:tid 12006] [client 20.9.82.33:15456] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/e3.php"] [unique_id "affgRAojk2nvxs7h5KvBCgAAANI"]
[Mon May 04 07:54:45.417915 2026] [:error] [pid 12022:tid 12031] [client 20.9.82.33:16320] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fkohd.php"] [unique_id "affgRUVhgvCNKBWnaTIdoAAAAIc"]
[Mon May 04 07:54:46.136860 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:16347] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fkohd.php"] [unique_id "affgRurVB-w_PyOHK6koagAAAVQ"]
[Mon May 04 07:54:50.102156 2026] [:error] [pid 12051:tid 12065] [client 20.9.82.33:15424] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fkohd.php"] [unique_id "affgSurVB-w_PyOHK6kodAAAAUw"]
[Mon May 04 07:54:53.162314 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:16281] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fkohd.php"] [unique_id "affgTerVB-w_PyOHK6kovwAAAU4"]
[Mon May 04 07:54:54.015194 2026] [:error] [pid 11959:tid 12002] [client 20.9.82.33:16296] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "affgTgojk2nvxs7h5KvBDQAAAM4"]
[Mon May 04 07:54:54.542974 2026] [:error] [pid 11959:tid 11999] [client 20.9.82.33:16274] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "affgTgojk2nvxs7h5KvBDwAAAMs"]
[Mon May 04 07:54:57.260954 2026] [:error] [pid 12022:tid 12037] [client 20.9.82.33:16365] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "affgUUVhgvCNKBWnaTId2wAAAI0"]
[Mon May 04 07:55:00.070506 2026] [:error] [pid 11958:tid 11963] [client 20.9.82.33:15433] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "affgVDAK_o2NLEdfAUkjvAAAAEI"]
[Mon May 04 07:55:00.833428 2026] [:error] [pid 11959:tid 11990] [client 20.9.82.33:16328] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "affgVAojk2nvxs7h5KvBHQAAAMI"]
[Mon May 04 07:55:02.767985 2026] [:error] [pid 12022:tid 12037] [client 20.9.82.33:15465] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "affgVkVhgvCNKBWnaTId4wAAAI0"]
[Mon May 04 07:55:03.743735 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:16259] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "affgVwojk2nvxs7h5KvBIQAAAMQ"]
[Mon May 04 07:55:04.949409 2026] [:error] [pid 11959:tid 12000] [client 20.9.82.33:15482] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws80.php"] [unique_id "affgWAojk2nvxs7h5KvBIgAAAMw"]
[Mon May 04 07:55:13.390538 2026] [:error] [pid 12022:tid 12033] [client 20.9.82.33:16323] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zo.php"] [unique_id "affgYUVhgvCNKBWnaTId8gAAAIk"]
[Mon May 04 07:55:14.704499 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:15447] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zo.php"] [unique_id "affgYurVB-w_PyOHK6ko1AAAAVU"]
[Mon May 04 07:55:15.434310 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:15442] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zo.php"] [unique_id "affgY-rVB-w_PyOHK6ko2AAAAVA"]
[Mon May 04 07:55:17.095761 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:15483] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zo.php"] [unique_id "affgZUVhgvCNKBWnaTIeDwAAAIo"]
[Mon May 04 07:55:19.295509 2026] [:error] [pid 11958:tid 11969] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/xy.php
[Mon May 04 07:55:19.488424 2026] [:error] [pid 11958:tid 11962] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/masks.php
[Mon May 04 07:55:19.678973 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/man.php
[Mon May 04 07:55:19.869075 2026] [:error] [pid 11958:tid 11973] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/xfun.php
[Mon May 04 07:55:20.059638 2026] [:error] [pid 11958:tid 11975] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Mon May 04 07:55:20.288366 2026] [:error] [pid 11958:tid 11966] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/vv.php
[Mon May 04 07:55:20.478503 2026] [:error] [pid 11958:tid 11968] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/wpconf.php
[Mon May 04 07:55:20.978420 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Mon May 04 07:55:21.384299 2026] [:error] [pid 11958:tid 11978] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-zx.php
[Mon May 04 07:55:21.578021 2026] [:error] [pid 11958:tid 11977] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/000.php
[Mon May 04 07:55:21.769023 2026] [:error] [pid 11958:tid 11963] [client 20.9.82.33:16288] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Mon May 04 07:55:21.972930 2026] [:error] [pid 11958:tid 11985] [client 20.9.82.33:16288] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iov.php"] [unique_id "affgaTAK_o2NLEdfAUkj7gAAAFg"]
[Mon May 04 07:55:23.344169 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:16272] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iov.php"] [unique_id "affgazAK_o2NLEdfAUkj8QAAAE8"]
[Mon May 04 07:55:26.259856 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:15468] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iov.php"] [unique_id "affgbkVhgvCNKBWnaTIePwAAAJM"]
[Mon May 04 07:55:26.955571 2026] [:error] [pid 11958:tid 11964] [client 20.9.82.33:16366] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/iov.php"] [unique_id "affgbjAK_o2NLEdfAUkj_wAAAEM"]
[Mon May 04 07:55:28.033590 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:16335] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jodohghi.php"] [unique_id "affgcEVhgvCNKBWnaTIeRQAAAI8"]
[Mon May 04 07:55:29.335328 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:16364] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jodohghi.php"] [unique_id "affgcerVB-w_PyOHK6kpDQAAAUg"]
[Mon May 04 07:55:30.644513 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:15463] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jodohghi.php"] [unique_id "affgckVhgvCNKBWnaTIeSwAAAIs"]
[Mon May 04 07:55:34.252468 2026] [:error] [pid 11958:tid 11968] [client 20.9.82.33:16326] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jodohghi.php"] [unique_id "affgdjAK_o2NLEdfAUkkGQAAAEc"]
[Mon May 04 07:55:38.021697 2026] [:error] [pid 12022:tid 12040] [client 20.9.82.33:15486] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rendi59.php"] [unique_id "affgekVhgvCNKBWnaTIedAAAAJA"]
[Mon May 04 07:55:38.899174 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:16261] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rendi59.php"] [unique_id "affgekVhgvCNKBWnaTIedgAAAII"]
[Mon May 04 07:55:41.281701 2026] [:error] [pid 12051:tid 12072] [client 20.9.82.33:16368] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rendi59.php"] [unique_id "affgferVB-w_PyOHK6kpMgAAAVM"]
[Mon May 04 07:55:42.173327 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:15478] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rendi59.php"] [unique_id "affgfkVhgvCNKBWnaTIefQAAAJg"]
[Mon May 04 07:55:43.409365 2026] [:error] [pid 12022:tid 12037] [client 20.9.82.33:16330] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rivasqup.php"] [unique_id "affgf0VhgvCNKBWnaTIenAAAAI0"]
[Mon May 04 07:55:44.916126 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:16286] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rivasqup.php"] [unique_id "affggOrVB-w_PyOHK6kpUAAAAVI"]
[Mon May 04 07:55:47.921266 2026] [:error] [pid 11958:tid 11975] [client 20.9.82.33:15425] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rivasqup.php"] [unique_id "affggzAK_o2NLEdfAUkkJgAAAE4"]
[Mon May 04 07:55:49.101297 2026] [:error] [pid 12051:tid 12057] [client 20.9.82.33:16258] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rivasqup.php"] [unique_id "affgherVB-w_PyOHK6kpWQAAAUQ"]
[Mon May 04 07:55:50.327846 2026] [:error] [pid 11958:tid 11966] [client 20.9.82.33:16339] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mga.php"] [unique_id "affghjAK_o2NLEdfAUkkJwAAAEU"]
[Mon May 04 07:55:52.100748 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:16351] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mga.php"] [unique_id "affgiEVhgvCNKBWnaTIeyAAAAIs"]
[Mon May 04 07:55:55.113941 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:16346] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mga.php"] [unique_id "affgi-rVB-w_PyOHK6kpZQAAAVQ"]
[Mon May 04 07:55:56.767982 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:15464] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mga.php"] [unique_id "affgjOrVB-w_PyOHK6kpagAAAVI"]
[Mon May 04 07:55:58.322276 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:16379] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dshtv.php"] [unique_id "affgjurVB-w_PyOHK6kpbgAAAVU"]
[Mon May 04 07:55:59.579114 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:16279] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dshtv.php"] [unique_id "affgj-rVB-w_PyOHK6kpdQAAAVI"]
[Mon May 04 07:56:01.134010 2026] [:error] [pid 11958:tid 11973] [client 20.9.82.33:15450] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dshtv.php"] [unique_id "affgkTAK_o2NLEdfAUkkKQAAAEw"]
[Mon May 04 07:56:02.740623 2026] [:error] [pid 11958:tid 11965] [client 20.9.82.33:15471] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dshtv.php"] [unique_id "affgkjAK_o2NLEdfAUkkKwAAAEQ"]
[Mon May 04 07:56:04.480226 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:16376] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sym403.php"] [unique_id "affglOrVB-w_PyOHK6kpgQAAAUc"]
[Mon May 04 07:56:06.825744 2026] [:error] [pid 11959:tid 11997] [client 20.9.82.33:15435] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sym403.php"] [unique_id "affglgojk2nvxs7h5KvBhQAAAMk"]
[Mon May 04 07:56:08.446546 2026] [:error] [pid 12022:tid 12029] [client 20.9.82.33:16383] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sym403.php"] [unique_id "affgmEVhgvCNKBWnaTIe0wAAAIU"]
[Mon May 04 07:56:10.696958 2026] [:error] [pid 12022:tid 12024] [client 20.9.82.33:15481] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sym403.php"] [unique_id "affgmkVhgvCNKBWnaTIe1AAAAIA"]
[Mon May 04 07:56:12.936704 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:15449] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/temp1.php"] [unique_id "affgnEVhgvCNKBWnaTIe1gAAAJg"]
[Mon May 04 07:56:15.611906 2026] [:error] [pid 12051:tid 12072] [client 20.9.82.33:16284] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/temp1.php"] [unique_id "affgn-rVB-w_PyOHK6kpjwAAAVM"]
[Mon May 04 07:56:16.972436 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:16270] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/temp1.php"] [unique_id "affgoOrVB-w_PyOHK6kplAAAAUI"]
[Mon May 04 07:56:20.025919 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:16378] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/temp1.php"] [unique_id "affgpEVhgvCNKBWnaTIe3QAAAII"]
[Mon May 04 07:56:21.625338 2026] [:error] [pid 11958:tid 11972] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Mon May 04 07:56:21.814553 2026] [:error] [pid 11958:tid 11982] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Mon May 04 07:56:22.214873 2026] [:error] [pid 11958:tid 11970] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/Sanskrit.php
[Mon May 04 07:56:22.407268 2026] [:error] [pid 11958:tid 11962] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/bbny.php
[Mon May 04 07:56:22.705961 2026] [:error] [pid 11958:tid 11975] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Mon May 04 07:56:22.901557 2026] [:error] [pid 11958:tid 11966] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/zhw.php
[Mon May 04 07:56:23.098303 2026] [:error] [pid 11958:tid 11961] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/casp1.php
[Mon May 04 07:56:23.300670 2026] [:error] [pid 11958:tid 11968] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/ftde.php
[Mon May 04 07:56:23.490452 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/lov.php
[Mon May 04 07:56:23.680459 2026] [:error] [pid 11958:tid 11979] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/knw.php
[Mon May 04 07:56:23.885534 2026] [:error] [pid 11958:tid 11983] [client 20.9.82.33:16217] File does not exist: /usr/local/apache/htdocs/suspended-page/fi.php
[Mon May 04 07:56:24.072131 2026] [:error] [pid 11958:tid 11965] [client 20.9.82.33:16217] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "affgqDAK_o2NLEdfAUkkegAAAEQ"]
[Mon May 04 07:56:25.023628 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:16355] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "affgqerVB-w_PyOHK6kpmgAAAVQ"]
[Mon May 04 07:56:25.840318 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:16304] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "affgqUVhgvCNKBWnaTIe4AAAAIw"]
[Mon May 04 07:56:26.821071 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:16362] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jlex.php"] [unique_id "affgqurVB-w_PyOHK6kpngAAAVY"]
[Mon May 04 07:56:28.177533 2026] [:error] [pid 11958:tid 11979] [client 20.9.82.33:16267] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-k7djufwez2.php"] [unique_id "affgrDAK_o2NLEdfAUkkfAAAAFI"]
[Mon May 04 07:56:30.356410 2026] [:error] [pid 11959:tid 12008] [client 20.9.82.33:15431] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-k7djufwez2.php"] [unique_id "affgrgojk2nvxs7h5KvBlwAAANQ"]
[Mon May 04 07:56:32.906991 2026] [:error] [pid 11959:tid 12012] [client 20.9.82.33:15451] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-k7djufwez2.php"] [unique_id "affgsAojk2nvxs7h5KvBnQAAANg"]
[Mon May 04 07:56:40.939686 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:15475] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-k7djufwez2.php"] [unique_id "affguEVhgvCNKBWnaTIe9AAAAIw"]
[Mon May 04 07:56:43.056225 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:15448] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tiroto.php"] [unique_id "affgu-rVB-w_PyOHK6kprAAAAUY"]
[Mon May 04 07:56:46.316403 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:16363] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tiroto.php"] [unique_id "affgvurVB-w_PyOHK6kprwAAAU0"]
[Mon May 04 07:56:51.518970 2026] [:error] [pid 11958:tid 11965] [client 20.9.82.33:15474] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tiroto.php"] [unique_id "affgwzAK_o2NLEdfAUkkjgAAAEQ"]
[Mon May 04 07:56:53.469617 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:15452] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-tiroto.php"] [unique_id "affgxerVB-w_PyOHK6kpvwAAAVg"]
[Mon May 04 07:56:58.893121 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:15480] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/son.php"] [unique_id "affgykVhgvCNKBWnaTIfCwAAAIw"]
[Mon May 04 07:57:10.866002 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:16373] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/99.php"] [unique_id "affg1urVB-w_PyOHK6kp2wAAAVE"]
[Mon May 04 07:57:11.552387 2026] [:error] [pid 11959:tid 11992] [client 20.9.82.33:16354] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/99.php"] [unique_id "affg1wojk2nvxs7h5KvB4wAAAMQ"]
[Mon May 04 07:57:13.671113 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:15457] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/99.php"] [unique_id "affg2Qojk2nvxs7h5KvB5wAAANA"]
[Mon May 04 07:57:15.526094 2026] [:error] [pid 11958:tid 11981] [client 20.9.82.33:15446] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/99.php"] [unique_id "affg2zAK_o2NLEdfAUkkrgAAAFQ"]
[Mon May 04 07:57:17.674044 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:15459] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "affg3UVhgvCNKBWnaTIfEQAAAIs"]
[Mon May 04 07:57:19.381494 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:16214] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "affg3-rVB-w_PyOHK6kp5gAAAUM"]
[Mon May 04 07:57:22.499354 2026] [:error] [pid 11959:tid 12003] [client 20.9.82.33:15436] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "affg4gojk2nvxs7h5KvB9wAAAM8"]
[Mon May 04 07:57:23.908876 2026] [:error] [pid 11958:tid 11976] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Mon May 04 07:57:24.102971 2026] [:error] [pid 11958:tid 11969] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/filefuns.php
[Mon May 04 07:57:24.493392 2026] [:error] [pid 11958:tid 11970] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/ay.php
[Mon May 04 07:57:24.684812 2026] [:error] [pid 11958:tid 11983] [client 20.9.82.33:16331] File does not exist: /usr/local/apache/htdocs/suspended-page/options.php
[Mon May 04 07:57:24.876636 2026] [:error] [pid 11958:tid 11965] [client 20.9.82.33:16331] [client 20.9.82.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "affg5DAK_o2NLEdfAUkkuAAAAEQ"]
[Mon May 04 07:57:28.633446 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:16287] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Mon May 04 07:57:29.223184 2026] [:error] [pid 12051:tid 12076] [client 20.9.82.33:16287] File does not exist: /usr/local/apache/htdocs/suspended-page/1a.php
[Mon May 04 07:57:29.414911 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:16287] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Mon May 04 07:57:29.604101 2026] [:error] [pid 12051:tid 12064] [client 20.9.82.33:16287] File does not exist: /usr/local/apache/htdocs/suspended-page/file-kikikoko.php
[Mon May 04 07:57:29.821201 2026] [:error] [pid 12051:tid 12055] [client 20.9.82.33:16287] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Mon May 04 07:57:30.035524 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:16287] File does not exist: /usr/local/apache/htdocs/suspended-page/tramuibs.php
[Mon May 04 07:57:30.308388 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:16287] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Mon May 04 07:57:30.502469 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:16287] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "affg6urVB-w_PyOHK6kqGgAAAVI"]
[Mon May 04 07:57:32.313428 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:16367] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "affg7EVhgvCNKBWnaTIfIwAAAJI"]
[Mon May 04 07:57:36.935381 2026] [:error] [pid 11959:tid 12012] [client 20.9.82.33:16271] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "affg8Aojk2nvxs7h5KvCAQAAANg"]
[Mon May 04 07:57:37.601794 2026] [:error] [pid 11958:tid 11963] [client 20.9.82.33:16375] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "affg8TAK_o2NLEdfAUkkywAAAEI"]
[Mon May 04 07:57:38.644377 2026] [:error] [pid 11958:tid 11980] [client 20.9.82.33:16329] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bpxrn.php"] [unique_id "affg8jAK_o2NLEdfAUkkzQAAAFM"]
[Mon May 04 07:57:42.287581 2026] [:error] [pid 12051:tid 12060] [client 20.9.82.33:16198] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bpxrn.php"] [unique_id "affg9urVB-w_PyOHK6kqbgAAAUc"]
[Mon May 04 07:57:43.082961 2026] [:error] [pid 12051:tid 12057] [client 20.9.82.33:16280] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bpxrn.php"] [unique_id "affg9-rVB-w_PyOHK6kqcwAAAUQ"]
[Mon May 04 07:57:43.853216 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:16269] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bpxrn.php"] [unique_id "affg9-rVB-w_PyOHK6kqdgAAAUM"]
[Mon May 04 07:57:47.085893 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:16295] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "affg--rVB-w_PyOHK6kqewAAAUM"]
[Mon May 04 07:57:49.609438 2026] [:error] [pid 12022:tid 12031] [client 20.9.82.33:15428] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "affg_UVhgvCNKBWnaTIfKwAAAIc"]
[Mon May 04 07:57:51.070307 2026] [:error] [pid 11959:tid 12002] [client 20.9.82.33:16325] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "affg_wojk2nvxs7h5KvCDwAAAM4"]
[Mon May 04 07:57:52.809462 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:16192] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "affhAEVhgvCNKBWnaTIfMgAAAJc"]
[Mon May 04 07:57:57.083367 2026] [:error] [pid 11959:tid 11995] [client 20.9.82.33:16275] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws37.php"] [unique_id "affhBQojk2nvxs7h5KvCFgAAAMc"]
[Mon May 04 07:57:57.738555 2026] [:error] [pid 11958:tid 11969] [client 20.9.82.33:16314] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws37.php"] [unique_id "affhBTAK_o2NLEdfAUklBwAAAEg"]
[Mon May 04 07:57:59.158167 2026] [:error] [pid 11958:tid 11980] [client 20.9.82.33:16354] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws37.php"] [unique_id "affhBzAK_o2NLEdfAUklDgAAAFM"]
[Mon May 04 07:58:00.221805 2026] [:error] [pid 11959:tid 12003] [client 20.9.82.33:16343] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws37.php"] [unique_id "affhCAojk2nvxs7h5KvCGwAAAM8"]
[Mon May 04 07:58:01.484063 2026] [:error] [pid 12022:tid 12040] [client 20.9.82.33:16310] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "affhCUVhgvCNKBWnaTIfOgAAAJA"]
[Mon May 04 07:58:02.143465 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:16370] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "affhCkVhgvCNKBWnaTIfPAAAAI8"]
[Mon May 04 07:58:03.001319 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:15441] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "affhC0VhgvCNKBWnaTIfPQAAAJg"]
[Mon May 04 07:58:03.899006 2026] [:error] [pid 12022:tid 12044] [client 20.9.82.33:15455] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "affhC0VhgvCNKBWnaTIfQAAAAJQ"]
[Mon May 04 07:58:05.093583 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:15437] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bojcdooq.php"] [unique_id "affhDTAK_o2NLEdfAUklEwAAAE0"]
[Mon May 04 07:58:06.935081 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:15466] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bojcdooq.php"] [unique_id "affhDurVB-w_PyOHK6kqfwAAAVU"]
[Mon May 04 07:58:07.830829 2026] [:error] [pid 11958:tid 11983] [client 20.9.82.33:16324] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bojcdooq.php"] [unique_id "affhDzAK_o2NLEdfAUklFAAAAFY"]
[Mon May 04 07:58:09.595921 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:16356] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bojcdooq.php"] [unique_id "affhEUVhgvCNKBWnaTIfRwAAAJI"]
[Mon May 04 07:58:10.895553 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:16340] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zdd.php"] [unique_id "affhEkVhgvCNKBWnaTIfSgAAAII"]
[Mon May 04 07:58:13.758500 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:15438] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zdd.php"] [unique_id "affhFUVhgvCNKBWnaTIfTwAAAJM"]
[Mon May 04 07:58:22.584867 2026] [:error] [pid 11959:tid 11991] [client 20.9.82.33:16350] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zdd.php"] [unique_id "affhHgojk2nvxs7h5KvCOgAAAMM"]
[Mon May 04 07:58:27.907037 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:16337] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "affhIzAK_o2NLEdfAUklGwAAAE0"]
[Mon May 04 07:58:28.742198 2026] [:error] [pid 11958:tid 11962] [client 20.9.82.33:15426] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "affhJDAK_o2NLEdfAUklHgAAAEE"]
[Mon May 04 07:58:29.614006 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:15485] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/133.php"] [unique_id "affhJerVB-w_PyOHK6kqlwAAAUo"]
[Mon May 04 07:58:31.486425 2026] [:error] [pid 12022:tid 12033] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/133.php
[Mon May 04 07:58:31.682992 2026] [:error] [pid 12022:tid 12047] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/jq.php
[Mon May 04 07:58:31.881084 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/cro.php
[Mon May 04 07:58:32.072646 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/wwx.php
[Mon May 04 07:58:32.292379 2026] [:error] [pid 12022:tid 12025] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/trx24.php
[Mon May 04 07:58:32.500470 2026] [:error] [pid 12022:tid 12046] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/blox.php
[Mon May 04 07:58:32.695963 2026] [:error] [pid 12022:tid 12035] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/berax.php
[Mon May 04 07:58:32.898733 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/bkxzo.php
[Mon May 04 07:58:33.115465 2026] [:error] [pid 12022:tid 12039] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/cdxadmin.php
[Mon May 04 07:58:33.307801 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/dfre.php
[Mon May 04 07:58:33.500030 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:16293] File does not exist: /usr/local/apache/htdocs/suspended-page/sko.php
[Mon May 04 07:58:33.688046 2026] [:error] [pid 12022:tid 12040] [client 20.9.82.33:16293] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shorw.php"] [unique_id "affhKUVhgvCNKBWnaTIfbgAAAJA"]
[Mon May 04 07:58:38.662402 2026] [:error] [pid 12022:tid 12025] [client 20.9.82.33:15479] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shorw.php"] [unique_id "affhLkVhgvCNKBWnaTIfdAAAAIE"]
[Mon May 04 07:58:39.684054 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:15427] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shorw.php"] [unique_id "affhL-rVB-w_PyOHK6kqrAAAAVY"]
[Mon May 04 07:58:40.725841 2026] [:error] [pid 11959:tid 11997] [client 20.9.82.33:16277] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shorw.php"] [unique_id "affhMAojk2nvxs7h5KvCRQAAAMk"]
[Mon May 04 07:58:43.398007 2026] [:error] [pid 11959:tid 11994] [client 20.9.82.33:16205] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shelp.php"] [unique_id "affhMwojk2nvxs7h5KvCTQAAAMY"]
[Mon May 04 07:58:45.060724 2026] [:error] [pid 11959:tid 12001] [client 20.9.82.33:15469] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shelp.php"] [unique_id "affhNQojk2nvxs7h5KvCUgAAAM0"]
[Mon May 04 07:58:46.204649 2026] [:error] [pid 12022:tid 12034] [client 20.9.82.33:15476] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shelp.php"] [unique_id "affhNkVhgvCNKBWnaTIfewAAAIo"]
[Mon May 04 07:58:48.325124 2026] [:error] [pid 12051:tid 12072] [client 20.9.82.33:16303] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shelp.php"] [unique_id "affhOOrVB-w_PyOHK6kqsAAAAVM"]
[Mon May 04 07:58:49.782309 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:15443] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seyv.php"] [unique_id "affhOerVB-w_PyOHK6kqtwAAAVI"]
[Mon May 04 07:58:50.840447 2026] [:error] [pid 12051:tid 12059] [client 20.9.82.33:16342] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seyv.php"] [unique_id "affhOurVB-w_PyOHK6kquwAAAUY"]
[Mon May 04 07:58:51.708518 2026] [:error] [pid 11959:tid 11993] [client 20.9.82.33:15472] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seyv.php"] [unique_id "affhOwojk2nvxs7h5KvCWQAAAMU"]
[Mon May 04 07:58:52.791450 2026] [:error] [pid 11959:tid 12007] [client 20.9.82.33:16212] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seyv.php"] [unique_id "affhPAojk2nvxs7h5KvCWwAAANM"]
[Mon May 04 07:58:57.574299 2026] [:error] [pid 11959:tid 12006] [client 20.9.82.33:16320] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad821.php"] [unique_id "affhQQojk2nvxs7h5KvCYAAAANI"]
[Mon May 04 07:58:58.354868 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:15473] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad821.php"] [unique_id "affhQgojk2nvxs7h5KvCYQAAANA"]
[Mon May 04 07:59:03.313253 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:16265] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad821.php"] [unique_id "affhR-rVB-w_PyOHK6kqygAAAU4"]
[Mon May 04 07:59:04.594462 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:16344] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad821.php"] [unique_id "affhSOrVB-w_PyOHK6kqzgAAAUo"]
[Mon May 04 07:59:05.635986 2026] [:error] [pid 11959:tid 11989] [client 20.9.82.33:16257] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8210.php"] [unique_id "affhSQojk2nvxs7h5KvCdAAAAME"]
[Mon May 04 07:59:07.228666 2026] [:error] [pid 12051:tid 12071] [client 20.9.82.33:16306] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8210.php"] [unique_id "affhS-rVB-w_PyOHK6kq1QAAAVI"]
[Mon May 04 07:59:08.902866 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:15484] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8210.php"] [unique_id "affhTOrVB-w_PyOHK6kq2gAAAVY"]
[Mon May 04 07:59:16.600749 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:16349] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8210.php"] [unique_id "affhVEVhgvCNKBWnaTIfhgAAAJM"]
[Mon May 04 07:59:21.576794 2026] [:error] [pid 12022:tid 12026] [client 20.9.82.33:16374] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "affhWUVhgvCNKBWnaTIfowAAAII"]
[Mon May 04 07:59:24.257121 2026] [:error] [pid 11959:tid 11996] [client 20.9.82.33:16301] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "affhXAojk2nvxs7h5KvCeAAAAMg"]
[Mon May 04 07:59:24.954727 2026] [:error] [pid 12022:tid 12038] [client 20.9.82.33:16341] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "affhXEVhgvCNKBWnaTIfqAAAAI4"]
[Mon May 04 07:59:30.912780 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:16336] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sad8rd1.php"] [unique_id "affhYurVB-w_PyOHK6krDQAAAVE"]
[Mon May 04 07:59:31.992590 2026] [:error] [pid 12022:tid 12041] [client 20.9.82.33:16215] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saxzgf5.php"] [unique_id "affhY0VhgvCNKBWnaTIfrQAAAJE"]
[Mon May 04 07:59:33.079910 2026] [:error] [pid 12051:tid 12066] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzgf5.php
[Mon May 04 07:59:33.272105 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/saxzw9t.php
[Mon May 04 07:59:33.476459 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/sder5252u.php
[Mon May 04 07:59:33.668076 2026] [:error] [pid 12051:tid 12056] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/sderty5u.php
[Mon May 04 07:59:33.938198 2026] [:error] [pid 12051:tid 12064] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/hilk.php
[Mon May 04 07:59:34.130080 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/miso.php
[Mon May 04 07:59:34.394268 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Mon May 04 07:59:34.597362 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/checkout.php
[Mon May 04 07:59:34.789681 2026] [:error] [pid 12051:tid 12069] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/fictioner.php
[Mon May 04 07:59:35.077934 2026] [:error] [pid 12051:tid 12054] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Mon May 04 07:59:35.505610 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:16371] File does not exist: /usr/local/apache/htdocs/suspended-page/xxa.php
[Mon May 04 07:59:35.693538 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:16371] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "affhZ-rVB-w_PyOHK6krJAAAAUA"]
[Mon May 04 07:59:37.087025 2026] [:error] [pid 12022:tid 12036] [client 20.9.82.33:15424] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "affhaUVhgvCNKBWnaTIfsQAAAIw"]
[Mon May 04 07:59:38.058767 2026] [:error] [pid 11959:tid 12005] [client 20.9.82.33:16259] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "affhagojk2nvxs7h5KvCgQAAANE"]
[Mon May 04 07:59:39.921684 2026] [:error] [pid 12051:tid 12053] [client 20.9.82.33:16323] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "affha-rVB-w_PyOHK6krLwAAAUA"]
[Mon May 04 07:59:45.404071 2026] [:error] [pid 12022:tid 12025] [client 20.9.82.33:15429] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asyn-upload.php"] [unique_id "affhcUVhgvCNKBWnaTIfvAAAAIE"]
[Mon May 04 07:59:46.465146 2026] [:error] [pid 11959:tid 12011] [client 20.9.82.33:16260] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asyn-upload.php"] [unique_id "affhcgojk2nvxs7h5KvCiAAAANc"]
[Mon May 04 07:59:47.787318 2026] [:error] [pid 12022:tid 12031] [client 20.9.82.33:15486] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asyn-upload.php"] [unique_id "affhc0VhgvCNKBWnaTIfvgAAAIc"]
[Mon May 04 07:59:48.838755 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:15483] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-asyn-upload.php"] [unique_id "affhdEVhgvCNKBWnaTIfwgAAAJM"]
[Mon May 04 07:59:51.653943 2026] [:error] [pid 12022:tid 12024] [client 20.9.82.33:15478] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "affhd0VhgvCNKBWnaTIfygAAAIA"]
[Mon May 04 07:59:52.566248 2026] [:error] [pid 12051:tid 12077] [client 20.9.82.33:16334] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "affheOrVB-w_PyOHK6krRQAAAVg"]
[Mon May 04 07:59:54.912307 2026] [:error] [pid 12051:tid 12073] [client 20.9.82.33:16276] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "affheurVB-w_PyOHK6krSwAAAVQ"]
[Mon May 04 07:59:56.214620 2026] [:error] [pid 11959:tid 12004] [client 20.9.82.33:15439] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/redixsx.php"] [unique_id "affhfAojk2nvxs7h5KvCkwAAANA"]
[Mon May 04 07:59:57.019640 2026] [:error] [pid 12022:tid 12044] [client 20.9.82.33:16332] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "affhfUVhgvCNKBWnaTIf0gAAAJQ"]
[Mon May 04 07:59:58.063829 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:15453] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "affhfurVB-w_PyOHK6krUQAAAUk"]
[Mon May 04 07:59:59.160111 2026] [:error] [pid 12051:tid 12058] [client 20.9.82.33:15456] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "affhf-rVB-w_PyOHK6krVAAAAUU"]
[Mon May 04 08:00:01.295381 2026] [:error] [pid 12051:tid 12061] [client 20.9.82.33:15465] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alpha.php"] [unique_id "affhgerVB-w_PyOHK6krWgAAAUg"]
[Mon May 04 08:00:02.895781 2026] [:error] [pid 11959:tid 11993] [client 20.9.82.33:16225] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "affhggojk2nvxs7h5KvCmwAAAMU"]
[Mon May 04 08:00:05.077776 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:16333] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "affhherVB-w_PyOHK6krYAAAAVU"]
[Mon May 04 08:00:07.333899 2026] [:error] [pid 12051:tid 12067] [client 20.9.82.33:16162] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "affhh-rVB-w_PyOHK6krYwAAAU4"]
[Mon May 04 08:00:09.318804 2026] [:error] [pid 12051:tid 12062] [client 20.9.82.33:16322] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "affhierVB-w_PyOHK6krZwAAAUk"]
[Mon May 04 08:00:10.727827 2026] [:error] [pid 12051:tid 12063] [client 20.9.82.33:15471] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/67.php"] [unique_id "affhiurVB-w_PyOHK6krawAAAUo"]
[Mon May 04 08:00:12.254101 2026] [:error] [pid 11959:tid 11988] [client 20.9.82.33:16361] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/67.php"] [unique_id "affhjAojk2nvxs7h5KvCoAAAAMA"]
[Mon May 04 08:00:13.069329 2026] [:error] [pid 11958:tid 11974] [client 20.9.82.33:16316] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/67.php"] [unique_id "affhjTAK_o2NLEdfAUklTAAAAE0"]
[Mon May 04 08:00:14.430061 2026] [:error] [pid 12051:tid 12075] [client 20.9.82.33:16298] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/67.php"] [unique_id "affhjurVB-w_PyOHK6krdwAAAVY"]
[Mon May 04 08:00:15.741031 2026] [:error] [pid 12022:tid 12048] [client 20.9.82.33:16264] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1mrX.php"] [unique_id "affhj0VhgvCNKBWnaTIf8AAAAJg"]
[Mon May 04 08:00:16.817264 2026] [:error] [pid 11958:tid 11981] [client 20.9.82.33:15432] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1mrX.php"] [unique_id "affhkDAK_o2NLEdfAUklpQAAAFQ"]
[Mon May 04 08:00:19.057444 2026] [:error] [pid 11958:tid 11980] [client 20.9.82.33:16292] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1mrX.php"] [unique_id "affhkzAK_o2NLEdfAUklrgAAAFM"]
[Mon May 04 08:00:19.931621 2026] [:error] [pid 11958:tid 11964] [client 20.9.82.33:15464] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1mrX.php"] [unique_id "affhkzAK_o2NLEdfAUklswAAAEM"]
[Mon May 04 08:00:23.311041 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:16347] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x402.php"] [unique_id "affhl0VhgvCNKBWnaTIgBwAAAJM"]
[Mon May 04 08:00:25.933467 2026] [:error] [pid 12022:tid 12027] [client 20.9.82.33:15461] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x402.php"] [unique_id "affhmUVhgvCNKBWnaTIgCwAAAIM"]
[Mon May 04 08:00:28.245044 2026] [:error] [pid 12051:tid 12070] [client 20.9.82.33:16339] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x402.php"] [unique_id "affhnOrVB-w_PyOHK6kriQAAAVE"]
[Mon May 04 08:00:29.379981 2026] [:error] [pid 11959:tid 11989] [client 20.9.82.33:16358] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x402.php"] [unique_id "affhnQojk2nvxs7h5KvC4wAAAME"]
[Mon May 04 08:00:34.950439 2026] [:error] [pid 12051:tid 12074] [client 20.9.82.33:16359] [client 20.9.82.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/485.php"] [unique_id "affhourVB-w_PyOHK6krkwAAAVU"]
[Mon May 04 08:00:37.039738 2026] [:error] [pid 12022:tid 12043] [client 20.9.82.33:16199] File does not exist: /usr/local/apache/htdocs/suspended-page/485.php
[Mon May 04 08:00:37.228580 2026] [:error] [pid 12022:tid 12042] [client 20.9.82.33:16199] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Mon May 04 08:00:37.428950 2026] [:error] [pid 12022:tid 12037] [client 20.9.82.33:16199] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Mon May 04 10:24:40.508653 2026] [:error] [pid 12022:tid 12035] [client 45.94.31.15:52700] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Mon May 04 10:24:41.489436 2026] [:error] [pid 12051:tid 12061] [client 45.94.31.15:52774] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afgDaerVB-w_PyOHK6louwAAAUg"]
[Mon May 04 10:24:41.991493 2026] [:error] [pid 12022:tid 12038] [client 45.94.31.15:52818] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afgDaUVhgvCNKBWnaTJOZgAAAI4"]
[Mon May 04 10:24:42.479183 2026] [:error] [pid 12022:tid 12025] [client 45.94.31.15:52861] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afgDakVhgvCNKBWnaTJOZwAAAIE"]
[Mon May 04 10:24:43.475349 2026] [:error] [pid 12022:tid 12046] [client 45.94.31.15:52953] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "afgDa0VhgvCNKBWnaTJOawAAAJY"]
[Mon May 04 10:24:43.965176 2026] [:error] [pid 12051:tid 12072] [client 45.94.31.15:53014] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Mon May 04 10:24:44.461948 2026] [:error] [pid 12022:tid 12027] [client 45.94.31.15:53072] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Mon May 04 10:25:25.823353 2026] [:error] [pid 11959:tid 11988] [client 43.138.68.113:44476] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afgDlQojk2nvxs7h5KvnXQAAAMA"]
[Mon May 04 12:52:30.487326 2026] [:error] [pid 12022:tid 12040] [client 94.247.172.129:8214] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afgmDkVhgvCNKBWnaTJ86gAAAJA"]
[Mon May 04 13:21:32.815351 2026] [:error] [pid 11959:tid 11990] [client 43.166.134.114:36540] [client 43.166.134.114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afgs3Aojk2nvxs7h5KsGwgAAAMI"]
[Mon May 04 15:45:06.703816 2026] [:error] [pid 3341:tid 3348] [client 136.107.232.91:65215] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "afhOgk9o3_LordU0wW7qbgAAAIQ"]
[Mon May 04 15:45:07.133030 2026] [:error] [pid 3341:tid 3364] [client 136.107.232.91:50501] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "afhOg09o3_LordU0wW7qeAAAAJQ"]
[Mon May 04 15:45:07.560352 2026] [:error] [pid 61044:tid 61109] [client 136.107.232.91:52220] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afhOg0w8w2zZZXI6H1tmJQAAAAc"]
[Mon May 04 18:16:18.530848 2026] [:error] [pid 3341:tid 3354] [client 43.153.35.128:52000] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afhx8k9o3_LordU0wW4cSQAAAIo"]
[Mon May 04 20:16:19.474376 2026] [:error] [pid 61043:tid 61081] [client 43.166.244.251:41972] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afiOE58-LwtfURjiAbC7iwAAAEY"]
[Mon May 04 20:24:07.905208 2026] [:error] [pid 61150:tid 61161] [client 34.24.211.32:55416] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afiP5-8QXWVLiwIGVpd_6AAAAUg"]
[Mon May 04 20:59:53.684624 2026] [:error] [pid 61043:tid 61091] [client 209.87.169.25:44873] [client 209.87.169.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afiYSZ8-LwtfURjiAbDFIwAAAFA"]
[Mon May 04 21:46:39.886082 2026] [:error] [pid 61044:tid 61104] [client 209.87.169.208:50761] [client 209.87.169.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afijP0w8w2zZZXI6H1umUQAAAAI"]
[Mon May 04 23:10:19.254084 2026] [:error] [pid 61150:tid 61170] [client 146.56.197.150:39386] [client 146.56.197.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afi22-8QXWVLiwIGVpefuQAAAVE"]
[Tue May 05 06:15:28.476932 2026] [:error] [pid 39071:tid 39083] [client 43.130.3.122:34310] [client 43.130.3.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afkagIvmnRMz9gRzix1e8wAAAAM"]
[Tue May 05 08:44:13.508500 2026] [:error] [pid 39071:tid 39081] [client 34.32.88.132:34288] [client 34.32.88.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "afk9XYvmnRMz9gRzix3jQgAAAAE"]
[Tue May 05 10:34:48.729533 2026] [:error] [pid 25744:tid 25782] [client 43.140.247.223:45228] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aflXSCR8IuyzjkW06ONrLgAAAIg"]
[Tue May 05 11:26:37.549353 2026] [:error] [pid 25745:tid 25820] [client 43.160.240.216:33140] [client 43.160.240.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afljbZsd7hb7vrvCNBnMvQAAANM"]
[Tue May 05 18:34:03.546781 2026] [:error] [pid 25744:tid 25791] [client 172.178.119.117:32541] [client 172.178.119.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.178.119.117, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/wp/xmlrpc.php"] [unique_id "afnHmyR8IuyzjkW06OPWrgAAAJE"]
[Tue May 05 19:18:45.985889 2026] [:error] [pid 25744:tid 25793] [client 170.106.35.153:43866] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afnSFSR8IuyzjkW06OPf7wAAAJM"]
[Wed May 06 02:02:31.513405 2026] [:error] [pid 25743:tid 25768] [client 43.154.250.181:57290] [client 43.154.250.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afowt2-PCMRhF5DdUnM6xQAAABU"]
[Wed May 06 04:09:14.542442 2026] [:error] [pid 48759:tid 48845] [client 45.154.98.197:50261] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Wed May 06 04:09:15.621086 2026] [:error] [pid 48759:tid 48833] [client 45.154.98.197:50698] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afpOa6mcftH9JrQl_yG0UQAAAIs"]
[Wed May 06 04:09:16.131424 2026] [:error] [pid 48867:tid 48876] [client 45.154.98.197:50956] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afpObFZQ-8ZcCbMZPy7mJgAAAMY"]
[Wed May 06 04:09:16.655560 2026] [:error] [pid 48758:tid 48814] [client 45.154.98.197:51206] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afpObDENoN-kMgC5tXgH0AAAAFM"]
[Wed May 06 04:09:17.692706 2026] [:error] [pid 48867:tid 48870] [client 45.154.98.197:51620] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "afpObVZQ-8ZcCbMZPy7mKQAAAMA"]
[Wed May 06 04:09:18.213680 2026] [:error] [pid 48867:tid 48890] [client 45.154.98.197:51751] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Wed May 06 04:09:18.728960 2026] [:error] [pid 48758:tid 48808] [client 45.154.98.197:51905] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Wed May 06 05:05:08.064541 2026] [:error] [pid 48867:tid 48892] [client 166.88.26.191:60234] [client 166.88.26.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/nacos/"] [unique_id "afpbhFZQ-8ZcCbMZPy79mwAAANY"]
[Wed May 06 07:11:33.616064 2026] [:error] [pid 48759:tid 48831] [client 43.130.131.18:38542] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afp5JamcftH9JrQl_yHe0AAAAIk"]
[Wed May 06 10:09:14.414531 2026] [:error] [pid 9789:tid 9808] [client 24.199.121.112:58758] [client 24.199.121.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.121.112, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "afqiyj_YStPJSCHPkUUhawAAAFE"]
[Wed May 06 10:09:14.418468 2026] [:error] [pid 9789:tid 9808] [client 24.199.121.112:58758] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed May 06 11:18:11.385189 2026] [:error] [pid 9653:tid 9708] [client 192.144.148.122:50008] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afqy86hJ49Xc4dqq0B530QAAAAo"]
[Wed May 06 11:33:19.839089 2026] [:error] [pid 9789:tid 9800] [client 167.99.248.70:54990] [client 167.99.248.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.248.70, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "afq2fz_YStPJSCHPkUUzZQAAAEk"]
[Wed May 06 11:33:19.844196 2026] [:error] [pid 9789:tid 9800] [client 167.99.248.70:54990] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Wed May 06 14:31:46.924206 2026] [:error] [pid 9653:tid 9713] [client 43.163.4.179:38368] [client 43.163.4.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afrgUqhJ49Xc4dqq0B6lBgAAAA8"]
[Wed May 06 14:59:19.845272 2026] [:error] [pid 9653:tid 9716] [client 43.166.162.82:41686] [client 43.166.162.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afrmx6hJ49Xc4dqq0B6ufgAAABI"]
[Wed May 06 15:31:46.643046 2026] [:error] [pid 482:tid 497] [client 129.226.209.117:33368] [client 129.226.209.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afruYsxs8HOc_nWgOW4PegAAAc0"]
[Wed May 06 15:53:53.134544 2026] [:error] [pid 13443:tid 13445] [client 43.157.188.74:59150] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afrzkQCyfZallDmsQreH_QAAAUA"]
[Wed May 06 16:18:57.610038 2026] [:error] [pid 482:tid 484] [client 170.106.8.192:60338] [client 170.106.8.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afr5ccxs8HOc_nWgOW4ZAQAAAcA"]
[Wed May 06 17:20:22.415739 2026] [:error] [pid 592:tid 601] [client 43.156.125.227:38620] [client 43.156.125.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afsH1piX28mb6xLi2PyeQQAAAoU"]
[Wed May 06 18:06:22.980144 2026] [:error] [pid 9789:tid 9800] [client 43.167.241.46:57678] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afsSnj_YStPJSCHPkUV2jgAAAEk"]
[Wed May 06 19:17:09.181937 2026] [:error] [pid 9664:tid 9763] [client 43.156.50.197:46576] [client 43.156.50.197] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afsjNQH4OZbrg1SjsBM59gAAAIE"]
[Wed May 06 20:00:22.494463 2026] [:error] [pid 13414:tid 13423] [client 43.156.249.28:44672] [client 43.156.249.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afstVkuJQpWjVpJTu_kbFwAAAQc"]
[Wed May 06 20:53:49.810799 2026] [:error] [pid 482:tid 508] [client 170.106.8.38:50420] [client 170.106.8.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afs53cxs8HOc_nWgOW5SrgAAAdY"]
[Wed May 06 20:55:21.712563 2026] [:error] [pid 592:tid 615] [client 2.24.75.104:33072] [client 2.24.75.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "afs6OZiX28mb6xLi2PyuwQAAApE"]
[Wed May 06 20:55:23.642037 2026] [:error] [pid 482:tid 497] [client 2.24.75.104:33168] [client 2.24.75.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "afs6O8xs8HOc_nWgOW5S2AAAAc0"]
[Wed May 06 20:58:45.652100 2026] [:error] [pid 9789:tid 9800] [client 43.164.133.138:39442] [client 43.164.133.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afs7BT_YStPJSCHPkUWVWQAAAEk"]
[Wed May 06 21:14:14.483418 2026] [:error] [pid 9659:tid 9737] [client 173.239.214.27:62711] [client 173.239.214.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afs-pvwJnWjd8JHpBtuU8AAAAMM"]
[Wed May 06 22:39:24.230964 2026] [:error] [pid 9659:tid 9742] [client 34.106.188.217:37176] [client 34.106.188.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "aftSnPwJnWjd8JHpBtudVgAAAMg"]
[Wed May 06 22:52:50.476040 2026] [:error] [pid 9653:tid 9712] [client 43.160.225.169:46724] [client 43.160.225.169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aftVwqhJ49Xc4dqq0B4zPwAAAA4"]
[Thu May 07 01:56:54.039553 2026] [:error] [pid 9789:tid 9811] [client 43.157.170.126:41652] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afuA5j_YStPJSCHPkUXWIgAAAFQ"]
[Thu May 07 04:16:11.924661 2026] [:error] [pid 29606:tid 29655] [client 43.134.5.250:38032] [client 43.134.5.250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afuhixR5HjZ1PlSAiKtI7wAAAE4"]
[Thu May 07 04:59:22.708982 2026] [:error] [pid 29607:tid 29675] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/shoha.php
[Thu May 07 04:59:22.923319 2026] [:error] [pid 29607:tid 29674] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-thi.php
[Thu May 07 04:59:23.138336 2026] [:error] [pid 29607:tid 29672] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-slss.php
[Thu May 07 04:59:23.352858 2026] [:error] [pid 29607:tid 29686] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Thu May 07 04:59:23.569035 2026] [:error] [pid 29607:tid 29678] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/ftde.php
[Thu May 07 04:59:23.785047 2026] [:error] [pid 29607:tid 29687] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/tires.php
[Thu May 07 04:59:24.007330 2026] [:error] [pid 29607:tid 29683] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Thu May 07 04:59:24.221537 2026] [:error] [pid 29607:tid 29671] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Thu May 07 04:59:24.434558 2026] [:error] [pid 29607:tid 29684] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Thu May 07 04:59:24.648438 2026] [:error] [pid 29607:tid 29682] [client 20.43.25.175:32633] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Thu May 07 04:59:24.860206 2026] [:error] [pid 29607:tid 29690] [client 20.43.25.175:32633] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afurrKbP7TJOAh7WSUNbWwAAAJY"]
[Thu May 07 04:59:25.278037 2026] [:error] [pid 4539:tid 4553] [client 20.43.25.175:32624] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afurrYPEZE1565sDGnwN_AAAAQw"]
[Thu May 07 04:59:25.694691 2026] [:error] [pid 29606:tid 29665] [client 20.43.25.175:32576] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afurrRR5HjZ1PlSAiKtYPwAAAFg"]
[Thu May 07 04:59:26.108930 2026] [:error] [pid 29606:tid 29643] [client 20.43.25.175:32617] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afurrhR5HjZ1PlSAiKtYQQAAAEI"]
[Thu May 07 04:59:26.519596 2026] [:error] [pid 29606:tid 29652] [client 20.43.25.175:32619] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afurrhR5HjZ1PlSAiKtYQwAAAEs"]
[Thu May 07 04:59:26.934806 2026] [:error] [pid 29607:tid 29670] [client 20.43.25.175:32592] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afurrqbP7TJOAh7WSUNbXgAAAII"]
[Thu May 07 04:59:27.352604 2026] [:error] [pid 29605:tid 29615] [client 20.43.25.175:32589] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afurr4nxrTjETioEY0TWqgAAAAE"]
[Thu May 07 04:59:27.779812 2026] [:error] [pid 29607:tid 29679] [client 20.43.25.175:32591] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afurr6bP7TJOAh7WSUNbYQAAAIs"]
[Thu May 07 04:59:28.203949 2026] [:error] [pid 29605:tid 29634] [client 20.43.25.175:32634] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "afursInxrTjETioEY0TWqwAAABQ"]
[Thu May 07 04:59:28.617993 2026] [:error] [pid 29710:tid 29722] [client 20.43.25.175:32514] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "afursP0atTQld9Y2ht_N3wAAAMo"]
[Thu May 07 04:59:29.029677 2026] [:error] [pid 4539:tid 4548] [client 20.43.25.175:32608] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "afursYPEZE1565sDGnwOAgAAAQc"]
[Thu May 07 04:59:29.448060 2026] [:error] [pid 29607:tid 29677] [client 20.43.25.175:32523] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "afursabP7TJOAh7WSUNbZgAAAIk"]
[Thu May 07 04:59:29.866295 2026] [:error] [pid 29606:tid 29647] [client 20.43.25.175:32525] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "afursRR5HjZ1PlSAiKtYRAAAAEY"]
[Thu May 07 04:59:30.279283 2026] [:error] [pid 29710:tid 29734] [client 20.43.25.175:32526] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "afursv0atTQld9Y2ht_N4QAAANY"]
[Thu May 07 04:59:30.693091 2026] [:error] [pid 29607:tid 29685] [client 20.43.25.175:32555] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "afursqbP7TJOAh7WSUNbaQAAAJE"]
[Thu May 07 04:59:31.105866 2026] [:error] [pid 29607:tid 29680] [client 20.43.25.175:32587] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "afurs6bP7TJOAh7WSUNbawAAAIw"]
[Thu May 07 04:59:31.519070 2026] [:error] [pid 29607:tid 29672] [client 20.43.25.175:32590] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "afurs6bP7TJOAh7WSUNbbQAAAIQ"]
[Thu May 07 04:59:31.952088 2026] [:error] [pid 29605:tid 29620] [client 20.43.25.175:32540] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "afurs4nxrTjETioEY0TWrAAAAAY"]
[Thu May 07 04:59:32.372973 2026] [:error] [pid 29606:tid 29659] [client 20.43.25.175:32524] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "afurtBR5HjZ1PlSAiKtYRgAAAFI"]
[Thu May 07 04:59:32.788463 2026] [:error] [pid 29606:tid 29662] [client 20.43.25.175:32623] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "afurtBR5HjZ1PlSAiKtYRwAAAFU"]
[Thu May 07 04:59:33.206331 2026] [:error] [pid 29710:tid 29733] [client 20.43.25.175:32516] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "afurtf0atTQld9Y2ht_N5gAAANU"]
[Thu May 07 04:59:33.626646 2026] [:error] [pid 29710:tid 29727] [client 20.43.25.175:32618] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "afurtf0atTQld9Y2ht_N5wAAAM8"]
[Thu May 07 04:59:34.048653 2026] [:error] [pid 29607:tid 29677] [client 20.43.25.175:32601] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "afurtqbP7TJOAh7WSUNbbwAAAIk"]
[Thu May 07 04:59:34.461626 2026] [:error] [pid 29607:tid 29676] [client 20.43.25.175:32451] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "afurtqbP7TJOAh7WSUNbcAAAAIg"]
[Thu May 07 04:59:34.875826 2026] [:error] [pid 29606:tid 29657] [client 20.43.25.175:32585] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/revealability.php"] [unique_id "afurthR5HjZ1PlSAiKtYSwAAAFA"]
[Thu May 07 04:59:35.287881 2026] [:error] [pid 29607:tid 29680] [client 20.43.25.175:32631] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/revealability.php"] [unique_id "afurt6bP7TJOAh7WSUNbcgAAAIw"]
[Thu May 07 04:59:35.706707 2026] [:error] [pid 29606:tid 29644] [client 20.43.25.175:32529] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/revealability.php"] [unique_id "afurtxR5HjZ1PlSAiKtYTQAAAEM"]
[Thu May 07 04:59:36.132094 2026] [:error] [pid 29606:tid 29656] [client 20.43.25.175:32596] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/revealability.php"] [unique_id "afuruBR5HjZ1PlSAiKtYTgAAAE8"]
[Thu May 07 04:59:36.549652 2026] [:error] [pid 29606:tid 29658] [client 20.43.25.175:32627] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "afuruBR5HjZ1PlSAiKtYUAAAAFE"]
[Thu May 07 04:59:36.963793 2026] [:error] [pid 29606:tid 29660] [client 20.43.25.175:32625] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "afuruBR5HjZ1PlSAiKtYUwAAAFM"]
[Thu May 07 04:59:37.384841 2026] [:error] [pid 29606:tid 29664] [client 20.43.25.175:32519] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "afuruRR5HjZ1PlSAiKtYVgAAAFc"]
[Thu May 07 04:59:37.800546 2026] [:error] [pid 29710:tid 29724] [client 20.43.25.175:32528] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "afuruf0atTQld9Y2ht_N6gAAAMw"]
[Thu May 07 04:59:38.214843 2026] [:error] [pid 29605:tid 29624] [client 20.43.25.175:32622] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afuruonxrTjETioEY0TWsAAAAAo"]
[Thu May 07 04:59:38.635015 2026] [:error] [pid 29607:tid 29690] [client 20.43.25.175:32610] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afuruqbP7TJOAh7WSUNbdwAAAJY"]
[Thu May 07 04:59:39.050976 2026] [:error] [pid 29605:tid 29615] [client 20.43.25.175:32588] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afuru4nxrTjETioEY0TWtQAAAAE"]
[Thu May 07 04:59:39.475958 2026] [:error] [pid 29607:tid 29671] [client 20.43.25.175:32538] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afuru6bP7TJOAh7WSUNbeQAAAIM"]
[Thu May 07 04:59:39.892046 2026] [:error] [pid 29710:tid 29716] [client 20.43.25.175:32530] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "afuru_0atTQld9Y2ht_N7QAAAMQ"]
[Thu May 07 04:59:40.307806 2026] [:error] [pid 29710:tid 29733] [client 20.43.25.175:32621] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "afurvP0atTQld9Y2ht_N7gAAANU"]
[Thu May 07 04:59:40.717586 2026] [:error] [pid 4539:tid 4542] [client 20.43.25.175:32595] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "afurvIPEZE1565sDGnwOBwAAAQE"]
[Thu May 07 04:59:41.133356 2026] [:error] [pid 29710:tid 29712] [client 20.43.25.175:32613] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "afurvf0atTQld9Y2ht_N8gAAAMA"]
[Thu May 07 04:59:41.552877 2026] [:error] [pid 29607:tid 29682] [client 20.43.25.175:32570] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "afurvabP7TJOAh7WSUNbfQAAAI4"]
[Thu May 07 04:59:41.969731 2026] [:error] [pid 4539:tid 4558] [client 20.43.25.175:32548] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "afurvYPEZE1565sDGnwOCAAAARE"]
[Thu May 07 04:59:42.387955 2026] [:error] [pid 4539:tid 4554] [client 20.43.25.175:32602] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "afurvoPEZE1565sDGnwOCQAAAQ0"]
[Thu May 07 04:59:42.801213 2026] [:error] [pid 29607:tid 29688] [client 20.43.25.175:32581] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "afurvqbP7TJOAh7WSUNbgQAAAJQ"]
[Thu May 07 04:59:43.212754 2026] [:error] [pid 4539:tid 4546] [client 20.43.25.175:32626] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "afurv4PEZE1565sDGnwOCwAAAQU"]
[Thu May 07 04:59:43.629571 2026] [:error] [pid 4539:tid 4544] [client 20.43.25.175:32609] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "afurv4PEZE1565sDGnwODQAAAQM"]
[Thu May 07 04:59:44.041789 2026] [:error] [pid 29710:tid 29722] [client 20.43.25.175:32637] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "afurwP0atTQld9Y2ht_N9QAAAMo"]
[Thu May 07 04:59:44.454887 2026] [:error] [pid 29710:tid 29734] [client 20.43.25.175:32632] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "afurwP0atTQld9Y2ht_N9gAAANY"]
[Thu May 07 04:59:44.870521 2026] [:error] [pid 29607:tid 29690] [client 20.43.25.175:32559] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell20211028.php"] [unique_id "afurwKbP7TJOAh7WSUNbhAAAAJY"]
[Thu May 07 04:59:45.289079 2026] [:error] [pid 29606:tid 29664] [client 20.43.25.175:32639] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell20211028.php"] [unique_id "afurwRR5HjZ1PlSAiKtYWAAAAFc"]
[Thu May 07 04:59:45.701754 2026] [:error] [pid 29607:tid 29671] [client 20.43.25.175:32515] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell20211028.php"] [unique_id "afurwabP7TJOAh7WSUNbhgAAAIM"]
[Thu May 07 04:59:46.126865 2026] [:error] [pid 29710:tid 29725] [client 20.43.25.175:32615] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell20211028.php"] [unique_id "afurwv0atTQld9Y2ht_N-QAAAM0"]
[Thu May 07 04:59:46.550110 2026] [:error] [pid 29605:tid 29615] [client 20.43.25.175:32503] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "afurwonxrTjETioEY0TWvgAAAAE"]
[Thu May 07 04:59:46.983607 2026] [:error] [pid 29607:tid 29682] [client 20.43.25.175:32616] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "afurwqbP7TJOAh7WSUNbigAAAI4"]
[Thu May 07 04:59:47.404080 2026] [:error] [pid 4539:tid 4541] [client 20.43.25.175:32479] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "afurw4PEZE1565sDGnwODwAAAQA"]
[Thu May 07 04:59:47.816511 2026] [:error] [pid 29607:tid 29680] [client 20.43.25.175:32542] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "afurw6bP7TJOAh7WSUNbjQAAAIw"]
[Thu May 07 04:59:48.231791 2026] [:error] [pid 4539:tid 4561] [client 20.43.25.175:32577] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "afurxIPEZE1565sDGnwOEQAAARQ"]
[Thu May 07 04:59:48.648937 2026] [:error] [pid 4539:tid 4551] [client 20.43.25.175:32571] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "afurxIPEZE1565sDGnwOEwAAAQo"]
[Thu May 07 04:59:49.067006 2026] [:error] [pid 29607:tid 29690] [client 20.43.25.175:32563] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "afurxabP7TJOAh7WSUNbkAAAAJY"]
[Thu May 07 04:59:49.488537 2026] [:error] [pid 29607:tid 29671] [client 20.43.25.175:32582] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "afurxabP7TJOAh7WSUNbkwAAAIM"]
[Thu May 07 04:59:49.901797 2026] [:error] [pid 29607:tid 29681] [client 20.43.25.175:32561] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "afurxabP7TJOAh7WSUNblQAAAI0"]
[Thu May 07 04:59:50.314575 2026] [:error] [pid 29607:tid 29684] [client 20.43.25.175:32583] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "afurxqbP7TJOAh7WSUNblwAAAJA"]
[Thu May 07 04:59:50.728162 2026] [:error] [pid 29710:tid 29714] [client 20.43.25.175:32568] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "afurxv0atTQld9Y2ht_N_wAAAMI"]
[Thu May 07 04:59:51.150406 2026] [:error] [pid 4539:tid 4542] [client 20.43.25.175:32455] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "afurx4PEZE1565sDGnwOFgAAAQE"]
[Thu May 07 04:59:51.567860 2026] [:error] [pid 4539:tid 4546] [client 20.43.25.175:32551] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "afurx4PEZE1565sDGnwOFwAAAQU"]
[Thu May 07 04:59:51.991019 2026] [:error] [pid 4539:tid 4562] [client 20.43.25.175:32549] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "afurx4PEZE1565sDGnwOGQAAARU"]
[Thu May 07 04:59:52.413079 2026] [:error] [pid 29607:tid 29675] [client 20.43.25.175:32404] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "afuryKbP7TJOAh7WSUNbnAAAAIc"]
[Thu May 07 04:59:52.825468 2026] [:error] [pid 29605:tid 29616] [client 20.43.25.175:32518] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x.php"] [unique_id "afuryInxrTjETioEY0TWyQAAAAI"]
[Thu May 07 04:59:53.243602 2026] [:error] [pid 29605:tid 29628] [client 20.43.25.175:32472] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "afuryYnxrTjETioEY0TWygAAAA4"]
[Thu May 07 04:59:53.663340 2026] [:error] [pid 29605:tid 29615] [client 20.43.25.175:32539] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "afuryYnxrTjETioEY0TWywAAAAE"]
[Thu May 07 04:59:54.075440 2026] [:error] [pid 29605:tid 29617] [client 20.43.25.175:32554] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "afuryonxrTjETioEY0TWzQAAAAM"]
[Thu May 07 04:59:54.492190 2026] [:error] [pid 29606:tid 29641] [client 20.43.25.175:32594] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "afuryhR5HjZ1PlSAiKtYXAAAAEA"]
[Thu May 07 04:59:54.904475 2026] [:error] [pid 29607:tid 29668] [client 20.43.25.175:32604] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "afuryqbP7TJOAh7WSUNbngAAAIA"]
[Thu May 07 04:59:55.331959 2026] [:error] [pid 29607:tid 29670] [client 20.43.25.175:32628] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "afury6bP7TJOAh7WSUNbnwAAAII"]
[Thu May 07 04:59:55.750321 2026] [:error] [pid 29606:tid 29654] [client 20.43.25.175:32603] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "afuryxR5HjZ1PlSAiKtYXwAAAE0"]
[Thu May 07 04:59:56.162441 2026] [:error] [pid 29606:tid 29663] [client 20.43.25.175:32604] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "afurzBR5HjZ1PlSAiKtYYAAAAFY"]
[Thu May 07 04:59:56.580181 2026] [:error] [pid 29605:tid 29638] [client 20.43.25.175:32546] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "afurzInxrTjETioEY0TW0AAAABg"]
[Thu May 07 04:59:56.998320 2026] [:error] [pid 29607:tid 29675] [client 20.43.25.175:32612] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "afurzKbP7TJOAh7WSUNbogAAAIc"]
[Thu May 07 04:59:57.410720 2026] [:error] [pid 29605:tid 29635] [client 20.43.25.175:32614] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "afurzYnxrTjETioEY0TW0gAAABU"]
[Thu May 07 04:59:57.827969 2026] [:error] [pid 29605:tid 29637] [client 20.43.25.175:32476] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "afurzYnxrTjETioEY0TW1AAAABc"]
[Thu May 07 04:59:58.253179 2026] [:error] [pid 29605:tid 29633] [client 20.43.25.175:32599] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "afurzonxrTjETioEY0TW1QAAABM"]
[Thu May 07 04:59:58.673924 2026] [:error] [pid 29605:tid 29629] [client 20.43.25.175:32547] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "afurzonxrTjETioEY0TW1wAAAA8"]
[Thu May 07 04:59:59.087139 2026] [:error] [pid 29606:tid 29643] [client 20.43.25.175:32597] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "afurzxR5HjZ1PlSAiKtYYQAAAEI"]
[Thu May 07 04:59:59.507826 2026] [:error] [pid 29606:tid 29656] [client 20.43.25.175:32464] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "afurzxR5HjZ1PlSAiKtYYgAAAE8"]
[Thu May 07 04:59:59.931435 2026] [:error] [pid 29605:tid 29626] [client 20.43.25.175:32470] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afurz4nxrTjETioEY0TW3gAAAAw"]
[Thu May 07 05:00:00.361510 2026] [:error] [pid 29605:tid 29638] [client 20.43.25.175:32535] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afur0InxrTjETioEY0TW4AAAABg"]
[Thu May 07 05:00:00.787324 2026] [:error] [pid 29710:tid 29713] [client 20.43.25.175:32477] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afur0P0atTQld9Y2ht_OBwAAAME"]
[Thu May 07 05:00:01.204672 2026] [:error] [pid 29710:tid 29720] [client 20.43.25.175:32532] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afur0f0atTQld9Y2ht_OCAAAAMg"]
[Thu May 07 05:00:01.630379 2026] [:error] [pid 29607:tid 29683] [client 20.43.25.175:32606] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "afur0abP7TJOAh7WSUNbpwAAAI8"]
[Thu May 07 05:00:02.041544 2026] [:error] [pid 4539:tid 4561] [client 20.43.25.175:32586] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "afur0oPEZE1565sDGnwOIwAAARQ"]
[Thu May 07 05:00:02.464453 2026] [:error] [pid 4539:tid 4560] [client 20.43.25.175:32513] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "afur0oPEZE1565sDGnwOJgAAARM"]
[Thu May 07 05:00:02.881651 2026] [:error] [pid 4539:tid 4550] [client 20.43.25.175:32553] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "afur0oPEZE1565sDGnwOKQAAAQk"]
[Thu May 07 05:00:03.300096 2026] [:error] [pid 29607:tid 29668] [client 20.43.25.175:32389] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afur06bP7TJOAh7WSUNbqAAAAIA"]
[Thu May 07 05:00:03.717056 2026] [:error] [pid 29606:tid 29662] [client 20.43.25.175:32505] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afur0xR5HjZ1PlSAiKtYZwAAAFU"]
[Thu May 07 05:00:04.135737 2026] [:error] [pid 4539:tid 4556] [client 20.43.25.175:32483] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afur1IPEZE1565sDGnwOKgAAAQ8"]
[Thu May 07 05:00:04.549044 2026] [:error] [pid 4539:tid 4552] [client 20.43.25.175:32580] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-trackback.php"] [unique_id "afur1IPEZE1565sDGnwOLAAAAQs"]
[Thu May 07 05:00:04.966045 2026] [:error] [pid 4539:tid 4546] [client 20.43.25.175:32572] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afur1IPEZE1565sDGnwOLQAAAQU"]
[Thu May 07 05:00:05.384334 2026] [:error] [pid 4539:tid 4558] [client 20.43.25.175:32521] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afur1YPEZE1565sDGnwOMAAAARE"]
[Thu May 07 05:00:05.798083 2026] [:error] [pid 29607:tid 29686] [client 20.43.25.175:32520] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afur1abP7TJOAh7WSUNbqwAAAJI"]
[Thu May 07 05:00:06.211186 2026] [:error] [pid 29606:tid 29663] [client 20.43.25.175:32478] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afur1hR5HjZ1PlSAiKtYaQAAAFY"]
[Thu May 07 05:00:06.620770 2026] [:error] [pid 29710:tid 29722] [client 20.43.25.175:32487] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "afur1v0atTQld9Y2ht_OCwAAAMo"]
[Thu May 07 05:00:07.061857 2026] [:error] [pid 29710:tid 29736] [client 20.43.25.175:32557] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "afur1_0atTQld9Y2ht_ODgAAANg"]
[Thu May 07 05:00:07.480025 2026] [:error] [pid 29710:tid 29732] [client 20.43.25.175:32449] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "afur1_0atTQld9Y2ht_OEAAAANQ"]
[Thu May 07 05:00:07.897351 2026] [:error] [pid 29605:tid 29638] [client 20.43.25.175:32517] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "afur14nxrTjETioEY0TW7gAAABg"]
[Thu May 07 05:00:08.312732 2026] [:error] [pid 29606:tid 29645] [client 20.43.25.175:32527] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afur2BR5HjZ1PlSAiKtYagAAAEQ"]
[Thu May 07 05:00:08.725510 2026] [:error] [pid 4539:tid 4550] [client 20.43.25.175:32573] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afur2IPEZE1565sDGnwOMgAAAQk"]
[Thu May 07 05:00:09.141804 2026] [:error] [pid 29605:tid 29637] [client 20.43.25.175:32465] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afur2YnxrTjETioEY0TW8QAAABc"]
[Thu May 07 05:00:09.558798 2026] [:error] [pid 29605:tid 29633] [client 20.43.25.175:32460] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afur2YnxrTjETioEY0TW8gAAABM"]
[Thu May 07 05:00:09.971697 2026] [:error] [pid 4539:tid 4543] [client 20.43.25.175:32545] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "afur2YPEZE1565sDGnwONQAAAQI"]
[Thu May 07 05:00:10.390219 2026] [:error] [pid 29710:tid 29726] [client 20.43.25.175:32400] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "afur2v0atTQld9Y2ht_OEwAAAM4"]
[Thu May 07 05:00:10.807013 2026] [:error] [pid 29710:tid 29713] [client 20.43.25.175:32566] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "afur2v0atTQld9Y2ht_OFAAAAME"]
[Thu May 07 05:00:11.227168 2026] [:error] [pid 29607:tid 29679] [client 20.43.25.175:32620] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "afur26bP7TJOAh7WSUNbrQAAAIs"]
[Thu May 07 05:00:11.646557 2026] [:error] [pid 29710:tid 29721] [client 20.43.25.175:32564] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "afur2_0atTQld9Y2ht_OFwAAAMk"]
[Thu May 07 05:00:12.062924 2026] [:error] [pid 29710:tid 29723] [client 20.43.25.175:32605] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "afur3P0atTQld9Y2ht_OGAAAAMs"]
[Thu May 07 05:00:12.478932 2026] [:error] [pid 29606:tid 29641] [client 20.43.25.175:32485] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "afur3BR5HjZ1PlSAiKtYbwAAAEA"]
[Thu May 07 05:00:12.888340 2026] [:error] [pid 29605:tid 29627] [client 20.43.25.175:32397] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "afur3InxrTjETioEY0TW9QAAAA0"]
[Thu May 07 05:00:13.309456 2026] [:error] [pid 29710:tid 29732] [client 20.43.25.175:32437] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "afur3f0atTQld9Y2ht_OGgAAANQ"]
[Thu May 07 05:00:13.725822 2026] [:error] [pid 29606:tid 29654] [client 20.43.25.175:32385] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "afur3RR5HjZ1PlSAiKtYcQAAAE0"]
[Thu May 07 05:00:14.137629 2026] [:error] [pid 29710:tid 29713] [client 20.43.25.175:32629] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "afur3v0atTQld9Y2ht_OHwAAAME"]
[Thu May 07 05:00:14.558075 2026] [:error] [pid 29710:tid 29714] [client 20.43.25.175:32448] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file59.php"] [unique_id "afur3v0atTQld9Y2ht_OIQAAAMI"]
[Thu May 07 05:00:14.983068 2026] [:error] [pid 29710:tid 29723] [client 20.43.25.175:32584] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "afur3v0atTQld9Y2ht_OIwAAAMs"]
[Thu May 07 05:00:15.405355 2026] [:error] [pid 4539:tid 4545] [client 20.43.25.175:32512] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "afur34PEZE1565sDGnwOPAAAAQQ"]
[Thu May 07 05:00:15.828456 2026] [:error] [pid 29710:tid 29719] [client 20.43.25.175:32595] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "afur3_0atTQld9Y2ht_OJwAAAMc"]
[Thu May 07 05:00:16.254497 2026] [:error] [pid 4539:tid 4549] [client 20.43.25.175:32534] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lala.php"] [unique_id "afur4IPEZE1565sDGnwOPwAAAQg"]
[Thu May 07 05:00:16.679715 2026] [:error] [pid 29710:tid 29734] [client 20.43.25.175:32522] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "afur4P0atTQld9Y2ht_OKgAAANY"]
[Thu May 07 05:00:17.130135 2026] [:error] [pid 29710:tid 29732] [client 20.43.25.175:32578] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "afur4f0atTQld9Y2ht_OKwAAANQ"]
[Thu May 07 05:00:17.553280 2026] [:error] [pid 4539:tid 4561] [client 20.43.25.175:32550] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "afur4YPEZE1565sDGnwORAAAARQ"]
[Thu May 07 05:00:17.995765 2026] [:error] [pid 29710:tid 29715] [client 20.43.25.175:32415] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "afur4f0atTQld9Y2ht_OLQAAAMM"]
[Thu May 07 05:00:18.427862 2026] [:error] [pid 4539:tid 4541] [client 20.43.25.175:32565] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afur4oPEZE1565sDGnwORwAAAQA"]
[Thu May 07 05:00:18.846477 2026] [:error] [pid 4539:tid 4547] [client 20.43.25.175:32600] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afur4oPEZE1565sDGnwOSwAAAQY"]
[Thu May 07 05:00:19.273796 2026] [:error] [pid 29710:tid 29723] [client 20.43.25.175:32387] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afur4_0atTQld9Y2ht_OLgAAAMs"]
[Thu May 07 05:00:19.701039 2026] [:error] [pid 29710:tid 29726] [client 20.43.25.175:32403] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "afur4_0atTQld9Y2ht_OMAAAAM4"]
[Thu May 07 05:00:20.121972 2026] [:error] [pid 4539:tid 4556] [client 20.43.25.175:32603] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "afur5IPEZE1565sDGnwOTAAAAQ8"]
[Thu May 07 05:00:20.549336 2026] [:error] [pid 29606:tid 29643] [client 20.43.25.175:32579] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "afur5BR5HjZ1PlSAiKtYcwAAAEI"]
[Thu May 07 05:00:20.981575 2026] [:error] [pid 4539:tid 4559] [client 20.43.25.175:32560] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "afur5IPEZE1565sDGnwOTgAAARI"]
[Thu May 07 05:00:21.400270 2026] [:error] [pid 29710:tid 29717] [client 20.43.25.175:32459] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "afur5f0atTQld9Y2ht_OMwAAAMU"]
[Thu May 07 05:00:21.818552 2026] [:error] [pid 4539:tid 4551] [client 20.43.25.175:32556] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "afur5YPEZE1565sDGnwOUAAAAQo"]
[Thu May 07 05:00:22.235796 2026] [:error] [pid 4539:tid 4561] [client 20.43.25.175:32482] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "afur5oPEZE1565sDGnwOUwAAARQ"]
[Thu May 07 05:00:22.651917 2026] [:error] [pid 29710:tid 29721] [client 20.43.25.175:32537] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "afur5v0atTQld9Y2ht_ONgAAAMk"]
[Thu May 07 05:00:23.062534 2026] [:error] [pid 29710:tid 29726] [client 20.43.25.175:32493] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "afur5_0atTQld9Y2ht_ONwAAAM4"]
[Thu May 07 05:00:23.475782 2026] [:error] [pid 4539:tid 4541] [client 20.43.25.175:32494] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afur54PEZE1565sDGnwOVgAAAQA"]
[Thu May 07 05:00:23.887063 2026] [:error] [pid 29710:tid 29725] [client 20.43.25.175:32390] [client 20.43.25.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afur5_0atTQld9Y2ht_OOgAAAM0"]
[Thu May 07 05:00:24.306622 2026] [:error] [pid 29606:tid 29661] [client 20.43.25.175:32458] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-good.php
[Thu May 07 05:00:24.515852 2026] [:error] [pid 29606:tid 29647] [client 20.43.25.175:32458] File does not exist: /usr/local/apache/htdocs/suspended-page/db.php
[Thu May 07 05:00:24.726701 2026] [:error] [pid 29606:tid 29656] [client 20.43.25.175:32458] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Thu May 07 05:00:24.936390 2026] [:error] [pid 29606:tid 29648] [client 20.43.25.175:32458] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Thu May 07 05:00:25.147069 2026] [:error] [pid 29606:tid 29665] [client 20.43.25.175:32458] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Thu May 07 05:00:25.357051 2026] [:error] [pid 29606:tid 29662] [client 20.43.25.175:32458] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Thu May 07 05:00:25.566342 2026] [:error] [pid 29606:tid 29641] [client 20.43.25.175:32458] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Thu May 07 07:44:10.825086 2026] [:error] [pid 29606:tid 29653] [client 43.165.7.132:41302] [client 43.165.7.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afvSShR5HjZ1PlSAiKuEcwAAAEw"]
[Thu May 07 08:09:31.686173 2026] [:error] [pid 29710:tid 29730] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Thu May 07 08:09:31.879293 2026] [:error] [pid 29710:tid 29731] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/ox.php
[Thu May 07 08:09:32.070852 2026] [:error] [pid 29710:tid 29716] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/htto.php
[Thu May 07 08:09:32.263968 2026] [:error] [pid 29710:tid 29715] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/gpt-sh.php
[Thu May 07 08:09:32.456103 2026] [:error] [pid 29710:tid 29727] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/jp.php
[Thu May 07 08:09:32.647290 2026] [:error] [pid 29710:tid 29720] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Thu May 07 08:09:32.838823 2026] [:error] [pid 29710:tid 29734] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/ta0ol.php
[Thu May 07 08:09:33.029909 2026] [:error] [pid 29710:tid 29714] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/aligk.php
[Thu May 07 08:09:33.221266 2026] [:error] [pid 29710:tid 29725] [client 135.119.49.165:18317] File does not exist: /usr/local/apache/htdocs/suspended-page/users.php
[Thu May 07 08:09:33.601650 2026] [:error] [pid 29710:tid 29712] [client 135.119.49.165:18317] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "afvYPf0atTQld9Y2ht8byAAAAMA"]
[Thu May 07 08:09:33.992115 2026] [:error] [pid 29607:tid 29688] [client 135.119.49.165:18410] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "afvYPabP7TJOAh7WSUOcrQAAAJQ"]
[Thu May 07 08:09:34.389601 2026] [:error] [pid 4539:tid 4546] [client 135.119.49.165:18427] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "afvYPoPEZE1565sDGnx_3QAAAQU"]
[Thu May 07 08:09:34.790379 2026] [:error] [pid 29710:tid 29735] [client 135.119.49.165:18383] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/elp.php"] [unique_id "afvYPv0atTQld9Y2ht8bywAAANc"]
[Thu May 07 08:09:35.174251 2026] [:error] [pid 4539:tid 4551] [client 135.119.49.165:18420] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "afvYP4PEZE1565sDGnx_3gAAAQo"]
[Thu May 07 08:09:35.556196 2026] [:error] [pid 29710:tid 29712] [client 135.119.49.165:18401] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "afvYP_0atTQld9Y2ht8b4QAAAMA"]
[Thu May 07 08:09:35.933966 2026] [:error] [pid 29710:tid 29732] [client 135.119.49.165:18381] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "afvYP_0atTQld9Y2ht8b5gAAANQ"]
[Thu May 07 08:09:36.310952 2026] [:error] [pid 4539:tid 4558] [client 135.119.49.165:18306] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zc-243.php"] [unique_id "afvYQIPEZE1565sDGnx_3wAAARE"]
[Thu May 07 08:09:36.688296 2026] [:error] [pid 4539:tid 4564] [client 135.119.49.165:18400] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bkyac.php"] [unique_id "afvYQIPEZE1565sDGnx_4QAAARc"]
[Thu May 07 08:09:37.093121 2026] [:error] [pid 4539:tid 4554] [client 135.119.49.165:18417] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "afvYQYPEZE1565sDGnx_4wAAAQ0"]
[Thu May 07 08:09:37.486051 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18304] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "afvYQYPEZE1565sDGnx_5gAAAQM"]
[Thu May 07 08:09:37.887858 2026] [:error] [pid 4539:tid 4565] [client 135.119.49.165:18431] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "afvYQYPEZE1565sDGnx_6AAAARg"]
[Thu May 07 08:09:38.269528 2026] [:error] [pid 4539:tid 4548] [client 135.119.49.165:18375] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wziar1.php"] [unique_id "afvYQoPEZE1565sDGnx_6gAAAQc"]
[Thu May 07 08:09:38.653343 2026] [:error] [pid 29710:tid 29729] [client 135.119.49.165:18408] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvYQv0atTQld9Y2ht8cBAAAANE"]
[Thu May 07 08:09:39.033300 2026] [:error] [pid 29710:tid 29724] [client 135.119.49.165:18382] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvYQ_0atTQld9Y2ht8cBgAAAMw"]
[Thu May 07 08:09:39.414025 2026] [:error] [pid 29710:tid 29725] [client 135.119.49.165:18424] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvYQ_0atTQld9Y2ht8cCAAAAM0"]
[Thu May 07 08:09:39.802117 2026] [:error] [pid 4539:tid 4559] [client 135.119.49.165:18343] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvYQ4PEZE1565sDGnx_7AAAARI"]
[Thu May 07 08:09:40.183254 2026] [:error] [pid 29607:tid 29668] [client 135.119.49.165:18324] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "afvYRKbP7TJOAh7WSUOcygAAAIA"]
[Thu May 07 08:09:40.556564 2026] [:error] [pid 4539:tid 4546] [client 135.119.49.165:18366] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "afvYRIPEZE1565sDGnx_7wAAAQU"]
[Thu May 07 08:09:40.937265 2026] [:error] [pid 4539:tid 4562] [client 135.119.49.165:18398] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "afvYRIPEZE1565sDGnx_8gAAARU"]
[Thu May 07 08:09:41.314190 2026] [:error] [pid 4539:tid 4549] [client 135.119.49.165:18307] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7logs.php"] [unique_id "afvYRYPEZE1565sDGnx_8wAAAQg"]
[Thu May 07 08:09:41.722005 2026] [:error] [pid 29607:tid 29672] [client 135.119.49.165:18305] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvYRabP7TJOAh7WSUOc0wAAAIQ"]
[Thu May 07 08:09:42.102298 2026] [:error] [pid 29710:tid 29723] [client 135.119.49.165:18364] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvYRv0atTQld9Y2ht8cOwAAAMs"]
[Thu May 07 08:09:42.481839 2026] [:error] [pid 29606:tid 29654] [client 135.119.49.165:18321] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvYRhR5HjZ1PlSAiKuLyQAAAE0"]
[Thu May 07 08:09:42.858366 2026] [:error] [pid 29710:tid 29726] [client 135.119.49.165:18393] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvYRv0atTQld9Y2ht8cUgAAAM4"]
[Thu May 07 08:09:43.232078 2026] [:error] [pid 29606:tid 29660] [client 135.119.49.165:18394] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afvYRxR5HjZ1PlSAiKuL0QAAAFM"]
[Thu May 07 08:09:43.628881 2026] [:error] [pid 29607:tid 29683] [client 135.119.49.165:18345] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afvYR6bP7TJOAh7WSUOc2gAAAI8"]
[Thu May 07 08:09:44.008356 2026] [:error] [pid 4539:tid 4552] [client 135.119.49.165:18380] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afvYSIPEZE1565sDGnyAFQAAAQs"]
[Thu May 07 08:09:44.385258 2026] [:error] [pid 4539:tid 4542] [client 135.119.49.165:18385] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "afvYSIPEZE1565sDGnyAFwAAAQE"]
[Thu May 07 08:09:44.778132 2026] [:error] [pid 4539:tid 4559] [client 135.119.49.165:18426] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "afvYSIPEZE1565sDGnyAGgAAARI"]
[Thu May 07 08:09:45.151999 2026] [:error] [pid 29606:tid 29650] [client 135.119.49.165:18318] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "afvYSRR5HjZ1PlSAiKuL2gAAAEk"]
[Thu May 07 08:09:45.529519 2026] [:error] [pid 4539:tid 4558] [client 135.119.49.165:18333] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "afvYSYPEZE1565sDGnyAHgAAARE"]
[Thu May 07 08:09:45.906369 2026] [:error] [pid 29606:tid 29644] [client 135.119.49.165:18414] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ctex1.php"] [unique_id "afvYSRR5HjZ1PlSAiKuL2wAAAEM"]
[Thu May 07 08:09:46.281498 2026] [:error] [pid 4539:tid 4563] [client 135.119.49.165:18392] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "afvYSoPEZE1565sDGnyAJAAAARY"]
[Thu May 07 08:09:46.673430 2026] [:error] [pid 29605:tid 29635] [client 135.119.49.165:18348] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "afvYSonxrTjETioEY0QEdwAAABU"]
[Thu May 07 08:09:47.045545 2026] [:error] [pid 4539:tid 4565] [client 135.119.49.165:18411] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "afvYS4PEZE1565sDGnyAJQAAARg"]
[Thu May 07 08:09:47.420549 2026] [:error] [pid 29607:tid 29684] [client 135.119.49.165:18391] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lb.php"] [unique_id "afvYS6bP7TJOAh7WSUOc4AAAAJA"]
[Thu May 07 08:09:47.794620 2026] [:error] [pid 29607:tid 29672] [client 135.119.49.165:18312] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "afvYS6bP7TJOAh7WSUOc4gAAAIQ"]
[Thu May 07 08:09:48.172306 2026] [:error] [pid 29606:tid 29646] [client 135.119.49.165:18327] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "afvYTBR5HjZ1PlSAiKuL4QAAAEU"]
[Thu May 07 08:09:48.551664 2026] [:error] [pid 29710:tid 29724] [client 135.119.49.165:18315] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "afvYTP0atTQld9Y2ht8cnwAAAMw"]
[Thu May 07 08:09:48.928968 2026] [:error] [pid 29605:tid 29636] [client 135.119.49.165:18421] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "afvYTInxrTjETioEY0QEeQAAABY"]
[Thu May 07 08:09:49.311278 2026] [:error] [pid 4539:tid 4562] [client 135.119.49.165:18332] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "afvYTYPEZE1565sDGnyALgAAARU"]
[Thu May 07 08:09:49.695084 2026] [:error] [pid 4539:tid 4555] [client 135.119.49.165:18419] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "afvYTYPEZE1565sDGnyAMQAAAQ4"]
[Thu May 07 08:09:50.068717 2026] [:error] [pid 4539:tid 4554] [client 135.119.49.165:18387] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "afvYToPEZE1565sDGnyANAAAAQ0"]
[Thu May 07 08:09:50.447445 2026] [:error] [pid 29607:tid 29671] [client 135.119.49.165:18330] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mh.php"] [unique_id "afvYTqbP7TJOAh7WSUOc6QAAAIM"]
[Thu May 07 08:09:50.857603 2026] [:error] [pid 29606:tid 29661] [client 135.119.49.165:18396] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "afvYThR5HjZ1PlSAiKuL5gAAAFQ"]
[Thu May 07 08:09:51.241788 2026] [:error] [pid 4539:tid 4548] [client 135.119.49.165:18358] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "afvYT4PEZE1565sDGnyAOAAAAQc"]
[Thu May 07 08:09:51.620537 2026] [:error] [pid 4539:tid 4552] [client 135.119.49.165:18349] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "afvYT4PEZE1565sDGnyAOwAAAQs"]
[Thu May 07 08:09:52.023968 2026] [:error] [pid 4539:tid 4543] [client 135.119.49.165:18340] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "afvYUIPEZE1565sDGnyAPQAAAQI"]
[Thu May 07 08:09:52.409583 2026] [:error] [pid 29607:tid 29668] [client 135.119.49.165:18423] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "afvYUKbP7TJOAh7WSUOc7AAAAIA"]
[Thu May 07 08:09:52.792519 2026] [:error] [pid 4539:tid 4545] [client 135.119.49.165:18323] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "afvYUIPEZE1565sDGnyAPgAAAQQ"]
[Thu May 07 08:09:53.178379 2026] [:error] [pid 29607:tid 29690] [client 135.119.49.165:18354] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "afvYUabP7TJOAh7WSUOc8QAAAJY"]
[Thu May 07 08:09:53.559030 2026] [:error] [pid 4539:tid 4562] [client 135.119.49.165:18242] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/auth.php"] [unique_id "afvYUYPEZE1565sDGnyAQQAAARU"]
[Thu May 07 08:09:53.937518 2026] [:error] [pid 4539:tid 4564] [client 135.119.49.165:18310] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "afvYUYPEZE1565sDGnyARQAAARc"]
[Thu May 07 08:09:54.340569 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18334] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "afvYUoPEZE1565sDGnyARwAAAQk"]
[Thu May 07 08:09:54.719776 2026] [:error] [pid 4539:tid 4563] [client 135.119.49.165:18347] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "afvYUoPEZE1565sDGnyASQAAARY"]
[Thu May 07 08:09:55.099568 2026] [:error] [pid 4539:tid 4561] [client 135.119.49.165:18355] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ortasekerli1.php"] [unique_id "afvYU4PEZE1565sDGnyASwAAARQ"]
[Thu May 07 08:09:55.486001 2026] [:error] [pid 29605:tid 29622] [client 135.119.49.165:18320] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afvYU4nxrTjETioEY0QEfgAAAAg"]
[Thu May 07 08:09:55.890902 2026] [:error] [pid 29607:tid 29674] [client 135.119.49.165:18413] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afvYU6bP7TJOAh7WSUOc8wAAAIY"]
[Thu May 07 08:09:56.286964 2026] [:error] [pid 4539:tid 4547] [client 135.119.49.165:18374] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afvYVIPEZE1565sDGnyAUAAAAQY"]
[Thu May 07 08:09:56.674972 2026] [:error] [pid 29606:tid 29644] [client 135.119.49.165:18325] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "afvYVBR5HjZ1PlSAiKuL6QAAAEM"]
[Thu May 07 08:09:57.068034 2026] [:error] [pid 29606:tid 29652] [client 135.119.49.165:18326] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "afvYVRR5HjZ1PlSAiKuL6wAAAEs"]
[Thu May 07 08:09:57.451433 2026] [:error] [pid 29606:tid 29646] [client 135.119.49.165:18240] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "afvYVRR5HjZ1PlSAiKuL7QAAAEU"]
[Thu May 07 08:09:57.829998 2026] [:error] [pid 29710:tid 29721] [client 135.119.49.165:18418] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "afvYVf0atTQld9Y2ht8czwAAAMk"]
[Thu May 07 08:09:58.205153 2026] [:error] [pid 4539:tid 4542] [client 135.119.49.165:18293] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-png.php"] [unique_id "afvYVoPEZE1565sDGnyAUwAAAQE"]
[Thu May 07 08:09:58.589764 2026] [:error] [pid 29710:tid 29727] [client 135.119.49.165:18314] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "afvYVv0atTQld9Y2ht8c1QAAAM8"]
[Thu May 07 08:09:58.978711 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18261] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "afvYVoPEZE1565sDGnyAVgAAAQk"]
[Thu May 07 08:09:59.357436 2026] [:error] [pid 29606:tid 29653] [client 135.119.49.165:18397] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "afvYVxR5HjZ1PlSAiKuL8QAAAEw"]
[Thu May 07 08:09:59.777980 2026] [:error] [pid 4539:tid 4557] [client 135.119.49.165:18319] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "afvYV4PEZE1565sDGnyAVwAAARA"]
[Thu May 07 08:10:00.167999 2026] [:error] [pid 29605:tid 29625] [client 135.119.49.165:18428] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afvYWInxrTjETioEY0QEhgAAAAs"]
[Thu May 07 08:10:00.562571 2026] [:error] [pid 29607:tid 29676] [client 135.119.49.165:18258] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afvYWKbP7TJOAh7WSUOc9QAAAIg"]
[Thu May 07 08:10:00.950403 2026] [:error] [pid 29607:tid 29684] [client 135.119.49.165:18350] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afvYWKbP7TJOAh7WSUOc9gAAAJA"]
[Thu May 07 08:10:01.323886 2026] [:error] [pid 29607:tid 29682] [client 135.119.49.165:18316] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afvYWabP7TJOAh7WSUOc-QAAAI4"]
[Thu May 07 08:10:01.710955 2026] [:error] [pid 4539:tid 4541] [client 135.119.49.165:18338] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvYWYPEZE1565sDGnyAWAAAAQA"]
[Thu May 07 08:10:02.093882 2026] [:error] [pid 29605:tid 29621] [client 135.119.49.165:18346] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvYWonxrTjETioEY0QEigAAAAc"]
[Thu May 07 08:10:02.489374 2026] [:error] [pid 29607:tid 29688] [client 135.119.49.165:18268] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvYWqbP7TJOAh7WSUOc-gAAAJQ"]
[Thu May 07 08:10:02.866484 2026] [:error] [pid 29607:tid 29683] [client 135.119.49.165:18404] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvYWqbP7TJOAh7WSUOc_AAAAI8"]
[Thu May 07 08:10:03.250386 2026] [:error] [pid 4539:tid 4545] [client 135.119.49.165:18307] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "afvYW4PEZE1565sDGnyAWwAAAQQ"]
[Thu May 07 08:10:03.634051 2026] [:error] [pid 29710:tid 29730] [client 135.119.49.165:18414] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "afvYW_0atTQld9Y2ht8c2wAAANI"]
[Thu May 07 08:10:04.017643 2026] [:error] [pid 29607:tid 29668] [client 135.119.49.165:18389] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "afvYXKbP7TJOAh7WSUOdAAAAAIA"]
[Thu May 07 08:10:04.409521 2026] [:error] [pid 4539:tid 4551] [client 135.119.49.165:18409] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bfil.php"] [unique_id "afvYXIPEZE1565sDGnyAXgAAAQo"]
[Thu May 07 08:10:04.797884 2026] [:error] [pid 29606:tid 29647] [client 135.119.49.165:18422] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "afvYXBR5HjZ1PlSAiKuL9gAAAEY"]
[Thu May 07 08:10:05.213793 2026] [:error] [pid 29710:tid 29732] [client 135.119.49.165:18372] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "afvYXf0atTQld9Y2ht8c3gAAANQ"]
[Thu May 07 08:10:05.608320 2026] [:error] [pid 29605:tid 29617] [client 135.119.49.165:18416] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "afvYXYnxrTjETioEY0QEkQAAAAM"]
[Thu May 07 08:10:05.980540 2026] [:error] [pid 29606:tid 29662] [client 135.119.49.165:18406] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abrand.php"] [unique_id "afvYXRR5HjZ1PlSAiKuL9wAAAFU"]
[Thu May 07 08:10:06.367743 2026] [:error] [pid 29606:tid 29641] [client 135.119.49.165:18294] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "afvYXhR5HjZ1PlSAiKuL-AAAAEA"]
[Thu May 07 08:10:06.768767 2026] [:error] [pid 29606:tid 29655] [client 135.119.49.165:18405] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "afvYXhR5HjZ1PlSAiKuL-QAAAE4"]
[Thu May 07 08:10:07.175558 2026] [:error] [pid 29605:tid 29629] [client 135.119.49.165:18368] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "afvYX4nxrTjETioEY0QEmQAAAA8"]
[Thu May 07 08:10:07.580315 2026] [:error] [pid 29605:tid 29625] [client 135.119.49.165:18357] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amax.php"] [unique_id "afvYX4nxrTjETioEY0QEmwAAAAs"]
[Thu May 07 08:10:07.953627 2026] [:error] [pid 29605:tid 29627] [client 135.119.49.165:18308] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "afvYX4nxrTjETioEY0QEngAAAA0"]
[Thu May 07 08:10:08.338178 2026] [:error] [pid 29710:tid 29714] [client 135.119.49.165:18429] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "afvYYP0atTQld9Y2ht8c4AAAAMI"]
[Thu May 07 08:10:08.726141 2026] [:error] [pid 29606:tid 29663] [client 135.119.49.165:18352] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "afvYYBR5HjZ1PlSAiKuL-wAAAFY"]
[Thu May 07 08:10:09.105692 2026] [:error] [pid 4539:tid 4554] [client 135.119.49.165:18356] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amwxl.php"] [unique_id "afvYYYPEZE1565sDGnyAZgAAAQ0"]
[Thu May 07 08:10:09.483543 2026] [:error] [pid 29710:tid 29721] [client 135.119.49.165:18335] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "afvYYf0atTQld9Y2ht8c4wAAAMk"]
[Thu May 07 08:10:09.860534 2026] [:error] [pid 29710:tid 29733] [client 135.119.49.165:18339] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "afvYYf0atTQld9Y2ht8c5AAAANU"]
[Thu May 07 08:10:10.233452 2026] [:error] [pid 29710:tid 29725] [client 135.119.49.165:18282] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "afvYYv0atTQld9Y2ht8c5gAAAM0"]
[Thu May 07 08:10:10.615203 2026] [:error] [pid 4539:tid 4555] [client 135.119.49.165:18272] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "afvYYoPEZE1565sDGnyAZwAAAQ4"]
[Thu May 07 08:10:10.992170 2026] [:error] [pid 4539:tid 4557] [client 135.119.49.165:18273] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "afvYYoPEZE1565sDGnyAaQAAARA"]
[Thu May 07 08:10:11.390610 2026] [:error] [pid 29710:tid 29727] [client 135.119.49.165:18191] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "afvYY_0atTQld9Y2ht8c6AAAAM8"]
[Thu May 07 08:10:11.803558 2026] [:error] [pid 29605:tid 29619] [client 135.119.49.165:18353] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "afvYY4nxrTjETioEY0QEpwAAAAU"]
[Thu May 07 08:10:12.201080 2026] [:error] [pid 29605:tid 29634] [client 135.119.49.165:18263] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/userfuns.php"] [unique_id "afvYZInxrTjETioEY0QEqgAAABQ"]
[Thu May 07 08:10:12.619884 2026] [:error] [pid 4539:tid 4553] [client 135.119.49.165:18283] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "afvYZIPEZE1565sDGnyAawAAAQw"]
[Thu May 07 08:10:13.015632 2026] [:error] [pid 29606:tid 29650] [client 135.119.49.165:18260] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "afvYZRR5HjZ1PlSAiKuL_AAAAEk"]
[Thu May 07 08:10:13.563014 2026] [:error] [pid 4539:tid 4561] [client 135.119.49.165:18365] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "afvYZYPEZE1565sDGnyAbAAAARQ"]
[Thu May 07 08:10:13.973427 2026] [:error] [pid 4539:tid 4559] [client 135.119.49.165:18351] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/menu.php"] [unique_id "afvYZYPEZE1565sDGnyAbQAAARI"]
[Thu May 07 08:10:14.383096 2026] [:error] [pid 29605:tid 29622] [client 135.119.49.165:18267] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afvYZonxrTjETioEY0QEsAAAAAg"]
[Thu May 07 08:10:14.815519 2026] [:error] [pid 4539:tid 4552] [client 135.119.49.165:18309] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afvYZoPEZE1565sDGnyAbwAAAQs"]
[Thu May 07 08:10:15.203500 2026] [:error] [pid 29605:tid 29621] [client 135.119.49.165:18281] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afvYZ4nxrTjETioEY0QEsgAAAAc"]
[Thu May 07 08:10:15.639301 2026] [:error] [pid 29607:tid 29686] [client 135.119.49.165:18336] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "afvYZ6bP7TJOAh7WSUOdBAAAAJI"]
[Thu May 07 08:10:16.015594 2026] [:error] [pid 4539:tid 4545] [client 135.119.49.165:18430] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "afvYaIPEZE1565sDGnyAcAAAAQQ"]
[Thu May 07 08:10:16.397473 2026] [:error] [pid 29605:tid 29615] [client 135.119.49.165:18284] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "afvYaInxrTjETioEY0QEtwAAAAE"]
[Thu May 07 08:10:16.773996 2026] [:error] [pid 29607:tid 29669] [client 135.119.49.165:18249] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "afvYaKbP7TJOAh7WSUOdBgAAAIE"]
[Thu May 07 08:10:17.156955 2026] [:error] [pid 29607:tid 29680] [client 135.119.49.165:18360] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/saorix1.php"] [unique_id "afvYaabP7TJOAh7WSUOdCAAAAIw"]
[Thu May 07 08:10:17.535619 2026] [:error] [pid 29607:tid 29673] [client 135.119.49.165:18336] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afvYaabP7TJOAh7WSUOdCgAAAIU"]
[Thu May 07 08:10:17.920955 2026] [:error] [pid 29710:tid 29726] [client 135.119.49.165:18243] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afvYaf0atTQld9Y2ht8c7QAAAM4"]
[Thu May 07 08:10:18.303133 2026] [:error] [pid 4539:tid 4565] [client 135.119.49.165:18183] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afvYaoPEZE1565sDGnyAcgAAARg"]
[Thu May 07 08:10:18.682607 2026] [:error] [pid 29605:tid 29619] [client 135.119.49.165:18337] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afvYaonxrTjETioEY0QEuwAAAAU"]
[Thu May 07 08:10:19.072552 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18203] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "afvYa4PEZE1565sDGnyAcwAAAQM"]
[Thu May 07 08:10:19.472624 2026] [:error] [pid 29605:tid 29631] [client 135.119.49.165:18328] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "afvYa4nxrTjETioEY0QEvQAAABE"]
[Thu May 07 08:10:19.860815 2026] [:error] [pid 4539:tid 4564] [client 135.119.49.165:18277] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "afvYa4PEZE1565sDGnyAdwAAARc"]
[Thu May 07 08:10:20.245138 2026] [:error] [pid 29605:tid 29627] [client 135.119.49.165:18373] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/rip.php"] [unique_id "afvYbInxrTjETioEY0QEvwAAAA0"]
[Thu May 07 08:10:20.626400 2026] [:error] [pid 4539:tid 4542] [client 135.119.49.165:18264] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "afvYbIPEZE1565sDGnyAeAAAAQE"]
[Thu May 07 08:10:21.058006 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18425] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "afvYbYPEZE1565sDGnyAegAAAQk"]
[Thu May 07 08:10:21.441311 2026] [:error] [pid 4539:tid 4556] [client 135.119.49.165:18412] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "afvYbYPEZE1565sDGnyAfQAAAQ8"]
[Thu May 07 08:10:21.849969 2026] [:error] [pid 4539:tid 4548] [client 135.119.49.165:18369] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gptsh.php"] [unique_id "afvYbYPEZE1565sDGnyAgAAAAQc"]
[Thu May 07 08:10:22.237754 2026] [:error] [pid 29605:tid 29623] [client 135.119.49.165:18232] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "afvYbonxrTjETioEY0QExAAAAAk"]
[Thu May 07 08:10:22.625147 2026] [:error] [pid 4539:tid 4561] [client 135.119.49.165:18222] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "afvYboPEZE1565sDGnyAgQAAARQ"]
[Thu May 07 08:10:23.042671 2026] [:error] [pid 29710:tid 29732] [client 135.119.49.165:18331] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "afvYb_0atTQld9Y2ht8c7wAAANQ"]
[Thu May 07 08:10:23.435160 2026] [:error] [pid 29606:tid 29647] [client 135.119.49.165:18118] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/0x.php"] [unique_id "afvYbxR5HjZ1PlSAiKuMCAAAAEY"]
[Thu May 07 08:10:23.819280 2026] [:error] [pid 4539:tid 4541] [client 135.119.49.165:18363] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afvYb4PEZE1565sDGnyAhAAAAQA"]
[Thu May 07 08:10:24.201818 2026] [:error] [pid 4539:tid 4547] [client 135.119.49.165:18399] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afvYcIPEZE1565sDGnyAhgAAAQY"]
[Thu May 07 08:10:24.591608 2026] [:error] [pid 4539:tid 4565] [client 135.119.49.165:18371] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afvYcIPEZE1565sDGnyAiAAAARg"]
[Thu May 07 08:10:24.978239 2026] [:error] [pid 29710:tid 29717] [client 135.119.49.165:18251] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bgymj.php"] [unique_id "afvYcP0atTQld9Y2ht8c8wAAAMU"]
[Thu May 07 08:10:25.361256 2026] [:error] [pid 4539:tid 4558] [client 135.119.49.165:18362] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afvYcYPEZE1565sDGnyAiwAAARE"]
[Thu May 07 08:10:25.736073 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18378] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afvYcYPEZE1565sDGnyAjgAAAQk"]
[Thu May 07 08:10:26.123107 2026] [:error] [pid 4539:tid 4557] [client 135.119.49.165:18201] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afvYcoPEZE1565sDGnyAkAAAARA"]
[Thu May 07 08:10:26.509171 2026] [:error] [pid 4539:tid 4554] [client 135.119.49.165:18342] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "afvYcoPEZE1565sDGnyAkwAAAQ0"]
[Thu May 07 08:10:26.899379 2026] [:error] [pid 29710:tid 29724] [client 135.119.49.165:18302] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "afvYcv0atTQld9Y2ht8c9QAAAMw"]
[Thu May 07 08:10:27.332630 2026] [:error] [pid 29710:tid 29721] [client 135.119.49.165:18377] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "afvYc_0atTQld9Y2ht8c9wAAAMk"]
[Thu May 07 08:10:27.708646 2026] [:error] [pid 29710:tid 29725] [client 135.119.49.165:18341] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "afvYc_0atTQld9Y2ht8c-QAAAM0"]
[Thu May 07 08:10:28.089522 2026] [:error] [pid 29606:tid 29663] [client 135.119.49.165:18402] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "afvYdBR5HjZ1PlSAiKuMCgAAAFY"]
[Thu May 07 08:10:28.478791 2026] [:error] [pid 29605:tid 29636] [client 135.119.49.165:18379] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koiy.php"] [unique_id "afvYdInxrTjETioEY0QEyQAAABY"]
[Thu May 07 08:10:28.861247 2026] [:error] [pid 4539:tid 4541] [client 135.119.49.165:18255] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koiy.php"] [unique_id "afvYdIPEZE1565sDGnyAmAAAAQA"]
[Thu May 07 08:10:29.251902 2026] [:error] [pid 29605:tid 29617] [client 135.119.49.165:18388] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koiy.php"] [unique_id "afvYdYnxrTjETioEY0QEywAAAAM"]
[Thu May 07 08:10:29.659275 2026] [:error] [pid 29605:tid 29635] [client 135.119.49.165:18262] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koiy.php"] [unique_id "afvYdYnxrTjETioEY0QEzAAAABU"]
[Thu May 07 08:10:30.049122 2026] [:error] [pid 4539:tid 4551] [client 135.119.49.165:18247] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afvYdoPEZE1565sDGnyAmgAAAQo"]
[Thu May 07 08:10:30.451282 2026] [:error] [pid 29605:tid 29619] [client 135.119.49.165:18288] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afvYdonxrTjETioEY0QEzgAAAAU"]
[Thu May 07 08:10:30.835736 2026] [:error] [pid 29710:tid 29728] [client 135.119.49.165:18390] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afvYdv0atTQld9Y2ht8c_QAAANA"]
[Thu May 07 08:10:31.215500 2026] [:error] [pid 4539:tid 4564] [client 135.119.49.165:18270] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "afvYd4PEZE1565sDGnyAngAAARc"]
[Thu May 07 08:10:31.589990 2026] [:error] [pid 29710:tid 29712] [client 135.119.49.165:18205] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "afvYd_0atTQld9Y2ht8dAgAAAMA"]
[Thu May 07 08:10:31.964850 2026] [:error] [pid 4539:tid 4549] [client 135.119.49.165:18179] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "afvYd4PEZE1565sDGnyAnwAAAQg"]
[Thu May 07 08:10:32.341398 2026] [:error] [pid 29605:tid 29629] [client 135.119.49.165:18259] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "afvYeInxrTjETioEY0QE0QAAAA8"]
[Thu May 07 08:10:32.712787 2026] [:error] [pid 4539:tid 4555] [client 135.119.49.165:18286] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "afvYeIPEZE1565sDGnyApQAAAQ4"]
[Thu May 07 08:10:33.289666 2026] [:error] [pid 4539:tid 4561] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Thu May 07 08:10:33.482268 2026] [:error] [pid 4539:tid 4548] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp9.php
[Thu May 07 08:10:33.676007 2026] [:error] [pid 4539:tid 4541] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Thu May 07 08:10:33.867533 2026] [:error] [pid 4539:tid 4560] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/wp5.php
[Thu May 07 08:10:34.060078 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Thu May 07 08:10:34.251191 2026] [:error] [pid 4539:tid 4542] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/file61.php
[Thu May 07 08:10:34.442825 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Thu May 07 08:10:34.634774 2026] [:error] [pid 4539:tid 4558] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/tfm.php
[Thu May 07 08:10:34.826720 2026] [:error] [pid 4539:tid 4542] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Thu May 07 08:10:35.018779 2026] [:error] [pid 4539:tid 4555] [client 135.119.49.165:18189] File does not exist: /usr/local/apache/htdocs/suspended-page/t00l.php
[Thu May 07 08:10:35.207683 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18189] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "afvYe4PEZE1565sDGnyA4wAAAQM"]
[Thu May 07 08:10:35.583055 2026] [:error] [pid 29710:tid 29716] [client 135.119.49.165:18202] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "afvYe_0atTQld9Y2ht8dEAAAAMQ"]
[Thu May 07 08:10:35.965820 2026] [:error] [pid 29710:tid 29719] [client 135.119.49.165:18241] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "afvYe_0atTQld9Y2ht8dFAAAAMc"]
[Thu May 07 08:10:36.343191 2026] [:error] [pid 29710:tid 29723] [client 135.119.49.165:18278] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "afvYfP0atTQld9Y2ht8dGAAAAMs"]
[Thu May 07 08:10:36.731198 2026] [:error] [pid 4539:tid 4557] [client 135.119.49.165:18295] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "afvYfIPEZE1565sDGnyBFQAAARA"]
[Thu May 07 08:10:37.121388 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18292] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "afvYfYPEZE1565sDGnyBGgAAAQM"]
[Thu May 07 08:10:37.533510 2026] [:error] [pid 29607:tid 29690] [client 135.119.49.165:18199] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "afvYfabP7TJOAh7WSUOdFAAAAJY"]
[Thu May 07 08:10:37.917663 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18212] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acc.php"] [unique_id "afvYfYPEZE1565sDGnyBKAAAAQM"]
[Thu May 07 08:10:38.297929 2026] [:error] [pid 29607:tid 29691] [client 135.119.49.165:18188] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "afvYfqbP7TJOAh7WSUOdFQAAAJc"]
[Thu May 07 08:10:38.670521 2026] [:error] [pid 29607:tid 29669] [client 135.119.49.165:18259] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "afvYfqbP7TJOAh7WSUOdFgAAAIE"]
[Thu May 07 08:10:39.054548 2026] [:error] [pid 4539:tid 4558] [client 135.119.49.165:18225] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "afvYf4PEZE1565sDGnyBMAAAARE"]
[Thu May 07 08:10:39.448209 2026] [:error] [pid 29607:tid 29680] [client 135.119.49.165:18344] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "afvYf6bP7TJOAh7WSUOdGQAAAIw"]
[Thu May 07 08:10:39.832635 2026] [:error] [pid 29710:tid 29720] [client 135.119.49.165:18289] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "afvYf_0atTQld9Y2ht8dHwAAAMg"]
[Thu May 07 08:10:40.205439 2026] [:error] [pid 29710:tid 29724] [client 135.119.49.165:18271] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "afvYgP0atTQld9Y2ht8dIAAAAMw"]
[Thu May 07 08:10:40.582086 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18192] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "afvYgIPEZE1565sDGnyBOAAAAQM"]
[Thu May 07 08:10:40.974642 2026] [:error] [pid 4539:tid 4547] [client 135.119.49.165:18195] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "afvYgIPEZE1565sDGnyBOQAAAQY"]
[Thu May 07 08:10:41.352089 2026] [:error] [pid 4539:tid 4551] [client 135.119.49.165:18181] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "afvYgYPEZE1565sDGnyBPAAAAQo"]
[Thu May 07 08:10:41.725324 2026] [:error] [pid 29607:tid 29683] [client 135.119.49.165:18215] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "afvYgabP7TJOAh7WSUOdHwAAAI8"]
[Thu May 07 08:10:42.111971 2026] [:error] [pid 4539:tid 4558] [client 135.119.49.165:18266] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "afvYgoPEZE1565sDGnyBPgAAARE"]
[Thu May 07 08:10:42.499015 2026] [:error] [pid 4539:tid 4554] [client 135.119.49.165:18223] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/packsin1.php"] [unique_id "afvYgoPEZE1565sDGnyBPwAAAQ0"]
[Thu May 07 08:10:42.888310 2026] [:error] [pid 4539:tid 4557] [client 135.119.49.165:18297] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "afvYgoPEZE1565sDGnyBQgAAARA"]
[Thu May 07 08:10:43.274807 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18280] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "afvYg4PEZE1565sDGnyBRgAAAQk"]
[Thu May 07 08:10:43.648978 2026] [:error] [pid 29710:tid 29721] [client 135.119.49.165:18274] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "afvYg_0atTQld9Y2ht8dIQAAAMk"]
[Thu May 07 08:10:44.023647 2026] [:error] [pid 29710:tid 29725] [client 135.119.49.165:18244] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "afvYhP0atTQld9Y2ht8dIwAAAM0"]
[Thu May 07 08:10:44.400280 2026] [:error] [pid 29605:tid 29621] [client 135.119.49.165:18214] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "afvYhInxrTjETioEY0QE2QAAAAc"]
[Thu May 07 08:10:44.778970 2026] [:error] [pid 29710:tid 29727] [client 135.119.49.165:18140] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "afvYhP0atTQld9Y2ht8dJQAAAM8"]
[Thu May 07 08:10:45.163537 2026] [:error] [pid 4539:tid 4553] [client 135.119.49.165:18121] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "afvYhYPEZE1565sDGnyBSgAAAQw"]
[Thu May 07 08:10:45.536422 2026] [:error] [pid 29710:tid 29716] [client 135.119.49.165:18256] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "afvYhf0atTQld9Y2ht8dJgAAAMQ"]
[Thu May 07 08:10:45.923756 2026] [:error] [pid 29710:tid 29718] [client 135.119.49.165:18384] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "afvYhf0atTQld9Y2ht8dKAAAAMY"]
[Thu May 07 08:10:46.309997 2026] [:error] [pid 29710:tid 29712] [client 135.119.49.165:18254] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "afvYhv0atTQld9Y2ht8dLQAAAMA"]
[Thu May 07 08:10:46.681322 2026] [:error] [pid 29710:tid 29734] [client 135.119.49.165:18233] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "afvYhv0atTQld9Y2ht8dMAAAANY"]
[Thu May 07 08:10:47.055073 2026] [:error] [pid 29710:tid 29714] [client 135.119.49.165:18197] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/motu.php"] [unique_id "afvYh_0atTQld9Y2ht8dMQAAAMI"]
[Thu May 07 08:10:47.429510 2026] [:error] [pid 4539:tid 4552] [client 135.119.49.165:18276] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afvYh4PEZE1565sDGnyBTAAAAQs"]
[Thu May 07 08:10:47.806088 2026] [:error] [pid 4539:tid 4547] [client 135.119.49.165:18301] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afvYh4PEZE1565sDGnyBTgAAAQY"]
[Thu May 07 08:10:48.183783 2026] [:error] [pid 4539:tid 4556] [client 135.119.49.165:18193] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afvYiIPEZE1565sDGnyBUAAAAQ8"]
[Thu May 07 08:10:48.561516 2026] [:error] [pid 29710:tid 29735] [client 135.119.49.165:18359] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "afvYiP0atTQld9Y2ht8dNAAAANc"]
[Thu May 07 08:10:48.938184 2026] [:error] [pid 4539:tid 4561] [client 135.119.49.165:18248] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afvYiIPEZE1565sDGnyBVAAAARQ"]
[Thu May 07 08:10:49.314866 2026] [:error] [pid 4539:tid 4553] [client 135.119.49.165:18211] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afvYiYPEZE1565sDGnyBWAAAAQw"]
[Thu May 07 08:10:49.697227 2026] [:error] [pid 4539:tid 4560] [client 135.119.49.165:18322] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afvYiYPEZE1565sDGnyBWQAAARM"]
[Thu May 07 08:10:50.071620 2026] [:error] [pid 29710:tid 29725] [client 135.119.49.165:18257] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afvYiv0atTQld9Y2ht8dNgAAAM0"]
[Thu May 07 08:10:50.442699 2026] [:error] [pid 29710:tid 29727] [client 135.119.49.165:18221] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "afvYiv0atTQld9Y2ht8dOAAAAM8"]
[Thu May 07 08:10:50.820957 2026] [:error] [pid 29710:tid 29716] [client 135.119.49.165:18204] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "afvYiv0atTQld9Y2ht8dOQAAAMQ"]
[Thu May 07 08:10:51.201395 2026] [:error] [pid 29710:tid 29712] [client 135.119.49.165:18151] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "afvYi_0atTQld9Y2ht8dPQAAAMA"]
[Thu May 07 08:10:51.577435 2026] [:error] [pid 4539:tid 4546] [client 135.119.49.165:18113] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8573.php"] [unique_id "afvYi4PEZE1565sDGnyBXgAAAQU"]
[Thu May 07 08:10:51.957484 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18207] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "afvYi4PEZE1565sDGnyBYQAAAQk"]
[Thu May 07 08:10:52.337698 2026] [:error] [pid 4539:tid 4561] [client 135.119.49.165:18185] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "afvYjIPEZE1565sDGnyBZQAAARQ"]
[Thu May 07 08:10:52.721916 2026] [:error] [pid 29606:tid 29645] [client 135.119.49.165:18216] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "afvYjBR5HjZ1PlSAiKuMEgAAAEQ"]
[Thu May 07 08:10:53.098361 2026] [:error] [pid 4539:tid 4565] [client 135.119.49.165:18415] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sadcut1.php"] [unique_id "afvYjYPEZE1565sDGnyBZwAAARg"]
[Thu May 07 08:10:53.473213 2026] [:error] [pid 4539:tid 4553] [client 135.119.49.165:18194] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "afvYjYPEZE1565sDGnyBagAAAQw"]
[Thu May 07 08:10:53.846230 2026] [:error] [pid 29607:tid 29680] [client 135.119.49.165:18265] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "afvYjabP7TJOAh7WSUOdLAAAAIw"]
[Thu May 07 08:10:54.221417 2026] [:error] [pid 29605:tid 29632] [client 135.119.49.165:18231] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "afvYjonxrTjETioEY0QE4gAAABI"]
[Thu May 07 08:10:54.618449 2026] [:error] [pid 4539:tid 4552] [client 135.119.49.165:18213] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/666.php"] [unique_id "afvYjoPEZE1565sDGnyBbQAAAQs"]
[Thu May 07 08:10:54.998326 2026] [:error] [pid 29605:tid 29629] [client 135.119.49.165:18150] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afvYjonxrTjETioEY0QE5AAAAA8"]
[Thu May 07 08:10:55.373271 2026] [:error] [pid 4539:tid 4563] [client 135.119.49.165:18198] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afvYj4PEZE1565sDGnyBcQAAARY"]
[Thu May 07 08:10:55.752827 2026] [:error] [pid 29710:tid 29727] [client 135.119.49.165:18386] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afvYj_0atTQld9Y2ht8dTQAAAM8"]
[Thu May 07 08:10:56.136596 2026] [:error] [pid 29605:tid 29626] [client 135.119.49.165:18245] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "afvYkInxrTjETioEY0QE5wAAAAw"]
[Thu May 07 08:10:56.512495 2026] [:error] [pid 29605:tid 29620] [client 135.119.49.165:18125] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "afvYkInxrTjETioEY0QE6AAAAAY"]
[Thu May 07 08:10:56.891940 2026] [:error] [pid 29710:tid 29729] [client 135.119.49.165:18287] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "afvYkP0atTQld9Y2ht8dWgAAANE"]
[Thu May 07 08:10:57.293836 2026] [:error] [pid 29710:tid 29728] [client 135.119.49.165:18403] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "afvYkf0atTQld9Y2ht8dWwAAANA"]
[Thu May 07 08:10:57.688597 2026] [:error] [pid 29710:tid 29735] [client 135.119.49.165:18235] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/prosellers8.php"] [unique_id "afvYkf0atTQld9Y2ht8dXQAAANc"]
[Thu May 07 08:10:58.079557 2026] [:error] [pid 29605:tid 29638] [client 135.119.49.165:18296] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "afvYkonxrTjETioEY0QE6gAAABg"]
[Thu May 07 08:10:58.462763 2026] [:error] [pid 29606:tid 29641] [client 135.119.49.165:18190] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "afvYkhR5HjZ1PlSAiKuMGAAAAEA"]
[Thu May 07 08:10:58.853202 2026] [:error] [pid 29605:tid 29630] [client 135.119.49.165:18246] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "afvYkonxrTjETioEY0QE6wAAABA"]
[Thu May 07 08:10:59.254084 2026] [:error] [pid 29710:tid 29733] [client 135.119.49.165:18120] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop.php"] [unique_id "afvYk_0atTQld9Y2ht8dYAAAANU"]
[Thu May 07 08:10:59.657678 2026] [:error] [pid 29605:tid 29621] [client 135.119.49.165:18196] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "afvYk4nxrTjETioEY0QE7QAAAAc"]
[Thu May 07 08:11:00.033376 2026] [:error] [pid 29605:tid 29628] [client 135.119.49.165:18253] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "afvYlInxrTjETioEY0QE7gAAAA4"]
[Thu May 07 08:11:00.424728 2026] [:error] [pid 29607:tid 29682] [client 135.119.49.165:18129] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "afvYlKbP7TJOAh7WSUOdNAAAAI4"]
[Thu May 07 08:11:00.814715 2026] [:error] [pid 29606:tid 29642] [client 135.119.49.165:18130] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ww.php"] [unique_id "afvYlBR5HjZ1PlSAiKuMGwAAAEE"]
[Thu May 07 08:11:01.198650 2026] [:error] [pid 29606:tid 29650] [client 135.119.49.165:18206] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "afvYlRR5HjZ1PlSAiKuMHQAAAEk"]
[Thu May 07 08:11:01.575508 2026] [:error] [pid 29606:tid 29644] [client 135.119.49.165:18139] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "afvYlRR5HjZ1PlSAiKuMHwAAAEM"]
[Thu May 07 08:11:01.968414 2026] [:error] [pid 29605:tid 29636] [client 135.119.49.165:18275] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "afvYlYnxrTjETioEY0QE7wAAABY"]
[Thu May 07 08:11:02.348629 2026] [:error] [pid 29606:tid 29651] [client 135.119.49.165:18209] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fsjzs.php"] [unique_id "afvYlhR5HjZ1PlSAiKuMIgAAAEo"]
[Thu May 07 08:11:02.728970 2026] [:error] [pid 29606:tid 29643] [client 135.119.49.165:18252] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "afvYlhR5HjZ1PlSAiKuMIwAAAEI"]
[Thu May 07 08:11:03.121421 2026] [:error] [pid 29606:tid 29654] [client 135.119.49.165:18229] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "afvYlxR5HjZ1PlSAiKuMJAAAAE0"]
[Thu May 07 08:11:03.506026 2026] [:error] [pid 29710:tid 29718] [client 135.119.49.165:18311] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "afvYl_0atTQld9Y2ht8ddQAAAMY"]
[Thu May 07 08:11:03.887651 2026] [:error] [pid 29710:tid 29729] [client 135.119.49.165:18291] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cwclass.php"] [unique_id "afvYl_0atTQld9Y2ht8deAAAANE"]
[Thu May 07 08:11:04.277552 2026] [:error] [pid 29710:tid 29730] [client 135.119.49.165:18176] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "afvYmP0atTQld9Y2ht8deQAAANI"]
[Thu May 07 08:11:04.673927 2026] [:error] [pid 29710:tid 29719] [client 135.119.49.165:18298] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "afvYmP0atTQld9Y2ht8dfAAAAMc"]
[Thu May 07 08:11:05.081436 2026] [:error] [pid 29607:tid 29670] [client 135.119.49.165:18313] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "afvYmabP7TJOAh7WSUOdPAAAAII"]
[Thu May 07 08:11:05.474302 2026] [:error] [pid 29607:tid 29685] [client 135.119.49.165:18236] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit-tags.php"] [unique_id "afvYmabP7TJOAh7WSUOdPwAAAJE"]
[Thu May 07 08:11:05.887717 2026] [:error] [pid 29607:tid 29674] [client 135.119.49.165:18132] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afvYmabP7TJOAh7WSUOdQQAAAIY"]
[Thu May 07 08:11:06.305782 2026] [:error] [pid 29607:tid 29680] [client 135.119.49.165:18187] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afvYmqbP7TJOAh7WSUOdQwAAAIw"]
[Thu May 07 08:11:06.728295 2026] [:error] [pid 4539:tid 4559] [client 135.119.49.165:18186] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afvYmoPEZE1565sDGnyBfgAAARI"]
[Thu May 07 08:11:07.141315 2026] [:error] [pid 4539:tid 4550] [client 135.119.49.165:18285] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "afvYm4PEZE1565sDGnyBgQAAAQk"]
[Thu May 07 08:11:07.548712 2026] [:error] [pid 4539:tid 4544] [client 135.119.49.165:18290] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "afvYm4PEZE1565sDGnyBiQAAAQM"]
[Thu May 07 08:11:07.950016 2026] [:error] [pid 4539:tid 4553] [client 135.119.49.165:18115] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "afvYm4PEZE1565sDGnyBmwAAAQw"]
[Thu May 07 08:11:08.327013 2026] [:error] [pid 29710:tid 29725] [client 135.119.49.165:18086] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "afvYnP0atTQld9Y2ht8dgQAAAM0"]
[Thu May 07 08:11:08.723822 2026] [:error] [pid 29710:tid 29718] [client 135.119.49.165:18230] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "afvYnP0atTQld9Y2ht8dhAAAAMY"]
[Thu May 07 08:11:09.115813 2026] [:error] [pid 29710:tid 29724] [client 135.119.49.165:18299] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afvYnf0atTQld9Y2ht8diAAAAMw"]
[Thu May 07 08:11:09.559422 2026] [:error] [pid 29710:tid 29720] [client 135.119.49.165:18220] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afvYnf0atTQld9Y2ht8digAAAMg"]
[Thu May 07 08:11:09.953307 2026] [:error] [pid 29607:tid 29682] [client 135.119.49.165:18303] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afvYnabP7TJOAh7WSUOdYAAAAI4"]
[Thu May 07 08:11:10.340567 2026] [:error] [pid 29710:tid 29726] [client 135.119.49.165:18184] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afvYnv0atTQld9Y2ht8djgAAAM4"]
[Thu May 07 08:11:10.719427 2026] [:error] [pid 29606:tid 29653] [client 135.119.49.165:18142] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "afvYnhR5HjZ1PlSAiKuMOwAAAEw"]
[Thu May 07 08:11:11.121698 2026] [:error] [pid 29605:tid 29632] [client 135.119.49.165:18300] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "afvYn4nxrTjETioEY0QE9gAAABI"]
[Thu May 07 08:11:11.525413 2026] [:error] [pid 29607:tid 29692] [client 135.119.49.165:18082] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "afvYn6bP7TJOAh7WSUOdZgAAAJg"]
[Thu May 07 08:11:11.908595 2026] [:error] [pid 29710:tid 29715] [client 135.119.49.165:18208] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ai.php"] [unique_id "afvYn_0atTQld9Y2ht8dkQAAAMM"]
[Thu May 07 08:11:12.286203 2026] [:error] [pid 29605:tid 29629] [client 135.119.49.165:18161] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "afvYoInxrTjETioEY0QE-AAAAA8"]
[Thu May 07 08:11:12.666703 2026] [:error] [pid 29605:tid 29634] [client 135.119.49.165:18224] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "afvYoInxrTjETioEY0QE-gAAABQ"]
[Thu May 07 08:11:13.050463 2026] [:error] [pid 29710:tid 29730] [client 135.119.49.165:18116] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "afvYof0atTQld9Y2ht8dlgAAANI"]
[Thu May 07 08:11:13.433828 2026] [:error] [pid 29710:tid 29720] [client 135.119.49.165:18144] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jga.php"] [unique_id "afvYof0atTQld9Y2ht8dmQAAAMg"]
[Thu May 07 08:11:13.833247 2026] [:error] [pid 29606:tid 29657] [client 135.119.49.165:18234] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "afvYoRR5HjZ1PlSAiKuMPwAAAFA"]
[Thu May 07 08:11:14.227749 2026] [:error] [pid 29710:tid 29726] [client 135.119.49.165:18149] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "afvYov0atTQld9Y2ht8dngAAAM4"]
[Thu May 07 08:11:14.614284 2026] [:error] [pid 4539:tid 4555] [client 135.119.49.165:18237] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "afvYooPEZE1565sDGnyBrQAAAQ4"]
[Thu May 07 08:11:14.996366 2026] [:error] [pid 29607:tid 29686] [client 135.119.49.165:18367] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/term.php"] [unique_id "afvYoqbP7TJOAh7WSUOdagAAAJI"]
[Thu May 07 08:11:15.392512 2026] [:error] [pid 29710:tid 29735] [client 135.119.49.165:18128] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "afvYo_0atTQld9Y2ht8doAAAANc"]
[Thu May 07 08:11:15.789338 2026] [:error] [pid 29607:tid 29683] [client 135.119.49.165:18209] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "afvYo6bP7TJOAh7WSUOdawAAAI8"]
[Thu May 07 08:11:16.187207 2026] [:error] [pid 29607:tid 29682] [client 135.119.49.165:18239] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "afvYpKbP7TJOAh7WSUOdbAAAAI4"]
[Thu May 07 08:11:16.573534 2026] [:error] [pid 29710:tid 29722] [client 135.119.49.165:18177] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gk.php"] [unique_id "afvYpP0atTQld9Y2ht8dogAAAMo"]
[Thu May 07 08:11:16.953698 2026] [:error] [pid 29710:tid 29727] [client 135.119.49.165:18164] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afvYpP0atTQld9Y2ht8dpAAAAM8"]
[Thu May 07 08:11:17.352852 2026] [:error] [pid 29607:tid 29688] [client 135.119.49.165:18092] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afvYpabP7TJOAh7WSUOdbgAAAJQ"]
[Thu May 07 08:11:17.761228 2026] [:error] [pid 29710:tid 29730] [client 135.119.49.165:18217] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afvYpf0atTQld9Y2ht8dpgAAANI"]
[Thu May 07 08:11:18.139291 2026] [:error] [pid 29710:tid 29723] [client 135.119.49.165:18155] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afvYpv0atTQld9Y2ht8dqAAAAMs"]
[Thu May 07 08:11:18.519703 2026] [:error] [pid 4539:tid 4542] [client 135.119.49.165:18163] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sd.php"] [unique_id "afvYpoPEZE1565sDGnyBtgAAAQE"]
[Thu May 07 08:11:18.901164 2026] [:error] [pid 4539:tid 4541] [client 135.119.49.165:18070] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sd.php"] [unique_id "afvYpoPEZE1565sDGnyBuAAAAQA"]
[Thu May 07 08:11:19.279655 2026] [:error] [pid 4539:tid 4565] [client 135.119.49.165:18050] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sd.php"] [unique_id "afvYp4PEZE1565sDGnyBuQAAARg"]
[Thu May 07 08:11:19.655511 2026] [:error] [pid 29710:tid 29716] [client 135.119.49.165:18180] [client 135.119.49.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sd.php"] [unique_id "afvYp_0atTQld9Y2ht8drAAAAMQ"]
[Thu May 07 13:51:07.454028 2026] [:error] [pid 56065:tid 56111] [client 43.134.53.242:49866] [client 43.134.53.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afwoS3dV4hYThdnhfxDobAAAAI8"]
[Thu May 07 14:22:46.434821 2026] [:error] [pid 15630:tid 15677] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/0x.php
[Thu May 07 14:22:46.646132 2026] [:error] [pid 15630:tid 15675] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/l.php
[Thu May 07 14:22:46.858305 2026] [:error] [pid 15630:tid 15682] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/mac.php
[Thu May 07 14:22:47.074820 2026] [:error] [pid 15630:tid 15683] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/hayuk.php
[Thu May 07 14:22:47.287985 2026] [:error] [pid 15630:tid 15680] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-files.php
[Thu May 07 14:22:48.900636 2026] [:error] [pid 15630:tid 15680] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/wefile.php
[Thu May 07 14:22:49.115127 2026] [:error] [pid 15630:tid 15669] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-signin.php
[Thu May 07 14:22:49.327916 2026] [:error] [pid 15630:tid 15666] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/momo.php
[Thu May 07 14:22:49.542398 2026] [:error] [pid 15630:tid 15678] [client 52.138.31.126:16157] File does not exist: /usr/local/apache/htdocs/suspended-page/gtc.php
[Thu May 07 14:22:49.963044 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:16157] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwvuXTithRAi4821qt_KQAAAJM"]
[Thu May 07 14:22:50.444716 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:15563] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwvuiY4dZsLOttMkcc-sgAAAQA"]
[Thu May 07 14:22:50.908349 2026] [:error] [pid 15629:tid 15642] [client 52.138.31.126:14789] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwvuvrIJCALdUrO43lJqwAAAAk"]
[Thu May 07 14:22:51.444523 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:16231] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwvuyY4dZsLOttMkcc-tAAAAQs"]
[Thu May 07 14:22:51.890389 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:16159] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links.php"] [unique_id "afwvu3vP1GkPUuuLfqX25wAAANQ"]
[Thu May 07 14:22:52.313839 2026] [:error] [pid 15630:tid 15664] [client 52.138.31.126:15544] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links.php"] [unique_id "afwvvHTithRAi4821qt_KgAAAIQ"]
[Thu May 07 14:22:52.734726 2026] [:error] [pid 15629:tid 15645] [client 52.138.31.126:15585] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links.php"] [unique_id "afwvvPrIJCALdUrO43lJrAAAAAw"]
[Thu May 07 14:22:53.192828 2026] [:error] [pid 15629:tid 15635] [client 52.138.31.126:15504] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-links.php"] [unique_id "afwvvfrIJCALdUrO43lJrQAAAAI"]
[Thu May 07 14:22:53.656782 2026] [:error] [pid 15630:tid 15684] [client 52.138.31.126:16237] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upload/wp-info.php"] [unique_id "afwvvXTithRAi4821qt_KwAAAJg"]
[Thu May 07 14:22:54.072325 2026] [:error] [pid 15715:tid 15734] [client 52.138.31.126:15601] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upload/wp-info.php"] [unique_id "afwvviY4dZsLOttMkcc-tQAAAQ4"]
[Thu May 07 14:22:54.547320 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:15612] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upload/wp-info.php"] [unique_id "afwvviY4dZsLOttMkcc-twAAAQ8"]
[Thu May 07 14:22:55.049327 2026] [:error] [pid 15631:tid 15688] [client 52.138.31.126:16147] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upload/wp-info.php"] [unique_id "afwvv3vP1GkPUuuLfqX26gAAAME"]
[Thu May 07 14:22:55.514777 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:16153] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "afwvv3vP1GkPUuuLfqX27AAAANg"]
[Thu May 07 14:22:55.943166 2026] [:error] [pid 15630:tid 15671] [client 52.138.31.126:16218] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "afwvv3TithRAi4821qt_LgAAAIs"]
[Thu May 07 14:22:56.391969 2026] [:error] [pid 15630:tid 15662] [client 52.138.31.126:14834] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "afwvwHTithRAi4821qt_LwAAAII"]
[Thu May 07 14:22:56.836545 2026] [:error] [pid 15715:tid 15739] [client 52.138.31.126:16198] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "afwvwCY4dZsLOttMkcc-ugAAARM"]
[Thu May 07 14:22:57.261424 2026] [:error] [pid 15630:tid 15667] [client 52.138.31.126:15605] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "afwvwXTithRAi4821qt_MQAAAIc"]
[Thu May 07 14:22:57.677934 2026] [:error] [pid 15629:tid 15637] [client 52.138.31.126:14820] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "afwvwfrIJCALdUrO43lJtAAAAAQ"]
[Thu May 07 14:22:58.103805 2026] [:error] [pid 15630:tid 15672] [client 52.138.31.126:15609] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "afwvwnTithRAi4821qt_MgAAAIw"]
[Thu May 07 14:22:58.546832 2026] [:error] [pid 15630:tid 15675] [client 52.138.31.126:15557] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "afwvwnTithRAi4821qt_NAAAAI8"]
[Thu May 07 14:22:58.967873 2026] [:error] [pid 15631:tid 15701] [client 52.138.31.126:15598] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "afwvwnvP1GkPUuuLfqX27gAAAM4"]
[Thu May 07 14:22:59.387306 2026] [:error] [pid 15631:tid 15696] [client 52.138.31.126:16238] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "afwvw3vP1GkPUuuLfqX27wAAAMk"]
[Thu May 07 14:22:59.807153 2026] [:error] [pid 15631:tid 15700] [client 52.138.31.126:15577] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "afwvw3vP1GkPUuuLfqX28AAAAM0"]
[Thu May 07 14:23:00.233575 2026] [:error] [pid 15631:tid 15695] [client 52.138.31.126:14826] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "afwvxHvP1GkPUuuLfqX28QAAAMg"]
[Thu May 07 14:23:00.658983 2026] [:error] [pid 15631:tid 15703] [client 52.138.31.126:15541] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afwvxHvP1GkPUuuLfqX28wAAANA"]
[Thu May 07 14:23:01.138106 2026] [:error] [pid 15630:tid 15683] [client 52.138.31.126:15588] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afwvxXTithRAi4821qt_NQAAAJc"]
[Thu May 07 14:23:01.615848 2026] [:error] [pid 15630:tid 15680] [client 52.138.31.126:15500] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afwvxXTithRAi4821qt_NgAAAJQ"]
[Thu May 07 14:23:02.094304 2026] [:error] [pid 15631:tid 15705] [client 52.138.31.126:15489] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tires.php"] [unique_id "afwvxnvP1GkPUuuLfqX29gAAANI"]
[Thu May 07 14:23:02.615279 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:14735] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afwvxiY4dZsLOttMkcc-vgAAAQY"]
[Thu May 07 14:23:03.058319 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:16186] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afwvxyY4dZsLOttMkcc-wAAAAQA"]
[Thu May 07 14:23:03.508204 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:15492] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afwvx3vP1GkPUuuLfqX29wAAAMw"]
[Thu May 07 14:23:03.929608 2026] [:error] [pid 15629:tid 15642] [client 52.138.31.126:15574] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "afwvx_rIJCALdUrO43lJvAAAAAk"]
[Thu May 07 14:23:04.344722 2026] [:error] [pid 15629:tid 15635] [client 52.138.31.126:15566] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwvyPrIJCALdUrO43lJvgAAAAI"]
[Thu May 07 14:23:04.757001 2026] [:error] [pid 15630:tid 15663] [client 52.138.31.126:14827] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwvyHTithRAi4821qt_OAAAAIM"]
[Thu May 07 14:23:05.179427 2026] [:error] [pid 15631:tid 15710] [client 52.138.31.126:14829] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwvyXvP1GkPUuuLfqX2-AAAANc"]
[Thu May 07 14:23:05.606790 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:16228] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwvySY4dZsLOttMkcc-xAAAAQo"]
[Thu May 07 14:23:06.021808 2026] [:error] [pid 15630:tid 15673] [client 52.138.31.126:15515] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "afwvynTithRAi4821qt_OQAAAI0"]
[Thu May 07 14:23:06.462075 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:15523] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "afwvyiY4dZsLOttMkcc-xQAAAQc"]
[Thu May 07 14:23:06.881528 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:16210] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "afwvyiY4dZsLOttMkcc-xgAAARg"]
[Thu May 07 14:23:07.340911 2026] [:error] [pid 15629:tid 15633] [client 52.138.31.126:14791] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-block.php"] [unique_id "afwvy_rIJCALdUrO43lJwgAAAAA"]
[Thu May 07 14:23:07.794516 2026] [:error] [pid 15630:tid 15664] [client 52.138.31.126:16179] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "afwvy3TithRAi4821qt_OwAAAIQ"]
[Thu May 07 14:23:08.258039 2026] [:error] [pid 15629:tid 15649] [client 52.138.31.126:15506] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "afwvzPrIJCALdUrO43lJxgAAABA"]
[Thu May 07 14:23:08.735441 2026] [:error] [pid 15629:tid 15639] [client 52.138.31.126:15591] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "afwvzPrIJCALdUrO43lJxwAAAAY"]
[Thu May 07 14:23:09.152967 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:16137] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "afwvzfrIJCALdUrO43lJyQAAAAM"]
[Thu May 07 14:23:09.575341 2026] [:error] [pid 15631:tid 15689] [client 52.138.31.126:14804] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/olik.php"] [unique_id "afwvzXvP1GkPUuuLfqX2-QAAAMI"]
[Thu May 07 14:23:09.995786 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:15600] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/olik.php"] [unique_id "afwvzSY4dZsLOttMkcc-yAAAARQ"]
[Thu May 07 14:23:10.418073 2026] [:error] [pid 15630:tid 15674] [client 52.138.31.126:16251] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/olik.php"] [unique_id "afwvznTithRAi4821qt_PQAAAI4"]
[Thu May 07 14:23:10.840628 2026] [:error] [pid 15630:tid 15667] [client 52.138.31.126:16144] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/olik.php"] [unique_id "afwvznTithRAi4821qt_QQAAAIc"]
[Thu May 07 14:23:11.257626 2026] [:error] [pid 15630:tid 15666] [client 52.138.31.126:7852] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h.php"] [unique_id "afwvz3TithRAi4821qt_RQAAAIY"]
[Thu May 07 14:23:11.682028 2026] [:error] [pid 15631:tid 15702] [client 52.138.31.126:15545] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h.php"] [unique_id "afwvz3vP1GkPUuuLfqX2-wAAAM8"]
[Thu May 07 14:23:12.103113 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:16215] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h.php"] [unique_id "afwv0CY4dZsLOttMkcc-zQAAAQk"]
[Thu May 07 14:23:12.525519 2026] [:error] [pid 15631:tid 15693] [client 52.138.31.126:14790] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/h.php"] [unique_id "afwv0HvP1GkPUuuLfqX2_AAAAMY"]
[Thu May 07 14:23:12.943665 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:14833] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "afwv0CY4dZsLOttMkcc-zgAAARI"]
[Thu May 07 14:23:13.358678 2026] [:error] [pid 15631:tid 15701] [client 52.138.31.126:16190] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "afwv0XvP1GkPUuuLfqX2_gAAAM4"]
[Thu May 07 14:23:13.776820 2026] [:error] [pid 15629:tid 15634] [client 52.138.31.126:16205] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "afwv0frIJCALdUrO43lJzwAAAAE"]
[Thu May 07 14:23:14.209168 2026] [:error] [pid 15630:tid 15663] [client 52.138.31.126:15511] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kj.php"] [unique_id "afwv0nTithRAi4821qt_SgAAAIM"]
[Thu May 07 14:23:14.628397 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:16200] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/about.php"] [unique_id "afwv0vrIJCALdUrO43lJ0AAAAAc"]
[Thu May 07 14:23:15.045678 2026] [:error] [pid 15631:tid 15700] [client 52.138.31.126:14814] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/about.php"] [unique_id "afwv03vP1GkPUuuLfqX2_wAAAM0"]
[Thu May 07 14:23:15.474331 2026] [:error] [pid 15630:tid 15664] [client 52.138.31.126:15520] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/about.php"] [unique_id "afwv03TithRAi4821qt_TAAAAIQ"]
[Thu May 07 14:23:15.923917 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:16242] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/about.php"] [unique_id "afwv03TithRAi4821qt_TQAAAJM"]
[Thu May 07 14:23:16.342635 2026] [:error] [pid 15630:tid 15668] [client 52.138.31.126:14786] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "afwv1HTithRAi4821qt_TgAAAIg"]
[Thu May 07 14:23:16.766621 2026] [:error] [pid 15630:tid 15661] [client 52.138.31.126:62050] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxl.php"] [unique_id "afwv1HTithRAi4821qt_TwAAAIE"]
[Thu May 07 14:23:17.181449 2026] [:error] [pid 15630:tid 15667] [client 52.138.31.126:7845] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxl.php"] [unique_id "afwv1XTithRAi4821qt_UAAAAIc"]
[Thu May 07 14:23:17.599426 2026] [:error] [pid 15630:tid 15677] [client 52.138.31.126:16197] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxl.php"] [unique_id "afwv1XTithRAi4821qt_UwAAAJE"]
[Thu May 07 14:23:18.021868 2026] [:error] [pid 15631:tid 15692] [client 52.138.31.126:15512] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxml.php"] [unique_id "afwv1nvP1GkPUuuLfqX3AgAAAMU"]
[Thu May 07 14:23:18.442123 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:14831] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxml.php"] [unique_id "afwv1nvP1GkPUuuLfqX3AwAAANQ"]
[Thu May 07 14:23:18.864030 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:14832] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxml.php"] [unique_id "afwv1iY4dZsLOttMkcc-0gAAARA"]
[Thu May 07 14:23:19.279465 2026] [:error] [pid 15629:tid 15637] [client 52.138.31.126:14828] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wpxml.php"] [unique_id "afwv1_rIJCALdUrO43lJ1gAAAAQ"]
[Thu May 07 14:23:19.697008 2026] [:error] [pid 15630:tid 15678] [client 52.138.31.126:15578] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afwv13TithRAi4821qt_WAAAAJI"]
[Thu May 07 14:23:20.130115 2026] [:error] [pid 15631:tid 15694] [client 52.138.31.126:15514] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afwv2HvP1GkPUuuLfqX3BgAAAMc"]
[Thu May 07 14:23:20.544708 2026] [:error] [pid 15715:tid 15734] [client 52.138.31.126:16229] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afwv2CY4dZsLOttMkcc-1AAAAQ4"]
[Thu May 07 14:23:20.966246 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:7890] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bob.php"] [unique_id "afwv2CY4dZsLOttMkcc-1gAAAQc"]
[Thu May 07 14:23:21.381720 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:15576] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afwv2SY4dZsLOttMkcc-1wAAARg"]
[Thu May 07 14:23:21.826074 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:15521] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afwv2frIJCALdUrO43lJ2wAAAAM"]
[Thu May 07 14:23:22.244172 2026] [:error] [pid 15715:tid 15739] [client 52.138.31.126:16243] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afwv2iY4dZsLOttMkcc-2AAAARM"]
[Thu May 07 14:23:22.696463 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:14811] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/spawns.php"] [unique_id "afwv2iY4dZsLOttMkcc-2gAAAQ8"]
[Thu May 07 14:23:23.177587 2026] [:error] [pid 15715:tid 15732] [client 52.138.31.126:16247] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afwv2yY4dZsLOttMkcc-2wAAAQw"]
[Thu May 07 14:23:23.593050 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:14839] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afwv2yY4dZsLOttMkcc-3AAAAQg"]
[Thu May 07 14:23:24.021759 2026] [:error] [pid 15715:tid 15722] [client 52.138.31.126:15567] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afwv3CY4dZsLOttMkcc-3gAAAQU"]
[Thu May 07 14:23:24.471890 2026] [:error] [pid 15629:tid 15653] [client 52.138.31.126:14815] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/t3s.php"] [unique_id "afwv3PrIJCALdUrO43lJ3gAAABQ"]
[Thu May 07 14:23:24.914760 2026] [:error] [pid 15715:tid 15733] [client 52.138.31.126:16226] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afwv3CY4dZsLOttMkcc-3wAAAQ0"]
[Thu May 07 14:23:25.331793 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:16193] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afwv3SY4dZsLOttMkcc-4AAAAQM"]
[Thu May 07 14:23:25.747404 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:16203] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afwv3SY4dZsLOttMkcc-5QAAAQs"]
[Thu May 07 14:23:26.170561 2026] [:error] [pid 15629:tid 15655] [client 52.138.31.126:16131] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/"] [unique_id "afwv3vrIJCALdUrO43lJ6AAAABY"]
[Thu May 07 14:23:26.637148 2026] [:error] [pid 15629:tid 15639] [client 52.138.31.126:7924] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afwv3vrIJCALdUrO43lJ6wAAAAY"]
[Thu May 07 14:23:27.161966 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:14813] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afwv33vP1GkPUuuLfqX3BwAAAMw"]
[Thu May 07 14:23:27.624328 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:15569] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afwv3_rIJCALdUrO43lJ7QAAAAM"]
[Thu May 07 14:23:28.095445 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:15565] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/x/"] [unique_id "afwv4CY4dZsLOttMkcc-8AAAAQg"]
[Thu May 07 14:23:28.561593 2026] [:error] [pid 15629:tid 15638] [client 52.138.31.126:15527] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afwv4PrIJCALdUrO43lJ8AAAAAU"]
[Thu May 07 14:23:28.993633 2026] [:error] [pid 15715:tid 15718] [client 52.138.31.126:15501] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afwv4CY4dZsLOttMkcc-8gAAAQE"]
[Thu May 07 14:23:29.410746 2026] [:error] [pid 15631:tid 15687] [client 52.138.31.126:16184] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afwv4XvP1GkPUuuLfqX3CAAAAMA"]
[Thu May 07 14:23:29.825835 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:14781] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afwv4XvP1GkPUuuLfqX3CgAAANg"]
[Thu May 07 14:23:30.264177 2026] [:error] [pid 15631:tid 15697] [client 52.138.31.126:14808] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afwv4nvP1GkPUuuLfqX3DAAAAMo"]
[Thu May 07 14:23:30.686172 2026] [:error] [pid 15631:tid 15698] [client 52.138.31.126:14771] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afwv4nvP1GkPUuuLfqX3DQAAAMs"]
[Thu May 07 14:23:31.103954 2026] [:error] [pid 15631:tid 15704] [client 52.138.31.126:16222] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afwv43vP1GkPUuuLfqX3EAAAANE"]
[Thu May 07 14:23:31.516623 2026] [:error] [pid 15629:tid 15641] [client 52.138.31.126:15518] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/configuration.php"] [unique_id "afwv4_rIJCALdUrO43lJ9QAAAAg"]
[Thu May 07 14:23:31.934217 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:62049] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwv4yY4dZsLOttMkcc-9AAAAQs"]
[Thu May 07 14:23:32.390789 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:16227] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwv5CY4dZsLOttMkcc-9QAAAQc"]
[Thu May 07 14:23:32.837630 2026] [:error] [pid 15715:tid 15721] [client 52.138.31.126:15575] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwv5CY4dZsLOttMkcc-9wAAAQQ"]
[Thu May 07 14:23:33.259074 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:15579] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "afwv5frIJCALdUrO43lJ-gAAAAM"]
[Thu May 07 14:23:33.684040 2026] [:error] [pid 15631:tid 15700] [client 52.138.31.126:14805] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afwv5XvP1GkPUuuLfqX3EQAAAM0"]
[Thu May 07 14:23:34.150726 2026] [:error] [pid 15629:tid 15638] [client 52.138.31.126:15561] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afwv5vrIJCALdUrO43lJ_QAAAAU"]
[Thu May 07 14:23:34.615772 2026] [:error] [pid 15629:tid 15656] [client 52.138.31.126:14793] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afwv5vrIJCALdUrO43lJ_wAAABc"]
[Thu May 07 14:23:35.032993 2026] [:error] [pid 15629:tid 15648] [client 52.138.31.126:15539] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwu.php"] [unique_id "afwv5_rIJCALdUrO43lKAAAAAA8"]
[Thu May 07 14:23:35.483902 2026] [:error] [pid 15629:tid 15642] [client 52.138.31.126:14816] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwa.php"] [unique_id "afwv5_rIJCALdUrO43lKAwAAAAk"]
[Thu May 07 14:23:35.906885 2026] [:error] [pid 15630:tid 15684] [client 52.138.31.126:7930] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwa.php"] [unique_id "afwv53TithRAi4821qt_WgAAAJg"]
[Thu May 07 14:23:36.319939 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:15562] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwa.php"] [unique_id "afwv6HTithRAi4821qt_WwAAAJM"]
[Thu May 07 14:23:36.748334 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:15488] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uwa.php"] [unique_id "afwv6CY4dZsLOttMkcc--gAAARU"]
[Thu May 07 14:23:37.185040 2026] [:error] [pid 15630:tid 15668] [client 52.138.31.126:15499] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "afwv6XTithRAi4821qt_XAAAAIg"]
[Thu May 07 14:23:37.633421 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:16134] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "afwv6SY4dZsLOttMkcc--wAAARg"]
[Thu May 07 14:23:38.101690 2026] [:error] [pid 15631:tid 15690] [client 52.138.31.126:14755] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "afwv6nvP1GkPUuuLfqX3FQAAAMM"]
[Thu May 07 14:23:38.545774 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:15599] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "afwv6iY4dZsLOttMkcc-_AAAARQ"]
[Thu May 07 14:23:38.967676 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:16133] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "afwv6iY4dZsLOttMkcc-_QAAAQk"]
[Thu May 07 14:23:39.438002 2026] [:error] [pid 15631:tid 15694] [client 52.138.31.126:14733] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "afwv63vP1GkPUuuLfqX3FgAAAMc"]
[Thu May 07 14:23:39.904530 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:15549] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "afwv63vP1GkPUuuLfqX3FwAAANg"]
[Thu May 07 14:23:40.319908 2026] [:error] [pid 15631:tid 15697] [client 52.138.31.126:16241] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "afwv7HvP1GkPUuuLfqX3GgAAAMo"]
[Thu May 07 14:23:40.742567 2026] [:error] [pid 15631:tid 15688] [client 52.138.31.126:15503] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "afwv7HvP1GkPUuuLfqX3GwAAAME"]
[Thu May 07 14:23:41.156490 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:15534] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "afwv7frIJCALdUrO43lKCAAAAAM"]
[Thu May 07 14:23:41.614177 2026] [:error] [pid 15715:tid 15718] [client 52.138.31.126:16167] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "afwv7SY4dZsLOttMkcc-_gAAAQE"]
[Thu May 07 14:23:42.029273 2026] [:error] [pid 15715:tid 15733] [client 52.138.31.126:16244] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "afwv7iY4dZsLOttMkcc-_wAAAQ0"]
[Thu May 07 14:23:42.447416 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:16161] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afwv7iY4dZsLOttMkcc_AAAAAQA"]
[Thu May 07 14:23:42.863895 2026] [:error] [pid 15631:tid 15708] [client 52.138.31.126:14786] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afwv7nvP1GkPUuuLfqX3HAAAANU"]
[Thu May 07 14:23:43.281046 2026] [:error] [pid 15631:tid 15702] [client 52.138.31.126:7881] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afwv73vP1GkPUuuLfqX3HQAAAM8"]
[Thu May 07 14:23:43.697687 2026] [:error] [pid 15631:tid 15701] [client 52.138.31.126:16173] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/byypas.php"] [unique_id "afwv73vP1GkPUuuLfqX3HgAAAM4"]
[Thu May 07 14:23:44.112082 2026] [:error] [pid 15715:tid 15721] [client 52.138.31.126:14740] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "afwv8CY4dZsLOttMkcc_AwAAAQQ"]
[Thu May 07 14:23:44.527909 2026] [:error] [pid 15715:tid 15719] [client 52.138.31.126:14784] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "afwv8CY4dZsLOttMkcc_BQAAAQI"]
[Thu May 07 14:23:44.945740 2026] [:error] [pid 15631:tid 15700] [client 52.138.31.126:15522] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "afwv8HvP1GkPUuuLfqX3HwAAAM0"]
[Thu May 07 14:23:45.381549 2026] [:error] [pid 15631:tid 15696] [client 52.138.31.126:14836] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "afwv8XvP1GkPUuuLfqX3IAAAAMk"]
[Thu May 07 14:23:45.804931 2026] [:error] [pid 15630:tid 15669] [client 52.138.31.126:16151] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoko.php"] [unique_id "afwv8XTithRAi4821qt_awAAAIk"]
[Thu May 07 14:23:46.226869 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:16213] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoko.php"] [unique_id "afwv8nvP1GkPUuuLfqX3IgAAANQ"]
[Thu May 07 14:23:46.712702 2026] [:error] [pid 15631:tid 15691] [client 52.138.31.126:16214] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoko.php"] [unique_id "afwv8nvP1GkPUuuLfqX3JAAAAMQ"]
[Thu May 07 14:23:47.252908 2026] [:error] [pid 15629:tid 15634] [client 52.138.31.126:16236] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoko.php"] [unique_id "afwv8_rIJCALdUrO43lKCwAAAAE"]
[Thu May 07 14:23:47.765400 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:15526] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class892.php"] [unique_id "afwv83vP1GkPUuuLfqX3KAAAAMw"]
[Thu May 07 14:23:48.182005 2026] [:error] [pid 15629:tid 15648] [client 52.138.31.126:14759] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class892.php"] [unique_id "afwv9PrIJCALdUrO43lKDAAAAA8"]
[Thu May 07 14:23:48.599474 2026] [:error] [pid 15631:tid 15698] [client 52.138.31.126:15494] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class892.php"] [unique_id "afwv9HvP1GkPUuuLfqX3KQAAAMs"]
[Thu May 07 14:23:49.020137 2026] [:error] [pid 15631:tid 15687] [client 52.138.31.126:16219] File does not exist: /usr/local/apache/htdocs/suspended-page/class892.php
[Thu May 07 14:23:49.231944 2026] [:error] [pid 15631:tid 15688] [client 52.138.31.126:16219] File does not exist: /usr/local/apache/htdocs/suspended-page/locales.php
[Thu May 07 14:23:49.444435 2026] [:error] [pid 15631:tid 15693] [client 52.138.31.126:16219] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Thu May 07 14:23:49.654833 2026] [:error] [pid 15631:tid 15704] [client 52.138.31.126:16219] File does not exist: /usr/local/apache/htdocs/suspended-page/pucci.php
[Thu May 07 14:23:50.724097 2026] [:error] [pid 15631:tid 15706] [client 52.138.31.126:16219] File does not exist: /usr/local/apache/htdocs/suspended-page/one.php
[Thu May 07 14:23:50.933686 2026] [:error] [pid 15631:tid 15691] [client 52.138.31.126:16219] File does not exist: /usr/local/apache/htdocs/suspended-page/no20.php
[Thu May 07 14:23:51.143469 2026] [:error] [pid 15631:tid 15709] [client 52.138.31.126:16219] File does not exist: /usr/local/apache/htdocs/suspended-page/yasnu.php
[Thu May 07 14:23:51.350553 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:16219] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sl.php"] [unique_id "afwv93vP1GkPUuuLfqX3NwAAANg"]
[Thu May 07 14:23:51.777401 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:15554] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sl.php"] [unique_id "afwv9yY4dZsLOttMkcc_DQAAAQA"]
[Thu May 07 14:23:52.204966 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:7928] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sl.php"] [unique_id "afwv-HvP1GkPUuuLfqX3OQAAAMw"]
[Thu May 07 14:23:52.629134 2026] [:error] [pid 15631:tid 15690] [client 52.138.31.126:15495] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sl.php"] [unique_id "afwv-HvP1GkPUuuLfqX3OgAAAMM"]
[Thu May 07 14:23:53.051866 2026] [:error] [pid 15631:tid 15698] [client 52.138.31.126:16248] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "afwv-XvP1GkPUuuLfqX3OwAAAMs"]
[Thu May 07 14:23:53.487125 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:15560] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "afwv-SY4dZsLOttMkcc_IgAAAQA"]
[Thu May 07 14:23:53.917918 2026] [:error] [pid 15715:tid 15733] [client 52.138.31.126:15582] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "afwv-SY4dZsLOttMkcc_IwAAAQ0"]
[Thu May 07 14:23:54.374757 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:14800] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "afwv-iY4dZsLOttMkcc_JAAAARI"]
[Thu May 07 14:23:54.885448 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:15510] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afwv-iY4dZsLOttMkcc_JQAAAQM"]
[Thu May 07 14:23:55.354736 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:15570] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afwv-yY4dZsLOttMkcc_JgAAAQY"]
[Thu May 07 14:23:55.816481 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:7830] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afwv-yY4dZsLOttMkcc_JwAAAQc"]
[Thu May 07 14:23:56.239394 2026] [:error] [pid 15631:tid 15705] [client 52.138.31.126:14787] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afwv_HvP1GkPUuuLfqX3PgAAANI"]
[Thu May 07 14:23:56.660192 2026] [:error] [pid 15629:tid 15641] [client 52.138.31.126:14845] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afwv_PrIJCALdUrO43lKEwAAAAg"]
[Thu May 07 14:23:57.083971 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:14819] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afwv_SY4dZsLOttMkcc_LQAAARI"]
[Thu May 07 14:23:57.505227 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:14825] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afwv_SY4dZsLOttMkcc_LwAAAQM"]
[Thu May 07 14:23:57.928620 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:16187] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afwv_XTithRAi4821qt_ewAAAJM"]
[Thu May 07 14:23:58.348247 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:16176] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afwv_iY4dZsLOttMkcc_MAAAAQs"]
[Thu May 07 14:23:58.765364 2026] [:error] [pid 15715:tid 15737] [client 52.138.31.126:15610] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afwv_iY4dZsLOttMkcc_MwAAARE"]
[Thu May 07 14:23:59.218975 2026] [:error] [pid 15631:tid 15697] [client 52.138.31.126:15590] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afwv_3vP1GkPUuuLfqX3RAAAAMo"]
[Thu May 07 14:23:59.666466 2026] [:error] [pid 15631:tid 15690] [client 52.138.31.126:15606] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "afwv_3vP1GkPUuuLfqX3RQAAAMM"]
[Thu May 07 14:24:00.113568 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:16225] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "afwwAPrIJCALdUrO43lKFQAAAAc"]
[Thu May 07 14:24:00.559841 2026] [:error] [pid 15631:tid 15710] [client 52.138.31.126:15530] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "afwwAHvP1GkPUuuLfqX3SQAAANc"]
[Thu May 07 14:24:00.996385 2026] [:error] [pid 15631:tid 15689] [client 52.138.31.126:14770] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "afwwAHvP1GkPUuuLfqX3SgAAAMI"]
[Thu May 07 14:24:01.420086 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:16164] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-xme.php"] [unique_id "afwwAXvP1GkPUuuLfqX3TAAAANQ"]
[Thu May 07 14:24:01.885185 2026] [:error] [pid 15630:tid 15680] [client 52.138.31.126:16141] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "afwwAXTithRAi4821qt_gQAAAJQ"]
[Thu May 07 14:24:02.350056 2026] [:error] [pid 15631:tid 15694] [client 52.138.31.126:16146] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "afwwAnvP1GkPUuuLfqX3TQAAAMc"]
[Thu May 07 14:24:02.765839 2026] [:error] [pid 15631:tid 15692] [client 52.138.31.126:16150] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "afwwAnvP1GkPUuuLfqX3TgAAAMU"]
[Thu May 07 14:24:03.187895 2026] [:error] [pid 15630:tid 15666] [client 52.138.31.126:14797] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminer.php"] [unique_id "afwwA3TithRAi4821qt_hQAAAIY"]
[Thu May 07 14:24:03.609214 2026] [:error] [pid 15630:tid 15673] [client 52.138.31.126:16206] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afwwA3TithRAi4821qt_hgAAAI0"]
[Thu May 07 14:24:04.061280 2026] [:error] [pid 15630:tid 15664] [client 52.138.31.126:14763] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afwwBHTithRAi4821qt_hwAAAIQ"]
[Thu May 07 14:24:04.484464 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:16174] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afwwBCY4dZsLOttMkcc_PAAAARI"]
[Thu May 07 14:24:04.906955 2026] [:error] [pid 15631:tid 15701] [client 52.138.31.126:15611] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ktfow.php"] [unique_id "afwwBHvP1GkPUuuLfqX3WgAAAM4"]
[Thu May 07 14:24:05.352408 2026] [:error] [pid 15631:tid 15705] [client 52.138.31.126:14767] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afwwBXvP1GkPUuuLfqX3WwAAANI"]
[Thu May 07 14:24:05.767984 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:62061] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afwwBSY4dZsLOttMkcc_QwAAARA"]
[Thu May 07 14:24:06.200392 2026] [:error] [pid 15629:tid 15649] [client 52.138.31.126:16209] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afwwBvrIJCALdUrO43lKGgAAABA"]
[Thu May 07 14:24:06.621106 2026] [:error] [pid 15631:tid 15706] [client 52.138.31.126:62030] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "afwwBnvP1GkPUuuLfqX3YAAAANM"]
[Thu May 07 14:24:07.076613 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:15547] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afwwByY4dZsLOttMkcc_TwAAARI"]
[Thu May 07 14:24:07.564452 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:14798] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afwwByY4dZsLOttMkcc_VAAAAQo"]
[Thu May 07 14:24:08.007648 2026] [:error] [pid 15715:tid 15718] [client 52.138.31.126:15604] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afwwCCY4dZsLOttMkcc_WAAAAQE"]
[Thu May 07 14:24:08.453221 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:16132] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2468.php"] [unique_id "afwwCCY4dZsLOttMkcc_WgAAARQ"]
[Thu May 07 14:24:08.908152 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:16185] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afwwCHvP1GkPUuuLfqX3aAAAAMw"]
[Thu May 07 14:24:09.337588 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:14727] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afwwCSY4dZsLOttMkcc_ZAAAAQM"]
[Thu May 07 14:24:09.754759 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:14720] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afwwCXTithRAi4821qt_rwAAAJM"]
[Thu May 07 14:24:10.202284 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:14732] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/index.php"] [unique_id "afwwCiY4dZsLOttMkcc_bgAAAQg"]
[Thu May 07 14:24:10.622899 2026] [:error] [pid 15629:tid 15655] [client 52.138.31.126:15607] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwCvrIJCALdUrO43lKHQAAABY"]
[Thu May 07 14:24:11.085256 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:16171] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwCyY4dZsLOttMkcc_dwAAARQ"]
[Thu May 07 14:24:11.560081 2026] [:error] [pid 15630:tid 15666] [client 52.138.31.126:16152] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwC3TithRAi4821qt_wwAAAIY"]
[Thu May 07 14:24:11.980323 2026] [:error] [pid 15631:tid 15690] [client 52.138.31.126:15594] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwC3vP1GkPUuuLfqX3dAAAAMM"]
[Thu May 07 14:24:12.402411 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:16155] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afwwDCY4dZsLOttMkcc_fQAAAQk"]
[Thu May 07 14:24:12.823709 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:14846] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afwwDHTithRAi4821qt_xQAAAJM"]
[Thu May 07 14:24:13.301376 2026] [:error] [pid 15630:tid 15667] [client 52.138.31.126:16253] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afwwDXTithRAi4821qt_xwAAAIc"]
[Thu May 07 14:24:13.756398 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:14823] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/amdin.php"] [unique_id "afwwDfrIJCALdUrO43lKIQAAAAc"]
[Thu May 07 14:24:14.180013 2026] [:error] [pid 15631:tid 15693] [client 52.138.31.126:7872] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "afwwDnvP1GkPUuuLfqX3eQAAAMY"]
[Thu May 07 14:24:14.601022 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:14799] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "afwwDiY4dZsLOttMkcc_hwAAARU"]
[Thu May 07 14:24:15.018964 2026] [:error] [pid 15631:tid 15705] [client 52.138.31.126:7831] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "afwwD3vP1GkPUuuLfqX3fwAAANI"]
[Thu May 07 14:24:15.505103 2026] [:error] [pid 15715:tid 15737] [client 52.138.31.126:14838] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/huya.php"] [unique_id "afwwDyY4dZsLOttMkcc_lAAAARE"]
[Thu May 07 14:24:15.998789 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:16149] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "afwwDyY4dZsLOttMkcc_mgAAAQo"]
[Thu May 07 14:24:16.533517 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:14794] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "afwwECY4dZsLOttMkcc_oQAAAQM"]
[Thu May 07 14:24:17.017586 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:14758] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "afwwESY4dZsLOttMkcc_pwAAARU"]
[Thu May 07 14:24:17.520500 2026] [:error] [pid 15715:tid 15732] [client 52.138.31.126:16212] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/puc.php"] [unique_id "afwwESY4dZsLOttMkcc_qgAAAQw"]
[Thu May 07 14:24:17.934712 2026] [:error] [pid 15630:tid 15683] [client 52.138.31.126:14824] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "afwwEXTithRAi4821qt_0gAAAJc"]
[Thu May 07 14:24:18.376531 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:7931] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "afwwEiY4dZsLOttMkcc_rgAAAQM"]
[Thu May 07 14:24:18.798872 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:14764] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "afwwEiY4dZsLOttMkcc_sAAAARg"]
[Thu May 07 14:24:19.230699 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:15551] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "afwwEyY4dZsLOttMkcc_sQAAARU"]
[Thu May 07 14:24:19.659429 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:16130] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "afwwEyY4dZsLOttMkcc_swAAARQ"]
[Thu May 07 14:24:20.101348 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:14810] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "afwwFCY4dZsLOttMkcc_tQAAAQo"]
[Thu May 07 14:24:20.597861 2026] [:error] [pid 15715:tid 15734] [client 52.138.31.126:15501] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "afwwFCY4dZsLOttMkcc_tgAAAQ4"]
[Thu May 07 14:24:21.040972 2026] [:error] [pid 15715:tid 15743] [client 52.138.31.126:16128] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ewp.php"] [unique_id "afwwFSY4dZsLOttMkcc_twAAARc"]
[Thu May 07 14:24:21.506662 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:7886] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwFXvP1GkPUuuLfqX36QAAANg"]
[Thu May 07 14:24:21.974439 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:7891] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwFXTithRAi4821qt_1AAAAJM"]
[Thu May 07 14:24:22.415301 2026] [:error] [pid 15715:tid 15733] [client 52.138.31.126:14806] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwFiY4dZsLOttMkcc_uQAAAQ0"]
[Thu May 07 14:24:22.830812 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:16182] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dx.php"] [unique_id "afwwFiY4dZsLOttMkcc_ugAAAQs"]
[Thu May 07 14:24:23.264064 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:14722] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "afwwFyY4dZsLOttMkcc_uwAAAQM"]
[Thu May 07 14:24:23.691669 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:14745] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "afwwFyY4dZsLOttMkcc_vAAAAQA"]
[Thu May 07 14:24:24.143571 2026] [:error] [pid 15715:tid 15718] [client 52.138.31.126:15498] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "afwwGCY4dZsLOttMkcc_vgAAAQE"]
[Thu May 07 14:24:24.633907 2026] [:error] [pid 15629:tid 15657] [client 52.138.31.126:15595] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xff.php"] [unique_id "afwwGPrIJCALdUrO43lKQQAAABg"]
[Thu May 07 14:24:25.084020 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:14731] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "afwwGSY4dZsLOttMkcc_wAAAAQc"]
[Thu May 07 14:24:25.514109 2026] [:error] [pid 15630:tid 15661] [client 52.138.31.126:14783] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "afwwGXTithRAi4821qt_1gAAAIE"]
[Thu May 07 14:24:25.931336 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:16162] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "afwwGSY4dZsLOttMkcc_wgAAARQ"]
[Thu May 07 14:24:26.349761 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:62051] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lupo.php"] [unique_id "afwwGiY4dZsLOttMkcc_wwAAAQk"]
[Thu May 07 14:24:26.770388 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:15548] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "afwwGiY4dZsLOttMkcc_xQAAAQo"]
[Thu May 07 14:24:27.195572 2026] [:error] [pid 15715:tid 15721] [client 52.138.31.126:16158] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "afwwGyY4dZsLOttMkcc_xgAAAQQ"]
[Thu May 07 14:24:27.611688 2026] [:error] [pid 15631:tid 15695] [client 52.138.31.126:15589] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "afwwG3vP1GkPUuuLfqX36wAAAMg"]
[Thu May 07 14:24:28.040920 2026] [:error] [pid 15631:tid 15688] [client 52.138.31.126:16178] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/awa.php"] [unique_id "afwwHHvP1GkPUuuLfqX37AAAAME"]
[Thu May 07 14:24:28.475584 2026] [:error] [pid 15630:tid 15682] [client 52.138.31.126:62018] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "afwwHHTithRAi4821qt_2AAAAJY"]
[Thu May 07 14:24:28.895553 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:14802] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "afwwHCY4dZsLOttMkcc_yAAAARI"]
[Thu May 07 14:24:29.329327 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:16138] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "afwwHSY4dZsLOttMkcc_ygAAAQs"]
[Thu May 07 14:24:29.831895 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:14758] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/popo.php"] [unique_id "afwwHSY4dZsLOttMkcc_ywAAAQA"]
[Thu May 07 14:24:30.286321 2026] [:error] [pid 15715:tid 15719] [client 52.138.31.126:14785] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "afwwHiY4dZsLOttMkcc_zAAAAQI"]
[Thu May 07 14:24:30.747272 2026] [:error] [pid 15630:tid 15662] [client 52.138.31.126:62031] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "afwwHnTithRAi4821qt_2gAAAII"]
[Thu May 07 14:24:31.166918 2026] [:error] [pid 15631:tid 15702] [client 52.138.31.126:7839] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "afwwH3vP1GkPUuuLfqX37gAAAM8"]
[Thu May 07 14:24:31.601774 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:62045] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/13.php"] [unique_id "afwwH3vP1GkPUuuLfqX37wAAANQ"]
[Thu May 07 14:24:32.023550 2026] [:error] [pid 15630:tid 15683] [client 52.138.31.126:15532] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tews.php"] [unique_id "afwwIHTithRAi4821qt_2wAAAJc"]
[Thu May 07 14:24:32.438463 2026] [:error] [pid 15630:tid 15681] [client 52.138.31.126:7899] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tews.php"] [unique_id "afwwIHTithRAi4821qt_3AAAAJU"]
[Thu May 07 14:24:32.870738 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:15611] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tews.php"] [unique_id "afwwIPrIJCALdUrO43lKSAAAAAM"]
[Thu May 07 14:24:33.287144 2026] [:error] [pid 15631:tid 15697] [client 52.138.31.126:14821] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tews.php"] [unique_id "afwwIXvP1GkPUuuLfqX38QAAAMo"]
[Thu May 07 14:24:33.750969 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:16202] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afwwIXvP1GkPUuuLfqX38gAAANg"]
[Thu May 07 14:24:34.220115 2026] [:error] [pid 15630:tid 15664] [client 52.138.31.126:14796] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afwwInTithRAi4821qt_3wAAAIQ"]
[Thu May 07 14:24:34.669978 2026] [:error] [pid 15631:tid 15692] [client 52.138.31.126:14769] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afwwInvP1GkPUuuLfqX38wAAAMU"]
[Thu May 07 14:24:35.123794 2026] [:error] [pid 15631:tid 15698] [client 52.138.31.126:14837] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "afwwI3vP1GkPUuuLfqX39gAAAMs"]
[Thu May 07 14:24:35.538795 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:14807] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afwwIyY4dZsLOttMkcc_zQAAAQY"]
[Thu May 07 14:24:35.960841 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:16205] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afwwIyY4dZsLOttMkcc_zgAAARQ"]
[Thu May 07 14:24:36.404701 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:16208] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afwwJCY4dZsLOttMkcc_zwAAAQk"]
[Thu May 07 14:24:36.854932 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:15525] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "afwwJCY4dZsLOttMkcc_0AAAAQo"]
[Thu May 07 14:24:37.269416 2026] [:error] [pid 15629:tid 15652] [client 52.138.31.126:15571] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afwwJfrIJCALdUrO43lKSgAAABM"]
[Thu May 07 14:24:37.690256 2026] [:error] [pid 15629:tid 15657] [client 52.138.31.126:15513] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afwwJfrIJCALdUrO43lKSwAAABg"]
[Thu May 07 14:24:38.110636 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:7882] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afwwJnvP1GkPUuuLfqX39wAAAMw"]
[Thu May 07 14:24:38.527761 2026] [:error] [pid 15630:tid 15665] [client 52.138.31.126:62016] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/p.php"] [unique_id "afwwJnTithRAi4821qt_5QAAAIU"]
[Thu May 07 14:24:38.948790 2026] [:error] [pid 15630:tid 15670] [client 52.138.31.126:7908] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afwwJnTithRAi4821qt_5gAAAIo"]
[Thu May 07 14:24:39.362559 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:15524] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afwwJyY4dZsLOttMkcc_0gAAAQ8"]
[Thu May 07 14:24:39.775316 2026] [:error] [pid 15630:tid 15680] [client 52.138.31.126:16172] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afwwJ3TithRAi4821qt_6gAAAJQ"]
[Thu May 07 14:24:40.199899 2026] [:error] [pid 15629:tid 15635] [client 52.138.31.126:7808] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/Requests/"] [unique_id "afwwKPrIJCALdUrO43lKTQAAAAI"]
[Thu May 07 14:24:40.648285 2026] [:error] [pid 15631:tid 15700] [client 52.138.31.126:15542] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afwwKHvP1GkPUuuLfqX3_AAAAM0"]
[Thu May 07 14:24:41.097416 2026] [:error] [pid 15630:tid 15660] [client 52.138.31.126:7911] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afwwKXTithRAi4821qt_6wAAAIA"]
[Thu May 07 14:24:41.515745 2026] [:error] [pid 15629:tid 15655] [client 52.138.31.126:16217] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afwwKfrIJCALdUrO43lKTwAAABY"]
[Thu May 07 14:24:41.930579 2026] [:error] [pid 15631:tid 15706] [client 52.138.31.126:16148] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "afwwKXvP1GkPUuuLfqX3_QAAANM"]
[Thu May 07 14:24:42.349176 2026] [:error] [pid 15631:tid 15702] [client 52.138.31.126:7880] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afwwKnvP1GkPUuuLfqX3_wAAAM8"]
[Thu May 07 14:24:42.775000 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:15581] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afwwKiY4dZsLOttMkcc_1AAAARI"]
[Thu May 07 14:24:43.195969 2026] [:error] [pid 15629:tid 15643] [client 52.138.31.126:7809] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afwwK_rIJCALdUrO43lKUQAAAAo"]
[Thu May 07 14:24:43.613285 2026] [:error] [pid 15630:tid 15670] [client 52.138.31.126:7877] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shell.php"] [unique_id "afwwK3TithRAi4821qt_7wAAAIo"]
[Thu May 07 14:24:44.080266 2026] [:error] [pid 15630:tid 15676] [client 52.138.31.126:14734] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "afwwLHTithRAi4821qt_8AAAAJA"]
[Thu May 07 14:24:44.532717 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:7907] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "afwwLHvP1GkPUuuLfqX4AQAAANg"]
[Thu May 07 14:24:45.014445 2026] [:error] [pid 15715:tid 15733] [client 52.138.31.126:14830] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "afwwLSY4dZsLOttMkcc_1wAAAQ0"]
[Thu May 07 14:24:45.465159 2026] [:error] [pid 15630:tid 15683] [client 52.138.31.126:14795] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/seo.php"] [unique_id "afwwLXTithRAi4821qt_8gAAAJc"]
[Thu May 07 14:24:45.883223 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:15587] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "afwwLfrIJCALdUrO43lKVAAAAAM"]
[Thu May 07 14:24:46.331949 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:16139] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "afwwLiY4dZsLOttMkcc_2QAAAQg"]
[Thu May 07 14:24:46.775881 2026] [:error] [pid 15715:tid 15719] [client 52.138.31.126:14817] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "afwwLiY4dZsLOttMkcc_2gAAAQI"]
[Thu May 07 14:24:47.204547 2026] [:error] [pid 15630:tid 15663] [client 52.138.31.126:14751] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "afwwL3TithRAi4821qt_9AAAAIM"]
[Thu May 07 14:24:47.622114 2026] [:error] [pid 15715:tid 15742] [client 52.138.31.126:14812] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afwwLyY4dZsLOttMkcc_3gAAARY"]
[Thu May 07 14:24:48.040317 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:15555] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afwwMCY4dZsLOttMkcc_4AAAAQY"]
[Thu May 07 14:24:48.463353 2026] [:error] [pid 15715:tid 15739] [client 52.138.31.126:62079] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afwwMCY4dZsLOttMkcc_6wAAARM"]
[Thu May 07 14:24:48.876404 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:15550] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "afwwMCY4dZsLOttMkcc_7QAAAQM"]
[Thu May 07 14:24:49.298890 2026] [:error] [pid 15715:tid 15718] [client 52.138.31.126:14842] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "afwwMSY4dZsLOttMkcc_7gAAAQE"]
[Thu May 07 14:24:49.721141 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:14818] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "afwwMSY4dZsLOttMkcc_8QAAAQA"]
[Thu May 07 14:24:50.172440 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:14754] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "afwwMiY4dZsLOttMkcc_8gAAAQs"]
[Thu May 07 14:24:50.620770 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:14775] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "afwwMiY4dZsLOttMkcc_8wAAAQo"]
[Thu May 07 14:24:51.042822 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:7870] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Thu May 07 14:24:51.252972 2026] [:error] [pid 15715:tid 15734] [client 52.138.31.126:7870] File does not exist: /usr/local/apache/htdocs/suspended-page/3.php
[Thu May 07 14:24:51.462803 2026] [:error] [pid 15715:tid 15743] [client 52.138.31.126:7870] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Thu May 07 14:24:51.672856 2026] [:error] [pid 15715:tid 15732] [client 52.138.31.126:7870] File does not exist: /usr/local/apache/htdocs/suspended-page/5.php
[Thu May 07 14:24:51.882681 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:7870] File does not exist: /usr/local/apache/htdocs/suspended-page/6.php
[Thu May 07 14:24:52.089169 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:7870] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/js/nss.php"] [unique_id "afwwNCY4dZsLOttMkcdAAwAAAQs"]
[Thu May 07 14:24:52.506347 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:16166] File does not exist: /usr/local/apache/htdocs/suspended-page/class.php
[Thu May 07 14:24:52.717005 2026] [:error] [pid 15715:tid 15743] [client 52.138.31.126:16166] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Thu May 07 14:24:53.139414 2026] [:error] [pid 15715:tid 15733] [client 52.138.31.126:16166] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Thu May 07 14:24:53.351348 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:16166] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Thu May 07 14:24:53.562506 2026] [:error] [pid 15715:tid 15742] [client 52.138.31.126:16166] File does not exist: /usr/local/apache/htdocs/suspended-page/hplfuns.php
[Thu May 07 14:24:53.770057 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:16166] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afwwNSY4dZsLOttMkcdAEAAAAQA"]
[Thu May 07 14:24:54.185086 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:14840] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afwwNiY4dZsLOttMkcdAEwAAAQc"]
[Thu May 07 14:24:54.613532 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:7893] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afwwNiY4dZsLOttMkcdAGAAAARQ"]
[Thu May 07 14:24:55.033980 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:15603] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "afwwN_rIJCALdUrO43lKZwAAAAc"]
[Thu May 07 14:24:55.459818 2026] [:error] [pid 15629:tid 15651] [client 52.138.31.126:61958] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afwwN_rIJCALdUrO43lKagAAABI"]
[Thu May 07 14:24:55.872579 2026] [:error] [pid 15715:tid 15718] [client 52.138.31.126:55502] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afwwNyY4dZsLOttMkcdAHwAAAQE"]
[Thu May 07 14:24:56.315098 2026] [:error] [pid 15629:tid 15634] [client 52.138.31.126:15533] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afwwOPrIJCALdUrO43lKawAAAAE"]
[Thu May 07 14:24:56.734460 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:14752] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "afwwOCY4dZsLOttMkcdAIgAAAQo"]
[Thu May 07 14:24:57.152176 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:55527] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "afwwOSY4dZsLOttMkcdAJAAAARU"]
[Thu May 07 14:24:57.572212 2026] [:error] [pid 15631:tid 15710] [client 52.138.31.126:14788] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "afwwOXvP1GkPUuuLfqX4EgAAANc"]
[Thu May 07 14:24:57.989398 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:7933] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "afwwOSY4dZsLOttMkcdAJgAAAQk"]
[Thu May 07 14:24:58.411336 2026] [:error] [pid 15630:tid 15677] [client 52.138.31.126:15528] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inege.php"] [unique_id "afwwOnTithRAi4821qt__wAAAJE"]
[Thu May 07 14:24:58.825100 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:14803] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afwwOiY4dZsLOttMkcdAKgAAARI"]
[Thu May 07 14:24:59.243992 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:7887] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afwwOyY4dZsLOttMkcdANgAAAQs"]
[Thu May 07 14:24:59.659402 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:15537] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afwwOyY4dZsLOttMkcdARgAAAQc"]
[Thu May 07 14:25:00.073796 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:7824] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/midnight/"] [unique_id "afwwPHvP1GkPUuuLfqX4FQAAAMw"]
[Thu May 07 14:25:00.493044 2026] [:error] [pid 15631:tid 15691] [client 52.138.31.126:7828] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "afwwPHvP1GkPUuuLfqX4FwAAAMQ"]
[Thu May 07 14:25:00.905600 2026] [:error] [pid 15631:tid 15700] [client 52.138.31.126:14809] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "afwwPHvP1GkPUuuLfqX4GQAAAM0"]
[Thu May 07 14:25:01.333502 2026] [:error] [pid 15631:tid 15702] [client 52.138.31.126:15497] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "afwwPXvP1GkPUuuLfqX4GgAAAM8"]
[Thu May 07 14:25:01.747355 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:7932] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "afwwPXvP1GkPUuuLfqX4HQAAANQ"]
[Thu May 07 14:25:02.163315 2026] [:error] [pid 15631:tid 15689] [client 52.138.31.126:7846] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "afwwPnvP1GkPUuuLfqX4HwAAAMI"]
[Thu May 07 14:25:02.581627 2026] [:error] [pid 15629:tid 15657] [client 52.138.31.126:61952] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "afwwPvrIJCALdUrO43lKdAAAABg"]
[Thu May 07 14:25:03.006428 2026] [:error] [pid 15631:tid 15696] [client 52.138.31.126:14762] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "afwwP3vP1GkPUuuLfqX4IgAAAMk"]
[Thu May 07 14:25:03.426451 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:61963] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w2025.php"] [unique_id "afwwPyY4dZsLOttMkcdASAAAAQ8"]
[Thu May 07 14:25:03.839922 2026] [:error] [pid 15630:tid 15669] [client 52.138.31.126:14847] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "afwwP3TithRAi4821quABAAAAIk"]
[Thu May 07 14:25:04.297859 2026] [:error] [pid 15629:tid 15647] [client 52.138.31.126:14843] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "afwwQPrIJCALdUrO43lKeQAAAA4"]
[Thu May 07 14:25:04.711677 2026] [:error] [pid 15631:tid 15709] [client 52.138.31.126:62039] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "afwwQHvP1GkPUuuLfqX4JQAAANY"]
[Thu May 07 14:25:05.157779 2026] [:error] [pid 15630:tid 15668] [client 52.138.31.126:15593] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fvvff.php"] [unique_id "afwwQXTithRAi4821quACgAAAIg"]
[Thu May 07 14:25:05.607148 2026] [:error] [pid 15631:tid 15692] [client 52.138.31.126:7837] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "afwwQXvP1GkPUuuLfqX4JwAAAMU"]
[Thu May 07 14:25:06.057075 2026] [:error] [pid 15631:tid 15701] [client 52.138.31.126:7863] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "afwwQnvP1GkPUuuLfqX4KQAAAM4"]
[Thu May 07 14:25:06.506372 2026] [:error] [pid 15631:tid 15703] [client 52.138.31.126:14749] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "afwwQnvP1GkPUuuLfqX4KgAAANA"]
[Thu May 07 14:25:06.950295 2026] [:error] [pid 15630:tid 15671] [client 52.138.31.126:7922] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "afwwQnTithRAi4821quADgAAAIs"]
[Thu May 07 14:25:07.396789 2026] [:error] [pid 15630:tid 15680] [client 52.138.31.126:55441] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afwwQ3TithRAi4821quAEQAAAJQ"]
[Thu May 07 14:25:07.813942 2026] [:error] [pid 15629:tid 15654] [client 52.138.31.126:55500] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afwwQ_rIJCALdUrO43lKfgAAABU"]
[Thu May 07 14:25:08.233166 2026] [:error] [pid 15715:tid 15739] [client 52.138.31.126:14768] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afwwRCY4dZsLOttMkcdATQAAARM"]
[Thu May 07 14:25:08.652206 2026] [:error] [pid 15629:tid 15642] [client 52.138.31.126:7894] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "afwwRPrIJCALdUrO43lKggAAAAk"]
[Thu May 07 14:25:09.068544 2026] [:error] [pid 15629:tid 15655] [client 52.138.31.126:61960] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwRfrIJCALdUrO43lKgwAAABY"]
[Thu May 07 14:25:09.485796 2026] [:error] [pid 15631:tid 15702] [client 52.138.31.126:62027] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwRXvP1GkPUuuLfqX4LgAAAM8"]
[Thu May 07 14:25:09.899668 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:14741] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwRXvP1GkPUuuLfqX4MQAAANQ"]
[Thu May 07 14:25:10.312894 2026] [:error] [pid 15715:tid 15742] [client 52.138.31.126:62036] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwRiY4dZsLOttMkcdAUAAAARY"]
[Thu May 07 14:25:10.754970 2026] [:error] [pid 15715:tid 15737] [client 52.138.31.126:15558] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afwwRiY4dZsLOttMkcdAUQAAARE"]
[Thu May 07 14:25:11.181659 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:7815] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afwwRyY4dZsLOttMkcdAVAAAARg"]
[Thu May 07 14:25:11.597026 2026] [:error] [pid 15631:tid 15709] [client 52.138.31.126:62057] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afwwR3vP1GkPUuuLfqX4MgAAANY"]
[Thu May 07 14:25:12.013627 2026] [:error] [pid 15629:tid 15656] [client 52.138.31.126:61955] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "afwwSPrIJCALdUrO43lKhwAAABc"]
[Thu May 07 14:25:12.482286 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:15552] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "afwwSCY4dZsLOttMkcdAVwAAARQ"]
[Thu May 07 14:25:12.941109 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:62006] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "afwwSCY4dZsLOttMkcdAXAAAAQM"]
[Thu May 07 14:25:13.356530 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:15509] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "afwwSSY4dZsLOttMkcdAZQAAAQY"]
[Thu May 07 14:25:13.777267 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:16207] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "afwwSSY4dZsLOttMkcdAagAAAQk"]
[Thu May 07 14:25:14.193486 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:16163] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "afwwSiY4dZsLOttMkcdAcAAAARA"]
[Thu May 07 14:25:14.610704 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:16195] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "afwwSnvP1GkPUuuLfqX4OAAAAMw"]
[Thu May 07 14:25:15.027765 2026] [:error] [pid 15631:tid 15695] [client 52.138.31.126:15543] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "afwwS3vP1GkPUuuLfqX4OgAAAMg"]
[Thu May 07 14:25:15.443246 2026] [:error] [pid 15631:tid 15706] [client 52.138.31.126:15491] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "afwwS3vP1GkPUuuLfqX4PgAAANM"]
[Thu May 07 14:25:15.857046 2026] [:error] [pid 15631:tid 15689] [client 52.138.31.126:7874] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afwwS3vP1GkPUuuLfqX4PwAAAMI"]
[Thu May 07 14:25:16.270347 2026] [:error] [pid 15629:tid 15652] [client 52.138.31.126:62078] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afwwTPrIJCALdUrO43lKjQAAABM"]
[Thu May 07 14:25:16.734496 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:16202] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afwwTCY4dZsLOttMkcdAjwAAARQ"]
[Thu May 07 14:25:17.206489 2026] [:error] [pid 15631:tid 15708] [client 52.138.31.126:14742] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "afwwTXvP1GkPUuuLfqX4QwAAANU"]
[Thu May 07 14:25:17.634219 2026] [:error] [pid 15630:tid 15673] [client 52.138.31.126:7892] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwwTXTithRAi4821quAIAAAAI0"]
[Thu May 07 14:25:18.053655 2026] [:error] [pid 15629:tid 15655] [client 52.138.31.126:16240] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwwTvrIJCALdUrO43lKkAAAABY"]
[Thu May 07 14:25:18.482110 2026] [:error] [pid 15630:tid 15660] [client 52.138.31.126:7916] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwwTnTithRAi4821quAJAAAAIA"]
[Thu May 07 14:25:18.936380 2026] [:error] [pid 15629:tid 15643] [client 52.138.31.126:16221] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwwTvrIJCALdUrO43lKlAAAAAo"]
[Thu May 07 14:25:19.391682 2026] [:error] [pid 15631:tid 15701] [client 52.138.31.126:16210] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afwwT3vP1GkPUuuLfqX4RwAAAM4"]
[Thu May 07 14:25:19.808601 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:7876] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afwwT3vP1GkPUuuLfqX4SAAAAMw"]
[Thu May 07 14:25:20.254859 2026] [:error] [pid 15715:tid 15742] [client 52.138.31.126:62043] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afwwUCY4dZsLOttMkcdAtAAAARY"]
[Thu May 07 14:25:20.706290 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:7822] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-act.php"] [unique_id "afwwUCY4dZsLOttMkcdAvgAAAQ8"]
[Thu May 07 14:25:21.120136 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:14725] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afwwUSY4dZsLOttMkcdAxAAAARA"]
[Thu May 07 14:25:21.579355 2026] [:error] [pid 15715:tid 15737] [client 52.138.31.126:7861] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afwwUSY4dZsLOttMkcdAygAAARE"]
[Thu May 07 14:25:22.046339 2026] [:error] [pid 15630:tid 15683] [client 52.138.31.126:62033] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afwwUnTithRAi4821quALQAAAJc"]
[Thu May 07 14:25:22.470403 2026] [:error] [pid 15630:tid 15680] [client 52.138.31.126:16169] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/classwithtostring.php"] [unique_id "afwwUnTithRAi4821quALgAAAJQ"]
[Thu May 07 14:25:22.888670 2026] [:error] [pid 15715:tid 15739] [client 52.138.31.126:14761] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afwwUiY4dZsLOttMkcdA2wAAARM"]
[Thu May 07 14:25:23.330028 2026] [:error] [pid 15629:tid 15641] [client 52.138.31.126:62049] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afwwU_rIJCALdUrO43lKlwAAAAg"]
[Thu May 07 14:25:23.810350 2026] [:error] [pid 15630:tid 15664] [client 52.138.31.126:16183] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afwwU3TithRAi4821quAMQAAAIQ"]
[Thu May 07 14:25:24.286947 2026] [:error] [pid 15631:tid 15687] [client 52.138.31.126:7847] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/index.php"] [unique_id "afwwVHvP1GkPUuuLfqX4WQAAAMA"]
[Thu May 07 14:25:24.712815 2026] [:error] [pid 15629:tid 15646] [client 52.138.31.126:16135] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afwwVPrIJCALdUrO43lKnAAAAA0"]
[Thu May 07 14:25:25.170579 2026] [:error] [pid 15630:tid 15681] [client 52.138.31.126:15536] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afwwVXTithRAi4821quAOQAAAJU"]
[Thu May 07 14:25:25.592551 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:14822] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afwwVSY4dZsLOttMkcdA4QAAAQY"]
[Thu May 07 14:25:26.056908 2026] [:error] [pid 15715:tid 15722] [client 52.138.31.126:15613] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "afwwViY4dZsLOttMkcdA4gAAAQU"]
[Thu May 07 14:25:26.479015 2026] [:error] [pid 15631:tid 15688] [client 52.138.31.126:16250] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afwwVnvP1GkPUuuLfqX4YwAAAME"]
[Thu May 07 14:25:26.940491 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:62056] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afwwVnTithRAi4821quAQAAAAJM"]
[Thu May 07 14:25:27.416186 2026] [:error] [pid 15631:tid 15689] [client 52.138.31.126:62009] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afwwV3vP1GkPUuuLfqX4ZgAAAMI"]
[Thu May 07 14:25:27.849048 2026] [:error] [pid 15631:tid 15690] [client 52.138.31.126:7849] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-blog.php"] [unique_id "afwwV3vP1GkPUuuLfqX4aAAAAMM"]
[Thu May 07 14:25:28.279007 2026] [:error] [pid 15631:tid 15704] [client 52.138.31.126:62058] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afwwWHvP1GkPUuuLfqX4agAAANE"]
[Thu May 07 14:25:28.701485 2026] [:error] [pid 15715:tid 15739] [client 52.138.31.126:7851] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afwwWCY4dZsLOttMkcdA5wAAARM"]
[Thu May 07 14:25:29.173264 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:7814] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afwwWSY4dZsLOttMkcdA6QAAAQo"]
[Thu May 07 14:25:29.634563 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:62076] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/js/jquery/"] [unique_id "afwwWSY4dZsLOttMkcdA6wAAARg"]
[Thu May 07 14:25:30.052186 2026] [:error] [pid 15631:tid 15698] [client 52.138.31.126:15508] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwWnvP1GkPUuuLfqX4bwAAAMs"]
[Thu May 07 14:25:30.467289 2026] [:error] [pid 15629:tid 15653] [client 52.138.31.126:14747] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwWvrIJCALdUrO43lKogAAABQ"]
[Thu May 07 14:25:30.902192 2026] [:error] [pid 15631:tid 15703] [client 52.138.31.126:14757] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwWnvP1GkPUuuLfqX4cQAAANA"]
[Thu May 07 14:25:31.320486 2026] [:error] [pid 15631:tid 15695] [client 52.138.31.126:16136] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "afwwW3vP1GkPUuuLfqX4dAAAAMg"]
[Thu May 07 14:25:31.734883 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:53665] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afwwWyY4dZsLOttMkcdA8AAAAQY"]
[Thu May 07 14:25:32.188698 2026] [:error] [pid 15715:tid 15722] [client 52.138.31.126:16177] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afwwXCY4dZsLOttMkcdA8QAAAQU"]
[Thu May 07 14:25:32.606884 2026] [:error] [pid 15630:tid 15662] [client 52.138.31.126:16192] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afwwXHTithRAi4821quAbQAAAII"]
[Thu May 07 14:25:33.028497 2026] [:error] [pid 15629:tid 15644] [client 52.138.31.126:62074] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "afwwXfrIJCALdUrO43lKpgAAAAs"]
[Thu May 07 14:25:33.449552 2026] [:error] [pid 15631:tid 15697] [client 52.138.31.126:62029] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afwwXXvP1GkPUuuLfqX4fgAAAMo"]
[Thu May 07 14:25:33.866485 2026] [:error] [pid 15629:tid 15634] [client 52.138.31.126:62012] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afwwXfrIJCALdUrO43lKqQAAAAE"]
[Thu May 07 14:25:34.305047 2026] [:error] [pid 15631:tid 15710] [client 52.138.31.126:62067] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afwwXnvP1GkPUuuLfqX4ggAAANc"]
[Thu May 07 14:25:34.724895 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:14743] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "afwwXiY4dZsLOttMkcdA9AAAAQ8"]
[Thu May 07 14:25:35.154754 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:7888] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "afwwXyY4dZsLOttMkcdA9QAAARA"]
[Thu May 07 14:25:35.581860 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:14844] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "afwwXyY4dZsLOttMkcdA-QAAAQM"]
[Thu May 07 14:25:36.005060 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:16165] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "afwwYCY4dZsLOttMkcdA_AAAARg"]
[Thu May 07 14:25:36.428199 2026] [:error] [pid 15631:tid 15692] [client 52.138.31.126:55506] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "afwwYHvP1GkPUuuLfqX4hgAAAMU"]
[Thu May 07 14:25:36.848379 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:55488] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "afwwYCY4dZsLOttMkcdA_QAAAQc"]
[Thu May 07 14:25:37.307987 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:53755] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "afwwYSY4dZsLOttMkcdBAgAAARA"]
[Thu May 07 14:25:37.778385 2026] [:error] [pid 15715:tid 15739] [client 52.138.31.126:15490] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "afwwYSY4dZsLOttMkcdBBQAAARM"]
[Thu May 07 14:25:38.207307 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:16145] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "afwwYiY4dZsLOttMkcdBBwAAARU"]
[Thu May 07 14:25:38.623042 2026] [:error] [pid 15630:tid 15679] [client 52.138.31.126:62038] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "afwwYnTithRAi4821quAqwAAAJM"]
[Thu May 07 14:25:39.041330 2026] [:error] [pid 15630:tid 15666] [client 52.138.31.126:14753] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "afwwY3TithRAi4821quAwAAAAIY"]
[Thu May 07 14:25:39.470276 2026] [:error] [pid 15630:tid 15669] [client 52.138.31.126:7895] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "afwwY3TithRAi4821quA0gAAAIk"]
[Thu May 07 14:25:39.886750 2026] [:error] [pid 15629:tid 15649] [client 52.138.31.126:7906] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/index.php"] [unique_id "afwwY_rIJCALdUrO43lKvwAAABA"]
[Thu May 07 14:25:40.301660 2026] [:error] [pid 15629:tid 15638] [client 52.138.31.126:16235] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "afwwZPrIJCALdUrO43lKwAAAAAU"]
[Thu May 07 14:25:40.754921 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:62077] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "afwwZCY4dZsLOttMkcdBKQAAAQY"]
[Thu May 07 14:25:41.233181 2026] [:error] [pid 15631:tid 15687] [client 52.138.31.126:15517] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "afwwZXvP1GkPUuuLfqX4qgAAAMA"]
[Thu May 07 14:25:41.657486 2026] [:error] [pid 15715:tid 15743] [client 52.138.31.126:62044] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fff.php"] [unique_id "afwwZSY4dZsLOttMkcdBLAAAARc"]
[Thu May 07 14:25:42.127813 2026] [:error] [pid 15629:tid 15656] [client 52.138.31.126:14780] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "afwwZvrIJCALdUrO43lKwQAAABc"]
[Thu May 07 14:25:42.597015 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:15556] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "afwwZiY4dZsLOttMkcdBMAAAARg"]
[Thu May 07 14:25:43.043144 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:62001] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "afwwZ3vP1GkPUuuLfqX4rwAAANg"]
[Thu May 07 14:25:43.524433 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:7897] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/makeasmtp.php"] [unique_id "afwwZyY4dZsLOttMkcdBMwAAARU"]
[Thu May 07 14:25:43.991035 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:55537] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwnd.php"] [unique_id "afwwZ_rIJCALdUrO43lKxQAAAAc"]
[Thu May 07 14:25:44.552563 2026] [:error] [pid 15629:tid 15644] [client 52.138.31.126:7901] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwnd.php"] [unique_id "afwwaPrIJCALdUrO43lKxwAAAAs"]
[Thu May 07 14:25:44.972919 2026] [:error] [pid 15631:tid 15707] [client 52.138.31.126:53745] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwnd.php"] [unique_id "afwwaHvP1GkPUuuLfqX4tAAAANQ"]
[Thu May 07 14:25:45.400363 2026] [:error] [pid 15631:tid 15693] [client 52.138.31.126:16232] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pwnd.php"] [unique_id "afwwaXvP1GkPUuuLfqX4tgAAAMY"]
[Thu May 07 14:25:45.821638 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:7821] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afwwaXvP1GkPUuuLfqX4twAAAMw"]
[Thu May 07 14:25:46.239835 2026] [:error] [pid 15629:tid 15637] [client 52.138.31.126:16224] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afwwavrIJCALdUrO43lKyAAAAAQ"]
[Thu May 07 14:25:46.663961 2026] [:error] [pid 15630:tid 15681] [client 52.138.31.126:55549] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afwwanTithRAi4821quA3QAAAJU"]
[Thu May 07 14:25:47.114275 2026] [:error] [pid 15630:tid 15684] [client 52.138.31.126:7926] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "afwwa3TithRAi4821quA3wAAAJg"]
[Thu May 07 14:25:47.609592 2026] [:error] [pid 15715:tid 15717] [client 52.138.31.126:62053] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afwwayY4dZsLOttMkcdBTwAAAQA"]
[Thu May 07 14:25:48.031353 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:7913] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afwwbCY4dZsLOttMkcdBVQAAARQ"]
[Thu May 07 14:25:48.462935 2026] [:error] [pid 15631:tid 15691] [client 52.138.31.126:7898] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afwwbHvP1GkPUuuLfqX4uwAAAMQ"]
[Thu May 07 14:25:48.881616 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:14720] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "afwwbCY4dZsLOttMkcdBYQAAAQc"]
[Thu May 07 14:25:49.371180 2026] [:error] [pid 15715:tid 15743] [client 52.138.31.126:62075] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afwwbSY4dZsLOttMkcdBaAAAARc"]
[Thu May 07 14:25:49.823352 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:15540] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afwwbSY4dZsLOttMkcdBbgAAAQg"]
[Thu May 07 14:25:50.254502 2026] [:error] [pid 15715:tid 15732] [client 52.138.31.126:16211] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afwwbiY4dZsLOttMkcdBcwAAAQw"]
[Thu May 07 14:25:50.732319 2026] [:error] [pid 15715:tid 15722] [client 52.138.31.126:7812] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "afwwbiY4dZsLOttMkcdBeQAAAQU"]
[Thu May 07 14:25:51.182813 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:16170] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afwwbyY4dZsLOttMkcdBgQAAAQ8"]
[Thu May 07 14:25:51.644448 2026] [:error] [pid 15715:tid 15734] [client 52.138.31.126:61969] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afwwbyY4dZsLOttMkcdBhwAAAQ4"]
[Thu May 07 14:25:52.059438 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:7833] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afwwcCY4dZsLOttMkcdBjwAAARI"]
[Thu May 07 14:25:52.533953 2026] [:error] [pid 15629:tid 15645] [client 52.138.31.126:62008] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "afwwcPrIJCALdUrO43lKzAAAAAw"]
[Thu May 07 14:25:53.008057 2026] [:error] [pid 15629:tid 15636] [client 52.138.31.126:7905] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Thu May 07 14:25:53.459721 2026] [:error] [pid 15629:tid 15643] [client 52.138.31.126:7905] File does not exist: /usr/local/apache/htdocs/suspended-page/fe5.php
[Thu May 07 14:25:53.879607 2026] [:error] [pid 15629:tid 15633] [client 52.138.31.126:7905] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Thu May 07 14:25:54.089960 2026] [:error] [pid 15629:tid 15656] [client 52.138.31.126:7905] File does not exist: /usr/local/apache/htdocs/suspended-page/abcd.php
[Thu May 07 14:25:54.299511 2026] [:error] [pid 15629:tid 15651] [client 52.138.31.126:7905] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Thu May 07 14:25:54.725795 2026] [:error] [pid 15629:tid 15641] [client 52.138.31.126:7905] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afwwcvrIJCALdUrO43lK2gAAAAg"]
[Thu May 07 14:25:55.196614 2026] [:error] [pid 15629:tid 15650] [client 52.138.31.126:7842] File does not exist: /usr/local/apache/htdocs/suspended-page/f35.php
[Thu May 07 14:25:55.918166 2026] [:error] [pid 15629:tid 15645] [client 52.138.31.126:7842] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "afwwc_rIJCALdUrO43lK5AAAAAw"]
[Thu May 07 14:25:56.372920 2026] [:error] [pid 15629:tid 15653] [client 52.138.31.126:14768] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "afwwdPrIJCALdUrO43lK5wAAABQ"]
[Thu May 07 14:25:56.794355 2026] [:error] [pid 15631:tid 15702] [client 52.138.31.126:16156] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "afwwdHvP1GkPUuuLfqX4zQAAAM8"]
[Thu May 07 14:25:57.217523 2026] [:error] [pid 15629:tid 15633] [client 52.138.31.126:7885] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "afwwdfrIJCALdUrO43lK6gAAAAA"]
[Thu May 07 14:25:57.638163 2026] [:error] [pid 15629:tid 15647] [client 52.138.31.126:62025] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "afwwdfrIJCALdUrO43lK7QAAAA4"]
[Thu May 07 14:25:58.059727 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:16216] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "afwwdvrIJCALdUrO43lK7gAAAAc"]
[Thu May 07 14:25:58.474032 2026] [:error] [pid 15629:tid 15641] [client 52.138.31.126:15568] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "afwwdvrIJCALdUrO43lK8QAAAAg"]
[Thu May 07 14:25:58.906916 2026] [:error] [pid 15715:tid 15740] [client 52.138.31.126:55528] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/in.php"] [unique_id "afwwdiY4dZsLOttMkcdBwAAAARQ"]
[Thu May 07 14:25:59.330542 2026] [:error] [pid 15715:tid 15721] [client 52.138.31.126:16220] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-widgets.php"] [unique_id "afwwdyY4dZsLOttMkcdBwQAAAQQ"]
[Thu May 07 14:25:59.749197 2026] [:error] [pid 15629:tid 15648] [client 52.138.31.126:16245] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-widgets.php"] [unique_id "afwwd_rIJCALdUrO43lK9gAAAA8"]
[Thu May 07 14:26:00.216890 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:14776] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-widgets.php"] [unique_id "afwweCY4dZsLOttMkcdBwwAAAQk"]
[Thu May 07 14:26:00.698826 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:15559] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-widgets.php"] [unique_id "afwweCY4dZsLOttMkcdBxAAAAQ8"]
[Thu May 07 14:26:01.119907 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:7862] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "afwweSY4dZsLOttMkcdBxQAAAQM"]
[Thu May 07 14:26:01.544560 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:7841] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "afwweSY4dZsLOttMkcdBxgAAARg"]
[Thu May 07 14:26:01.965134 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:61973] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "afwweSY4dZsLOttMkcdBxwAAARA"]
[Thu May 07 14:26:02.381657 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:62066] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "afwweiY4dZsLOttMkcdByQAAAQs"]
[Thu May 07 14:26:02.798834 2026] [:error] [pid 15631:tid 15703] [client 52.138.31.126:53752] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afwwenvP1GkPUuuLfqX5FwAAANA"]
[Thu May 07 14:26:03.247825 2026] [:error] [pid 15715:tid 15742] [client 52.138.31.126:14841] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afwweyY4dZsLOttMkcdBzAAAARY"]
[Thu May 07 14:26:03.755104 2026] [:error] [pid 15629:tid 15653] [client 52.138.31.126:62055] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afwwe_rIJCALdUrO43lK_wAAABQ"]
[Thu May 07 14:26:04.220997 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:55458] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bs1.php"] [unique_id "afwwfCY4dZsLOttMkcdB1AAAARI"]
[Thu May 07 14:26:04.646630 2026] [:error] [pid 15631:tid 15708] [client 52.138.31.126:7929] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwwfHvP1GkPUuuLfqX5NgAAANU"]
[Thu May 07 14:26:05.064428 2026] [:error] [pid 15631:tid 15692] [client 52.138.31.126:55544] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwwfXvP1GkPUuuLfqX5PAAAAMU"]
[Thu May 07 14:26:05.479747 2026] [:error] [pid 15631:tid 15700] [client 52.138.31.126:7935] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwwfXvP1GkPUuuLfqX5QwAAAM0"]
[Thu May 07 14:26:05.926690 2026] [:error] [pid 15631:tid 15689] [client 52.138.31.126:14835] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwwfXvP1GkPUuuLfqX5TQAAAMI"]
[Thu May 07 14:26:06.346714 2026] [:error] [pid 15631:tid 15698] [client 52.138.31.126:62072] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afwwfnvP1GkPUuuLfqX5UwAAAMs"]
[Thu May 07 14:26:06.777473 2026] [:error] [pid 15631:tid 15706] [client 52.138.31.126:62032] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afwwfnvP1GkPUuuLfqX5WQAAANM"]
[Thu May 07 14:26:07.246144 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:55541] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afwwfyY4dZsLOttMkcdB2QAAAQk"]
[Thu May 07 14:26:07.695782 2026] [:error] [pid 15629:tid 15655] [client 52.138.31.126:7925] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "afwwf_rIJCALdUrO43lLDAAAABY"]
[Thu May 07 14:26:08.110426 2026] [:error] [pid 15715:tid 15735] [client 52.138.31.126:15507] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/BypassBest.php"] [unique_id "afwwgCY4dZsLOttMkcdB2wAAAQ8"]
[Thu May 07 14:26:08.529079 2026] [:error] [pid 15629:tid 15653] [client 52.138.31.126:16167] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/BypassBest.php"] [unique_id "afwwgPrIJCALdUrO43lLFwAAABQ"]
[Thu May 07 14:26:08.979849 2026] [:error] [pid 15715:tid 15736] [client 52.138.31.126:14782] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/BypassBest.php"] [unique_id "afwwgCY4dZsLOttMkcdB3QAAARA"]
[Thu May 07 14:26:09.433221 2026] [:error] [pid 15631:tid 15691] [client 52.138.31.126:7860] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/BypassBest.php"] [unique_id "afwwgXvP1GkPUuuLfqX5XQAAAMQ"]
[Thu May 07 14:26:09.849707 2026] [:error] [pid 15715:tid 15737] [client 52.138.31.126:62069] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afwwgSY4dZsLOttMkcdB3gAAARE"]
[Thu May 07 14:26:10.345136 2026] [:error] [pid 15715:tid 15734] [client 52.138.31.126:62060] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afwwgiY4dZsLOttMkcdB3wAAAQ4"]
[Thu May 07 14:26:10.814775 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:53697] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afwwgiY4dZsLOttMkcdB4gAAAQc"]
[Thu May 07 14:26:11.292774 2026] [:error] [pid 15631:tid 15705] [client 52.138.31.126:14765] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/"] [unique_id "afwwg3vP1GkPUuuLfqX5XgAAANI"]
[Thu May 07 14:26:11.752574 2026] [:error] [pid 15631:tid 15696] [client 52.138.31.126:7860] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afwwg3vP1GkPUuuLfqX5XwAAAMk"]
[Thu May 07 14:26:12.170065 2026] [:error] [pid 15715:tid 15732] [client 52.138.31.126:15493] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afwwhCY4dZsLOttMkcdB4wAAAQw"]
[Thu May 07 14:26:12.635378 2026] [:error] [pid 15629:tid 15657] [client 52.138.31.126:7873] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afwwhPrIJCALdUrO43lLOQAAABg"]
[Thu May 07 14:26:13.178646 2026] [:error] [pid 15715:tid 15730] [client 52.138.31.126:16160] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "afwwhSY4dZsLOttMkcdB5QAAAQo"]
[Thu May 07 14:26:13.658296 2026] [:error] [pid 15629:tid 15644] [client 52.138.31.126:55518] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "afwwhfrIJCALdUrO43lLRQAAAAs"]
[Thu May 07 14:26:14.087288 2026] [:error] [pid 15631:tid 15706] [client 52.138.31.126:15519] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "afwwhnvP1GkPUuuLfqX5YQAAANM"]
[Thu May 07 14:26:14.500868 2026] [:error] [pid 15715:tid 15744] [client 52.138.31.126:7866] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "afwwhiY4dZsLOttMkcdB6QAAARg"]
[Thu May 07 14:26:14.928787 2026] [:error] [pid 15631:tid 15699] [client 52.138.31.126:16179] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/buy.php"] [unique_id "afwwhnvP1GkPUuuLfqX5YgAAAMw"]
[Thu May 07 14:26:15.352369 2026] [:error] [pid 15630:tid 15677] [client 52.138.31.126:61966] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afwwh3TithRAi4821quBJwAAAJE"]
[Thu May 07 14:26:15.777075 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:7920] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afwwhyY4dZsLOttMkcdB6wAAAQg"]
[Thu May 07 14:26:16.229907 2026] [:error] [pid 15715:tid 15734] [client 52.138.31.126:16191] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afwwiCY4dZsLOttMkcdB7AAAAQ4"]
[Thu May 07 14:26:16.710402 2026] [:error] [pid 15715:tid 15724] [client 52.138.31.126:62026] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "afwwiCY4dZsLOttMkcdB7QAAAQc"]
[Thu May 07 14:26:17.191026 2026] [:error] [pid 15629:tid 15649] [client 52.138.31.126:61998] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afwwifrIJCALdUrO43lLZwAAABA"]
[Thu May 07 14:26:17.637837 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:61975] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afwwifrIJCALdUrO43lLbAAAAAc"]
[Thu May 07 14:26:18.092829 2026] [:error] [pid 15630:tid 15675] [client 52.138.31.126:15602] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afwwinTithRAi4821quBKQAAAI8"]
[Thu May 07 14:26:18.519922 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:14726] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hypo.php"] [unique_id "afwwiiY4dZsLOttMkcdB7gAAARI"]
[Thu May 07 14:26:18.942832 2026] [:error] [pid 15629:tid 15649] [client 52.138.31.126:14792] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "afwwivrIJCALdUrO43lLewAAABA"]
[Thu May 07 14:26:19.374335 2026] [:error] [pid 15629:tid 15640] [client 52.138.31.126:55429] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "afwwi_rIJCALdUrO43lLfgAAAAc"]
[Thu May 07 14:26:19.821167 2026] [:error] [pid 15715:tid 15726] [client 52.138.31.126:53634] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "afwwiyY4dZsLOttMkcdB8QAAAQk"]
[Thu May 07 14:26:20.280545 2026] [:error] [pid 15715:tid 15720] [client 52.138.31.126:7832] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "afwwjCY4dZsLOttMkcdB8gAAAQM"]
[Thu May 07 14:26:20.704778 2026] [:error] [pid 15630:tid 15665] [client 52.138.31.126:61987] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afwwjHTithRAi4821quBOAAAAIU"]
[Thu May 07 14:26:21.131267 2026] [:error] [pid 15630:tid 15664] [client 52.138.31.126:15586] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afwwjXTithRAi4821quBPwAAAIQ"]
[Thu May 07 14:26:21.562154 2026] [:error] [pid 15715:tid 15721] [client 52.138.31.126:53147] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afwwjSY4dZsLOttMkcdB8wAAAQQ"]
[Thu May 07 14:26:21.975723 2026] [:error] [pid 15715:tid 15718] [client 52.138.31.126:55526] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afwwjSY4dZsLOttMkcdB9AAAAQE"]
[Thu May 07 14:26:22.413312 2026] [:error] [pid 15630:tid 15678] [client 52.138.31.126:7825] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "afwwjnTithRAi4821quBTgAAAJI"]
[Thu May 07 14:26:22.828234 2026] [:error] [pid 15715:tid 15725] [client 52.138.31.126:62035] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "afwwjiY4dZsLOttMkcdB9QAAAQg"]
[Thu May 07 14:26:23.250463 2026] [:error] [pid 15715:tid 15731] [client 52.138.31.126:7816] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "afwwjyY4dZsLOttMkcdB9gAAAQs"]
[Thu May 07 14:26:23.677906 2026] [:error] [pid 15715:tid 15741] [client 52.138.31.126:16196] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "afwwjyY4dZsLOttMkcdB9wAAARU"]
[Thu May 07 14:26:24.094934 2026] [:error] [pid 15715:tid 15737] [client 52.138.31.126:55511] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mws.php"] [unique_id "afwwkCY4dZsLOttMkcdB-AAAARE"]
[Thu May 07 14:26:24.573170 2026] [:error] [pid 15631:tid 15711] [client 52.138.31.126:62034] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mws.php"] [unique_id "afwwkHvP1GkPUuuLfqX5aAAAANg"]
[Thu May 07 14:26:25.037779 2026] [:error] [pid 15631:tid 15697] [client 52.138.31.126:61953] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mws.php"] [unique_id "afwwkXvP1GkPUuuLfqX5aQAAAMo"]
[Thu May 07 14:26:25.494408 2026] [:error] [pid 15629:tid 15635] [client 52.138.31.126:62013] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mws.php"] [unique_id "afwwkfrIJCALdUrO43lLfwAAAAI"]
[Thu May 07 14:26:25.942725 2026] [:error] [pid 15629:tid 15633] [client 52.138.31.126:53714] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/"] [unique_id "afwwkfrIJCALdUrO43lLgAAAAAA"]
[Thu May 07 14:26:26.387278 2026] [:error] [pid 15715:tid 15733] [client 52.138.31.126:62007] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/"] [unique_id "afwwkiY4dZsLOttMkcdB-wAAAQ0"]
[Thu May 07 14:26:26.835888 2026] [:error] [pid 15715:tid 15723] [client 52.138.31.126:62021] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/"] [unique_id "afwwkiY4dZsLOttMkcdB_QAAAQY"]
[Thu May 07 14:26:27.319806 2026] [:error] [pid 15715:tid 15738] [client 52.138.31.126:55546] [client 52.138.31.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/block-bindings/"] [unique_id "afwwkyY4dZsLOttMkcdB_gAAARI"]
[Thu May 07 17:35:12.485064 2026] [:error] [pid 15629:tid 15641] [client 119.28.122.202:47084] [client 119.28.122.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afxc0PrIJCALdUrO43lmyAAAAAg"]
[Thu May 07 17:39:39.300606 2026] [:error] [pid 15631:tid 15701] [client 34.182.166.92:49313] [client 34.182.166.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.166.92, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "afxd23vP1GkPUuuLfqUkegAAAM4"]
[Thu May 07 17:39:39.304063 2026] [:error] [pid 15631:tid 15701] [client 34.182.166.92:49313] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Thu May 07 17:39:42.435797 2026] [:error] [pid 15631:tid 15707] [client 34.182.166.92:49313] [client 34.182.166.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "afxd3nvP1GkPUuuLfqUkhgAAANQ"]
[Thu May 07 17:39:43.020344 2026] [:error] [pid 15630:tid 15670] [client 34.182.166.92:61410] [client 34.182.166.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "afxd33TithRAi4821quhKAAAAIo"]
[Thu May 07 17:39:44.115761 2026] [:error] [pid 15629:tid 15645] [client 34.182.166.92:53065] [client 34.182.166.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "afxd4PrIJCALdUrO43lndgAAAAw"]
[Thu May 07 17:39:46.027591 2026] [:error] [pid 15715:tid 15735] [client 34.182.166.92:61678] [client 34.182.166.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "afxd4iY4dZsLOttMkcd-5AAAAQ8"]
[Thu May 07 17:39:47.789611 2026] [:error] [pid 15630:tid 15666] [client 34.182.166.92:52780] [client 34.182.166.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "afxd43TithRAi4821quhLwAAAIY"]
[Thu May 07 17:39:49.174660 2026] [:error] [pid 28098:tid 28100] [client 34.182.166.92:61709] [client 34.182.166.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "afxd5cvhwfljlt8trSq6ewAAAEA"]
[Thu May 07 17:39:50.541473 2026] [:error] [pid 15715:tid 15740] [client 34.182.166.92:63286] [client 34.182.166.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "afxd5iY4dZsLOttMkcd-7AAAARQ"]
[Thu May 07 18:11:42.475740 2026] [:error] [pid 15630:tid 15669] [client 20.168.111.65:12200] [client 20.168.111.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.168.111.65, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/wp/xmlrpc.php"] [unique_id "afxlXnTithRAi4821qulswAAAIk"]
[Thu May 07 19:37:51.123432 2026] [:error] [pid 28098:tid 28100] [client 104.23.175.219:11557] [client 104.23.175.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "afx5j8vhwfljlt8trSrjeQAAAEA"], referer: https://www.google.com/search?q=rejuva.au
[Thu May 07 19:37:51.144709 2026] [:error] [pid 28098:tid 28114] [client 104.23.175.185:13888] [client 104.23.175.185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "afx5j8vhwfljlt8trSrjegAAAE4"], referer: https://www.google.com/search?q=www.rejuva.au
[Thu May 07 19:37:51.265082 2026] [:error] [pid 15715:tid 15739] [client 172.70.208.82:10740] [client 172.70.208.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "afx5jyY4dZsLOttMkceZNgAAARM"]
[Thu May 07 19:37:51.572753 2026] [:error] [pid 28098:tid 28107] [client 104.22.66.132:12232] [client 104.22.66.132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "afx5j8vhwfljlt8trSrjewAAAEc"], referer: https://www.google.com/search?q=www.rejuva.au
[Thu May 07 20:49:26.076737 2026] [:error] [pid 28098:tid 28104] [client 43.133.91.48:43004] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afyKVsvhwfljlt8trSr5CwAAAEQ"]
[Thu May 07 23:36:47.955552 2026] [:error] [pid 15715:tid 15741] [client 43.130.47.33:57354] [client 43.130.47.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "afyxjyY4dZsLOttMkcfaBQAAARU"]
[Thu May 07 23:57:41.807742 2026] [:error] [pid 15629:tid 15654] [client 192.144.148.122:45492] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afy2dfrIJCALdUrO43mX4gAAABU"]
[Fri May 08 01:58:45.872014 2026] [:error] [pid 15715:tid 15732] [client 124.156.226.179:35426] [client 124.156.226.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "afzS1SY4dZsLOttMkccDRgAAAQw"]
[Fri May 08 02:31:30.484575 2026] [:error] [pid 12374:tid 12383] [client 34.142.233.253:52112] [client 34.142.233.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "afzagho3QnNcFDMfKt2LcgAAAYU"]
[Fri May 08 05:47:10.966873 2026] [:error] [pid 51113:tid 51136] [client 170.106.37.134:45668] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af0IXkQfs7sWtqkpQIcVgwAAANU"]
[Fri May 08 06:29:03.615402 2026] [:error] [pid 51008:tid 51062] [client 43.133.36.219:44606] [client 43.133.36.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "af0SL3B58C2Y1tgLtuIR6gAAAE0"]
[Fri May 08 08:19:50.381514 2026] [:error] [pid 61317:tid 61320] [client 43.157.67.70:60630] [client 43.157.67.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "af0sJs-fFk_CedOCOYtF2AAAAUA"]
[Fri May 08 09:02:32.505920 2026] [:error] [pid 61317:tid 61333] [client 34.174.113.137:60634] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/admin/.env"] [unique_id "af02KM-fFk_CedOCOYtOvQAAAU0"]
[Fri May 08 09:02:32.572990 2026] [:error] [pid 61356:tid 61405] [client 34.174.113.137:60638] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.dev"] [unique_id "af02KIx3vpB8oWhUq2O1XwAAAdE"]
[Fri May 08 09:02:32.614991 2026] [:error] [pid 61317:tid 61335] [client 34.174.113.137:60602] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.local"] [unique_id "af02KM-fFk_CedOCOYtOvwAAAU8"]
[Fri May 08 09:02:32.646570 2026] [:error] [pid 61356:tid 61406] [client 34.174.113.137:60618] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.development.local"] [unique_id "af02KIx3vpB8oWhUq2O1YAAAAdI"]
[Fri May 08 09:02:32.668542 2026] [:error] [pid 61356:tid 61392] [client 34.174.113.137:60648] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/app/.env.local"] [unique_id "af02KIx3vpB8oWhUq2O1YQAAAcQ"]
[Fri May 08 09:02:32.684950 2026] [:error] [pid 61356:tid 61411] [client 34.174.113.137:60660] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.docker"] [unique_id "af02KIx3vpB8oWhUq2O1YgAAAdc"]
[Fri May 08 09:02:32.688329 2026] [:error] [pid 61317:tid 61336] [client 34.174.113.137:60664] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.dev.local"] [unique_id "af02KM-fFk_CedOCOYtOwAAAAVA"]
[Fri May 08 09:02:32.855291 2026] [:error] [pid 61317:tid 61341] [client 34.174.113.137:60672] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/api/.env"] [unique_id "af02KM-fFk_CedOCOYtOwQAAAVU"]
[Fri May 08 09:02:33.042421 2026] [:error] [pid 61317:tid 61339] [client 34.174.113.137:60696] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/app/.env"] [unique_id "af02Kc-fFk_CedOCOYtOxAAAAVM"]
[Fri May 08 09:02:33.138503 2026] [:error] [pid 61355:tid 61370] [client 34.174.113.137:60684] [client 34.174.113.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "af02KfkhJTi30CBXmMnvawAAAYk"]
[Fri May 08 11:32:18.941829 2026] [:error] [pid 61355:tid 61370] [client 43.130.39.254:39038] [client 43.130.39.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af1ZQvkhJTi30CBXmMkmLwAAAYk"]
[Fri May 08 11:48:24.782930 2026] [:error] [pid 51113:tid 51130] [client 146.56.197.150:51292] [client 146.56.197.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af1dCEQfs7sWtqkpQIdMnwAAAM8"]
[Fri May 08 13:24:22.410482 2026] [:error] [pid 61356:tid 61405] [client 35.229.183.45:48878] [client 35.229.183.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "af1zhox3vpB8oWhUq2MGBgAAAdE"]
[Fri May 08 14:01:59.776843 2026] [:error] [pid 51008:tid 51064] [client 43.153.19.83:40406] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "af18V3B58C2Y1tgLtuJnLAAAAE8"]
[Fri May 08 15:28:56.768416 2026] [:error] [pid 61355:tid 61375] [client 34.122.144.100:55790] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "af2QuPkhJTi30CBXmMlemwAAAY4"]
[Fri May 08 15:51:02.234730 2026] [:error] [pid 51008:tid 51070] [client 43.133.36.219:48274] [client 43.133.36.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af2V5nB58C2Y1tgLtuJ2YgAAAFU"]
[Fri May 08 19:07:39.119983 2026] [:error] [pid 51009:tid 51081] [client 43.166.224.244:34522] [client 43.166.224.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "af3D--B0GbUWhxgzX9UogwAAAIU"]
[Fri May 08 19:34:10.382915 2026] [:error] [pid 34318:tid 34331] [client 104.23.239.56:10324] [client 104.23.239.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "af3KMsr3guirgJiKhzDURAAAAQs"]
[Fri May 08 19:34:10.422885 2026] [:error] [pid 61356:tid 61410] [client 162.158.95.184:12046] [client 162.158.95.184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "af3KMox3vpB8oWhUq2OUSwAAAdY"]
[Fri May 08 22:03:29.046824 2026] [:error] [pid 61317:tid 61342] [client 49.51.50.147:35564] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af3tMc-fFk_CedOCOYvaVQAAAVY"]
[Fri May 08 23:36:19.484173 2026] [:error] [pid 61355:tid 61363] [client 35.252.25.200:39314] [client 35.252.25.200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "af4C8_khJTi30CBXmMnwYQAAAYI"]
[Fri May 08 23:47:57.543521 2026] [:error] [pid 61355:tid 61384] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/shoha.php
[Fri May 08 23:47:57.766418 2026] [:error] [pid 61355:tid 61361] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-thi.php
[Fri May 08 23:47:57.988320 2026] [:error] [pid 61355:tid 61381] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-slss.php
[Fri May 08 23:47:58.210163 2026] [:error] [pid 61355:tid 61364] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-load.php
[Fri May 08 23:47:58.438474 2026] [:error] [pid 61355:tid 61373] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/ftde.php
[Fri May 08 23:47:58.659995 2026] [:error] [pid 61355:tid 61371] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/tires.php
[Fri May 08 23:47:58.883741 2026] [:error] [pid 61355:tid 61376] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/ff1.php
[Fri May 08 23:47:59.126138 2026] [:error] [pid 61355:tid 61380] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Fri May 08 23:47:59.366431 2026] [:error] [pid 61355:tid 61377] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Fri May 08 23:47:59.592574 2026] [:error] [pid 61355:tid 61367] [client 130.131.249.131:32801] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Fri May 08 23:47:59.812208 2026] [:error] [pid 61355:tid 61365] [client 130.131.249.131:32801] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "af4Fr_khJTi30CBXmMn0WgAAAYQ"]
[Fri May 08 23:48:01.164405 2026] [:error] [pid 61355:tid 61375] [client 130.131.249.131:36793] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "af4FsfkhJTi30CBXmMn0XQAAAY4"]
[Fri May 08 23:48:03.055820 2026] [:error] [pid 51009:tid 51100] [client 130.131.249.131:36775] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "af4Fs-B0GbUWhxgzX9VvDwAAAJg"]
[Fri May 08 23:48:05.525659 2026] [:error] [pid 61356:tid 61411] [client 130.131.249.131:36797] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "af4FtYx3vpB8oWhUq2P7mgAAAdc"]
[Fri May 08 23:48:08.878852 2026] [:error] [pid 51007:tid 51040] [client 130.131.249.131:35717] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "af4FuFMagSGstWKyzzUJ9QAAABI"]
[Fri May 08 23:48:11.170837 2026] [:error] [pid 51009:tid 51082] [client 130.131.249.131:32967] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "af4Fu-B0GbUWhxgzX9VvFQAAAIY"]
[Fri May 08 23:48:13.089370 2026] [:error] [pid 51008:tid 51070] [client 130.131.249.131:37366] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "af4FvXB58C2Y1tgLtuLD9gAAAFU"]
[Fri May 08 23:48:16.385841 2026] [:error] [pid 51007:tid 51034] [client 130.131.249.131:33142] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sbhu.php"] [unique_id "af4FwFMagSGstWKyzzUJ-gAAAAw"]
[Fri May 08 23:48:18.534630 2026] [:error] [pid 61356:tid 61397] [client 130.131.249.131:22312] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "af4Fwox3vpB8oWhUq2P7qgAAAck"]
[Fri May 08 23:48:23.058796 2026] [:error] [pid 51009:tid 51080] [client 130.131.249.131:35496] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "af4Fx-B0GbUWhxgzX9VvQAAAAIQ"]
[Fri May 08 23:48:23.727658 2026] [:error] [pid 51009:tid 51078] [client 130.131.249.131:32886] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "af4Fx-B0GbUWhxgzX9VvRAAAAII"]
[Fri May 08 23:48:26.012047 2026] [:error] [pid 61355:tid 61370] [client 130.131.249.131:32957] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "af4FyvkhJTi30CBXmMn0kgAAAYk"]
[Fri May 08 23:48:31.482861 2026] [:error] [pid 51007:tid 51024] [client 130.131.249.131:33309] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "af4Fz1MagSGstWKyzzUKAwAAAAI"]
[Fri May 08 23:48:34.944431 2026] [:error] [pid 51009:tid 51090] [client 130.131.249.131:35850] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "af4F0uB0GbUWhxgzX9VvVwAAAI4"]
[Fri May 08 23:48:38.046784 2026] [:error] [pid 61317:tid 61328] [client 130.131.249.131:35840] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "af4F1s-fFk_CedOCOYvufgAAAUg"]
[Fri May 08 23:48:40.334549 2026] [:error] [pid 51009:tid 51100] [client 130.131.249.131:34722] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "af4F2OB0GbUWhxgzX9VvXgAAAJg"]
[Fri May 08 23:48:41.339114 2026] [:error] [pid 61356:tid 61391] [client 130.131.249.131:21805] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "af4F2Yx3vpB8oWhUq2P8AgAAAcM"]
[Fri May 08 23:48:42.621191 2026] [:error] [pid 61356:tid 61405] [client 130.131.249.131:22427] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "af4F2ox3vpB8oWhUq2P8EwAAAdE"]
[Fri May 08 23:48:44.603917 2026] [:error] [pid 61356:tid 61406] [client 130.131.249.131:34244] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "af4F3Ix3vpB8oWhUq2P8JAAAAdI"]
[Fri May 08 23:48:45.291471 2026] [:error] [pid 51007:tid 51040] [client 130.131.249.131:21776] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "af4F3VMagSGstWKyzzUKCgAAABI"]
[Fri May 08 23:48:46.527407 2026] [:error] [pid 51113:tid 51127] [client 130.131.249.131:33691] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "af4F3kQfs7sWtqkpQIeN0QAAAMw"]
[Fri May 08 23:48:47.747762 2026] [:error] [pid 51113:tid 51116] [client 130.131.249.131:34749] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "af4F30Qfs7sWtqkpQIeN0gAAAME"]
[Fri May 08 23:48:49.649177 2026] [:error] [pid 61355:tid 61366] [client 130.131.249.131:21520] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "af4F4fkhJTi30CBXmMn0qQAAAYU"]
[Fri May 08 23:48:51.999118 2026] [:error] [pid 51009:tid 51095] [client 130.131.249.131:38705] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "af4F4-B0GbUWhxgzX9VvawAAAJM"]
[Fri May 08 23:48:53.056976 2026] [:error] [pid 61355:tid 61377] [client 130.131.249.131:38666] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/revealability.php"] [unique_id "af4F5fkhJTi30CBXmMn0rgAAAZA"]
[Fri May 08 23:48:54.621860 2026] [:error] [pid 61355:tid 61373] [client 130.131.249.131:21532] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/revealability.php"] [unique_id "af4F5vkhJTi30CBXmMn0tAAAAYw"]
[Fri May 08 23:48:57.528714 2026] [:error] [pid 61356:tid 61395] [client 130.131.249.131:22417] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/revealability.php"] [unique_id "af4F6Yx3vpB8oWhUq2P8MgAAAcc"]
[Fri May 08 23:49:02.682859 2026] [:error] [pid 51009:tid 51094] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/revealability.php
[Fri May 08 23:49:02.906478 2026] [:error] [pid 51009:tid 51090] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/file4.php
[Fri May 08 23:49:03.129560 2026] [:error] [pid 51009:tid 51095] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/atomlib.php
[Fri May 08 23:49:03.351791 2026] [:error] [pid 51009:tid 51077] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/file30.php
[Fri May 08 23:49:03.591068 2026] [:error] [pid 51009:tid 51082] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/forbidals.php
[Fri May 08 23:49:03.813942 2026] [:error] [pid 51009:tid 51097] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-firewall.php
[Fri May 08 23:49:04.042833 2026] [:error] [pid 51009:tid 51083] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Fri May 08 23:49:04.267959 2026] [:error] [pid 51009:tid 51085] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/wuasr.php
[Fri May 08 23:49:04.513098 2026] [:error] [pid 51009:tid 51080] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/1index.php
[Fri May 08 23:49:04.735859 2026] [:error] [pid 51009:tid 51092] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/png.php
[Fri May 08 23:49:04.987851 2026] [:error] [pid 51009:tid 51078] [client 130.131.249.131:21548] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Fri May 08 23:49:05.231149 2026] [:error] [pid 51009:tid 51081] [client 130.131.249.131:21548] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "af4F8eB0GbUWhxgzX9VvfQAAAIU"]
[Fri May 08 23:49:08.339201 2026] [:error] [pid 61356:tid 61406] [client 130.131.249.131:37868] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "af4F9Ix3vpB8oWhUq2P8QQAAAdI"]
[Fri May 08 23:49:10.784389 2026] [:error] [pid 51113:tid 51117] [client 130.131.249.131:33285] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "af4F9kQfs7sWtqkpQIeN6wAAAMI"]
[Fri May 08 23:49:12.784988 2026] [:error] [pid 51113:tid 51136] [client 130.131.249.131:37839] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "af4F-EQfs7sWtqkpQIeN7wAAANU"]
[Fri May 08 23:49:16.197868 2026] [:error] [pid 61356:tid 61392] [client 130.131.249.131:35918] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "af4F_Ix3vpB8oWhUq2P8WQAAAcQ"]
[Fri May 08 23:49:20.879511 2026] [:error] [pid 51007:tid 51043] [client 130.131.249.131:32324] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "af4GAFMagSGstWKyzzUKFgAAABU"]
[Fri May 08 23:49:23.889053 2026] [:error] [pid 61356:tid 61405] [client 130.131.249.131:35162] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "af4GA4x3vpB8oWhUq2P8YgAAAdE"]
[Fri May 08 23:49:27.478596 2026] [:error] [pid 51007:tid 51045] [client 130.131.249.131:35310] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "af4GB1MagSGstWKyzzUKKgAAABc"]
[Fri May 08 23:49:30.902057 2026] [:error] [pid 51009:tid 51099] [client 130.131.249.131:32295] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "af4GCuB0GbUWhxgzX9VvkQAAAJc"]
[Fri May 08 23:49:32.778877 2026] [:error] [pid 61356:tid 61407] [client 130.131.249.131:22326] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "af4GDIx3vpB8oWhUq2P8fQAAAdM"]
[Fri May 08 23:49:34.195431 2026] [:error] [pid 61356:tid 61394] [client 130.131.249.131:34002] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "af4GDox3vpB8oWhUq2P8gwAAAcY"]
[Fri May 08 23:49:37.843694 2026] [:error] [pid 61356:tid 61404] [client 130.131.249.131:22286] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "af4GEYx3vpB8oWhUq2P8lAAAAdA"]
[Fri May 08 23:49:42.762339 2026] [:error] [pid 61356:tid 61398] [client 130.131.249.131:37188] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "af4GFox3vpB8oWhUq2P8oAAAAco"]
[Fri May 08 23:49:45.422827 2026] [:error] [pid 51113:tid 51139] [client 130.131.249.131:21851] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "af4GGUQfs7sWtqkpQIeN_gAAANg"]
[Fri May 08 23:49:50.701898 2026] [:error] [pid 61355:tid 61374] [client 130.131.249.131:21572] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "af4GHvkhJTi30CBXmMn08gAAAY0"]
[Fri May 08 23:49:58.109465 2026] [:error] [pid 61356:tid 61400] [client 130.131.249.131:34837] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "af4GJox3vpB8oWhUq2P8rQAAAcw"]
[Fri May 08 23:50:06.513120 2026] [:error] [pid 61355:tid 61378] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kd4xalrg7m.php
[Fri May 08 23:50:09.813376 2026] [:error] [pid 61355:tid 61374] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Fri May 08 23:50:10.306375 2026] [:error] [pid 61355:tid 61382] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/new.php
[Fri May 08 23:50:10.530346 2026] [:error] [pid 61355:tid 61369] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/aevly.php
[Fri May 08 23:50:10.753535 2026] [:error] [pid 61355:tid 61375] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Fri May 08 23:50:10.979483 2026] [:error] [pid 61355:tid 61370] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Fri May 08 23:50:11.206323 2026] [:error] [pid 61355:tid 61381] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Fri May 08 23:50:11.435066 2026] [:error] [pid 61355:tid 61383] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Fri May 08 23:50:11.699506 2026] [:error] [pid 61355:tid 61384] [client 130.131.249.131:37166] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-at.php
[Fri May 08 23:50:13.847987 2026] [:error] [pid 61355:tid 61374] [client 130.131.249.131:37166] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "af4GNfkhJTi30CBXmMn1JwAAAY0"]
[Fri May 08 23:50:17.501082 2026] [:error] [pid 61356:tid 61407] [client 130.131.249.131:22147] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "af4GOYx3vpB8oWhUq2P82wAAAdM"]
[Fri May 08 23:50:20.954699 2026] [:error] [pid 61317:tid 61342] [client 130.131.249.131:37178] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "af4GPM-fFk_CedOCOYvu0gAAAVY"]
[Fri May 08 23:50:24.450788 2026] [:error] [pid 61317:tid 61320] [client 130.131.249.131:36999] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "af4GQM-fFk_CedOCOYvu1wAAAUA"]
[Fri May 08 23:50:28.496780 2026] [:error] [pid 61355:tid 61366] [client 130.131.249.131:36912] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "af4GRPkhJTi30CBXmMn1PAAAAYU"]
[Fri May 08 23:50:33.574097 2026] [:error] [pid 61355:tid 61372] [client 130.131.249.131:22175] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "af4GSfkhJTi30CBXmMn1TAAAAYs"]
[Fri May 08 23:50:36.618869 2026] [:error] [pid 61317:tid 61336] [client 130.131.249.131:34893] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "af4GTM-fFk_CedOCOYvu3gAAAVA"]
[Fri May 08 23:50:39.137794 2026] [:error] [pid 61355:tid 61365] [client 130.131.249.131:39809] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "af4GT_khJTi30CBXmMn1WgAAAYQ"]
[Fri May 08 23:50:42.814563 2026] [:error] [pid 61355:tid 61370] [client 130.131.249.131:34330] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "af4GUvkhJTi30CBXmMn1ZQAAAYk"]
[Fri May 08 23:50:45.417148 2026] [:error] [pid 51009:tid 51086] [client 130.131.249.131:36456] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "af4GVeB0GbUWhxgzX9VvrgAAAIo"]
[Fri May 08 23:50:45.940095 2026] [:error] [pid 51009:tid 51090] [client 130.131.249.131:22472] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "af4GVeB0GbUWhxgzX9VvsgAAAI4"]
[Fri May 08 23:50:46.538602 2026] [:error] [pid 61356:tid 61391] [client 130.131.249.131:34314] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "af4GVox3vpB8oWhUq2P9CwAAAcM"]
[Fri May 08 23:50:48.796711 2026] [:error] [pid 61356:tid 61397] [client 130.131.249.131:35687] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "af4GWIx3vpB8oWhUq2P9DwAAAck"]
[Fri May 08 23:50:51.775273 2026] [:error] [pid 51008:tid 51062] [client 130.131.249.131:45607] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "af4GW3B58C2Y1tgLtuLEJwAAAE0"]
[Fri May 08 23:50:56.293577 2026] [:error] [pid 61317:tid 61329] [client 130.131.249.131:22511] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "af4GYM-fFk_CedOCOYvu4gAAAUk"]
[Fri May 08 23:50:59.472483 2026] [:error] [pid 61356:tid 61405] [client 130.131.249.131:50370] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "af4GY4x3vpB8oWhUq2P9HQAAAdE"]
[Fri May 08 23:51:01.241685 2026] [:error] [pid 51007:tid 51028] [client 130.131.249.131:35103] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "af4GZVMagSGstWKyzzUKWwAAAAY"]
[Fri May 08 23:51:04.343994 2026] [:error] [pid 51008:tid 51066] [client 130.131.249.131:35132] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "af4GaHB58C2Y1tgLtuLEKQAAAFE"]
[Fri May 08 23:51:10.614027 2026] [:error] [pid 51007:tid 51023] [client 130.131.249.131:34964] [client 130.131.249.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "af4GblMagSGstWKyzzUKXAAAAAE"]
[Fri May 08 23:51:16.206058 2026] [:error] [pid 51113:tid 51126] [client 130.131.249.131:34595] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Fri May 08 23:51:16.397511 2026] [:error] [pid 51113:tid 51123] [client 130.131.249.131:34595] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Fri May 08 23:51:16.589920 2026] [:error] [pid 51113:tid 51124] [client 130.131.249.131:34595] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Fri May 08 23:51:16.781166 2026] [:error] [pid 51113:tid 51134] [client 130.131.249.131:34595] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Fri May 08 23:51:16.989955 2026] [:error] [pid 51113:tid 51119] [client 130.131.249.131:34595] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat May 09 00:17:42.370407 2026] [:error] [pid 51009:tid 51084] [client 162.62.213.187:54694] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "af4MpuB0GbUWhxgzX9V2SAAAAIg"]
[Sat May 09 00:37:30.781958 2026] [:error] [pid 51009:tid 51080] [client 123.207.65.62:57034] [client 123.207.65.62] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "af4RSuB0GbUWhxgzX9V6_QAAAIQ"]
[Sat May 09 01:08:20.067022 2026] [:error] [pid 51009:tid 51096] [client 35.88.49.76:49626] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "af4YhOB0GbUWhxgzX9WFggAAAJQ"]
[Sat May 09 01:08:20.977377 2026] [:error] [pid 51009:tid 51085] [client 35.88.49.76:49634] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4YhOB0GbUWhxgzX9WFjwAAAIk"]
[Sat May 09 01:08:21.706021 2026] [:error] [pid 61355:tid 61364] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sat May 09 01:08:21.892143 2026] [:error] [pid 61355:tid 61365] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat May 09 01:08:22.076297 2026] [:error] [pid 61355:tid 61361] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Sat May 09 01:08:22.259946 2026] [:error] [pid 61355:tid 61380] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sat May 09 01:08:22.443415 2026] [:error] [pid 61355:tid 61374] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Sat May 09 01:08:22.628033 2026] [:error] [pid 61355:tid 61368] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Sat May 09 01:08:22.811589 2026] [:error] [pid 61355:tid 61385] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sat May 09 01:08:23.179742 2026] [:error] [pid 61355:tid 61379] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sat May 09 01:08:23.363323 2026] [:error] [pid 61355:tid 61362] [client 35.88.49.76:49646] File does not exist: /usr/local/apache/htdocs/suspended-page/debug.php
[Sat May 09 01:08:23.727589 2026] [:error] [pid 61355:tid 61371] [client 35.88.49.76:49646] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/phpinfo.php"] [unique_id "af4Yh_khJTi30CBXmMkbfgAAAYo"]
[Sat May 09 01:08:24.456006 2026] [:error] [pid 61355:tid 61377] [client 35.88.49.76:49660] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dev/phpinfo.php"] [unique_id "af4YiPkhJTi30CBXmMkbhAAAAZA"]
[Sat May 09 01:08:25.200673 2026] [:error] [pid 51009:tid 51095] [client 35.88.49.76:33154] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/old/phpinfo.php"] [unique_id "af4YieB0GbUWhxgzX9WFwwAAAJM"]
[Sat May 09 01:08:25.923935 2026] [:error] [pid 51009:tid 51088] [client 35.88.49.76:33170] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tmp/phpinfo.php"] [unique_id "af4YieB0GbUWhxgzX9WFzQAAAIw"]
[Sat May 09 01:08:26.645076 2026] [:error] [pid 61356:tid 61402] [client 35.88.49.76:33176] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/phpinfo.php"] [unique_id "af4Yiox3vpB8oWhUq2MZ-QAAAc4"]
[Sat May 09 01:08:27.366863 2026] [:error] [pid 61356:tid 61390] [client 35.88.49.76:33182] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info"] [unique_id "af4Yi4x3vpB8oWhUq2MZ_wAAAcI"]
[Sat May 09 01:08:28.086743 2026] [:error] [pid 61355:tid 61368] [client 35.88.49.76:33194] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php-info.php"] [unique_id "af4YjPkhJTi30CBXmMkbpQAAAYc"]
[Sat May 09 01:08:28.842739 2026] [:error] [pid 34318:tid 34333] [client 35.88.49.76:33202] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpversion.php"] [unique_id "af4YjMr3guirgJiKhzD-rgAAAQ0"]
[Sat May 09 01:08:29.561354 2026] [:error] [pid 61355:tid 61374] [client 35.88.49.76:33208] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_phpinfo.php"] [unique_id "af4YjfkhJTi30CBXmMkbrwAAAY0"]
[Sat May 09 01:08:30.281569 2026] [:error] [pid 61355:tid 61375] [client 35.88.49.76:33212] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/old_phpinfo.php"] [unique_id "af4YjvkhJTi30CBXmMkbtgAAAY4"]
[Sat May 09 01:08:31.003589 2026] [:error] [pid 61317:tid 61324] [client 35.88.49.76:33214] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-info.php"] [unique_id "af4Yj8-fFk_CedOCOYsCoAAAAUQ"]
[Sat May 09 01:08:31.725620 2026] [:error] [pid 51007:tid 51039] [client 35.88.49.76:33228] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/server-status.php"] [unique_id "af4Yj1MagSGstWKyzzUU5gAAABE"]
[Sat May 09 01:08:32.445715 2026] [:error] [pid 51007:tid 51022] [client 35.88.49.76:33240] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_profiler/phpinfo"] [unique_id "af4YkFMagSGstWKyzzUU6AAAAAA"]
[Sat May 09 01:08:33.167785 2026] [:error] [pid 51009:tid 51082] [client 35.88.49.76:33248] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/_environment"] [unique_id "af4YkeB0GbUWhxgzX9WGBQAAAIY"]
[Sat May 09 01:08:33.889141 2026] [:error] [pid 61356:tid 61398] [client 35.88.49.76:33258] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webroot/index.php/_environment"] [unique_id "af4YkYx3vpB8oWhUq2MaDQAAAco"]
[Sat May 09 01:08:34.611499 2026] [:error] [pid 61355:tid 61380] [client 35.88.49.76:45646] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mail/phpinfo.php"] [unique_id "af4YkvkhJTi30CBXmMkbwgAAAZM"]
[Sat May 09 01:08:35.332971 2026] [:error] [pid 61356:tid 61392] [client 35.88.49.76:45652] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cpanel/phpinfo.php"] [unique_id "af4Yk4x3vpB8oWhUq2MaFwAAAcQ"]
[Sat May 09 01:08:36.056584 2026] [:error] [pid 61355:tid 61383] [client 35.88.49.76:45656] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hosting/phpinfo.php"] [unique_id "af4YlPkhJTi30CBXmMkbyQAAAZY"]
[Sat May 09 01:08:36.779326 2026] [:error] [pid 61317:tid 61327] [client 35.88.49.76:45660] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/webmail/phpinfo.php"] [unique_id "af4YlM-fFk_CedOCOYsCzAAAAUc"]
[Sat May 09 01:08:37.505712 2026] [:error] [pid 61317:tid 61341] [client 35.88.49.76:45664] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/smtp/phpinfo.php"] [unique_id "af4Ylc-fFk_CedOCOYsC0QAAAVU"]
[Sat May 09 01:08:38.228126 2026] [:error] [pid 61355:tid 61361] [client 35.88.49.76:45670] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php.bak"] [unique_id "af4YlvkhJTi30CBXmMkb1gAAAYA"]
[Sat May 09 01:08:38.950912 2026] [:error] [pid 51008:tid 51049] [client 35.88.49.76:45676] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php.old"] [unique_id "af4YlnB58C2Y1tgLtuLR2gAAAEA"]
[Sat May 09 01:08:39.674639 2026] [:error] [pid 61317:tid 61340] [client 35.88.49.76:45680] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php~"] [unique_id "af4Yl8-fFk_CedOCOYsC1wAAAVQ"]
[Sat May 09 01:08:40.396386 2026] [:error] [pid 51113:tid 51138] [client 35.88.49.76:45690] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php.bak"] [unique_id "af4YmEQfs7sWtqkpQIeXjAAAANc"]
[Sat May 09 01:08:41.119377 2026] [:error] [pid 51008:tid 51072] [client 35.88.49.76:45702] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo.php.save"] [unique_id "af4YmXB58C2Y1tgLtuLR4AAAAFc"]
[Sat May 09 01:08:41.840890 2026] [:error] [pid 61355:tid 61378] [client 35.88.49.76:45704] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/staging/phpinfo.php"] [unique_id "af4YmfkhJTi30CBXmMkb5gAAAZE"]
[Sat May 09 01:08:42.564125 2026] [:error] [pid 61356:tid 61391] [client 35.88.49.76:45710] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/beta/phpinfo.php"] [unique_id "af4Ymox3vpB8oWhUq2MaOwAAAcM"]
[Sat May 09 01:08:43.286323 2026] [:error] [pid 51009:tid 51079] [client 35.88.49.76:45722] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/uat/phpinfo.php"] [unique_id "af4Ym-B0GbUWhxgzX9WGGQAAAIM"]
[Sat May 09 01:08:44.006396 2026] [:error] [pid 61355:tid 61362] [client 35.88.49.76:45728] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/qa/phpinfo.php"] [unique_id "af4YnPkhJTi30CBXmMkb9AAAAYE"]
[Sat May 09 01:08:44.726280 2026] [:error] [pid 61355:tid 61381] [client 35.88.49.76:41418] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/preview/phpinfo.php"] [unique_id "af4YnPkhJTi30CBXmMkb_QAAAZQ"]
[Sat May 09 01:08:45.446091 2026] [:error] [pid 61355:tid 61370] [client 35.88.49.76:41432] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/www/phpinfo.php"] [unique_id "af4YnfkhJTi30CBXmMkcAwAAAYk"]
[Sat May 09 01:08:46.183713 2026] [:error] [pid 61355:tid 61367] [client 35.88.49.76:41444] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/htdocs/phpinfo.php"] [unique_id "af4YnvkhJTi30CBXmMkcDAAAAYY"]
[Sat May 09 01:08:46.904756 2026] [:error] [pid 61356:tid 61397] [client 35.88.49.76:41448] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public_html/phpinfo.php"] [unique_id "af4Ynox3vpB8oWhUq2MaSAAAAck"]
[Sat May 09 01:08:47.629599 2026] [:error] [pid 51008:tid 51058] [client 35.88.49.76:41450] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/phpinfo.php"] [unique_id "af4Yn3B58C2Y1tgLtuLR5AAAAEk"]
[Sat May 09 01:08:48.350102 2026] [:error] [pid 61355:tid 61365] [client 35.88.49.76:41464] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/docs/phpinfo.php"] [unique_id "af4YoPkhJTi30CBXmMkcFgAAAYQ"]
[Sat May 09 01:08:49.071142 2026] [:error] [pid 61356:tid 61390] [client 35.88.49.76:41468] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4YoYx3vpB8oWhUq2MaTQAAAcI"]
[Sat May 09 01:08:49.796431 2026] [:error] [pid 51008:tid 51062] [client 35.88.49.76:41476] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/administrator/phpinfo.php"] [unique_id "af4YoXB58C2Y1tgLtuLR5wAAAE0"]
[Sat May 09 01:08:50.519432 2026] [:error] [pid 61317:tid 61320] [client 35.88.49.76:41480] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core/phpinfo.php"] [unique_id "af4Yos-fFk_CedOCOYsC3QAAAUA"]
[Sat May 09 01:08:51.247135 2026] [:error] [pid 61355:tid 61362] [client 35.88.49.76:41494] [client 35.88.49.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/includes/phpinfo.php"] [unique_id "af4Yo_khJTi30CBXmMkcLAAAAYE"]
[Sat May 09 01:50:04.260093 2026] [:error] [pid 61355:tid 61369] [client 54.195.12.43:40720] [client 54.195.12.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "af4iTPkhJTi30CBXmMlDOgAAAYg"]
[Sat May 09 01:50:05.553698 2026] [:error] [pid 51008:tid 51066] [client 54.195.12.43:47898] [client 54.195.12.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4iTXB58C2Y1tgLtuLfygAAAFE"]
[Sat May 09 01:50:06.584661 2026] [:error] [pid 61355:tid 61366] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/phpinfo.php
[Sat May 09 01:50:06.879735 2026] [:error] [pid 61355:tid 61374] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/info.php
[Sat May 09 01:50:07.140207 2026] [:error] [pid 61355:tid 61385] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/php.php
[Sat May 09 01:50:07.402030 2026] [:error] [pid 61355:tid 61370] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/i.php
[Sat May 09 01:50:07.662496 2026] [:error] [pid 61355:tid 61364] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Sat May 09 01:50:07.923072 2026] [:error] [pid 61355:tid 61372] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/pinfo.php
[Sat May 09 01:50:08.183168 2026] [:error] [pid 61355:tid 61368] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/test.php
[Sat May 09 01:50:08.703921 2026] [:error] [pid 61355:tid 61383] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Sat May 09 01:50:08.964944 2026] [:error] [pid 61355:tid 61365] [client 54.195.12.43:47900] File does not exist: /usr/local/apache/htdocs/suspended-page/debug.php
[Sat May 09 01:50:09.482767 2026] [:error] [pid 61355:tid 61376] [client 54.195.12.43:47900] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/test/phpinfo.php"] [unique_id "af4iUfkhJTi30CBXmMlDYQAAAY8"]
[Sat May 09 01:50:10.508911 2026] [:error] [pid 61355:tid 61370] [client 54.195.12.43:47902] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/dev/phpinfo.php"] [unique_id "af4iUvkhJTi30CBXmMlDaQAAAYk"]
[Sat May 09 01:50:11.538974 2026] [:error] [pid 51009:tid 51094] [client 54.195.12.43:47918] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/old/phpinfo.php"] [unique_id "af4iU-B0GbUWhxgzX9Wa9AAAAJI"]
[Sat May 09 01:50:12.570128 2026] [:error] [pid 51009:tid 51100] [client 54.195.12.43:47926] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/tmp/phpinfo.php"] [unique_id "af4iVOB0GbUWhxgzX9Wa9gAAAJg"]
[Sat May 09 01:50:13.596738 2026] [:error] [pid 61317:tid 61335] [client 54.195.12.43:47932] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public/phpinfo.php"] [unique_id "af4iVc-fFk_CedOCOYsSqwAAAU8"]
[Sat May 09 01:50:14.626330 2026] [:error] [pid 51008:tid 51061] [client 54.195.12.43:47944] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info"] [unique_id "af4iVnB58C2Y1tgLtuLfzwAAAEw"]
[Sat May 09 01:50:15.651835 2026] [:error] [pid 51007:tid 51034] [client 54.195.12.43:57136] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/php-info.php"] [unique_id "af4iV1MagSGstWKyzzUfdAAAAAw"]
[Sat May 09 01:50:16.675002 2026] [:error] [pid 51009:tid 51079] [client 54.195.12.43:57144] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/phpversion.php"] [unique_id "af4iWOB0GbUWhxgzX9Wa-wAAAIM"]
[Sat May 09 01:50:17.700474 2026] [:error] [pid 51007:tid 51023] [client 54.195.12.43:57146] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_phpinfo.php"] [unique_id "af4iWVMagSGstWKyzzUfdwAAAAE"]
[Sat May 09 01:50:18.724957 2026] [:error] [pid 61355:tid 61383] [client 54.195.12.43:57150] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/old_phpinfo.php"] [unique_id "af4iWvkhJTi30CBXmMlDfQAAAZY"]
[Sat May 09 01:50:19.760087 2026] [:error] [pid 51008:tid 51062] [client 54.195.12.43:57152] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-info.php"] [unique_id "af4iW3B58C2Y1tgLtuLf3AAAAE0"]
[Sat May 09 01:50:20.787765 2026] [:error] [pid 51007:tid 51037] [client 54.195.12.43:57168] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/server-status.php"] [unique_id "af4iXFMagSGstWKyzzUfewAAAA8"]
[Sat May 09 01:50:21.813517 2026] [:error] [pid 51007:tid 51043] [client 54.195.12.43:57174] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_profiler/phpinfo"] [unique_id "af4iXVMagSGstWKyzzUffwAAABU"]
[Sat May 09 01:50:22.851174 2026] [:error] [pid 51009:tid 51091] [client 54.195.12.43:57190] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/_environment"] [unique_id "af4iXuB0GbUWhxgzX9WbAAAAAI8"]
[Sat May 09 01:50:23.885667 2026] [:error] [pid 51008:tid 51071] [client 54.195.12.43:57198] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/webroot/index.php/_environment"] [unique_id "af4iX3B58C2Y1tgLtuLf4gAAAFY"]
[Sat May 09 01:50:24.913098 2026] [:error] [pid 51009:tid 51094] [client 54.195.12.43:53246] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/mail/phpinfo.php"] [unique_id "af4iYOB0GbUWhxgzX9WbAwAAAJI"]
[Sat May 09 01:50:25.945915 2026] [:error] [pid 61356:tid 61391] [client 54.195.12.43:53252] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/cpanel/phpinfo.php"] [unique_id "af4iYYx3vpB8oWhUq2MyrgAAAcM"]
[Sat May 09 01:50:27.017533 2026] [:error] [pid 61355:tid 61363] [client 54.195.12.43:53254] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/hosting/phpinfo.php"] [unique_id "af4iY_khJTi30CBXmMlDlQAAAYI"]
[Sat May 09 01:50:28.045389 2026] [:error] [pid 61317:tid 61336] [client 54.195.12.43:53260] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/webmail/phpinfo.php"] [unique_id "af4iZM-fFk_CedOCOYsSsQAAAVA"]
[Sat May 09 01:50:29.073766 2026] [:error] [pid 51113:tid 51139] [client 54.195.12.43:53270] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/smtp/phpinfo.php"] [unique_id "af4iZUQfs7sWtqkpQIeeLAAAANg"]
[Sat May 09 01:50:30.099742 2026] [:error] [pid 51007:tid 51030] [client 54.195.12.43:53272] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/phpinfo.php.bak"] [unique_id "af4iZlMagSGstWKyzzUfiQAAAAg"]
[Sat May 09 01:50:31.131402 2026] [:error] [pid 51007:tid 51040] [client 54.195.12.43:53284] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/phpinfo.php.old"] [unique_id "af4iZ1MagSGstWKyzzUfigAAABI"]
[Sat May 09 01:50:32.156138 2026] [:error] [pid 61356:tid 61390] [client 54.195.12.43:53300] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/phpinfo.php~"] [unique_id "af4iaIx3vpB8oWhUq2MyvgAAAcI"]
[Sat May 09 01:50:33.189208 2026] [:error] [pid 61355:tid 61371] [client 54.195.12.43:53316] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/info.php.bak"] [unique_id "af4iafkhJTi30CBXmMlDoQAAAYo"]
[Sat May 09 01:50:34.223914 2026] [:error] [pid 34318:tid 34340] [client 54.195.12.43:53322] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/phpinfo.php.save"] [unique_id "af4iasr3guirgJiKhzAHUQAAARQ"]
[Sat May 09 01:50:35.258744 2026] [:error] [pid 61317:tid 61336] [client 54.195.12.43:55464] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/staging/phpinfo.php"] [unique_id "af4ia8-fFk_CedOCOYsSvQAAAVA"]
[Sat May 09 01:50:36.292282 2026] [:error] [pid 61355:tid 61373] [client 54.195.12.43:55468] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/beta/phpinfo.php"] [unique_id "af4ibPkhJTi30CBXmMlDpQAAAYw"]
[Sat May 09 01:50:37.317134 2026] [:error] [pid 51009:tid 51081] [client 54.195.12.43:55472] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/uat/phpinfo.php"] [unique_id "af4ibeB0GbUWhxgzX9WbGQAAAIU"]
[Sat May 09 01:50:38.347177 2026] [:error] [pid 51009:tid 51082] [client 54.195.12.43:55482] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/qa/phpinfo.php"] [unique_id "af4ibuB0GbUWhxgzX9WbHAAAAIY"]
[Sat May 09 01:50:39.381712 2026] [:error] [pid 51113:tid 51136] [client 54.195.12.43:55494] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/preview/phpinfo.php"] [unique_id "af4ib0Qfs7sWtqkpQIeeMAAAANU"]
[Sat May 09 01:50:40.407702 2026] [:error] [pid 51113:tid 51135] [client 54.195.12.43:55508] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/www/phpinfo.php"] [unique_id "af4icEQfs7sWtqkpQIeeMwAAANQ"]
[Sat May 09 01:50:41.437674 2026] [:error] [pid 61355:tid 61382] [client 54.195.12.43:55524] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/htdocs/phpinfo.php"] [unique_id "af4icfkhJTi30CBXmMlDswAAAZU"]
[Sat May 09 01:50:42.458823 2026] [:error] [pid 51008:tid 51068] [client 54.195.12.43:55538] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/public_html/phpinfo.php"] [unique_id "af4icnB58C2Y1tgLtuLf9AAAAFM"]
[Sat May 09 01:50:43.489285 2026] [:error] [pid 51009:tid 51079] [client 54.195.12.43:55540] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/site/phpinfo.php"] [unique_id "af4ic-B0GbUWhxgzX9WbIAAAAIM"]
[Sat May 09 01:50:44.515946 2026] [:error] [pid 61356:tid 61390] [client 54.195.12.43:55544] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/docs/phpinfo.php"] [unique_id "af4idIx3vpB8oWhUq2My1AAAAcI"]
[Sat May 09 01:50:45.543314 2026] [:error] [pid 61355:tid 61369] [client 54.195.12.43:57216] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4idfkhJTi30CBXmMlDuQAAAYg"]
[Sat May 09 01:50:46.565759 2026] [:error] [pid 61356:tid 61406] [client 54.195.12.43:57222] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/administrator/phpinfo.php"] [unique_id "af4idox3vpB8oWhUq2My3gAAAdI"]
[Sat May 09 01:50:47.591765 2026] [:error] [pid 61356:tid 61397] [client 54.195.12.43:57224] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/core/phpinfo.php"] [unique_id "af4id4x3vpB8oWhUq2My5gAAAck"]
[Sat May 09 01:50:48.624493 2026] [:error] [pid 61356:tid 61389] [client 54.195.12.43:57234] [client 54.195.12.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/includes/phpinfo.php"] [unique_id "af4ieIx3vpB8oWhUq2My6wAAAcE"]
[Sat May 09 03:11:35.373843 2026] [:error] [pid 61355:tid 61361] [client 35.88.49.76:48592] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "af41Z_khJTi30CBXmMlx4QAAAYA"]
[Sat May 09 03:11:36.299910 2026] [:error] [pid 61356:tid 61393] [client 35.88.49.76:48606] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "af41aIx3vpB8oWhUq2NZhgAAAcU"]
[Sat May 09 03:11:37.020519 2026] [:error] [pid 51009:tid 51085] [client 35.88.49.76:48622] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "af41aeB0GbUWhxgzX9W5zgAAAIk"]
[Sat May 09 03:11:37.743013 2026] [:error] [pid 61355:tid 61380] [client 35.88.49.76:48638] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "af41afkhJTi30CBXmMlx-wAAAZM"]
[Sat May 09 03:11:38.464243 2026] [:error] [pid 51008:tid 51055] [client 35.88.49.76:48652] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "af41anB58C2Y1tgLtuLz7wAAAEY"]
[Sat May 09 03:11:39.185982 2026] [:error] [pid 51008:tid 51056] [client 35.88.49.76:48662] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "af41a3B58C2Y1tgLtuLz8gAAAEc"]
[Sat May 09 03:11:39.906321 2026] [:error] [pid 51009:tid 51092] [client 35.88.49.76:48668] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "af41a-B0GbUWhxgzX9W55wAAAJA"]
[Sat May 09 03:11:40.625845 2026] [:error] [pid 61356:tid 61407] [client 35.88.49.76:48680] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.remote"] [unique_id "af41bIx3vpB8oWhUq2NZlAAAAdM"]
[Sat May 09 03:11:41.349355 2026] [:error] [pid 51113:tid 51116] [client 35.88.49.76:48684] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "af41bUQfs7sWtqkpQIeqVQAAAME"]
[Sat May 09 03:11:42.071329 2026] [:error] [pid 51008:tid 51072] [client 35.88.49.76:48686] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "af41bnB58C2Y1tgLtuLz-gAAAFc"]
[Sat May 09 03:11:42.792872 2026] [:error] [pid 61355:tid 61376] [client 35.88.49.76:48694] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.save"] [unique_id "af41bvkhJTi30CBXmMlyCQAAAY8"]
[Sat May 09 03:11:43.515189 2026] [:error] [pid 51113:tid 51139] [client 35.88.49.76:48696] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "af41b0Qfs7sWtqkpQIeqWwAAANg"]
[Sat May 09 03:11:44.234707 2026] [:error] [pid 51009:tid 51099] [client 35.88.49.76:48702] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.sample"] [unique_id "af41cOB0GbUWhxgzX9W6DAAAAJc"]
[Sat May 09 03:11:44.957353 2026] [:error] [pid 51009:tid 51085] [client 35.88.49.76:34604] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.example"] [unique_id "af41cOB0GbUWhxgzX9W6FQAAAIk"]
[Sat May 09 03:11:45.678412 2026] [:error] [pid 51008:tid 51064] [client 35.88.49.76:34616] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev"] [unique_id "af41cXB58C2Y1tgLtuLz_wAAAE8"]
[Sat May 09 03:11:46.399486 2026] [:error] [pid 51113:tid 51124] [client 35.88.49.76:34622] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.prod"] [unique_id "af41ckQfs7sWtqkpQIeqYAAAAMk"]
[Sat May 09 03:11:47.121769 2026] [:error] [pid 51009:tid 51092] [client 35.88.49.76:34632] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.stage"] [unique_id "af41c-B0GbUWhxgzX9W6HAAAAJA"]
[Sat May 09 03:11:47.842272 2026] [:error] [pid 51007:tid 51027] [client 35.88.49.76:34638] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.ci"] [unique_id "af41c1MagSGstWKyzzUuxAAAAAU"]
[Sat May 09 03:11:48.564983 2026] [:error] [pid 51008:tid 51055] [client 35.88.49.76:34640] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.docker"] [unique_id "af41dHB58C2Y1tgLtuL0BgAAAEY"]
[Sat May 09 03:11:49.289450 2026] [:error] [pid 51008:tid 51049] [client 35.88.49.76:34644] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.live"] [unique_id "af41dXB58C2Y1tgLtuL0CAAAAEA"]
[Sat May 09 03:11:50.009155 2026] [:error] [pid 51009:tid 51093] [client 35.88.49.76:34656] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.preprod"] [unique_id "af41duB0GbUWhxgzX9W6IQAAAJE"]
[Sat May 09 03:11:50.731057 2026] [:error] [pid 51113:tid 51136] [client 35.88.49.76:34672] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.uat"] [unique_id "af41dkQfs7sWtqkpQIeqZgAAANU"]
[Sat May 09 03:11:51.452652 2026] [:error] [pid 51113:tid 51124] [client 35.88.49.76:34684] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dist"] [unique_id "af41d0Qfs7sWtqkpQIeqZwAAAMk"]
[Sat May 09 03:11:52.173844 2026] [:error] [pid 61356:tid 61400] [client 35.88.49.76:34688] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.swp"] [unique_id "af41eIx3vpB8oWhUq2NZnQAAAcw"]
[Sat May 09 03:11:52.894997 2026] [:error] [pid 61355:tid 61382] [client 35.88.49.76:34700] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env~"] [unique_id "af41ePkhJTi30CBXmMlyIQAAAZU"]
[Sat May 09 03:11:55.143400 2026] [:error] [pid 61355:tid 61379] [client 35.88.49.76:38686] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env2"] [unique_id "af41e_khJTi30CBXmMlyMQAAAZI"]
[Sat May 09 03:11:55.866664 2026] [:error] [pid 51009:tid 51090] [client 35.88.49.76:38702] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env_copy"] [unique_id "af41e-B0GbUWhxgzX9W6SgAAAI4"]
[Sat May 09 03:11:56.587478 2026] [:error] [pid 61317:tid 61344] [client 35.88.49.76:38716] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.txt"] [unique_id "af41fM-fFk_CedOCOYsndwAAAVg"]
[Sat May 09 03:11:57.307227 2026] [:error] [pid 61317:tid 61343] [client 35.88.49.76:38720] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.json"] [unique_id "af41fc-fFk_CedOCOYsneQAAAVc"]
[Sat May 09 03:11:58.029075 2026] [:error] [pid 61317:tid 61337] [client 35.88.49.76:38722] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.yaml"] [unique_id "af41fs-fFk_CedOCOYsnfQAAAVE"]
[Sat May 09 03:11:58.758470 2026] [:error] [pid 51009:tid 51087] [client 35.88.49.76:38730] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.yml"] [unique_id "af41fuB0GbUWhxgzX9W6VQAAAIs"]
[Sat May 09 03:11:59.478278 2026] [:error] [pid 61355:tid 61365] [client 35.88.49.76:38746] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "af41f_khJTi30CBXmMlyNgAAAYQ"]
[Sat May 09 03:12:01.686507 2026] [:error] [pid 61355:tid 61380] [client 35.88.49.76:38760] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "af41gfkhJTi30CBXmMlyQQAAAZM"]
[Sat May 09 03:12:02.405916 2026] [:error] [pid 61355:tid 61368] [client 35.88.49.76:38762] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/web/.env"] [unique_id "af41gvkhJTi30CBXmMlyQwAAAYc"]
[Sat May 09 03:12:03.128755 2026] [:error] [pid 51008:tid 51063] [client 35.88.49.76:38770] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/site/.env"] [unique_id "af41g3B58C2Y1tgLtuL0DQAAAE4"]
[Sat May 09 03:12:03.850304 2026] [:error] [pid 61355:tid 61372] [client 35.88.49.76:38774] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.env"] [unique_id "af41g_khJTi30CBXmMlySgAAAYs"]
[Sat May 09 03:12:04.569001 2026] [:error] [pid 61356:tid 61388] [client 35.88.49.76:33208] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env"] [unique_id "af41hIx3vpB8oWhUq2NZugAAAcA"]
[Sat May 09 03:12:05.288021 2026] [:error] [pid 61317:tid 61323] [client 35.88.49.76:33222] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backend/.env"] [unique_id "af41hc-fFk_CedOCOYsngAAAAUM"]
[Sat May 09 03:12:06.010935 2026] [:error] [pid 51009:tid 51091] [client 35.88.49.76:33232] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/server/.env"] [unique_id "af41huB0GbUWhxgzX9W6XgAAAI8"]
[Sat May 09 03:12:06.734355 2026] [:error] [pid 61355:tid 61370] [client 35.88.49.76:33238] [client 35.88.49.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/frontend/.env"] [unique_id "af41hvkhJTi30CBXmMlyUQAAAYk"]
[Sat May 09 04:00:16.102905 2026] [:error] [pid 9187:tid 9260] [client 45.92.229.123:50015] [client 45.92.229.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.229.123, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "af5A0BC7An6gkXsRsaG4bgAAAIc"]
[Sat May 09 04:00:16.105729 2026] [:error] [pid 9187:tid 9260] [client 45.92.229.123:50015] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat May 09 09:09:29.667204 2026] [:error] [pid 9187:tid 9253] [client 20.206.86.59:44105] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Sat May 09 09:09:29.978878 2026] [:error] [pid 9187:tid 9272] [client 20.206.86.59:44105] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Sat May 09 09:09:30.602456 2026] [:error] [pid 9187:tid 9276] [client 20.206.86.59:44105] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Sat May 09 09:09:30.916253 2026] [:error] [pid 9187:tid 9255] [client 20.206.86.59:44105] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sat May 09 09:09:31.540360 2026] [:error] [pid 9187:tid 9266] [client 20.206.86.59:44105] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Sat May 09 09:09:31.854153 2026] [:error] [pid 9187:tid 9256] [client 20.206.86.59:44105] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat May 09 09:09:32.165263 2026] [:error] [pid 9187:tid 9264] [client 20.206.86.59:44105] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Sat May 09 09:09:32.795727 2026] [:error] [pid 9187:tid 9274] [client 20.206.86.59:44105] [client 20.206.86.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "af6JTBC7An6gkXsRsaEh1AAAAJU"]
[Sat May 09 09:09:34.084556 2026] [:error] [pid 9833:tid 9850] [client 20.206.86.59:52774] [client 20.206.86.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "af6JTiM9JmxIS0KGZUBPbwAAAYw"]
[Sat May 09 09:09:35.363166 2026] [:error] [pid 9760:tid 9787] [client 20.206.86.59:41654] [client 20.206.86.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "af6JT2IkCp-C_fh0s7IdYgAAAVU"]
[Sat May 09 09:09:36.604295 2026] [:error] [pid 9187:tid 9265] [client 20.206.86.59:46286] [client 20.206.86.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "af6JUBC7An6gkXsRsaEh1gAAAIw"]
[Sat May 09 09:33:19.670267 2026] [:error] [pid 9293:tid 9319] [client 45.154.98.197:52186] File does not exist: /usr/local/apache/htdocs/suspended-page/txets.php
[Sat May 09 09:33:20.688708 2026] [:error] [pid 9920:tid 9935] [client 45.154.98.197:52514] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/widgets/txets.php"] [unique_id "af6O4ExitGYhlzgZb5aVKwAAAc0"]
[Sat May 09 09:33:21.194808 2026] [:error] [pid 9293:tid 9302] [client 45.154.98.197:52672] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "af6O4ZR__qEzV5O6Z2MnqAAAAMU"]
[Sat May 09 09:33:21.701419 2026] [:error] [pid 9293:tid 9317] [client 45.154.98.197:52791] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "af6O4ZR__qEzV5O6Z2MnqQAAANQ"]
[Sat May 09 09:33:22.712911 2026] [:error] [pid 9920:tid 9943] [client 45.154.98.197:53005] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/txets.php"] [unique_id "af6O4kxitGYhlzgZb5aVNgAAAdU"]
[Sat May 09 09:33:23.218964 2026] [:error] [pid 9920:tid 9936] [client 45.154.98.197:53090] File does not exist: /usr/local/apache/htdocs/suspended-page/schallfuns.php
[Sat May 09 09:33:23.726531 2026] [:error] [pid 9663:tid 9670] [client 45.154.98.197:53287] File does not exist: /usr/local/apache/htdocs/suspended-page/postnews.php
[Sat May 09 11:21:26.466778 2026] [:error] [pid 9186:tid 9233] [client 45.154.98.198:60256] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oNhW4eFOEw1mKOgKuoAAAAEc"], referer: www.google.com
[Sat May 09 11:21:26.466939 2026] [:error] [pid 9293:tid 9298] [client 45.154.98.198:60236] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oNpR__qEzV5O6Z2NV1AAAAME"], referer: www.google.com
[Sat May 09 11:21:26.467657 2026] [:error] [pid 9293:tid 9301] [client 45.154.98.198:60521] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "af6oNpR__qEzV5O6Z2NV1QAAAMQ"], referer: www.google.com
[Sat May 09 11:21:26.468548 2026] [:error] [pid 9187:tid 9262] [client 45.154.98.198:60949] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "af6oNhC7An6gkXsRsaFJqAAAAIk"]
[Sat May 09 11:21:26.965914 2026] [:error] [pid 9293:tid 9321] [client 45.154.98.198:56435] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oNpR__qEzV5O6Z2NV2gAAANg"], referer: www.google.com
[Sat May 09 11:21:26.965984 2026] [:error] [pid 9293:tid 9299] [client 45.154.98.198:56475] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "af6oNpR__qEzV5O6Z2NV2wAAAMI"]
[Sat May 09 11:21:26.967481 2026] [:error] [pid 9293:tid 9314] [client 45.154.98.198:56440] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "af6oNpR__qEzV5O6Z2NV3AAAANE"], referer: www.google.com
[Sat May 09 11:21:26.967782 2026] [:error] [pid 9293:tid 9302] [client 45.154.98.198:56437] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oNpR__qEzV5O6Z2NV3QAAAMU"], referer: www.google.com
[Sat May 09 11:21:27.218568 2026] [:error] [pid 9293:tid 9315] [client 45.154.98.198:60529] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "af6oN5R__qEzV5O6Z2NV4QAAANI"]
[Sat May 09 11:21:27.466019 2026] [:error] [pid 9293:tid 9308] [client 45.154.98.198:59690] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oN5R__qEzV5O6Z2NV4gAAAMs"], referer: www.google.com
[Sat May 09 11:21:27.478047 2026] [:error] [pid 9293:tid 9298] [client 45.154.98.198:62767] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oN5R__qEzV5O6Z2NV4wAAAME"], referer: www.google.com
[Sat May 09 11:21:27.480267 2026] [:error] [pid 9293:tid 9301] [client 45.154.98.198:63267] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "af6oN5R__qEzV5O6Z2NV5AAAAMQ"], referer: www.google.com
[Sat May 09 11:21:27.717040 2026] [:error] [pid 9293:tid 9316] [client 45.154.98.198:53197] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "af6oN5R__qEzV5O6Z2NV6AAAANM"]
[Sat May 09 11:21:27.971003 2026] [:error] [pid 9293:tid 9314] [client 45.154.98.198:57960] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oN5R__qEzV5O6Z2NV6wAAANE"], referer: www.google.com
[Sat May 09 11:21:27.978906 2026] [:error] [pid 9293:tid 9302] [client 45.154.98.198:58447] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oN5R__qEzV5O6Z2NV7AAAAMU"], referer: www.google.com
[Sat May 09 11:21:27.979582 2026] [:error] [pid 9293:tid 9310] [client 45.154.98.198:58422] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "af6oN5R__qEzV5O6Z2NV7QAAAM0"], referer: www.google.com
[Sat May 09 11:21:28.212933 2026] [:error] [pid 9920:tid 9933] [client 45.154.98.198:60315] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "af6oOExitGYhlzgZb5atTAAAAcs"]
[Sat May 09 11:21:28.483635 2026] [:error] [pid 9187:tid 9256] [client 45.154.98.198:52579] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oOBC7An6gkXsRsaFJrQAAAIM"], referer: www.google.com
[Sat May 09 11:21:28.484909 2026] [:error] [pid 9187:tid 9266] [client 45.154.98.198:61791] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oOBC7An6gkXsRsaFJrgAAAI0"], referer: www.google.com
[Sat May 09 11:21:28.499327 2026] [:error] [pid 9187:tid 9253] [client 45.154.98.198:60509] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-plain.php"] [unique_id "af6oOBC7An6gkXsRsaFJsAAAAIA"], referer: www.google.com
[Sat May 09 11:21:29.487405 2026] [:error] [pid 9187:tid 9258] [client 45.154.98.198:60962] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oORC7An6gkXsRsaFJuAAAAIU"], referer: www.google.com
[Sat May 09 11:21:29.523277 2026] [:error] [pid 9187:tid 9257] [client 45.154.98.198:60944] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oORC7An6gkXsRsaFJuQAAAIQ"], referer: www.google.com
[Sat May 09 11:21:30.485993 2026] [:error] [pid 9833:tid 9858] [client 45.154.98.198:61577] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oOiM9JmxIS0KGZUBiOQAAAZQ"], referer: www.google.com
[Sat May 09 11:21:30.540641 2026] [:error] [pid 9833:tid 9848] [client 45.154.98.198:62689] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oOiM9JmxIS0KGZUBiOgAAAYo"], referer: www.google.com
[Sat May 09 11:21:31.562270 2026] [:error] [pid 9187:tid 9275] [client 45.154.98.198:63476] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oOxC7An6gkXsRsaFJvgAAAJY"], referer: www.google.com
[Sat May 09 11:21:31.632167 2026] [:error] [pid 9920:tid 9941] [client 45.154.98.198:51926] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oO0xitGYhlzgZb5atTgAAAdM"], referer: www.google.com
[Sat May 09 11:21:32.562939 2026] [:error] [pid 9187:tid 9270] [client 45.154.98.198:56998] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oPBC7An6gkXsRsaFJwwAAAJE"], referer: www.google.com
[Sat May 09 11:21:32.648863 2026] [:error] [pid 9187:tid 9272] [client 45.154.98.198:58255] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oPBC7An6gkXsRsaFJxQAAAJM"], referer: www.google.com
[Sat May 09 11:21:33.583169 2026] [:error] [pid 9293:tid 9302] [client 45.154.98.198:51745] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6oPZR__qEzV5O6Z2NWAQAAAMU"], referer: www.google.com
[Sat May 09 11:21:33.671681 2026] [:error] [pid 9920:tid 9925] [client 45.154.98.198:52751] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6oPUxitGYhlzgZb5atUAAAAcM"], referer: www.google.com
[Sat May 09 14:40:46.741378 2026] [:error] [pid 9293:tid 9305] [client 43.167.157.80:56042] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af7W7pR__qEzV5O6Z2OThAAAAMg"]
[Sat May 09 15:10:16.434192 2026] [:error] [pid 9293:tid 9297] [client 82.223.117.181:36258] [client 82.223.117.181] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.117.181, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "af7d2JR__qEzV5O6Z2Ob4AAAAMA"]
[Sat May 09 15:10:16.438375 2026] [:error] [pid 9293:tid 9297] [client 82.223.117.181:36258] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat May 09 15:10:18.744186 2026] [:error] [pid 9293:tid 9319] [client 82.223.117.181:36258] [client 82.223.117.181] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.117.181, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "af7d2pR__qEzV5O6Z2Ob5AAAANY"]
[Sat May 09 15:10:18.747664 2026] [:error] [pid 9293:tid 9319] [client 82.223.117.181:36258] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Sat May 09 15:18:28.473686 2026] [:error] [pid 9293:tid 9320] [client 43.133.36.219:48572] [client 43.133.36.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af7fxJR__qEzV5O6Z2OeBAAAANc"]
[Sat May 09 18:49:02.534631 2026] [:error] [pid 9186:tid 9228] [client 34.180.91.173:58918] [client 34.180.91.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "af8RHhW4eFOEw1mKOgLrfwAAAEI"]
[Sun May 10 02:03:56.570095 2026] [:error] [pid 62831:tid 62835] [client 43.134.49.216:42086] [client 43.134.49.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "af93DOYBNqNhtZ_l7qBxcwAAAAI"]
[Sun May 10 03:14:48.953282 2026] [:error] [pid 55182:tid 55213] [client 43.130.47.33:59396] [client 43.130.47.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "af-HqDaxmP-S8ASrqQkC9QAAAME"]
[Sun May 10 12:02:48.742622 2026] [:error] [pid 46330:tid 46409] [client 43.134.5.250:41882] [client 43.134.5.250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agADaIztrhd3evDQvs9YcAAAAFU"]
[Sun May 10 13:16:47.316002 2026] [:error] [pid 46417:tid 46442] [client 192.144.148.122:38990] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agAUv2Inm7mhwgbe48af1gAAARc"]
[Sun May 10 14:12:21.744829 2026] [:error] [pid 46331:tid 46377] [client 49.51.50.147:49244] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agAhxQP02hpYETwsZpg5EwAAAIk"]
[Sun May 10 20:08:13.819331 2026] [:error] [pid 16037:tid 16043] [client 43.159.140.236:57510] [client 43.159.140.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agB1LXzjLQfyYTkAdSR7PgAAAAI"]
[Sun May 10 22:15:20.851621 2026] [:error] [pid 16136:tid 16140] [client 43.133.36.219:58472] [client 43.133.36.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agCS-EOBGdmCMnPX0McKJAAAAII"]
[Sun May 10 23:28:28.415713 2026] [:error] [pid 37030:tid 37038] [client 34.18.188.95:38782] [client 34.18.188.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agCkHJrBzfXWwKkDkdbIDQAAAMY"]
[Mon May 11 01:00:10.698647 2026] [:error] [pid 9842:tid 9848] [client 34.88.105.84:43778] [client 34.88.105.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agC5mkKCvgYKKAjiZbJo8AAAAQM"]
[Mon May 11 01:41:57.684273 2026] [:error] [pid 16038:tid 16089] [client 34.32.78.158:33626] [client 34.32.78.158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agDDZU4hf5Tcsfa2scJ72QAAAZU"]
[Mon May 11 02:01:06.374518 2026] [:error] [pid 16038:tid 16090] [client 1.15.52.154:33316] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agDH4k4hf5Tcsfa2scKAxgAAAZY"]
[Mon May 11 02:13:35.825029 2026] [:error] [pid 16038:tid 16085] [client 34.175.183.228:49904] [client 34.175.183.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agDKz04hf5Tcsfa2scKEHgAAAZE"]
[Mon May 11 06:07:49.351435 2026] [:error] [pid 65366:tid 65384] [client 49.51.178.45:55798] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agEBtahVGdYzapDtv-Hv9gAAAM8"]
[Mon May 11 08:22:34.226985 2026] [:error] [pid 35052:tid 35055] [client 129.226.93.97:51896] [client 129.226.93.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agEhSuHjpNNnFJrMXu2XowAAAUA"]
[Mon May 11 14:22:42.149351 2026] [:error] [pid 58750:tid 58753] [client 129.211.172.249:51532] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agF1sjBVaNG3wJtPBU-KBwAAAUE"]
[Mon May 11 18:26:25.183978 2026] [:error] [pid 4645:tid 4659] [client 43.134.178.104:50192] [client 43.134.178.104] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agGu0Xy4dxn8-Cx5vOWkvwAAAEs"]
[Mon May 11 21:15:50.176758 2026] [:error] [pid 4685:tid 4711] [client 34.88.8.130:47264] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/app/.env"] [unique_id "agHWhnwrjbU4NZilCZ8KcgAAARc"]
[Mon May 11 21:15:50.214209 2026] [:error] [pid 4685:tid 4693] [client 34.88.8.130:47284] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env"] [unique_id "agHWhnwrjbU4NZilCZ8KcwAAAQU"]
[Mon May 11 21:15:50.225538 2026] [:error] [pid 4685:tid 4695] [client 34.88.8.130:47268] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.dev.local"] [unique_id "agHWhnwrjbU4NZilCZ8KdAAAAQc"]
[Mon May 11 21:15:50.261583 2026] [:error] [pid 58750:tid 58773] [client 34.88.8.130:47288] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.development.local"] [unique_id "agHWhjBVaNG3wJtPBU-0EwAAAVU"]
[Mon May 11 21:15:50.435200 2026] [:error] [pid 58677:tid 58699] [client 34.88.8.130:47290] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.local"] [unique_id "agHWhhasRhyteIXf1RVuWAAAAIs"]
[Mon May 11 21:15:50.455765 2026] [:error] [pid 58677:tid 58688] [client 34.88.8.130:47298] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/admin/.env"] [unique_id "agHWhhasRhyteIXf1RVuWQAAAIA"]
[Mon May 11 21:15:50.901382 2026] [:error] [pid 4685:tid 4712] [client 34.88.8.130:47302] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/app/.env.local"] [unique_id "agHWhnwrjbU4NZilCZ8KdgAAARg"]
[Mon May 11 21:15:50.901388 2026] [:error] [pid 4685:tid 4691] [client 34.88.8.130:47308] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.docker"] [unique_id "agHWhnwrjbU4NZilCZ8KdQAAAQM"]
[Mon May 11 21:15:51.454478 2026] [:error] [pid 4645:tid 4657] [client 34.88.8.130:47310] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/api/.env"] [unique_id "agHWh3y4dxn8-Cx5vOXDNQAAAEk"]
[Mon May 11 21:15:51.881153 2026] [:error] [pid 4685:tid 4688] [client 34.88.8.130:47312] [client 34.88.8.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.env.dev"] [unique_id "agHWh3wrjbU4NZilCZ8KdwAAAQA"]
[Mon May 11 22:36:22.844574 2026] [:error] [pid 58616:tid 58664] [client 49.51.243.95:48920] [client 49.51.243.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agHpZtnsbeF5ioCAecj1KQAAANI"]
[Mon May 11 22:53:35.041531 2026] [:error] [pid 58677:tid 58699] [client 165.154.163.227:55282] [client 165.154.163.227] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/favicon.ico"] [unique_id "agHtbxasRhyteIXf1RV6lgAAAIs"]
[Tue May 12 00:11:45.721644 2026] [:error] [pid 58750:tid 58772] [client 49.51.36.179:53388] [client 49.51.36.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agH_wTBVaNG3wJtPBU_DawAAAVQ"]
[Tue May 12 04:08:13.167904 2026] [:error] [pid 40061:tid 40072] [client 85.121.126.219:60028] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "agI3LbycIKt8hxHMBYt0KAAAAMk"]
[Tue May 12 04:08:13.168616 2026] [:error] [pid 39956:tid 39965] [client 85.121.126.219:60096] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backend/.env"] [unique_id "agI3LY2K3wZDsNji3My7twAAAAA"]
[Tue May 12 04:08:13.171839 2026] [:error] [pid 39956:tid 39978] [client 85.121.126.219:60044] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "agI3LY2K3wZDsNji3My7uQAAAA0"]
[Tue May 12 04:08:13.171849 2026] [:error] [pid 39956:tid 39981] [client 85.121.126.219:60066] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.test"] [unique_id "agI3LY2K3wZDsNji3My7ugAAABA"]
[Tue May 12 04:08:13.172137 2026] [:error] [pid 40061:tid 40073] [client 85.121.126.219:60078] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "agI3LbycIKt8hxHMBYt0KwAAAMo"]
[Tue May 12 04:08:13.172157 2026] [:error] [pid 39956:tid 39975] [client 85.121.126.219:60022] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "agI3LY2K3wZDsNji3My7uwAAAAo"]
[Tue May 12 04:08:13.172845 2026] [:error] [pid 40061:tid 40079] [client 85.121.126.219:60026] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "agI3LbycIKt8hxHMBYt0KQAAANA"]
[Tue May 12 04:08:13.172845 2026] [:error] [pid 40061:tid 40063] [client 85.121.126.219:60108] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "agI3LbycIKt8hxHMBYt0LAAAAMA"]
[Tue May 12 04:08:13.172948 2026] [:error] [pid 40061:tid 40087] [client 85.121.126.219:60114] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/public/.env"] [unique_id "agI3LbycIKt8hxHMBYt0LQAAANg"]
[Tue May 12 04:08:13.175377 2026] [:error] [pid 39958:tid 40040] [client 85.121.126.219:59948] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agI3LeVI9FVDxXB2XxgdCAAAAJU"]
[Tue May 12 04:08:13.175377 2026] [:error] [pid 39958:tid 40033] [client 85.121.126.219:60004] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "agI3LeVI9FVDxXB2XxgdCQAAAI4"]
[Tue May 12 04:08:13.176002 2026] [:error] [pid 40061:tid 40066] [client 85.121.126.219:60014] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.example"] [unique_id "agI3LbycIKt8hxHMBYt0MgAAAMM"]
[Tue May 12 04:08:13.183248 2026] [:error] [pid 55559:tid 55625] [client 85.121.126.219:60016] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "agI3Ldj0hVMLJAOI_fwtsQAAAQc"]
[Tue May 12 04:08:13.184711 2026] [:error] [pid 55559:tid 55642] [client 85.121.126.219:59984] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rejuva.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/storage/logs/laravel.log"] [unique_id "agI3Ldj0hVMLJAOI_fwtsgAAARU"]
[Tue May 12 04:08:13.186485 2026] [:error] [pid 39958:tid 40038] [client 85.121.126.219:60092] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env"] [unique_id "agI3LeVI9FVDxXB2XxgdCgAAAJM"]
[Tue May 12 04:08:13.186513 2026] [:error] [pid 39958:tid 40034] [client 85.121.126.219:60060] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.staging"] [unique_id "agI3LeVI9FVDxXB2XxgdCwAAAI8"]
[Tue May 12 04:08:13.187356 2026] [:error] [pid 55559:tid 55644] [client 85.121.126.219:60048] [client 85.121.126.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "agI3Ldj0hVMLJAOI_fwttQAAARc"]
[Tue May 12 04:40:55.454278 2026] [:error] [pid 55559:tid 55626] [client 43.135.36.201:47992] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agI-19j0hVMLJAOI_fw1lQAAAQg"]
[Tue May 12 06:33:27.758566 2026] [:error] [pid 39958:tid 40022] [client 34.88.124.243:56302] [client 34.88.124.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "agJZN-VI9FVDxXB2XxgtbgAAAIM"]
[Tue May 12 06:51:34.535536 2026] [:error] [pid 39958:tid 40024] [client 43.165.65.117:55908] [client 43.165.65.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agJdduVI9FVDxXB2XxgvKAAAAIU"]
[Tue May 12 08:27:23.170545 2026] [:error] [pid 55559:tid 55626] [client 43.156.232.134:37076] [client 43.156.232.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agJz69j0hVMLJAOI_fxn5gAAAQg"]
[Tue May 12 10:39:12.602268 2026] [:error] [pid 39957:tid 39994] [client 43.133.41.88:50278] [client 43.133.41.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agKS0OAfHHyq0DBh5BIdtAAAAEI"]
[Tue May 12 12:09:50.223656 2026] [:error] [pid 40061:tid 40075] [client 43.134.93.181:39354] [client 43.134.93.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agKoDrycIKt8hxHMBYvAPwAAAMw"]
[Tue May 12 18:15:44.304346 2026] [:error] [pid 40061:tid 40082] [client 43.135.172.89:39534] [client 43.135.172.89] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agL90LycIKt8hxHMBYvtzAAAANM"]
[Tue May 12 19:53:18.996753 2026] [:error] [pid 42143:tid 42150] [client 43.157.95.239:59462] [client 43.157.95.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agMUrkS2WmK92iCO2L0YtAAAAUM"]
[Tue May 12 23:32:20.974259 2026] [:error] [pid 40061:tid 40081] [client 43.159.141.150:33778] [client 43.159.141.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agNIBLycIKt8hxHMBYsUNwAAANI"]
[Wed May 13 01:53:11.356451 2026] [:error] [pid 39957:tid 40008] [client 43.156.116.44:48782] [client 43.156.116.44] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agNpB-AfHHyq0DBh5BKrtAAAAFA"]
[Wed May 13 03:27:47.793455 2026] [:error] [pid 39957:tid 39999] [client 141.98.11.120:50167] [client 141.98.11.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/wp-admin/css/"] [unique_id "agN_M-AfHHyq0DBh5BK56AAAAEc"], referer: binance.com
[Wed May 13 04:05:35.393033 2026] [:error] [pid 23787:tid 23868] [client 175.178.110.121:51986] [client 175.178.110.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agOIDx1cs5wE7VT6wiqG6AAAAJQ"]
[Wed May 13 06:11:59.412203 2026] [:error] [pid 23787:tid 23858] [client 129.226.217.17:58886] [client 129.226.217.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agOlrx1cs5wE7VT6wiqdFgAAAIo"]
[Wed May 13 07:52:23.703652 2026] [:error] [pid 3259:tid 3266] [client 43.130.67.33:47310] [client 43.130.67.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agO9N-WJB4YwcPVLeAqdegAAAQU"]
[Wed May 13 12:06:28.659606 2026] [:error] [pid 27332:tid 27347] [client 43.161.217.205:51422] [client 43.161.217.205] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agP4xI6Y5F_V9bmyC4Zu2AAAAU0"]
[Wed May 13 14:30:45.315570 2026] [:error] [pid 27332:tid 27355] [client 43.135.145.77:55552] [client 43.135.145.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agQalY6Y5F_V9bmyC4amSgAAAVU"]
[Wed May 13 18:23:59.006999 2026] [:error] [pid 45289:tid 45302] [client 101.32.49.171:42950] [client 101.32.49.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agRRP4OEpVhwFIe0Nzgf-wAAAYk"]
[Wed May 13 18:27:59.886314 2026] [:error] [pid 55744:tid 55758] [client 101.32.49.171:47168] [client 101.32.49.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agRSLwwbbCCudzl3Bmmi3QAAAoo"]
[Wed May 13 20:04:50.250885 2026] [:error] [pid 23782:tid 23824] [client 43.135.138.128:56936] [client 43.135.138.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agRo4iBrKFYHXUGnR-oJRQAAAEM"]
[Wed May 13 23:47:41.778478 2026] [:error] [pid 12338:tid 12384] [client 43.130.57.46:58002] [client 43.130.57.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agSdHcUJ87l42ffPr4wezAAAAE8"]
[Thu May 14 02:24:32.503015 2026] [:error] [pid 17873:tid 17888] [client 49.51.180.2:54760] [client 49.51.180.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agTB4PEqBQQrkyEyu_o2ngAAAQ0"]
[Thu May 14 02:43:51.187490 2026] [:error] [pid 12340:tid 12413] [client 160.30.179.128:42786] [client 160.30.179.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "agTGZ8rxSPfvmN7BQjLMXwAAAJE"]
[Thu May 14 05:01:33.021555 2026] [:error] [pid 63033:tid 63058] [client 122.51.236.174:40156] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agTmrVMY49UWn5BpqVY5iAAAARc"]
[Thu May 14 08:47:08.983692 2026] [:error] [pid 11690:tid 11707] [client 43.134.100.210:46480] [client 43.134.100.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agUbjCnxWuLN8Hptw8mm0AAAAMg"]
[Thu May 14 11:10:38.891626 2026] [:error] [pid 11690:tid 11704] [client 43.128.73.132:57040] [client 43.128.73.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agU9LinxWuLN8Hptw8nQAQAAAMU"]
[Thu May 14 12:30:18.976649 2026] [:error] [pid 11690:tid 11700] [client 192.96.159.129:64932] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "agVP2inxWuLN8Hptw8neYQAAAME"]
[Thu May 14 14:56:40.727516 2026] [:error] [pid 47721:tid 47731] [client 43.134.5.186:35086] [client 43.134.5.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agVyKHEmh7_G0hfOa6vStgAAAYg"]
[Thu May 14 16:29:06.211512 2026] [:error] [pid 11581:tid 11605] [client 43.134.40.189:53456] [client 43.134.40.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agWH0v0vF48FbzpvQMXTCQAAAAg"]
[Thu May 14 17:48:10.925727 2026] [:error] [pid 47721:tid 47726] [client 129.211.172.249:42192] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agWaWnEmh7_G0hfOa6vz6wAAAYM"]
[Thu May 14 20:14:01.620198 2026] [:error] [pid 11588:tid 11661] [client 170.106.148.137:56034] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agW8idUr21rOixkeGKauZQAAAIk"]
[Thu May 14 23:58:52.804354 2026] [:error] [pid 11581:tid 11613] [client 43.134.114.37:36498] [client 43.134.114.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agXxPP0vF48FbzpvQMVVuwAAABA"]
[Fri May 15 02:26:59.264734 2026] [:error] [pid 47721:tid 47732] [client 101.32.239.179:50422] [client 101.32.239.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agYT83Emh7_G0hfOa6tULAAAAYk"]
[Fri May 15 02:54:35.923755 2026] [:error] [pid 47721:tid 47746] [client 34.39.6.65:33454] [client 34.39.6.65] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "agYaa3Emh7_G0hfOa6tXjgAAAZc"]
[Fri May 15 05:16:00.768167 2026] [:error] [pid 1190:tid 1271] [client 34.101.245.122:49020] [client 34.101.245.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agY7kNqiXrD7hne4gFaVVwAAAJM"]
[Fri May 15 05:49:43.329006 2026] [:error] [pid 1189:tid 1240] [client 35.246.216.243:57164] [client 35.246.216.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agZDdwe36qIGegR4kclLFgAAAE8"]
[Fri May 15 05:49:45.285148 2026] [:error] [pid 50531:tid 50555] [client 35.246.216.243:42042] [client 35.246.216.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agZDeR3WbFwE6voqGzqg9AAAARY"]
[Fri May 15 05:57:49.235831 2026] [:error] [pid 50531:tid 50545] [client 175.27.171.245:49904] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agZFXR3WbFwE6voqGzqicgAAAQw"]
[Fri May 15 06:55:54.025929 2026] [:error] [pid 1188:tid 1216] [client 34.130.12.157:57892] [client 34.130.12.157] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agZS-tY68iW8yuNkNzPTSwAAABM"]
[Fri May 15 06:56:18.779908 2026] [:error] [pid 50531:tid 50547] [client 43.153.26.165:60356] [client 43.153.26.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agZTEh3WbFwE6voqGzqwiAAAAQ4"]
[Fri May 15 06:58:28.417002 2026] [:error] [pid 1189:tid 1231] [client 35.205.201.227:57772] [client 35.205.201.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agZTlAe36qIGegR4kclTgwAAAEY"]
[Fri May 15 07:02:22.208932 2026] [:error] [pid 1188:tid 1207] [client 34.97.118.137:46476] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "agZUftY68iW8yuNkNzPT3gAAAAo"]
[Fri May 15 07:02:22.247188 2026] [:error] [pid 1295:tid 1313] [client 34.97.118.137:46484] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev"] [unique_id "agZUftmMhqLvs0GYixnj7QAAAM8"]
[Fri May 15 07:02:22.277479 2026] [:error] [pid 1295:tid 1316] [client 34.97.118.137:46498] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development.local"] [unique_id "agZUftmMhqLvs0GYixnj7gAAANI"]
[Fri May 15 07:02:22.319854 2026] [:error] [pid 1188:tid 1201] [client 34.97.118.137:46514] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.dev.local"] [unique_id "agZUftY68iW8yuNkNzPT4AAAAAQ"]
[Fri May 15 07:02:22.358244 2026] [:error] [pid 1295:tid 1299] [client 34.97.118.137:46526] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "agZUftmMhqLvs0GYixnj7wAAAME"]
[Fri May 15 07:02:22.585409 2026] [:error] [pid 50531:tid 50553] [client 34.97.118.137:46540] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "agZUfh3WbFwE6voqGzqxiAAAARQ"]
[Fri May 15 07:02:22.660648 2026] [:error] [pid 1295:tid 1306] [client 34.97.118.137:46548] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.docker"] [unique_id "agZUftmMhqLvs0GYixnj8AAAAMg"]
[Fri May 15 07:02:22.666606 2026] [:error] [pid 50531:tid 50556] [client 34.97.118.137:46564] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env.local"] [unique_id "agZUfh3WbFwE6voqGzqxiQAAARc"]
[Fri May 15 07:02:22.732201 2026] [:error] [pid 1295:tid 1303] [client 34.97.118.137:46566] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "agZUftmMhqLvs0GYixnj8QAAAMU"]
[Fri May 15 07:02:22.841111 2026] [:error] [pid 50531:tid 50552] [client 34.97.118.137:46576] [client 34.97.118.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/admin/.env"] [unique_id "agZUfh3WbFwE6voqGzqxigAAARM"]
[Fri May 15 07:15:11.341890 2026] [:error] [pid 50531:tid 50542] [client 34.174.233.254:40232] [client 34.174.233.254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agZXfx3WbFwE6voqGzq0fAAAAQk"]
[Fri May 15 07:15:32.523028 2026] [:error] [pid 1190:tid 1253] [client 142.248.80.117:23502] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/backend/.env"] [unique_id "agZXlNqiXrD7hne4gFam5QAAAIE"]
[Fri May 15 07:15:32.523301 2026] [:error] [pid 1295:tid 1314] [client 142.248.80.117:23488] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/api/.env"] [unique_id "agZXlNmMhqLvs0GYixnlrgAAANA"]
[Fri May 15 07:15:32.524000 2026] [:error] [pid 1190:tid 1255] [client 142.248.80.117:23482] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/app/.env"] [unique_id "agZXlNqiXrD7hne4gFam5gAAAIM"]
[Fri May 15 07:15:32.524198 2026] [:error] [pid 1188:tid 1201] [client 142.248.80.117:23470] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "agZXlNY68iW8yuNkNzPVFQAAAAQ"]
[Fri May 15 07:15:32.524713 2026] [:error] [pid 1190:tid 1263] [client 142.248.80.117:23460] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "agZXlNqiXrD7hne4gFam5wAAAIs"]
[Fri May 15 07:15:32.532160 2026] [:error] [pid 50531:tid 50540] [client 142.248.80.117:54346] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "agZXlB3WbFwE6voqGzq0iwAAAQc"]
[Fri May 15 07:15:34.395700 2026] [:error] [pid 1188:tid 1206] [client 142.248.80.117:23574] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production.copy"] [unique_id "agZXltY68iW8yuNkNzPVGwAAAAk"]
[Fri May 15 07:15:34.514880 2026] [:error] [pid 1295:tid 1298] [client 142.248.80.117:23472] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/FETCH_HEAD"] [unique_id "agZXltmMhqLvs0GYixnlrwAAAMA"]
[Fri May 15 07:15:34.514891 2026] [:error] [pid 1188:tid 1200] [client 142.248.80.117:23562] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/HEAD"] [unique_id "agZXltY68iW8yuNkNzPVHAAAAAM"]
[Fri May 15 07:15:34.516012 2026] [:error] [pid 1188:tid 1200] [client 142.248.80.117:23524] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agZXltY68iW8yuNkNzPVHQAAAAM"]
[Fri May 15 07:15:35.212289 2026] [:error] [pid 1190:tid 1271] [client 142.248.80.117:23818] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/refs/heads/master"] [unique_id "agZXl9qiXrD7hne4gFam6wAAAJM"]
[Fri May 15 07:15:35.212254 2026] [:error] [pid 1190:tid 1252] [client 142.248.80.117:23626] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.old"] [unique_id "agZXl9qiXrD7hne4gFam7AAAAIA"]
[Fri May 15 07:15:35.213271 2026] [:error] [pid 1190:tid 1276] [client 142.248.80.117:23614] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "agZXl9qiXrD7hne4gFam7gAAAJg"]
[Fri May 15 07:15:35.213326 2026] [:error] [pid 1190:tid 1259] [client 142.248.80.117:23642] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/logs/HEAD"] [unique_id "agZXl9qiXrD7hne4gFam7QAAAIc"]
[Fri May 15 07:15:35.213481 2026] [:error] [pid 1190:tid 1262] [client 142.248.80.117:23600] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "agZXl9qiXrD7hne4gFam7wAAAIo"]
[Fri May 15 07:15:35.214088 2026] [:error] [pid 1190:tid 1273] [client 142.248.80.117:23832] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.save"] [unique_id "agZXl9qiXrD7hne4gFam8AAAAJU"]
[Fri May 15 07:15:35.214685 2026] [:error] [pid 1295:tid 1311] [client 142.248.80.117:23588] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env~"] [unique_id "agZXl9mMhqLvs0GYixnlsQAAAM0"]
[Fri May 15 07:15:35.214915 2026] [:error] [pid 1190:tid 1274] [client 142.248.80.117:23582] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.swp"] [unique_id "agZXl9qiXrD7hne4gFam8QAAAJY"]
[Fri May 15 07:15:35.215487 2026] [:error] [pid 1188:tid 1213] [client 142.248.80.117:23806] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production.save"] [unique_id "agZXl9Y68iW8yuNkNzPVHgAAABA"]
[Fri May 15 07:15:35.215601 2026] [:error] [pid 50531:tid 50544] [client 142.248.80.117:23792] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production.old"] [unique_id "agZXlx3WbFwE6voqGzq0jAAAAQs"]
[Fri May 15 07:15:35.216291 2026] [:error] [pid 1188:tid 1204] [client 142.248.80.117:23768] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local.copy"] [unique_id "agZXl9Y68iW8yuNkNzPVIAAAAAc"]
[Fri May 15 07:15:35.216701 2026] [:error] [pid 1188:tid 1216] [client 142.248.80.117:23802] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production.backup"] [unique_id "agZXl9Y68iW8yuNkNzPVHwAAABM"]
[Fri May 15 07:15:35.217107 2026] [:error] [pid 1295:tid 1303] [client 142.248.80.117:23780] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production.bak"] [unique_id "agZXl9mMhqLvs0GYixnlsgAAAMU"]
[Fri May 15 07:15:35.217196 2026] [:error] [pid 1188:tid 1204] [client 142.248.80.117:23752] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local.orig"] [unique_id "agZXl9Y68iW8yuNkNzPVIQAAAAc"]
[Fri May 15 07:15:35.217570 2026] [:error] [pid 1188:tid 1216] [client 142.248.80.117:23738] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local.swp"] [unique_id "agZXl9Y68iW8yuNkNzPVIgAAABM"]
[Fri May 15 07:15:35.218299 2026] [:error] [pid 1189:tid 1244] [client 142.248.80.117:23710] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local.save"] [unique_id "agZXlwe36qIGegR4kclVcwAAAFM"]
[Fri May 15 07:15:35.218308 2026] [:error] [pid 1188:tid 1203] [client 142.248.80.117:23722] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local~"] [unique_id "agZXl9Y68iW8yuNkNzPVIwAAAAY"]
[Fri May 15 07:15:35.218791 2026] [:error] [pid 1295:tid 1307] [client 142.248.80.117:23706] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local.backup"] [unique_id "agZXl9mMhqLvs0GYixnlswAAAMk"]
[Fri May 15 07:15:35.218988 2026] [:error] [pid 1188:tid 1209] [client 142.248.80.117:23702] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local.old"] [unique_id "agZXl9Y68iW8yuNkNzPVJAAAAAw"]
[Fri May 15 07:15:35.219608 2026] [:error] [pid 1188:tid 1210] [client 142.248.80.117:23682] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.copy"] [unique_id "agZXl9Y68iW8yuNkNzPVJQAAAA0"]
[Fri May 15 07:15:35.219968 2026] [:error] [pid 1295:tid 1315] [client 142.248.80.117:23688] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local.bak"] [unique_id "agZXl9mMhqLvs0GYixnltAAAANE"]
[Fri May 15 07:15:35.220084 2026] [:error] [pid 1188:tid 1199] [client 142.248.80.117:23676] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.orig"] [unique_id "agZXl9Y68iW8yuNkNzPVJgAAAAI"]
[Fri May 15 07:15:35.220414 2026] [:error] [pid 1188:tid 1211] [client 142.248.80.117:23668] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production~"] [unique_id "agZXl9Y68iW8yuNkNzPVJwAAAA4"]
[Fri May 15 07:15:35.220952 2026] [:error] [pid 1295:tid 1300] [client 142.248.80.117:23658] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production.swp"] [unique_id "agZXl9mMhqLvs0GYixnltQAAAMI"]
[Fri May 15 07:15:35.221112 2026] [:error] [pid 1188:tid 1211] [client 142.248.80.117:23652] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production.orig"] [unique_id "agZXl9Y68iW8yuNkNzPVKAAAAA4"]
[Fri May 15 07:15:35.300379 2026] [:error] [pid 1188:tid 1202] [client 142.248.80.117:23834] [client 142.248.80.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/refs/heads/main"] [unique_id "agZXl9Y68iW8yuNkNzPVKQAAAAU"]
[Fri May 15 16:52:15.924055 2026] [:error] [pid 30272:tid 30297] [client 43.128.89.111:47336] [client 43.128.89.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agbev3vc_jSFaQ_7_wfCywAAAZc"]
[Fri May 15 18:56:09.081552 2026] [:error] [pid 30272:tid 30275] [client 43.165.170.119:57294] [client 43.165.170.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agb7yXvc_jSFaQ_7_wfdgQAAAYE"]
[Fri May 15 22:29:48.150877 2026] [:error] [pid 9305:tid 9343] [client 43.153.113.127:38688] [client 43.153.113.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agct3N5FZyBmdCM8GsGWLgAAAEU"]
[Sat May 16 01:59:26.618507 2026] [:error] [pid 59153:tid 59173] [client 158.173.67.46:57263] [client 158.173.67.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.46, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "agde_u2qfjWznRhjHAo3WQAAAdE"]
[Sat May 16 01:59:26.975363 2026] [:error] [pid 59153:tid 59173] [client 158.173.67.46:57263] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sat May 16 06:21:18.357948 2026] [:error] [pid 24979:tid 24992] [client 43.153.204.189:60300] [client 43.153.204.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agecXrvSFUQiwLaOL2otLQAAAMs"]
[Sat May 16 06:43:34.852954 2026] [:error] [pid 24869:tid 24927] [client 129.211.172.249:58164] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agehluxo3FMprMltYl4DZwAAAFM"]
[Sat May 16 07:08:37.398000 2026] [:error] [pid 5602:tid 5623] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Sat May 16 07:08:37.639533 2026] [:error] [pid 5602:tid 5616] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/sx_pms.php
[Sat May 16 07:08:37.855137 2026] [:error] [pid 5602:tid 5624] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Sat May 16 07:08:38.069093 2026] [:error] [pid 5602:tid 5613] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-test.php
[Sat May 16 07:08:38.284260 2026] [:error] [pid 5602:tid 5626] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/like.php
[Sat May 16 07:08:38.497768 2026] [:error] [pid 5602:tid 5625] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Sat May 16 07:08:38.712523 2026] [:error] [pid 5602:tid 5617] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Sat May 16 07:08:38.931250 2026] [:error] [pid 5602:tid 5606] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-indx.php
[Sat May 16 07:08:39.144726 2026] [:error] [pid 5602:tid 5604] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/zoo.php
[Sat May 16 07:08:39.357734 2026] [:error] [pid 5602:tid 5620] [client 4.205.123.246:9353] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-link-spm.php
[Sat May 16 07:08:39.567795 2026] [:error] [pid 5602:tid 5605] [client 4.205.123.246:9353] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "agend9zTTsu77r3UIsnQOgAAAQE"]
[Sat May 16 07:08:43.179391 2026] [:error] [pid 24874:tid 24949] [client 4.205.123.246:10753] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "agene8iii6x3XidYGHGlpgAAAI4"]
[Sat May 16 07:08:50.086961 2026] [:error] [pid 5602:tid 5611] [client 4.205.123.246:4323] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "agengtzTTsu77r3UIsnQSwAAAQc"]
[Sat May 16 07:08:53.179326 2026] [:error] [pid 5602:tid 5608] [client 4.205.123.246:23990] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "agenhdzTTsu77r3UIsnQUQAAAQQ"]
[Sat May 16 07:08:57.537502 2026] [:error] [pid 24979:tid 24990] [client 4.205.123.246:23976] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "agenibvSFUQiwLaOL2o48AAAAMk"]
[Sat May 16 07:09:05.554689 2026] [:error] [pid 24874:tid 24938] [client 4.205.123.246:16226] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "agenkciii6x3XidYGHGl3gAAAIM"]
[Sat May 16 07:09:08.092107 2026] [:error] [pid 5602:tid 5620] [client 4.205.123.246:26043] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "agenlNzTTsu77r3UIsnQZQAAARA"]
[Sat May 16 07:09:15.552081 2026] [:error] [pid 5602:tid 5619] [client 4.205.123.246:16209] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agenm9zTTsu77r3UIsnQcgAAAQ8"]
[Sat May 16 07:09:17.313189 2026] [:error] [pid 5602:tid 5623] [client 4.205.123.246:5574] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agenndzTTsu77r3UIsnQdgAAARM"]
[Sat May 16 07:09:21.579543 2026] [:error] [pid 5602:tid 5625] [client 4.205.123.246:20217] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agenodzTTsu77r3UIsnQfgAAARU"]
[Sat May 16 07:09:24.800667 2026] [:error] [pid 24869:tid 24911] [client 4.205.123.246:12743] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agenpOxo3FMprMltYl4HWwAAAEM"]
[Sat May 16 07:09:27.379654 2026] [:error] [pid 24869:tid 24926] [client 4.205.123.246:1642] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "agenp-xo3FMprMltYl4HXgAAAFI"]
[Sat May 16 07:09:30.664146 2026] [:error] [pid 24979:tid 24993] [client 4.205.123.246:19014] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "agenqrvSFUQiwLaOL2o4_gAAAMw"]
[Sat May 16 07:09:33.461137 2026] [:error] [pid 24869:tid 24924] [client 4.205.123.246:13325] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "agenrexo3FMprMltYl4HZgAAAFA"]
[Sat May 16 07:09:35.997867 2026] [:error] [pid 24869:tid 24921] [client 4.205.123.246:37956] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "agenr-xo3FMprMltYl4HagAAAE0"]
[Sat May 16 07:09:40.861460 2026] [:error] [pid 24979:tid 24996] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/ws81.php
[Sat May 16 07:09:41.103639 2026] [:error] [pid 24979:tid 24981] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/drykl.php
[Sat May 16 07:09:41.316678 2026] [:error] [pid 24979:tid 24988] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Sat May 16 07:09:41.546326 2026] [:error] [pid 24979:tid 24992] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Sat May 16 07:09:41.769295 2026] [:error] [pid 24979:tid 24997] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Sat May 16 07:09:41.992257 2026] [:error] [pid 24979:tid 24983] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/x402.php
[Sat May 16 07:09:42.235774 2026] [:error] [pid 24979:tid 24991] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Sat May 16 07:09:42.449284 2026] [:error] [pid 24979:tid 24989] [client 4.205.123.246:1451] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Sat May 16 07:09:42.659419 2026] [:error] [pid 24979:tid 24984] [client 4.205.123.246:1451] [client 4.205.123.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "agentrvSFUQiwLaOL2o5CQAAAMM"]
[Sat May 16 07:09:46.621174 2026] [:error] [pid 24869:tid 24912] [client 4.205.123.246:1449] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Sat May 16 07:09:46.836526 2026] [:error] [pid 24869:tid 24922] [client 4.205.123.246:1449] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Sat May 16 07:09:47.047162 2026] [:error] [pid 24869:tid 24931] [client 4.205.123.246:1449] File does not exist: /usr/local/apache/htdocs/suspended-page/tires.php
[Sat May 16 07:09:47.260354 2026] [:error] [pid 24869:tid 24928] [client 4.205.123.246:1449] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "agenu-xo3FMprMltYl4HhAAAAFQ"]
[Sat May 16 07:09:50.912145 2026] [:error] [pid 24869:tid 24929] [client 4.205.123.246:7224] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "agenvuxo3FMprMltYl4HhQAAAFU"]
[Sat May 16 07:09:54.091703 2026] [:error] [pid 24979:tid 24997] [client 4.205.123.246:1518] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "agenwrvSFUQiwLaOL2o5FwAAANA"]
[Sat May 16 07:09:55.495461 2026] [:error] [pid 24979:tid 25002] [client 4.205.123.246:1466] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "agenw7vSFUQiwLaOL2o5GAAAANU"]
[Sat May 16 07:09:57.831142 2026] [:error] [pid 24979:tid 25001] [client 4.205.123.246:5897] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "agenxbvSFUQiwLaOL2o5IQAAANQ"]
[Sat May 16 07:09:59.809143 2026] [:error] [pid 24869:tid 24908] [client 4.205.123.246:38059] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "agenx-xo3FMprMltYl4HjQAAAEA"]
[Sat May 16 07:10:02.615404 2026] [:error] [pid 24869:tid 24916] [client 4.205.123.246:4576] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "agenyuxo3FMprMltYl4HmAAAAEg"]
[Sat May 16 07:10:04.241735 2026] [:error] [pid 24979:tid 25002] [client 4.205.123.246:38038] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "agenzLvSFUQiwLaOL2o5MQAAANU"]
[Sat May 16 07:10:08.737046 2026] [:error] [pid 5602:tid 5620] [client 4.205.123.246:1468] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "agen0NzTTsu77r3UIsnQxAAAARA"]
[Sat May 16 07:10:11.560521 2026] [:error] [pid 24874:tid 24944] [client 4.205.123.246:20886] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "agen08iii6x3XidYGHGmJAAAAIk"]
[Sat May 16 07:10:14.919828 2026] [:error] [pid 24869:tid 24929] [client 4.205.123.246:18500] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "agen1uxo3FMprMltYl4HqAAAAFU"]
[Sat May 16 07:10:17.708978 2026] [:error] [pid 24874:tid 24935] [client 4.205.123.246:2085] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cu.php"] [unique_id "agen2ciii6x3XidYGHGmPwAAAIA"]
[Sat May 16 07:10:22.326951 2026] [:error] [pid 24979:tid 24989] [client 4.205.123.246:11090] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "agen3rvSFUQiwLaOL2o5OwAAAMg"]
[Sat May 16 07:10:45.727932 2026] [:error] [pid 24979:tid 24994] [client 4.205.123.246:1201] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "agen9bvSFUQiwLaOL2o5ZQAAAM0"]
[Sat May 16 07:10:51.190768 2026] [:error] [pid 5602:tid 5604] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/sallu.php
[Sat May 16 07:10:51.417382 2026] [:error] [pid 5602:tid 5611] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/ng.php
[Sat May 16 07:10:51.673995 2026] [:error] [pid 5602:tid 5610] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/link.php
[Sat May 16 07:10:51.917500 2026] [:error] [pid 5602:tid 5615] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Sat May 16 07:10:52.132926 2026] [:error] [pid 5602:tid 5621] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/BDKR28WP.php
[Sat May 16 07:10:52.349638 2026] [:error] [pid 5602:tid 5614] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Sat May 16 07:10:52.600760 2026] [:error] [pid 5602:tid 5620] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Sat May 16 07:10:52.826034 2026] [:error] [pid 5602:tid 5607] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/one.php
[Sat May 16 07:10:53.069609 2026] [:error] [pid 5602:tid 5626] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Sat May 16 07:10:53.316353 2026] [:error] [pid 5602:tid 5619] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Sat May 16 07:10:53.575637 2026] [:error] [pid 5602:tid 5611] [client 4.205.123.246:6086] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Sat May 16 07:10:53.816551 2026] [:error] [pid 5602:tid 5605] [client 4.205.123.246:6086] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axe.php"] [unique_id "agen_dzTTsu77r3UIsnRJgAAAQE"]
[Sat May 16 07:10:57.133852 2026] [:error] [pid 24979:tid 24992] [client 4.205.123.246:19551] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axe.php"] [unique_id "ageoAbvSFUQiwLaOL2o5aQAAAMs"]
[Sat May 16 07:11:02.007057 2026] [:error] [pid 24874:tid 24938] [client 4.205.123.246:1202] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axe.php"] [unique_id "ageoBsiii6x3XidYGHGmfgAAAIM"]
[Sat May 16 07:11:07.923632 2026] [:error] [pid 24874:tid 24952] [client 4.205.123.246:42637] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/axe.php"] [unique_id "ageoC8iii6x3XidYGHGmigAAAJE"]
[Sat May 16 07:11:10.881580 2026] [:error] [pid 24874:tid 24939] [client 4.205.123.246:5689] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/de.php"] [unique_id "ageoDsiii6x3XidYGHGmkQAAAIQ"]
[Sat May 16 07:11:13.195333 2026] [:error] [pid 24869:tid 24920] [client 4.205.123.246:7361] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/de.php"] [unique_id "ageoEexo3FMprMltYl4H9QAAAEw"]
[Sat May 16 07:11:16.553696 2026] [:error] [pid 24874:tid 24953] [client 4.205.123.246:18179] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/de.php"] [unique_id "ageoFMiii6x3XidYGHGmmwAAAJI"]
[Sat May 16 07:11:18.064933 2026] [:error] [pid 24979:tid 25003] [client 4.205.123.246:5665] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/de.php"] [unique_id "ageoFrvSFUQiwLaOL2o5mwAAANY"]
[Sat May 16 07:11:20.076556 2026] [:error] [pid 5602:tid 5604] [client 4.205.123.246:30203] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ageoGNzTTsu77r3UIsnRXQAAAQA"]
[Sat May 16 07:11:21.430966 2026] [:error] [pid 5602:tid 5628] [client 4.205.123.246:23122] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ageoGdzTTsu77r3UIsnRZgAAARg"]
[Sat May 16 07:11:22.259208 2026] [:error] [pid 24874:tid 24958] [client 4.205.123.246:5683] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ageoGsiii6x3XidYGHGmnwAAAJc"]
[Sat May 16 07:11:25.085884 2026] [:error] [pid 5602:tid 5623] [client 4.205.123.246:5671] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aa.php"] [unique_id "ageoHdzTTsu77r3UIsnRhAAAARM"]
[Sat May 16 07:11:32.451869 2026] [:error] [pid 24874:tid 24958] [client 4.205.123.246:18149] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ageoJMiii6x3XidYGHGmsgAAAJc"]
[Sat May 16 07:11:35.757966 2026] [:error] [pid 24979:tid 24985] [client 4.205.123.246:19531] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ageoJ7vSFUQiwLaOL2o5tgAAAMQ"]
[Sat May 16 07:11:39.745919 2026] [:error] [pid 24874:tid 24949] [client 4.205.123.246:7397] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ageoK8iii6x3XidYGHGmvAAAAI4"]
[Sat May 16 07:11:43.881629 2026] [:error] [pid 5602:tid 5616] [client 4.205.123.246:19523] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "ageoL9zTTsu77r3UIsnRyAAAAQw"]
[Sat May 16 07:11:50.726722 2026] [:error] [pid 24979:tid 24990] [client 4.205.123.246:14363] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f5.php"] [unique_id "ageoNrvSFUQiwLaOL2o52AAAAMk"]
[Sat May 16 07:11:53.030681 2026] [:error] [pid 24979:tid 24981] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php
[Sat May 16 07:11:53.249410 2026] [:error] [pid 24979:tid 24987] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/view.php
[Sat May 16 07:11:53.471894 2026] [:error] [pid 24979:tid 24993] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/bc.php
[Sat May 16 07:11:53.687250 2026] [:error] [pid 24979:tid 24992] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/tx79.php
[Sat May 16 07:11:53.904751 2026] [:error] [pid 24979:tid 25000] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/moshou.php
[Sat May 16 07:11:54.124112 2026] [:error] [pid 24979:tid 24985] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/lib.php
[Sat May 16 07:11:54.347361 2026] [:error] [pid 24979:tid 24999] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/zoper1.php
[Sat May 16 07:11:54.637410 2026] [:error] [pid 24979:tid 24988] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Sat May 16 07:11:54.857675 2026] [:error] [pid 24979:tid 25001] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/geforce.php
[Sat May 16 07:11:55.073329 2026] [:error] [pid 24979:tid 24997] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/dostshell.php
[Sat May 16 07:11:56.878879 2026] [:error] [pid 24979:tid 24997] [client 4.205.123.246:5936] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Sat May 16 07:11:57.114711 2026] [:error] [pid 24979:tid 24992] [client 4.205.123.246:5936] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "ageoPbvSFUQiwLaOL2o59wAAAMs"]
[Sat May 16 07:11:59.592408 2026] [:error] [pid 24869:tid 24922] [client 4.205.123.246:16252] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "ageoP-xo3FMprMltYl4IDwAAAE4"]
[Sat May 16 07:12:03.878362 2026] [:error] [pid 24874:tid 24938] [client 4.205.123.246:6915] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "ageoQ8iii6x3XidYGHGm4QAAAIM"]
[Sat May 16 07:12:08.050278 2026] [:error] [pid 24869:tid 24925] [client 4.205.123.246:19131] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "ageoSOxo3FMprMltYl4IFgAAAFE"]
[Sat May 16 07:12:10.031251 2026] [:error] [pid 24869:tid 24911] [client 4.205.123.246:26615] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "ageoSuxo3FMprMltYl4IGQAAAEM"]
[Sat May 16 07:12:12.570571 2026] [:error] [pid 24979:tid 24982] [client 4.205.123.246:22350] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "ageoTLvSFUQiwLaOL2o6DwAAAME"]
[Sat May 16 07:12:16.428146 2026] [:error] [pid 24874:tid 24951] [client 4.205.123.246:16290] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "ageoUMiii6x3XidYGHGm8QAAAJA"]
[Sat May 16 07:12:20.524540 2026] [:error] [pid 24979:tid 24994] [client 4.205.123.246:11188] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "ageoVLvSFUQiwLaOL2o6FQAAAM0"]
[Sat May 16 07:12:22.539297 2026] [:error] [pid 5602:tid 5623] [client 4.205.123.246:11141] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ageoVtzTTsu77r3UIsnSNAAAARM"]
[Sat May 16 07:12:24.571396 2026] [:error] [pid 24874:tid 24952] [client 4.205.123.246:22780] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ageoWMiii6x3XidYGHGm_AAAAJE"]
[Sat May 16 07:12:29.322547 2026] [:error] [pid 24874:tid 24947] [client 4.205.123.246:20530] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ageoXciii6x3XidYGHGnBwAAAIw"]
[Sat May 16 07:12:32.851603 2026] [:error] [pid 24979:tid 24996] [client 4.205.123.246:21631] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ageoYLvSFUQiwLaOL2o6OAAAAM8"]
[Sat May 16 07:12:35.311104 2026] [:error] [pid 24979:tid 24984] [client 4.205.123.246:29728] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "ageoY7vSFUQiwLaOL2o6RQAAAMM"]
[Sat May 16 07:12:37.029521 2026] [:error] [pid 24869:tid 24909] [client 4.205.123.246:15417] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "ageoZexo3FMprMltYl4IMAAAAEE"]
[Sat May 16 07:12:38.950557 2026] [:error] [pid 24979:tid 24986] [client 4.205.123.246:15398] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "ageoZrvSFUQiwLaOL2o6TQAAAMU"]
[Sat May 16 07:12:41.744812 2026] [:error] [pid 24869:tid 24910] [client 4.205.123.246:2383] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "ageoaexo3FMprMltYl4INgAAAEI"]
[Sat May 16 07:12:44.863015 2026] [:error] [pid 24869:tid 24912] [client 4.205.123.246:15388] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ageobOxo3FMprMltYl4IPQAAAEQ"]
[Sat May 16 07:12:47.145181 2026] [:error] [pid 24869:tid 24917] [client 4.205.123.246:29659] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ageob-xo3FMprMltYl4IRgAAAEk"]
[Sat May 16 07:12:48.652958 2026] [:error] [pid 24869:tid 24925] [client 4.205.123.246:19080] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ageocOxo3FMprMltYl4ISgAAAFE"]
[Sat May 16 07:12:49.856432 2026] [:error] [pid 24869:tid 24911] [client 4.205.123.246:17356] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ageocexo3FMprMltYl4ITgAAAEM"]
[Sat May 16 07:12:53.144909 2026] [:error] [pid 24869:tid 24916] [client 4.205.123.246:1825] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "ageodexo3FMprMltYl4IWAAAAEg"]
[Sat May 16 07:12:54.992564 2026] [:error] [pid 5602:tid 5616] [client 4.205.123.246:2425] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xltt.php"] [unique_id "ageodtzTTsu77r3UIsnSXAAAAQw"]
[Sat May 16 07:12:57.921702 2026] [:error] [pid 24874:tid 24946] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Sat May 16 07:12:58.142462 2026] [:error] [pid 24874:tid 24943] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Sat May 16 07:12:58.361427 2026] [:error] [pid 24874:tid 24936] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/press.php
[Sat May 16 07:12:58.578919 2026] [:error] [pid 24874:tid 24940] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Sat May 16 07:12:58.797153 2026] [:error] [pid 24874:tid 24939] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Sat May 16 07:12:59.013915 2026] [:error] [pid 24874:tid 24945] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/ws78.php
[Sat May 16 07:12:59.231052 2026] [:error] [pid 24874:tid 24937] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/options.php
[Sat May 16 07:12:59.447415 2026] [:error] [pid 24874:tid 24942] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/min.php
[Sat May 16 07:12:59.681564 2026] [:error] [pid 24874:tid 24949] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/img.php
[Sat May 16 07:12:59.901480 2026] [:error] [pid 24874:tid 24944] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Sat May 16 07:13:00.175703 2026] [:error] [pid 24874:tid 24935] [client 4.205.123.246:15313] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Sat May 16 07:13:00.389047 2026] [:error] [pid 24874:tid 24947] [client 4.205.123.246:15313] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "ageofMiii6x3XidYGHGnPwAAAIw"]
[Sat May 16 07:13:01.994884 2026] [:error] [pid 24979:tid 24987] [client 4.205.123.246:42988] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "ageofbvSFUQiwLaOL2o6XwAAAMY"]
[Sat May 16 07:13:04.341810 2026] [:error] [pid 5602:tid 5622] [client 4.205.123.246:13249] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "ageogNzTTsu77r3UIsnSZwAAARI"]
[Sat May 16 07:13:07.883100 2026] [:error] [pid 24874:tid 24954] [client 4.205.123.246:37463] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "ageog8iii6x3XidYGHGnQgAAAJM"]
[Sat May 16 07:13:10.179995 2026] [:error] [pid 5602:tid 5625] [client 4.205.123.246:19104] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj11.php"] [unique_id "ageohtzTTsu77r3UIsnScQAAARU"]
[Sat May 16 07:13:12.953347 2026] [:error] [pid 24869:tid 24917] [client 4.205.123.246:10779] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj11.php"] [unique_id "ageoiOxo3FMprMltYl4IYgAAAEk"]
[Sat May 16 07:13:16.604043 2026] [:error] [pid 24867:tid 24898] [client 4.205.123.246:4312] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aj11.php"] [unique_id "ageojCDgFLCgyKq-zmbzJwAAABE"]
[Sat May 16 07:13:31.463887 2026] [:error] [pid 24874:tid 24947] [client 4.205.123.246:8951] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "ageom8iii6x3XidYGHGnXQAAAIw"]
[Sat May 16 07:13:36.102372 2026] [:error] [pid 24979:tid 24992] [client 4.205.123.246:26589] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "ageooLvSFUQiwLaOL2o6egAAAMs"]
[Sat May 16 07:13:41.823794 2026] [:error] [pid 24979:tid 24983] [client 4.205.123.246:15896] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "ageopbvSFUQiwLaOL2o6fgAAAMI"]
[Sat May 16 07:13:53.426948 2026] [:error] [pid 24869:tid 24918] [client 4.205.123.246:7375] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "ageosexo3FMprMltYl4IdAAAAEo"]
[Sat May 16 07:13:56.680259 2026] [:error] [pid 24874:tid 24940] [client 4.205.123.246:6647] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "ageotMiii6x3XidYGHGndwAAAIU"]
[Sat May 16 07:14:00.402185 2026] [:error] [pid 5602:tid 5616] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/man.php
[Sat May 16 07:14:00.613006 2026] [:error] [pid 5602:tid 5625] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Sat May 16 07:14:00.836134 2026] [:error] [pid 5602:tid 5608] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Sat May 16 07:14:01.097981 2026] [:error] [pid 5602:tid 5605] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Sat May 16 07:14:01.322212 2026] [:error] [pid 5602:tid 5628] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Sat May 16 07:14:01.573508 2026] [:error] [pid 5602:tid 5627] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/bob.php
[Sat May 16 07:14:01.783381 2026] [:error] [pid 5602:tid 5618] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Sat May 16 07:14:01.999880 2026] [:error] [pid 5602:tid 5615] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/insta.php
[Sat May 16 07:14:02.226621 2026] [:error] [pid 5602:tid 5620] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-kz.php
[Sat May 16 07:14:02.473558 2026] [:error] [pid 5602:tid 5611] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/xs.php
[Sat May 16 07:14:02.692604 2026] [:error] [pid 5602:tid 5614] [client 4.205.123.246:7054] File does not exist: /usr/local/apache/htdocs/suspended-page/2026w.php
[Sat May 16 07:14:02.899455 2026] [:error] [pid 5602:tid 5624] [client 4.205.123.246:7054] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ageoutzTTsu77r3UIsnSugAAARQ"]
[Sat May 16 07:14:12.530864 2026] [:error] [pid 24874:tid 24948] [client 4.205.123.246:7055] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ageoxMiii6x3XidYGHGnhgAAAI0"]
[Sat May 16 07:14:14.720476 2026] [:error] [pid 24874:tid 24954] [client 4.205.123.246:42746] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ageoxsiii6x3XidYGHGnjQAAAJM"]
[Sat May 16 07:14:18.111497 2026] [:error] [pid 24869:tid 24928] [client 4.205.123.246:19598] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ageoyuxo3FMprMltYl4IgQAAAFQ"]
[Sat May 16 07:14:21.965937 2026] [:error] [pid 24869:tid 24922] [client 4.205.123.246:1588] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ageozexo3FMprMltYl4IgwAAAE4"]
[Sat May 16 07:14:25.874579 2026] [:error] [pid 24874:tid 24954] [client 4.205.123.246:19875] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ageo0ciii6x3XidYGHGnmgAAAJM"]
[Sat May 16 07:14:29.727944 2026] [:error] [pid 24874:tid 24943] [client 4.205.123.246:20904] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ageo1ciii6x3XidYGHGnogAAAIg"]
[Sat May 16 07:14:32.475673 2026] [:error] [pid 24979:tid 24994] [client 4.205.123.246:8683] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ageo2LvSFUQiwLaOL2o6kQAAAM0"]
[Sat May 16 07:14:37.154796 2026] [:error] [pid 5602:tid 5613] [client 4.205.123.246:8655] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ageo3dzTTsu77r3UIsnS2wAAAQk"]
[Sat May 16 07:14:41.259688 2026] [:error] [pid 5602:tid 5610] [client 4.205.123.246:26047] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ageo4dzTTsu77r3UIsnS4gAAAQY"]
[Sat May 16 07:14:46.018401 2026] [:error] [pid 5602:tid 5611] [client 4.205.123.246:1454] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ageo5tzTTsu77r3UIsnS6wAAAQc"]
[Sat May 16 07:14:51.360300 2026] [:error] [pid 5602:tid 5609] [client 4.205.123.246:14343] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "ageo69zTTsu77r3UIsnS8wAAAQU"]
[Sat May 16 07:15:00.792293 2026] [:error] [pid 5602:tid 5626] [client 4.205.123.246:1442] [client 4.205.123.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/simple.php"] [unique_id "ageo9NzTTsu77r3UIsnTFAAAARY"]
[Sat May 16 07:15:04.089940 2026] [:error] [pid 5602:tid 5604] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Sat May 16 07:15:04.308361 2026] [:error] [pid 5602:tid 5617] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Sat May 16 07:15:04.570707 2026] [:error] [pid 5602:tid 5607] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Sat May 16 07:15:04.793532 2026] [:error] [pid 5602:tid 5623] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxml.php
[Sat May 16 07:15:05.046251 2026] [:error] [pid 5602:tid 5614] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/zo.php
[Sat May 16 07:15:05.262750 2026] [:error] [pid 5602:tid 5628] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/sky.php
[Sat May 16 07:15:05.485262 2026] [:error] [pid 5602:tid 5609] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Sat May 16 07:15:05.716934 2026] [:error] [pid 5602:tid 5606] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Sat May 16 07:15:05.998329 2026] [:error] [pid 5602:tid 5608] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/xstelth.php
[Sat May 16 07:15:06.214596 2026] [:error] [pid 5602:tid 5611] [client 4.205.123.246:20456] File does not exist: /usr/local/apache/htdocs/suspended-page/3369.php
[Sat May 16 09:32:32.737941 2026] [:error] [pid 24979:tid 24993] [client 43.130.72.40:54994] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agfJMLvSFUQiwLaOL2pWfAAAAMw"]
[Sat May 16 11:19:49.521404 2026] [:error] [pid 24979:tid 24989] [client 129.226.152.67:39118] [client 129.226.152.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agfiVbvSFUQiwLaOL2ppOwAAAMg"]
[Sat May 16 13:49:58.543645 2026] [:error] [pid 61463:tid 61469] [client 43.166.240.231:40106] [client 43.166.240.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aggFhjXdL1WU7nYXPmTmKwAAAcQ"]
[Sat May 16 15:21:48.064559 2026] [:error] [pid 24979:tid 24983] [client 43.165.125.66:33244] [client 43.165.125.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aggbDLvSFUQiwLaOL2qKPwAAAMI"]
[Sat May 16 19:09:10.749609 2026] [:error] [pid 62341:tid 62350] [client 129.211.172.249:46476] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aghQVqnvQ59ep-XG78i60AAAAoQ"]
[Sat May 16 21:18:11.310352 2026] [:error] [pid 61361:tid 61368] [client 43.157.175.122:51460] [client 43.157.175.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aghuk5Zojzbt3jGziNmCgQAAAUU"]
[Sat May 16 22:53:56.585885 2026] [:error] [pid 61361:tid 61373] [client 43.164.190.124:58752] [client 43.164.190.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agiFBJZojzbt3jGziNmQuQAAAUo"]
[Sun May 17 00:01:14.601581 2026] [:error] [pid 24979:tid 25000] [client 34.169.82.194:52834] [client 34.169.82.194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "agiUyrvSFUQiwLaOL2q6BwAAANM"]
[Sun May 17 00:42:18.472488 2026] [:error] [pid 61411:tid 61434] [client 103.153.183.69:33422] [client 103.153.183.69] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||rejuva.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agieamVkiEwGnPL_dvE2SQAAAZU"]
[Sun May 17 00:42:18.472576 2026] [:error] [pid 61411:tid 61434] [client 103.153.183.69:33422] [client 103.153.183.69] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||rejuva.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agieamVkiEwGnPL_dvE2SQAAAZU"]
[Sun May 17 01:08:00.480268 2026] [:error] [pid 62341:tid 62357] [client 43.156.51.128:54112] [client 43.156.51.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agikcKnvQ59ep-XG78jUKQAAAos"]
[Sun May 17 10:00:28.144481 2026] [:error] [pid 36652:tid 36676] [client 92.118.39.29:37716] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "agkhPDZrzQadnZADvj8wpwAAARY"]
[Sun May 17 13:00:54.775855 2026] [:error] [pid 17234:tid 17239] [client 43.130.14.245:49440] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "aglLhtJ4QOrYRCeDR2g-SQAAAUM"]
[Sun May 17 13:03:23.008808 2026] [:error] [pid 59060:tid 59076] [client 192.96.159.129:63707] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "aglMG_vwvq3bndkPE4ndAgAAAAc"]
[Sun May 17 15:18:03.255276 2026] [:error] [pid 59060:tid 59076] [client 43.130.57.76:55620] [client 43.130.57.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "aglrq_vwvq3bndkPE4niYQAAAAc"]
[Sun May 17 15:22:17.968222 2026] [:error] [pid 11079:tid 11113] [client 91.224.92.127:55942] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Sun May 17 15:22:20.193081 2026] [:error] [pid 11079:tid 11106] [client 91.224.92.127:57605] File does not exist: /usr/local/apache/htdocs/suspended-page/about.php
[Sun May 17 17:04:39.834181 2026] [:error] [pid 59060:tid 59074] [client 43.156.168.214:38074] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agmEp_vwvq3bndkPE4no0wAAAAU"]
[Sun May 17 19:09:58.255728 2026] [:error] [pid 10834:tid 10862] [client 49.51.253.83:54324] [client 49.51.253.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agmiBhISNQ_Nf83-Vpqk4AAAAdA"]
[Sun May 17 19:37:50.822322 2026] [:error] [pid 10835:tid 10875] [client 175.178.110.121:39346] [client 175.178.110.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agmojkk8lW0-dtknLl8fywAAAgI"]
[Sun May 17 20:39:49.918971 2026] [:error] [pid 10784:tid 10807] [client 43.134.224.16:46318] [client 43.134.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agm3FWBWRlKsFkSZGxBLnAAAAYg"]
[Sun May 17 22:05:13.689486 2026] [:error] [pid 10834:tid 10867] [client 209.112.91.75:57202] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/HEAD"] [unique_id "agnLGRISNQ_Nf83-Vpq3CwAAAdU"]
[Sun May 17 22:05:13.698818 2026] [:error] [pid 11079:tid 11103] [client 209.112.91.75:57196] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "agnLGWeR3-DrxhvUqxEGkgAAAkM"]
[Sun May 17 22:05:13.894935 2026] [:error] [pid 10834:tid 10851] [client 209.112.91.75:57204] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.development"] [unique_id "agnLGRISNQ_Nf83-Vpq3DAAAAcU"]
[Sun May 17 22:05:14.931605 2026] [:error] [pid 10835:tid 10882] [client 209.112.91.75:37222] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.bak"] [unique_id "agnLGkk8lW0-dtknLl8zuwAAAgk"]
[Sun May 17 22:05:14.932637 2026] [:error] [pid 59062:tid 59145] [client 209.112.91.75:37272] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.local"] [unique_id "agnLGj4V9GkVWmCFmGY2hwAAAJY"]
[Sun May 17 22:05:14.934418 2026] [:error] [pid 10835:tid 10881] [client 209.112.91.75:37242] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.backup"] [unique_id "agnLGkk8lW0-dtknLl8zvwAAAgg"]
[Sun May 17 22:05:14.940577 2026] [:error] [pid 59062:tid 59125] [client 209.112.91.75:37270] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "agnLGj4V9GkVWmCFmGY2iwAAAII"]
[Sun May 17 22:05:14.941880 2026] [:error] [pid 59062:tid 59144] [client 209.112.91.75:37246] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env.production"] [unique_id "agnLGj4V9GkVWmCFmGY2jAAAAJU"]
[Sun May 17 22:16:24.046405 2026] [:error] [pid 11079:tid 11120] [client 35.245.102.42:61655] [client 35.245.102.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.245.102.42, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "agnNuGeR3-DrxhvUqxEIDAAAAlA"]
[Sun May 17 22:16:24.050342 2026] [:error] [pid 11079:tid 11120] [client 35.245.102.42:61655] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Sun May 17 22:16:28.035338 2026] [:error] [pid 11079:tid 11109] [client 35.245.102.42:61655] [client 35.245.102.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "agnNvGeR3-DrxhvUqxEIHQAAAkg"]
[Sun May 17 22:16:28.496362 2026] [:error] [pid 10834:tid 10852] [client 35.245.102.42:53875] [client 35.245.102.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "agnNvBISNQ_Nf83-Vpq38gAAAcY"]
[Sun May 17 22:16:28.998356 2026] [:error] [pid 10835:tid 10876] [client 35.245.102.42:61437] [client 35.245.102.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "agnNvEk8lW0-dtknLl801AAAAgM"]
[Sun May 17 22:16:29.425831 2026] [:error] [pid 10835:tid 10874] [client 35.245.102.42:54942] [client 35.245.102.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "agnNvUk8lW0-dtknLl801QAAAgE"]
[Sun May 17 22:16:29.880856 2026] [:error] [pid 10835:tid 10887] [client 35.245.102.42:61560] [client 35.245.102.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "agnNvUk8lW0-dtknLl801gAAAg4"]
[Sun May 17 22:16:30.352824 2026] [:error] [pid 10784:tid 10824] [client 35.245.102.42:58526] [client 35.245.102.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "agnNvmBWRlKsFkSZGxBSVgAAAZc"]
[Sun May 17 22:16:30.818898 2026] [:error] [pid 10784:tid 10809] [client 35.245.102.42:61492] [client 35.245.102.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "agnNvmBWRlKsFkSZGxBSWAAAAYo"]
[Mon May 18 02:51:46.650601 2026] [:error] [pid 10784:tid 10821] [client 43.162.109.249:36880] [client 43.162.109.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agoOQmBWRlKsFkSZGxBjeAAAAZU"]
[Mon May 18 04:42:23.953084 2026] [:error] [pid 63115:tid 63119] [client 170.106.160.90:45138] [client 170.106.160.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agooL-z_ApFcYdejvGfbKgAAAQI"]
[Mon May 18 07:02:39.733512 2026] [:error] [pid 20884:tid 20890] [client 43.133.42.227:39332] [client 43.133.42.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agpJD3v9K_lRldrJG3PABgAAAMQ"]
[Mon May 18 07:38:32.515506 2026] [:error] [pid 20778:tid 20830] [client 139.155.126.16:36686] [client 139.155.126.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agpReGb9K2_TPGoCpAoC3AAAAEw"]
[Mon May 18 08:52:23.865641 2026] [:error] [pid 36493:tid 36550] [client 43.135.142.37:53762] [client 43.135.142.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agpixwynkzQB5nM668qAEwAAAQE"]
[Mon May 18 11:31:06.467647 2026] [:error] [pid 36491:tid 36506] [client 162.62.231.139:40810] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agqH-k555B9CZb6D60l59wAAAUs"]
[Mon May 18 11:49:24.452151 2026] [:error] [pid 44046:tid 44061] [client 194.62.107.32:43069] [client 194.62.107.32] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.env"] [unique_id "agqMRIYF4k2jfXJBXk3WuAAAAY0"]
[Mon May 18 15:40:18.641081 2026] [:error] [pid 36493:tid 36560] [client 43.135.144.81:51032] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agrCYgynkzQB5nM668qu9AAAAQs"]
[Mon May 18 17:24:28.283299 2026] [:error] [pid 44010:tid 44012] [client 43.128.104.75:53502] [client 43.128.104.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agrazDcFUuogD3-74-ZwGwAAAMA"]
[Mon May 18 19:34:09.807643 2026] [:error] [pid 43916:tid 43946] [client 43.165.198.144:36694] [client 43.165.198.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agr5MdQC236p33zJJvnKaQAAAJY"]
[Mon May 18 20:24:00.974194 2026] [:error] [pid 44087:tid 44098] [client 49.233.45.47:39536] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agsE4G5HPHbH9GK7l6z28AAAAck"]
[Mon May 18 20:31:13.482216 2026] [:error] [pid 36493:tid 36558] [client 35.185.10.43:64367] [client 35.185.10.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.185.10.43, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "agsGkQynkzQB5nM668rJfgAAAQk"]
[Mon May 18 20:31:13.487657 2026] [:error] [pid 36493:tid 36558] [client 35.185.10.43:64367] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Mon May 18 20:31:16.335363 2026] [:error] [pid 36493:tid 36553] [client 35.185.10.43:64367] [client 35.185.10.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "agsGlAynkzQB5nM668rJigAAAQQ"]
[Mon May 18 20:31:16.866205 2026] [:error] [pid 36492:tid 36522] [client 35.185.10.43:50103] [client 35.185.10.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "agsGlGCVlogrkn9m2w7rEAAAAAA"]
[Mon May 18 20:31:17.417564 2026] [:error] [pid 36492:tid 36526] [client 35.185.10.43:62598] [client 35.185.10.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/wp-includes/wlwmanifest.xml"] [unique_id "agsGlWCVlogrkn9m2w7rEgAAAAQ"]
[Mon May 18 20:31:17.846367 2026] [:error] [pid 36579:tid 36604] [client 35.185.10.43:56358] [client 35.185.10.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp2/wp-includes/wlwmanifest.xml"] [unique_id "agsGlV-aoZxBfgL5vDyTQgAAAFY"]
[Mon May 18 20:31:18.279368 2026] [:error] [pid 36579:tid 36605] [client 35.185.10.43:51720] [client 35.185.10.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/site/wp-includes/wlwmanifest.xml"] [unique_id "agsGll-aoZxBfgL5vDyTQwAAAFc"]
[Mon May 18 20:31:18.798038 2026] [:error] [pid 44010:tid 44028] [client 35.185.10.43:63986] [client 35.185.10.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/wp-includes/wlwmanifest.xml"] [unique_id "agsGljcFUuogD3-74-Z7mgAAANA"]
[Mon May 18 20:31:19.242711 2026] [:error] [pid 44010:tid 44017] [client 35.185.10.43:60214] [client 35.185.10.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sito/wp-includes/wlwmanifest.xml"] [unique_id "agsGlzcFUuogD3-74-Z7mwAAAMU"]
[Mon May 18 23:18:57.834341 2026] [:error] [pid 36491:tid 36519] [client 43.166.134.47:33704] [client 43.166.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agst4U555B9CZb6D60nkCgAAAVg"]
[Tue May 19 03:11:47.927998 2026] [:error] [pid 36492:tid 36529] [client 43.130.72.177:50688] [client 43.130.72.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agtkc2CVlogrkn9m2w42sgAAAAc"]
[Tue May 19 04:50:36.655576 2026] [:error] [pid 38814:tid 38840] [client 103.65.237.216:57334] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "agt7nAvkKuBwP0epzWdFKQAAANg"]
[Tue May 19 04:50:36.896565 2026] [:error] [pid 38705:tid 38776] [client 103.65.237.216:57368] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.vscode/sftp.json"] [unique_id "agt7nMg5dNOZ5umN9lsNbgAAAIc"]
[Tue May 19 04:58:16.168549 2026] [:error] [pid 38699:tid 38765] [client 43.131.45.213:36596] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agt9aL--Adsw_P-dthYiaAAAAFc"]
[Tue May 19 07:06:07.921990 2026] [:error] [pid 46815:tid 46819] [client 43.165.186.188:45246] [client 43.165.186.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agubXyPnRhJOmA06LgoC_QAAAUI"]
[Tue May 19 11:11:57.664393 2026] [:error] [pid 46896:tid 46900] [client 43.164.1.211:39198] [client 43.164.1.211] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agvU_aCHyzL3Ci9LGE0ftgAAAYI"]
[Tue May 19 12:48:58.592978 2026] [:error] [pid 41573:tid 41586] [client 43.163.85.226:35166] [client 43.163.85.226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agvrui1A2bd6JDSW9RZcGgAAAQs"]
[Tue May 19 17:05:38.680950 2026] [:error] [pid 38697:tid 38733] [client 101.32.128.28:50210] [client 101.32.128.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agwn4qXP9pP6Kgt-msQ4xgAAABI"]
[Tue May 19 20:50:07.505592 2026] [:error] [pid 38699:tid 38749] [client 43.166.246.180:46312] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agxcf7--Adsw_P-dthajswAAAEc"]
[Tue May 19 21:07:34.290636 2026] [:error] [pid 38699:tid 38759] [client 175.27.171.245:59928] [client 175.27.171.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agxglr--Adsw_P-dthalZwAAAFE"]
[Tue May 19 22:13:46.357939 2026] [:error] [pid 38699:tid 38745] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/r.php
[Tue May 19 22:13:46.683967 2026] [:error] [pid 38699:tid 38756] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/ight.php
[Tue May 19 22:13:47.026419 2026] [:error] [pid 38699:tid 38765] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/wpns.php
[Tue May 19 22:13:47.366678 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/er.php
[Tue May 19 22:13:47.681723 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/sql.php
[Tue May 19 22:13:48.324081 2026] [:error] [pid 38699:tid 38749] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/getir.php
[Tue May 19 22:13:48.947686 2026] [:error] [pid 38699:tid 38753] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue May 19 22:13:49.259999 2026] [:error] [pid 38699:tid 38764] [client 20.226.97.125:13297] File does not exist: /usr/local/apache/htdocs/suspended-page/xmrlpc.php
[Tue May 19 22:13:49.596805 2026] [:error] [pid 38699:tid 38748] [client 20.226.97.125:13297] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "agxwHb--Adsw_P-dthau8AAAAEY"]
[Tue May 19 22:13:50.225137 2026] [:error] [pid 41573:tid 41599] [client 20.226.97.125:13290] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "agxwHi1A2bd6JDSW9RaiBQAAARg"]
[Tue May 19 22:13:50.886535 2026] [:error] [pid 46815:tid 46835] [client 20.226.97.125:13255] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "agxwHiPnRhJOmA06Lgp84AAAAVI"]
[Tue May 19 22:13:51.622261 2026] [:error] [pid 55881:tid 55900] [client 20.226.97.125:13203] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class.php"] [unique_id "agxwH--UExma0LUC7WAMjgAAAlE"]
[Tue May 19 22:13:52.301468 2026] [:error] [pid 55881:tid 55885] [client 20.226.97.125:13204] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "agxwIO-UExma0LUC7WAMjwAAAkI"]
[Tue May 19 22:13:53.042130 2026] [:error] [pid 41573:tid 41594] [client 20.226.97.125:13192] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "agxwIS1A2bd6JDSW9RaiCAAAARM"]
[Tue May 19 22:13:53.814054 2026] [:error] [pid 29823:tid 29851] [client 20.226.97.125:13300] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "agxwIWO09C0nAz8vRk5Z8wAAAcw"]
[Tue May 19 22:13:54.650108 2026] [:error] [pid 46896:tid 46898] [client 20.226.97.125:13143] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/goods.php"] [unique_id "agxwIqCHyzL3Ci9LGE1nsgAAAYA"]
[Tue May 19 22:13:55.409961 2026] [:error] [pid 38814:tid 38818] [client 20.226.97.125:13130] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "agxwIwvkKuBwP0epzWekeQAAAMI"]
[Tue May 19 22:13:56.207836 2026] [:error] [pid 38699:tid 38756] [client 20.226.97.125:13268] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "agxwJL--Adsw_P-dthau8gAAAE4"]
[Tue May 19 22:13:56.992722 2026] [:error] [pid 38697:tid 38721] [client 20.226.97.125:13301] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "agxwJKXP9pP6Kgt-msRcnwAAAAY"]
[Tue May 19 22:13:57.648632 2026] [:error] [pid 55881:tid 55899] [client 20.226.97.125:13190] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/info.php"] [unique_id "agxwJe-UExma0LUC7WAMkAAAAlA"]
[Tue May 19 22:13:58.374014 2026] [:error] [pid 29622:tid 29635] [client 20.226.97.125:13288] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "agxwJjkOqPKWkPs_P15VggAAAgs"]
[Tue May 19 22:13:59.044266 2026] [:error] [pid 29622:tid 29627] [client 20.226.97.125:13248] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "agxwJzkOqPKWkPs_P15VgwAAAgM"]
[Tue May 19 22:13:59.917534 2026] [:error] [pid 38697:tid 38727] [client 20.226.97.125:13304] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "agxwJ6XP9pP6Kgt-msRcoAAAAAw"]
[Tue May 19 22:14:00.769929 2026] [:error] [pid 38814:tid 38839] [client 20.226.97.125:13269] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/as.php"] [unique_id "agxwKAvkKuBwP0epzWekgQAAANc"]
[Tue May 19 22:14:01.435833 2026] [:error] [pid 29622:tid 29625] [client 20.226.97.125:13291] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "agxwKTkOqPKWkPs_P15VhgAAAgE"]
[Tue May 19 22:14:02.160910 2026] [:error] [pid 38699:tid 38749] [client 20.226.97.125:13199] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "agxwKr--Adsw_P-dthau9AAAAEc"]
[Tue May 19 22:14:02.980812 2026] [:error] [pid 46815:tid 46825] [client 20.226.97.125:13262] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "agxwKiPnRhJOmA06Lgp85QAAAUg"]
[Tue May 19 22:14:03.824556 2026] [:error] [pid 38697:tid 38722] [client 20.226.97.125:13251] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aw.php"] [unique_id "agxwK6XP9pP6Kgt-msRcpAAAAAc"]
[Tue May 19 22:14:04.541710 2026] [:error] [pid 46815:tid 46826] [client 20.226.97.125:13253] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "agxwLCPnRhJOmA06Lgp85wAAAUk"]
[Tue May 19 22:14:05.311443 2026] [:error] [pid 41573:tid 41587] [client 20.226.97.125:13294] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "agxwLS1A2bd6JDSW9RaiDQAAAQw"]
[Tue May 19 22:14:06.109670 2026] [:error] [pid 41573:tid 41588] [client 20.226.97.125:13271] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "agxwLi1A2bd6JDSW9RaiDgAAAQ0"]
[Tue May 19 22:14:06.830053 2026] [:error] [pid 41573:tid 41594] [client 20.226.97.125:13310] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "agxwLi1A2bd6JDSW9RaiEQAAARM"]
[Tue May 19 22:14:07.501285 2026] [:error] [pid 29823:tid 29861] [client 20.226.97.125:13278] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "agxwL2O09C0nAz8vRk5Z9wAAAdY"]
[Tue May 19 22:14:08.436264 2026] [:error] [pid 41573:tid 41577] [client 20.226.97.125:13186] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "agxwMC1A2bd6JDSW9RaiEwAAAQI"]
[Tue May 19 22:14:09.124983 2026] [:error] [pid 46815:tid 46837] [client 20.226.97.125:13184] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "agxwMSPnRhJOmA06Lgp86AAAAVQ"]
[Tue May 19 22:14:09.860364 2026] [:error] [pid 41573:tid 41581] [client 20.226.97.125:13187] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "agxwMS1A2bd6JDSW9RaiFAAAAQY"]
[Tue May 19 22:14:10.495063 2026] [:error] [pid 41573:tid 41598] [client 20.226.97.125:13217] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "agxwMi1A2bd6JDSW9RaiFQAAARc"]
[Tue May 19 22:14:11.187592 2026] [:error] [pid 41573:tid 41589] [client 20.226.97.125:13216] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "agxwMy1A2bd6JDSW9RaiFwAAAQ4"]
[Tue May 19 22:14:11.905503 2026] [:error] [pid 55881:tid 55895] [client 20.226.97.125:13305] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "agxwM--UExma0LUC7WAMlwAAAkw"]
[Tue May 19 22:14:12.547869 2026] [:error] [pid 38699:tid 38764] [client 20.226.97.125:13205] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/222.php"] [unique_id "agxwNL--Adsw_P-dthau-AAAAFY"]
[Tue May 19 22:14:13.294056 2026] [:error] [pid 38699:tid 38756] [client 20.226.97.125:13191] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "agxwNb--Adsw_P-dthau_AAAAE4"]
[Tue May 19 22:14:14.014072 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:13296] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "agxwNr--Adsw_P-dthau_QAAAEQ"]
[Tue May 19 22:14:14.729658 2026] [:error] [pid 29823:tid 29858] [client 20.226.97.125:13284] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "agxwNmO09C0nAz8vRk5Z-gAAAdM"]
[Tue May 19 22:14:15.500058 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:13226] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test1.php"] [unique_id "agxwN7--Adsw_P-dthau_wAAAFI"]
[Tue May 19 22:14:16.167732 2026] [:error] [pid 38697:tid 38727] [client 20.226.97.125:13274] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "agxwOKXP9pP6Kgt-msRcqQAAAAw"]
[Tue May 19 22:14:16.976488 2026] [:error] [pid 46896:tid 46904] [client 20.226.97.125:13230] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "agxwOKCHyzL3Ci9LGE1ntAAAAYY"]
[Tue May 19 22:14:17.817908 2026] [:error] [pid 29823:tid 29842] [client 20.226.97.125:13267] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "agxwOWO09C0nAz8vRk5Z_AAAAcc"]
[Tue May 19 22:14:18.493623 2026] [:error] [pid 55881:tid 55896] [client 20.226.97.125:13263] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-mail.php"] [unique_id "agxwOu-UExma0LUC7WAMnAAAAk0"]
[Tue May 19 22:14:19.162722 2026] [:error] [pid 29823:tid 29855] [client 20.226.97.125:13239] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "agxwO2O09C0nAz8vRk5Z_QAAAdA"]
[Tue May 19 22:14:19.994010 2026] [:error] [pid 55881:tid 55888] [client 20.226.97.125:13287] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "agxwO--UExma0LUC7WAMngAAAkU"]
[Tue May 19 22:14:21.740881 2026] [:error] [pid 29823:tid 29859] [client 20.226.97.125:13298] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "agxwPWO09C0nAz8vRk5Z_wAAAdQ"]
[Tue May 19 22:14:22.694161 2026] [:error] [pid 46896:tid 46910] [client 20.226.97.125:13272] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "agxwPqCHyzL3Ci9LGE1nuQAAAYw"]
[Tue May 19 22:14:23.445845 2026] [:error] [pid 46896:tid 46906] [client 20.226.97.125:13200] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "agxwP6CHyzL3Ci9LGE1nvAAAAYg"]
[Tue May 19 22:14:24.190651 2026] [:error] [pid 46896:tid 46903] [client 20.226.97.125:13285] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "agxwQKCHyzL3Ci9LGE1nvgAAAYU"]
[Tue May 19 22:14:25.063573 2026] [:error] [pid 55881:tid 55885] [client 20.226.97.125:13309] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "agxwQe-UExma0LUC7WAMnwAAAkI"]
[Tue May 19 22:14:25.693577 2026] [:error] [pid 55881:tid 55889] [client 20.226.97.125:13307] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/adminfuns.php"] [unique_id "agxwQe-UExma0LUC7WAMowAAAkY"]
[Tue May 19 22:14:26.468021 2026] [:error] [pid 38699:tid 38751] [client 20.226.97.125:13282] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "agxwQr--Adsw_P-dthavAAAAAEk"]
[Tue May 19 22:14:27.225667 2026] [:error] [pid 29823:tid 29856] [client 20.226.97.125:13120] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "agxwQ2O09C0nAz8vRk5aAgAAAdE"]
[Tue May 19 22:14:27.852610 2026] [:error] [pid 41573:tid 41575] [client 20.226.97.125:13218] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "agxwQy1A2bd6JDSW9RaiHgAAAQA"]
[Tue May 19 22:14:28.585373 2026] [:error] [pid 46815:tid 46828] [client 20.226.97.125:13233] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/php8.php"] [unique_id "agxwRCPnRhJOmA06Lgp86QAAAUs"]
[Tue May 19 22:14:29.240619 2026] [:error] [pid 29622:tid 29641] [client 20.226.97.125:13202] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "agxwRTkOqPKWkPs_P15VigAAAhE"]
[Tue May 19 22:14:29.867425 2026] [:error] [pid 41573:tid 41589] [client 20.226.97.125:13128] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "agxwRS1A2bd6JDSW9RaiIgAAAQ4"]
[Tue May 19 22:14:30.551948 2026] [:error] [pid 38699:tid 38761] [client 20.226.97.125:13292] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "agxwRr--Adsw_P-dthavBQAAAFM"]
[Tue May 19 22:14:31.242854 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:13225] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ioxi-o.php"] [unique_id "agxwR7--Adsw_P-dthavBgAAAEI"]
[Tue May 19 22:14:32.129856 2026] [:error] [pid 41573:tid 41592] [client 20.226.97.125:13229] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "agxwSC1A2bd6JDSW9RaiJAAAARE"]
[Tue May 19 22:14:32.776102 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:13194] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "agxwSC1A2bd6JDSW9RaiJwAAAQU"]
[Tue May 19 22:14:33.413596 2026] [:error] [pid 41573:tid 41576] [client 20.226.97.125:13213] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "agxwSS1A2bd6JDSW9RaiKAAAAQE"]
[Tue May 19 22:14:34.043584 2026] [:error] [pid 41573:tid 41586] [client 20.226.97.125:13188] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "agxwSi1A2bd6JDSW9RaiKwAAAQs"]
[Tue May 19 22:14:34.673190 2026] [:error] [pid 41573:tid 41589] [client 20.226.97.125:13237] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "agxwSi1A2bd6JDSW9RaiMAAAAQ4"]
[Tue May 19 22:14:35.526103 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:13141] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "agxwSy1A2bd6JDSW9RaiMgAAARQ"]
[Tue May 19 22:14:36.183763 2026] [:error] [pid 29823:tid 29848] [client 20.226.97.125:13193] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "agxwTGO09C0nAz8vRk5aBAAAAck"]
[Tue May 19 22:14:36.925340 2026] [:error] [pid 55881:tid 55887] [client 20.226.97.125:13276] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sid3.php"] [unique_id "agxwTO-UExma0LUC7WAMpQAAAkQ"]
[Tue May 19 22:14:37.609731 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:13185] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/load.php"] [unique_id "agxwTS1A2bd6JDSW9RaiNQAAAQU"]
[Tue May 19 22:14:38.248542 2026] [:error] [pid 41573:tid 41587] [client 20.226.97.125:13137] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/load.php"] [unique_id "agxwTi1A2bd6JDSW9RaiNwAAAQw"]
[Tue May 19 22:14:38.913385 2026] [:error] [pid 46815:tid 46820] [client 20.226.97.125:13299] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/load.php"] [unique_id "agxwTiPnRhJOmA06Lgp86wAAAUM"]
[Tue May 19 22:14:39.724277 2026] [:error] [pid 55881:tid 55905] [client 20.226.97.125:13139] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/load.php"] [unique_id "agxwT--UExma0LUC7WAMpwAAAlY"]
[Tue May 19 22:14:40.469380 2026] [:error] [pid 29823:tid 29861] [client 20.226.97.125:13208] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "agxwUGO09C0nAz8vRk5aBgAAAdY"]
[Tue May 19 22:14:41.638888 2026] [:error] [pid 38705:tid 38774] [client 20.226.97.125:13247] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "agxwUcg5dNOZ5umN9ltl0AAAAIU"]
[Tue May 19 22:14:42.576986 2026] [:error] [pid 38814:tid 38830] [client 20.226.97.125:13306] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "agxwUgvkKuBwP0epzWekkAAAAM4"]
[Tue May 19 22:14:43.785389 2026] [:error] [pid 38699:tid 38745] [client 20.226.97.125:13196] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/166.php"] [unique_id "agxwU7--Adsw_P-dthavDgAAAEM"]
[Tue May 19 22:14:45.107075 2026] [:error] [pid 38699:tid 38756] [client 20.226.97.125:13154] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "agxwVb--Adsw_P-dthavDwAAAE4"]
[Tue May 19 22:14:46.105218 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:13240] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "agxwVr--Adsw_P-dthavEwAAAEI"]
[Tue May 19 22:14:46.937674 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:13063] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "agxwVr--Adsw_P-dthavFgAAAEQ"]
[Tue May 19 22:14:47.667009 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:13311] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "agxwV7--Adsw_P-dthavGAAAAFI"]
[Tue May 19 22:14:48.573328 2026] [:error] [pid 55881:tid 55893] [client 20.226.97.125:13142] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpinfo/info.php"] [unique_id "agxwWO-UExma0LUC7WAMqQAAAko"]
[Tue May 19 22:14:49.538889 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-the.php
[Tue May 19 22:14:49.856668 2026] [:error] [pid 41573:tid 41579] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/CDX2.php
[Tue May 19 22:14:50.282949 2026] [:error] [pid 41573:tid 41589] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/profile.php
[Tue May 19 22:14:50.752084 2026] [:error] [pid 41573:tid 41596] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/ws80.php
[Tue May 19 22:14:51.065759 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/a4.php
[Tue May 19 22:14:51.395529 2026] [:error] [pid 41573:tid 41582] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/app.php
[Tue May 19 22:14:51.715598 2026] [:error] [pid 41573:tid 41598] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue May 19 22:14:52.149705 2026] [:error] [pid 41573:tid 41583] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/core.php
[Tue May 19 22:14:52.477838 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue May 19 22:14:52.796958 2026] [:error] [pid 41573:tid 41592] [client 20.226.97.125:13258] File does not exist: /usr/local/apache/htdocs/suspended-page/bc.php
[Tue May 19 22:14:53.110117 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:13258] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "agxwXS1A2bd6JDSW9RaiRgAAAQU"]
[Tue May 19 22:14:53.990555 2026] [:error] [pid 29823:tid 29859] [client 20.226.97.125:13252] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "agxwXWO09C0nAz8vRk5aDAAAAdQ"]
[Tue May 19 22:14:55.117451 2026] [:error] [pid 38697:tid 38724] [client 20.226.97.125:13273] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "agxwX6XP9pP6Kgt-msRcrwAAAAk"]
[Tue May 19 22:14:55.850579 2026] [:error] [pid 38697:tid 38723] [client 20.226.97.125:13260] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "agxwX6XP9pP6Kgt-msRcsAAAAAg"]
[Tue May 19 22:14:56.523764 2026] [:error] [pid 29823:tid 29841] [client 20.226.97.125:13109] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "agxwYGO09C0nAz8vRk5aEAAAAcY"]
[Tue May 19 22:14:57.545374 2026] [:error] [pid 38705:tid 38782] [client 20.226.97.125:13277] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "agxwYcg5dNOZ5umN9ltl2AAAAI0"]
[Tue May 19 22:14:58.379040 2026] [:error] [pid 38699:tid 38758] [client 20.226.97.125:13289] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "agxwYr--Adsw_P-dthavIAAAAFA"]
[Tue May 19 22:14:59.143060 2026] [:error] [pid 29823:tid 29838] [client 20.226.97.125:13180] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp1.php"] [unique_id "agxwY2O09C0nAz8vRk5aEwAAAcM"]
[Tue May 19 22:14:59.993714 2026] [:error] [pid 41573:tid 41575] [client 20.226.97.125:13065] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "agxwYy1A2bd6JDSW9RaiSwAAAQA"]
[Tue May 19 22:15:00.906584 2026] [:error] [pid 41573:tid 41589] [client 20.226.97.125:13060] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "agxwZC1A2bd6JDSW9RaiTQAAAQ4"]
[Tue May 19 22:15:01.702642 2026] [:error] [pid 38814:tid 38827] [client 20.226.97.125:13125] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "agxwZQvkKuBwP0epzWeklgAAAMs"]
[Tue May 19 22:15:03.104802 2026] [:error] [pid 38705:tid 38769] [client 20.226.97.125:13275] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "agxwZ8g5dNOZ5umN9ltl2gAAAIA"]
[Tue May 19 22:15:04.104665 2026] [:error] [pid 46896:tid 46921] [client 20.226.97.125:13234] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "agxwaKCHyzL3Ci9LGE1nwgAAAZc"]
[Tue May 19 22:15:05.309437 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:13146] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "agxwaS1A2bd6JDSW9RaiUwAAAQo"]
[Tue May 19 22:15:06.700818 2026] [:error] [pid 38699:tid 38754] [client 20.226.97.125:13302] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "agxwar--Adsw_P-dthavJgAAAEw"]
[Tue May 19 22:15:08.851865 2026] [:error] [pid 41573:tid 41587] [client 20.226.97.125:13219] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "agxwbC1A2bd6JDSW9RaiVQAAAQw"]
[Tue May 19 22:15:12.367266 2026] [:error] [pid 41573:tid 41578] [client 20.226.97.125:13259] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "agxwcC1A2bd6JDSW9RaiWgAAAQM"]
[Tue May 19 22:15:14.820375 2026] [:error] [pid 46815:tid 46832] [client 20.226.97.125:13152] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "agxwciPnRhJOmA06Lgp88gAAAU8"]
[Tue May 19 22:15:16.276029 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:13221] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "agxwdL--Adsw_P-dthavJwAAAEg"]
[Tue May 19 22:15:17.966684 2026] [:error] [pid 41573:tid 41583] [client 20.226.97.125:13157] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxa.php"] [unique_id "agxwdS1A2bd6JDSW9RaiYQAAAQg"]
[Tue May 19 22:15:18.903634 2026] [:error] [pid 41573:tid 41592] [client 20.226.97.125:13136] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "agxwdi1A2bd6JDSW9RaiYgAAARE"]
[Tue May 19 22:15:19.677303 2026] [:error] [pid 46815:tid 46831] [client 20.226.97.125:13175] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "agxwdyPnRhJOmA06Lgp88wAAAU4"]
[Tue May 19 22:15:20.484091 2026] [:error] [pid 41573:tid 41577] [client 20.226.97.125:13189] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "agxweC1A2bd6JDSW9RaiagAAAQI"]
[Tue May 19 22:15:21.310190 2026] [:error] [pid 41573:tid 41594] [client 20.226.97.125:13207] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index0.php"] [unique_id "agxweS1A2bd6JDSW9RaibQAAARM"]
[Tue May 19 22:15:22.001337 2026] [:error] [pid 29622:tid 29641] [client 20.226.97.125:13158] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "agxwejkOqPKWkPs_P15VtQAAAhE"]
[Tue May 19 22:15:22.656204 2026] [:error] [pid 46896:tid 46922] [client 20.226.97.125:13215] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "agxweqCHyzL3Ci9LGE1nygAAAZg"]
[Tue May 19 22:15:23.322773 2026] [:error] [pid 38814:tid 38840] [client 20.226.97.125:13121] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "agxwewvkKuBwP0epzWekmwAAANg"]
[Tue May 19 22:15:24.102733 2026] [:error] [pid 46815:tid 46818] [client 20.226.97.125:13195] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "agxwfCPnRhJOmA06Lgp8-QAAAUE"]
[Tue May 19 22:15:24.791283 2026] [:error] [pid 41573:tid 41599] [client 20.226.97.125:13198] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/19.php"] [unique_id "agxwfC1A2bd6JDSW9RaidwAAARg"]
[Tue May 19 22:15:25.535169 2026] [:error] [pid 46815:tid 46820] [client 20.226.97.125:13222] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/19.php"] [unique_id "agxwfSPnRhJOmA06Lgp8-gAAAUM"]
[Tue May 19 22:15:26.201805 2026] [:error] [pid 46815:tid 46819] [client 20.226.97.125:13242] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/19.php"] [unique_id "agxwfiPnRhJOmA06Lgp8-wAAAUI"]
[Tue May 19 22:15:26.891822 2026] [:error] [pid 41573:tid 41577] [client 20.226.97.125:13241] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/19.php"] [unique_id "agxwfi1A2bd6JDSW9RaiegAAAQI"]
[Tue May 19 22:15:27.750086 2026] [:error] [pid 29823:tid 29835] [client 20.226.97.125:13286] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "agxwf2O09C0nAz8vRk5aIAAAAcA"]
[Tue May 19 22:15:28.422665 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:13236] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "agxwgL--Adsw_P-dthavNwAAAEg"]
[Tue May 19 22:15:29.134011 2026] [:error] [pid 29823:tid 29836] [client 20.226.97.125:13151] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "agxwgWO09C0nAz8vRk5aIQAAAcE"]
[Tue May 19 22:15:29.942344 2026] [:error] [pid 46815:tid 46824] [client 20.226.97.125:13134] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "agxwgSPnRhJOmA06Lgp8_QAAAUc"]
[Tue May 19 22:15:30.751293 2026] [:error] [pid 41573:tid 41576] [client 20.226.97.125:13261] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "agxwgi1A2bd6JDSW9RaigwAAAQE"]
[Tue May 19 22:15:31.623731 2026] [:error] [pid 46815:tid 46841] [client 20.226.97.125:13140] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "agxwgyPnRhJOmA06Lgp9AAAAAVg"]
[Tue May 19 22:15:32.370356 2026] [:error] [pid 46815:tid 46829] [client 20.226.97.125:13135] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "agxwhCPnRhJOmA06Lgp9AQAAAUw"]
[Tue May 19 22:15:33.205104 2026] [:error] [pid 46896:tid 46909] [client 20.226.97.125:13303] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/w.php"] [unique_id "agxwhaCHyzL3Ci9LGE1nzQAAAYs"]
[Tue May 19 22:15:33.921361 2026] [:error] [pid 38699:tid 38765] [client 20.226.97.125:13295] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "agxwhb--Adsw_P-dthavPgAAAFc"]
[Tue May 19 22:15:34.634109 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:13264] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "agxwhr--Adsw_P-dthavQAAAAEE"]
[Tue May 19 22:15:35.594391 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:13197] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "agxwh7--Adsw_P-dthavQwAAAEg"]
[Tue May 19 22:15:36.221081 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:13201] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ws78.php"] [unique_id "agxwiL--Adsw_P-dthavRgAAAEI"]
[Tue May 19 22:15:37.649065 2026] [:error] [pid 55881:tid 55895] [client 20.226.97.125:13097] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "agxwie-UExma0LUC7WAMyAAAAkw"]
[Tue May 19 22:15:38.526665 2026] [:error] [pid 46815:tid 46826] [client 20.226.97.125:13124] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "agxwiiPnRhJOmA06Lgp9BgAAAUk"]
[Tue May 19 22:15:39.176915 2026] [:error] [pid 29823:tid 29854] [client 20.226.97.125:13293] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "agxwi2O09C0nAz8vRk5aIgAAAc8"]
[Tue May 19 22:15:39.852193 2026] [:error] [pid 38814:tid 38826] [client 20.226.97.125:13281] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "agxwiwvkKuBwP0epzWeknwAAAMo"]
[Tue May 19 22:15:40.540614 2026] [:error] [pid 29622:tid 29640] [client 20.226.97.125:13069] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "agxwjDkOqPKWkPs_P15VvwAAAhA"]
[Tue May 19 22:15:41.231160 2026] [:error] [pid 38699:tid 38752] [client 20.226.97.125:13170] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "agxwjb--Adsw_P-dthavSgAAAEo"]
[Tue May 19 22:15:41.908651 2026] [:error] [pid 38699:tid 38757] [client 20.226.97.125:13148] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "agxwjb--Adsw_P-dthavSwAAAE8"]
[Tue May 19 22:15:42.648920 2026] [:error] [pid 41573:tid 41599] [client 20.226.97.125:13206] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a7.php"] [unique_id "agxwji1A2bd6JDSW9RailgAAARg"]
[Tue May 19 22:15:43.658363 2026] [:error] [pid 38697:tid 38729] [client 20.226.97.125:13156] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "agxwj6XP9pP6Kgt-msRctQAAAA4"]
[Tue May 19 22:15:44.788606 2026] [:error] [pid 29823:tid 29842] [client 20.226.97.125:13123] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "agxwkGO09C0nAz8vRk5aIwAAAcc"]
[Tue May 19 22:15:45.709755 2026] [:error] [pid 41573:tid 41590] [client 20.226.97.125:13144] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "agxwkS1A2bd6JDSW9RainQAAAQ8"]
[Tue May 19 22:15:46.427182 2026] [:error] [pid 46815:tid 46817] [client 20.226.97.125:13058] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "agxwkiPnRhJOmA06Lgp9FQAAAUA"]
[Tue May 19 22:15:47.156759 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:13179] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "agxwky1A2bd6JDSW9RaingAAARQ"]
[Tue May 19 22:15:48.238785 2026] [:error] [pid 38814:tid 38822] [client 20.226.97.125:13147] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "agxwlAvkKuBwP0epzWekpAAAAMY"]
[Tue May 19 22:15:48.943699 2026] [:error] [pid 29823:tid 29860] [client 20.226.97.125:13212] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "agxwlGO09C0nAz8vRk5aJQAAAdU"]
[Tue May 19 22:15:49.707819 2026] [:error] [pid 46815:tid 46831] [client 20.226.97.125:13210] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "agxwlSPnRhJOmA06Lgp9FwAAAU4"]
[Tue May 19 22:15:50.397279 2026] [:error] [pid 38699:tid 38758] [client 20.226.97.125:13061] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "agxwlr--Adsw_P-dthavVQAAAFA"]
[Tue May 19 22:15:51.322492 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:13127] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "agxwly1A2bd6JDSW9RairgAAARQ"]
[Tue May 19 22:15:51.983006 2026] [:error] [pid 46815:tid 46822] [client 20.226.97.125:13257] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/d.php"] [unique_id "agxwlyPnRhJOmA06Lgp9GAAAAUU"]
[Tue May 19 22:15:52.964639 2026] [:error] [pid 46815:tid 46838] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Tue May 19 22:15:53.280364 2026] [:error] [pid 46815:tid 46834] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/xff.php
[Tue May 19 22:15:53.652147 2026] [:error] [pid 46815:tid 46818] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/bal.php
[Tue May 19 22:15:54.018169 2026] [:error] [pid 46815:tid 46823] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Tue May 19 22:15:54.374783 2026] [:error] [pid 46815:tid 46821] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/son.php
[Tue May 19 22:15:54.690228 2026] [:error] [pid 46815:tid 46819] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue May 19 22:15:55.026002 2026] [:error] [pid 46815:tid 46828] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/zo.php
[Tue May 19 22:15:55.366274 2026] [:error] [pid 46815:tid 46836] [client 20.226.97.125:13228] File does not exist: /usr/local/apache/htdocs/suspended-page/xper1.php
[Tue May 19 22:15:55.684279 2026] [:error] [pid 46815:tid 46824] [client 20.226.97.125:13228] [client 20.226.97.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "agxwmyPnRhJOmA06Lgp9IwAAAUc"]
[Tue May 19 22:15:56.739629 2026] [:error] [pid 38699:tid 38757] [client 20.226.97.125:13266] File does not exist: /usr/local/apache/htdocs/suspended-page/s1.php
[Tue May 19 22:15:57.055684 2026] [:error] [pid 38699:tid 38748] [client 20.226.97.125:13266] File does not exist: /usr/local/apache/htdocs/suspended-page/de.php
[Tue May 19 22:15:57.392146 2026] [:error] [pid 38699:tid 38765] [client 20.226.97.125:13266] File does not exist: /usr/local/apache/htdocs/suspended-page/1a.php
[Tue May 19 22:15:57.704653 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:13266] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "agxwnb--Adsw_P-dthavXgAAAEE"]
[Tue May 19 22:15:58.498207 2026] [:error] [pid 38814:tid 38839] [client 20.226.97.125:13181] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "agxwngvkKuBwP0epzWekpwAAANc"]
[Tue May 19 22:15:59.480862 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:13227] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "agxwn7--Adsw_P-dthavYQAAAFI"]
[Tue May 19 22:16:00.309311 2026] [:error] [pid 29823:tid 29857] [client 20.226.97.125:13224] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2.php"] [unique_id "agxwoGO09C0nAz8vRk5aLwAAAdI"]
[Tue May 19 22:16:01.003973 2026] [:error] [pid 29823:tid 29835] [client 20.226.97.125:13246] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "agxwoWO09C0nAz8vRk5aMQAAAcA"]
[Tue May 19 22:16:01.863002 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:13080] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "agxwob--Adsw_P-dthavYwAAAEg"]
[Tue May 19 22:16:02.653387 2026] [:error] [pid 55881:tid 55905] [client 20.226.97.125:13155] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "agxwou-UExma0LUC7WAM1QAAAlY"]
[Tue May 19 22:16:03.357668 2026] [:error] [pid 38697:tid 38730] [client 20.226.97.125:13160] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "agxwo6XP9pP6Kgt-msRcvAAAAA8"]
[Tue May 19 22:16:04.072495 2026] [:error] [pid 29823:tid 29837] [client 20.226.97.125:13138] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "agxwpGO09C0nAz8vRk5aPAAAAcI"]
[Tue May 19 22:16:04.737737 2026] [:error] [pid 41573:tid 41588] [client 20.226.97.125:13176] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "agxwpC1A2bd6JDSW9RaitAAAAQ0"]
[Tue May 19 22:16:05.428071 2026] [:error] [pid 29622:tid 29630] [client 20.226.97.125:13095] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "agxwpTkOqPKWkPs_P15VwQAAAgY"]
[Tue May 19 22:16:06.174856 2026] [:error] [pid 38697:tid 38728] [client 20.226.97.125:13166] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sky.php"] [unique_id "agxwpqXP9pP6Kgt-msRcwQAAAA0"]
[Tue May 19 22:16:06.874615 2026] [:error] [pid 38697:tid 38736] [client 20.226.97.125:13270] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "agxwpqXP9pP6Kgt-msRcwgAAABU"]
[Tue May 19 22:16:07.580037 2026] [:error] [pid 38699:tid 38752] [client 20.226.97.125:13245] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "agxwp7--Adsw_P-dthavaAAAAEo"]
[Tue May 19 22:16:08.348306 2026] [:error] [pid 55881:tid 55896] [client 20.226.97.125:13182] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "agxwqO-UExma0LUC7WAM2QAAAk0"]
[Tue May 19 22:16:09.001511 2026] [:error] [pid 38699:tid 38765] [client 20.226.97.125:13085] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/man.php"] [unique_id "agxwqb--Adsw_P-dthavagAAAFc"]
[Tue May 19 22:16:09.822035 2026] [:error] [pid 38814:tid 38829] [client 20.226.97.125:13066] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "agxwqQvkKuBwP0epzWekqAAAAM0"]
[Tue May 19 22:16:10.549855 2026] [:error] [pid 38697:tid 38730] [client 20.226.97.125:13243] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "agxwqqXP9pP6Kgt-msRcxAAAAA8"]
[Tue May 19 22:16:11.299897 2026] [:error] [pid 55881:tid 55885] [client 20.226.97.125:13070] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "agxwq--UExma0LUC7WAM3QAAAkI"]
[Tue May 19 22:16:11.932042 2026] [:error] [pid 38699:tid 38747] [client 20.226.97.125:13083] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ms-edit.php"] [unique_id "agxwq7--Adsw_P-dthavbAAAAEU"]
[Tue May 19 22:16:12.630888 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:13232] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "agxwrL--Adsw_P-dthavbQAAAFI"]
[Tue May 19 22:16:13.483749 2026] [:error] [pid 55881:tid 55904] [client 20.226.97.125:13167] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "agxwre-UExma0LUC7WAM3wAAAlU"]
[Tue May 19 22:16:14.171368 2026] [:error] [pid 38699:tid 38751] [client 20.226.97.125:13283] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "agxwrr--Adsw_P-dthavcQAAAEk"]
[Tue May 19 22:16:15.013374 2026] [:error] [pid 29823:tid 29847] [client 20.226.97.125:13165] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "agxwr2O09C0nAz8vRk5aSgAAAcg"]
[Tue May 19 22:16:15.742343 2026] [:error] [pid 29823:tid 29849] [client 20.226.97.125:13082] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "agxwr2O09C0nAz8vRk5aTAAAAco"]
[Tue May 19 22:16:16.709689 2026] [:error] [pid 41573:tid 41587] [client 20.226.97.125:13163] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "agxwsC1A2bd6JDSW9RaiuQAAAQw"]
[Tue May 19 22:16:17.512577 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:13087] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "agxwsS1A2bd6JDSW9RaiugAAARA"]
[Tue May 19 22:16:18.252615 2026] [:error] [pid 46815:tid 46831] [client 20.226.97.125:13231] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pp.php"] [unique_id "agxwsiPnRhJOmA06Lgp9KQAAAU4"]
[Tue May 19 22:16:19.106118 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:13062] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "agxws7--Adsw_P-dthaveAAAAEE"]
[Tue May 19 22:16:19.910848 2026] [:error] [pid 46896:tid 46906] [client 20.226.97.125:13150] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "agxws6CHyzL3Ci9LGE1n2gAAAYg"]
[Tue May 19 22:16:20.630549 2026] [:error] [pid 46815:tid 46825] [client 20.226.97.125:13129] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "agxwtCPnRhJOmA06Lgp9KwAAAUg"]
[Tue May 19 22:16:21.318098 2026] [:error] [pid 46815:tid 46826] [client 20.226.97.125:13265] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mar.php"] [unique_id "agxwtSPnRhJOmA06Lgp9LAAAAUk"]
[Tue May 19 22:16:21.972786 2026] [:error] [pid 41573:tid 41576] [client 20.226.97.125:13074] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "agxwtS1A2bd6JDSW9RaivQAAAQE"]
[Tue May 19 22:16:22.716736 2026] [:error] [pid 46815:tid 46838] [client 20.226.97.125:13177] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "agxwtiPnRhJOmA06Lgp9LQAAAVU"]
[Tue May 19 22:16:23.401139 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:13131] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "agxwty1A2bd6JDSW9RaiwQAAAQo"]
[Tue May 19 22:16:24.140425 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:13178] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/themes.php"] [unique_id "agxwuL--Adsw_P-dthavgAAAAEI"]
[Tue May 19 22:16:24.785002 2026] [:error] [pid 46815:tid 46834] [client 20.226.97.125:13115] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "agxwuCPnRhJOmA06Lgp9LwAAAVE"]
[Tue May 19 22:16:25.527084 2026] [:error] [pid 38697:tid 38715] [client 20.226.97.125:13073] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "agxwuaXP9pP6Kgt-msRc0AAAAAA"]
[Tue May 19 22:16:26.165878 2026] [:error] [pid 46896:tid 46900] [client 20.226.97.125:13088] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "agxwuqCHyzL3Ci9LGE1n3AAAAYI"]
[Tue May 19 22:16:26.884101 2026] [:error] [pid 38697:tid 38722] [client 20.226.97.125:13254] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/acp.php"] [unique_id "agxwuqXP9pP6Kgt-msRc0QAAAAc"]
[Tue May 19 22:16:27.573373 2026] [:error] [pid 29622:tid 29638] [client 20.226.97.125:13003] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zdd.php"] [unique_id "agxwuzkOqPKWkPs_P15VxwAAAg4"]
[Tue May 19 22:16:28.261661 2026] [:error] [pid 46896:tid 46909] [client 20.226.97.125:13017] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zdd.php"] [unique_id "agxwvKCHyzL3Ci9LGE1n3gAAAYs"]
[Tue May 19 22:16:28.955364 2026] [:error] [pid 38705:tid 38788] [client 20.226.97.125:13162] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zdd.php"] [unique_id "agxwvMg5dNOZ5umN9ltl4wAAAJM"]
[Tue May 19 22:16:29.628196 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:13172] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zdd.php"] [unique_id "agxwvb--Adsw_P-dthavigAAAFI"]
[Tue May 19 22:16:30.287192 2026] [:error] [pid 46896:tid 46902] [client 20.226.97.125:13108] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "agxwvqCHyzL3Ci9LGE1n3wAAAYQ"]
[Tue May 19 22:16:30.929546 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:13100] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "agxwvi1A2bd6JDSW9RaixwAAARA"]
[Tue May 19 22:16:31.579720 2026] [:error] [pid 38697:tid 38728] [client 20.226.97.125:13308] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "agxwv6XP9pP6Kgt-msRc0wAAAA0"]
[Tue May 19 22:16:32.264292 2026] [:error] [pid 41573:tid 41584] [client 20.226.97.125:13149] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "agxwwC1A2bd6JDSW9RaiygAAAQk"]
[Tue May 19 22:16:32.987473 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:13059] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "agxwwC1A2bd6JDSW9RaizwAAAQo"]
[Tue May 19 22:16:33.650150 2026] [:error] [pid 41573:tid 41583] [client 20.226.97.125:13022] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "agxwwS1A2bd6JDSW9Rai1AAAAQg"]
[Tue May 19 22:16:34.285013 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:13016] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "agxwwr--Adsw_P-dthavjQAAAEg"]
[Tue May 19 22:16:35.046778 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:13256] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "agxwwy1A2bd6JDSW9Rai6QAAAQU"]
[Tue May 19 22:16:35.711024 2026] [:error] [pid 29823:tid 29854] [client 20.226.97.125:13042] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "agxww2O09C0nAz8vRk5aUQAAAc8"]
[Tue May 19 22:16:36.483791 2026] [:error] [pid 41573:tid 41597] [client 20.226.97.125:13220] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "agxwxC1A2bd6JDSW9Rai8AAAARY"]
[Tue May 19 22:16:37.259944 2026] [:error] [pid 41573:tid 41583] [client 20.226.97.125:13000] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "agxwxS1A2bd6JDSW9Rai8QAAAQg"]
[Tue May 19 22:16:37.903010 2026] [:error] [pid 46896:tid 46898] [client 20.226.97.125:13256] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aboute.php"] [unique_id "agxwxaCHyzL3Ci9LGE1n4AAAAYA"]
[Tue May 19 22:16:38.668460 2026] [:error] [pid 38697:tid 38736] [client 20.226.97.125:13223] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "agxwxqXP9pP6Kgt-msRc2AAAABU"]
[Tue May 19 22:16:39.376987 2026] [:error] [pid 41573:tid 41586] [client 20.226.97.125:13089] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "agxwxy1A2bd6JDSW9Rai9gAAAQs"]
[Tue May 19 22:16:40.255034 2026] [:error] [pid 41573:tid 41584] [client 20.226.97.125:13214] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "agxwyC1A2bd6JDSW9Rai-AAAAQk"]
[Tue May 19 22:16:41.106030 2026] [:error] [pid 46896:tid 46914] [client 20.226.97.125:13084] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ayk.php"] [unique_id "agxwyaCHyzL3Ci9LGE1n4QAAAZA"]
[Tue May 19 22:16:41.729472 2026] [:error] [pid 29823:tid 29858] [client 20.226.97.125:13178] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "agxwyWO09C0nAz8vRk5aVQAAAdM"]
[Tue May 19 22:16:42.476340 2026] [:error] [pid 41573:tid 41590] [client 20.226.97.125:13090] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "agxwyi1A2bd6JDSW9Rai_gAAAQ8"]
[Tue May 19 22:16:43.310956 2026] [:error] [pid 29823:tid 29849] [client 20.226.97.125:13209] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "agxwy2O09C0nAz8vRk5aWQAAAco"]
[Tue May 19 22:16:44.603032 2026] [:error] [pid 46896:tid 46918] [client 20.226.97.125:13099] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "agxwzKCHyzL3Ci9LGE1n5AAAAZQ"]
[Tue May 19 22:16:45.485568 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:13132] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "agxwzS1A2bd6JDSW9RajAgAAAQo"]
[Tue May 19 22:16:46.283708 2026] [:error] [pid 38814:tid 38840] [client 20.226.97.125:13187] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "agxwzgvkKuBwP0epzWekqwAAANg"]
[Tue May 19 22:16:46.978240 2026] [:error] [pid 29823:tid 29835] [client 20.226.97.125:13036] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "agxwzmO09C0nAz8vRk5aXAAAAcA"]
[Tue May 19 22:16:48.088187 2026] [:error] [pid 38814:tid 38834] [client 20.226.97.125:13102] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "agxw0AvkKuBwP0epzWekrAAAANI"]
[Tue May 19 22:16:48.902621 2026] [:error] [pid 38699:tid 38761] [client 20.226.97.125:13103] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "agxw0L--Adsw_P-dthavpgAAAFM"]
[Tue May 19 22:16:49.786772 2026] [:error] [pid 38699:tid 38757] [client 20.226.97.125:13094] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "agxw0b--Adsw_P-dthavqQAAAE8"]
[Tue May 19 22:16:50.602511 2026] [:error] [pid 29823:tid 29842] [client 20.226.97.125:12944] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "agxw0mO09C0nAz8vRk5aXwAAAcc"]
[Tue May 19 22:16:51.280568 2026] [:error] [pid 38697:tid 38732] [client 20.226.97.125:12997] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-class.php"] [unique_id "agxw06XP9pP6Kgt-msRc3wAAABE"]
[Tue May 19 22:16:52.044431 2026] [:error] [pid 38814:tid 38820] [client 20.226.97.125:13056] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "agxw1AvkKuBwP0epzWeksAAAAMQ"]
[Tue May 19 22:16:52.716927 2026] [:error] [pid 55881:tid 55885] [client 20.226.97.125:13122] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "agxw1O-UExma0LUC7WAM6wAAAkI"]
[Tue May 19 22:16:53.448932 2026] [:error] [pid 46815:tid 46829] [client 20.226.97.125:13238] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "agxw1SPnRhJOmA06Lgp9NwAAAUw"]
[Tue May 19 22:16:54.328123 2026] [:error] [pid 38705:tid 38769] [client 20.226.97.125:13104] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "agxw1sg5dNOZ5umN9ltl6QAAAIA"]
[Tue May 19 22:16:55.161328 2026] [:error] [pid 29622:tid 29648] [client 20.226.97.125:13145] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "agxw1zkOqPKWkPs_P15VzwAAAhg"]
[Tue May 19 22:16:55.921449 2026] [:error] [pid 38697:tid 38718] [client 20.226.97.125:13279] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "agxw16XP9pP6Kgt-msRc4QAAAAM"]
[Tue May 19 22:16:56.653593 2026] [:error] [pid 38697:tid 38716] [client 20.226.97.125:12938] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "agxw2KXP9pP6Kgt-msRc5AAAAAE"]
[Tue May 19 22:16:57.431556 2026] [:error] [pid 38814:tid 38823] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/options.php
[Tue May 19 22:16:57.753539 2026] [:error] [pid 38814:tid 38822] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php
[Tue May 19 22:16:58.067965 2026] [:error] [pid 38814:tid 38827] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Tue May 19 22:16:58.383601 2026] [:error] [pid 38814:tid 38839] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/son1.php
[Tue May 19 22:16:58.698141 2026] [:error] [pid 38814:tid 38819] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/ggb.php
[Tue May 19 22:16:59.012925 2026] [:error] [pid 38814:tid 38833] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/amxloxxr.php
[Tue May 19 22:16:59.350997 2026] [:error] [pid 38814:tid 38829] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/ss.php
[Tue May 19 22:16:59.665748 2026] [:error] [pid 38814:tid 38825] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/sadcut1.php
[Tue May 19 22:16:59.981251 2026] [:error] [pid 38814:tid 38837] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Tue May 19 22:17:00.296539 2026] [:error] [pid 38814:tid 38821] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/99.php
[Tue May 19 22:17:00.611979 2026] [:error] [pid 38814:tid 38817] [client 20.226.97.125:13118] File does not exist: /usr/local/apache/htdocs/suspended-page/layout.php
[Tue May 19 22:17:00.924009 2026] [:error] [pid 38814:tid 38840] [client 20.226.97.125:13118] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "agxw3AvkKuBwP0epzWekvwAAANg"]
[Tue May 19 22:17:01.742471 2026] [:error] [pid 38814:tid 38834] [client 20.226.97.125:13018] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "agxw3QvkKuBwP0epzWekwAAAANI"]
[Tue May 19 22:17:02.423901 2026] [:error] [pid 38814:tid 38828] [client 20.226.97.125:13105] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "agxw3gvkKuBwP0epzWekwQAAAMw"]
[Tue May 19 22:17:03.085415 2026] [:error] [pid 38814:tid 38826] [client 20.226.97.125:13161] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/12.php"] [unique_id "agxw3wvkKuBwP0epzWekwwAAAMo"]
[Tue May 19 22:17:03.723208 2026] [:error] [pid 55881:tid 55900] [client 20.226.97.125:13244] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "agxw3--UExma0LUC7WAM8wAAAlE"]
[Tue May 19 22:17:04.386985 2026] [:error] [pid 46815:tid 46819] [client 20.226.97.125:13004] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "agxw4CPnRhJOmA06Lgp9PwAAAUI"]
[Tue May 19 22:17:05.076447 2026] [:error] [pid 29823:tid 29837] [client 20.226.97.125:13106] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "agxw4WO09C0nAz8vRk5abgAAAcI"]
[Tue May 19 22:17:05.756485 2026] [:error] [pid 29823:tid 29847] [client 20.226.97.125:12936] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "agxw4WO09C0nAz8vRk5adAAAAcg"]
[Tue May 19 22:17:06.489561 2026] [:error] [pid 29823:tid 29836] [client 20.226.97.125:13067] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agxw4mO09C0nAz8vRk5aegAAAcE"]
[Tue May 19 22:17:07.247648 2026] [:error] [pid 46896:tid 46900] [client 20.226.97.125:13235] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agxw46CHyzL3Ci9LGE1n6wAAAYI"]
[Tue May 19 22:17:07.947182 2026] [:error] [pid 38814:tid 38838] [client 20.226.97.125:13098] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agxw4wvkKuBwP0epzWekxgAAANY"]
[Tue May 19 22:17:08.611006 2026] [:error] [pid 29823:tid 29837] [client 20.226.97.125:13116] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "agxw5GO09C0nAz8vRk5agQAAAcI"]
[Tue May 19 22:17:09.282031 2026] [:error] [pid 38705:tid 38781] [client 20.226.97.125:13057] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "agxw5cg5dNOZ5umN9ltl8QAAAIw"]
[Tue May 19 22:17:10.070506 2026] [:error] [pid 38699:tid 38763] [client 20.226.97.125:13169] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "agxw5r--Adsw_P-dthavtAAAAFU"]
[Tue May 19 22:17:10.743561 2026] [:error] [pid 38699:tid 38757] [client 20.226.97.125:12992] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "agxw5r--Adsw_P-dthavtgAAAE8"]
[Tue May 19 22:17:11.394541 2026] [:error] [pid 38814:tid 38818] [client 20.226.97.125:12949] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Ov-Simple1.php"] [unique_id "agxw5wvkKuBwP0epzWekyAAAAMI"]
[Tue May 19 22:17:12.113211 2026] [:error] [pid 29622:tid 29646] [client 20.226.97.125:12943] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "agxw6DkOqPKWkPs_P15V1AAAAhY"]
[Tue May 19 22:17:12.996861 2026] [:error] [pid 38699:tid 38751] [client 20.226.97.125:13029] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "agxw6L--Adsw_P-dthavugAAAEk"]
[Tue May 19 22:17:13.692355 2026] [:error] [pid 38814:tid 38839] [client 20.226.97.125:12993] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "agxw6QvkKuBwP0epzWekywAAANc"]
[Tue May 19 22:17:14.441799 2026] [:error] [pid 46815:tid 46839] [client 20.226.97.125:13072] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "agxw6iPnRhJOmA06Lgp9TwAAAVY"]
[Tue May 19 22:17:15.452978 2026] [:error] [pid 38699:tid 38762] [client 20.226.97.125:13117] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "agxw67--Adsw_P-dthavvQAAAFQ"]
[Tue May 19 22:17:16.585875 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:12935] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "agxw7L--Adsw_P-dthavvgAAAEI"]
[Tue May 19 22:17:17.310159 2026] [:error] [pid 38699:tid 38749] [client 20.226.97.125:13068] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "agxw7b--Adsw_P-dthavwgAAAEc"]
[Tue May 19 22:17:18.047288 2026] [:error] [pid 38697:tid 38730] [client 20.226.97.125:13211] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hplfuns.php"] [unique_id "agxw7qXP9pP6Kgt-msRc7AAAAA8"]
[Tue May 19 22:17:19.040548 2026] [:error] [pid 29823:tid 29847] [client 20.226.97.125:13126] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "agxw72O09C0nAz8vRk5ahQAAAcg"]
[Tue May 19 22:17:19.842756 2026] [:error] [pid 38814:tid 38833] [client 20.226.97.125:13039] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "agxw7wvkKuBwP0epzWekzgAAANE"]
[Tue May 19 22:17:20.532758 2026] [:error] [pid 41573:tid 41593] [client 20.226.97.125:13091] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "agxw8C1A2bd6JDSW9RajBAAAARI"]
[Tue May 19 22:17:21.642438 2026] [:error] [pid 41573:tid 41592] [client 20.226.97.125:13064] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bolt.php"] [unique_id "agxw8S1A2bd6JDSW9RajCAAAARE"]
[Tue May 19 22:17:22.401658 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:13035] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "agxw8i1A2bd6JDSW9RajCQAAAQU"]
[Tue May 19 22:17:23.052118 2026] [:error] [pid 38697:tid 38720] [client 20.226.97.125:12947] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "agxw86XP9pP6Kgt-msRc7wAAAAU"]
[Tue May 19 22:17:23.722413 2026] [:error] [pid 41573:tid 41596] [client 20.226.97.125:13020] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "agxw8y1A2bd6JDSW9RajDgAAARU"]
[Tue May 19 22:17:24.390873 2026] [:error] [pid 41573:tid 41592] [client 20.226.97.125:13125] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "agxw9C1A2bd6JDSW9RajGAAAARE"]
[Tue May 19 22:17:25.071166 2026] [:error] [pid 41573:tid 41588] [client 20.226.97.125:13101] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "agxw9S1A2bd6JDSW9RajHAAAAQ0"]
[Tue May 19 22:17:25.827594 2026] [:error] [pid 29823:tid 29840] [client 20.226.97.125:12929] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "agxw9WO09C0nAz8vRk5alAAAAcU"]
[Tue May 19 22:17:26.468104 2026] [:error] [pid 29823:tid 29853] [client 20.226.97.125:13002] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "agxw9mO09C0nAz8vRk5alwAAAc4"]
[Tue May 19 22:17:27.099592 2026] [:error] [pid 29823:tid 29851] [client 20.226.97.125:13048] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file2.php"] [unique_id "agxw92O09C0nAz8vRk5amwAAAcw"]
[Tue May 19 22:17:27.749953 2026] [:error] [pid 38705:tid 38775] [client 20.226.97.125:13183] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "agxw98g5dNOZ5umN9ltl9AAAAIY"]
[Tue May 19 22:17:28.502267 2026] [:error] [pid 38705:tid 38792] [client 20.226.97.125:13171] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "agxw-Mg5dNOZ5umN9ltl9gAAAJc"]
[Tue May 19 22:17:29.184520 2026] [:error] [pid 38705:tid 38784] [client 20.226.97.125:13168] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "agxw-cg5dNOZ5umN9ltl-AAAAI8"]
[Tue May 19 22:17:29.846618 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:13076] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/index/function.php"] [unique_id "agxw-b--Adsw_P-dthavygAAAEQ"]
[Tue May 19 22:17:30.485658 2026] [:error] [pid 46896:tid 46905] [client 20.226.97.125:13093] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "agxw-qCHyzL3Ci9LGE1n7QAAAYc"]
[Tue May 19 22:17:31.195086 2026] [:error] [pid 41573:tid 41579] [client 20.226.97.125:12999] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "agxw-y1A2bd6JDSW9RajIAAAAQQ"]
[Tue May 19 22:17:31.895028 2026] [:error] [pid 41573:tid 41599] [client 20.226.97.125:12996] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "agxw-y1A2bd6JDSW9RajKwAAARg"]
[Tue May 19 22:17:32.675896 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:13041] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wk/index.php"] [unique_id "agxw_C1A2bd6JDSW9RajMQAAAQo"]
[Tue May 19 22:17:33.522517 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:13034] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "agxw_S1A2bd6JDSW9RajNQAAAQU"]
[Tue May 19 22:17:34.287869 2026] [:error] [pid 38814:tid 38819] [client 20.226.97.125:13159] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "agxw_gvkKuBwP0epzWek2QAAAMM"]
[Tue May 19 22:17:35.007306 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:13032] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "agxw_y1A2bd6JDSW9RajNwAAARA"]
[Tue May 19 22:17:35.727586 2026] [:error] [pid 38697:tid 38722] [client 20.226.97.125:12933] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/alfa.php"] [unique_id "agxw_6XP9pP6Kgt-msRc-QAAAAc"]
[Tue May 19 22:17:36.427381 2026] [:error] [pid 38705:tid 38789] [client 20.226.97.125:13040] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-theme.php"] [unique_id "agxxAMg5dNOZ5umN9ltl_AAAAJQ"]
[Tue May 19 22:17:37.097017 2026] [:error] [pid 29823:tid 29857] [client 20.226.97.125:12963] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-theme.php"] [unique_id "agxxAWO09C0nAz8vRk5anwAAAdI"]
[Tue May 19 22:17:37.974602 2026] [:error] [pid 41573:tid 41583] [client 20.226.97.125:13023] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-theme.php"] [unique_id "agxxAS1A2bd6JDSW9RajPQAAAQg"]
[Tue May 19 22:17:39.009015 2026] [:error] [pid 41573:tid 41598] [client 20.226.97.125:12963] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-theme.php"] [unique_id "agxxAy1A2bd6JDSW9RajQQAAARc"]
[Tue May 19 22:17:40.356772 2026] [:error] [pid 41573:tid 41587] [client 20.226.97.125:13164] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-file.php"] [unique_id "agxxBC1A2bd6JDSW9RajRAAAAQw"]
[Tue May 19 22:17:41.028899 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:13024] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-file.php"] [unique_id "agxxBS1A2bd6JDSW9RajRwAAARQ"]
[Tue May 19 22:17:41.729682 2026] [:error] [pid 38697:tid 38721] [client 20.226.97.125:13096] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-file.php"] [unique_id "agxxBaXP9pP6Kgt-msRdAgAAAAY"]
[Tue May 19 22:17:42.484351 2026] [:error] [pid 38814:tid 38837] [client 20.226.97.125:13026] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-file.php"] [unique_id "agxxBgvkKuBwP0epzWek3QAAANU"]
[Tue May 19 22:17:43.343809 2026] [:error] [pid 38697:tid 38727] [client 20.226.97.125:12961] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "agxxB6XP9pP6Kgt-msRdBAAAAAw"]
[Tue May 19 22:17:44.257268 2026] [:error] [pid 41573:tid 41598] [client 20.226.97.125:13153] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "agxxCC1A2bd6JDSW9RajSgAAARc"]
[Tue May 19 22:17:44.988034 2026] [:error] [pid 38699:tid 38749] [client 20.226.97.125:13005] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "agxxCL--Adsw_P-dthavzwAAAEc"]
[Tue May 19 22:17:45.772552 2026] [:error] [pid 41573:tid 41584] [client 20.226.97.125:12891] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/default.php"] [unique_id "agxxCS1A2bd6JDSW9RajTAAAAQk"]
[Tue May 19 22:17:46.680535 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:12998] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "agxxCi1A2bd6JDSW9RajTwAAARA"]
[Tue May 19 22:17:47.348108 2026] [:error] [pid 41573:tid 41587] [client 20.226.97.125:12966] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "agxxCy1A2bd6JDSW9RajUQAAAQw"]
[Tue May 19 22:17:48.044315 2026] [:error] [pid 41573:tid 41592] [client 20.226.97.125:13133] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "agxxDC1A2bd6JDSW9RajUgAAARE"]
[Tue May 19 22:17:48.746192 2026] [:error] [pid 41573:tid 41596] [client 20.226.97.125:13280] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mah.php"] [unique_id "agxxDC1A2bd6JDSW9RajUwAAARU"]
[Tue May 19 22:17:49.733528 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:13107] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "agxxDS1A2bd6JDSW9RajVgAAARQ"]
[Tue May 19 22:17:50.615207 2026] [:error] [pid 38697:tid 38732] [client 20.226.97.125:13015] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "agxxDqXP9pP6Kgt-msRdBgAAABE"]
[Tue May 19 22:17:51.453422 2026] [:error] [pid 38697:tid 38718] [client 20.226.97.125:12934] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "agxxD6XP9pP6Kgt-msRdBwAAAAM"]
[Tue May 19 22:17:52.189949 2026] [:error] [pid 46896:tid 46904] [client 20.226.97.125:13006] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins.php"] [unique_id "agxxEKCHyzL3Ci9LGE1n9QAAAYY"]
[Tue May 19 22:17:52.966589 2026] [:error] [pid 41573:tid 41592] [client 20.226.97.125:12952] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "agxxEC1A2bd6JDSW9RajXAAAARE"]
[Tue May 19 22:17:53.721570 2026] [:error] [pid 46896:tid 46916] [client 20.226.97.125:13001] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "agxxEaCHyzL3Ci9LGE1n9gAAAZI"]
[Tue May 19 22:17:54.390914 2026] [:error] [pid 29823:tid 29852] [client 20.226.97.125:13071] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "agxxEmO09C0nAz8vRk5aoQAAAc0"]
[Tue May 19 22:17:55.162631 2026] [:error] [pid 41573:tid 41577] [client 20.226.97.125:13208] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "agxxEy1A2bd6JDSW9RajXQAAAQI"]
[Tue May 19 22:17:55.927534 2026] [:error] [pid 29823:tid 29855] [client 20.226.97.125:13043] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "agxxE2O09C0nAz8vRk5aowAAAdA"]
[Tue May 19 22:17:56.676439 2026] [:error] [pid 41573:tid 41593] [client 20.226.97.125:13055] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "agxxFC1A2bd6JDSW9RajYAAAARI"]
[Tue May 19 22:17:57.517600 2026] [:error] [pid 38699:tid 38763] [client 20.226.97.125:13290] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "agxxFb--Adsw_P-dthav0QAAAFU"]
[Tue May 19 22:17:58.555337 2026] [:error] [pid 46815:tid 46824] [client 20.226.97.125:12994] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a.php"] [unique_id "agxxFiPnRhJOmA06Lgp9WAAAAUc"]
[Tue May 19 22:17:59.263656 2026] [:error] [pid 46815:tid 46828] [client 20.226.97.125:12939] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/k.php"] [unique_id "agxxFyPnRhJOmA06Lgp9WwAAAUs"]
[Tue May 19 22:18:00.123133 2026] [:error] [pid 29823:tid 29851] [client 20.226.97.125:13044] File does not exist: /usr/local/apache/htdocs/suspended-page/k.php
[Tue May 19 22:18:00.792975 2026] [:error] [pid 29823:tid 29839] [client 20.226.97.125:13044] File does not exist: /usr/local/apache/htdocs/suspended-page/ini.php
[Tue May 19 22:18:01.116075 2026] [:error] [pid 29823:tid 29837] [client 20.226.97.125:13044] File does not exist: /usr/local/apache/htdocs/suspended-page/ca4.php
[Tue May 19 22:18:01.757883 2026] [:error] [pid 29823:tid 29854] [client 20.226.97.125:13044] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue May 19 22:18:02.071679 2026] [:error] [pid 29823:tid 29856] [client 20.226.97.125:13044] File does not exist: /usr/local/apache/htdocs/suspended-page/init.php
[Tue May 19 22:18:02.447385 2026] [:error] [pid 29823:tid 29850] [client 20.226.97.125:13044] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Tue May 19 22:18:02.757323 2026] [:error] [pid 29823:tid 29842] [client 20.226.97.125:13044] [client 20.226.97.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/fm.php"] [unique_id "agxxGmO09C0nAz8vRk5arwAAAcc"]
[Tue May 19 22:55:03.499038 2026] [:error] [pid 29823:tid 29858] [client 43.162.95.192:51606] [client 43.162.95.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agx5x2O09C0nAz8vRk5eygAAAdM"]
[Wed May 20 00:24:43.023119 2026] [:error] [pid 46815:tid 46831] [client 43.164.190.124:34394] [client 43.164.190.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agyOyyPnRhJOmA06LgqG8gAAAU4"]
[Wed May 20 02:34:53.066508 2026] [:error] [pid 38697:tid 38722] [client 146.19.215.249:63288] [client 146.19.215.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/core.php"] [unique_id "agytTaXP9pP6Kgt-msR1dgAAAAc"]
[Wed May 20 02:56:25.010688 2026] [:error] [pid 29622:tid 29645] [client 43.130.53.252:55270] [client 43.130.53.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "agyyWTkOqPKWkPs_P15hQQAAAhU"]
[Wed May 20 04:55:23.740385 2026] [:error] [pid 36145:tid 36153] [client 43.155.195.141:35888] [client 43.155.195.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "agzOO6tS18KtvF2VagsynwAAAQU"]
[Wed May 20 09:02:06.441197 2026] [:error] [pid 44059:tid 44076] [client 43.153.208.32:44498] [client 43.153.208.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag0IDhfFs-oSOOcyjyxa8gAAAQ8"]
[Wed May 20 10:00:07.830642 2026] [:error] [pid 41278:tid 41328] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Wed May 20 10:00:08.044158 2026] [:error] [pid 41278:tid 41315] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Wed May 20 10:00:08.280008 2026] [:error] [pid 41278:tid 41322] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/file.php
[Wed May 20 10:00:08.492729 2026] [:error] [pid 41278:tid 41319] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Wed May 20 10:00:08.749486 2026] [:error] [pid 41278:tid 41318] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Wed May 20 10:00:08.975587 2026] [:error] [pid 41278:tid 41323] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Wed May 20 10:00:09.188381 2026] [:error] [pid 41278:tid 41320] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/bgymj.php
[Wed May 20 10:00:09.682603 2026] [:error] [pid 41278:tid 41321] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/404.php
[Wed May 20 10:00:09.895360 2026] [:error] [pid 41278:tid 41325] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/file3.php
[Wed May 20 10:00:10.109067 2026] [:error] [pid 41278:tid 41316] [client 20.220.236.34:49138] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-mail.php
[Wed May 20 10:00:10.323673 2026] [:error] [pid 41278:tid 41324] [client 20.220.236.34:49138] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ag0VqvWiNKASEfiGdwZ1iQAAAE8"]
[Wed May 20 10:00:11.504926 2026] [:error] [pid 41277:tid 41302] [client 20.220.236.34:52004] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ag0Vq7TTCltJmboB5ufJ7AAAABQ"]
[Wed May 20 10:00:12.494048 2026] [:error] [pid 41277:tid 41282] [client 20.220.236.34:17523] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ag0VrLTTCltJmboB5ufJ7QAAAAA"]
[Wed May 20 10:00:13.741560 2026] [:error] [pid 41279:tid 41349] [client 20.220.236.34:51492] [client 20.220.236.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ag0VrbEFyfaehGZbt4xKLQAAAM0"]
[Wed May 20 13:07:53.748097 2026] [:error] [pid 44059:tid 44081] [client 43.153.48.240:45144] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag1BqRfFs-oSOOcyjyy1jAAAARQ"]
[Wed May 20 14:33:59.403098 2026] [:error] [pid 7731:tid 7737] [client 34.46.57.55:53816] [client 34.46.57.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.46.57.55, incrementing ddos counter"] [hostname "rejuva.au"] [uri "/xmlrpc.php"] [unique_id "ag1V139qQlHXbkl2nEueVwAAAYQ"]
[Wed May 20 14:33:59.407397 2026] [:error] [pid 7731:tid 7737] [client 34.46.57.55:53816] File does not exist: /usr/local/apache/htdocs/suspended-page/xmlrpc.php
[Wed May 20 14:33:59.601541 2026] [:error] [pid 7731:tid 7745] [client 34.46.57.55:53816] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag1V139qQlHXbkl2nEueWgAAAYw"]
[Wed May 20 14:33:59.988318 2026] [:error] [pid 44059:tid 44074] [client 34.46.57.55:60316] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blog/wp-includes/wlwmanifest.xml"] [unique_id "ag1V1xfFs-oSOOcyjyzQSgAAAQ0"]
[Wed May 20 14:34:00.376011 2026] [:error] [pid 7731:tid 7751] [client 34.46.57.55:62945] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/web/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2H9qQlHXbkl2nEuebgAAAZI"]
[Wed May 20 14:34:00.763231 2026] [:error] [pid 7664:tid 7672] [client 34.46.57.55:56664] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wordpress/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2HZ8s7o3eiqT2kvOugAAAUU"]
[Wed May 20 14:34:01.155465 2026] [:error] [pid 41277:tid 41282] [client 34.46.57.55:51299] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/website/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2bTTCltJmboB5ufm0gAAAAA"]
[Wed May 20 14:34:01.545798 2026] [:error] [pid 44059:tid 44081] [client 34.46.57.55:65397] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2RfFs-oSOOcyjyzQjAAAARQ"]
[Wed May 20 14:34:01.932291 2026] [:error] [pid 7664:tid 7675] [client 34.46.57.55:50430] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/news/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2XZ8s7o3eiqT2kvO0wAAAUg"]
[Wed May 20 14:34:02.327283 2026] [:error] [pid 41364:tid 41390] [client 34.46.57.55:62783] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2018/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2hKTmyvxtNXrN-iU2QAAAJg"]
[Wed May 20 14:34:02.729713 2026] [:error] [pid 41277:tid 41299] [client 34.46.57.55:53422] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2019/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2rTTCltJmboB5ufm4AAAABE"]
[Wed May 20 14:34:03.125660 2026] [:error] [pid 41364:tid 41375] [client 34.46.57.55:50120] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/shop/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2xKTmyvxtNXrN-iU4wAAAIk"]
[Wed May 20 14:34:03.518448 2026] [:error] [pid 41279:tid 41354] [client 34.46.57.55:55365] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp1/wp-includes/wlwmanifest.xml"] [unique_id "ag1V27EFyfaehGZbt4xzUwAAANI"]
[Wed May 20 14:34:03.916116 2026] [:error] [pid 41364:tid 41386] [client 34.46.57.55:56170] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2xKTmyvxtNXrN-iU6QAAAJQ"]
[Wed May 20 15:21:10.210450 2026] [:error] [pid 41364:tid 41376] [client 101.32.128.113:60018] [client 101.32.128.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag1g5hKTmyvxtNXrN-ic5QAAAIo"]
[Wed May 20 17:07:27.212100 2026] [:error] [pid 41278:tid 41309] [client 43.153.87.54:46104] [client 43.153.87.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag15z_WiNKASEfiGdwaiYgAAAEA"]
[Wed May 20 19:15:48.236931 2026] [:error] [pid 41277:tid 41284] [client 43.157.46.118:52194] [client 43.157.46.118] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag2X5LTTCltJmboB5uf6LAAAAAI"]
[Wed May 20 22:01:35.503477 2026] [:error] [pid 41364:tid 41377] [client 146.56.197.150:33818] [client 146.56.197.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag2-vxKTmyvxtNXrN-joiAAAAIs"]
[Wed May 20 22:56:07.977319 2026] [:error] [pid 44059:tid 44083] [client 43.166.224.244:51128] [client 43.166.224.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag3LhxfFs-oSOOcyjyxAfgAAARY"]
[Thu May 21 00:27:51.628537 2026] [:error] [pid 44059:tid 44078] [client 43.133.187.11:39706] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag3hBxfFs-oSOOcyjyxP6AAAARE"]
[Thu May 21 07:25:52.099157 2026] [:error] [pid 49884:tid 49971] [client 43.156.34.42:52352] [client 43.156.34.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag5DAK5MPpsTNNHWS6jTzwAAAJg"]
[Thu May 21 09:22:56.586290 2026] [:error] [pid 51613:tid 51621] [client 129.226.146.134:52768] [client 129.226.146.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag5ecGbP0MDvqrVnweqoDwAAAQY"]
[Thu May 21 09:28:33.306411 2026] [:error] [pid 49982:tid 49993] [client 101.42.46.71:43852] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag5fwWFwIDa5Tf8O4bZUAQAAAMk"]
[Thu May 21 17:31:37.422578 2026] [:error] [pid 9189:tid 9223] [client 170.106.181.163:45294] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag7Q-ZvTDh1NbYizKVyYtwAAAgQ"]
[Thu May 21 19:46:32.189253 2026] [:error] [pid 49879:tid 49925] [client 43.164.190.124:51592] [client 43.164.190.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag7wmIVqYDjFSyG2gFpgZgAAAEU"]
[Thu May 21 21:19:51.680087 2026] [:error] [pid 49884:tid 49954] [client 49.51.38.193:53090] [client 49.51.38.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag8Gd65MPpsTNNHWS6j2UgAAAIc"]
[Thu May 21 21:42:11.658430 2026] [:error] [pid 9188:tid 9206] [client 49.233.45.47:39768] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag8Ls7GYm6q5dNSUvA_xhQAAAc4"]
[Thu May 21 22:55:42.460748 2026] [:error] [pid 9157:tid 9175] [client 45.131.195.200:60097] [client 45.131.195.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ag8c7sGfHcLNqE8m88KhNQAAAZA"]
[Thu May 21 23:24:09.503011 2026] [:error] [pid 9188:tid 9207] [client 34.150.255.112:63215] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag8jmbGYm6q5dNSUvA_-5wAAAc8"]
[Thu May 21 23:24:09.928362 2026] [:error] [pid 51613:tid 51625] [client 34.150.255.112:59834] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag8jmWbP0MDvqrVnweoTvgAAAQo"]
[Thu May 21 23:24:10.356278 2026] [:error] [pid 49884:tid 49967] [client 34.150.255.112:52712] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag8jmq5MPpsTNNHWS6gXnQAAAJQ"]
[Thu May 21 23:34:07.212185 2026] [:error] [pid 51613:tid 51617] [client 43.135.138.128:59630] [client 43.135.138.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag8l72bP0MDvqrVnweoUmgAAAQI"]
[Fri May 22 01:19:11.797658 2026] [:error] [pid 9188:tid 9197] [client 43.153.205.132:42812] [client 43.153.205.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag8-j7GYm6q5dNSUvA8NDgAAAcU"]
[Fri May 22 04:16:10.159101 2026] [:error] [pid 15585:tid 15655] [client 43.159.128.155:43950] [client 43.159.128.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag9oCiKb-vB41AF-LC0iLgAAAIg"]
[Fri May 22 06:27:09.976937 2026] [:error] [pid 58813:tid 58826] [client 38.154.97.38:36225] [client 38.154.97.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/robots.txt"] [unique_id "ag-GvZ6yyKWDKULhxJ3-JgAAAUo"]
[Fri May 22 06:27:09.980504 2026] [:error] [pid 15584:tid 15633] [client 38.154.97.38:33959] [client 38.154.97.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/sitemap.xml"] [unique_id "ag-Gvd9Z_TVLbNEx52h9eQAAAE0"]
[Fri May 22 06:27:09.987306 2026] [:error] [pid 58813:tid 58816] [client 38.154.97.38:38965] [client 38.154.97.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag-GvZ6yyKWDKULhxJ3-JwAAAUA"]
[Fri May 22 06:27:11.340478 2026] [:error] [pid 15584:tid 15623] [client 38.154.97.38:54428] [client 38.154.97.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/sitemap.xml"] [unique_id "ag-Gv99Z_TVLbNEx52h9ewAAAEM"]
[Fri May 22 06:27:11.355638 2026] [:error] [pid 15584:tid 15628] [client 38.154.97.38:55389] [client 38.154.97.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/robots.txt"] [unique_id "ag-Gv99Z_TVLbNEx52h9fAAAAEg"]
[Fri May 22 08:40:44.398424 2026] [:error] [pid 58782:tid 58794] [client 43.164.0.21:45692] [client 43.164.0.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag-mDIxsdTFafgO8vhTBfwAAAQo"]
[Fri May 22 08:46:20.727940 2026] [:error] [pid 15583:tid 15607] [client 49.234.192.248:54182] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag-nXHnaOncRcIm17YWU_QAAABM"]
[Fri May 22 09:11:47.103097 2026] [:error] [pid 15585:tid 15648] [client 45.55.78.121:50533] [client 45.55.78.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.78.121, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "ag-tUyKb-vB41AF-LC2WOAAAAIE"]
[Fri May 22 09:11:47.106722 2026] [:error] [pid 15585:tid 15648] [client 45.55.78.121:50533] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri May 22 10:24:32.361504 2026] [:error] [pid 15585:tid 15671] [client 165.22.206.23:64625] [client 165.22.206.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.206.23, incrementing brute counter"] [hostname "rejuva.au"] [uri "/wp-login.php"] [unique_id "ag--YCKb-vB41AF-LC2v1QAAAJg"]
[Fri May 22 10:24:32.365085 2026] [:error] [pid 15585:tid 15671] [client 165.22.206.23:64625] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-login.php
[Fri May 22 10:43:58.590917 2026] [:error] [pid 58782:tid 58790] [client 162.62.213.187:57874] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ag_C7oxsdTFafgO8vhTVrQAAAQY"]
[Fri May 22 13:19:00.897138 2026] [:error] [pid 15583:tid 15589] [client 43.165.67.31:39600] [client 43.165.67.31] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ag_nRHnaOncRcIm17YXL-wAAAAE"]
[Fri May 22 15:10:21.451026 2026] [:error] [pid 15679:tid 15687] [client 43.134.178.104:44942] [client 43.134.178.104] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahABXSh8tgGc38WJ-GwPnQAAAMY"]
[Fri May 22 17:11:07.651877 2026] [:error] [pid 15679:tid 15690] [client 34.93.63.75:58109] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feed/"] [unique_id "ahAdqyh8tgGc38WJ-GwwZQAAAMk"]
[Fri May 22 17:56:44.160304 2026] [:error] [pid 15679:tid 15701] [client 170.106.65.93:58360] [client 170.106.65.93] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahAoXCh8tgGc38WJ-Gw6hgAAANQ"]
[Fri May 22 18:20:43.535009 2026] [:error] [pid 15585:tid 15668] [client 177.7.56.92:41346] [client 177.7.56.92] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/HEAD"] [unique_id "ahAt-yKb-vB41AF-LC1eJAAAAJU"]
[Fri May 22 18:20:44.385712 2026] [:error] [pid 15679:tid 15684] [client 177.7.56.92:43850] [client 177.7.56.92] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ahAt_Ch8tgGc38WJ-Gw_9AAAAMM"]
[Fri May 22 18:44:50.709455 2026] [:error] [pid 15584:tid 15639] [client 194.163.157.206:56931] [client 194.163.157.206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/sftp-config.json"] [unique_id "ahAzot9Z_TVLbNEx52gdWwAAAFM"]
[Fri May 22 19:41:58.232770 2026] [:error] [pid 15679:tid 15688] [client 150.109.12.46:37802] [client 150.109.12.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahBBBih8tgGc38WJ-GxR8QAAAMc"]
[Fri May 22 20:39:37.574699 2026] [:error] [pid 15679:tid 15682] [client 162.14.81.106:36948] [client 162.14.81.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahBOiSh8tgGc38WJ-Gxe8wAAAME"]
[Fri May 22 22:12:41.952662 2026] [:error] [pid 15679:tid 15698] [client 43.156.204.134:59172] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahBkWSh8tgGc38WJ-Gx3kgAAANE"]
[Sat May 23 00:21:27.285185 2026] [:error] [pid 15583:tid 15589] [client 49.51.33.159:40158] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahCCh3naOncRcIm17YVWhgAAAAE"]
[Sat May 23 05:32:52.873464 2026] [:error] [pid 31039:tid 31043] [client 43.159.143.187:36380] [client 43.159.143.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahDLhKIYDYo8WvA5zLJU1QAAAMI"]
[Sat May 23 09:00:22.026502 2026] [:error] [pid 31039:tid 31050] [client 43.135.182.43:43438] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahD8JqIYDYo8WvA5zLKPRAAAAMk"]
[Sat May 23 10:29:19.565107 2026] [:error] [pid 30942:tid 31023] [client 138.249.138.2:44640] [client 138.249.138.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.rejuva.au"] [uri "/.git/config"] [unique_id "ahEQ_9Uosz64YFiBlG3zMQAAAJQ"]
[Sat May 23 12:51:04.627086 2026] [:error] [pid 31039:tid 31043] [client 43.153.26.165:56464] [client 43.153.26.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahEyOKIYDYo8WvA5zLLSEgAAAMI"]
[Sat May 23 15:21:04.303659 2026] [:error] [pid 30940:tid 30965] [client 43.160.225.169:32876] [client 43.160.225.169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahFVYJqUP2XZmzp7RDre0AAAABA"]
[Sat May 23 18:25:18.352946 2026] [:error] [pid 31039:tid 31065] [client 43.165.167.69:49804] [client 43.165.167.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahGAjqIYDYo8WvA5zLI2EwAAANg"]
[Sat May 23 20:30:57.457088 2026] [:error] [pid 30941:tid 30977] [client 49.235.136.28:40930] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahGeAXTIgjSDhiZmvlXmwAAAAEE"]
[Sat May 23 20:45:46.344822 2026] [:error] [pid 25876:tid 25896] [client 43.156.117.41:38784] [client 43.156.117.41] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahGhegSpWUCKPezIBJCtCQAAARI"]
[Sat May 23 23:20:16.045532 2026] [:error] [pid 30941:tid 30994] [client 43.130.139.177:45864] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahHFsHTIgjSDhiZmvlUmwAAAAFI"]
[Sun May 24 01:47:10.289392 2026] [:error] [pid 44326:tid 44367] [client 170.106.165.186:60012] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahHoHsyrPrcAqE-FOKLxzwAAAcw"]
[Sun May 24 05:44:06.853714 2026] [:error] [pid 58521:tid 58543] [client 43.134.98.88:54668] [client 43.134.98.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahIfpmu03QVCX-cF2G_QGQAAARQ"]
[Sun May 24 07:47:37.800585 2026] [:error] [pid 58797:tid 58823] [client 111.230.233.46:37412] [client 111.230.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahI8mfzoIKLVypLB5Ng7rwAAAVc"]
[Sun May 24 08:17:25.102298 2026] [:error] [pid 50978:tid 50991] [client 170.106.35.187:38604] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahJDlSu0qFnUKJJuyO6VKAAAAMY"]
[Sun May 24 11:34:51.849660 2026] [:error] [pid 49775:tid 49779] [client 43.163.104.54:53842] [client 43.163.104.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahJx24vZb8G6T8WpI1hHfgAAAAI"]
[Sun May 24 13:46:00.488089 2026] [:error] [pid 49744:tid 49757] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/revealability.php
[Sun May 24 13:46:00.700683 2026] [:error] [pid 49744:tid 49754] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/ok.php
[Sun May 24 13:46:00.922014 2026] [:error] [pid 49744:tid 49749] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/tires.php
[Sun May 24 13:46:01.133050 2026] [:error] [pid 49744:tid 49751] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/amxloxxr.php
[Sun May 24 13:46:01.345628 2026] [:error] [pid 49744:tid 49766] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-block.php
[Sun May 24 13:46:01.558616 2026] [:error] [pid 49744:tid 49755] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/wehrman.php
[Sun May 24 13:46:01.770904 2026] [:error] [pid 49744:tid 49764] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-thi.php
[Sun May 24 13:46:01.982418 2026] [:error] [pid 49744:tid 49756] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/z.php
[Sun May 24 13:46:02.195202 2026] [:error] [pid 49744:tid 49746] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-trackback.php
[Sun May 24 13:46:02.407872 2026] [:error] [pid 49744:tid 49767] [client 20.63.33.98:33618] File does not exist: /usr/local/apache/htdocs/suspended-page/333.php
[Sun May 24 13:46:02.617182 2026] [:error] [pid 49744:tid 49750] [client 20.63.33.98:33618] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahKQmjsE5kPdFpUbbHGkOwAAAMQ"]
[Sun May 24 13:46:03.043499 2026] [:error] [pid 23497:tid 23517] [client 20.63.33.98:25352] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahKQmyPlV47QcYwd2v-VNwAAAVE"]
[Sun May 24 13:46:03.474826 2026] [:error] [pid 49744:tid 49766] [client 20.63.33.98:33647] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahKQmzsE5kPdFpUbbHGkPgAAANQ"]
[Sun May 24 13:46:03.896567 2026] [:error] [pid 49688:tid 49698] [client 20.63.33.98:33626] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahKQm2YoQ9V6a_4pBsiOXQAAAEc"]
[Sun May 24 13:46:04.330062 2026] [:error] [pid 23497:tid 23521] [client 20.63.33.98:33610] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahKQnCPlV47QcYwd2v-VPAAAAVU"]
[Sun May 24 13:46:04.756928 2026] [:error] [pid 23497:tid 23500] [client 20.63.33.98:25378] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahKQnCPlV47QcYwd2v-VPQAAAUA"]
[Sun May 24 13:46:05.184993 2026] [:error] [pid 23497:tid 23520] [client 20.63.33.98:33660] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahKQnSPlV47QcYwd2v-VPwAAAVQ"]
[Sun May 24 13:46:05.611285 2026] [:error] [pid 49744:tid 49755] [client 20.63.33.98:33657] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahKQnTsE5kPdFpUbbHGkQQAAAMk"]
[Sun May 24 13:46:06.037298 2026] [:error] [pid 23497:tid 23508] [client 20.63.33.98:33642] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "ahKQniPlV47QcYwd2v-VRAAAAUg"]
[Sun May 24 13:46:06.464517 2026] [:error] [pid 23497:tid 23517] [client 20.63.33.98:33614] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "ahKQniPlV47QcYwd2v-VRQAAAVE"]
[Sun May 24 13:46:06.883447 2026] [:error] [pid 49688:tid 49710] [client 20.63.33.98:25375] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "ahKQnmYoQ9V6a_4pBsiOYgAAAFM"]
[Sun May 24 13:46:07.332662 2026] [:error] [pid 23497:tid 23501] [client 20.63.33.98:33662] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/atomlib.php"] [unique_id "ahKQnyPlV47QcYwd2v-VSAAAAUE"]
[Sun May 24 13:46:07.790632 2026] [:error] [pid 49688:tid 49715] [client 20.63.33.98:33611] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-der.php"] [unique_id "ahKQn2YoQ9V6a_4pBsiOZAAAAFg"]
[Sun May 24 13:46:08.208847 2026] [:error] [pid 49689:tid 49718] [client 20.63.33.98:25381] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-der.php"] [unique_id "ahKQoAaxiY3NxLUD97VP3AAAAIA"]
[Sun May 24 13:46:08.639728 2026] [:error] [pid 23497:tid 23507] [client 20.63.33.98:25358] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-der.php"] [unique_id "ahKQoCPlV47QcYwd2v-VTAAAAUc"]
[Sun May 24 13:46:09.097950 2026] [:error] [pid 49744:tid 49754] [client 20.63.33.98:25372] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-der.php"] [unique_id "ahKQoTsE5kPdFpUbbHGkRAAAAMg"]
[Sun May 24 13:46:09.546781 2026] [:error] [pid 49688:tid 49702] [client 20.63.33.98:25389] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "ahKQoWYoQ9V6a_4pBsiOZQAAAEs"]
[Sun May 24 13:46:09.973442 2026] [:error] [pid 49775:tid 49785] [client 20.63.33.98:33650] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "ahKQoYvZb8G6T8WpI1hoGQAAAAg"]
[Sun May 24 13:46:10.400818 2026] [:error] [pid 2639:tid 2646] [client 20.63.33.98:25385] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "ahKQokzQncQTd0Z0Oe8uxgAAAQU"]
[Sun May 24 13:46:10.821669 2026] [:error] [pid 49744:tid 49753] [client 20.63.33.98:21319] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ftde.php"] [unique_id "ahKQojsE5kPdFpUbbHGkSQAAAMc"]
[Sun May 24 13:46:11.250541 2026] [:error] [pid 49688:tid 49694] [client 20.63.33.98:33613] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "ahKQo2YoQ9V6a_4pBsiOZgAAAEM"]
[Sun May 24 13:46:11.707704 2026] [:error] [pid 49688:tid 49707] [client 20.63.33.98:21313] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "ahKQo2YoQ9V6a_4pBsiOZwAAAFA"]
[Sun May 24 13:46:12.186758 2026] [:error] [pid 2639:tid 2655] [client 20.63.33.98:33663] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "ahKQpEzQncQTd0Z0Oe8uygAAAQ4"]
[Sun May 24 13:46:12.645959 2026] [:error] [pid 23497:tid 23502] [client 20.63.33.98:25355] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asasx.php"] [unique_id "ahKQpCPlV47QcYwd2v-VUAAAAUI"]
[Sun May 24 13:46:13.107261 2026] [:error] [pid 23497:tid 23507] [client 20.63.33.98:25382] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "ahKQpSPlV47QcYwd2v-VUwAAAUc"]
[Sun May 24 13:46:13.608072 2026] [:error] [pid 23497:tid 23519] [client 20.63.33.98:33628] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "ahKQpSPlV47QcYwd2v-VVAAAAVM"]
[Sun May 24 13:46:14.066680 2026] [:error] [pid 2639:tid 2651] [client 20.63.33.98:25354] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "ahKQpkzQncQTd0Z0Oe8uzQAAAQo"]
[Sun May 24 13:46:14.494655 2026] [:error] [pid 2639:tid 2652] [client 20.63.33.98:33606] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-good.php"] [unique_id "ahKQpkzQncQTd0Z0Oe8uzwAAAQs"]
[Sun May 24 13:46:14.923702 2026] [:error] [pid 2639:tid 2646] [client 20.63.33.98:33625] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "ahKQpkzQncQTd0Z0Oe8u0AAAAQU"]
[Sun May 24 13:46:15.362359 2026] [:error] [pid 23497:tid 23516] [client 20.63.33.98:33633] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "ahKQpyPlV47QcYwd2v-VVQAAAVA"]
[Sun May 24 13:46:15.792990 2026] [:error] [pid 23497:tid 23512] [client 20.63.33.98:33603] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "ahKQpyPlV47QcYwd2v-VWAAAAUw"]
[Sun May 24 13:46:16.240022 2026] [:error] [pid 49775:tid 49789] [client 20.63.33.98:33609] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app.php"] [unique_id "ahKQqIvZb8G6T8WpI1hoVwAAAAw"]
[Sun May 24 13:46:16.689483 2026] [:error] [pid 23497:tid 23504] [client 20.63.33.98:21329] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahKQqCPlV47QcYwd2v-VWgAAAUQ"]
[Sun May 24 13:46:17.171429 2026] [:error] [pid 2639:tid 2661] [client 20.63.33.98:25365] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahKQqUzQncQTd0Z0Oe8u1AAAARQ"]
[Sun May 24 13:46:17.622272 2026] [:error] [pid 23497:tid 23524] [client 20.63.33.98:25366] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahKQqSPlV47QcYwd2v-VXgAAAVg"]
[Sun May 24 13:46:18.041347 2026] [:error] [pid 2639:tid 2643] [client 20.63.33.98:25353] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahKQqkzQncQTd0Z0Oe8u1wAAAQI"]
[Sun May 24 13:46:18.469529 2026] [:error] [pid 49688:tid 49713] [client 20.63.33.98:33620] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "ahKQqmYoQ9V6a_4pBsiOawAAAFY"]
[Sun May 24 13:46:18.886881 2026] [:error] [pid 49689:tid 49721] [client 20.63.33.98:33601] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "ahKQqgaxiY3NxLUD97VP3gAAAIM"]
[Sun May 24 13:46:19.314339 2026] [:error] [pid 23497:tid 23507] [client 20.63.33.98:33611] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "ahKQqyPlV47QcYwd2v-VYQAAAUc"]
[Sun May 24 13:46:19.773846 2026] [:error] [pid 23497:tid 23516] [client 20.63.33.98:21333] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wuasr.php"] [unique_id "ahKQqyPlV47QcYwd2v-VYwAAAVA"]
[Sun May 24 13:46:20.232597 2026] [:error] [pid 49689:tid 49727] [client 20.63.33.98:33624] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "ahKQrAaxiY3NxLUD97VP3wAAAIk"]
[Sun May 24 13:46:20.660224 2026] [:error] [pid 49775:tid 49783] [client 20.63.33.98:33644] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "ahKQrIvZb8G6T8WpI1hoYQAAAAY"]
[Sun May 24 13:46:21.118779 2026] [:error] [pid 23497:tid 23522] [client 20.63.33.98:33655] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "ahKQrSPlV47QcYwd2v-VaQAAAVY"]
[Sun May 24 13:46:21.576646 2026] [:error] [pid 23497:tid 23504] [client 20.63.33.98:33603] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bthil.php"] [unique_id "ahKQrSPlV47QcYwd2v-VawAAAUQ"]
[Sun May 24 13:46:22.004186 2026] [:error] [pid 23497:tid 23506] [client 20.63.33.98:33631] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ahKQriPlV47QcYwd2v-VbQAAAUY"]
[Sun May 24 13:46:22.463059 2026] [:error] [pid 49689:tid 49720] [client 20.63.33.98:25351] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ahKQrgaxiY3NxLUD97VP4QAAAII"]
[Sun May 24 13:46:22.952117 2026] [:error] [pid 49689:tid 49734] [client 20.63.33.98:25357] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ahKQrgaxiY3NxLUD97VP4gAAAJA"]
[Sun May 24 13:46:23.413526 2026] [:error] [pid 49775:tid 49789] [client 20.63.33.98:21330] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/albin.php"] [unique_id "ahKQr4vZb8G6T8WpI1hoZAAAAAw"]
[Sun May 24 13:46:23.832967 2026] [:error] [pid 49775:tid 49781] [client 20.63.33.98:33649] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahKQr4vZb8G6T8WpI1hoZQAAAAQ"]
[Sun May 24 13:46:24.263556 2026] [:error] [pid 49689:tid 49738] [client 20.63.33.98:33653] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahKQsAaxiY3NxLUD97VP5QAAAJQ"]
[Sun May 24 13:46:24.717287 2026] [:error] [pid 49688:tid 49704] [client 20.63.33.98:33600] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahKQsGYoQ9V6a_4pBsiObQAAAE0"]
[Sun May 24 13:46:25.175791 2026] [:error] [pid 49689:tid 49724] [client 20.63.33.98:25376] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahKQsQaxiY3NxLUD97VP6QAAAIY"]
[Sun May 24 13:46:25.605857 2026] [:error] [pid 49688:tid 49698] [client 20.63.33.98:33632] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "ahKQsWYoQ9V6a_4pBsiObgAAAEc"]
[Sun May 24 13:46:26.063866 2026] [:error] [pid 49775:tid 49798] [client 20.63.33.98:33646] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "ahKQsovZb8G6T8WpI1hoaQAAABU"]
[Sun May 24 13:46:26.550801 2026] [:error] [pid 49744:tid 49756] [client 20.63.33.98:33651] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "ahKQsjsE5kPdFpUbbHGkYQAAAMo"]
[Sun May 24 13:46:27.007551 2026] [:error] [pid 23497:tid 23511] [client 20.63.33.98:25350] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file30.php"] [unique_id "ahKQsyPlV47QcYwd2v-VcgAAAUs"]
[Sun May 24 13:46:27.470441 2026] [:error] [pid 23497:tid 23507] [client 20.63.33.98:25345] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "ahKQsyPlV47QcYwd2v-VdAAAAUc"]
[Sun May 24 13:46:27.939409 2026] [:error] [pid 49689:tid 49736] [client 20.63.33.98:25374] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "ahKQswaxiY3NxLUD97VP6wAAAJI"]
[Sun May 24 13:46:28.369379 2026] [:error] [pid 49689:tid 49733] [client 20.63.33.98:25370] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "ahKQtAaxiY3NxLUD97VP7QAAAI8"]
[Sun May 24 13:46:28.828707 2026] [:error] [pid 49689:tid 49732] [client 20.63.33.98:25344] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file4.php"] [unique_id "ahKQtAaxiY3NxLUD97VP7wAAAI4"]
[Sun May 24 13:46:29.279310 2026] [:error] [pid 49689:tid 49727] [client 20.63.33.98:21335] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "ahKQtQaxiY3NxLUD97VP8QAAAIk"]
[Sun May 24 13:46:29.707376 2026] [:error] [pid 49744:tid 49766] [client 20.63.33.98:33604] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "ahKQtTsE5kPdFpUbbHGkZgAAANQ"]
[Sun May 24 13:46:30.134471 2026] [:error] [pid 49744:tid 49752] [client 20.63.33.98:33637] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "ahKQtjsE5kPdFpUbbHGkZwAAAMY"]
[Sun May 24 13:46:30.591703 2026] [:error] [pid 23497:tid 23504] [client 20.63.33.98:33612] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dropdown.php"] [unique_id "ahKQtiPlV47QcYwd2v-VeAAAAUQ"]
[Sun May 24 13:46:31.047721 2026] [:error] [pid 23497:tid 23508] [client 20.63.33.98:33630] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "ahKQtyPlV47QcYwd2v-VewAAAUg"]
[Sun May 24 13:46:31.504555 2026] [:error] [pid 23497:tid 23511] [client 20.63.33.98:25383] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "ahKQtyPlV47QcYwd2v-VfgAAAUs"]
[Sun May 24 13:46:31.963313 2026] [:error] [pid 49744:tid 49769] [client 20.63.33.98:25398] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "ahKQtzsE5kPdFpUbbHGkbAAAANc"]
[Sun May 24 13:46:32.385476 2026] [:error] [pid 49744:tid 49755] [client 20.63.33.98:33656] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/txets.php"] [unique_id "ahKQuDsE5kPdFpUbbHGkbQAAAMk"]
[Sun May 24 13:46:32.813331 2026] [:error] [pid 23497:tid 23500] [client 20.63.33.98:33636] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "ahKQuCPlV47QcYwd2v-VggAAAUA"]
[Sun May 24 13:46:33.248200 2026] [:error] [pid 23497:tid 23519] [client 20.63.33.98:25356] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "ahKQuSPlV47QcYwd2v-VgwAAAVM"]
[Sun May 24 13:46:33.675564 2026] [:error] [pid 23497:tid 23501] [client 20.63.33.98:25349] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "ahKQuSPlV47QcYwd2v-VhAAAAUE"]
[Sun May 24 13:46:34.146509 2026] [:error] [pid 49688:tid 49711] [client 20.63.33.98:21343] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-access.php"] [unique_id "ahKQumYoQ9V6a_4pBsiOdQAAAFQ"]
[Sun May 24 13:46:34.594577 2026] [:error] [pid 49688:tid 49705] [client 20.63.33.98:25371] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "ahKQumYoQ9V6a_4pBsiOdgAAAE4"]
[Sun May 24 13:46:35.021917 2026] [:error] [pid 49688:tid 49691] [client 20.63.33.98:21314] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "ahKQu2YoQ9V6a_4pBsiOeQAAAEA"]
[Sun May 24 13:46:35.441017 2026] [:error] [pid 23497:tid 23522] [client 20.63.33.98:25395] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "ahKQuyPlV47QcYwd2v-ViAAAAVY"]
[Sun May 24 13:46:35.867965 2026] [:error] [pid 49744:tid 49754] [client 20.63.33.98:33615] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aevly.php"] [unique_id "ahKQuzsE5kPdFpUbbHGkcQAAAMg"]
[Sun May 24 13:46:36.326069 2026] [:error] [pid 23497:tid 23504] [client 20.63.33.98:33607] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "ahKQvCPlV47QcYwd2v-ViQAAAUQ"]
[Sun May 24 13:46:36.785584 2026] [:error] [pid 49775:tid 49798] [client 20.63.33.98:25367] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "ahKQvIvZb8G6T8WpI1hocQAAABU"]
[Sun May 24 13:46:37.213118 2026] [:error] [pid 49689:tid 49741] [client 20.63.33.98:33605] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "ahKQvQaxiY3NxLUD97VP9gAAAJc"]
[Sun May 24 13:46:37.641159 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:21372] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/vx.php"] [unique_id "ahKQvTsE5kPdFpUbbHGkcwAAAM8"]
[Sun May 24 13:46:38.069397 2026] [:error] [pid 49775:tid 49794] [client 20.63.33.98:25348] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wz.php"] [unique_id "ahKQvovZb8G6T8WpI1hocwAAABE"]
[Sun May 24 13:46:38.529459 2026] [:error] [pid 23497:tid 23523] [client 20.63.33.98:33658] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wz.php"] [unique_id "ahKQviPlV47QcYwd2v-ViwAAAVc"]
[Sun May 24 13:46:38.988478 2026] [:error] [pid 23497:tid 23519] [client 20.63.33.98:21316] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wz.php"] [unique_id "ahKQviPlV47QcYwd2v-VjAAAAVM"]
[Sun May 24 13:46:39.416058 2026] [:error] [pid 2639:tid 2649] [client 20.63.33.98:25400] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-wz.php"] [unique_id "ahKQv0zQncQTd0Z0Oe8u5gAAAQg"]
[Sun May 24 13:46:39.843828 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:25373] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahKQv4vZb8G6T8WpI1hodgAAABY"]
[Sun May 24 13:46:40.271515 2026] [:error] [pid 2639:tid 2655] [client 20.63.33.98:33659] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahKQwEzQncQTd0Z0Oe8u6QAAAQ4"]
[Sun May 24 13:46:40.698057 2026] [:error] [pid 2639:tid 2650] [client 20.63.33.98:25405] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahKQwEzQncQTd0Z0Oe8u6gAAAQk"]
[Sun May 24 13:46:41.159076 2026] [:error] [pid 23497:tid 23515] [client 20.63.33.98:21338] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahKQwSPlV47QcYwd2v-VkgAAAU8"]
[Sun May 24 13:46:41.610130 2026] [:error] [pid 23497:tid 23506] [client 20.63.33.98:21318] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "ahKQwSPlV47QcYwd2v-VkwAAAUY"]
[Sun May 24 13:46:42.029505 2026] [:error] [pid 23497:tid 23521] [client 20.63.33.98:25393] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "ahKQwiPlV47QcYwd2v-VlgAAAVU"]
[Sun May 24 13:46:42.487300 2026] [:error] [pid 49744:tid 49749] [client 20.63.33.98:25379] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "ahKQwjsE5kPdFpUbbHGkfQAAAMM"]
[Sun May 24 13:46:42.946220 2026] [:error] [pid 2639:tid 2651] [client 20.63.33.98:25397] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/new.php"] [unique_id "ahKQwkzQncQTd0Z0Oe8u6wAAAQo"]
[Sun May 24 13:46:43.373752 2026] [:error] [pid 2639:tid 2644] [client 20.63.33.98:21352] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahKQw0zQncQTd0Z0Oe8u7AAAAQM"]
[Sun May 24 13:46:43.802252 2026] [:error] [pid 2639:tid 2645] [client 20.63.33.98:21373] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahKQw0zQncQTd0Z0Oe8u7gAAAQQ"]
[Sun May 24 13:46:44.230343 2026] [:error] [pid 49744:tid 49748] [client 20.63.33.98:21356] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahKQxDsE5kPdFpUbbHGkhAAAAMI"]
[Sun May 24 13:46:44.657165 2026] [:error] [pid 2639:tid 2652] [client 20.63.33.98:33648] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahKQxEzQncQTd0Z0Oe8u8QAAAQs"]
[Sun May 24 13:46:45.087957 2026] [:error] [pid 2639:tid 2641] [client 20.63.33.98:21353] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "ahKQxUzQncQTd0Z0Oe8u8wAAAQA"]
[Sun May 24 13:46:45.507191 2026] [:error] [pid 23497:tid 23506] [client 20.63.33.98:21337] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "ahKQxSPlV47QcYwd2v-VnAAAAUY"]
[Sun May 24 13:46:45.934138 2026] [:error] [pid 23497:tid 23518] [client 20.63.33.98:25396] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "ahKQxSPlV47QcYwd2v-VnQAAAVI"]
[Sun May 24 13:46:46.352857 2026] [:error] [pid 49688:tid 49691] [client 20.63.33.98:33627] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ccou.php"] [unique_id "ahKQxmYoQ9V6a_4pBsiOngAAAEA"]
[Sun May 24 13:46:46.781858 2026] [:error] [pid 23497:tid 23513] [client 20.63.33.98:21345] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "ahKQxiPlV47QcYwd2v-VogAAAU0"]
[Sun May 24 13:46:47.209295 2026] [:error] [pid 2639:tid 2650] [client 20.63.33.98:33621] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "ahKQx0zQncQTd0Z0Oe8u9wAAAQk"]
[Sun May 24 13:46:47.636931 2026] [:error] [pid 23497:tid 23512] [client 20.63.33.98:21348] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "ahKQxyPlV47QcYwd2v-VpwAAAUw"]
[Sun May 24 13:46:48.065710 2026] [:error] [pid 49688:tid 49703] [client 20.63.33.98:25401] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/db.php"] [unique_id "ahKQyGYoQ9V6a_4pBsiOoAAAAEw"]
[Sun May 24 13:46:48.523669 2026] [:error] [pid 23497:tid 23507] [client 20.63.33.98:20902] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ahKQyCPlV47QcYwd2v-VqQAAAUc"]
[Sun May 24 13:46:49.010946 2026] [:error] [pid 49744:tid 49746] [client 20.63.33.98:25347] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ahKQyTsE5kPdFpUbbHGkigAAAMA"]
[Sun May 24 13:46:49.468796 2026] [:error] [pid 49688:tid 49704] [client 20.63.33.98:25404] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ahKQyWYoQ9V6a_4pBsiOoQAAAE0"]
[Sun May 24 13:46:49.926919 2026] [:error] [pid 49775:tid 49784] [client 20.63.33.98:21331] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ahKQyYvZb8G6T8WpI1hofAAAAAc"]
[Sun May 24 13:46:50.414378 2026] [:error] [pid 23497:tid 23511] [client 20.63.33.98:33638] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "ahKQyiPlV47QcYwd2v-VqwAAAUs"]
[Sun May 24 13:46:50.863933 2026] [:error] [pid 23497:tid 23514] [client 20.63.33.98:21322] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "ahKQyiPlV47QcYwd2v-VrQAAAU4"]
[Sun May 24 13:46:51.283299 2026] [:error] [pid 2639:tid 2647] [client 20.63.33.98:21364] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "ahKQy0zQncQTd0Z0Oe8u-AAAAQY"]
[Sun May 24 13:46:51.741130 2026] [:error] [pid 49775:tid 49789] [client 20.63.33.98:33629] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yellow.php"] [unique_id "ahKQy4vZb8G6T8WpI1hogAAAAAw"]
[Sun May 24 13:46:52.220369 2026] [:error] [pid 49775:tid 49786] [client 20.63.33.98:25403] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "ahKQzIvZb8G6T8WpI1hogQAAAAk"]
[Sun May 24 13:46:52.671668 2026] [:error] [pid 49775:tid 49781] [client 20.63.33.98:33641] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "ahKQzIvZb8G6T8WpI1hogwAAAAQ"]
[Sun May 24 13:46:53.090882 2026] [:error] [pid 2639:tid 2648] [client 20.63.33.98:33608] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "ahKQzUzQncQTd0Z0Oe8u_gAAAQc"]
[Sun May 24 13:46:53.517908 2026] [:error] [pid 23497:tid 23513] [client 20.63.33.98:33661] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mifta.php"] [unique_id "ahKQzSPlV47QcYwd2v-VtAAAAU0"]
[Sun May 24 13:46:53.945191 2026] [:error] [pid 23497:tid 23503] [client 20.63.33.98:25360] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "ahKQzSPlV47QcYwd2v-VtgAAAUM"]
[Sun May 24 13:46:54.374249 2026] [:error] [pid 23497:tid 23501] [client 20.63.33.98:21365] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "ahKQziPlV47QcYwd2v-VuAAAAUE"]
[Sun May 24 13:46:54.800558 2026] [:error] [pid 2639:tid 2661] [client 20.63.33.98:25394] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "ahKQzkzQncQTd0Z0Oe8vAQAAARQ"]
[Sun May 24 13:46:55.227572 2026] [:error] [pid 23497:tid 23502] [client 20.63.33.98:25377] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-firewall.php"] [unique_id "ahKQzyPlV47QcYwd2v-VvQAAAUI"]
[Sun May 24 13:46:55.654997 2026] [:error] [pid 2639:tid 2651] [client 20.63.33.98:25361] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "ahKQz0zQncQTd0Z0Oe8vAwAAAQo"]
[Sun May 24 13:46:56.075169 2026] [:error] [pid 2639:tid 2658] [client 20.63.33.98:25363] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "ahKQ0EzQncQTd0Z0Oe8vBAAAARE"]
[Sun May 24 13:46:56.500584 2026] [:error] [pid 2639:tid 2647] [client 20.63.33.98:25346] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "ahKQ0EzQncQTd0Z0Oe8vBwAAAQY"]
[Sun May 24 13:46:56.926812 2026] [:error] [pid 23497:tid 23503] [client 20.63.33.98:20889] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fun.php"] [unique_id "ahKQ0CPlV47QcYwd2v-VvwAAAUM"]
[Sun May 24 13:46:57.353409 2026] [:error] [pid 2639:tid 2653] [client 20.63.33.98:25362] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahKQ0UzQncQTd0Z0Oe8vCQAAAQw"]
[Sun May 24 13:46:57.788335 2026] [:error] [pid 2639:tid 2652] [client 20.63.33.98:5084] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahKQ0UzQncQTd0Z0Oe8vCwAAAQs"]
[Sun May 24 13:46:58.246917 2026] [:error] [pid 2639:tid 2665] [client 20.63.33.98:25369] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahKQ0kzQncQTd0Z0Oe8vDQAAARg"]
[Sun May 24 13:46:58.728198 2026] [:error] [pid 49689:tid 49721] [client 20.63.33.98:21320] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahKQ0gaxiY3NxLUD97VP_QAAAIM"]
[Sun May 24 13:46:59.190398 2026] [:error] [pid 2639:tid 2645] [client 20.63.33.98:21341] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "ahKQ00zQncQTd0Z0Oe8vEgAAAQQ"]
[Sun May 24 13:46:59.609077 2026] [:error] [pid 2639:tid 2653] [client 20.63.33.98:21363] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "ahKQ00zQncQTd0Z0Oe8vFQAAAQw"]
[Sun May 24 13:47:00.037566 2026] [:error] [pid 23497:tid 23523] [client 20.63.33.98:20915] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "ahKQ1CPlV47QcYwd2v-VxQAAAVc"]
[Sun May 24 13:47:00.457175 2026] [:error] [pid 23497:tid 23511] [client 20.63.33.98:20879] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sys.php"] [unique_id "ahKQ1CPlV47QcYwd2v-VxwAAAUs"]
[Sun May 24 13:47:00.916373 2026] [:error] [pid 23497:tid 23505] [client 20.63.33.98:21351] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "ahKQ1CPlV47QcYwd2v-VyQAAAUU"]
[Sun May 24 13:47:01.375379 2026] [:error] [pid 23497:tid 23510] [client 20.63.33.98:25407] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "ahKQ1SPlV47QcYwd2v-VywAAAUo"]
[Sun May 24 13:47:01.802042 2026] [:error] [pid 2639:tid 2646] [client 20.63.33.98:21369] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1index.php"] [unique_id "ahKQ1UzQncQTd0Z0Oe8vHQAAAQU"]
[Sun May 24 13:47:02.278952 2026] [:error] [pid 2639:tid 2651] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/1index.php
[Sun May 24 13:47:03.994870 2026] [:error] [pid 2639:tid 2651] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/shell20211028.php
[Sun May 24 13:47:04.242097 2026] [:error] [pid 2639:tid 2660] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-ver.php
[Sun May 24 13:47:04.489457 2026] [:error] [pid 2639:tid 2661] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/lala.php
[Sun May 24 13:47:04.737345 2026] [:error] [pid 2639:tid 2652] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/sbhu.php
[Sun May 24 13:47:04.984700 2026] [:error] [pid 2639:tid 2643] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-sing.php
[Sun May 24 13:47:05.233763 2026] [:error] [pid 2639:tid 2657] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/file59.php
[Sun May 24 13:47:05.481191 2026] [:error] [pid 2639:tid 2663] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-slss.php
[Sun May 24 13:47:05.729154 2026] [:error] [pid 2639:tid 2651] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Sun May 24 13:47:05.977104 2026] [:error] [pid 2639:tid 2658] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/atkno.php
[Sun May 24 13:47:06.225284 2026] [:error] [pid 2639:tid 2660] [client 20.63.33.98:25387] File does not exist: /usr/local/apache/htdocs/suspended-page/ff.php
[Sun May 24 13:47:06.470287 2026] [:error] [pid 2639:tid 2661] [client 20.63.33.98:25387] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "ahKQ2kzQncQTd0Z0Oe8vMQAAARQ"]
[Sun May 24 13:47:06.951715 2026] [:error] [pid 49744:tid 49770] [client 20.63.33.98:33654] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "ahKQ2jsE5kPdFpUbbHGkoQAAANg"]
[Sun May 24 13:47:07.443305 2026] [:error] [pid 49775:tid 49796] [client 20.63.33.98:20881] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "ahKQ24vZb8G6T8WpI1homQAAABM"]
[Sun May 24 13:47:07.908681 2026] [:error] [pid 49775:tid 49778] [client 20.63.33.98:25364] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/yas.php"] [unique_id "ahKQ24vZb8G6T8WpI1homwAAAAE"]
[Sun May 24 13:47:08.329749 2026] [:error] [pid 23497:tid 23507] [client 20.63.33.98:21362] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "ahKQ3CPlV47QcYwd2v-V5QAAAUc"]
[Sun May 24 13:47:08.787631 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:33635] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "ahKQ3IvZb8G6T8WpI1honQAAABY"]
[Sun May 24 13:47:09.245156 2026] [:error] [pid 23497:tid 23509] [client 20.63.33.98:21336] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "ahKQ3SPlV47QcYwd2v-V6AAAAUk"]
[Sun May 24 13:47:09.702158 2026] [:error] [pid 23497:tid 23500] [client 20.63.33.98:21358] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/png.php"] [unique_id "ahKQ3SPlV47QcYwd2v-V6gAAAUA"]
[Sun May 24 13:47:10.191602 2026] [:error] [pid 23497:tid 23513] [client 20.63.33.98:25391] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ahKQ3iPlV47QcYwd2v-V6wAAAU0"]
[Sun May 24 13:47:10.658668 2026] [:error] [pid 49689:tid 49730] [client 20.63.33.98:25368] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ahKQ3gaxiY3NxLUD97VQEgAAAIw"]
[Sun May 24 13:47:11.072915 2026] [:error] [pid 49744:tid 49766] [client 20.63.33.98:20882] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ahKQ3zsE5kPdFpUbbHGkrwAAANQ"]
[Sun May 24 13:47:11.499674 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:21366] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wmore1.php"] [unique_id "ahKQ34vZb8G6T8WpI1hoogAAAA4"]
[Sun May 24 13:47:12.060641 2026] [:error] [pid 23497:tid 23524] [client 20.63.33.98:33634] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "ahKQ4CPlV47QcYwd2v-V8AAAAVg"]
[Sun May 24 13:47:12.541184 2026] [:error] [pid 49744:tid 49762] [client 20.63.33.98:25402] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "ahKQ4DsE5kPdFpUbbHGksQAAANA"]
[Sun May 24 13:47:13.006196 2026] [:error] [pid 23497:tid 23517] [client 20.63.33.98:20898] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "ahKQ4SPlV47QcYwd2v-V8QAAAVE"]
[Sun May 24 13:47:13.491154 2026] [:error] [pid 23497:tid 23519] [client 20.63.33.98:25390] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ah25.php"] [unique_id "ahKQ4SPlV47QcYwd2v-V8gAAAVM"]
[Sun May 24 13:47:14.008452 2026] [:error] [pid 23497:tid 23518] [client 20.63.33.98:20884] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "ahKQ4iPlV47QcYwd2v-V8wAAAVI"]
[Sun May 24 13:47:14.487266 2026] [:error] [pid 2639:tid 2660] [client 20.63.33.98:21332] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "ahKQ4kzQncQTd0Z0Oe8vPAAAARM"]
[Sun May 24 13:47:15.007059 2026] [:error] [pid 49775:tid 49795] [client 20.63.33.98:20906] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "ahKQ44vZb8G6T8WpI1hoqwAAABI"]
[Sun May 24 13:47:15.524067 2026] [:error] [pid 23497:tid 23503] [client 20.63.33.98:5057] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/forbidals.php"] [unique_id "ahKQ4yPlV47QcYwd2v-V9wAAAUM"]
[Sun May 24 13:47:16.001173 2026] [:error] [pid 23497:tid 23507] [client 20.63.33.98:21327] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "ahKQ5CPlV47QcYwd2v-V-QAAAUc"]
[Sun May 24 13:47:16.423827 2026] [:error] [pid 49744:tid 49748] [client 20.63.33.98:21375] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "ahKQ5DsE5kPdFpUbbHGktAAAAMI"]
[Sun May 24 13:47:16.869150 2026] [:error] [pid 2639:tid 2646] [client 20.63.33.98:33639] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "ahKQ5EzQncQTd0Z0Oe8vPwAAAQU"]
[Sun May 24 13:47:17.344215 2026] [:error] [pid 23497:tid 23500] [client 20.63.33.98:20883] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lv.php"] [unique_id "ahKQ5SPlV47QcYwd2v-V_gAAAUA"]
[Sun May 24 13:47:17.771714 2026] [:error] [pid 49744:tid 49758] [client 20.63.33.98:20885] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "ahKQ5TsE5kPdFpUbbHGktgAAAMw"]
[Sun May 24 13:47:18.189810 2026] [:error] [pid 23497:tid 23505] [client 20.63.33.98:21323] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "ahKQ5iPlV47QcYwd2v-WAQAAAUU"]
[Sun May 24 13:47:18.608748 2026] [:error] [pid 49775:tid 49783] [client 20.63.33.98:5061] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "ahKQ5ovZb8G6T8WpI1hotgAAAAY"]
[Sun May 24 13:47:19.036773 2026] [:error] [pid 49689:tid 49719] [client 20.63.33.98:25388] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/explorer/index_.php"] [unique_id "ahKQ5waxiY3NxLUD97VQFAAAAIE"]
[Sun May 24 13:47:19.463388 2026] [:error] [pid 2639:tid 2665] [client 20.63.33.98:5063] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ahKQ50zQncQTd0Z0Oe8vQQAAARg"]
[Sun May 24 13:47:19.890793 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:21334] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ahKQ54vZb8G6T8WpI1hovAAAABY"]
[Sun May 24 13:47:20.309622 2026] [:error] [pid 49688:tid 49691] [client 20.63.33.98:20872] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ahKQ6GYoQ9V6a_4pBsiOsQAAAEA"]
[Sun May 24 13:47:20.758708 2026] [:error] [pid 2639:tid 2649] [client 20.63.33.98:20910] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xda.php"] [unique_id "ahKQ6EzQncQTd0Z0Oe8vQwAAAQg"]
[Sun May 24 13:47:21.219800 2026] [:error] [pid 49688:tid 49696] [client 20.63.33.98:20866] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "ahKQ6WYoQ9V6a_4pBsiOsgAAAEU"]
[Sun May 24 13:47:21.648706 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:5105] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "ahKQ6YvZb8G6T8WpI1howgAAAA4"]
[Sun May 24 13:47:22.075513 2026] [:error] [pid 2639:tid 2641] [client 20.63.33.98:20876] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "ahKQ6kzQncQTd0Z0Oe8vRwAAAQA"]
[Sun May 24 13:47:22.495835 2026] [:error] [pid 49689:tid 49731] [client 20.63.33.98:21315] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/samll.php"] [unique_id "ahKQ6gaxiY3NxLUD97VQGAAAAI0"]
[Sun May 24 13:47:22.920160 2026] [:error] [pid 49689:tid 49735] [client 20.63.33.98:20895] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "ahKQ6gaxiY3NxLUD97VQGwAAAJE"]
[Sun May 24 13:47:23.368592 2026] [:error] [pid 49689:tid 49739] [client 20.63.33.98:21354] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "ahKQ6waxiY3NxLUD97VQHAAAAJU"]
[Sun May 24 13:47:23.816407 2026] [:error] [pid 23497:tid 23501] [client 20.63.33.98:21326] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "ahKQ6yPlV47QcYwd2v-WCwAAAUE"]
[Sun May 24 13:47:24.246628 2026] [:error] [pid 49688:tid 49704] [client 20.63.33.98:33611] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-at.php"] [unique_id "ahKQ7GYoQ9V6a_4pBsiOtAAAAE0"]
[Sun May 24 13:47:24.705279 2026] [:error] [pid 49688:tid 49693] [client 20.63.33.98:33617] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKQ7GYoQ9V6a_4pBsiOtgAAAEI"]
[Sun May 24 13:47:25.163293 2026] [:error] [pid 49688:tid 49709] [client 20.63.33.98:20874] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKQ7WYoQ9V6a_4pBsiOuAAAAFI"]
[Sun May 24 13:47:25.620326 2026] [:error] [pid 23497:tid 23521] [client 20.63.33.98:21374] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKQ7SPlV47QcYwd2v-WDQAAAVU"]
[Sun May 24 13:47:26.065611 2026] [:error] [pid 49689:tid 49724] [client 20.63.33.98:4993] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahKQ7gaxiY3NxLUD97VQHgAAAIY"]
[Sun May 24 13:47:26.484968 2026] [:error] [pid 49688:tid 49692] [client 20.63.33.98:20908] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ahKQ7mYoQ9V6a_4pBsiOuQAAAEE"]
[Sun May 24 13:47:26.911953 2026] [:error] [pid 49689:tid 49723] [client 20.63.33.98:21344] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ahKQ7gaxiY3NxLUD97VQHwAAAIU"]
[Sun May 24 13:47:27.339182 2026] [:error] [pid 23497:tid 23523] [client 20.63.33.98:21349] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ahKQ7yPlV47QcYwd2v-WEAAAAVc"]
[Sun May 24 13:47:27.783635 2026] [:error] [pid 23497:tid 23500] [client 20.63.33.98:21325] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-the.php"] [unique_id "ahKQ7yPlV47QcYwd2v-WEQAAAUA"]
[Sun May 24 13:47:28.274537 2026] [:error] [pid 49688:tid 49715] [client 20.63.33.98:20912] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "ahKQ8GYoQ9V6a_4pBsiOvAAAAFg"]
[Sun May 24 13:47:28.722952 2026] [:error] [pid 49744:tid 49768] [client 20.63.33.98:21324] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "ahKQ8DsE5kPdFpUbbHGkuAAAANY"]
[Sun May 24 13:47:29.150899 2026] [:error] [pid 49744:tid 49747] [client 20.63.33.98:5066] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "ahKQ8TsE5kPdFpUbbHGkugAAAME"]
[Sun May 24 13:47:29.578995 2026] [:error] [pid 2639:tid 2661] [client 20.63.33.98:25384] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff1.php"] [unique_id "ahKQ8UzQncQTd0Z0Oe8vUgAAARQ"]
[Sun May 24 13:47:30.009989 2026] [:error] [pid 23497:tid 23512] [client 20.63.33.98:5074] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "ahKQ8iPlV47QcYwd2v-WEwAAAUw"]
[Sun May 24 13:47:30.444757 2026] [:error] [pid 2639:tid 2654] [client 20.63.33.98:20897] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "ahKQ8kzQncQTd0Z0Oe8vVQAAAQ0"]
[Sun May 24 13:47:30.896806 2026] [:error] [pid 23497:tid 23509] [client 20.63.33.98:20920] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "ahKQ8iPlV47QcYwd2v-WFQAAAUk"]
[Sun May 24 13:47:31.354907 2026] [:error] [pid 49689:tid 49718] [client 20.63.33.98:25405] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cilus.php"] [unique_id "ahKQ8waxiY3NxLUD97VQJgAAAIA"]
[Sun May 24 13:47:31.782025 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:20911] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "ahKQ8zsE5kPdFpUbbHGkvQAAAM8"]
[Sun May 24 13:47:32.196476 2026] [:error] [pid 49689:tid 49736] [client 20.63.33.98:5089] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "ahKQ9AaxiY3NxLUD97VQJwAAAJI"]
[Sun May 24 13:47:32.625205 2026] [:error] [pid 49689:tid 49722] [client 20.63.33.98:20878] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "ahKQ9AaxiY3NxLUD97VQKgAAAIQ"]
[Sun May 24 13:47:33.059306 2026] [:error] [pid 49689:tid 49723] [client 20.63.33.98:21347] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Okxob.php"] [unique_id "ahKQ9QaxiY3NxLUD97VQLwAAAIU"]
[Sun May 24 13:47:33.486197 2026] [:error] [pid 49689:tid 49728] [client 20.63.33.98:25380] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "ahKQ9QaxiY3NxLUD97VQMAAAAIo"]
[Sun May 24 13:47:33.906250 2026] [:error] [pid 23497:tid 23508] [client 20.63.33.98:25392] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "ahKQ9SPlV47QcYwd2v-WFgAAAUg"]
[Sun May 24 13:47:34.334795 2026] [:error] [pid 49775:tid 49782] [client 20.63.33.98:20886] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "ahKQ9ovZb8G6T8WpI1ho0wAAAAU"]
[Sun May 24 13:47:34.799578 2026] [:error] [pid 49744:tid 49756] [client 20.63.33.98:25399] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pass4.php"] [unique_id "ahKQ9jsE5kPdFpUbbHGkwAAAAMo"]
[Sun May 24 13:47:35.276830 2026] [:error] [pid 49744:tid 49749] [client 20.63.33.98:25406] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-su.php"] [unique_id "ahKQ9zsE5kPdFpUbbHGkwgAAAMM"]
[Sun May 24 13:47:35.734013 2026] [:error] [pid 49688:tid 49715] [client 20.63.33.98:25405] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-su.php"] [unique_id "ahKQ92YoQ9V6a_4pBsiOwQAAAFg"]
[Sun May 24 13:47:36.181163 2026] [:error] [pid 49744:tid 49765] [client 20.63.33.98:21340] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-su.php"] [unique_id "ahKQ-DsE5kPdFpUbbHGkxAAAANM"]
[Sun May 24 13:47:36.639666 2026] [:error] [pid 49744:tid 49759] [client 20.63.33.98:25359] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-su.php"] [unique_id "ahKQ-DsE5kPdFpUbbHGkxQAAAM0"]
[Sun May 24 13:47:37.054424 2026] [:error] [pid 49744:tid 49753] [client 20.63.33.98:20914] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "ahKQ-TsE5kPdFpUbbHGkxwAAAMc"]
[Sun May 24 13:47:37.516155 2026] [:error] [pid 49775:tid 49778] [client 20.63.33.98:21328] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "ahKQ-YvZb8G6T8WpI1ho2AAAAAE"]
[Sun May 24 13:47:37.982688 2026] [:error] [pid 49744:tid 49763] [client 20.63.33.98:20873] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "ahKQ-TsE5kPdFpUbbHGkywAAANE"]
[Sun May 24 13:47:38.411441 2026] [:error] [pid 2639:tid 2642] [client 20.63.33.98:33652] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/like.php"] [unique_id "ahKQ-kzQncQTd0Z0Oe8vYgAAAQE"]
[Sun May 24 13:47:38.840718 2026] [:error] [pid 49744:tid 49746] [client 20.63.33.98:5056] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mass.php"] [unique_id "ahKQ-jsE5kPdFpUbbHGk0AAAAMA"]
[Sun May 24 13:47:39.271938 2026] [:error] [pid 49775:tid 49792] [client 20.63.33.98:21312] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mass.php"] [unique_id "ahKQ-4vZb8G6T8WpI1ho3AAAAA8"]
[Sun May 24 13:47:39.700941 2026] [:error] [pid 49744:tid 49751] [client 20.63.33.98:20880] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mass.php"] [unique_id "ahKQ-zsE5kPdFpUbbHGk0gAAAMU"]
[Sun May 24 13:47:40.144992 2026] [:error] [pid 23497:tid 23524] [client 20.63.33.98:21371] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mass.php"] [unique_id "ahKQ_CPlV47QcYwd2v-WGgAAAVg"]
[Sun May 24 13:47:40.632836 2026] [:error] [pid 23497:tid 23502] [client 20.63.33.98:20865] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "ahKQ_CPlV47QcYwd2v-WGwAAAUI"]
[Sun May 24 13:47:41.108292 2026] [:error] [pid 23497:tid 23522] [client 20.63.33.98:5110] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "ahKQ_SPlV47QcYwd2v-WHQAAAVY"]
[Sun May 24 13:47:41.553930 2026] [:error] [pid 23497:tid 23518] [client 20.63.33.98:20900] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "ahKQ_SPlV47QcYwd2v-WIQAAAVI"]
[Sun May 24 13:47:41.981734 2026] [:error] [pid 23497:tid 23513] [client 20.63.33.98:5108] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/i.php"] [unique_id "ahKQ_SPlV47QcYwd2v-WIwAAAU0"]
[Sun May 24 13:47:42.410048 2026] [:error] [pid 49689:tid 49732] [client 20.63.33.98:5082] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "ahKQ_gaxiY3NxLUD97VQQQAAAI4"]
[Sun May 24 13:47:42.839983 2026] [:error] [pid 2639:tid 2663] [client 20.63.33.98:5111] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "ahKQ_kzQncQTd0Z0Oe8vagAAARY"]
[Sun May 24 13:47:43.288864 2026] [:error] [pid 49744:tid 49747] [client 20.63.33.98:5012] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "ahKQ_zsE5kPdFpUbbHGk1wAAAME"]
[Sun May 24 13:47:43.736853 2026] [:error] [pid 2639:tid 2660] [client 20.63.33.98:21360] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/test.php"] [unique_id "ahKQ_0zQncQTd0Z0Oe8vbgAAARM"]
[Sun May 24 13:47:44.164623 2026] [:error] [pid 23497:tid 23506] [client 20.63.33.98:21342] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "ahKRACPlV47QcYwd2v-WJgAAAUY"]
[Sun May 24 13:47:44.622723 2026] [:error] [pid 23497:tid 23521] [client 20.63.33.98:5042] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "ahKRACPlV47QcYwd2v-WJwAAAVU"]
[Sun May 24 13:47:45.083943 2026] [:error] [pid 2639:tid 2652] [client 20.63.33.98:21370] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "ahKRAUzQncQTd0Z0Oe8vcQAAAQs"]
[Sun May 24 13:47:45.503075 2026] [:error] [pid 49689:tid 49731] [client 20.63.33.98:5098] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/la.php"] [unique_id "ahKRAQaxiY3NxLUD97VQRwAAAI0"]
[Sun May 24 13:47:45.931678 2026] [:error] [pid 49689:tid 49741] [client 20.63.33.98:21361] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "ahKRAQaxiY3NxLUD97VQSAAAAJc"]
[Sun May 24 13:47:46.358121 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:20926] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "ahKRAovZb8G6T8WpI1ho4wAAABY"]
[Sun May 24 13:47:46.816224 2026] [:error] [pid 49775:tid 49792] [client 20.63.33.98:21321] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "ahKRAovZb8G6T8WpI1ho5QAAAA8"]
[Sun May 24 13:47:47.304895 2026] [:error] [pid 49775:tid 49795] [client 20.63.33.98:33616] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/reze.php"] [unique_id "ahKRA4vZb8G6T8WpI1ho5gAAABI"]
[Sun May 24 13:47:47.793798 2026] [:error] [pid 2639:tid 2664] [client 20.63.33.98:5090] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "ahKRA0zQncQTd0Z0Oe8vdwAAARc"]
[Sun May 24 13:47:48.272249 2026] [:error] [pid 2639:tid 2648] [client 20.63.33.98:5099] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "ahKRBEzQncQTd0Z0Oe8veAAAAQc"]
[Sun May 24 13:47:48.720948 2026] [:error] [pid 2639:tid 2661] [client 20.63.33.98:20901] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "ahKRBEzQncQTd0Z0Oe8vegAAARQ"]
[Sun May 24 13:47:49.134908 2026] [:error] [pid 49775:tid 49801] [client 20.63.33.98:20917] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/database.php"] [unique_id "ahKRBYvZb8G6T8WpI1ho5wAAABg"]
[Sun May 24 13:47:49.566001 2026] [:error] [pid 49775:tid 49790] [client 20.63.33.98:33611] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/favicon.php"] [unique_id "ahKRBYvZb8G6T8WpI1ho6QAAAA0"]
[Sun May 24 13:47:49.993266 2026] [:error] [pid 49775:tid 49780] [client 20.63.33.98:5002] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/favicon.php"] [unique_id "ahKRBYvZb8G6T8WpI1ho6wAAAAM"]
[Sun May 24 13:47:50.425662 2026] [:error] [pid 23497:tid 23506] [client 20.63.33.98:20869] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/favicon.php"] [unique_id "ahKRBiPlV47QcYwd2v-WNAAAAUY"]
[Sun May 24 13:47:50.846833 2026] [:error] [pid 49744:tid 49769] [client 20.63.33.98:5092] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/favicon.php"] [unique_id "ahKRBjsE5kPdFpUbbHGk4AAAANc"]
[Sun May 24 14:00:32.358115 2026] [:error] [pid 23497:tid 23503] [client 129.226.93.214:50150] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahKUACPlV47QcYwd2v-bFwAAAUM"]
[Sun May 24 17:01:14.200563 2026] [:error] [pid 23497:tid 23505] [client 43.156.228.27:35950] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahK-WiPlV47QcYwd2v_alwAAAUU"]
[Sun May 24 19:02:44.903138 2026] [:error] [pid 23497:tid 23505] [client 129.226.95.137:57372] [client 129.226.95.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahLa1CPlV47QcYwd2v8B3AAAAUU"]
[Sun May 24 19:46:51.248300 2026] [:error] [pid 2639:tid 2642] [client 119.91.20.139:58898] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahLlK0zQncQTd0Z0Oe97GAAAAQE"]
[Sun May 24 21:45:38.498248 2026] [:error] [pid 15835:tid 15855] [client 43.130.14.245:41678] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahMBAmWbknYlUM9P0qPeuwAAABI"]
[Sun May 24 22:01:55.306001 2026] [:error] [pid 11282:tid 11364] [client 134.199.156.173:59700] [client 134.199.156.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ahME0-0bPyN3C7HZ1R-ooQAAANg"]
[Sun May 24 22:01:55.474120 2026] [:error] [pid 11368:tid 11375] [client 134.199.156.173:40656] [client 134.199.156.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rejuva.au"] [uri "/.git/config"] [unique_id "ahME04fq_sTmmtTKm1U3-gAAAQU"]
[Sun May 24 22:01:55.701472 2026] [:error] [pid 11368:tid 11394] [client 134.199.156.173:59736] [client 134.199.156.173] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||rejuva.au|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rejuva.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ahME04fq_sTmmtTKm1U3_AAAARg"]
[Sun May 24 22:01:55.774464 2026] [:error] [pid 11282:tid 11351] [client 134.199.156.173:59708] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/frontend/jquery-file-upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-oqAAAAMs"]
[Sun May 24 22:01:55.790101 2026] [:error] [pid 11368:tid 11391] [client 134.199.156.173:59720] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/frontend/jquery-file-upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4AgAAARU"]
[Sun May 24 22:01:55.804535 2026] [:error] [pid 11368:tid 11393] [client 134.199.156.173:59736] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/frontend/jquery-file-upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4AwAAARc"]
[Sun May 24 22:01:55.810985 2026] [:error] [pid 11368:tid 11387] [client 134.199.156.173:59746] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4BAAAARE"]
[Sun May 24 22:01:55.825835 2026] [:error] [pid 11282:tid 11355] [client 134.199.156.173:59744] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-oqQAAAM8"]
[Sun May 24 22:01:55.867980 2026] [:error] [pid 11368:tid 11383] [client 134.199.156.173:59748] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/app-assets/data/jquery-file-upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4BQAAAQ0"]
[Sun May 24 22:01:55.870857 2026] [:error] [pid 11368:tid 11382] [client 134.199.156.173:59754] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4BgAAAQw"]
[Sun May 24 22:01:55.871472 2026] [:error] [pid 11368:tid 11389] [client 134.199.156.173:59766] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fileupload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4BwAAARM"]
[Sun May 24 22:01:55.876067 2026] [:error] [pid 11282:tid 11343] [client 134.199.156.173:59774] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-oqgAAAMM"]
[Sun May 24 22:01:55.877040 2026] [:error] [pid 11368:tid 11372] [client 134.199.156.173:59786] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4CAAAAQI"]
[Sun May 24 22:01:55.879677 2026] [:error] [pid 11281:tid 11324] [client 134.199.156.173:59800] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jquery-file-upload/server/php/"] [unique_id "ahME05KmC9taWvA91j6K5QAAAIs"]
[Sun May 24 22:01:55.887144 2026] [:error] [pid 11282:tid 11360] [client 134.199.156.173:59816] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/jquery-file-upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-oqwAAANQ"]
[Sun May 24 22:01:55.892496 2026] [:error] [pid 15835:tid 15839] [client 134.199.156.173:59824] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset_admin/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahME02WbknYlUM9P0qPm-wAAAAI"]
[Sun May 24 22:01:55.913505 2026] [:error] [pid 11281:tid 11319] [client 134.199.156.173:59832] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/server/php/"] [unique_id "ahME05KmC9taWvA91j6K5gAAAIY"]
[Sun May 24 22:01:55.914883 2026] [:error] [pid 11282:tid 11361] [client 134.199.156.173:59830] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-orAAAANU"]
[Sun May 24 22:01:55.915754 2026] [:error] [pid 11282:tid 11362] [client 134.199.156.173:59848] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fileupload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-orQAAANY"]
[Sun May 24 22:01:55.917069 2026] [:error] [pid 11281:tid 11323] [client 134.199.156.173:59852] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahME05KmC9taWvA91j6K5wAAAIo"]
[Sun May 24 22:01:55.918935 2026] [:error] [pid 11368:tid 11381] [client 134.199.156.173:59860] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4CQAAAQs"]
[Sun May 24 22:01:55.921485 2026] [:error] [pid 11282:tid 11345] [client 134.199.156.173:59876] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jquery-file-upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-orgAAAMU"]
[Sun May 24 22:01:55.930734 2026] [:error] [pid 11281:tid 11332] [client 134.199.156.173:59878] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/jquery-file-upload/server/php/"] [unique_id "ahME05KmC9taWvA91j6K6QAAAJM"]
[Sun May 24 22:01:55.934138 2026] [:error] [pid 11281:tid 11325] [client 134.199.156.173:59882] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset_admin/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahME05KmC9taWvA91j6K6gAAAIw"]
[Sun May 24 22:01:55.936391 2026] [:error] [pid 11281:tid 11333] [client 134.199.156.173:59892] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/galerie/server/php/"] [unique_id "ahME05KmC9taWvA91j6K6wAAAJQ"]
[Sun May 24 22:01:55.937337 2026] [:error] [pid 11282:tid 11352] [client 134.199.156.173:59908] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-orwAAAMw"]
[Sun May 24 22:01:55.938467 2026] [:error] [pid 11282:tid 11357] [client 134.199.156.173:59920] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-osAAAANE"]
[Sun May 24 22:01:55.955147 2026] [:error] [pid 11368:tid 11392] [client 134.199.156.173:59934] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4CgAAARY"]
[Sun May 24 22:01:55.956320 2026] [:error] [pid 11368:tid 11376] [client 134.199.156.173:59944] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4CwAAAQY"]
[Sun May 24 22:01:55.959616 2026] [:error] [pid 11368:tid 11388] [client 134.199.156.173:59948] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fileupload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4DAAAARI"]
[Sun May 24 22:01:55.960635 2026] [:error] [pid 11368:tid 11373] [client 134.199.156.173:59950] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4DQAAAQM"]
[Sun May 24 22:01:55.961465 2026] [:error] [pid 11282:tid 11354] [client 134.199.156.173:59962] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/blueimp-jQuery-File-Upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-osQAAAM4"]
[Sun May 24 22:01:55.963058 2026] [:error] [pid 11282:tid 11344] [client 134.199.156.173:59964] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jquery-file-upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-osgAAAMQ"]
[Sun May 24 22:01:55.973806 2026] [:error] [pid 11281:tid 11328] [client 134.199.156.173:59980] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/jquery-file-upload/server/php/"] [unique_id "ahME05KmC9taWvA91j6K7AAAAI8"]
[Sun May 24 22:01:55.976933 2026] [:error] [pid 11282:tid 11356] [client 134.199.156.173:59982] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset_admin/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-oswAAANA"]
[Sun May 24 22:01:55.978731 2026] [:error] [pid 11282:tid 11341] [client 134.199.156.173:59992] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/galerie/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-otAAAAME"]
[Sun May 24 22:01:55.979275 2026] [:error] [pid 11282:tid 11348] [client 134.199.156.173:60008] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upload/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-otQAAAMg"]
[Sun May 24 22:01:55.980224 2026] [:error] [pid 11282:tid 11342] [client 134.199.156.173:60012] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/server/php/"] [unique_id "ahME0-0bPyN3C7HZ1R-otgAAAMI"]
[Sun May 24 22:01:55.998295 2026] [:error] [pid 11368:tid 11374] [client 134.199.156.173:60018] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/jQuery-File-Upload/server/php/"] [unique_id "ahME04fq_sTmmtTKm1U4DgAAAQQ"]
[Sun May 24 22:01:56.020689 2026] [:error] [pid 11280:tid 11289] [client 134.199.156.173:60022] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/galerie/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcdAAAAEQ"]
[Sun May 24 22:01:56.021302 2026] [:error] [pid 11281:tid 11330] [client 134.199.156.173:60028] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/upload/server/php/"] [unique_id "ahME1JKmC9taWvA91j6K7QAAAJE"]
[Sun May 24 22:01:56.022703 2026] [:error] [pid 11368:tid 11384] [client 134.199.156.173:60044] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4DwAAAQ4"]
[Sun May 24 22:01:56.041375 2026] [:error] [pid 11282:tid 11349] [client 134.199.156.173:60048] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libraries/jsupload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-otwAAAMk"]
[Sun May 24 22:01:56.070003 2026] [:error] [pid 11368:tid 11380] [client 134.199.156.173:60064] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/global/plugins/jquery-file-upload/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4EAAAAQo"]
[Sun May 24 22:01:56.085613 2026] [:error] [pid 11282:tid 11364] [client 134.199.156.173:60072] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libraries/jsupload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ouAAAANg"]
[Sun May 24 22:01:56.108562 2026] [:error] [pid 11281:tid 11322] [client 134.199.156.173:60088] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/js/server/php/"] [unique_id "ahME1JKmC9taWvA91j6K7gAAAIk"]
[Sun May 24 22:01:56.112922 2026] [:error] [pid 11282:tid 11358] [client 134.199.156.173:60098] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/global/plugins/jquery-file-upload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ouQAAANI"]
[Sun May 24 22:01:56.116884 2026] [:error] [pid 11282:tid 11363] [client 134.199.156.173:60102] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ougAAANc"]
[Sun May 24 22:01:56.120701 2026] [:error] [pid 11282:tid 11340] [client 134.199.156.173:60114] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/global/plugins/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ouwAAAMA"]
[Sun May 24 22:01:56.128987 2026] [:error] [pid 11282:tid 11350] [client 134.199.156.173:60124] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libraries/jsupload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ovAAAAMo"]
[Sun May 24 22:01:56.150876 2026] [:error] [pid 11282:tid 11347] [client 134.199.156.173:60128] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/js/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ovQAAAMc"]
[Sun May 24 22:01:56.154227 2026] [:error] [pid 11281:tid 11316] [client 134.199.156.173:60134] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/server/php/"] [unique_id "ahME1JKmC9taWvA91j6K7wAAAIM"]
[Sun May 24 22:01:56.154930 2026] [:error] [pid 11281:tid 11318] [client 134.199.156.173:60154] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/global/plugins/jquery-file-upload/server/php/"] [unique_id "ahME1JKmC9taWvA91j6K8AAAAIU"]
[Sun May 24 22:01:56.155522 2026] [:error] [pid 11281:tid 11317] [client 134.199.156.173:60140] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahME1JKmC9taWvA91j6K8QAAAIQ"]
[Sun May 24 22:01:56.159918 2026] [:error] [pid 11368:tid 11385] [client 134.199.156.173:60162] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4EQAAAQ8"]
[Sun May 24 22:01:56.161698 2026] [:error] [pid 15835:tid 15851] [client 134.199.156.173:60166] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/global/plugins/server/php/"] [unique_id "ahME1GWbknYlUM9P0qPm_AAAAA4"]
[Sun May 24 22:01:56.193454 2026] [:error] [pid 11282:tid 11353] [client 134.199.156.173:60176] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/js/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ovgAAAM0"]
[Sun May 24 22:01:56.195588 2026] [:error] [pid 11282:tid 11346] [client 134.199.156.173:60180] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-ovwAAAMY"]
[Sun May 24 22:01:56.197412 2026] [:error] [pid 11368:tid 11375] [client 134.199.156.173:60196] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4EwAAAQU"]
[Sun May 24 22:01:56.202345 2026] [:error] [pid 11368:tid 11394] [client 134.199.156.173:60204] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/global/plugins/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4FAAAARg"]
[Sun May 24 22:01:56.203150 2026] [:error] [pid 11368:tid 11378] [client 134.199.156.173:60202] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4FQAAAQg"]
[Sun May 24 22:01:56.239562 2026] [:error] [pid 11368:tid 11390] [client 134.199.156.173:60210] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4FgAAARQ"]
[Sun May 24 22:01:56.240593 2026] [:error] [pid 11282:tid 11351] [client 134.199.156.173:60222] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/jquery-file-upload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-owAAAAMs"]
[Sun May 24 22:01:56.361804 2026] [:error] [pid 11368:tid 11377] [client 134.199.156.173:60232] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4FwAAAQc"]
[Sun May 24 22:01:56.361805 2026] [:error] [pid 11282:tid 11355] [client 134.199.156.173:60234] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-owQAAAM8"]
[Sun May 24 22:01:56.364061 2026] [:error] [pid 11280:tid 11309] [client 134.199.156.173:60250] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcdQAAAFg"]
[Sun May 24 22:01:56.374070 2026] [:error] [pid 11282:tid 11343] [client 134.199.156.173:60260] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/jquery-file-upload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-owgAAAMM"]
[Sun May 24 22:01:56.377502 2026] [:error] [pid 11282:tid 11360] [client 134.199.156.173:60268] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-owwAAANQ"]
[Sun May 24 22:01:56.435955 2026] [:error] [pid 11368:tid 11371] [client 134.199.156.173:60280] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4GAAAAQE"]
[Sun May 24 22:01:56.438786 2026] [:error] [pid 11282:tid 11361] [client 134.199.156.173:60284] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-oxAAAANU"]
[Sun May 24 22:01:56.447813 2026] [:error] [pid 11368:tid 11386] [client 134.199.156.173:60346] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4GQAAARA"]
[Sun May 24 22:01:56.448651 2026] [:error] [pid 11280:tid 11286] [client 134.199.156.173:60334] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/jquery-file-upload/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcdgAAAEE"]
[Sun May 24 22:01:56.449597 2026] [:error] [pid 11280:tid 11297] [client 134.199.156.173:60326] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcdwAAAEw"]
[Sun May 24 22:01:56.452507 2026] [:error] [pid 11280:tid 11290] [client 134.199.156.173:60318] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QceAAAAEU"]
[Sun May 24 22:01:56.453648 2026] [:error] [pid 11280:tid 11295] [client 134.199.156.173:60316] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QceQAAAEo"]
[Sun May 24 22:01:56.454660 2026] [:error] [pid 11281:tid 11320] [client 134.199.156.173:60300] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahME1JKmC9taWvA91j6K8gAAAIc"]
[Sun May 24 22:01:56.455763 2026] [:error] [pid 11280:tid 11291] [client 134.199.156.173:60290] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcegAAAEY"]
[Sun May 24 22:01:56.459721 2026] [:error] [pid 11280:tid 11299] [client 134.199.156.173:60350] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcewAAAE4"]
[Sun May 24 22:01:56.465946 2026] [:error] [pid 11368:tid 11370] [client 134.199.156.173:60358] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4GwAAAQA"]
[Sun May 24 22:01:56.466386 2026] [:error] [pid 11368:tid 11391] [client 134.199.156.173:60362] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/jquery-file-upload/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4GgAAARU"]
[Sun May 24 22:01:56.481725 2026] [:error] [pid 11280:tid 11300] [client 134.199.156.173:60368] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QcfAAAAE8"]
[Sun May 24 22:01:56.485012 2026] [:error] [pid 11280:tid 11292] [client 134.199.156.173:60370] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QcfQAAAEc"]
[Sun May 24 22:01:56.489420 2026] [:error] [pid 11280:tid 11294] [client 134.199.156.173:60384] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcfgAAAEk"]
[Sun May 24 22:01:56.490181 2026] [:error] [pid 11280:tid 11307] [client 134.199.156.173:60396] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/jquery-file-upload/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcfwAAAFY"]
[Sun May 24 22:01:56.492219 2026] [:error] [pid 11280:tid 11301] [client 134.199.156.173:60406] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcgAAAAFA"]
[Sun May 24 22:01:56.496564 2026] [:error] [pid 11282:tid 11362] [client 134.199.156.173:60412] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugin/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-oxQAAANY"]
[Sun May 24 22:01:56.497335 2026] [:error] [pid 11280:tid 11288] [client 134.199.156.173:60416] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QcgQAAAEM"]
[Sun May 24 22:01:56.498318 2026] [:error] [pid 11368:tid 11393] [client 134.199.156.173:60432] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4HAAAARc"]
[Sun May 24 22:01:56.500272 2026] [:error] [pid 11282:tid 11345] [client 134.199.156.173:60426] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-oxgAAAMU"]
[Sun May 24 22:01:56.501301 2026] [:error] [pid 11280:tid 11306] [client 134.199.156.173:60444] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QcggAAAFU"]
[Sun May 24 22:01:56.508514 2026] [:error] [pid 11368:tid 11387] [client 134.199.156.173:60456] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4HQAAARE"]
[Sun May 24 22:01:56.508552 2026] [:error] [pid 11282:tid 11352] [client 134.199.156.173:60472] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/jquery-file-upload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-oxwAAAMw"]
[Sun May 24 22:01:56.523566 2026] [:error] [pid 11280:tid 11293] [client 134.199.156.173:60482] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QcgwAAAEg"]
[Sun May 24 22:01:56.531328 2026] [:error] [pid 11368:tid 11383] [client 134.199.156.173:60488] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4HgAAAQ0"]
[Sun May 24 22:01:56.533406 2026] [:error] [pid 11282:tid 11357] [client 134.199.156.173:60504] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/jquery-file-upload/server/php/"] [unique_id "ahME1O0bPyN3C7HZ1R-oyAAAANE"]
[Sun May 24 22:01:56.538406 2026] [:error] [pid 11280:tid 11308] [client 134.199.156.173:60510] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QchAAAAFc"]
[Sun May 24 22:01:56.545822 2026] [:error] [pid 11368:tid 11382] [client 134.199.156.173:60522] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/server/php/"] [unique_id "ahME1Ifq_sTmmtTKm1U4HwAAAQw"]
[Sun May 24 22:01:56.546890 2026] [:error] [pid 11280:tid 11285] [client 134.199.156.173:60536] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QchQAAAEA"]
[Sun May 24 22:01:56.548055 2026] [:error] [pid 11280:tid 11304] [client 134.199.156.173:60534] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/js/jquery-file-upload/server/php/"] [unique_id "ahME1IRn5s7laoSxy1QchgAAAFM"]
[Sun May 24 22:01:56.597414 2026] [:error] [pid 11282:tid 11354] [client 134.199.156.173:60548] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-oyQAAAM4"]
[Sun May 24 22:01:56.610781 2026] [:error] [pid 11280:tid 11305] [client 134.199.156.173:60556] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QchwAAAFQ"]
[Sun May 24 22:01:56.640554 2026] [:error] [pid 11368:tid 11389] [client 134.199.156.173:60596] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/tinymce/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4IAAAARM"]
[Sun May 24 22:01:56.641475 2026] [:error] [pid 11282:tid 11344] [client 134.199.156.173:60580] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-oygAAAMQ"]
[Sun May 24 22:01:56.642608 2026] [:error] [pid 11280:tid 11303] [client 134.199.156.173:60572] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QciAAAAFI"]
[Sun May 24 22:01:56.643429 2026] [:error] [pid 11368:tid 11372] [client 134.199.156.173:60600] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/components/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4IQAAAQI"]
[Sun May 24 22:01:56.650848 2026] [:error] [pid 11280:tid 11302] [client 134.199.156.173:60616] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QciQAAAFE"]
[Sun May 24 22:01:56.651155 2026] [:error] [pid 11282:tid 11356] [client 134.199.156.173:60630] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ckeditor/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-oywAAANA"]
[Sun May 24 22:01:56.653077 2026] [:error] [pid 15835:tid 15854] [client 134.199.156.173:60640] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPm_QAAABE"]
[Sun May 24 22:01:56.656593 2026] [:error] [pid 15835:tid 15837] [client 134.199.156.173:60648] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPm_gAAAAA"]
[Sun May 24 22:01:56.675859 2026] [:error] [pid 11281:tid 11314] [client 134.199.156.173:60652] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/kcfinder/upload.php"] [unique_id "ahME1JKmC9taWvA91j6K9AAAAIE"]
[Sun May 24 22:01:56.683053 2026] [:error] [pid 11281:tid 11321] [client 134.199.156.173:60664] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib/kcfinder/upload.php"] [unique_id "ahME1JKmC9taWvA91j6K9QAAAIg"]
[Sun May 24 22:01:56.683301 2026] [:error] [pid 11281:tid 11327] [client 134.199.156.173:60656] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/tinymce/kcfinder/upload.php"] [unique_id "ahME1JKmC9taWvA91j6K9gAAAI4"]
[Sun May 24 22:01:56.685971 2026] [:error] [pid 11281:tid 11335] [client 134.199.156.173:60676] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/kcfinder/upload.php"] [unique_id "ahME1JKmC9taWvA91j6K9wAAAJY"]
[Sun May 24 22:01:56.686919 2026] [:error] [pid 11368:tid 11381] [client 134.199.156.173:60686] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/components/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4IgAAAQs"]
[Sun May 24 22:01:56.693017 2026] [:error] [pid 11280:tid 11287] [client 134.199.156.173:60700] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QciwAAAEI"]
[Sun May 24 22:01:56.693918 2026] [:error] [pid 11282:tid 11341] [client 134.199.156.173:60706] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ckeditor/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-ozQAAAME"]
[Sun May 24 22:01:56.694294 2026] [:error] [pid 11281:tid 11337] [client 134.199.156.173:60694] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libs/kcfinder/upload.php"] [unique_id "ahME1JKmC9taWvA91j6K-AAAAJg"]
[Sun May 24 22:01:56.694776 2026] [:error] [pid 11280:tid 11296] [client 134.199.156.173:60712] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QcjAAAAEs"]
[Sun May 24 22:01:56.699560 2026] [:error] [pid 11282:tid 11348] [client 134.199.156.173:60714] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-ozgAAAMg"]
[Sun May 24 22:01:56.701570 2026] [:error] [pid 11282:tid 11342] [client 134.199.156.173:60718] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core/scripts/wysiwyg/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-ozwAAAMI"]
[Sun May 24 22:01:56.705738 2026] [:error] [pid 11282:tid 11349] [client 134.199.156.173:60734] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core/scripts/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-o0AAAAMk"]
[Sun May 24 22:01:56.717537 2026] [:error] [pid 11282:tid 11364] [client 134.199.156.173:60748] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-o0QAAANg"]
[Sun May 24 22:01:56.724860 2026] [:error] [pid 11282:tid 11358] [client 134.199.156.173:60758] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-o0gAAANI"]
[Sun May 24 22:01:56.725756 2026] [:error] [pid 11282:tid 11363] [client 134.199.156.173:60766] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/tinymce/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-o0wAAANc"]
[Sun May 24 22:01:56.732028 2026] [:error] [pid 11282:tid 11340] [client 134.199.156.173:60774] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/components/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-o1AAAAMA"]
[Sun May 24 22:01:56.735675 2026] [:error] [pid 11368:tid 11392] [client 134.199.156.173:60782] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/js/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4IwAAARY"]
[Sun May 24 22:01:56.736863 2026] [:error] [pid 11368:tid 11376] [client 134.199.156.173:60792] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ckeditor/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4JAAAAQY"]
[Sun May 24 22:01:56.737604 2026] [:error] [pid 11280:tid 11289] [client 134.199.156.173:60798] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libs/kcfinder/upload.php"] [unique_id "ahME1IRn5s7laoSxy1QcjQAAAEQ"]
[Sun May 24 22:01:56.740411 2026] [:error] [pid 11368:tid 11388] [client 134.199.156.173:60810] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4JQAAARI"]
[Sun May 24 22:01:56.745168 2026] [:error] [pid 11368:tid 11373] [client 134.199.156.173:60812] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core/scripts/wysiwyg/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4JgAAAQM"]
[Sun May 24 22:01:56.750993 2026] [:error] [pid 11281:tid 11315] [client 134.199.156.173:60814] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core/scripts/kcfinder/upload.php"] [unique_id "ahME1JKmC9taWvA91j6K-QAAAII"]
[Sun May 24 22:01:56.760396 2026] [:error] [pid 11368:tid 11374] [client 134.199.156.173:60816] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4JwAAAQQ"]
[Sun May 24 22:01:56.780442 2026] [:error] [pid 11368:tid 11384] [client 134.199.156.173:60820] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/libs/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4KAAAAQ4"]
[Sun May 24 22:01:56.781814 2026] [:error] [pid 15835:tid 15849] [client 134.199.156.173:60836] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPm_wAAAAw"]
[Sun May 24 22:01:56.788066 2026] [:error] [pid 15835:tid 15846] [client 134.199.156.173:60852] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core/scripts/wysiwyg/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPnAAAAAAk"]
[Sun May 24 22:01:56.791884 2026] [:error] [pid 15835:tid 15857] [client 134.199.156.173:60858] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/core/scripts/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPnAQAAABQ"]
[Sun May 24 22:01:56.821887 2026] [:error] [pid 11282:tid 11350] [client 134.199.156.173:60864] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/webroot/js/kcfinder/upload.php"] [unique_id "ahME1O0bPyN3C7HZ1R-o1QAAAMo"]
[Sun May 24 22:01:56.823641 2026] [:error] [pid 15835:tid 15858] [client 134.199.156.173:60878] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPnAgAAABU"]
[Sun May 24 22:01:56.854014 2026] [:error] [pid 11368:tid 11380] [client 134.199.156.173:60892] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4KQAAAQo"]
[Sun May 24 22:01:56.858660 2026] [:error] [pid 11368:tid 11385] [client 134.199.156.173:60894] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4KgAAAQ8"]
[Sun May 24 22:01:56.863562 2026] [:error] [pid 11368:tid 11375] [client 134.199.156.173:60910] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/webroot/js/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4KwAAAQU"]
[Sun May 24 22:01:56.864773 2026] [:error] [pid 11368:tid 11394] [client 134.199.156.173:60924] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4LAAAARg"]
[Sun May 24 22:01:56.870181 2026] [:error] [pid 11368:tid 11378] [client 134.199.156.173:60932] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jquery/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4LQAAAQg"]
[Sun May 24 22:01:56.883410 2026] [:error] [pid 11368:tid 11390] [client 134.199.156.173:60944] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/ckeditor/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4LgAAARQ"]
[Sun May 24 22:01:56.888923 2026] [:error] [pid 11368:tid 11379] [client 134.199.156.173:60946] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/application/themes/admin/assets/js/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4LwAAAQk"]
[Sun May 24 22:01:56.898509 2026] [:error] [pid 11368:tid 11377] [client 134.199.156.173:60952] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4MAAAAQc"]
[Sun May 24 22:01:56.900368 2026] [:error] [pid 11368:tid 11371] [client 134.199.156.173:60958] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/webroot/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4MQAAAQE"]
[Sun May 24 22:01:56.901306 2026] [:error] [pid 11368:tid 11386] [client 134.199.156.173:60970] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4MgAAARA"]
[Sun May 24 22:01:56.904909 2026] [:error] [pid 11368:tid 11370] [client 134.199.156.173:60984] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/webroot/js/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4MwAAAQA"]
[Sun May 24 22:01:56.914580 2026] [:error] [pid 11368:tid 11391] [client 134.199.156.173:60986] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jquery/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4NAAAARU"]
[Sun May 24 22:01:56.929762 2026] [:error] [pid 11368:tid 11393] [client 134.199.156.173:60994] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/ckeditor/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4NQAAARc"]
[Sun May 24 22:01:56.931936 2026] [:error] [pid 11368:tid 11387] [client 134.199.156.173:32768] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/application/themes/admin/assets/js/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4NgAAARE"]
[Sun May 24 22:01:56.941244 2026] [:error] [pid 11368:tid 11383] [client 134.199.156.173:32780] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4NwAAAQ0"]
[Sun May 24 22:01:56.944928 2026] [:error] [pid 11368:tid 11382] [client 134.199.156.173:32790] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/webroot/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4OAAAAQw"]
[Sun May 24 22:01:56.946039 2026] [:error] [pid 15835:tid 15855] [client 134.199.156.173:32806] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/ckeditor/plugins/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPnAwAAABI"]
[Sun May 24 22:01:56.956578 2026] [:error] [pid 15835:tid 15848] [client 134.199.156.173:32816] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jquery/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPnBAAAAAs"]
[Sun May 24 22:01:56.972111 2026] [:error] [pid 11368:tid 11389] [client 134.199.156.173:32828] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/ckeditor/kcfinder/upload.php"] [unique_id "ahME1Ifq_sTmmtTKm1U4OQAAARM"]
[Sun May 24 22:01:56.974852 2026] [:error] [pid 15835:tid 15838] [client 134.199.156.173:32838] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/application/themes/admin/assets/js/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPnBQAAAAE"]
[Sun May 24 22:01:56.987745 2026] [:error] [pid 15835:tid 15847] [client 134.199.156.173:32842] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/app/webroot/kcfinder/upload.php"] [unique_id "ahME1GWbknYlUM9P0qPnBgAAAAo"]
[Sun May 24 22:01:57.087153 2026] [:error] [pid 15835:tid 15852] [client 134.199.156.173:32846] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/scripts/filemanager/dialog.php"] [unique_id "ahME1WWbknYlUM9P0qPnBwAAAA8"]
[Sun May 24 22:01:57.093450 2026] [:error] [pid 15835:tid 15860] [client 134.199.156.173:32854] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1WWbknYlUM9P0qPnCAAAABc"]
[Sun May 24 22:01:57.104541 2026] [:error] [pid 11368:tid 11372] [client 134.199.156.173:32856] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/js/kcfinder/upload.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4OgAAAQI"]
[Sun May 24 22:01:57.109657 2026] [:error] [pid 11368:tid 11381] [client 134.199.156.173:32872] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpformbuilder/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4OwAAAQs"]
[Sun May 24 22:01:57.113024 2026] [:error] [pid 11368:tid 11392] [client 134.199.156.173:32874] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4PAAAARY"]
[Sun May 24 22:01:57.117399 2026] [:error] [pid 15835:tid 15843] [client 134.199.156.173:32886] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/filemanager/dialog.php"] [unique_id "ahME1WWbknYlUM9P0qPnCQAAAAY"]
[Sun May 24 22:01:57.129773 2026] [:error] [pid 11368:tid 11376] [client 134.199.156.173:32912] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4PQAAAQY"]
[Sun May 24 22:01:57.130684 2026] [:error] [pid 11368:tid 11388] [client 134.199.156.173:32902] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/scripts/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4PgAAARI"]
[Sun May 24 22:01:57.139077 2026] [:error] [pid 11368:tid 11373] [client 134.199.156.173:32924] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4PwAAAQM"]
[Sun May 24 22:01:57.140900 2026] [:error] [pid 11368:tid 11374] [client 134.199.156.173:32940] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4QAAAAQQ"]
[Sun May 24 22:01:57.148859 2026] [:error] [pid 11282:tid 11353] [client 134.199.156.173:32942] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/js/kcfinder/upload.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o1gAAAM0"]
[Sun May 24 22:01:57.153185 2026] [:error] [pid 11282:tid 11346] [client 134.199.156.173:32950] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpformbuilder/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o1wAAAMY"]
[Sun May 24 22:01:57.153902 2026] [:error] [pid 11282:tid 11351] [client 134.199.156.173:32958] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/scripts/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o2AAAAMs"]
[Sun May 24 22:01:57.159161 2026] [:error] [pid 11282:tid 11343] [client 134.199.156.173:32980] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o2gAAAMM"]
[Sun May 24 22:01:57.160023 2026] [:error] [pid 11282:tid 11355] [client 134.199.156.173:32970] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o2QAAAM8"]
[Sun May 24 22:01:57.160239 2026] [:error] [pid 11282:tid 11360] [client 134.199.156.173:32994] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/core/kcfinder/upload.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o2wAAANQ"]
[Sun May 24 22:01:57.163282 2026] [:error] [pid 11368:tid 11384] [client 134.199.156.173:33006] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4QQAAAQ4"]
[Sun May 24 22:01:57.171048 2026] [:error] [pid 11368:tid 11380] [client 134.199.156.173:33010] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4QgAAAQo"]
[Sun May 24 22:01:57.178223 2026] [:error] [pid 11282:tid 11361] [client 134.199.156.173:33026] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/scripts/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o3AAAANU"]
[Sun May 24 22:01:57.178546 2026] [:error] [pid 11282:tid 11362] [client 134.199.156.173:33030] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o3QAAANY"]
[Sun May 24 22:01:57.182721 2026] [:error] [pid 11282:tid 11345] [client 134.199.156.173:33042] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o3gAAAMU"]
[Sun May 24 22:01:57.184243 2026] [:error] [pid 11282:tid 11352] [client 134.199.156.173:33056] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o3wAAAMw"]
[Sun May 24 22:01:57.190110 2026] [:error] [pid 11368:tid 11385] [client 134.199.156.173:33058] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/js/kcfinder/upload.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4QwAAAQ8"]
[Sun May 24 22:01:57.196560 2026] [:error] [pid 11282:tid 11357] [client 134.199.156.173:33072] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/phpformbuilder/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o4AAAANE"]
[Sun May 24 22:01:57.197620 2026] [:error] [pid 11282:tid 11354] [client 134.199.156.173:33076] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/scripts/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o4QAAAM4"]
[Sun May 24 22:01:57.200440 2026] [:error] [pid 11282:tid 11344] [client 134.199.156.173:33080] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o4gAAAMQ"]
[Sun May 24 22:01:57.202636 2026] [:error] [pid 11368:tid 11375] [client 134.199.156.173:33088] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4RAAAAQU"]
[Sun May 24 22:01:57.204557 2026] [:error] [pid 11368:tid 11394] [client 134.199.156.173:33100] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/core/kcfinder/upload.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4RQAAARg"]
[Sun May 24 22:01:57.204662 2026] [:error] [pid 11368:tid 11378] [client 134.199.156.173:33108] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4RgAAAQg"]
[Sun May 24 22:01:57.215145 2026] [:error] [pid 11368:tid 11390] [client 134.199.156.173:33110] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4RwAAARQ"]
[Sun May 24 22:01:57.220559 2026] [:error] [pid 11280:tid 11309] [client 134.199.156.173:33120] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/filemanager/dialog.php"] [unique_id "ahME1YRn5s7laoSxy1QcjgAAAFg"]
[Sun May 24 22:01:57.228126 2026] [:error] [pid 11368:tid 11379] [client 134.199.156.173:33124] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4SAAAAQk"]
[Sun May 24 22:01:57.245519 2026] [:error] [pid 11280:tid 11286] [client 134.199.156.173:33142] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/dialog.php"] [unique_id "ahME1YRn5s7laoSxy1QcjwAAAEE"]
[Sun May 24 22:01:57.248024 2026] [:error] [pid 11282:tid 11356] [client 134.199.156.173:33154] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/core/kcfinder/upload.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o4wAAANA"]
[Sun May 24 22:01:57.253007 2026] [:error] [pid 11280:tid 11297] [client 134.199.156.173:33126] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/scripts/filemanager/dialog.php"] [unique_id "ahME1YRn5s7laoSxy1QckAAAAEw"]
[Sun May 24 22:01:57.263632 2026] [:error] [pid 11280:tid 11290] [client 134.199.156.173:33162] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/asset/filemanager/dialog.php"] [unique_id "ahME1YRn5s7laoSxy1QckQAAAEU"]
[Sun May 24 22:01:57.291691 2026] [:error] [pid 11281:tid 11313] [client 134.199.156.173:33166] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1ZKmC9taWvA91j6K-wAAAIA"]
[Sun May 24 22:01:57.298779 2026] [:error] [pid 11282:tid 11341] [client 134.199.156.173:33182] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o5AAAAME"]
[Sun May 24 22:01:57.325731 2026] [:error] [pid 11282:tid 11348] [client 134.199.156.173:33194] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o5QAAAMg"]
[Sun May 24 22:01:57.329374 2026] [:error] [pid 11282:tid 11342] [client 134.199.156.173:33202] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/tinymce4/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o5gAAAMI"]
[Sun May 24 22:01:57.342569 2026] [:error] [pid 11368:tid 11377] [client 134.199.156.173:33206] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4SQAAAQc"]
[Sun May 24 22:01:57.343606 2026] [:error] [pid 11280:tid 11295] [client 134.199.156.173:33208] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinymce/filemanager/dialog.php"] [unique_id "ahME1YRn5s7laoSxy1QckgAAAEo"]
[Sun May 24 22:01:57.344588 2026] [:error] [pid 11282:tid 11349] [client 134.199.156.173:33224] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/scripts/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o5wAAAMk"]
[Sun May 24 22:01:57.347026 2026] [:error] [pid 11282:tid 11364] [client 134.199.156.173:33226] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o6AAAANg"]
[Sun May 24 22:01:57.355666 2026] [:error] [pid 11282:tid 11358] [client 134.199.156.173:33236] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o6QAAANI"]
[Sun May 24 22:01:57.360077 2026] [:error] [pid 11282:tid 11363] [client 134.199.156.173:33238] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o6gAAANc"]
[Sun May 24 22:01:57.372626 2026] [:error] [pid 11282:tid 11340] [client 134.199.156.173:33254] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o6wAAAMA"]
[Sun May 24 22:01:57.375482 2026] [:error] [pid 11282:tid 11359] [client 134.199.156.173:33260] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/tinymce4/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o7AAAANM"]
[Sun May 24 22:01:57.377022 2026] [:error] [pid 11282:tid 11347] [client 134.199.156.173:33270] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fileManager/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o7QAAAMc"]
[Sun May 24 22:01:57.385143 2026] [:error] [pid 11282:tid 11353] [client 134.199.156.173:33280] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o7gAAAM0"]
[Sun May 24 22:01:57.386247 2026] [:error] [pid 11282:tid 11346] [client 134.199.156.173:33302] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/scripts/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o7wAAAMY"]
[Sun May 24 22:01:57.386907 2026] [:error] [pid 11368:tid 11371] [client 134.199.156.173:33288] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinymce/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4SgAAAQE"]
[Sun May 24 22:01:57.391067 2026] [:error] [pid 11282:tid 11351] [client 134.199.156.173:33308] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/admin/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o8AAAAMs"]
[Sun May 24 22:01:57.393028 2026] [:error] [pid 11282:tid 11343] [client 134.199.156.173:33322] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/js/libraries/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o8QAAAMM"]
[Sun May 24 22:01:57.401267 2026] [:error] [pid 11282:tid 11355] [client 134.199.156.173:33334] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o8gAAAM8"]
[Sun May 24 22:01:57.403814 2026] [:error] [pid 11368:tid 11386] [client 134.199.156.173:33338] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4SwAAARA"]
[Sun May 24 22:01:57.409210 2026] [:error] [pid 11282:tid 11360] [client 134.199.156.173:33340] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o8wAAANQ"]
[Sun May 24 22:01:57.432625 2026] [:error] [pid 11282:tid 11361] [client 134.199.156.173:33352] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o9AAAANU"]
[Sun May 24 22:01:57.437613 2026] [:error] [pid 11282:tid 11362] [client 134.199.156.173:33364] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/tinymce4/plugins/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o9QAAANY"]
[Sun May 24 22:01:57.442514 2026] [:error] [pid 11368:tid 11370] [client 134.199.156.173:33374] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fileManager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4TAAAAQA"]
[Sun May 24 22:01:57.447752 2026] [:error] [pid 11282:tid 11352] [client 134.199.156.173:33384] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tinymce/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o9gAAAMw"]
[Sun May 24 22:01:57.448694 2026] [:error] [pid 11282:tid 11345] [client 134.199.156.173:33376] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/scripts/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o9wAAAMU"]
[Sun May 24 22:01:57.455112 2026] [:error] [pid 11282:tid 11357] [client 134.199.156.173:33388] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/tinymce/filemanager/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o-AAAANE"]
[Sun May 24 22:01:57.459627 2026] [:error] [pid 11282:tid 11354] [client 134.199.156.173:33398] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/js/libraries/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o-QAAAM4"]
[Sun May 24 22:01:57.463809 2026] [:error] [pid 11368:tid 11391] [client 134.199.156.173:33412] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4TQAAARU"]
[Sun May 24 22:01:57.464686 2026] [:error] [pid 11368:tid 11393] [client 134.199.156.173:33416] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/media/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4TgAAARc"]
[Sun May 24 22:01:57.476974 2026] [:error] [pid 11368:tid 11387] [client 134.199.156.173:33422] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4TwAAARE"]
[Sun May 24 22:01:57.484839 2026] [:error] [pid 11368:tid 11383] [client 134.199.156.173:33428] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/js/fileManager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4UAAAAQ0"]
[Sun May 24 22:01:57.497111 2026] [:error] [pid 11368:tid 11382] [client 134.199.156.173:33430] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/tinymce/filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4UQAAAQw"]
[Sun May 24 22:01:57.501829 2026] [:error] [pid 11368:tid 11389] [client 134.199.156.173:33434] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/js/libraries/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4UgAAARM"]
[Sun May 24 22:01:57.548570 2026] [:error] [pid 11368:tid 11372] [client 134.199.156.173:33446] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/public/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4UwAAAQI"]
[Sun May 24 22:01:57.560982 2026] [:error] [pid 11368:tid 11381] [client 134.199.156.173:33448] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resources/plugins/tiny_mce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4VAAAAQs"]
[Sun May 24 22:01:57.567871 2026] [:error] [pid 11282:tid 11344] [client 134.199.156.173:33462] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/tinymce/filemanager/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o-gAAAMQ"]
[Sun May 24 22:01:57.573616 2026] [:error] [pid 11282:tid 11356] [client 134.199.156.173:33472] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib/filemanager/dialog.php"] [unique_id "ahME1e0bPyN3C7HZ1R-o-wAAANA"]
[Sun May 24 22:01:57.575992 2026] [:error] [pid 11368:tid 11392] [client 134.199.156.173:33476] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/events/lib/external/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4VQAAARY"]
[Sun May 24 22:01:57.580197 2026] [:error] [pid 11368:tid 11376] [client 134.199.156.173:33480] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/editor/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4VgAAAQY"]
[Sun May 24 22:01:57.585168 2026] [:error] [pid 11368:tid 11388] [client 134.199.156.173:33482] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resources/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4VwAAARI"]
[Sun May 24 22:01:57.591178 2026] [:error] [pid 11368:tid 11373] [client 134.199.156.173:33492] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4WAAAAQM"]
[Sun May 24 22:01:57.634688 2026] [:error] [pid 11368:tid 11374] [client 134.199.156.173:33506] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resources/plugins/tiny_mce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4WQAAAQQ"]
[Sun May 24 22:01:57.647708 2026] [:error] [pid 11368:tid 11380] [client 134.199.156.173:33540] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/editor/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4WgAAAQo"]
[Sun May 24 22:01:57.648334 2026] [:error] [pid 11368:tid 11385] [client 134.199.156.173:33524] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/events/lib/external/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4WwAAAQ8"]
[Sun May 24 22:01:57.650426 2026] [:error] [pid 11368:tid 11375] [client 134.199.156.173:33520] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4XAAAAQU"]
[Sun May 24 22:01:57.660892 2026] [:error] [pid 11368:tid 11378] [client 134.199.156.173:33556] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4XQAAAQg"]
[Sun May 24 22:01:57.664031 2026] [:error] [pid 15835:tid 15839] [client 134.199.156.173:33554] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1WWbknYlUM9P0qPnCwAAAAI"]
[Sun May 24 22:01:57.665916 2026] [:error] [pid 11368:tid 11394] [client 134.199.156.173:33568] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resources/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4XgAAARg"]
[Sun May 24 22:01:57.678176 2026] [:error] [pid 11368:tid 11390] [client 134.199.156.173:33576] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resources/plugins/tiny_mce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4XwAAARQ"]
[Sun May 24 22:01:57.691009 2026] [:error] [pid 11368:tid 11379] [client 134.199.156.173:33592] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/events/lib/external/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4YAAAAQk"]
[Sun May 24 22:01:57.691331 2026] [:error] [pid 11368:tid 11377] [client 134.199.156.173:33590] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/editor/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4YQAAAQc"]
[Sun May 24 22:01:57.693976 2026] [:error] [pid 11368:tid 11371] [client 134.199.156.173:33602] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4YgAAAQE"]
[Sun May 24 22:01:57.704207 2026] [:error] [pid 11368:tid 11386] [client 134.199.156.173:33612] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/assets/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4YwAAARA"]
[Sun May 24 22:01:57.705780 2026] [:error] [pid 11368:tid 11370] [client 134.199.156.173:33618] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4ZAAAAQA"]
[Sun May 24 22:01:57.709831 2026] [:error] [pid 11368:tid 11391] [client 134.199.156.173:33628] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/resources/js/tinymce/plugins/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4ZQAAARU"]
[Sun May 24 22:01:57.751514 2026] [:error] [pid 11368:tid 11393] [client 134.199.156.173:33642] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4ZgAAARc"]
[Sun May 24 22:01:57.851802 2026] [:error] [pid 11368:tid 11387] [client 134.199.156.173:33648] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4ZwAAARE"]
[Sun May 24 22:01:57.863419 2026] [:error] [pid 11368:tid 11383] [client 134.199.156.173:33658] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4aAAAAQ0"]
[Sun May 24 22:01:57.870130 2026] [:error] [pid 11368:tid 11382] [client 134.199.156.173:33660] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4aQAAAQw"]
[Sun May 24 22:01:57.894674 2026] [:error] [pid 11368:tid 11389] [client 134.199.156.173:33672] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4agAAARM"]
[Sun May 24 22:01:57.905819 2026] [:error] [pid 11368:tid 11372] [client 134.199.156.173:33676] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4awAAAQI"]
[Sun May 24 22:01:57.911288 2026] [:error] [pid 11368:tid 11381] [client 134.199.156.173:33686] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4bAAAAQs"]
[Sun May 24 22:01:57.937820 2026] [:error] [pid 11368:tid 11392] [client 134.199.156.173:33688] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4bQAAARY"]
[Sun May 24 22:01:57.940049 2026] [:error] [pid 11368:tid 11376] [client 134.199.156.173:33694] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/vendor/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4bgAAAQY"]
[Sun May 24 22:01:57.950421 2026] [:error] [pid 11368:tid 11388] [client 134.199.156.173:33704] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4bwAAARI"]
[Sun May 24 22:01:57.954566 2026] [:error] [pid 11368:tid 11373] [client 134.199.156.173:33710] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/plugins/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4cAAAAQM"]
[Sun May 24 22:01:57.983533 2026] [:error] [pid 11368:tid 11374] [client 134.199.156.173:33722] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/vendor/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1Yfq_sTmmtTKm1U4cQAAAQQ"]
[Sun May 24 22:01:58.027660 2026] [:error] [pid 11368:tid 11380] [client 134.199.156.173:33730] [client 134.199.156.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cms/vendor/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahME1ofq_sTmmtTKm1U4cgAAAQo"]
[Sun May 24 23:45:38.496927 2026] [:error] [pid 15835:tid 15838] [client 43.164.0.96:39540] [client 43.164.0.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahMdImWbknYlUM9P0qMRZwAAAAE"]
[Mon May 25 02:06:43.029876 2026] [:error] [pid 11368:tid 11390] [client 20.9.45.132:17731] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Mon May 25 02:06:43.262953 2026] [:error] [pid 11368:tid 11393] [client 20.9.45.132:17731] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Mon May 25 02:06:43.648319 2026] [:error] [pid 11368:tid 11382] [client 20.9.45.132:17731] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Mon May 25 02:06:43.905604 2026] [:error] [pid 11368:tid 11379] [client 20.9.45.132:17731] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Mon May 25 02:06:44.343024 2026] [:error] [pid 11368:tid 11387] [client 20.9.45.132:17731] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Mon May 25 02:06:44.536417 2026] [:error] [pid 11368:tid 11389] [client 20.9.45.132:17731] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Mon May 25 02:06:44.727990 2026] [:error] [pid 11368:tid 11370] [client 20.9.45.132:17731] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Mon May 25 02:06:45.108571 2026] [:error] [pid 11368:tid 11381] [client 20.9.45.132:17731] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahM-NYfq_sTmmtTKm1WC6QAAAQs"]
[Mon May 25 02:06:46.136212 2026] [:error] [pid 11282:tid 11362] [client 20.9.45.132:7561] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahM-Nu0bPyN3C7HZ1R_jngAAANY"]
[Mon May 25 02:06:48.006806 2026] [:error] [pid 15835:tid 15848] [client 20.9.45.132:18057] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahM-OGWbknYlUM9P0qNPWgAAAAs"]
[Mon May 25 02:06:52.296745 2026] [:error] [pid 11368:tid 11371] [client 20.9.45.132:7601] [client 20.9.45.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahM-PIfq_sTmmtTKm1WC9QAAAQE"]
[Mon May 25 02:44:13.267797 2026] [:error] [pid 11280:tid 11297] [client 49.51.233.95:44976] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahNG_YRn5s7laoSxy1RPSgAAAEw"]
[Mon May 25 05:03:05.981865 2026] [:error] [pid 9302:tid 9307] [client 43.165.67.31:59816] [client 43.165.67.31] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahNniS1RaFfTSnDQnqFDCQAAAAA"]
[Mon May 25 06:50:33.047587 2026] [:error] [pid 9303:tid 9342] [client 106.54.62.156:34386] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahOAuX3bQScbssitjPQ9owAAAEg"]
[Mon May 25 07:09:27.118465 2026] [:error] [pid 9304:tid 9375] [client 104.28.214.122:20168] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/ms-themes.php"] [unique_id "ahOFJ-VEV2qpMC_1UzSWMAAAAI4"]
[Mon May 25 07:09:27.568132 2026] [:error] [pid 9304:tid 9370] [client 104.28.214.122:20240] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/chosen.php"] [unique_id "ahOFJ-VEV2qpMC_1UzSWPQAAAIk"]
[Mon May 25 07:09:28.019603 2026] [:error] [pid 9302:tid 9308] [client 104.28.214.122:20341] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "ahOFKC1RaFfTSnDQnqFbvAAAAAE"]
[Mon May 25 07:09:28.467488 2026] [:error] [pid 9398:tid 9418] [client 104.28.214.122:20418] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/flower.php"] [unique_id "ahOFKOhIu7KstzsCua-3awAAAM4"]
[Mon May 25 07:09:31.943296 2026] [:error] [pid 9398:tid 9402] [client 104.28.214.122:20062] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/gifclass.php"] [unique_id "ahOFK-hIu7KstzsCua-3gQAAAMI"]
[Mon May 25 07:09:33.400383 2026] [:error] [pid 9304:tid 9382] [client 104.28.246.122:55394] [client 104.28.246.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "rejuva.au"] [uri "/bless.php"] [unique_id "ahOFLeVEV2qpMC_1UzSWdAAAAJU"]
[Mon May 25 07:50:37.302640 2026] [:error] [pid 62426:tid 62453] [client 43.153.135.208:49152] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahOOzUj3D3Mo8ANpTRBsmQAAABc"]
[Mon May 25 10:05:04.700426 2026] [:error] [pid 62427:tid 62475] [client 43.134.100.210:47662] [client 43.134.100.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahOuUPMUa83fc4GDyBwQcAAAAVI"]
[Mon May 25 13:27:29.355372 2026] [:error] [pid 62515:tid 62533] [client 43.156.156.96:40610] [client 43.156.156.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahPdwRig0_XsOwmnrv-6FwAAANA"]
[Mon May 25 16:50:48.141545 2026] [:error] [pid 62427:tid 62474] [client 139.155.134.17:37748] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahQNaPMUa83fc4GDyBxiVgAAAVE"]
[Mon May 25 22:42:12.650298 2026] [:error] [pid 62515:tid 62522] [client 43.159.139.164:36986] [client 43.159.139.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahRfxBig0_XsOwmnrv9htwAAAMU"]
[Mon May 25 22:43:08.570945 2026] [:error] [pid 62426:tid 62432] [client 82.156.34.74:45168] [client 82.156.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahRf_Ej3D3Mo8ANpTRAqbgAAAAI"]
[Tue May 26 00:03:25.057699 2026] [:error] [pid 3698:tid 3722] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue May 26 00:03:25.267712 2026] [:error] [pid 3698:tid 3701] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/sx_pms.php
[Tue May 26 00:03:25.477856 2026] [:error] [pid 3698:tid 3708] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-info.php
[Tue May 26 00:03:26.562400 2026] [:error] [pid 3698:tid 3708] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-test.php
[Tue May 26 00:03:26.783794 2026] [:error] [pid 3698:tid 3723] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/asd67.php
[Tue May 26 00:03:27.014287 2026] [:error] [pid 3698:tid 3711] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/Cap.php
[Tue May 26 00:03:27.265609 2026] [:error] [pid 3698:tid 3705] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/like.php
[Tue May 26 00:03:28.202204 2026] [:error] [pid 3698:tid 3702] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/we.php
[Tue May 26 00:03:28.411678 2026] [:error] [pid 3698:tid 3704] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/wp.php
[Tue May 26 00:03:28.643719 2026] [:error] [pid 3698:tid 3720] [client 20.151.106.7:65031] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-indx.php
[Tue May 26 00:03:28.849721 2026] [:error] [pid 3698:tid 3706] [client 20.151.106.7:65031] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "ahRy0AtZBEwA4fyFLKMSzAAAAQY"]
[Tue May 26 00:03:30.463461 2026] [:error] [pid 62427:tid 62465] [client 20.151.106.7:64340] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "ahRy0vMUa83fc4GDyByWywAAAUg"]
[Tue May 26 00:03:32.368838 2026] [:error] [pid 62515:tid 62536] [client 20.151.106.7:65000] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "ahRy1Big0_XsOwmnrv95NAAAANM"]
[Tue May 26 00:03:34.670406 2026] [:error] [pid 62428:tid 62492] [client 20.151.106.7:65039] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoo.php"] [unique_id "ahRy1pNosGBa7mui3VSICwAAAIg"]
[Tue May 26 00:03:38.627121 2026] [:error] [pid 62427:tid 62471] [client 20.151.106.7:65085] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-spm.php"] [unique_id "ahRy2vMUa83fc4GDyByW0AAAAU4"]
[Tue May 26 00:03:40.154677 2026] [:error] [pid 62515:tid 62534] [client 20.151.106.7:64962] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-spm.php"] [unique_id "ahRy3Big0_XsOwmnrv95PQAAANE"]
[Tue May 26 00:03:42.941960 2026] [:error] [pid 62515:tid 62520] [client 20.151.106.7:64999] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-spm.php"] [unique_id "ahRy3hig0_XsOwmnrv95QgAAAMM"]
[Tue May 26 00:03:44.807869 2026] [:error] [pid 53791:tid 53796] [client 20.151.106.7:65014] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-spm.php"] [unique_id "ahRy4CCRhhNTD40Nf1VCtgAAAYM"]
[Tue May 26 00:03:45.919484 2026] [:error] [pid 53791:tid 53799] [client 20.151.106.7:65060] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "ahRy4SCRhhNTD40Nf1VCtwAAAYY"]
[Tue May 26 00:03:47.593874 2026] [:error] [pid 62426:tid 62440] [client 20.151.106.7:64995] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "ahRy40j3D3Mo8ANpTRBILAAAAAo"]
[Tue May 26 00:03:50.511476 2026] [:error] [pid 62426:tid 62438] [client 20.151.106.7:64967] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "ahRy5kj3D3Mo8ANpTRBILwAAAAg"]
[Tue May 26 00:03:51.380098 2026] [:error] [pid 62426:tid 62442] [client 20.151.106.7:65047] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-link-snpm.php"] [unique_id "ahRy50j3D3Mo8ANpTRBIMgAAAAw"]
[Tue May 26 00:03:52.811825 2026] [:error] [pid 62426:tid 62449] [client 20.151.106.7:65065] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "ahRy6Ej3D3Mo8ANpTRBINgAAABM"]
[Tue May 26 00:03:54.486074 2026] [:error] [pid 62427:tid 62479] [client 20.151.106.7:65066] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "ahRy6vMUa83fc4GDyByW1AAAAVY"]
[Tue May 26 00:03:55.249629 2026] [:error] [pid 62426:tid 62439] [client 20.151.106.7:65035] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "ahRy60j3D3Mo8ANpTRBIPwAAAAk"]
[Tue May 26 00:03:56.995720 2026] [:error] [pid 62428:tid 62499] [client 20.151.106.7:64992] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xminie.php"] [unique_id "ahRy7JNosGBa7mui3VSIJQAAAI8"]
[Tue May 26 00:03:57.833225 2026] [:error] [pid 62428:tid 62487] [client 20.151.106.7:65053] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahRy7ZNosGBa7mui3VSIKwAAAIM"]
[Tue May 26 00:03:59.041711 2026] [:error] [pid 62515:tid 62523] [client 20.151.106.7:64314] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahRy7xig0_XsOwmnrv95XAAAAMY"]
[Tue May 26 00:04:01.711577 2026] [:error] [pid 53791:tid 53795] [client 20.151.106.7:65070] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahRy8SCRhhNTD40Nf1VCzQAAAYI"]
[Tue May 26 00:04:04.634885 2026] [:error] [pid 53791:tid 53816] [client 20.151.106.7:64990] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahRy9CCRhhNTD40Nf1VC1wAAAZc"]
[Tue May 26 00:04:06.713302 2026] [:error] [pid 62428:tid 62506] [client 20.151.106.7:65007] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "ahRy9pNosGBa7mui3VSINgAAAJY"]
[Tue May 26 00:04:08.492614 2026] [:error] [pid 3698:tid 3715] [client 20.151.106.7:64983] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "ahRy-AtZBEwA4fyFLKMS5wAAAQ8"]
[Tue May 26 00:04:09.154286 2026] [:error] [pid 53791:tid 53794] [client 20.151.106.7:65071] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "ahRy-SCRhhNTD40Nf1VC5QAAAYE"]
[Tue May 26 00:04:10.931890 2026] [:error] [pid 62426:tid 62433] [client 20.151.106.7:65019] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "ahRy-kj3D3Mo8ANpTRBIWwAAAAM"]
[Tue May 26 00:04:12.358742 2026] [:error] [pid 62428:tid 62496] [client 20.151.106.7:64332] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahRy_JNosGBa7mui3VSIPAAAAIw"]
[Tue May 26 00:04:15.583175 2026] [:error] [pid 53791:tid 53814] [client 20.151.106.7:64330] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahRy_yCRhhNTD40Nf1VC7wAAAZU"]
[Tue May 26 00:04:17.810351 2026] [:error] [pid 3698:tid 3704] [client 20.151.106.7:64352] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahRzAQtZBEwA4fyFLKMS7wAAAQQ"]
[Tue May 26 00:04:20.683692 2026] [:error] [pid 62428:tid 62491] [client 20.151.106.7:65068] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/drykl.php"] [unique_id "ahRzBJNosGBa7mui3VSIQwAAAIc"]
[Tue May 26 00:04:22.387455 2026] [:error] [pid 3698:tid 3719] [client 20.151.106.7:64256] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ahRzBgtZBEwA4fyFLKMS9AAAARM"]
[Tue May 26 00:04:23.633813 2026] [:error] [pid 53791:tid 53814] [client 20.151.106.7:65082] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ahRzByCRhhNTD40Nf1VDAgAAAZU"]
[Tue May 26 00:04:25.069780 2026] [:error] [pid 3698:tid 3700] [client 20.151.106.7:64988] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ahRzCQtZBEwA4fyFLKMS-AAAAQA"]
[Tue May 26 00:04:26.122852 2026] [:error] [pid 62515:tid 62520] [client 20.151.106.7:65043] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ahRzChig0_XsOwmnrv95dwAAAMM"]
[Tue May 26 00:04:27.843163 2026] [:error] [pid 62722:tid 62741] [client 20.151.106.7:64998] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/11.php"] [unique_id "ahRzC6M6ssnLWYf6CVBm7gAAAFE"]
[Tue May 26 00:04:29.663322 2026] [:error] [pid 62426:tid 62434] [client 20.151.106.7:64989] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Tue May 26 00:04:29.887455 2026] [:error] [pid 62426:tid 62432] [client 20.151.106.7:64989] File does not exist: /usr/local/apache/htdocs/suspended-page/77.php
[Tue May 26 00:04:30.098482 2026] [:error] [pid 62426:tid 62450] [client 20.151.106.7:64989] File does not exist: /usr/local/apache/htdocs/suspended-page/x402.php
[Tue May 26 00:04:30.309545 2026] [:error] [pid 62426:tid 62433] [client 20.151.106.7:64989] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue May 26 00:04:30.544569 2026] [:error] [pid 62426:tid 62442] [client 20.151.106.7:64989] File does not exist: /usr/local/apache/htdocs/suspended-page/1.php
[Tue May 26 00:04:30.766729 2026] [:error] [pid 62426:tid 62446] [client 20.151.106.7:64989] [client 20.151.106.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "rejuva.au"] [uri "/tiny.php"] [unique_id "ahRzDkj3D3Mo8ANpTRBIaQAAABA"]
[Tue May 26 00:04:32.677772 2026] [:error] [pid 62515:tid 62539] [client 20.151.106.7:64322] File does not exist: /usr/local/apache/htdocs/suspended-page/w.php
[Tue May 26 00:04:33.094611 2026] [:error] [pid 62515:tid 62517] [client 20.151.106.7:64322] File does not exist: /usr/local/apache/htdocs/suspended-page/test1.php
[Tue May 26 00:04:33.745487 2026] [:error] [pid 62515:tid 62522] [client 20.151.106.7:64322] File does not exist: /usr/local/apache/htdocs/suspended-page/tires.php
[Tue May 26 00:04:33.993246 2026] [:error] [pid 62515:tid 62539] [client 20.151.106.7:64322] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue May 26 00:04:34.207416 2026] [:error] [pid 62515:tid 62532] [client 20.151.106.7:64322] File does not exist: /usr/local/apache/htdocs/suspended-page/d.php
[Tue May 26 00:04:34.445576 2026] [:error] [pid 62515:tid 62533] [client 20.151.106.7:64322] File does not exist: /usr/local/apache/htdocs/suspended-page/cu.php
[Tue May 26 00:04:34.669662 2026] [:error] [pid 62515:tid 62526] [client 20.151.106.7:64322] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "ahRzEhig0_XsOwmnrv95jwAAAMk"]
[Tue May 26 00:04:36.122417 2026] [:error] [pid 53791:tid 53800] [client 20.151.106.7:64973] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "ahRzFCCRhhNTD40Nf1VDCQAAAYc"]
[Tue May 26 00:04:40.268623 2026] [:error] [pid 62427:tid 62480] [client 20.151.106.7:64993] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "ahRzGPMUa83fc4GDyByW8QAAAVc"]
[Tue May 26 00:04:41.942914 2026] [:error] [pid 62428:tid 62508] [client 20.151.106.7:65017] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fone1.php"] [unique_id "ahRzGZNosGBa7mui3VSISwAAAJg"]
[Tue May 26 00:04:45.998139 2026] [:error] [pid 62722:tid 62737] [client 20.151.106.7:65078] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "ahRzHaM6ssnLWYf6CVBm9AAAAE0"]
[Tue May 26 00:04:49.404017 2026] [:error] [pid 62515:tid 62532] [client 20.151.106.7:65048] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "ahRzIRig0_XsOwmnrv95lAAAAM8"]
[Tue May 26 00:04:53.492855 2026] [:error] [pid 62426:tid 62435] [client 20.151.106.7:65004] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "ahRzJUj3D3Mo8ANpTRBIiQAAAAU"]
[Tue May 26 00:04:58.224987 2026] [:error] [pid 62427:tid 62476] [client 20.151.106.7:65003] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sallu.php"] [unique_id "ahRzKvMUa83fc4GDyByW9gAAAVM"]
[Tue May 26 00:05:01.935017 2026] [:error] [pid 62722:tid 62747] [client 20.151.106.7:65016] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ahRzLaM6ssnLWYf6CVBm9QAAAFc"]
[Tue May 26 00:05:03.765577 2026] [:error] [pid 3698:tid 3714] [client 20.151.106.7:65005] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ahRzLwtZBEwA4fyFLKMTAAAAAQ4"]
[Tue May 26 00:05:06.745060 2026] [:error] [pid 62722:tid 62730] [client 20.151.106.7:65010] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ahRzMqM6ssnLWYf6CVBm-AAAAEY"]
[Tue May 26 00:05:09.114322 2026] [:error] [pid 3698:tid 3703] [client 20.151.106.7:64359] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ng.php"] [unique_id "ahRzNQtZBEwA4fyFLKMTAwAAAQM"]
[Tue May 26 00:05:10.645065 2026] [:error] [pid 3698:tid 3724] [client 20.151.106.7:65067] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "ahRzNgtZBEwA4fyFLKMTBQAAARg"]
[Tue May 26 00:05:13.255420 2026] [:error] [pid 53791:tid 53801] [client 20.151.106.7:64335] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "ahRzOSCRhhNTD40Nf1VDSgAAAYg"]
[Tue May 26 00:05:19.106306 2026] [:error] [pid 62515:tid 62520] [client 20.151.106.7:65029] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "ahRzPxig0_XsOwmnrv95uwAAAMM"]
[Tue May 26 00:05:22.478008 2026] [:error] [pid 3698:tid 3716] [client 20.151.106.7:65030] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/link.php"] [unique_id "ahRzQgtZBEwA4fyFLKMTDAAAARA"]
[Tue May 26 00:05:25.473423 2026] [:error] [pid 53791:tid 53799] [client 20.151.106.7:65001] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "ahRzRSCRhhNTD40Nf1VDUAAAAYY"]
[Tue May 26 00:05:27.412859 2026] [:error] [pid 53791:tid 53817] [client 20.151.106.7:64344] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "ahRzRyCRhhNTD40Nf1VDUQAAAZg"]
[Tue May 26 00:05:28.469458 2026] [:error] [pid 62428:tid 62499] [client 20.151.106.7:64370] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "ahRzSJNosGBa7mui3VSIYwAAAI8"]
[Tue May 26 00:05:29.809225 2026] [:error] [pid 62427:tid 62461] [client 20.151.106.7:64339] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xxx.php"] [unique_id "ahRzSfMUa83fc4GDyByXFQAAAUQ"]
[Tue May 26 00:05:30.329579 2026] [:error] [pid 53791:tid 53793] [client 20.151.106.7:63570] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahRzSiCRhhNTD40Nf1VDUgAAAYA"]
[Tue May 26 00:05:31.152689 2026] [:error] [pid 62428:tid 62495] [client 20.151.106.7:65024] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahRzS5NosGBa7mui3VSIZAAAAIs"]
[Tue May 26 00:05:31.686040 2026] [:error] [pid 62515:tid 62540] [client 20.151.106.7:64965] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahRzSxig0_XsOwmnrv95wwAAANc"]
[Tue May 26 00:05:32.425824 2026] [:error] [pid 62427:tid 62477] [client 20.151.106.7:64334] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahRzTPMUa83fc4GDyByXGQAAAVQ"]
[Tue May 26 00:05:33.015651 2026] [:error] [pid 62515:tid 62526] [client 20.151.106.7:64320] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahRzTRig0_XsOwmnrv95xQAAAMk"]
[Tue May 26 00:05:34.189187 2026] [:error] [pid 62515:tid 62518] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/edit.php
[Tue May 26 00:05:34.412428 2026] [:error] [pid 62515:tid 62521] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/pp.php
[Tue May 26 00:05:34.628616 2026] [:error] [pid 62515:tid 62536] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/one.php
[Tue May 26 00:05:34.854670 2026] [:error] [pid 62515:tid 62524] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Tue May 26 00:05:35.073058 2026] [:error] [pid 62515:tid 62538] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/a7.php
[Tue May 26 00:05:35.376951 2026] [:error] [pid 62515:tid 62519] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/roksad1.php
[Tue May 26 00:05:35.593115 2026] [:error] [pid 62515:tid 62539] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/axe.php
[Tue May 26 00:05:35.809891 2026] [:error] [pid 62515:tid 62535] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/de.php
[Tue May 26 00:05:36.050673 2026] [:error] [pid 62515:tid 62540] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/aa.php
[Tue May 26 00:05:36.266625 2026] [:error] [pid 62515:tid 62532] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/100.php
[Tue May 26 00:05:36.502908 2026] [:error] [pid 62515:tid 62534] [client 20.151.106.7:64324] File does not exist: /usr/local/apache/htdocs/suspended-page/f5.php
[Tue May 26 00:05:36.724545 2026] [:error] [pid 62515:tid 62533] [client 20.151.106.7:64324] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/view.php"] [unique_id "ahRzUBig0_XsOwmnrv952gAAANA"]
[Tue May 26 00:05:37.846907 2026] [:error] [pid 3698:tid 3705] [client 20.151.106.7:65013] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/view.php"] [unique_id "ahRzUQtZBEwA4fyFLKMTEQAAAQU"]
[Tue May 26 00:05:39.009394 2026] [:error] [pid 53791:tid 53801] [client 20.151.106.7:64326] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/view.php"] [unique_id "ahRzUyCRhhNTD40Nf1VDVwAAAYg"]
[Tue May 26 00:05:40.438338 2026] [:error] [pid 62722:tid 62731] [client 20.151.106.7:64331] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/view.php"] [unique_id "ahRzVKM6ssnLWYf6CVBnAwAAAEc"]
[Tue May 26 00:05:43.952472 2026] [:error] [pid 62722:tid 62728] [client 20.151.106.7:65073] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "ahRzV6M6ssnLWYf6CVBnDgAAAEQ"]
[Tue May 26 00:05:48.767901 2026] [:error] [pid 53791:tid 53805] [client 20.151.106.7:65087] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "ahRzXCCRhhNTD40Nf1VDXwAAAYw"]
[Tue May 26 00:05:52.784763 2026] [:error] [pid 62426:tid 62449] [client 20.151.106.7:64986] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "ahRzYEj3D3Mo8ANpTRBIogAAABM"]
[Tue May 26 00:05:54.850529 2026] [:error] [pid 62426:tid 62446] [client 20.151.106.7:64374] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bc.php"] [unique_id "ahRzYkj3D3Mo8ANpTRBIpAAAABA"]
[Tue May 26 00:05:55.860123 2026] [:error] [pid 62426:tid 62454] [client 20.151.106.7:65061] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "ahRzY0j3D3Mo8ANpTRBIqAAAABg"]
[Tue May 26 00:05:57.834620 2026] [:error] [pid 53791:tid 53795] [client 20.151.106.7:64984] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "ahRzZSCRhhNTD40Nf1VDcgAAAYI"]
[Tue May 26 00:06:00.758461 2026] [:error] [pid 62427:tid 62465] [client 20.151.106.7:64380] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "ahRzaPMUa83fc4GDyByXLQAAAUg"]
[Tue May 26 00:06:03.519518 2026] [:error] [pid 62515:tid 62523] [client 20.151.106.7:65041] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/tx79.php"] [unique_id "ahRzaxig0_XsOwmnrv96BwAAAMY"]
[Tue May 26 00:06:04.950201 2026] [:error] [pid 62427:tid 62477] [client 20.151.106.7:65059] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "ahRzbPMUa83fc4GDyByXMwAAAVQ"]
[Tue May 26 00:06:06.585454 2026] [:error] [pid 62722:tid 62743] [client 20.151.106.7:65080] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "ahRzbqM6ssnLWYf6CVBnGQAAAFM"]
[Tue May 26 00:06:07.441767 2026] [:error] [pid 62515:tid 62518] [client 20.151.106.7:64985] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "ahRzbxig0_XsOwmnrv96CAAAAME"]
[Tue May 26 00:06:08.262914 2026] [:error] [pid 62515:tid 62530] [client 20.151.106.7:64981] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/moshou.php"] [unique_id "ahRzcBig0_XsOwmnrv96CQAAAM0"]
[Tue May 26 00:06:16.619481 2026] [:error] [pid 62427:tid 62481] [client 20.151.106.7:64257] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ahRzePMUa83fc4GDyByXPAAAAVg"]
[Tue May 26 00:06:19.018924 2026] [:error] [pid 62426:tid 62443] [client 20.151.106.7:65055] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ahRze0j3D3Mo8ANpTRBI4gAAAA0"]
[Tue May 26 00:06:21.284483 2026] [:error] [pid 62426:tid 62439] [client 20.151.106.7:65052] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/lib.php"] [unique_id "ahRzfUj3D3Mo8ANpTRBI6wAAAAk"]
[Tue May 26 00:06:24.146783 2026] [:error] [pid 62722:tid 62730] [client 20.151.106.7:64969] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ahRzgKM6ssnLWYf6CVBnJQAAAEY"]
[Tue May 26 00:06:26.401452 2026] [:error] [pid 62428:tid 62503] [client 20.151.106.7:65002] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ahRzgpNosGBa7mui3VSIgAAAAJM"]
[Tue May 26 00:06:27.966880 2026] [:error] [pid 62426:tid 62430] [client 20.151.106.7:65009] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ahRzg0j3D3Mo8ANpTRBJBAAAAAA"]
[Tue May 26 00:06:29.018640 2026] [:error] [pid 62426:tid 62451] [client 20.151.106.7:64261] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/zoper1.php"] [unique_id "ahRzhUj3D3Mo8ANpTRBJBwAAABU"]
[Tue May 26 00:06:31.631896 2026] [:error] [pid 62426:tid 62433] [client 20.151.106.7:64325] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/19.php"] [unique_id "ahRzh0j3D3Mo8ANpTRBJEAAAAAM"]
[Tue May 26 00:06:33.942607 2026] [:error] [pid 62426:tid 62450] [client 20.151.106.7:65022] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/19.php"] [unique_id "ahRziUj3D3Mo8ANpTRBJFAAAABQ"]
[Tue May 26 00:06:38.976672 2026] [:error] [pid 62426:tid 62432] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/19.php
[Tue May 26 00:06:39.187162 2026] [:error] [pid 62426:tid 62438] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/geforce.php
[Tue May 26 00:06:39.398278 2026] [:error] [pid 62426:tid 62449] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/dostshell.php
[Tue May 26 00:06:39.638276 2026] [:error] [pid 62426:tid 62435] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/doc.php
[Tue May 26 00:06:39.850711 2026] [:error] [pid 62426:tid 62444] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/mar.php
[Tue May 26 00:06:41.430948 2026] [:error] [pid 62426:tid 62431] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/casp1.php
[Tue May 26 00:06:41.647769 2026] [:error] [pid 62426:tid 62450] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/a1.php
[Tue May 26 00:06:41.869614 2026] [:error] [pid 62426:tid 62452] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue May 26 00:06:42.080508 2026] [:error] [pid 62426:tid 62432] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/8.php
[Tue May 26 00:06:42.291333 2026] [:error] [pid 62426:tid 62438] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/xltt.php
[Tue May 26 00:06:42.512188 2026] [:error] [pid 62426:tid 62435] [client 20.151.106.7:65034] File does not exist: /usr/local/apache/htdocs/suspended-page/cilus.php
[Tue May 26 00:06:42.719467 2026] [:error] [pid 62426:tid 62440] [client 20.151.106.7:65034] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "ahRzkkj3D3Mo8ANpTRBJNwAAAAo"]
[Tue May 26 00:06:44.943350 2026] [:error] [pid 62515:tid 62529] [client 20.151.106.7:64316] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "ahRzlBig0_XsOwmnrv96QAAAAMw"]
[Tue May 26 00:06:49.013758 2026] [:error] [pid 62427:tid 62474] [client 20.151.106.7:65075] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "ahRzmfMUa83fc4GDyByXUAAAAVE"]
[Tue May 26 00:06:49.951682 2026] [:error] [pid 62426:tid 62431] [client 20.151.106.7:65083] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/press.php"] [unique_id "ahRzmUj3D3Mo8ANpTRBJRgAAAAE"]
[Tue May 26 00:06:51.561683 2026] [:error] [pid 62428:tid 62487] [client 20.151.106.7:64354] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "ahRzm5NosGBa7mui3VSInQAAAIM"]
[Tue May 26 00:06:52.818065 2026] [:error] [pid 62428:tid 62503] [client 20.151.106.7:64341] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "ahRznJNosGBa7mui3VSIpAAAAJM"]
[Tue May 26 00:06:54.278662 2026] [:error] [pid 62428:tid 62508] [client 20.151.106.7:65064] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "ahRznpNosGBa7mui3VSIqwAAAJg"]
[Tue May 26 00:06:56.784808 2026] [:error] [pid 62426:tid 62448] [client 20.151.106.7:64356] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file6.php"] [unique_id "ahRzoEj3D3Mo8ANpTRBJXwAAABI"]
[Tue May 26 00:06:59.287906 2026] [:error] [pid 62515:tid 62541] [client 20.151.106.7:65086] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "ahRzoxig0_XsOwmnrv96VwAAANg"]
[Tue May 26 00:07:00.954740 2026] [:error] [pid 62428:tid 62508] [client 20.151.106.7:65002] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "ahRzpJNosGBa7mui3VSIrwAAAJg"]
[Tue May 26 00:07:02.999575 2026] [:error] [pid 53791:tid 53816] [client 20.151.106.7:64265] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "ahRzpiCRhhNTD40Nf1VDvAAAAZc"]
[Tue May 26 00:07:07.654577 2026] [:error] [pid 62426:tid 62451] [client 20.151.106.7:64306] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ss.php"] [unique_id "ahRzq0j3D3Mo8ANpTRBJqAAAABU"]
[Tue May 26 00:07:12.022085 2026] [:error] [pid 62426:tid 62449] [client 20.151.106.7:64291] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "ahRzsEj3D3Mo8ANpTRBJvQAAABM"]
[Tue May 26 00:07:15.149330 2026] [:error] [pid 62428:tid 62495] [client 20.151.106.7:64960] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "ahRzs5NosGBa7mui3VSIuQAAAIs"]
[Tue May 26 00:07:17.002500 2026] [:error] [pid 62428:tid 62492] [client 20.151.106.7:65049] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "ahRztZNosGBa7mui3VSIwgAAAIg"]
[Tue May 26 00:07:18.325854 2026] [:error] [pid 62515:tid 62537] [client 20.151.106.7:64281] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/options.php"] [unique_id "ahRzthig0_XsOwmnrv96awAAANQ"]
[Tue May 26 00:07:20.527432 2026] [:error] [pid 62515:tid 62531] [client 20.151.106.7:65046] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/min.php"] [unique_id "ahRzuBig0_XsOwmnrv96cgAAAM4"]
[Tue May 26 00:07:21.617934 2026] [:error] [pid 62515:tid 62538] [client 20.151.106.7:64297] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/min.php"] [unique_id "ahRzuRig0_XsOwmnrv96dAAAANU"]
[Tue May 26 00:07:22.338874 2026] [:error] [pid 62515:tid 62524] [client 20.151.106.7:64964] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/min.php"] [unique_id "ahRzuhig0_XsOwmnrv96dQAAAMc"]
[Tue May 26 00:07:23.338178 2026] [:error] [pid 62428:tid 62487] [client 20.151.106.7:64264] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/min.php"] [unique_id "ahRzu5NosGBa7mui3VSIzgAAAIM"]
[Tue May 26 00:07:24.746736 2026] [:error] [pid 62515:tid 62527] [client 20.151.106.7:64301] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "ahRzvBig0_XsOwmnrv96ewAAAMo"]
[Tue May 26 00:07:26.008811 2026] [:error] [pid 53791:tid 53806] [client 20.151.106.7:65051] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "ahRzviCRhhNTD40Nf1VD2QAAAY0"]
[Tue May 26 00:07:27.544601 2026] [:error] [pid 62426:tid 62454] [client 20.151.106.7:65058] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "ahRzv0j3D3Mo8ANpTRBJ1AAAABg"]
[Tue May 26 00:07:28.542183 2026] [:error] [pid 62428:tid 62484] [client 20.151.106.7:63589] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/img.php"] [unique_id "ahRzwJNosGBa7mui3VSI0QAAAIA"]
[Tue May 26 00:07:29.325794 2026] [:error] [pid 62426:tid 62442] [client 20.151.106.7:64296] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "ahRzwUj3D3Mo8ANpTRBJ3AAAAAw"]
[Tue May 26 00:07:30.513772 2026] [:error] [pid 62426:tid 62435] [client 20.151.106.7:65006] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "ahRzwkj3D3Mo8ANpTRBJ4QAAAAU"]
[Tue May 26 00:07:31.634099 2026] [:error] [pid 62426:tid 62445] [client 20.151.106.7:65037] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "ahRzw0j3D3Mo8ANpTRBJ4wAAAA8"]
[Tue May 26 00:07:32.957552 2026] [:error] [pid 62515:tid 62527] [client 20.151.106.7:65008] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/7.php"] [unique_id "ahRzxBig0_XsOwmnrv96lgAAAMo"]
[Tue May 26 00:07:34.700560 2026] [:error] [pid 62426:tid 62454] [client 20.151.106.7:65020] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ahRzxkj3D3Mo8ANpTRBJ7wAAABg"]
[Tue May 26 00:07:37.125690 2026] [:error] [pid 62426:tid 62433] [client 20.151.106.7:65056] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ahRzyUj3D3Mo8ANpTRBJ-QAAAAM"]
[Tue May 26 00:07:38.996725 2026] [:error] [pid 62428:tid 62505] [client 20.151.106.7:64346] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ahRzypNosGBa7mui3VSI3gAAAJU"]
[Tue May 26 00:07:41.278484 2026] [:error] [pid 62428:tid 62497] [client 20.151.106.7:64260] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ggb.php"] [unique_id "ahRzzZNosGBa7mui3VSI4wAAAI0"]
[Tue May 26 00:07:44.350917 2026] [:error] [pid 3698:tid 3718] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/xxa.php
[Tue May 26 00:07:44.564380 2026] [:error] [pid 3698:tid 3711] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/aj11.php
[Tue May 26 00:07:44.774334 2026] [:error] [pid 3698:tid 3702] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/fs.php
[Tue May 26 00:07:44.986279 2026] [:error] [pid 3698:tid 3701] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/2.php
[Tue May 26 00:07:45.196667 2026] [:error] [pid 3698:tid 3722] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/man.php
[Tue May 26 00:07:45.413309 2026] [:error] [pid 3698:tid 3710] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/12.php
[Tue May 26 00:07:45.623857 2026] [:error] [pid 3698:tid 3715] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/acp.php
[Tue May 26 00:07:45.858857 2026] [:error] [pid 3698:tid 3717] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/wps.php
[Tue May 26 00:07:46.070140 2026] [:error] [pid 3698:tid 3713] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/alpha.php
[Tue May 26 00:07:46.280361 2026] [:error] [pid 3698:tid 3719] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/bob.php
[Tue May 26 00:07:46.689887 2026] [:error] [pid 3698:tid 3723] [client 20.151.106.7:65074] File does not exist: /usr/local/apache/htdocs/suspended-page/yuzuru1.php
[Tue May 26 00:07:46.897199 2026] [:error] [pid 3698:tid 3721] [client 20.151.106.7:65074] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "ahRz0gtZBEwA4fyFLKMTUgAAARU"]
[Tue May 26 00:07:48.043101 2026] [:error] [pid 62426:tid 62449] [client 20.151.106.7:63597] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "ahRz1Ej3D3Mo8ANpTRBKBwAAABM"]
[Tue May 26 00:07:49.973412 2026] [:error] [pid 62428:tid 62500] [client 20.151.106.7:65031] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "ahRz1ZNosGBa7mui3VSI6gAAAJA"]
[Tue May 26 00:07:51.535308 2026] [:error] [pid 3698:tid 3702] [client 20.151.106.7:64970] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/insta.php"] [unique_id "ahRz1wtZBEwA4fyFLKMTVgAAAQI"]
[Tue May 26 00:07:52.586875 2026] [:error] [pid 3698:tid 3715] [client 20.151.106.7:64364] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "ahRz2AtZBEwA4fyFLKMTWAAAAQ8"]
[Tue May 26 00:07:53.451343 2026] [:error] [pid 3698:tid 3713] [client 20.151.106.7:63578] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "ahRz2QtZBEwA4fyFLKMTWgAAAQ0"]
[Tue May 26 00:07:54.516848 2026] [:error] [pid 62722:tid 62734] [client 20.151.106.7:64966] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "ahRz2qM6ssnLWYf6CVBneAAAAEo"]
[Tue May 26 00:07:55.497272 2026] [:error] [pid 3698:tid 3716] [client 20.151.106.7:64342] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-kz.php"] [unique_id "ahRz2wtZBEwA4fyFLKMTXwAAARA"]
[Tue May 26 00:07:56.603662 2026] [:error] [pid 3698:tid 3702] [client 20.151.106.7:64361] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "ahRz3AtZBEwA4fyFLKMTYgAAAQI"]
[Tue May 26 00:07:58.091558 2026] [:error] [pid 62515:tid 62527] [client 20.151.106.7:64274] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "ahRz3hig0_XsOwmnrv96yAAAAMo"]
[Tue May 26 00:08:03.332754 2026] [:error] [pid 62515:tid 62524] [client 20.151.106.7:65077] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "ahRz4xig0_XsOwmnrv962wAAAMc"]
[Tue May 26 00:08:07.298505 2026] [:error] [pid 62426:tid 62446] [client 20.151.106.7:65038] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xs.php"] [unique_id "ahRz50j3D3Mo8ANpTRBKNgAAABA"]
[Tue May 26 00:08:09.928767 2026] [:error] [pid 62426:tid 62449] [client 20.151.106.7:65032] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "ahRz6Uj3D3Mo8ANpTRBKQQAAABM"]
[Tue May 26 00:08:13.690194 2026] [:error] [pid 62428:tid 62501] [client 20.151.106.7:64999] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "ahRz7ZNosGBa7mui3VSJBgAAAJE"]
[Tue May 26 00:08:19.862032 2026] [:error] [pid 62722:tid 62733] [client 20.151.106.7:65040] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "ahRz86M6ssnLWYf6CVBngQAAAEk"]
[Tue May 26 00:08:22.160121 2026] [:error] [pid 62428:tid 62504] [client 20.151.106.7:65033] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2026w.php"] [unique_id "ahRz9pNosGBa7mui3VSJEAAAAJQ"]
[Tue May 26 00:08:22.674777 2026] [:error] [pid 62515:tid 62526] [client 20.151.106.7:64330] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahRz9hig0_XsOwmnrv969gAAAMk"]
[Tue May 26 00:08:23.446541 2026] [:error] [pid 62428:tid 62493] [client 20.151.106.7:64961] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahRz95NosGBa7mui3VSJFQAAAIk"]
[Tue May 26 00:08:24.132174 2026] [:error] [pid 62426:tid 62432] [client 20.151.106.7:64318] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahRz-Ej3D3Mo8ANpTRBKdQAAAAI"]
[Tue May 26 00:08:25.782537 2026] [:error] [pid 62428:tid 62495] [client 20.151.106.7:65025] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahRz-ZNosGBa7mui3VSJGQAAAIs"]
[Tue May 26 00:08:27.514465 2026] [:error] [pid 62428:tid 62499] [client 20.151.106.7:63582] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ahRz-5NosGBa7mui3VSJHAAAAI8"]
[Tue May 26 00:08:30.259316 2026] [:error] [pid 62426:tid 62440] [client 20.151.106.7:65076] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ahRz_kj3D3Mo8ANpTRBKkQAAAAo"]
[Tue May 26 00:08:32.841615 2026] [:error] [pid 62426:tid 62451] [client 20.151.106.7:64963] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ahR0AEj3D3Mo8ANpTRBKpgAAABU"]
[Tue May 26 00:08:34.334048 2026] [:error] [pid 62426:tid 62439] [client 20.151.106.7:63586] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwx1.php"] [unique_id "ahR0Akj3D3Mo8ANpTRBKsAAAAAk"]
[Tue May 26 00:08:36.210855 2026] [:error] [pid 3698:tid 3705] [client 20.151.106.7:63554] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ahR0BAtZBEwA4fyFLKMTiAAAAQU"]
[Tue May 26 00:08:38.744028 2026] [:error] [pid 62426:tid 62444] [client 20.151.106.7:65068] [client 20.151.106.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ahR0Bkj3D3Mo8ANpTRBKvQAAAA4"]
[Tue May 26 00:08:47.302810 2026] [:error] [pid 62428:tid 62497] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/xmu.php
[Tue May 26 00:08:47.518620 2026] [:error] [pid 62428:tid 62495] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue May 26 00:08:47.760924 2026] [:error] [pid 62428:tid 62500] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/ayk.php
[Tue May 26 00:08:47.988447 2026] [:error] [pid 62428:tid 62501] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/gecko.php
[Tue May 26 00:08:48.202760 2026] [:error] [pid 62428:tid 62498] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/wpxml.php
[Tue May 26 00:08:48.416736 2026] [:error] [pid 62428:tid 62488] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/zo.php
[Tue May 26 00:08:48.639725 2026] [:error] [pid 62428:tid 62506] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/sky.php
[Tue May 26 00:08:48.853961 2026] [:error] [pid 62428:tid 62505] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/rh.php
[Tue May 26 00:08:49.074807 2026] [:error] [pid 62428:tid 62487] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/ortasekerli1.php
[Tue May 26 00:08:49.297094 2026] [:error] [pid 62428:tid 62489] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/xstelth.php
[Tue May 26 00:08:49.510787 2026] [:error] [pid 62428:tid 62497] [client 20.151.106.7:63555] File does not exist: /usr/local/apache/htdocs/suspended-page/3369.php
[Tue May 26 01:20:40.604551 2026] [:error] [pid 62515:tid 62523] [client 170.106.197.109:45472] [client 170.106.197.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahSE6Big0_XsOwmnrv-NxwAAAMY"]
[Tue May 26 03:29:52.851095 2026] [:error] [pid 20125:tid 20138] [client 43.135.211.148:39584] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahSjMNk9jeWERFDLJc5UFwAAAMs"]
[Tue May 26 03:43:30.623331 2026] [:error] [pid 55988:tid 55997] [client 170.64.238.42:50596] [client 170.64.238.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahSmYv3kVIz2sql52scjRgAAAQY"]
[Tue May 26 03:43:30.667558 2026] [:error] [pid 55988:tid 56000] [client 170.64.238.42:50562] [client 170.64.238.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahSmYv3kVIz2sql52scjRwAAAQk"]
[Tue May 26 03:43:30.682485 2026] [:error] [pid 55988:tid 55992] [client 170.64.238.42:50558] [client 170.64.238.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.rejuva.au"] [uri "/arquivos/javascript/responsive_filemanager/filemanager/dialog.php"] [unique_id "ahSmYv3kVIz2sql52scjSAAAAQE"]
[Tue May 26 04:14:29.738218 2026] [:error] [pid 20125:tid 20149] [client 124.221.140.98:50244] [client 124.221.140.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahStpdk9jeWERFDLJc5gMQAAANY"]
[Tue May 26 05:31:11.367582 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/x.php
[Tue May 26 05:31:11.683395 2026] [:error] [pid 55988:tid 56007] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/201.php
[Tue May 26 05:31:12.507416 2026] [:error] [pid 55988:tid 56008] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/ops.php
[Tue May 26 05:31:12.819682 2026] [:error] [pid 55988:tid 56010] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/samll.php
[Tue May 26 05:31:13.134423 2026] [:error] [pid 55988:tid 56012] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/ingfo.php
[Tue May 26 05:31:13.488909 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/c55cdler.php
[Tue May 26 05:31:13.801154 2026] [:error] [pid 55988:tid 56007] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/error_log.php
[Tue May 26 05:31:14.136935 2026] [:error] [pid 55988:tid 56009] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/xenon1337.php
[Tue May 26 05:31:14.466717 2026] [:error] [pid 55988:tid 56011] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/alfa403.php
[Tue May 26 05:31:14.797657 2026] [:error] [pid 55988:tid 56013] [client 20.195.199.65:28006] File does not exist: /usr/local/apache/htdocs/suspended-page/test11.php
[Tue May 26 05:31:16.251975 2026] [:error] [pid 55988:tid 56013] [client 20.195.199.65:28006] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koala.php"] [unique_id "ahS_pP3kVIz2sql52sdQowAAARY"]
[Tue May 26 05:31:17.701890 2026] [:error] [pid 20125:tid 20129] [client 20.195.199.65:28025] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koala.php"] [unique_id "ahS_pdk9jeWERFDLJc541wAAAMI"]
[Tue May 26 05:31:19.146285 2026] [:error] [pid 20026:tid 20106] [client 20.195.199.65:30345] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koala.php"] [unique_id "ahS_pzXIXIr-5BZ8nR7eUwAAAI4"]
[Tue May 26 05:31:20.049197 2026] [:error] [pid 20025:tid 20067] [client 20.195.199.65:12586] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/koala.php"] [unique_id "ahS_qH7k8Vts-JPOkgWeWgAAAEI"]
[Tue May 26 05:31:21.047788 2026] [:error] [pid 20025:tid 20088] [client 20.195.199.65:19483] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mac.php"] [unique_id "ahS_qX7k8Vts-JPOkgWeXAAAAFc"]
[Tue May 26 05:31:22.545408 2026] [:error] [pid 20025:tid 20076] [client 20.195.199.65:4069] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mac.php"] [unique_id "ahS_qn7k8Vts-JPOkgWeXgAAAEs"]
[Tue May 26 05:31:24.256010 2026] [:error] [pid 55988:tid 56002] [client 20.195.199.65:23311] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mac.php"] [unique_id "ahS_rP3kVIz2sql52sdQsAAAAQs"]
[Tue May 26 05:31:26.663912 2026] [:error] [pid 20024:tid 20045] [client 20.195.199.65:33570] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mac.php"] [unique_id "ahS_rldk7QtxEB93NpcFNgAAAAc"]
[Tue May 26 05:31:27.936729 2026] [:error] [pid 55988:tid 56014] [client 20.195.199.65:46861] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/25d653587fdfd1.php"] [unique_id "ahS_r_3kVIz2sql52sdQvQAAARc"]
[Tue May 26 05:31:28.885977 2026] [:error] [pid 20025:tid 20078] [client 20.195.199.65:40939] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/25d653587fdfd1.php"] [unique_id "ahS_sH7k8Vts-JPOkgWeZQAAAE0"]
[Tue May 26 05:31:30.188934 2026] [:error] [pid 20125:tid 20133] [client 20.195.199.65:41758] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/25d653587fdfd1.php"] [unique_id "ahS_stk9jeWERFDLJc549AAAAMY"]
[Tue May 26 05:31:31.235770 2026] [:error] [pid 55988:tid 56012] [client 20.195.199.65:31464] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/25d653587fdfd1.php"] [unique_id "ahS_s_3kVIz2sql52sdQzwAAARU"]
[Tue May 26 05:31:33.229825 2026] [:error] [pid 20025:tid 20071] [client 20.195.199.65:41778] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahS_tX7k8Vts-JPOkgWeaAAAAEY"]
[Tue May 26 05:31:34.843458 2026] [:error] [pid 55988:tid 55998] [client 20.195.199.65:15346] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahS_tv3kVIz2sql52sdQ3AAAAQc"]
[Tue May 26 05:31:36.830543 2026] [:error] [pid 20025:tid 20083] [client 20.195.199.65:46911] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahS_uH7k8Vts-JPOkgWebgAAAFI"]
[Tue May 26 05:31:38.304639 2026] [:error] [pid 55988:tid 55992] [client 20.195.199.65:4197] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wefile.php"] [unique_id "ahS_uv3kVIz2sql52sdQ6gAAAQE"]
[Tue May 26 05:31:40.225892 2026] [:error] [pid 20125:tid 20144] [client 20.195.199.65:5871] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp3.php"] [unique_id "ahS_vNk9jeWERFDLJc55FQAAANE"]
[Tue May 26 05:31:44.235233 2026] [:error] [pid 55988:tid 56009] [client 20.195.199.65:25158] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp3.php"] [unique_id "ahS_wP3kVIz2sql52sdQ-QAAARI"]
[Tue May 26 05:31:45.325403 2026] [:error] [pid 20125:tid 20129] [client 20.195.199.65:20292] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp3.php"] [unique_id "ahS_wdk9jeWERFDLJc55GgAAAMI"]
[Tue May 26 05:31:46.581924 2026] [:error] [pid 20125:tid 20143] [client 20.195.199.65:59983] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/casp3.php"] [unique_id "ahS_wtk9jeWERFDLJc55GwAAANA"]
[Tue May 26 05:31:47.508957 2026] [:error] [pid 20125:tid 20144] [client 20.195.199.65:20332] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahS_w9k9jeWERFDLJc55HQAAANE"]
[Tue May 26 05:31:48.830093 2026] [:error] [pid 20125:tid 20139] [client 20.195.199.65:46880] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahS_xNk9jeWERFDLJc55HgAAAMw"]
[Tue May 26 05:31:49.915820 2026] [:error] [pid 20025:tid 20084] [client 20.195.199.65:20335] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahS_xX7k8Vts-JPOkgWeeAAAAFM"]
[Tue May 26 05:31:51.740787 2026] [:error] [pid 20026:tid 20093] [client 20.195.199.65:3894] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahS_xzXIXIr-5BZ8nR7edQAAAIE"]
[Tue May 26 05:31:53.173674 2026] [:error] [pid 20024:tid 20062] [client 20.195.199.65:5839] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "ahS_yVdk7QtxEB93NpcFUQAAABg"]
[Tue May 26 05:31:54.319771 2026] [:error] [pid 55988:tid 55994] [client 20.195.199.65:19942] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "ahS_yv3kVIz2sql52sdRDwAAAQM"]
[Tue May 26 05:31:55.453886 2026] [:error] [pid 55988:tid 56001] [client 20.195.199.65:20311] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "ahS_y_3kVIz2sql52sdREwAAAQo"]
[Tue May 26 05:31:56.853644 2026] [:error] [pid 20125:tid 20136] [client 20.195.199.65:31130] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/js/"] [unique_id "ahS_zNk9jeWERFDLJc55PQAAAMk"]
[Tue May 26 05:31:58.108335 2026] [:error] [pid 55988:tid 55994] [client 20.195.199.65:27673] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ahS_zv3kVIz2sql52sdRLAAAAQM"]
[Tue May 26 05:31:59.384626 2026] [:error] [pid 55988:tid 56005] [client 20.195.199.65:42462] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ahS_z_3kVIz2sql52sdRNgAAAQ4"]
[Tue May 26 05:32:00.803091 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:26716] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ahS_0P3kVIz2sql52sdRQAAAARg"]
[Tue May 26 05:32:02.459563 2026] [:error] [pid 20025:tid 20077] [client 20.195.199.65:35488] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-admin/css/colour.php"] [unique_id "ahS_0n7k8Vts-JPOkgWefAAAAEw"]
[Tue May 26 05:32:03.610171 2026] [:error] [pid 20125:tid 20136] [client 20.195.199.65:27686] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "ahS_09k9jeWERFDLJc55WwAAAMk"]
[Tue May 26 05:32:04.971739 2026] [:error] [pid 20025:tid 20089] [client 20.195.199.65:42490] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "ahS_1H7k8Vts-JPOkgWefgAAAFg"]
[Tue May 26 05:32:06.003640 2026] [:error] [pid 20025:tid 20070] [client 20.195.199.65:35392] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "ahS_1n7k8Vts-JPOkgWegQAAAEU"]
[Tue May 26 05:32:07.005818 2026] [:error] [pid 20026:tid 20106] [client 20.195.199.65:46512] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/half.php"] [unique_id "ahS_1zXIXIr-5BZ8nR7ejgAAAI4"]
[Tue May 26 05:32:08.442056 2026] [:error] [pid 20025:tid 20082] [client 20.195.199.65:50067] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "ahS_2H7k8Vts-JPOkgWehwAAAFE"]
[Tue May 26 05:32:09.607320 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:19153] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "ahS_2TXIXIr-5BZ8nR7ekgAAAIU"]
[Tue May 26 05:32:11.291485 2026] [:error] [pid 20026:tid 20114] [client 20.195.199.65:11588] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "ahS_2zXIXIr-5BZ8nR7elwAAAJY"]
[Tue May 26 05:32:13.468525 2026] [:error] [pid 20125:tid 20135] [client 20.195.199.65:35417] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/2P.php"] [unique_id "ahS_3dk9jeWERFDLJc55agAAAMg"]
[Tue May 26 05:32:16.299341 2026] [:error] [pid 20026:tid 20115] [client 20.195.199.65:16753] File does not exist: /usr/local/apache/htdocs/suspended-page/tires.php
[Tue May 26 05:32:16.923763 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:16753] File does not exist: /usr/local/apache/htdocs/suspended-page/like.php
[Tue May 26 05:32:17.567993 2026] [:error] [pid 20026:tid 20099] [client 20.195.199.65:16753] [client 20.195.199.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ahS_4TXIXIr-5BZ8nR7eoAAAAIc"]
[Tue May 26 05:32:20.913837 2026] [:error] [pid 20025:tid 20072] [client 20.195.199.65:18785] File does not exist: /usr/local/apache/htdocs/suspended-page/bob.php
[Tue May 26 05:32:21.250686 2026] [:error] [pid 20025:tid 20081] [client 20.195.199.65:18785] File does not exist: /usr/local/apache/htdocs/suspended-page/t3s.php
[Tue May 26 05:32:22.504334 2026] [:error] [pid 20025:tid 20069] [client 20.195.199.65:18785] File does not exist: /usr/local/apache/htdocs/suspended-page/uwu.php
[Tue May 26 05:32:22.832865 2026] [:error] [pid 20025:tid 20079] [client 20.195.199.65:18785] File does not exist: /usr/local/apache/htdocs/suspended-page/uwa.php
[Tue May 26 05:32:23.141662 2026] [:error] [pid 20025:tid 20088] [client 20.195.199.65:18785] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahS_537k8Vts-JPOkgWenAAAAFc"]
[Tue May 26 05:32:26.368327 2026] [:error] [pid 55988:tid 56008] [client 20.195.199.65:22523] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahS_6v3kVIz2sql52sdRbwAAARE"]
[Tue May 26 05:32:28.625737 2026] [:error] [pid 20024:tid 20048] [client 20.195.199.65:4688] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahS_7Fdk7QtxEB93NpcFdwAAAAo"]
[Tue May 26 05:32:29.651729 2026] [:error] [pid 20125:tid 20128] [client 20.195.199.65:3299] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/crgio.php"] [unique_id "ahS_7dk9jeWERFDLJc55lgAAAME"]
[Tue May 26 05:32:31.054912 2026] [:error] [pid 20125:tid 20129] [client 20.195.199.65:4698] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "ahS_79k9jeWERFDLJc55mAAAAMI"]
[Tue May 26 05:32:32.379757 2026] [:error] [pid 55988:tid 56008] [client 20.195.199.65:30774] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "ahS_8P3kVIz2sql52sdRdQAAARE"]
[Tue May 26 05:32:33.593902 2026] [:error] [pid 20024:tid 20057] [client 20.195.199.65:28519] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "ahS_8Vdk7QtxEB93NpcFfgAAABM"]
[Tue May 26 05:32:34.753258 2026] [:error] [pid 20024:tid 20056] [client 20.195.199.65:64542] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/geforce.php"] [unique_id "ahS_8ldk7QtxEB93NpcFgAAAABI"]
[Tue May 26 05:32:35.724908 2026] [:error] [pid 20125:tid 20149] [client 20.195.199.65:14252] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "ahS_89k9jeWERFDLJc55owAAANY"]
[Tue May 26 05:32:37.710350 2026] [:error] [pid 20125:tid 20128] [client 20.195.199.65:18370] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "ahS_9dk9jeWERFDLJc55qgAAAME"]
[Tue May 26 05:32:39.337826 2026] [:error] [pid 20125:tid 20147] [client 20.195.199.65:3228] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "ahS_99k9jeWERFDLJc55rgAAANQ"]
[Tue May 26 05:32:41.262978 2026] [:error] [pid 20025:tid 20075] [client 20.195.199.65:4449] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pucci.php"] [unique_id "ahS_-X7k8Vts-JPOkgWerwAAAEo"]
[Tue May 26 05:32:43.778748 2026] [:error] [pid 20025:tid 20082] [client 20.195.199.65:25490] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ahS_-37k8Vts-JPOkgWetAAAAFE"]
[Tue May 26 05:32:45.958110 2026] [:error] [pid 55988:tid 56010] [client 20.195.199.65:59327] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ahS__f3kVIz2sql52sdRfwAAARM"]
[Tue May 26 05:32:50.626275 2026] [:error] [pid 55988:tid 56006] [client 20.195.199.65:13756] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ahTAAv3kVIz2sql52sdRiAAAAQ8"]
[Tue May 26 05:32:53.335325 2026] [:error] [pid 55988:tid 55992] [client 20.195.199.65:48608] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/details/"] [unique_id "ahTABf3kVIz2sql52sdRjgAAAQE"]
[Tue May 26 05:32:55.851145 2026] [:error] [pid 20024:tid 20060] [client 20.195.199.65:59317] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ahTAB1dk7QtxEB93NpcFmgAAABY"]
[Tue May 26 05:32:59.170107 2026] [:error] [pid 55988:tid 55992] [client 20.195.199.65:41827] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ahTAC_3kVIz2sql52sdRlAAAAQE"]
[Tue May 26 05:33:00.236381 2026] [:error] [pid 55988:tid 55991] [client 20.195.199.65:13742] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ahTADP3kVIz2sql52sdRlgAAAQA"]
[Tue May 26 05:33:01.541641 2026] [:error] [pid 20125:tid 20131] [client 20.195.199.65:59302] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/audio/"] [unique_id "ahTADdk9jeWERFDLJc55ywAAAMQ"]
[Tue May 26 05:33:02.533705 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:13705] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "ahTADjXIXIr-5BZ8nR7ezgAAAII"]
[Tue May 26 05:33:03.537640 2026] [:error] [pid 20024:tid 20056] [client 20.195.199.65:15346] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "ahTAD1dk7QtxEB93NpcFrAAAABI"]
[Tue May 26 05:33:04.657416 2026] [:error] [pid 55988:tid 56010] [client 20.195.199.65:31055] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "ahTAEP3kVIz2sql52sdRmgAAARM"]
[Tue May 26 05:33:05.684755 2026] [:error] [pid 55988:tid 56007] [client 20.195.199.65:50535] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/one.php"] [unique_id "ahTAEf3kVIz2sql52sdRnAAAARA"]
[Tue May 26 05:33:06.560175 2026] [:error] [pid 20025:tid 20084] [client 20.195.199.65:63904] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "ahTAEn7k8Vts-JPOkgWewQAAAFM"]
[Tue May 26 05:33:07.527896 2026] [:error] [pid 20026:tid 20115] [client 20.195.199.65:14548] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "ahTAEzXIXIr-5BZ8nR7e1AAAAJc"]
[Tue May 26 05:33:08.681130 2026] [:error] [pid 55988:tid 55993] [client 20.195.199.65:23776] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "ahTAFP3kVIz2sql52sdRogAAAQI"]
[Tue May 26 05:33:10.233475 2026] [:error] [pid 20026:tid 20113] [client 20.195.199.65:4096] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-temp.php"] [unique_id "ahTAFjXIXIr-5BZ8nR7e1gAAAJU"]
[Tue May 26 05:33:11.151061 2026] [:error] [pid 55988:tid 56002] [client 20.195.199.65:63891] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ahTAF_3kVIz2sql52sdRqQAAAQs"]
[Tue May 26 05:33:12.681738 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:63883] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ahTAGDXIXIr-5BZ8nR7e2gAAAIU"]
[Tue May 26 05:33:13.925532 2026] [:error] [pid 55988:tid 56009] [client 20.195.199.65:18726] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ahTAGf3kVIz2sql52sdRsAAAARI"]
[Tue May 26 05:33:15.479191 2026] [:error] [pid 20125:tid 20144] [client 20.195.199.65:41818] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "ahTAG9k9jeWERFDLJc552gAAANE"]
[Tue May 26 05:33:17.360775 2026] [:error] [pid 20025:tid 20073] [client 20.195.199.65:50008] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ahTAHX7k8Vts-JPOkgWexAAAAEg"]
[Tue May 26 05:33:18.517944 2026] [:error] [pid 20024:tid 20059] [client 20.195.199.65:4144] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ahTAHldk7QtxEB93NpcFtgAAABU"]
[Tue May 26 05:33:19.795731 2026] [:error] [pid 20025:tid 20072] [client 20.195.199.65:33964] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ahTAH37k8Vts-JPOkgWeywAAAEc"]
[Tue May 26 05:33:20.778329 2026] [:error] [pid 20025:tid 20080] [client 20.195.199.65:18724] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xmu.php"] [unique_id "ahTAIH7k8Vts-JPOkgWezwAAAE8"]
[Tue May 26 05:33:21.718718 2026] [:error] [pid 20024:tid 20042] [client 20.195.199.65:4141] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/mode.php"] [unique_id "ahTAIVdk7QtxEB93NpcFvwAAAAQ"]
[Tue May 26 05:33:23.080148 2026] [:error] [pid 20125:tid 20138] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/mode.php
[Tue May 26 05:33:23.932182 2026] [:error] [pid 20125:tid 20149] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Tue May 26 05:33:24.260187 2026] [:error] [pid 20125:tid 20146] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/puc.php
[Tue May 26 05:33:24.583844 2026] [:error] [pid 20125:tid 20140] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue May 26 05:33:24.897099 2026] [:error] [pid 20125:tid 20136] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/dx.php
[Tue May 26 05:33:25.212829 2026] [:error] [pid 20125:tid 20127] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/11.php
[Tue May 26 05:33:25.527570 2026] [:error] [pid 20125:tid 20132] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/p.php
[Tue May 26 05:33:26.176591 2026] [:error] [pid 20125:tid 20142] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/bthil.php
[Tue May 26 05:33:26.815561 2026] [:error] [pid 20125:tid 20144] [client 20.195.199.65:34345] File does not exist: /usr/local/apache/htdocs/suspended-page/7.php
[Tue May 26 05:33:27.125332 2026] [:error] [pid 20125:tid 20131] [client 20.195.199.65:34345] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ahTAJ9k9jeWERFDLJc559AAAAMQ"]
[Tue May 26 05:33:28.268911 2026] [:error] [pid 20125:tid 20134] [client 20.195.199.65:63931] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ahTAKNk9jeWERFDLJc55-AAAAMc"]
[Tue May 26 05:33:29.540186 2026] [:error] [pid 20125:tid 20140] [client 20.195.199.65:28587] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ahTAKdk9jeWERFDLJc55-gAAAM0"]
[Tue May 26 05:33:30.800300 2026] [:error] [pid 20026:tid 20098] [client 20.195.199.65:60290] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/8.php"] [unique_id "ahTAKjXIXIr-5BZ8nR7e5QAAAIY"]
[Tue May 26 05:33:32.684813 2026] [:error] [pid 20026:tid 20113] [client 20.195.199.65:34262] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ahTALDXIXIr-5BZ8nR7e6QAAAJU"]
[Tue May 26 05:33:33.955369 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:50047] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ahTALTXIXIr-5BZ8nR7e7QAAAII"]
[Tue May 26 05:33:34.850096 2026] [:error] [pid 20125:tid 20151] [client 20.195.199.65:42405] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ahTALtk9jeWERFDLJc56BwAAANg"]
[Tue May 26 05:33:36.447155 2026] [:error] [pid 20026:tid 20104] [client 20.195.199.65:60343] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/1.php"] [unique_id "ahTAMDXIXIr-5BZ8nR7e8QAAAIw"]
[Tue May 26 05:33:37.354589 2026] [:error] [pid 20125:tid 20137] [client 20.195.199.65:65126] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ahTAMdk9jeWERFDLJc56CgAAAMo"]
[Tue May 26 05:33:39.342047 2026] [:error] [pid 20026:tid 20112] [client 20.195.199.65:33983] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ahTAMzXIXIr-5BZ8nR7e9AAAAJQ"]
[Tue May 26 05:33:40.987601 2026] [:error] [pid 20125:tid 20142] [client 20.195.199.65:13224] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ahTANNk9jeWERFDLJc56EQAAAM8"]
[Tue May 26 05:33:42.721301 2026] [:error] [pid 55988:tid 56009] [client 20.195.199.65:5794] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/100.php"] [unique_id "ahTANv3kVIz2sql52sdRugAAARI"]
[Tue May 26 05:33:44.036828 2026] [:error] [pid 20026:tid 20112] [client 20.195.199.65:65105] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ahTAODXIXIr-5BZ8nR7e-gAAAJQ"]
[Tue May 26 05:33:48.715472 2026] [:error] [pid 55988:tid 56012] [client 20.195.199.65:64502] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ahTAPP3kVIz2sql52sdRwwAAARU"]
[Tue May 26 05:33:49.618475 2026] [:error] [pid 55988:tid 56003] [client 20.195.199.65:12815] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ahTAPf3kVIz2sql52sdRxgAAAQw"]
[Tue May 26 05:33:50.747764 2026] [:error] [pid 20125:tid 20128] [client 20.195.199.65:14617] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/about.php"] [unique_id "ahTAPtk9jeWERFDLJc56KwAAAME"]
[Tue May 26 05:33:51.980890 2026] [:error] [pid 20024:tid 20057] [client 20.195.199.65:25884] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ahTAP1dk7QtxEB93NpcF4QAAABM"]
[Tue May 26 05:33:53.299985 2026] [:error] [pid 20125:tid 20138] [client 20.195.199.65:17220] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ahTAQdk9jeWERFDLJc56LAAAAMs"]
[Tue May 26 05:33:55.405536 2026] [:error] [pid 20025:tid 20087] [client 20.195.199.65:26257] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ahTAQ37k8Vts-JPOkgWe9QAAAFY"]
[Tue May 26 05:33:58.302938 2026] [:error] [pid 20024:tid 20043] [client 20.195.199.65:25590] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/admin.php"] [unique_id "ahTARldk7QtxEB93NpcF5QAAAAU"]
[Tue May 26 05:34:00.601091 2026] [:error] [pid 20125:tid 20134] [client 20.195.199.65:12806] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahTASNk9jeWERFDLJc56NQAAAMc"]
[Tue May 26 05:34:02.668233 2026] [:error] [pid 20024:tid 20053] [client 20.195.199.65:44570] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahTASldk7QtxEB93NpcF6wAAAA8"]
[Tue May 26 05:34:03.723104 2026] [:error] [pid 20125:tid 20151] [client 20.195.199.65:29205] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahTAS9k9jeWERFDLJc56NgAAANg"]
[Tue May 26 05:34:05.691414 2026] [:error] [pid 20025:tid 20083] [client 20.195.199.65:26259] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/edit.php"] [unique_id "ahTATX7k8Vts-JPOkgWfAgAAAFI"]
[Tue May 26 05:34:06.722429 2026] [:error] [pid 20024:tid 20056] [client 20.195.199.65:3437] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ahTATldk7QtxEB93NpcF9AAAABI"]
[Tue May 26 05:34:07.919780 2026] [:error] [pid 20024:tid 20047] [client 20.195.199.65:29596] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ahTAT1dk7QtxEB93NpcF-AAAAAk"]
[Tue May 26 05:34:09.326180 2026] [:error] [pid 20026:tid 20098] [client 20.195.199.65:45827] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ahTAUTXIXIr-5BZ8nR7fGQAAAIY"]
[Tue May 26 05:34:10.941546 2026] [:error] [pid 20024:tid 20051] [client 20.195.199.65:37595] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/admin.php"] [unique_id "ahTAUldk7QtxEB93NpcGAQAAAA0"]
[Tue May 26 05:34:12.400983 2026] [:error] [pid 55988:tid 55991] [client 20.195.199.65:15040] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ahTAVP3kVIz2sql52sdR6AAAAQA"]
[Tue May 26 05:34:14.175550 2026] [:error] [pid 20024:tid 20062] [client 20.195.199.65:29602] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ahTAVldk7QtxEB93NpcGCwAAABg"]
[Tue May 26 05:34:15.555122 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:26290] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ahTAV_3kVIz2sql52sdR8gAAARg"]
[Tue May 26 05:34:17.921883 2026] [:error] [pid 20025:tid 20077] [client 20.195.199.65:3359] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f6.php"] [unique_id "ahTAWX7k8Vts-JPOkgWfDAAAAEw"]
[Tue May 26 05:34:19.599968 2026] [:error] [pid 20125:tid 20134] [client 20.195.199.65:8512] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "ahTAW9k9jeWERFDLJc56PQAAAMc"]
[Tue May 26 05:34:21.451116 2026] [:error] [pid 55988:tid 56005] [client 20.195.199.65:3342] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "ahTAXf3kVIz2sql52sdR_AAAAQ4"]
[Tue May 26 05:34:22.457805 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:26631] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "ahTAXjXIXIr-5BZ8nR7fKQAAAII"]
[Tue May 26 05:34:23.914843 2026] [:error] [pid 20026:tid 20106] [client 20.195.199.65:15102] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/inputs.php"] [unique_id "ahTAXzXIXIr-5BZ8nR7fLAAAAI4"]
[Tue May 26 05:34:25.609221 2026] [:error] [pid 55988:tid 56013] [client 20.195.199.65:45873] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/av.php"] [unique_id "ahTAYf3kVIz2sql52sdSAAAAARY"]
[Tue May 26 05:34:27.669336 2026] [:error] [pid 20026:tid 20104] [client 20.195.199.65:37612] File does not exist: /usr/local/apache/htdocs/suspended-page/av.php
[Tue May 26 05:34:27.995170 2026] [:error] [pid 20026:tid 20099] [client 20.195.199.65:37612] File does not exist: /usr/local/apache/htdocs/suspended-page/classwithtostring.php
[Tue May 26 05:34:29.068588 2026] [:error] [pid 20026:tid 20095] [client 20.195.199.65:37612] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-blog.php
[Tue May 26 05:34:30.060582 2026] [:error] [pid 20026:tid 20100] [client 20.195.199.65:37612] File does not exist: /usr/local/apache/htdocs/suspended-page/adminfuns.php
[Tue May 26 05:34:30.379010 2026] [:error] [pid 20026:tid 20108] [client 20.195.199.65:37612] File does not exist: /usr/local/apache/htdocs/suspended-page/goods.php
[Tue May 26 05:34:30.692066 2026] [:error] [pid 20026:tid 20096] [client 20.195.199.65:37612] File does not exist: /usr/local/apache/htdocs/suspended-page/ms-edit.php
[Tue May 26 05:34:31.006300 2026] [:error] [pid 20026:tid 20105] [client 20.195.199.65:37612] File does not exist: /usr/local/apache/htdocs/suspended-page/222.php
[Tue May 26 05:34:31.628027 2026] [:error] [pid 20026:tid 20098] [client 20.195.199.65:37612] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ahTAZzXIXIr-5BZ8nR7fSQAAAIY"]
[Tue May 26 05:34:33.026928 2026] [:error] [pid 55988:tid 56012] [client 20.195.199.65:26683] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ahTAaf3kVIz2sql52sdSGAAAARU"]
[Tue May 26 05:34:34.210392 2026] [:error] [pid 20125:tid 20142] [client 20.195.199.65:15148] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ahTAatk9jeWERFDLJc56QgAAAM8"]
[Tue May 26 05:34:35.882287 2026] [:error] [pid 55988:tid 56008] [client 20.195.199.65:26673] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/css/dist/"] [unique_id "ahTAa_3kVIz2sql52sdSHQAAARE"]
[Tue May 26 05:34:37.876622 2026] [:error] [pid 20026:tid 20106] [client 20.195.199.65:3363] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahTAbTXIXIr-5BZ8nR7fSgAAAI4"]
[Tue May 26 05:34:39.340277 2026] [:error] [pid 20026:tid 20111] [client 20.195.199.65:65059] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahTAbzXIXIr-5BZ8nR7fTgAAAJM"]
[Tue May 26 05:34:40.966966 2026] [:error] [pid 20026:tid 20099] [client 20.195.199.65:18038] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahTAcDXIXIr-5BZ8nR7fUgAAAIc"]
[Tue May 26 05:34:43.295369 2026] [:error] [pid 55988:tid 55991] [client 20.195.199.65:27470] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/BDKR28WP.php"] [unique_id "ahTAc_3kVIz2sql52sdSIwAAAQA"]
[Tue May 26 05:34:44.846419 2026] [:error] [pid 20125:tid 20138] [client 20.195.199.65:65126] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ahTAdNk9jeWERFDLJc56SAAAAMs"]
[Tue May 26 05:34:46.513925 2026] [:error] [pid 20025:tid 20079] [client 20.195.199.65:28921] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ahTAdn7k8Vts-JPOkgWfKwAAAE4"]
[Tue May 26 05:34:48.698634 2026] [:error] [pid 20024:tid 20053] [client 20.195.199.65:37076] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ahTAeFdk7QtxEB93NpcGKAAAAA8"]
[Tue May 26 05:34:51.224434 2026] [:error] [pid 20125:tid 20150] [client 20.195.199.65:45903] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/l10n/"] [unique_id "ahTAe9k9jeWERFDLJc56VwAAANc"]
[Tue May 26 05:34:52.711770 2026] [:error] [pid 20025:tid 20080] [client 20.195.199.65:65080] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "ahTAfH7k8Vts-JPOkgWfMQAAAE8"]
[Tue May 26 05:34:54.023327 2026] [:error] [pid 20025:tid 20072] [client 20.195.199.65:45244] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "ahTAfn7k8Vts-JPOkgWfMwAAAEc"]
[Tue May 26 05:34:55.767034 2026] [:error] [pid 20025:tid 20084] [client 20.195.199.65:37085] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "ahTAf37k8Vts-JPOkgWfNQAAAFM"]
[Tue May 26 05:34:57.609332 2026] [:error] [pid 20026:tid 20100] [client 20.195.199.65:17955] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-content/uploads/"] [unique_id "ahTAgTXIXIr-5BZ8nR7fYQAAAIg"]
[Tue May 26 05:34:58.855813 2026] [:error] [pid 20125:tid 20128] [client 20.195.199.65:13125] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahTAgtk9jeWERFDLJc56ZwAAAME"]
[Tue May 26 05:35:00.158624 2026] [:error] [pid 20026:tid 20114] [client 20.195.199.65:50561] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahTAhDXIXIr-5BZ8nR7fcwAAAJY"]
[Tue May 26 05:35:01.535927 2026] [:error] [pid 55988:tid 55992] [client 20.195.199.65:39956] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahTAhf3kVIz2sql52sdSNAAAAQE"]
[Tue May 26 05:35:03.671120 2026] [:error] [pid 20125:tid 20142] [client 20.195.199.65:37103] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp.php"] [unique_id "ahTAh9k9jeWERFDLJc56cQAAAM8"]
[Tue May 26 05:35:05.428463 2026] [:error] [pid 20024:tid 20045] [client 20.195.199.65:45203] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ahTAiVdk7QtxEB93NpcGMQAAAAc"]
[Tue May 26 05:35:07.760565 2026] [:error] [pid 20026:tid 20092] [client 20.195.199.65:9235] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ahTAizXIXIr-5BZ8nR7fewAAAIA"]
[Tue May 26 05:35:09.853379 2026] [:error] [pid 20125:tid 20141] [client 20.195.199.65:13164] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ahTAjdk9jeWERFDLJc56dwAAAM4"]
[Tue May 26 05:35:11.289823 2026] [:error] [pid 20026:tid 20107] [client 20.195.199.65:33867] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/abcd.php"] [unique_id "ahTAjzXIXIr-5BZ8nR7ffAAAAI8"]
[Tue May 26 05:35:12.642379 2026] [:error] [pid 20025:tid 20066] [client 20.195.199.65:55395] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ahTAkH7k8Vts-JPOkgWfRQAAAEE"]
[Tue May 26 05:35:14.132644 2026] [:error] [pid 20025:tid 20084] [client 20.195.199.65:31544] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ahTAkn7k8Vts-JPOkgWfRgAAAFM"]
[Tue May 26 05:35:15.218782 2026] [:error] [pid 20026:tid 20112] [client 20.195.199.65:31526] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ahTAkzXIXIr-5BZ8nR7fgQAAAJQ"]
[Tue May 26 05:35:16.237267 2026] [:error] [pid 20024:tid 20041] [client 20.195.199.65:39912] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a1.php"] [unique_id "ahTAlFdk7QtxEB93NpcGPQAAAAM"]
[Tue May 26 05:35:17.183983 2026] [:error] [pid 55988:tid 55995] [client 20.195.199.65:3481] [client 20.195.199.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "rejuva.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ahTAlf3kVIz2sql52sdSSQAAAQQ"]
[Tue May 26 05:35:18.316262 2026] [:error] [pid 20024:tid 20054] [client 20.195.199.65:31525] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "ahTAlldk7QtxEB93NpcGPwAAABA"]
[Tue May 26 05:35:19.586076 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:3514] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "ahTAlzXIXIr-5BZ8nR7fhwAAAII"]
[Tue May 26 05:35:20.837746 2026] [:error] [pid 55988:tid 56007] [client 20.195.199.65:31505] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bal.php"] [unique_id "ahTAmP3kVIz2sql52sdSTwAAARA"]
[Tue May 26 05:35:22.202985 2026] [:error] [pid 55988:tid 55992] [client 20.195.199.65:14907] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "ahTAmv3kVIz2sql52sdSWAAAAQE"]
[Tue May 26 05:35:23.472317 2026] [:error] [pid 20025:tid 20081] [client 20.195.199.65:19866] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "ahTAm37k8Vts-JPOkgWfTgAAAFA"]
[Tue May 26 05:35:24.693014 2026] [:error] [pid 20025:tid 20073] [client 20.195.199.65:22034] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "ahTAnH7k8Vts-JPOkgWfTwAAAEg"]
[Tue May 26 05:35:26.132034 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:22027] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cgi-bin/admin.php"] [unique_id "ahTAnv3kVIz2sql52sdSbQAAARg"]
[Tue May 26 05:35:27.404482 2026] [:error] [pid 20026:tid 20104] [client 20.195.199.65:22079] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ahTAnzXIXIr-5BZ8nR7fkQAAAIw"]
[Tue May 26 05:35:29.223251 2026] [:error] [pid 20025:tid 20067] [client 20.195.199.65:30374] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ahTAoX7k8Vts-JPOkgWfVgAAAEI"]
[Tue May 26 05:35:30.502816 2026] [:error] [pid 20025:tid 20074] [client 20.195.199.65:3363] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/gettest.php"] [unique_id "ahTAon7k8Vts-JPOkgWfWgAAAEk"]
[Tue May 26 05:35:32.320126 2026] [:error] [pid 20026:tid 20109] [client 20.195.199.65:43955] File does not exist: /usr/local/apache/htdocs/suspended-page/gettest.php
[Tue May 26 05:35:33.269212 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:43955] File does not exist: /usr/local/apache/htdocs/suspended-page/simple.php
[Tue May 26 05:35:33.605511 2026] [:error] [pid 20026:tid 20107] [client 20.195.199.65:43955] File does not exist: /usr/local/apache/htdocs/suspended-page/buy.php
[Tue May 26 05:35:33.926074 2026] [:error] [pid 20026:tid 20102] [client 20.195.199.65:43955] File does not exist: /usr/local/apache/htdocs/suspended-page/xxx.php
[Tue May 26 05:35:34.237906 2026] [:error] [pid 20026:tid 20104] [client 20.195.199.65:43955] File does not exist: /usr/local/apache/htdocs/suspended-page/hypo.php
[Tue May 26 05:35:34.886407 2026] [:error] [pid 20026:tid 20099] [client 20.195.199.65:43955] File does not exist: /usr/local/apache/htdocs/suspended-page/chosen.php
[Tue May 26 05:35:36.062350 2026] [:error] [pid 20026:tid 20106] [client 20.195.199.65:43955] File does not exist: /usr/local/apache/htdocs/suspended-page/00.php
[Tue May 26 05:35:36.416737 2026] [:error] [pid 20026:tid 20109] [client 20.195.199.65:43955] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/als.php"] [unique_id "ahTAqDXIXIr-5BZ8nR7fpQAAAJE"]
[Tue May 26 05:35:38.047193 2026] [:error] [pid 20025:tid 20065] [client 20.195.199.65:17182] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/als.php"] [unique_id "ahTAqn7k8Vts-JPOkgWfcQAAAEA"]
[Tue May 26 05:35:39.771823 2026] [:error] [pid 20125:tid 20147] [client 20.195.199.65:23309] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/als.php"] [unique_id "ahTAq9k9jeWERFDLJc56nAAAANQ"]
[Tue May 26 05:35:40.792247 2026] [:error] [pid 20125:tid 20137] [client 20.195.199.65:28038] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/als.php"] [unique_id "ahTArNk9jeWERFDLJc56nwAAAMo"]
[Tue May 26 05:35:41.903740 2026] [:error] [pid 20026:tid 20093] [client 20.195.199.65:33184] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pol.php"] [unique_id "ahTArTXIXIr-5BZ8nR7frQAAAIE"]
[Tue May 26 05:35:43.074687 2026] [:error] [pid 20026:tid 20105] [client 20.195.199.65:33167] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pol.php"] [unique_id "ahTArzXIXIr-5BZ8nR7frwAAAI0"]
[Tue May 26 05:35:44.281972 2026] [:error] [pid 20125:tid 20127] [client 20.195.199.65:23336] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pol.php"] [unique_id "ahTAsNk9jeWERFDLJc56oQAAAMA"]
[Tue May 26 05:35:45.132353 2026] [:error] [pid 20026:tid 20103] [client 20.195.199.65:28059] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/pol.php"] [unique_id "ahTAsTXIXIr-5BZ8nR7fsgAAAIs"]
[Tue May 26 05:35:46.419426 2026] [:error] [pid 55988:tid 55998] [client 20.195.199.65:15319] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "ahTAsv3kVIz2sql52sdSdwAAAQc"]
[Tue May 26 05:35:47.267683 2026] [:error] [pid 20026:tid 20115] [client 20.195.199.65:33171] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "ahTAszXIXIr-5BZ8nR7ftQAAAJc"]
[Tue May 26 05:35:48.306962 2026] [:error] [pid 20026:tid 20106] [client 20.195.199.65:4010] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "ahTAtDXIXIr-5BZ8nR7ftwAAAI4"]
[Tue May 26 05:35:49.132461 2026] [:error] [pid 20025:tid 20067] [client 20.195.199.65:28053] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ll.php"] [unique_id "ahTAtX7k8Vts-JPOkgWfdwAAAEI"]
[Tue May 26 05:35:52.447342 2026] [:error] [pid 20125:tid 20133] [client 20.195.199.65:41757] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ahTAuNk9jeWERFDLJc56rgAAAMY"]
[Tue May 26 05:35:53.703498 2026] [:error] [pid 55988:tid 55998] [client 20.195.199.65:51574] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ahTAuf3kVIz2sql52sdSgQAAAQc"]
[Tue May 26 05:35:55.219322 2026] [:error] [pid 20125:tid 20127] [client 20.195.199.65:33152] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ahTAu9k9jeWERFDLJc56sQAAAMA"]
[Tue May 26 05:35:57.347832 2026] [:error] [pid 20026:tid 20100] [client 20.195.199.65:3975] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/sf.php"] [unique_id "ahTAvTXIXIr-5BZ8nR7fwAAAAIg"]
[Tue May 26 05:35:58.723062 2026] [:error] [pid 20125:tid 20142] [client 20.195.199.65:15329] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "ahTAvtk9jeWERFDLJc56ugAAAM8"]
[Tue May 26 05:36:00.367483 2026] [:error] [pid 20026:tid 20101] [client 20.195.199.65:4035] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "ahTAwDXIXIr-5BZ8nR7fwQAAAIk"]
[Tue May 26 05:36:01.734157 2026] [:error] [pid 20026:tid 20111] [client 20.195.199.65:19113] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "ahTAwTXIXIr-5BZ8nR7fxQAAAJM"]
[Tue May 26 05:36:04.173389 2026] [:error] [pid 20125:tid 20132] [client 20.195.199.65:19470] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file5.php"] [unique_id "ahTAxNk9jeWERFDLJc56wQAAAMU"]
[Tue May 26 05:36:06.514293 2026] [:error] [pid 20025:tid 20069] [client 20.195.199.65:31481] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "ahTAxn7k8Vts-JPOkgWfggAAAEQ"]
[Tue May 26 05:36:08.308884 2026] [:error] [pid 20025:tid 20065] [client 20.195.199.65:28299] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "ahTAyH7k8Vts-JPOkgWfhQAAAEA"]
[Tue May 26 05:36:11.264246 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:46875] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "ahTAy_3kVIz2sql52sdSkAAAARg"]
[Tue May 26 05:36:12.847675 2026] [:error] [pid 55988:tid 56005] [client 20.195.199.65:33563] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/fs.php"] [unique_id "ahTAzP3kVIz2sql52sdSlQAAAQ4"]
[Tue May 26 05:36:16.207339 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:33209] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ahTA0P3kVIz2sql52sdSnQAAARg"]
[Tue May 26 05:36:18.235012 2026] [:error] [pid 55988:tid 56001] [client 20.195.199.65:28037] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ahTA0v3kVIz2sql52sdSpAAAAQo"]
[Tue May 26 05:36:20.341060 2026] [:error] [pid 55988:tid 56007] [client 20.195.199.65:4049] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ahTA1P3kVIz2sql52sdSrAAAARA"]
[Tue May 26 05:36:22.388194 2026] [:error] [pid 55988:tid 56014] [client 20.195.199.65:17159] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/4PJcpMFsD8B.php"] [unique_id "ahTA1v3kVIz2sql52sdStQAAARc"]
[Tue May 26 05:36:23.823848 2026] [:error] [pid 55988:tid 55992] [client 20.195.199.65:33154] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "ahTA1_3kVIz2sql52sdSvgAAAQE"]
[Tue May 26 05:36:25.692599 2026] [:error] [pid 20125:tid 20127] [client 20.195.199.65:17215] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "ahTA2dk9jeWERFDLJc564AAAAMA"]
[Tue May 26 05:36:27.468220 2026] [:error] [pid 55988:tid 56015] [client 20.195.199.65:37683] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "ahTA2_3kVIz2sql52sdSywAAARg"]
[Tue May 26 05:36:29.293489 2026] [:error] [pid 55988:tid 55994] [client 20.195.199.65:43904] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file.php"] [unique_id "ahTA3f3kVIz2sql52sdS1gAAAQM"]
[Tue May 26 05:36:30.722902 2026] [:error] [pid 20024:tid 20060] [client 20.195.199.65:30381] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "ahTA3ldk7QtxEB93NpcGeQAAABY"]
[Tue May 26 05:36:32.174092 2026] [:error] [pid 20024:tid 20061] [client 20.195.199.65:14905] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "ahTA4Fdk7QtxEB93NpcGfQAAABc"]
[Tue May 26 05:36:33.727171 2026] [:error] [pid 20125:tid 20139] [client 20.195.199.65:33898] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "ahTA4dk9jeWERFDLJc567wAAAMw"]
[Tue May 26 05:36:35.003132 2026] [:error] [pid 20125:tid 20128] [client 20.195.199.65:13183] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/cfile.php"] [unique_id "ahTA49k9jeWERFDLJc568wAAAME"]
[Tue May 26 05:36:35.855383 2026] [:error] [pid 55988:tid 55994] [client 20.195.199.65:9278] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/class-wp.php"] [unique_id "ahTA4_3kVIz2sql52sdS5QAAAQM"]
[Tue May 26 05:36:36.868373 2026] [:error] [pid 20024:tid 20055] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/class-wp.php
[Tue May 26 05:36:37.181135 2026] [:error] [pid 20024:tid 20042] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/ahax.php
[Tue May 26 05:36:37.696402 2026] [:error] [pid 20024:tid 20051] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/aa2.php
[Tue May 26 05:36:38.245900 2026] [:error] [pid 20024:tid 20041] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/ccou.php
[Tue May 26 05:36:38.569125 2026] [:error] [pid 20024:tid 20039] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/login8.php
[Tue May 26 05:36:38.883503 2026] [:error] [pid 20024:tid 20038] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/nx.php
[Tue May 26 05:36:39.195858 2026] [:error] [pid 20024:tid 20044] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/dr.php
[Tue May 26 05:36:39.508756 2026] [:error] [pid 20024:tid 20062] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/xamp.php
[Tue May 26 05:36:39.820642 2026] [:error] [pid 20024:tid 20054] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/cA3bHIkVhgP.php
[Tue May 26 05:36:40.133613 2026] [:error] [pid 20024:tid 20055] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/clas11.php
[Tue May 26 05:36:40.445291 2026] [:error] [pid 20024:tid 20042] [client 20.195.199.65:9163] File does not exist: /usr/local/apache/htdocs/suspended-page/cxl.php
[Tue May 26 05:36:40.753585 2026] [:error] [pid 20024:tid 20058] [client 20.195.199.65:9163] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "ahTA6Fdk7QtxEB93NpcGkgAAABQ"]
[Tue May 26 05:36:41.897334 2026] [:error] [pid 20025:tid 20075] [client 20.195.199.65:14189] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "ahTA6X7k8Vts-JPOkgWflQAAAEo"]
[Tue May 26 05:36:43.270508 2026] [:error] [pid 20125:tid 20130] [client 20.195.199.65:21658] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "ahTA69k9jeWERFDLJc57AQAAAMM"]
[Tue May 26 05:36:44.305398 2026] [:error] [pid 20026:tid 20110] [client 20.195.199.65:13224] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/bb.php"] [unique_id "ahTA7DXIXIr-5BZ8nR7f4QAAAJI"]
[Tue May 26 05:36:45.950737 2026] [:error] [pid 20025:tid 20074] [client 20.195.199.65:22425] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtox.php"] [unique_id "ahTA7X7k8Vts-JPOkgWfmgAAAEk"]
[Tue May 26 05:36:48.189931 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:29644] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtox.php"] [unique_id "ahTA8DXIXIr-5BZ8nR7f6AAAAIU"]
[Tue May 26 05:36:49.717439 2026] [:error] [pid 20024:tid 20039] [client 20.195.199.65:37579] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtox.php"] [unique_id "ahTA8Vdk7QtxEB93NpcGlQAAAAE"]
[Tue May 26 05:36:51.030264 2026] [:error] [pid 55988:tid 55999] [client 20.195.199.65:29581] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/dtox.php"] [unique_id "ahTA8_3kVIz2sql52sdS8wAAAQg"]
[Tue May 26 05:36:51.932942 2026] [:error] [pid 20026:tid 20092] [client 20.195.199.65:45856] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ahTA8zXIXIr-5BZ8nR7f7QAAAIA"]
[Tue May 26 05:36:52.982435 2026] [:error] [pid 55988:tid 55991] [client 20.195.199.65:13690] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ahTA9P3kVIz2sql52sdS9wAAAQA"]
[Tue May 26 05:36:54.816892 2026] [:error] [pid 55988:tid 56011] [client 20.195.199.65:37597] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ahTA9v3kVIz2sql52sdS_QAAARQ"]
[Tue May 26 05:36:56.665345 2026] [:error] [pid 55988:tid 55995] [client 20.195.199.65:8540] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/eee.php"] [unique_id "ahTA-P3kVIz2sql52sdTBAAAAQQ"]
[Tue May 26 05:36:58.915137 2026] [:error] [pid 20025:tid 20089] [client 20.195.199.65:15977] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5BltUjE9CrY.php"] [unique_id "ahTA-n7k8Vts-JPOkgWfpQAAAFg"]
[Tue May 26 05:37:00.225954 2026] [:error] [pid 55988:tid 56005] [client 20.195.199.65:17224] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5BltUjE9CrY.php"] [unique_id "ahTA_P3kVIz2sql52sdTEQAAAQ4"]
[Tue May 26 05:37:01.465166 2026] [:error] [pid 20025:tid 20065] [client 20.195.199.65:40993] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5BltUjE9CrY.php"] [unique_id "ahTA_X7k8Vts-JPOkgWfpgAAAEA"]
[Tue May 26 05:37:03.110860 2026] [:error] [pid 55988:tid 56013] [client 20.195.199.65:6999] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/5BltUjE9CrY.php"] [unique_id "ahTA__3kVIz2sql52sdTFwAAARY"]
[Tue May 26 05:37:04.235772 2026] [:error] [pid 20025:tid 20079] [client 20.195.199.65:25570] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/come.php"] [unique_id "ahTBAH7k8Vts-JPOkgWfrAAAAE4"]
[Tue May 26 05:37:05.779033 2026] [:error] [pid 20026:tid 20100] [client 20.195.199.65:14599] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/come.php"] [unique_id "ahTBATXIXIr-5BZ8nR7f_AAAAIg"]
[Tue May 26 05:37:07.367429 2026] [:error] [pid 20026:tid 20112] [client 20.195.199.65:6165] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/come.php"] [unique_id "ahTBAzXIXIr-5BZ8nR7gBAAAAJQ"]
[Tue May 26 05:37:08.571184 2026] [:error] [pid 20026:tid 20106] [client 20.195.199.65:6206] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/come.php"] [unique_id "ahTBBDXIXIr-5BZ8nR7gCwAAAI4"]
[Tue May 26 05:37:09.594807 2026] [:error] [pid 20125:tid 20130] [client 20.195.199.65:44638] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hg.php"] [unique_id "ahTBBdk9jeWERFDLJc57HQAAAMM"]
[Tue May 26 05:37:10.791479 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:44665] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hg.php"] [unique_id "ahTBBjXIXIr-5BZ8nR7gFQAAAII"]
[Tue May 26 05:37:12.029593 2026] [:error] [pid 55988:tid 55999] [client 20.195.199.65:23729] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hg.php"] [unique_id "ahTBCP3kVIz2sql52sdTIQAAAQg"]
[Tue May 26 05:37:12.963057 2026] [:error] [pid 20125:tid 20132] [client 20.195.199.65:22118] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/hg.php"] [unique_id "ahTBCNk9jeWERFDLJc57JAAAAMU"]
[Tue May 26 05:37:14.193020 2026] [:error] [pid 20125:tid 20146] [client 20.195.199.65:60349] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahTBCtk9jeWERFDLJc57JgAAANM"]
[Tue May 26 05:37:16.617097 2026] [:error] [pid 55988:tid 55995] [client 20.195.199.65:60340] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahTBDP3kVIz2sql52sdTJQAAAQQ"]
[Tue May 26 05:37:18.357371 2026] [:error] [pid 55988:tid 55996] [client 20.195.199.65:19574] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahTBDv3kVIz2sql52sdTKQAAAQU"]
[Tue May 26 05:37:19.337129 2026] [:error] [pid 55988:tid 56005] [client 20.195.199.65:34276] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/aaa.php"] [unique_id "ahTBD_3kVIz2sql52sdTLAAAAQ4"]
[Tue May 26 05:37:21.315513 2026] [:error] [pid 55988:tid 56006] [client 20.195.199.65:6175] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/at.php"] [unique_id "ahTBEf3kVIz2sql52sdTMgAAAQ8"]
[Tue May 26 05:37:22.651383 2026] [:error] [pid 20125:tid 20143] [client 20.195.199.65:60348] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/at.php"] [unique_id "ahTBEtk9jeWERFDLJc57NQAAANA"]
[Tue May 26 05:37:25.028116 2026] [:error] [pid 55988:tid 56001] [client 20.195.199.65:34295] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/at.php"] [unique_id "ahTBFf3kVIz2sql52sdTRQAAAQo"]
[Tue May 26 05:37:26.650411 2026] [:error] [pid 55988:tid 55994] [client 20.195.199.65:18693] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/at.php"] [unique_id "ahTBFv3kVIz2sql52sdTSgAAAQM"]
[Tue May 26 05:37:28.191812 2026] [:error] [pid 55988:tid 55994] [client 20.195.199.65:18714] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "ahTBGP3kVIz2sql52sdTUAAAAQM"]
[Tue May 26 05:37:29.864003 2026] [:error] [pid 55988:tid 55996] [client 20.195.199.65:46505] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "ahTBGf3kVIz2sql52sdTVwAAAQU"]
[Tue May 26 05:37:31.007098 2026] [:error] [pid 55988:tid 56013] [client 20.195.199.65:13676] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "ahTBG_3kVIz2sql52sdTXQAAARY"]
[Tue May 26 05:37:32.456528 2026] [:error] [pid 20025:tid 20078] [client 20.195.199.65:50087] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/ff.php"] [unique_id "ahTBHH7k8Vts-JPOkgWfuQAAAE0"]
[Tue May 26 05:37:34.377740 2026] [:error] [pid 20025:tid 20071] [client 20.195.199.65:23800] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "ahTBHn7k8Vts-JPOkgWfvQAAAEY"]
[Tue May 26 05:37:35.975617 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:31083] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "ahTBHzXIXIr-5BZ8nR7gKAAAAIU"]
[Tue May 26 05:37:37.284951 2026] [:error] [pid 20025:tid 20080] [client 20.195.199.65:23762] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "ahTBIX7k8Vts-JPOkgWfvwAAAE8"]
[Tue May 26 05:37:38.792521 2026] [:error] [pid 20125:tid 20140] [client 20.195.199.65:23768] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/file31.php"] [unique_id "ahTBItk9jeWERFDLJc57TAAAAM0"]
[Tue May 26 05:37:39.983549 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:28805] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/Crypto.php"] [unique_id "ahTBIzXIXIr-5BZ8nR7gKwAAAII"]
[Tue May 26 05:37:41.013417 2026] [:error] [pid 20026:tid 20111] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/Crypto.php
[Tue May 26 05:37:41.325972 2026] [:error] [pid 20026:tid 20108] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/firewall.php
[Tue May 26 05:37:41.659828 2026] [:error] [pid 20026:tid 20109] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/pi.php
[Tue May 26 05:37:41.970928 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/testphp.php
[Tue May 26 05:37:42.284276 2026] [:error] [pid 20026:tid 20116] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/build.php
[Tue May 26 05:37:42.595800 2026] [:error] [pid 20026:tid 20104] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/file6.php
[Tue May 26 05:37:42.926054 2026] [:error] [pid 20026:tid 20110] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/cabs.php
[Tue May 26 05:37:43.252638 2026] [:error] [pid 20026:tid 20113] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/file15.php
[Tue May 26 05:37:43.597086 2026] [:error] [pid 20026:tid 20114] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/lock360.php
[Tue May 26 05:37:43.917790 2026] [:error] [pid 20026:tid 20096] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/security.php
[Tue May 26 05:37:44.231780 2026] [:error] [pid 20026:tid 20112] [client 20.195.199.65:63931] File does not exist: /usr/local/apache/htdocs/suspended-page/title.php
[Tue May 26 05:37:44.555503 2026] [:error] [pid 20026:tid 20094] [client 20.195.199.65:63931] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/N1.php"] [unique_id "ahTBKDXIXIr-5BZ8nR7gOAAAAII"]
[Tue May 26 05:37:46.422159 2026] [:error] [pid 20125:tid 20143] [client 20.195.199.65:4697] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/N1.php"] [unique_id "ahTBKtk9jeWERFDLJc57fgAAANA"]
[Tue May 26 05:37:48.638568 2026] [:error] [pid 20025:tid 20076] [client 20.195.199.65:64522] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/N1.php"] [unique_id "ahTBLH7k8Vts-JPOkgWf4gAAAEs"]
[Tue May 26 05:37:50.470399 2026] [:error] [pid 20025:tid 20079] [client 20.195.199.65:3609] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/N1.php"] [unique_id "ahTBLn7k8Vts-JPOkgWf4wAAAE4"]
[Tue May 26 05:37:54.703646 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:4724] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "ahTBMjXIXIr-5BZ8nR7gPgAAAIU"]
[Tue May 26 05:37:55.538457 2026] [:error] [pid 20024:tid 20058] [client 20.195.199.65:40946] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "ahTBM1dk7QtxEB93NpcG-wAAABQ"]
[Tue May 26 05:37:56.436335 2026] [:error] [pid 55988:tid 55996] [client 20.195.199.65:64546] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "ahTBNP3kVIz2sql52sdT1QAAAQU"]
[Tue May 26 05:37:57.609734 2026] [:error] [pid 20025:tid 20070] [client 20.195.199.65:3593] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.well-known/nastar.php"] [unique_id "ahTBNX7k8Vts-JPOkgWf6wAAAEU"]
[Tue May 26 05:37:58.996750 2026] [:error] [pid 20024:tid 20048] [client 20.195.199.65:23377] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ahTBNldk7QtxEB93NpcG_AAAAAo"]
[Tue May 26 05:38:00.563900 2026] [:error] [pid 20125:tid 20137] [client 20.195.199.65:14257] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ahTBONk9jeWERFDLJc57iQAAAMo"]
[Tue May 26 05:38:01.969458 2026] [:error] [pid 20026:tid 20103] [client 20.195.199.65:18424] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ahTBOTXIXIr-5BZ8nR7gSAAAAIs"]
[Tue May 26 05:38:02.915737 2026] [:error] [pid 55988:tid 56009] [client 20.195.199.65:17604] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/no1.php"] [unique_id "ahTBOv3kVIz2sql52sdT2gAAARI"]
[Tue May 26 05:38:04.489058 2026] [:error] [pid 55988:tid 56006] [client 20.195.199.65:11643] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "ahTBPP3kVIz2sql52sdT3wAAAQ8"]
[Tue May 26 05:38:05.747340 2026] [:error] [pid 20024:tid 20040] [client 20.195.199.65:35432] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "ahTBPVdk7QtxEB93NpcHAQAAAAI"]
[Tue May 26 05:38:07.468909 2026] [:error] [pid 20025:tid 20083] [client 20.195.199.65:18383] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "ahTBP37k8Vts-JPOkgWf-AAAAFI"]
[Tue May 26 05:38:08.400764 2026] [:error] [pid 20125:tid 20138] [client 20.195.199.65:3827] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/.sghb.php"] [unique_id "ahTBQNk9jeWERFDLJc57jQAAAMs"]
[Tue May 26 05:38:09.563701 2026] [:error] [pid 20024:tid 20049] [client 20.195.199.65:5838] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ahTBQVdk7QtxEB93NpcHCAAAAAs"]
[Tue May 26 05:38:10.692500 2026] [:error] [pid 20125:tid 20148] [client 20.195.199.65:40930] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ahTBQtk9jeWERFDLJc57kAAAANU"]
[Tue May 26 05:38:12.078574 2026] [:error] [pid 20125:tid 20130] [client 20.195.199.65:19166] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ahTBRNk9jeWERFDLJc57kgAAAMM"]
[Tue May 26 05:38:13.376520 2026] [:error] [pid 20026:tid 20108] [client 20.195.199.65:17598] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/jp.php"] [unique_id "ahTBRTXIXIr-5BZ8nR7gUgAAAJA"]
[Tue May 26 05:38:15.043950 2026] [:error] [pid 20024:tid 20052] [client 20.195.199.65:30300] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahTBR1dk7QtxEB93NpcHDAAAAA4"]
[Tue May 26 05:38:17.336529 2026] [:error] [pid 20125:tid 20132] [client 20.195.199.65:4437] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahTBSdk9jeWERFDLJc57mgAAAMU"]
[Tue May 26 05:38:18.981736 2026] [:error] [pid 55988:tid 56004] [client 20.195.199.65:15905] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahTBSv3kVIz2sql52sdT4gAAAQ0"]
[Tue May 26 05:38:20.715651 2026] [:error] [pid 20024:tid 20055] [client 20.195.199.65:12835] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/f35.php"] [unique_id "ahTBTFdk7QtxEB93NpcHGAAAABE"]
[Tue May 26 05:38:22.645710 2026] [:error] [pid 55988:tid 56001] [client 20.195.199.65:43336] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ahTBTv3kVIz2sql52sdT7gAAAQo"]
[Tue May 26 05:38:23.642569 2026] [:error] [pid 55988:tid 55997] [client 20.195.199.65:3205] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ahTBT_3kVIz2sql52sdT9AAAAQY"]
[Tue May 26 05:38:24.655832 2026] [:error] [pid 20125:tid 20138] [client 20.195.199.65:13652] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ahTBUNk9jeWERFDLJc57nwAAAMs"]
[Tue May 26 05:38:26.291142 2026] [:error] [pid 20025:tid 20068] [client 20.195.199.65:5867] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xa.php"] [unique_id "ahTBUn7k8Vts-JPOkgWgDQAAAEM"]
[Tue May 26 05:38:27.135516 2026] [:error] [pid 55988:tid 55992] [client 20.195.199.65:3662] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahTBU_3kVIz2sql52sdT-QAAAQE"]
[Tue May 26 05:38:28.132627 2026] [:error] [pid 20024:tid 20042] [client 20.195.199.65:5825] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahTBVFdk7QtxEB93NpcHIwAAAAQ"]
[Tue May 26 05:38:29.866118 2026] [:error] [pid 20025:tid 20071] [client 20.195.199.65:43351] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahTBVX7k8Vts-JPOkgWgEwAAAEY"]
[Tue May 26 05:38:31.068432 2026] [:error] [pid 55988:tid 56004] [client 20.195.199.65:14255] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-load.php"] [unique_id "ahTBV_3kVIz2sql52sdT_wAAAQ0"]
[Tue May 26 05:38:32.175047 2026] [:error] [pid 55988:tid 56009] [client 20.195.199.65:26704] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "ahTBWP3kVIz2sql52sdUAQAAARI"]
[Tue May 26 05:38:33.485653 2026] [:error] [pid 55988:tid 56010] [client 20.195.199.65:12825] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "ahTBWf3kVIz2sql52sdUCQAAARM"]
[Tue May 26 05:38:35.114463 2026] [:error] [pid 55988:tid 56002] [client 20.195.199.65:3238] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "ahTBW_3kVIz2sql52sdUDgAAAQs"]
[Tue May 26 05:38:36.724397 2026] [:error] [pid 20025:tid 20065] [client 20.195.199.65:3658] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/xwpg.php"] [unique_id "ahTBXH7k8Vts-JPOkgWgGwAAAEA"]
[Tue May 26 05:38:39.379337 2026] [:error] [pid 20024:tid 20047] [client 20.195.199.65:40930] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "ahTBX1dk7QtxEB93NpcHJwAAAAk"]
[Tue May 26 05:38:41.697955 2026] [:error] [pid 20025:tid 20072] [client 20.195.199.65:13658] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "ahTBYX7k8Vts-JPOkgWgHwAAAEc"]
[Tue May 26 05:38:43.395921 2026] [:error] [pid 20026:tid 20110] [client 20.195.199.65:12856] [client 20.195.199.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/a5.php"] [unique_id "ahTBYzXIXIr-5BZ8nR7geQAAAJI"]
[Tue May 26 05:38:44.412528 2026] [:error] [pid 20026:tid 20100] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/a5.php
[Tue May 26 05:38:45.697669 2026] [:error] [pid 20026:tid 20101] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/dropdown.php
[Tue May 26 05:38:46.032446 2026] [:error] [pid 20026:tid 20107] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/ddd.php
[Tue May 26 05:38:46.680863 2026] [:error] [pid 20026:tid 20112] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/jj.php
[Tue May 26 05:38:46.994784 2026] [:error] [pid 20026:tid 20108] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/ccc.php
[Tue May 26 05:38:47.306568 2026] [:error] [pid 20026:tid 20113] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/wp-link-snpm.php
[Tue May 26 05:38:47.622383 2026] [:error] [pid 20026:tid 20110] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/4.php
[Tue May 26 05:38:47.947500 2026] [:error] [pid 20026:tid 20097] [client 20.195.199.65:50086] File does not exist: /usr/local/apache/htdocs/suspended-page/xstelth.php
[Tue May 26 06:34:56.897530 2026] [:error] [pid 55988:tid 55996] [client 40.113.217.8:2733] File does not exist: /usr/local/apache/htdocs/suspended-page/inputs.php
[Tue May 26 06:34:57.128089 2026] [:error] [pid 55988:tid 56008] [client 40.113.217.8:2733] File does not exist: /usr/local/apache/htdocs/suspended-page/ioxi-o.php
[Tue May 26 06:34:57.553519 2026] [:error] [pid 55988:tid 55994] [client 40.113.217.8:2733] File does not exist: /usr/local/apache/htdocs/suspended-page/rip.php
[Tue May 26 06:34:57.745583 2026] [:error] [pid 55988:tid 56011] [client 40.113.217.8:2733] File does not exist: /usr/local/apache/htdocs/suspended-page/admin.php
[Tue May 26 06:34:58.129835 2026] [:error] [pid 55988:tid 55991] [client 40.113.217.8:2733] File does not exist: /usr/local/apache/htdocs/suspended-page/cache.php
[Tue May 26 06:34:58.321402 2026] [:error] [pid 55988:tid 56000] [client 40.113.217.8:2733] File does not exist: /usr/local/apache/htdocs/suspended-page/themes.php
[Tue May 26 06:34:58.515539 2026] [:error] [pid 55988:tid 56014] [client 40.113.217.8:2733] File does not exist: /usr/local/apache/htdocs/suspended-page/an.php
[Tue May 26 06:34:58.898077 2026] [:error] [pid 55988:tid 56007] [client 40.113.217.8:2733] [client 40.113.217.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahTOkv3kVIz2sql52sdp_QAAARA"]
[Tue May 26 06:35:00.452846 2026] [:error] [pid 20024:tid 20061] [client 40.113.217.8:5454] [client 40.113.217.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahTOlFdk7QtxEB93NpcR6gAAABc"]
[Tue May 26 06:35:01.745862 2026] [:error] [pid 20026:tid 20106] [client 40.113.217.8:8514] [client 40.113.217.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahTOlTXIXIr-5BZ8nR7uWAAAAI4"]
[Tue May 26 06:35:04.011722 2026] [:error] [pid 55988:tid 56014] [client 40.113.217.8:6456] [client 40.113.217.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/randkeyword.PhP7"] [unique_id "ahTOmP3kVIz2sql52sdqAwAAARc"]
[Tue May 26 07:02:25.420588 2026] [:error] [pid 20026:tid 20105] [client 49.51.33.159:40696] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahTVATXIXIr-5BZ8nR72ngAAAI0"]
[Tue May 26 09:33:33.280002 2026] [:error] [pid 55988:tid 56006] [client 146.56.197.150:55858] [client 146.56.197.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahT4bf3kVIz2sql52sexrgAAAQ8"]
[Tue May 26 09:46:36.633190 2026] [:error] [pid 20125:tid 20148] [client 43.135.142.7:52578] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahT7fNk9jeWERFDLJc7EgwAAANU"]
[Tue May 26 14:22:14.381669 2026] [:error] [pid 55988:tid 55991] [client 43.159.138.217:54244] [client 43.159.138.217] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahU8Fv3kVIz2sql52scVPgAAAQA"]
[Tue May 26 15:30:06.720330 2026] [:error] [pid 20025:tid 20069] [client 106.52.216.13:57144] [client 106.52.216.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahVL_n7k8Vts-JPOkgWzDAAAAEQ"]
[Tue May 26 17:05:07.239462 2026] [:error] [pid 55988:tid 55996] [client 34.11.17.55:59147] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViQ_3kVIz2sql52sdhdAAAAQU"]
[Tue May 26 17:05:07.670297 2026] [:error] [pid 20024:tid 20042] [client 34.11.17.55:56155] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "rejuva.au"] [uri "/feed/"] [unique_id "ahViQ1dk7QtxEB93NpeBnQAAAAQ"]
[Tue May 26 17:58:13.918193 2026] [:error] [pid 33888:tid 33959] [client 43.166.237.57:50384] [client 43.166.237.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahVutTqzTeoxiinZsGHF7gAAAQ0"]
[Tue May 26 19:44:35.096562 2026] [:error] [pid 33977:tid 33980] [client 43.134.236.33:40694] [client 43.134.236.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahWHo-9cnSDNAU9sYPi9dQAAAAA"]
[Tue May 26 21:32:42.314495 2026] [:error] [pid 43701:tid 43723] [client 162.14.66.219:60698] [client 162.14.66.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rejuva.au"] [uri "/"] [unique_id "ahWg-oWtVI_UGrhtwKDg8gAAAVQ"]
[Tue May 26 21:53:37.364557 2026] [:error] [pid 36497:tid 36515] [client 43.153.10.13:55866] [client 43.153.10.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.rejuva.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.rejuva.au"] [uri "/"] [unique_id "ahWl4bjKQWM1gBmBY4gnuwAAAMU"]